fix(desktop): invalidate filtered catalog on changed hosted head

crates/oa-desktop/src/behavior/topology/layout_tests.rs

@@ -0,0 +1,138 @@
+use super::*;
+use iced::advanced::{Layout, layout, widget};
+use iced::{Rectangle, Vector};
+
+#[derive(Default)]
+struct Geometry {
+    scrolls: Vec<(Option<widget::Id>, Rectangle, Vector)>,
+    actions: Option<Rectangle>,
+}
+impl widget::Operation for Geometry {
+    fn traverse(&mut self, operate: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        operate(self);
+    }
+    fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+        if id == Some(&widget::Id::new("test-process-actions")) {
+            self.actions = Some(bounds);
+        }
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&widget::Id>,
+        bounds: Rectangle,
+        _: Rectangle,
+        translation: Vector,
+        _: &mut dyn widget::operation::Scrollable,
+    ) {
+        self.scrolls.push((id.cloned(), bounds, translation));
+    }
+}
+fn workspace(pending: bool) -> iced::Element<'static, Message, iced::Theme, ()> {
+    let diagram = scrollable(iced::widget::Space::new().width(500).height(1200))
+        .id("test-process-page")
+        .height(Fill)
+        .into();
+    let form = if pending {
+        editor_panel(
+            container(iced::widget::Space::new().height(32))
+                .id("test-process-actions")
+                .into(),
+            iced::widget::Space::new().height(1400).into(),
+        )
+    } else {
+        iced::widget::Space::new().height(0).into()
+    };
+    panes(diagram, form, pending)
+}
+fn geometry(
+    view: &mut iced::Element<'_, Message, iced::Theme, ()>,
+    tree: &mut widget::Tree,
+    size: Size,
+) -> (layout::Node, Geometry) {
+    let node = view
+        .as_widget_mut()
+        .layout(tree, &(), &layout::Limits::new(Size::ZERO, size));
+    let mut geometry = Geometry::default();
+    view.as_widget_mut()
+        .operate(tree, Layout::new(&node), &(), &mut geometry);
+    (node, geometry)
+}
+
+#[test]
+fn direct_process_pending_editor_uses_available_height_and_keeps_actions_visible() {
+    // Actual available center-pane sizes at the minimum/default supported windows.
+    // Space represents arbitrarily long diagram/form content; the production
+    // pane/card builders and real Iced layout/scroll operations are exercised.
+    for size in [Size::new(500., 570.), Size::new(840., 770.)] {
+        let mut view = workspace(false);
+        let mut tree = widget::Tree::new(view.as_widget());
+        let (node, _) = geometry(&mut view, &mut tree, size);
+        let mut scroll = widget::operation::scrollable::scroll_to::<()>(
+            widget::Id::new("test-process-page"),
+            widget::operation::scrollable::AbsoluteOffset {
+                x: None,
+                y: Some(180.),
+            },
+        );
+        view.as_widget_mut()
+            .operate(&mut tree, Layout::new(&node), &(), &mut scroll);
+        view = workspace(true);
+        tree.diff(view.as_widget());
+        let (node, before) = geometry(&mut view, &mut tree, size);
+        let page = before
+            .scrolls
+            .iter()
+            .find(|s| s.0 == Some(widget::Id::new("test-process-page")))
+            .unwrap();
+        let form = before
+            .scrolls
+            .iter()
+            .find(|s| s.0 == Some(widget::Id::new("process-form")))
+            .unwrap();
+        assert_eq!(node.size(), size);
+        assert!(
+            form.1.height >= 200.,
+            "usable form viewport: {size:?} {:?}",
+            form.1
+        );
+        assert!(form.1.y >= page.1.y + page.1.height);
+        assert!(form.1.y + form.1.height <= size.height);
+        assert_eq!(page.2.y, 180., "opening a form retains the page scroll");
+        let actions = before.actions.unwrap();
+        assert!(actions.y >= page.1.y + page.1.height);
+        assert!(actions.y + actions.height <= form.1.y);
+        let mut scroll = widget::operation::scrollable::scroll_to::<()>(
+            widget::Id::new("process-form"),
+            widget::operation::scrollable::AbsoluteOffset {
+                x: None,
+                y: Some(600.),
+            },
+        );
+        view.as_widget_mut()
+            .operate(&mut tree, Layout::new(&node), &(), &mut scroll);
+        let (_, after) = geometry(&mut view, &mut tree, size);
+        assert_eq!(
+            after.actions,
+            Some(actions),
+            "Create/Cancel stay pinned during form scrolling"
+        );
+        assert_eq!(
+            after.scrolls[0].2.y, 180.,
+            "form scrolling does not move the diagram page"
+        );
+        assert!(
+            after
+                .scrolls
+                .iter()
+                .any(|s| s.0 == Some(widget::Id::new("process-form")) && s.2.y == 600.)
+        );
+        view = workspace(false);
+        tree.diff(view.as_widget());
+        let (_, closed) = geometry(&mut view, &mut tree, size);
+        assert_eq!(
+            closed.scrolls[0].2.y, 180.,
+            "cancel retains the page scroll"
+        );
+        assert_eq!(closed.scrolls[0].1.height, size.height);
+    }
+}

crates/oa-desktop/src/behavior/topology/view.rs

@@ -305,6 +305,7 @@ pub(super) fn view<'a>(
             button("Back to caller").on_press(Message::TopologyCanvas(CanvasEvent::Back(context))),
         );
     }
+    let mut form_panel: Element<'_, Message> = iced::widget::Space::new().height(0).into();
     if let Some(d) = state.draft.as_ref().filter(|d| d.owner == owner) {
         let mut form = column![text(d.tool.title()).size(16)].spacing(8);
         if let Some(link) = d.insertion.link.and_then(|id| p.relations.get(&id)) {
@@ -473,21 +474,65 @@ pub(super) fn view<'a>(
             button("Cancel").on_press(event(Event::Cancel))
         ]
         .spacing(7);
-        out = out.push(
+        form_panel = editor_panel(actions.into(), form.into());
-            container(
-                column![
-                    actions,
-                    scrollable(form).height((app.window_size.height - 520.).clamp(150., 260.))
-                ]
-                .spacing(8),
-            )
-            .padding(12)
-            .style(style::card),
-        );
     }
+    panes(
         super::super::scenario_scroll::observe_topology(
             context,
             scenario::ScrollArea::Page,
             scrollable(out.padding(18)),
+        ),
+        form_panel,
+        pending,
     )
 }
+
+/// Keep the diagram mounted while an independent editor uses the remaining
+/// workspace height. The editor must never be clipped by the page scrollable.
+fn panes<'a, R: iced::advanced::Renderer + 'a>(
+    diagram: iced::Element<'a, Message, iced::Theme, R>,
+    form: iced::Element<'a, Message, iced::Theme, R>,
+    pending: bool,
+) -> iced::Element<'a, Message, iced::Theme, R> {
+    column![
+        container(diagram).width(Fill).height(if pending {
+            iced::Length::FillPortion(1)
+        } else {
+            Fill
+        }),
+        container(form).width(Fill).height(if pending {
+            iced::Length::FillPortion(1)
+        } else {
+            iced::Length::Shrink
+        }),
+    ]
+    .width(Fill)
+    .height(Fill)
+    .into()
+}
+
+fn editor_panel<'a, R: iced::advanced::text::Renderer + 'a>(
+    actions: iced::Element<'a, Message, iced::Theme, R>,
+    fields: iced::Element<'a, Message, iced::Theme, R>,
+) -> iced::Element<'a, Message, iced::Theme, R> {
+    container(
+        container(column![actions, scrollable(fields).id("process-form").height(Fill)].spacing(8))
+            .width(Fill)
+            .height(Fill)
+            .padding(12)
+            .style(style::card),
+    )
+    .width(Fill)
+    .height(Fill)
+    .padding(iced::Padding {
+        top: 0.,
+        right: 18.,
+        bottom: 18.,
+        left: 18.,
+    })
+    .into()
+}
+
+#[cfg(all(test, debug_assertions))]
+#[path = "layout_tests.rs"]
+mod layout_tests;

crates/oa-desktop/src/forms.rs

@@ -46,6 +46,8 @@ pub struct Draft {
     pub inputs: BTreeMap<String, Input>,
     pub exact_strings: bool,
     context: Option<Value>,
+    pub semantic_groups: bool,
+    constructor_drafts: BTreeMap<(String, String), (Value, BTreeMap<String, Input>)>,
     port_contract_drafts: BTreeMap<String, Value>,
     pub value_browsers: BTreeMap<String, ValueBrowser>,
 }
@@ -85,6 +87,8 @@ impl Draft {
             inputs: BTreeMap::new(),
             exact_strings: false,
             context: None,
+            semantic_groups: false,
+            constructor_drafts: BTreeMap::new(),
             port_contract_drafts: BTreeMap::new(),
             value_browsers: BTreeMap::new(),
         };
@@ -248,6 +252,75 @@ impl Draft {
         self.rebuild_retaining(|old| (!within(old, path)).then(|| old.to_owned()));
         Ok(())
     }
+    /// Preserve each selected constructor branch, including incomplete raw input
+    /// and editor state. No sibling fields are parsed or cleared by a switch.
+    pub fn variant_scoped(&mut self, path: &str, proposed: Value) -> Result<(), String> {
+        let current = self
+            .value
+            .pointer(path)
+            .ok_or("Property no longer exists.")?
+            .clone();
+        if same_variant(&current, &proposed) {
+            return Ok(());
+        }
+        let constructor = path.ends_with("/DataType/definition")
+            || path.ends_with("/Port/contract")
+            || path.ends_with("/Occurrence/body")
+            || path.ends_with("/Event/body")
+            || path.ends_with("/message_kind");
+        if !constructor {
+            return self.shape_scoped(path, proposed);
+        }
+        // Input/output direction changes carry the item declaration. Read those
+        // raw reference strings before stashing their editor buffers so an
+        // incomplete reference cannot silently fall back to its stored UUID.
+        let port_current = if path.ends_with("/Port/contract") {
+            self.materialize_scopes(&[path.to_owned()])?
+                .pointer(path)
+                .cloned()
+        } else {
+            None
+        };
+        let tag = |value: &Value| {
+            value
+                .as_str()
+                .or_else(|| value.as_object()?.keys().next().map(String::as_str))
+                .unwrap_or("")
+                .to_owned()
+        };
+        let previous_key = (path.to_owned(), tag(&current));
+        let next_key = (path.to_owned(), tag(&proposed));
+        let mut inputs = BTreeMap::new();
+        for key in self
+            .inputs
+            .keys()
+            .filter(|key| within(key, path))
+            .cloned()
+            .collect::<Vec<_>>()
+        {
+            inputs.insert(key.clone(), self.inputs.remove(&key).unwrap());
+        }
+        self.constructor_drafts
+            .insert(previous_key, (current.clone(), inputs));
+        let saved = self.constructor_drafts.remove(&next_key);
+        let (value, restored) = if let Some(saved) = saved {
+            saved
+        } else {
+            let value = if path.ends_with("/Port/contract") {
+                port_fields::switch_contract(
+                    port_current.as_ref().unwrap_or(&current),
+                    proposed,
+                    &mut BTreeMap::new(),
+                )
+            } else {
+                proposed
+            };
+            (value, BTreeMap::new())
+        };
+        self.shape_scoped(path, value)?;
+        self.inputs.extend(restored);
+        Ok(())
+    }
     fn rebuild_retaining(&mut self, new_path: impl Fn(&str) -> Option<String>) {
         let previous = std::mem::take(&mut self.inputs);
         self.rebuild();
@@ -645,7 +718,12 @@ fn free_string(path: &str) -> bool {
 // These are choices for the closed model, not a second validation boundary.
 // A current reference is always retained, even while other draft fields make it
 // incompatible. Applying the complete draft remains the core validator's job.
-fn reference_choices(draft: &Draft, project: &Project, path: &str, current: Id) -> Vec<Choice> {
+pub(crate) fn reference_choices(
+    draft: &Draft,
+    project: &Project,
+    path: &str,
+    current: Id,
+) -> Vec<Choice> {
     let identities = project.identities().into_iter().collect::<BTreeMap<_, _>>();
     let compatible = reference_ids(draft, project, path);
     let mut objects = compatible
@@ -1290,6 +1368,7 @@ fn variants(path: &str, value: &Value, kind: RecordKind) -> Vec<(String, Value)>
         "layer" => &["Oa", "Sa"],
         "mechanism" => &["Unspecified", "Flow", "Event", "Operation", "SharedData"],
         "storage" => &["Value", "Reference"],
+        "direction" if path.contains("/Port/legacy/") => &["In", "Out", "InOut"],
         "direction" if path.contains("DataField") => {
             &["Unspecified", "In", "Out", "InOut", "Return"]
         }
@@ -1546,7 +1625,7 @@ fn property<'a>(
         return view;
     }
     let label_view = || text(label.to_owned()).size(11).color(style::MUTED);
-    if path.ends_with("/Port/legacy") {
+    if path.ends_with("/Port/legacy") && !draft.semantic_groups {
         let mut content = column![].spacing(4);
         if !value.is_null() {
             content = content.push(
@@ -1560,6 +1639,29 @@ fn property<'a>(
         }
         return content.into();
     }
+    if path.ends_with("/Port/legacy") && draft.semantic_groups && !skip_variant {
+        let mut content = column![
+            label_view(),
+            text(
+                "Retained generic association is part of this group. Change or clear it explicitly."
+            )
+            .size(11)
+        ]
+        .spacing(5);
+        if value.is_null() {
+            content = content.push(button(text("Add generic association").size(11)).on_press(
+                Message::FieldShape(path.into(), json!({"direction":"InOut","interface":null})),
+            ));
+        } else {
+            content = content
+                .push(property(draft, project, value, path, label, true))
+                .push(
+                    button(text("Clear generic association").size(11))
+                        .on_press(Message::FieldShape(path.into(), Value::Null)),
+                );
+        }
+        return content.into();
+    }
     let enum_choices = if skip_variant {
         vec![]
     } else {
@@ -1817,6 +1919,73 @@ fn property<'a>(
 mod tests {
     use super::*;
 
+    #[test]
+    fn semantic_port_group_choices_use_combined_owner_and_retain_invalid_transferred_items() {
+        let mut p = Project::empty();
+        let function = p
+            .add_element(Kind::Function, Layer::Sa, "Function", None)
+            .unwrap();
+        let component = p
+            .add_element(Kind::System, Layer::Sa, "Component", None)
+            .unwrap();
+        let item = p
+            .add_element(Kind::ExchangeItem, Layer::Sa, "Item", None)
+            .unwrap();
+        let id = Id::new_v4();
+        p.elements.insert(
+            id,
+            ports::make_port(
+                &p,
+                id,
+                function,
+                "Port",
+                PortContract::FunctionInput {
+                    incoming_items: vec![item],
+                },
+            )
+            .unwrap(),
+        );
+        let mut draft = Draft::from_project(&p, id).unwrap();
+        draft.semantic_groups = true;
+        let path = "/body/Sa/Shared/Port/contract";
+        let input = format!("{path}/FunctionInput/incoming_items/0");
+        draft.input(&input, "incomplete-id".into());
+        let cursor = draft.inputs[&input].editor.cursor();
+        draft
+            .variant_scoped(path, json!({"FunctionOutput":{"outgoing_items":[]}}))
+            .unwrap();
+        assert_eq!(
+            draft.inputs[&format!("{path}/FunctionOutput/outgoing_items/0")].raw,
+            "incomplete-id"
+        );
+        assert!(serde_json::from_value::<Element>(draft.materialize().unwrap()).is_err());
+        draft
+            .variant_scoped(path, json!({"FunctionInput":{"incoming_items":[]}}))
+            .unwrap();
+        assert_eq!(draft.inputs[&input].raw, "incomplete-id");
+        assert_eq!(draft.inputs[&input].editor.cursor(), cursor);
+        let choices =
+            port_fields::variants(&draft, &p, path, draft.value.pointer(path).unwrap()).unwrap();
+        assert!(
+            choices
+                .iter()
+                .any(|(_, v)| v.get("FunctionInput").is_some())
+        );
+        assert!(choices.iter().any(|(_, v)| *v == json!("Legacy")));
+        assert!(!choices.iter().any(|(_, v)| v.get("Component").is_some()));
+        let mut context = draft.value.clone();
+        context["parent"] = json!(component);
+        draft.set_context(Some(context));
+        let choices =
+            port_fields::variants(&draft, &p, path, draft.value.pointer(path).unwrap()).unwrap();
+        assert!(choices.iter().any(|(_, v)| v.get("Component").is_some()));
+        assert!(
+            !choices
+                .iter()
+                .any(|(_, v)| v.get("FunctionInput").is_some())
+        );
+    }
+
     fn ids(draft: &Draft, project: &Project, path: &str) -> Vec<Id> {
         reference_ids(draft, project, path)
     }

crates/oa-desktop/src/forms/port_fields.rs

@@ -45,7 +45,11 @@ pub(super) fn variants(
         let current = draft.context_value();
         let sa = current.pointer("/body/Sa").is_some();
         if !sa {
-            return Some(vec![]);
+            return Some(if draft.semantic_groups {
+                vec![("Legacy generic port".into(), json!("Legacy"))]
+            } else {
+                vec![]
+            });
         }
         let owner = current
             .get("parent")
@@ -69,6 +73,9 @@ pub(super) fn variants(
                 json!({"Component":{"kind":"Standard","orientation":"Unset"}}),
             ));
         }
+        if draft.semantic_groups {
+            choices.push(("Legacy generic port".into(), json!("Legacy")));
+        }
         return Some(choices);
     }
     if path.ends_with("/Port/contract/Component/kind") {

crates/oa-desktop/src/semantic_review.rs

@@ -8,16 +8,28 @@ use oa_core::{transitions::*, *};
 use serde_json::Value;
 use std::collections::{BTreeMap, BTreeSet};
 
+mod constructors;
+mod history;
+mod keyed;
+mod message_kind;
 mod scalar;
 mod view;
 pub(crate) use view::summary;
 #[cfg(test)]
+mod constructor_tests;
+#[cfg(test)]
+mod keyed_tests;
+#[cfg(test)]
+mod message_kind_tests;
+#[cfg(test)]
 mod tests;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Tab {
     Facts,
     References,
+    Members,
+    History,
     Impacts,
 }
 
@@ -43,6 +55,16 @@ pub enum Event {
     RemoveReference(Id),
     AcceptImpact(usize, bool),
     Preview,
+    Reset(FacetSelector, bool),
+    Presence(FacetSelector, bool),
+    MemberFamily(keyed::Family),
+    MemberOa(Option<Choice>),
+    MemberSa(Option<Choice>),
+    Literal(String),
+    LiteralSide(Layer, bool),
+    EditPair(FacetSelector),
+    StageMember,
+    DropStaged(FacetSelector),
 }
 
 pub struct State {
@@ -53,7 +75,19 @@ pub struct State {
     pub selected: Option<FacetSelector>,
     pub decisions: BTreeMap<FacetSelector, SemanticDecision>,
     pub references: BTreeMap<Id, Id>,
+    pub resets: BTreeSet<FacetSelector>,
+    pub staged: BTreeSet<FacetSelector>,
+    pub presence: BTreeMap<FacetSelector, bool>,
+    pub member_family: keyed::Family,
+    pub member_oa: Option<Choice>,
+    pub member_sa: Option<Choice>,
+    pub literal: String,
+    pub literal_oa: bool,
+    pub literal_sa: bool,
     pub draft: Option<Draft>,
+    // Each closed constructor has an independent draft, including nested kinds.
+    // Scalar and sibling drafts survive decision and constructor changes.
+    pub group_drafts: BTreeMap<FacetSelector, Draft>,
     pub plan: Option<SemanticTransitionPlan>,
     pub proposed: Option<Project>,
     pub error: Option<String>,
@@ -95,7 +129,17 @@ impl State {
             selected: None,
             decisions: BTreeMap::new(),
             references: BTreeMap::new(),
+            resets: BTreeSet::new(),
+            staged: BTreeSet::new(),
+            presence: BTreeMap::new(),
+            member_family: keyed::Family::Literal,
+            member_oa: None,
+            member_sa: None,
+            literal: String::new(),
+            literal_oa: true,
+            literal_sa: true,
             draft: None,
+            group_drafts: BTreeMap::new(),
             plan: None,
             proposed: None,
             error: None,
@@ -122,15 +166,41 @@ impl State {
     fn load_trace(&mut self, project: &Project) {
         self.facts.clear();
         self.decisions.clear();
+        self.resets.clear();
+        self.staged.clear();
+        self.presence.clear();
+        self.member_oa = None;
+        self.member_sa = None;
+        self.literal.clear();
+        self.literal_oa = true;
+        self.literal_sa = true;
         self.selected = None;
         self.accepted_impacts.clear();
         self.references.clear();
         self.draft = self
             .target(project)
             .and_then(|id| Draft::from_project(project, id));
+        self.group_drafts.clear();
+        if let Some(trace) = self.trace.and_then(|id| project.traces.get(&id)) {
+            for facet in constructors::selectors() {
+                if constructors::available(project, trace, &facet)
+                    && let Some(mut draft) = self
+                        .target(project)
+                        .and_then(|id| Draft::from_project(project, id))
+                {
+                    draft.semantic_groups = true;
+                    self.group_drafts.insert(facet, draft);
+                }
+            }
+        }
         if let Some(trace) = self.trace.and_then(|id| project.traces.get(&id)) {
             self.references.insert(trace.oa, trace.sa);
         }
+        self.member_family = self
+            .member_families(project)
+            .first()
+            .copied()
+            .unwrap_or(keyed::Family::Literal);
         self.refresh(project);
     }
 
