SAFETY-38 round 3: pin the banner the SHIPPED install actually prints

Round 2 pinned the operand order of `SignWatchdog.evaluate()` at main.py:1620 -
the SITE detector. Part 9c asserts that detector is never armed at a roster of
one, so on every install this add-on has, the PER-UNIT banner is the only
sign-disagreement sentence that can ever be printed, and its call site is a
different line. main.py:1560 was left unpinned.

1. THE SAME ZERO-BYTE DEFECT ONE CALL SITE OVER.
   `evaluate(stood, against, ...)` -> `evaluate(against, stood, ...)`:
   app/main.py 234 542 bytes before and after, delta 0, fingerprint
   61aa413f... -> e57e6026..., bytecode purged, tree mounted :ro, line re-read
   from disk. On the round-2 tree the FULL 21-FILE SUITE PASSES.

   Nothing behavioural could ever have caught it. `watchdog.disagrees()` is
   SYMMETRIC in its first two arguments - `commanded_w * against_w < 0` with an
   abs() gate on both - so the mutant takes identical actions on every input.
   Not "no fixture happens to separate them": no fixture CAN.

   What moves is the sentence. Measured by diffing the suite's own printed
   banners between the round-3 tree and the same tree carrying only this edit:
   9 emitted banner lines invert, in 3 distinct sentences.

     shipped  commanded -2000 W against a meter reading +2000 W
     swapped  commanded +2000 W against a meter reading -2000 W
     shipped  commanded +1000 W against its own measured power -1000 W
     swapped  commanded -1000 W against its own measured power +1000 W
     shipped  commanded -2000 W against a meter reading +4000 W   (the N=1 arm)
     swapped  commanded +4000 W against a meter reading -2000 W

   Persisted to `sign_reason` and re-read after the restart the latch exists to
   survive; also the action log, `_LOG.error` and `status_payload()`'s headline.

   CLOSED by the ORDERED PAIR on both per-unit banners, both operands read off
   the OBSERVED CYCLE - `inv.last_write` and `inv.batt` off the objects the
   plant moved, never off the arguments the detector was handed, which would
   compare the swap against itself:
     - part 3, the N>=2 trip: "commanded {stood:+.0f} W against its own
       measured power {meas:+.0f} W", plus the persisted namespaced copy;
     - part 7, the N=1 controller-driven trip: "commanded {stood:+.0f} W
       against a meter reading {grid:+.0f} W", plus the namespaced key AND the
       flat rollback mirror;
     - a PRECONDITION on each that the two operands are different numbers of
       opposite sign - without it a transposition produces the same string and
       the check is decoration.

   Measured after the fix: RED on four named checks in test_watchdog.py, GREEN
   in the other twenty files. M11 (the site swap) re-measured on this tree:
   still red. Round 1's and round 2's kills are intact.

2. A FALSE STATEMENT ROUND 2 INTRODUCED, AND IT WAS WORSE THAN REPORTED.
   Section 4 said "three of these left the whole suite green - M1, M2 and M3 -
   and the remaining seven were caught by SAFETY-30's own N>=2 checks". Round
   1's vaguer wording was harmless; naming three made it specific and wrong.

   Re-measured mutation by mutation on clean release/1.0 @ bbc903b, each on a
   fresh copy, bytecode purged, byte delta and fingerprint printed, FULL 21-FILE
   SUITE each time:

     M1  +24 B  fp 362374cf...  21/21 PASS - SURVIVOR
     M2   +9 B  fp 86573e74...  21/21 PASS - SURVIVOR
     M3   +4 B  fp 59fa8815...  21/21 PASS - SURVIVOR
     M4   +9 B  fp 43d852be...  21/21 PASS - SURVIVOR
     M5  +16 B  fp 58d26de8...  RED  test_watchdog.py, 3 checks
     M6   +1 B  fp 407ddb5f...  RED  test_watchdog.py, 3 checks
     M7  -11 B  fp 2a635a4e...  21/21 PASS - SURVIVOR
     M8   +6 B  fp b21eed89...  21/21 PASS - SURVIVOR
     M9   +6 B  fp 0973d3ca...  21/21 PASS - SURVIVOR
     M10  +7 B  fp 0e7b7a4f...  21/21 PASS - SURVIVOR

   EIGHT survived, not three - and not the four a reviewer proposed either.
   The corrected sentence is in DECISIONS section 4.

