Work the register due list, and add the one-check-per-sitting rule

Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).

The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.

record_check.py now handles regulatory records as well as findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/method/check-procedure.md

@@ -53,6 +53,23 @@ make register
 check that is not written down did not happen** — the same rule this register
 applies to every repo it grades.
 
+## One check per sitting
+
+**A finding you recorded as `moved` is not clean-checked in the same sitting.**
+
+The ladder says `instant` means "now, and again immediately until a check comes
+back clean". The temptation is to record the movement, re-read what you just
+wrote, find it consistent, and climb — which produces a `1h` rung seconds after
+a change, on the evidence of your own keystrokes.
+
+That is self-certification, and the rung is supposed to carry information about
+how long the world has held still, not about how quickly the register can agree
+with itself. A finding that moved stays at `instant` until a *later* pass finds
+nothing new. It costs one extra check and it keeps the signal honest.
+
+Applied on 2026-08-20: `RISK-F-0002`, `RISK-F-0007` and `RISK-F-0008` all moved
+and were left due rather than climbed.
+
 ## What must not happen
 
 **Stamping `clean` without doing the four questions.** It costs nothing, takes