admin/goodwe-addon
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

SAFETY-57: the stale-reading verdict gets an exit, because its own consequence is what stopped it being tested
checks / unit (pull_request) Successful in 7m58s
Details

Browse Source 
SAFETY-37's freshness gate reports a battery-power register as MISSING when it
stops following its own command, and a missing input is "command 0 W and keep
commanding" (§11.1 rule 1). The gate's only exit was "an arrival carrying a
DIFFERENT number" - and at 0 W nothing is asking the register to be anywhere.
The state had no exit reachable from inside it, and the log line promised the
opposite in the same sentence that announced the 0 W.

REPRODUCED FROM THE WIRE, NOT MODELLED. scenarios/safety57-2026-09-21/ is 3840
verbatim frames off the RS-485 pair, read from the passive sniffer, decoded by
tools/decode_bus_capture.py (0 unparsed, 0 bad CRC, 0 unknown shapes; the
mode->sign convention is graded off the capture, not trusted). The box was
running 0.10.0, so the 0 W in the trace IS the add-on's own claim:

  10:51:24.7  0x0518 reaches -3 W. Pack at 11 %, the BMS refuses the discharge,
              the inverter idles. THE REGISTER IS HEALTHY AND TRUTHFUL.
  10:51:29.7  the command reaches +1060 W - 800 W of travel
  10:52:00    the conjunction arms. Inverter.batt becomes None
  10:52:21.7  the site commands 0 W, on the wire
  ...         0x0518 does not change value for 850.0 s. The setpoint does not
              change value for 790.0 s. The house exports 2.4 kW throughout
  ~11:04      a human restarts the add-on. That is what ends it

AND IT HAD BEEN ESCAPING BY LUCK. Replaying the committed 16-day loop capture
through the shipped conjunction finds 93 trips whose wait for the BMS
keep-alive pulse that cleared them has a median of 143.4 s, a worst case of
21440.1 s, and 17 of 93 at or beyond this episode's 710 s. That distribution
belongs to the battery's firmware, not to this code.

THE CARD'S OPTION 2 ALREADY HELD AND IS NOT THE BUG. _grade() has required
|standing| >= MOVE_W since SAFETY-37. The trip was at +1060 W and the stuck
state is at 0 W; they are different moments, and an entry-side rule cannot
reach a state entered legitimately and then persisted. Nothing in the
conjunction is weakened here.

THE RULE, SAFETY-13's SHAPE ONE MODULE OVER - which latches get an exit, not
how long the block lasts:

  the verdict is withdrawn when the obligation that produced it has been gone
  for RELEASE_S, and the register is then re-graded from scratch.

RELEASE_S is BATT_OBLIGED_S, 17.0 s - the obligation window already derived in
the file (6.0 plant + 10.0 publish + 1.0 read), taken at the FLOOR of its band
for the mirror of MOVE_W's reason. Which half is safe is the opposite of
SAFETY-13's: being wrong long is the failure being fixed, being wrong short
costs one bounded re-grading window. Below 17 s the release pre-empts the
cheaper exit - the register answering by itself - and that is graded
behaviourally, not asserted.

The whole parked interval is now stale_input_s + RELEASE_S = 32 s. On the live
episode: telemetry back at 10:52:39 instead of 11:05:35, with 0x0518 still
answering the same -3 W. RED BEFORE (release_s=inf, a graded counterfactual and
not a second implementation), GREEN AFTER.

WHAT IT COSTS, AND IT IS NOT SMALL. A register dead for good is re-graded for
ever: over 1201 reads the held number reaches a consumer on 630 (52.5 %)
against 35 (2.9 %) before. Payable only because one window is at most 35 s and
the two consumers hold for 75 s and 85 s, so neither can reach a verdict inside
one and the re-trip clears both windows. No detection SAFETY-37 had is given
back - a permanent None clears the same windows for ever too - and the command
is derived from the P1 meter, never from batt.

