OPT-09: the weights DO move on a wedged unit, and that narrows SAFETY-42

B1, the blocking review finding. §5 of the decision said:

    "A wedged unit reads a healthy SoC, so no envelope closes and no weight
     moves - OPT-09 cannot see it at all."

The first clause is true and is about the ENVELOPE. The second clause is
FALSE, and it was load-bearing for the claim that OPT-09 and SAFETY-42 meet
without overlapping. A weight is a function of a pack's ENERGY HEADROOM, not
of what the pack delivers, so a wedged unit's weight moves whenever its
headroom differs from its sibling's - the ordinary case this card exists to
exploit. And delivery.delinquent() (app/delivery.py:484, threshold at :531)
names a unit only while its short_by() gap exceeds min_w = Tuning.saturation_w
= 500 W in ABSOLUTE WATTS. Shrinking the share shrinks the gap below the
threshold, and the alarm stops firing on a unit still delivering nothing.

So the seam, stated accurately: OPT-09 stops the ask AND narrows SAFETY-42's
detection window for a low-headroom unit. That is a DETECTION REGRESSION at
N=2. It is disclosed here, not fixed: making delinquent() relative to the ask
rather than absolute is SAFETY-42's code and a design change, filed as its own
card.

1. THE CORRECTION, in the three places that carried the claim

   * DECISIONS/OPT-09-soc-aware-weights.md §5 - rewritten. States the seam
     accurately, quotes the sentence it is replacing, carries the measured
     rows and the window arithmetic, and names the residual in the same voice
     as SAFETY-13's "2 of 272" and SAFETY-42's "the discriminator does not
     exist". Also drops "they meet and do not overlap" from the opening.
   * app/packshare.py - a new section in the module docstring, immediately
     after "weights are a comfort choice for stability and not for delivery",
     which is where the over-read starts.
   * CHANGELOG.md - a new paragraph in the SAFETY-42 entry, ending on the
     operator-facing sentence: a wedged inverter with less energy headroom
     than its sibling can now go unreported at ordinary house loads.

   test_packshare.py part 8's closing check and its "what this file cannot
   see" list repeated the same false clause; both now say the ENVELOPE cannot
   reach a wedged unit and point at part 8b for what the WEIGHTS do to it.

2. THE GRADED CHECK - test_packshare.py part 8b, 6 named checks

   The reviewer's probe, reproduced: real compute(), real plan(), real
   packshare.weights(), real delivery.account(), real delivery.delinquent();
   the only model is the plant (A obeys within one cycle inside its rating,
   B accepts its share and delivers 0 W). Unit B is WEDGED at 15 % against
   its own 10 % floor, so envelope() does not close and account() explains
   nothing - a SAFETY-42 true positive by that card's own definition, which
   a PRECONDITION check asserts before anything is concluded from it.

       load 1500 W, B wedged at 15 %, equal weights  named on 199/200 cycles,
         site target +3000 W, shares a+1500, b+1500, grid +0 W, named=[b]
       load 1500 W, B wedged at 15 %, OPT-09 weights named on   0/200 cycles,
         site target +1630 W, shares a+1505, b+125,  grid -5 W, named=(nobody)
       load 6000 W, B wedged at 15 %, equal weights  named on 199/200 cycles
       load 6000 W, B wedged at 15 %, OPT-09 weights named on 195/200 cycles

       suppression window: equal weights, site target < 1000 W; OPT-09
       weights, site target < 6500 W of a 9600 W site

   THE CHECKS ASSERT THE CURRENT, UNFLATTERING BEHAVIOUR ON PURPOSE - that
   the weighted arm names NOBODY where the equal arm names the wedged unit.
   A check asserting the alarm still fires would fail, and papering over it
   would be worse than the original defect. The 6000 W row is there so the
   part is not pinning "the weighted arm never names anybody": past the
   healthy pack's own rating, _fill()'s last-resort pass hands the wedged
   unit 3000 W and both arms name it. The window is real and it has an edge.

