# docs/risks.md — risk register (Phase 0, 2026-11-02; update at every gate)

| # | Risk | Likelihood | Impact | Mitigation / decision | Owner phase |
|---|---|---|---|---|---|
| R1 | **No FP64 on Metal** → GPU estimates drift from FP64 references on long reductions (390 000 bars, ill-conditioned X'X) | certain (verified) | high | FP32 + Kahan/pairwise reductions; sufficient statistics accumulated per chunk then combined in FP64 on CPU; mixed-precision policy per method; tolerances per method; GPU paths that cannot meet tolerance are flagged `precision=fp32-approx`, not silently accepted | 3, 4 |
| R2 | GPU does not beat the 18-core CPU for small/medium workloads (realistic for 1-day RV on one series) | high | medium (it is a *result*, not a failure) | Publish break-even charts and CPU-wins cases (charter §8); auto backend picks CPU below measured break-even | 3, 6 |
| R3 | GARCH optimization on GPU unstable (nonconvex, constraints) | medium | medium | GPU only evaluates batched likelihoods/gradients; CPU optimizer (L-BFGS-B / Nelder–Mead with transforms) drives; report convergence codes; never mark non-converged fits as success | 4 |
| R4 | FinData rate limit (600/min) / export caps (31 d per 1m call, 12 y per export) | certain | low | token bucket, retries with `Retry-After`, exports chunked ≤ 10 y, on-disk cache keyed by (dataset, version, symbol, range) with SHA-256 | 2 |
| R5 | Duplicate last session in exports (base + delta layouts, WP 39) | high | low | dedupe on (instrument_id, timestamp_utc), counted in QualityReport | 2 |
| R6 | License breach by committing real bars or figures that reveal raw prices | low | critical | `.gitignore` for `*.parquet`/`data/`; pre-commit hook scanning for `fd_` keys and large binaries; paper tables show only aggregates/ratios; fixtures synthetic | all |
| R7 | Secret leakage (`FINDATA_API_KEY`) in logs/manifests | low | critical | client redacts `Authorization` header; manifests store key *prefix hash* only; `scripts/check_no_secrets.sh` in CI | 2, 8 |
| R8 | Thermal throttling / background load on the laptop biases benchmarks | medium | medium | record `pmset -g therm`, load average, and `powermetrics` when available; randomized order, warm-ups, ≥ 5 repetitions, medians + bootstrap CIs; rerun flagged outliers | 6 |
| R9 | Cluster nodes lack Homebrew/cmake in SSH PATH; m2m8b lacks developer tools; 7 nodes unreachable | certain | low | self-contained static bundle built on the laptop; nodes that stay unreachable are reported as "not tested" in E7 | 6 |
| R10 | Production interference (FinData on M3U96a, Ka apps on M4M64a/b, gateway M1M32) | low | high | those nodes excluded from timing runs (M1M32: ≤ 2-minute microbench only, off-hours); never install software on nodes; no sudo | 6 |
| R11 | Arrow C++ dependency makes wheels/Linux builds heavy | medium | medium | Arrow optional (`RAID_WITH_ARROW`); core library and tests build without it; Parquet reader behind an interface; Python path can fall back to pyarrow → NumPy views | 1 |
| R12 | `clang` 21 does not know `-mcpu=apple-m5` | certain | low | use `-mcpu=apple-m4` on M5/M6 hosts (recorded in manifest); ISA difference irrelevant for the claims | 1 |
| R13 | Reference software definitional differences (BPV constants, HARQ scaling, GARCH initialization, HAC bandwidth, DoF of HC corrections) | high | high (validation tables) | per-method registry pins the exact competitor options; tests compare under identical conventions; discrepancies documented, not hidden | 4 |
| R14 | Scope creep (Tier B/C lists) | high | medium | gates: Tier B only after Tier A passes; Tier C only with validated inputs; RESEARCH_STATUS lists "not implemented" honestly | 5 |
| R15 | Survivorship / PIT issues if a HAR-X uses fundamentals | medium | medium | methods paper uses market covariates only (realized measures, returns, VIX-type indices from FinData index bars); no fundamentals in Tier A experiments | 4, 6 |
| R16 | Nondeterministic GPU reductions (threadgroup scheduling) break bitwise reproducibility | certain | low | deterministic reduction order within fixed threadgroup sizes; `ExecutionPlan.deterministic=true` forces fixed-order tree reductions; nondeterminism bound reported when disabled | 3 |
| R17 | Energy claims without an instrument | medium | medium | energy reported only from `powermetrics` samples (requires sudo on the laptop, password available to the owner); otherwise "not measured" | 6 |
| R18 | Paper claims not traceable to artifacts | medium | high | every table/figure generated by `experiments/scripts/*` from `experiments/results/*.json` with SHA-256 in `experiments/manifests/`; Phase 8 reproduction from clean checkout | 7, 8 |