Tactical Action · Guides & deep dives

V4 Program Risk Register

probability of the risk event occurring before launch + 90 days.

4sections15 minread
Markdown source
On this page

Status: Active. Created 2026-06-12 to close the gap identified in V1_V7_PLAN_SET_AUDIT_2026-06-12.md §6.1(5)/§6.2 (no risk/mitigation section anywhere in V4's planning set).

Scope: program-defining bets only — six AAA-feel cells at once, 9-platform day-one certification, 12 full-VO languages, three netcode models in one codebase, live service from day one, and the 2026-10-01 launch date itself (V4/liveops/live-service-calendar.json launchDateUtc: 2026-10-01T16:00:00Z). Feature-level risks live with their owning sections in V4/V4_features.md and V4/V4_ARCHITECTURE.md.

Scoring#

  • Likelihood (L): 1 = <10%, 2 = 10–30%, 3 = 30–55%, 4 = 55–80%, 5 = >80% probability of the risk event occurring before launch + 90 days.
  • Impact (I): 1 = absorbable in sprint, 2 = milestone slip <2 weeks, 3 = milestone slip 2–8 weeks or one cell's gate at risk, 4 = launch-date or launch-scope change, 5 = product-thesis failure (launch fails its exit criteria, V4/V4_features.md:2731-2751).
  • Exposure = L × I. Exposure ≥ 12 is reviewed weekly by the Program Director; 6–11 bi-weekly; <6 monthly.
  • Probabilities and dates below are planning assumptions adopted 2026-06-12 unless they cite a spec line.

Milestone frame (derived, planning assumption adopted 2026-06-12)#

Backward from 2026-10-01 using V4/V4_features.md:2722-2726: Closed Alpha 2025-10-01 (L-12 mo, 5 000 players), Closed Beta 2026-04-01 (L-6 mo, 50 k), Open Beta 2026-08-03 (L-2 mo, open), Soak 2026-09-24 (L-7 d, 200 k, EU+NA, all six cells). As of today (2026-06-12) the program sits between Closed Beta and Open Beta, ~16 weeks from launch — every risk below is scored against that clock.

Register#

R-01 — Six AAA-feel cells simultaneously: at least one cell misses its feel bar#

  • Statement: The product promise is per-ruleset feel with "no compromise blends" (V4/V4_features.md:280-291) across six launch cells (ADR 0002). Each cell has hard, quantitative feel tests (V4/V4_features.md:343-384, e.g. Wukong parry windows 6 frames ±1; Hitman sandbox 60 fps with 120 NPCs; RTS opening timings within ±2% of SC2). Industry base rate for shipping even one genre at "matches the genre leader" quality on first attempt is low; V4 attempts six at once.
  • L/I/Exposure: 4 / 4 / 16
  • Trigger (leading indicator): Any cell's nightly Gauntlet feel-test pass rate (V4/V4_features.md:382-384) below 80% over a trailing 21-nightly window after Closed Beta; Closed-Beta player survey "feels like the inspiration" top-2-box <70% for any cell.
  • Mitigation: Per-cell kill/defer criteria and a pre-agreed de-scope sequence now exist in ADR 0011 (V4/docs/decisions/0011-cell-kill-criteria.md) so the decision is mechanical, not political. Feel-test gates remain release-blocking per cell. Cross-cell strike team (animation, game feel, camera) staffed to parachute into the worst-scoring cell each sprint.
  • Owner: Game Director (criteria), Program Director (decision forcing).

R-02 — 9-platform day-one certification fails on at least one platform#

  • Statement: Day-one cert on 9 platforms (V4/V4_features.md:300-304, ADR 0009) is an exit criterion (V4/V4_features.md:2738-2740). Four of the nine (Switch 2, iPad Pro, Android tablets, macOS) are unusual cert surfaces for an AAA shooter; Switch 2 cert pipelines are <18 months old industry-wide. Simultaneous first-submission pass on 9 platforms has likelihood near zero; the real question is whether resubmission loops fit before 2026-10-01.
  • L/I/Exposure: 4 / 4 / 16
  • Trigger: Any platform's first cert submission later than 2026-08-17 (L-6.5 weeks — leaves one full resubmission loop, planning assumption adopted 2026-06-12: 10 business days per console loop, 2 loops budgeted); any TRC/XR/lotcheck waiver still open at 2026-09-10.
  • Mitigation: Cert-readiness mock submissions ran per platform at Closed Beta exit; constrained targets strip heavy cells via cook rules (ADR 0005, ADR 0009 consequences) as a pre-approved fallback; explicit pre-agreed fallback ladder: a mobile/tablet platform may slip to a dated post-launch patch only via a launch-scope ADR — the marketing claim (V4/V4_features.md:300) must be edited the same day.
  • Owner: Platform & Certification Manager; escalation to Program Director.

