SAFETY-13: the output freeze gets an exit, and only where it needs one

While the loop is frozen the command's magnitude may fall but never rise. At
prev_w == 0 there is no magnitude left to fall, so a charge cannot START. That
refusal is deliberate and it is kept: the inverter reporting power we did not
command means another writer is on the actuator, which is the §1.5 non-goal.
What it did not have was an END - nothing cleared it but the other writer
leaving.

Reproduced on release/1.0 @ c8dcb38, at the live install's shape (max_w 5000,
slew_w 400, target_grid_w -10), with another writer holding the pack at +700 W.
The route is not the obvious one: entering from an export, the slew limit moves
the command off zero before the counter reaches 3. It is entered from the
DEADBAND - a site resting at its target counts saturated cycles while nothing is
wrong - and 0 W is then a fixed point: a 2 kW export arriving afterwards leaves
the command at exactly 0.0 W on every subsequent cycle.

And prev_w == 0 is not where it stops. The same tuning pins at -800 W against
its own integrator standing at -2388 W, with the same absence of an exit. So the
change is written against the output freeze, not against a special case of it.

THE DECISION IS WHICH FREEZES GET AN EXIT, NOT HOW LONG THE BLOCK LASTS.

  - A divergence a LIMIT could have produced - the inverter doing less than the
    command, in the command's own direction - clears itself, because the command
    is pinned at something the inverter can reach. No exit. release/1.0
    unchanged, and asserted so: a curtailed inverter is never released over 30
    cycles.
  - A divergence a limit could NOT have produced - overshooting the command, or
    the opposite sign - cannot clear itself, because clearing it needs the
    inverter to track OUR command. That one releases.

unasked_power() is that predicate and it is physical, not statistical: a limit
can only make the inverter do less, in the command's own direction, so
everything a limit can produce lies in the interval spanned by 0 and prev_w
widened by saturation_w. At prev_w == 0 it IS the saturation test, which is
exactly why the zero case is the one that strands.

The bound is not a new number. SETTLE_CYCLES = ceil(PLANT_SETTLE_S /
LOOP_TICK_S) = 9, SAFETY-39's two measured constants and the reciprocal of
SLEW_RAIL_FRAC: a divergence still standing after the plant's own settling time
is not this plant catching up. _SAT_COUNT_CAP is written as SETTLE_CYCLES + 1;
its value is unchanged at 10.

RELEASING THE OUTPUT FREEZE DOES NOT UNFREEZE THE LOOP, which is what makes this
bounded. The integrator freeze is untouched, so a released cycle can only move
the command toward an accumulator that stopped accumulating, by at most one slew
step, and never past it - swept over 107 625 released states. On the run above
the command starts on the ninth saturated cycle and settles at -1190 W against a
frozen integrator of -1194 W, not at the 5000 W rail.

Graded against a transcription of release/1.0 over the 3024-case sweep, which
was NOT taught the new rule: 2592 cases bit-identical, 432 releases, and 27 of
those change the command - every one a charge from prev_w == 0 that release/1.0
refused to start.

SAFETY-04's deliberate assertion is kept rather than inverted: its fixture sits
below the bound, so it still asserts the block, and the release is asserted
beside it on the other side of the bound.

Coverage audit re-measured, same mutation form, __pycache__ purged: output
freeze 2 -> 11 (2 reproduced on a pristine c8dcb38 first), the exit 4,
unasked_power 6.

saturation_cycles at 9 or 10 removes the block entirely, because the freeze
cannot engage before its own exit is due. Not refused at startup; asserted in
the tests and written in DOCS.md.

Nothing was measured on two inverters: inverter B does not physically exist
(NOTES.md §1.1b) and sim/plantsim.py:216 INVERTER_B is INVERTER_A copied with
measured=False. The N=2 escalation is stated from the code (actual_w is
site_batt_w, the SUM) and is labelled as such.

22/22 test files pass in goodwe-addon-ci, mounted :ro, bytecode purged first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/app/control.py

@@ -16,6 +16,7 @@ the short version is in the comments below. Do not "clean this up" - each rule
 exists because its absence produced a specific, observed failure.
 """
 
+import math
 from dataclasses import dataclass
 
 # ---------------------------------------------------------------------------
@@ -86,6 +87,56 @@ PLANT_SETTLE_S = 18.0
 LOOP_TICK_S = 2.0
 SLEW_RAIL_FRAC = LOOP_TICK_S / PLANT_SETTLE_S      # 0.111..., i.e. 9 ticks
 
