Work the register due list, and add the one-check-per-sitting rule

Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).

The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.

record_check.py now handles regulatory records as well as findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

findings/RISK-F-0008-audit-retention-legal-basis-assumed.md

@@ -32,8 +32,8 @@ escalation_act: rule
 decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor"
 outstanding: "a defensible retention period per category (waits on audit-core's co-residency horizon), and the trigger list for buying an external answer"
 determination: RISK-REG-0001
-last_checked: "2026-08-20T05:25:00Z"
-next_check: "2026-08-20T05:25:00Z"          # due now: the ladder starts at instant
+last_checked: "2026-08-20T10:02:41Z"
+next_check: "2026-08-20T10:02:41Z"
 cadence: instant
 clean_streak: 0
 graded_by: risk-nexus
@@ -308,3 +308,4 @@ The finding stays open. What remains is a retention period per category, which
 waits on the co-residency horizon, and the trigger list for buying an external
 determination. The record is reviewed every 90 days with this finding, or
 immediately on any trigger.
+- **2026-08-20** — not clean: The determination now exists: RISK-REG-0001 states the grounds per category and names duration as the weak point. Cadence instant → instant; checked again immediately.