Repair a residual-risk treatment register

Repair risk-register.json: controls is a list of selected IDs; register has one row per risk with risk, probabilityPercent, lossAmount, outageHours, approver and reviewDay. Use the 15-unit budget and retain both risks. Baseline ransomware: 20%, loss 100000, outage 12 hours, expected-loss limit 5000; normal approvers operations-director or risk-board. Baseline fraud: 10%, loss 60000, outage 1 hour, expected-loss limit 3000; normal approvers finance-director or risk-board. Both outage limits are 4 hours and cannot be waived. If computed expected loss exceeds its limit, only risk-board may accept it and review is due by day 14; otherwise review is due by day 30. Choose a future reviewDay. security-analyst has no acceptance authority. Controls and costs: immutable-backup (4) enables restore-drill but has no standalone reduction here. restore-drill (4) requires immutable-backup; ransomware loss factor 0.5 and outage factor 0.16666666666666666 (one sixth). privileged-access (5): ransomware probability factor 0.25, fraud probability factor 0.5. dual-approval (4): fraud probability factor 0.25. insurance (3): both financial loss factors 0.2, with probability and outage unchanged. isolated-service (12): ransomware probability factor 0.25, loss factor 0.4, outage factor 0.25; fraud unchanged. Unmentioned factors are 1. Multiply operative control factors within each dimension; missing prerequisites make a control inoperative. Count every selected control's cost once. Expected loss = probabilityPercent * lossAmount / 100. Round entered residuals to two decimals; authority uses expected loss before rounding. Use any funded portfolio meeting the service limits, including an authorized financial exception. These factors and delegations are read-only practice assumptions, not universal control efficacy.