SAFETY-73: a battery that refuses, per inverter, with two or more

SAFETY-52's hold applied per unit at N>1 (owner, 2026-09-27, option R).
A unit that gives < 100 W for 12 cycles in one direction while asked
> 200 W, or trips its stale-reading gate on a ~0 W reading, gets a
P_SAFETY `refused` unit limit closing that direction, so the allocator
hands its share to the others within their own limits. Probe: a +-200 W
pin every 15 min, one unit at a time, only while the site asks 200 W that
way. All units refusing: the site law holds 0 W. Exits reseed the site
target from the wire. INFO plus one WARNING (REFUSES_ABOVE_CUT_OUT) above
the configured cut-out; SAFETY-42/43 no longer report a refusing unit.
N=1 unchanged.

test_refusal_units.py: cases a/b/c on flat and jitter registers against
the old behaviour, probes, recovery, exits; mutations U1-U13 all red.
TEST-19 no-fault campaign: 0 engagements in 5280 runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/app/arbiter.py

@@ -226,6 +226,12 @@ CLAIM_SCOPE = {
     # reaches the allocator, so a unit-scoped claim is the shape that sentence
     # asks for rather than an evasion of it.
     "pack": SCOPE_UNIT,
+    # main.py: `Claim.limit("refused", P_SAFETY, ...)` and, during a probe,
+    # `Claim.set("refused", P_SAFETY, +-PROBE_W)`. SAFETY-73: THIS battery gives
+    # nothing in one direction, measured on THIS unit's own reading. A hard unit
+    # limit that always intersects, so the share goes to the siblings. Filed at
+    # N>1 only; at N=1 SAFETY-52's law in compute() does the same job.
+    "refused": SCOPE_UNIT,
     # main.py: `Claim.set("maintenance", P_MAINTENANCE, ...)` when the cycle owns
     # the setpoint, and `Claim.limit("maintenance", P_MAINT_SHAPE, hi=...)` when
     # it only shapes. §12's monthly recalibration is a PACK procedure - drain

goodwe_controller/app/inverter.py

@@ -317,6 +317,16 @@ class Inverter:
             tripped=bool(data.get(self.key("delivery_tripped"), False)),
             reason=str(data.get(self.key("delivery_reason"), "") or ""))
 
+        # SAFETY-73. The direction this unit's battery refuses (+1 give, -1
+        # take, 0 none), when that refusal or its last probe started, the
+        # current probe's start, and the cycles of evidence so far. Memory
+        # only, like SAFETY-52's: stop and start end it. Used at N>1 only.
+        self.refused = 0
+        self.refused_at = None
+        self.probe_from = None
+        self.ref_count = 0
+        self.ref_sign = 0
+
     # -- store ---------------------------------------------------------------
     def key(self, name: str) -> str:
         """This unit's namespaced Store key for `name`. See store.unit_key()."""
@@ -411,6 +421,13 @@ class Inverter:
         return (messages.row_battery_stuck(self.name) if self.batt_fresh.stale
                 else "")
 
+    def refusal_note(self) -> str:
+        """SAFETY-73's status row while this unit's battery refuses."""
+        if not self.refused:
+            return ""
+        return messages.row_battery_refuses(self.name, self.refused,
+                                            self.probe_from is not None)
+
     def link_note(self, now: datetime) -> str:
         """One line for the status page. Empty when there is nothing to say.
 

goodwe_controller/app/main.py

@@ -28,6 +28,7 @@ import contextlib
 import functools
 import json
 import logging
+import math
 import signal
 import time
 from datetime import datetime, timedelta, timezone
@@ -234,6 +235,11 @@ def pack_energy_of(inv):
                                 inv.capacity_kwh, inv.max_w)
 
 
+def _refused_interval(sign: int) -> tuple:
+    """SAFETY-73: the (lo, hi) a refusing unit may be asked: 0 W that way."""
+    return (-math.inf, 0.0) if sign > 0 else (0.0, math.inf)
+
+
 def why_key(winner: str, claims) -> str:
     """The key of `messages.WHY_WINNER` for a resolution's winner.
 
