SAFETY-03 review fixes: both clamp stages always run, and two checks that could not fail

1. BEHAVIOURAL, and a regression this PR introduced. clamp_to_rating() returned
early from the max_w stage, so the device bound was applied only when the rating
bound had NOT fired - the bigger the overshoot, the less the guard did. At max_w
5000 against a +-4000 device, +9999 emitted +5000 W, outside the device range,
while +4500 was correctly held to +4000. It undid the pre-PR guarantee "never
send a value the device will reject outright" and undercut this module's own
case for max_w-not-min(), which rests on that stage catching a validation that
did not run. Both stages now always run; the result names both bounds when both
bite (max_w+device). Asserted over a 492-point sweep, because the defect was
invisible to any single-value check sitting inside one stage.

2. The hysteresis check issued range(CLEAR_CYCLES - 1) clean cycles, which at
CLEAR_CYCLES = 1 issues zero, passes, and prints "0 clean cycles do NOT clear
it" - green for the chatter setting the constant exists to prevent. Now: ONE
clean cycle must not clear the alarm, a literal that does not move with the
constant, and the de-assert count is measured by looping until it clears.

3. The re-assert check stimulated at REASSERT_S + 9, green for any value
including 3600 - the hour of silence the module promises not to produce. Now
stated in wall-clock terms: a loop pinned across the 900 s capacity-tariff
quarter must speak at least 5 times and on no more than 20% of cycles. Pinned in
both directions.

Red confirmed for each: the restored early return (3 checks), CLEAR_CYCLES = 1
(1), REASSERT_S = 3600 (1) and REASSERT_S = 0 (3).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015VXjA3LWccN1rJsk3okyPC

goodwe_controller/app/clamp.py

@@ -161,9 +161,9 @@ class ClampResult:
 
     def describe(self) -> str:
         return (f"{REASON_CODE}: the computed setpoint {self.requested_w:+.0f} W "
-                f"exceeds the {self.limit_w:.0f} W rating and was clamped to "
-                f"{self.applied_w:+.0f} W by the {self.bound} bound - something "
-                f"upstream is winding")
+                f"was clamped to {self.applied_w:+.0f} W by the {self.bound} "
+                f"bound (rating {self.limit_w:.0f} W) - something upstream is "
+                f"winding")
 
 
 def is_commandable(value) -> bool:
@@ -204,19 +204,32 @@ def clamp_to_rating(requested_w, limit_w, dev_min=None, dev_max=None) -> ClampRe
     requested = float(requested_w)
     limit = abs(float(limit_w))
 
+    # ⚠️ BOTH STAGES ALWAYS RUN. THIS USED TO `return` FROM THE FIRST ONE, AND
+    # THAT WAS A REGRESSION AGAINST THE CODE IT REPLACED. `write_setpoint()`
+    # previously clamped to the device range unconditionally, under the comment
+    # "never send a value the device will reject outright"; short-circuiting here
+    # meant the device bound was applied only when the rating bound had NOT
+    # fired, i.e. THE BIGGER THE OVERSHOOT THE LESS THE GUARD DID. Measured on
+    # the shipped function at max_w 5000 against a device of +-4000:
+    #
+    #     +9999 -> +5000  bound='max_w'   <- outside the device range
+    #     +4500 -> +4000  bound='device'
+    #
+    # It also undercut this module's own argument for clamping to `max_w` rather
+    # than a runtime `min()`, which rests entirely on this stage catching the
+    # case where the startup validation did not run.
     applied = max(-limit, min(limit, requested))
-    if applied != requested:
-        return ClampResult(requested, applied, limit, True, "max_w")
+    bound = "max_w" if applied != requested else ""
 
     # Second stage. Arithmetically dead after a successful startup validation -
     # and therefore worth alarming on precisely BECAUSE it fired.
     if dev_min is not None and dev_max is not None:
         bounded = max(float(dev_min), min(float(dev_max), applied))
         if bounded != applied:
-            return ClampResult(requested, bounded, limit, True, "device")
-        applied = bounded
+            bound = "device" if not bound else "max_w+device"
+            applied = bounded
 
-    return ClampResult(requested, applied, limit, False, "")
+    return ClampResult(requested, applied, limit, applied != requested, bound)
 
 
 class ClampWatchdog: