waggle-os/notes/risk-vocabulary-drift.md

One shared risk vocabulary; drifted enums silently inverted safety UX

Five backend modules each grew their own risk/approval/audit enums. Two real consequences: a critical-sorts-below-low RBAC bug (string sort on drifted tiers), and the headline D4(ii) defect — the server computed full trust metadata but the FE card type dropped it, so the riskiest approval showed the least information. Fix: canonical @waggle/shared/risk.ts (widest-set enums + riskRank), all consumers re-pointed, critical→critical behavior-preserving, and "Always allow" gated by approvalClass so a critical op can never be permanently granted in one click. Lesson: safety UX degrades through type drift, not through missing features — unify vocabulary before polishing surfaces.