THE CONTROL DECIDES THE ANSWER: A MATCHED-OPERATOR NULL FOR EXPLANATION CHANGE UNDER MODEL UPDATES

When a deployed model is updated in response to a distribution shift, its feature attributions move. Existing work measures how far they move and treats the residual, after conditioning on prediction change, as instability. That is not yet a criterion, because it carries no account of how far an explanation should have moved. We supply one. Using shift families whose Bayes-optimal predictor is available in closed form, we define a warranted-change reference w and decompose attribution change across an update into warranted, unwarranted and explainer-noise parts. The design turns on a control prior work does not use: a matched-operator null, applying the identical update to fresh source data, so treatment and control differ in the distribution alone and not in the amount of training. This changes the conclusion. Across 681 runs the null reproduces a median 82% of the movement that follows an update. On a no-shift placebo, where the answer is fixed by construction, it returns 1.02 on an MLP and 0.98 on gradient-boosted trees with exact TreeSHAP, while the seed-retraining floor prior work uses implicitly returns 0.32 and 1.90 on the same data, disagreeing with itself sixfold. We state the consequence for our own results instead of leaving it to be found: against that seed floor our headline effect is inverted (median 0.31), so the case for the matched null rests on the placebo. Applying the missing control to a published audit, 64% of its 45 settings produce movement smaller than refitting on a bootstrap resample of the same data. Unwarranted change is real but bounded: present across MLPs over a 609x parameter range, trees and a small ResNet, weaker on real census covariates, absent on DistilBERT. Magnitude indicates legitimacy only once an update completes the adaptation it implies, so it fails in the light-update regime auditors work in.