V2 Program Risk Register

Status: planning baseline, adopted 2026-06-12. Fills the "no risk registers" gap identified by V1_V7_PLAN_SET_AUDIT_2026-06-12.md §6.1(5)/§6.2 ("V2 rollback-netcode-in-GAS ... undefended by contingency planning").

Conventions: Likelihood H/M/L = >40% / 15-40% / <15% over the program (planning assumptions adopted 2026-06-12, derived where stated). Impact Critical = launch-date or launch-viability threat; High = tier-drop or multi-month slip; Medium = contained slip or cost. Each risk names a trigger (the observable that converts risk → issue) and an owner-role accountable for the mitigation. Review cadence: monthly at program review; re-baseline quarterly with production actuals (PD).

Owner-roles: TD Technical Director, OEL Online Engineering Lead, EP Executive Producer, BD Head of Business Development, GC General Counsel, PD Production Director, AD Art Director, AuD Audio Director, LOC Localization Manager, QAD QA Director, RM Release Manager, EL Engine Lead, BL Balance Lead, MS Mocap Stage Supervisor, LOps Live Ops Lead, FIN Finance Director.

R-01 — Rollback netcode inside UE5 GAS at multi-fighter scope#

• Likelihood: H. Impact: Critical. The genre's hardest engineering problem, attempted in a framework (GAS) that is not deterministic or rollback-aware out of the box: prediction keys, async ability tasks, Chaos-physics nondeterminism, float divergence across compilers, and UE's actor-tick model all fight the snapshot/re-simulate pattern. The promise is ≤ 8 frames rollback at ≤ 100 ms RTT with 2v2 at 60 Hz (V2/V2_features.md:212-215). Budget math: gameplay sim has 4 ms/frame (V2/V2_ARCHITECTURE.md:1534); an 8-frame rollback burst must re-simulate 8 frames plus the current frame inside one 16.6 ms frame, so the deterministic sim step must cost ≤ 0.5 ms — an 8× headroom requirement over a naive 4 ms sim.
• Validation milestone (binding): RB-VS1. A 2-character vertical slice (1 original Striker + 1 Grappler, full GAS ability sets, hitbox authority, meters, one stage) proving, before broad content production:
  • deterministic lockstep: zero desyncs across 10,000 automated rounds on PC + PS5 + XSX cross-play pairs (golden-replay divergence detection per V2/V2_ARCHITECTURE.md:1545-1546);
  • rollback quality: with injected 100 ms RTT ± 20 ms jitter and 2% loss, ≥ 99.9% of rollbacks ≤ 8 frames over a 24 h soak;
  • performance: re-sim cost ≤ 0.5 ms per rolled frame; p95 frame time ≤ 16.6 ms during 8-frame rollback bursts on PS5;
  • input latency: ≤ 4 frames local button-to-photon delta vs offline. Gate: roster production halts at 8 fighters until RB-VS1 is green (minimum-lovable-launch.md §4 G1); the 2v2 extension (RB-VS2, four active fighters) gates tag-mode content.
• Trigger: RB-VS1 not green by GM − 18 mo, or any desync class without a root cause for > 4 weeks.
• Mitigation: dedicated determinism strike team from day one; sim/render split (§7.2 of V2/V2_TODOS.md) with a fixed-point or strict-fp math core off Chaos; GAS used for orchestration only with a custom deterministic ability runtime underneath; delay-based fallback mode (§66) as the break-glass for launch. Owner: OEL (with TD).

R-02 — Partner-IP licensing failure#

• Likelihood: H (joint probability of the full 18-character slate ≈ 0.1%; even "two meaningful packages" is a coin flip — derivation in rights-strategy.md §2.5). Impact: Medium — because the fallback exists; without it this is Critical.
• Trigger: no executed license recorded in V2/legal/licenses/ by GM − 12 mo (gate G3, minimum-lovable-launch.md §4).
• Mitigation: all-original 60-fighter fallback roster with 1:1 archetype/style-pool backfill (rights-strategy.md §5); partner-IP becomes post-launch DLC; fail-closed marketing/build gate (rights-strategy.md §6) guarantees no exposure to an unlicensed character. Owner: BD (deals), RDL (fallback roster).

