admin/goodwe-addon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SAFETY-43: delinquency measured against the ask, not against a flat 500 W
checks / unit (pull_request) Successful in 6m20s
Details

Browse Source 
`delivery.delinquent()` named a unit whose `short_by()` gap exceeded an
ABSOLUTE `min_w = Tuning.saturation_w = 500 W`. OPT-09's SoC-aware weights
shrink a low-headroom unit's share, and shrinking the share shrinks the gap, so
a unit standing at +125 W and delivering 0 W - 100 % delinquent - was never
named. Measured end to end on the real loop (test_packshare.py part 8b):

    load 1500 W, B wedged at 15 %, equal weights    named on 199/200 cycles
    load 1500 W, B wedged at 15 %, OPT-09 weights   named on   0/200 cycles

⚠️ The suppressed regime is the quiet one: at a load the healthy sibling covers,
the meter is satisfied, `unmet_w` is 0 and no action-log line fires, so this
alarm is the ONLY instrument that would have told the operator.

WHAT CHANGED, in one line:

    named if  short_by() > min_w  OR  short_by() > frac * share

⚠️ `min_w` WAS NOT LOWERED. It exists to stop normal saturation being reported
as delinquency, and lowering it trades a missed alarm for a false one on every
unit at once - SAFETY-41's four-attempt regime. This is a SECOND way to be
named, not a looser first one: all seven of test_delivery.py part 1's existing
fixtures answer identically under both rules, and the absolute arm's suppression
window is still exactly 1000 W / 6500 W, still asserted in part 8b.

THE FRACTION IS DERIVED, 0.85. admin/goodwe:sim/delivery_window.py gained a
`--fractions` axis and grades the constant over the SAME 2640 no-fault runs that
produced `delivery_hold_s`'s 35.0 s floor. Worst continuous legitimate episode,
worst of three families, twenty fractions:

    frac   0.05  0.10  0.15  0.20  0.25  0.30  0.35  0.40  0.45  0.50
    worst  90.0  90.0  70.0  70.0  60.0  55.0  55.0  60.0  45.0  45.0  s
    frac   0.55  0.60  0.65  0.70  0.75  0.80 *0.85  0.90  0.95  0.99
    worst  40.0  40.0  45.0  45.0  45.0  45.0  40.0  40.0  40.0  40.0  s
    absolute arm alone: 35.0 s (SAFETY-42 §3.3, reproduced in the same runs)

⚠️ NO CLIFF ANYWHERE: 0.45-0.99 is flat within one control cycle, and it is not
monotone - §3.3's own mechanism (c). ⚠️ "Zero false namings" is NOT achievable
at any fraction and the record says so; what is zero is false ALARMS - 90.0 s
worst against a 185 s hold, so nothing comes within 95 s of notifying anybody.
N=1 control 0.0 s at every fraction in all 2640 one-inverter runs; flapping
0.0 s in all 840.

DRIVEN. Part 8b pinned the SUPPRESSED behaviour and said "if it ever goes red
because the alarm fired, read the card that made it fire". It now grades BOTH
rules on one run - `share_frac=None` is SAFETY-42's rule exactly:

    OPT-09 weights, absolute arm alone   named on   0/200
    OPT-09 weights, the shipped rule     named on 200/200

POSITIVE CONTROL. Same fixture, same weights, same 125 W share, one legitimate
fact changed: a pack at its own 10 % cut-out is named on 0/200 (account() still
gates it), and a unit delivering HALF its share is named on 0/200.

N=1 BYTE-IDENTICAL, asserted: `plan()` handed a `weights` mapping that raises on
any read still answers identically at a roster of one, and the same mapping
raises at a roster of two; `delinquent()` answers {} on all 84 single-unit
(share, measured, rule) combinations including 0 of 125 W.

MUTATION, run on fresh :ro trees: M12 (drop the relative arm), M13 (frac -> 1.0)
and M14 (frac -> 0.05) are all red on named checks. The constant cannot move in
either direction unseen.

⚠️ CFG-07 gets ONE CONTROL CYCLE WORSE and is deliberately not fixed here: the
worst legitimate episode goes 35.0 -> 40.0 s, so the schema's `int(30,900)`
false-tripping band widens from [30,35] to [30,40]. CFG-07 should be re-derived
against 40.0 s.

