fix(telemetry): a floor that moved inside the window makes the band check a comparison of two populations (#4225)

`retrieval_telemetry(days=30)` reported, for write_path_rule:

  "the weakest tenth of what this arm returns scores 0.6984, only -0.0216
   above its floor of 0.72"

A negative distance above something. The tenth percentile of what an arm
RETURNED cannot sit below the floor that gates what it may return — not
inside one population.

MEASURED CAUSE. write_path_rule's floor was 0.68 until 2026-09-02, when
2385100 (#3318) raised the shipped default to 0.72. The window opened
2026-08-22, so six days of it are calls made under the old bar; top_score.min
for the surface is exactly 0.68, the old bar still in the sample.

AND THE CHANGE LEFT NO TRACE THE READOUT COULD SEE. retrieval_tuning_events
records dial turns — a person or a model choosing a number. It was silent
about the other way a floor moves: somebody edits floor_default and ships it.
retrieval_tuning_history returned {"events": []} and retrieval_surfaces said
last_change: {}, source: "shipped". All true, and all of it silent about a
floor that had in fact moved.

THE RAISE ANNOUNCED ITSELF. A LOWERED FLOOR WOULD NOT: the gap comes out
comfortably positive and reads as a clean bill of health on a sample that
half predates the bar being judged. Both directions are now pinned.

So the check is SUSPENDED, not softened. band_hugs_floor asks whether the
scores are piled on the bar; that needs the scores and the bar to come from
the same regime. Where they do not, the honest answer is that this sample
cannot say, plus the date after which one can — floor_moved_mid_window
replaces band_hugs_floor for that arm and never accompanies it. A reader told
a number is unavailable goes and gets one; a reader handed a qualified number
uses it.

NO MIGRATION. `actor` is Text with no CHECK precisely so a new kind of actor
is not one — the model's own comment says so, and this is the case it
anticipated. "release" joins "model" and "human". user_id is already
nullable, which is right: no user did this, a release acts on every account
that has not overridden the dial, and a row per user would both multiply and
misattribute it. Both readers now take the newest of (this user's change, the
release's).

THE FIRST SIGHTING IS A BASELINE, written with old_value NULL. Nothing moved;
the row exists so the next release has a predecessor. That null is
load-bearing: floor_moves_since asks for old_value IS NOT NULL, so a fresh
install's baseline does not silently retire the check on every new install.

UI: the tuning history rendered actor as `human ? 'you' : 'Claude'`, so a
release row would have told the operator that Claude moved a floor it never
touched — the one failure the actor column exists to prevent. Three-way now,
with an unknown value printing itself rather than guessing.

Recorded at startup, inline and awaited. What #4181 cost three hours was
concurrency — a background task racing the hook for the same pool. Sequential
creates no contention, and this is twelve single-row reads. It must finish
before serving because a readout served before the change was recorded is the
exact answer this exists to stop giving.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

tests/test_retrieval_warnings.py

@@ -49,9 +49,10 @@ def src(**kw) -> dict:
 
 
 def warn(sources, usage=None, rule_usage=None, floors=None,
-         min_calls=N, epsilon=EPS) -> list[dict]:
+         min_calls=N, epsilon=EPS, floor_moves=None) -> list[dict]:
     return _compute_warnings(
         sources, usage or {}, rule_usage or {}, floors or {}, min_calls, epsilon,
+        floor_moves or {},
     )
 
 
@@ -349,3 +350,99 @@ def test_an_absent_rule_usage_block_is_not_a_finding() -> None:
     assert "outcomes_never_recorded" not in codes(
         warn({}, rule_usage={"rule_usage_failed": True})
     )
+
+
+# ── floor_moved_mid_window (#4225) ────────────────────────────────────────
+#
+# WHY THE BAND CHECK IS SUSPENDED RATHER THAN SOFTENED.
+#
+# `band_hugs_floor` asks whether the scores are piled on the bar. That needs
+# the scores and the bar to come from the same regime, and across a floor
+# change they do not — the comparison silently becomes one between two
+# populations.
+#
+# It announced itself when the change was a RAISE: on the instance this was
+# found on, `write_path_rule` went 0.68 -> 0.72 as a shipped default inside
+# the window, and p10 computed over calls made under the old bar came out
+# BELOW the new floor. The readout printed a band "-0.0216 above" its floor.
+#
+# A LOWERED floor is the dangerous one, because it hides: the gap comes out
+# comfortably positive and reads as a clean bill of health on a sample that
+# half predates the bar being judged. Both directions are pinned below.
+
+MOVED = "2026-09-02T00:00:00+00:00"
+
+
+def test_a_floor_that_moved_in_the_window_suspends_the_band_check() -> None:
+    ws = warn({"auto_inject": src(calls=100, zero_result_calls=5, p10=0.705)},
+              floors={"auto_inject": 0.70}, floor_moves={"auto_inject": MOVED})
+    assert "floor_moved_mid_window" in codes(ws, "auto_inject")
+    assert "band_hugs_floor" not in codes(ws), (
+        "a suspended check must not also answer — the two never accompany "
+        "each other, or the reader gets a number and a warning about it"
+    )
+
+
+def test_the_impossible_negative_gap_is_not_printed_at_all() -> None:
+    """The symptom that exposed this: p10 BELOW the floor that gates the arm.
+
+    Arithmetically impossible inside one population, and the sentence built
+    from it ("only -0.0216 above") is not one anybody can act on.
+    """
+    ws = warn({"auto_inject": src(calls=100, zero_result_calls=5, p10=0.6984)},
+              floors={"auto_inject": 0.72}, floor_moves={"auto_inject": MOVED})
+    assert "band_hugs_floor" not in codes(ws)
+    assert not any(w.get("numbers", {}).get("gap", 0) < 0 for w in ws)
+
+
+def test_a_lowered_floor_is_suspended_too_though_its_gap_looks_healthy() -> None:
+    """The direction that does NOT announce itself.
+
+    A gap of 0.10 reads as a comfortable margin. It is computed over calls
+    half of which were made under a different bar, so it is not a margin at
+    all — and nothing in the number says so.
+    """
+    ws = warn({"auto_inject": src(calls=100, zero_result_calls=5, p10=0.80)},
+              floors={"auto_inject": 0.70}, floor_moves={"auto_inject": MOVED})
+    assert "floor_moved_mid_window" in codes(ws, "auto_inject")
+
+
+def test_a_floor_that_did_not_move_still_gets_judged() -> None:
+    """The mirror error, and the expensive one: suspending on nothing would
+    retire a working check."""
+    ws = warn({"auto_inject": src(calls=100, zero_result_calls=5, p10=0.705)},
+              floors={"auto_inject": 0.70}, floor_moves={})
+    assert "band_hugs_floor" in codes(ws, "auto_inject")
+    assert "floor_moved_mid_window" not in codes(ws)
+
+
+def test_only_the_arm_that_moved_is_suspended() -> None:
+    """Surfaces are judged independently; one arm's release change says
+    nothing about another's sample."""
+    ws = warn(
+        {"auto_inject": src(calls=100, zero_result_calls=5, p10=0.705),
+         "write_path": src(calls=100, zero_result_calls=5, p10=0.705)},
+        floors={"auto_inject": 0.70, "write_path": 0.70},
+        floor_moves={"auto_inject": MOVED},
+    )
+    assert "floor_moved_mid_window" in codes(ws, "auto_inject")
+    assert "band_hugs_floor" in codes(ws, "write_path")
+
+
+def test_the_warning_says_when_and_what_to_do_about_it() -> None:
+    """A finding with no remedy is a complaint. The reader needs the date, so
+    they can ask again with a window that starts after it."""
+    w = next(w for w in warn(
+        {"auto_inject": src(calls=100, zero_result_calls=5, p10=0.705)},
+        floors={"auto_inject": 0.70}, floor_moves={"auto_inject": MOVED},
+    ) if w["code"] == "floor_moved_mid_window")
+    assert w["numbers"]["moved_at"] == MOVED
+    assert MOVED in w["detail"] and "days" in w["detail"]
+
+
+def test_a_quiet_arm_is_not_suspended_either_way() -> None:
+    """Below `min_calls` neither check runs — a moved floor does not promote
+    an arm nobody used into something worth a line."""
+    ws = warn({"auto_inject": src(calls=1, zero_result_calls=0, p10=0.705)},
+              floors={"auto_inject": 0.70}, floor_moves={"auto_inject": MOVED})
+    assert "floor_moved_mid_window" not in codes(ws)