Director cleanup: strip industry stats/solution language, lower Critical on stale Tier 2, keep concrete evidence

docs/clients/overcome-fitness/threat-register-v1.md

@@ -1,130 +1,132 @@
 # Threat Register – Overcome Fitness
 
-**Status:** Draft (Benchmark)
-**Last Updated:** 2026-08-02
-**Reviewed by:**
+**Status:** Draft (Benchmark)  
+**Last Updated:** 2026-08-02  
+**Reviewed by:**  
 **Source Inventory:** `docs/clients/overcome-fitness/data-inventory-v1.md`
 
 ## Purpose
-Identify specific customer-acquisition and retention failures grounded only in data from the locked Data Inventory.
+Identify specific customer-acquisition and retention failures grounded only in data from the Data Inventory.  
 No speculation. No invented gaps. No solution language.
 
 ## Threat Entries
 
 ### Threat ID: T-001
-- **Title:** Website navigation failure sends users to dead pages
-- **Signal Source:** Website (overcomefitnesscp.com) — HTTP status check of /trainers, /plans, /power-cycle
-- **Evidence Snippet:** 3 of 5 primary navigation links return HTTP 404. Pages linked from main nav with no content behind them. User clicking "Trainers" or "Plans" from main menu hits a dead end.
+- **Title:** Website navigation links observed returning dead pages
+- **Signal Source:** Website (overcomefitnesscp.com)
+- **Evidence Snippet:** Prior audit observed primary navigation links (including /trainers, /plans, /power-cycle) returning HTTP 404.
 - **Data Recency:** 2025-08 — requires fresh re-snapshot
-- **Estimated Severity:** Critical
+- **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Direct browser test confirmed 404s. No owner-provided explanation for why pages are missing or if they were ever live. Industry data suggests ~60% bounce rate on users who click a broken nav link.
+- **Notes / Context:** Concrete technical observation from prior audit. Must be re-verified before any severity or tier upgrade.
 - **Human Decision:** Pending
 
 ### Threat ID: T-002
-- **Title:** No booking integration on Google Business Profile
-- **Signal Source:** GBP — no "Book" button; website — no booking system detected
-- **Evidence Snippet:** GBP shows no booking widget. Website "FITNESS PLANS" CTA returns 404. Contact form at footer is the only conversion path. 4 competitors within 10-mile radius all have booking links on GBP.
+- **Title:** No booking integration visible on public GMB or website surfaces
+- **Signal Source:** GMB public surface + website
+- **Evidence Snippet:** Prior audit observed no booking widget on GMB and no detected booking system on the website. Public conversion path appeared contact-form / phone oriented. Related website CTA path was also observed returning 404.
 - **Data Recency:** 2025-08 — requires fresh re-snapshot
-- **Estimated Severity:** Critical
+- **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Industry data suggests ~30-40% of local fitness mobile bookings flow through GBP booking buttons. Absence means lost conversions. Unknown if owner has a separate booking system or if integration is pending.
+- **Notes / Context:** Booking availability behind the scenes is unknown without owner confirmation.
 - **Human Decision:** Pending
 
 ### Threat ID: T-003
-- **Title:** TikTok personal account (39.6K followers) has zero business attribution
-- **Signal Source:** TikTok @byronslavin — fully public profile
-- **Evidence Snippet:** 39.6K followers, 221.1K total likes. Bio: "Trainer / Ultra Marathon Runner / Girl Dad." Link in bio (linktr.ee/overcometrainer) → personal trainer funnel, not Overcome Fitness. No branding in handle, bio, or visible content. No pixel, no UTM tracking.
+- **Title:** Large personal TikTok audience shows limited clear business attribution
+- **Signal Source:** TikTok @byronslavin (public profile)
+- **Evidence Snippet:** Prior audit observed substantial public following on a personal trainer-oriented profile. Public bio/handle/content surface showed limited or no clear Overcome Fitness business branding; link destination appeared personal-trainer oriented.
 - **Data Recency:** 2025-08 — requires fresh re-snapshot
-- **Estimated Severity:** Critical
+- **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Largest warm audience asset in the client's orbit. 100% of that audience flow leaks — no business attribution, no retargeting, no conversion path. Owner (Byron) created the content; the audience follows him personally, not the business.
+- **Notes / Context:** Potential warm audience exists, but public attribution to the business was weak at time of observation. Current metrics and relationship need confirmation.
 - **Human Decision:** Pending
 
