**REVISE**

**Confirmations.** No identifier is allocated: `control.json` carries `modelId: null`, `registryId: null`, `allocationState: "unassigned"`, the profile carries `newRuntimeId: false`, and the holds state that allocation is pending and no identifier is guessed. No publication readiness is claimed: all three files carry `candidateRevision: 2` and `canonicalPublishable: false`, the fixtures are `executable: false`, and the profile's `publicationStatement` denies canonical publishability, installability and verification. Exactly one new root is proposed (Control), consistent with both providers; this audit introduces none. One caveat to the first confirmation is recorded at defect 2.

## Identity and mastership

1. **Bases are unpinned.** `bases` lists bare `WM-KNW-015` and `WM-XCT-027`, though the dossier pins them by digest (`6725…3ccd`, `4abb…5928`). Same for `conditionalReferences` WM-ACT-034 and every entry of `control.json.boundary.references`. EP-02 demands revision, criteria and method pins of everything the profile governs while the profile itself binds to unpinned upstream. Pin every reference by revision or digest.
2. **WM-REC-001 is unsupported.** It appears only in `control.json` as the master for "Execution, test and documentary evidence records". Neither study names it; both place evidence in an identifier-unassigned external model. It is unpinned, unheld and traceable to nothing in the material. Remove it or replace it with an unresolved external evidence plane plus a hold. This is a reference, not an allocation, so confirmation one stands — but it is an unverified identifier binding.
3. **WM-ACT-034 is stated inconsistently.** The profile makes it conditional on a written occupancy crosswalk; `control.json` lists it flatly as the master for "Scoped control assessment and effectiveness determination". Read alone, the control candidate asserts the very binding EP-08 blocks. Carry the identical condition text in both files.
4. **Effectiveness-determination mastership is nowhere.** CTL-06, CTL-08, CTL-09 and CTL-12 all require a determination bearing population, period, mechanism, method, evidence chain, confidence, conclusion time, validity and invalidation triggers. WM-ACT-034 is reference-only, no control-assessment candidate exists (the three-candidate position was reduced to one), and `unownedScopeRegister` omits the plane entirely. Either reinstate the candidate or register the plane as unowned, and record why the reduction was made.
5. **`unownedScopeRegister` is incomplete beyond item 4.** Criteria/method/technique registry, scale registry, party/owner registry, the policy-and-requirement master and the upstream-supersession detection mechanism are all load-bearing in the rules and unassigned.
6. **Owner and implementation state are mastered twice.** `ownerRef` is required on both `Control` and `ControlRevision`, while CTL-02 makes an owner change a successor-revision trigger — an in-place `Control.ownerRef` update contradicts CTL-02 and no precedence rule exists. Likewise `implementationState` sits on the immutable `ControlRevision`: an implementation change either mutates an immutable revision or forces a revision CTL-02 does not license, and CTL-05 holds implementation distinct from design. Move implementation state to a time-bounded state record on the control identity and declare owner precedence.
7. **WM-XCT-027's `status: split` is not resolved at field level.** EP-05 is a prose prohibition with no bound cut. The base's control-authoring groups (catalogue binding, objective classification, applicability scope, accountability references including control-owner ref, design and implementation assertions, operating cadence, assessment-evidence binding, effectiveness conclusion, crosswalk alignment, coverage dependency) are not named as excluded; `rctl-control-link-record` is not constrained to a contained collection under the single host-scoped root; `rctl-control-residual-contribution` is not split into an assessment-authored claim versus a risk-owner-held `attribution-status`. As written EP-05 is unenforceable against the base's delivered structure.
8. **Context identity dependence is unstated.** No rule says the assessment context has no identity or lifecycle independent of its host and pinned risk revision, and nothing bars a second root inside the profile. EP-02 asserts host-scoping only.

## Lifecycle

9. **Both lifecycles are bare state lists.** No transition graph, no terminal states, no gate conditions, no re-activation rule from `suspended`. CTL-03 requires an effective control to reference "exactly one immutable approved revision" while the revision vocabulary separates `approved` from `effective`, leaving CTL-03's referent ambiguous.
10. **Two supersession semantics are conflated.** `Control.status: superseded` with `successorRef` (identity replaced) and `ControlRevision: superseded` with `supersedesRevision` (identity preserved, per CTL-02) are not distinguished, and CTL-13 addresses only the revision case. The effect of control-identity supersession on dependent contexts is undefined.
11. **Lifecycle integrity fields are optional without conditions.** Nothing requires `successorRef` when status is `superseded`, `retiredAt` when `retired`, or `effectiveTo` on a superseded revision. The `revision` key's ordering and immutability are undeclared, and CTL-16 protects control identifiers from recycling but not revision identifiers.
12. **Operating state is missing though asserted.** CTL-05 distinguishes operation from design, implementation, execution and effectiveness, but no operation plane exists (operating / suspended / not operating, with expected versus observed occurrences by reference), and `suspended` does double duty as a control-lifecycle state.
13. **Forward reliance on dead revisions is unconstrained.** CTL-13 marks dependent contexts stale after supersession or retirement; no rule bars a new reliance citation on a withdrawn, retired or superseded revision.

