# Stage 44 — sealed synthetic-history transaction revision

## Boundary
Planning only; supersedes stage 43 SHA-256 `dd0b3874d8153739450e7de15c861544c49fd49eda4d2c640db2d2f097ae6947`. No product/profile/test/Telegram/provider/deployment mutation is authorized. Later source/fixture changes are limited to `/home/cube/.hermes/profiles/dualcoachtest/workspace/checkin_cli`; later runtime work is limited to the fixed registered `dualcoachtest/virtual_customer` APIs. Never direct-write JSONL or call `recover`, migration, truncation, delete/restore, gateway/service/provider/Telegram, approval/activation/reservation/delivery/deployment.

Fixed scenario: `synthetic_30_day_v2`, seed `synthetic-30day-v2-dualcoachtest-2026-07-27`, offsets 0..29/KST 2026-06-28..2026-07-27, recorded time `2026-07-27T23:59:00+09:00`, seed SHA `2f319fff9a0d89189f8c943605a048972fc7a90013b04ca303551b65c471b936`, scenario SHA `34119a44c4a505433bbc192f1bd9a0a72fb7d2df9dc845ae21a5ab308ed332cd`, owner SHA `3daa1af451f593b7bd0832ac6c04d5e93fa2c2cd04d0a1960ed7bd810697ad18`, generation SHA `63d284286ed10e3a480b6480eea47b3662904caeb502ee5570fc9f65343b1520`. Preserve baseline 44, offset 11 omitted, root offsets `[0,1,2,3,4,5,6,7,8,9,10,12,13,14,15,23,27,28]`, and training offsets `[1,3,5,8,10,12,15,22,26,28]`; all-skipped is zero-write.

## ADR decisions
1. Closed literal baseline manifest, never runtime-discovered artifact universe.
2. In-workspace typed synthetic protocol plus explicit union loader; do not edit unrelated physique-coach contract.
3. Durable intent-aware sole mutating recovery; ordinary readers fail closed.
4. Coverage is generation members only, never incumbent 44.
5. Literal independently checked scenario/golden/derived-plan fixtures; a generator never blesses its own result.

## Sole correction identity
The only correction ID is `synthetic_6a2a26ed2bc60126dc0e040c`; no alternative spelling is valid. It is ordinal 19 after the 18 roots and is the correction ID in golden bytes, pair intent/complete, transactions, coverage, tombstones, retraction/replay/crash tests and reports.