   AND THE TWO THAT WERE CAUGHT MAKE THE CARD'S CASE. M5 (`sum(abs ...)`) and
   M6 (`-sum`) are the only two entries that reverse the SIGN. Every other one
   changes only the MAGNITUDE, and `_sign_site` - the suite's only N>=2 site
   fixture before this card - runs shares of about -2500 W each against a 320 W
   gate, so sum / mean / max / min / sorted[-1] / [0] / self.target / half /
   double land on -2500, -2500, -2500, -2500, -2500, -2500, -2500, -1250 and
   -5000 W: nine numbers, ALL ON THE SAME SIDE OF THE SAME THRESHOLD. The
   pre-existing coverage could see a sign and nothing else.

3. THEN THE THING THAT WOULD HAVE CAUGHT BOTH: the SYMMETRIC-PREDICATE FAMILY,
   enumerated by machine rather than by hand for a third time.
   `tools/symmetric_message_scan.py` renames each parameter pair, erases every
   formatted string, canonicalises the commutative operators and iterates to a
   FIXPOINT - the symmetry is usually one call deep, and a single pass reports
   an EMPTY family on a tree whose answer is already known. A second census
   covers sentences the CALLER builds. Both print their own blind spots,
   including the one way the scan OVER-reports.

   It found one open survivor this card does not close and now discloses:
   rail_unreachable()'s dev_min/dev_max at main.py:3208 - 0 bytes, 21/21 green,
   a status-page NOT COVERED row - and twelve unpinned caller-built sentences,
   including SAFETY-31's `circ_reason`, which is the same shape and is also
   persisted and re-read after a restart. DECISIONS section 7 has the list, the
   pinned status of every member, and what the instrument cannot see.

No app/ code changes. MUTATION.md gains habit 15.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/MUTATION.md

@@ -276,7 +276,25 @@ same place twice, the check is decoration.
   The fix is to assert the **ORDERED PAIR**,
   `f"commanded {sum:+.0f} W against a meter reading {grid:+.0f} W"`.
 
-  The general habit is **14** below.
+  ⚠️ **AND THE ELEVENTH WAS THE SAME DEFECT ONE CALL SITE OVER — THE ONE A
+  SHIPPED INSTALL CAN ACTUALLY SEE.** Round 2 pinned the operand order of
+  `SignWatchdog.evaluate()` at `main.py:1620`. That call site is the **site**
+  detector, and `test_watchdog.py` part 9c asserts it is **never armed at a
+  roster of one** — which is every install this add-on has. The **per-unit**
+  call at `main.py:1560` was left unpinned, and swapping its first two
+  arguments is the same **ZERO-BYTE** edit: `disagrees()` is symmetric in them
+  (`commanded_w * against_w < 0` with an `abs()` gate on both), so **no trip
+  decision can change** and the full 21-file suite stays green — measured. What
+  moves is five banner lines, including the one persisted to `sign_reason` and
+  re-read after a restart: *"commanded −1000 W against its own measured power
+  +1000 W"*, operands inverted, on the only sign-disagreement sentence a
+  one-inverter install can ever print. Closed in round 3 by the ordered pair on
+  **both** per-unit banners — the N≥2 `its own measured power` one and the N=1
+  `a meter reading` one — red on four named checks, green in the other twenty
+  files. **Habit 15 is what falls out of finding the same shape twice in the
+  same card.**
+
+  The general habits are **14** and **15** below.
 
