[
  {
    "evidence": "Current metrics include trace timestamp and latency but not actual dispatch/finish wall-clock timestamps.",
    "mitigation": "Add dispatch/finish timestamps and run Batch 0 before SRR claims.",
    "risk": "Session sequentiality not proven",
    "severity": "high"
  },
  {
    "evidence": "PD matrix scaffold exists separately; some old runs used earlier flags/methodology.",
    "mitigation": "Use fresh PD matrix for paper-grade claims.",
    "risk": "Legacy PD-sep data may not match final methodology",
    "severity": "medium"
  },
  {
    "evidence": "Existing artifacts have gpu_util.csv but lack per-worker queue and session ownership.",
    "mitigation": "Add route-decision and per-worker queue logs for Batch 3.",
    "risk": "GPU util is not a sufficient hot-spot proof",
    "severity": "medium"
  },
  {
    "evidence": "Trace has hash_ids; metrics have cached_tokens; request IDs may not join across all artifacts.",
    "mitigation": "Emit hash_ids/session_id/cached_tokens in the same per-request record.",
    "risk": "Cache reuse decomposition is incomplete without joined hash/cache-hit data",
    "severity": "medium"
  }
]