   MUTATION - packshare.weights() keeps its shape and forces every weight to
   1.0 (M11 in part 11's table, which now has 11 rows). RUN on a purged tree
   with python3 -B, not reasoned about:

       load 1500 W, B wedged at 15 %, equal weights  named on 199/200 cycles,
         site target +3000 W, shares a+1500, b+1500, grid +0 W, named=[b]
       load 1500 W, B wedged at 15 %, OPT-09 weights named on 199/200 cycles,
         site target +3000 W, shares a+1500, b+1500, grid +0 W, named=[b]
       load 6000 W, B wedged at 15 %, OPT-09 weights named on 199/200 cycles,
         site target +4000 W, shares a+2000, b+2000, grid +4000 W, named=[b]
       suppression window: equal weights < 1000 W; OPT-09 weights < 1000 W

     FAIL  AND WITH OPT-09's WEIGHTS IT IS NAMED ON NONE OF THE 200 [...]
     FAIL  ...and the arithmetic behind it, stated as a window [...]
     FAIL  AND IT IS NOT THAT THE WEIGHTED ARM NEVER NAMES ANYBODY [...]

   test_packshare.py exits 1. Restored: exits 0.

3. THREE PROC-01 PROSE DEFECTS

   * DECISIONS/OPT-09-soc-aware-weights.md:3 said "Base: release/1.0 @
     464d398". The branch was rebased; git merge-base HEAD 3368231 is
     3368231. Corrected, and it says why the old number was there.
   * Same file:13 cited main.py:2272 for "resolution = resolve(...)".
     git show 3368231:goodwe_controller/app/main.py | grep -n says 2422.
     Corrected. The sibling citation arbiter.py:535 is right and is left.
   * DOCS.md:174 said "Since 0.7.x the split is driven by two separate
     things", which tells an operator the fix already shipped. config.yaml
     is 0.8.0 and the live install is 0.7.0, where the split is 50/50 - this
     card's own premise. Now "from 0.8.0 onwards", with an explicit warning
     that 0.7.0 and earlier are a fixed 50/50.

NOT TOUCHED, deliberately: delinquent()'s absolute threshold (SAFETY-42's
code, its own card), and app/main.py:2699's double-logged scope refusal (N4,
filed separately).

INVERTER B DOES NOT EXIST (expected ~2026-09-12). Every two-unit figure above
is TWO COPIES OF A through a plant modelled in test_packshare.py; B's 4600 W /
20.48 kWh / 10 % floor are from the datasheet and the serial. Nothing here was
measured on hardware, and the added disclaimers say so in each place.

Verified with the real harness per .gitea/workflows/checks.yml
(goodwe-addon-checks:1): COLLECTED 24 files, ALLGREEN. Harness positive
control run first - test_validate.py deliberately broken, harness reported
"FAILED: test_validate.py" and exited 1; restored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/DECISIONS/OPT-09-soc-aware-weights.md

@@ -1,6 +1,8 @@
 # OPT-09 - the weights parameter, and what it is honestly for
 
-**Status:** implemented. **Branch:** `OPT-09`. **Base:** `release/1.0` @ `464d398`.
+**Status:** implemented. **Branch:** `OPT-09`. **Base:** `release/1.0` @ `3368231`
+(`git merge-base HEAD 3368231`; the branch was rebased and this line used to name
+the pre-rebase base, `464d398`).
 
 ## 0. What was actually wrong
 
@@ -9,7 +11,7 @@ consumes it in two passes, and **nothing had ever passed one**. Confirmed on the
 base commit:
 
     arbiter.py:535   def resolve(claims, *, units=None, weights=None, live=None, ...)
-    main.py:2272     resolve(claims, units=self.units, live=self.live_units(), ...)
+    main.py:2422     resolve(claims, units=self.units, live=self.live_units(), ...)
 
 So `weights` was None on every tick of every install, `plan()` turned that into
 1.0 per unit, and the site target was split **50/50 regardless of what either
@@ -147,16 +149,67 @@ deferred option, and the BMS is what stops it.
 
 ## 5. SAFETY-42 - the same hazard from the opposite side
 
-They meet and do not overlap, and the seam is **the state of charge**:
+The seam is **the state of charge** - and they overlap in one direction, which
+is what the rest of this section is about:
 
 * **OPT-09 stops the site ASKING** a pack whose own SoC says it cannot deliver.
 * **SAFETY-42 alarms** when a pack that said it could does not.
 