+# ---------------------------------------------------------------------------
+# SAFETY-13. HOW LONG THE PLANT STAYS A CANDIDATE EXPLANATION.
+#
+# The output freeze below stops the command growing while the inverter is not
+# following. Two completely different things produce that divergence and the
+# freeze cannot tell them apart on magnitude alone:
+#
+#   (a) THE PLANT HAS NOT CAUGHT UP YET, or it is at a limit - a cold pack, a
+#       curtailment, an export cap. Asking for more is pointless, and the
+#       freeze is right to hold. It also CLEARS ITSELF: the command is pinned
+#       at something the inverter can do, so the inverter catches up to it and
+#       `saturated_now` goes false.
+#
+#   (b) SOMETHING ELSE IS DRIVING THE ACTUATOR - the §1.5 non-goal, two writers
+#       on one actuator. The freeze CANNOT clear itself here, because clearing
+#       it needs the inverter to track OUR command and the other writer is what
+#       stops it. Nothing ends this but the other writer going away.
+#
+# ⚠️ SO THE BOUND BELONGS TO (b) AND ONLY TO (b), and this constant is what
+# separates them in TIME rather than by guessing. Case (a) is bounded by the
+# plant: PLANT_SETTLE_S is how long this plant takes to settle, measured, and
+# after that the plant has run out of alibi. A divergence still standing after
+# PLANT_SETTLE_S is not this plant catching up.
+#
+#     SETTLE_CYCLES = ceil(PLANT_SETTLE_S / LOOP_TICK_S)
+#
+# ⚠️ THE SAME TWO MEASURED NUMBERS SAFETY-39 USES, AND DELIBERATELY NOT A NEW
+# ONE. It is the reciprocal of SLEW_RAIL_FRAC - the slew limit takes exactly
+# this many ticks to traverse the rail, for exactly this reason. A new constant
+# here would be a second thing to re-derive when the plant is re-measured, and
+# a number that outlives its derivation is the defect SAFETY-39 was about.
+#
+# ⚠️ AND IT INHERITS SAFETY-39's CAVEAT ABOUT LOOP_TICK_S, in the opposite
+# direction, which is why it is repeated rather than cross-referenced. A meter
+# SLOWER than 2 s makes these 9 cycles cover MORE than 18 s, so the freeze
+# holds longer than the plant needs: that costs energy - see the case in
+# DOCS.md - and never safety. A meter FASTER than 2 s makes them cover LESS,
+# so the freeze can release while the plant is genuinely still moving. That one
+# is bounded twice over and by neither this constant nor luck: the INTEGRATOR
+# freeze is not released with the output freeze, so the command can only reach
+# the integrator's frozen value, and the output clamp bounds that in turn.
+SETTLE_CYCLES = math.ceil(PLANT_SETTLE_S / LOOP_TICK_S)      # 9
+
+# The saturation counter's ceiling. It has always been 10 and still is; it is
+# written against SETTLE_CYCLES rather than as a literal so that a counter
+# capped BELOW the longest bound read from it - which would silently make that
+# bound unreachable, i.e. delete the exit condition - cannot happen by editing
+# one of the two.
+_SAT_COUNT_CAP = SETTLE_CYCLES + 1                           # 10
+
 
 @dataclass(frozen=True)
 class Tuning:
@@ -185,6 +236,48 @@ def slew_limit_w(tuning: Tuning) -> float:
     return SLEW_RAIL_FRAC * abs(float(tuning.max_w))
 
 
+def unasked_power(prev_w: float, actual_w: float, saturation_w: float) -> bool:
+    """True when `actual_w` cannot be explained by the command not being met.
+
+    SAFETY-13. The one question the saturation magnitude test cannot answer:
+    is the inverter FAILING TO REACH what we asked, or is it doing something we
+    never asked for at all?
+
+    ⚠️ THE ANSWER IS PHYSICAL, NOT STATISTICAL, WHICH IS WHY IT IS A PREDICATE
+    AND NOT A THRESHOLD. A limit can only make the inverter do LESS than the
+    command, in the command's own direction. It cannot make it overshoot the
+    command, and it cannot make it produce power of the OPPOSITE sign. So the
+    whole set of readings a limit can produce is the closed interval spanned by
+    0 and `prev_w`, widened by `saturation_w` for measurement noise, ramp lag
+    and the inverter's own idle draw. Anything outside that interval was put
+    there by something other than this loop.
+
+    Worked, at `saturation_w = 500`:
+
+        prev  +2000, actual   +700  ->  inside [0, 2000]     a limit. False.
+        prev  -5000, actual   -700  ->  inside [-5000, 0]    a limit. False.
+        prev      0, actual   +700  ->  outside [-500, 500]  unasked. True.
+        prev   -800, actual   +700  ->  outside [-1300, 500] unasked. True.
+
+    ⚠️ AT `prev_w == 0` THIS IS EXACTLY `saturated_now`, and that is not a
+    coincidence to be tidied away - it is the reason the freeze's zero case is
+    the one the card was written about. With nothing commanded there is no
+    interval left for a limit to live in, so every saturated cycle at zero is a
+    cycle in which the actuator is being driven by someone else.
+
+    ⚠️ IT IS NOT A DETECTOR AND MUST NOT BE ALARMED ON. A saturated inverter
+    whose reading is stale, wrong-signed or simply noisy lands outside the
+    interval too. All this predicate decides is whether the output freeze gets
+    an EXIT; being wrong about it costs at most a bounded command that the
+    frozen integrator and the output clamp both still bound. SAFETY-30's
+    `unit_sign_disagree_w` is the thing that alarms on sign, and it is
+    deliberately a different test with a different threshold.
+    """
+    lo = min(0.0, float(prev_w)) - abs(float(saturation_w))
+    hi = max(0.0, float(prev_w)) + abs(float(saturation_w))
+    return not (lo <= float(actual_w) <= hi)
+
+
 def compute(
     prev_w: float,
     grid_w: float,
@@ -232,7 +325,7 @@ def compute(
     # clockless; the remaining ceiling is that saturation_cycles expresses a
     # bound in seconds rather than an exact number of them.
     saturated_now = abs(prev_w - actual_w) > tuning.saturation_w
-    sat_count = min(sat_count + 1, 10) if saturated_now else 0
+    sat_count = min(sat_count + 1, _SAT_COUNT_CAP) if saturated_now else 0
     frozen = sat_count >= tuning.saturation_cycles
 
