fix(telemetry): a floor that moved inside the window makes the band check a comparison of two populations (#4225)

`retrieval_telemetry(days=30)` reported, for write_path_rule:

  "the weakest tenth of what this arm returns scores 0.6984, only -0.0216
   above its floor of 0.72"

A negative distance above something. The tenth percentile of what an arm
RETURNED cannot sit below the floor that gates what it may return — not
inside one population.

MEASURED CAUSE. write_path_rule's floor was 0.68 until 2026-09-02, when
2385100 (#3318) raised the shipped default to 0.72. The window opened
2026-08-22, so six days of it are calls made under the old bar; top_score.min
for the surface is exactly 0.68, the old bar still in the sample.

AND THE CHANGE LEFT NO TRACE THE READOUT COULD SEE. retrieval_tuning_events
records dial turns — a person or a model choosing a number. It was silent
about the other way a floor moves: somebody edits floor_default and ships it.
retrieval_tuning_history returned {"events": []} and retrieval_surfaces said
last_change: {}, source: "shipped". All true, and all of it silent about a
floor that had in fact moved.

THE RAISE ANNOUNCED ITSELF. A LOWERED FLOOR WOULD NOT: the gap comes out
comfortably positive and reads as a clean bill of health on a sample that
half predates the bar being judged. Both directions are now pinned.

So the check is SUSPENDED, not softened. band_hugs_floor asks whether the
scores are piled on the bar; that needs the scores and the bar to come from
the same regime. Where they do not, the honest answer is that this sample
cannot say, plus the date after which one can — floor_moved_mid_window
replaces band_hugs_floor for that arm and never accompanies it. A reader told
a number is unavailable goes and gets one; a reader handed a qualified number
uses it.

NO MIGRATION. `actor` is Text with no CHECK precisely so a new kind of actor
is not one — the model's own comment says so, and this is the case it
anticipated. "release" joins "model" and "human". user_id is already
nullable, which is right: no user did this, a release acts on every account
that has not overridden the dial, and a row per user would both multiply and
misattribute it. Both readers now take the newest of (this user's change, the
release's).

THE FIRST SIGHTING IS A BASELINE, written with old_value NULL. Nothing moved;
the row exists so the next release has a predecessor. That null is
load-bearing: floor_moves_since asks for old_value IS NOT NULL, so a fresh
install's baseline does not silently retire the check on every new install.

UI: the tuning history rendered actor as `human ? 'you' : 'Claude'`, so a
release row would have told the operator that Claude moved a floor it never
touched — the one failure the actor column exists to prevent. Three-way now,
with an unknown value printing itself rather than guessing.

Recorded at startup, inline and awaited. What #4181 cost three hours was
concurrency — a background task racing the hook for the same pool. Sequential
creates no contention, and this is twelve single-row reads. It must finish
before serving because a readout served before the change was recorded is the
exact answer this exists to stop giving.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_retrieval_tuning.py

