## Summary
Revision 22 materially improves the execution plan: it specifies the operator menu/session protocol, full action matrix, P2–P6 observable outcomes and cleanup, canonical runbook ownership, and focused release lanes. It cannot receive the requested CLEAR/APPROVE verdict because the Topic-59 ingress rule permits an unsafe alternate route and the two-file downgrade reservation lacks an order/fence that prevents an old binary from sending during a crash window.

## Claims
- Review basis: the immutable stage-22 plan at the assigned path (supplied SHA `83e8864e33e25d33cddb955351ffd02d248cced88c9d017cca36d28ba1daffe4`) was inspected in full.
- The plan explicitly covers all listed Telegram ingress categories, opaque sessions, typed edit input, action-specific pins, P2–P6 UI/rows/cleanup, a durable schedule ledger API, runbook authority, and profile/gateway test lanes (stage-22-revision.md:222-261).
- Current Telegram ingress is independently registered as text, command, location, media, and callback handlers (`/home/cube/projects/richard/hermes-agent/gateway/platforms/telegram.py:2151-2168`); the planned reservation therefore needs an unambiguous first boundary before those handlers dispatch.
- Current schedule protection is only an exclusive-create legacy `.claim`; a preexisting claim is what prevents another scheduler from sending (`/home/cube/.hermes/profiles/physique-coach/workspace/checkin_cli/checkin_cli/customer_schedule.py:75-91`).
- The present root runbook establishes profile-package and virtual-environment context before commands (`PILOT_RUNBOOK.md:10-35`), unlike the revision's bare release command list.

## Analysis
### Spec compliance
Positive: Revision 22 resolves the previously thin behavioral descriptions for exact menu actions, session consumption/idempotence, typed note entry, final delivery messages, no-retry outcomes, scenario isolation, terminal cleanup, runbook authority, and removal of production retry/release. The API names and failure-injection test boundaries are concrete.

Blocker 1: “all wrong triples reject or follow their own registered route” conflicts with zero downstream calls for a reserved Topic-59 space. Because routing is handler-based today, it must specify that the `(chat_id, topic_id)` review space is matched first; the exact review triple alone may reach the adaptive service, and all other senders in that space must terminally reject. Separate registered routing is safe only outside that address. Configuration must reject address overlap with customer/trainer spaces.

Blocker 2: “atomically/fsync” cannot make two independently named files one atomic write. The proposed new ledger and legacy tombstone must be ordered safely. Writing the ledger first leaves a crash interval in which the old reader does not see a claim and can send. Tombstone-first, each file and parent directory fsynced, is conservative: a tombstone-only pair blocks sending and becomes recovery-required. A durable cutover fence must prevent either scheduler version from starting until incomplete pairs are reconciled.

The stated commands are directionally correct test selections but are not exact executable commands without working directory and interpreter. This can cause collection against the wrong checkout/interpreter and invalid release evidence.

### Antithesis
A strict Topic-59 rejection policy can make an accidental overlapping route visibly fail rather than preserve legacy behavior, and tombstone-first can leave harmless-but-manual recovery records. Those costs are appropriate: this plan's primary invariant is no unauthorized or duplicate provider send. Routing fallback and ledger-first improve convenience only by reopening that invariant.

### Constructive synthesis
Add a single ingress predicate shared by every registered handler: first match review `(chat_id, topic_id)`; exact full review triple dispatches only to `AdaptiveOperatorService`, every other actor is rejected, and non-review space continues normal routing. Validate address-space disjointness at config/preflight time.

Define schedule reservation as: acquire schedule lock; write/fsync immutable old-format tombstone; write/fsync new prepared row; fsync parent directories; only then expose eligibility and call provider. Tombstone-only/ledger-only/mismatched digest states set a durable no-send recovery fence. Both scheduler versions refuse startup while the fence is present. Add old-reader starts after every crash point.

Make each command include its checkout and interpreter, for example profile commands from `/home/cube/.hermes/profiles/physique-coach/workspace/checkin_cli` using that package's `.venv/bin/python`, and gateway commands from `/home/cube/projects/richard/hermes-agent` using its `.venv/bin/python`.

## Root Cause
The remaining gaps are boundary ambiguity rather than missing feature lists: an address reservation is defined by incompatible fallback language, and a cross-version exactly-once scheme is described as an impossible atomic two-file action without a crash-safe serialization order.

## Findings
1. HIGH — `stage-22-revision.md:223`: Topic-59 reservation permits a wrong triple to use another registered route despite the stated all-downstream-zero property. Require first-match terminal rejection for wrong actors in the configured review `(chat_id, topic_id)` and validate address disjointness. Reported as P1.
2. HIGH — `stage-22-revision.md:239-240`: Dual-write has no safe write order; a ledger-first crash allows the existing old claim-only reader to send. Require tombstone-first fsync, durable no-send cutover fence, and old-reader crash tests. Reported as P1.
3. MEDIUM — `stage-22-revision.md:256-261`: Release commands omit required CWD and interpreter. Make them self-contained. Reported as P2.

## Recommendations
1. Resolve the Topic-59 first-match/reject rule and add same-chat/topic wrong-user tests for text, command, location, media, and callback before implementation.
2. Replace the dual-write statement with tombstone-first, fsync/fence/recovery semantics and test every crash plus old-reader startup boundary.
3. Replace bare release commands with explicit per-repository CWD/interpreter invocations and corresponding parser assertions.
4. After those corrections, re-run the architect consensus pass; the otherwise detailed P2–P6, UI/session, action-matrix, documentation-authority, and test-lane content can remain.

## Architectural Status
BLOCK

## Code Review Recommendation
REQUEST CHANGES

## Tradeoffs
| Option | Benefit | Cost | Verdict |
|---|---|---|---|
| Allow wrong Topic-59 actors to use another route | Preserves accidental overlapping routes | Breaks reserved-space isolation | Reject |
| Reserve `(chat_id, topic_id)` first and reject wrong actors | Enforces all-ingress isolation | Makes overlap a visible configuration error | Choose |
| Ledger-first dual write | New-ledger record appears first | Old binary can send after crash | Reject |
| Tombstone-first plus recovery fence | Old binary remains blocked at every crash boundary | Some incomplete intents require reconciliation | Choose |