@@ -168,6 +238,17 @@ impl State {
                     {
                         Err("This fact needs the structured review workflow; its history remains unchanged.".into())
                     } else {
+                        if keyed::supported(&facet) {
+                            let target_presence = self
+                                .effective_trace(project)
+                                .and_then(|t| capture_facet(project, t.oa, t.sa, &facet).ok())
+                                .and_then(|f| scalar::value(&f, self.direction.target_layer()))
+                                .and_then(|v| v.as_bool())
+                                .unwrap_or(false);
+                            self.presence
+                                .entry(facet.clone())
+                                .or_insert(target_presence);
+                        }
                         self.decisions.insert(facet, decision);
                         Ok(())
                     }
@@ -187,16 +268,9 @@ impl State {
             Event::Shape(path, value) => {
                 self.edit(project, &path, |d| d.shape_scoped(&path, value))
             }
-            Event::Variant(path, value) => self.edit(project, &path, |d| {
+            Event::Variant(path, value) => {
-                if d.value
+                self.edit(project, &path, |d| d.variant_scoped(&path, value))
-                    .pointer(&path)
-                    .is_some_and(|v| crate::forms::same_variant(v, &value))
-                {
-                    Ok(())
-                } else {
-                    d.shape_scoped(&path, value)
             }
-            }),
             Event::Array(path, index, direction) => {
                 self.edit(project, &path, |d| d.array_scoped(&path, index, direction))
             }
@@ -258,6 +332,57 @@ impl State {
                 return;
             }
             Event::Preview => Ok(()),
+            Event::Reset(facet, reset) => self.reset_history(project, facet, reset),
+            Event::Presence(facet, present) => {
+                if keyed::supported(&facet)
+                    && self.decisions.get(&facet) == Some(&SemanticDecision::Candidate)
+                {
+                    self.presence.insert(facet, present);
+                    Ok(())
+                } else {
+                    Err("Choose Set final value for this member before editing presence.".into())
+                }
+            }
+            Event::MemberFamily(family) => {
+                self.member_family = family;
+                replan = false;
+                Ok(())
+            }
+            Event::MemberOa(choice) => {
+                self.member_oa = choice;
+                replan = false;
+                Ok(())
+            }
+            Event::MemberSa(choice) => {
+                self.member_sa = choice;
+                replan = false;
+                Ok(())
+            }
+            Event::Literal(value) => {
+                self.literal = value;
+                replan = false;
+                Ok(())
+            }
+            Event::LiteralSide(layer, present) => {
+                if layer == Layer::Oa {
+                    self.literal_oa = present;
+                } else {
+                    self.literal_sa = present;
+                }
+                replan = false;
+                Ok(())
+            }
+            Event::EditPair(facet) => {
+                replan = false;
+                self.edit_pair(project, facet)
+            }
+            Event::StageMember => self.stage_member(project),
+            Event::DropStaged(facet) => {
+                if self.staged.remove(&facet) {
+                    self.decisions.remove(&facet);
+                }
+                Ok(())
+            }
         };
         if let Err(error) = result {
             self.error = Some(error);
@@ -281,15 +406,23 @@ impl State {
         if self.decisions.get(facet) != Some(&SemanticDecision::Candidate) {
             return Err("Choose Set final value before editing this property.".into());
         }
-        let root = self
+        let roots = self
             .target(project)
-            .and_then(|id| scalar::binding(project, id, facet))
+            .and_then(|id| constructors::roots(project, id, facet))
-            .ok_or("Selected scalar property is unavailable.")?;
+            .ok_or("Selected property is unavailable.")?;
-        if path != root && !path.starts_with(&format!("{root}/")) {
+        if !roots
-            return Err("Only the selected scalar property can change in this draft.".into());
+            .iter()
+            .any(|root| path == root || path.starts_with(&format!("{root}/")))
+        {
+            return Err("Only the selected review property can change in this draft.".into());
         }
-        let draft = self.draft.as_mut().ok_or("Choose an existing target.")?;
+        let draft = if scalar::grouped(facet) {
-        // The scoped view sends only descendants of the selected scalar property.
+            self.group_drafts.get_mut(facet)
+        } else {
+            self.draft.as_mut()
+        }
+        .ok_or("Choose an existing target.")?;
+        // The scoped view sends only the selected property or closed group roots.
         // Protected identity and top-level body/perspective controls are never exposed.
         if path == "/id" || path == "/alias" || path == "/body" || path == "/layer" {
             return Err("Semantic candidates retain identity, alias and perspective.".into());
@@ -298,17 +431,35 @@ impl State {
     }
 
     pub fn editable(&self, project: &Project, facet: &FacetSelector) -> bool {
+        if keyed::supported(facet) {
+            return self
+                .effective_trace(project)
+                .is_some_and(|trace| capture_facet(project, trace.oa, trace.sa, facet).is_ok());
+        }
         self.target(project)
             .and_then(|id| scalar::binding(project, id, facet))
             .is_some()
-            && !scalar::grouped(facet)
+            && (!scalar::grouped(facet)
+                || (self.group_drafts.contains_key(facet)
+                    && self
+                        .trace
+                        .and_then(|id| project.traces.get(&id))
+                        .is_some_and(|trace| constructors::available(project, trace, facet))))
+    }
+
+    fn candidate_draft(&self, facet: &FacetSelector) -> Option<&Draft> {
+        if scalar::grouped(facet) {
+            self.group_drafts.get(facet)
+        } else {
+            self.draft.as_ref()
+        }
     }
 
     pub fn can_acknowledge_constructor(&self, project: &Project, facet: &FacetSelector) -> bool {
         if !scalar::grouped(facet) {
             return false;
         }
-        let Some(trace) = self.trace.and_then(|id| project.traces.get(&id)) else {
+        let Some(trace) = self.effective_trace(project) else {
             return false;
         };
         if trace
@@ -319,13 +470,12 @@ impl State {
         {
             return false;
         }
-        self.facts
+        capture_facet(project, trace.oa, trace.sa, facet)
-            .iter()
+            .ok()
-            .find(|f| f.selector == *facet)
+            .is_some_and(|current| {
-            .is_some_and(|f| {
+                scalar::value(&current, Layer::Oa).is_some()
-                scalar::value(&f.current, Layer::Oa).is_some()
+                    && scalar::observation(&current, Layer::Oa)
-                    && scalar::observation(&f.current, Layer::Oa)
+                        == scalar::observation(&current, Layer::Sa)
-                        == scalar::observation(&f.current, Layer::Sa)
             })
     }
 
@@ -358,7 +508,7 @@ impl State {
                     decision: *decision,
                 })
                 .collect(),
-            reset: vec![],
+            reset: self.resets.iter().cloned().collect(),
         });
         request.accepted_impacts = self.accepted_impacts.clone();
         if self
@@ -383,14 +533,11 @@ impl State {
         Ok(request)
     }
 
-    /// Compose selected scalar values for both the candidate and dependent form
+    /// Compose selected values for both the candidate and dependent form
     /// controls. Incomplete inputs retain their stored shape only for controls;
     /// request construction always requires every selected input to parse.
     fn combined_value(&self, project: &Project, form_context: bool) -> Result<Value, String> {
-        let trace = self
+        let trace = self.effective_trace(project).ok_or("Choose a trace.")?;
-            .trace
-            .and_then(|id| project.traces.get(&id))
-            .ok_or("Choose a trace.")?;
         let (source, target) = if self.direction == TransitionDirection::OaToSa {
             (trace.oa, trace.sa)
         } else {
@@ -399,7 +546,6 @@ impl State {
         let mut final_value = Draft::from_project(project, target)
             .ok_or("Target has no editable record.")?
             .value;
-        let draft = self.draft.as_ref().ok_or("Target draft is unavailable.")?;
         let mut map = BTreeMap::new();
         for (oa, sa) in &self.references {
             let (from, to) = if self.direction == TransitionDirection::OaToSa {
@@ -412,33 +558,79 @@ impl State {
             }
         }
         map.insert(source, target);
-        for (facet, decision) in &self.decisions {
+        let original = final_value.clone();
+        let mut group_candidates = vec![];
+        // Outer groups precede nested groups and leaves. The core rejects actual
+        // overlapping replacement scopes; this order also supports first-equal
+        // discriminator acknowledgment together with explicit descendant values.
+        let mut decisions: Vec<_> = self.decisions.iter().collect();
+        decisions.sort_by_key(|(facet, _)| match facet {
+            FacetSelector::Occurrence(OccurrenceFacet::Constructor) => 0,
+            facet if scalar::grouped(facet) => 1,
+            _ => 2,
+        });
+        for (facet, decision) in decisions {
             if *decision == SemanticDecision::KeepTarget {
                 continue;
             }
-            let path = scalar::binding(project, target, facet)
+            if keyed::supported(facet) {
+                self.keyed_value(project, &trace, &mut final_value, facet, *decision)?;
+                continue;
+            }
+            let roots = constructors::roots(project, target, facet)
                 .ok_or("Selected property is not applicable to the target.")?;
-            let value = match decision {
+            let supplied = match decision {
                 SemanticDecision::KeepTarget => continue,
                 SemanticDecision::Candidate => {
-                    let value = match draft.materialize_scopes(std::slice::from_ref(&path)) {
+                    let draft = self
+                        .candidate_draft(facet)
+                        .ok_or("Target draft is unavailable.")?;
+                    match draft.materialize_scopes(&roots) {
                         Ok(value) => value,
                         Err(_) if form_context => draft.value.clone(),
                         Err(error) => return Err(error),
-                    };
+                    }
-                    value
+                }
-                        .pointer(&path)
+                SemanticDecision::TakeSource if scalar::grouped(facet) => {
-                        .cloned()
+                    if self.can_acknowledge_constructor(project, facet) {
-                        .ok_or("Candidate property is no longer available.")?
+                        original.clone()
+                    } else {
+                        constructors::take_value(project, &trace, self.direction, facet, &map)?
+                    }
                 }
                 SemanticDecision::TakeSource => {
                     let fact = capture_facet(project, trace.oa, trace.sa, facet)?;
-                    scalar::source_value(&fact, self.direction.source_layer(), &map)?
+                    let value = scalar::source_value(&fact, self.direction.source_layer(), &map)?;
+                    let mut supplied = original.clone();
+                    *supplied
+                        .pointer_mut(&roots[0])
+                        .ok_or("Source property is unavailable.")? = value;
+                    supplied
                 }
             };
-            *final_value
+            for path in roots {
-                .pointer_mut(&path)
+                let value = supplied
-                .ok_or("Final target property is unavailable.")? = value;
+                    .pointer(&path)
+                    .cloned()
+                    .ok_or("Candidate property is no longer available.")?;
+                if scalar::grouped(facet) && *decision == SemanticDecision::Candidate {
+                    group_candidates.push((path.clone(), value.clone()));
+                }
+                *final_value.pointer_mut(&path).ok_or("Final target property is unavailable; resolve the overlapping constructor decision.")? = value;
+            }
+        }
+        if !form_context {
+            for (path, authored) in group_candidates {
+                if !original
+                    .pointer(&path)
+                    .zip(final_value.pointer(&path))
+                    .is_some_and(|(original, final_value)| {
+                        constructors::authored_agrees(original, &authored, final_value)
+                    })
+                {
+                    return Err("The constructor candidate and descendant decision propose different final values. Keep the kind or make their final values agree; both drafts are retained.".into());
+                }
+            }
         }
         Ok(final_value)
     }
@@ -449,17 +641,48 @@ impl State {
         self.error = None;
         let context = self.combined_value(project, true).ok();
         if let Some(draft) = &mut self.draft {
-            draft.set_context(context);
+            draft.set_context(context.clone());
         }
-        let Some(trace) = self.trace.and_then(|id| project.traces.get(&id)) else {
+        for draft in self.group_drafts.values_mut() {
+            draft.set_context(context.clone());
+        }
+        let Some(trace) = self.effective_trace(project) else {
             self.error = Some(
                 "Several traces are available. Choose the correspondence and review history above."
                     .into(),
             );
             return;
         };
-        match semantic_facets(project, trace, &self.references) {
+        match semantic_facets(project, &trace, &self.references) {
-            Ok(facts) => self.facts = facts,
+            Ok(mut facts) => {
+                // Explicit addresses survive catalog normalization, pairing changes and resets.
+                for selector in self.staged.iter().chain(self.decisions.keys()) {
+                    if !facts.iter().any(|f| &f.selector == selector) {
+                        match capture_facet(project, trace.oa, trace.sa, selector) {
+                            Ok(current) => {
+                                let previous = trace
+                                    .baseline
+                                    .as_ref()
+                                    .and_then(|b| b.semantic.as_ref())
+                                    .and_then(|b| {
+                                        b.facets.iter().find(|f| f.selector() == *selector)
+                                    });
+                                facts.push(FacetDrift {
+                                    selector: selector.clone(),
+                                    drift: facet_drift(&current, previous),
+                                    current,
+                                });
+                            }
+                            Err(error) => {
+                                self.error = Some(error);
+                                return;
+                            }
+                        }
+                    }
+                }
+                facts.sort_by(|a, b| a.selector.cmp(&b.selector));
+                self.facts = facts;
+            }
             Err(error) => {
                 self.error = Some(error);
                 return;
@@ -499,8 +722,11 @@ impl State {
     }
 
     pub fn command(&mut self, project: &Project) -> Result<Command, String> {
-        if self.decisions.is_empty() {
+        if self.decisions.is_empty() && self.resets.is_empty() {
-            return Err("Choose at least one property to review.".into());
+            return Err(
+                "Choose at least one property to review or an exact history observation to reset."
+                    .into(),
+            );
         }
         if let Some(error) = &self.error {
             return Err(error.clone());
@@ -514,7 +740,7 @@ impl State {
     }
 
     pub fn can_apply(&self) -> bool {
-        !self.decisions.is_empty()
+        (!self.decisions.is_empty() || !self.resets.is_empty())
             && self.error.is_none()
             && self
                 .plan

crates/oa-desktop/src/semantic_review/constructors.rs

@@ -0,0 +1,327 @@
+//! Closed constructor payload bindings. The core owns decisions and review scope;
+//! this adapter supplies complete target records for its Candidate agreement check.
+use super::{scalar, *};
+
+pub(super) fn selectors() -> [FacetSelector; 5] {
+    [
+        FacetSelector::Data(DataFacet::Constructor),
+        FacetSelector::Port(PortFacet::Constructor),
+        FacetSelector::Occurrence(OccurrenceFacet::Constructor),
+        FacetSelector::Occurrence(OccurrenceFacet::MessageKind),
+        FacetSelector::Event(EventFacet::Constructor),
+    ]
+}
+
+pub(super) fn roots(project: &Project, target: Id, facet: &FacetSelector) -> Option<Vec<String>> {
+    let root = scalar::binding(project, target, facet)?;
+    let mut roots = vec![root.clone()];
+    match facet {
+        FacetSelector::Data(DataFacet::Constructor) => {
+            roots.push(format!("{}/default", root.strip_suffix("/definition")?));
+        }
+        FacetSelector::Port(PortFacet::Constructor) => {
+            roots.push(format!("{}/legacy", root.strip_suffix("/contract")?));
+        }
+        _ => {}
+    }
+    Some(roots)
+}
+
+pub(super) fn available(project: &Project, trace: &Trace, facet: &FacetSelector) -> bool {
+    roots(project, trace.oa, facet).is_some() && roots(project, trace.sa, facet).is_some()
+}
+
+/// Used for explanation and explicit overlap controls, never for acknowledgment.
+pub(super) fn contains(group: &FacetSelector, facet: &FacetSelector) -> bool {
+    use FacetSelector as F;
+    match group {
+        F::Data(DataFacet::Constructor) => {
+            matches!(facet, F::Data(f) if *f != DataFacet::Unit) || matches!(facet, F::Literal(_))
+        }
+        F::Port(PortFacet::Constructor) => matches!(
+            facet,
+            F::Port(_)
+                | F::Member {
+                    collection: ReferenceCollection::FunctionInputItems
+                        | ReferenceCollection::FunctionOutputItems,
+                    ..
+                }
+        ),
+        F::Occurrence(OccurrenceFacet::Constructor) => {
+            matches!(facet, F::Occurrence(f) if !matches!(f, OccurrenceFacet::Precondition | OccurrenceFacet::Postcondition))
+                || matches!(
+                    facet,
+                    F::Annotation(_)
+                        | F::Binding(_)
+                        | F::Member {
+                            collection: ReferenceCollection::Steps
+                                | ReferenceCollection::FragmentBranches,
+                            ..
+                        }
+                        | F::Order(_)
+                )
+        }
+        F::Occurrence(OccurrenceFacet::MessageKind) => matches!(
+            facet,
+            F::Occurrence(OccurrenceFacet::MessageKind | OccurrenceFacet::TimerExpression)
+        ),
+        F::Event(EventFacet::Constructor) => matches!(
+            facet,
+            F::Event(_)
+                | F::Member {
+                    collection: ReferenceCollection::SignalItems,
+                    ..
+                }
+        ),
+        _ => false,
+    }
+}
+
+pub(super) fn description(facet: &FacetSelector) -> &'static str {
+    match facet {
+        FacetSelector::Data(_) => {
+            "Definition, bounds or literal members, record supertype and default. Unit stays independent."
+        }
+        FacetSelector::Port(_) => {
+            "Contract, item members and retained generic association. Owner stays independent."
+        }
+        FacetSelector::Occurrence(OccurrenceFacet::Constructor) => {
+            "Occurrence body, including references, message annotations, bindings and branch or step order. Pre/postconditions stay independent."
+        }
+        FacetSelector::Occurrence(_) => {
+            "Message kind and Timer Expression. Exchange references and annotations stay independent."
+        }
+        FacetSelector::Event(_) => {
+            "Event body, including signal items or its complete time/change expression."
+        }
+        _ => "",
+    }
+}
+
+fn chosen<T>(keys: &KeyPair<T>, layer: Layer) -> Option<&T> {
+    match layer {
+        Layer::Oa => keys.oa.as_ref(),
+        Layer::Sa => keys.sa.as_ref(),
+    }
+}
+
+// The source payload is mapped by the core's typed visitor, never by replacing
+// UUID-looking strings. For a historical same-kind Take, retain only current
+// target-present/source-absent rows with no prior source-present observation. The final core planner
+// checks this assembled record against its own independent expected result.
+pub(super) fn take_value(
+    project: &Project,
+    trace: &Trace,
+    direction: TransitionDirection,
+    facet: &FacetSelector,
+    map: &BTreeMap<Id, Id>,
+) -> Result<Value, String> {
+    let (source, target) = if direction == TransitionDirection::OaToSa {
+        (trace.oa, trace.sa)
+    } else {
+        (trace.sa, trace.oa)
+    };
+    let mut element = project
+        .elements
+        .get(&source)
+        .cloned()
+        .ok_or("Missing constructor source.")?;
+    if !message_kind::handles(facet) {
+        element.parent = None;
+        let mut missing = BTreeSet::new();
+        oa_core::references::visit_element_refs(&mut element, |id| {
+            if let Some(mapped) = map.get(id) {
+                *id = *mapped;
+            } else {
+                missing.insert(*id);
+            }
+        });
+        if !missing.is_empty() {
+            return Err(format!(
+                "Missing explicit reference correspondence: {missing:?}"
+            ));
+        }
+    }
+    let supplied = serde_json::to_value(element).map_err(|e| e.to_string())?;
+    let mut value = Draft::from_project(project, target)
+        .ok_or("Missing target draft.")?
+        .value;
+    for (from, to) in roots(project, source, facet)
+        .ok_or("Source group is unavailable.")?
+        .iter()
+        .zip(roots(project, target, facet).ok_or("Target group is unavailable.")?)
+    {
+        *value
+            .pointer_mut(&to)
+            .ok_or("Target group payload is unavailable.")? = supplied
+            .pointer(from)
+            .cloned()
+            .ok_or("Source group payload is unavailable.")?;
+    }
+    let current = capture_facet(project, trace.oa, trace.sa, facet)?;
+    if scalar::observation(&current, Layer::Oa) != scalar::observation(&current, Layer::Sa) {
+        return Ok(value);
+    }
+    let references = if direction == TransitionDirection::OaToSa {
+        map.clone()
+    } else {
+        map.iter().map(|(sa, oa)| (*oa, *sa)).collect()
+    };
+    let old = trace.baseline.as_ref().and_then(|b| b.semantic.as_ref());
+    for fact in semantic_facets(project, trace, &references)? {
+        if !contains(facet, &fact.selector) {
+            continue;
+        }
+        let Some((path, key)) =
+            target_row(project, target, &fact.selector, direction.target_layer())
+        else {
+            continue;
+        };
+        if row_present(&fact.current, direction.source_layer())
+            || !row_present(&fact.current, direction.target_layer())
+        {
+            continue;
+        }
+        let was_paired = old.is_some_and(|b| {
+            b.facets.iter().any(|previous| {
+                row_present(previous, direction.source_layer())
+                    && target_row(
+                        project,
+                        target,
+                        &previous.selector(),
+                        direction.target_layer(),
+                    )
+                    .as_ref()
+                        == Some(&(path.clone(), key.clone()))
+            })
+        });
+        if was_paired {
+            continue;
+        }
+        let row = scalar::value(&fact.current, direction.target_layer())
+            .ok_or("Target row is inapplicable.")?;
+        let items = value
+            .pointer_mut(&path)
+            .and_then(Value::as_array_mut)
+            .ok_or("Target collection is unavailable.")?;
+        match &fact.selector {
+            FacetSelector::Member { .. } | FacetSelector::Literal(_) => {
+                if row == Value::Bool(true) && !items.contains(&key) {
+                    items.push(key);
+                } else if row == Value::Bool(false) {
+                    items.retain(|v| v != &key);
+                }
+            }
+            FacetSelector::Annotation(_) => {
+                items.retain(|v| {
+                    serde_json::from_value::<MessageValue>(v.clone())
+                        .ok()
+                        .map(|v| serde_json::to_value(AnnotationKey::from(&v)).unwrap())
+                        .as_ref()
+                        != Some(&key)
+                });
+                if !row.is_null() {
+                    items.push(row);
+                }
+            }
+            FacetSelector::Binding(_) => {
+                items.retain(|v| v.get("referenced") != Some(&key));
+                if !row.is_null() {
+                    items.push(row);
+                }
+            }
+            _ => unreachable!(),
+        }
+    }
+    Ok(value)
+}
+
+fn row_present(fact: &FacetReview, layer: Layer) -> bool {
+    match fact {
+        FacetReview::Member { .. } | FacetReview::Literal { .. } => {
+            scalar::value(fact, layer) == Some(Value::Bool(true))
+        }
+        FacetReview::Annotation { .. } | FacetReview::Binding { .. } => {
+            scalar::value(fact, layer).is_some_and(|value| !value.is_null())
+        }
+        _ => false,
+    }
+}
+
+fn row_key(facet: &FacetSelector, layer: Layer) -> Option<Value> {
+    match facet {
+        FacetSelector::Member { keys, .. } | FacetSelector::Binding(keys) => {
+            chosen(keys, layer).map(|v| serde_json::json!(v))
+        }
+        FacetSelector::Literal(keys) => chosen(keys, layer).map(|v| serde_json::json!(v)),
+        FacetSelector::Annotation(keys) => chosen(keys, layer).map(|v| serde_json::json!(v)),
+        _ => None,
+    }
+}
+fn target_row(
+    project: &Project,
+    target: Id,
+    facet: &FacetSelector,
+    layer: Layer,
+) -> Option<(String, Value)> {
+    let key = row_key(facet, layer)?;
+    let (group, suffix) = match facet {
+        FacetSelector::Literal(_) => (
+            FacetSelector::Data(DataFacet::Constructor),
+            "/Enumeration/literals",
+        ),
+        FacetSelector::Binding(_) => (
+            FacetSelector::Occurrence(OccurrenceFacet::Constructor),
+            "/ScenarioUse/bindings",
+        ),
+        FacetSelector::Annotation(_) => (
+            FacetSelector::Occurrence(OccurrenceFacet::Constructor),
+            "/Exchange/values",
+        ),
+        FacetSelector::Member { collection, .. } => match collection {
+            ReferenceCollection::FunctionInputItems => (
+                FacetSelector::Port(PortFacet::Constructor),
+                "/FunctionInput/incoming_items",
+            ),
+            ReferenceCollection::FunctionOutputItems => (
+                FacetSelector::Port(PortFacet::Constructor),
+                "/FunctionOutput/outgoing_items",
+            ),
+            ReferenceCollection::SignalItems => (
+                FacetSelector::Event(EventFacet::Constructor),
+                "/Signal/items",
+            ),
+            ReferenceCollection::Steps => (
+                FacetSelector::Occurrence(OccurrenceFacet::Constructor),
+                "/Branch/occurrences",
+            ),
+            ReferenceCollection::FragmentBranches => (
+                FacetSelector::Occurrence(OccurrenceFacet::Constructor),
+                "/Fragment/branches",
+            ),
+            _ => return None,
+        },
+        _ => return None,
+    };
+    Some((
+        format!("{}{suffix}", scalar::binding(project, target, &group)?),
+        key,
+    ))
+}
+
+/// A selected descendant may fill untouched group fields during first-equal
+/// acknowledgment, but cannot silently replace an authored group field.
+pub(super) fn authored_agrees(original: &Value, authored: &Value, final_value: &Value) -> bool {
+    if original == authored || authored == final_value {
+        return true;
+    }
+    match (original, authored, final_value) {
+        (Value::Object(a), Value::Object(b), Value::Object(c)) if a.keys().eq(b.keys()) => {
+            b.iter().all(|(key, v)| {
+                c.get(key)
+                    .is_some_and(|final_value| authored_agrees(&a[key], v, final_value))
+            })
+        }
+        _ => false,
+    }
+}