@@ -196,3 +196,147 @@ def test_every_tool_in_the_module_is_registered():
         "retrieval_surfaces", "migrate_retrieval_floor",
         "tune_retrieval", "retrieval_tuning_history",
     ]
+
+
+# ── record_release_defaults / floor_moves_since (#4225) ───────────────────
+#
+# THE HOLE THESE FILL. This table records dial turns — a person or a model
+# choosing a number. It was silent about the other way a floor moves: somebody
+# edits `floor_default` in the registry and ships it. That change is invisible
+# to every consumer of this table, and one consumer is `band_hugs_floor`, which
+# compares a band against a floor and could not notice they came from different
+# regimes.
+#
+# Measured on the instance that found it: `write_path_rule` went 0.68 -> 0.72
+# on 2026-09-02 as a shipped default, so a 30-day window opening 2026-08-22
+# held six days of calls made under the old bar. The readout reported the band
+# sitting "-0.0216 above" its floor — which is what a two-population comparison
+# looks like when it finally says so out loud.
+
+
+def _release_rows(rows):
+    """Patch `async_session` so the recorder sees `rows` as what is on record.
+
+    `rows` maps (surface, dial) -> new_value already recorded by a release.
+    """
+    session = make_mock_session()
+    seen = []
+
+    async def execute(stmt):
+        seen.append(stmt)
+        result = MagicMock()
+        # The recorder asks one question at a time, in registry order, so the
+        # answers are handed back in the order it asks them.
+        key = seen_keys.pop(0) if seen_keys else None
+        row = None
+        if key is not None and key in rows:
+            row = MagicMock()
+            row.new_value = rows[key]
+        result.scalars.return_value.first.return_value = row
+        return result
+
+    seen_keys = [(n, d) for n in rt.surface_names() for d in ("floor", "budget")]
+    session.execute = AsyncMock(side_effect=execute)
+    return session
+
+
+@pytest.mark.asyncio
+async def test_a_first_boot_records_a_baseline_and_calls_it_one():
+    """Nothing moved. The row exists so the NEXT release has a predecessor.
+
+    Load-bearing downstream: the band check suspends itself on a genuine move
+    and must NOT suspend itself on a fresh install's baseline. It tells them
+    apart by `old_value` being null, so a baseline that claimed a change would
+    silently retire the check on every new install.
+    """
+    session = _release_rows({})
+    with patch.object(rt, "async_session", MagicMock(return_value=session)):
+        written = await rt.record_release_defaults()
+    assert written, "a first boot records every dial"
+    assert all(w["baseline"] for w in written)
+    assert all(w["old_value"] is None for w in written)
+
+
+@pytest.mark.asyncio
+async def test_a_default_that_did_not_move_writes_nothing():
+    """Called on every boot, so it has to be idempotent — otherwise the
+    history fills with rows saying the release shipped the same number again,
+    and a history nobody can skim is one nobody reads."""
+    current = {(n, d): (rt.get_surface(n).floor_default if d == "floor"
+                        else float(rt.get_surface(n).budget_default))
+               for n in rt.surface_names() for d in ("floor", "budget")}
+    session = _release_rows(current)
+    with patch.object(rt, "async_session", MagicMock(return_value=session)):
+        written = await rt.record_release_defaults()
+    assert written == []
+    session.add.assert_not_called()
+    session.commit.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_a_moved_default_is_recorded_with_both_values():
+    """The event the whole task is about, and it carries what it moved FROM —
+    without that a reader knows a change happened and nothing about whether
+    the old sample can be pooled with the new one."""
+    name = rt.surface_names()[0]
+    s = rt.get_surface(name)
+    current = {(n, d): (rt.get_surface(n).floor_default if d == "floor"
+                        else float(rt.get_surface(n).budget_default))
+               for n in rt.surface_names() for d in ("floor", "budget")}
+    current[(name, "floor")] = s.floor_default - 0.04    # what the last release shipped
+    session = _release_rows(current)
+    with patch.object(rt, "async_session", MagicMock(return_value=session)):
+        written = await rt.record_release_defaults()
+    moved = [w for w in written if w["surface"] == name and w["dial"] == "floor"]
+    assert len(moved) == 1
+    assert moved[0]["baseline"] is False
+    assert moved[0]["old_value"] == pytest.approx(s.floor_default - 0.04)
+    assert moved[0]["new_value"] == pytest.approx(s.floor_default)
+
+
+@pytest.mark.asyncio
+async def test_a_release_row_belongs_to_no_account():
+    """`user_id IS NULL`, because no user did this.
+
+    A release acts on every account that has not overridden the dial. Writing
+    one row per user would both multiply the row and misattribute it, and the
+    readers take the newest of (this user's change, the release's) — which only
+    works if the release's is distinguishable.
+    """
+    session = _release_rows({})
+    with patch.object(rt, "async_session", MagicMock(return_value=session)):
+        await rt.record_release_defaults()
+    added = [c.args[0] for c in session.add.call_args_list]
+    assert added
+    assert all(e.user_id is None for e in added)
+    assert all(e.actor == rt.RELEASE_ACTOR for e in added)
+
+
+@pytest.mark.asyncio
+async def test_every_release_row_states_why_it_exists():
+    """`reason` is the guardrail on this table, and a row written by machinery
+    is the one most likely to arrive blank."""
+    session = _release_rows({})
+    with patch.object(rt, "async_session", MagicMock(return_value=session)):
+        await rt.record_release_defaults()
+    added = [c.args[0] for c in session.add.call_args_list]
+    assert all(e.reason and e.reason.strip() for e in added)
+    assert all(e.surface in e.reason for e in added)
+
+
+@pytest.mark.asyncio
+async def test_a_baseline_is_not_reported_as_a_floor_move():
+    """`floor_moves_since` is what suspends the band check, so it must ask for
+    a genuine move — `old_value IS NOT NULL` — rather than for any row."""
+    from datetime import datetime, timezone
+    session = make_mock_session()
+    result = MagicMock()
+    result.scalars.return_value.all.return_value = []
+    session.execute = AsyncMock(return_value=result)
+    with patch.object(rt, "async_session", MagicMock(return_value=session)):
+        out = await rt.floor_moves_since(datetime.now(timezone.utc))
+    assert out == {}
+    # The filter is the whole correctness argument; assert it is in the query.
+    stmt = str(session.execute.call_args.args[0])
+    assert "old_value IS NOT NULL" in stmt
+    assert "dial" in stmt