R-03 — 12-language full-VO localization throughput#

  • Statement: Exit criteria require all 12 VO languages delivered (V4/V4_features.md:1600, :2737). Scale (planning assumption adopted 2026-06-12): 38 tactical/stealth campaign missions + 22 RTST missions + 12 Wukong areas/30 bosses + 8 Contra stages + ~180 cinematic minutes (V4/V4_features.md:1576-1603) implies ≈75 000 source lines; ×12 languages ≈ 900 000 recorded lines; at 60 lines/studio-hour ≈ 15 000 studio-hours. In the remaining 16 weeks that needs ≈14 recording studios running 165 h/month in parallel — feasible only if scripts locked already.
  • L/I/Exposure: 3 / 4 / 12
  • Trigger: Source-script lock later than 2026-06-30 for any cell; any language below 70% lines recorded at 2026-08-01; pickup-rate >8% after first QA pass in any language.
  • Mitigation: Script lock enforced as a Closed-Beta-exit deliverable; per-language burn-up chart reviewed weekly; pre-negotiated overflow capacity with two vendor networks; cinematics (~180 min) recorded first since they gate the 4K master. Contractual right to drop a language is not a mitigation — it changes the exit criteria and requires a launch-scope ADR.
  • Owner: Localization Director; Audio/VO Production Lead.

R-04 — Three netcode models in one codebase: determinism/prediction defect tail#

  • Statement: V4 ships deterministic lockstep (25 Hz, 32.32 fixed-point, state-hash every 100 ticks, V4/V4_ARCHITECTURE.md:890-932), rollback-emulated prediction (8-frame window, V4/V4_ARCHITECTURE.md:1037-1048), and client-server replication with custom relevancy bands (V4/V4_ARCHITECTURE.md:976-1035) — three correctness regimes maintained by one team in one codebase (ADR 0003). Lockstep determinism must additionally hold across 9 platforms' compilers and SIMD paths; a single non-deterministic code path desyncs every cross-platform RTS match.
  • L/I/Exposure: 4 / 3 / 12
  • Trigger: RTS desync (hash-mismatch) rate >0.5% of matches in Closed/Open Beta telemetry; rollback mis-prediction visible-correction rate >2/min at 100 ms RTT in twitch PvP; any cross-platform determinism failure not reproducible on PC.
  • Mitigation: Per-netcode regression suites are mandated by ADR 0003 consequences — fund them as release-blocking, not advisory. Cross-platform determinism farm runs the same input bundle on all 9 targets nightly and diffs hashes. Desync telemetry ships in Open Beta with full input-bundle capture for replay-reproduction (V4/V4_ARCHITECTURE.md:927-932). RTS is the pre-agreed second cell in the de-scope sequence precisely because this risk is the most isolated (ADR 0011 §De-scope sequence).
  • Owner: Netcode Lead; Technical Director.

R-05 — Live service from day one: ops not staffed to its own SLAs#

  • Statement: Day-one live service commits to 30-minute hotfix turnaround (V4/V4_features.md:1961-1962), a 24/7 Watchtower with ≤60-minute fixes for ranked-blocking bugs (V4/V4_features.md:2728-2729), support in 12 languages 24/7 (:2746), seasonal content (battle pass, contracts, factions) live at hour zero. These are operational SLAs an unlaunched studio has never executed.
  • L/I/Exposure: 3 / 3 / 9
  • Trigger: Hotfix-channel end-to-end drill (data-table change → approval → fleet) slower than 30 min in staging by 2026-08-15; support staffing plan below 100% hire/contract coverage for 12 languages at 2026-08-01; no completed game-day incident simulation by Soak.
  • Mitigation: Two full launch-day game-day rehearsals (one during Open Beta, one at Soak) exercising hotfix, rollback, queue, and comms paths; Season 1 + Season 2 content locked before launch (already an exit criterion, :2747) so the live team's first 90 days are operations, not authoring.
  • Owner: Live Ops Director; Support Director for the 12-language desk.

