# V4 Program Risk Register

Status: Active. Created 2026-06-12 to close the gap identified in
`V1_V7_PLAN_SET_AUDIT_2026-06-12.md` §6.1(5)/§6.2 (no risk/mitigation section
anywhere in V4's planning set).

Scope: program-defining bets only — six AAA-feel cells at once, 9-platform
day-one certification, 12 full-VO languages, three netcode models in one
codebase, live service from day one, and the 2026-10-01 launch date itself
(`V4/liveops/live-service-calendar.json` `launchDateUtc:
2026-10-01T16:00:00Z`). Feature-level risks live with their owning sections in
`V4/V4_features.md` and `V4/V4_ARCHITECTURE.md`.

## Scoring

- **Likelihood (L):** 1 = <10%, 2 = 10–30%, 3 = 30–55%, 4 = 55–80%, 5 = >80%
  probability of the risk event occurring before launch + 90 days.
- **Impact (I):** 1 = absorbable in sprint, 2 = milestone slip <2 weeks,
  3 = milestone slip 2–8 weeks or one cell's gate at risk, 4 = launch-date or
  launch-scope change, 5 = product-thesis failure (launch fails its exit
  criteria, `V4/V4_features.md:2731-2751`).
- **Exposure = L × I.** Exposure ≥ 12 is reviewed weekly by the Program
  Director; 6–11 bi-weekly; <6 monthly.
- Probabilities and dates below are planning assumptions adopted 2026-06-12
  unless they cite a spec line.

## Milestone frame (derived, planning assumption adopted 2026-06-12)

Backward from `2026-10-01` using `V4/V4_features.md:2722-2726`: Closed Alpha
2025-10-01 (L-12 mo, 5 000 players), Closed Beta 2026-04-01 (L-6 mo, 50 k),
Open Beta 2026-08-03 (L-2 mo, open), Soak 2026-09-24 (L-7 d, 200 k, EU+NA, all
six cells). **As of today (2026-06-12) the program sits between Closed Beta
and Open Beta, ~16 weeks from launch** — every risk below is scored against
that clock.

## Register

### R-01 — Six AAA-feel cells simultaneously: at least one cell misses its feel bar

- **Statement:** The product promise is per-ruleset feel with "no compromise
  blends" (`V4/V4_features.md:280-291`) across six launch cells (ADR 0002).
  Each cell has hard, quantitative feel tests (`V4/V4_features.md:343-384`,
  e.g. Wukong parry windows 6 frames ±1; Hitman sandbox 60 fps with 120 NPCs;
  RTS opening timings within ±2% of SC2). Industry base rate for shipping even
  one genre at "matches the genre leader" quality on first attempt is low; V4
  attempts six at once.
- **L/I/Exposure:** 4 / 4 / **16**
- **Trigger (leading indicator):** Any cell's nightly Gauntlet feel-test pass
  rate (`V4/V4_features.md:382-384`) below 80% over a trailing 21-nightly
  window after Closed Beta; Closed-Beta player survey "feels like the
  inspiration" top-2-box <70% for any cell.
- **Mitigation:** Per-cell kill/defer criteria and a pre-agreed de-scope
  sequence now exist in ADR 0011 (`V4/docs/decisions/0011-cell-kill-criteria.md`)
  so the decision is mechanical, not political. Feel-test gates remain
  release-blocking per cell. Cross-cell strike team (animation, game feel,
  camera) staffed to parachute into the worst-scoring cell each sprint.
- **Owner:** Game Director (criteria), Program Director (decision forcing).

### R-02 — 9-platform day-one certification fails on at least one platform

- **Statement:** Day-one cert on 9 platforms (`V4/V4_features.md:300-304`,
  ADR 0009) is an exit criterion (`V4/V4_features.md:2738-2740`). Four of the
  nine (Switch 2, iPad Pro, Android tablets, macOS) are unusual cert surfaces
  for an AAA shooter; Switch 2 cert pipelines are <18 months old industry-wide.
  Simultaneous first-submission pass on 9 platforms has likelihood near zero;
  the real question is whether resubmission loops fit before 2026-10-01.
- **L/I/Exposure:** 4 / 4 / **16**
- **Trigger:** Any platform's first cert submission later than 2026-08-17
  (L-6.5 weeks — leaves one full resubmission loop, planning assumption
  adopted 2026-06-12: 10 business days per console loop, 2 loops budgeted);
  any TRC/XR/lotcheck waiver still open at 2026-09-10.
- **Mitigation:** Cert-readiness mock submissions ran per platform at Closed
  Beta exit; constrained targets strip heavy cells via cook rules (ADR 0005,
  ADR 0009 consequences) as a pre-approved fallback; explicit pre-agreed
  fallback ladder: a mobile/tablet platform may slip to a dated post-launch
  patch **only** via a launch-scope ADR — the marketing claim
  (`V4/V4_features.md:300`) must be edited the same day.
- **Owner:** Platform & Certification Manager; escalation to Program Director.