R-03 — Platform cert risk for Web3 / Aje surfaces#

• Likelihood: H. Impact: High (cert rejection at submission is a launch-date event). The cert-ban registry (V2/legal/platform-cert-bans.json, schema v2, reviewed 2026-05-13, next review 2026-08-11) currently records all five Aje surfaces banned on ps5, xsx, switch2, ios, macos (bannedSurfaces includes web3_cosmetic_ownership, cosmetic_nft_ownership, on_chain_in_game_items, fan_token_gated_gameplay, on_chain_rights_manifest); win64 is explicitly cleared for four surfaces but on_chain_rights_manifest is neither banned nor cleared on win64 — an ambiguity that must be resolved, not assumed.
• Trigger: any cooked console/Apple build linking @aje/* packages; or the 2026-08-11 registry review tightening win64.
• Mitigation: compile-time exclusion of @aje/identity, @aje/nft, @aje/governance, @aje/rwa from all console/Apple build configurations (cook fails if linked — fail-closed); no gameplay state ever derives from an on-chain record so parity across platforms is automatic; win64 on_chain_rights_manifest ambiguity escalated to publisher legal before any rights-manifest feature work; registry re-checked every cert submission. Owner: RM (gate), GC (registry truth).

R-04 — Engine-version risk on UE5.5#

• Likelihood: M. Impact: High. The client is a UE5.5 project (V2/V2_ARCHITECTURE.md:310). Epic ships no formal LTS; 5.5 receives hotfixes only until the next minor. Two failure directions: (a) staying locked while needed systems mature elsewhere — Motion Matching (§4.3) and Mover 2.0 (§4.4) are still maturing and V2 depends on both; (b) a mid-production engine upgrade, which historically costs AAA teams 2-4 months of integration + re-cert of determinism (direct collision with R-01's golden replays).
• Trigger: a required fix exists only in 5.6+; or a console-platform SDK mandate (TRC/XR compliance windows) forces an engine bump.
• Mitigation: engine-lock ADR at V2/docs/decisions/ (lock to 5.5.x for P1); maintained custom engine branch with cherry-pick policy (security + platform-mandated fixes only); 3-5 FTE engine team owning the branch; upgrade rehearsal on a throwaway branch each minor release to keep the true cost measured; golden-replay suite as the determinism regression gate for any engine change. Owner: EL.

R-05 — P2 scope bleed: racing / battle-royale / heist modes#

• Likelihood: M. Impact: High. §96-§125 (racing stack, convoy, heist) and §127 (100-player BR) are a second game's worth of scope sitting in the same backlog. The failure mode is quiet pre-investment — "shared" vehicle tech, BR-ready netcode abstractions, heist level prototypes — taxing P1's critical path.
• Trigger: any P1-phase sprint contains tasks from §96-§125/§127 without a phase-cut ADR; or shared-systems designs grow BR/vehicle requirements.
• Mitigation: hard staffing firewall (zero P2 FTE until P1 content velocity ≥ plan for 2 consecutive quarters); P2 modes get their own kill criteria at greenlight (CCU and attach thresholds defined then, not retrofitted); client-server modes (BR/heist) reuse the §8 dedicated-server stack as-is or wait. Owner: EP.

R-06 — Content-production schedule risk (roster + cinematics)#

• Likelihood: H. Impact: High. The math in content-production-model.md: 60 fighters = 1,080 pm at 2.5 fighters/mo steady state with ~23 fighters in flight; uncut P1 cinematics ≈ 930 finished minutes ≈ 930 pm — together ~186 person-years of content. 60 launch fighters is 2-3× any modern genre launch.
• Trigger: completed-fighter velocity (signature-checklist + QA cert definition) < 2.0/mo for two consecutive months at 60-fighter scope; or gate G2 counts (< 40 done at GM − 12 mo) per minimum-lovable-launch.md §4.
• Mitigation: MLL tier ladder as the pre-agreed de-scope; side stories (the largest line) pre-designated as the first internal cut (MLL-2a); quarterly recalibration of the production constants from actuals; outsourcing share already planned at 60-70% of character art. Owner: PD.

