## Summary
Revision 15 (`.gjc/_session-019f8455-334a-7000-99ca-318dfd0e06b1/plans/ralplan/019f8455-334a-7000-99ca-318dfd0e06b1/stage-15-revision.md`, SHA-256 `761099d8ad358ee4d667e2f8053f3eddb74ab525dc62ea3e0088a83dcc9e71aa`) makes Revision 14 and Revision 13 explicitly normative and resolves the prior strict-transport, shared-lock, `supersedes`, canonicalization/arithmetic/resolver, feature-config, downgrade, and retained meal/compiler-scope blockers. One HIGH durability defect remains: a new root event can survive without its authoritative source-day sidecar after a crash and is silently treated as legacy data.

## Claims
- The normative precedence and Gate-A numeric/delivery suppression are explicit in Revision 15, “Normative plan set.”
- Revision 15 replaces `correction_of` with the existing `Event.supersedes`; the current strict schema and model both expose `supersedes` (`/home/cube/.hermes/profiles/physique-coach/contracts/checkin-event.schema.json:4-65`; `/home/cube/.hermes/profiles/physique-coach/workspace/checkin_cli/checkin_cli/models.py:753-766`).
- It specifies one-call topic-59-only adaptive transport based on `_send_message_strict_topic`, correctly avoiding the current generic path’s retry and topic-removal fallback (`/home/cube/projects/richard/hermes-agent/gateway/platforms/telegram.py:2534-2623,3268-3286`).
- It defines a customer-wide authority lock and a provider-call linearization point, closing the previously separate canonical-event and delivery-lock domains (`/home/cube/.hermes/profiles/physique-coach/workspace/checkin_cli/checkin_cli/store.py:411-423`; `/home/cube/projects/richard/hermes-agent/gateway/platforms/nutrition_coaching.py:1246-1261`).
- It adds the missing typed config/parser and atomic monotonic epoch plan; the current parser only accepts `enabled` and `registry_path` (`/home/cube/projects/richard/hermes-agent/gateway/platforms/nutrition_coaching_config.py:11-26`).

## Analysis
### Spec compliance
Revision 15 correctly preserves legacy-reader compatibility by keeping observation-day metadata out of the strict canonical event wire, declares Revision 13’s full meal/catalog compiler and release material normative, and restores the exact contracts requested by the pass-14 review. Its canonical byte rules, Decimal ingestion/scales, exact-lattice compiler, bitemporal resolver, config epoch transaction, transport result taxonomy, and independent-writer race fixtures are implementation-grade.

### Remaining durability failure
The source adapter mandates: append/fsync the canonical root event first, then append the sidecar mapping; any root with no sidecar is treated as a legacy root and derives its day from `occurred_at`. A crash or failed sidecar append between those operations leaves a post-cutover root indistinguishable from legacy data. For a delayed save this silently changes the observation date, D+, and projection window rather than failing closed—the precise data-integrity property the sidecar was introduced to preserve. Holding the transition lock prevents concurrent observation during the normal path but cannot repair process death after the first durable append.

### Antithesis and synthesis
Canonical-first minimizes orphan sidecars, but orphan sidecars are harmless because readers can ignore mappings whose root is absent. Silent reclassification of a committed new root is not harmless. Prewrite and fsync the immutable mapping under the same lock before the canonical root, then tolerate/clean rootless sidecars; alternatively use a durable finalization journal plus a rollout watermark that rejects post-cutover roots lacking a sidecar. Both preserve old-reader compatibility without changing the canonical event envelope.

## Root Cause
The two-file source-day transaction has an irreversible first write but no recovery marker distinguishing a newly committed root from a true legacy root.

## Findings
1. **HIGH — Revision 15, Canonical source adapter:** New finalization writes the canonical event before `source-days.jsonl`, while absent mappings are silently legacy-derived. A crash in between can misbucket a new delayed-save root and produce incorrect D+/trend inputs. Persist the mapping before the root and ignore/clean absent-root mappings, or define a durable journal/watermark that makes a post-cutover missing mapping an integrity failure. Add crash-before/after-each-write, restart recovery, and delayed-save correctness fixtures. Reported as P1.

## Recommendations
1. Resolve the source-day two-file crash contract before Gate A. The preferred shape is sidecar fsync first, canonical root second, with exact mapping idempotency/conflict rejection and orphan-sidecar cleanup.
2. Add the described crash/restart fixtures to the Gate-A exit criteria; a post-cutover root without its mapping must never silently take the legacy-date path.
3. Retain Revision 15’s strict one-call transport, shared lock, `supersedes` fold, canonical arithmetic/resolver, config epoch, downgrade, and normative meal/compiler clauses unchanged after this correction.

## Architectural Status
BLOCK

## Code Review Recommendation
REQUEST CHANGES

## Tradeoffs
| Option | Benefit | Risk | Decision |
|---|---|---|---|
| Canonical event then sidecar | No orphan sidecars | Crash silently reclassifies new data as legacy | Reject |
| Sidecar then canonical event | Preserves authoritative date; orphan mapping is ignorable | Requires orphan cleanup/recovery | Prefer |
| Finalization journal + post-cutover watermark | Retains canonical-first ordering | More state and recovery logic | Acceptable alternative |