MAINT-05 fix round 2: the refusal has to survive the NEXT start, and both marker guards have to be visible

REJECTED because the fix round's own load-bearing sentence was FALSE, and the
whole suite was blind to that. `_verify_moves()` produced the red the reviewer
reproduced - that half stood - but DECISIONS §2 claimed "`ok` gates the marker,
so a misdirected migration is not stamped and the next start runs it again ...
a re-run is recoverable". THE REFUSAL LASTED EXACTLY ONE START.

MEASURED, Controller level, ONE persisted store, roster ["garage","shed"], flat
last_completed 2026-08-07, call site still handing `inverter-a` on both starts:

    construction 1: ok=False misdirected=4 moved=4 kept=0   marker=<absent>
    construction 2: ok=True  misdirected=0 moved=0 kept=4   marker=1
    history parked under unit/inverter-a/...; marker stamped after ONE restart.

WHY. `_verify_moves()` graded only `rep.moved`. On start 2 the same wrong call
site finds the four keys already present, so rule 1 routes every one of them to
`rep.kept`, `rep.moved` is EMPTY, the roster loop iterates over nothing,
`misdirected` is empty and `ok` is True. Start 3 then takes the
`from_version >= MAINT_SCHEMA_VERSION` early return FOREVER - including after
the call site is fixed. Loud-and-recoverable became silent-and-permanent after
one restart: the exact state store.py's header says must never happen, reached
by the fix written to prevent it.

WHY THE CHECK MISSED IT - the recurring defect, this time INSIDE the remedy.
Part 9b's recovery check was `migrate_maint_keys(_m5, ROSTER[0], ROSTER)` - the
CORRECTED name. It measures recovery along the one path where the operator has
ALREADY fixed the bug. Nothing in the 19 files called `migrate_maint_keys()`
twice with the SAME WRONG `unit`. The check was true and passed for the wrong
reason.

WHAT CHANGED

1. app/store.py `_verify_moves()` grades `set(rep.moved) | set(rep.kept)`.
   Sound by construction: every entry in both lists is a `unit_key(unit,
   legacy)` built from the SAME `unit` argument, so grading `kept` grades the
   same namespace decision `moved` does. A correct call site's `kept` entries
   sit under a roster name and pass; a wrong one cannot launder its namespace by
   having already written it. `migrate_unit_keys()` passes `roster=None` and
   returns before the loop, so it is untouched.

2. test_maintenance.py part 9c - THE CHECK THAT WAS MISSING. Two starts, SAME
   wrong unit, ONE store: the marker is still withheld on the second, the
   refusal names the same roster, the flat history is still there to recover
   from, and a third start with the CORRECTED name still gets a run (which a
   stamped marker would have made impossible). Its PRECONDITION asserts the
   SHAPE of the second report - `moved` empty, `kept` full - so it cannot
   quietly revert to grading 9b's path. Counterfactual beside it: the same two
   calls with the right name are accepted, then skipped as `already at schema`.

3. test_maintenance.py part 9d - THE OTHER GUARD ON THE SAME LINE, and a
   survivor nothing in the repository could see. `if rep.ok:` is
   `not lost and not misdirected`; every check that reached the marker did so on
   a store whose `kept` was empty, so

       if rep.ok:        ->      if rep.ok or rep.kept:        (+12 B)

   stamped the marker on a migration that LOST A MONTH OF HISTORY - defeating
   the older, settled `lost` guard as well as the new one - and ALL 19 SUITES
   WERE GREEN on it (measured at 65cddf3, purged, :ro). 9d's fixture is the one
   shape that separates the guards: two keys already namespaced (`kept`
   non-empty, the mutant's `or` fires) and two whose write the store drops
   (`lost` non-empty), `misdirected` empty throughout.