Canonical bytes use UTF-8 `json.dumps(value, ensure_ascii=False,sort_keys=True,separators=(',',':'))` plus LF. Exact correction JSON+LF (831 bytes, SHA-256 `9d74419621e3e9f8d08f8f2e5fcc279b927ffea9816c322194119c916b87fe82`) is:
```json
{"check_in":{"body_weight_kg":78.2},"dedupe_key":"242929ce8e124aaaf52c020e2ce0ead656bc66308468b6f6309318ddea7f96eb","event_id":"synthetic_6a2a26ed2bc60126dc0e040c","event_kind":"correction","event_type":"correction","history_correction":{"corrected_fields":["body_weight_kg"],"root_event_id":"synthetic_a5d5104b012a39359bbbeeab","root_payload_sha256":"a1f8083950f0b5ff15abdd2cd4318013d8132db34846cf674cac2ee831bd2282"},"occurred_at_kst":"2026-07-21T00:01:00+09:00","provenance":{"generation_digest":"63d284286ed10e3a480b6480eea47b3662904caeb502ee5570fc9f65343b1520","source_ref":"synthetic_history_v2:dualcoachtest:virtual_customer","source_type":"synthetic_derived"},"recorded_at_kst":"2026-07-27T23:59:00+09:00","schema_version":"synthetic_history_event_v1","status":"accepted","supersedes":"synthetic_a5d5104b012a39359bbbeeab"}
```
Base64: `eyJjaGVja19pbiI6eyJib2R5X3dlaWdodF9rZyI6NzguMn0sImRlZHVwZV9rZXkiOiIyNDI5MjljZThlMTI0YWFhZjUyYzAyMGUyY2UwZWFkNjU2YmM2NjMwODQ2OGI2ZjYzMDkzMThkZGVhN2Y5NmViIiwiZXZlbnRfaWQiOiJzeW50aGV0aWNfNmEyYTI2ZWQyYmM2MDEyNmRjMGUwNDBjIiwiZXZlbnRfa2luZCI6ImNvcnJlY3Rpb24iLCJldmVudF90eXBlIjoiY29ycmVjdGlvbiIsImhpc3RvcnlfY29ycmVjdGlvbiI6eyJjb3JyZWN0ZWRfZmllbGRzIjpbImJvZHlfd2VpZ2h0X2tnIl0sInJvb3RfZXZlbnRfaWQiOiJzeW50aGV0aWNfYTVkNTEwNGIwMTJhMzkzNTliYmJlZWFiIiwicm9vdF9wYXlsb2FkX3NoYTI1NiI6ImExZjgwODM5NTBmMGI1ZmYxNWFiZGQyY2Q0MzE4MDEzZDgxMzJkYjM0ODQ2Y2Y2NzRjYWMyZWU4MzFiZDIyODIifSwib2NjdXJyZWRfYXRfa3N0IjoiMjAyNi0wNy0yMVQwMDowMTowMCswOTowMCIsInByb3ZlbmFuY2UiOnsiZ2VuZXJhdGlvbl9kaWdlc3QiOiI2M2QyODQyODZlZDEwZTNhNDgwYjY0ODBlZWE0N2IzNjYyOTA0Y2FlYjUwMmVlNTU3MGZjOWY2NTM0M2IxNTIwIiwic291cmNlX3JlZiI6InN5bnRoZXRpY19oaXN0b3J5X3YyOmR1YWxjb2FjaHRlc3Q6dmlydHVhbF9jdXN0b21lciIsInNvdXJjZV90eXBlIjoic3ludGhldGljX2Rlcml2ZWQifSwicmVjb3JkZWRfYXRfa3N0IjoiMjAyNi0wNy0yN1QyMzo1OTowMCswOTowMCIsInNjaGVtYV92ZXJzaW9uIjoic3ludGhldGljX2hpc3RvcnlfZXZlbnRfdjEiLCJzdGF0dXMiOiJhY2NlcHRlZCIsInN1cGVyc2VkZXMiOiJzeW50aGV0aWNfYTVkNTEwNGIwMTJhMzkzNTliYmJlZWFiIn0K`.

## Schema and loader
Ordinary authoritative schema remains `/home/cube/.hermes/profiles/physique-coach/contracts/checkin-event.schema.json`, loaded by unchanged `checkin_cli.models.validate_event()` in `checkin_cli/models.py`; ordinary events still must pass it. Add in-workspace `synthetic_history_models.py` (frozen, forbid-extra typed root/correction/retraction/coverage/intent/tombstone/pair/transaction models), `schemas/synthetic-history-event-v1.schema.json`, `schemas/synthetic-history-journals-v1.schema.json`, and `history_synthetic.load_canonical_record_bytes`. The loader dispatches exact ordinary versions to unchanged validator and exact `synthetic_history_event_v1` to the synthetic schema then explicit `event_kind` model; unknown/mixed/cross-kind fields, non-derived provenance, wrong KST timestamp fail. Update `CanonicalEventTransaction.read_snapshot_readonly`, EventStore, AdaptiveEventStore, projection and `AdaptiveOperatorService._validate_journal_consistency` to use it.

## Reproducible independent fixtures
Commit literal checked-in `fixtures/synthetic_history_v2/synthetic-history-v2-scenario.json` with all 19 ordered members, every exact numeric/string/enum/timestamp/target/actual/omission/owner/payload SHA/ID; `golden-canonical-events.jsonl`, 19 rows/29,775 bytes/SHA `56a49db5f96e44bb48bb5dd1f6d7f93e974cf72ac1a282409b7cdc66be47b54a`; and literal `golden-derived-plan-import.json`/`golden-derived-plan-retract.json` schema `synthetic_derived_plan_v1`. Test-only independent `tests/fixtures/build_synthetic_history_v2_fixture.py` parses scenario without importing production model/serializer/store and emits only a temp candidate. Tests independently parse scenario/expected bytes, calculate fixture SHA/count, then compare production serializer actual bytes; no generator may update expectations. Use Decimal SHA-derived U, ROUND_HALF_EVEN, exact textual enums and explicit precision (factor 3 decimals; weight 1; calorie/macros integer) so float/locale/time/random/order cannot influence bytes.

