RISK-WP-0005 finished: the seven gaps closed

T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/method/review.md

@@ -49,6 +49,17 @@ Two rules and one escape:
   the only way out of the bottom rung other than a clean check, and it is a
   decision with a name on it rather than a check quietly not happening.
 
+### Who checked, and when anyone last did
+
+`RISK-WP-0005-T06`. Two defences against the rung telling a lie:
+
+- **`checked_by` on every check.** `record_check.py` writes it. A rung earned
+  by nobody in particular is visible as such.
+- **A heartbeat.** If nothing anywhere in the register has been checked for two
+  days, `make check` says so **before anything else**. A `1q` rung means
+  "stable for a quarter" and "nobody looked for a quarter", and those read
+  identically from the outside — the heartbeat is what separates them.
+
 ### The rung is the signal
 
 This is the point of the design, not a side effect. **The cadence a finding