R-06 — The 2026-10-01 date itself#

  • Statement: The date is fixed in V4/liveops/live-service-calendar.json and anchors the anniversary, seasonal, esports (12-month pro circuit, V4/V4_features.md:1921-1926) and charity calendars. As of 2026-06-12 the program is 16 weeks out with Open Beta in ~7 weeks. The date also sits ~7 weeks before GTA VI (2026-11-19) and in the annual CoD launch corridor — slipping 6–10 weeks is strictly worse than slipping into 2027Q1 (see V4/docs/planning/market-analysis.md §Why-now).
  • L/I/Exposure: 3 / 4 / 12
  • Trigger: Any two of R-01…R-05 triggers firing in the same month; Open Beta entry gate (ADR 0011 G2) missed by any cell with no defer decision taken within 10 business days.
  • Mitigation: The pre-agreed answer to schedule pressure is scope (the ADR 0011 de-scope ladder), not date. A date move is a last resort decided only by Studio Head + Program Director, and if taken must jump clean past the GTA VI/CoD corridor to ≥2027-02 (planning assumption adopted 2026-06-12), re-cutting the entire live-service calendar JSON.
  • Owner: Program Director.

R-07 — Launch concurrency mis-forecast (capacity and cost both ways)#

  • Statement: Exit criteria gate matchmaking at "5× expected launch concurrency" (V4/V4_features.md:1825, :2744, V4/V4_ARCHITECTURE.md:1881) but no expected-concurrency number existed until V4/docs/planning/concurrency-and-monetization-forecast.md (created 2026-06-12: 250 k global peak CCU base case, 1.25 M staging target). Under-forecast → launch-day queues across 10 server regions (V4/V4_ARCHITECTURE.md:983-984); over-provision → idle fleet burn.
  • L/I/Exposure: 3 / 3 / 9
  • Trigger: Open Beta peak CCU outside 0.5×–1.6× of the pro-rated forecast band; soak test (200 k, V4/V4_features.md:2725-2726) p99 matchmaking >35 s in any region.
  • Mitigation: Forecast doc now pins the number with conservative/base/ optimistic bands and a re-forecast checkpoint at Open Beta +7 days; autoscaling validated to 2× base within 30 minutes per region; login queue with ETA shipped (degrade-gracefully posture already in V4/V4_features.md:296-299).
  • Owner: Online Services Lead; Finance/BizOps Lead for the cost side.

R-08 — Workshop GameFeature-plugin distribution becomes a security/cert liability#

  • Statement: Mods load "as sandboxed GameFeatures plugins" with only a crash-isolation claim (V4/V4_features.md:1708-1731) — crash containment is reliability, not security. Without the trust-tier line now drawn in V4/docs/planning/ugc-plugin-threat-model.md, the workshop is an arbitrary code-distribution channel (UObject deserialization, cheat-bearing cosmetic assets, supply-chain via mod updates) and console platform-holders will reject downloaded-executable content at cert. Workshop live at launch is an exit criterion (V4/V4_features.md:2751).
  • L/I/Exposure: 4 / 4 / 16 (highest joint with R-01/R-02)
  • Trigger: Any threat-model GA gate (threat-model §7, G1–G7) unmet at 2026-08-15; any platform-holder UGC scope approval not in writing by 2026-07-15.
  • Mitigation: Adopt the threat model's tier design (asset-only on clients, interpreted mission-script logic, full Blueprint plugins server-side only, no native plugins ever) and its signing/scanning/kill-switch pipeline as workshop-GA blocking gates.
  • Owner: Security Lead (Trust & Safety); Workshop Service Lead.