Two clocks, deliberately: changed_mono/unchanged_s() stay facts about the
REGISTER, graded_from/graded_s() are the VERDICT's window. Collapsing them
either lies to the operator or defeats the re-grading.

main.py's stale line had its ESCAPE CLAUSE corrected - it promised a clearance
the state could not produce - and gained a STALE WITHDRAWN edge that says in
its own words that nothing has been learned about the register. The DIAGNOSIS
half is SAFETY-56's and is deliberately untouched, with a named check asserting
it is still there so that rewrite has to be deliberate.

Battery: 22 mutations, 21 red, 1 argued equivalent, 0 unexplained survivors.
Two findings kept in DECISIONS: _release()'s move_w test swapped for
unchanged_s SURVIVED at +5 B because every fixture rested at exactly 0 W (habit
11, closed by a 0/100/300 W fixture); and the code shipped a habit-22 comment
claiming the _release/_grade order was load-bearing, which the battery
falsified - the two act on mutually exclusive predicates, so the order is not
observable. MUTATION.md gains habit 23 for a mutation that ran, fingerprinted
clean, and was a no-op on the fixture because `0.0 or x` is x.

Suite: 30/30 in the CI image, checks.yml's exact command, purged tree, :ro, one
file at a time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU
This commit is contained in:
admin
2026-09-21 12:33:56 +02:00
co-authored by Claude Opus 5
parent 6f5e8e378a
commit 43c144b8d9
10 changed files with 1921 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
goodwe_controller/app/freshness.py
+298 -19
View File
@@ -175,6 +175,124 @@ only one of them is WIRED - see `BOUNDS` below and the note on SoC.
integrator, and K. It does NOT owe a second freshness mechanism - `Freshness`
below takes its obligation term from the caller precisely so that an energy
integral can be handed in where command travel is handed in here.
THE EXIT, AND WHY THE FIRST VERSION OF THIS MODULE DID NOT HAVE ONE (SAFETY-57)
==============================================================================
⚠️ THE VERDICT ABOVE IS ABOUT AN OBLIGATION, AND ITS OWN CONSEQUENCE REMOVES
THE OBLIGATION. Declaring the reading stale makes `Controller.inputs_ok` False,
which commands 0 W (§11.1 rule 1). At 0 W nothing is asking the register to be
anywhere - `|standing| >= MOVE_W` is false, so the conjunction cannot arm - and
the class docstring's clearing rule, "an arrival carrying a DIFFERENT number",
asks the register for evidence that only a command could have produced. A pack
sitting at its BMS floor answers the same integer watt for hours. **The state
had no exit reachable from inside it**, and the operator-facing line said the
opposite: *"It clears itself the moment the register reports a different
value."*
MEASURED ON THE LIVE SITE, 2026-09-21, and committed as
`scenarios/safety57-2026-09-21/` - a passive RS-485 capture, decoded by
`tools/decode_bus_capture.py`:
10:51:24.7 0x0518 reaches -3 W. The pack is at 11 % and the loop has just
reversed from -447 W of charge into discharge; the BMS refuses
and the inverter idles. The register is HEALTHY and TRUTHFUL.
10:51:29.7 the standing command reaches +1060 W. 800 W of travel, and the
register is obliged to follow it.
10:52:00 the conjunction arms. `Inverter.batt` becomes None.
10:52:21.7 the site commands 0 W - on the wire, in the capture.
... 0x0518 does not change value for 850.0 s. The setpoint does not
change value for 790.0 s. Nothing in this add-on can end it.
11:04 a human restarts the add-on.
11:05:31.7 the restarted loop commands -400 W of charge, which the pack
ACCEPTS at 11 %, and the register moves 3 s later.
⚠️ AND IT HAD BEEN ESCAPING BY LUCK. This BMS emits a keep-alive pulse of a few
hundred watts, which twitches 0x0518 and satisfies the clearing rule by
accident. Replaying the committed 16-day loop capture
(`scenarios/loop-2026-09-02_2026-09-17/`) through the shipped conjunction at
1 Hz gives **93 trips**, and the time from each trip to the register's next
change - which was the ONLY exit - has a median of 143 s, 17 episodes at or
