Why doesn't one strange trace trigger a behavior drift alert?

Because drift is a property of a population’s behavior over time, not a verdict on any single trace, so one unusual session doesn’t fire it on its own.

A call site’s normal traffic already has variation in it: a retried step, a shortcut path, an edge case handled differently. Judging any one trace against a fixed threshold would either fire constantly on that ordinary variation, or get tuned so loose it catches nothing real. Tessary’s behavior_drift classifier instead watches whether an action, an order, or a path is showing up across many sessions at a rate the call site’s own history doesn’t support, which is a statement about a trend, not a ruling on one interaction.

That’s also why a new pattern doesn’t count as drift the moment it first appears. It has to recur across enough sessions to be a pattern before it’s treated as one, and only firings that clear that bar get grouped by cause and triaged.