R-09 — Anti-cheat insufficient at launch for PvP-led monetization#

  • Statement: EAC is the default (ADR 0008) with no Denuvo (ADR 0006); a 100-player BR and ranked tactical PvP are the highest-value cheat targets. Public launches of EAC-protected shooters routinely see commercial cheats within days. Exit criteria require "anti-cheat live with a verified ban roster" (V4/V4_features.md:2745) — a roster, not an efficacy bar.
  • L/I/Exposure: 4 / 3 / 12
  • Trigger: Cheat-seller listings for V4 appearing during Open Beta with no detection within 72 h; server-side anomaly detection (ADR 0008 consequences) flagging <50% of QA red-team cheat sessions in staging.
  • Mitigation: Internal red-team cheat suite (aimbot, wallhack via replication abuse, lockstep map-hack) run against staging monthly; server-authority audits for the BR relevancy bands (V4/V4_ARCHITECTURE.md:992-998 — Band design already limits wallhack value; verify it); ban-wave cadence and appeal flow rehearsed in Open Beta.
  • Owner: Anti-Cheat Lead; Online Services Lead.

R-10 — Genre-bundle market rejection (audience dilution)#

  • Statement: One SKU spanning five genre families may read as "master of none" — review scores average across cells, store algorithms can't classify it, and each genre community judges its cell against that genre's best-in-class. Failure precedents and the honest counter-case are analyzed in V4/docs/planning/market-analysis.md §Portfolio thesis.
  • L/I/Exposure: 3 / 4 / 12
  • Trigger: Open Beta cross-cell engagement <20% of players touching 2+ cells in week 1 (thesis metric, market-analysis §6); wishlist/pre-order conversion below the comparables band at L-4 weeks; press preview coverage framing the game primarily as "too much at once."
  • Mitigation: Wedge strategy (market-analysis §5): market the Tactical FPS cell as the identity, present other cells as included value; per-cell store-page sub-branding; beta playlist rotation engineered to seed cross-cell trial.
  • Owner: Publishing/Marketing Director; Game Director.

R-11 — Monetization underperformance against the live-service cost base#

  • Statement: Live-service costs (R-05, R-07) are committed day one; revenue depends on premium sales plus battle-pass attach (V4/V4_features.md:1946-1950) and mission DLC at $9.99–$19.99 (:1958-1960). Forecast doc base case assumes 22% pass attach among 90-day actives (planning assumption adopted 2026-06-12) — a miss to ~12% with conservative unit sales puts Year-1 MTX below the live-team run-rate.
  • L/I/Exposure: 3 / 3 / 9
  • Trigger: Season-1 pass attach <14% at launch+30 d; MTX net ARPU per MAU <$0.80/month at launch+60 d; mission-DLC drop-1 attach <5% of owners.
  • Mitigation: Scenario plan in the forecast doc pre-commits the cost levers (region scaling, AI-inference degradation ladder, content-cadence stretch from 90 to 120-day seasons) before any pay-to-win temptation; cosmetic-only constraint (V4/V4_features.md:1951-1953) is non-negotiable.
  • Owner: Finance/BizOps Lead; Live Ops Director.

R-12 — Constrained-platform performance breaks feel tests (Switch 2 / tablets / Steam Deck)#

  • Statement: Feel tests embed hard perf floors — Hitman sandbox 60 fps with 120 NPCs (V4/V4_features.md:352-355), crowd scenes to 400 NPCs (:1634-1640), 200-pop RTS pathing without stutter (:373-376), Contra 60 fps couch co-op (:377-380) — on platforms including Switch 2 "scaled", iPad Pro, and Android tablets (:300-304). Nanite/Lumen-class rendering at those NPC counts on tablet thermals is unproven at this scale.
  • L/I/Exposure: 4 / 3 / 12
  • Trigger: Any feel-test perf scenario >15% below target on Switch 2 or iPad at Open Beta entry; thermal-throttled 20-minute soak run losing >10% median fps on tablets.
  • Mitigation: ADR 0005/0009 already allow stripping expensive cells per platform at cook — pre-decide the strip list per platform at Open Beta entry rather than during cert; scalability tiers with crowd-density floors respected (V4/V4_features.md:1637-1640 — density must not drop below stealth-design floors, so the fallback is resolution/GI tier, not crowd count).
  • Owner: Technical Director (Engine); Platform & Certification Manager.