 ### Threat ID: T-004
-- **Title:** Dual Instagram handles split brand authority
-- **Signal Source:** Instagram — two handles: @overcomefitnesscp (405 followers) and @overcometrainer (unknown)
-- **Evidence Snippet:** @overcomefitnesscp linked from website footer. @overcometrainer linked from TikTok bio. Both login-walled — content and engagement unknown. Dual handles split follower base, content library, hashtag equity, and algorithm trust.
-- **Data Recency:** 2025-08 (handles identified); 2026-07 (follower count for @overcomefitnesscp)
+- **Title:** Multiple related Instagram handles observed
+- **Signal Source:** Instagram public profiles
+- **Evidence Snippet:** Two related handles observed (@overcomefitnesscp and @overcometrainer), linked from different public surfaces. Deeper content/engagement metrics incomplete.
+- **Data Recency:** Mixed (handles 2025-08; partial follower observation 2026-07)
 - **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Owner-provided explanation unknown — may have been intentional (personal vs business) or legacy. Either way, divided authority means suboptimal reach on both.
+- **Notes / Context:** Dual handles can fragment authority; actual impact depends on content and audience split, which are not fully known.
 - **Human Decision:** Pending
 
 ### Threat ID: T-005
-- **Title:** Facebook NAP conflict — city mismatch between platforms
-- **Signal Source:** Facebook page OvercomeFitnessCP — page title shows "Shingle Springs CA"
-- **Evidence Snippet:** Facebook lists city as Shingle Springs. Google Maps and website list Cameron Park (same physical address, ~4 miles apart). Google's local algorithm treats conflicting NAP data as unreliable.
+- **Title:** Possible Facebook NAP / city label mismatch
+- **Signal Source:** Facebook page metadata + website/directories
+- **Evidence Snippet:** Prior observation of Facebook page city label as Shingle Springs while website/directories list Cameron Park.
 - **Data Recency:** 2025-08 — requires fresh re-snapshot
 - **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Facebook page is login-walled — full address, phone, and category cannot be verified without owner access. City conflict was observed in visible page title only.
+- **Notes / Context:** Conflicting location signals can affect local consistency. Must be re-verified on current page settings.
 - **Human Decision:** Pending
 
 ### Threat ID: T-006
-- **Title:** Yelp listing absent — invisible to high-intent local search
-- **Signal Source:** Yelp — organic search + direct URL both failed
-- **Evidence Snippet:** Search for "Overcome Fitness, Cameron Park" returned no organic listing. Direct biz URL blocked by CAPTCHA — consistent with unclaimed or unindexed listing. All 4 nearest competitors have claimed Yelp listings with 40–100+ reviews.
+- **Title:** Weak or absent Yelp presence under current brand name
+- **Signal Source:** Yelp public search
+- **Evidence Snippet:** Prior public search did not establish a strong claimed listing under Overcome Fitness.
 - **Data Recency:** 2025-08
 - **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Yelp is a top-3 discovery channel for local fitness. Absence means zero review management capability and zero visibility to Yelp's local search traffic.
+- **Notes / Context:** Fresh confirmation required.
 - **Human Decision:** Pending
 
 ### Threat ID: T-007
-- **Title:** No lead capture mechanism beyond bottom-of-funnel contact form
-- **Signal Source:** Website — no email capture, no lead magnet, no trial offer
-- **Evidence Snippet:** Contact form at footer is the only conversion path. No "Book Now" above fold. No newsletter signup. No free trial or assessment offer. "Nurtion Plans" typo in form checkbox indicates lack of maintenance.
+- **Title:** Limited lead-capture surface beyond bottom-of-funnel contact form
+- **Signal Source:** Website
+- **Evidence Snippet:** Prior audit observed contact form as the primary visible conversion path, with limited above-the-fold booking/trial capture mechanisms.
 - **Data Recency:** 2025-08 — requires fresh re-snapshot
 - **Estimated Severity:** Major
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Top-of-funnel and mid-funnel nurture absent. Visitors not ready to contact immediately have no reason to leave their email. Competitors offer "Free Consultation" or trial CTAs.
+- **Notes / Context:** Structural observation only.
 - **Human Decision:** Pending
 