### R-03 — 12-language full-VO localization throughput

- **Statement:** Exit criteria require all 12 VO languages delivered
  (`V4/V4_features.md:1600`, `:2737`). Scale (planning assumption adopted
  2026-06-12): 38 tactical/stealth campaign missions + 22 RTST missions + 12
  Wukong areas/30 bosses + 8 Contra stages + ~180 cinematic minutes
  (`V4/V4_features.md:1576-1603`) implies ≈75 000 source lines; ×12 languages
  ≈ 900 000 recorded lines; at 60 lines/studio-hour ≈ 15 000 studio-hours. In
  the remaining 16 weeks that needs ≈14 recording studios running 165 h/month
  in parallel — feasible only if scripts locked already.
- **L/I/Exposure:** 3 / 4 / **12**
- **Trigger:** Source-script lock later than 2026-06-30 for any cell; any
  language below 70% lines recorded at 2026-08-01; pickup-rate >8% after first
  QA pass in any language.
- **Mitigation:** Script lock enforced as a Closed-Beta-exit deliverable;
  per-language burn-up chart reviewed weekly; pre-negotiated overflow capacity
  with two vendor networks; cinematics (`~180 min`) recorded first since they
  gate the 4K master. Contractual right to drop a language is **not** a
  mitigation — it changes the exit criteria and requires a launch-scope ADR.
- **Owner:** Localization Director; Audio/VO Production Lead.

### R-04 — Three netcode models in one codebase: determinism/prediction defect tail

- **Statement:** V4 ships deterministic lockstep (25 Hz, 32.32 fixed-point,
  state-hash every 100 ticks, `V4/V4_ARCHITECTURE.md:890-932`),
  rollback-emulated prediction (8-frame window,
  `V4/V4_ARCHITECTURE.md:1037-1048`), and client-server replication with
  custom relevancy bands (`V4/V4_ARCHITECTURE.md:976-1035`) — three
  correctness regimes maintained by one team in one codebase (ADR 0003).
  Lockstep determinism must additionally hold **across 9 platforms'**
  compilers and SIMD paths; a single non-deterministic code path desyncs every
  cross-platform RTS match.
- **L/I/Exposure:** 4 / 3 / **12**
- **Trigger:** RTS desync (hash-mismatch) rate >0.5% of matches in Closed/Open
  Beta telemetry; rollback mis-prediction visible-correction rate >2/min at
  100 ms RTT in twitch PvP; any cross-platform determinism failure not
  reproducible on PC.
- **Mitigation:** Per-netcode regression suites are mandated by ADR 0003
  consequences — fund them as release-blocking, not advisory. Cross-platform
  determinism farm runs the same input bundle on all 9 targets nightly and
  diffs hashes. Desync telemetry ships in Open Beta with full input-bundle
  capture for replay-reproduction (`V4/V4_ARCHITECTURE.md:927-932`). RTS is
  the pre-agreed second cell in the de-scope sequence precisely because this
  risk is the most isolated (ADR 0011 §De-scope sequence).
- **Owner:** Netcode Lead; Technical Director.

### R-05 — Live service from day one: ops not staffed to its own SLAs

- **Statement:** Day-one live service commits to 30-minute hotfix turnaround
  (`V4/V4_features.md:1961-1962`), a 24/7 Watchtower with ≤60-minute fixes for
  ranked-blocking bugs (`V4/V4_features.md:2728-2729`), support in 12
  languages 24/7 (`:2746`), seasonal content (battle pass, contracts,
  factions) live at hour zero. These are operational SLAs an unlaunched studio
  has never executed.
- **L/I/Exposure:** 3 / 3 / **9**
- **Trigger:** Hotfix-channel end-to-end drill (data-table change → approval →
  fleet) slower than 30 min in staging by 2026-08-15; support staffing plan
  below 100% hire/contract coverage for 12 languages at 2026-08-01; no
  completed game-day incident simulation by Soak.
- **Mitigation:** Two full launch-day game-day rehearsals (one during Open
  Beta, one at Soak) exercising hotfix, rollback, queue, and comms paths;
  Season 1 + Season 2 content locked before launch (already an exit criterion,
  `:2747`) so the live team's first 90 days are operations, not authoring.
- **Owner:** Live Ops Director; Support Director for the 12-language desk.

