# V2 Program Risk Register

Status: planning baseline, adopted 2026-06-12. Fills the "no risk registers"
gap identified by `V1_V7_PLAN_SET_AUDIT_2026-06-12.md` §6.1(5)/§6.2 ("V2
rollback-netcode-in-GAS ... undefended by contingency planning").

Conventions: **Likelihood** H/M/L = >40% / 15-40% / <15% over the program
(planning assumptions adopted 2026-06-12, derived where stated). **Impact**
Critical = launch-date or launch-viability threat; High = tier-drop or
multi-month slip; Medium = contained slip or cost. Each risk names a
**trigger** (the observable that converts risk → issue) and an **owner-role**
accountable for the mitigation. Review cadence: monthly at program review;
re-baseline quarterly with production actuals (**PD**).

Owner-roles: **TD** Technical Director, **OEL** Online Engineering Lead,
**EP** Executive Producer, **BD** Head of Business Development, **GC**
General Counsel, **PD** Production Director, **AD** Art Director, **AuD**
Audio Director, **LOC** Localization Manager, **QAD** QA Director, **RM**
Release Manager, **EL** Engine Lead, **BL** Balance Lead, **MS** Mocap Stage
Supervisor, **LOps** Live Ops Lead, **FIN** Finance Director.

---

## R-01 — Rollback netcode inside UE5 GAS at multi-fighter scope

- **Likelihood: H. Impact: Critical.** The genre's hardest engineering
  problem, attempted in a framework (GAS) that is not deterministic or
  rollback-aware out of the box: prediction keys, async ability tasks,
  Chaos-physics nondeterminism, float divergence across compilers, and UE's
  actor-tick model all fight the snapshot/re-simulate pattern. The promise is
  ≤ 8 frames rollback at ≤ 100 ms RTT with 2v2 at 60 Hz
  (`V2/V2_features.md:212-215`). Budget math: gameplay sim has 4 ms/frame
  (`V2/V2_ARCHITECTURE.md:1534`); an 8-frame rollback burst must re-simulate
  8 frames **plus** the current frame inside one 16.6 ms frame, so the
  deterministic sim step must cost **≤ 0.5 ms** — an 8× headroom requirement
  over a naive 4 ms sim.
- **Validation milestone (binding): RB-VS1.** A 2-character vertical slice
  (1 original Striker + 1 Grappler, full GAS ability sets, hitbox authority,
  meters, one stage) proving, before broad content production:
  - deterministic lockstep: zero desyncs across 10,000 automated rounds on
    PC + PS5 + XSX cross-play pairs (golden-replay divergence detection per
    `V2/V2_ARCHITECTURE.md:1545-1546`);
  - rollback quality: with injected 100 ms RTT ± 20 ms jitter and 2% loss,
    ≥ 99.9% of rollbacks ≤ 8 frames over a 24 h soak;
  - performance: re-sim cost ≤ 0.5 ms per rolled frame; p95 frame time
    ≤ 16.6 ms during 8-frame rollback bursts on PS5;
  - input latency: ≤ 4 frames local button-to-photon delta vs offline.
  **Gate:** roster production halts at 8 fighters until RB-VS1 is green
  (`minimum-lovable-launch.md` §4 G1); the 2v2 extension (RB-VS2, four
  active fighters) gates tag-mode content.
- **Trigger:** RB-VS1 not green by GM − 18 mo, or any desync class without a
  root cause for > 4 weeks.
- **Mitigation:** dedicated determinism strike team from day one; sim/render
  split (§7.2 of `V2/V2_TODOS.md`) with a fixed-point or strict-fp math core
  off Chaos; GAS used for orchestration only with a custom deterministic
  ability runtime underneath; delay-based fallback mode (§66) as the
  break-glass for launch. **Owner: OEL** (with **TD**).

## R-02 — Partner-IP licensing failure

- **Likelihood: H** (joint probability of the full 18-character slate ≈ 0.1%;
  even "two meaningful packages" is a coin flip — derivation in
  `rights-strategy.md` §2.5). **Impact: Medium** — *because the fallback
  exists*; without it this is Critical.
- **Trigger:** no executed license recorded in `V2/legal/licenses/` by
  GM − 12 mo (gate G3, `minimum-lovable-launch.md` §4).
- **Mitigation:** all-original 60-fighter fallback roster with 1:1
  archetype/style-pool backfill (`rights-strategy.md` §5); partner-IP becomes
  post-launch DLC; fail-closed marketing/build gate (`rights-strategy.md`
  §6) guarantees no exposure to an unlicensed character. **Owner: BD**
  (deals), **RDL** (fallback roster).

