Trigger, ordinary paths, and proof

You've seen how at_risk computes (L19–L22). Three operational questions remain: What kicks off a run? What do the boring, non-oracle cells look like? And how does anyone know the answer is right? They're the bookends of one lifecycle — trigger → compute → proof — so we'll do all three here and close the book on at_risk.

1What fires a run — the scheduler

AtRiskScheduler (at_risk_scheduler.go) drives the metric on a periodic cadence: load the full risk graph, run EnrichAtRisk over the live focus-token list, write the per-token at_risk_summary / at_risk_cells / at_risk_updated_at back to Memgraph. Default tick: 30 min.

Three properties tie straight back to earlier lessons:

• Single-goroutine writer (L9). The Run() loop is the only caller, so there are never concurrent at_risk writes. Off by default (AT_RISK_SCHEDULER_ENABLED=false); cycles are sequential — a slow cycle delays the next tick, never stacks.
• Fail-loop, don't fail-stop (L8). A bad cycle increments at_risk.cycle.errors at WARN and the loop continues; three consecutive failures tip the AtRiskSchedulerStalled alarm at 90 min (2× cadence) — observability you met in L11.
• One heavy job at a time. HeavyMu / WithHeavy (heavy_gate.go) is a process-wide mutex — at_risk shares the box with centrality, DebtRank, and other heavy computers, so the gate serializes them instead of letting 7+ fan out and thrash memory.

2The ordinary cells — Path 3 & 3b (HOLDS / vault)

L20 showed the gnarliest path. These are the opposite: the plain majority. Path 3 (emitHoldsBasedCells) walks every venue that HOLDS the focus token and emits a cell, with target_role read straight off the venue's subtype:

switch vKind {
case "bridge": targetRole = TargetRoleBridge
case "pool":   targetRole = TargetRolePool
default:       targetRole = TargetRoleVault   // catch-all
}
// at_stake = focusUSD (USD of T this venue holds); + the usual admin & contract cells

Path 3b (emitVaultAssetOnlyCells) is a small but instructive fix-up: MetaMorpho-style vaults dropped their (phantom) HOLDS edge in PR #168 but still carry a VAULT_ASSET edge. Path 3 would miss them, so 3b catches vaults reachable only via VAULT_ASSET, using vault.attrs.tvl_usd as the balance proxy and skipping any vault Path 3 already covered. Same admin + contract-failure cell pairing as everywhere else.

3How it's kept honest — the parity harness

Every lesson since L6 has dropped phrases like "mirrors at_risk.py:2689," "any change here is a parity break," and the KeyedSum/sorted-iteration ulp discipline. Here's the machine behind those words. The entire Go at_risk engine is a port of a Python original (at_risk.py), and correctness is defined as matching Python's output. Two mechanisms enforce it:

A · The cross-implementation diff (DiffEnrichedGraphs)

Run both implementations on the same graph, compare per-token, field by field. USD floats compare within a tolerance; counts must match exactly:

USDRelativeTolerance: 1e-4   // 0.01% relative drift allowed on $ fields
USDAbsoluteTolerance: 1e-2   // or 1 cent absolute, whichever is kinder
// count fields (n_cells, n_anchor, …) — exact match required

This is exactly why the engine is so fussy about float determinism: a ulp of drift from an unsorted map walk or a naive sum could push a token past tolerance and fail the harness. cmd/at-risk-diff is the CLI front end; the tolerances track docs/at_risk_io_schema.md §9.3.

B · The 4 sanity invariants (CheckInvariants) — independent of Python

This is the satisfying capstone. Four invariants run against the Go output alone — and every one of them is a fact you learned in a previous lesson, now encoded as a machine-checked guarantee:

What you can now do

• Explain that at_risk's cells are a periodic full-graph recompute (scheduler, 30 min), distinct from L16's delta-driven exposure — and not over-generalize "the engine is incremental."
• Connect the scheduler to single-writer (L9), fail-loop + alarms (L8/L11), and the HeavyMu serialization gate.
• Describe Path 3 / 3b (HOLDS & VAULT_ASSET cells), and articulate the user/custody exclusion as the line between protocol risk and a phished wallet.
• Explain the parity harness: DiffEnrichedGraphs (tolerance on $, exact on counts) and why float determinism matters to it.
• Recite the 4 sanity invariants and trace each back to the lesson whose fact it encodes.