diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 2ef0bd8..0ee06cb 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -8,12 +8,12 @@
 
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
-| workplan | RISK-NEXUS-WP-0001 | active | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T01 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T02 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T03 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T04 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T05 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T06 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T07 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
-| task | RISK-NEXUS-WP-0001-T08 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md |
+| workplan | RISK-WP-0001 | active | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T01 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T02 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T03 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T04 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T05 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T06 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T07 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
+| task | RISK-WP-0001-T08 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
diff --git a/findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md b/findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
index c586d30..2123314 100644
--- a/findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
+++ b/findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
@@ -10,7 +10,7 @@ date_reported: "2026-08-19"
 system: ops-warden
 environment: production
 fix_owner: ops-warden
-fix_tracking: unset
+fix_tracking: WARDEN-WP-0032-T05
 # risk-nexus's fields, deliberately left unset by the reporter.
 severity: unset
 disclosure: unset
@@ -97,6 +97,24 @@ Two candidate fixes, both ops-warden's to choose between:
 Either way the grading is real work with real judgement in it, and the five
 `exec_capable` lanes are the ones that matter first.
 
+**Update 2026-08-19 — a third direction, and the one being taken.** The operator
+has directed that the default derive from **maturity context**: in an early or
+experimental context an absent grade is tolerable and explicitly accepted; in a
+production context an absent grade resolves to `high`, or `critical` where the
+context is critical. This validates against the data here — all five exposed
+lanes are owned by production-serving components, so the rule would have caught
+every one.
+
+The durable form of that is a zone-model question (`ZONE-WP-0001-T03`), because
+the `M0`-`M3` maturity ladder that would drive it has no join to catalog lanes
+today. That work is months out, so the two are being run separately: the five
+lanes are graded explicitly now under `WARDEN-WP-0032-T05`, and the structural
+fix that makes absence impossible follows under `WARDEN-WP-0032-T06`.
+
+Note for whoever sets severity: `.repo-classification.yaml` `category` is **not**
+usable as the maturity signal. `railiance-platform`, which runs production
+OpenBao and owns three of the five lanes above, is `category: tooling`.
+
 ## Related
 
 - ops-warden `ADR-0004` — high-risk lanes refuse raw value streaming