_regulate wraps the optional duties (grantDistrictBoost, pause, startWar, startCollapse, listLot) in try/catch so one busy module cannot block the rest, but Enhancement.announceCap is called bare. announceCap reads registry.launchTime(), which reverts NotConfigured while the market hook's initializedAt() is 0 (the Desk is bound after job A, before the token/hook launch M3) or if the bound registry's market has no initializedAt().

The same holds for the unconditional registry.module(12)/module(11)/module(4) resolutions in _regulate and module(7)/module(12) in _event, which revert NotConfigured until job B registers roles 6-13. Because _accept already set acceptedSlotPlusOne[1] = s+1 and consumed the UUID, no second answer for that week slot is accepted and execute keeps reverting until validUntil passes; the eight Params updates, the feature notice and the letter of that week are lost.

Nothing is stolen; this is a liveness gap in the one-answer-per-slot design.

Suggested minimal fix: wrap announceCap (and the module resolutions it depends on) in the same try/catch pattern, or resolve module(11)/module(12)/module(4) through registeredModule and skip when zero, so one unavailable duty cannot strand the whole vector.

The documented M-2 race (docs/m2-trust-assumption.md section 2, item 3) says a twin needs its own Params and GameRegistry launched through the ProjectFactory, i.e. at least a three-contract launch. The code only requires that r.params() equal the factory's CREATE2 result of the pinned Params code with (Desk, 200, 1e18) at some coordinates; it does not require those coordinates to be in the same launch as the registry.

The honest Params from job A satisfies that proof for any registry, so a twin is a single pinned GameRegistry whose constructor names the honest Params, the public roots/snapshot/endowment and any token and market the attacker likes. The outcome is the documented griefing (honest game orphaned, no funds movable by the attacker), but the attacker's cost and admission surface are one contract, not three to eight, which changes the likelihood input of the documented severity.

No funds are at risk through the Desk; this is reported so the trust document and the keeper's bind-right-after-job-A mitigation are sized against the real cost. A code fix would require requiring paramsLaunch == registryLaunch (one job deploys both), which changes the pinned Desk creation code and is the requester's decision.

submit() accepts any attestation the attester signed for this Desk's domain, and the question hash excludes panelSize, quorum, validForSeconds and allowAmbiguous (tools/oracle_question_hash.mjs).

Anyone can therefore pay 0.5 IMD for the committed question naming the Desk as consumer, with panelSize 5 and quorum 4 (the Desk's and the committed bodies' minimum), and relay the result before the schedule's answer; the first accepted answer fixes the slot (acceptedSlotPlusOne) and later ones are ignored.

The relayer cannot alter the signed vector, so the exposure is the oracle platform's panel integrity at the smallest panel the Desk admits, which the oracle-consumer reference flags as cheap to fill with seats one holder controls. The Desk's levers are bounded (kind 0-7/9, severity 5000-7000, Params +-10%/day within hard bounds, pack pause <=72h, war/collapse/lot gated by Civic features), so the impact is bounded game steering, not funds.

This is the requester's chosen design (no owner, static minimums); it is recorded as the residual trust assumption, not a defect.