SAFETY-10: the whole decision path runs and nothing reaches the inverter

Every optimiser defect this project has found was invisible from outside
while it was happening, and each was paid for at the meter first: SAFETY-45's
28 charge onsets an hour against a binding peak_cap_w, TARIFF-14's wrong
quarter-hour for 45 minutes in every 60, SAFETY-46's 598 Wh spent to gain
310 Wh. There was no way to watch what the optimiser WOULD do without letting
it do it.

`shadow_mode` runs strategies, arbiter, clamps and guards, records the
decision with its reason, and commands nothing.

⚠️ IT WRITES. It writes 0 W, on the ordinary heartbeat, through the ordinary
single writer. The inverter holds its last command forever - it has no meter
timeout - so "commands nothing" implemented as "stops writing" would leave
whatever was standing when shadow mode came on standing for as long as it was
left on, under a page saying nothing is being commanded. That is the failure
this repository keeps finding. Refreshing 0 W is also what
firmware/goodwe-master.yaml's 30 s stale-input watchdog requires of us; going
quiet would keep that board tripped for the whole run, which is an alarm being
used as a mode.

⚠️ IT IS NOT A SECOND WRITE PATH. No claim, no transport, no arithmetic of its
own. It is a substitution inside Controller._write_unit() - the single choke
point every write already reaches - in the same form as the three above it,
and it is the LAST of them, so SAFETY-28's gate and SAFETY-03's clamp still
grade the number the decision path produced.

⚠️ THE DEFAULT IS `auto`, NOT `true`, AND THAT IS THE CARD'S REAL CONTENT. The
Supervisor composes options as {**config.yaml defaults, **stored user
options}, so a new key with a new default reaches EVERY EXISTING INSTALL on
the next update - including the one regulating a real battery. A boolean
default-on would have stopped it silently. There is no mechanism by which one
key can default differently for a new install and an existing one, so
"default-on for new" is a value the add-on RESOLVES: `auto` is shadow while
control is STOPPED and live once it is STARTED. A fresh install ships
`auto_start: false` and comes up observing; an install that is controlling is
started and does not change by one watt.

THE FAILSAFES. Sign watchdogs (SAFETY-02/30): INERT - they grade
Inverter.standing_w(), which shadow mode holds at 0 W. Fed the shadow decision
they would disagree with a meter that never saw it and LATCH A TRIP THAT
SURVIVES INTO LIVE OPERATION AND A RESTART. Clamp (SAFETY-03), write gate
(SAFETY-28), meter freeze (SAFETY-18), peak guard: OBSERVE. Circulation
(SAFETY-31) and delivery (SAFETY-42): observe and may legitimately latch,
because their evidence is measured power. The operator stop is the one
deliberate change: enforced at the wire rather than as a P_SAFETY claim, which
would otherwise make every recorded decision read "stopped".

⚠️ RECORDED LIMITATION: _shadow_settle() re-seeds the carried command to what
stands on the wire, which makes the exit safe by construction - and therefore
the loop leg's shadow decision is ONE SLEW STEP, not a trajectory. A shadow
run answers "what would it command now", not "what would it have done next".
The strategies are unaffected; all three defects above are visible from one.

Graded on the writes and on the rendered surface, never on the flag: 22
mutations, no survivors, including one that lets a write escape and one that
goes silent instead of commanding 0 W. Closed loop on TEST-23 stage 3's rig,
same hour twice: live drives the pack to -2000 W and SoC 50.000 -> 62.331 %;
shadow commands 0 W throughout, SoC stays 50.0 exactly, and the arbitrage
decision is identical in action, instant, signed power, reason and arbiter
winner.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/test_validate.py

@@ -21,6 +21,7 @@ from app.maintenance import MAINT_OPTION_DEFAULTS, MaintConfig
 from app.price import (
     PRICE_OPTION_DEFAULTS, SUPERSEDED_TAXES_DEFAULTS_EUR_KWH)
 from app.control import LOOP_TICK_S, PLANT_SETTLE_S, SLEW_RAIL_FRAC
+from app import shadow
 from app.validate import (
     ACTUATOR_WRITE_KEYS, FIRMWARE_INGEST_VETO_S, ConfigRefused,
     actuator_writers, refuse, site_rail_w, validate_startup_config,
@@ -1722,6 +1723,90 @@ check("and the 6% asymmetry is reported as an ORDERED PAIR: the transposed "
           "vat_pct 6" not in _T16_PAIR[0])
 
