ARCADIA-Studio/harness/release-semantic-batch-implementation.md

Semantic batch foundation implementation evidence

Work begins from checkpoint 2b2d2bc. This is an implementation ledger, not release acceptance. Root owns native input and coordinates the shared Cargo target. The semantic owner edits only crates/oa-desktop/src/semantic_review.rs and its subtree.

Current architecture

State remains the App/Workflow facade, including target, command, error and recovery methods. ReviewRow stores independent raw scalar/constructor/keyed/order drafts. batch.rs owns the frozen Project, canonical shared references, stable source/target/trace addresses, retained row order/inclusion, active row and one combined plan. Row views emit addressed messages; facet identity accompanies draft edits. Exclusion affects request contribution without deleting raw input. Direction changes restore retained reverse drafts. Duplicate included source histories and reverse reference-map convergence are explicit conflicts.

compose.rs derives target-slot intentions before creating the unique candidate per target. Keep is a frozen-value constraint, including explicit absence. Key pairs compare by destination identity; UUID-shaped annotation prose remains literal. Constructor discriminator equality alone is insufficient: constructor scopes also contribute their descendant catalog observations, and are compared against other rows' newly introduced slots. Existing membership/order adapters still supply row-local anchor rules; final implicit orders must agree with surviving combined membership. Only the session calls the core planner; row materialization does not require an individually valid Project.

Recovery v2 stores shared session identity/references/accepted impacts once plus typed row payloads, explicit inclusion/order and active address. V1 imports through its prior strict decoder, including absent orders; no commands or proposed Projects are serialized. Aggregate structure/text bounds and retained-row limits supplement existing typed draft validation. Excluded invalid payloads remain editable after recovery.

The root's observed reference-panel right gutter (18 px) is retained; the same gutter covers properties/detail, member, history and impact scroll content. Native rechecks remain required at 1100×700 and 1440×900.

Decisive regression matrix

1. Two sources converge on one Integer target: first minimum 120 alone violates base maximum 100; second maximum 150 makes the atomic candidate valid. Compare one unique complete candidate and core-produced Project; reverse display order must not change it.
2. Two independent Candidate minima 120 and 130 disagree; both raw strings remain. Unselecting the second minimum restores the original first-row proposal. Equal values agree; Keep minimum 0 conflicts with either mutation.
3. Exclude an invalid - draft, apply another included row, then restore the excluded workflow without discarding that exact raw input. Switching focus, opening an existing excluded row and recovery must not implicitly include it.
4. Capture a text event from source A/minimum, switch to source B or another facet, deliver it: only its original row/facet may change. Also reject a genuinely unknown row address.
5. Constructor switch versus another source's kept retiring leaf, in both inclusion orders; constructor payload versus a newly introduced keyed member; first equal constructor-only acknowledgment with independent bounds.
6. Exact Annotation/Binding target keys with equal versus conflicting values, including UUID-shaped expression text, one-sided identity and presence removal. Different source-key pairs naming the same target slot cannot evade conflict comparison.
7. Ordered members preserve destination-only rows. Conflicting implicit anchor orders and combined membership without an explicit complete Order refuse; explicit repair remains row-authored, not silently inserted by the GUI.
8. Reverse distinct-target batch succeeds; reverse many-to-one mapping reports the existing core correspondence limitation without dropping a source.
9. V2 raw-row recovery and V1 migration, duplicate row/source/facet rejection, invalid active address, aggregate bounds and stale accepted-base rejection. Snapshot order/inclusion and all history resets survive.
10. Apply one batch through App/Document with exact source comments; one Undo restores all affected models/histories/source, Redo and reopen reproduce the same Project. Compare direct shared-core expected records, not merely the GUI's own intermediate serialization.

Validation status

First production refactor checkpoint is saved and rustfmt parses owned files. Root's cargo check -p oa-desktop --tests is the next gate. Batch regression implementation and executable test results are pending; existing ordered regressions remain required. No native or release completion claim is made.

Integration corrections before executable validation

The first root desktop test-target check found two extraction bridge errors (workflow::RowEvent and missing form_event import), plus the external data-fields test helper still using old row variants. These adapters are corrected; the shared test helper routes through an addressed row event. Category family/member selectors and CommunicationMean fixed constructor paths are integrated with the source-6 core contract.