crates/oa-desktop/src/semantic_review/history.rs

@@ -0,0 +1,43 @@
+use super::*;
+
+pub(super) fn resettable(facet: &FacetSelector) -> bool {
+    !matches!(facet, FacetSelector::Artifact { .. })
+}
+
+impl State {
+    pub(super) fn effective_trace(&self, project: &Project) -> Option<Trace> {
+        let mut trace = project.traces.get(&self.trace?)?.clone();
+        if let Some(baseline) = trace.baseline.as_mut().and_then(|b| b.semantic.as_mut()) {
+            baseline
+                .facets
+                .retain(|f| !self.resets.contains(&f.selector()));
+        }
+        Some(trace)
+    }
+
+    pub(super) fn reset_history(
+        &mut self,
+        project: &Project,
+        facet: FacetSelector,
+        reset: bool,
+    ) -> Result<(), String> {
+        if !reset && self.resets.remove(&facet) {
+            return Ok(());
+        }
+        let exists = self
+            .trace
+            .and_then(|id| project.traces.get(&id))
+            .and_then(|t| t.baseline.as_ref())
+            .and_then(|b| b.semantic.as_ref())
+            .is_some_and(|b| b.facets.iter().any(|f| f.selector() == facet));
+        if !exists || !resettable(&facet) {
+            return Err("Choose an exact existing non-artifact observation to reset.".into());
+        }
+        if reset {
+            self.resets.insert(facet);
+        } else {
+            self.resets.remove(&facet);
+        }
+        Ok(())
+    }
+}

crates/oa-desktop/src/semantic_review/keyed.rs

@@ -0,0 +1,263 @@
+//! Closed presence-only adapter. The core independently validates the full final record.
+use super::*;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Family {
+    Member(ReferenceCollection),
+    Literal,
+}
+impl std::fmt::Display for Family {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Self::Member(ReferenceCollection::FunctionInputItems) => "Function input items",
+            Self::Member(ReferenceCollection::FunctionOutputItems) => "Function output items",
+            Self::Member(ReferenceCollection::SignalItems) => "Signal items",
+            Self::Member(ReferenceCollection::ExchangeItems) => "Exchange items",
+            Self::Member(ReferenceCollection::TransitionTriggers) => "Transition triggers",
+            Self::Member(ReferenceCollection::TransitionEffects) => "Transition effects",
+            Self::Member(ReferenceCollection::Constrained) => "Constrained identities",
+            Self::Literal => "Enumeration literals",
+            _ => "Ordered membership (read-only)",
+        })
+    }
+}
+pub(super) const FAMILIES: [Family; 8] = [
+    Family::Member(ReferenceCollection::FunctionInputItems),
+    Family::Member(ReferenceCollection::FunctionOutputItems),
+    Family::Member(ReferenceCollection::SignalItems),
+    Family::Member(ReferenceCollection::ExchangeItems),
+    Family::Member(ReferenceCollection::TransitionTriggers),
+    Family::Member(ReferenceCollection::TransitionEffects),
+    Family::Member(ReferenceCollection::Constrained),
+    Family::Literal,
+];
+pub(super) fn family(facet: &FacetSelector) -> Option<Family> {
+    let family = match facet {
+        FacetSelector::Member { collection, .. } => Family::Member(*collection),
+        FacetSelector::Literal(_) => Family::Literal,
+        _ => return None,
+    };
+    FAMILIES.contains(&family).then_some(family)
+}
+pub(super) fn supported(facet: &FacetSelector) -> bool {
+    family(facet).is_some()
+}
+
+// Fixed paths for the seven unordered collections and the exact enum literal set.
+// They are selected by the typed facet; callers cannot supply arbitrary paths.
+pub(super) fn path(value: &Value, family: Family) -> Option<String> {
+    let prefixes = ["/body/Oa/Shared", "/body/Sa/Shared"];
+    let tails: &[&str] = match family {
+        Family::Member(ReferenceCollection::FunctionInputItems) => {
+            &["Port/contract/FunctionInput/incoming_items"]
+        }
+        Family::Member(ReferenceCollection::FunctionOutputItems) => {
+            &["Port/contract/FunctionOutput/outgoing_items"]
+        }
+        Family::Member(ReferenceCollection::SignalItems) => &["Event/body/Signal/items"],
+        Family::Member(ReferenceCollection::Constrained) => &["Constraint/constrained"],
+        Family::Literal => &["DataType/definition/Enumeration/literals"],
+        Family::Member(ReferenceCollection::ExchangeItems) => {
+            return ["Interaction", "FunctionalExchange", "BoundaryExchange"]
+                .iter()
+                .map(|kind| format!("/body/{kind}/items"))
+                .find(|p| value.pointer(p).is_some_and(Value::is_array));
+        }
+        Family::Member(ReferenceCollection::TransitionTriggers) => {
+            return value
+                .pointer("/body/StateTransition/triggers")
+                .is_some_and(Value::is_array)
+                .then(|| "/body/StateTransition/triggers".into());
+        }
+        Family::Member(ReferenceCollection::TransitionEffects) => {
+            return value
+                .pointer("/body/StateTransition/effects")
+                .is_some_and(Value::is_array)
+                .then(|| "/body/StateTransition/effects".into());
+        }
+        _ => return None,
+    };
+    prefixes
+        .iter()
+        .flat_map(|prefix| tails.iter().map(move |tail| format!("{prefix}/{tail}")))
+        .find(|p| value.pointer(p).is_some_and(Value::is_array))
+}
+fn key(facet: &FacetSelector, layer: Layer) -> Option<Value> {
+    match facet {
+        FacetSelector::Member { keys, .. } => if layer == Layer::Oa { keys.oa } else { keys.sa }
+            .map(|id| serde_json::to_value(id).expect("Id")),
+        FacetSelector::Literal(keys) => if layer == Layer::Oa {
+            keys.oa.as_ref()
+        } else {
+            keys.sa.as_ref()
+        }
+        .map(|v| Value::String(v.clone())),
+        _ => None,
+    }
+}
+pub(super) fn overlap(a: &FacetSelector, b: &FacetSelector) -> bool {
+    if family(a).is_none() || family(a) != family(b) {
+        return false;
+    }
+    [Layer::Oa, Layer::Sa]
+        .into_iter()
+        .any(|layer| key(a, layer).is_some() && key(a, layer) == key(b, layer))
+}
+pub(super) fn project_presence(
+    value: &mut Value,
+    facet: &FacetSelector,
+    layer: Layer,
+    present: bool,
+) -> Result<(), String> {
+    let family = family(facet).ok_or("This keyed family remains read-only.")?;
+    let key = key(facet, layer)
+        .ok_or("Choose the destination identity in Members before setting or taking presence.")?;
+    let path =
+        path(value, family).ok_or("This collection is not applicable to the destination kind.")?;
+    let list = value
+        .pointer_mut(&path)
+        .and_then(Value::as_array_mut)
+        .ok_or("Destination collection is unavailable.")?;
+    if present {
+        if !list.contains(&key) {
+            list.push(key);
+        }
+    } else {
+        list.retain(|v| v != &key);
+    }
+    Ok(())
+}
+
+impl State {
+    pub(super) fn keyed_value(
+        &self,
+        project: &Project,
+        trace: &Trace,
+        value: &mut Value,
+        facet: &FacetSelector,
+        decision: SemanticDecision,
+    ) -> Result<(), String> {
+        let present = match decision {
+            SemanticDecision::KeepTarget => return Ok(()),
+            SemanticDecision::TakeSource => {
+                // A missing source identity is a target-local row, not a removal.
+                if key(facet, self.direction.source_layer()).is_none() {
+                    return Ok(());
+                }
+                let fact = capture_facet(project, trace.oa, trace.sa, facet)?;
+                scalar::value(&fact, self.direction.source_layer()).and_then(|v| v.as_bool()).ok_or("Source collection is not applicable; choose an explicit final presence or Keep.")?
+            }
+            SemanticDecision::Candidate => *self
+                .presence
+                .get(facet)
+                .ok_or("Choose final membership presence.")?,
+        };
+        project_presence(value, facet, self.direction.target_layer(), present)
+    }
+
+    pub(super) fn member_families(&self, project: &Project) -> Vec<Family> {
+        let Some(trace) = self.effective_trace(project) else {
+            return vec![];
+        };
+        let values: Vec<_> = [trace.oa, trace.sa]
+            .into_iter()
+            .filter_map(|id| Draft::from_project(project, id).map(|d| d.value))
+            .collect();
+        FAMILIES
+            .into_iter()
+            .filter(|family| values.iter().any(|value| path(value, *family).is_some()))
+            .collect()
+    }
+
+    pub(super) fn member_choices(&self, project: &Project, layer: Layer) -> Vec<Choice> {
+        let Some(trace) = self.effective_trace(project) else {
+            return vec![];
+        };
+        let id = if layer == Layer::Oa {
+            trace.oa
+        } else {
+            trace.sa
+        };
+        let Some(mut draft) = Draft::from_project(project, id) else {
+            return vec![];
+        };
+        if layer == self.direction.target_layer() {
+            draft.set_context(self.combined_value(project, true).ok());
+        }
+        let selected = if layer == Layer::Oa {
+            &self.member_oa
+        } else {
+            &self.member_sa
+        };
+        let Some(path) = path(&draft.context_value(), self.member_family) else {
+            return selected.iter().cloned().collect();
+        };
+        crate::forms::reference_choices(
+            &draft,
+            project,
+            &format!("{path}/0"),
+            selected.as_ref().map_or(Id::nil(), |c| c.id),
+        )
+        .into_iter()
+        .filter(|c| !c.id.is_nil())
+        .collect()
+    }
+
+    pub(super) fn edit_pair(
+        &mut self,
+        project: &Project,
+        facet: FacetSelector,
+    ) -> Result<(), String> {
+        self.member_family = family(&facet).ok_or("This keyed family remains read-only.")?;
+        match facet {
+            FacetSelector::Member { keys, .. } => {
+                self.member_oa = keys.oa.map(|id| view::choice(project, id));
+                self.member_sa = keys.sa.map(|id| view::choice(project, id));
+            }
+            FacetSelector::Literal(keys) => {
+                self.literal_oa = keys.oa.is_some();
+                self.literal_sa = keys.sa.is_some();
+                self.literal = keys.oa.or(keys.sa).unwrap_or_default();
+            }
+            _ => unreachable!(),
+        }
+        self.tab = Tab::Members;
+        Ok(())
+    }
+
+    pub(super) fn stage_member(&mut self, project: &Project) -> Result<(), String> {
+        if !FAMILIES.contains(&self.member_family) {
+            return Err("This keyed family remains read-only.".into());
+        }
+        let facet = match self.member_family {
+            Family::Member(collection) => FacetSelector::Member {
+                collection,
+                keys: KeyPair {
+                    oa: self.member_oa.as_ref().map(|c| c.id),
+                    sa: self.member_sa.as_ref().map(|c| c.id),
+                },
+            },
+            Family::Literal => FacetSelector::Literal(KeyPair {
+                oa: self.literal_oa.then(|| self.literal.clone()),
+                sa: self.literal_sa.then(|| self.literal.clone()),
+            }),
+        };
+        let trace = self.effective_trace(project).ok_or("Choose a trace.")?;
+        capture_facet(project, trace.oa, trace.sa, &facet)?;
+        if let FacetSelector::Member {
+            keys:
+                KeyPair {
+                    oa: Some(oa),
+                    sa: Some(sa),
+                },
+            ..
+        } = &facet
+        {
+            self.references.insert(*oa, *sa);
+        }
+        self.staged.insert(facet.clone());
+        self.selected = Some(facet);
+        self.tab = Tab::Facts;
+        Ok(())
+    }
+}