R-07 — Mocap stage capacity and stunt-performer availability#

• Likelihood: M. Impact: Medium. 220 roster stage-days + up to 465 cinematic stage-days (content-production-model.md §2) against 184 stage-days/year per stage; fight-choreo stunt teams are a thin labor market, and a single performer injury idles a booked stage.
• Trigger: capture backlog > 20 stage-days; or retained-seconds/day actuals < 60 (vs 75 planned) across 10 stage-days.
• Mitigation: second stage / vendor contract optioned now (lead time ~2 quarters); choreography pre-viz so stage time is selects, not exploration; cross-trained stunt pairs for paired finishers; capture schedule front-loads fighters, leaving cinematics on the vendor stage. Owner: MS.

R-08 — VO program: 8-locale throughput, labor actions, AI-voice terms#

• Likelihood: M. Impact: Medium-High. ≈ 300,000 recorded lines across 8 full-VO locales, ≈ 2,500 studio-days, ~400 actor contracts (content-production-model.md §6). Voice-actor labor actions over interactive-media and AI-voice terms have already shut down game VO pipelines this decade; locale vendors are a serial dependency for the 18-locale launch promise (V2/V2_features.md:2445).
• Trigger: any locale > 15% behind its studio-day plan; union negotiation entering a strike-authorization phase; a vendor losing a key casting.
• Mitigation: contracts include explicit AI-voice consent scope and strike-contingency recast clauses (GC reviews the template); barks and efforts recorded first (cheapest to recast); per-locale fallback to subtitle-only is already a specced degradation (V2/V2_features.md:2454-2455); two EN rooms to protect the source-locale schedule. Owner: AuD + LOC.

R-09 — Cross-platform determinism for cross-play rollback#

• Likelihood: H. Impact: Critical (subset of R-01 but distinct cause: even a perfectly deterministic sim on one platform diverges across CPU/compiler/SIMD differences on PC vs PS5 vs XSX vs Switch2). Cross-play is a product promise (V2/V2_features.md:233-234).
• Trigger: any cross-platform golden-replay divergence in CI; > 0.01% cross-play desync rate in playtests.
• Mitigation: fixed-point math core or strictly-controlled fp (no FMA/SIMD variance, single rounding mode) for everything inside the rollback boundary; per-PR cross-platform replay CI (the 200-replay suite, V2/V2_ARCHITECTURE.md:1545-1546) run on real devkit pairs; desync telemetry with state-hash bisection built before content scale-up. Owner: OEL.

R-10 — Anti-cheat vs rollback architecture#

• Likelihood: M. Impact: High. Input-delay/rollback P2P topologies expose state to both clients; ranked integrity then rests on detection, not prevention. Naive server authority breaks the ≤ 8-frame promise.
• Trigger: cheat tooling for V2 observed in the wild during betas; ranked dispute rate > 0.5% of matches.
• Mitigation: server-side replay verification for ranked (inputs are tiny; re-simulate suspicious matches headlessly and compare state hashes); relay-based connection privacy (no raw peer IPs); kernel-level anti-cheat decision made per platform with the compatibility cert requirement (V2/V2_features.md:2530); the anti-cheat false-positive dashboard (V2/V2_ARCHITECTURE.md:1515) gates enforcement rollout. Owner: OEL
  • QAD.

R-11 — Balance/QA combinatorics of 7 rulesets × 60 fighters#

• Likelihood: H. Impact: Medium-High. Matchup cells: 60×59/2 = 1,770 pairings × 7 rulesets = 12,390 matchup-ruleset cells — exhaustive human coverage is impossible; an infinite or degenerate loop shipping in a niche ruleset is near-certain without systemic defense.
• Trigger: any touch-of-death/infinite reproducible in two distinct matchups; per-ruleset pick-rate Gini worsening two seasons running.
• Mitigation: automated combo-search fuzzing (AI-driven input search for damage-unbounded sequences) on the deterministic sim in CI; telemetry- driven balance ops (§55, §88) with the server-driven data-only hotfix path (V2/V2_features.md:2558-2560); tiered coverage policy — full human QA on the MLL-0 ruleset pairs, sampled + fuzzed coverage beyond. Owner: BL
  • QAD.