Native impact acceptance now carries the exact displayed SemanticImpact; a delayed acceptance cannot acknowledge a different current indexed impact. Typed row staging promotes its explicit correspondence into the shared session. Independent review found one reproducible recovery edge case: a rejected direction switch at the retained-row limit must roll back the direction. Its focused falsifier is prepared, with correction pending the current compiler edit freeze.

The History tab's old (0) label counted pending resets, not persisted observations; the panel itself already rendered exact trace history without filtering by ephemeral references. The label now shows observation and reset counts separately. “Restore reviewed reference pairs” restores only exact persisted typed key pairs, atomically rejects conflicts, and excludes pending-reset observations. Order vectors contain no explicit correspondence map and are never zipped. Therefore unchanged order anchors absent from keyed history still require explicit correspondence. The new focused history regression checks this boundary and atomic refusal.

Nine new regressions are installed (eight batch cases plus history restoration). Further exact-key convergence, category coupling and row-limit recovery falsifiers are prepared under ignored .local files for the next safe source window. No executable results are claimed yet.

Next bounded ownership after the batch gate

Implement existing Child/Incident attachment review in semantic_review/attachments.rs, with changes limited to row payload/events, view, composition and recovery. The current composition address assumes every selected slot belongs to the trace target. Replace that assumption with a closed actual-record slot adapter: Child targets the mapped child's Header.Parent; Incident targets the mapped relationship's Source or Target field. This must compare against ordinary child/relationship review rows before merging one candidate per actual record.

Keep an independent per-row attached-record draft bank. Parent choices and endpoint choices should name the concrete child/relation, current owner/endpoint, and proposed final owner/endpoint. Show explicit Operational/System key pairs. Child removal detaches only from this owner; an already differently owned target stays unchanged on a negative source observation. Incident removal offers an explicit final endpoint, not an unlink checkbox. The existing core Candidate branch reads a complete relation candidate's exact endpoint even when the owner trace is the only selected review row (semantic/review.rs Child/Incident Candidate branches). Opening another existing relation trace is useful for separate history but is not a necessary prerequisite for that candidate operation.

The existing r3_semantic::child_membership_and_parent_resolutions_agree_by_actual_child_slot test is a direct oracle for Child/Parent agreement and order-independent refusal. No direct Incident-selector regression was found by searching the current core tests or source test names; the next slice should add an independent direct-core endpoint oracle before GUI implementation, covering both ends, both transition directions, absent Take refusal, Candidate reattachment, and conflict with a kept ordinary Relation endpoint.

Artifact lifecycle remains a separate subsequent slice: typed provisional artifact identity, complete metadata draft, Presence plus all seven introduced metadata decisions on creation, initially attached owner context for metadata/move, and exact retired facts on deletion. This adds Artifact record read/install and independently addressed artifact slots to candidate composition. Reuse artifact_creation_requires_reviewed_metadata_and_deletion_retires_exact_facts, artifact_owner_candidate_moves_link_and_conflicts_with_kept_attachment, and target_only_artifact_move_records_owner_and_metadata_in_either_order as concrete core oracles. Add default-empty typed recovery fields with strict v1/v2 compatibility; do not persist plans or silently reinterpret prior snapshots.

Second integrated desktop test-target check reported no semantic production errors; its only semantic diagnostic was the new exact-source test using language::encode instead of the existing language::format. That test call is corrected. Fourteen new desktop regressions are now installed. The row-limit switch is transactional for both event paths; independent review confirmed correction, bounded retained proposal memory and browser-only no-replan handling. Executable desktop results remain pending the coordinated shared Cargo slot.

The next-slice direct core oracle is prepared in new crates/oa-core/tests/semantic_attachments_gui_oracle.rs: four parameterized tests cover owner-trace-only Candidate parent/endpoint replacement, absent Incident Take refusal with explicit Candidate repair, direct-record Keep conflicts on the same actual slot, and agreeing/conflicting convergent owner reviews under source/review permutation. Child and both incident ends run in both directions where correspondence is representable. This file is not yet executed; do not treat its assertions as established evidence until the target passes.

