ARCADIA-Studio/harness/release-semantic-remaining-plan.md

Remaining semantic review GUI: bounded implementation plan

Read-only review on DATA c091f80e6ecf90e9aa6f13ec6fd34924c5ef55de plus the current keyed-row/recovery working tree. No production edits or new tests were performed for this plan. Existing Annotation/Binding and unordered members are complete within their documented slice and must be reused.

Exact remaining contract

Area	Core selector and semantics	Current desktop boundary
Ordered lists	Member { collection: Steps / FragmentBranches, keys } independently decides presence; Order(Steps / FragmentBranches) separately decides the complete surviving order. Steps covers sequences and Branch occurrences. Every survivor occurs exactly once. Source anchors may place an insertion, but ambiguous placement requires an explicit final order. Target-local members survive Take.	keyed::supported excludes these collections; complete lists are editable only inside replacing occurrence groups.
Ownership	Child(KeyPair<Id>) attaches an existing mapped child by changing its Parent; removal detaches only from this owner. A new child needs an explicit transition mapping. Child and Header.Parent decisions must agree on the same actual child slot.	No independent Child editor. Candidate composition currently emits only the selected trace's target record.
Incident relation	Incident { keys, end: Source / Target } attaches an existing mapped relationship endpoint. Detachment requires an explicit final endpoint reviewed through the relationship trace; a boolean false alone is insufficient.	No endpoint attachment editor or linked relationship review in this modal.
Artifacts	Artifact { keys, facet }: Presence, Name, Description, Owner, Relation, Uri, Revision, Fragment. Creation needs a complete typed artifact candidate and explicit review of all seven introduced metadata facets. Deletion retires exact metadata observations. Metadata is reviewed from its initially attached owner trace; moves must reconcile attachment and Owner.	Artifact observations are visible; editing and exact artifact-history reset are disabled. No artifact candidate collection is emitted.
Multiple sources	One SemanticTransitionRequest carries explicit mappings, selected trace per source, canonical references, independent resolutions/resets per source, and one final candidate per record ID. All source proposals are derived from the same frozen project. Equal actual-slot proposals agree; contradictions reject regardless of source iteration order.	State::request constructs one source/mapping/review/target candidate. Switching trace clears its current drafts.

Smallest coherent sequence and ownership

1. Ordered membership and order. Add semantic_review/ordered.rs and focused tests; extend existing member choices rather than replacing keyed rows. Show explicit OA/SA member pairs, independent presence decisions, and a named final order with Up/Down controls. Preserve raw order across deselection and rejected previews. Initial defaults may retain the destination order but must not silently acknowledge an ambiguous insertion. Extend semantic_review.rs, view.rs, and recovery.rs only. This is independently shippable using current single-record request construction; no core change is demonstrated as necessary.
2. Batch review foundation with existing facets. Introduce a session containing per-source drafts and one shared references table, accepted base and preview. Add/remove an explicit source-target-trace row; select a row to use the existing facts/forms, retaining other rows' raw drafts. Compose one candidate per record ID, then invoke the core once for the full batch. Display contradictions beside every involved source, retaining all decisions. Extend recovery to all rows and shared draft state. Own semantic_review/**; coordinate the Workflow wrapper and root's App event integration only if its public State interface changes.
3. Child and incident attachments. Add attachments.rs with typed existing object/relationship pair choices and Source/Target endpoint labels. Child Candidate edits a separate child record. For incident removal offer a linked relationship-review row and explicit replacement endpoint, using the batch foundation; do not offer a misleading standalone unlink checkbox. Include creation only via explicit transition mapping. Generalize candidate assembly to a map of typed record IDs. Keep full induced-impact review and one Apply.
4. Complete artifact lifecycle. Add artifacts.rs: select existing attached links or deliberately reserve a new destination identity, stage its explicit pair, and edit typed raw metadata with separate None versus empty optional text. Creation shows every required metadata decision together. Move identifies the new owner and linked review rows; deletion shows retired history before Apply. Enable exact artifact history reset only with lifecycle support. Preserve provisional identity and invalid text in recovery. Own semantic subtree; reuse ordinary artifact form helpers only with their owner's coordination.

No core contract extension is presently a verified blocker. Multi-record candidate composition and the single-source State shape are desktop dependencies, not evidence that planner scope must be broadened. Do not implement batch review as sequential Apply operations: later sources must never observe earlier proposed writes.

Engineering example and oracle

Review an OA vehicle-start process into an SA startup chain. OA adds “verify interlock” between “request start” and “energize”; SA already retains a local “self-test” between those anchors. Stage the explicit occurrence pair and Take presence. Ambiguous placement must block until the user selects a final sequence, for example request, self-test, verify interlock, energize. Review a second OA maintenance-start process against the same SA chain: contradictory placement of the same mapped occurrence must block in either source order. Agreeing explicit final orders should yield one candidate and one transaction.

Then attach an already mapped “verify interlock” function to the selected subsystem, move its incoming functional exchange through an explicitly reviewed endpoint, and attach a requirement link with URI, revision and fragment. A conflicting kept Parent or attachment must block the whole batch. Creating the requirement link with only Presence selected must block until every introduced metadata facet is reviewed.

Compare GUI-produced requests and prepared results against direct core calls on the same frozen fixture. Existing r3_semantic.rs oracles include ordered_member_requires_anchor_or_explicit_order_and_preserves_target_only, combined_ordered_membership_commutes_or_requires_agreed_anchors, child_membership_and_parent_resolutions_agree_by_actual_child_slot, artifact_creation_requires_reviewed_metadata_and_deletion_retires_exact_facts, artifact_owner_candidate_moves_link_and_conflicts_with_kept_attachment, and target_only_artifact_move_records_owner_and_metadata_in_either_order.

For every slice, compare both directions, source iteration permutations, exact acknowledged/retired scopes and accepted impacts. Apply must preserve unrelated records and comments, round-trip source/model/history, and produce one Undo/Redo. Invalid raw drafts, rejected/stale previews and workflow recovery must retain all authored values. Native review remains required at normal and minimum window size.