detectkit 0.49.2__tar.gz → 0.51.0__tar.gz

{detectkit-0.49.2/detectkit.egg-info → detectkit-0.51.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: detectkit
-Version: 0.49.2
+Version: 0.51.0
 Summary: Metric monitoring with automatic anomaly detection
 Author: detectkit team
 License: MIT

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/__init__.py

@@ -4,7 +4,7 @@ detectk - Anomaly Detection for Time-Series Metrics
 A Python library for data analysts and engineers to monitor metrics with automatic anomaly detection.
 """
 
-__version__ = "0.49.2"
+__version__ = "0.51.0"
 
 from detectkit.core.interval import Interval
 from detectkit.core.models import ColumnDefinition, TableModel

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/autotune/grid_search.py

@@ -1,12 +1,13 @@
 """Stage 3: bounded coordinate search over detector hyperparameters.
 
 Not a Cartesian product — a greedy coordinate sweep per candidate type:
-threshold → recency weighting → detrend (gated by a trend test) → window size
-(with the trend-gated window tie-bias from window_select) → a final threshold
-re-sweep at the chosen window (the threshold↔window coupling fix). The objective
-is the cross-validated score (settings.metric, or the unsupervised objective when
-there are no labels). Total evaluations stay in the low tens per type and are
-capped by settings.max_candidates.
+threshold → recency weighting → detrend (gated by a trend test) → stabilization
+(anomaly-robust baseline) → window size (with the trend-gated window tie-bias
+from window_select) → a final threshold re-sweep at the chosen window (the
+threshold↔window coupling fix). The objective is the cross-validated score
+(settings.metric, or the unsupervised objective when there are no labels).
+Total evaluations stay in the low tens per type and are capped by
+settings.max_candidates.
 """
 
 from __future__ import annotations
@@ -149,6 +150,19 @@ def grid_search(
                 if ev is not None and ev.score > best.score + eps:
                     best, accepted["detrend"] = ev, detrend
 
+        # Axis 3b: stabilization (anomaly-robust baseline; adopt only when it
+        # clears the margin). Flagged points enter subsequent windows clamped
+        # to the bound they violated, so a sustained incident cannot inflate
+        # the band and mask its own tail — usually decisive on labeled data
+        # with long incidents, near-neutral on clean series. Swept before the
+        # window axis so select_window evaluates with the adopted baseline.
+        for stabilization in (None, "clamp"):
+            if stabilization == accepted.get("stabilization"):
+                continue
+            ev = tuner.safe_evaluate(detector_type, {**accepted, "stabilization": stabilization})
+            if ev is not None and ev.score > best.score + eps:
+                best, accepted["stabilization"] = ev, stabilization
+
         # Axis 4: window size (large-window tie-bias, trend-gated in select_window).
         window_best = select_window(tuner, detector_type, accepted, best, grid)
         if window_best.score >= best.score - tuner.settings.window_tie_margin:

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/CLAUDE.section.md

@@ -40,7 +40,7 @@ version — **read the relevant one on demand** instead of guessing:
 | Alert rules (quorum/direction/consecutive), cooldown, recovery, templates | `.claude/rules/detectkit/alerting.md` |
 | Auto-tuning a detector (`dtk autotune`), labels file, the `autotune:` block, `_dtk_autotune_runs` | `.claude/rules/detectkit/autotune.md` |
 | Manually/interactively tuning a detector in the browser and writing it back in place (`dtk tune`) | `.claude/rules/detectkit/cli.md` |
-| A project-wide live overview + driving the pipeline from the browser (`dtk ui`) | `.claude/rules/detectkit/cli.md` |
+| A project-wide live overview, driving the pipeline, and creating/editing/deleting metric YAMLs from the browser (`dtk ui`) | `.claude/rules/detectkit/cli.md` |
 | OSI (Open Semantic Interchange) interop: import an OSI metric into a native metric / export back (`dtk osi`) | `.claude/rules/detectkit/cli.md` |
 