## R-03 — Platform cert risk for Web3 / Aje surfaces

- **Likelihood: H. Impact: High** (cert rejection at submission is a
  launch-date event). The cert-ban registry
  (`V2/legal/platform-cert-bans.json`, schema v2, reviewed 2026-05-13, next
  review 2026-08-11) currently records **all five Aje surfaces banned on
  ps5, xsx, switch2, ios, macos** (`bannedSurfaces` includes
  `web3_cosmetic_ownership`, `cosmetic_nft_ownership`,
  `on_chain_in_game_items`, `fan_token_gated_gameplay`,
  `on_chain_rights_manifest`); win64 is explicitly cleared for four surfaces
  but **`on_chain_rights_manifest` is neither banned nor cleared on win64**
  — an ambiguity that must be resolved, not assumed.
- **Trigger:** any cooked console/Apple build linking `@aje/*` packages; or
  the 2026-08-11 registry review tightening win64.
- **Mitigation:** compile-time exclusion of `@aje/identity`, `@aje/nft`,
  `@aje/governance`, `@aje/rwa` from all console/Apple build configurations
  (cook fails if linked — fail-closed); no gameplay state ever derives from
  an on-chain record so parity across platforms is automatic; win64
  `on_chain_rights_manifest` ambiguity escalated to publisher legal before
  any rights-manifest feature work; registry re-checked every cert
  submission. **Owner: RM** (gate), **GC** (registry truth).

## R-04 — Engine-version risk on UE5.5

- **Likelihood: M. Impact: High.** The client is a UE5.5 project
  (`V2/V2_ARCHITECTURE.md:310`). Epic ships no formal LTS; 5.5 receives
  hotfixes only until the next minor. Two failure directions: (a) staying
  locked while needed systems mature elsewhere — Motion Matching (§4.3) and
  Mover 2.0 (§4.4) are still maturing and V2 depends on both; (b) a
  mid-production engine upgrade, which historically costs AAA teams 2-4
  months of integration + re-cert of determinism (direct collision with
  R-01's golden replays).
- **Trigger:** a required fix exists only in 5.6+; or a console-platform SDK
  mandate (TRC/XR compliance windows) forces an engine bump.
- **Mitigation:** engine-lock ADR at `V2/docs/decisions/` (lock to 5.5.x for
  P1); maintained custom engine branch with cherry-pick policy (security +
  platform-mandated fixes only); 3-5 FTE engine team owning the branch;
  upgrade rehearsal on a throwaway branch each minor release to keep the
  true cost measured; golden-replay suite as the determinism regression gate
  for any engine change. **Owner: EL.**

## R-05 — P2 scope bleed: racing / battle-royale / heist modes

- **Likelihood: M. Impact: High.** §96-§125 (racing stack, convoy, heist)
  and §127 (100-player BR) are a second game's worth of scope sitting in the
  same backlog. The failure mode is quiet pre-investment — "shared" vehicle
  tech, BR-ready netcode abstractions, heist level prototypes — taxing P1's
  critical path.
- **Trigger:** any P1-phase sprint contains tasks from §96-§125/§127 without
  a phase-cut ADR; or shared-systems designs grow BR/vehicle requirements.
- **Mitigation:** hard staffing firewall (zero P2 FTE until P1 content
  velocity ≥ plan for 2 consecutive quarters); P2 modes get their own kill
  criteria at greenlight (CCU and attach thresholds defined then, not
  retrofitted); client-server modes (BR/heist) reuse the §8 dedicated-server
  stack as-is or wait. **Owner: EP.**

## R-06 — Content-production schedule risk (roster + cinematics)

- **Likelihood: H. Impact: High.** The math in
  `content-production-model.md`: 60 fighters = 1,080 pm at 2.5 fighters/mo
  steady state with ~23 fighters in flight; uncut P1 cinematics ≈ 930
  finished minutes ≈ 930 pm — together ~186 person-years of content. 60
  launch fighters is 2-3× any modern genre launch.
- **Trigger:** completed-fighter velocity (signature-checklist + QA cert
  definition) < 2.0/mo for two consecutive months at 60-fighter scope; or
  gate G2 counts (< 40 done at GM − 12 mo) per
  `minimum-lovable-launch.md` §4.
- **Mitigation:** MLL tier ladder as the pre-agreed de-scope; side stories
  (the largest line) pre-designated as the first internal cut (MLL-2a);
  quarterly recalibration of the production constants from actuals;
  outsourcing share already planned at 60-70% of character art. **Owner:
  PD.**