     # --- deadband ----------------------------------------------------------
@@ -346,8 +439,53 @@ def compute(
         # implementation: commanding 0 while the inverter reports >500 W means
         # something else is driving the bus, and that is not the moment to
         # start pushing power the other way.
-        target = min(target, prev_w) if prev_w > 0 else max(target, prev_w)
-        reason = "saturated-freeze"
+        #
+        # --- SAFETY-13: ...AND IT IS NOT THE MOMENT FOREVER EITHER ----------
+        # Everything above stands. What was missing is an END. Held at
+        # `prev_w == 0` this is a refusal to START, and nothing in this
+        # function or above it clears it - not the error growing, not the
+        # integrator moving, not time. Measured on release/1.0 @ c8dcb38, at
+        # the live install's shape (max_w 5000, slew_w 400, target_grid_w -10):
+        # a site resting in the deadband with another writer holding the pack
+        # at +700 W reaches sat_count 3 with the command at 0, and 0 W is then
+        # a FIXED POINT - a 2 kW export arriving afterwards leaves the command
+        # at exactly 0.0 W on every subsequent cycle, with the integrator
+        # standing at -1194 W the whole time.
+        #
+        # ⚠️ AND THE ZERO CASE IS NOT SPECIAL, WHICH IS WHY THE FIX IS NOT
+        # SPECIAL EITHER. The same run pinned at prev_w == -800 W, against its
+        # own integrator standing at -2388 W, for as long as it ran.
+        # `prev_w == 0` is only the instance where the pinned magnitude happens
+        # to be zero - i.e. where the standing cost is the whole of what the
+        # battery could have done.
+        # A rule written for the zero case alone would have left the other
+        # instances exactly as unbounded as it found them.
+        #
+        # ⚠️ WHAT DECIDES IS NOT HOW LONG, IT IS WHETHER THE FREEZE CAN EVER
+        # END ON ITS OWN. See SETTLE_CYCLES and `unasked_power()` at the top:
+        # a divergence a LIMIT could produce clears itself once the inverter
+        # catches up to the pinned command, so it needs no exit and gets none -
+        # unbounded, exactly as shipped. A divergence a limit CANNOT produce is
+        # another writer, which by construction stops our command ever being
+        # tracked, so it can only end when the other writer leaves. That is the
+        # one this releases, and only after the divergence has outlasted the
+        # plant that would otherwise have explained it.
+        #
+        # ⚠️ RELEASING IS NOT UNFREEZING. The INTEGRATOR freeze above is not
+        # lifted, and that is what makes this bounded rather than merely
+        # different: the command is free to move, but only as far as an
+        # integrator that stopped accumulating cycles ago, through the same
+        # slew limit as any other cycle. It buys back the standing error, not
+        # the rail.
+        #
+        # `reason` is authoritative here in a way it is not elsewhere in this
+        # function: nothing after this line writes it.
+        if unasked_power(prev_w, actual_w, tuning.saturation_w) \
+                and sat_count >= SETTLE_CYCLES:
+            reason = "freeze-released"
+        else:
+            target = min(target, prev_w) if prev_w > 0 else max(target, prev_w)
+            reason = "saturated-freeze"
 
     # --- quantise ----------------------------------------------------------
     # 10 W. The register is 1 W and the inverter reports at 1 W, but its