refactor(review): retire FINALIZE through last-event atomic closure #3587

Pre-flight Checklist

• I have searched existing issues and this is not a duplicate.
• I understand that PRs will be rejected if the linked issue does not have status:approved.

📝 Bug Description

Ordinary atomic review still exposes review finalize as a separate mutation after all reviewer or validator inputs have already been admitted. That extra lifecycle round reconstructs candidate views, rebinds workspace state, collects general final evidence, and can enter recovery even though review is informational and delivery is unmanaged.

In the current atomic architecture, FINALIZE owns no independent product decision. CaptureAdmittedReviewerResult already admits each exact candidate-bound lens result, while ReviewCore.finalize primarily verifies that all selected lenses are present and reduces the captured set to approve or escalate. Keeping those operations separated creates a failure surface after the substantive work is complete.

This is the root class behind multiple FINALIZE, correction-evidence, targeted-validation, intended-untracked, and recovery dead ends. The fix must shrink the lifecycle: the last admitted event becomes the atomic reducer and burn trigger.

🔄 Steps to Reproduce

1. Start an ordinary high-risk review for an exact workspace candidate and admit all four selected reviewer results.
2. Observe that STATUS still requires a separate FINALIZE operation instead of reducing the completed captured set.
3. Enter the bounded correction path, capture repository verification evidence, and obtain the requested targeted validator result.
4. Invoke FINALIZE to submit the already-bound validator result.
5. Observe that candidate-view reconstruction or intended-untracked/index reconciliation can fail after review and verification have completed, leaving STATUS to request recovery for review plumbing rather than a candidate defect.

Concrete sanitized failures observed on current main:

candidate-view-invalid: candidate view context is missing or ambiguous for FINALIZE
mutation_performed: false

review/recover: intended-untracked path "<path>" is already tracked
mutation_outcome: unknown

The failed FINALIZE also changed intended-untracked paths to staged entries while reporting no mutation. Candidate bytes and the current candidate tree remained unchanged.

✅ Expected Behavior

The lifecycle closes on the last admitted event:

• The last reviewer capture acquires the authority lock, verifies that every selected lens is present, reduces the complete admitted set exactly once, returns advisories, and atomically burns authority when no candidate-caused severe finding survives admission.
• Candidate-caused severe findings transition directly to the one bounded correction.
• After a correction, the admitted targeted-validator result directly burns or escalates the lineage.
• Clean 4R completion requires no general final-evidence collection and no separate FINALIZE round.
• STATUS remains read-only and never offers review.finalize.
• Review remains informational and never governs commit, push, PR, archive, release, or other repository delivery.

❌ Actual Behavior

The lifecycle has two closing authorities:

1. capture operations admit the exact results;
2. FINALIZE reconstructs context and decides whether those already-admitted results may close.

The second authority can fail or mutate client workspace/index state after the candidate has already passed SDD verification, repository tests, and independent review. Recovery then diagnoses review transport state instead of candidate correctness.

🖥️ Environment

• Gentle AI Version: gentle-ai dev, main@51a0d60b
• Operating System: Linux (Other)
• AI Agent / Client: Other — Pi
• Affected Area: CLI (commands, flags)

Acceptance Criteria

Clean path

• review capture-result admits one exact lens result and, when it is the final outstanding selected lens, elects exactly one closer under the existing authority lock.
• A complete admitted set with no candidate-caused BLOCKER/CRITICAL finding returns terminal advisories and atomically burns authority in the same operation.
• Concurrent final-lens submissions cannot create two closers, duplicate outcomes, or surviving authority.
• No clean 4R path requests repository verification evidence or a separate finalize invocation.

Correction path

• A complete admitted set with candidate-caused severe findings transitions directly to the existing single bounded correction.
• The exact requested targeted-validator result is the terminal event: pass burns; failure escalates.
• General final-evidence capture is not a second review authority. Repository tests remain ordinary SDD/repository evidence.
• A validator that refutes the original finding cannot be converted into approval by caller-authored interpretation.

Public contract removal

• Delete gentle-ai review finalize as a public lifecycle command and capability.
• Delete FINALIZE from negotiated transitions, schemas, help, prompts, adapters, runtime assets, sanctioned-exit messages, fixtures, journeys, and docs.
• No compatibility command, parser, alias, migration reader, or dual route remains.
• Pi and other adapters transport capture events opaquely; shared Go contracts own reduction and burn semantics.
• Driven evidence proves consent → freeze → four captures → terminal response + burn and correction → validator → terminal response + burn/escalation.

Delivery and cleanup boundaries

• Review outcomes remain informational and cannot block delivery or archive.
• Functional slices stay reviewable; split at independent rollback boundaries when authored changes approach 400 lines.
• Broad dead-code deletion follows the functional cut under refactor(review): delete orphaned review authority after the SDD clean break #2423 rather than being mixed into the transition change.

Root-Cause Cluster

This issue is the canonical architectural line. During implementation, audit and disposition the open symptom reports involving separate FINALIZE/correction closure, including #2478, #2503, #3014, #3134, #3194, #3205, #3427, #3450, #3467, and #3476. Close or supersede only when named driven tests prove each reported symptom is unreachable.

Additional Context

The implementation must preserve the atomic foundation:

consent → freeze → lenses → [bounded correction → targeted validator] → terminal response + burn

“Finalize” may remain as an internal pure reducer name temporarily during implementation, but it must not survive as a public phase, command, transition, or caller-supplied decision point. The final architecture has one closing mutation: the last admitted event.