R-12 — Ratings and regional content risk for gore#

• Likelihood: M. Impact: Medium. Target boards ESRB M / PEGI 18 / CERO Z / USK 18 / ACB R18+ / GRAC (V2/V2_features.md:2533-2534, V2/legal/rating-boards.json). MK-grade fatalities historically force CERO content modification or non-release in Japan, and Japan is a core FGC market for the SF/Tekken rulesets — a direct tension.
• Trigger: CERO pre-consultation flags fatality content; any board reclassifies mid-cert.
• Mitigation: gore opt-in/opt-out and locale-aware content switches are already product promises (V2/V2_features.md:226-227) — build the per-region content-adjustment matrix into the cook (regional SKU differences limited to data flags, not binaries); pre-consultation with CERO/USK before Beta; finisher library tagged by intensity tier from authoring day one. Owner: RM + GC.

R-13 — Install size and day-one patch budget#

• Likelihood: M. Impact: Medium. Per-fighter worst case from the asset budgets (V2/V2_features.md:2538-2541): 80 MB anim + ~64 MB textures + 50 MB audio × 8 VO locales = ~544 MB/fighter if all locales install; × 60 fighters ≈ 33 GB before stages (30 × up to 256 MB textures ≈ 7.7 GB), cinematics (930 min, the largest single item if pre-rendered — in-engine rendering keeps it to scene data), modes, and the rest. Uncontrolled, the install breaches 150 GB-class and the ≤ 5 GB day-one patch budget (:2555) becomes unmeetable.
• Trigger: projected install > 110 GB at Beta; day-one patch projection

  4 GB at GM − 3 mo.

• Mitigation: the specced per-fighter chunking (:2545-2546) plus VO-locale-on-demand (install 1 locale by default, stream others); in-engine cinematics policy (no pre-rendered video except attract reel); weekly asset audit (:2550-2551) with oversize alarms; texture pack tiers per platform already specced. Owner: TD + RM.

R-14 — Multi-studio / multi-vendor coordination#

• Likelihood: M. Impact: Medium-High. The plan leans on 60-70% outsourced character art, external VO vendors in 8 locales, a possible second mocap stage, and a multi-studio org (V2/V2_features.md:2574-2579). Vendor desync (style drift, redelivery loops, schedule mismatch) is the standard failure mode at this volume.
• Trigger: first-pass art acceptance rate < 70% from any vendor over a month; any vendor > 3 weeks behind plan.
• Mitigation: style bible + golden-sample sign-off before volume orders; per-vendor embedded internal reviewer; Perforce-based delivery with automated budget validation on ingest (tris/texture/LOD lint from the weekly audit tooling); dual-vendor sourcing for character art so no single vendor carries > 40% of the roster. Owner: PD + AD.

R-15 — Live-service economics of dedicated-server modes#

• Likelihood: M. Impact: Medium. Rollback 1v1/2v2 is peer-cheap, but BR, World Tour, Battle Hub, Convoy, Heist, World Boss all require dedicated servers (V2/V2_features.md:216-219) whose cost scales with CCU while the revenue is a one-time premium purchase plus optional MTX (market-rationale.md §6).
• Trigger: projected infra cost > 7% of projected net revenue at the CCU forecast; or post-launch CCU > 2× forecast without MTX attach scaling.
• Mitigation: hub/open-world modes designed for graceful instance consolidation; server capacity gates in the launch-readiness checklist (§138) tied to the matchmaking-p99 dashboards (V2/V2_ARCHITECTURE.md:1513); P2/P3 server-heavy modes (BR, World Boss) held behind attach-rate evidence per R-05 kill criteria. Owner: LOps
  • FIN.

Summary heat map#