SAFETY-03: alarm when a computed setpoint exceeds the rating, do not just clip it

The clamp was never the missing half. specs.md 10.3 records an unclamped
integrator climbing ~130 W per 4 s past 10 kW and reporting 14 768 W pinned at
the 5 kW rail; clipped silently that is a flat, legal-looking 5000 W hold and
nothing says the loop asked for three times it.

write_setpoint() - the one path every write takes - now clamps to the VALIDATED
max_w and reports whether the raw value differed; check_output_clamp() raises
OUTPUT_CLAMP as a notification, an ERROR, an event row and a red status banner.
Not a trip: the clamped value is written and the loop keeps running.

The rating is max_w and nothing is min()ed at runtime - CFG-01 already refuses a
max_w outside the device range at startup. The device range is applied second as
defence in depth; it cannot bite after a successful validation, so if it ever
does it alarms too and names the bound. No new config key.

Decision grew i_clamped / clamped booleans, and that is the load-bearing part:
`reason` is one string that slew-limiting and the saturation freeze overwrite,
so an alarm keyed on it is silent on exactly the cycles a winding loop produces.
Mutating main.py back onto the string drops the 10.3 replay from 2 engagements
to 0.

Distinct from saturation by construction - no shared reason code, notification
id, status row or counter - and checked in the negative, after first asserting
the saturation freeze really did engage.

Two things found by running it rather than by reading it: a row per engagement
flushed the 40-row event log and evicted SAFETY-18's own METER FROZEN? row (now
coalesced per episode with an exact count), and a naive clamp turns a nan into a
command at the full rating because every comparison against nan is False.

test_clamp.py is new: assert-based, no framework. Six author mutations
reproduced red, including "clamp kept, alarm deleted". Two of the check's own
hypotheses about the freeze/clamp interaction were refused by its sweep and
rewritten to what it measured.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015VXjA3LWccN1rJsk3okyPC

goodwe_controller/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 ## Unreleased
 
+**A computed setpoint over the rating now alarms instead of being clipped in
+silence (SAFETY-03).** The clamp was never the missing half - specs.md 10.3
+records an unclamped integrator climbing ~130 W per 4 s past 10 kW and reporting
+**14 768 W** while pinned at the 5 kW rail, and a silent clamp turns exactly that
+into a flat, legal-looking 5000 W hold. `write_setpoint()` - the one path every
+write takes, cycle, heartbeat, operator button and shutdown alike - now clamps to
+the **validated** `max_w` and reports whether the raw value differed, and
+`Controller.check_output_clamp()` raises `OUTPUT_CLAMP`: a persistent
+notification (`goodwe_output_clamp`), an `ERROR`, an event row and a red status
+banner. **Not a trip**: the clamped value is written and the loop keeps running,
+per 11.2's "clamp *and alarm*".
+
+**The bound is `max_w` and nothing is `min()`ed at runtime.** Section 14 requires
+the loop clamp and the driver's `setpoint_limit_w` to agree, validated at startup
+with a refusal on mismatch - which CFG-01 already ships. The device range is
+still applied second, as defence in depth; after a successful validation it
+cannot engage, so if it ever does, that is louder than the first stage and it
+alarms too, naming the bound. No new config key: the guard's limit is the one
+the operator already set, and its cadence is a module constant.
+
+**`Decision` grew `i_clamped` / `clamped` booleans, and that is the load-bearing
+part.** `reason` is one string that later stages overwrite - a cycle that clamps
+the integrator and is then slew limited reports `slew-limited`, and one that
+clamps while saturated reports `saturated-freeze`. Both *are* the winding case,
+so an alarm keyed on the string is silent on exactly the cycles it exists for:
+mutating main.py back onto `"clamp" in decision.reason` drops the 10.3 replay
+from 2 engagements to **0**. The flags are set where the clamp happens and are
+never overwritten. On a default install (`integrator_max_w` following `max_w`)
+the integrator bound is the one that bites and the output clamp is unreachable,
+so the integrator flag is the whole signal.
+
+**Distinct from the saturation freeze, and checked in the negative.** A clamp is
+a *software* bug signal; saturation is the *hardware* failing to follow a legal
+command, and its action is to freeze the integrator, not to alarm. They share no
+reason code, notification id, status row or counter. `test_clamp.py` drives a
+loop that saturates for 10 consecutive cycles at 1.4 % of the rating and asserts
+zero clamp notifications, zero engagements, no log row and no status row - after
+first asserting that the saturation freeze *really did* engage, so the silence is
+an observation rather than a scenario that did nothing.
+
+**The action log is coalesced per episode, and that was a real bug.**
+`log_event()` keeps 40 rows; one row per engagement flushed the entire ring
+within 40 cycles of a winding loop, and the first thing it evicted was
+SAFETY-18's own `METER FROZEN?` row - this guard silencing another guard's log.
+Caught by `test_freeze.py` going red, not by inspection. One row per episode now,
+carrying the exact engagement count read off the counter.
+
+**A non-finite setpoint is refused, and it was worse than passing one through.**
+`nan` is loss of input (11.1 rule 1: command zero, keep commanding), not an
+out-of-range value. Measured: because every comparison against `nan` is False, a
+naive `max(-limit, min(limit, nan))` keeps its *first* argument and turns a `nan`
+into a command **at the full rating**, then reports it as a clamp engagement.
+
+**`test_clamp.py`** (new, assert-based, no framework) covers the clamp
+arithmetic and its boundaries - exactly +-`max_w` is *not* an engagement - the
+alarm's edge/re-assert/hysteresis cadence, the 10.3 runaway replayed through the
+real `Controller.cycle()` against an unclamped transcription, the saturation
+negative, and the direct-write path. Six author mutations reproduced red,
+including "clamp kept, alarm deleted" (the historical build) and "alarm keyed on
+`reason`". Two of the check's own hypotheses about how the freeze and the clamp
+interact were **refused by the sweep** and rewritten to what it measured: a
+frozen cycle *can* clamp, and does so exactly when the integrator reverses.
+
+`test_freeze.py`'s notification assertions now filter by `notification_id`
+rather than by service - the add-on raises more than one kind of notification,
+and its railing scenarios legitimately raise this one too.
+
 **Cheap-window maintenance charging was unreachable at the shipped defaults, and
 now the config that makes it unreachable is refused (MAINT-04).** `config.yaml`
 shipped `max_w: 2000` against `maintenance_charge_w: 2500`. The cheap-window