RISK-WP-0005 T02, T03, T04: intake, the transition, and an honest README

T02: docs/method/intake.md names all four sources INTENT claims and
builds the two that had none. An incident files first and grades within
the hour, carries first_observed because obligations run from it, sits at
instant until it is over, and escalates immediately rather than batched —
a 72-hour notification clock outranks the rule that protects the
operator's attention. External report has no address anywhere in the
estate, and where one lives is policy-nexus's and the custodian's, so it
is routed with a proposal rather than invented here.

T03: the production transition defined by what is held rather than what
was announced — the first moment any system holds real external data,
which can happen by accident and cannot be reversed. Declared by the
custodian; noticed and asked about by this register. Lists what fires:
five re-scores, two acceptances ending, six policies activating.

T04: the README no longer claims a surface this repo does not have.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/method/severity.md

@@ -142,6 +142,19 @@ comes back.
 > *Added 2026-08-19 (`RISK-WP-0001-T07`).* Forced by `RISK-F-0006`, where the
 > defect is an absent backup and the reach reading produced nonsense.
 
+## Live incidents
+
+Everything above assumes a latent defect — something reachable that nobody is
+currently reaching. When someone is, three things change:
+
+- **Likelihood is `L4`.** The band means "already happening" and this is what
+  it is for.
+- **Impact is scored on what has occurred plus what is still reachable**, not
+  on the worst case. An incident in progress has facts; use them.
+- **The grade is provisional and expected to move.** File first, grade within
+  the hour, re-grade as facts arrive. `docs/method/intake.md` has the rest,
+  including the 72-hour clock that `first_observed` starts.
+
 ## The floor
 
 `INTENT.md`: if a finding would not change anyone's decision, it is a note,