over the live one's 710 s, and a worst case of 21440 s. That distribution is a
property of this battery's firmware. It is not a property of this code, and the
add-on must not depend on it.
THE RULE, and it is SAFETY-13's shape one module over - "which latches get an
exit, not how long the block lasts":
RELEASE <=> the verdict is standing
AND |standing command| < MOVE_W has held continuously for
>= RELEASE_S
On a release the latch clears and a NEW grading window opens at that instant:
the register is re-graded, from scratch, against the commands issued AFTER it.
Nothing about the register's own history is rewritten - `changed_mono`,
`held` and `unchanged_s()` go on reporting that the register has not moved for
850 s, because it has not.
⚠️ `RELEASE_S` IS `BATT_OBLIGED_S`, 17.0 s, AND IT IS THE FLOOR OF ITS BAND
RATHER THAN A PREFERENCE - the mirror of `MOVE_W` taking the ceiling of its
own. The question the bound answers is *has the register had its chance to
answer the command that is now standing?*, and that is exactly the 17.0 s
already derived above: 6.0 s of plant, one 10 s publish, one 1 s read. Below it
the release happens before the cheaper exit - the register moving by itself -
could have occurred. Which half is safe is the opposite of SAFETY-13's, and for
the reason that card states in its §4.2 table: being wrong LONG here is the
failure being fixed (a site parked while it exports), and being wrong SHORT
costs one re-grading window, which is bounded below.
WHAT A RELEASE COSTS, MEASURED AND NOT ABSORBED - AND IT IS NOT SMALL. For the
duration of the new window the consumers get the held number again, which is
the exposure this module was written to close. Driven at the live install's
shape against a register frozen for good (`test_freshness.py` part 10c), over
1200 s:
shipped parked 1166 s, the held number reaches a consumer 35 s 2.9 %
SAFETY-57 parked 571 s, the held number reaches a consumer 630 s 52.5 %
⚠️ **52 % IS THE PRICE OF THE EXIT AND IT IS PAID EVERY CYCLE**, not an
occasional slip. The period is the whole of `stale_input_s` (15 s) + `RELEASE_S`
(17 s) parked, then one `BATT_UNCHANGED_S` (35 s) window of re-grading. It is
bounded by construction, and that bound is the one thing that makes it payable:
the new window is AT MOST BATT_UNCHANGED_S = 35 s, and 35 < 75 < 85 - the
circulation hold and the per-unit sign hold. NEITHER CONSUMER CAN REACH A
VERDICT INSIDE ONE WINDOW, and a re-trip returns them a None, which CLEARS
both windows rather than accumulating into them.
That inequality is the same one part 6 already grades, and it is why the window
is `BATT_UNCHANGED_S` rather than a number chosen to make the table above look
better. Neither detector can be made to say anything by a held number under
this scheme - which is exactly the state the shipped code leaves them in as
well, since a permanent None clears both windows for ever. **So nothing that
SAFETY-37 detects is given back.** What the held number does reach for those
35 s is `site_batt_w`, the anti-windup input of `control.compute()`, which
responds to a large unexplained divergence by FREEZING the output - the
conservative direction, and SAFETY-13's business. And the command itself is
derived from the P1 meter, never from `batt`, so a site regulating through a
re-grading window is regulating on the signal it always regulates on.
**A register frozen under a command that never travels 250 W is still not
detected at all** (survivor 2, unchanged), and a dead publisher whose value
alternates is still invisible (survivor 3).
⚠️ AND THE NARROWING THIS DOES NOT TAKE, named so the next card can. The live
episode's register refused a DISCHARGE into an 11 % pack and then followed a
CHARGE immediately; a refusal in one direction is not evidence about the other,
and a gate that knew the pack's floor could re-grade on the first command that
crosses it instead of on a timer. That needs SoC, which this module deliberately
does not take (see the `soc` row), and the pack floor, which is SAFETY-32's
number. It would shrink the 52 % above; it is not needed to give the state an
