Implement closed typed semantic review with immutable proposals

harness/release-semantic-review-implementation.md

@@ -21,6 +21,13 @@ explicit mapping, target-only preservation, honest unreviewed state, source/JSON
 parity, and one stale-checked validated transaction. No generic metamodel, graph
 synchronization service, runtime value tree, or second mutation engine is added.
 
+Compiled core catalog: `semantic/types.rs` contains 84 scalar selectors across 13
+families, nine reference collections, two ordered collections, and the closed
+Literal/Annotation/Binding/Child/Incident/Artifact facts. The catalog coverage test
+enumerates every current element payload, constructor branch and relation kind;
+an unrepresented payload field fails that gate. Serialization paths used by the
+private adapter are fixed implementation details, never accepted user selectors.
+
 ## Persisted shape and granularity
 
 `TraceBaseline` retains existing `oa`/`sa: TracedProperties` and adds
@@ -61,6 +68,15 @@ introduced/removed group atomically, retiring obsolete branch facts. Unchanged
 kind cannot acknowledge unrelated bound/default drift by a Keep shortcut. An
 explicit actual target switch may reconsider an earlier deliberate Keep.
 
+Persist only `DataConstructor`, `PortConstructor`, `OccurrenceConstructor`,
+`EventConstructor` and `MessageConstructor` discriminator enums (State uses the
+existing StateKind). A grouped decision uses a transient typed record, retires
+obsolete branch facts and stores each resulting descendant independently. A
+constructor payload snapshot must never overlap later independently reviewed
+leaves. Repeating Keep on an already acknowledged unequal discriminator pair
+cannot acknowledge newly changed bounds/defaults. Constructor retirement writes
+explicit NotApplicable target slots for agreement checking against other reviews.
+
 Artifact reviews are attached facts of the owning semantic trace; they do not
 widen ordinary Trace endpoint compatibility. Cover artifact membership and
 name/description/owner/relation/URI/revision/fragment, preserving target-only links.
@@ -104,6 +120,36 @@ Command preparation. Keep the prose request/API compatible; add sibling typed
 semantic request/preview/apply helpers. Whole existing typed records may appear
 as transient candidates or impact snapshots, never as persisted baseline carriers.
 
+The implemented sibling boundary is `SemanticTransitionRequest { transition,
+traces, references, reviews, candidates, accepted_impacts }`.
+`traces` selects a particular trace by source UUID when one endpoint pair has
+several traces; `references` is canonical OA→SA correspondence, including old
+deleted IDs. `SemanticReviewRequest { source, resolutions, reset }` and
+`FacetResolution { facet, decision }` use KeepTarget/TakeSource/Candidate.
+Candidates are full existing typed Element/Relation/Artifact records with identity
+and aliases protected; they must equal the result of selected facets exactly.
+`plan_semantic_transition`, `prepare_semantic_transition` and
+`apply_semantic_transition` reuse the existing mapping planner and Command batch.
+Previews expose typed current/drift facts, acknowledged and retired selectors,
+exact typed prepared impacts, conflicts, and a stale-check fingerprint.
+
+Artifact metadata slots are keyed by the actual artifact UUID, independent of
+which owning trace reaches them. Presence and owner share the ownership slot;
+metadata selection requires the currently attached owner. An explicit Owner
+candidate can move that link to another valid owner; its canonical owner slot
+must agree with any selected attachment decision. Creating a link
+requires a complete candidate and explicit review of every introduced metadata
+field. Removing a link retires its metadata and checks those removed slots against
+other decisions. Historical artifact keys/owners are visited only by explicit
+identity remapping, alongside all other historical UUIDs.
+
+Attachment authorization uses the immutable initial snapshot; metadata observations
+use the identified artifact record. Thus a target-only Owner or Owner+Name candidate
+records the actual resulting owner/metadata after a move, independent of facet
+order. Presence remains relative to the trace owner. A subsequent metadata decision
+through the former owner trace is rejected, while its historical observation remains
+available for drift. This avoids replacing an explicit owner value with both-side NA.
+
 Freeze mappings before proposals. Resolve all live and historical reference
 members through explicit correspondence; no display-name matching. Many sources
 may affect a target only when resolved deltas agree for each canonical target
@@ -111,12 +157,46 @@ slot. A source/key-pair collision or contradictory target delta is a conflict,
 independent of request order. Mapping changes require explicit invalidation/reset
 of affected old reviews; never silently replace or accumulate overlapping pairs.
 
+An established paired selector remains the identity when one side's member or
+constructor branch disappears. It suppresses the redundant generated one-sided
+projection, preserving an NA/remaining-value observation. The reverse case is
+different: a newly appearing pair does not suppress old one-sided history and
+requires an explicit reset. Apply this rule to the closed keyed selector catalog,
+not only enumeration or constructor special cases.
+
+Every selected source derives desired values from the same immutable initial
+project. Apply explicit baseline resets before deriving its current catalog or
+constructor scope. Union all selected canonical slots across constructor scopes,
+including introduced members and removals, and reject disagreement before applying
+any writes. Materialize the agreed result once and compare every selected desired
+slot against it, then repeat that audit after ordinary command preparation.
+An exact approved cleanup impact still cannot contradict a selected Keep/Take.
+This invariant replaces sequential proposal mutation and order-dependent audits.
+When the target already has the proposed constructor, preserve target-only members
+while reconciling its group; a source constructor change is not whole-list deletion
+authority. Independently inferred orders must agree; commuting member removals
+filter those orders to surviving members without refreshing order history.
+
 Compare each side against its own reviewed value, retaining intentionally unequal
 pairs. Keep acknowledges only the selected current source/retained target fact.
 Take or a typed candidate acknowledges only the selected resulting fact. Untouched
 changes remain drift. Preview unreviewed differences rather than falsely claiming
 unchanged semantics. A selected constructor group names every fact it acknowledges.
 
+New resolution admission requires the appropriate current record family and at
+least one applicable current side. Persisted historical facts are different: their
+typed former family/constructor and deleted UUIDs remain valid history even after
+the live endpoints change. Validate their closed types, keys, duplicate slots,
+finite values, text and work limits without requiring present-day live references
+or present-day family applicability. Historical observations are never live edges.
+
+Linked shared-definition drift is derived, not copied into each referring baseline.
+The bounded walk follows reusable data fields/types, exchange items, interfaces,
+events and interface allocation declarations, stopping at 4096 objects per side
+or 32768 edges with an observable diagnostic. Parent edges and arbitrary architecture
+neighborhoods do not expand that walk. Missing pairs/reviews remain Unreviewed;
+own and linked rollups explicitly retain their unreviewed counts.
+
 Preserve target-only members and records. Removing source membership proposes
 unlinking, not deletion of target semantic objects. Ordered insertion is automatic
 only with a unique unchanged mapped anchor; ambiguous insertion/reorder requires