## Summary
The stage-09 plan is grounded in the current Hermes and both profile roots and is strong on redaction, typed semantics, one-call OpenAI-only provider isolation, journal integrity, prepared-delivery pinning, and adaptive publication locking. It cannot be approved at the iteration cap because its claimed open-ended prose is a finite local style language, its required live-shadow release proof bypasses the coordinator that produces `shadow_selected`, and the legacy-config preflight has no executable owner or invocation.

## Claims
- The plan identity matches the supplied SHA-256: `index.jsonl` records `cf871b4ad6ca14e476f135317d8861efe6678f44e5abd7ac64de212f0a64d81d` for `stage-09-revision.md`.
- The current unsafe daily route is real: `telegram.py:5663-5948` accepts generated feedback and `_saved_physique_coaching_feedback` gates it on `coaching_feedback_enabled`; the plan's deletion/canonical replay boundary is therefore targeted.
- Both deployed profile configs retain that legacy key; physique-coach is enabled while dualcoachtest is disabled (`physique-coach/config.yaml:623-633`, `dualcoachtest/config.yaml:624-634`).
- Both profiles share the schedule ledger model, validated ready-fence/hash-chain/tombstone checks, and bounded digest-only `ScheduledDeliveryReceipt` (`customer_schedule.py:89-130,812-1140,1348-1435`), so the proposed pinned-material reader is the appropriate narrow recovery seam.
- The profiles have materially different card render grammars (`physique-coach/adaptive_nutrition.py:4629-4693`; `dualcoachtest/adaptive_nutrition.py:4859-4916`), and the plan correctly covers both.
- Current adaptive publication persists an arbitrary validated card under locks but does not bind a generated candidate to freshly revalidated authority (`nutrition_coaching.py:3677-3757`); the proposed atomic service operation addresses that race.

## Analysis
### Spec compliance
The plan covers all requested surfaces, deletes rather than aliases the unsafe daily route, pins weekly bytes before reservation, handles existing prepared weekly rows without rendering/calling the provider, keeps adaptive recovery payload-only, and gives each profile its own golden suite. Its direct provider is precisely configured to OpenAI with one non-streaming call, no retries, no alternate provider, and credential isolation; this complies with the OpenAI-only/no-Kimi contract.

The determinism architecture is otherwise coherent: typed branch selection is local; redacted capsules expose only opaque artifact identity plus semantic/action IDs; full-document rejection, locked-byte reconstruction, HMAC journal identity, hash chaining, mode checks, and no-retry claim handling preserve the primary contract. The scheduled and adaptive persistence owners remain the existing durable stores, rather than creating a second content store.

### Architecture and antithesis
The strongest argument for the style grammar is correct: arbitrary Korean text cannot be proven to preserve clinical/action/delivery semantics. The current tokenized design safely prevents that authority transfer. However, the stated benefit is not open-ended prose. A bounded language with one-to-three placeholders and at most 16 tokens selected from a fixed 20-item lexicon is finite and locally enumerable; omitting a materialized variant table does not change that fact. The plan must choose an honest, reviewable product contract: constrained model-selected style composition, or a new safety mechanism that can validate genuinely free prose. It cannot claim both unconstrained/open-ended model prose and deterministic semantic non-authority.

The adaptive candidate binding is well-shaped: it moves validation and persistence into the existing authority/publication critical section, recomputes a digest over canonical payload/provenance/revision, and makes recovery no-call. The weekly reader likewise uses existing ledger authority. These are proportional extensions rather than parallel workflows.

The rollout gate is internally inconsistent. The coordinator—not the direct OpenAI client—owns claims, strict parsing, `shadow_selected`, terminal journal rows, candidate discard, and publication permission. Direct-client-only live calls therefore do not provide the stated proof before promotion. The live test needs a synthetic coordinator path in shadow mode with the direct OpenAI client as its sole network dependency.

The migration sequencing is safe in principle: old code treats a missing legacy key as false, leaving the active physique bridge enabled. But the proposed new preflight is not assigned to a file/API or release command. The existing Gate-D preflight is a duplicated, closed receipt schema in both `customer_admin.py` modules, and `PhysiqueCheckinConfig.from_extra` returns early for disabled dualcoachtest; a stale key there will not be found after cutover unless an explicit deployment preflight reads it.

## Root Cause
The plan conflates model-selected composition over a fixed finite lexicon with open-ended prose, then uses a client-only live test to certify coordinator-owned shadow semantics. The same lack of executable ownership appears in the migration preflight.

## Findings
- **HIGH — stage-09-revision.md:143-171:** The finite safe-lexeme grammar does not satisfy an open-ended LLM-prose requirement. Reported as P1: restore a genuinely open-ended prose contract.
- **HIGH — stage-09-revision.md:291-302:** The controlled live-shadow proof invokes only the direct client but requires coordinator-owned `shadow_selected`/journal/publication guarantees. Reported as P1: exercise the coordinator in the real-model shadow gate.
- **MEDIUM — stage-09-revision.md:253-278:** The legacy-config preflight lacks a concrete implementation owner and invocation, leaving the disabled dualcoachtest legacy key undetectable by the new bridge parser. Reported as P2: locate and invoke the legacy-config preflight.

## Recommendations
1. Resolve the fundamental contract conflict before implementation: either rename/re-scope the feature to constrained typed style composition and remove the open-ended acceptance claim, or supply a demonstrably semantic-safe mechanism for genuine free Korean prose.
2. Replace the live test's direct-client-only path with coordinator invocation over synthetic canonical surfaces, a temporary journal, direct OpenAI client injection, and fail-fast publisher/reservation/editor seams. Require terminal journal `shadow_selected` evidence and zero calls to those seams.
3. Name and implement one read-only profile migration preflight API/command, list its files in the implementation sequence, invoke it on both real profile configs before cutover and promotion, and test its explicit diagnostic for each legacy shape.

## Architectural Status
BLOCK

## Code Review Recommendation
REQUEST CHANGES

## Tradeoffs
| Option | Semantic safety | Expressiveness | Review result |
|---|---|---|---|
| Current finite safe-lexeme composition | Strong deterministic safety | Low; finite style permutations | Valid only if product contract is explicitly constrained style, not open-ended prose |
| Free-form model prose | High expressiveness | High | Incompatible with deterministic no-semantic-authority guarantee without a new trusted validation model |
| Typed, genuinely productive DSL with formally bounded nonsemantic constructs | Potentially strong, but requires proof/goldens | Moderate | Viable only after a precise grammar and formal rejection boundary are designed |