## Findings

- **HIGH — Exact-link migration can commit unintended cross-table trigger side effects while reporting success and `restore_test=true`.**  
  `scripts/health/lab_source_reconciliation.py:448-456, 500-504, 545-563`  
  `_protected_lab_digest()` protects only `laborwerte` columns other than `canonical_document_id`; it does not detect mutations to `dokumente` or other tables. A deterministic temporary-DB probe added an `AFTER UPDATE` trigger that changed `dokumente.review_status`. `apply_exact_backfills()` returned success with `restore_test=True`, while the live database retained both the link and the unintended `review_status='triggered'`. This violates the rollback/protected-state claim in `docs/sprint6g-a2-laboratory-reconciliation.md:81` and the unchanged medical-state claim at `docs/sprint6g-a2-laboratory-reconciliation.md:85-91`.

- **MEDIUM — The staging plan does not provide review entries or exclusion reasons for every canonical discrepancy.**  
  `scripts/health/lab_source_reconciliation.py:323-330, 376-392, 582-584`  
  Real audit output identifies **228** workbook rows absent from canonical V5, but `staging_plan()` silently drops incomplete rows and deduplicates others, emitting only **204** candidates. The private report does not persist `staging_candidates`, and the plan has no excluded-candidate section or reason codes, leaving 24 discrepancies without item-level review coverage. The updated published counts now accurately disclose 228 versus 204, and emitted candidates remain unverified.

## Verified

- Canonical workbook/V5 comparison uses the same allowlist identity; percent and micro-unit variants resolve correctly.
- `/record-labs` and `/series` remain count-consistent above 100 rows; focused suite: **10 passed**.
- Real aggregate matched code: canonical exact **19**, canonical discrepancy **228**, plan actionable **204**, verified-not-catalogued **91**, catalogue-without-verified **1**.
- Python compilation, JavaScript syntax, and `git diff --check` passed.
- **Files modified:** none.