docs(patterns): correlation-window semantics rationale (#367)

[trilamsr]

Summary

The patterndetector ships 11 detectors with 14 time-bounded knobs. The join shape varies across patterns and the rationale lived only in code comments + PR review threads — operators tuning windows had to read source per detector. PR #346 reviewer flagged this on three named detectors; the actual scope is wider.

Root-cause finding

Five distinct join shapes exist across the 11 detectors. They are load-bearing, not bugs — each shape matches the causal physics of the signal:

• One-sided lookback (ci(deps): bump the gh-actions group with 5 updates #1 Add NORTHSTARS, RFC-0002, and Q1 MILESTONES #3 Apply Wave-1 follow-ups: tests, automation, doc-truth #5 Make RFC process optional, not gated #6 Add AI review + PR-creation gates and lifecycle skills #7 Tighten developer and PR feedback loops #10): cause precedes effect; effect.t - cause.t ∈ [0, window].
• Asymmetric two-sided (Add developer foundation: Git hooks suite, issue templates, editorconfig #11): pre-stall leg covers concurrent-start checkpoints (30s); post-stall leg covers OTTL-bridge logger latency (60s).
• Symmetric two-sided ([ci] Set required_status_checks_strict: false #9 CNI-event leg): cohort-ready ±window could be cause OR consequence.
• Job-window bounded ([general] M1.6 hardening: lint + coverage + panic recovery + pipelinebuilder #13): SDC counter rise must fall in the bounded eval-cycle's owning job; no operator window knob is meaningful.
• Trailing-window rate / freshness (Bump the gh-actions group across 1 directory with 4 updates #2 Wave 1: governance bootstrap (CODEOWNERS, DCO, signing) #4 [ci] Sync branch-protection.yml with relaxed review rule #8): rolling window anchored at now or the most-recent record.

Decision

Document the existing reality, do not converge. The original suggestion (unified asymmetric two-knob form) was explored and rejected: it would force forward_window=0s on the one-sided detectors (a footgun on clock skew across nodes) and would not apply to #13 at all (bounds come from the eval record itself, not an operator knob).

Changes

• docs/patterns/README.md — new "Correlation-window semantics" section covering all 11 detectors with the 5-shape vocabulary, per-detector predicate / anchor / default / rationale table, and a "why not converge" explanation.
• docs/patterns/07-dataloader-hang.md — "Why this correlation shape" subsection (one-sided lookback rationale, predicate location, default).
• docs/patterns/11-checkpointer-hang.md — "Why this correlation shape" subsection (asymmetric two-sided rationale, both legs explained).
• docs/patterns/13-silent-data-corruption.md — "Why this correlation shape" subsection (job-bounded rationale, why no *_window knob).

The README table cross-links into the three per-pattern sections via in-page anchors.

Test plan

• make check clean (gofumpt, golangci-lint 0 issues, go vet, go mod verify, attribute-namespace-check 100/100).
• Source-of-truth claims verified by direct grep: predicate locations cited (module/pkg/patterns/*.go line numbers), defaults match module/processor/patterndetectorprocessor/config.go, bound-inclusivity (> for correlation, < for freshness) confirmed by tests GOWORK=off go test ./module/pkg/patterns/... -run Window green on main.
• All cross-links resolve (in-page anchors validated by header slug match).

No code changes; no detector behavior changes.

Closes #367.

NONE

[trilamsr]

Empty diff — content was discarded during worktree-collision recovery. PR #392 bundles the same #367-adjacent work; reopening #367 fresh as separate PR.