## Risk, treatment and control boundaries

14. **The treatment cut is negative only.** EP-07 declares treatment execution unowned but never states what the risk entity may hold (response-option selection, rationale, treatment-plan reference) or what the profile must not author (plans, milestones, closure). Nothing therefore prevents treatment workflow accreting on WM-KNW-015 or the context.
15. **EP-07 encodes an unverified cross-contour scope claim as a rule.** "EM-RSK-02 is assurance" rests on a single provider and reverses the earlier local synthesis, with no hold recording that EM-RSK-02's scope is unverified in this dossier and no named route to settle treatment mastership.
16. **A declared conflict is unrecorded.** The contour's candidate type list still contains Risk Treatment and Control Execution while the delivered boundary strips treatment and externalises execution. Neither candidate file carries this as an open item.

## Comparability

17. **EP-03's pin set is narrower than EP-02's.** It omits exclusions, as-of and valid-until times, technique version, taxonomy pin and case basis (expected / most likely / worst credible). Records can be judged comparable on pins EP-02 required.
18. **There is no aggregation gate.** Nothing requires an explicit comparability verdict plus aggregation eligibility before roll-up; the verdict vocabulary (comparable / comparable-with-caveats / not-comparable) and a mismatched-pin list are undeclared; and no rule bars difference, product or mean under qualitative, ordinal or scenario expression modes. CTL-15 forbids only arithmetic licensed by shared cause.
19. **Withdrawn-criteria handling is absent.** No rule routes records pinned to superseded or withdrawn criteria through a declared handling path, and none forbids silent re-scoring.
20. **Inherent-to-residual comparison is underspecified.** EP-04 requires changed dimension and explanation but not direction, and does not restrict magnitude computation to modes that admit it.

## Temporal and evidence semantics

21. **The three clocks are never separated.** No rule declares event time, observation/as-of time and record time distinct and non-substitutable. `ControlRevision` carries `effectiveFrom`/`effectiveTo` with no recorded or decision time and no bar on backdating across existing reliance history.
22. **Currency has no stated clock.** CTL-09 degrades missing, expired or invalidated effectiveness to unknown but does not fix expiry to the assessment's as-of time rather than read time.
23. **Upstream risk-side staleness has no mechanism.** CTL-13 covers the control side; a superseded upstream risk revision marking the binding stale is neither a rule nor an explicit hold, though the material names it a declared gap.
24. **"Evidence chain" is load-bearing and undefined.** CTL-06 and CTL-12 turn on it, yet no rule requires an evidence reference to resolve with a matching digest, states that non-resolution or digest mismatch invalidates the determination rather than degrading it silently, or separates lawful retention and destruction from falsification.
25. **Value vocabularies are undeclared.** Effectiveness conclusion terms, `implementationState` values, binding-validity state, comparison outcome and `attribution-status` (accepted / rejected / suspended) are all unenumerated, and "shared cause" — CTL-15's antecedent — is undefined (same source reference, same predisposing condition, same held-fixed context condition, or common relied-on control or dependency).
26. **Valence asymmetry and identity survival.** EP-01 claims a Risk / Opportunity identity while CTL-08 and CTL-09 are written solely as "residual reduction", incoherent for upside items; the base's known adverse-only purpose defect is not held and no rule makes estimation and comparability valence-symmetric. Separately, identity survival through re-estimation, split, merge, closure and register-membership change is unstated — EP-01 covers only that assessment revisions are not risk identities.
27. **Acceptance semantics are thin.** EP-06 and EP-09 make acceptance external and non-implied, but no rule requires a referenced decision with sufficient recorded authority, threshold-table version and authorisation time, and none states that acceptance does not close a risk.

## Rule IDs and fixtures

28. **Rule text is duplicated without precedence.** `control.json` carries the sixteen texts verbatim in both `invariants` and `invariantRules`; they currently agree, and nothing keeps them agreeing. Keep the ID-bearing array as the sole source.
29. **Rule planes are misassigned.** CTL-07, CTL-08, CTL-09, CTL-12, CTL-13 and CTL-15 are assessment-context obligations carried under the control namespace, and they overlap EP-04, EP-05 and EP-09 — FX-028 binds CTL-04 and EP-09 to one behaviour. Add an owning plane and a precedence rule.
30. **Twenty-five of thirty-one fixtures are tautological.** FX-001 through FX-025 take "an implementation contradicts \<rule text\>" as input and "rejected under \<rule id\>" as expectation. They bind identifiers but discriminate nothing: any implementation that merely restates the rule passes. Replace each with concrete state, pins and an expected verdict.
31. **Coverage and balance are skewed.** Two positive cases against twenty-nine negatives, with no positive case for revision creation (CTL-02, CTL-03), expiry to unknown (CTL-09), supersession to stale (CTL-13), comparable-with-caveats (EP-03), grounded residual (EP-04) or retired-identifier resolution (CTL-16).
32. **FX-027 collapses two distinct grounds.** R2 is unchanged because the reliance falls outside the failed occurrence's population and scope, so no causal link holds; R3 is unchanged because there was no cited determination and therefore no effectiveness claim to falsify, and it additionally gains a coverage-gap finding. Split into separately bound cases.
33. **Fixtures bind IDs to no pinned source.** Beyond a matching `candidateRevision: 2`, nothing names the files or revisions the rule IDs come from, no completeness check asserts that every rule has at least one fixture and every cited ID resolves, and the file carries neither holds nor a publication statement mirroring the other two.

**Checklist closed at 33 items**; no further defects are identifiable from the supplied material. Every item is correctable within a revision 3 without allocating an identifier and without introducing any root beyond the single unassigned Control candidate.