SAFETY-38 round 4: the enumeration covered one sink, and it was not the one this codebase uses

The scanner's two censuses between them scored ONE syntactic sink and called it
the family. Every one of census B's 16 members was a sentence that is APPENDED,
ASSIGNED to a `reason`-shaped name, or passed as a LOG ARGUMENT. Not one was
RETURNED - and census A's return bucket only ever held a callee formatting its
own PARAMETERS, so a method formatting its own ATTRIBUTES and handing the string
back was invisible to both. That is the whole describe() / explain() /
reason-builder family, which is where this repository actually keeps its
operator sentences. Worse than the gap: it was in NONE of the five blind spots
the tool printed about itself.

THE SCANNER, WIDENED - and it rediscovered both members without being told:

  * CENSUS C, the return sink, resolved through the returning method's CALL
    SITES so a returned KEY (store.unit_key, mqtt.unit_state_key - MAINT-05's
    card) is not mistaken for a returned SENTENCE. 53 returned pairs, 39
    reaching an operator, 16 of those sharing a format spec.
  * A sentence handed to a constructor as `reason=` or placed under a "text"
    dict key is a MESSAGE. That one line of the sink walker was hiding SIX more
    caller-built members, census B 16 -> 22.
  * Every census B and C row now prints whether the two interpolations share a
    FORMAT SPEC - the difference between a transposition that is silent and one
    that merely looks broken.
  * The blind-spot list is now TWO lists: what it scans (printed from the
    constants, so they cannot drift) and WHAT IT DOES NOT SCAN AT ALL, largest
    hole first - `%s`-style lazy logging, MEASURED at 31 calls across 8 modules
    and each one listed, not asserted.

CLOSED, both zero-byte survivors of a green 21-file suite:

  * clamp.py:253 ClampResult.describe(), requested_w <-> applied_w. No
    test_*.py mentioned describe() at all. It is the SS15 action-log row
    (main.py:1366) AND the ClampWatchdog notification reason (main.py:2452) -
    the alarm SAFETY-40 and SAFETY-41 are about. Under the swap the guard
    reports a setpoint clamped UPWARD, to +9999 W by a bound whose rating the
    same sentence gives as 2000 W. Pinned on the ORDERED PAIR on the contiguous
    literal at BOTH consumers, operands read off ctl.target and
    hass.writes[-1] - what the loop asked and what the device was sent - not
    off the ClampResult the swap lives in. 4 checks red.
  * peakguard.py:493 PeakDecision.explain(), projected_w <-> ceiling_w. "peak
    guard idle" was in no test_*.py. The row then reads "projects 5013 W under
    a 2300 W ceiling" - 2713 W OVER - on a row whose own words say idle and
    whose own flag says ok. Pinned on the decision and on the shipped status
    row. 3 checks red.
  * test_arbiter.py's scope-violation check, whose CLAIM was wider than its
    ASSERTION. Measured this round rather than left at source level: 0 bytes,
    21/21 green before, red now. 2 checks.

DISCLOSED, NOT CLOSED - 11 measured zero-byte survivors, each with its file
fingerprint and its 21/21 verdict, in the decision doc SS7e-SS7g. Three in
allocator.py's UnitPlan.explain(), three across arbiter.py's two explain()s,
two in tariff.py, two in arbitrage.py's trade reasons, one in main.py's
SoC-floor notification. An enumerated list with honest gaps beats a fifth round
finding a fifth instance.

CORRECTIONS THIS ROUND OWES:

  * The idle sentence does NOT reach main.py:3299/3302 - those are the
    floor-limited branch, where explain() returns self.reason before the idle
    literal is built. It reaches main.py:3313 and, on the release edge, 1951.
    1951 is disclosed unpinned.
  * SS4's "Every one of the ten is red" sat under a twelve-row table: it is the
    ten site_standing entries.
  * SS6b said "weaker evidence than A1-A3"; A4 was measured, so SS7d's
    "A1-A4 and B1" is the right list and SS6b now says it.
  * AND THE PROBE THAT GRADES THESE MUTATIONS WAS THE DEFECT, ONCE. Its first
    cut numbered the operands BY ORDER OF APPEARANCE, so after a transposition
    the other leaf took the same number and all thirteen mutant renders came
    back byte-identical - which reads exactly like "the edit is inert". Keying
    the value to the NAME fixed it. Habit 4, in the measuring instrument:
    MUTATION.md habit 16 is the new entry, and the count there is corrected to
    eleven rather than inflated.

14 mutations measured: fresh full-repo copy each, mounted :ro, bytecode purged
and the purge COUNT printed, the edit re-read from disk, length and sha256
printed on both sides, and every one required to change the EMITTED SENTENCE
and not merely the bytes. 12 survived the pre-round suite, 1 was already
caught, 3 are caught now. Full 21-file suite green on the final tree.

NOT ONE BYTE OF app/ MOVES. This card changes coverage only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/MUTATION.md

@@ -135,7 +135,7 @@ manufactures them from a **fixture**: the check runs, the assertion is
 evaluated, the sentence above it is true — and the numbers it compares are
 arranged so that the failure it describes could not have changed the answer.
 
