SAFETY-37: a stale reading is None, and arrival cannot be what says so

The architect pass made SAFETY-37, TEL-06 and TEL-08 one systemic problem -
"a stale reading holds its last value and reads healthy" - and this builds the
single policy. Both consumers the card names are gated by one change, and
neither consumer needed a line: `SignWatchdog.evaluate` already CLEARS its
window on a None measurement and `circulating_w` already returns None for a
roster with a missing term. Neither could ever receive one. The gate is the
piece that was missing BETWEEN the shipped read and the shipped checks.

⚠️ ONE CRITERION IN THE CARD COULD NOT BE IMPLEMENTED AS WRITTEN, AND SAYING SO
IS THE MAIN CONTENT. The card says "only arrival separates them". At this layer
arrival cannot: `read_inputs()` polls Home Assistant's state cache about once a
second and HA answers 200 with a number whether or not the publisher behind the
entity is alive, so both members of the pair arrive identically for ever.
test_freshness.py part 1a BUILDS the arrival-age gate the card asks for and
grades it failing - the age is 0.0 s at every instant of both runs, a threshold
that can never fire, which is TEL-06's own defect one layer up. The half of the
rule that survives is honoured absolutely: nothing here reads a Home Assistant
timestamp, and the check asserts the module contains no `last_updated`.

So the criterion became: a reading is stale when it has not moved through a
change it was OBLIGED to follow.

    STALE  <=>  unchanged >= 35 s
                AND |standing| >= 250 W
                AND |standing - standing when the reading last changed| >= 250 W

Latched until a different value arrives. `Inverter.batt` becomes None - never a
held number - which is a missing input, which §11.1 rule 1 answers with 0 W.

WHY A CONJUNCTION AND NOT A THRESHOLD, MEASURED 2026-09-06. Replaying the
committed 30-day capture of this house's own 1 W power entity (485,841 samples
out of HA's recorder, where a row exists only on a CHANGE, so the gap between
rows IS the unchanged duration every consumer saw): the longest legitimate
unchanged run is 263.2 s, held at -899.0 W. A false-positive-free threshold
would have to exceed that, and 263 s is 3.5x too slow for a consumer that trips
at 75 s. There is no admissible threshold. Every one of those long runs is
under an UNMOVING load, which is what the travel term keys on.

THE BOUND, derived at both ends and graded against the shipped config.yaml.
Floor 17.0 s = 6.0 plant settle (NOTES §5.9, measured 2026-08-22) + 10.0
ESPHome publish (firmware/goodwe-master.yaml:181) + 1.0 read period
(run_control's asyncio.sleep(1)). Ceiling 75.0 s = min(circulation_hold_s 75,
unit_sign_disagree_s 85). Band [34.0, 37.5]; 35 is a CHOICE inside a DERIVED
band and the check says so - the first draft claimed the band held one integer
and went red on its own first run. MOVE_W is the LARGEST admissible value,
unit_sign_disagree_w, because below it the consumer cannot speak at all.

SoC is STATED, NOT WIRED, and BOUNDS carries it with wired=False and the reason.
Its obligation term is energy through the pack, not command travel - a rested
pack holds a percent for hours under a 0 W command - and K needs a usable
capacity nobody has measured. That is TEL-08's; the record says so.

⚠️ BEHAVIOUR CHANGES AT THE SHIPPED ROSTER OF ONE, and it is named rather than
hidden: a FROZEN register now stops the site where it used to read as a healthy
measurement for ever. That is HW-01, which was a one-inverter site. A healthy
install is unchanged, asserted over sixty reads of a dithering register under a
reversing command. A false verdict fails toward 0 W behind the existing
stale_input_s hold and clears itself on the register's next move.

⚠️ BOTH UNITS IN EVERY TWO-INVERTER FIXTURE ARE INVERTER A with different
numbers passed in; inverter B does not physically exist (~2026-09-12).