-A wedged unit reads a healthy SoC, so no envelope closes and no weight moves -
-OPT-09 cannot see it at all. A pack at its floor is `account()`'s explained case,
-so SAFETY-42 stays silent - and after this card that ask does not arrive in the
-first place, which removes the benign arm from the detector's input rather than
-teaching it a new discriminator.
+A wedged unit reads a healthy SoC, so **no envelope closes** - that half is
+absolute, and it is why this card cannot stop the ask on a wedged box. A pack at
+its floor is `account()`'s explained case, so SAFETY-42 stays silent - and after
+this card that ask does not arrive in the first place, which removes the benign
+arm from the detector's input rather than teaching it a new discriminator.
+
+⚠️ **BUT THE WEIGHT DOES MOVE, AND IT NARROWS SAFETY-42's DETECTION WINDOW. THIS
+IS A DETECTION REGRESSION AT N=2 AND IT IS NOT FIXED HERE.** An earlier draft of
+this section said "no envelope closes and no weight moves - OPT-09 cannot see it
+at all". The second clause was **false**, and it was load-bearing for the claim
+that the two cards do not overlap. A weight is a function of the pack's ENERGY
+HEADROOM, not of what the pack delivers, so a wedged unit's weight moves whenever
+its headroom differs from its sibling's - which is the ordinary case this card
+exists to exploit. And `delivery.delinquent()` (`app/delivery.py:484`)
+names a unit only while its `short_by()` gap exceeds `min_w =
+Tuning.saturation_w` - the comparison is `app/delivery.py:531`, and it is
+**500 W in absolute watts**. Shrinking a unit's share shrinks its gap. Shrink the
+share far enough and the gap drops below 500 W while the unit is still delivering
+nothing, and the alarm stops firing.
+
+Measured on the closed loop - real `compute()`, real `plan()`, real
+`delinquent()`, modelled plant, B wedged at 15 % against its own 10 % floor so
+nothing closes and `account()` explains nothing, i.e. a SAFETY-42 **true
+positive** by that card's own definition:
+
+    load 1500 W  equal weights (shipped)  named on 199/200 cycles
+                 shares {a:1500, b:1500}  grid  +0 W  named=['inverter-b']
+    load 1500 W  OPT-09 weights           named on   0/200 cycles
+                 shares {a:1505, b: 125}  grid  -5 W  named=(nobody)
+
+⚠️ That plant is modelled in `test_packshare.py`, and **inverter B does not
+exist** (expected ~2026-09-12): it is two copies of A driven with different
+numbers, and B's 4600 W / 20.48 kWh / 10 % floor are from the datasheet and the
+serial. The claim is about the arithmetic of the split and the threshold, which
+needs no hardware, and not about a GW5000S-BP.
+
+At a load the healthy pack can cover - the regime where nothing else tells the
+operator anything, `unmet_w` is 0, the meter is satisfied and no action-log line
+fires - a wedged inverter goes from named on essentially every cycle to **never
+named**. The suppression window widens from `site target < 2 * min_w` = 1000 W to
+`site target < min_w * (w_A + w_B) / w_B`, which on that fixture is **6500 W** of
+a 9600 W site; above it - once the healthy pack is at its own rating and
+`_fill()`'s last-resort pass hands the wedged unit a big share again - the alarm
+returns. `test_packshare.py` part 8b grades all of it and **pins the current,
+unflattering behaviour**, so that the day it changes a named check moves.
+
+So the seam, stated accurately: **OPT-09 stops the ask AND narrows SAFETY-42's
+detection window for a low-headroom unit.** The two cards do not merely meet from
+opposite sides; this one takes something away from the other one. Closing the gap
+means making `delinquent()` relative to the ask rather than absolute, which is
+SAFETY-42's code and a design change - it is filed as its own card, deliberately
+not done here, and this paragraph is its input. Until then this is a **disclosed
+residual**, in the same voice as SAFETY-13's "2 of 272" and SAFETY-42's own "the
+discriminator does not exist": at two inverters, a wedged unit with materially
+less energy headroom than its sibling can go unreported at ordinary house loads.
 
 ⚠️ **And OPT-09 supplies the mechanism SAFETY-42 said was missing, without
 connecting it.** That module's rejection of re-allocation rests on *"the only