 ### Threat ID: T-008
-- **Title:** Second GBP listing ("Overcome Power Cycle") creates brand dilution
-- **Signal Source:** Google Maps — separate listing at 4100 Cameron Park Dr #109
-- **Evidence Snippet:** "Overcome Power Cycle" exists as a separate GBP at same building, different suite. Zero reviews. Creates confusion: prospective customers see two listings for one business.
+- **Title:** Second related GMB listing observed (Overcome Power Cycle)
+- **Signal Source:** Google Maps / directory observations
+- **Evidence Snippet:** Prior audit noted a separate related listing at the same building (different suite) under Overcome Power Cycle.
 - **Data Recency:** 2025-08
 - **Estimated Severity:** Minor
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Owner-provided explanation unknown. May be legacy or intended spin-off. Either way, two GBPs at same address for related entities dilute local authority.
+- **Notes / Context:** May be intentional or legacy. Impact depends on current state and ownership structure.
 - **Human Decision:** Pending
 
 ### Threat ID: T-009
-- **Title:** No YouTube or business TikTok video presence
+- **Title:** No YouTube or brand TikTok presence identified
 - **Signal Source:** YouTube + TikTok brand search
-- **Evidence Snippet:** No channel for "Overcome Fitness" on YouTube. No @overcomefitness or @overcomefitnesscp on TikTok. CrossFit Cameron Park has both.
+- **Evidence Snippet:** Prior search found no business YouTube channel and no clear brand TikTok account under Overcome Fitness naming.
 - **Data Recency:** 2025-08
 - **Estimated Severity:** Minor
 - **Verification Tier:** Tier 2
-- **Notes / Context:** Zero video presence on 2nd largest search engine (YouTube) and fastest-growing fitness discovery platform (TikTok). First-mover opportunity — most local competitors are also absent from TikTok.
+- **Notes / Context:** Absence observation only.
 - **Human Decision:** Pending
 
 ### Threat ID: T-010
-- **Title:** No LinkedIn presence
-- **Signal Source:** LinkedIn — company search
-- **Evidence Snippet:** No company page found for "Overcome Fitness."
+- **Title:** No LinkedIn company presence identified
+- **Signal Source:** LinkedIn company search
+- **Evidence Snippet:** No company page found for Overcome Fitness in prior search.
 - **Data Recency:** 2025-08
-- **Estimated Severity:** Minor (informational)
+- **Estimated Severity:** Minor
 - **Verification Tier:** Tier 2
-- **Notes / Context:** No B2B partnership visibility. Low priority for fitness studio — zero-cost to create but low impact channel.
+- **Notes / Context:** Low immediate impact channel for this vertical; recorded for completeness.
 - **Human Decision:** Pending
 
 ## Summary
 - Total threats drafted: 10
 - Tier 1 (Verified): 0
 - Tier 2 (Indicative): 10
-- Rejected / removed: Original T-007 (brand continuity / prior-name speculation) — removed as not grounded in clear evidence
+- Critical severity used: 0 (all elevated findings held at Major while data remains stale/Tier 2)
+- Several entries explicitly require freshness re-verification before lock or tier upgrade
 
 ## Human Review Gate
-- [ ] Every entry is backed by real data from the locked inventory
+- [ ] Every entry is backed by real data from the inventory
 - [ ] Every entry has a Data Recency note
 - [ ] Every entry has a Verification Tier
 - [ ] Stale observations are clearly flagged
+- [ ] No industry-stat or solution language remains
 - [ ] Human has recorded a decision on each entry
 - [ ] No invented or speculative threats remain
 
 Once this gate is signed off (and freshness checks completed where required), the Threat Register may be **Locked**.
 
-**Reviewer sign-off:** _________________ **Date:** _________
+**Reviewer sign-off:** _________________ Date: _________