MUTATION: 16 mutations against a purged, :ro, python3 -B tree, fingerprinted
before and after every revert. One survivor, and it is the finding - dropping
the magnitude term left every check green because no fixture separated "the
command travelled 250 W" from "the command ended up above 250 W". Closed, and
recorded as MUTATION.md habit 17. A second process defect is habit 18: a
mutation run that timed out between the edit and the revert left the module
mutated on disk and nothing announced it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/app/inverter.py

@@ -122,6 +122,9 @@ import math
 from datetime import datetime
 
 from .clamp import ClampResult
+# SAFETY-37. The freshness policy, and the ONE place its bounds are written.
+# freshness.py imports nothing from this package, so the direction is one-way.
+from .freshness import BOUNDS, Freshness
 # CFG-03's ONE in-code mirror of config.yaml's SAFETY-24 defaults. Imported
 # rather than retyped: the flat-keys path below needs `bms_soc_floor`'s
 # shipped default and a literal here would be the fourth defaults site that
@@ -213,7 +216,22 @@ class Inverter:
 
         # --- this unit's own measurements ------------------------------------
         self.soc = None
+        # ⚠️ SAFETY-37: `batt` IS NOW THE GATED READING, NOT THE RAW ONE. It is
+        # None whenever `batt_fresh` says the register is not following its own
+        # command - see freshness.py - and a None here is a MISSING input, which
+        # §11.1 rule 1 answers with 0 W. The raw number that arrived is on
+        # `batt_fresh.last`; read that only for diagnostics, never for control.
         self.batt = None
+        # SAFETY-37. One arrival record per SIGNAL per UNIT. Per unit for
+        # DEV-02's reason - a freshness verdict about B is not evidence about A,
+        # and at N>=2 a shared record would be the flat-scalar defect rebuilt
+        # inside the gate that exists to protect the per-unit checks.
+        #
+        # ⚠️ ONLY `batt` IS WIRED. `BOUNDS["soc"]` exists and is deliberately not
+        # constructed here: SoC's obligation term is energy through the pack, not
+        # command travel, and the constant it needs has not been measured. That
+        # is TEL-08's, and freshness.py's docstring says exactly what it owes.
+        self.batt_fresh = Freshness(BOUNDS["batt"])
 
         # --- what this unit was last told, and what it last accepted ---------
         # `target` is THIS unit's share of the site target from the last
@@ -266,6 +284,24 @@ class Inverter:
             self.store.set(self.key(name), value)
 
     # -- the numbers other modules ask this object for -----------------------
+    def standing_w(self) -> float:
+        """What this controller has standing on THIS unit's wire right now.
+
+        ⚠️ ONE DEFINITION, TWO CALLERS, and it was a transcription before
+        SAFETY-37. `cycle()` computes this for the sign watchdog and
+        `_read_unit()` needs the identical number for the freshness conjunction;
+        two spellings of "what is standing" would be two answers to the question
+        the gate and the check it protects are both asking, and the copy that
+        drifts is always the one further from the wire.
+
+        `last_write` is the value after the device clamp and confirmed accepted;
+        `target` covers the case where nothing has been written yet and,
+        deliberately, the case where the last write was REJECTED - the inverter
+        is then still latched on `last_write`, which is what `last_write` holds.
+        """
+        return float(self.last_write if self.last_write is not None
+                     else self.target)
+
     def rating_w(self) -> float:
         """The largest magnitude this unit can be commanded, in W.
 
@@ -319,6 +355,18 @@ class Inverter:
                                f"(limit {float(stale_s):.0f} s)")
         return True, ""
 
+    def stale_note(self) -> str:
+        """SAFETY-37's one line for the status page. Empty when nothing to say.
+
+        Separate from `link_note()` because they are about different halves of
+        the device and want opposite remedies: liveness is about the WRITE path
+        and its answer is to drop this unit and let the survivors carry it,
+        while a stale MEASUREMENT is about the read path and its answer is to
+        stop the site (`inputs_ok`). Folding one into the other is how a
+        measurement fault ends up handing a sibling extra power.
+        """
+        return self.batt_fresh.note(self.name)
+
     def link_note(self, now: datetime) -> str:
         """One line for the status page. Empty when there is nothing to say."""
         if not self.has_writer():