Your keyboard promises a never-empty suggestion strip; how do you decide the quality floor below which a degraded suggestion is worse than the safe default?

## The promise is about rendering "The strip is never empty" is an interface guarantee: the row of candidates always has something in it, so the layout never jumps and the user never sees a hole. It says nothing about whether the candidates are worth looking at. Teams slide from one to the other during an incident — the strip is full, therefore we are fine — and that slide is what a stated floor prevents. ## What a degraded suggestion actually costs The costs are asymmetric, and the asymmetry is the whole argument: - A suggestion the user **ignores** costs almost nothing. It occupied space they were not going to use. - A suggestion the user **taps and then has to undo** costs a correction, a broken sentence, and a small amount of trust. - Lost trust does **not** recover when the scorer does. Acceptance is a learned habit: users who were burned glance at the strip less often, so the metric stays depressed for a while after the incident and the recovery looks like an unexplained slow regression. That lag is why a floor is worth stating in advance. It is also why the answer is not simply "always render something": a rung whose suggestions are wrong often enough to be tapped by mistake can cost more than the blank space it replaced. ## Three numbers that make a floor operable 1. **A relative acceptance floor per rung.** State each rung's acceptance rate as a fraction of the top rung's, measured continuously. If the global frequency-list rung is expected to hold, say, 40% of the personalised rung's acceptance and it is measured at 15%, it is not a degraded service — it is a defect in the fallback path, and it should be fixed or removed from the ladder. 2. **A budget for time spent degraded.** The share of keystrokes served below the top rung over a rolling window, treated exactly like an error budget: normal while unspent, a reason to stop shipping when exhausted. Without it, a permanently elevated degraded share never triggers anything, because a level that does not change never crosses a threshold. 3. **An abstain threshold.** When even the cheap rung has no candidate above a minimum score for this prefix, render the neutral default — the safe, obviously-generic candidates — rather than the top of a flat distribution. A flat distribution dressed as a confident suggestion is the case where tapping is most likely to be wrong. | rung | what the floor commits to | what breaching it means | |---|---|---| | personalised scorer | the product's normal quality | an incident on the model or feature path | | cached prediction | close to the top rung, with older inputs | entries are too old or too coarsely keyed to be useful | | frequency list | a stated fraction of the top rung | the fallback is not worth rendering; fix or drop the rung | | constant default | recognisably generic, never wrong-looking | it is being mistaken for a personalised suggestion | ## Who signs the number The floor is not a serving decision, because it spends user-visible quality to buy availability and capacity headroom. It belongs to whoever owns the product metric, with the serving team supplying the measurements. The practical form is a standing commitment reviewed on a cadence — what quality we promise while degraded, how often we permit being degraded — rather than a judgement made under pressure during an incident, which is the one time it will be made badly. ## What a lower floor buys, and what it costs A low floor is genuinely useful: it lets the system lean on the cheap rungs more, which means less headroom has to be held for the personalised path and more load can be shed before anything user-visible breaks. A high floor forces the opposite — the top rung must be available nearly always, which is bought with capacity and with engineering effort on the feature path. Stating the floor and the degraded-traffic budget together is what makes that trade explicit instead of accidental, and it is the honest answer to "how available does the scorer need to be?": as available as the floor and the budget jointly require, and no more. ## The failure mode a floor prevents Without a stated floor, every rung looks acceptable because it renders. The ladder grows a rung nobody has measured, the degraded share drifts up, and the product's quality erodes in a direction no single alert covers, because each individual response was a success. The floor turns that erosion into a measurable, ownable number.