### R-06 — The 2026-10-01 date itself

- **Statement:** The date is fixed in
  `V4/liveops/live-service-calendar.json` and anchors the anniversary,
  seasonal, esports (12-month pro circuit, `V4/V4_features.md:1921-1926`) and
  charity calendars. As of 2026-06-12 the program is 16 weeks out with Open
  Beta in ~7 weeks. The date also sits ~7 weeks before GTA VI (2026-11-19) and
  in the annual CoD launch corridor — slipping 6–10 weeks is strictly worse
  than slipping into 2027Q1 (see
  `V4/docs/planning/market-analysis.md` §Why-now).
- **L/I/Exposure:** 3 / 4 / **12**
- **Trigger:** Any two of R-01…R-05 triggers firing in the same month; Open
  Beta entry gate (ADR 0011 G2) missed by any cell with no defer decision
  taken within 10 business days.
- **Mitigation:** The pre-agreed answer to schedule pressure is **scope** (the
  ADR 0011 de-scope ladder), not date. A date move is a last resort decided
  only by Studio Head + Program Director, and if taken must jump clean past
  the GTA VI/CoD corridor to ≥2027-02 (planning assumption adopted
  2026-06-12), re-cutting the entire live-service calendar JSON.
- **Owner:** Program Director.

### R-07 — Launch concurrency mis-forecast (capacity and cost both ways)

- **Statement:** Exit criteria gate matchmaking at "5× expected launch
  concurrency" (`V4/V4_features.md:1825`, `:2744`,
  `V4/V4_ARCHITECTURE.md:1881`) but no expected-concurrency number existed
  until `V4/docs/planning/concurrency-and-monetization-forecast.md` (created
  2026-06-12: 250 k global peak CCU base case, 1.25 M staging target).
  Under-forecast → launch-day queues across 10 server regions
  (`V4/V4_ARCHITECTURE.md:983-984`); over-provision → idle fleet burn.
- **L/I/Exposure:** 3 / 3 / **9**
- **Trigger:** Open Beta peak CCU outside 0.5×–1.6× of the pro-rated forecast
  band; soak test (200 k, `V4/V4_features.md:2725-2726`) p99 matchmaking >35 s
  in any region.
- **Mitigation:** Forecast doc now pins the number with conservative/base/
  optimistic bands and a re-forecast checkpoint at Open Beta +7 days;
  autoscaling validated to 2× base within 30 minutes per region; login queue
  with ETA shipped (degrade-gracefully posture already in
  `V4/V4_features.md:296-299`).
- **Owner:** Online Services Lead; Finance/BizOps Lead for the cost side.

### R-08 — Workshop GameFeature-plugin distribution becomes a security/cert liability

- **Statement:** Mods load "as sandboxed GameFeatures plugins" with only a
  crash-isolation claim (`V4/V4_features.md:1708-1731`) — crash containment is
  reliability, not security. Without the trust-tier line now drawn in
  `V4/docs/planning/ugc-plugin-threat-model.md`, the workshop is an arbitrary
  code-distribution channel (UObject deserialization, cheat-bearing cosmetic
  assets, supply-chain via mod updates) and console platform-holders will
  reject downloaded-executable content at cert. Workshop live at launch is an
  exit criterion (`V4/V4_features.md:2751`).
- **L/I/Exposure:** 4 / 4 / **16** (highest joint with R-01/R-02)
- **Trigger:** Any threat-model GA gate (threat-model §7, G1–G7) unmet at
  2026-08-15; any platform-holder UGC scope approval not in writing by
  2026-07-15.
- **Mitigation:** Adopt the threat model's tier design (asset-only on clients,
  interpreted mission-script logic, full Blueprint plugins server-side only,
  no native plugins ever) and its signing/scanning/kill-switch pipeline as
  workshop-GA blocking gates.
- **Owner:** Security Lead (Trust & Safety); Workshop Service Lead.