4. FOUND HERE AND CLOSED: THE SAME MUTATION ONE FUNCTION UP. `migrate_unit_keys()`
   - SAFETY-02's LATCH migration - gates its own marker the same way, and every
   check that reached it ran on a store with an empty `kept`. `if rep.ok or
   rep.kept:` at store.py:307 SURVIVED ALL 19 FILES. It stamps `schema_version`
   on a migration that DROPPED THE LATCH: the guard is off, the file still reads
   `sign_tripped: true`, and the store now says the migration finished, so the
   next start skips the one thing that would re-arm it. test_inverter.py part 10
   now drops the `sign_tripped` write BESIDE an already-namespaced
   `sign_reason`, with the accepted-baseline counterfactual. No source change -
   the shipped gate was right; nothing could see it. Mutation table 34 -> 35.

5. DECISIONS/MAINT-05 §2 CORRECTED. The paragraph that stated the false
   guarantee now states what was measured, why grading `moved` alone could not
   hold, and why the union is sound. §7 records the marker-gate hole found in
   `migrate_unit_keys()` and that it was closed. MUTATION.md gains habit 9 -
   "exercise a refusal a SECOND time with the SAME wrong input, not the
   corrected one" - and two survey rows.

MUTATION LEDGER - 11 mutations, ALL RED on the final tree, every run on a fresh
copy with the bytecode cache purged (entry count printed before and after) and
the tree mounted :ro so none could be written. Two were survivors BEFORE this
commit and both are recorded as such. Full transcript on the PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -62,6 +62,39 @@ two power-moving phases on one grid connection pulling against each other.
   Every two-pack fixture that could see this now names its first pack
   `garage`; with them all called `inverter-a`, `self.inverters[0].name` and
   `UNIT_A` were the same string and the swap left all 19 suites green.
+* **AND THE REFUSAL NOW SURVIVES THE NEXT START** (second fix round). The fix
+  above graded only the keys it had just *written*, so it refused exactly once:
+  measured at Controller level over one persisted store, roster
+  `["garage", "shed"]`, with the call site still wrong on both starts —
+  construction 1 `ok=False misdirected=4 moved=4 kept=0 marker=<absent>`,
+  construction 2 `ok=True misdirected=0 moved=0 kept=4` and the marker
+  **stamped**. On the second start rule 1 finds the wrong keys already there and
+  routes all four to `kept`, so `moved` is empty and the roster loop grades
+  nothing — and start 3 skips the migration forever, *including after the call
+  site is fixed*. Loud-and-recoverable became silent-and-permanent after one
+  restart. `_verify_moves()` now grades `set(moved) | set(kept)`; both lists are
+  built from the same `unit` argument, so grading `kept` grades the same
+  namespace decision. `test_maintenance.py` part **9c** drives two starts with
+  the same wrong unit over one store — the shape nothing in the suite had, since
+  9b measured recovery along the path where the operator has *already* fixed the
+  call site.
+* **AND THE MARKER GATE IS PINNED ON BOTH GUARDS.** `if rep.ok:` is
+  `not lost and not misdirected`, and the mutation `if rep.ok or rep.kept:`
+  stamped the marker on a migration that **lost a month of history** with all 19
+  suites green. Part **9d** is the fixture that separates the two guards: two
+  keys already namespaced (`kept` non-empty) and two whose write the store
+  drops (`lost` non-empty), `misdirected` empty throughout.
+* ⚠️ **AND THE SAME MUTATION ONE FUNCTION UP WAS A SURVIVOR, FOUND HERE AND
+  CLOSED.** `migrate_unit_keys()` — SAFETY-02's **latch** migration — gates its
+  own marker on `rep.ok` too, and every check that reached that gate ran on a
+  store where nothing was namespaced yet, so `rep.kept` was empty in all of
+  them. `if rep.ok or rep.kept:` there stamps `schema_version` on a migration
+  that **dropped the latch**: the guard is off, the file still says
+  `sign_tripped: true`, and the next start skips the migration that would have
+  re-armed it. Measured a survivor of all 19 files; now red on
+  `test_inverter.py` part 10, which drops the `sign_tripped` write beside an
+  already-namespaced `sign_reason`. No source change — the shipped gate was
+  right; nothing could see it.
 * ⚠️ **FOUND, RECORDED, NOT FIXED (SECOND ONE).** `migrate_unit_keys()` —
   SAFETY-02's latch migration — has the identical hole and it costs a **guard**
   rather than a history. It runs before `build_roster()` (each `Inverter`