 
+# --------------------------------------------------------------------------- #
+print("\nSAFETY-10 - shadow_mode is validated like every other option")
+# ⚠️ WHY THIS IS A REFUSAL AND NOT A COERCION. `shadow.mode()` resolves an
+# unrecognised value to SHADOW - the direction that does not move energy - and
+# an install silently reinterpreted that way COMMANDS NOTHING, indefinitely,
+# while its status page calmly explains that this is intentional. A typo is not
+# a decision, and UX-02 made this validator the one rule surface both editors
+# read, so the rule has to be here rather than in a quiet fallback.
+_S10_BAD = ["true", "yes", "1", "shadow", "", "autoo", None, 1]
+for _v in _S10_BAD:
+    _p = validate_startup_config(base(shadow_mode=_v), -5000, 5000)
+    check(f"shadow_mode={_v!r} is REFUSED, and the refusal SPELLS the key so "
+          "configui.problems_by_field() can file it under the right control",
+          why(_p, "shadow_mode is") and why(_p, "'auto'")
+          and why(_p, "'on'") and why(_p, "'off'"))
+for _v in ("auto", "on", "off", "AUTO", " on ", "Auto "):
+    check(f"shadow_mode={_v!r} starts - the three values and the tolerant "
+          "spellings of them are accepted, so the rule above refuses garbage "
+          "and not case",
+          validate_startup_config(base(shadow_mode=_v), -5000, 5000) == [])
+check("PRECONDITION: and the key being ABSENT starts too, which is what every "
+      "install that upgrades into this version has. A rule that refused the "
+      "absent key would refuse every existing install at once",
+      validate_startup_config(base(), -5000, 5000) == []
+      and "shadow_mode" not in base())
+# The two arrangements have to DISAGREE somewhere, or `why()` is grading a
+# sentence that is in the list for another reason entirely.
+check("...and a refused shadow_mode is the ONLY thing wrong with that config, "
+      "so the refusal above is this rule's and not some other rule's",
+      len(validate_startup_config(base(shadow_mode="maybe"), -5000, 5000)) == 1)
+
+
+# --- THE SIX STATES, AND THE ONE THAT PROTECTS THE EXISTING INSTALL ---------
+# ⚠️ GRADED HERE RATHER THAN IN test_clamp.py, WHERE IT STARTED, AND THE REASON
+# IS MEASURED. `shadow.engaged()` is a pure function of the option and the
+# start button; a mutation that defeats the DEFAULT stops test_clamp.py's
+# part 3 reaching the wire at all, which aborts that file with an IndexError
+# before part 8 runs - so the mutation's red count there is a lower bound and
+# the table itself is never graded (MUTATION.md, FCST-06's shape). Nothing in
+# this file drives a Controller, so nothing here can be taken down that way.
+# Six states. The one that matters most is the LAST row: an install that is
+# controlling today must not be changed by this option arriving with a default.
+_TABLE = [
+    ("off", True, False), ("off", False, False),
+    ("on", True, True), ("on", False, True),
+    ("auto", False, True), ("auto", True, False),
+]
+for _m, _started, _want in _TABLE:
+    check(f"shadow_mode {_m!r} with control "
+          f"{'started' if _started else 'stopped'} -> "
+          f"{'SHADOW' if _want else 'LIVE'}",
+          shadow.engaged({"shadow_mode": _m}, control_started=_started)
+          is _want)
+check("THE EXISTING INSTALL: the SHIPPED DEFAULT, on an install that is "
+      "controlling, is LIVE. This is the whole reason the option is not a "
+      "boolean defaulting to true - the Supervisor merges a new default into "
+      "every existing install, and a boolean would have stopped a battery that "
+      "is regulating a real house today",
+      shadow.engaged({}, control_started=True) is False)
+check("...and the SAME shipped default on a FRESH install - `auto_start` is "
+      "false, so nothing has started - is SHADOW. That is what 'default-on' "
+      "means here, delivered where it is safe",
+      shadow.engaged({}, control_started=False) is True)
+# ⚠️ THE REASON, NOT THE VERDICT (MUTATION.md's masking rule). `on` and
+# `auto`-while-stopped are the same boolean and want DIFFERENT operator
+# actions: one is an option, the other is a button. A surface showing only the
+# verdict would be blind to the two rungs being swapped.
+check("the two ways of being in shadow mode are told apart in words, so a "
+      "build that swapped the rungs could not render identically",
+      shadow.why({"shadow_mode": "on"}, control_started=False)
+      != shadow.why({"shadow_mode": "auto"}, control_started=False))
+
+# ⚠️ AND THE FAIL-SAFE DIRECTION OF AN UNREADABLE VALUE IS GRADED, THOUGH THE
+# rule above means a running install can never hold one. It survived the first
+# mutation battery as M9 for exactly that reason: everything else refused the
+# value before `mode()` ever saw it, so the direction it fails in was ungraded
+# and could have been flipped to "live" with the whole suite green.
+check("an UNREADABLE shadow_mode resolves to SHADOW, not to live - the "
+      "direction that does not move energy. It is reachable only if this "
+      "file's rule is ever weakened, which is the case it exists for",
+      shadow.engaged({"shadow_mode": "garbage"}, control_started=True) is True
+      and shadow.engaged({"shadow_mode": ""}, control_started=True) is True
+      and shadow.mode({"shadow_mode": "garbage"}) == "on")
+
 # --------------------------------------------------------------------------- #
 print()
 if fails: