RISK-WP-0005 finished: the seven gaps closed

T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/method/check-procedure.md

@@ -43,6 +43,7 @@ Then, per due finding:
 Then record it, in the same sitting:
 
 ```
+RISK_CHECKED_BY=<who-or-what-you-are> \
 make checked ARGS="RISK-F-0002 clean"
 make checked ARGS="RISK-F-0002 moved  'ops-warden enabled the gate'"
 make checked ARGS="RISK-F-0002 defer 2026-09-01 'operator: after the migration'"

docs/method/escalation.md

@@ -184,6 +184,26 @@ The test therefore applies to intake, not to sweeps:
 If that trips, the first suspects are triggers 3 and 4 — spend thresholds set
 too low, and "unowned" being read where "not yet routed" is meant.
 
+## Delivery is a state, not an act
+
+`RISK-WP-0005-T05`. An escalation that nobody acknowledged is indistinguishable
+from one never sent — which is precisely the failure this register committed
+on 2026-08-19 and then fixed for its **own** inbox with an hourly watch, while
+leaving the path that matters more unguarded.
+
+So an escalation carries a state:
+
+```yaml
+escalation_status: pending-operator   # sent | seen | answered | withdrawn
+escalation_sent: "2026-08-19"
+```
+
+`make check` reports how long each has been unacknowledged. At seven days it
+says so and the escalation is **raised once more** — once, per the rule above.
+After that the default applies and is recorded. Repetition until someone
+answers is how the operator becomes the queue, and silence that is recorded is
+not the same as silence that is ignored.
+
 ## Escalations are batched
 
 Four escalations are one conversation, not four interruptions. Open items go

docs/method/review.md

@@ -49,6 +49,17 @@ Two rules and one escape:
   the only way out of the bottom rung other than a clean check, and it is a
   decision with a name on it rather than a check quietly not happening.
 
+### Who checked, and when anyone last did
+
+`RISK-WP-0005-T06`. Two defences against the rung telling a lie:
+
+- **`checked_by` on every check.** `record_check.py` writes it. A rung earned
+  by nobody in particular is visible as such.
+- **A heartbeat.** If nothing anywhere in the register has been checked for two
+  days, `make check` says so **before anything else**. A `1q` rung means
+  "stable for a quarter" and "nobody looked for a quarter", and those read
+  identically from the outside — the heartbeat is what separates them.
+
 ### The rung is the signal
 
 This is the point of the design, not a side effect. **The cadence a finding