Record all three rulings; RISK-WP-0003 finished

Escalation rule adopted as written. RISK-F-0008 accepted with the legal
policy set as the compensating control. Canon kinds packet sent to
the-custodian, with note offered lifecycle-free and verifications
deliberately withheld as an unsettled species.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/rulings/2026-08-20-publication.md

@@ -67,3 +67,51 @@ depends on it.
   (`POLICY-NEXUS-WP-0001`). Paths proposed here are proposals.
 - **Whether anything else ever publishes.** Rulings, verifications and
   regulatory records are unaddressed and stay internal until someone asks.
+
+---
+
+# Later the same day — three more rulings
+
+## The escalation rule is adopted, as written
+
+`docs/method/escalation.md`, `status: adopted`, thresholds included. €50/month
+recurring and €500 one-off are now the operator's numbers.
+
+It had governed four escalations while still a draft. That was the state
+`RISK-WP-0001-T03` refused to leave open, and the wait carried the register's
+most uncomfortable default — unadopted by 2026-09-17 would have meant recording
+it as *de facto in force but unratified*, said on the face of every escalation
+sent under it.
+
+## No external legal determination while building — and a policy set instead
+
+`RISK-F-0008` moves to `accepted`. The estate will not buy advice in build
+mode; `RISK-REG-0001` stands as the recorded position. The three triggers
+survive as what **ends** the acceptance rather than what starts a purchase.
+
+The direction that came with it is the substantive part: **define and keep a set
+of legal policies for reuse**, because work contexts will need specific
+positions in place and should retrieve them rather than research them.
+
+`docs/regulatory/policies/` holds thirteen, keyed by **activation condition**
+rather than by regime, so a context pulls a slice — a first real user account
+pulls six; a consumer product in Germany pulls those plus accessibility.
+
+Two turned out to be **already active and unowned**: commercial and tax
+retention, and the e-invoicing receiving obligation live since 2025 with no
+named receiving point in the estate. That is the catalogue justifying itself in
+its first hour, and it is exactly the failure `INTENT.md` describes — regulation
+consulted once and discarded, with nobody noticing what had quietly become
+true.
+
+## Register the canon kinds
+
+`finding`, `regulatory-record` and `note` go to canon as work-record kinds. The
+packet is with `the-custodian`; canon is theirs and this repo does not edit it.
+
+**The reason is not the C-31 warning.** No repo can currently ask the hub what
+findings are open against it, and that capability gap was simply showing up as
+a warning. `note` is offered with no lifecycle at all — a note is not work and
+does not progress — and with an explicit invitation to reject it rather than
+give it a fake one. Verifications were deliberately left out: two records and a
+week-old shape is not a settled species.