@@ -1121,6 +1127,19 @@ class Controller:
         """
         t = self.tuning
         standing = inv.standing_w()
+        if len(self.inverters) > 1:
+            # SAFETY-73: at N>1 the same trip refuses THIS unit only.
+            if ((self.auto or self.shadow) and not inv.refused
+                    and inv.ref_count >= t.saturation_cycles
+                    and inv.batt_fresh.held is not None
+                    and abs(inv.batt_fresh.held) < _ctl.REFUSED_BELOW_W
+                    and abs(standing) > _ctl.PROBE_W):
+                self._now_mono = now_mono
+                self._unit_refusal_start(
+                    inv, 1 if standing > 0 else -1,
+                    f"stale reading {inv.batt_fresh.held:+.0f} W while asked "
+                    f"{standing:+.0f} W")
+            return
         if (len(self.inverters) == 1 and (self.auto or self.shadow)
                 and not self.batt_refused
                 and self.sat_count >= t.saturation_cycles
@@ -1132,6 +1151,111 @@ class Controller:
                                 f"stale reading {inv.batt_fresh.held:+.0f} W "
                                 f"while asked {standing:+.0f} W")
 
+    # --- SAFETY-73: the same refusal, per inverter, at N>1 -------------------
+    # SAFETY-52's decisions applied to one unit of several: a unit that gives
+    # < REFUSED_BELOW_W for SETTLE_CYCLES while asked > PROBE_W is closed in
+    # that direction by a P_SAFETY unit limit, so the allocator hands its share
+    # to the others; it is probed at PROBE_W every PROBE_EVERY_S, one unit at a
+    # time. The ask is PROBE_W, not `saturation_w`: a unit's share is often
+    # small (a 400 W night load split two ways) and SAFETY-43 would otherwise
+    # name the empty battery as not delivering. DECISIONS/SAFETY-73.
+    def _unit_refusal_start(self, inv, sign: int, evidence: str) -> None:
+        inv.refused, inv.refused_at = sign, self._now_mono
+        inv.probe_from, inv.ref_count = None, 0
+        self.log_event(f"BATTERY REFUSES {inv.name}: {evidence}",
+                       hint=messages.hint("unit_refuses", unit=inv.name))
+        _LOG.info("%s: the battery refuses power, so it is asked 0 W and the "
+                  "other inverters take over: BATTERY_REFUSES.", inv.name)
+        _LOG.debug("Evidence for %s: BATTERY_REFUSES: %s.", inv.name, evidence)
+        if (inv.soc is not None and inv.bms_soc_floor is not None
+                and float(inv.soc) > float(inv.bms_soc_floor)):
+            # Owner decision 3: a refusal above the configured cut-out level
+            # may mean that level is set wrong. One line, no safety stop.
+            _LOG.warning("%s refuses power above its battery cut-out level, "
+                         "check its cut-out level: REFUSES_ABOVE_CUT_OUT.",
+                         inv.name)
+            _LOG.debug("Evidence for %s: REFUSES_ABOVE_CUT_OUT: battery level "
+                       "%.0f %%, cut-out level %.0f %%.", inv.name,
+                       float(inv.soc), float(inv.bms_soc_floor))
+
+    def _unit_refusal_end(self, inv, why: str) -> None:
+        if not inv.refused:
+            return
+        inv.refused, inv.refused_at, inv.probe_from = 0, None, None
+        inv.ref_count = 0
+        self.log_event(f"BATTERY REFUSES ENDED {inv.name}: {why}",
+                       hint=messages.hint("unit_gives", unit=inv.name))
+        _LOG.info("%s: the battery refusal ends, it is asked for power again: "
+                  "%s.", inv.name, why)
+        # The site target may stand above what was placed (the refused share
+        # was unmet). Restart it from the watts on the wire, or the reopened
+        # unit is handed the parked remainder at once (phase A: -1059 W).
+        placed = float(sum(i.standing_w() for i in self.inverters))