## R-07 — Mocap stage capacity and stunt-performer availability

- **Likelihood: M. Impact: Medium.** 220 roster stage-days + up to 465
  cinematic stage-days (`content-production-model.md` §2) against 184
  stage-days/year per stage; fight-choreo stunt teams are a thin labor
  market, and a single performer injury idles a booked stage.
- **Trigger:** capture backlog > 20 stage-days; or retained-seconds/day
  actuals < 60 (vs 75 planned) across 10 stage-days.
- **Mitigation:** second stage / vendor contract optioned now (lead time
  ~2 quarters); choreography pre-viz so stage time is selects, not
  exploration; cross-trained stunt pairs for paired finishers; capture
  schedule front-loads fighters, leaving cinematics on the vendor stage.
  **Owner: MS.**

## R-08 — VO program: 8-locale throughput, labor actions, AI-voice terms

- **Likelihood: M. Impact: Medium-High.** ≈ 300,000 recorded lines across 8
  full-VO locales, ≈ 2,500 studio-days, ~400 actor contracts
  (`content-production-model.md` §6). Voice-actor labor actions over
  interactive-media and AI-voice terms have already shut down game VO
  pipelines this decade; locale vendors are a serial dependency for the
  18-locale launch promise (`V2/V2_features.md:2445`).
- **Trigger:** any locale > 15% behind its studio-day plan; union
  negotiation entering a strike-authorization phase; a vendor losing a key
  casting.
- **Mitigation:** contracts include explicit AI-voice consent scope and
  strike-contingency recast clauses (**GC** reviews the template); barks and
  efforts recorded first (cheapest to recast); per-locale fallback to
  subtitle-only is already a specced degradation
  (`V2/V2_features.md:2454-2455`); two EN rooms to protect the source-locale
  schedule. **Owner: AuD** + **LOC**.

## R-09 — Cross-platform determinism for cross-play rollback

- **Likelihood: H. Impact: Critical** (subset of R-01 but distinct cause:
  even a perfectly deterministic sim on one platform diverges across
  CPU/compiler/SIMD differences on PC vs PS5 vs XSX vs Switch2). Cross-play
  is a product promise (`V2/V2_features.md:233-234`).
- **Trigger:** any cross-platform golden-replay divergence in CI; > 0.01%
  cross-play desync rate in playtests.
- **Mitigation:** fixed-point math core or strictly-controlled fp
  (no FMA/SIMD variance, single rounding mode) for everything inside the
  rollback boundary; per-PR cross-platform replay CI (the 200-replay suite,
  `V2/V2_ARCHITECTURE.md:1545-1546`) run on real devkit pairs; desync
  telemetry with state-hash bisection built before content scale-up.
  **Owner: OEL.**

## R-10 — Anti-cheat vs rollback architecture

- **Likelihood: M. Impact: High.** Input-delay/rollback P2P topologies expose
  state to both clients; ranked integrity then rests on detection, not
  prevention. Naive server authority breaks the ≤ 8-frame promise.
- **Trigger:** cheat tooling for V2 observed in the wild during betas;
  ranked dispute rate > 0.5% of matches.
- **Mitigation:** server-side replay verification for ranked (inputs are
  tiny; re-simulate suspicious matches headlessly and compare state hashes);
  relay-based connection privacy (no raw peer IPs); kernel-level anti-cheat
  decision made per platform with the compatibility cert requirement
  (`V2/V2_features.md:2530`); the anti-cheat false-positive dashboard
  (`V2/V2_ARCHITECTURE.md:1515`) gates enforcement rollout. **Owner: OEL**
  + **QAD**.

## R-11 — Balance/QA combinatorics of 7 rulesets × 60 fighters

- **Likelihood: H. Impact: Medium-High.** Matchup cells: 60×59/2 = 1,770
  pairings × 7 rulesets = **12,390 matchup-ruleset cells** — exhaustive
  human coverage is impossible; an infinite or degenerate loop shipping in a
  niche ruleset is near-certain without systemic defense.
- **Trigger:** any touch-of-death/infinite reproducible in two distinct
  matchups; per-ruleset pick-rate Gini worsening two seasons running.
- **Mitigation:** automated combo-search fuzzing (AI-driven input search for
  damage-unbounded sequences) on the deterministic sim in CI; telemetry-
  driven balance ops (§55, §88) with the server-driven data-only hotfix path
  (`V2/V2_features.md:2558-2560`); tiered coverage policy — full human QA on
  the MLL-0 ruleset pairs, sampled + fuzzed coverage beyond. **Owner: BL**
  + **QAD**.

