fix(wired): see the links that fail slowly, and the multi-gig ones that fall to 1G

[drench44]

Two blind spots in the wired detectors, both found the hard way: a port on a Mini Switch 2.5G was dropping a work computer's ethernet all day, and the tool reported nothing about it.

Review band: three agents (code-reviewer + silent-failure-hunter + pr-test-analyzer) — the diff touches tests/netadmin/detect/test_unit_convention.py, a convention-enforcing CI gate, and netadmin/store/repository.py's retention path. Their findings are folded in; the notable ones are called out below.

wired.port_flapping — a 24 h tier

It had a 10-minute tier (≥5 transitions) and a 1-hour tier (≥10), so it could only see a link failing fast. The port in question dropped 55 times in two weeks, 16 in one day, and never fired once — no single 10-minute window ever held 5 transitions.

That slow-burn shape is what a marginal cable or a power-managed NIC actually produces, and it is just as disruptive to the person using the port, so the new tier carries the same severity (P2, P1 on infra).

Also fixes the title. It always quoted the 10-minute count, so a long- or daily-tier trip rendered as (0 transitions/10m) — there is a real issue in a live store that reads exactly that, and it makes a true finding look like a bug. The title now names the tightest tier that actually tripped.

wired.bad_cable — an observed-ceiling arm

The downshift check returned early on any speed >= 1000, correct when gigabit was the ceiling. On a 2.5G/10G port a fall to 1000 is the same broken-pair symptom and was simply unreportable.

It cannot just compare against the rated ceiling — 1000 is unremarkable for a 2.5G port carrying a 1G device — so it compares against the port's own history: a link that has held 2500 proves its peer can do 2500.

Four things make that inference safe. Three of them came from review or dogfooding, not from the tests:

• Time-held, not row count. record_state_change writes only on change, so a port that ran a week at 2500 carries exactly one row saying 2500, dated a week ago. Counting rows inside the window finds nothing, and the commonest shape of all — damaged once, renegotiated down once, sitting there since — reports nothing. The value in effect entering the window seeds the timeline. prune() now preserves that boundary row per (entity, attr) for the same reason it already preserves the latest one: both answer "what was the value at time T" for a T still served. Without it the arm silently stopped reporting after 30 days.
• Fetched by window, never by row count. A count-limited fetch drops the oldest rows first — exactly where the seed lives — so the harder a link flapped, the more certainly its ceiling was truncated away.
• Peer age compared against when the speed was held, not against the window start. The latter is wrong in both directions: it rejects a peer that demonstrably ran fast mid-window, and on any store younger than the lookback it reads every peer as a newcomer and silently disables the arm site-wide. Where several peers claim one port the newest wins, so a departed device's lingering entity cannot vouch for its replacement.
• The device-class list is overruled only by a dominant ceiling — one held longer than the current speed. Dogfooding caught the alternative: a real G6 Turret, 10/100 by Ubiquiti's spec and working correctly, blipped to 1000 six times inside one 20-minute cabling event and then sat at 100 for five days. Twelve minutes of anomaly must not outvote five days of correct operation and send someone to re-run cable to a healthy camera. Thirty days at gigabit against two hours at 100 still wins.

Also fixed

• The peer-age confounder no longer leaks onto findings whose downshift arm was suppressed. confounders is the shared list handed to every finding, and the LLM dossier prints every key unconditionally — so an error-rate finding shipped claiming the detector had "tested and rejected" a trap when it had concluded the opposite.
• The flapping confounder note guards its new clause. Issues predating the tier never get their evidence refreshed, so an unguarded f-string rendered "unknown in unknown" on every resolved issue and on the public demo seed.
• _as_int/_as_float reject non-finite input. json.loads accepts Infinity by default and port.meta comes straight from stored controller JSON, so one malformed field raised an uncaught OverflowError out of the detector — blinding wired.bad_cable for every port on the site for that pass.

Verification

Run against a live site DB, all 46 ports across 6 switches:

• port_flapping fires P2 on exactly the offending port — 38 transitions/24h, with transitions_short: 0, transitions_long: 2 in the evidence, the counts that show precisely why it was missed — and on no other port.
• A point-in-time replay of the window when that port sat at 1000 fires bad_cable with observed_speed_max: 2500.
• No other port on the site reports, the camera ports included.

2052 passed, 1 skipped (2024 on main → +28 new tests), 92.53% coverage, black/isort/flake8 clean. transitions_sustained is added to the same conscious-exemption list that already carries transitions_short/transitions_long; its sibling window_sustained_s carries the _s suffix and is not exempted.

🤖 Generated with Claude Code