No option value, no schema bound and no default changed. 27/27 suites green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU
This commit is contained in:
Claude Opus 5
2026-09-08 03:14:16 +02:00
parent 6719bd882f
commit 2271e147c6
9 changed files with 948 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files
goodwe_controller/test_packshare.py
+270 -93
View File
@@ -41,7 +41,9 @@ from app.arbiter import (
ACTUATOR_SITE, CLAIM_SCOPE, P_LOOP, P_SAFETY, SCOPE_UNIT, Claim, resolve,
)
from app.control import Tuning, compute
from app.delivery import UnitDelivery, account, delinquent
from app.delivery import (
DELIVERY_SHARE_FRACTION, UnitDelivery, account, delinquent,
)
from app.peakguard import discharge_permitted
fails = []
@@ -605,67 +607,81 @@ check("...and SAFETY-42 is where the case this card CANNOT reach is handled. A "
"site ASKING a pack whose own SoC says it cannot deliver; SAFETY-42 "
"alarms when a pack that said it could does not. ⚠️ THE WEIGHT, HOWEVER, "
"DOES MOVE - this check used to say it did not - and part 8b grades what "
"that costs the alarm",
"that cost the alarm, and what SAFETY-43 did about it",
not packshare.envelope(PE(Bee, 55.0, B_KWH)).binding)
# ==============================================================================
print()
print("8b. ⚠️ AND WHAT THE WEIGHTS DO TO SAFETY-42's DETECTION WINDOW, WHICH IS "
"A REGRESSION AND IS PINNED HERE AS ONE")
print("8b. ⚠️ WHAT THE WEIGHTS DID TO SAFETY-42's DETECTION WINDOW, AND WHAT "
"SAFETY-43 DID ABOUT IT - GRADED UNDER BOTH RULES, ON ONE FIXTURE")
# ⚠️ READ THIS BEFORE READING THE CHECKS: THEY ASSERT THE UNFLATTERING ANSWER ON
# PURPOSE. An earlier draft of §5 of the decision said a wedged unit's weight
# does not move, so OPT-09 "cannot see it at all". The first clause is about the
# ENVELOPE and is true; the second is FALSE. A wedged unit's weight moves
# whenever its energy headroom differs from its sibling's - it is a pack fact,
# not a delivery fact - and `delivery.delinquent()` names a unit only while its
# `short_by()` gap exceeds `min_w` (`Tuning.saturation_w`, 500 W) IN ABSOLUTE
# WATTS. Shrinking a unit's share shrinks its gap. Shrink it below 500 W and the
# alarm stops firing on a unit that is still delivering nothing.
# ⚠️ THIS PART USED TO PIN THE UNFLATTERING ANSWER ON PURPOSE, AND SAFETY-43 IS
# THE CARD THAT INVERTED IT. What it said - and it was true when it was written
# - was: a wedged unit's weight MOVES whenever its energy headroom differs from
# its sibling's (it is a pack fact, not a delivery fact), `delivery.delinquent()`
# named a unit only while its `short_by()` gap exceeded `min_w`
# (`Tuning.saturation_w`, 500 W) IN ABSOLUTE WATTS, and shrinking a unit's share
# shrinks its gap. Shrink it below 500 W and the alarm stopped firing on a unit
# that was still delivering nothing. The old text ended "if it ever goes red
# because the alarm fired, read the card that made it fire before 'fixing' this
# line". SAFETY-43 is that card, this is that red, and the checks below are the
# same three measurements with their answers the other way round.
#
# So the seam is not "OPT-09 cannot see it". It is: OPT-09 stops the ask AND
# narrows SAFETY-42's detection window on the same unit. At equal weights the
# window is `site target < 2 * min_w` = 1000 W; at OPT-09's weights it is
# `site target < min_w * (w_A + w_B) / w_B`, which on this fixture is 6500 W.