exit, and mixing it in here would make the exit depend on a second measurement
being right.
⚠️ WHAT THIS DOES NOT DO, because the temptation is to call it a fix for the
whole episode: it does not tell a BMS refusal apart from a dead register. The
site above was parked for 790 s by a register that was working perfectly, and
after this change it is parked for `stale_input_s + RELEASE_S` instead - about
32 s on the shipped default - and then regrades. Telling the two apart needs
the pack's own floor, which is SAFETY-32's number and not this module's input;
the wording the operator reads about it is SAFETY-56's.
"""
import time
@@ -211,6 +329,19 @@ BATT_UNCHANGED_S = 35.0
# and goes red if the two drift.
MOVE_W = 250.0
# SAFETY-57. How long the obligation must have been ABSENT before a standing
# verdict is withdrawn and the register re-graded. See the module docstring's
# last section for the live episode this exists for and for which half of the
# band is the safe one.
#
# ⚠️ IT IS `BATT_OBLIGED_S` AND NOT A NEW NUMBER, and that identity is the
# derivation rather than a convenience. The question is "has the register had
# its chance to answer the command standing NOW?", which is the same physical
# quantity the floor of `BATT_UNCHANGED_S`'s band is: 6.0 s of plant, one 10 s
# ESPHome publish, one 1 s add-on read. Releasing sooner would throw away the
# cheaper exit - the register moving by itself - before it could have happened.
RELEASE_S = BATT_OBLIGED_S # 17.0
@dataclass(frozen=True)
class Bound:
@@ -219,6 +350,7 @@ class Bound:
signal: str
unchanged_s: float
move_w: float
release_s: float
wired: bool
derivation: str
@@ -233,13 +365,19 @@ BOUNDS = {
signal="batt (0x0518, AC power, S16, 1 W, 10 s publish)",
unchanged_s=BATT_UNCHANGED_S,
move_w=MOVE_W,
release_s=RELEASE_S,
wired=True,
derivation="settle 6.0 + publish 10.0 + read 1.0 = 17.0 s floor; "
"circulation_hold_s 75 s ceiling; band [34.0, 37.5]"),
"circulation_hold_s 75 s ceiling; band [34.0, 37.5]. "
"SAFETY-57: the verdict is withdrawn after 17.0 s of the "
"standing command below 250 W, because at 0 W the register "
"is obliged to nothing and the verdict cannot be tested "
"again from inside the state it creates"),
"soc": Bound(
signal="soc (0x050E, pack SoC, U16, 1 %, 10 s publish)",
unchanged_s=float("inf"),
move_w=float("inf"),
release_s=float("inf"),
wired=False,
derivation="TEL-08. Command travel is the WRONG obligation term for "
"SoC - a rested pack holds a percent for hours under a 0 W "
@@ -263,10 +401,33 @@ class Freshness:
Declaring the reading stale makes `Controller.inputs_ok` False, which
commands 0 W (§11.1 rule 1), which drops the standing command below
`MOVE_W`, which un-arms the conjunction, which would return the held number
to the consumers - and round again every read. So the ONLY thing that clears
the latch is an arrival carrying a DIFFERENT number, which is exactly the
evidence the verdict was about. A register that is working clears it on its
next 10 s publish; a register that is not, does not.
to the consumers - and round again every read. So an arrival carrying a
DIFFERENT number clears the latch, which is exactly the evidence the verdict
was about. A register that is working clears it on its next 10 s publish; a
register that is not, does not.
⚠️ AND IT IS NOT THE ONLY THING THAT CLEARS IT ANY MORE (SAFETY-57), BECAUSE
THAT MADE THE STATE INESCAPABLE FROM INSIDE. The command the verdict itself
produces is 0 W, and at 0 W the register is obliged to be nowhere - so
"report a different value" is evidence a parked site cannot ask for. The
live site sat at 0 W for 790 s on 2026-09-21 with a register that was
working correctly, and was freed by a human. `_release()` below withdraws a
verdict whose obligation has been gone for `bound.release_s`, and opens a
new grading window at that instant. The 1 Hz oscillation the latch exists to
prevent is still prevented: the new window is `bound.unchanged_s` wide, so
no re-trip can land sooner than 35 s after a release, rather than on the
next read. ⚠️ MEASURED FROM THE RELEASE, NOT FROM THE COMMAND RESUMING - if
