# Stage 43 — Architect review

## Review basis

Reviewed immutable Planner revision `stage-43-revision.md` with SHA-256 `dd0b3874d8153739450e7de15c861544c49fd49eda4d2c640db2d2f097ae6947`.

Concrete read-only baseline checks confirm the four declared target canonical files exactly match their stated SHA-256s and sizes/counts: wizard events `6eb973…989eb` (44/36,631), canonical sequence `238bdd…131f3` (44/11,518), source days `bb3fd6…7aed3` (44/21,425), and source-day intents `525edd…5c20b` (88/57,986). The named `profile.yaml`, registry, feature epoch, overlay, and policy digests also match the target values stated in the revision.

## Verdict

**Status: BLOCK**  
**Decision: REQUEST CHANGES**

### Blockers

1. **The correction ID is self-contradictory, so the byte oracle is not deterministic.** The only displayed golden correction ID (line 65) ends `…040c`; line 69 simultaneously calls `…040c` the superseded stage-41 typo. No replacement literal appears. Specify one final correction ID, then make the golden JSONL hash, manifest member list, correction preimage, retraction assertions, and all crash/replay tests use that same value.

2. **The immutable artifact universe is not fully pinned in an auditable way.** Line 35 names a few paths/digests but delegates all binding/registration/policy/audit/revision/authority/lifecycle/reservation/delivery/activation/credential/destination artifacts to “every … artifact discovered by the sealed registered runtime.” That is an open runtime-discovered set, contrary to an immutable precondition; the ordinary-v1 binding and activation digests also lack declared artifact paths. Commit the complete literal path/byte/SHA-256 table (and a table digest) as a fixed input, including the two mapped hashes, and require the preflight to reject both missing and extra entries without registered-runtime discovery.

3. **Derived transaction suffixes are not yet byte-sealed.** Canonical pair intents carry exact base64 bytes, but `synthetic_history_tx_v1` only carries an undefined `derived_plan_digest`; coverage intents carry row/tombstone digests rather than the exact derived bytes or a versioned, fully specified preimage. The stated “exact expected suffix” cannot be independently reconstructed or rejected at every derived crash boundary. Define a versioned derived-plan canonical preimage and digest, include the ordered raw canonical-JSON+LF bytes (or unambiguous base64 equivalents) for every transaction, coverage, intent, commit, and tombstone suffix record, and pin a golden plan hash/count. Recovery and suffix assertions must compare those exact ordered bytes.

### Closed stage-41 concerns

- Intent-aware canonical crash admission is concrete: one matching durable pair intent, exact expected bytes/prefixes, and otherwise `torn_pair_stop` with zero writes.
- Canonical and derived artifacts are named, versioned, append-only, and lock ordering plus legal recovery states are specified.
- Correction/retraction folding is designed consistently through root-keyed tombstones, but remains blocked by the unresolved correction ID.
- Immutable artifact/prefix assertions and exact owned-suffix assertions are required after all outcomes, subject to the incomplete artifact and derived-plan pins above.
- The no-live boundary is explicit: fixed profile/customer APIs only, copied-fixture tests, and construction/call tripwires for Telegram, providers, gateway startup, approval, activation, delivery, reservation, and deployment.

## Required revision outcome

Resolve all three blockers without weakening the sealed-preflight, read-only reader, append-only recovery, or no-live constraints. Re-review is required because each blocker governs deterministic crash/replay behavior.