Macro-4 Risk Register — R2-B2 (2026-06-19)

Date: 2026-06-19 · Workstream: R2-B2-MACRO-4-STAGING-WORKBENCH-IO-CONTRACT-TD-ENTRY-GATE-2026-06-19 (Deliverable 4 of 90) · Editorial revision: rev1 Class: risk register · READ-ONLY · NON-ENACTING · NON-AUTHORIZING · NO write performed.

Metadata convention. Editorial revision (rev1) only. Storage revision/content_length authoritative at read time.

---

0. Status and non-authorization

STATUS: PASS — engineering / design-readiness. The risks Macro-4 itself must guard against, with the drift token + stop disposition for each. Engineering PASS ≠ authority PASS. Default: HOLD.

1. Purpose

Name every way this macro could drift out of design-only and the lock that prevents it.

2. Sources / evidence read

Prompt §4–§6 (forbidden / contingency / safety locks); Macro-3 risk maps (bad-input fail-open, no-production-touch, delete-fast); inspect-producer §8/§15. Main process, no reader-agents.

3. Accepted baseline (carried)

A design-readiness macro can prepare and define contracts; it cannot build, write schema/corpus, open TD, or implement.

4. Evidence / analysis — risk matrix

#	Risk	Drift token	Disposition
RK-1	Actual TD content appears (schema/DDL/function body/wiring)	ACTUAL_TD_DRIFT	HOLD
RK-2	A staging schema/table/corpus is created	STAGING_BUILD_REQUIRED_BUT_FORBIDDEN / STAGING_TD_DRIFT	HOLD
RK-3	IO contract becomes a mega-registry / shared mutable write surface	IO_CONTRACT_OVERREACH	HOLD
RK-4	Channel treated as runtime authority	CHANNEL_AUTHORITY_DRIFT	HOLD
RK-5	S2 owner assigned / ownership row written	OWNER_ASSIGNMENT_DRIFT	HOLD
RK-6	Điều 0-G source adopted / recovered / patched	SOURCE_ADOPTION_DRIFT	HOLD
RK-7	Bad-input test executed	BAD_INPUT_TEST_RUN_DRIFT	HOLD
RK-8	B5/B7 opened as active workstream	B5_B7_SCOPE_CREEP	HOLD
RK-9	R1/KG opened as active workstream	R1_SCOPE_CREEP	HOLD
RK-10	Any DB write/DDL/DML; blocker falsely resolved	(FAIL conditions)	FAIL
RK-11	v0.1/FIX7 V3 overwritten or v0.2 promoted	F8 / F9	FAIL/HOLD
RK-12	A deliverable not independently discardable	NOT_LEGO_COMPATIBLE	HOLD

5. Contract / requirement / matrix / result

Status this run: no drift token triggered. Each token has a dedicated guard deliverable (locks group 66–72; risk maps 43–54). Only KB consolidation docs were written; runtime was read-only.

6. Owner-gated future work

Any action a token guards against is Owner-gated; forbidden now.

7. What remains unresolved

Risks are guarded, not eliminated — they re-arm for every future macro and for the eventual build.

8. Ready for GPT/Codex review

Yes — Codex should add any drift mode this register omits.