## R-12 — Ratings and regional content risk for gore

- **Likelihood: M. Impact: Medium.** Target boards ESRB M / PEGI 18 / CERO Z
  / USK 18 / ACB R18+ / GRAC (`V2/V2_features.md:2533-2534`,
  `V2/legal/rating-boards.json`). MK-grade fatalities historically force
  CERO content modification or non-release in Japan, and Japan is a core FGC
  market for the SF/Tekken rulesets — a direct tension.
- **Trigger:** CERO pre-consultation flags fatality content; any board
  reclassifies mid-cert.
- **Mitigation:** gore opt-in/opt-out and locale-aware content switches are
  already product promises (`V2/V2_features.md:226-227`) — build the
  per-region content-adjustment matrix into the cook (regional SKU
  differences limited to data flags, not binaries); pre-consultation with
  CERO/USK before Beta; finisher library tagged by intensity tier from
  authoring day one. **Owner: RM** + **GC**.

## R-13 — Install size and day-one patch budget

- **Likelihood: M. Impact: Medium.** Per-fighter worst case from the asset
  budgets (`V2/V2_features.md:2538-2541`): 80 MB anim + ~64 MB textures + 50
  MB audio × 8 VO locales = **~544 MB/fighter if all locales install**; × 60
  fighters ≈ 33 GB before stages (30 × up to 256 MB textures ≈ 7.7 GB),
  cinematics (930 min, the largest single item if pre-rendered — in-engine
  rendering keeps it to scene data), modes, and the rest. Uncontrolled, the
  install breaches 150 GB-class and the ≤ 5 GB day-one patch budget
  (`:2555`) becomes unmeetable.
- **Trigger:** projected install > 110 GB at Beta; day-one patch projection
  > 4 GB at GM − 3 mo.
- **Mitigation:** the specced per-fighter chunking (`:2545-2546`) plus
  **VO-locale-on-demand** (install 1 locale by default, stream others);
  in-engine cinematics policy (no pre-rendered video except attract reel);
  weekly asset audit (`:2550-2551`) with oversize alarms; texture pack tiers
  per platform already specced. **Owner: TD** + **RM**.

## R-14 — Multi-studio / multi-vendor coordination

- **Likelihood: M. Impact: Medium-High.** The plan leans on 60-70%
  outsourced character art, external VO vendors in 8 locales, a possible
  second mocap stage, and a multi-studio org
  (`V2/V2_features.md:2574-2579`). Vendor desync (style drift, redelivery
  loops, schedule mismatch) is the standard failure mode at this volume.
- **Trigger:** first-pass art acceptance rate < 70% from any vendor over a
  month; any vendor > 3 weeks behind plan.
- **Mitigation:** style bible + golden-sample sign-off before volume orders;
  per-vendor embedded internal reviewer; Perforce-based delivery with
  automated budget validation on ingest (tris/texture/LOD lint from the
  weekly audit tooling); dual-vendor sourcing for character art so no single
  vendor carries > 40% of the roster. **Owner: PD** + **AD**.

## R-15 — Live-service economics of dedicated-server modes

- **Likelihood: M. Impact: Medium.** Rollback 1v1/2v2 is peer-cheap, but BR,
  World Tour, Battle Hub, Convoy, Heist, World Boss all require dedicated
  servers (`V2/V2_features.md:216-219`) whose cost scales with CCU while the
  revenue is a one-time premium purchase plus optional MTX
  (`market-rationale.md` §6).
- **Trigger:** projected infra cost > 7% of projected net revenue at the
  CCU forecast; or post-launch CCU > 2× forecast without MTX attach scaling.
- **Mitigation:** hub/open-world modes designed for graceful instance
  consolidation; server capacity gates in the launch-readiness checklist
  (§138) tied to the matchmaking-p99 dashboards
  (`V2/V2_ARCHITECTURE.md:1513`); P2/P3 server-heavy modes (BR, World Boss)
  held behind attach-rate evidence per R-05 kill criteria. **Owner: LOps**
  + **FIN**.

---

## Summary heat map

| ID | Risk | L | I | Owner |
| --- | --- | --- | --- | --- |
| R-01 | Rollback-in-GAS (RB-VS1 gate) | H | Critical | OEL |
| R-09 | Cross-platform determinism | H | Critical | OEL |
| R-02 | Licensing failure → fallback roster | H | Medium | BD |
| R-03 | Web3/Aje platform cert | H | High | RM |
| R-06 | Content schedule (roster + cinematics) | H | High | PD |
| R-11 | 7-ruleset balance combinatorics | H | Med-High | BL |
| R-04 | UE5.5 engine version | M | High | EL |
| R-05 | P2 racing/BR/heist scope bleed | M | High | EP |
| R-10 | Anti-cheat vs rollback | M | High | OEL |
| R-08 | VO program / labor | M | Med-High | AuD |
| R-14 | Multi-vendor coordination | M | Med-High | PD |
| R-07 | Mocap capacity | M | Medium | MS |
| R-12 | Ratings/gore regional | M | Medium | RM |
| R-13 | Install size / day-one patch | M | Medium | TD |
| R-15 | Dedicated-server economics | M | Medium | LOps |