docs(refactor): BASE-07 track compatibility risks and third-party provenance

2026-10-10 12:46:15 -08:00 · 2026-09-10 21:07:56 +08:00
1 parent e01f39ffa0
commit ed293231dc
@@ -37,6 +37,9 @@
 | [任务数据](tasks.json) | 任务状态和依赖的唯一数据来源 |
 | [包基线](package-inventory.json) | 包版本、入口、声明、源码清单及对应 demo 的初始快照 |
 | [发布基线与重跑说明](baselines/README.md) | 固定 npm tarball、完整性及已知源码/发布差异 |
+| [差异与风险索引](risk-table.md) | 已复现问题、源码事实和待核实事项的责任任务 |
+| [风险维护说明](risk-guide.md) | 证据等级、关闭条件、第三方边界和校验命令 |
+| [第三方来源清单](third-party.json) | 依赖解析、vendor 文件指纹、SDK/CDN 与许可来源缺口 |

 ## 维护规则

@@ -0,0 +1,19 @@
+# BASE-07：差异与第三方风险台账
+
+日期 2026-09-10；分支 codex/compatible-modernization；起点 e01f39ff。
+
+## 交付
+
+将 15 项已有基线发现与发布来源、站点/素材、vendor 和 SDK 缺口统一为 39 项风险，全部保留 open。逐项记录证据等级、后续任务、兼容处理路线与关闭条件，区分发布包问题和工作区已存在的修复，未把源码观察扩写成完整浏览器复现。
+
+第三方清单覆盖 22 包、9 个直接运行依赖的锁定版本和已安装许可证元数据、8 组内嵌资源的 123 个文件指纹以及 12 个集成边界。上游许可入口与本地来源不确定性分别记录；没有调用外部 SDK、广告、模型或 ASR 服务，没有宣称完成传递依赖/许可证审计。
+
+新增风险/来源校验器、生成索引及两项带负例的 Node 测试，自动并入现有 test:baseline。相关包、核心、站点与发布准入任务已补充接续验收条件。详见 [维护说明](../risk-guide.md)、[风险索引](../risk-table.md)、[机器台账](../risks.json) 与 [第三方清单](../third-party.json)。
+
+## 验证与接续
+
+风险校验和两项专门测试通过；完整 ci:check 通过工具链/计划/链接/只读 lint、21 项既有 Node 测试与 17 项基线测试，共 38 项，无失败或跳过。负例覆盖遗漏基线发现、无任务责任、无证据关闭、越界证据、遗漏包/vendor/SDK、指纹变化与错误锁定版本。没有修改生产源码、声明、依赖或构建产物。
+
+本任务独立本地提交，主题含 BASE-07；不推送/发布。撤销本提交可移除新增台账和校验，原有基线报告不受影响。下一项 BASE-08 完成环境与能力验证矩阵，随后进入必要 TS 工程配置和 chapter 试点；未完成的真机/SDK 验证明确留给对应任务，不阻塞无关源码工作的启动。
+
+用户要求明确报告源码重构进度：截至本任务，生产源码 TS 迁移为零；基础设施和文档任务完成数不能代表源码迁移比例。后续进度必须分别说明。
@@ -4,7 +4,7 @@

 基线：`40fcda6a37d0049d42e49c1e64e70d4fd9ba5f7f`。总任务 214 项，范围 22 个包及工作区/示例。

-状态：todo 191 / doing 0 / blocked 0 / done 23 / deferred 0。风险 L/M/H 表示兼容风险，不表示工期。
+状态：todo 190 / doing 0 / blocked 0 / done 24 / deferred 0。风险 L/M/H 表示兼容风险，不表示工期。

 前置依赖是启动条件；验收是完成条件。任务可以继续拆分，但不能复用或悄悄删除旧 ID。

@@ -66,7 +66,7 @@
 | BASE-04 | workspace<br>捕获 DOM、CSS 和官方 demo | BASE-02 | 核心模板/类名/变量、键盘/焦点/可访问名称基线及全 demo 路径映射；docs-browser-testing.md 中 HTML/编辑器的脚本来源与存储状态；登记契约/版本/固定测试 ID/命令/报告与负责任务 | 核心/试点用户样式和输入用法已记录，其他 demo 运行状态与未知项明确；使用已发布包和最小可重跑探针启动，不等待后续 ENG 服务 | M | done |
 | BASE-05 | workspace<br>捕获包入口、资源和类型消费 | BASE-01 | 全包 manifest/资源路径清单；核心/试点的 UMD/AMD/ESM/CJS/legacy/i18n 和类型消费者基线；登记契约/版本/固定测试 ID/命令/报告与负责任务；区分库/npm 与站点实际分发类别，SSR import/模板/非浏览器构造错误分别捕获 | 核心/试点隔离消费可运行，其他包由各自契约任务验证，thumbnail tool 差异已登记 | H | done |
 | BASE-06 | workspace<br>记录性能与资源基线 | BASE-03, BASE-04 | 固定媒体/设备测量、包体积、反复装卸资源报告 | 多次采样可重跑，指标和审查阈值确定，不承诺未经测量的收益；使用已发布包和最小可重跑探针启动，不等待后续 ENG 服务 | M | done |
-| BASE-07 | workspace<br>建立差异和风险台账 | BASE-03, BASE-05 | 销毁/切源/类型差异、vendored 许可和外部 SDK 清单 | 已确认与待复现分开，每项有负责任务及兼容处理路线；纳入 BASE-TYPE-01/02/03/04 和 BASE-DIST-01 的发布/声明/工作区证据；纳入 BASE-PERF-01 销毁后 resize/notice 延迟工作 | H | todo |
+| BASE-07 | workspace<br>建立差异和风险台账 | BASE-03, BASE-05 | 销毁/切源/类型差异、vendored 许可和外部 SDK 清单 | 已确认与待复现分开，每项有负责任务及兼容处理路线；纳入 BASE-TYPE-01/02/03/04 和 BASE-DIST-01 的发布/声明/工作区证据；纳入 BASE-PERF-01 销毁后 resize/notice 延迟工作 | H | done |
 | BASE-08 | workspace<br>建立消费者与真实环境验证矩阵 | BASE-01, BASE-05 | 每包版本/浏览器/codec/SDK/设备/样本、证据和负责验证任务的矩阵 | 格式兼容与运行能力分开，未知/缺环境不算通过，明确哪些检查阻止哪些批次发布 | H | todo |

 ## 2 工程保障
@@ -83,7 +83,7 @@
 | ENG-07 | workspace<br>建立 tarball 消费与产物检查 | ENG-04, ENG-06 | 隔离 npm 消费 fixtures、API/声明/入口差分 | 不借 workspace 源码通过，能识别缺文件与默认导出变化 | H | todo |
 | ENG-08 | workspace<br>增加覆盖率、资源与性能报告 | ENG-03, ENG-05, BASE-06 | 覆盖率基线、资源清理断言、性能报告与阈值 | 关键生命周期分支有门槛，报告不靠无意义断言堆数量；将 BASE-06 的同环境多组配对、计时/压缩审查阈值与资源异常分开接入候选，不把历史现象冻结成正常要求 | M | todo |
 | ENG-09 | workspace<br>建立全包依赖影响和文档检查 | ENG-07, DOC-04 | 共享核心/构建影响映射、文档及每任务完成提交的 Git 审计接入；契约-支持版本-测试 ID-命令-候选/报告-任务的覆盖索引 | 核心变化触发必需生态检查；原有 DOC-01 至 04 基线例外明确，后续 done 任务不能缺失独立 commit；计划/已执行/缺证据分开，识别缺少验证归属的公开契约 | M | todo |
-| ENG-10 | workspace<br>建立历史失败分级和测试可靠性规则 | ENG-03, ENG-04, ENG-05, ENG-07, BASE-07 | 历史失败 ID/环境/旧版复现/负责修复任务、逐模块门槛、受控等待与 trace/retry 规则 | 不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见 | M | todo |
+| ENG-10 | workspace<br>建立历史失败分级和测试可靠性规则 | ENG-03, ENG-04, ENG-05, ENG-07, BASE-07 | 历史失败 ID/环境/旧版复现/负责修复任务、逐模块门槛、受控等待与 trace/retry 规则 | 不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见；以 risks.json 为统一差异索引；关闭必须有 resolutionEvidence/rationale，已复现、源码事实、未验证分开，登记不等于豁免 | M | todo |