crates/oa-desktop/src/semantic_review/keyed_tests.rs

@@ -0,0 +1,782 @@
+use super::{tests::*, *};
+use crate::{app::App, document::Document};
+
+fn errors(s: &State) -> String {
+    s.error
+        .iter()
+        .chain(s.plan.iter().flat_map(|p| &p.conflicts))
+        .cloned()
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+fn put(p: &mut Project, owner: Id, facet: &FacetSelector, present: bool) {
+    let layer = p.layer_of(owner).unwrap();
+    let mut value = Draft::from_project(p, owner).unwrap().value;
+    keyed::project_presence(&mut value, facet, layer, present).unwrap();
+    if let Some(element) = p.elements.get_mut(&owner) {
+        *element = serde_json::from_value(value).unwrap();
+    } else {
+        p.relations
+            .insert(owner, serde_json::from_value(value).unwrap());
+    }
+}
+fn contains(p: &Project, owner: Id, facet: &FacetSelector, oa: Id, sa: Id) -> bool {
+    scalar::value(
+        &capture_facet(p, oa, sa, facet).unwrap(),
+        p.layer_of(owner).unwrap(),
+    )
+    .unwrap()
+    .as_bool()
+    .unwrap()
+}
+fn history(p: &mut Project, trace: Id, selectors: &[FacetSelector]) {
+    let t = &p.traces[&trace];
+    let baseline = TraceBaseline {
+        oa: p.properties(t.oa).unwrap(),
+        sa: p.properties(t.sa).unwrap(),
+        semantic: Some(SemanticBaseline {
+            facets: selectors
+                .iter()
+                .map(|s| capture_facet(p, t.oa, t.sa, s).unwrap())
+                .collect(),
+        }),
+    };
+    p.traces.get_mut(&trace).unwrap().baseline = Some(baseline);
+}
+fn literal(name: &str) -> FacetSelector {
+    FacetSelector::Literal(KeyPair {
+        oa: Some(name.into()),
+        sa: Some(name.into()),
+    })
+}
+fn enum_pair() -> (Project, Id, Id, Id) {
+    let mut p = Project::empty();
+    let mut ids = vec![];
+    for layer in [Layer::Oa, Layer::Sa] {
+        let id = p.add_element(Kind::DataType, layer, "Enum", None).unwrap();
+        *p.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::DataType {
+            definition: DataTypeDefinition::Enumeration {
+                literals: vec!["retained".into()],
+            },
+            default: Some(DataValue::Enumeration("retained".into())),
+            unit: String::new(),
+        };
+        ids.push(id);
+    }
+    let trace = add_trace(&mut p, ids[0], ids[1], "Literal review");
+    (p, ids[0], ids[1], trace)
+}
+fn member_pair(collection: ReferenceCollection) -> (Project, Id, Id, Id, FacetSelector, [Id; 2]) {
+    let mut p = Project::empty();
+    let mut owners = vec![];
+    let mut keys = vec![];
+    let mut locals = vec![];
+    for layer in [Layer::Oa, Layer::Sa] {
+        let work = if layer == Layer::Oa {
+            Kind::Activity
+        } else {
+            Kind::Function
+        };
+        let kind = match collection {
+            ReferenceCollection::TransitionTriggers => Kind::Event,
+            ReferenceCollection::TransitionEffects | ReferenceCollection::Constrained => work,
+            _ => Kind::ExchangeItem,
+        };
+        let key = p.add_element(kind, layer, "Mapped member", None).unwrap();
+        let local = p.add_element(kind, layer, "Local member", None).unwrap();
+        let owner = match collection {
+            ReferenceCollection::SignalItems => {
+                let id = p.add_element(Kind::Event, layer, "Signal", None).unwrap();
+                *p.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Event {
+                    body: EventBody::Signal { items: vec![] },
+                };
+                id
+            }
+            ReferenceCollection::Constrained => p
+                .add_element(Kind::Constraint, layer, "Constraint", None)
+                .unwrap(),
+            ReferenceCollection::ExchangeItems => {
+                let a = p.add_element(work, layer, "From", None).unwrap();
+                let b = p.add_element(work, layer, "To", None).unwrap();
+                let id = p.relate(
+                    if layer == Layer::Oa {
+                        RelationKind::Interaction
+                    } else {
+                        RelationKind::FunctionalExchange
+                    },
+                    "Exchange",
+                    a,
+                    b,
+                );
+                if let RelationBody::FunctionalExchange {
+                    source_port,
+                    target_port,
+                    ..
+                } = p.relations[&id].body
+                {
+                    for port in [source_port, target_port] {
+                        if let Some(SharedBody::Port { contract, .. }) =
+                            p.elements.get_mut(&port).unwrap().shared_mut()
+                        {
+                            match contract {
+                                PortContract::FunctionInput { incoming_items } => {
+                                    *incoming_items = vec![key, local]
+                                }
+                                PortContract::FunctionOutput { outgoing_items } => {
+                                    *outgoing_items = vec![key, local]
+                                }
+                                _ => unreachable!(),
+                            }
+                        }
+                    }
+                }
+                id
+            }
+            ReferenceCollection::TransitionTriggers | ReferenceCollection::TransitionEffects => {
+                let machine = p
+                    .add_element(Kind::StateMachine, layer, "Machine", None)
+                    .unwrap();
+                let region = p
+                    .add_element(Kind::Region, layer, "Region", Some(machine))
+                    .unwrap();
+                let state = p
+                    .add_element(Kind::State, layer, "State", Some(region))
+                    .unwrap();
+                p.relate(RelationKind::StateTransition, "Transition", state, state)
+            }
+            ReferenceCollection::FunctionInputItems | ReferenceCollection::FunctionOutputItems => {
+                let parent = p.add_element(work, layer, "Owner", None).unwrap();
+                let id = Id::new_v4();
+                let contract = if layer == Layer::Oa {
+                    PortContract::Legacy
+                } else if collection == ReferenceCollection::FunctionInputItems {
+                    PortContract::FunctionInput {
+                        incoming_items: vec![],
+                    }
+                } else {
+                    PortContract::FunctionOutput {
+                        outgoing_items: vec![],
+                    }
+                };
+                let mut port = ports::make_port(&p, id, parent, "Port", contract).unwrap();
+                if layer == Layer::Oa
+                    && let Some(SharedBody::Port { legacy, .. }) = port.shared_mut()
+                {
+                    *legacy = Some(LegacyPortContract {
+                        direction: PortDirection::InOut,
+                        interface: None,
+                    });
+                }
+                p.elements.insert(id, port);
+                id
+            }
+            _ => unreachable!(),
+        };
+        owners.push(owner);
+        keys.push(key);
+        locals.push(local);
+    }
+    let trace = add_trace(&mut p, owners[0], owners[1], "Membership review");
+    let facet = FacetSelector::Member {
+        collection,
+        keys: KeyPair {
+            oa: Some(keys[0]),
+            sa: Some(keys[1]),
+        },
+    };
+    (
+        p,
+        owners[0],
+        owners[1],
+        trace,
+        facet,
+        [locals[0], locals[1]],
+    )
+}
+fn stage(app: &mut App, facet: &FacetSelector) {
+    send(app, Event::EditPair(facet.clone()));
+    send(app, Event::StageMember);
+    assert_eq!(
+        state(app).selected.as_ref(),
+        Some(facet),
+        "{}",
+        errors(state(app))
+    );
+}
+
+#[test]
+fn unordered_members_keep_take_candidate_preserve_other_rows_both_directions() {
+    for collection in [
+        ReferenceCollection::SignalItems,
+        ReferenceCollection::ExchangeItems,
+        ReferenceCollection::TransitionTriggers,
+        ReferenceCollection::TransitionEffects,
+        ReferenceCollection::Constrained,
+    ] {
+        for reverse in [false, true] {
+            for decision in [
+                SemanticDecision::KeepTarget,
+                SemanticDecision::TakeSource,
+                SemanticDecision::Candidate,
+            ] {
+                let (mut p, oa, sa, trace, facet, locals) = member_pair(collection);
+                let (source, target, local) = if reverse {
+                    (sa, oa, locals[0])
+                } else {
+                    (oa, sa, locals[1])
+                };
+                put(&mut p, source, &facet, true);
+                let local_facet = FacetSelector::Member {
+                    collection,
+                    keys: KeyPair {
+                        oa: reverse.then_some(local),
+                        sa: (!reverse).then_some(local),
+                    },
+                };
+                put(&mut p, target, &local_facet, true);
+                let mut app = App::with_project(p);
+                let before = app.document.snapshot();
+                start(&mut app, source);
+                stage(&mut app, &facet);
+                decide(&mut app, facet.clone(), decision);
+                if decision == SemanticDecision::Candidate {
+                    send(&mut app, Event::Presence(facet.clone(), true));
+                }
+                // A target-only Take is an explicit acknowledgment, never implicit removal.
+                decide(&mut app, local_facet.clone(), SemanticDecision::TakeSource);
+                assert!(
+                    state(&app).can_apply(),
+                    "{collection:?} reverse={reverse} {decision:?}: {}",
+                    errors(state(&app))
+                );
+                let proposed = state(&app).proposed.clone().unwrap();
+                assert_eq!(app.document.bundle(), &before.bundle);
+                apply(&mut app);
+                assert!(app.workflow.is_none(), "{}", app.status);
+                assert_eq!(app.project(), &proposed);
+                assert_eq!(
+                    contains(app.project(), target, &facet, oa, sa),
+                    decision != SemanticDecision::KeepTarget
+                );
+                assert!(contains(app.project(), target, &local_facet, oa, sa));
+                assert!(app.project().elements.contains_key(&local));
+                assert_eq!(
+                    app.project().traces[&trace]
+                        .baseline
+                        .as_ref()
+                        .unwrap()
+                        .semantic
+                        .as_ref()
+                        .unwrap()
+                        .facets
+                        .len(),
+                    2
+                );
+                let _ = app.update(Message::Undo);
+                assert_eq!(app.document.bundle(), &before.bundle);
+            }
+        }
+    }
+}
+
+#[test]
+fn function_port_members_use_existing_typed_choices_and_preserve_oa_legacy() {
+    for collection in [
+        ReferenceCollection::FunctionInputItems,
+        ReferenceCollection::FunctionOutputItems,
+    ] {
+        let (p, oa, sa, _, facet, _) = member_pair(collection);
+        let FacetSelector::Member { keys, .. } = &facet else {
+            unreachable!()
+        };
+        let mut app = App::with_project(p);
+        start(&mut app, oa);
+        assert_eq!(
+            state(&app).member_families(app.project()),
+            vec![keyed::Family::Member(collection)]
+        );
+        send(&mut app, Event::EditPair(facet.clone()));
+        assert!(
+            state(&app)
+                .member_choices(app.project(), Layer::Sa)
+                .iter()
+                .any(|c| Some(c.id) == keys.sa)
+        );
+        send(&mut app, Event::StageMember);
+        decide(&mut app, facet.clone(), SemanticDecision::Candidate);
+        send(&mut app, Event::Presence(facet.clone(), true));
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        apply(&mut app);
+        assert!(contains(app.project(), sa, &facet, oa, sa));
+        assert!(matches!(
+            app.project().elements[&oa].shared(),
+            Some(SharedBody::Port {
+                contract: PortContract::Legacy,
+                ..
+            })
+        ));
+        start(&mut app, sa);
+        stage(&mut app, &facet);
+        decide(&mut app, facet.clone(), SemanticDecision::KeepTarget);
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        decide(&mut app, facet.clone(), SemanticDecision::Candidate);
+        send(&mut app, Event::Presence(facet, true));
+        assert!(
+            !state(&app).can_apply(),
+            "OA typed membership must remain inapplicable"
+        );
+    }
+}
+
+#[test]
+fn exact_literal_new_rows_and_removals_commit_both_directions_without_default_loss() {
+    for reverse in [false, true] {
+        let (mut p, oa, sa, _) = enum_pair();
+        let (source, target) = if reverse { (sa, oa) } else { (oa, sa) };
+        let incoming = literal(" New value ");
+        put(&mut p, source, &incoming, true);
+        let removed = literal("old");
+        put(&mut p, target, &removed, true);
+        let created = literal("new value");
+        let mut app = App::with_project(p);
+        start(&mut app, source);
+        for (facet, decision) in [
+            (&incoming, SemanticDecision::TakeSource),
+            (&removed, SemanticDecision::Candidate),
+            (&created, SemanticDecision::Candidate),
+        ] {
+            stage(&mut app, facet);
+            decide(&mut app, facet.clone(), decision);
+            if decision == SemanticDecision::Candidate {
+                send(&mut app, Event::Presence(facet.clone(), facet == &created));
+            }
+        }
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        apply(&mut app);
+        assert!(contains(app.project(), target, &incoming, oa, sa));
+        assert!(contains(app.project(), target, &created, oa, sa));
+        assert!(!contains(app.project(), target, &removed, oa, sa));
+        assert!(
+            matches!(app.project().elements[&target].shared(),Some(SharedBody::DataType { default: Some(DataValue::Enumeration(value)), .. }) if value=="retained")
+        );
+        let reopened = Document::from_bundle(
+            app.document.bundle().clone(),
+            source_project::ProjectLimits::default(),
+        )
+        .unwrap();
+        assert_eq!(reopened.project(), app.project());
+    }
+}
+
+#[test]
+fn exact_reset_only_is_one_history_source_transaction_and_undo_redo_both_directions() {
+    for reverse in [false, true] {
+        let (mut p, oa, sa, trace) = enum_pair();
+        let reset = literal("retained");
+        let kept = FacetSelector::Header(HeaderFacet::Name);
+        history(&mut p, trace, &[reset.clone(), kept.clone()]);
+        let previous = p.traces[&trace].baseline.clone().unwrap();
+        let mut app = App::with_project(p);
+        let mut bundle = app.document.bundle().clone();
+        bundle
+            .files
+            .get_mut(&bundle.entry)
+            .unwrap()
+            .insert_str(0, "// Exact review rationale survives reset.\n");
+        app.document.apply_bundle(bundle).unwrap();
+        let before = app.document.snapshot();
+        let revision = app.document.revision();
+        start(&mut app, if reverse { sa } else { oa });
+        send(&mut app, Event::Reset(reset.clone(), true));
+        assert!(state(&app).decisions.is_empty());
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        assert_eq!(
+            state(&app)
+                .facts
+                .iter()
+                .find(|f| f.selector == reset)
+                .unwrap()
+                .drift,
+            Drift::Unreviewed
+        );
+        send(&mut app, Event::Reset(reset.clone(), false));
+        assert!(!state(&app).can_apply());
+        assert_eq!(
+            state(&app)
+                .facts
+                .iter()
+                .find(|f| f.selector == reset)
+                .unwrap()
+                .drift,
+            Drift::Unchanged
+        );
+        send(&mut app, Event::Reset(reset, true));
+        apply(&mut app);
+        assert_eq!(app.document.revision(), revision + 1);
+        assert_eq!(app.project().elements, before.decoded.project.elements);
+        let after = &app.project().traces[&trace].baseline.as_ref().unwrap();
+        assert_eq!(after.oa, previous.oa);
+        assert_eq!(after.sa, previous.sa);
+        assert_eq!(
+            after
+                .semantic
+                .as_ref()
+                .unwrap()
+                .facets
+                .iter()
+                .map(FacetReview::selector)
+                .collect::<Vec<_>>(),
+            vec![kept]
+        );
+        assert!(
+            app.document.bundle().files[&app.document.bundle().entry]
+                .contains("// Exact review rationale survives reset.")
+        );
+        let accepted = app.document.snapshot();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before.bundle);
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &accepted.bundle);
+    }
+}
+
+#[test]
+fn historical_one_sided_pair_migration_requires_exact_reset_and_explicit_overlap_resolution() {
+    for reverse in [false, true] {
+        let (mut p, oa, sa, trace, paired, _) = member_pair(ReferenceCollection::SignalItems);
+        let FacetSelector::Member { collection, keys } = &paired else {
+            unreachable!()
+        };
+        let (source, target) = if reverse { (sa, oa) } else { (oa, sa) };
+        let previous = FacetSelector::Member {
+            collection: *collection,
+            keys: KeyPair {
+                oa: if reverse { None } else { keys.oa },
+                sa: if reverse { keys.sa } else { None },
+            },
+        };
+        put(&mut p, source, &paired, true);
+        history(&mut p, trace, std::slice::from_ref(&previous));
+        let mut app = App::with_project(p);
+        start(&mut app, source);
+        decide(&mut app, previous.clone(), SemanticDecision::KeepTarget);
+        stage(&mut app, &paired);
+        decide(&mut app, paired.clone(), SemanticDecision::Candidate);
+        send(&mut app, Event::Presence(paired.clone(), true));
+        assert!(!state(&app).can_apply());
+        assert_eq!(state(&app).decisions.len(), 2);
+        send(&mut app, Event::Decide(previous.clone(), None));
+        assert!(
+            !state(&app).can_apply(),
+            "Historic pair cannot silently migrate"
+        );
+        send(&mut app, Event::Reset(previous.clone(), true));
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        send(&mut app, Event::Reset(previous, false));
+        assert!(!state(&app).can_apply());
+        assert!(state(&app).presence[&paired]);
+        let old = state(&app).resets.clone();
+        assert!(old.is_empty());
+        let historic = app.project().traces[&trace]
+            .baseline
+            .as_ref()
+            .unwrap()
+            .semantic
+            .as_ref()
+            .unwrap()
+            .facets[0]
+            .selector();
+        send(&mut app, Event::Reset(historic, true));
+        apply(&mut app);
+        assert!(contains(app.project(), target, &paired, oa, sa));
+        assert_eq!(
+            app.project().traces[&trace]
+                .baseline
+                .as_ref()
+                .unwrap()
+                .semantic
+                .as_ref()
+                .unwrap()
+                .facets[0]
+                .selector(),
+            paired
+        );
+    }
+}
+
+#[test]
+fn reset_precedes_equal_constructor_candidate_and_preserves_independent_literal_draft() {
+    for reverse in [false, true] {
+        let (mut p, oa, sa, trace) = enum_pair();
+        let ctor = FacetSelector::Data(DataFacet::Constructor);
+        history(&mut p, trace, std::slice::from_ref(&ctor));
+        let mut app = App::with_project(p);
+        start(&mut app, if reverse { sa } else { oa });
+        let created = literal("separate");
+        stage(&mut app, &created);
+        decide(&mut app, created.clone(), SemanticDecision::Candidate);
+        send(&mut app, Event::Presence(created.clone(), true));
+        send(&mut app, Event::Reset(ctor.clone(), true));
+        decide(&mut app, ctor.clone(), SemanticDecision::Candidate);
+        assert!(state(&app).can_acknowledge_constructor(app.project(), &ctor));
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        let reviewed = &state(&app).plan.as_ref().unwrap().reviews[0];
+        assert_eq!(
+            reviewed
+                .acknowledged
+                .iter()
+                .cloned()
+                .collect::<BTreeSet<_>>(),
+            BTreeSet::from([ctor.clone(), created.clone()])
+        );
+        assert!(reviewed.retired.is_empty());
+        send(&mut app, Event::Reset(ctor.clone(), false));
+        assert!(!state(&app).can_apply());
+        assert!(state(&app).presence[&created]);
+        send(&mut app, Event::Reset(ctor, true));
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+    }
+}
+
+#[test]
+fn invalid_literal_removal_and_unselected_scalar_buffers_are_retained_and_repairable() {
+    let (p, oa, _, _) = enum_pair();
+    let mut app = App::with_project(p);
+    start(&mut app, oa);
+    let unit = FacetSelector::Data(DataFacet::Unit);
+    decide(&mut app, unit.clone(), SemanticDecision::Candidate);
+    send(
+        &mut app,
+        Event::Input(
+            "/body/Sa/Shared/DataType/unit".into(),
+            "  untouched unit ".into(),
+        ),
+    );
+    decide(&mut app, unit.clone(), SemanticDecision::KeepTarget);
+    let retained = literal("retained");
+    decide(&mut app, retained.clone(), SemanticDecision::Candidate);
+    send(&mut app, Event::Presence(retained.clone(), false));
+    assert!(
+        !state(&app).can_apply(),
+        "Existing default must prevent removal"
+    );
+    assert!(!state(&app).presence[&retained]);
+    send(&mut app, Event::Presence(retained.clone(), true));
+    assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+    assert_eq!(
+        state(&app).draft.as_ref().unwrap().inputs["/body/Sa/Shared/DataType/unit"].raw,
+        "  untouched unit "
+    );
+    decide(&mut app, unit, SemanticDecision::Candidate);
+    assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+}
+
+#[test]
+fn unsupported_independent_families_and_missing_identities_do_not_gain_edit_authority() {
+    let (p, oa, _, _) = enum_pair();
+    let mut app = App::with_project(p);
+    start(&mut app, oa);
+    let unsupported = FacetSelector::Member {
+        collection: ReferenceCollection::Steps,
+        keys: KeyPair {
+            oa: Some(oa),
+            sa: None,
+        },
+    };
+    decide(&mut app, unsupported.clone(), SemanticDecision::Candidate);
+    assert!(!state(&app).decisions.contains_key(&unsupported));
+    send(&mut app, Event::MemberFamily(keyed::Family::Literal));
+    send(&mut app, Event::Literal("unpaired".into()));
+    send(&mut app, Event::LiteralSide(Layer::Sa, false));
+    send(&mut app, Event::StageMember);
+    let facet = state(&app).selected.clone().unwrap();
+    decide(&mut app, facet.clone(), SemanticDecision::Candidate);
+    assert!(!state(&app).can_apply());
+    send(&mut app, Event::LiteralSide(Layer::Oa, false));
+    send(&mut app, Event::StageMember);
+    assert!(state(&app).error.is_some());
+    assert_eq!(
+        state(&app).decisions.get(&facet),
+        Some(&SemanticDecision::Candidate)
+    );
+}
+
+#[test]
+fn deleted_member_source_observation_removes_only_mapped_membership_both_directions() {
+    for reverse in [false, true] {
+        let (mut p, oa, sa, trace, facet, locals) = member_pair(ReferenceCollection::SignalItems);
+        let FacetSelector::Member { keys, .. } = &facet else {
+            unreachable!()
+        };
+        let (source, target, deleted, local) = if reverse {
+            (sa, oa, keys.sa.unwrap(), locals[0])
+        } else {
+            (oa, sa, keys.oa.unwrap(), locals[1])
+        };
+        let target_only = FacetSelector::Member {
+            collection: ReferenceCollection::SignalItems,
+            keys: KeyPair {
+                oa: reverse.then_some(local),
+                sa: (!reverse).then_some(local),
+            },
+        };
+        put(&mut p, source, &facet, true);
+        put(&mut p, target, &facet, true);
+        put(&mut p, target, &target_only, true);
+        history(&mut p, trace, std::slice::from_ref(&facet));
+        p = prepare_command(&p, &Command::Delete(deleted))
+            .unwrap()
+            .project;
+        let mut app = App::with_project(p);
+        start(&mut app, source);
+        stage(&mut app, &facet);
+        decide(&mut app, facet.clone(), SemanticDecision::TakeSource);
+        // Force mixed final-record composition, as well as the core Take projection.
+        let name = FacetSelector::Header(HeaderFacet::Name);
+        decide(&mut app, name, SemanticDecision::Candidate);
+        assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+        apply(&mut app);
+        assert!(!contains(app.project(), target, &facet, oa, sa));
+        assert!(contains(app.project(), target, &target_only, oa, sa));
+        let retained = if reverse {
+            keys.oa.unwrap()
+        } else {
+            keys.sa.unwrap()
+        };
+        assert!(app.project().elements.contains_key(&retained));
+    }
+}
+
+#[test]
+fn stale_or_source_failed_reset_and_membership_apply_retain_exact_choices() {
+    let (mut p, oa, _, trace) = enum_pair();
+    let reset = FacetSelector::Header(HeaderFacet::Name);
+    history(&mut p, trace, std::slice::from_ref(&reset));
+    let mut app = App::with_project(p.clone());
+    start(&mut app, oa);
+    send(&mut app, Event::Reset(reset.clone(), true));
+    app.document
+        .execute(Command::Rename(oa, "Changed after preview".into()))
+        .unwrap();
+    let before = app.document.snapshot();
+    apply(&mut app);
+    assert!(state(&app).error.as_ref().unwrap().contains("stale"));
+    assert!(state(&app).resets.contains(&reset));
+    assert_eq!(app.document.bundle(), &before.bundle);
+    let mut app = App::with_project(p);
+    let bundle = app.document.bundle().clone();
+    let mut limits = source_project::ProjectLimits::default();
+    limits.model.max_source_bytes = bundle.files.values().map(String::len).sum::<usize>() + 10;
+    app.document = Document::from_bundle(bundle, limits).unwrap();
+    start(&mut app, oa);
+    send(&mut app, Event::Reset(reset.clone(), true));
+    let added = literal(&" exact long literal ".repeat(100));
+    stage(&mut app, &added);
+    decide(&mut app, added.clone(), SemanticDecision::Candidate);
+    send(&mut app, Event::Presence(added.clone(), true));
+    assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+    let before = app.document.snapshot();
+    apply(&mut app);
+    assert!(state(&app).error.is_some());
+    assert!(state(&app).resets.contains(&reset));
+    assert_eq!(
+        state(&app).decisions.get(&added),
+        Some(&SemanticDecision::Candidate)
+    );
+    assert!(state(&app).presence[&added]);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn member_identity_labels_and_new_tabs_preserve_exact_names_and_deleted_keys() {
+    let (mut p, oa, _, trace, facet, _) = member_pair(ReferenceCollection::SignalItems);
+    let FacetSelector::Member { collection, keys } = &facet else {
+        unreachable!()
+    };
+    p.elements.get_mut(&keys.oa.unwrap()).unwrap().name = "Absent intentionally in name".into();
+    let name = view::title(&p, &facet);
+    assert!(name.contains("Absent intentionally in name"));
+    let deleted1 = Id::new_v4();
+    let deleted2 = Id::new_v4();
+    let old1 = FacetSelector::Member {
+        collection: *collection,
+        keys: KeyPair {
+            oa: Some(deleted1),
+            sa: None,
+        },
+    };
+    let old2 = FacetSelector::Member {
+        collection: *collection,
+        keys: KeyPair {
+            oa: Some(deleted2),
+            sa: None,
+        },
+    };
+    history(&mut p, trace, &[old1.clone(), old2.clone()]);
+    assert!(view::title(&p, &old1).contains(&deleted1.to_string()));
+    assert_ne!(view::title(&p, &old1), view::title(&p, &old2));
+    assert_ne!(
+        view::title(&p, &literal("Absent")),
+        view::title(
+            &p,
+            &FacetSelector::Literal(KeyPair {
+                oa: None,
+                sa: Some("Absent".into())
+            })
+        )
+    );
+    let mut app = App::with_project(p);
+    start(&mut app, oa);
+    for tab in [Tab::History, Tab::Members, Tab::Facts] {
+        send(&mut app, Event::Tab(tab));
+        let _ = state(&app).view(app.project());
+    }
+    send(&mut app, Event::Reset(old1.clone(), true));
+    assert!(state(&app).can_apply(), "{}", errors(state(&app)));
+    assert!(!state(&app).facts.iter().any(|f| f.selector == old1));
+    assert!(state(&app).facts.iter().any(|f| f.selector == old2));
+}
+
+#[test]
+fn staging_removal_and_obsolete_reset_recovery_keep_other_decisions_and_raw_presence() {
+    let (mut p, oa, _, trace) = enum_pair();
+    let reset = FacetSelector::Header(HeaderFacet::Name);
+    history(&mut p, trace, std::slice::from_ref(&reset));
+    let mut app = App::with_project(p.clone());
+    start(&mut app, oa);
+    send(&mut app, Event::Reset(reset.clone(), true));
+    let added = literal("staged draft");
+    stage(&mut app, &added);
+    decide(&mut app, added.clone(), SemanticDecision::Candidate);
+    send(&mut app, Event::Presence(added.clone(), true));
+    send(&mut app, Event::DropStaged(added.clone()));
+    assert!(state(&app).decisions.is_empty());
+    assert!(!state(&app).staged.contains(&added));
+    assert!(state(&app).presence[&added]);
+    assert!(state(&app).can_apply());
+    stage(&mut app, &added);
+    decide(&mut app, added.clone(), SemanticDecision::Candidate);
+    assert!(state(&app).presence[&added]);
+    p.traces
+        .get_mut(&trace)
+        .unwrap()
+        .baseline
+        .as_mut()
+        .unwrap()
+        .semantic
+        .as_mut()
+        .unwrap()
+        .facets
+        .clear();
+    let crate::workflow::Workflow::Semantic(s) = app.workflow.as_mut().unwrap() else {
+        unreachable!()
+    };
+    s.refresh(&p);
+    assert!(!s.can_apply());
+    s.tab = Tab::History;
+    let _ = s.view(&p);
+    s.update(&p, Event::Reset(reset, false));
+    assert!(s.can_apply(), "{}", errors(s));
+    assert_eq!(s.decisions.get(&added), Some(&SemanticDecision::Candidate));
+}

