When a contract default changes, old policies must run under a pinned legacy profile - a silent clock swap is out-of-distribution on hardware

Symptom

The walk profile's gait clock moved from 0.40 s to 0.50 s for new training, but versions v5-v9 were all trained at 0.40 s - running them under the updated default would silently feed a 25% slower phase clock to policies that never saw one.

Context

The re-test runbook hard-codes --policy-profile legacy_walk_040 into every command for the old versions, with the warning not to omit the flag: the mismatch is invisible (no error, no crash) but puts the policy out of distribution on hardware, where the same file had already documented that off-clock operation collapses gait quality.

Change

Deployment profiles versioned per training era; historical policies permanently associated with their era's profile; runbooks write the profile flag explicitly rather than relying on defaults.

Outcome

Old policies stayed runnable and comparable after the contract moved on; the silent-mismatch failure mode was closed by convention.

Mechanism

Changing a shared default rebinds every old artifact to a contract it was not trained under; unlike a schema break, a value change produces no error - only degraded, unexplainable behavior. Version-pinned profiles make the binding explicit and permanent.

Applies when

• changing any default in the deployment contract (clock, scales, gains) while old policies remain in use
• writing runbooks that mix policy generations
• a re-tested old policy behaves worse than its era's records