# ⚠️ AND THE EVIDENCE IS THE DIFF BETWEEN TWO RULES ON ONE RUN, NOT A NUMBER
# THAT CHANGED IN A COMMIT. `delinquent()` takes `share_frac`, and
# `share_frac=None` is SAFETY-42's rule EXACTLY - the absolute arm alone. So
# `wedged_loop` grades every cycle twice, once under each rule, and the red and
# the green sit side by side in one output:
#
# ⚠️ BOTH BOUNDS ARE ARITHMETIC ABOUT `_fill()`'s PROPORTIONAL REGIME AND NEITHER IS A REACHABLE STEADY STATE. Swept on this fixture, the healthy pack's own 5000 W rating binds FIRST: suppressed 0/200 up to a 3000 W load, 4/200 at 4000 W, 41/200 at 4900 W (site target 5320 W, the largest reached with the wedged unit still under 500 W), then 195/200 at 5000 W once `_fill()` pins A at its cap and hands B 3000 W. So the alarm returns BELOW the 6500 W formula bound, not above it. The equal-weights 1000 W bound is unreachable for the same reason - the equal arm names the wedged unit 199/200 at every load swept, 1000 W included.
# load 1500 W, OPT-09 weights, absolute arm only named on 0/200 cycles
# load 1500 W, OPT-09 weights, the shipped rule named on 200/200 cycles
#
# ⚠️ THIS IS A DETECTION REGRESSION AT N=2 AND IT IS NOT FIXED HERE. Making
# `delinquent()` relative to the ask rather than absolute is SAFETY-42's code and
# a design change; it is filed as card SAFETY-43. What this part does is GRADE THE
# CURRENT BEHAVIOUR so that the day it changes, a named check moves.
# A future reader who wants to know what this card did runs this file.
#
# ⚠️ WHAT SAFETY-43 DID NOT DO IS LOWER `min_w`, and the check on the window
# arithmetic below is what holds that open: the ABSOLUTE arm's suppression
# window is still 500 W wide and still widens to 6500 W under these weights.
# Nothing that was quiet became noisy; a SECOND way to be named was added, and
# it is a fraction of the unit's OWN ask, so it fires on a unit delivering none
# of 125 W exactly as it fires on one delivering none of 1500 W.
#
# ⚠️ AND THE FIXTURE IS A SAFETY-42 TRUE POSITIVE BY THAT CARD'S OWN DEFINITION,
# checked below before anything is concluded from it: B is WEDGED - it accepts
# its share and produces nothing - at a HEALTHY 15 % against its own 10 % floor,
# so `envelope()` does not close and `account()` explains nothing. This is
# exactly the case §5 says the envelope cannot reach, which is why it is the
# case where the weights' side effect matters.
# case where the weights' side effect mattered.
#
# ⚠️ TWO COPIES OF A. Inverter B does not exist; the plant below is modelled in
# this file the way part 8's is, and B's ratings are datasheet.
WEDGED_A_SOC, WEDGED_B_SOC = 90.0, 15.0 # both healthy, both above their floor
MIN_W = Tuning().saturation_w # what `delinquent()` is handed
ABSOLUTE_ONLY = None # `share_frac=None` - SAFETY-42's rule
def wedged_loop(load_w, weighted, cycles=200):
def wedged_loop(load_w, weighted, cycles=200, share_frac=DELIVERY_SHARE_FRACTION,
b_delivers=0.0, b_soc=WEDGED_B_SOC):
"""The closed loop with unit B WEDGED at a healthy SoC. Real everything.
Real `compute()`, real `plan()`, real `packshare.weights()`, real
`delivery.account()` and real `delivery.delinquent()`. The only model is the
plant: A obeys within one cycle inside its rating, B accepts whatever it is
told and delivers 0 W - which is the wedged box, and is what makes this a
plant: A obeys within one cycle inside its rating, B delivers `b_delivers`
of whatever it is told - 0.0 is the wedged box, and is what makes this a
SAFETY-42 case rather than an OPT-09 one.
`weighted=False` is equal weights - what shipped. Envelopes are left OPEN in
both arms deliberately: neither pack's SoC closes one here, so filing them
would change nothing and would blur which half of the card is being graded.
`share_frac` is SAFETY-43's relative arm. `ABSOLUTE_ONLY` grades the same
cycles under SAFETY-42's rule, which is how the red and the green below come
out of ONE run over ONE tree instead of out of two commits.
Returns `(cycles on which delinquent() named somebody, last cycle)`.
"""
packs = [PE(A, WEDGED_A_SOC, A_KWH), PE(Bee, WEDGED_B_SOC, B_KWH)]
packs = [PE(A, WEDGED_A_SOC, A_KWH), PE(Bee, b_soc, B_KWH)]
tuning = Tuning(gain=1.0, slew_w=1000.0, max_w=A_W + B_W)
prev, i_w, sat = 0.0, None, 0
power = [0.0, 0.0]
