Integrate semantic review core source API and scalar desktop workflow

harness/DECISIONS.md

@@ -14,6 +14,21 @@
 - **Evidence governs completion.** Original Capella was operated in an isolated example and its useful nesting/navigation/transition patterns informed the UI. Independent reviews, real native workflows and automated invariants complement each other. Platform and feature boundaries remain explicit in validation/scope documents.
 # First-release decisions (supersede narrower V2 exclusions below)
 
+- R3 production adopts closed typed per-facet reviews (C), selected after the
+  11-case proof in b2ab2b1 and independent adversarial review. Each self-tagged
+  fact stores independently reviewed OA/SA typed values; absent facts remain
+  Unreviewed, and NotApplicable distinguishes an absent constructor branch from
+  an absent optional value. This supersedes recursive SemanticValue/string paths
+  and typed-body carrier/mask/order-shadow baselines. Extra finite adapter code
+  is accepted for fewer persisted-state invariants, not as a generic metamodel.
+  Atomic keyed rows, target-only preserving member deltas, independent order,
+  exact constructor groups, explicit mapping resets/canonical target agreement
+  and actual prepared-impact review remain required. Keep the existing Command
+  and transition planner boundaries. Artifact reviews attach to semantic traces.
+  Schema/source5 is explicit, with unchanged data4 compatibility. The authoritative
+  implementation/ownership/evidence contract is release-semantic-review-implementation.md;
+  production implementation and release acceptance are still pending.
+
 - OA/SA semantic scope follows `release-semantics-audit.md` R1–R6 and actual Capella workflow evidence. Later Arcadia layers remain future work; missing OA/SA reuse, topology, state/data contracts and semantic transition review do not become release limitations.
 - Preserve one typed Rust core and atomic validated model commands. Mission/capability links and process topology are independent of containment and diagram placement. Work/chain reuse uses stable reference occurrences rather than copied semantic objects; sequence guards belong to contextual links rather than global exchanges.
 - Desktop lint uses one background parser plus the latest queued source version. Accepted model checks are cached separately from draft diagnostics. Stale results cannot enter a different document or overwrite newer edits. The REST service prepares bounded candidates outside its global store lock and rechecks ETags during commit.
@@ -69,3 +84,35 @@ the leak and native Windows/Linux tests verified the correction in316dc55.
   paths were proven ambiguous in native recursive/reused data. Browsing does not
   change the selected field or expression; choosing a field remains an explicit
   draft edit through the ordinary validated command. No persistent browser schema.
+## Semantic review proposals and historical admission (2026-09-06)
+
+R3 stores closed, typed, independently reviewed OA/SA facet pairs. Constructor
+facts store discriminators only; explicit group decisions enumerate and retire
+their exact branch facts. No persisted recursive value tree, own-record carrier,
+review mask or order shadow is introduced. The complete contract is
+release-semantic-review-implementation.md.
+
+Derive every source proposal from the same immutable initial project. Reset old
+mapping selectors before deriving scopes; compare all desired canonical target
+slots, including constructor removals, before one materialization. Audit selected
+values against both that result and the ordinarily prepared project. This prevents
+sequential last-write wins, even when one source introduces a member another
+constructor removes. Preserve target-only members during same-target-constructor
+reconciliation. Artifact attachment and explicit owner changes share the actual
+artifact's owner slot; child/incident operations similarly share actual parent or
+endpoint slots. Exact prepared cleanup impacts require explicit acknowledgement
+and may not contradict a selected Keep/Take.
+
+Artifact metadata is observed by identified record after authorization against
+its initial attachment. An owner move therefore retains the actual resulting
+Owner/Name facts, including target-only links; Presence remains owner-relative.
+New metadata decisions require the current attached owner trace. Historical paired
+selectors survive disappearance of one side and suppress redundant one-sided
+projections. A new pairing cannot suppress prior one-sided history without reset.
+
+Current resolution applicability and historical baseline admission are separate.
+New decisions require a compatible current family and an applicable side; historical
+typed facts can outlive former constructors/families and deleted references. Their
+typed reference visitor supports explicit reidentification but does not add live
+deletion dependencies. Derived linked-definition drift remains bounded and exposes
+missing review coverage instead of copying a shared definition into every baseline.