 Note what these have in common with a masked rung: the mutation *runs*, and the
 suite is *honestly* green. Nothing in a purge, a fingerprint or a disassembly
@@ -427,6 +445,56 @@ Cheap habits fall out of it, and all of them are now used in this repository:
     this one was found: **inside the fix written to close the previous instance
     of the same family**, which is the second time in this list.
 
+    ⚠️ **AND THE FIX FOR IT WAS ONE CALL SITE WIDE, WHICH IS THE HALF WORTH
+    KEEPING.** The ordered pair went onto `main.py:1620`, the **site** detector
+    — armed only at N≥2, and part 9c asserts it is **absent at a roster of
+    one**. The identical swap at `main.py:1560`, the **per-unit** detector, was
+    still **ZERO BYTES**, still changed no decision, still left the 21-file
+    suite green — and it is the **only** sign-disagreement sentence a shipped
+    one-inverter install can ever print: *"commanded −1000 W against its own
+    measured power +1000 W"*, backwards, in the log, on the status page and in
+    `sign_reason` after the restart the latch is designed to survive. Measured
+    size: **main.py:1560, 0 bytes, 21/21 green.** So habit 14 is not "pin the
+    banner", it is **"pin every call site of the banner, and say which one the
+    shipped roster reaches"** — and habit 15 is how you find them all.
+
+15. **A SYMMETRIC PREDICATE MAKES ARGUMENT ORDER A PROPERTY OF THE MESSAGE
+    ALONE — so ENUMERATE THAT FAMILY BY MACHINE, and grade the CALL SITES, not
+    the function.** Where a callee is symmetric in two arguments, a swap at any
+    call site is invisible to every behavioural check **by construction**: not
+    "no fixture happens to separate them" but *no fixture can*. There is
+    nothing for a mutation battery to find, because the mutant and the shipped
+    tree take identical actions on every input. The only surface that moves is
+    the sentence, and the only check that can see it is one asserting the
+    **ordered pair** (habit 14) at **that** call site.
+    Three consequences, and all three are why this is its own habit:
+    * **The unit of coverage is the CALL SITE.** SAFETY-38 pinned
+      `evaluate()`'s operand order and still shipped the defect, because the
+      pin was on the call two lines below the one that matters. Ask of every
+      banner: *how many places call this, and which does the shipped roster
+      reach?*
+    * **The scope must be COMPUTED** — habit 12's argument, and SAFETY-38 is
+      its proof: the family was enumerated by hand twice and was short both
+      times. `tools/symmetric_message_scan.py` renames each parameter pair,
+      erases every formatted string, canonicalises the commutative operators
+      and iterates to a **fixpoint** over `app/` (the symmetry is usually one
+      call deep — `evaluate()` is symmetric only *through* `disagrees()`), then
+      classifies each sentence by where it GOES. A returned string may be a
+      **key** — swapping `store.unit_key(unit, key)` renames a store key, which
+      is behaviour and is MAINT-05's card — or a **sentence**, which is this
+      family.
+    * **Say what the instrument cannot see, with shapes** (habit 13). That scan
+      under-reports semantic symmetry no canonicaliser on its finite list can
+      spell; its second census, for sentences the CALLER builds, pairs only
+      expressions **one leaf apart** and never sees `%s`-style logging; it
+      covers only `app/`; and it **over-reports in exactly one way** — it
+      erases the sentence, so a swap that would make the FORMATTING itself
+      raise is scored as changing no decision. It prints all of that on every
+      run. The family, every member's call sites, and which of them are pinned
+      are in `DECISIONS/SAFETY-38-site-standing-pin.md` §7 — **with two
+      measured, still-open survivors named there rather than rounded off**,
+      both zero bytes and both 21/21 green.
+
 And the mutation-table consequence: **a variant is not covered because a
 near-miss of it is.** DEV-02's table listed the *actuator* variant of the
 per-unit claim defect (`device`/`supervised` filed without `inv`), which the