q-blog/docs/RISKS_ASSUMPTIONS.md

# Q-Blog — Risks, Assumptions & Mitigations

_Generated 2025-08-16 23:27Z_

|  ID | Area    | Risk/Assumption                                                         | Phase | Impact | Mitigation                                            |
| --: | ------- | ----------------------------------------------------------------------- | :---: | ------ | ----------------------------------------------------- |
|  R1 | Data    | Legacy content migration to default blogs may fail on malformed records |   6   | High   | Idempotent migrator, dry run, backup + rollback notes |
|  R2 | Editor  | Rich-text sanitization strips needed formatting                         |  10   | Medium | Allowlist tuned with tests; sample content goldens    |
|  R3 | A11y    | Keyboard traps in complex modals/popovers                               |  4–5  | Medium | Component audits; focus tests; Esc/restore policies   |
|  R4 | Collab  | Permission gaps lead to privilege escalation                            |   7   | High   | Server-side checks; matrix tests; deny-by-default     |
|  R5 | Perf    | Large lists regress INP/LCP                                             |   8   | Medium | Virtualization, prefetch, memoization; vitals budgets |
|  A1 | API     | We can evolve/extend server contracts                                   |   0   | —      | If not, draft shims and versioned adapters            |
|  A2 | Tooling | CI runners can execute headless browsers for axe/e2e                    |   2   | —      | If flaky, move some checks to nightly                 |