R-13 — Inspiration-adjacency legal exposure (trade dress / cloning claims)#

  • Statement: The product deliberately matches named competitors' hallmarks: SC2-replicable build orders within ±2% timing (V4/V4_features.md:368-372), Hitman/Commandos/Contra-pattern feel tests, R6-style breaching. Mechanics are generally unprotectable; trade dress, specific expressive elements, and named-comparison marketing are litigation surface (precedents in market-analysis §2 footnotes).
  • L/I/Exposure: 2 / 4 / 8
  • Trigger: Any C&D or platform-store IP complaint; marketing copy naming a competitor product shipping without legal review.
  • Mitigation: Legal review pass on all feel-test-derived marketing claims (internal docs may name inspirations; consumer-facing copy must not); expressive-distance review per cell (art, names, audio) before Open Beta; the heritage-firearms accuracy partnership template (V4/legal/partnerships/) shows the existing clearance muscle — extend it.
  • Owner: General Counsel; Publishing Director.

R-14 — AI commentary compliance/bias incident across 12 languages#

  • Statement: Live AI spectator commentary in 12 VO languages with bias review (V4/V4_features.md:2576-2601, DPIA at V4/docs/compliance/dpia-in-game-commentary.md) is a generative system speaking publicly about real players in real time. One slur, protected-trait inference, or harassment amplification clip can dominate launch coverage.
  • L/I/Exposure: 3 / 3 / 9
  • Trigger: Any BiasReview.AICommentary.Live block-rate >1% in Open Beta (signals the generator, not the filter, is the problem); any unreviewed line reaching broadcast in staging drills.
  • Mitigation: Fail-closed posture: blocked output = silence, never fallback to unreviewed text; per-language red-team phrase suites before each language enables; kill switch per language and per persona; launch with live commentary on partnered/esports broadcasts only (cap also bounds inference cost — forecast doc §4).
  • Owner: Trust & Safety Lead; AI Systems Lead.

R-15 — Esports commitment outruns ranked population#

  • Statement: A 12-month pro circuit must be published at launch (V4/V4_features.md:2750, circuit JSON at V4/esports/pro-circuit/pro-circuit-2026.json) across five ranked ladders (:2020-2024). If any ladder's population is too thin (especially RTS Historical and ARPG BossRush), early Majors play to empty brackets and the public calendar becomes a visible failure.
  • L/I/Exposure: 3 / 2 / 6
  • Trigger: Any ranked ladder <50 k accounts at launch+30 d; Open qualifier signups <4× bracket capacity for the first Minor.
  • Mitigation: Circuit JSON authored with per-ladder go/no-go checkpoints at launch+30 d — collapse thin ladders' events into the Wildcard/Roulette format (V4/V4_features.md:1931-1936) rather than cancelling; prize-pool commitments staged per checkpoint, not pre-committed for 12 months.
  • Owner: Esports Director; Community Director.

R-16 — Shared-roster coupling: one cell's balance break contaminates others#

  • Statement: One shared roster of 34 canonical operators crosses cells (V4/V4_features.md:1576-1579, ADR 0004). A balance or exploit fix for an operator in tactical PvP can silently change Hitman/RTST/co-op tuning; hotfixes ship in 30 minutes (:1961-1962), faster than cross-cell QA.
  • L/I/Exposure: 3 / 2 / 6
  • Trigger: Any hotfix shipped without the per-cell regression matrix attached; two or more cross-cell regression incidents in one season.
  • Mitigation: Per-cell stat-override layers so a tactical nerf is scoped by default and cross-cell only by explicit choice; hotfix pipeline runs the six cells' smoke feel-tests as an automatic pre-flight; public balance ledger (V4/V4_features.md:309-311) annotates cell scope per change.
  • Owner: Balance Lead; Live Ops Director.

Review cadence and change control#

  • Register reviewed in the weekly program meeting; exposure ≥12 items get a named action with a date each week.
  • Any risk whose trigger fires becomes an agenda-forcing item within 48 h; R-01/R-08 triggers additionally start the ADR 0011 / threat-model gate clocks respectively.
  • New program-level risks enter via PR to this file with L/I scored and an owner named; closing a risk requires the trigger metric to be green for 30 consecutive days.