 ### Skills

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/rules/autotune.md

@@ -45,9 +45,10 @@ same windowed detectors and `detector_id` identity). The fastest path is the
    detectors (`mad`/`zscore`/`iqr`) and cross-validation picks the winner — no
    type is excluded by heuristic.
 3. **Hyperparameters** — a bounded coordinate grid search over `threshold`,
-   recency weighting (and its **half-life** when adopted), detrending and
-   `window_size`, maximizing a cross-validated score, with a final `threshold`
-   re-sweep at the chosen window. Fold scores aggregate as
+   recency weighting (and its **half-life** when adopted), detrending,
+   **stabilization** (`clamp`, adopted only when it clears the score margin)
+   and `window_size`, maximizing a cross-validated score, with a final
+   `threshold` re-sweep at the chosen window. Fold scores aggregate as
    `mean − stability_lambda · downside_deviation` (downside-only, so a config that
    scores *better* on recent folds isn't penalized; lower `stability_lambda` for a
    regime-shift metric).

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/rules/cli.md

@@ -12,7 +12,7 @@ Run all commands from a project directory (the one containing
 | `dtk run --select <sel>` | Run the load → detect → alert pipeline |
 | `dtk autotune --select <sel>` | Auto-configure a metric's detector (see `autotune.md`) |
 | `dtk tune --select <sel>` | Interactively tune a detector on real data, write it back in place |
-| `dtk ui` | Project-wide live overview + browser pipeline control panel |
+| `dtk ui` | Project-wide live overview + browser pipeline control panel + create/edit/delete metric YAMLs |
 | `dtk test-alert <metric>` | Send a mock alert to the metric's channels |
 | `dtk unlock --select <sel>` | Clear a stuck pipeline lock |
 | `dtk clean --select <sel>` | Prune internal data that no longer matches the config |
@@ -84,7 +84,7 @@ Full reference: `autotune.md`.
 The **manual, interactive** sibling of `dtk autotune`. Opens a localhost browser
 view of the metric's **real** persisted series and lets you turn the detector's
 knobs (type — including **Manual bounds** with lower/upper sliders — threshold,
-window, recency weighting + half-life, detrend, smoothing, **seasonality groups**,
+window, recency weighting + half-life, detrend, stabilization, smoothing, **seasonality groups**,
 **direction** (both/up/down), alert `consecutive_anomalies`) while the confidence
 band and flagged anomalies **recompute live**. The whole screen is a **chart-first
 cockpit**: ONE chart (the windshield) fills the view, the live metrics ride
@@ -210,6 +210,32 @@ its own isolated, lock-free session. The `dtk ui` server itself takes **no
 pipeline lock** and never mutates anything — every spawned command behaves
 exactly as if typed into a terminal.
 
+### Managing metrics from the UI
+
+The cockpit header has a **New metric** button — an editor overlay seeded
+with a starter YAML template, with an optional subfolder under `metrics/`;
+saving writes `metrics/[<folder>/]<name>.yml`. Every metric row also has an
+**Edit** action that opens its raw YAML in the same editor. **Save** validates
+server-side **before any write**: YAML syntax → full `MetricConfig` → a deep
+detector-params check (each factory-known detector is actually constructed) —
+an invalid config lands in the editor's error pane with nothing written. A
+successful save **archives the previous file verbatim** to
+`metrics/.history/<metric>/` (the same archive `dtk tune`'s Apply writes,
+excluded from metric discovery) and only then overwrites in place, so the
+text typed is what lands on disk, comments intact (normalized only to end
+with a newline). A save is refused when the file changed on disk after the
+editor was opened (a `dtk tune` Apply or another session saved first) —
+reopen the metric rather than overwrite it. Renaming via `name:`
+is allowed — uniqueness is enforced project-wide — and rows under the old name
+stay in the `_dtk_*` tables until `dtk clean`. **Delete** lives in the edit
+overlay behind an explicit confirmation step, and the server additionally
+requires the request to echo the metric name back; it archives the file
+(`…-deleted.yml`) before removing it, so a delete is reversible by hand, and
+its `_dtk_*` rows likewise remain until `dtk clean`. While a `dtk tune` session
+for that metric is running, Save and Delete are refused (its Apply would race
+the edit). Like the rest of `dtk ui`, metric management takes no pipeline lock
+and never touches the database — it only manages metric YAML files.
+
 ## `dtk test-alert <metric>`
 