### R-09 — Anti-cheat insufficient at launch for PvP-led monetization

- **Statement:** EAC is the default (ADR 0008) with no Denuvo (ADR 0006); a
  100-player BR and ranked tactical PvP are the highest-value cheat targets.
  Public launches of EAC-protected shooters routinely see commercial cheats
  within days. Exit criteria require "anti-cheat live with a verified ban
  roster" (`V4/V4_features.md:2745`) — a roster, not an efficacy bar.
- **L/I/Exposure:** 4 / 3 / **12**
- **Trigger:** Cheat-seller listings for V4 appearing during Open Beta with no
  detection within 72 h; server-side anomaly detection (ADR 0008 consequences)
  flagging <50% of QA red-team cheat sessions in staging.
- **Mitigation:** Internal red-team cheat suite (aimbot, wallhack via
  replication abuse, lockstep map-hack) run against staging monthly;
  server-authority audits for the BR relevancy bands
  (`V4/V4_ARCHITECTURE.md:992-998` — Band design already limits wallhack
  value; verify it); ban-wave cadence and appeal flow rehearsed in Open Beta.
- **Owner:** Anti-Cheat Lead; Online Services Lead.

### R-10 — Genre-bundle market rejection (audience dilution)

- **Statement:** One SKU spanning five genre families may read as "master of
  none" — review scores average across cells, store algorithms can't classify
  it, and each genre community judges its cell against that genre's
  best-in-class. Failure precedents and the honest counter-case are analyzed
  in `V4/docs/planning/market-analysis.md` §Portfolio thesis.
- **L/I/Exposure:** 3 / 4 / **12**
- **Trigger:** Open Beta cross-cell engagement <20% of players touching 2+
  cells in week 1 (thesis metric, market-analysis §6); wishlist/pre-order
  conversion below the comparables band at L-4 weeks; press preview coverage
  framing the game primarily as "too much at once."
- **Mitigation:** Wedge strategy (market-analysis §5): market the Tactical FPS
  cell as the identity, present other cells as included value; per-cell
  store-page sub-branding; beta playlist rotation engineered to seed
  cross-cell trial.
- **Owner:** Publishing/Marketing Director; Game Director.

### R-11 — Monetization underperformance against the live-service cost base

- **Statement:** Live-service costs (R-05, R-07) are committed day one;
  revenue depends on premium sales plus battle-pass attach
  (`V4/V4_features.md:1946-1950`) and mission DLC at $9.99–$19.99
  (`:1958-1960`). Forecast doc base case assumes 22% pass attach among 90-day
  actives (planning assumption adopted 2026-06-12) — a miss to ~12% with
  conservative unit sales puts Year-1 MTX below the live-team run-rate.
- **L/I/Exposure:** 3 / 3 / **9**
- **Trigger:** Season-1 pass attach <14% at launch+30 d; MTX net ARPU per MAU
  <$0.80/month at launch+60 d; mission-DLC drop-1 attach <5% of owners.
- **Mitigation:** Scenario plan in the forecast doc pre-commits the cost
  levers (region scaling, AI-inference degradation ladder, content-cadence
  stretch from 90 to 120-day seasons) before any pay-to-win temptation;
  cosmetic-only constraint (`V4/V4_features.md:1951-1953`) is non-negotiable.
- **Owner:** Finance/BizOps Lead; Live Ops Director.

### R-12 — Constrained-platform performance breaks feel tests (Switch 2 / tablets / Steam Deck)

- **Statement:** Feel tests embed hard perf floors — Hitman sandbox 60 fps
  with 120 NPCs (`V4/V4_features.md:352-355`), crowd scenes to 400 NPCs
  (`:1634-1640`), 200-pop RTS pathing without stutter (`:373-376`), Contra
  60 fps couch co-op (`:377-380`) — on platforms including Switch 2 "scaled",
  iPad Pro, and Android tablets (`:300-304`). Nanite/Lumen-class rendering at
  those NPC counts on tablet thermals is unproven at this scale.
- **L/I/Exposure:** 4 / 3 / **12**
- **Trigger:** Any feel-test perf scenario >15% below target on Switch 2 or
  iPad at Open Beta entry; thermal-throttled 20-minute soak run losing >10%
  median fps on tablets.
- **Mitigation:** ADR 0005/0009 already allow stripping expensive cells per
  platform at cook — pre-decide the strip list per platform at Open Beta entry
  rather than during cert; scalability tiers with crowd-density floors
  respected (`V4/V4_features.md:1637-1640` — density must not drop below
  stealth-design floors, so the fallback is resolution/GI tier, not crowd
  count).
- **Owner:** Technical Director (Engine); Platform & Certification Manager.

