RISK-WP-0005-T01: read the fix records, and two findings moved

fix_tracker.py resolves fix_tracking against the owning repo's workplan
file — the ADR-001 source of truth — and uses the file's last commit date
as the honest answer to 'has this moved', independent of whether the
register looked. Archived workplans are searched too, so a finished fix
that was filed away does not read as missing.

First run, three findings it should have known about:

RISK-F-0005 — AUDIT-WP-0008-T04 has read done since 2026-08-18. The fix
this finding asked for has landed and the register spent three days not
knowing. Now mitigated, embargo lifted, disclosure public. Not fixed:
that needs a probe, and T05's adversarial evidence artifact still reads
wait.

RISK-F-0002 — both tracked records were closed before the finding was
filed: WARDEN-WP-0007 archived 2026-07-08, FLEX-WP-0007 finished
2026-06-29, against a finding of 2026-08-18 that names FLEX-WP-0007 as
the blocker. Routed as a question, not a conclusion.

Four findings carry no fix tracking at all, which the report now says out
loud rather than leaving as an empty field.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/register_check.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import datetime as dt
 
+import fix_tracker
 import register_lib as lib
 
 NOW = lib.now()
@@ -143,6 +144,9 @@ def main() -> int:
             if ref in waiting_ids and f.get("waiting_on"):
                 deep.append(f"{f['id']} waits, and points at {ref} which also waits — depth two, cut one")
     section("Waiting on someone", waiting, "nothing is waiting on anyone")
+    # RISK-WP-0005-T01: the fix's own state, read from the owner's workplan
+    # file rather than from our memory of what they told us.
+    section("Fix state", fix_tracker.report(), "no finding claims a tracked fix")
     if due_defaults:
         section("Defaults now due — apply them", due_defaults, "none")
     if deep: