the worst day in the record cannot happen in operation

Every risk document has a worst-case line, and that line is usually taken at face value. One candidate's single worst day was an extreme outlier, far outside everything around it. It would have been easy either to discard it as noise or to build policy around it. Neither is right.

The decomposition showed what it was. A quality filter had silenced a stretch of the series. After the silence, one record carried the whole accumulated movement at once. The measurement correctly attributed the entire move to that one entry, which is why the figure was so large — but the entry that produced it could not have been taken, because the filter that created the silence was in force at the time. So the figure is true in the record and unreachable in operation. Both statements are written down, so a reader can check either one.

The same document attached a deliberately operational trigger: the cost assumption for the first evaluation would be chosen from the observed cost of running, not guessed in advance, so a favourable assumption could not be smuggled into a registration. And the document was labelled a recommendation: nothing runs until a person signs it.

What it proves: the programme can separate an artefact of its own cleaning from a property of the system, and it can write down a risk figure without either hiding it or planning around a phantom.