fix(daemon): adaptive EMA integration + shard.ttl 3-threshold shape (Phase 6 soak)

[githubrobbi]

Summary

Two root-cause fixes from the 2026-05-07 Phase 6 24-h min_tier="WARM" soak plus a corresponding update to the soak validator so future runs measure the right thing.

Findings & fixes

1. DriveStats::decay_ema only decayed — never integrated new queries

The 24-h soak captured rate_qpm=0.0 across all 2882 shard.ttl events for the queried drive. Root cause: decay_ema only applied exponential decay; mark_query_at bumps were never folded into the EMA. The adaptive bonus formula in crate::cache::policy::warm_ttl therefore could never engage in production.

Fix (crates/uffs-daemon/src/cache/shard/drive_stats.rs): standard half-life EMA blend new = decay·prev + (1-decay)·sample with sample = delta_queries/elapsed_secs, expressed as mul_add for the suboptimal_flops gate. New atomic last_decay_queries_total tracks the queries-total snapshot at the last call; threaded through snapshot serde with #[serde(default)] so pre-fix snapshots restore cleanly as "first call after restore". Hot-path posture preserved — mark_query_at still touches only relaxed atomics.

2. shard.ttl event reported tier-mixed fields

Pre-fix, the event emitted only chosen_ttl_sec — the outgoing edge of the drive's current tier. Drives in different tiers therefore reported different underlying values (Warm→Parked vs Parked→Cold), and the soak validator's chosen_ttl_sec exceeds peers assertion was structurally impossible to pass under the default ladder (warm cap < parked base).

Fix (crates/uffs-daemon/src/index/transitions.rs): emit all four fields — chosen_ttl_sec (back-compat preserved), hot_ttl_sec, warm_ttl_sec, parked_ttl_sec — on every event so consumers can pick a single edge and compare across drives regardless of tier. Applied to all three event paths: min-tier-clamp / idle-demote / below-ttl.

3. Soak validator alignment

scripts/dev/long-soak.rs now uses warm_ttl_sec (the rate-sensitive Warm→Parked edge present on every drive's events) and the max observed value per drive across the soak — robust against EMA decay between the synthetic-load window and the validation read.

Tests

• decay_ema_integrates_new_queries_into_rate_estimate — pins the Phase 6 contract: 60 q over 60 s lifts the EMA above 0.
• decay_ema_idle_run_only_decays — pins the pure-decay-when-no-new-queries property (no random walk introduced).
• shard_ttl_event_emits_all_three_thresholds — pins the four-field shape on the live demote controller path. Extracted into a sibling shard_ttl_events module to keep idle_demote.rs under the 800-LOC file-size policy (no exception added).

Local validation

• ✅ cargo nextest run -p uffs-daemon --lib — 281/281 passed
• ✅ just lint-fast — fmt-check, file-size, typos, reuse, lint-ci, lint-prod, lint-tests
• ✅ just check-windows — cargo xwin check --workspace --all-targets --all-features

Compliance audit (mandatory rules)

1. No suppression hacks — file-size violation resolved by decomposition into shard_ttl_events.rs, not via file_size_exceptions.txt. The new #![expect(...)] block carries only the lints actually triggered (no blanket allows).
2. Surgical, correct fixes — root-cause fix for the EMA (standard half-life blend), minimal additions for the tracing event (3 fields + 3 let bindings).
3. Preserve behavior & contracts — chosen_ttl_sec field preserved for back-compat, first-call-returns-stored-value contract preserved (existing test still green), pre-fix snapshots restore cleanly.
4. Improve tests, don't dodge them — three new tests added pinning the Phase 6 contracts; tolerances generous-but-meaningful so a regression that drops integration entirely fails decisively.

Follow-up

The Phase 6 24-h Windows soak should be re-run once this lands so we capture a clean warm_ttl_sec divergence between the queried target drive and idle peers.