+        self.target = self.i_w = placed
+        self.sat_count = 0
+
+    def _unit_probe(self, inv) -> bool:
+        """True while `inv` may try PROBE_W. One unit probes at a time."""
+        now = self._now_mono
+        if not inv.refused or inv.refused_at is None or now is None:
+            return False
+        if inv.probe_from is not None:
+            if now - inv.probe_from < _ctl.PROBE_S:
+                return True
+            inv.probe_from, inv.refused_at = None, now
+            return False
+        if now - inv.refused_at < _ctl.PROBE_EVERY_S or any(
+                i.probe_from is not None for i in self.inverters):
+            return False
+        inv.probe_from = now
+        return True
+
+    def _unit_refusals(self) -> None:
+        """Engage and end each unit's refusal from its own reading."""
+        for inv in self.inverters:
+            b = inv.batt
+            if inv.refused:
+                if b is not None and inv.refused * b >= _ctl.PROBE_ANSWER_W:
+                    self._unit_refusal_end(
+                        inv, "the probe was answered"
+                        if inv.probe_from is not None
+                        else "the battery gives power")
+                    continue
+                # The other direction: the battery takes PROBE_ANSWER_W or more
+                # the other way (charge at the floor) for SETTLE_CYCLES. Counted
+                # on its own reading, so one cycle of the loop overshooting
+                # through zero does not hand it its share back.
+                inv.ref_count = (inv.ref_count + 1 if b is not None and
+                                 -inv.refused * b >= _ctl.PROBE_ANSWER_W else 0)
+                if inv.ref_count >= _ctl.SETTLE_CYCLES:
+                    self._unit_refusal_end(
+                        inv, "the battery takes power the other way")
+                continue
+            if b is None:
+                continue        # a gap keeps the count: the gate's trip seeds
+            standing = inv.standing_w()
+            sign = 1 if standing > 0 else -1
+            # One direction throughout: a command that swaps sign every cycle
+            # (a flapping load) reads ~0 through the plant's own lag, and that
+            # is a battery following, not refusing (TEST-19 flapping family).
+            if abs(standing) > _ctl.PROBE_W and abs(b) < _ctl.REFUSED_BELOW_W:
+                inv.ref_count = (min(inv.ref_count + 1, _ctl.SETTLE_CYCLES)
+                                 if sign == inv.ref_sign else 1)
+            else:
+                inv.ref_count = 0
+            inv.ref_sign = sign
+            if inv.ref_count >= _ctl.SETTLE_CYCLES:
+                self._unit_refusal_start(
+                    inv, sign,
+                    f"asked {standing:+.0f} W, the battery gave {b:+.0f} W "
+                    f"for {_ctl.SETTLE_CYCLES} cycles")
+
+    def _site_refused(self):
+        """Owner decision 4: every unit refuses the same way, so the site law
+        holds 0 W (SAFETY-52's, in compute()). Otherwise None, the old law."""
+        signs = {inv.refused for inv in self.inverters}
+        return signs.pop() if len(signs) == 1 and 0 not in signs else None
+
     def log_event(self, msg: str, hint: str | None = None) -> None:
         """`msg` goes on the action log, the add-on's own technical record.
         `hint` is `messages.hint()`'s plain words for the same event, and is
@@ -2516,7 +2640,8 @@ class Controller:
         now = datetime.now(timezone.utc)
         return [n for n in
                 [x for inv in self.inverters
-                 for x in (inv.link_note(now), inv.stale_note())]
+                 for x in (inv.link_note(now), inv.stale_note(),
+                           inv.refusal_note())]
                 if n]
 
