# Risk register Nonfinal architecture review · 0.4.0. Generated from `assets/fixtures-cost.js`; edit that source and rerun `node tools/generate-docs.js`. Unmeasured source behavior, privacy/publication mistakes, epoch fencing failures, and unresolved identity splits remain material. ## id risk_identity_split ## title Identity evolution, split and merge errors ## impact High ## likelihood Medium ## trigger A source renames or re-bundles an item; a pack-size change is matched to the old catalog item; two items merged that differ (500 g vs 2 × 250 g). ## mitigation Identity changes need human approval when LLM-dependent (EST). Corrections are first-class events. Keep split/merge as explicit operations with lineage, never in-place edits. ## evidence Count of mapping corrections per 1,000 accepted mappings during the prototype; time to propagate a correction to the product projection. ## residual How often real sources re-use identifiers for different configurations is unknown. ## owner OPEN ## label PROP ## id risk_db_round_trips ## title Database round trips per capture ## impact Medium ## likelihood Medium ## trigger Each capture needs receipt, listing lookup, fact compare, outbox write and case checks — several sequential round trips from a Worker to an external PostgreSQL. ## mitigation Batch writes in one transaction; one stored procedure or CTE per stage; place the database near Worker placement; use Hyperdrive pooling. Model shows queries / day as a capacity signal. ## evidence Measured round trips and wall time per capture in the first slice; database CPU at pilot volume. ## residual Latency between Cloudflare placement and the provider region is unmeasured. ## owner OPEN ## label OPEN ## id risk_cross_tenant ## title Cross-tenant leakage ## impact High ## likelihood Low ## trigger A query on cat_primary or ten_primary data omits the tenant predicate; cached projection shared across tenants; evidence URL guessed. ## mitigation Row-level security or mandatory tenant scope in the data-access layer; synthetic tenants ten_synth_a / ten_synth_b in tests; private evidence bucket with no public origin. ## evidence Isolation test suite results against ten_synth_a and ten_synth_b; review of every query path (see trust.html). ## residual Shared catalog cat_primary is by design visible to all tenants; mistakes in overlay precedence remain possible. ## owner OPEN ## label PROP ## id risk_projection_rebuild ## title Projection recovery and rebuild ## impact High ## likelihood Medium ## trigger Product projection corrupted or schema changed; consumer must re-apply all accepted events, or the outbox was pruned. ## mitigation Retain the accepted-change log long enough to rebuild; consumers dedupe by event ID and order by revision (EST); a snapshot + replay procedure. ## evidence Timed rebuild of the pilot projection from the event log; event-log retention decision. ## residual Rebuild time at pilot scale is unknown; queue costs during a rebuild are modelled only as replay volume. ## owner OPEN ## label OPEN ## id risk_provider_dependence ## title Provider dependence (Cloudflare, model provider) ## impact High ## likelihood Medium ## trigger Price change, plan restructure, regional outage, model deprecation or behaviour change in the extraction model. ## mitigation Ports for queue, object store and model (technology-ports); S3-compatible evidence; PostgreSQL outside Cloudflare; pin model versions and re-validate extraction on change. ## evidence Port conformance tests running against a second implementation; extraction regression set scored per model version. ## residual Bindings (Queues, Hyperdrive, Browser Run) are not portable without rework. ## owner OPEN ## label PROP ## id risk_collection_feasibility ## title Collection feasibility (blocking, terms of use, geography) ## impact High ## likelihood High ## trigger Source blocks automated fetches, terms forbid collection, storefront varies by visitor country, regional host capacity unavailable (Hetzner CX line showed "not available"). ## mitigation Prefer official APIs and feeds; per-source legal review before onboarding; verified egress geography for geo-gated sources; record execution region separately from market (EST). ## evidence Per-source feasibility record: access method, terms reviewed, block rate over two weeks. ## residual Terms can change after onboarding; blocking behaviour is adversarial. ## owner OPEN ## label OPEN ## id risk_runaway_cost ## title Runaway processing costs (LLM loops, replay storms, browser time) ## impact High ## likelihood Medium ## trigger A source redesign drives parser failure up and every failure goes to the LLM; a replay re-enqueues millions of captures; browser sessions hang. ## mitigation Bounded attempts per revision (EST); per-day LLM and browser budgets with circuit breakers; replays deterministic-only by default; dedupe fallback groups so one redesign creates one improvement item. ## evidence Sensitivity tab: LLM line dominates the stress scenario. Need measured parser failure and tokens per extraction. ## residual Budget thresholds are not yet chosen. ## owner OPEN ## label PROP ## id risk_evidence_retention ## title Evidence retention, storage law and takedown ## impact Medium ## likelihood Medium ## trigger Stored HTML/screenshots include personal data or copyrighted material; a source asks for removal; retention exceeds what is needed for corrections. ## mitigation Retention by evidence class (DEC-06); checksum-addressed storage with deletion lineage; strip or avoid personal data at capture. ## evidence Legal review of retention per market; deletion drill on R2. ## residual Replays older than retention become impossible by design. ## owner OPEN ## label OPEN ## id risk_reviewer_throughput ## title Human reviewer throughput ## impact High ## likelihood High ## trigger Cases needing a person exceed reviewer hours — the pilot defaults already imply 300 hours / month. ## mitigation Group duplicate fallback cases; auto-accept only deterministic, non-identity changes; prioritise by consumer impact; measure minutes per case. ## evidence Measured minutes per case and cases per day in the prototype. ## residual Backlog growth leaves stale facts visible as stale; that is safe but degrades the product. ## owner OPEN ## label OPEN ## id risk_source_schema_drift ## title Schema drift at sources ## impact Medium ## likelihood High ## trigger Storefront markup or feed fields change without notice; adapters silently mis-parse instead of failing. ## mitigation Adapter contracts that fail closed; field-level validation; drift alerts from rising fallback rates per source. ## evidence Per-source parser failure trend; count of silent mis-parses found in review. ## residual A plausible-but-wrong parse can pass validation. ## owner OPEN ## label PROP ## id risk_clock_integrity ## title Clock and timestamp integrity ## impact Medium ## likelihood Low ## trigger Collector host clock skew; replays overwrite observed_at; out-of-order captures accepted as newer. ## mitigation observed_at from the collector plus received_at from intake; reject skew beyond a bound; replays preserve observed_at (EST). ## evidence Skew distribution per collector over the prototype. ## residual Local collectors outside our control. ## owner OPEN ## label PROP ## id risk_cost_model_unvalidated ## title This cost model is unvalidated ## impact Medium ## likelihood High ## trigger Decisions taken on estimated inputs (measured = none) or on the unverified regional-host price. ## mitigation Replace each estimate with a measurement from the first slice; re-read prices before committing; keep DEC-08 open. ## evidence A measured value for every input marked estimate. ## residual Price pages change; token counts vary by model tokenizer. ## owner OPEN ## label OPEN