 ## 2.2 GitHub CI/CD

@@ -115,7 +115,7 @@
 | CORE-09 | artplayer<br>整理 URL 与切源操作 | CORE-04, CORE-06, CORE-08 | url/switch/customType 的操作身份及取消方案 | 并发切源、错误、同 URL、销毁和 Promise 结算有契约；处理 baselines/lifecycle-coverage.md 的 BASE-LIFE-01/02/06 并增加候选正向回归 | H | todo |
 | CORE-10 | artplayer<br>迁移播放与时间/状态属性 | CORE-09 | play/pause/toggle/seek/volume/rate/duration 等模块 | 旧返回值、拒绝、mutex、位置恢复、属性描述符与事件通过 | H | todo |
 | CORE-11 | artplayer<br>整理媒体事件、ready 与重连 | CORE-10 | 媒体转发、重连、UI 响应职责分离 | readiness 次数/顺序、过期重连、原错误参数有回归 | H | todo |
-| CORE-12 | artplayer<br>迁移模板及公开资源入口 | CORE-06, CORE-04, BASE-04 | template/icons/i18n/style、SSR 与 proxy 挂载 | DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误 | H | todo |
+| CORE-12 | artplayer<br>迁移模板及公开资源入口 | CORE-06, CORE-04, BASE-04 | template/icons/i18n/style、SSR 与 proxy 挂载 | DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误；接续 VENDOR-01/02，核对 screenfull/hint 复制版本、修改与分发通知，保留 DOM/CSS/fullscreen 行为 | H | todo |
 | CORE-13 | artplayer<br>迁移组件注册与控件 | CORE-12, CORE-08 | Component/control/layer/contextmenu 的资源与 TS 边界 | add/update/remove、name、selector、mounted/beforeUnmount 通过；处理 BASE-DOM-02 窄容器控件裁切，保留 controls.update 的旧 undefined 返回值 | H | todo |
 | CORE-14 | artplayer<br>拆分设置树、渲染和布局 | CORE-13 | setting model/selection/render/layout 的分批实现 | 不强行统一控件返回值，嵌套选择、默认高亮、更新清理通过；结合 BASE-DOM-02 验证窄容器设置定位 | H | todo |
 | CORE-15 | artplayer<br>迁移字幕获取、解析和渲染 | CORE-11, CORE-13 | subtitle 请求/track/DOM/URL 生命周期与类型 | 过期结果、偏移、cue 数组、原生全屏及错误路径通过 | H | todo |
@@ -209,7 +209,7 @@

 | ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- |
-| PKG-MULTI-SUB-01 | artplayer-plugin-multiple-subtitles<br>核对包契约与历史用法 | BASE-05 | subtitles/onParser、multipleSubtitles 名称及实际返回方法 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结 | H | todo |
+| PKG-MULTI-SUB-01 | artplayer-plugin-multiple-subtitles<br>核对包契约与历史用法 | BASE-05 | subtitles/onParser、multipleSubtitles 名称及实际返回方法 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-03，定位 WebVTT parser 来源/修订及 CC0 头，保留解析/序列化行为 | H | todo |
 | PKG-MULTI-SUB-02 | artplayer-plugin-multiple-subtitles<br>建立特有行为与错误测试 | PKG-MULTI-SUB-01, ENG-03, ENG-05 | VTT/SRT/ASS、编码/重叠 cue/排序/空轨/失败与切换 | 旧版本行为可重跑，成功/失败/切源/销毁有必要断言 | H | todo |
 | PKG-MULTI-SUB-03 | artplayer-plugin-multiple-subtitles<br>整理内部职责与资源 | PKG-MULTI-SUB-02, CORE-15 | 解析与合并/获取/渲染分离，过期请求及对象 URL 清理 | 结构变化和缺陷修复分开记录；原 API/事件/资源生命周期通过 | H | todo |
 | PKG-MULTI-SUB-04 | artplayer-plugin-multiple-subtitles<br>迁移自有源码和公开类型 | PKG-MULTI-SUB-03, ENG-04, ENG-06, CORE-07 | 准确 parser/cue/tree/result 类型与真实异步形状 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | todo |
@@ -220,7 +220,7 @@

 | ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- |
-| PKG-JASSUB-01 | artplayer-plugin-jassub<br>核对包契约与历史用法 | BASE-05 | 选项透传、result.instance、vendor 来源、worker/WASM/font 路径 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结 | H | todo |
+| PKG-JASSUB-01 | artplayer-plugin-jassub<br>核对包契约与历史用法 | BASE-05 | 选项透传、result.instance、vendor 来源、worker/WASM/font 路径 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-04/05，核对 wrapper/worker/WASM/font 的独立来源与通知，保持资源路径和选项透传 | H | todo |
 | PKG-JASSUB-02 | artplayer-plugin-jassub<br>建立特有行为与错误测试 | PKG-JASSUB-01, ENG-03, ENG-05 | ASS 字体、时钟/seek/倍率/resize、加载失败和销毁 | 旧版本行为可重跑，成功/失败/切源/销毁有必要断言 | H | todo |
 | PKG-JASSUB-03 | artplayer-plugin-jassub<br>整理内部职责与资源 | PKG-JASSUB-02, CORE-15, CORE-16 | 仅整理自有 adapter/销毁；保留第三方文件及来源 | 结构变化和缺陷修复分开记录；原 API/事件/资源生命周期通过 | H | todo |
 | PKG-JASSUB-04 | artplayer-plugin-jassub<br>迁移自有源码和公开类型 | PKG-JASSUB-03, ENG-04, ENG-06, CORE-07 | JASSUB option/instance 的兼容类型包装，vendor JS 例外记录 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | todo |
@@ -231,7 +231,7 @@

 | ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- |
-| PKG-MASK-01 | artplayer-plugin-danmuku-mask<br>核对包契约与历史用法 | BASE-05 | 模型参数、start/stop、默认下载路径及 mask 样式 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结 | H | todo |
+| PKG-MASK-01 | artplayer-plugin-danmuku-mask<br>核对包契约与历史用法 | BASE-05 | 模型参数、start/stop、默认下载路径及 mask 样式 | 源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 SDK-08，分别核实 Yarn 解析版本、未固定版本的模型 solutionPath 和资源来源 | H | todo |
 | PKG-MASK-02 | artplayer-plugin-danmuku-mask<br>建立特有行为与错误测试 | PKG-MASK-01, ENG-03, ENG-05 | 加载期间停止/销毁、重复启动、推理失败、WebGL/CPU 边界 | 旧版本行为可重跑，成功/失败/切源/销毁有必要断言 | H | todo |
 | PKG-MASK-03 | artplayer-plugin-danmuku-mask<br>整理内部职责与资源 | PKG-MASK-02, CORE-18, PKG-DANMUKU-07 | 模型加载/推理/画布输出分离，阻止重叠推理与过期写入 | 结构变化和缺陷修复分开记录；原 API/事件/资源生命周期通过 | H | todo |
 | PKG-MASK-04 | artplayer-plugin-danmuku-mask<br>迁移自有源码和公开类型 | PKG-MASK-03, ENG-04, ENG-06, CORE-07 | 模型 adapter、canvas 和选项的精确类型 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | todo |
@@ -322,7 +322,7 @@

 | ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- |
-| PKG-MB-01 | artplayer-proxy-mediabunny<br>核对 shim 与媒体契约 | BASE-05 | 全部 option、art.mediabunny、canvas/shim 属性及事件表 | 公开暴露成员和实际发布依赖/资源范围明确 | H | todo |
+| PKG-MB-01 | artplayer-proxy-mediabunny<br>核对 shim 与媒体契约 | BASE-05 | 全部 option、art.mediabunny、canvas/shim 属性及事件表 | 公开暴露成员和实际发布依赖/资源范围明确；核实 third-party.json 所记录依赖 MPL-2.0 元数据与实际 bundle 的许可/通知范围，不从根 MIT 推断 | H | todo |
 | PKG-MB-02 | artplayer-proxy-mediabunny<br>建立真实媒体与事件基线 | PKG-MB-01, ENG-05, ENG-08 | MP4/WebM/HLS/Blob/Stream、seek/错误/轨道切换样本 | ready 事件顺序、音画同步、超时和释放可重跑 | H | todo |
 | PKG-MB-03 | artplayer-proxy-mediabunny<br>整理 input 与加载取消 | PKG-MB-02, CORE-09 | input.js 源检测、输入资源、Range 与取消 | HLS 检测在 input 边界，旧来源类型和超时保持 | H | todo |
 | PKG-MB-04 | artplayer-proxy-mediabunny<br>整理 VideoShim/EventTarget/Engine 协调 | PKG-MB-03, CORE-06, CORE-11 | shim 描述符、事件桥、加载状态和操作隔离 | 公开属性/同步异步返回与事件重入顺序保持 | H | todo |
@@ -359,7 +359,7 @@

 | ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- |
-| SITE-01 | artplayer-vitepress<br>清点文档/示例/生成链 | BASE-04, BASE-05 | 中英文文档、插件页面、demo URL、编辑器声明与生成目录清单；六类 HTML 入口、prod/libs/code/example 加载行为及移动重定向 | 所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图 | M | todo |
+| SITE-01 | artplayer-vitepress<br>清点文档/示例/生成链 | BASE-04, BASE-05 | 中英文文档、插件页面、demo URL、编辑器声明与生成目录清单；六类 HTML 入口、prod/libs/code/example 加载行为及移动重定向 | 所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图；接续 VENDOR-05/06/07/08 和 BASE-SITE-01/BASE-MEDIA-01，核对字体、Monaco、vConsole、console bundle 与样本来源及分发范围 | M | todo |
 | SITE-02 | artplayer-vitepress<br>整理声明与示例生成器 | SITE-01, ENG-04, ENG-06 | build-ts/build-test 生成链的可验证 TS 脚本 | 不靠字符串拼接掩盖声明错误，生成示例有真实断言或仅标 smoke；替换固定 100ms 成功判定，明确异步错误、清理和生成覆盖限制 | M | todo |
 | SITE-03 | artplayer-vitepress<br>整理 i18n/文档/LLM 生成流程 | SITE-02 | build-i18n/build-docs/build-llm/trans-docs 的任务边界和错误处理 | 原命令兼容、生成可复现，翻译步骤不隐式运行远程服务 | M | todo |
 | SITE-04 | artplayer-vitepress<br>交叉核对逐包持续维护的文档 | CORE-21, SITE-03, PKG-CHAPTER-04, PKG-AMBILIGHT-04, PKG-AUDIO-04, PKG-AUTO-THUMB-04, PKG-VTT-THUMB-04, PKG-HLS-04, PKG-DASH-04, PKG-MULTI-SUB-04, PKG-JASSUB-04, PKG-MASK-04, PKG-ASR-04, PKG-ADS-04, PKG-VAST-04, PKG-CAST-04, PKG-DPIP-04, PKG-CANVAS-04, PKG-IFRAME-04, PKG-TOOL-THUMB-04, PKG-DANMUKU-06, PKG-MB-08 | 已随实现更新的中文/英文 API、包内实现地图、旧 JS 示例及已知能力限制的全包核对 | 未把缺环境的能力写成已验证，静态核对不等待设备任务；最终 demo 仍由 EX-03 验收 | M | todo |
@@ -383,7 +383,7 @@

 | ID | 范围 / 步骤 | 前置依赖 | 交付物 | 验收条件 | 风险 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- |
-| REL-08 | workspace<br>提前建立逐包发布准入台账 | BASE-08, ENG-07 | 每批包/版本/源码/锁文件/工具/tarball integrity、必需测试/设备证据、限制和回退映射 | 受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围 | H | todo |
+| REL-08 | workspace<br>提前建立逐包发布准入台账 | BASE-08, ENG-07 | 每批包/版本/源码/锁文件/工具/tarball integrity、必需测试/设备证据、限制和回退映射 | 受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围；关联 risks.json 和 third-party.json；受影响 bundle/worker/WASM/font/模型的来源与许可通知缺口必须有审查结论，未决项阻止对应批次 | H | todo |
 | REL-01 | workspace<br>提前确定分包版本与差异方案 | REL-08, CORE-21, SITE-03, PKG-CHAPTER-04, PKG-AMBILIGHT-04, PKG-AUDIO-04, PKG-AUTO-THUMB-04, PKG-VTT-THUMB-04, PKG-HLS-04, PKG-DASH-04, PKG-MULTI-SUB-04, PKG-JASSUB-04, PKG-MASK-04, PKG-ASR-04, PKG-ADS-04, PKG-VAST-04, PKG-CAST-04, PKG-DPIP-04, PKG-CANVAS-04, PKG-IFRAME-04, PKG-TOOL-THUMB-04, PKG-DANMUKU-06, PKG-MB-08 | 每包版本/变更日志/依赖/类型差异方案和独立准入状态；按 version-policy.md 冻结各包下一 major（minor/patch 归零）并核实 registry 占用 | 所有包有方案和剩余门槛，未决项明确阻止相应发布；本步骤不声称已经可发布；全部包有 major 目标，版本冲突明确处理，独立准备任务同步 manifest/锁/依赖/日志；按 BASE-05 区分 21 库与文档站分发，不机械把文档站当库上传 npm | H | todo |
 | REL-09 | workspace<br>落实全包下一 major 版本及依赖元数据 | REL-01, DOC-11 | 22 包版本目标落实、适用锁文件/依赖范围/示例/变更日志同步，核实 registry 版本占用 | 版本与 policy 一致，旧核心支持保留；必要拆子任务各自提交，候选构建前完成，不执行 publish | H | todo |
 | REL-02 | workspace<br>生成候选 tarball 并验证新旧组合 | REL-01, CORE-22, ENG-07, REL-09 | 各候选本地 tarball/integrity 与新旧核心/插件消费者验证报告，外部门槛单独标注 | 隔离安装和可自动化组合通过；设备结论不伪造，最终发布绑定同一候选内容；在目标 major 版本确定后构建 pack，不在测试后改版本 | H | todo |
@@ -423,6 +423,7 @@
 - BASE-04: [记录](changes/2026-09-10-BASE-04-dom.md) [记录](baselines/dom.json) [记录](baselines/dom-coverage.md) [记录](baselines/demo-inventory.json)
 - BASE-05: [记录](changes/2026-09-10-BASE-05-consumers.md) [记录](baselines/consumer-coverage.md) [记录](baselines/consumers.json) [记录](baselines/ssr.json) [记录](baselines/distribution.json)
 - BASE-06: [记录](changes/2026-09-10-BASE-06-performance.md) [记录](baselines/performance-coverage.md) [记录](baselines/performance.json) [记录](baselines/sizes.json)
+- BASE-07: [记录](changes/2026-09-10-BASE-07-risk-register.md) [记录](risk-guide.md) [记录](risk-table.md) [记录](risks.json) [记录](third-party.json)
 - ENG-01: [记录](changes/2026-09-10-ENG-01-reproducible-toolchain.md) [记录](baselines/toolchain-validation.json)
 - ENG-PM-01: [记录](changes/2026-09-10-ENG-PM-01-yarn-toolchain.md) [记录](baselines/yarn-validation.json)
 - ENG-02: [记录](changes/2026-09-10-ENG-02-readonly-ci.md) [记录](baselines/ci-validation.json)
@@ -1,5 +1,11 @@
 # 进度与证据

+## 当前实施：BASE-07 风险与第三方来源台账完成
+
+39 项差异/来源缺口已关联责任任务、证据与关闭条件，22 包运行依赖、8 组内嵌资源（123 个文件）及 12 个集成边界可校验。全部风险仍 open，不能把清点完成视为已修复或获准发布。见 [BASE-07](changes/2026-09-10-BASE-07-risk-register.md)。
+
+当前 214 项任务，24 完成、190 待办。生产源码 TS 迁移仍为零；已完成工作主要是规划、工程流程与基线，后续继续单独报告源码迁移进度。BASE-06 已提交 e01f39ff；本轮独立提交 BASE-07。下一任务 BASE-08，随后进入必要 TS 工程配置和 chapter 试点；没有推送或发布。
+
 ## 当前实施：BASE-06 性能与资源基线完成

 内置浏览器两轮各 12 个计时样本和 6 组资源探针已保存；真实播放及基本清理通过，同时复现销毁后 resize 防抖重新安排 notice timer，已分配 CORE-17/04/18。28 个发布 JS 与 85 个工作区 JS 的压缩体积独立记录。阈值只用于复测/审查，无生产优化或无内存泄漏结论。见 [BASE-06](changes/2026-09-10-BASE-06-performance.md)。
@@ -0,0 +1,53 @@
+# 差异、第三方来源与关闭证据
+
+BASE-07 将先前基线发现和第三方来源缺口纳入同一份责任台账。入口为 [风险索引](risk-table.md)、[完整处理与关闭条件](risks.json) 和 [第三方清单](third-party.json)。任务完成代表清点和接续规则建立，不代表其中的问题已经修复。
+
+## 如何读取状态
+
+39 项目前均为 open。reproduced 表示已保存复现结果；source-observed 表示在源码、声明或产物中看到事实；unverified 表示来源、环境或行为仍需取证。证据等级与处理状态互相独立，不能把 39 项全部称为缺陷，也不能因建立了测试基线而自动接受旧缺陷。
+
+其中 15 项来自生命周期、DOM/示例、消费者类型/分发和性能基线；其余包含发布来源、站点分发、素材来源、8 组内嵌资源和 12 个集成边界。每项都列出负责的任务 ID、证据路径、兼容处理路线与关闭条件。具体复现仍以原基线报告为准。
+
+特别注意 BASE-LIFE-06：已发布包的恢复播放拒绝问题不等于当前源码仍然相同。当前 switchMix 使用 silencePromise，已有 playback 测试；迁移必须保留该修复，再对候选进行验证。BASE-TYPE-04 同时涉及 plugins.add 和 toggle，浏览器直接复现、当前源码及类型测试的覆盖不同，不声称每个子差异都独立做过浏览器复现。
+
+resolved 或 accepted-with-scope 必须提供 resolutionEvidence 和 resolutionRationale。校验器检查文件与字段存在；负责人仍须审查证据是否满足对应 closureCriteria。范围接受需要说明受影响能力、有效环境和发布限制，不能用于全局忽略测试、默认放宽兼容契约或掩盖缺少真机证据。ENG-10 接续历史失败分类，REL-08 将未关闭事项映射到受影响的发布批次。
+
+## 清单范围与来源
+
+第三方清单覆盖 22 包的 manifest 依赖，记录 9 个直接运行依赖在当前 yarn.lock 与本地安装中的版本、许可证元数据。文档包的开发依赖另列；根目录私有工具链由工程任务维护。这不是完整传递依赖 SBOM，也不是完整许可证或安全审计。
+
+当前 Mediabunny 解析为 1.56.1，其已安装 manifest 声明 MPL-2.0。TensorFlow 四个直接依赖解析为 4.22.0，不能把声明范围 ^4.21.0 写成实际安装版本。依赖元数据仅是来源证据，实际 bundle 所含代码、NOTICE、源码提供方式等仍由相应包任务核实。
+
+8 组内嵌资源保存 123 个文件指纹：screenfull、hint.less、WebVTT parser、JASSUB wrapper/worker/WASM、JASSUB 字体、Monaco 静态文件、vConsole 和 console bundle。文本按 LF 计算 SHA-256，二进制直接计算；这些指纹用于识别变化，不证明来源或重新分发许可。并未穷举仓库所有视频、图片、模型和字体，剩余样本来源由 BASE-MEDIA-01、SITE-01 和具体集成任务接续。
+
+已核对的上游入口如下，但当前上游分支不能证明本地复制文件的精确版本、修改历史或全部组成：
+
+| 内容 | 当前证据与后续核实 |
+| --- | --- |
+| screenfull | 上游 [MIT license](https://github.com/sindresorhus/screenfull/blob/main/license)；本地缺少版本/许可证头，需定位版本与本地差异 |
+| Hint.css | 本地头标 2.7.0，已改为 Less；上游 [MIT license](https://github.com/chinchang/hint.css/blob/master/LICENSE)，仍需核对修改与分发通知 |
+| WebVTT parser | 本地保留公共领域/CC0 头；[上游项目](https://github.com/w3c/webvtt.js) 标明 CC0，精确 revision 待定 |
+| JASSUB | [上游 wrapper 许可证](https://github.com/ThaUnknown/jassub/blob/main/LICENSE) 为 MIT；worker/WASM 的库组成、构建来源和字体必须分别核实 |
+| Monaco/vConsole | 本地头标 Monaco 0.30.1、vConsole 3.15.0 及 MIT；Monaco bundle 还包含 DOMPurify 通知，完整组成和 notices 待核对 |
+| console bundle | 可见 Parcel/console-feed 特征，原始构建、版本与组成待定位；不从根 MIT 推导结论 |
+
+12 个集成边界分别为 HLS、DASH、FLV、MPEG-TS、WebTorrent、Cast、IMA、MediaPipe/TensorFlow、JASSUB、Mediabunny、调用方 ASR 服务和 option-validator。清单区分运行依赖、调用方对象、CDN 动态脚本及 worker/model/font URL。Yarn 锁定不能锁住没有固定版本的远端 solutionPath。
+
+ASR 插件向调用方回调输出 PCM，插件本身没有内置 ASR SDK；示例才调用远端服务取得 WebSocket 地址。本次只检查代码，没有访问该服务或其他 SDK/广告/模型运行服务。源码中出现 URL 不等于 SDK、设备、网络或媒体能力已通过测试；BASE-08 接续能力与环境矩阵。
+
+## 迁移与维护方式
+
+1. 先读取对应风险的关闭条件与负责任务，再修改生产实现。历史缺陷可修复，但要明确候选行为、老用法兼容性和回归证据。
+2. 第三方复制代码保持独立边界；优先为调用层建立 TS 类型与适配器。不要把上游压缩代码机械拆分或转写成 TS。替换 vendor 时记录原/新版本、源地址、差异、通知文件和受影响测试。
+3. worker/WASM/font 路径、构造参数、返回实例、DOM/CSS 和媒体事件仍受兼容契约保护。文档静态资源更新也需验证现有编辑器、移动入口和示例。
+4. 有意修改包依赖、vendor 内容或集成范围时，同任务更新 third-party.json 及风险证据；重新计算指纹前先审查差异，不以重写指纹绕过检查。保留 Git 历史中的初始快照。
+5. 修改 risks.json 后运行以下命令生成索引并检查，完成任务时同时提交实现、测试、记录和任务表。
+
+```sh
+node refactor/scripts/risk-register.mjs --write
+node refactor/scripts/risk-register.mjs --check
+node refactor/scripts/plan.mjs --write
+yarn ci:check
+```
+
+校验已包含在 test:baseline 中：保护既有基线发现、任务引用、证据路径、生成索引、包覆盖、依赖解析和内嵌文件指纹。负例覆盖漏项、错误任务、无证据关闭、越界路径、错误哈希和锁文件版本偏移。它不能自动发现所有新的第三方文件或判定许可证合规，新增资源仍须进入人工/AI 审查与包任务验收。
@@ -0,0 +1,45 @@
+# 重构风险与差异索引
+
+由 risks.json 生成；运行 node refactor/scripts/risk-register.mjs --write 更新。状态 open 表示尚缺关闭证据，不等于每项都是已复现缺陷。处理方案、关闭条件与证据见 [机器台账](risks.json)，来源与范围见 [维护说明](risk-guide.md)。
+
+| ID | 状态 / 证据等级 | 条目 | 后续任务 |
+| --- | --- | --- | --- |
+| BASE-LIFE-06 | open / 已复现 | Published switch leaves an unhandled rejection and an unsettled promise when resume fails | CORE-09 |
+| BASE-LIFE-01 | open / 已复现 | Superseded switch resolves along with the latest source | CORE-09 |
+| BASE-LIFE-02 | open / 已复现 | Switch remains unsettled during the bounded observation after destroy | CORE-09 |
+| BASE-LIFE-03 | open / 已复现 | Async plugin registers its result after destroy | CORE-08 |
+| BASE-LIFE-04 | open / 已复现 | Destroying an instance twice unregisters a different live instance | CORE-04 |
+| BASE-LIFE-05 | open / 已复现 | Failed constructor leaves initialized markup/listeners until explicit probe cleanup | CORE-04 |
+| BASE-DOM-01 | open / 已复现 | 控件 Tab 不可达 | CORE-23, CORE-17 |
+| BASE-DOM-02 | open / 已复现 | 窄容器中控件裁切 | CORE-13, CORE-14 |
+| BASE-DEMO-01 | open / 源码/产物事实 | 旧 thumbnail 插件示例不对应当前 workspace 包 | SITE-01, EX-03 |
+| BASE-TYPE-01 | open / 已复现 | NodeNext ESM 默认导出与声明互操作失配 | ENG-04, CORE-07, PKG-CHAPTER-04 |
+| BASE-TYPE-02 | open / 已复现 | chapter 可选运行时参数被声明为必填 | PKG-CHAPTER-02 |
+| BASE-TYPE-03 | open / 已复现 | chapter legacy 缺旧模块解析的声明回退 | ENG-04, PKG-CHAPTER-04 |
+| BASE-TYPE-04 | open / 源码/产物事实 | plugins.add / toggle 的旧声明返回值与运行时不同 | CORE-07 |
+| BASE-DIST-01 | open / 源码/产物事实 | thumbnail tool 分发入口与类型文件缺失 | PKG-TOOL-THUMB-01, PKG-TOOL-THUMB-04 |
+| BASE-PERF-01 | open / 已复现 | 销毁后的 resize 防抖重新创建 notice timer | CORE-17, CORE-04, CORE-18 |
+| BASE-SOURCE-01 | open / 源码/产物事实 | 工作区 5.4.1 与采集时真实发布 5.4.0 不同 | BASE-08, REL-01 |
+| BASE-SOURCE-02 | open / 源码/产物事实 | registry gitHead 与发布包版本对应不可靠 | ENG-07, REL-01 |
+| BASE-SITE-01 | open / 源码/产物事实 | 文档站实际为静态站点但 manifest 未设 private | SITE-01, REL-01 |
+| BASE-MEDIA-01 | open / 待取证 | 示例媒体和字体的完整来源/授权链待核实 | BASE-08, SITE-01, EX-03 |
+| VENDOR-01 | open / 待取证 | screenfull 来源、版本与许可闭环 | CORE-12 |
+| VENDOR-02 | open / 待取证 | hint.css 来源、版本与许可闭环 | CORE-12 |
+| VENDOR-03 | open / 待取证 | webvtt-parser 来源、版本与许可闭环 | PKG-MULTI-SUB-01 |
+| VENDOR-04 | open / 待取证 | jassub-code-and-workers 来源、版本与许可闭环 | PKG-JASSUB-01 |
+| VENDOR-05 | open / 待取证 | jassub-font-assets 来源、版本与许可闭环 | PKG-JASSUB-01, SITE-01 |
+| VENDOR-06 | open / 待取证 | monaco-static-assets 来源、版本与许可闭环 | SITE-01, SITE-05 |
+| VENDOR-07 | open / 待取证 | vconsole 来源、版本与许可闭环 | SITE-01 |
+| VENDOR-08 | open / 待取证 | console-bundle 来源、版本与许可闭环 | SITE-01 |
+| SDK-01 | open / 待取证 | hls.js 实际集成验证范围 | PKG-HLS-01, EX-03 |
+| SDK-02 | open / 待取证 | dash.js 实际集成验证范围 | PKG-DASH-01, EX-03 |
+| SDK-03 | open / 待取证 | flv.js 实际集成验证范围 | EX-03 |
+| SDK-04 | open / 待取证 | mpegts.js 实际集成验证范围 | EX-03 |
+| SDK-05 | open / 待取证 | webtorrent 实际集成验证范围 | EX-03 |
+| SDK-06 | open / 待取证 | google-cast 实际集成验证范围 | PKG-CAST-01, PKG-CAST-05 |
+| SDK-07 | open / 待取证 | ima-via-glomex 实际集成验证范围 | PKG-VAST-01, PKG-VAST-05 |
+| SDK-08 | open / 待取证 | mediapipe-tensorflow 实际集成验证范围 | PKG-MASK-01, PKG-MASK-05 |
+| SDK-09 | open / 待取证 | jassub-worker-wasm-fonts 实际集成验证范围 | PKG-JASSUB-01, PKG-JASSUB-05 |
+| SDK-10 | open / 待取证 | mediabunny 实际集成验证范围 | PKG-MB-01, PKG-MB-09 |
+| SDK-11 | open / 待取证 | asr-caller-service 实际集成验证范围 | PKG-ASR-01, PKG-ASR-05, EX-03 |
+| SDK-12 | open / 待取证 | option-validator 实际集成验证范围 | CORE-01, CORE-07 |
@@ -0,0 +1,613 @@
+{
+  "schemaVersion": 1,
+  "task": "BASE-07",
+  "sourceCommit": "e01f39ff",
+  "updatedAt": "2026-09-10T12:58:34.267Z",
+  "note": "Open means closure evidence is outstanding; source-observed and unverified are not reproduced runtime bugs. A source issue already mitigated in the workspace still requires candidate regression evidence. No accepted-with-scope item is implied by baseline task completion.",