     async def cycle(self) -> None:
@@ -2810,7 +2935,13 @@ class Controller:
                     # what part 6 grades instead is that WIDENING the window
                     # changes the answer.
                     live=inv.is_live(now)[0],
-                    parked=inv.sign_wd.tripped,
+                    # SAFETY-73: a refusing unit is asked 0 W on purpose, and
+                    # one asked under PROBE_W that gives under 100 W is a
+                    # refusal too small to call (its sibling covers the meter).
+                    parked=inv.sign_wd.tripped or bool(inv.refused) or (
+                        n_units > 1 and inv.batt is not None
+                        and abs(float(standing[inv.name])) <= _ctl.PROBE_W
+                        and abs(float(inv.batt)) < _ctl.REFUSED_BELOW_W),
                     # ⚠️ THIS UNIT'S OWN CUT-OUT. Not the shipped 10 %, and not
                     # the site's `peak_soc_floor` either - that one bounds a
                     # money-saving discharge only, and grading a pack against it
@@ -3422,6 +3553,16 @@ class Controller:
             self._refusal_auto = bool(self.auto)
             self._refusal_end("control started" if self.auto
                               else "control stopped")
+            for inv in (self.inverters if len(self.inverters) > 1 else ()):
+                self._unit_refusal_end(inv, "control started" if self.auto
+                                       else "control stopped")
+        # SAFETY-73: each unit's own refusal, engaged and ended on its own
+        # reading, before the loop reads `self.target` (an end reseeds it).
+        _probing = {}
+        if len(self.inverters) > 1 and self.inputs_ok:
+            self._unit_refusals()
+            _probing = {inv.name: self._unit_probe(inv)
+                        for inv in self.inverters if inv.refused}
         if (self.auto or self.shadow) and self.inputs_ok:
             # ⚠️ prev is the ARBITER's last output, not the loop's own last
             # wish. If something outranked the loop, that is what the hardware
@@ -3446,6 +3587,8 @@ class Controller:
             if self.loop_w is not None and self.target != self.loop_w:
                 self._refusal_end("another writer")
             probe = self._refusal_probe()
+            if len(self.inverters) > 1:
+                probe = any(_probing.values())
             # ⚠️ `actual_w` IS THE SITE SUM AND THAT IS DEV-02's OTHER HALF.
             # The anti-windup test inside compute() is
             # `abs(prev_w - actual_w) > saturation_w`, and `prev_w` is the SITE
@@ -3476,7 +3619,10 @@ class Controller:
                 i_w=self.i_w,
                 # SAFETY-52 at one inverter only: with several, OPT-09's pack
                 # limit already closes an empty battery's discharge end.
-                refused=self.batt_refused if len(self.inverters) == 1 else None,
+                # SAFETY-73: at N>1 the site law holds 0 W only while every
+                # unit refuses the same way. Otherwise None, the old law.
+                refused=self.batt_refused if len(self.inverters) == 1
+                else self._site_refused(),
                 probe=probe,
             )
             if decision.frozen and self.sat_count < self.tuning.saturation_cycles:
@@ -3486,7 +3632,8 @@ class Controller:
             self.sat_count = decision.sat_count
             self.i_w = decision.i_w
             self.loop_w = decision.target_w
-            self._refusal_update(decision, loop_prev, site_batt, probe)
+            if len(self.inverters) == 1:
+                self._refusal_update(decision, loop_prev, site_batt, probe)
             # --- TEL-10 ------------------------------------------------------
             # ⚠️ THE INTEGRATOR HAS NEVER LEFT THIS PROCESS, AND THAT IS WHAT
             # THE CARD IS. `self.i_w` is carried between cycles and published
@@ -3585,8 +3732,44 @@ class Controller:
         # ability to DELIVER rests on this argument - a weight cannot stop a
         # unit being commanded and cannot move a failing unit's load to its
         # sibling. The `pack` claim filed above is the half that constrains.
-        resolution = resolve(claims, units=self.units, live=self.live_units(),
-                             weights=self.pack_weights, tick=self.alloc_tick)
+        # --- SAFETY-73: each refusing unit's own P_SAFETY claim ---------------
+        # A hard unit limit that always intersects (OPT-11's P_MODE layer sits
+        # inside it): closed in the refused direction, so the allocator hands
+        # the share to the others within their own limits. During its probe it
+        # is a pin at PROBE_W and the others carry the rest.
+        for inv in self.inverters:
+            if not inv.refused:
+                continue
+            if _probing.get(inv.name):
+                claims.append(Claim.set("refused", P_SAFETY,
+                                        inv.refused * _ctl.PROBE_W,
+                                        _ctl.PROBING,
+                                        actuator=self.actuator_of("refused",
+                                                                  inv)))
+            else:
+                claims.append(Claim.limit("refused", P_SAFETY,
+                                          *_refused_interval(inv.refused),
+                                          _ctl.REFUSED,
+                                          actuator=self.actuator_of("refused",
+                                                                    inv)))
+        _live = self.live_units()
+        while True:
+            resolution = resolve(claims, units=self.units, live=_live,
+                                 weights=self.pack_weights, tick=self.alloc_tick)
+            # SAFETY-73: a probe pin stands only while the resolved site target
+            # asks at least PROBE_W its way. Below that a sibling would carry
+            # the opposite direction (circulation), so the pin goes back to the
+            # closed limit and the split is resolved once more.
+            _void = [k for k, c in enumerate(claims)
+                     if c.source == "refused" and c.kind == "set"
+                     and c.value * resolution.target_w < _ctl.PROBE_W ** 2]
+            if not _void:
+                break
+            for k in _void:
+                claims[k] = Claim.limit(
+                    "refused", P_SAFETY,
+                    *_refused_interval(1 if claims[k].value > 0 else -1),
+                    _ctl.REFUSED, actuator=claims[k].actuator)
         self.allocation = resolution.allocation
         # --- THE TWO REFUSALS, AND THEY ARE NOT THE SAME REFUSAL --------------
         # Both do the same thing - REPLACE the resolution with a 0 W failsafe
@@ -5114,7 +5297,8 @@ class Controller:
         _now = datetime.now(timezone.utc)
         for inv in self.inverters:
             for note, red in ((inv.link_note(_now), not inv.is_live(_now)[0]),
-                              (inv.stale_note(), False)):
+                              (inv.stale_note(), False),
+                              (inv.refusal_note(), False)):
                 if note:
                     out.append({"ok": False, "warn": not red, "text": note})
 

