SAFETY-38 round 4: the enumeration covered one sink, and it was not the one this codebase uses

The scanner's two censuses between them scored ONE syntactic sink and called it
the family. Every one of census B's 16 members was a sentence that is APPENDED,
ASSIGNED to a `reason`-shaped name, or passed as a LOG ARGUMENT. Not one was
RETURNED - and census A's return bucket only ever held a callee formatting its
own PARAMETERS, so a method formatting its own ATTRIBUTES and handing the string
back was invisible to both. That is the whole describe() / explain() /
reason-builder family, which is where this repository actually keeps its
operator sentences. Worse than the gap: it was in NONE of the five blind spots
the tool printed about itself.

THE SCANNER, WIDENED - and it rediscovered both members without being told:

  * CENSUS C, the return sink, resolved through the returning method's CALL
    SITES so a returned KEY (store.unit_key, mqtt.unit_state_key - MAINT-05's
    card) is not mistaken for a returned SENTENCE. 53 returned pairs, 39
    reaching an operator, 16 of those sharing a format spec.
  * A sentence handed to a constructor as `reason=` or placed under a "text"
    dict key is a MESSAGE. That one line of the sink walker was hiding SIX more
    caller-built members, census B 16 -> 22.
  * Every census B and C row now prints whether the two interpolations share a
    FORMAT SPEC - the difference between a transposition that is silent and one
    that merely looks broken.
  * The blind-spot list is now TWO lists: what it scans (printed from the
    constants, so they cannot drift) and WHAT IT DOES NOT SCAN AT ALL, largest
    hole first - `%s`-style lazy logging, MEASURED at 31 calls across 8 modules
    and each one listed, not asserted.

CLOSED, both zero-byte survivors of a green 21-file suite:

  * clamp.py:253 ClampResult.describe(), requested_w <-> applied_w. No
    test_*.py mentioned describe() at all. It is the SS15 action-log row
    (main.py:1366) AND the ClampWatchdog notification reason (main.py:2452) -
    the alarm SAFETY-40 and SAFETY-41 are about. Under the swap the guard
    reports a setpoint clamped UPWARD, to +9999 W by a bound whose rating the
    same sentence gives as 2000 W. Pinned on the ORDERED PAIR on the contiguous
    literal at BOTH consumers, operands read off ctl.target and
    hass.writes[-1] - what the loop asked and what the device was sent - not
    off the ClampResult the swap lives in. 4 checks red.
  * peakguard.py:493 PeakDecision.explain(), projected_w <-> ceiling_w. "peak
    guard idle" was in no test_*.py. The row then reads "projects 5013 W under
    a 2300 W ceiling" - 2713 W OVER - on a row whose own words say idle and
    whose own flag says ok. Pinned on the decision and on the shipped status
    row. 3 checks red.
  * test_arbiter.py's scope-violation check, whose CLAIM was wider than its
    ASSERTION. Measured this round rather than left at source level: 0 bytes,
    21/21 green before, red now. 2 checks.

DISCLOSED, NOT CLOSED - 11 measured zero-byte survivors, each with its file
fingerprint and its 21/21 verdict, in the decision doc SS7e-SS7g. Three in
allocator.py's UnitPlan.explain(), three across arbiter.py's two explain()s,
two in tariff.py, two in arbitrage.py's trade reasons, one in main.py's
SoC-floor notification. An enumerated list with honest gaps beats a fifth round
finding a fifth instance.

