Work the register due list, and add the one-check-per-sitting rule

Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).

The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.

record_check.py now handles regulatory records as well as findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md

@@ -24,10 +24,10 @@ embargo_condition: "RISK-F-0009 resolved — the OpenBao deny set covers every h
 embargo_since: "2026-08-19"
 embargo_review: "2026-09-18"
 escalation: none
-last_checked: "2026-08-20T05:40:00Z"
-next_check: "2026-08-20T05:40:00Z"          # due now: the ladder starts at instant
-cadence: instant
-clean_streak: 0
+last_checked: "2026-08-20T10:02:42Z"
+next_check: "2026-08-20T11:02:42Z"
+cadence: 1h
+clean_streak: 1
 graded_by: risk-nexus
 ruling: RISK-RULING-2026-08-19
 ---
@@ -225,3 +225,4 @@ finding's own fix has landed.
 **Verification limit, recorded rather than assumed:** the mitigation is
 `ops-warden`'s report and this register has not probed it. Their operator token
 is expired, which is also why `RISK-F-0009` rests on a file comparison.
+- **2026-08-20** — clean check: checked against the inbox and the owner's record; nothing moved. Cadence instant → 1h (1 clean in a row); next check 2026-08-20 11:02Z.