goodwe_controller/app/messages.py

@@ -786,6 +786,14 @@ def row_battery_stuck(unit) -> str:
             f"for now")
 
 
+def row_battery_refuses(unit, sign, probing) -> str:
+    """SAFETY-73. One inverter's battery refuses, the others take its share."""
+    way = "give" if sign > 0 else "take"
+    if probing:
+        return f"{unit}: testing if the battery will {way} power again"
+    return f"{unit}: the battery refuses to {way} power, the others take over"
+
+
 # The top of the page: why the battery does what it does (the "Why" line).
 WHY_WINNER = {
     "loop": "Keeping the grid near zero",
@@ -805,6 +813,8 @@ WHY_WINNER = {
     # SAFETY-52: the loop's two words for a battery that gives nothing.
     "battery refuses": "The battery refuses to give power",
     "battery probe": "Testing if the battery gives power again",
+    # SAFETY-73: a refusing inverter's own claim, closed or probing.
+    "refused": "A battery refuses power, the others take over",
 }
 WHY_LIMIT = {
     "peak(quarter peak)": "the peak limit",
@@ -815,6 +825,7 @@ WHY_LIMIT = {
     "pack": "the battery level",
     "reserve": "the battery reserve",
     "maintenance": "battery maintenance",
+    "refused": "a battery that refuses power",
 }
 
 
@@ -857,6 +868,8 @@ HINTS = {
     "battery_back": "{unit}: battery power reading is used again",
     "battery_refuses": "The battery refuses to give power, the add-on asks 0 W",
     "battery_gives": "The battery refusal ended, control asks for power again",
+    "unit_refuses": "{unit}: the battery refuses power, the others take over",
+    "unit_gives": "{unit}: the battery refusal ended, it is asked for power again",
     "bad_value": "The add-on made an invalid power value, inverters set to 0 W",
     "write_blocked": "{unit}: a power request was blocked, it is set to 0 W",
     "all_blocked": "A power request was blocked, inverters set to 0 W",
@@ -1027,6 +1040,12 @@ def status_samples() -> list:
         ("row_peak_guard_on", AMBER, row_peak_guard_on(1200, 2500,
                                                        shadow=True)),
         ("row_battery_stuck", AMBER, row_battery_stuck("inverter-b")),
+        ("row_battery_refuses", AMBER, row_battery_refuses("inverter-b", 1,
+                                                           False)),
+        ("row_battery_refuses", AMBER, row_battery_refuses("inverter-b", -1,
+                                                           False)),
+        ("row_battery_refuses", AMBER, row_battery_refuses("inverter-b", 1,
+                                                           True)),
         ("row_circulating_check", GREEN, row_circulating_check(0, 0, 60)),
     ]