# Adaptive Nutrition Workflow — Best Terminal Revision 18

## Review status
The five-pass review ceiling was reached. This best version incorporates the terminal pass-17 blockers but is not represented as Architect/Critic consensus. Stages 13–17 remain normative except where superseded here. Planning only.

## Safety is orthogonal
`safety_flag` and `safety_audit` are safety-only roots. Any event of any type whose typed `safety.coaching_held=true`, status unsafe, or normalized safety signal/reasons are present contributes to the unioned safety projection before ordinary flow mapping. Safety-bearing superseding events inherit root/customer/day and cannot clear earlier reasons except through an explicit typed safety-resolution event; unresolved reasons block every candidate. Fixtures cover safety_flag, safety_audit, and safety-bearing corrections.

## Append-only journal and sequence rows
Journals use immutable transition-row unions, never mutable state fields:
- `<kind>_prepared(intent_id,...,row_digest)`
- `<kind>_committed(intent_id,prepared_digest,result_ids...,row_digest)`
- `<kind>_abandoned(intent_id,prepared_digest,reason,row_digest)`
Exactly one terminal marker may follow prepared; identical marker replay is idempotent, different/second terminal marker conflicts. Replay order is append sequence.

`canonical-sequence.jsonl` row: schema_version=1.0, sequence_id, append_sequence, intent_id|null, canonical_event_id, canonical_event_digest, event_index, previous_prefix_digest, resulting_prefix_digest, row_digest. `event_index` starts at 0. Prefix digest is SHA-256 of exact canonical event-file bytes through the LF ending that event; legacy frozen prefix records byte_length, event_count, prefix digest. Sequence numbers are contiguous; gaps/conflicts block.

Every post-cutover EventStore writer participates. Observation writers require source-day intent; non-observation writers use append intent without flow/day and still get sequence/mirror recovery. WizardStorage finalization is routed through EventStore transaction API; direct post-cutover appends are rejected.

## Verifiable source intent
Prepare stores canonical `RootIntentPreimageV1`: customer_key, session_id, mapped_flow, observation_kst_day, and `event_projection` containing exact future Event fields available before ID/timestamp (event_type,payload,supersedes,source metadata). Its digest is independent of the Event envelope. After root append, commit binds intent digest to persisted canonical_event_id and canonical_event_digest. Recovery recomputes event projection from persisted root, compares it to prepared projection, then completes sequence/day mapping; mismatch blocks.

## Explicit recovery matrices
Source append: prepared/no root→abandon; root/no sequence→verify intent then append sequence; sequence/no day mapping for observation→append mapping; all present/no commit→commit; post-cutover root with no valid prepared intent→block. Identical replay returns prior receipt; conflicting digest/day/flow/terminal marker blocks.

Authority mirror: prepared/no canonical fact→abandon; fact/no mirror→verify fact digest then append mirror; mirror/no commit→commit; fact without prepared intent post-cutover→block adaptive actions. Config epoch uses same transitions; partial customer fanout keeps global epoch prepared and adaptive actions blocked until each listed customer commit exists. These state matrices are exact fixture tables.

## Meal-slot energy source and serving units
Macros are the sole slot energy source. Allocate protein/fat/carbs integer grams jointly with bounded deterministic search so each slot's derived calories is exactly `4C+4P+9F`; slot calorie targets are soft comparison targets, not independently allocated authority. The seven-day/day totals remain exact. Objective: macro normalized L1 first, calorie normalized absolute error second; tie by slot then macro vector. Tolerance formula is `abs(actual-target)/target*100 <= tolerance`; target zero passes only actual zero, otherwise fails. Divergent remainder fixtures are pinned.

For a catalog row, allowed serving grams are `min + k*step` for integer `k>=0` while <=max. One selected food row at any allowed grams counts as one serving unit, including k=0/minimum. Aggregate serving units are the sum of selected row instances across a Meal slot and must be <=12; distinct foods <=4. Duplicate food rows are combined before counting and must land on an allowed gram value.

## Telegram reconciliation evidence
Unknown remains permanent unless the operator supplies an immutable `ExternalDeliveryReceiptV1`: delivery_id, revision_id/digest, attempt_id, exact chat_id, topic_id=59, provider_message_id, rendered_body_digest, observed_at_kst, evidence_source, operator identity, evidence digest. Coordinator validates all IDs/digests/destination against the unknown attempt; mismatch leaves unknown. Because Telegram cannot prove body digest through API lookup, pilot acceptance requires contemporaneous captured provider response or exported message evidence that includes exact chat/topic/message ID and body matching the rendering digest. Without that evidence, no delivered/sent transition is permitted.

## Gate implications
Gate A includes all exact source/journal/safety/meal fixtures above. Gates B–D remain blocked on user-confirmed policy values and manual evidence. No product execution before final approval.