docs/risks.md

# Research risks and next evidence

Opened 2026-10-21. Owner: Nanobrush reference research. This register tracks concrete gaps; none of these entries alone blocks the source mapping already authorized by the user.

| ID | Evidence/gap | Impact | Next experiment/task |
| --- | --- | --- | --- |
| R01 | Original editor/engine source absent | Host implementations and runtime contracts remain unknown | Establish oracle and identify host boundaries, P3.05–P3.14 |
| R02 | Actual archive terms restrict executable RE/reuse/redistribution | Investigation/distribution paths need their own recorded basis | P0.04/P0.05; preserved original texts |
| R03 | No MB2 binary or converter sources recovered | Cannot claim MB2 compatibility | Optional P3.13 recovery stream |
| R04 | Missing font notice and unresolved resource naming | Runtime asset reuse and startup behavior remain uncertain | P0.06/P8.07/P8.08 |
| R05 | DAT converter layouts recovered; native editor conformance and plugin representation unknown | Converter specification does not prove editor compatibility | P6.19/P6.09 |
| R06 | Core IDs and IXModel versions change across builds | Misinterpreted older artifacts if latest tables are reused | Version-specific experiments, P4.03/P6.08 |
| R07 | Grammars and APIs do not prove semantic preservation | Risk of lossy or incorrect import/save | Format matrix/loss reports, P6.11/P6.13 |
| R08 | Single mutable callback slots and cached failed service lookups | Potential concurrency/order bugs | P4.04/P4.05 targeted task experiments |
| R09 | IXModel reset writer and file-stack inconsistencies | Source-derived decoder could encode the wrong behavior | Generate nested-handle/reset fixtures, P6.08 |
| R10 | Raycast helper temporarily changes selection | A pure Rust ray query may differ in observable callbacks/state | P5.06/P7.11 replay fixture |
| R11 | Mono converter oracle available (E02); editor/compiler and Windows/Linux unavailable | Converter observations cannot establish editor/platform parity | P3.05–P3.12, P6.20 |
| R12 | Solari/backend/platform qualification still open | Platform goal depends on measured hardware support | Synthetic P10 spike independent of these references |
| R13 | Static index deliberately lacks full IXPL typing/control-flow | Lexical edge/registration counts can overstate live behavior | Preserve uncertainty; refine analysis and compare actual traces |
| R14 | Legacy DAT short-read reuse and unbounded string EOF loop (F28) | Corruption, hangs/allocation growth on malformed data | Strict bounded Rust DAT parser implemented (F29); extend fuzzing/editor validation in P6.19/P6.20 |
| R15 | DAT ASCII loss, BOM-less UTF-8 drift, property normalization and silent MAP/Q3/OBJ losses (F26/F27) | Successful conversions can alter meaningful content | Explicit encoding and loss reports, P6.01/P6.13 |
| R16 | Rust DAT policy deliberately rejects ambiguous/unknown data and avoids lossy table normalization (F29) | Some converter-accepted files need explicit diagnosis/migration | Preserve originals; validate native-editor/real documents, P6.19/P6.20 |
| R17 | Native TXT uses strict UTF-8/BOM output, retained table indices and computed-array consistency (F30) | Latin-1 inputs or permissive/lossy historical cases need explicit recoding/diagnosis | Broader real-file/legacy interoperability and fuzzing, P6.20 |
| R18 | CLI publication uses hard-link/rename in a trusted parent; directory metadata not separately synced (F31) | Filesystem support, hostile directory races and power-loss durability differ by environment | Filesystem/platform failure matrix, P6.12/P15 |