@@ -678,13 +694,14 @@ def wedged_loop(load_w, weighted, cycles=200):
r = plan(d.target_w, {A: _B(-A_W, A_W), Bee: _B(-B_W, B_W)}, weights=w)
assert r.ok, r.refused
# THE MODELLED PLANT: A within one cycle inside its rating; B WEDGED.
power = [max(-A_W, min(A_W, float(r.shares[A]))), 0.0]
power = [max(-A_W, min(A_W, float(r.shares[A]))),
b_delivers * max(-B_W, min(B_W, float(r.shares[Bee])))]
grid = load_w - sum(power)
who = delinquent(
[UnitDelivery(p.name, r.shares[p.name], m,
account(live=True, parked=False, soc=p.soc,
bms_floor=p.bms_floor))
for p, m in zip(packs, power)], MIN_W)
for p, m in zip(packs, power)], MIN_W, share_frac)
named += bool(who)
last = (d.target_w, dict(r.shares), grid, who)
return named, last
@@ -698,75 +715,204 @@ check("PRECONDITION: the wedged unit is a SAFETY-42 TRUE POSITIVE and NOT an "
not packshare.envelope(_WEDGED_PACK).binding
and account(live=True, parked=False, soc=WEDGED_B_SOC,
bms_floor=FLOOR) is None)
check("PRECONDITION: the shipped fraction is a fraction, and it is STRICTLY "
"below 1.0 - at 1.0 the relative arm could only fire on a unit IMPORTING "
"while asked to discharge, which is SAFETY-30's fault and not this one, "
"and this card's own case (a unit delivering NONE of its share, gap over "
"share exactly 1.0) would be missed",
0.0 < DELIVERY_SHARE_FRACTION < 1.0)
_wedge = {}
for _load in (1500.0, 6000.0):
for _weighted in (False, True):
_n, _t = wedged_loop(_load, _weighted)
_wedge[(_load, _weighted)] = (_n, _t)
print(f" load {_load:.0f} W, B wedged at 15 %, "
f"{'OPT-09 weights' if _weighted else 'equal weights ':<14} "
f"named on {_n:3d}/200 cycles, site target {_t[0]:+.0f} W, shares "
+ ", ".join(f"{u}{v:+d}" for u, v in sorted(_t[1].items()))
+ f", grid {_t[2]:+.0f} W, named="
+ (str(sorted(_t[3])) if _t[3] else "(nobody)"))
for _frac in (ABSOLUTE_ONLY, DELIVERY_SHARE_FRACTION):
_n, _t = wedged_loop(_load, _weighted, share_frac=_frac)
_wedge[(_load, _weighted, _frac)] = (_n, _t)
print(f" load {_load:.0f} W, B wedged at 15 %, "
f"{'OPT-09 weights' if _weighted else 'equal weights ':<14} "
+ ("absolute arm only" if _frac is ABSOLUTE_ONLY
else f"frac {_frac:.2f} ")
+ f", named on {_n:3d}/200 cycles, site target {_t[0]:+.0f} W,"
+ " shares "
+ ", ".join(f"{u}{v:+d}" for u, v in sorted(_t[1].items()))
+ f", grid {_t[2]:+.0f} W, named="
+ (str(sorted(_t[3])) if _t[3] else "(nobody)"))
check("AT EQUAL WEIGHTS - WHAT SHIPPED - the wedged unit is named on every "
"cycle but the first, at a load its sibling can carry on its own. The "
"loop winds the site target to twice the load, the 50/50 split stands "
"+1500 W on a box producing nothing, and 1500 W > 500 W is what "
"`delinquent()` reads",
_wedge[(1500.0, False)][0] == 199
and sorted(_wedge[(1500.0, False)][1][3]) == [Bee]
and _wedge[(1500.0, False)][1][1] == {A: 1500, Bee: 1500})
check("⚠️ THE CARD, RED: UNDER SAFETY-42's RULE AND OPT-09's WEIGHTS THE WEDGED "
"UNIT IS NAMED ON NONE OF THE 200. Same wedged box, same healthy SoC, "
"same load, same detector: the split moves to 1505/125, the gap on the "
"wedged unit falls to 125 W, and 125 W < 500 W so the absolute arm "
"returns {}. This is the defect SAFETY-43 was filed for, and it is "
"measured here rather than remembered",
_wedge[(1500.0, True, ABSOLUTE_ONLY)][0] == 0
and _wedge[(1500.0, True, ABSOLUTE_ONLY)][1][3] == {}
and _wedge[(1500.0, True, ABSOLUTE_ONLY)][1][1] == {A: 1505, Bee: 125})
check("⚠️ AND WITH OPT-09's WEIGHTS IT IS NAMED ON NONE OF THE 200. Same wedged "
"box, same healthy SoC, same load, same detector: the split moves to "
"1505/125, the gap on the wedged unit falls to 125 W, and 125 W < 500 W "
"so `delinquent()` returns {}. THIS CHECK PINS A REGRESSION - it asserts "
"what the code DOES, not what anyone wants, and if it ever goes red "
"because the alarm fired, read the card that made it fire before "
"'fixing' this line",
_wedge[(1500.0, True)][0] == 0
and _wedge[(1500.0, True)][1][3] == {}
and _wedge[(1500.0, True)][1][1] == {A: 1505, Bee: 125})
check("⚠️ THE CARD, GREEN: THE SHIPPED RULE NAMES IT ON ALL 200, ON THE SAME "
"RUN. The unit is standing at +125 W and delivering 0 W - 100 % of its "
"ask is not arriving - and `gap > frac * share` does not care that 125 W "
"is a small number. The ONLY input that moved between this check and the "
"one above is `share_frac`",
_wedge[(1500.0, True, DELIVERY_SHARE_FRACTION)][0] == 200
and sorted(_wedge[(1500.0, True, DELIVERY_SHARE_FRACTION)][1][3]) == [Bee]
and _wedge[(1500.0, True, DELIVERY_SHARE_FRACTION)][1][1] \
== {A: 1505, Bee: 125})
check("AT EQUAL WEIGHTS - WHAT SHIPPED BEFORE OPT-09 - the wedged unit was "
"already named under the absolute rule on every cycle but the first, at "
"a load its sibling can carry on its own. The loop winds the site target "
"to twice the load, the 50/50 split stands +1500 W on a box producing "
"nothing, and 1500 W > 500 W is what the absolute arm reads",
_wedge[(1500.0, False, ABSOLUTE_ONLY)][0] == 199
and sorted(_wedge[(1500.0, False, ABSOLUTE_ONLY)][1][3]) == [Bee]
and _wedge[(1500.0, False, ABSOLUTE_ONLY)][1][1] == {A: 1500, Bee: 1500})
check("...and the shipped rule adds exactly the FIRST cycle to that arm and "
"nothing else - 199 becomes 200. On cycle one the slew limit holds the "
"split at 500/500, a 500 W gap is NOT over a 500 W threshold (the "
"absolute bound is strict), and the relative arm names a box delivering "
"none of its 500 W. That one cycle is the whole of what this card costs "
"an arm that was already firing",
_wedge[(1500.0, False, DELIVERY_SHARE_FRACTION)][0] == 200
and _wedge[(1500.0, False, DELIVERY_SHARE_FRACTION)][0]
- _wedge[(1500.0, False, ABSOLUTE_ONLY)][0] == 1)
check("...and this is the regime where NOTHING ELSE TELLS THE OPERATOR "
"ANYTHING: the meter is satisfied (grid within 5 W of zero), `unmet_w` is "
"0 because both units accepted their shares, no envelope closed and no "
"action-log line fires. The site is quietly running one inverter and the "
"one instrument built to say so has gone quiet with it",
abs(_wedge[(1500.0, True)][1][2]) <= 5.0
and abs(_wedge[(1500.0, False)][1][2]) <= 5.0)
"action-log line fires. The site is quietly running one inverter, and "
"before this card the one instrument built to say so had gone quiet with "
"it",
abs(_wedge[(1500.0, True, DELIVERY_SHARE_FRACTION)][1][2]) <= 5.0
and abs(_wedge[(1500.0, False, DELIVERY_SHARE_FRACTION)][1][2]) <= 5.0)
_w = packshare.weights([PE(A, WEDGED_A_SOC, A_KWH), _WEDGED_PACK], 1000.0)
_window_equal = MIN_W * 2.0
_window_opt09 = MIN_W * sum(_w.values()) / _w[Bee]
print(f" suppression window on this fixture: equal weights, site target "
f"< {_window_equal:.0f} W; OPT-09 weights, site target "
f"< {_window_opt09:.0f} W of a {A_W + B_W:.0f} W site")
check("...and the arithmetic behind it, stated as a window rather than as one "
"fixture: `delinquent()` reads an ABSOLUTE gap, so a unit weighted to a "
"fraction f of the site target is invisible while `f * target < min_w`. "
"Equal weights suppress below 1000 W; these weights suppress below "
"6500 W of a 9600 W site. ⚠️ BOTH ARE PROPORTIONAL-REGIME BOUNDS AND "
"NEITHER IS REACHABLE: the healthy pack's own rating binds first, so the "
"alarm returns BELOW 6500 W (swept: 0/200 to a 3000 W load, 41/200 at "
"4900 W, 195/200 at 5000 W) and the equal arm never suppresses at all. "
"That is the regression, and it is a property "
"of the threshold being absolute rather than of any number chosen here",
abs(_window_equal - 1000.0) < 1.0 and abs(_window_opt09 - 6500.0) < 1.0)
print(f" the ABSOLUTE arm's suppression window is UNCHANGED by SAFETY-43: "
f"equal weights, site target < {_window_equal:.0f} W; OPT-09 weights, "
