## Verdict
**ITERATE**

## Claim Checks
- Reviewed planner Revision 17 at `/home/cube/projects/richard/traning coach/.gjc/_session-019f8455-334a-7000-99ca-318dfd0e06b1/plans/ralplan/019f8455-334a-7000-99ca-318dfd0e06b1/stage-17-revision.md`, index SHA-256 `cad4b9a7b94798e6961cbcfe6a0a60fb0a29fc455f51899b9b7829b96b728210`, against normative planner Revisions 13–16 at SHAs `604064771fc3dcc4166ddcda28c47c6a216f6f1ca807c4160fcd3333f6b5e353`, `cc2b45593affc9b4d1b86e1bee216610e27b5ee2795a37325b32054a1af2de3c`, `761099d8ad358ee4d667e2f8053f3eddb74ab525dc62ea3e0088a83dcc9e71aa`, and `c7523fbc899907721197b6d4410e3ae5648c86748d8413feed567e2599e197ce`.
- Revision 17 resolves the real primary observation enum names, accepted `check_in_validated` combined projection, event-ID ordering defect, global config lock inversion, canonical collection ordering, Telegram absence-lookup defect, signed calorie direction table, and Meal-slot share/tolerance allocation.
- Safety projection remains under-specified. The current enum includes `safety_flag` (`checkin_cli/models.py:30-45`), and generic unsafe recording emits it (`checkin_cli/store.py:376-382`), but Revision 17 maps only `safety_audit`. Wizard safety audits also preserve `session.supersedes` (`checkin_cli/wizard.py:809-815,1022-1035`), so blindly inheriting root classification can turn a safety-bearing non-root event into MORNING/NUTRITION unless safety status/payload is explicitly projected orthogonally. The plan does not define that rule.
- The new ordering protocol is not executable for all stated writers. Revision 17 requires every post-cutover canonical append to receive `append_sequence`, but gives no `canonical-sequence.jsonl` row schema or independent append-intent schema. Its only source intent requires `session`, `flow`, and `day`, which do not exist for non-observation appends such as payment, satisfaction, operator time, drafts, and archived imports. Those writers all reach the canonical stream through current `EventStore` append paths (`checkin_cli/store.py:97-218,278-319`). A crash between canonical append and sequence append therefore has no specified recovery for these events.
- The claimed inherited recovery tables do not exist. Revision 16 says only that a recovery journal completes a missing authority mirror; it does not define state tables. Revision 17 names `prepared|committed|abandoned` rows but still omits the write order and deterministic result for prepared-only, fact-only, mirror-only, commit-only replay, conflicts, and adaptive-sequence reservation. Its own expected-row crash fixtures cannot be authored without choosing those semantics.
- Meal candidate validity is improved, but the retained `<=12 total serving units` bound is still ambiguous. `(serving_grams-serving_min_grams) % serving_step_grams == 0` defines an allowed gram grid, not the unit count. At `serving_grams == serving_min_grams`, executors still must guess whether the count is 0, 1, `min/step`, or another value.
- Representative implementation simulations covered: (1) standalone and superseding safety events through the projector, (2) wizard, generic record, import, and pilot-record canonical appends through sequence/source-day recovery, and (3) Meal compiler enumeration at min/step/max. No source mutation, tests, formatters, or product commands were performed.

## Missing Evidence
1. An explicit safety rule covering `safety_flag` and every event with unsafe/coaching-held safety payload independently of root flow.
2. A strict canonical-sequence row/intent/recovery contract that covers every post-cutover append writer, not only source-day roots.
3. Actual source-day and authority-mirror recovery state matrices; the referenced Stage-16 tables are absent.
4. One exact formula for total serving-unit count.

## Approval Boundary
The separate adaptive stream, immutable baseline, sole resolver, frozen-prefix cutover direction, per-customer lock order, one-call strict Telegram transport, no-resend unknown policy, deterministic collection order, signed calorie table, and basis-point Meal allocation may proceed into the next plan revision unchanged. Gate A implementation is not approved until safety and canonical append/journal recovery are exact. Gates B–D additionally remain outside approval until serving-unit semantics, user policy values, and manual Telegram proof are resolved.

## Summary
- Clarity: Stronger; four load-bearing semantics still require guesses.
- Verifiability: Golden/crash fixture coverage is broad, but exact expected rows cannot be derived from the stated journal contracts.
- Completeness: Telegram, ordering direction, collection order, rate sign, and Meal allocation are addressed; safety, sequence recovery, mirror recovery, and serving-unit count are not.
- Big Picture: The chosen architecture remains sound, but fail-closed projection and reconstructible cross-file writes must hold for every existing writer.
- Principle/Option Consistency: Conservative delivery is now consistent; silent safety reclassification and unrecoverable sequence gaps are not.
- Alternatives Depth: Normative Revision 13 remains sufficient.
- Risk/Verification Rigor: Good fixture breadth; missing transition semantics prevent deterministic implementation.

## Required Changes
1. Make safety orthogonal to root flow: map standalone `safety_flag`, union typed reasons from any event in a resolved chain, and require any unsafe/coaching-held event to block candidates even when it supersedes a MORNING/NUTRITION/TRAINER root. Add standalone and superseding `safety_flag`/`safety_audit` expected-byte fixtures.
2. Define `canonical-sequence.jsonl` exactly: path, row fields/digest, event identity/digest, contiguous-or-gap policy, dedupe/conflict behavior, allocation point, and restart recovery. Add a sequence/append intent usable by non-observation events, or explicitly narrow sequencing and state how historical ordering handles every excluded writer. Cover generic record, imports, payment/satisfaction/operator-time, draft events, and wizard events.
3. Publish explicit source-day and authority-mirror state matrices for no fact, matching fact, conflicting fact, missing/present mapping or mirror, reserved adaptive sequence, and missing commit. Specify the exact append/fsync order and idempotent recovery output for each state; do not reference nonexistent Stage-16 tables.
4. Define total serving units with one equation and boundary examples, including the count at minimum serving grams and the aggregate `<=12` calculation.