the site rests for longer than the window before it asks for anything, the
window is already old and the re-trip lands on the first read at which the
command travels 250 W again. That is survivor 5's shape, it predates this
card, and its cost is one `stale_input_s` hold.
⚠️ TWO CLOCKS, AND THE DISTINCTION IS THE WHOLE OF SAFETY-57'S HONESTY.
`changed_mono` / `held` are facts about the REGISTER: when it last carried a
different number. `graded_from` / `standing_at_grade` are the window the
VERDICT is computed over, which a release re-opens. They are the same thing
until the first release and diverge afterwards, and `unchanged_s()` - the
number an operator reads - is always the register's.
"""
def __init__(self, bound: Bound):
@@ -281,10 +442,20 @@ class Freshness:
# ability to fetch it.
self.held = None
self.changed_mono = None
# The standing command at that same instant. The conjunction compares
# against THIS, not against the previous cycle's command: what matters
# is whether the register has followed anything since it last moved.
self.standing_at_change = None
# SAFETY-57. The window the VERDICT is graded over, as opposed to the
# register's own history above, and the standing command at the instant
# it opened. The conjunction compares against THIS, not against the
# previous cycle's command: what matters is whether the register has
# followed anything since the current question was put to it. A register
# that moves opens a window, so until the first release these two are
# the change-stamps; `_release()` is where they diverge.
self.graded_from = None
self.standing_at_grade = None
# The instant the standing command last FELL below `move_w`, or None
# while an obligation is standing. The release timer runs off this.
self.rested_since = None
self.released_at = None
self.releases = 0
self.stale = False
self.reason = ""
self.arrivals = 0
@@ -311,20 +482,67 @@ class Freshness:
if self.changed_mono is None or value != self.held:
self.held = value
self.changed_mono = float(now_mono)
self.standing_at_change = (None if standing_w is None
else float(standing_w))
# Movement is the ONLY thing that clears the latch. See the class
# docstring on the 1 Hz oscillation this prevents.
self._open_window(standing_w, now_mono)
# Movement clears the latch, because it is exactly the evidence the
# verdict was about. See the class docstring on the 1 Hz oscillation
# the latch prevents, and `_release()` for the other way out.
self.stale = False
self.reason = ""
self.last = value
# ⚠️ THE ORDER OF THESE TWO IS NOT OBSERVABLE, AND THIS COMMENT SAYS SO
# BECAUSE THE FIRST VERSION OF IT CLAIMED THE OPPOSITE. Swapping them is
# a ZERO-BYTE edit and it SURVIVED the battery; the reason is structural
# rather than a missing fixture, so no fixture could have closed it:
# `_grade()` acts only when `|standing| >= move_w` and `_release()` only
# when `|standing| < move_w`, so at most one of them can do anything on
# any given read, whichever runs first. Release is written first because
# it reads in the order the state machine moves - withdraw, then
# re-grade - not because the code depends on it.
self._release(standing_w, now_mono)
self._grade(standing_w, now_mono)
def _open_window(self, standing_w, now_mono) -> None:
"""Start grading the register again, from this instant (SAFETY-57).
Called when the register moves - the window and the register's history
coincide there - and when a verdict is withdrawn, where they do not.
"""
self.graded_from = float(now_mono)
self.standing_at_grade = (None if standing_w is None
else float(standing_w))
def _release(self, standing_w, now_mono) -> None:
"""SAFETY-57. Withdraw a verdict whose obligation is no longer standing.
⚠️ THE TIMER RUNS ON THE COMMAND, NOT ON THE VERDICT. `rested_since` is
maintained on every arrival, latched or not, so the elapsed rest is the
real one and not "time since we last looked". An obligation reappearing
resets it to None, which is the whole point: a site that goes back to
asking the register for 250 W of movement has put the question back, and
the verdict stands until the question is withdrawn again.
"""
obliged = (standing_w is not None
and abs(float(standing_w)) >= self.bound.move_w)
if obliged:
self.rested_since = None
return
if self.rested_since is None:
self.rested_since = float(now_mono)
if not self.stale:
return
if float(now_mono) - self.rested_since < self.bound.release_s:
return
self.released_at = float(now_mono)
self.releases += 1
self.stale = False
self.reason = ""
self._open_window(standing_w, now_mono)
def _grade(self, standing_w, now_mono) -> None:
"""The conjunction. Sets the latch; never clears it."""
if self.stale or self.changed_mono is None:
if self.stale or self.graded_from is None:
return
held_s = self.unchanged_s(now_mono)
held_s = self.graded_s(now_mono)
if held_s < self.bound.unchanged_s:
return
# ⚠️ BOTH None GUARDS ARE FOR A CALLER THAT DOES NOT KNOW ITS OWN
@@ -333,30 +551,64 @@ class Freshness:
# consumer today. They are here for TEL-08, whose obligation term is an
# energy integral that has nothing to say until it has a window - and
# "nothing to say" must withhold the verdict, not manufacture one.
if standing_w is None or self.standing_at_change is None:
if standing_w is None or self.standing_at_grade is None:
return
standing_w = float(standing_w)
if abs(standing_w) < self.bound.move_w:
return
moved_w = abs(standing_w - self.standing_at_change)
moved_w = abs(standing_w - self.standing_at_grade)
if moved_w < self.bound.move_w:
return
self.stale = True
# ⚠️ THE SENTENCE SAYS "unchanged", SO IT GETS THE REGISTER'S OWN
# NUMBER, NOT THE WINDOW'S. They are the same until the first release
# and different afterwards, and an operator comparing this line against
# a history graph is reading the register.
shown_s = self.unchanged_s(now_mono)
self.reason = (
f"STALE_READING: {self.held:+.0f} unchanged for {held_s:.0f} s "
f"STALE_READING: {self.held:+.0f} unchanged for {shown_s:.0f} s "
f"while the standing command moved {moved_w:.0f} W to "
f"{standing_w:+.0f} W - the reading is not following, so it is "
f"reported as MISSING rather than as a measurement (limits: "
f"unchanged over {self.bound.unchanged_s:.0f} s, command over "
f"{self.bound.move_w:.0f} W and moved by over "
f"{self.bound.move_w:.0f} W)")
# ⚠️ SAFETY-57, AND THE THREE DURATIONS ARE THREE DIFFERENT FACTS, each
# in its own slot: the register's unchanged time is in the sentence
# above, the WINDOW this verdict actually rests on is here, and so is
# how many times this unit has been round the loop. Without the second
# one the sentence reads as though 92 s of unchanged register were what
# was compared against the 35 s limit, and it was not.
if self.releases:
self.reason += (
f" [re-graded: the {held_s:.0f} s window this verdict rests on "
f"opened when the previous one was withdrawn, not when the "
f"register last moved - this unit has now been graded "
f"{self.releases + 1} times]")
def unchanged_s(self, now_mono) -> float | None:
"""Seconds since an arrival carried a different number. Status page."""
"""Seconds since an arrival carried a different number. Status page.
⚠️ THE REGISTER'S CLOCK, NEVER THE VERDICT'S (SAFETY-57). A release
re-opens the grading window; it does not make the register younger, and
an operator reading "unchanged for 12 s" off a register that has held
one value for 850 s would be reading this module's bookkeeping back as a
measurement. `graded_s()` is the other one and is named differently for
that reason.
"""
if self.changed_mono is None:
return None
return max(0.0, float(now_mono) - self.changed_mono)
def graded_s(self, now_mono) -> float | None:
"""Seconds the CURRENT verdict window has been open (SAFETY-57).
Equal to `unchanged_s()` until the first release, and shorter after one.
"""
if self.graded_from is None:
return None
return max(0.0, float(now_mono) - self.graded_from)
def reading(self):
"""What the consumers get: the value, or None when it cannot be trusted.
@@ -366,6 +618,13 @@ class Freshness:
rather than accumulating it, and `circulation.circulating_w` returns None
for a roster with a missing term, which clears the circulation window