crates/oa-desktop/src/semantic_review/message_kind.rs

@@ -0,0 +1,24 @@
+//! The first supported constructor group is the closed nested MessageKind.
+//! The core owns its acknowledgment/retirement and validation policies.
+use super::*;
+
+pub(super) fn selector() -> FacetSelector {
+    FacetSelector::Occurrence(OccurrenceFacet::MessageKind)
+}
+#[cfg(test)]
+pub(super) fn timer_selector() -> FacetSelector {
+    FacetSelector::Occurrence(OccurrenceFacet::TimerExpression)
+}
+pub(super) fn handles(facet: &FacetSelector) -> bool {
+    *facet == selector()
+}
+#[cfg(test)]
+pub(super) fn value(project: &Project, id: Id) -> Option<&MessageKind> {
+    match project.elements.get(&id)?.shared()? {
+        SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange { message_kind, .. },
+            ..
+        } => Some(message_kind),
+        _ => None,
+    }
+}

crates/oa-desktop/src/semantic_review/message_kind_tests.rs

@@ -0,0 +1,717 @@
+use super::{tests::*, *};
+use crate::{app::App, document::Document};
+use serde_json::json;
+
+fn fixture(oa_kind: MessageKind, sa_kind: MessageKind) -> (Project, Id, Id, Id) {
+    let mut p = Project::empty();
+    let mut ids = vec![];
+    for (layer, message_kind) in [(Layer::Oa, oa_kind), (Layer::Sa, sa_kind)] {
+        let scenario = p
+            .add_element(Kind::Scenario, layer, "Scenario", None)
+            .unwrap();
+        let id = p
+            .add_element(Kind::Occurrence, layer, "Message", Some(scenario))
+            .unwrap();
+        *p.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: None,
+                sender: None,
+                receiver: None,
+                message_kind,
+                reply_to: None,
+                values: vec![],
+            },
+            precondition: "retain precondition".into(),
+            postcondition: "retain postcondition".into(),
+        };
+        p.elements
+            .get_mut(&scenario)
+            .unwrap()
+            .steps_mut()
+            .unwrap()
+            .push(id);
+        ids.push(id);
+    }
+    let trace = add_trace(&mut p, ids[0], ids[1], "Message-kind review");
+    (p, ids[0], ids[1], trace)
+}
+fn timer(value: &str) -> MessageKind {
+    MessageKind::Timer {
+        expression: value.into(),
+    }
+}
+fn path(layer: &str) -> String {
+    format!("/body/{layer}/Shared/Occurrence/body/Exchange/message_kind")
+}
+fn set_kind(p: &mut Project, id: Id, kind: MessageKind) {
+    let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange { message_kind, .. },
+        ..
+    }) = p.elements.get_mut(&id).unwrap().shared_mut()
+    else {
+        panic!()
+    };
+    *message_kind = kind;
+}
+fn seed_history(p: &mut Project, trace: Id) {
+    let t = &p.traces[&trace];
+    let baseline = TraceBaseline {
+        oa: p.properties(t.oa).unwrap(),
+        sa: p.properties(t.sa).unwrap(),
+        semantic: Some(SemanticBaseline {
+            facets: [message_kind::selector(), message_kind::timer_selector()]
+                .iter()
+                .map(|selector| capture_facet(p, t.oa, t.sa, selector).unwrap())
+                .collect(),
+        }),
+    };
+    p.traces.get_mut(&trace).unwrap().baseline = Some(baseline);
+}
+fn acknowledged(app: &App) -> BTreeSet<FacetSelector> {
+    state(app).plan.as_ref().unwrap().reviews[0]
+        .acknowledged
+        .iter()
+        .cloned()
+        .collect()
+}
+fn failures(app: &App) -> String {
+    state(app)
+        .error
+        .iter()
+        .chain(state(app).plan.iter().flat_map(|p| &p.conflicts))
+        .cloned()
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+#[test]
+fn message_group_take_full_timer_and_scalar_candidate_are_one_source_history_change_both_directions()
+ {
+    for reverse in [false, true] {
+        let expression = "  after β ≥ 5 s\n\tkeep exact whitespace  ";
+        let (p, oa, sa, trace) = if reverse {
+            fixture(MessageKind::Asynchronous, timer(expression))
+        } else {
+            fixture(timer(expression), MessageKind::Asynchronous)
+        };
+        let (source, target) = if reverse { (sa, oa) } else { (oa, sa) };
+        let mut app = App::with_project(p);
+        let mut bundle = app.document.bundle().clone();
+        bundle
+            .files
+            .get_mut(&bundle.entry)
+            .unwrap()
+            .insert_str(0, "// Keep the engineering review rationale.\r\n");
+        app.document.apply_bundle(bundle).unwrap();
+        let before = app.document.snapshot();
+        let revision = app.document.revision();
+        start(&mut app, source);
+        decide(
+            &mut app,
+            message_kind::selector(),
+            SemanticDecision::TakeSource,
+        );
+        decide(
+            &mut app,
+            FacetSelector::Header(HeaderFacet::Name),
+            SemanticDecision::Candidate,
+        );
+        send(
+            &mut app,
+            Event::Input("/name".into(), "Reviewed message".into()),
+        );
+        assert!(state(&app).can_apply(), "{:?}", state(&app).error);
+        assert_eq!(
+            acknowledged(&app),
+            BTreeSet::from([
+                message_kind::selector(),
+                message_kind::timer_selector(),
+                FacetSelector::Header(HeaderFacet::Name)
+            ])
+        );
+        assert!(
+            state(&app).plan.as_ref().unwrap().reviews[0]
+                .retired
+                .is_empty()
+        );
+        assert!(state(&app).plan.as_ref().unwrap().impacts.is_empty());
+        let expected = state(&app).proposed.clone().unwrap();
+        assert_eq!(
+            message_kind::value(&expected, target),
+            Some(&timer(expression))
+        );
+        assert_eq!(app.document.bundle(), &before.bundle);
+        apply(&mut app);
+        assert_eq!(app.project(), &expected);
+        assert_eq!(app.document.revision(), revision + 1);
+        assert_eq!(
+            app.project().elements[&source],
+            before.decoded.project.elements[&source]
+        );
+        let saved = app.document.bundle().clone();
+        assert!(saved.files[&saved.entry].starts_with("// Keep the engineering review rationale."));
+        assert_eq!(
+            Document::from_bundle(saved.clone(), source_project::ProjectLimits::default())
+                .unwrap()
+                .snapshot()
+                .decoded
+                .project,
+            expected
+        );
+        let facts = &app.project().traces[&trace]
+            .baseline
+            .as_ref()
+            .unwrap()
+            .semantic
+            .as_ref()
+            .unwrap()
+            .facets;
+        assert_eq!(facts.len(), 3);
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before.bundle);
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &saved);
+    }
+}
+
+#[test]
+fn message_group_candidate_timer_switches_preserve_both_drafts_and_overlap_is_explicit() {
+    let (p, oa, _, _) = fixture(MessageKind::Asynchronous, timer("original target"));
+    let mut app = App::with_project(p);
+    let before = app.document.snapshot();
+    let kind = path("Sa");
+    let expression = format!("{kind}/Timer/expression");
+    start(&mut app, oa);
+    decide(
+        &mut app,
+        message_kind::timer_selector(),
+        SemanticDecision::Candidate,
+    );
+    send(
+        &mut app,
+        Event::Input(expression.clone(), "independent scalar timer".into()),
+    );
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::Candidate,
+    );
+    assert_eq!(state(&app).decisions.len(), 2);
+    assert!(!state(&app).can_apply());
+    send(
+        &mut app,
+        Event::Input(expression.clone(), "  group β timer\n\t  ".into()),
+    );
+    send(
+        &mut app,
+        Event::Text(expression.clone(), text_editor::Action::SelectAll),
+    );
+    let cursor = state(&app)
+        .group_drafts
+        .get(&message_kind::selector())
+        .unwrap()
+        .inputs[&expression]
+        .editor
+        .cursor();
+    let selection = state(&app)
+        .group_drafts
+        .get(&message_kind::selector())
+        .unwrap()
+        .inputs[&expression]
+        .editor
+        .selection();
+    send(
+        &mut app,
+        Event::Variant(kind.clone(), json!("Asynchronous")),
+    );
+    send(
+        &mut app,
+        Event::Variant(kind, json!({"Timer":{"expression":""}})),
+    );
+    assert_eq!(
+        state(&app)
+            .group_drafts
+            .get(&message_kind::selector())
+            .unwrap()
+            .inputs[&expression]
+            .raw,
+        "  group β timer\n\t  "
+    );
+    assert_eq!(
+        state(&app)
+            .group_drafts
+            .get(&message_kind::selector())
+            .unwrap()
+            .inputs[&expression]
+            .editor
+            .cursor(),
+        cursor
+    );
+    assert_eq!(
+        state(&app)
+            .group_drafts
+            .get(&message_kind::selector())
+            .unwrap()
+            .inputs[&expression]
+            .editor
+            .selection(),
+        selection
+    );
+    assert_eq!(
+        state(&app).draft.as_ref().unwrap().inputs[&expression].raw,
+        "independent scalar timer"
+    );
+    assert!(!state(&app).can_apply());
+    assert_eq!(app.document.bundle(), &before.bundle);
+    // The visible overlap-resolution actions only change the explicitly chosen
+    // decision. Neither independent candidate buffer is discarded.
+    send(&mut app, Event::Decide(message_kind::selector(), None));
+    assert!(state(&app).can_apply());
+    send(
+        &mut app,
+        Event::Decide(message_kind::timer_selector(), None),
+    );
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::Candidate,
+    );
+    assert!(state(&app).can_apply(), "{:?}", state(&app).error);
+    assert_eq!(
+        acknowledged(&app),
+        BTreeSet::from([message_kind::selector(), message_kind::timer_selector()])
+    );
+    let _ = state(&app).view(app.project());
+    let expected = state(&app).proposed.clone().unwrap();
+    apply(&mut app);
+    assert_eq!(app.project(), &expected);
+}
+
+#[test]
+fn message_group_keep_historical_switch_retires_timer_and_completed_no_switch_rejects() {
+    let (mut p, oa, sa, trace) = fixture(timer("old OA"), timer("old SA"));
+    seed_history(&mut p, trace);
+    set_kind(&mut p, oa, MessageKind::Asynchronous);
+    set_kind(&mut p, sa, MessageKind::Asynchronous);
+    let mut app = App::with_project(p);
+    start(&mut app, oa);
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::KeepTarget,
+    );
+    assert!(state(&app).can_apply(), "{:?}", state(&app).error);
+    assert_eq!(
+        acknowledged(&app),
+        BTreeSet::from([message_kind::selector()])
+    );
+    assert_eq!(
+        state(&app).plan.as_ref().unwrap().reviews[0].retired,
+        vec![message_kind::timer_selector()]
+    );
+    apply(&mut app);
+    assert_eq!(
+        app.project().traces[&trace]
+            .baseline
+            .as_ref()
+            .unwrap()
+            .semantic
+            .as_ref()
+            .unwrap()
+            .facets
+            .len(),
+        1
+    );
+    start(&mut app, oa);
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::KeepTarget,
+    );
+    assert!(!state(&app).can_apply());
+    assert!(
+        failures(&app).contains("No constructor switch"),
+        "{}",
+        failures(&app)
+    );
+}
+
+#[test]
+fn message_group_reply_and_reference_take_require_explicit_call_mapping_both_directions() {
+    for reverse in [false, true] {
+        let (mut p, oa, sa, _) = if reverse {
+            fixture(MessageKind::Asynchronous, MessageKind::Reply)
+        } else {
+            fixture(MessageKind::Reply, MessageKind::Asynchronous)
+        };
+        let (source, target, layer) = if reverse {
+            (sa, oa, "Oa")
+        } else {
+            (oa, sa, "Sa")
+        };
+        let mut calls = vec![];
+        for message in [oa, sa] {
+            let scenario = p.elements[&message].parent.unwrap();
+            let layer = p.elements[&message].layer();
+            let call = p
+                .add_element(Kind::Occurrence, layer, "Correlated call", Some(scenario))
+                .unwrap();
+            *p.elements.get_mut(&call).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+                body: OccurrenceBody::Exchange {
+                    exchange: None,
+                    sender: None,
+                    receiver: None,
+                    message_kind: MessageKind::Call,
+                    reply_to: None,
+                    values: vec![],
+                },
+                precondition: String::new(),
+                postcondition: String::new(),
+            };
+            p.elements
+                .get_mut(&scenario)
+                .unwrap()
+                .steps_mut()
+                .unwrap()
+                .insert(0, call);
+            if message == source {
+                let Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Exchange { reply_to, .. },
+                    ..
+                }) = p.elements.get_mut(&message).unwrap().shared_mut()
+                else {
+                    panic!()
+                };
+                *reply_to = Some(call);
+            }
+            calls.push(call);
+        }
+        let target_call = if reverse { calls[0] } else { calls[1] };
+        let mut app = App::with_project(p);
+        let before = app.document.snapshot();
+        start(&mut app, source);
+        decide(
+            &mut app,
+            message_kind::selector(),
+            SemanticDecision::Candidate,
+        );
+        send(&mut app, Event::Variant(path(layer), json!("Reply")));
+        decide(
+            &mut app,
+            FacetSelector::Occurrence(OccurrenceFacet::ReplyTo),
+            SemanticDecision::TakeSource,
+        );
+        assert!(!state(&app).can_apply());
+        assert!(
+            failures(&app).contains("reference counterparts"),
+            "{}",
+            failures(&app)
+        );
+        send(
+            &mut app,
+            Event::ReferenceOa(Choice {
+                id: calls[0],
+                label: "OA call".into(),
+            }),
+        );
+        send(
+            &mut app,
+            Event::ReferenceSa(Choice {
+                id: calls[1],
+                label: "SA call".into(),
+            }),
+        );
+        send(&mut app, Event::AddReference);
+        assert!(state(&app).can_apply(), "{}", failures(&app));
+        assert_eq!(
+            acknowledged(&app),
+            BTreeSet::from([
+                message_kind::selector(),
+                FacetSelector::Occurrence(OccurrenceFacet::ReplyTo)
+            ])
+        );
+        let final_value =
+            serde_json::to_value(&state(&app).proposed.as_ref().unwrap().elements[&target])
+                .unwrap();
+        assert_eq!(
+            final_value.pointer(&format!(
+                "/body/{layer}/Shared/Occurrence/body/Exchange/reply_to"
+            )),
+            Some(&json!(target_call))
+        );
+        assert_eq!(app.document.bundle(), &before.bundle);
+        apply(&mut app);
+        assert_eq!(
+            message_kind::value(app.project(), target),
+            Some(&MessageKind::Reply)
+        );
+        for call in calls {
+            assert_eq!(
+                app.project().elements[&call],
+                before.decoded.project.elements[&call]
+            );
+        }
+    }
+}
+
+#[test]
+fn message_group_candidate_closed_kinds_are_core_validated_in_both_directions() {
+    for reverse in [false, true] {
+        for kind in [
+            MessageKind::Asynchronous,
+            MessageKind::Call,
+            MessageKind::Reply,
+            MessageKind::Create,
+            MessageKind::Delete,
+            timer("after 2 s"),
+        ] {
+            let (p, oa, sa, _) = fixture(MessageKind::Asynchronous, MessageKind::Asynchronous);
+            let (source, target, layer) = if reverse {
+                (sa, oa, "Oa")
+            } else {
+                (oa, sa, "Sa")
+            };
+            let mut app = App::with_project(p);
+            start(&mut app, source);
+            decide(
+                &mut app,
+                message_kind::selector(),
+                SemanticDecision::Candidate,
+            );
+            send(
+                &mut app,
+                Event::Variant(path(layer), serde_json::to_value(&kind).unwrap()),
+            );
+            assert!(state(&app).can_apply(), "{kind:?}: {}", failures(&app));
+            assert_eq!(
+                message_kind::value(state(&app).proposed.as_ref().unwrap(), target),
+                Some(&kind)
+            );
+            assert_eq!(
+                acknowledged(&app).contains(&message_kind::timer_selector()),
+                matches!(kind, MessageKind::Timer { .. })
+            );
+            assert!(state(&app).plan.as_ref().unwrap().impacts.is_empty());
+        }
+    }
+    let (mut p, oa, _, _) = fixture(MessageKind::Asynchronous, MessageKind::Asynchronous);
+    let mut review = State::new(&p, oa).unwrap();
+    let Some(SharedBody::Occurrence { body, .. }) = p.elements.get_mut(&oa).unwrap().shared_mut()
+    else {
+        panic!()
+    };
+    *body = OccurrenceBody::Action {
+        action: None,
+        lifeline: None,
+    };
+    review.refresh(&p);
+    assert!(
+        !review.editable(&p, &message_kind::selector()),
+        "An externally changed outer occurrence requires its own constructor review"
+    );
+    review.update(
+        &p,
+        Event::Decide(message_kind::selector(), Some(SemanticDecision::Candidate)),
+    );
+    assert!(review.decisions.is_empty());
+    assert!(!review.can_apply());
+}
+
+#[test]
+fn message_group_timer_does_not_erase_exchange_without_its_own_selected_decision() {
+    let (mut p, oa, sa, _) = fixture(MessageKind::Asynchronous, MessageKind::Asynchronous);
+    let sender = p
+        .add_element(Kind::Function, Layer::Sa, "Sender", None)
+        .unwrap();
+    let receiver = p
+        .add_element(Kind::Function, Layer::Sa, "Receiver", None)
+        .unwrap();
+    let exchange = p.relate(
+        RelationKind::FunctionalExchange,
+        "Message exchange",
+        sender,
+        receiver,
+    );
+    let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange {
+            exchange: selected, ..
+        },
+        ..
+    }) = p.elements.get_mut(&sa).unwrap().shared_mut()
+    else {
+        panic!()
+    };
+    *selected = Some(exchange);
+    let mut app = App::with_project(p);
+    let before = app.document.snapshot();
+    start(&mut app, oa);
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::Candidate,
+    );
+    send(
+        &mut app,
+        Event::Variant(path("Sa"), json!({"Timer":{"expression":"after 2 s"}})),
+    );
+    assert!(!state(&app).can_apply());
+    assert!(
+        failures(&app).contains("timer_contract"),
+        "{}",
+        failures(&app)
+    );
+    assert_eq!(state(&app).decisions.len(), 1);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    decide(
+        &mut app,
+        FacetSelector::Occurrence(OccurrenceFacet::Exchange),
+        SemanticDecision::Candidate,
+    );
+    send(
+        &mut app,
+        Event::Shape(
+            "/body/Sa/Shared/Occurrence/body/Exchange/exchange".into(),
+            Value::Null,
+        ),
+    );
+    assert!(state(&app).can_apply(), "{}", failures(&app));
+    assert_eq!(
+        acknowledged(&app),
+        BTreeSet::from([
+            message_kind::selector(),
+            message_kind::timer_selector(),
+            FacetSelector::Occurrence(OccurrenceFacet::Exchange)
+        ])
+    );
+    assert!(state(&app).plan.as_ref().unwrap().impacts.is_empty());
+    apply(&mut app);
+    assert_eq!(
+        app.project().relations[&exchange],
+        before.decoded.project.relations[&exchange]
+    );
+}
+
+#[test]
+fn message_group_initial_equal_take_acknowledges_only_kind_and_checks_authored_timer_agreement() {
+    let (p, oa, sa, _) = fixture(timer("source timer"), timer("target timer"));
+    let mut app = App::with_project(p);
+    start(&mut app, oa);
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::TakeSource,
+    );
+    decide(
+        &mut app,
+        FacetSelector::Header(HeaderFacet::Name),
+        SemanticDecision::Candidate,
+    );
+    send(&mut app, Event::Input("/name".into(), "Final name".into()));
+    assert!(state(&app).can_apply(), "{:?}", state(&app).error);
+    assert_eq!(
+        message_kind::value(state(&app).proposed.as_ref().unwrap(), sa),
+        Some(&timer("target timer"))
+    );
+    assert!(!acknowledged(&app).contains(&message_kind::timer_selector()));
+    let expression = format!("{}/Timer/expression", path("Sa"));
+    decide(
+        &mut app,
+        message_kind::selector(),
+        SemanticDecision::Candidate,
+    );
+    send(
+        &mut app,
+        Event::Input(expression.clone(), "authored group timer".into()),
+    );
+    assert!(
+        !state(&app).can_apply(),
+        "An unchanged initial kind cannot silently authorize a timer edit"
+    );
+    decide(
+        &mut app,
+        message_kind::timer_selector(),
+        SemanticDecision::Candidate,
+    );
+    send(
+        &mut app,
+        Event::Input(expression.clone(), "different scalar timer".into()),
+    );
+    assert!(!state(&app).can_apply());
+    assert!(
+        state(&app)
+            .error
+            .as_ref()
+            .unwrap()
+            .contains("different final values")
+    );
+    send(
+        &mut app,
+        Event::Input(expression, "authored group timer".into()),
+    );
+    assert!(state(&app).can_apply(), "{:?}", state(&app).error);
+    assert!(acknowledged(&app).contains(&message_kind::timer_selector()));
+    assert_eq!(
+        message_kind::value(state(&app).proposed.as_ref().unwrap(), sa),
+        Some(&timer("authored group timer"))
+    );
+}
+
+#[test]
+fn message_group_rejects_protected_edits_stale_plan_and_source_failure_without_losing_timer() {
+    for source_failure in [false, true] {
+        let (p, oa, _, _) = fixture(MessageKind::Asynchronous, timer("target"));
+        let mut app = App::with_project(p);
+        if source_failure {
+            let bundle = app.document.bundle().clone();
+            let mut limits = source_project::ProjectLimits::default();
+            limits.model.max_source_bytes =
+                bundle.files.values().map(String::len).sum::<usize>() + 10;
+            app.document = Document::from_bundle(bundle, limits).unwrap();
+        }
+        start(&mut app, oa);
+        decide(
+            &mut app,
+            message_kind::selector(),
+            SemanticDecision::Candidate,
+        );
+        let expression = format!("{}/Timer/expression", path("Sa"));
+        let raw = "retain exact timer β\n".repeat(40);
+        send(&mut app, Event::Input(expression.clone(), raw.clone()));
+        assert!(state(&app).can_apply(), "{:?}", state(&app).error);
+        send(
+            &mut app,
+            Event::Input("/name".into(), "Unselected protected scope".into()),
+        );
+        assert!(!state(&app).can_apply());
+        assert!(
+            state(&app)
+                .error
+                .as_ref()
+                .unwrap()
+                .contains("selected review")
+        );
+        send(&mut app, Event::Preview);
+        assert!(state(&app).can_apply());
+        if !source_failure {
+            app.document
+                .execute(Command::Rename(oa, "External source edit".into()))
+                .unwrap();
+        }
+        let before = app.document.snapshot();
+        let revision = app.document.revision();
+        apply(&mut app);
+        assert!(state(&app).error.is_some());
+        assert_eq!(state(&app).decisions.len(), 1);
+        assert_eq!(
+            state(&app)
+                .group_drafts
+                .get(&message_kind::selector())
+                .unwrap()
+                .inputs[&expression]
+                .raw,
+            raw
+        );
+        assert_eq!(app.document.bundle(), &before.bundle);
+        assert_eq!(app.document.revision(), revision);
+    }
+}