+  "items": [
+    {
+      "id": "BASE-LIFE-06",
+      "title": "Published switch leaves an unhandled rejection and an unsettled promise when resume fails",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-09"
+      ],
+      "evidence": [
+        "refactor/baselines/lifecycle.json",
+        "refactor/baselines/lifecycle-coverage.md",
+        "test/playback.test.js"
+      ],
+      "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+      "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。",
+      "workspaceState": "Current switchMix uses silencePromise and test/playback.test.js covers resume rejection. Published baseline still reproduces the old failure; preserve the existing workspace mitigation during migration."
+    },
+    {
+      "id": "BASE-LIFE-01",
+      "title": "Superseded switch resolves along with the latest source",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-09"
+      ],
+      "evidence": [
+        "refactor/baselines/lifecycle.json",
+        "refactor/baselines/lifecycle-coverage.md"
+      ],
+      "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+      "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+    },
+    {
+      "id": "BASE-LIFE-02",
+      "title": "Switch remains unsettled during the bounded observation after destroy",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-09"
+      ],
+      "evidence": [
+        "refactor/baselines/lifecycle.json",
+        "refactor/baselines/lifecycle-coverage.md"
+      ],
+      "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+      "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+    },
+    {
+      "id": "BASE-LIFE-03",
+      "title": "Async plugin registers its result after destroy",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-08"
+      ],
+      "evidence": [
+        "refactor/baselines/lifecycle.json",
+        "refactor/baselines/lifecycle-coverage.md"
+      ],
+      "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+      "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+    },
+    {
+      "id": "BASE-LIFE-04",
+      "title": "Destroying an instance twice unregisters a different live instance",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-04"
+      ],
+      "evidence": [
+        "refactor/baselines/lifecycle.json",
+        "refactor/baselines/lifecycle-coverage.md"
+      ],
+      "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+      "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+    },
+    {
+      "id": "BASE-LIFE-05",
+      "title": "Failed constructor leaves initialized markup/listeners until explicit probe cleanup",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-04"
+      ],
+      "evidence": [
+        "refactor/baselines/lifecycle.json",
+        "refactor/baselines/lifecycle-coverage.md"
+      ],
+      "compatibleResolution": "按对应 CORE 任务修复，保持合法旧调用；异步取消需明确结算策略，不把 pending 或重复销毁当正常兼容要求。",
+      "closureCriteria": "候选正向回归和旧新差异记录通过；有界观察问题不得仅靠延长等待隐藏。"
+    },
+    {
+      "id": "BASE-DOM-01",
+      "title": "控件 Tab 不可达",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-23",
+        "CORE-17"
+      ],
+      "evidence": [
+        "refactor/baselines/dom.json"
+      ],
+      "compatibleResolution": "补键盘可达性、焦点及名称，保留旧 DOM/CSS 和快捷键。",
+      "closureCriteria": "真实键盘与焦点回归通过，不只检查静态属性。"
+    },
+    {
+      "id": "BASE-DOM-02",
+      "title": "窄容器中控件裁切",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-13",
+        "CORE-14"
+      ],
+      "evidence": [
+        "refactor/baselines/dom.json"
+      ],
+      "compatibleResolution": "在保留自定义控件扩展入口下修正布局。",
+      "closureCriteria": "320px 及正常容器的设置/模式操作真实可用。"
+    },
+    {
+      "id": "BASE-DEMO-01",
+      "title": "旧 thumbnail 插件示例不对应当前 workspace 包",
+      "confirmation": "source-observed",
+      "status": "open",
+      "owners": [
+        "SITE-01",
+        "EX-03"
+      ],
+      "evidence": [
+        "docs/assets/example/thumbnail.js",
+        "refactor/baselines/demo-inventory.json"
+      ],
+      "compatibleResolution": "核实旧外部插件和链接，不自动替换为不同 API 的 auto-thumbnail。",
+      "closureCriteria": "示例依赖有来源，旧参数/URL 的保留或迁移解释完整。"
+    },
+    {
+      "id": "BASE-TYPE-01",
+      "title": "NodeNext ESM 默认导出与声明互操作失配",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "ENG-04",
+        "CORE-07",
+        "PKG-CHAPTER-04"
+      ],
+      "evidence": [
+        "refactor/baselines/consumers.json"
+      ],
+      "compatibleResolution": "分配 ESM/CJS 声明入口，保留旧解析模式，避免 any/skipLibCheck 掩盖。",
+      "closureCriteria": "四模式原合法消费通过，NodeNext ESM 对实际默认导出可构造/调用。"
+    },
+    {
+      "id": "BASE-TYPE-02",
+      "title": "chapter 可选运行时参数被声明为必填",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "PKG-CHAPTER-02"
+      ],
+      "evidence": [
+        "refactor/baselines/consumers.json",
+        "refactor/fixtures/api.js"
+      ],
+      "compatibleResolution": "补充兼容可选参数，不删除已接受的配置。",
+      "closureCriteria": "无参数和正确参数编译，错误参数依旧被拒绝，运行时一致。"
+    },
+    {
+      "id": "BASE-TYPE-03",
+      "title": "chapter legacy 缺旧模块解析的声明回退",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "ENG-04",
+        "PKG-CHAPTER-04"
+      ],
+      "evidence": [
+        "refactor/baselines/consumers.json"
+      ],
+      "compatibleResolution": "保留 legacy 文件和导入路径，补旧解析类型回退。",
+      "closureCriteria": "Node10 解析和 NodeNext/Bundler 消费均有正向证据。"
+    },
+    {
+      "id": "BASE-TYPE-04",
+      "title": "plugins.add / toggle 的旧声明返回值与运行时不同",
+      "confirmation": "source-observed",
+      "status": "open",
+      "owners": [
+        "CORE-07"
+      ],
+      "evidence": [
+        "refactor/baselines/consumers.json",
+        "refactor/baselines/public-api.json",
+        "refactor/baselines/lifecycle.json"
+      ],
+      "compatibleResolution": "保留旧声明接受范围并协调精确重载/扩展，不静默把同步注册改成 async。",
+      "closureCriteria": "返回值类型与运行时差异逐项说明，旧合法消费和拒绝传播回归通过。",
+      "scopeNote": "plugins.add synchronous result is browser-reproduced; toggle return comparison also relies on current source/playback tests. Do not claim every declaration mismatch was independently browser-reproduced."
+    },
+    {
+      "id": "BASE-DIST-01",
+      "title": "thumbnail tool 分发入口与类型文件缺失",
+      "confirmation": "source-observed",
+      "status": "open",
+      "owners": [
+        "PKG-TOOL-THUMB-01",
+        "PKG-TOOL-THUMB-04"
+      ],
+      "evidence": [
+        "refactor/baselines/distribution.json"
+      ],
+      "compatibleResolution": "核实真实旧 npm 后保留 .esm.js 等历史路径的兼容入口并补声明。",
+      "closureCriteria": "隔离打包消费者能加载所有原承诺路径，dist 不作为源码直接手改。"
+    },
+    {
+      "id": "BASE-PERF-01",
+      "title": "销毁后的 resize 防抖重新创建 notice timer",
+      "confirmation": "reproduced",
+      "status": "open",
+      "owners": [
+        "CORE-17",
+        "CORE-04",
+        "CORE-18"
+      ],
+      "evidence": [
+        "refactor/baselines/performance.json"
+      ],
+      "compatibleResolution": "为 debounce/晚到 UI 工作建立销毁归属；不靠等待自然过期掩盖。",
+      "closureCriteria": "正常 resize 保持，destroy 后无该回调及新 notice timer。"
+    },
+    {
+      "id": "BASE-SOURCE-01",
+      "title": "工作区 5.4.1 与采集时真实发布 5.4.0 不同",