too. This module is the thing that was missing between them.
⚠️ AND IT CAN GO BACK TO BEING A NUMBER WITHOUT THE REGISTER MOVING
(SAFETY-57). That is the exit, and it is bounded rather than free: the
window a release opens is `bound.unchanged_s` = 35 s, shorter than both
consumer holds (75 s and 85 s), so neither can reach a verdict inside
one - and a re-trip hands them a None, which CLEARS their windows. See
the module docstring's last section.
"""
return None if self.stale else self.last
@@ -373,6 +632,26 @@ class Freshness:
"""One line for the status page. Empty when there is nothing to say."""
return f"{unit_name}: {self.reason}" if self.stale else ""
def release_note(self, unit_name: str) -> str:
"""SAFETY-57's release, for the log. Empty when nothing was withdrawn.
⚠️ IT NAMES WHAT IS AND IS NOT BEING CLAIMED, because a line reading
"recovered" would be a lie: nothing has been learned about the register.
The verdict was withdrawn because it can no longer be tested, and the
next 35 s are the test.
"""
if self.released_at is None:
return ""
return (f"{unit_name}: STALE_WITHDRAWN after the standing command sat "
f"below {self.bound.move_w:.0f} W for "
f"{self.bound.release_s:.0f} s. NOTHING HAS BEEN LEARNED ABOUT "
f"THE REGISTER - it is still holding {self.held:+.0f} - but a "
f"verdict about a command that is no longer standing cannot be "
f"tested, and the 0 W this one produces is what stopped it "
f"being tested. The register is now re-graded over a fresh "
f"{self.bound.unchanged_s:.0f} s window; if it still does not "
f"follow, this returns")
def monotonic() -> float:
"""The clock this module's callers use, in one place so tests can find it.
goodwe_controller/app/main.py
+29 -2
View File
@@ -1769,6 +1769,7 @@ class Controller:
inv.soc = await self.hass.number(inv.soc_entity)
raw = await self.hass.number(inv.batt_entity, inv.batt_invert)
was_stale = inv.batt_fresh.stale
was_releases = inv.batt_fresh.releases
inv.batt_fresh.submit(raw, inv.standing_w(), now_mono)
# ⚠️ `inv.batt` IS THE GATED VALUE. A stale register is a MISSING input,
# not a measurement - `inputs_ok` sees the None, the site holds for
@@ -1777,11 +1778,37 @@ class Controller:
inv.batt = inv.batt_fresh.reading()
if inv.batt_fresh.stale and not was_stale:
self.log_event(f"STALE {inv.name}: " + inv.batt_fresh.reason)
# ⚠️ SAFETY-57 REWROTE THE LAST SENTENCE OF THIS LINE AND NOTHING
# ELSE IN IT. The escape clause used to read "It clears itself the
# moment the register reports a different value", full stop - and
# that was FALSE for the state this same line announces, because the
# 0 W it announces in the sentence before is exactly what stops the
# register ever being asked to report anything different. The live
# site sat in it for 790 s on 2026-09-21 and was freed by a human.
# ⚠️ THE DIAGNOSIS HALF IS SAFETY-56'S AND IS DELIBERATELY UNTOUCHED
# HERE - "is not following its own command" is wrong in a different
# way (a pack the BMS is refusing is not a faulty register) and that
# card is rewriting it. Two cards editing one sentence is how one of
# them silently loses.
_LOG.error("SAFETY-37: %s battery-power register is not following "
"its own command - %s. Treating it as MISSING, which "
"commands 0 W. It clears itself the moment the register "
"reports a different value.",
inv.name, inv.batt_fresh.reason)
"reports a different value, and failing that %.0f s "
"after the standing command falls below %.0f W "
"(SAFETY-57: a verdict whose own consequence is a 0 W "
"command cannot be tested again from inside it).",
inv.name, inv.batt_fresh.reason,
inv.batt_fresh.bound.release_s,
inv.batt_fresh.bound.move_w)
elif inv.batt_fresh.releases > was_releases:
# ⚠️ SAFETY-57. REPORTED, NEVER SILENT. A latch that lets go on a
# timer and says nothing is a latch no operator can audit - and this
# one is withdrawing a SITE STOP. `release_note()` is written to say
# that nothing has been learned about the register, because nothing
# has.
self.log_event(f"STALE WITHDRAWN {inv.name}")
_LOG.warning("SAFETY-57: %s",
inv.batt_fresh.release_note(inv.name))
@property
def shadow(self) -> bool: