analysis: last_seen_at cannot mean what control 4c claimed it meant

[JasonYeYuhe]

The defect

Control 4c selected on last_seen_at = first_seen_at AND first_provider_detected_at IS NULL and labelled the result "single-launch, not activated" — i.e. installs that never came back.

That conjunct is tautological, and the label is a claim this table cannot support.

last_seen_at advances only on an upsert; an upsert happens only on a send; and the client sends exactly twice ever (install, then first_provider_detected), both latched in UserDefaults (trap 3). So a non-activated install sends once and its last_seen_at is frozen at install time forever.

An install that relaunched a hundred times and never found a CLI is byte-identical to one deleted within the hour.

Verified both ways before changing anything

• Code — AnonymousInstallTelemetry has no third send path.
• Production, read-only:

query	result
where first_provider_detected_at is null	2
…and last_seen_at = first_seen_at	2 ← identical, so the conjunct selects nothing
where last_seen_at <> first_seen_at	0 across the entire table

The verdict 4c reached (AMBIGUOUS) was right. Its stated reason was not — which is the worse failure, because a reader would have acted on "never relaunched".

Why the file's own liveness check missed it

Section 4e feeds synthetic rows through the same predicates and asserts each control matches ≥ 1. It passed. Two of its four synthetic rows carry last_seen_at = now() with a NULL first_provider_detected_at — a shape production cannot emit. The control "discriminated" only against rows reality does not produce.

Those rows are kept (4a and 4b need them) but are now labelled as deliberately illegal shapes, with a note: never add a control whose only negative examples are impossible.

Changes

• trap 4 → FIVE TRAPS. Trap 5 states the freeze, the tautology it implies, and that prune_anonymous_installs()'s 400-day window is therefore "400 days since install" for non-activated rows.
• 4c — inert conjunct dropped, retitled not activated, explicit caveat column that relaunch behaviour is not observable.
• 4f — new tautology guard, run against the live table rather than synthetic rows: does adding the conjunct change what is selected? It also flips to a loud warning the moment any row re-sends, so trap 5 cannot go stale silently if the client ever changes.

The guard's own negative control found a flaw in the guard

Fed synthetic populations, 4f's first draft had a three-armed verdict whose UNEXPECTED arm is unreachable by construction — a conjunct that filters anything implies a re-sent row, so the first arm always wins:

population	verdict reached
today's shape	INERT as expected ✓
client re-sends	CLIENT NOW RE-SENDS ✓
conjunct filters	CLIENT NOW RE-SENDS ← never UNEXPECTED

A branch that can never fire is the mirror image of the tautology being fixed, so it's gone. The guard now has two arms and both were observed firing.

Read-only throughout: no migration, no schema change, no writes.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.