CORRECTIONS THIS ROUND OWES:

  * The idle sentence does NOT reach main.py:3299/3302 - those are the
    floor-limited branch, where explain() returns self.reason before the idle
    literal is built. It reaches main.py:3313 and, on the release edge, 1951.
    1951 is disclosed unpinned.
  * SS4's "Every one of the ten is red" sat under a twelve-row table: it is the
    ten site_standing entries.
  * SS6b said "weaker evidence than A1-A3"; A4 was measured, so SS7d's
    "A1-A4 and B1" is the right list and SS6b now says it.
  * AND THE PROBE THAT GRADES THESE MUTATIONS WAS THE DEFECT, ONCE. Its first
    cut numbered the operands BY ORDER OF APPEARANCE, so after a transposition
    the other leaf took the same number and all thirteen mutant renders came
    back byte-identical - which reads exactly like "the edit is inert". Keying
    the value to the NAME fixed it. Habit 4, in the measuring instrument:
    MUTATION.md habit 16 is the new entry, and the count there is corrected to
    eleven rather than inflated.

14 mutations measured: fresh full-repo copy each, mounted :ro, bytecode purged
and the purge COUNT printed, the edit re-read from disk, length and sha256
printed on both sides, and every one required to change the EMITTED SENTENCE
and not merely the bytes. 12 survived the pre-round suite, 1 was already
caught, 3 are caught now. Full 21-file suite green on the final tree.

NOT ONE BYTE OF app/ MOVES. This card changes coverage only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/test_clamp.py

@@ -1000,6 +1000,105 @@ check("...and main.py:856's consumer is the line that goes quietly false",
       bool(ctl_w.clamp_last and ctl_w.clamp_last.engaged))
 