+      "confirmation": "source-observed",
+      "status": "open",
+      "owners": [
+        "BASE-08",
+        "REL-01"
+      ],
+      "evidence": [
+        "refactor/baselines/releases.json"
+      ],
+      "compatibleResolution": "分别保留工作区与 npm 基线，目标大版本不变；更新发布窗口需新取证。",
+      "closureCriteria": "候选报告明确比较版本与 tarball，不声称工作区版本即已发布。"
+    },
+    {
+      "id": "BASE-SOURCE-02",
+      "title": "registry gitHead 与发布包版本对应不可靠",
+      "confirmation": "source-observed",
+      "status": "open",
+      "owners": [
+        "ENG-07",
+        "REL-01"
+      ],
+      "evidence": [
+        "refactor/baselines/releases.json"
+      ],
+      "compatibleResolution": "以 tarball 内容和可验证的构建来源为准，不能据 gitHead 自动声称复现。",
+      "closureCriteria": "候选 commit、工具链、包内容可关联，旧来源未知仍明确。"
+    },
+    {
+      "id": "BASE-SITE-01",
+      "title": "文档站实际为静态站点但 manifest 未设 private",
+      "confirmation": "source-observed",
+      "status": "open",
+      "owners": [
+        "SITE-01",
+        "REL-01"
+      ],
+      "evidence": [
+        "refactor/baselines/distribution.json"
+      ],
+      "compatibleResolution": "区分站点部署和库 npm 发布；自身 next-major 要求保留。",
+      "closureCriteria": "发布流程显式列出站点处理方式，不机械将其当库发布。"
+    },
+    {
+      "id": "BASE-MEDIA-01",
+      "title": "示例媒体和字体的完整来源/授权链待核实",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "BASE-08",
+        "SITE-01",
+        "EX-03"
+      ],
+      "evidence": [
+        "docs/assets/sample",
+        "docs/assets/jassub"
+      ],
+      "compatibleResolution": "复用现有样本时记录来源；缺许可的公开分发样本需补证据或可兼容替代，不能从文件名猜授权。",
+      "closureCriteria": "候选实际分发样本有来源、许可/使用依据和测试映射。"
+    },
+    {
+      "id": "VENDOR-01",
+      "title": "screenfull 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "CORE-12"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "packages/artplayer/src/libs/screenfull.js"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-02",
+      "title": "hint.css 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "CORE-12"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "packages/artplayer/src/style/hint.less"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-03",
+      "title": "webvtt-parser 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-MULTI-SUB-01"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "packages/artplayer-plugin-multiple-subtitles/src/parser.js"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-04",
+      "title": "jassub-code-and-workers 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-JASSUB-01"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "packages/artplayer-plugin-jassub/src/jassub.es.js",
+        "packages/artplayer-plugin-jassub/worker",
+        "docs/assets/jassub/jassub-worker.js",
+        "docs/assets/jassub/jassub-worker.wasm",
+        "docs/assets/jassub/jassub-worker-modern.wasm"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-05",
+      "title": "jassub-font-assets 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-JASSUB-01",
+        "SITE-01"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "docs/assets/jassub/default.woff2",
+        "docs/assets/jassub/fonts"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-06",
+      "title": "monaco-static-assets 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "SITE-01",
+        "SITE-05"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "docs/assets/js/vs"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-07",
+      "title": "vconsole 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "SITE-01"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "docs/assets/js/vconsole.min.js"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "VENDOR-08",
+      "title": "console-bundle 来源、版本与许可闭环",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "SITE-01"
+      ],
+      "evidence": [
+        "refactor/third-party.json",
+        "docs/assets/js/console.js"
+      ],
+      "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
+      "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。"
+    },
+    {
+      "id": "SDK-01",
+      "title": "hls.js 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-HLS-01",
+        "EX-03"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-hls-control/src/index.js",
+        "docs/assets/example/hls.control.js"
+      ],
+      "compatibleResolution": "Caller supplies art.hls; homepage demo loads hls.js 1.5.17. Preserve quality/audio selectors and old core integration.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-02",
+      "title": "dash.js 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-DASH-01",
+        "EX-03"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-dash-control/src/index.js",
+        "docs/assets/example/dash.control.js"
+      ],
+      "compatibleResolution": "Caller supplies art.dash; homepage demo loads dash.js 5.2.1. Preserve representation IDs, Auto/manual and audio topology.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-03",
+      "title": "flv.js 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "EX-03"
+      ],
+      "evidence": [
+        "docs/assets/example/flv.js"
+      ],
+      "compatibleResolution": "Demo dependency flv.js 1.6.2; customType playback/teardown must be tested with actual SDK.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-04",
+      "title": "mpegts.js 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "EX-03"
+      ],
+      "evidence": [
+        "docs/assets/example/mpegts.js"
+      ],
+      "compatibleResolution": "Demo dependency mpegts.js 1.7.3; actual codec/stream/browser support remains unverified.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-05",
+      "title": "webtorrent 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "EX-03"
+      ],
+      "evidence": [
+        "docs/assets/example/webtorrent.js"
+      ],
+      "compatibleResolution": "Demo URL uses webtorrent@1, a moving major selector; preserve caller integration and explicitly capture actual runtime version.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-06",
+      "title": "google-cast 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-CAST-01",
+        "PKG-CAST-05"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-chromecast/src/index.js"
+      ],
+      "compatibleResolution": "Default remote cast_sender.js?loadCastFramework=1; sdk URL/options and actual Cast device/session behavior require separate validation.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-07",
+      "title": "ima-via-glomex 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-VAST-01",
+        "PKG-VAST-05"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-vast/src/index.js"
+      ],
+      "compatibleResolution": "@glomex/vast-ima-player loadImaSdk loads external IMA; preserve event/content/ad state and teardown, do not equate mocks with vendor service acceptance.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-08",
+      "title": "mediapipe-tensorflow 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-MASK-01",
+        "PKG-MASK-05"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-danmuku-mask/src/index.js"
+      ],