f"site target < {_window_opt09:.0f} W of a {A_W + B_W:.0f} W site")
check("⚠️ AND `min_w` WAS NOT LOWERED, WHICH IS THE HALF OF THIS CARD THAT IS "
"EASIEST TO GET WRONG. The absolute arm still suppresses below 1000 W at "
"equal weights and below 6500 W at these ones - the same arithmetic this "
"part has always printed - because SAFETY-43 ADDED a second way to be "
"named rather than loosening the first. Lowering `saturation_w` would "
"have reported normal saturation on every unit at once, which is the "
"false-trip regime SAFETY-41 spent four attempts in",
abs(_window_equal - 1000.0) < 1.0 and abs(_window_opt09 - 6500.0) < 1.0
and MIN_W == Tuning().saturation_w == 500.0)
check("⚠️ AND THE ABSOLUTE ARM WAS NEVER SILENT EVERYWHERE - which is what a "
"check that only ever ran the quiet load would be pinning. Push the load "
"past the healthy pack's OWN RATING and `_fill()`'s last-resort pass "
"hands the wedged unit 3000 W anyway, the gap goes back over 500 W, and "
"both arms named it under SAFETY-42's rule too. The window was real and "
"it had an upper edge; the hole was the quiet regime below that edge, "
"and the shipped rule now names the unit on every cycle of all four runs",
_wedge[(6000.0, True, ABSOLUTE_ONLY)][0] == 195
and _wedge[(6000.0, False, ABSOLUTE_ONLY)][0] == 199
and _wedge[(6000.0, True, DELIVERY_SHARE_FRACTION)][0] == 200
and _wedge[(6000.0, False, DELIVERY_SHARE_FRACTION)][0] == 200
and sorted(_wedge[(6000.0, True, DELIVERY_SHARE_FRACTION)][1][3]) == [Bee])
print()
print(" THE POSITIVE CONTROL: what the relative arm must STILL NOT say")
# ⚠️ A CARD THAT ADDS A WAY TO RAISE AN ALARM HAS TO SHOW WHAT IT DID NOT ADD,
# or it has traded a missed alarm for a false one - which in this system is not
# a rhetorical risk. SAFETY-41 took four attempts on notification cadence and
# the owner's words were "i'm getting really annoyed by the notifications in my
# HA". So: the same fixture, the same weights, the same tiny 125 W share, with
# the ONE fact that makes the shortfall legitimate changed.
_sat_named, _sat_last = wedged_loop(1500.0, True, b_soc=FLOOR)
print(f" load 1500 W, B AT ITS OWN {FLOOR:.0f} % CUT-OUT, OPT-09 weights, "
f"frac {DELIVERY_SHARE_FRACTION:.2f}: named on {_sat_named:3d}/200 "
f"cycles, named="
+ (str(sorted(_sat_last[3])) if _sat_last[3] else "(nobody)"))
check("A PACK AT ITS OWN CUT-OUT DELIVERING NOTHING OF A SMALL SHARE IS STILL "
"NOT DELINQUENT. Identical trace to the wedged arm - 0 W against a "
"positive share, 100 % of the ask missing, the relative arm's exact "
"shape - and `account()` explains it, so nobody is named on any of the "
"200 cycles. The account gate is what keeps normal saturation out and "
"SAFETY-43 did not go near it",
_sat_named == 0 and _sat_last[3] == {})
_derate_named, _derate_last = wedged_loop(1500.0, True, b_delivers=0.5)
print(f" load 1500 W, B delivering HALF its share, OPT-09 weights, frac "
f"{DELIVERY_SHARE_FRACTION:.2f}: named on {_derate_named:3d}/200 cycles, "
f"shares "
+ ", ".join(f"{u}{v:+d}" for u, v in sorted(_derate_last[1].items()))
+ ", named="
+ (str(sorted(_derate_last[3])) if _derate_last[3] else "(nobody)"))
check("...and ORDINARY TRACKING ON A SMALL SHARE IS NOT DELINQUENCY EITHER. "
"The same unit at the same weights delivering HALF of what it is asked "
"for is short by 50 % - well inside the shipped fraction - and its gap "
"in watts is far under `min_w`, so NEITHER arm names it. A relative "
"criterion that fired here would be the saturation-shaped alarm this "
"whole module is written against",
_derate_named == 0 and _derate_last[3] == {})
check("...and the two controls are not vacuous: the SAME loop with the SAME "
"weights and a WEDGED B names it on all 200, so what separates them is "
"the pack's own cut-out and the size of the shortfall, not something "
"about the fixture that stopped the check reaching the comparison",
_wedge[(1500.0, True, DELIVERY_SHARE_FRACTION)][0] == 200)
print()
print(" N=1 IS BYTE-IDENTICAL, AND THAT IS ASSERTED RATHER THAN ARGUED")
# ⚠️ THE LIVE INSTALL IS N=1 AND THIS CARD MUST NOT REACH IT. Two independent
# statements, and each is checked against the thing that would break it:
# 1. `plan()` RETURNS BEFORE `weights` IS READ AT ALL, so no weighting - and
# no change to how one is derived - can move a one-inverter share. Graded
# with a `weights` object that RAISES if anything reads it.
# 2. `delinquent()` returns {} at a roster of one for every input, including
# the input the RELATIVE arm was built for. The proper-subset algebra runs
# before either arm, so the fraction is never even multiplied.
class _Poison(dict):
"""A `weights` that cannot be read without saying so. Not a mock: a tripwire."""
def get(self, *a, **k):
raise AssertionError("plan() read weights at a roster of one")
def __getitem__(self, k):
raise AssertionError("plan() read weights at a roster of one")
_n1_plain = plan(1234.5, {A: _B(-A_W, A_W)})
_n1_poison = plan(1234.5, {A: _B(-A_W, A_W)}, weights=_Poison())
check("`plan()` at a roster of ONE returns the site target unread, and it "
"returns it WITHOUT TOUCHING `weights` - handed a mapping that raises on "
"any read, it answers identically to the same call with no weights at "
"all. The N=1 pass-through is above the weighting, so OPT-09 could not "
"move it and SAFETY-43 does not either",
_n1_poison.shares == _n1_plain.shares == {A: 1234.5}
and _n1_poison.unmet_w == _n1_plain.unmet_w)
try:
plan(1234.5, {A: _B(-A_W, A_W), Bee: _B(-B_W, B_W)}, weights=_Poison())
except AssertionError:
_poison_bites = True
else:
_poison_bites = False
check("...and the tripwire is a real one: the SAME poisoned mapping at a roster "
"of TWO is read and raises. A check that could not fail would be "
"measuring nothing",
_poison_bites)
_n1_rel = [delinquent([UnitDelivery(A, s, m)], MIN_W, f)
for s in (0, 125, 500, 2000, 5000, -2000, None)
for m in (0, 60, 125, 2000, -2000, None)
for f in (ABSOLUTE_ONLY, DELIVERY_SHARE_FRACTION)]
check(f"...and `delinquent()` answers {{}} at a roster of one on all "
f"{len(_n1_rel)} of (share, measured, rule) - INCLUDING 0 of 125 W, the "
f"exact input this card added an arm for. `len(asked) < 2` returns "
f"before either threshold is compared, so the one-inverter install this "
f"add-on is running today cannot tell that SAFETY-43 happened",
all(r == {} for r in _n1_rel))
check("⚠️ AND IT IS NOT THAT THE WEIGHTED ARM NEVER NAMES ANYBODY - which is "
"what a check that only ever ran the quiet load would be pinning. Push "
"the load past the healthy pack's OWN RATING and `_fill()`'s last-resort "
"pass hands the wedged unit 3000 W anyway, the gap goes back over 500 W, "
"and BOTH arms name it. The window is real and it has an upper edge; the "
"hole is the quiet regime below that edge",
_wedge[(6000.0, True)][0] == 195
and sorted(_wedge[(6000.0, True)][1][3]) == [Bee]
and _wedge[(6000.0, False)][0] == 199
and sorted(_wedge[(6000.0, False)][1][3]) == [Bee])
# ==============================================================================
print()
@@ -978,9 +1124,12 @@ print(" a preference and are honest about being one.")
print(" * A WEDGED UNIT IS NOT REACHABLE BY THE ENVELOPE. Its SoC reads")
print(" healthy, so nothing closes, and SAFETY-42 owns the detection.")
print(" ⚠️ BUT IT IS REACHABLE BY THE WEIGHTS, WHICH MOVE ON ENERGY")
print(" HEADROOM AND NOT ON DELIVERY - part 8b grades what that does")
print(" to SAFETY-42's window, and the answer is a REGRESSION that is")
print(" pinned rather than fixed.")
print(" HEADROOM AND NOT ON DELIVERY. That narrowed SAFETY-42's")
print(" detection window - a regression this file PINNED rather than")