 Sends a mock alert (fake value/CI/severity) through the metric's configured

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/rules/detectors.md

@@ -66,6 +66,7 @@ expected interval for the current point.
     window_weights: null     # null (uniform) | exponential | linear
     half_life: null          # exponential half-life: int points or "3d"/"12h"
     detrend: null            # null | linear
+    stabilization: null      # null (off) | clamp
     # --- execution (NOT hashed) ---
     start_time: "2024-01-01 00:00:00"   # optional; when detection begins (default: loading_start_time)
     batch_size: 500
@@ -161,6 +162,24 @@ Trade-off: a shorter `half_life` adapts faster but also "accepts" a real
 sustained degradation as the new normal sooner. (`weight_decay` is a deprecated
 alias for `half_life`; prefer `half_life`.)
 
+## Stabilization — sustained incidents poisoning their own baseline
+
+A sustained incident's anomalous points enter the trailing window and inflate
+the spread / drag the center toward it, so the band widens mid-incident and the
+detector stops flagging the tail ("the incident becomes the new normal") —
+z-score (mean/std) is the most vulnerable; median/quartile-based mad/iqr resist
+short incidents but still bend under a long one. `stabilization: clamp` fixes
+this: once a point is flagged anomalous, subsequent trailing windows see it
+**clamped to the confidence bound it violated** (winsorized) instead of the
+raw value — only the statistics windows read the substituted history; scored
+and persisted values are unchanged, and anomalies still render as anomalies.
+Reach for it when alerting on metrics with occasional sustained incidents; it
+composes with `window_weights`/`half_life` (where it matters most, since
+recency weighting gives an ongoing incident's points more weight), `detrend`,
+`smoothing`, `input_type` and seasonality groups, and is near-neutral on clean
+series. Enabling it is a hashed change — it produces a new `detector_id` and
+recomputes on the next run; existing configs that don't set it keep their ids.
+
 ## Feature compatibility
 
 | Feature | mad | zscore | iqr | manual_bounds |
@@ -169,6 +188,7 @@ alias for `half_life`; prefer `half_life`.)
 | `smoothing` | Yes | Yes | Yes | No |
 | `window_weights` / `half_life` | Yes | Yes | Yes | No |
 | `detrend` | Yes | Yes | Yes | No |
+| `stabilization` | Yes | Yes | Yes | No |
 | `seasonality_components` | Yes | Yes | Yes | No |
 
 `manual_bounds` has no window, so window-based features don't apply.
@@ -177,9 +197,9 @@ alias for `half_life`; prefer `half_life`.)
 
 Every parameter that affects results (threshold, window_size, min_samples,
 seasonality_components, min_samples_per_group, input_type, smoothing*,
-window_weights, half_life, detrend) is hashed into the `detector_id` — only
-non-default values participate. Execution params (`start_time`, `batch_size`)
-are **not** hashed.
+window_weights, half_life, detrend, stabilization) is hashed into the
+`detector_id` — only non-default values participate. Execution params
+(`start_time`, `batch_size`) are **not** hashed.
 
 Changing any hashed parameter creates a new `detector_id` and recomputes that
 detector's detections from scratch on the next run; old rows stay under the

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/rules/overview.md

@@ -97,6 +97,12 @@ series, watch the band recompute live, then write the config back into the metri
 — use `dtk tune --select <m>`, the interactive sibling of `dtk autotune`
 (`cli.md`).
 
+For a **live**, project-wide view instead of a one-off file, run `dtk ui`: the
+same reports in a browser overlay plus an overview table (alert frequency,
+freshness, quality when incidents are labeled), a panel that drives
+`dtk run` / `dtk autotune` / `dtk unlock`, and an in-browser editor to create,
+edit and delete metric YAML files. See `cli.md`.
+
 ## Glossary
 
 - **metric** — a named time series (SQL + interval) you monitor.

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/skills/dtk-new-metric/SKILL.md

@@ -15,6 +15,14 @@ need detail on any field, read the matching file under
 `.claude/rules/detectkit/` (`metrics.md`, `detectors.md`, `alerting.md`,
 `project.md`); this skill is the procedure, those are the reference.
 
+`dtk ui` also has a browser editor for metric YAMLs (a **New metric** button
+and, per row, an **Edit** action), validated the same way before it writes.
+Prefer this skill when scaffolding from scratch — it gathers the query,
+detector and alerting choices and explains each one in context; prefer the UI
+for a quick manual edit while you're already watching the cockpit (nudging a
+threshold, adding a channel) — it's a raw-YAML editor with no procedure behind
+it.
+
 ## Step 0 — Confirm you're in a detectkit project
 
 A project root contains `detectkit_project.yml`. Verify it exists in the target

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/cli/assets/claude/skills/dtk-tune/SKILL.md

@@ -101,7 +101,10 @@ Walk the user to the mode that fits what they want to do:
   **window size**, **recency weighting + half-life**, **detrend**, **smoothing**,
   and **seasonality groups**; the band + anomalies + would-fire alerts recompute
   on every change. The window-size / half-life readouts show the equivalent
-  wall-clock span. This is the core "turn the knobs yourself" loop.
+  wall-clock span. **Stabilization** (none / clamp) clamps a flagged point to
+  the bound it violated in later windows' statistics — try it when a sustained
+  incident visibly balloons the band mid-incident and the detector stops
+  flagging its tail. This is the core "turn the knobs yourself" loop.
 
 - **Autotune** — *let the engine search, then refine.* Click **Run autotune** and
   the **same engine `dtk autotune` uses** (seasonality → detector → grid → window,

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/config/metric_config.py

@@ -890,8 +890,9 @@ class MetricConfig(BaseModel):
         if not data:
             raise ValueError(f"Empty metric config file: {path}")
 
-        # Support nested structure: metric: { ... }
-        if "metric" in data and isinstance(data["metric"], dict):
-            data = data["metric"]
+        # Support nested structure: metric: { ... } (shared unwrap seam)
+        from detectkit.config.metric_io import unwrap_metric_mapping
+
+        data = unwrap_metric_mapping(data)
 
         return cls.model_validate(data)

detectkit-0.51.0/detectkit/config/metric_io.py

@@ -0,0 +1,90 @@
+"""Shared low-level seams for metric YAML files.
+
+Three tiny helpers that were previously re-implemented per caller and had
+already started to drift (``tuning/config_writer.py``'s archive write had no
+same-second collision handling; the nested-form unwrap lived in four copies):
+
+- :func:`unwrap_metric_mapping` — the nested ``metric: {...}`` form accepted
+  everywhere a metric YAML is read (``MetricConfig.from_yaml_file``, the tune
+  write-back, the ``dtk ui`` editor).
+- :func:`safe_metric_stem` — a metric name reduced to one safe path component
+  (filenames, ``.history`` archive keys).
+- :func:`archive_metric_text` — the ``metrics/.history/<metric>/`` verbatim
+  archive convention shared by ``dtk tune``'s Apply and ``dtk ui``'s
+  update/delete, collision-safe within one UTC second.
+
+No imports from the rest of detectkit — safe to use from any layer.
+"""
+
+from __future__ import annotations
+
+import re
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+_SAFE_CHAR_RE = re.compile(r"[A-Za-z0-9_.\-]")
+
+
+def unwrap_metric_mapping(data: dict[str, Any]) -> dict[str, Any]:
+    """The metric body of a parsed YAML mapping — unwraps the nested ``metric: {...}`` form.
+
+    Returns the **same object reference** for the flat form and the nested
+    body for the wrapped form, so in-place mutations (the tune write-back
+    edits the body inside the original document) behave identically.
+    """
+    nested = data.get("metric")
+    return nested if isinstance(nested, dict) else data
+
+
+def safe_metric_stem(name: str) -> str:
+    """A single safe path component for a metric name — sanitized, never refused.
+
+    ``MetricConfig`` accepts names (unicode letters, a leading ``-``) that make
+    unsafe or awkward filenames; rather than rejecting a valid metric, every
+    character outside the safe set is replaced with ``_`` and leading dots or
+    dashes are stripped. Path separators can never survive, so the result is
+    always one component; a same-stem collision surfaces as "file already
+    exists". Used for created files' stems and ``.history`` archive keys.
+    """
+    stem = "".join(c if _SAFE_CHAR_RE.fullmatch(c) else "_" for c in name)
+    stem = stem.lstrip(".-")
+    return stem or "metric"
+
+
+def metric_stamp(now: datetime | None = None) -> str:
+    """UTC filesystem-safe timestamp (``20260709T101530Z``) used in archive filenames."""
+    now = now or datetime.now(timezone.utc)
+    return now.strftime("%Y%m%dT%H%M%SZ")
+
+
+def archive_metric_text(
+    project_root: Path,
+    metric_name: str,
+    text: str,
+    *,
+    suffix: str = "",
+    stamp: str | None = None,
+    now: datetime | None = None,
+) -> Path:
+    """Write *text* verbatim into ``metrics/.history/<key>/`` and return the path.
+
+    The directory key is the **sanitized** metric name (:func:`safe_metric_stem`)
+    — at archive time the name can be attacker/editor-influenced free text
+    (an on-disk ``name:`` changed after boot), and joining it raw into a path
+    would let ``../`` or an absolute component escape ``metrics/.history/``.
+    Two archives within the same UTC second get ``-1``, ``-2``, … suffixes so
+    a tune Apply and a UI save landing together never overwrite each other's
+    snapshot.
+    """
+    key = safe_metric_stem(metric_name)
+    archive_dir = project_root / "metrics" / ".history" / key
+    archive_dir.mkdir(parents=True, exist_ok=True)
+    base = f"{key}-{stamp or metric_stamp(now)}{suffix}"
+    archive_path = archive_dir / f"{base}.yml"
+    counter = 1
+    while archive_path.exists():
+        archive_path = archive_dir / f"{base}-{counter}.yml"
+        counter += 1
+    archive_path.write_text(text, encoding="utf-8")
+    return archive_path

{detectkit-0.49.2 → detectkit-0.51.0}/detectkit/detectors/statistical/_windowed.py

@@ -48,6 +48,7 @@ _CHANGE_INPUT_TYPES = {"changes", "absolute_changes", "log_changes"}
 _SMOOTHING_METHODS = {None, "ema", "sma"}
 _WEIGHT_METHODS = {None, "exponential", "linear"}
 _DETREND_METHODS = {None, "linear"}
+_STABILIZATION_METHODS = {None, "clamp"}
 
 
 class WindowedStatDetector(BaseDetector):
@@ -88,6 +89,18 @@ class WindowedStatDetector(BaseDetector):
             compute statistics on values projected to the current point.
             Recommended for metrics with a gradual trend so the slow
             drift itself is not flagged as anomalous.
+        stabilization (str | None): None (default) or "clamp" — when a
+            point is flagged anomalous, subsequent trailing windows see
+            the confidence bound it violated (winsorized value) instead
+            of the observed value. Keeps a long incident from poisoning
+            the baseline (inflating spread / dragging the center toward
+            the incident), so the detector keeps flagging it instead of
+            adapting to it. Clamping to the bound (not the center) is
+            deliberate: substituting the band center feeds zero-deviation
+            points back into the spread statistics, which collapses the
+            band and cascades into false flags after a long incident.
+            The scored/persisted values are unchanged — only the
+            statistics windows read the substituted history.
 
     All parameters that change detection output participate in the
     detector ID hash (only non-default values are hashed).
@@ -124,6 +137,7 @@ class WindowedStatDetector(BaseDetector):
         half_life: int | str | None = None,
         weight_decay: float | None = None,
         detrend: str | None = None,
+        stabilization: str | None = None,
     ):
         super().__init__(
             threshold=self.THRESHOLD_DEFAULT if threshold is None else threshold,
@@ -143,6 +157,7 @@ class WindowedStatDetector(BaseDetector):
             half_life=half_life,
             weight_decay=weight_decay,
             detrend=detrend,
+            stabilization=stabilization,
         )
         # Whether the one-time "seasonality groups can't fill this window" check
         # has run for this instance (so the warning fires at most once per run,
@@ -235,6 +250,10 @@ class WindowedStatDetector(BaseDetector):
         if detrend not in _DETREND_METHODS:
             raise ValueError(f"Unknown detrend method: {detrend}. Supported: linear")
 
+        stabilization = p.get("stabilization")
+        if stabilization not in _STABILIZATION_METHODS:
+            raise ValueError(f"Unknown stabilization method: {stabilization}. Supported: clamp")
+
     # ------------------------------------------------------------------
     # Identity
     # ------------------------------------------------------------------
@@ -254,6 +273,7 @@ class WindowedStatDetector(BaseDetector):
             "half_life": None,
             "weight_decay": None,
             "detrend": None,
+            "stabilization": None,
         }
 
     def _get_non_default_params(self) -> dict[str, Any]:
@@ -291,6 +311,15 @@ class WindowedStatDetector(BaseDetector):
         if self.params.get("input_type", "values") in _CHANGE_INPUT_TYPES:
             context += 1
 
+        if self.params.get("stabilization"):
+            # A point's substituted-history state depends on whether its own
+            # window points were flagged, which depends on THEIR windows. One
+            # extra window of warm-up lets every context point be scored on a
+            # full window, so incremental batches reproduce the same
+            # substitution history as a continuous run (residual differences
+            # decay geometrically past that).
+            context += int(self.params.get("window_size", 0) or 0)
+
         return context
 
     def _resolve_half_life_points(self, timestamps: np.ndarray) -> float:
@@ -463,12 +492,22 @@ class WindowedStatDetector(BaseDetector):
             "min_samples_per_group", self.MIN_SAMPLES_PER_GROUP_DEFAULT
         )
         detrend = self.params.get("detrend")
+        stabilization = self.params.get("stabilization")
         weighted = self.params.get("window_weights") is not None
 
         # STEP 0: Preprocessing (smoothing first, then input_type)
         smoothed_values = self._apply_smoothing(values)
         processed_values = self._preprocess_input(smoothed_values)
 
+        # Stabilization (opt-in): statistics windows read from a working copy
+        # where every previously-flagged point is clamped to the confidence
+        # bound it violated, so an ongoing incident cannot inflate the spread
+        # or drag the center toward itself. The scored value and the persisted
+        # processed_value stay the raw observations; genuinely missing (NaN)
+        # points are never substituted.
+        work_values = processed_values.copy() if stabilization else processed_values
+        replaced = np.zeros(len(processed_values), dtype=bool) if stabilization else None
+
         seasonality_dict = {}
         if seasonality_components and len(seasonality_data) > 0 and seasonality_columns:
             seasonality_dict = parse_seasonality_data(seasonality_data, seasonality_columns)
@@ -498,9 +537,11 @@ class WindowedStatDetector(BaseDetector):
                 )
                 continue
 
-            # Trailing window, current point excluded
+            # Trailing window, current point excluded. Both the global slice
+            # and the seasonality-group slices below read window_processed, so
+            # sourcing it from work_values covers every statistics consumer.
             window_start = max(0, i - window_size)
-            window_processed = processed_values[window_start:i]
+            window_processed = work_values[window_start:i]
             valid_mask = ~np.isnan(window_processed)
             window_valid = window_processed[valid_mask]
 
@@ -586,6 +627,14 @@ class WindowedStatDetector(BaseDetector):
                 current_processed > confidence_upper
             )
 
+            # Stabilization write-back: later windows see this point clamped
+            # to the bound it violated, not the anomalous observation.
+            if stabilization == "clamp" and is_anomaly:
+                work_values[i] = (
+                    confidence_lower if current_processed < confidence_lower else confidence_upper
+                )
+                replaced[i] = True  # type: ignore[index]
+
             # STEP 5: Metadata
             metadata: dict[str, Any] = {}
             for name, _ in self.STATS:
@@ -598,6 +647,10 @@ class WindowedStatDetector(BaseDetector):
                 metadata["ess"] = round(effective_sample_size(weights), 1)
             if detrend == "linear":
                 metadata["trend_slope_per_point"] = float(slope)
+            if replaced is not None:
+                n_replaced = int(np.count_nonzero(replaced[window_start:i]))
+                if n_replaced:
+                    metadata["stabilized_in_window"] = n_replaced
 
             if self.params.get("smoothing") or self.params.get("input_type") != "values":
                 metadata["preprocessing"] = {