+      "compatibleResolution": "Npm dependency versions are separate from unversioned solutionPath CDN assets; keep option override, backend fallback, model result disposal and masks.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-09",
+      "title": "jassub-worker-wasm-fonts 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-JASSUB-01",
+        "PKG-JASSUB-05"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-jassub/src/index.js",
+        "docs/assets/example/jassub.js"
+      ],
+      "compatibleResolution": "Preserve options pass-through, result.instance and worker/wasm/font URLs. Wrapper, worker and WASM must be a verified compatible set.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-10",
+      "title": "mediabunny 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-MB-01",
+        "PKG-MB-09"
+      ],
+      "evidence": [
+        "packages/artplayer-proxy-mediabunny/src/input.js",
+        "packages/artplayer-proxy-mediabunny/package.json"
+      ],
+      "compatibleResolution": "Preserve native-video-like events, HLS input and topology, codec capability failures and AV sync; actual library/codec environment still requires verification.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-11",
+      "title": "asr-caller-service 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "PKG-ASR-01",
+        "PKG-ASR-05",
+        "EX-03"
+      ],
+      "evidence": [
+        "packages/artplayer-plugin-asr/src/index.js",
+        "docs/assets/example/asr.js"
+      ],
+      "compatibleResolution": "Core plugin supplies PCM to caller onAudioChunk. Example fetches an external ASR endpoint and opens its returned WebSocket; not an embedded ASR SDK or a verified service.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    },
+    {
+      "id": "SDK-12",
+      "title": "option-validator 实际集成验证范围",
+      "confirmation": "unverified",
+      "status": "open",
+      "owners": [
+        "CORE-01",
+        "CORE-07"
+      ],
+      "evidence": [
+        "packages/artplayer/src/index.js"
+      ],
+      "compatibleResolution": "Bundled validation dependency; preserve validation/default/merge behavior and failure cleanup when typing constructor boundaries.",
+      "closureCriteria": "固定 SDK/外部资源版本和环境；成功/失败/切换/销毁有真实证据，设备和网络限制逐项记录。"
+    }
+  ]
+}
@@ -0,0 +1,94 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import lockfile from '@yarnpkg/lockfile'
+import { hash, refactorDir } from './releases.mjs'
+
+const root = path.resolve(refactorDir, '..')
+const read = name => JSON.parse(fs.readFileSync(path.join(refactorDir, name), 'utf8'))
+export function referencedFindings() {
+  const files = ['baselines/lifecycle-coverage.md', 'baselines/dom-coverage.md', 'baselines/consumer-coverage.md', 'baselines/performance-coverage.md']
+  return [...new Set(files.flatMap(name => fs.readFileSync(path.join(refactorDir, name), 'utf8').match(/BASE-(?:LIFE|DOM|DEMO|TYPE|DIST|PERF)-\d{2}/g) || []))].sort()
+}
+function evidenceExists(name) {
+  const absolute = path.resolve(root, name)
+  assert(absolute.startsWith(root + path.sep) && fs.existsSync(absolute), `Missing or invalid evidence: ${name}`)
+}
+export function validateRisks(register) {
+  const tasks = new Set(read('tasks.json').tasks.map(task => task.id))
+  const ids = new Set(register.items.map(item => item.id))
+  assert.equal(ids.size, register.items.length, 'Duplicate risk ID')
+  for (const id of referencedFindings()) assert(ids.has(id), `Unregistered baseline finding: ${id}`)
+  for (const item of register.items) {
+    assert(['reproduced', 'source-observed', 'unverified'].includes(item.confirmation))
+    assert(['open', 'resolved', 'accepted-with-scope'].includes(item.status))
+    assert(item.owners.length && item.owners.every(id => tasks.has(id)), `Unowned risk: ${item.id}`)
+    assert(item.evidence.length && item.compatibleResolution && item.closureCriteria, `Incomplete risk: ${item.id}`)
+    item.evidence.forEach(evidenceExists)
+    if (item.status !== 'open') {
+      assert(item.resolutionEvidence?.length && item.resolutionRationale, `Premature closure: ${item.id}`)
+      item.resolutionEvidence.forEach(evidenceExists)
+    }
+  }
+}
+export function assetFingerprints(inputs) {
+  const walk = name => {
+    const absolute = path.resolve(root, name)
+    evidenceExists(name)
+    return fs.statSync(absolute).isDirectory() ? fs.readdirSync(absolute).flatMap(child => walk(`${name}/${child}`)) : [name]
+  }
+  return inputs.flatMap(walk).sort().map(name => {
+    const bytes = fs.readFileSync(path.join(root, name))
+    const text = /\.(?:[cm]?[jt]s|css|less|json|html|svg|txt|md)$/.test(name)
+    return { path: name, algorithm: text ? 'sha256-lf' : 'sha256', sha256: hash(text ? bytes.toString('utf8').replaceAll('\r\n', '\n') : bytes) }
+  })
+}
+export function validateThirdParty(inventory, register) {
+  const tasks = new Set(read('tasks.json').tasks.map(task => task.id))
+  const risks = new Set(register.items.map(item => item.id))
+  const initial = read('package-inventory.json').packages.map(pkg => pkg.name).sort()
+  assert.deepEqual(inventory.packages.map(pkg => pkg.name).sort(), initial, 'External dependency package coverage missing')
+  const lock = lockfile.parse(fs.readFileSync(path.join(root, 'yarn.lock'), 'utf8')).object
+  for (const pkg of inventory.packages) {
+    const current = JSON.parse(fs.readFileSync(path.join(root, 'packages', pkg.name, 'package.json'), 'utf8'))
+    assert.deepEqual(pkg.declaredRuntimeDependencies, current.dependencies || {}, `Update dependency inventory: ${pkg.name}`)
+    assert.deepEqual(pkg.developmentDependencies, current.devDependencies || {}, `Update development dependency inventory: ${pkg.name}`)
+    assert.deepEqual(pkg.resolvedRuntimeDependencies.map(dependency => dependency.name).sort(), Object.keys(current.dependencies || {}).sort(), 'Missing resolved dependency')
+    for (const dependency of pkg.resolvedRuntimeDependencies) {
+      assert.equal(dependency.range, current.dependencies[dependency.name], 'Dependency range changed')
+      const installed = JSON.parse(fs.readFileSync(path.join(root, 'node_modules', dependency.name, 'package.json'), 'utf8'))
+      assert.equal(dependency.lockedVersion, lock[`${dependency.name}@${dependency.range}`]?.version, 'Dependency lock changed; update provenance')
+      assert.equal(dependency.installedVersion, installed.version, 'Installed dependency changed')
+      assert.equal(dependency.manifestLicense, installed.license || null, 'Dependency license metadata changed')
+    }
+  }
+  assert.deepEqual(inventory.vendored.map(vendor => vendor.riskId).sort(), [...risks].filter(id => id.startsWith('VENDOR-')).sort(), 'Missing vendored group')
+  assert.deepEqual(inventory.integrations.map(sdk => sdk.riskId).sort(), [...risks].filter(id => id.startsWith('SDK-')).sort(), 'Missing SDK integration')
+  for (const vendor of inventory.vendored) {
+    assert(risks.has(vendor.riskId) && vendor.owners.length && vendor.owners.every(id => tasks.has(id)))
+    assert(vendor.sourceStatus && vendor.licenseStatus && vendor.updatePolicy)
+    assert.deepEqual(assetFingerprints(vendor.inputs), vendor.fingerprints, `Vendored files changed without reviewed provenance: ${vendor.id}`)