 
+# --------------------------------------------------------------------------- #
+# 6d. SAFETY-38 round 4 - THE ORDERED PAIR INSIDE `ClampResult.describe()`
+# --------------------------------------------------------------------------- #
+# ⚠️ THIS IS THE ALARM THE OWNER HAS BEEN COMPLAINING ABOUT ALL DAY, AND UNTIL
+# THIS BLOCK NO test_*.py MENTIONED `describe()` AT ALL. `clamp.py:253` builds
+# the whole §15 action-log row and the whole ClampWatchdog notification reason
+# out of its own attributes:
+#
+#     f"{REASON_CODE}: the computed setpoint {self.requested_w:+.0f} W was
+#       clamped to {self.applied_w:+.0f} W by the {self.bound} bound
+#       (rating {self.limit_w:.0f} W) - something upstream is winding"
+#
+# Transpose `requested_w` and `applied_w` and the guard reports clamping a
+# setpoint UPWARD - here, to +9999 W by a bound whose rating the SAME SENTENCE
+# gives as 2000 W. MEASURED on this tree: a zero-byte edit (22 507 bytes before,
+# 22 507 after, sha256 0153133741497fa5 -> 47e4e371043e3201), the emitted
+# sentence changes, and the full 21-file suite stayed GREEN. Nothing decides on
+# the order, so nothing behavioural can ever see it - which is why the check
+# below has to be on the ORDERED PAIR and on the CONTIGUOUS LITERAL. A substring
+# test for either number passes under the swap; both numbers are still there.
+#
+# ⚠️ AND THE OPERANDS ARE READ OFF THE PLANT, NOT OFF `clamp_last`. `ctl.target`
+# is what the loop asked for and `hass.writes[-1]` is what the device was
+# actually sent; neither is a `ClampResult` field. Grading the sentence against
+# `result.requested_w` would compare the swap against itself - DEV-02's defect,
+# and the same one that made the first cut of this card's own render probe emit
+# thirteen empty diffs.
+
+
+async def _sentence(max_w, dev, wanted):
+    """One real write over `max_w`, then the guard, on a real Controller."""
+    hass = _Hass(0.0)
+    c = Controller({"setpoint_entity": "number.sp", "meter_source": "off",
+                    "max_w": max_w},
+                   hass, _Store(), _Pub(), stop=asyncio.Event())
+    c.auto = True
+    c.dev_min, c.dev_max = -dev, dev
+    c.target = wanted
+    arm(c, wanted)
+    await c.write_setpoint(wanted)
+    await c.check_output_clamp()
+    return hass, c
+
+
+hass_x, ctl_x = _sentence_run = asyncio.run(_sentence(2000.0, 5000.0, 9999.0))
+notes_x = clamp_notes(hass_x)
+_asked_x = ctl_x.target                  # what the loop asked for
+_sent_x = hass_x.writes[-1]              # what the device was actually sent
+_rating_x = ctl_x.inverters[0].max_w     # the bound the sentence names
+_rows_x = [e for e in ctl_x.events if REASON_CODE in e]
+print(f"    max_w {_rating_x:.0f} on a +-5000 W device, asked for "
+      f"{_asked_x:+.0f} W: the device saw {_sent_x:+.0f} W")
+print(f"       action log: {_rows_x[0] if _rows_x else '(none)'}")
+check("PRECONDITION: the write really clamped on the MAX_W bound, and the two "
+      "operands are DIFFERENT NUMBERS that RENDER differently - equal ones "
+      "would make the transposed sentence identical and every check below "
+      "vacuous. The asked-for magnitude is also strictly ABOVE the rating "
+      "while the sent one is not, which is what makes the swapped sentence "
+      "self-contradictory rather than merely wrong",
+      ctl_x.clamp_last is not None and ctl_x.clamp_last.engaged
+      and ctl_x.clamp_last.bound == "max_w"
+      and _asked_x != _sent_x
+      and f"{_asked_x:+.0f}" != f"{_sent_x:+.0f}"
+      and abs(_sent_x) <= _rating_x < abs(_asked_x))
+check("⚠️ THE ORDERED PAIR IN THE §15 ACTION-LOG ROW (main.py:1366). The "
+      "contiguous literal names the setpoint the loop COMPUTED first and the "
+      "one that REACHED THE WIRE second. Under the transposition this row says "
+      "the loop asked for +2000 W and the guard clamped it UP to +9999 W - "
+      "past the 2000 W rating printed four words later - which is the alarm "
+      "reading backwards on the one line an operator is woken by",
+      any(f"the computed setpoint {_asked_x:+.0f} W was clamped to "
+          f"{_sent_x:+.0f} W" in e for e in _rows_x))
+check("⚠️ ...AND IN THE ClampWatchdog NOTIFICATION REASON (main.py:2452), "
+      "which is a SECOND surface off the same sentence and has to be pinned "
+      "separately - SAFETY-38 round 3's whole lesson was that pinning one call "
+      "site leaves the other shipping",
+      bool(notes_x)
+      and f"the computed setpoint {_asked_x:+.0f} W was clamped to "
+          f"{_sent_x:+.0f} W" in notes_x[0]["message"])
+check("...and the TRANSPOSED sentence appears on NEITHER surface, so the two "
+      "checks above discriminate rather than decorate",
+      not any(f"the computed setpoint {_sent_x:+.0f} W was clamped to "
+              f"{_asked_x:+.0f} W" in e for e in _rows_x)
+      and f"the computed setpoint {_sent_x:+.0f} W was clamped to "
+          f"{_asked_x:+.0f} W" not in notes_x[0]["message"])
+# The DEVICE bound, off part 6c's controller: same sentence, other stage. The
+# unit of coverage is the call site, and `bound` is the only thing that differs
+# between the two rows an operator can receive.
+_asked_w, _sent_w = ctl_w.target, hass_w.writes[-1]
+check("...and the same ordered pair holds on the DEVICE-bound row, where the "
+      "loop asked for +3000 W and the device took +2500 W. PRECONDITION: those "
+      "two also render differently",
+      f"{_asked_w:+.0f}" != f"{_sent_w:+.0f}"
+      and any(f"the computed setpoint {_asked_w:+.0f} W was clamped to "
+              f"{_sent_w:+.0f} W" in e for e in ctl_w.events)
+      and f"the computed setpoint {_asked_w:+.0f} W was clamped to "
+          f"{_sent_w:+.0f} W" in notes_w[0]["message"])
+
+
 # ==============================================================================
 print()
 print("7. SAFETY-28: the write path is gated on the allocation record")