-It is not hypothetical and it is not rare. TEN instances in two weeks; four
+It is not hypothetical and it is not rare. ELEVEN instances in two weeks; four
 were found by review, two - CFG-04's fixture pair - by an author's own mutation
 battery, which is the cheaper place, one by review again, in the one
 place nobody had thought to point the rule at: not a check in the suite, but a
@@ -145,6 +145,15 @@ that names the rule in its own text - and the TENTH INSIDE THE FIX WRITTEN TO
 CLOSE THE NINTH, for the second time in this list. See SAFETY-38 below: the
 check that closed it asserted a NUMBER and not the number's POSITION.
 
+⚠️ AND THE ELEVENTH IS IN A MEASURING INSTRUMENT RATHER THAN IN A CHECK, which
+is where the seventh was too. SAFETY-38 round 4's render probe - the thing that
+decides whether a mutation changed the SENTENCE and not merely the bytes -
+numbered each interpolated operand BY ORDER OF APPEARANCE. After a transposition
+the other operand takes the same number, so all thirteen mutant renders came back
+BYTE-IDENTICAL to the clean tree: the probe compared the swap against itself, and
+its output read exactly like "the edit is inert". Keying the value to the
+operand's NAME fixed it. Habit 16.
+
 ⚠️ **AND IT HAS NOW APPEARED IN SIX CONSECUTIVE CARDS.** The seventh instance,
 MAINT-05's, is the one that says why: the defect is not carelessness about
 fixtures, it is that **a check and the thing it checks were built from the same
@@ -494,6 +503,48 @@ Cheap habits fall out of it, and all of them are now used in this repository:
       are in `DECISIONS/SAFETY-38-site-standing-pin.md` §7 — **with two
       measured, still-open survivors named there rather than rounded off**,
       both zero bytes and both 21/21 green.
+    * ⚠️ **AND THE SINK IS HALF THE SCOPE, WHICH IS HOW THE FIRST THREE ROUNDS
+      OF THIS SCAN MISSED THE PLACE THE CODEBASE ACTUALLY KEEPS ITS SENTENCES.**
+      The scan classified a sentence as operator-facing when it was **appended,
+      assigned to a `reason`-shaped name, or logged** — and every one of its 16
+      reported members was one of those. **None was RETURNED.** A method
+      formatting its own **attributes** and handing the string back —
+      `ClampResult.describe()`, `PeakDecision.explain()`, every reason-builder
+      in the tree — was outside all of it, and so were sentences handed to a
+      constructor as `reason=` or placed under a `"text"` dict key. Four
+      zero-byte survivors of a green 21-file suite were sitting there, two of
+      them on the alarm SAFETY-40 and SAFETY-41 are about. **The general form:
+      an enumeration is scoped by a SINK as much as by a PREDICATE, and a sink
+      list is a hand-written list like any other (habit 12).** Ask of any such
+      scan: *which syntactic forms does this call a message, and what does the
+      code under it actually use?*
+
+16. ⚠️ **AN INSTRUMENT THAT ASSERTS A COMPLETENESS IT DOES NOT HAVE IS WORSE
+    THAN NO INSTRUMENT, AND ITS BLIND-SPOT LIST IS PART OF THE CODE UNDER
+    REVIEW.** `tools/symmetric_message_scan.py` printed five honest gaps and a
+    census count, and a reader — including its author, twice — took the count
+    for the family. The gap that mattered, the RETURN sink, was **in none of the
+    five**. A gap list is not a disclaimer; it is a claim, and it is the claim
+    most likely to be believed because nothing else in the output argues with
+    it. Two consequences:
+    * **State what is NOT scanned, largest hole first, as a list of forms** —
+      not "this under-reports". The tool now names `%s`-style lazy logging
+      (`_LOG.error("… %s … %s", a, b)`, where the operands are *arguments*, so
+      no f-string census can ever see them), `.format()`/`%`/`+`/`.join()`
+      sentences, sentences that leave through a dict or dataclass, `yield`,
+      message attributes outside its own constant set, and everything outside
+      `app/`. Where the list is derived from a constant in the file, it is
+      **printed from that constant**, so the two cannot drift.
+    * **AND THE PROBE THAT GRADES THE MUTATIONS IS SUBJECT TO EVERY HABIT
+      ABOVE.** Round 4's render probe gave each interpolated operand a value by
+      **order of appearance** — so after a transposition the other operand took
+      the same number and **all thirteen mutant renders came back
+      byte-identical**, which reads exactly like *the edit changed nothing*.
+      Keying the value to the operand's **NAME** fixed it. That is habit 4, in
+      the measuring instrument: the fixture's own values were arranged so the
+      failure it was built to see could not change the answer. **Eleventh
+      instance of habit 4 in this file, and the second one in an instrument
+      rather than in a check.**
 
 And the mutation-table consequence: **a variant is not covered because a
 near-miss of it is.** DEV-02's table listed the *actuator* variant of the