[Polichinel]

Strategic /review-rr pass on reports/technical_risk_register.md, plus the guard that stops its findings recurring.

Why

The register was four days behind two events — run-0's delivery (2026-07-27) and the þing-01 verdict (2026-07-28) — and between them they fired or expired the triggers on eight open entries. Four entries still read "we'll verify at the global run" for a global run that had already happened.

Structural

	Before	After
Header	25 open / 30 resolved	21 / 37 (58 total)
Actual	27 open / 28 resolved	matches header

Root cause of the mismatch: C-19 and C-45 carried RESOLVED bodies but were never physically moved out of ## Open Concerns. Both re-verified in code before relocating.

Also relocated/resolved: C-08 (→ views-datafactory), C-37/C-38 (→ views-frames — code left in #62), C-42 (settled the direct internal contradiction between its own two closing paragraphs), C-32 (measured, not deferred). C-34 merged into C-30 as a forwarding stub so cross-refs still resolve.

Eight stale unfao.py line ranges refreshed (the manager grew 273 → 636 lines); C-161 / C-146 / C-71 namespaced to the registers that own them.

Calibration

• C-30 tier 1 → 2 — its stated residual was "not yet run against a real global delivery"; run-0 exercised the guard at 64,742 cells / 28,356,996 rows.
• C-24 tier 2 → 3 — the entry's own conclusion is that this is not this repo's defect to fix.
• C-26 held at tier 1 with an open question logged rather than a guess: whether get_feature_frame (the path run-0 actually used) inherits the fillna(0.0) could not be verified from here, since pipeline-core is deliberately absent from test environments. Needs the pipeline-core seat.

12 triggers rewritten — 4 expired, 5 symptomatic, 1 circular, 1 compound. C-43's now says plainly that it has fired.

The finding that matters

Run-0 discharged the availability half of the go-global debt (path runs, 5.6 GB peak, coverage proven) and left C-43 — the correctness half — standing alone and un-gated, with unverified enrichment values now in FAO's store. Proving the path runs at scale was never what C-43 asked for. Its forward-check (sample land_gaul assignments against the datafactory GAUL parquet) is cheap and folds into #131 q1.

Clusters

A–F indexed only deleted mapper-era code and covered no open entry. Collapsed to a historical stub; replaced with G (inherited pipeline-core surface), H (go-global debt), I (governance-artifact drift), J (delivery aftercare) — covering 19 of 21 live entries.

Three entries registered

• C-56 — the run-0 OOM incident chain (23.8 GB kill → 5.6 GB frame-native). Required by the un_fao: retire the pandas historical path — deliver frame-native end-to-end (fixes run-0 OOM) #126 closeout plan and never written; the repo's most consequential production event had no register presence. Notes the live memory budget it leaves for sample-bearing deliveries.
• C-57 (T3) — PLATFORM-001 registry drift. D1 correctly settled referenced by URL, never copied — but that moves the failure mode: nothing local can diff appwrite_env.py against coordinate_registry.toml. Two changes are already anticipated (legacy key retirement, second store).
• C-58 (T2) — a wrong Appwrite coordinate auto-provisions instead of raising, on both client lineages, on every write. þing-01 D5 requires the opposite. This is the finding from my seat that widened the verdict's D8 trigger. Not this repo's code to fix; mitigations named.

The guard

tests/test_register_integrity.py (8 tests, stdlib only) — counts match sections, no closed entry under Open, section order, unique IDs, required field rows, references that resolve here or name their owning repo.

Mutation-checked: each of the three historical bugs was re-introduced and caught by its own guard. Same pattern this repo already used for ADR-013 (test_falsify_adr013_*.py) and þing-01 (test_env_declaration.py).

Also

appwrite_cache/ gitignored — downloaded partner-store objects (production_forecasts/, unfao_bucket/, cache_metadata.json) were untracked and unignored, one git add -A from being committed ahead of the first public release (#125).

Verification

ruff clean. 278 passed, 41 xfailed. The 5 failures are the known local pyarrow byte-parity tests (local 23.0.1 vs pinned 16.1.0) — CI authoritative.

No source code touched — register, one new test, one gitignore line.

🤖 Generated with Claude Code