## Closed baseline manifest
Commit `expected-baseline-manifest.json` schema `synthetic_expected_baseline_v2`, a literal ordered closed table of relative path/size/line_count/SHA and JSONL raw bytes base64/SHA, with hard-coded table SHA/count. It lists profile.yaml, registry, both activation paths, every named non-lock nutrition-plans artifact, wizard events, all 15 literal draft paths, all three telegram binding paths and both views; reject missing and extra, never discover at runtime. Bind ordinary-v1 digest `16f32bdeab4bd0c12ed8f73312efcc0f9d6ba06e9919cc32bc25cf21675546d7` to registry SHA `f68c6950f61014722e69fac8375477350a414fa520f839e0eedad308c8a33689` and activation SHA `dc01bba9bea725aa272645b9d4a25a1b8e55faf1fe5c23f2f70d910b82e7a35c` to exact activation paths. Preserve pins events 36631/44/`6eb973a06db55df9d4ee1614fb98c2c32f676b240bb03f1b8cc6c706bea989eb`, sequence 11518/44/`238bddc00904d1177aff8e1279871d11e8996b5d9b224f3af96e6dfda6b131f3`, source days 21425/44/`bb3fd649945c56d0e43fdcf3542fbc5321365a7f3f268317e1d22072e647aed3`, intents 57986/88/`525edd99e6d1b5e464bfaa7a05c6482684a1efc3b9570c78a58bed0e6295c20b`. A read-only pre-execution capture may construct the large literal table once from current baseline; its reviewed digest/count must be hard-coded before mutation or execution stops pending amendment. Sealed reader uses O_NOFOLLOW and rechecks dev/ino/size/SHA pre/post lock and every append.

## Six journals, exact plans, recovery, coverage
Six private 0600 initial-missing/empty journals: `nutrition-plans/synthetic-history-pair-intents.jsonl` v1, `synthetic-history-pair-completes.jsonl` v1, `synthetic-history-transactions.jsonl` v1, `synthetic-coverage.jsonl` v1, `synthetic-coverage-intents.jsonl` v1, `synthetic-coverage-tombstones.jsonl` v1. Derived-plan fixtures contain fixed plan SHA/count and every ordered `{phase,journal,ordinal,bytes_b64,sha256}`: import pair/event/sequence/complete/transaction/coverage-intent/coverage/tombstone counts 19/19/19/19/4/38/19/0=117; retract 1/1/1/1/4/38/0/19=65; combined 182. Thus every phase suffix is exact bytes, not digest-only.

`resume_synthetic_history_transaction` is sole mutator. Under lock order canonical → adaptive → journals lexical, it admits only one matching durable intent after immutable-prefix + exact-owned-suffix validation, completes intent→event→sequence→complete via append/write_all/flush/fsync, then strict loads. Revalidate immutable prefix and exact transaction suffix after every append; foreign/malformed/ambiguous/replacement is torn_pair_stop/CONFLICT zero-write. Legal states ABSENT, PAIR_INTENT, EVENT_SUFFIX, SEQUENCE_SUFFIX, PAIR_COMPLETE, CANONICAL_COMPLETE, DERIVED_PREPARED, DERIVED_COMMITTING, DERIVED_COMPLETE and RETRACTION forms. Ordinary readers/proposals/gateway/validation never recover and reject incomplete state.

Coverage invariant is synthetic-generation members only: initial active=0/tombstones=0; import active=19/tombstones=0; retraction active=0/tombstones=19; all-skipped zero writes. `resolve_canonical_coverage` replaces raw source-day equality while retaining legacy rows. Verify model/schema negatives, all baseline/fixture/plan bytes, every flush/fsync crash branch, prefix/suffix revalidation, locks, import/replay/retract/replay, reader failure, immutable outcomes, copied-root E2E maintain/no calorie change and no active post-retraction. Tripwire live constructors/calls; no endpoint.