### R-13 — Inspiration-adjacency legal exposure (trade dress / cloning claims)

- **Statement:** The product deliberately matches named competitors'
  hallmarks: SC2-replicable build orders within ±2% timing
  (`V4/V4_features.md:368-372`), Hitman/Commandos/Contra-pattern feel tests,
  R6-style breaching. Mechanics are generally unprotectable; trade dress,
  specific expressive elements, and named-comparison marketing are litigation
  surface (precedents in market-analysis §2 footnotes).
- **L/I/Exposure:** 2 / 4 / **8**
- **Trigger:** Any C&D or platform-store IP complaint; marketing copy naming a
  competitor product shipping without legal review.
- **Mitigation:** Legal review pass on all feel-test-derived marketing claims
  (internal docs may name inspirations; consumer-facing copy must not);
  expressive-distance review per cell (art, names, audio) before Open Beta;
  the heritage-firearms accuracy partnership template
  (`V4/legal/partnerships/`) shows the existing clearance muscle — extend it.
- **Owner:** General Counsel; Publishing Director.

### R-14 — AI commentary compliance/bias incident across 12 languages

- **Statement:** Live AI spectator commentary in 12 VO languages with bias
  review (`V4/V4_features.md:2576-2601`, DPIA at
  `V4/docs/compliance/dpia-in-game-commentary.md`) is a generative system
  speaking publicly about real players in real time. One slur,
  protected-trait inference, or harassment amplification clip can dominate
  launch coverage.
- **L/I/Exposure:** 3 / 3 / **9**
- **Trigger:** Any `BiasReview.AICommentary.Live` block-rate >1% in Open Beta
  (signals the generator, not the filter, is the problem); any unreviewed
  line reaching broadcast in staging drills.
- **Mitigation:** Fail-closed posture: blocked output = silence, never
  fallback to unreviewed text; per-language red-team phrase suites before each
  language enables; kill switch per language and per persona; launch with live
  commentary on partnered/esports broadcasts only (cap also bounds inference
  cost — forecast doc §4).
- **Owner:** Trust & Safety Lead; AI Systems Lead.

### R-15 — Esports commitment outruns ranked population

- **Statement:** A 12-month pro circuit must be published at launch
  (`V4/V4_features.md:2750`, circuit JSON at
  `V4/esports/pro-circuit/pro-circuit-2026.json`) across five ranked ladders
  (`:2020-2024`). If any ladder's population is too thin (especially
  RTS Historical and ARPG BossRush), early Majors play to empty brackets and
  the public calendar becomes a visible failure.
- **L/I/Exposure:** 3 / 2 / **6**
- **Trigger:** Any ranked ladder <50 k accounts at launch+30 d; Open
  qualifier signups <4× bracket capacity for the first Minor.
- **Mitigation:** Circuit JSON authored with per-ladder go/no-go checkpoints
  at launch+30 d — collapse thin ladders' events into the Wildcard/Roulette
  format (`V4/V4_features.md:1931-1936`) rather than cancelling; prize-pool
  commitments staged per checkpoint, not pre-committed for 12 months.
- **Owner:** Esports Director; Community Director.

### R-16 — Shared-roster coupling: one cell's balance break contaminates others

- **Statement:** One shared roster of 34 canonical operators crosses cells
  (`V4/V4_features.md:1576-1579`, ADR 0004). A balance or exploit fix for an
  operator in tactical PvP can silently change Hitman/RTST/co-op tuning;
  hotfixes ship in 30 minutes (`:1961-1962`), faster than cross-cell QA.
- **L/I/Exposure:** 3 / 2 / **6**
- **Trigger:** Any hotfix shipped without the per-cell regression matrix
  attached; two or more cross-cell regression incidents in one season.
- **Mitigation:** Per-cell stat-override layers so a tactical nerf is scoped
  by default and cross-cell only by explicit choice; hotfix pipeline runs the
  six cells' smoke feel-tests as an automatic pre-flight; public balance
  ledger (`V4/V4_features.md:309-311`) annotates cell scope per change.
- **Owner:** Balance Lead; Live Ops Director.

## Review cadence and change control

- Register reviewed in the weekly program meeting; exposure ≥12 items get a
  named action with a date each week.
- Any risk whose trigger fires becomes an agenda-forcing item within 48 h;
  R-01/R-08 triggers additionally start the ADR 0011 / threat-model gate
  clocks respectively.
- New program-level risks enter via PR to this file with L/I scored and an
  owner named; closing a risk requires the trigger metric to be green for 30
  consecutive days.