# Risk register — recovery, ratified direction and architecture candidate

**v1.3-RC — APPROVED PLANNING BASELINE.** Original comprehensive historical review register is absent. REC-R IDs remain recovery/governance risks; T-R and AR retain provenance. Listed priority is not accepted residual risk. Owner adoption of eight planning contracts does not resolve technical risks without evidence; reserved acceptance remains staged. Material source/Book mismatch is BOOK_STALE → dependent execution STOP.

| ID | Risk | Priority / state | Evidence | Control / disposition |
|---|---|---|---|---|
| REC-R01 | Missing governing text causes invented product truth | ORIGINAL TEXT GAP RESOLVED; provenance/control risk remains | Three full sources restored/hash verified | Use exact source clauses; original referenced records still absent |
| REC-R02 | Candidate roadmap/book mistaken for ratification | HIGH / OPEN | Current document creation vs Owner review requirement | Visible candidate labels; no self-ratification |
| REC-R03 | Historical BLOCKED H1 mistaken for framework FAIL or PASS | HIGH / CONTROLLED IN CANDIDATE | H1 report O; Owner §2 | Preserve exact BLOCKED status; no runtime claims |
| REC-R04 | False authority from roadmap/Parent/Child or AI role | HIGH / OPEN | Owner §§3,14 | Verify cut/delegation; no automatic chaining or appointed Governor assumption |
| REC-R05 | Derived HTML/JSON drifts from Markdown | MEDIUM / OPEN | Owner §15 | Source hashes, generator, consistency audit; Markdown wins |
| REC-R06 | Evidence lost or overwritten during recovery | HIGH / CONTROLLED IN CANDIDATE | Existing H1 package | Byte-identical preservation; backup manifest/CRC/SHA256 |
| REC-R07 | Unrelated project material contaminates this book | HIGH / CONTROLLED IN CANDIDATE | Prior excluded attachment exists | Explicit source allowlist; no unrelated product import |
| REC-R08 | Backup/preview exposes secrets or internal governance publicly | HIGH / CONTROLLED IN CUT | Current no-publish/no-secret boundary | Copy allowlisted documentary sources only; no env dump; local Preview only, no publish |
| REC-R09 | Restoration confused with independent acceptance or validated configuration | HIGH / OPEN | Verified source bytes, candidate output, no runtime evidence | Separate source availability, authority, actual configuration and review |

## Technical Direction I — retained risk deltas

| Source ID | Risk / priority | Control / remaining evidence |
|---|---|---|
| T-R01 | Scope inflation / HIGH | Prevent journal→CRM, curated proof→EPK and validation→product expansion |
| T-R02 | Positioning / MEDIUM residual | Ratified commercial lead; actual offer copy and Music routing approval |
| T-R04 | Lost inquiries / HIGH | H3/H4 durability, retry/delivery visibility and assigned staff follow-up |
| T-R05 | Rights/publication / HIGH | Accurate item relationship, asset/permission approval |
| T-R07 | Platform/vendor mismatch / HIGH | One isolated H1; candidates pending, no parallel framework experiment |
| T-R12 | Recovery / HIGH operational | Naming closure is not actual retention/history/restore/RPO/RTO proof |
| T-R17 | Lock-in / MEDIUM | H10 usable content/media export and no venture storage coupling |
| T-R22 | Irreversible geography / HIGH before publish | Separate validation/production H7; no future production publishing here |
| T-R23 | Platform drift / MEDIUM ongoing | Official-doc and actual-config rechecks at relevant later gates |

**T-R21 documentary inconsistency: CLOSED / retired by the ratified Technical Direction**, specifically App Storage cross-app and recovery naming disputes. This is a restored prior closure, not author acceptance of account/runtime risks. Preserve history; do not reopen it.

## Architecture §20 — reconciled candidate risks

| Source ID / priority | Risk | Mitigation / gate and residual uncertainty |
|---|---|---|
| AR01 HIGH | Provisional framework/runtime unsuitable | Bounded H1; build/runtime/cold behaviour unproven |
| AR02 HIGH | CMS/draft/preview coupling exposes drafts or pages | Approved revisions/protected preview/retained release; H2/H9 assets/cache/promotion |
| AR03 HIGH | Lost/duplicate inquiry, orphan intent, false success | Atomic acceptance+outbox and identity; H3 concurrency/commit ambiguity |
| AR04 HIGH | Durable intent never dispatched after idle/restart | Recoverable trigger/staff inspection; H3/H4 activation/retry/cost ownership |
| AR05 HIGH | Replica-local state/DB connection exhaustion | Shared durable controls/bounded pooling; H3/H5 actual limits |
| AR06 HIGH | Journal grows into CRM/OS | Minimal concepts/truth/change control; Data review, follow-up pressure |
| AR07 HIGH | Unsupported/revoked claims persist publicly | Rights provenance/revision/corrective publication; H2/Brand, approved proof/removal |
| AR08 MEDIUM | Heavy media/scripts harm premium mobile UX | Budgets/selective hydration; H1/H6/Design final asset mix |
| AR09 HIGH | Provider outage/duplicate events corrupt handoff | Correlated durable attempts; H3/H4 provider idempotency/event semantics |
| AR10 MEDIUM | CMS lock-in/export gap | Stable contracts/representative export; H10 assets/revisions/cost |
| AR11 HIGH | Recovery overclaim/unsafe replay | Account and coordinated restore; H8 actual history/RPO/RTO/replay |
| AR12 HIGH before publish | Permanent unapproved location | Distinct H7 gates; actual resource/processors unknown |
| AR13 HIGH | No operating owner; failures unnoticed | Minimal staff process/backup/monitoring; named owners/targets/ceiling open |
| AR14 HIGH | Secret/private input leaks; ID enumeration/privacy | Separate contracts/logs/environment; no public lookup; H3/H6/H9/Security |
| AR15 HIGH for intake | Journal outage prevents confirmed acceptance | Editorial independence, controlled degraded mode/retry/fallback; H3/integrated boundary |
| AR16 HIGH for publication | Cannot identify approved public content/app/assets | Release-manifest traceability; H2/H10 tooling linkage/retention/reproducibility |

Constitution VII.3/XIV/XV governs material exceptions and residual HIGH/CRITICAL risk acceptance. Missing mandatory evidence cannot be hidden behind PASS WITH GAPS. No risk is independently accepted by authoring this register.

Prior H1 blocker is retained, not treated as evidence of unacceptable Astro behavior. No full security model or original residual-risk acceptance is inferred here.