First executable integration run and correction boundary

Root's first full desktop run (.local/source6-desktop-tests.log) completed 459 passed / 19 failed. Failures exposed a shared constructor-observation issue: synthetic destination-only capture may legitimately be NotApplicable on both sides, whereas public historical capture_facet requires at least one applicable side. The adapter now checks only closed typed binding/collection applicability before capture; applicable malformed facts still receive core validation. First-equal Candidate constructor payloads also must survive composition so the core can reject unreviewed timer/default changes; complete candidate payloads and changed descendant intents are now retained rather than normalized away.

The exact-source test was corrected to prepend its comment to the existing reachable source bundle instead of replacing only its entry with monolithic text. Stale errors explicitly identify the stale base. One pre-batch test previously mutated an external Project's history, refreshed against it, then expected application to become valid when a reset was unchecked. Root approved changing that assertion to the frozen-base contract: the uncheck, other decisions and presence values survive; no plan/proposed result or Apply is available until an explicit fresh review. This is a deliberate compatibility change, not an implicit rebase.

The first attachment oracle run rejected the initial DataAssociation fixture because endpoints defaulted to Boolean data types. The fixture now explicitly uses Record definitions, including the added convergent source owner. This establishes no production defect. Focused reruns remain pending.

Attachment implementation seam after these gates

ReviewRow::combined_value currently materializes only its owner record, and compose::canonical returns only a selector with the row target implicitly prepended. The smallest extension is attachments::target_slot(owner, selector, direction) and ReviewRow::materialized_records(base, form_context) -> BTreeMap<Id, Value>: retain the existing owner composition, then apply each closed child-parent or relation-endpoint draft to its actual record. Candidate collection includes exactly those actual records having Candidate decisions. The session compares every resulting actual slot with ordinary Header.Parent/Relation endpoint decisions before creating the core's unique record candidates.

Keep attached drafts keyed by exact facet address, not merely record ID, so independent source and target endpoint raw drafts do not overwrite each other. candidate_draft, scoped edit roots, and the Properties detail view delegate these two families to an attachment adapter. Pair staging stays explicit; related existing trace rows may be opened through current OpenTrace/row-bank behavior. Child Candidate uses a named final parent control; Incident Candidate uses a named final source/target control. This exposes the actual requested mutation rather than presenting an incomplete boolean unlink operation.

Recovery adds a default-empty typed attached-draft vector to the per-row payload with duplicate-address, exact target record identity/kind and scoped-root checks. Parent/endpoint choices are user-authored values; preview, candidate records and plans are rebuilt against the original accepted model. No App/Workflow interface change is required for existing attached records. Explicit creation mappings and full artifact lifecycle remain later bounds and must not be simulated by reserving implicit children in this slice.

Focused semantic gate passed

Root reran the entire semantic_review filter after the corrections: 82 passed / 0 failed (.local/source6-semantic-rerun.log). This includes prior constructor/keyed/ordered/message-kind regressions, batch convergence and rejection cases, v1/v2 recovery, exact source/history Undo/Redo and the approved stale-base behavior. Full integrated desktop repetition and native batch QA remain separate gates.

A standalone generator linked against built oa_core-6c8da57367eec642 and its matching serde_json fingerprint da2c4f333fc47818 created and validated .local/native-fixtures/semantic-batch.arcadia, initial/after JSON, independent core request and manifest. The exact after source comes from source_project::update_bundle. Three objects/two traces produce one target candidate, two acknowledged reviews and zero additional impacts; source and JSON roundtrips pass. Native steps are in semantic-batch-native.md, golden file hashes in semantic-batch.hashes.json. Initial source SHA256 5e1f433e04621424edac43e53411624059e873f88dd531bfdb39093953485ed7; exact after source d3315bba762395205ae761e6e64029e8b4070c15a1299c6114075581db7b0974.

At root's request, the separate dense-view example was also compiled with direct rustc into ignored output and run: .local/native-fixtures/dense-40/dense-40.arcadia plus oracle. It reports semantic assertions passed, 46 elements / 42 relations, 40 routed edges, 12 ms, 0 label-overlap pairs and 151 exactly coincident path pairs. Those routing metrics do not establish native readability; root owns that acceptance check. No Cargo target files were mutated by these standalone generator builds.