SAFETY-10: the whole decision path runs and nothing reaches the inverter

Every optimiser defect this project has found was invisible from outside
while it was happening, and each was paid for at the meter first: SAFETY-45's
28 charge onsets an hour against a binding peak_cap_w, TARIFF-14's wrong
quarter-hour for 45 minutes in every 60, SAFETY-46's 598 Wh spent to gain
310 Wh. There was no way to watch what the optimiser WOULD do without letting
it do it.

`shadow_mode` runs strategies, arbiter, clamps and guards, records the
decision with its reason, and commands nothing.

⚠️ IT WRITES. It writes 0 W, on the ordinary heartbeat, through the ordinary
single writer. The inverter holds its last command forever - it has no meter
timeout - so "commands nothing" implemented as "stops writing" would leave
whatever was standing when shadow mode came on standing for as long as it was
left on, under a page saying nothing is being commanded. That is the failure
this repository keeps finding. Refreshing 0 W is also what
firmware/goodwe-master.yaml's 30 s stale-input watchdog requires of us; going
quiet would keep that board tripped for the whole run, which is an alarm being
used as a mode.

⚠️ IT IS NOT A SECOND WRITE PATH. No claim, no transport, no arithmetic of its
own. It is a substitution inside Controller._write_unit() - the single choke
point every write already reaches - in the same form as the three above it,
and it is the LAST of them, so SAFETY-28's gate and SAFETY-03's clamp still
grade the number the decision path produced.

⚠️ THE DEFAULT IS `auto`, NOT `true`, AND THAT IS THE CARD'S REAL CONTENT. The
Supervisor composes options as {**config.yaml defaults, **stored user
options}, so a new key with a new default reaches EVERY EXISTING INSTALL on
the next update - including the one regulating a real battery. A boolean
default-on would have stopped it silently. There is no mechanism by which one
key can default differently for a new install and an existing one, so
"default-on for new" is a value the add-on RESOLVES: `auto` is shadow while
control is STOPPED and live once it is STARTED. A fresh install ships
`auto_start: false` and comes up observing; an install that is controlling is
started and does not change by one watt.

THE FAILSAFES. Sign watchdogs (SAFETY-02/30): INERT - they grade
Inverter.standing_w(), which shadow mode holds at 0 W. Fed the shadow decision
they would disagree with a meter that never saw it and LATCH A TRIP THAT
SURVIVES INTO LIVE OPERATION AND A RESTART. Clamp (SAFETY-03), write gate
(SAFETY-28), meter freeze (SAFETY-18), peak guard: OBSERVE. Circulation
(SAFETY-31) and delivery (SAFETY-42): observe and may legitimately latch,
because their evidence is measured power. The operator stop is the one
deliberate change: enforced at the wire rather than as a P_SAFETY claim, which
would otherwise make every recorded decision read "stopped".

⚠️ RECORDED LIMITATION: _shadow_settle() re-seeds the carried command to what
stands on the wire, which makes the exit safe by construction - and therefore
the loop leg's shadow decision is ONE SLEW STEP, not a trajectory. A shadow
run answers "what would it command now", not "what would it have done next".
The strategies are unaffected; all three defects above are visible from one.

Graded on the writes and on the rendered surface, never on the flag: 22
mutations, no survivors, including one that lets a write escape and one that
goes silent instead of commanding 0 W. Closed loop on TEST-23 stage 3's rig,
same hour twice: live drives the pack to -2000 W and SoC 50.000 -> 62.331 %;
shadow commands 0 W throughout, SoC stays 50.0 exactly, and the arbitrage
decision is identical in action, instant, signed power, reason and arbiter
winner.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -28,6 +28,42 @@ if it has, it needs 0.10.0. Whoever deploys decides.
 | _this branch_ | TARIFF-18 - `price_taxes_eur_kwh` stops shipping at half the real Flemish figure **⚠️ CHANGED DEFAULT** |
 | _this branch_ | TARIFF-16 - the injection leg stops being one number: an injection formula with its own coefficients, its own VAT and no floor under zero |
 | _this branch_ | SAFETY-45 - a price-driven charge is SIZED by the capacity-tariff guard instead of being switched on and off by it **⚠️ CONTROL STABILITY** |
+| _this branch_ | SAFETY-10 - shadow mode: the whole decision path runs and nothing reaches the inverter **⚠️ NEW OPTION, DEFAULT-ON FOR A NEW INSTALL** |
+
+### SAFETY-10 — shadow mode, and what its default does to YOUR install
+
+A new option, `shadow_mode`, with three values and a shipped default of
+`auto`. In shadow mode the add-on runs its entire decision path — strategies,
+arbiter, clamps, guards — and **sends nothing to the inverter**: every inverter
+is held at **0 W**, refreshed on the ordinary heartbeat by the ordinary single
+writer, and the status page says plainly that the battery is not being
+controlled. What it *would* have commanded, and why, is on the status page and
+in the action log.
+
+⚠️ **WHAT HAPPENS TO AN EXISTING INSTALL: NOTHING.** `auto` resolves to shadow
+mode only while control is **stopped**. An install that is controlling —
+`auto_start: true`, or *Start / stop control* pressed — is started, so `auto`
+resolves to ordinary control and not one watt changes. An install that is
+**stopped** keeps its actuator at 0 W exactly as it did before, from the same
+writer on the same heartbeat; what changes for it is what the status page and
+the action log **say**, and that the decision path now runs and is recorded.
+
+⚠️ **AND THAT IS WHY IT IS NOT A BOOLEAN.** The card is titled "default-on".
+Taken literally — `shadow_mode: true` in `config.yaml` — it would be the worst
+change in this repository's history: the Supervisor composes an add-on's
+options as *its defaults, overlaid with the stored user options*, so a new key
+with a new default reaches **every existing install** on the next update,
+including the one regulating a real battery at the reference site. It would
+have silently stopped it, and the only symptom would have been a battery that
+stopped doing anything. There is no mechanism in the add-on options system that
+lets one key default differently for a new install and an existing one, so
+"default-on for new" is expressed as a value the add-on **resolves** rather
+than a constant the Supervisor merges.
+
+A **new** install ships `auto_start: false`, so it comes up in shadow mode and
+observes a day of decisions before it is allowed to command anything. That is
+the default-on the card asked for, delivered where it is safe and withheld
+where it is not.
 
 ⚠️ **A CONFIG THAT STARTS ON THE CURRENT VERSION CAN BE REFUSED ON THE NEXT
 ONE.** TARIFF-07 withdraws `engie_dynamic`, `totalenergies_dynamic` and