Optional threshold layer.

The core detector emits φ values; this module turns them into :suspected / :recovered events with hysteresis. Thresholding is policy, not detection — the library keeps it out of the core so that consumers can:

• run multiple thresholds concurrently (e.g. φ=4 for dashboards, φ=8 for automated routing), each a separate instance,
• skip this module entirely and roll their own hysteresis,
• filter on confidence, :recovering state, etc. without touching the detector.

Events

Subscribes to [:phi_accrual, :phi, :computed]. Emits:

• [:phi_accrual, :threshold, :suspected] when φ crosses suspect_at from below,
• [:phi_accrual, :threshold, :recovered] when φ crosses recover_at from above.

Both events include %{node: node(), instance: name, threshold: ...} in metadata. The instance tag lets you disambiguate multiple threshold modules sharing the same event namespace.

Hysteresis

recover_at must be strictly less than suspect_at. Default band: suspect at 8.0, recover at 7.0. Widen the band if you see flapping around the boundary.

φ events for nodes in :insufficient_data state are ignored — φ is not meaningful there. :steady, :recovering, and :stale states all feed the threshold logic.