crates/oa-desktop/src/semantic_review/tests.rs

@@ -2,13 +2,13 @@ use super::*;
 use crate::{app::App, document::Document, workflow::Workflow};
 use serde_json::json;
 
-fn send(app: &mut App, event: Event) {
+pub(super) fn send(app: &mut App, event: Event) {
     let _ = app.update(Message::Workflow(crate::workflow::Event::Semantic(event)));
 }
-fn apply(app: &mut App) {
+pub(super) fn apply(app: &mut App) {
     let _ = app.update(Message::Workflow(crate::workflow::Event::Apply));
 }
-fn state(app: &App) -> &State {
+pub(super) fn state(app: &App) -> &State {
     let Some(Workflow::Semantic(state)) = &app.workflow else {
         panic!("Semantic workflow missing: {}", app.status)
     };
@@ -35,7 +35,7 @@ fn fixture() -> (Project, Id, Id, Id) {
     let trace = add_trace(&mut p, oa, sa, "Range rationale");
     (p, oa, sa, trace)
 }
-fn add_trace(p: &mut Project, oa: Id, sa: Id, name: &str) -> Id {
+pub(super) fn add_trace(p: &mut Project, oa: Id, sa: Id, name: &str) -> Id {
     let id = Id::new_v4();
     p.traces.insert(
         id,
@@ -52,7 +52,7 @@ fn add_trace(p: &mut Project, oa: Id, sa: Id, name: &str) -> Id {
     );
     id
 }
-fn start(app: &mut App, source: Id) {
+pub(super) fn start(app: &mut App, source: Id) {
     let _ = app.update(Message::StartSemanticReview(source));
 }
 fn facet(value: DataFacet) -> FacetSelector {
@@ -262,7 +262,7 @@ fn independent_review_keyed_fact_titles_keep_live_deleted_and_qualified_identity
     assert!(second_title.contains(&b.to_string()));
     assert_ne!(super::view::title(&p, &annotation(vec![])), first_title);
 }
-fn decide(app: &mut App, selected: FacetSelector, decision: SemanticDecision) {
+pub(super) fn decide(app: &mut App, selected: FacetSelector, decision: SemanticDecision) {
     send(app, Event::Select(selected.clone()));
     send(app, Event::Decide(selected, Some(decision)));
 }
@@ -386,7 +386,7 @@ fn invalid_numeric_draft_and_protected_edits_retain_workflow_and_source() {
             .error
             .as_ref()
             .unwrap()
-            .contains("selected scalar")
+            .contains("selected review")
     );
     assert_eq!(app.project(), &before.decoded.project);
     send(&mut app, Event::Preview);
@@ -568,7 +568,10 @@ fn read_only_structured_facts_and_partial_rollup_are_honest() {
     send(
         &mut app,
         Event::Decide(
-            facet(DataFacet::Constructor),
+            FacetSelector::Literal(KeyPair {
+                oa: Some("Unpaired".into()),
+                sa: None,
+            }),
             Some(SemanticDecision::TakeSource),
         ),
     );

crates/oa-desktop/src/semantic_review/view.rs

@@ -71,27 +71,37 @@ pub(super) fn group(facet: &FacetSelector) -> &'static str {
     }
 }
 pub(super) fn title(project: &Project, facet: &FacetSelector) -> String {
-    let keys = |keys: &KeyPair<Id>| {
+    let keys = |keys: &KeyPair<Id>, missing: &str| {
         format!(
             "{} ↔ {}",
             keys.oa
                 .map(|id| choice(project, id).label)
-                .unwrap_or_else(|| "Absent".into()),
+                .unwrap_or_else(|| missing.into()),
             keys.sa
                 .map(|id| choice(project, id).label)
-                .unwrap_or_else(|| "Absent".into())
+                .unwrap_or_else(|| missing.into())
         )
     };
     match facet {
         FacetSelector::Member {
             collection,
             keys: pair,
-        } => format!("{} · {}", words(&format!("{collection:?}")), keys(pair)),
+        } => format!(
+            "{} · {}",
+            words(&format!("{collection:?}")),
+            keys(pair, "No identity")
+        ),
         FacetSelector::Order(collection) => format!("{} order", words(&format!("{collection:?}"))),
         FacetSelector::Literal(pair) => format!(
             "Literal · {} ↔ {}",
-            pair.oa.as_deref().unwrap_or("Absent"),
+            pair.oa
-            pair.sa.as_deref().unwrap_or("Absent")
+                .as_ref()
+                .map(|s| format!("{s:?}"))
+                .unwrap_or_else(|| "No identity".into()),
+            pair.sa
+                .as_ref()
+                .map(|s| format!("{s:?}"))
+                .unwrap_or_else(|| "No identity".into())
         ),
         FacetSelector::Annotation(pair) => format!(
             "Message value · {} ↔ {}",
@@ -104,11 +114,17 @@ pub(super) fn title(project: &Project, facet: &FacetSelector) -> String {
                 .map(|key| annotation_title(project, key))
                 .unwrap_or_else(|| "Absent".into())
         ),
-        FacetSelector::Binding(pair) => format!("Lifeline binding · {}", keys(pair)),
+        FacetSelector::Binding(pair) => format!("Lifeline binding · {}", keys(pair, "Absent")),
-        FacetSelector::Child(pair) => format!("Owned child · {}", keys(pair)),
+        FacetSelector::Child(pair) => format!("Owned child · {}", keys(pair, "Absent")),
-        FacetSelector::Incident { keys: pair, end } => format!("Incident {end:?} · {}", keys(pair)),
+        FacetSelector::Incident { keys: pair, end } => {
+            format!("Incident {end:?} · {}", keys(pair, "Absent"))
+        }
         FacetSelector::Artifact { keys: pair, facet } => {
-            format!("Artifact {} · {}", words(&format!("{facet:?}")), keys(pair))
+            format!(
+                "Artifact {} · {}",
+                words(&format!("{facet:?}")),
+                keys(pair, "Absent")
+            )
         }
         _ => {
             let json = serde_json::to_value(facet).expect("Typed selector");
@@ -199,6 +215,12 @@ fn observed(project: &Project, fact: Option<&FacetReview>, layer: Layer) -> Stri
     let value = scalar::observation(fact, layer);
     if value.as_str() == Some("NotApplicable") {
         "Not applicable".into()
+    } else if keyed::supported(&fact.selector()) {
+        if value["Value"].as_bool() == Some(true) {
+            "Present".into()
+        } else {
+            "Absent".into()
+        }
     } else {
         formatted(project, &value["Value"], &scalar::references(fact))
     }
@@ -237,11 +259,13 @@ impl State {
                 action(direction, Event::Direction(if self.direction == TransitionDirection::OaToSa { TransitionDirection::SaToOa } else { TransitionDirection::OaToSa })),
             ].spacing(8),
             text("Changing trace or direction starts a new review draft. Other pending edits remain separate.").size(10).color(style::MUTED),
-            row![action("Properties", Event::Tab(Tab::Facts)), action(format!("Reference pairs ({})", self.references.len()), Event::Tab(Tab::References)), action(format!("Additional changes ({})", self.plan.as_ref().map_or(0, |p| p.impacts.len())), Event::Tab(Tab::Impacts)), Space::new().width(Fill), action("Refresh preview", Event::Preview)].spacing(6),
+            row![action("Properties", Event::Tab(Tab::Facts)), action("Members / literals", Event::Tab(Tab::Members)), action(format!("History ({})", self.resets.len()), Event::Tab(Tab::History)), action(format!("Reference pairs ({})", self.references.len()), Event::Tab(Tab::References)), action(format!("Additional changes ({})", self.plan.as_ref().map_or(0, |p| p.impacts.len())), Event::Tab(Tab::Impacts)), Space::new().width(Fill), action("Refresh preview", Event::Preview)].spacing(6).wrap(),
         ].spacing(8);
         let body = match self.tab {
             Tab::Facts => self.facts_view(project),
             Tab::References => self.references_view(project),
+            Tab::Members => self.members_view(project),
+            Tab::History => self.history_view(project),
             Tab::Impacts => self.impacts_view(project),
         };
         content = content.push(body);
@@ -266,7 +290,7 @@ impl State {
             .iter()
             .filter(|f| f.drift == Drift::Unreviewed)
             .count();
-        content = content.push(text(format!("{} selected decisions · {unreviewed} currently unreviewed facts · Constructors and structured collections require further review.", self.decisions.len())).size(10).color(style::MUTED));
+        content = content.push(text(format!("{} decisions · {} exact resets · {unreviewed} unreviewed facts · Ordered, annotation, binding and attached-record decisions remain pending.", self.decisions.len(), self.resets.len())).size(10).color(style::MUTED));
         if let Some(trace) = trace {
             content = content.push(text(summary(project, trace)).size(10).color(style::MUTED));
         }
@@ -364,7 +388,43 @@ impl State {
             .and_then(|t| t.baseline.as_ref())
             .and_then(|b| b.semantic.as_ref())
             .and_then(|b| b.facets.iter().find(|f| f.selector() == fact.selector));
+        let is_group = scalar::grouped(&fact.selector);
+        let group_observations = |project: &Project, facts: Vec<&FacetReview>, layer| {
+            facts
+                .into_iter()
+                .filter(|f| constructors::contains(&fact.selector, &f.selector()))
+                .map(|f| {
+                    format!(
+                        "{}: {}",
+                        title(project, &f.selector()),
+                        observed(project, Some(f), layer)
+                    )
+                })
+                .collect::<Vec<_>>()
+                .join("\n")
+        };
         let side = |layer, label: &str| {
+            let mut before = observed(project, previous, layer);
+            let mut current = observed(project, Some(&fact.current), layer);
+            if is_group {
+                before = group_observations(
+                    project,
+                    trace
+                        .and_then(|t| t.baseline.as_ref())
+                        .and_then(|b| b.semantic.as_ref())
+                        .map(|b| b.facets.iter().collect())
+                        .unwrap_or_default(),
+                    layer,
+                );
+                if before.is_empty() {
+                    before = "No previous group observations".into();
+                }
+                current = group_observations(
+                    project,
+                    self.facts.iter().map(|f| &f.current).collect(),
+                    layer,
+                );
+            }
             column![
                 text(format!(
                     "{label}{}",
@@ -377,9 +437,9 @@ impl State {
                 .size(12)
                 .color(style::TEAL),
                 text("Previously reviewed").size(10).color(style::MUTED),
-                text(observed(project, previous, layer)).size(12),
+                text(before).size(12),
                 text("Current").size(10).color(style::MUTED),
-                text(observed(project, Some(&fact.current), layer)).size(12),
+                text(current).size(12),
             ]
             .spacing(5)
             .width(Fill)
@@ -390,6 +450,38 @@ impl State {
             row![side(Layer::Oa, "Operational"), side(Layer::Sa, "System")].spacing(14)
         ]
         .spacing(10);
+        if previous.is_some() && history::resettable(&fact.selector) {
+            let facet = fact.selector.clone();
+            detail = detail.push(
+                checkbox(self.resets.contains(&facet))
+                    .label("Reset this exact previous observation before review")
+                    .text_size(11)
+                    .on_toggle(move |v| event(Event::Reset(facet.clone(), v))),
+            );
+        }
+        if keyed::supported(&fact.selector) {
+            detail = detail.push(text("Presence changes only this collection entry; referenced objects stay intact. Take preserves a row with no source identity. An explicit source identity that is absent can remove its mapped destination entry.").size(11))
+                .push(action("Choose / change exact row identities…", Event::EditPair(fact.selector.clone())));
+            if let Some(baseline) = trace
+                .and_then(|t| t.baseline.as_ref())
+                .and_then(|b| b.semantic.as_ref())
+            {
+                for prior in &baseline.facets {
+                    let prior = prior.selector();
+                    if prior != fact.selector && keyed::overlap(&prior, &fact.selector) {
+                        detail = detail.push(
+                            checkbox(self.resets.contains(&prior))
+                                .label(format!(
+                                    "Reset overlapping history: {}",
+                                    title(project, &prior)
+                                ))
+                                .text_size(11)
+                                .on_toggle(move |v| event(Event::Reset(prior.clone(), v))),
+                        );
+                    }
+                }
+            }
+        }
         if let Some(proposed) = &self.proposed
             && let Some(trace) = trace
             && let Ok(after) = capture_facet(proposed, trace.oa, trace.sa, &fact.selector)
@@ -401,11 +493,20 @@ impl State {
                         .color(style::TEAL),
                 )
                 .push(
-                    text(observed(
+                    text(if is_group {
+                        semantic_facets(proposed, &proposed.traces[&trace.id], &self.references)
+                            .ok()
+                            .map(|facts| {
+                                group_observations(
                                     proposed,
-                        Some(&after),
+                                    facts.iter().map(|f| &f.current).collect(),
                                     self.direction.target_layer(),
-                    ))
+                                )
+                            })
+                            .unwrap_or_else(|| "Group payload is unavailable.".into())
+                    } else {
+                        observed(proposed, Some(&after), self.direction.target_layer())
+                    })
                     .size(12),
                 );
         } else {
@@ -416,6 +517,13 @@ impl State {
             );
         }
         if self.editable(project, &fact.selector) {
+            if is_group {
+                detail = detail.push(text(constructors::description(&fact.selector)).size(12));
+                detail = detail.push(text("Replacing a kind reviews its complete payload. Review every removed reference, row and prior observation in the exact scope below; changing kind retains your draft for switching back.").size(11));
+                if self.can_acknowledge_constructor(project, &fact.selector) {
+                    detail = detail.push(text("These initial kinds are equal. Keep or Take acknowledges only the kind; an unchanged Candidate kind needs independent descendant decisions for payload edits.").size(11).color(style::MUTED));
+                }
+            }
             let destination = if self.direction.target_layer() == Layer::Sa {
                 "System"
             } else {
@@ -438,30 +546,120 @@ impl State {
             ]
             .spacing(5);
             buttons = buttons.push(action(
-                "Set final value…",
+                if is_group {
+                    "Set final kind and payload…"
+                } else {
+                    "Set final value…"
+                },
                 Event::Decide(fact.selector.clone(), Some(SemanticDecision::Candidate)),
             ));
-            detail = detail.push(buttons).push(action(
+            detail = detail.push(buttons.wrap()).push(action(
                 "Leave unselected",
                 Event::Decide(fact.selector.clone(), None),
             ));
             if self.decisions.get(&fact.selector) == Some(&SemanticDecision::Candidate)
-                && let Some(draft) = &self.draft
+                && keyed::supported(&fact.selector)
-                && let Some(path) = self
-                    .target(project)
-                    .and_then(|id| scalar::binding(project, id, &fact.selector))
             {
-                detail = detail.push(text("Final destination value").size(12)).push(
+                let facet = fact.selector.clone();
-                    crate::forms::scoped(draft, project, &path, &title(project, &fact.selector))
+                detail = detail.push(
+                    checkbox(self.presence.get(&facet).copied().unwrap_or(false))
+                        .label(
+                            "Include in destination collection (unchecked removes only this entry)",
+                        )
+                        .text_size(12)
+                        .on_toggle(move |v| event(Event::Presence(facet.clone(), v))),
+                );
+            }
+            if self.decisions.get(&fact.selector) == Some(&SemanticDecision::Candidate)
+                && let Some(draft) = self.candidate_draft(&fact.selector)
+                && let Some(paths) = self
+                    .target(project)
+                    .and_then(|id| constructors::roots(project, id, &fact.selector))
+            {
+                detail = detail.push(text("Final destination value").size(12));
+                for path in paths {
+                    let label = if path.ends_with("/default") {
+                        "Default"
+                    } else if path.ends_with("/legacy") {
+                        "Generic association"
+                    } else {
+                        "Kind and payload"
+                    };
+                    detail = detail.push(
+                        crate::forms::scoped(
+                            draft,
+                            project,
+                            &path,
+                            if is_group { label } else { "Final value" },
+                        )
                         .map(form_event),
                     );
                 }
+            }
         } else if self.can_acknowledge_constructor(project, &fact.selector) {
             detail = detail.push(text("Both constructor kinds are equal and have no prior observation. Acknowledge only the kind; its properties remain independent.").size(12))
                 .push(action("Acknowledge equal kind only", Event::Decide(fact.selector.clone(), Some(SemanticDecision::KeepTarget))))
                 .push(action("Leave unselected", Event::Decide(fact.selector.clone(), None)));
         } else {
-            detail = detail.push(text(if scalar::grouped(&fact.selector) { "Constructor groups are shown for comparison. Group replacement and its complete descendant review are a later milestone." } else { "This structured or inapplicable fact is read-only here. Its review history is retained." }).size(12).color(style::MUTED));
+            detail = detail.push(text(if scalar::grouped(&fact.selector) { "This constructor is unavailable on one of the current counterparts. Review the outer constructor before its nested kind." } else { "This structured or inapplicable fact is read-only here. Its review history is retained." }).size(12).color(style::MUTED));
+        }
+        if self.staged.contains(&fact.selector) {
+            detail = detail.push(action(
+                "Remove staged address and its decision",
+                Event::DropStaged(fact.selector.clone()),
+            ));
+        }
+        let overlaps: Vec<_> = self
+            .decisions
+            .keys()
+            .filter(|other| {
+                **other != fact.selector
+                    && (constructors::contains(&fact.selector, other)
+                        || constructors::contains(other, &fact.selector)
+                        || keyed::overlap(other, &fact.selector))
+            })
+            .collect();
+        if self.decisions.contains_key(&fact.selector) && !overlaps.is_empty() {
+            detail = detail.push(text("Related decisions are selected. Paired rows cannot review the same OA or SA identity twice. Replacing groups require one combined decision; first equal-kind acknowledgments may coexist with descendants. Resolve overlaps explicitly; all drafts are retained.").size(11));
+            for other in overlaps {
+                detail = detail.push(action(
+                    format!("Leave {} unselected", title(project, other)),
+                    Event::Decide(other.clone(), None),
+                ));
+            }
+            detail = detail.push(action(
+                "Leave this decision unselected; use the related decisions",
+                Event::Decide(fact.selector.clone(), None),
+            ));
+        }
+        if (is_group
+            || keyed::supported(&fact.selector)
+            || constructors::selectors().iter().any(|group| {
+                self.decisions.contains_key(group) && constructors::contains(group, &fact.selector)
+            }))
+            && let Some(review) = self.plan.as_ref().and_then(|p| p.reviews.first())
+        {
+            detail = detail.push(text("Exact review scope from preview").size(13));
+            for (label, selectors) in [
+                ("Acknowledge", &review.acknowledged),
+                ("Retire previous observation", &review.retired),
+            ] {
+                detail = detail.push(
+                    text(format!(
+                        "{label}: {}",
+                        if selectors.is_empty() {
+                            "None".into()
+                        } else {
+                            selectors
+                                .iter()
+                                .map(|s| title(project, s))
+                                .collect::<Vec<_>>()
+                                .join(", ")
+                        }
+                    ))
+                    .size(11),
+                );
+            }
         }
         if matches!(
             fact.selector,
@@ -474,10 +672,106 @@ impl State {
         detail.into()
     }
 