print(" fixed - and SAFETY-43 closed it by making delinquency relative")
print(" to the ask as well as absolute. Part 8b now grades both rules")
print(" on one fixture: the absolute arm still says nothing, and the")
print(" shipped one names the unit on all 200 cycles.")
# ==============================================================================
print()
@@ -1023,13 +1172,38 @@ MUT = [
"mutation took it down with a TypeError three lines into part 1"),
("M11 weights(): keep the shape, force every weight to 1.0 <- THE PROOF "
"THAT PART 8b CAN GO RED",
"test_packshare 8b, three named checks: the wedged unit goes back to being "
"named on 199/200 at 1500 W, the split reverts to 1500/1500 and the "
"window collapses from 6500 W to 1000 W. ⚠️ RUN, NOT REASONED ABOUT - a "
"check that pins an UNFLATTERING behaviour has to be shown capable of "
"failing, or it is indistinguishable from a check that pins nothing. "
"test_packshare 8b, FIVE named checks - re-run for SAFETY-43 rather than "
"carried across, because the part it grades was rewritten: the split "
"reverts to 1500/1500 so the absolute arm names the unit on 199/200 "
"(taking the card's RED check down), the shipped rule's 200/200 comes "
"from the wrong shares (taking the GREEN one down), the OPT-09 window "
"collapses from 6500 W to 1000 W, the 6000 W arm's 195 becomes 199, and "
"the derated positive control moves from 0/200 to 3/200. ⚠️ RUN, NOT "
"REASONED ABOUT - a check that pins a behaviour has to be shown capable "
"of failing, or it is indistinguishable from a check that pins nothing. "
"(It also takes parts 1, 3, 7 and 8 down, which is M3's territory; 8b is "
"the part that names the SAFETY-42 interaction)"),
# --- SAFETY-43's three, and they pin the new arm from BOTH sides --------
("M12 delinquent(): drop the relative arm, keep `gap > min_w` <- THE "
"CARD ITSELF REVERTED",
"test_delivery 1 (one named check) and test_packshare 8b (FOUR): the "
"GREEN check goes back to 0/200 under OPT-09's weights, the equal arm "
"goes back to 199, the 6000 W arm back to 195/199, and the vacuity guard "
"on the positive controls falls with them. test_alloc and test_control "
"stay green, which is the point - nothing outside this check moves"),
("M13 DELIVERY_SHARE_FRACTION 0.85 -> 1.0 <- THE TOO-LOOSE DIRECTION",
"test_delivery 1 and test_packshare 8b, five named checks including the "
"PRECONDITION that the fraction is strictly below 1.0. At 1.0 the arm can "
"only fire on a unit IMPORTING while asked to discharge, so the card's "
"own case - 0 of 125 W, gap over share exactly 1.0 - is missed and the "
"whole card is a no-op"),
("M14 DELIVERY_SHARE_FRACTION 0.85 -> 0.05 <- THE TOO-SENSITIVE ONE",
"test_delivery 1 and 4b (four named checks) and test_packshare 8b's "
"DERATED positive control: a unit delivering half its share starts being "
"named, and part 4b's `saturation_w` pin goes vacuous because the "
"relative arm names B at every threshold. ⚠️ THIS IS THE ROW THAT MATTERS "
"- the fraction is pinned from BOTH directions, so it is a derived number "
"with checks around it rather than a literal nobody can move"),
]
for _n, _w in MUT:
print(f" caught {_n}")
@@ -1039,8 +1213,11 @@ check("every mutation in the table above was RUN and every one of them is "
"M6: the whole defect this card fixes - a parameter nothing passes - is "
"invisible to every behavioural fixture in this repository, because they "
"all build their own claim list and call `resolve()` themselves. That is "
"why the call site is pinned statically as well",
len(MUT) == 11)
"why the call site is pinned statically as well. ⚠️ M12-M14 ARE "
"SAFETY-43's and were run the same way, on trees copied fresh and "
"mounted :ro so no `.pyc` could go stale - MUTATION.md's defect. All "
"three are REDS, which is the direction that defect cannot fabricate",
len(MUT) == 14)
print()
if fails: