# Critic review — stage 41

reviewed_planner_path: `/home/cube/projects/richard/traning coach/.gjc/_session-019fa699-506a-7000-a490-6163a4ceb697/plans/ralplan/019fa699-506a-7000-a490-6163a4ceb697/stage-41-revision.md`
reviewed_planner_sha256: `1f9db59e7d67b22adddfc614d10d4edd2033963035757e8487318ead6b671dea`
stage_n: 41
verdict: **ITERATE**

## Blockers

1. **The immutable incumbent pin table cannot admit the actual target baseline.** The target currently has 44 wizard events and 44 canonical-sequence rows, and the listed terminal IDs are reachable as stated, but every pinned terminal SHA-256 in the plan is wrong. For example `gate_d_weight_only_20260714_00` is newline-record SHA-256 `71ae1a7edc8f8c09ae68d8d0318875b7300f98974f597a84be1ddef32a2fddde`, not `7530c1d0…`; `...20260727_10` is `78f2d6b9bbd0dd4e59ba0224385aabbe07f3019acdcfc818d7c2a09439d46d34`, not `144100ec…`. The same mismatch exists for all 11 listed terminal rows. Because the plan requires exact match before writes, its selected 18-root/one-correction case is unreachable and import must fail zero-write. Regenerate and include the complete verified terminal digest table from the sealed record bytes.

2. **Crash completion is contradicted by the preflight rule.** Section 0 requires the strict preflight loader to reject any partial append protocol before writing, while section 3 says import begins by completing a pending pair. A crash after durable pair-intent or either candidate suffix necessarily presents that forbidden partial state, so the stated preflight stops before `complete_pending_synthetic_pair_locked` can run. Select and specify one ordering: a sealed, intent-aware recovery admission that validates the unique deterministic pending candidate before completion, followed by ordinary strict read-only loading; or an explicit resume entrypoint that performs that admission before the baseline seal. Ordinary loaders must remain nonrepairing.

3. **Derived reconciliation/retraction is neither readonly nor crash-completable.** `reconcile_synthetic_history_readonly` is declared as a public API and local E2E step, yet section 5 requires it to append coverage and prepare/commit intents. Retraction can durably append its canonical retraction and then crash before coverage/tombstone/intents, but no derived state machine, durable ordering, suffix-completion rule, or retry classification is specified. This can leave canonical retraction visible while active evidence remains and violates the shared coverage invariant. Rename/select the mutating reconciler versus read-only validator, and define a generation-keyed, append-only derived transaction with exact journal paths/schema, prepare/commit order, crash boundaries, and retry rules. Require strict readers to reject every incomplete derived transaction and tests to cover each boundary.

4. **The scenario and golden oracle are not deterministic enough to implement.** “`C(...)` on training days else `rest`” never defines the training-day offset set. ID/dedupe derivation likewise gives inputs but no exact preimage/encoding. Further, the plan demands a checked-in fixture of all serialized events while `recorded_at_kst` is first chosen dynamically and persisted in pair-intent; if serialized event bytes include that field, a static fixture cannot be byte-identical. Pin the training offsets, ID/dedupe preimages and encodings, and either make the timestamp a deterministic scenario value or exclude it from the byte/golden claims and define a separate timestamp oracle.

5. **New append-only pair artifacts are not fully named or covered by the immutable manifest.** Pair-intent and pair-complete records need exact path(s), versioned typed schemas, per-record chain/integrity fields, retention/lookup selection, and explicit allowed-manifest treatment. The current artifact assertion excepts canonical/sequence/source-day/source-intent journals only; a separate pair journal would otherwise make the required byte-for-byte immutable-manifest assertion impossible. The same explicit path/schema/allowed-delta treatment is needed for coverage/tombstone storage.

The fixed target’s actual overlap shape is otherwise reachable: the 11 specified terminal IDs own offsets 16–22, 24–26, and 29; offset 11 is omitted; offset 23 has no incumbent terminal. The selected 18 roots plus one offset-23 correction is therefore sound once the terminal pin bytes and the above state-machine/oracle gaps are corrected. The canonical→adaptive lock order, rejection of normal-loader recovery, tombstone membership direction, local-only tripwires, and focused test categories are directionally consistent but do not close these blockers.