+    fn members_view<'a>(&'a self, project: &'a Project) -> Element<'a, Message> {
+        let families = self.member_families(project);
+        let available = families.contains(&self.member_family);
+        let mut content = column![
+            text("Review an individual member or literal").size(16),
+            text("Choose an address, then review its presence in Properties. This also stages a new row in an empty collection. No model object is created.").size(12),
+            pick_list(families, Some(self.member_family), |v| event(Event::MemberFamily(v))).text_size(12).padding(7),
+        ].spacing(9);
+        if !available {
+            content = content.push(text("This collection is not available on the current counterparts. Choose an available collection above; existing staged addresses remain removable below.").size(12));
+        } else if self.member_family == keyed::Family::Literal {
+            content = content.push(text("Literal identity is exact, including case and spaces. Both sides use the same string; a rename requires separate old/new rows.").size(11))
+                .push(text_input("Exact literal", &self.literal).on_input(|v| event(Event::Literal(v))).size(12).padding(7))
+                .push(row![checkbox(self.literal_oa).label("Operational identity").text_size(12).on_toggle(|v| event(Event::LiteralSide(Layer::Oa,v))), checkbox(self.literal_sa).label("System identity").text_size(12).on_toggle(|v| event(Event::LiteralSide(Layer::Sa,v)))].spacing(12));
+        } else {
+            content = content.push(text("Identities may exist outside the collection. Choosing both explicitly sets their OA → SA correspondence. No identity means an unpaired side, distinct from an absent member.").size(11))
+                .push(row![pick_list(self.member_choices(project, Layer::Oa), self.member_oa.clone(), |v| event(Event::MemberOa(Some(v)))).placeholder("Operational identity").text_size(12).padding(7).width(Fill), action("No OA identity", Event::MemberOa(None))].spacing(7))
+                .push(row![pick_list(self.member_choices(project, Layer::Sa), self.member_sa.clone(), |v| event(Event::MemberSa(Some(v)))).placeholder("System identity").text_size(12).padding(7).width(Fill), action("No SA identity", Event::MemberSa(None))].spacing(7));
+        }
+        content = content.push(button(text("Use these identities and review presence").size(12)).padding([7,9]).style(style::nav).on_press_maybe(available.then_some(event(Event::StageMember))))
+            .push(text("Changing a row address retains its earlier decisions and drafts. Reset conflicting historical observations and leave overlapping decisions unselected explicitly.").size(11).color(style::MUTED));
+        if !self.staged.is_empty() {
+            content = content.push(text("Staged addresses in this draft").size(13));
+            for facet in &self.staged {
+                content = content.push(
+                    row![
+                        text(title(project, facet)).size(11).width(Fill),
+                        action(
+                            "Remove address / decision",
+                            Event::DropStaged(facet.clone())
+                        )
+                    ]
+                    .spacing(7),
+                );
+            }
+        }
+        scrollable(content).height(305).into()
+    }
+
+    fn history_view<'a>(&'a self, project: &'a Project) -> Element<'a, Message> {
+        let mut content = column![text("Exact previous observations").size(16), text("Check only the observations to forget. Resets run before this review's decisions; reset alone changes history, not model values. Uncheck to restore the pending observation. Prose history remains separate.").size(12)].spacing(9);
+        let baseline = self
+            .trace
+            .and_then(|id| project.traces.get(&id))
+            .and_then(|t| t.baseline.as_ref())
+            .and_then(|b| b.semantic.as_ref());
+        if baseline.is_none_or(|b| b.facets.is_empty()) {
+            content =
+                content.push(text("No previous semantic observations on this trace.").size(12));
+        }
+        if let Some(baseline) = baseline {
+            for fact in &baseline.facets {
+                let facet = fact.selector();
+                let mut item = column![
+                    text(title(project, &facet)).size(13),
+                    text(format!(
+                        "Operational: {}\nSystem: {}",
+                        observed(project, Some(fact), Layer::Oa),
+                        observed(project, Some(fact), Layer::Sa)
+                    ))
+                    .size(11)
+                ]
+                .spacing(4);
+                if history::resettable(&facet) {
+                    item = item.push(
+                        checkbox(self.resets.contains(&facet))
+                            .label("Reset this exact observation")
+                            .text_size(11)
+                            .on_toggle(move |v| event(Event::Reset(facet.clone(), v))),
+                    );
+                } else {
+                    item = item.push(
+                        text("Artifact history reset remains pending with artifact review.")
+                            .size(11),
+                    );
+                }
+                content = content.push(container(item).padding(7));
+            }
+        }
+        for pending in &self.resets {
+            if baseline.is_none_or(|b| !b.facets.iter().any(|f| f.selector() == *pending)) {
+                let facet = pending.clone();
+                content = content.push(
+                    checkbox(true)
+                        .label(format!(
+                            "Pending reset no longer in current history: {}",
+                            title(project, &facet)
+                        ))
+                        .text_size(11)
+                        .on_toggle(move |v| event(Event::Reset(facet.clone(), v))),
+                );
+            }
+        }
+        scrollable(content).height(305).into()
+    }
+
     fn references_view<'a>(&'a self, project: &'a Project) -> Element<'a, Message> {
         let mut content = column![
             text("Reference correspondence · always Operational → System").size(15),
-            text("Choose explicit counterpart identities before taking reference values. Names do not establish correspondence. Changing an already reviewed keyed pair requires reset in the structured workflow.").size(12),
+            text("Choose explicit counterpart identities before taking reference values. Names do not establish correspondence. Changing an already reviewed keyed pair requires an exact reset in History. Existing decisions are retained; resolve their overlapping row identities explicitly.").size(12),
             text_input("Filter reference choices by name or alias", &self.reference_search).on_input(|v| event(Event::ReferenceSearch(v))).padding(7).size(12),
             row![
                 pick_list(self.all_references(project, Layer::Oa), self.reference_oa.clone(), |c| event(Event::ReferenceOa(c))).placeholder("Operational reference").padding(7).text_size(12).width(Fill),

crates/oa-desktop/src/views.rs

@@ -736,6 +736,7 @@ fn traces(app: &App) -> View<'_, Message> {
             action("+ Artifact", Message::AddArtifact)
         ]
         .spacing(8)
+        .wrap()
     ]
     .spacing(16);
     for t in p.traces.values() {

harness/STATE.md

@@ -1,152 +1,92 @@
-# First release — current engineering state
+# Current release state — 2026-09-06
 
-## Objective and phase
+The first-release goal remains active and incomplete. The authoritative objective
+is attachment10134df9-bea2-4c02-a820-67b53d6b86f7/goal-objective.md. PLAN and
+TASK_LEDGER retain release scope. Do not equate the accepted0.2 prototype or scoped
+verification with complete OA/SA/source/REST/UI parity.
 
-The first-release goal is active and incomplete: usable Rust/Iced OA/SA,
+## Checkouts and ownership
-equivalent graphical/source/REST semantics, traceability, direct behavior editing,
-offline guidance, lifecycle/hosted workflows and Windows/Linux evidence.
-Authoritative objective reread 2026-09-06: attachment10134df9-bea2-4c02-a820-67b53d6b86f7.
-PLAN retains full scope; no subsystem checkpoint completes the release.
 
-Main remains a documentation pointer on production a8f451e. Current integration is
+- Main C:/Users/sorok/OneDrive/Documents/ChatGPT/Capella 2 is the continuation pointer
-D:/CodexBuilds/Capella2-data-integration, branch codex/data-contract-integration.
+  checkout, branch codex/release1-engineering, last pointer04316a7.
-Production merge332e46b + formatc6db9d4 + evidenced114a5d integrate DATA/scenario/
+- Active integration D:/CodexBuilds/Capella2-data-integration,
-process60d162c and semantic6ad3cb. Scalar fixes5a51a75 integrated as e7fa061 and evidence767634a;
+  codex/data-contract-integration, production67ed8e0. Root owns index and data-target.
-322 desktop tests/strict checks/build pass on both platforms. That worker owns DATA/Linux indexes and targets;
+- Linux D:/CodexBuilds/Capella2-data-linux-review, codex/data-linux-review,
-root owns this file, other native ledgers, README and all native input.
+  43dd566 equivalent source. Root owns index and data-linux-target; currently idle.
+- SEM D:/CodexBuilds/Capella2-semantic-review, codex/semantic-review,
+  f73551f. semantic_gui_design owns remaining constructor families in semantic_review,
+  minimal forms adapters and its GUI ledger; semantic-desktop-target is exclusive.
+- HOST D:/CodexBuilds/Capella2-hosted-desktop, codex/hosted-desktop, base1086e54.
+  semantic_integration owns hosted client/lifecycle, Cargo/index and exactly three
+  views.rs header hooks. Its child owns client.rs only. scenario-target is exclusive.
+- semantic_http_review closed MessageKind review; Temp target and SEM target released.
+  Root is sole native operator. No worker may issue native input.
 
-## Accepted foundations and evidence
+## Integrated behavior and evidence
 
-- Typed ports and migration: release-port-{contract,core,migration}.md and
+R6 data contracts, direct scenario/process editing, source5 typed core reconciliation,
-  release-capella-workflow-benchmark.md.
+REST typed preview/apply and scalar GUI are integrated. Milestone3 has only the
-- Explorer grouping/deep hierarchy, contextual port creation, routing, labels,
+MessageKind/TimerExpression constructor group complete; other constructor/keyed/order/
-  anchors, direct exchange drawing, menus and source tree: release-explorer-usability.md,
+reset/artifact/multi-source graphical decisions remain required.
-  release-routing-{verification,linux}.md, release-port-drawing.md,
-  release-context-menus.md.
-- Modular source/includes, provenance-aware writes, exact source/model history,
-  retained drafts and coupled hosted revisions: release-source-integration.md.
-- Direct state creation/movement/transitions/reconnect, typed forms, fold and
-  camera/tool lifetime through316dc55, Windows/Linux native: release-state-editing.md.
 
-## Integrated semantics and verification
+Full source5 baseline passed Windows718 and Linux721 workspace tests, one intentional
+benchmark ignored on each; strict workspace Clippy and optimized desktop/server builds.
+Real optimized loopback REST checked184 schemas,19 actual typed values and9 malformed
+rejections. Current67ed8e0/43dd566 adds desktop-only changes:335 complete desktop tests,
+strict all-target Clippy, whole-workspace fmt and optimized builds pass on both.
+Linux sessions/logs are recorded in release-semantic-native.md.
 
-R6 data payloads/defaults/inheritance/associations/interface allocations/qualified
+Independent scalar review closed3 P2 findings (scoped invalid buffers, combined
-message-value paths are integrated. Source3 migration preserves comments/nesting
+candidate context, historical identity). MessageKind review closed22 tests plus288
-until Save All. Typed review now uses source/schema5 with explicit migration.
+independent differential cases with no material finding. Process camera/form-scroll
-See release-data-{contract,implementation,verification}.md.
+fixcf33785 and mounted-owner reset8c60008 passed actual Iced red/green regressions,
+327 desktop platform gates and independent26 observer/process checks. Native final
+camera/owner verification remains pending; see release-process-scroll-identity.md.
 
-Semantic core supports finite typed facts, historical references, mappings/reset,
+## Native evidence and environment
-constructor groups, canonical agreement and exact prepared impacts. Independent
-equal-discriminator review found and fixed first acknowledgment reachability:
-initial equal unreviewed discriminators acknowledge only that scalar; true and
-historical switches retain grouped rules.353 core tests and independent36 focused/
-8 adversarial probes passed. Normative clarification6ad3cb is integrated.
 
-REST query/preview/apply is implemented and verified after explicit user approval.
+Windows scalar e7fa061 trial62786 closed0 normally, empty stderr.1440x900 and1100x700:
-Exact prepared candidates preserve generated identities, conditional ETags and
+mixed Keep/Take/Candidate, invalid default99 retention/repair7, exact source/comment,
-coupled model/source commits. Fingerprints express consistency, not authentication.
+Undo/Redo/Save; Boolean type+default candidate; missing reference mapping rejection,
-48 server tests pass; optimized live loopback checks validate184 schemas and19
+explicit named-type pair and valid Integer1 default; distinct deleted UUID headings;
-actual/typed values, reject9 malformed shapes. Strict reST/catalog checks pass.
+saved reopen; reverse System→OA minimum/default and atomic Undo. See
-No deployment was requested or performed. See release-semantic-integration.md.
+release-semantic-native.md. Working file windows-scalar.arcadia contains the three
+forward reviews; reverse was undone. Linux and scoped raw-bound clearing remain.
 
-d114a5d integration: Windows718 / Linux721 tests pass, one intentional inheritance
+Prior Linux Wayland60d162c actual1440x900: numeric constraints/defaults, recursive
-benchmark ignored on each. Strict workspace all-target Clippy, formatting and
+qualified value browser, middle Call/Reply scenario and direct SA chain, Undo/Redo,
-optimized desktop/server builds pass. Linux exec80687 exited0; logs are
+source/includes/Save. Windows reopened Linux69-object chain, added named Choice and
-semantic-workspace-test.log, semantic-workspace-clippy.log and
+Two paths at1100x700, Undo/Redo/Save74objects/13links/5 incomplete-model checks. Details
-semantic-release-build.log in Capella2-data-linux-target.
+in release-data-verification.md, release-scenario-editing.md, release-process-editing.md.
 
-Scalar GUI milestones1–2 provide existing-trace scoped Keep/Take/Candidate review,
+New frozen ui-semantic-groups-{windows,linux}-67ed8e0 include current process fixes
-typed forms, exact ordinary Batch, impact review and source/history. Independent
+and MessageKind slice. Hashes and source commits in release-semantic-native.md.
-review found three P2 issues: unrelated invalid draft blocking scoped actions,
+Windows freeze/model is an isolated74-object process copy. Neither new binary has
-combined type-decision form context, and hidden historical keyed identities.
+been natively operated yet. Re-inventory windows; scalar2099614 is now closed.
-Worker5a51a75 fixes all three;277 desktop tests/Clippy/build pass in SEM. Fresh
+Original Capella395654 remains available. Do not touch protected user windows.
-independent recheck passed280 tests (277 repository +3 independent probes),
-closing all three P2 findings; integrated platform verification also passed. Native scalar
-acceptance and structured milestone3 are still required; do not claim full parity.
 
-## Native behavior evidence and current environment
+Wayland works with WGPU_BACKEND=vulkan and
-
+VK_DRIVER_FILES=/usr/share/vulkan/icd.d/lvp_icd.x86_64.json. Compact WSLg frame resizing
-Frozen60d162c binaries live under D:/CodexBuilds/Capella2-release1-01a06e2e:
+is unverified. Optional X11 is blocked by missing libxkbcommon-x11-0; sudo requires
-ui-behavior-windows-60d162c and ui-behavior-linux-60d162c. Hashes in the linked ledgers.
+user password. User was told to run sudo apt-get install libxkbcommon-x11-0 in Ubuntu.
-Windows prior scenario native passed middle/ALT insertion, guarded correlated
+No authentication bypass; Windows/Wayland/REST progress is not blocked.
-Call/Reply, qualified values, Undo/Redo, save/reopen, minimum layout and viewport
-retention. See release-scenario-editing.md. Remaining advanced tasks are explicit.
-
-Linux1440x900 Wayland native: numeric Retry budget0..4 rejects default9 without
-losing draft; default2 saves, Undo/Redo works. Recursive Destination/Next/Latitude
-browser preserves independent Origin expression; save/reopen passed. Created
-Validated route Call/Reply in the middle, Undo/Redo and save/reopen passed. Created
-SA chain with two existing functions, drew guarded ready link, inserted existing
-Navigation request into it, verified guard and original link ID, Undo/Redo and saved
-69objects/7links/3expected checks. Final chain reopen and advanced process cases
-remain. See release-data-verification.md and release-process-editing.md.
-
-Wayland exec61870 closed normally, exit0 and no serious runtime output. Current Windows semantic trial is exec62786/window2099614, frozen e7fa061,
-1100x700. Root owns input. Re-inventory; never reuse closed window4852212.
-Original Capella395654 remains available. Do not modify protected user windows.
-Wayland compact resizing is unverified: capture separates frame and client into
-bounded surfaces. X11 launch fails in dependency xkbcommon-dl because Ubuntu lacks
-libxkbcommon-x11-0. sudo installation requires the user's password; user has been
-given `sudo apt-get install libxkbcommon-x11-0`. Windows/Wayland testing continues.
-Do not bypass authentication or treat this optional environment issue as goal blocked.
 
 ## Exact next actions
 
-1. Finish5a51a75 integration/recheck, update immutable binaries/hashes, operate scalar
+1. Launch current frozen native build; verify preserved Fit/manual scale, remote
-   review in actual Windows/Linux app including reverse, failure and compact forms.
+   scroll through forms, owner-to-owner reset, compact branch labels and toolbar.
-2. Complete native R6/scenario/process cases (both layers, branching/reuse/reconnect,
+2. Finish Linux scalar and native MessageKind/TimerExpression acceptance, then
-   cancellation, minimum size and source reopen); fix from observed behavior.
+   remaining advanced OA/process/scenario cases and pending raw-bound cases.
-3. Complete structured semantic GUI: constructor groups, keyed/order/reset/artifact
+3. Integrate independently reviewed remaining constructor/keyed/order/reset/artifact/
-   operations and multi-source final-candidate review; retain shared core planner.
+   multi-source GUI slices; preserve core prepared plans and exact source history.
-4. Finish coverage/filter, Home/recent/recovery, hosted desktop ETag and offline help
+4. Integrate HOST open/publish/save/conflict lifecycle and operate actual
-   requirements. Fresh end-state reviews, full platform/MSRV checks and packaging.
+   desktop→loopback API→desktop including offline retention and Save as local.
+5. Complete remaining coverage/filter, Home/recent/recovery, offline help and guided
+   engineering task requirements; fresh final reviews, full platform/MSRV and packaging.
 