+  }
+  for (const sdk of inventory.integrations) {
+    assert(risks.has(sdk.riskId) && sdk.owners.length && sdk.owners.every(id => tasks.has(id)))
+    assert(sdk.sourceFiles.length && sdk.validationStatus && sdk.contract)
+    sdk.sourceFiles.forEach(evidenceExists)
+  }
+}
+export function renderRisks(register) {
+  const labels = { reproduced: '已复现', 'source-observed': '源码/产物事实', unverified: '待取证' }
+  const escape = text => text.replaceAll('|', '\\|').replaceAll('\n', ' ')
+  return `# 重构风险与差异索引\n\n由 risks.json 生成；运行 node refactor/scripts/risk-register.mjs --write 更新。状态 open 表示尚缺关闭证据，不等于每项都是已复现缺陷。处理方案、关闭条件与证据见 [机器台账](risks.json)，来源与范围见 [维护说明](risk-guide.md)。\n\n| ID | 状态 / 证据等级 | 条目 | 后续任务 |\n| --- | --- | --- | --- |\n${register.items.map(item => `| ${item.id} | ${item.status} / ${labels[item.confirmation]} | ${escape(item.title)} | ${item.owners.join(', ')} |`).join('\n')}\n`
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  assert(process.argv.slice(2).every(arg => ['--check', '--write'].includes(arg)), 'Use --check or --write')
+  const register = read('risks.json')
+  const inventory = read('third-party.json')
+  validateRisks(register)
+  validateThirdParty(inventory, register)
+  const rendered = renderRisks(register)
+  if (process.argv.includes('--write')) fs.writeFileSync(path.join(refactorDir, 'risk-table.md'), rendered)
+  else assert.equal(fs.readFileSync(path.join(refactorDir, 'risk-table.md'), 'utf8').replaceAll('\r\n', '\n'), rendered, 'Regenerate risk-table.md')
+  console.log(`Risk register checked: ${register.items.length} items, ${inventory.vendored.length} vendored groups, ${inventory.integrations.length} integrations; no unresolved item is waived`)
+}
@@ -0,0 +1,39 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import test from 'node:test'
+import { renderRisks, validateRisks, validateThirdParty } from './risk-register.mjs'
+import { refactorDir } from './releases.mjs'
+
+const read = name => JSON.parse(fs.readFileSync(path.join(refactorDir, name), 'utf8'))
+test('Risk register rejects omitted findings, missing owners and unsupported closure', () => {
+  const register = read('risks.json')
+  validateRisks(register)
+  assert.equal(fs.readFileSync(path.join(refactorDir, 'risk-table.md'), 'utf8').replaceAll('\r\n', '\n'), renderRisks(register))
+  for (const mutate of [
+    value => value.items = value.items.filter(item => item.id !== 'BASE-LIFE-04'),
+    value => value.items[0].owners = ['NO-SUCH-TASK'],
+    value => value.items[0].status = 'resolved',
+    value => value.items[0].evidence = ['../outside-workspace'],
+  ]) {
+    const changed = structuredClone(register)
+    mutate(changed)
+    assert.throws(() => validateRisks(changed))
+  }
+})
+test('Third-party provenance cannot silently omit copied assets, SDKs or change fingerprints', () => {
+  const register = read('risks.json')
+  const inventory = read('third-party.json')
+  validateThirdParty(inventory, register)
+  for (const mutate of [
+    value => value.packages.pop(),
+    value => value.vendored.pop(),
+    value => value.integrations.pop(),
+    value => value.vendored[0].fingerprints[0].sha256 = 'incorrect',
+    value => value.packages.find(pkg => pkg.resolvedRuntimeDependencies.length).resolvedRuntimeDependencies[0].lockedVersion = '0.0.0',
+  ]) {
+    const changed = structuredClone(inventory)
+    mutate(changed)
+    assert.throws(() => validateThirdParty(changed, register))
+  }
+})
@@ -391,11 +391,17 @@
        "BASE-03",
        "BASE-05"
      ],
-      "status": "todo",
+      "status": "done",
      "risk": "H",
      "deliverable": "销毁/切源/类型差异、vendored 许可和外部 SDK 清单",
      "acceptance": "已确认与待复现分开，每项有负责任务及兼容处理路线；纳入 BASE-TYPE-01/02/03/04 和 BASE-DIST-01 的发布/声明/工作区证据；纳入 BASE-PERF-01 销毁后 resize/notice 延迟工作",
-      "evidence": []
+      "evidence": [
+        "changes/2026-09-10-BASE-07-risk-register.md",
+        "risk-guide.md",
+        "risk-table.md",
+        "risks.json",
+        "third-party.json"
+      ]
    },
    {
      "scope": [
@@ -611,7 +617,7 @@
        "BASE-07"
      ],
      "deliverable": "历史失败 ID/环境/旧版复现/负责修复任务、逐模块门槛、受控等待与 trace/retry 规则",
-      "acceptance": "不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见"
+      "acceptance": "不靠全局忽略或无理由 skip 隐藏问题，新增回归阻止交付，设备缺口和偶发失败单独可见；以 risks.json 为统一差异索引；关闭必须有 resolutionEvidence/rationale，已复现、源码事实、未验证分开，登记不等于豁免"
    },
    {
      "id": "CI-01",
@@ -910,7 +916,7 @@
      "status": "todo",
      "risk": "H",
      "deliverable": "template/icons/i18n/style、SSR 与 proxy 挂载",
-      "acceptance": "DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误",
+      "acceptance": "DOM/CSS/global/样式注入、i18n 子路径及 SSR import 保持；不把 SSR import/useSSR 保持扩大为服务端构造播放器；复跑 BASE-05 的 SSR import/模板、浏览器 useSSR 节点复用和非浏览器构造错误；接续 VENDOR-01/02，核对 screenfull/hint 复制版本、修改与分发通知，保留 DOM/CSS/fullscreen 行为",
      "evidence": []
    },
    {
@@ -1854,7 +1860,7 @@
      "status": "todo",
      "risk": "H",
      "deliverable": "subtitles/onParser、multipleSubtitles 名称及实际返回方法",
-      "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结",
+      "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-03，定位 WebVTT parser 来源/修订及 CC0 头，保留解析/序列化行为",
      "evidence": []
    },
    {
@@ -1958,7 +1964,7 @@
      "status": "todo",
      "risk": "H",
      "deliverable": "选项透传、result.instance、vendor 来源、worker/WASM/font 路径",
-      "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结",
+      "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 VENDOR-04/05，核对 wrapper/worker/WASM/font 的独立来源与通知，保持资源路径和选项透传",
      "evidence": []
    },
    {
@@ -2063,7 +2069,7 @@
      "status": "todo",
      "risk": "H",
      "deliverable": "模型参数、start/stop、默认下载路径及 mask 样式",
-      "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结",
+      "acceptance": "源码/声明/README/demo/发布包差异已登记；公开形状和版本范围冻结；接续 SDK-08，分别核实 Yarn 解析版本、未固定版本的模型 solutionPath 和资源来源",
      "evidence": []
    },
    {
@@ -2953,7 +2959,7 @@
      "status": "todo",
      "risk": "H",
      "deliverable": "全部 option、art.mediabunny、canvas/shim 属性及事件表",
-      "acceptance": "公开暴露成员和实际发布依赖/资源范围明确",
+      "acceptance": "公开暴露成员和实际发布依赖/资源范围明确；核实 third-party.json 所记录依赖 MPL-2.0 元数据与实际 bundle 的许可/通知范围，不从根 MIT 推断",
      "evidence": []
    },
    {
@@ -3334,7 +3340,7 @@
      "status": "todo",
      "risk": "M",
      "deliverable": "中英文文档、插件页面、demo URL、编辑器声明与生成目录清单；六类 HTML 入口、prod/libs/code/example 加载行为及移动重定向",
-      "acceptance": "所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图",
+      "acceptance": "所有公开 API/插件有对应页面或明确补充任务；核实 BASE-DEMO-01 的历史 thumbnail 插件来源及 29 示例/36 HTML 路径；明确 BASE-05 所记录站点实际分发与未设 private 的 manifest 意图；接续 VENDOR-05/06/07/08 和 BASE-SITE-01/BASE-MEDIA-01，核对字体、Monaco、vConsole、console bundle 与样本来源及分发范围",
      "evidence": []
    },
    {
@@ -3616,7 +3622,7 @@
        "ENG-07"
      ],
      "deliverable": "每批包/版本/源码/锁文件/工具/tarball integrity、必需测试/设备证据、限制和回退映射",
-      "acceptance": "受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围"
+      "acceptance": "受影响能力缺证据明确阻止对应批次；无关批次可独立准备，旧证据在候选内容变化后失效；站点采用真实构建/URL/资源验收，npm 分发依据历史核实，不从版本清单推断新增发布范围；关联 risks.json 和 third-party.json；受影响 bundle/worker/WASM/font/模型的来源与许可通知缺口必须有审查结论，未决项阻止对应批次"
    },
    {
      "id": "REL-01",