-Use dedicated Cargo targets. Windows: cargo test --locked --offline --workspace;
+Build workflow: cargo test --locked --offline --workspace;
 cargo clippy --locked --offline --workspace --all-targets -- -D warnings;
 cargo build --locked --offline --release -p oa-desktop -p oa-server.
-WSL Ubuntu24.04 uses target/linux-cargo.toml, Rust1.98.1 at
+Use dedicated targets. WSL Ubuntu24.04 Rust1.98.1 PATH starts
-/home/sorokinoleg/.cache/arcadia/rust/bin and Mesa software Vulkan. No remote push,
+/home/sorokinoleg/.cache/arcadia/rust/bin; add --config target/linux-cargo.toml.
-publication, usage reset or broad recursive target deletion is authorized.
+No remote push/publication, usage reset or broad target deletion is authorized.
-
-## Latest native and process checkpoint — 2026-09-06
-
-Process cf33785 + evidence1b0b072 fixes forced zoom on palette changes and canvas
-remount/scroll loss on pending forms, with persistent two-path field labels.
-325 desktop tests/strict checks/release pass on each platform. Independent24-test
-review closed both original defects but found owner-to-owner Scrollable leakage.
-Fix8c60008 resets actual observer child only on (document,owner) changes;25 focused
-red/green checks pass. Full platforms and fresh semantic_http_review are active.
-semantic_integration owns DATA/Linux indexes and targets for this narrow follow-up.
-
-Windows60d162c reopened Linux69-object bundle. At1100x700, inserted named Choice
-Route available? on the ready path, then Two paths added Choice/two existing-work
-occurrences/Merge with ready/else guards. Undo74→70 and Redo70→74; Save All wrote
-74objects/13links/5 incomplete-model checks. Original link identity/ready preserved.
-Trial3607004 closed; saved bundle remains in ui-behavior-linux-60d162c/model.
-Final camera/owner fixes and advanced OA/process native cases remain unverified.
-
-Scalar Windows e7fa061 actual native: source5 fixture, numeric prior/current
-comparison; Keep SA minimum1, Take OA maximum20, candidate default99 rejects and
-retains all three decisions; corrected7. Error, editor and Apply fit1100x700.
-Additional changes0; Apply atomically changes SA to1..20/default7, OA remains
-0..20/default5. Native text verifies comment and values. Undo restores saved state,
-Redo restores review; Save All succeeds. Field Type Take OA Boolean + Default
-Candidate creates Boolean(false), previews/applies/saves successfully at1100x700.
-Current saved working copy: C:/Users/sorok/AppData/Local/Temp/
-capella2-semantic-native-fixture-20260906/windows-scalar.arcadia. Runtime stderr empty.
-Reverse, mapping, historical identity, reopen and Linux scalar cases remain.
-
-semantic_gui_design owns SEM message-kind/TimerExpression constructor slice and
-compact Traceability toolbar clipping fix (views.rs), plus its semantic module/forms
-adapter/GUI ledger and semantic-desktop-target. Scope is one existing trace and a
-complete nested constructor family; no API/core change or full parity claim.
-semantic_http_review temporarily owns semantic-desktop-target for isolated process
-review; GUI worker must wait for release before builds. Root owns all native input.
-
-Latest process closure: DATA/Linux f4cb486, production8c60008.327 desktop tests,
-strict Clippy/fmt/build pass on both. Independent26 tests (4 actual Iced observer,
-22 process) close owner-scroll findings. Both targets are idle and root-owned.
-Frozen ui-process-owner-{windows,linux}-8c60008 await root native verification.
-semantic_http_review used a separate Temp target and released it; SEM GUI owns
-semantic-desktop-target exclusively. Hosted lifecycle mapping is read-only parallel
-work by semantic_integration; no shared index or target reservation for that task.

harness/TASK_LEDGER.md

@@ -98,3 +98,11 @@ have actual native evidence in their ledgers; advanced and compact cases remain.
 X11 lacks libxkbcommon-x11-0, installation requires user's sudo password. User has
 the exact fix command; Windows/Wayland progress is independent. This environment
 issue is not evidence of a semantic defect or reason to mark the release blocked.
+
+2026-09-06: DATA67ed8e0/Linux43dd566 integrates bounded MessageKind/TimerExpression
+review.335 desktop tests and strict checks/build pass per platform; independent22
+module tests+288 differential cases close no findings. Windows native scalar now
+includes named mapping/default, historical identities, reopen and reverse Undo;
+trial closed0/empty stderr. Exact scope and pending native cases:
+release-semantic-native.md. Hosted desktop implementation is isolated in
+Capella2-hosted-desktop; all release completion claims remain pending.

harness/release-semantic-gui.md

@@ -1,7 +1,8 @@
-# Semantic desktop review — milestones 1 and 2
+# Semantic desktop review — scalars and closed constructor groups
 
-Status: milestones 1–2 implemented and desktop tests/build verified; not full GUI
+Status: milestones 1–2 and the closed constructor group forms are implemented.
-parity, native acceptance or release acceptance.
+Independent keyed/ordered review, historical pairing reset, multi-source review,
+full GUI parity, native acceptance and release acceptance remain outstanding.
 Base: `d130013`. Dedicated build target:
 `D:/CodexBuilds/Capella2-semantic-desktop-target`. Native verification is root-owned.
 
@@ -16,9 +17,10 @@ Base: `d130013`. Dedicated build target:
 - Support every applicable scalar leaf through Keep, Take and typed final-value
   forms. Candidate records contain the complete combined selected result. Identity,
   alias and layer are protected. The closed core remains the validation boundary.
-- State.Kind is a single structural scalar. Other constructor switches, keyed
+- State.Kind is a single structural scalar. Data, Port, Occurrence, nested
-  membership/order/annotation/binding/attachment decisions and pairing resets belong
+  MessageKind and Event support their closed constructor groups and complete
-  to milestone 3; show them read-only with an honest explanation.
+  typed payloads. Independent keyed membership/order/annotation/binding/attachment
+  decisions and pairing resets remain visibly read-only outside a replacing group.
 - Core `6bb2583` permits first equal constructor acknowledgment without descendant
   expansion. The GUI exposes **Acknowledge equal kind only** when applicable;
   previously reviewed constructors remain governed by the core's switch rules.
@@ -36,14 +38,16 @@ Base: `d130013`. Dedicated build target:
 2. Scalar decisions and typed candidates; immutable initial observations; combined
    final records; exact impact acceptance; atomic document/source commit. Focused
    App event/source/history tests, strict Clippy and a dedicated desktop build.
-3. Constructor closure, keyed and ordered facts, reset, complete artifact lifecycle,
+3. All closed constructor forms are implemented, including nested MessageKind.
-   multi-source review and remaining source/REST parity cases. Still outstanding.
+   Independent keyed and ordered facts, reset, complete artifact lifecycle,
+   multi-source review and remaining source/REST parity cases are outstanding.
 4. Root-owned native review, cross-surface fixtures, package/release acceptance.
 
 ## Verification
 
-Verified after the independent scalar review fixes on SEM `6ad3cb`, using only the
+Scalar fixes were verified on SEM `6ad3cb`; the nested message-kind slice builds
-dedicated desktop target (core behavior remains based on `6bb2583`):
+on scalar commit `5a51a75`. Verification uses only the dedicated desktop target
+(core behavior remains based on `6bb2583`):
 
 ```powershell
 $env:CARGO_TARGET_DIR='D:/CodexBuilds/Capella2-semantic-desktop-target'
@@ -52,8 +56,8 @@ cargo clippy --locked -p oa-desktop --all-targets -- -D warnings
 cargo build --locked -p oa-desktop
 ```
 
-All **277 desktop tests passed**, including **11 original semantic review tests**
+All **285 desktop tests passed**, including **11 original semantic review tests**,
-and **5 scalar review regression tests**.
+**5 scalar review regression tests**, and **8 nested message-kind tests**.
 Strict Clippy and the desktop build passed. The existing migration test's header
 assertion now follows `SCHEMA_VERSION` instead of expecting schema 4.
 
@@ -85,19 +89,203 @@ The independent scalar review found three gaps, now corrected:
 The regression tests exercise App events, the actual default-form helpers and
 button availability, exact source retention before Apply, and one-step undo.
 
+## Bounded constructor slice
+
+Occurrence.MessageKind is a complete closed nested family: Asynchronous, Call,
+Reply, Create, Delete and Timer. It is available only when both traced counterparts
+are Exchange occurrences. The only constructor-specific payload is the timer
+expression. This first slice left outer occurrence replacement read-only; the later closed
+constructor slice below now covers it.
+
+- Keep/Take/Candidate use the core's switch and first-equal acknowledgment policy.
+  Taking a replacing group copies the typed MessageKind, including its expression.
+  Taking an initial equal discriminator does not copy an unselected timer value.
+- Candidate MessageKind has its own scoped draft. The independent TimerExpression
+  scalar draft survives group decisions; the group timer's exact raw text, editor
+  cursor and selection survive switching away from Timer and back.
+- An overlapping kind/timer draft retains both decisions and blocks Apply until
+  explicitly resolved. The dialog offers **Replace timer decision with message-kind
+  group** and **Leave message kind unselected; use timer decision**. First equal-kind
+  acknowledgment can coexist with an independent timer decision. Divergent authored
+  candidate values reject; neither candidate silently overwrites the other.
+- The kind detail includes baseline/current timer observations and the complete
+  proposed kind. It displays the exact plan-provided acknowledged/retired lists.
+  Exchange, reply-to, lifelines, annotations and pre/postconditions stay separately
+  scoped. Incompatible Timer contracts remain core errors; no dependency or payload
+  is silently removed. Existing additional-impact approval remains in force.
+- Group changes compose with scalar choices and execute the exact prepared Document
+  batch. Tests cover both directions, all six kinds, mapped reply correlation,
+  historical retirement, repeated no-switch rejection, invalid combinations,
+  protected scopes, stale preview, source failure, comments and one-step undo/redo.
+- The Traceability contextual toolbar now wraps at the available width so +Artifact
+  remains reachable in the compact layout. This is a single `row.wrap()` change in
+  `views.rs`; other toolbars are outside this slice.
+
+Root reported native scalar coverage on frozen integrated `e7fa061`: mixed numeric
+Keep/Take/Candidate, invalid default retention/repair, zero additional changes,
+atomic Apply, comment/value inspection, Undo/Redo and Save All at 1440×900 and
+1100×700. Reverse/type/reference/history/reopen native checks were still continuing
+when this slice was implemented. This task launched no native application.
+
 Built executable:
 `D:/CodexBuilds/Capella2-semantic-desktop-target/debug/arcadia-studio.exe`.
 The build target is idle. No native application was launched by this task.
 
 ## Remaining work
 
-Milestone 3 must add explicit constructor closure/replacement, keyed and ordered
+Milestone 3 must add independent keyed and ordered decisions, historical pairing
-decisions, historical pairing reset, complete artifact lifecycle and multi-source
+reset, complete artifact lifecycle and multi-source review. These facts are currently inspectable, with unsupported writes visibly
-review. These facts are currently inspectable, with unsupported writes visibly
 identified. The reference table supplies explicit mappings for scalar reference
 Take; it does not claim to complete a reset or establish keyed acknowledgments.
 
-Fresh independent scalar GUI review and root-owned native verification are still
+Fresh independent requirements/correctness review and root-owned native checks of
-required before merging this milestone into release acceptance. In particular,
+the message-kind slice are required before release acceptance. Verify the compact
-validate the 1100×700 layout, keyboard/focus continuity, long historical values,
+kind picker, timer text/focus retention, overlap choices, exact closure/retirement,
-reference selection, source reopening and prepared-impact inspection in the app.
+mapped Reply, blocked Timer contract, source reopening and toolbar wrapping.
+
+
+## Remaining closed constructor families (this slice)
+
+Owned files: `semantic_review/**`, `semantic_review.rs`, the scoped Draft adapter
+in `forms.rs`, semantic-only port choices in `forms/port_fields.rs`, and this ledger.
+No shared traceability header, core, API, native state or source language edits.
+Base: `f73551f`; same exclusive desktop target.
+
+| Constructor | Complete group payload | Independent fields |
+| --- | --- | --- |
+| Data | Definition, bounds, literal members, record supertype, default | Unit, owner and headers |
+| Port | Contract, function item members, retained legacy direction/interface | Owner and headers |
+| Occurrence | Body, nested message kind/timer, references, qualified annotations, bindings, branch and step order | Pre/postconditions, owner and headers |
+| Event | Body, signal item members, time kind/expression or change expression | Owner and headers |
+| MessageKind | Complete nested kind and timer expression | Other occurrence body properties |
+
+Each group owns an independent draft, including the nested MessageKind group.
+Keep/Take/leave-unselected retain all drafts. Constructor picker changes save the
+old branch value plus its raw inputs and editor state. Switching back restores them.
+Port input/output changes also carry authored item reference strings, including
+invalid strings, rather than falling back to stored UUIDs. A Data definition switch
+leaves its existing default visible until the user deliberately changes or clears
+it; Port's retained generic association has explicit add/edit/clear controls.
+
+The same combined candidate projection supplies dependent form context. Only the
+selected roots are materialized; unrelated invalid scalar/group drafts stay local.
+Full Take payloads use the public core typed reference visitor, so UUID-shaped prose
+is never remapped. For historical same-kind Take, the closed adapter retains only
+current target-present/source-absent rows without a previous source-present
+observation on that target slot; the core independently
+checks the supplied final record. No GUI acknowledgment, retirement or impact list
+is synthesized. The core remains authoritative for those lists and applicability.
+
+Group details show every baseline/current/proposed group observation, including
+qualified and historical row identities. Actual preview acknowledged/retired lists
+remain explicit. A replacing group and selected descendants retain both decisions
+and provide explicit leave-unselected actions. First-equal discriminator observation
+can coexist with independent descendant decisions. Conflicting authored values
+reject instead of silently discarding either draft's edits.
+
+Array controls support the whole authorized payload, including order, existing
+owned branches/steps, signal items, annotations and scenario bindings. They do not
+create referenced semantic objects, change their ownership, delete dependencies,
+or infer reference correspondences. Incompatible payload/owner combinations stay
+visible as validation failures. Apply still sends exactly one prepared Document
+batch, preserving comments, source/model/history agreement and one-step undo/redo.
+
+New coverage exercises all six Data definitions and companion defaults in both
+directions; all eight Occurrence and all three Event kinds; all four Port forms;
+combined owner context; nested and scalar draft retention; explicit overlap;
+protected fields; mapped record, state, event item and scenario binding payloads;
+complete owned branch/step order; historical retirement and first-equal scope;
+90 Data/Event kind-pair and direction comparisons against the core-only preview;
+source comments/reopen and atomic undo/redo. Full checks and core dependency status
+will be recorded at freeze. This task launches no native application.
+
+The delegated keyed-closure fix `43370de` is integrated into SEM as `9c3184b`.
+Reverse Literal/Member/Binding/Annotation closure and historical local-member
+preservation now pass the desktop desired-success tests. The separately delegated existing-target Port fix `8a75294` is integrated into
+SEM as `7512ac8`. Fresh reverse Keep and Candidate reviews can preserve/edit the
+OA Legacy association; taking a typed contract into OA still rejects. Both fixes
+are covered by desired-success desktop tests; no GUI workaround weakens validation.
+
+Native acceptance remains root-owned: use the existing trace Review semantics
+entry, inspect complete group before/after and retired identities, switch variants
+away/back, resolve explicit nested overlaps, repair invalid defaults/references,
+apply once, inspect source, undo/redo, save and reopen at 1100×700 and 1440×900.
+
+
+## Closed constructor freeze verification
+
+On integrated SEM base `7512ac8`, all **299 desktop tests pass**. This adds 13
+constructor workflow tests and one scoped port form regression to the previous
+285-test slice. The new suite includes 90 complete Data/Event kind-pair/direction
+comparisons against core previews, all closed candidate kinds, mapped qualified
+annotation addresses, bindings and references, actual reverse Legacy edits, owned
+branch/step ordering, source/model/history agreement, retained drafts and strict
+scope protection. Both delegated core defects are resolved and exercised.
+
+Owned-file rustfmt check, strict Clippy (`--all-targets -- -D warnings`) and the
+desktop build all pass using the dedicated target and commands above. Native checks remain root-owned. No native application
+was launched, and full milestone 3 / GUI parity / release acceptance remain open.
+
+## Independent unordered membership and exact reset slice
+
+Current scope: seven unordered reference collections (function input/output items,
+signal/exchange items, transition triggers/effects, constrained identities) and exact
+enumeration literals. Stage an explicit OA/SA address, then choose Keep, Take or
+Candidate presence. New rows never create referenced model objects or infer pairs.
+Pair changes preserve existing decisions and require explicit history resets and
+overlap resolution. Literal pairing uses the same exact string on both sides.
+
+History lists exact previous observations, with reversible pending resets applied
+before catalog construction, constructor scope and candidate composition. A reset-only
+Apply uses the same core prepared command batch and atomic source/history undo.
+Artifact history stays deferred; other read-only value families can have their
+exact historical observations reset without exposing value editors.
+
+Independent annotation, binding, ordered/owned/incident/artifact decisions and
+multi-source review remain later slices. Existing constructor forms remain intact.
+The member-family picker offers collections available on the current counterparts.
+Identity pickers reuse the ordinary property editor's typed choices. Presence and
+all scalar/group drafts remain separate; leaving a decision or removing a staged
+address retains its raw presence draft. A missing source key means a target-local
+row that Take preserves; an explicit absent source key can remove only the mapped
+entry. Existing model objects and unrelated entries remain intact. Previous member
+identities, deleted UUIDs and quoted exact literals remain distinguishable.
+
+History and Members use the existing compact scroll area, and the contextual tabs
+wrap. Users can explicitly remove staged addresses and their decisions or uncheck
+obsolete pending resets after refresh, without discarding other work. Candidate
+projection changes only the selected boolean member entries; the core independently
+checks the complete typed candidate and supplies all acknowledged/retired/impact
+scope. The GUI never synthesizes accepted history or additional-change commands.
+
+On base `c149f2f`, all **311 desktop tests pass**, including 12 new workflow tests.
+The suite covers 30 five-family/direction/Keep-Take-Candidate cases, both typed
+function-port item families with reverse Legacy applicability, exact literal
+add/remove and default retention, historical pair migration with explicit overlap
+resolution, constructor reset before equal-kind acknowledgment, deleted source
+members and target-local preservation, exact reset-only source/Undo/Redo, source
+reopen/comments, retained drafts, stale/source-write failures and recovery.
+Owned-file rustfmt check, strict Clippy (`--all-targets -- -D warnings`) and
+`cargo build --locked -p oa-desktop` all pass with the dedicated desktop target.
+No core, API, schema or shared header changes were needed.
+
+Root-owned native acceptance uses the fixtures mirrored by `keyed_tests.rs`:
+- Signal pair: source contains a mapped item; destination contains a separate local
+  item. In Members, choose Signal items and both mapped identities, then Take in
+  Properties. Inspect the proposed present row and retained local row; apply, undo,
+  redo and inspect source. Repeat in reverse. Test Candidate exclusion as well.
+- Enum pair: both contain `retained` with that default; source also contains
+  ` New value ` and destination contains `old`. Stage exact paired literals; Take
+  the incoming row, Candidate-remove `old`, Candidate-add `new value`. Inspect the
+  distinct exact strings, unchanged default and one source/history transaction.
+- Historical pair: an existing one-sided member observation is replaced by an
+  explicitly paired address. Apply stays unavailable until that exact old history
+  is reset and any overlapping earlier decision is explicitly left unselected.
+  Use History for a reset-only Apply; values and prose history stay unchanged, and
+  one Undo restores the exact prior source and semantic history.
+- At 1100x700, verify wrapped tabs, scrollable member/history content, long/deleted
+  identity labels, retained errors/decisions, staged-address removal, source failure
+  repair and apply/cancel access; repeat a normal transaction at 1440x900.
+
+No native application was launched here. Independent review, actual native
+acceptance, later keyed/ordered slices and full GUI parity remain open.

harness/release-semantic-native.md

@@ -6,7 +6,7 @@ Trial exec62786/window2099614; stderr/stdout captured under ui-semantic-windows-
 Source fixture and exact GUI steps: C:/Users/sorok/AppData/Local/Temp/
 capella2-semantic-native-fixture-20260906. Original source SHA256
 54BA9528F6904428B3DE2E41E3D8CAC6861FA652E5F83F11C1516FB3DB40E937.
-Root edits only windows-scalar.arcadia, preserving the generator's starting source.
+Root edited windows-scalar.arcadia, preserving the generator's starting source.
 
 ## Observed Windows workflows
 
@@ -27,9 +27,55 @@ All persists it. This exercises combined type context through actual controls.
 
 ## Remaining checks and findings
 
-Reverse decisions, raw invalid bound scoped clearing, named-type mapping, deleted
+Raw invalid bound scoped clearing and Linux remain required. Error evidence above
-historical identities, saved reopen and Linux remain required. Error evidence above
 covers a normal validation message, not arbitrarily large diagnostics.
 Native found compact Traceability toolbar clips Artifact after the semantic button;
 semantic_gui_design owns a narrow wrapping correction. No scalar-modal defect found
 in the tested paths. Structured review is a separate incomplete milestone.
+
+## Mapping, history, reopen and reverse review — 2026-09-06
+
+At1100x700, selected Take Operational Type on OA Selected count → SA Selected count.
+Preview rejected the missing explicit OA Count range correspondence and disabled
+Apply. Reference pairs OA Count range → SA Count range resolved it. The proposed
+named type was @sa_count_range; a candidate literal default initialized to Integer1,
+using the destination range minimum. Apply and Save All persisted both atomically.
+Disk source confirms Named @sa_count_range and Integer1, with0 model checks.
+
+Selected the record trace and inspected both historical deleted children. Detail
+headings distinguish full UUIDs ending2329 and232a, despite identical former names;
+prior OA presence and current absence are retained. Cancel changed nothing.
+
+Opened the saved windows-scalar.arcadia through the native file dialog. It reopened
+with9objects/0links/0checks, original comment, accepted values and reviewed history.
+On the range trace, switched to System→Operational and included unchanged facts.
+Previously reviewed/current minimum values were OA0/SA1 and defaults OA5/SA7.
+Take System minimum and default previewed1/7; Apply selected the OA destination.
+Native source showed OA default7. One Undo restored OA default5 and All changes
+saved, retaining the earlier three saved reviews. The reverse exercise was left
+undone intentionally. The separate windows-reverse.arcadia remains an unused copy.
+
+Closed trial62786 normally, exit0. Captured stderr was empty. No new scalar defect
+was found. This still does not establish complete structured review acceptance.
+
+## Integrated message-kind group verification — 2026-09-06
+
+SEM f73551f integrates as DATA67ed8e0 and Linux43dd566. Both platforms passed335
+complete desktop tests, strict all-target desktop Clippy, workspace formatting and
+optimized desktop build. Core/server are unchanged from the full integrated gates.
+Independent review on a fresh Temp archive passed22 semantic-review tests and a
+288-case differential matrix against core (all6 kinds, both directions, baseline
+and no-baseline, Keep/Take with unrelated Header candidate). No material findings.
+Temp probe: capella2-message-review-f73551f/semantic_review/message_kind_tests.rs
+under the desktop crate. Root native checks of the new group remain required.
+
+Frozen binaries under D:/CodexBuilds/Capella2-release1-01a06e2e:
+- ui-semantic-groups-windows-67ed8e0/arcadia-studio.exe, SHA256
+  CC741CC0FE21B7873E545DE7763E74CCF18AB8401D1EEBD8F90DA493B7262DD8.
+- ui-semantic-groups-linux-67ed8e0/arcadia-studio, SHA256
+  B50BD6462C239C52AEF93FD235FC3652901C519E5289938DD881523357C891D4.
+
+Windows build/test session97666 and Linux2903 exited0. Linux logs are
+message-kind-{test,clippy,build}.log in Capella2-data-linux-target. Frozen manifests
+record source/platform/hash. The Windows freeze contains an isolated copy of the
+74-object process fixture for native camera, owner-scroll and branch checks.