SAFETY-47: what a shadow run can show, and the watts on its status row

Not a leak and not a write-path defect. Shadow mode's safety is intact -
the substitution, the re-seed, the authorisation gate and the clamp are
untouched. What was wrong is what three merged documents SAY a shadow run
can show you, and a number on the status row that can be 6.61x what a live
controller would command.

SHADOW MODE CANNOT SURFACE A CLOSED-LOOP DEFECT, AND THE DOCUMENTS NOW SAY
SO. The battery is held at 0 W and the carried command is re-seeded to it,
so every measured input - the meter, the billed-quarter accumulator behind
it, the battery power, the SoC - describes a plant that did not respond. A
closed-loop defect is one whose stimulus IS that response. This is the same
property that makes shadow mode safe, so it is not a gap to close later:
the closed-loop answer comes from the closed-loop rig or from a live run.
SAFETY-10 §5 already conceded this for the grid-following loop. It was
never the loop leg's limitation; it is the general case.

THE "STRATEGIES ARE UNAFFECTED" EXEMPTION WAS TRUE UNTIL SAFETY-45 MERGED,
ONE COMMIT EARLIER. That card sizes the buy leg as min(asked, headroom)
with headroom = (900/remaining) x (ceiling - projected), and `projected`
reads the open quarter's accumulator - the meter - which is a function of
what the battery did earlier in that quarter. Measured on TEST-23 stage 3
at peak_cap_w 1500 / house 1200 / max_w 2000, one hour at 5 s:

  SAFETY-45's limit cycle  NOT visible. 28 onsets live vs 1; grid
                           -455.5..+3200.0 W vs flat at the 1200 W house;
                           guard engaged 410/720 cycles vs 0/720.
  SAFETY-46's SoC churn    NOT visible. The SoC moves 0.000000000 pp.
  TARIFF-14's wrong hour   VISIBLE, and it is the only one: which hour, at
                           what price, clearing what spread - identical on
                           720 of 720 charging cycles at a binding cap.

The exemption narrows to exactly what survives: WHICH hour a strategy picks
and WHY are unaffected; HOW HARD it trades is not. The peak guard's ceiling
and reasons are worth reading from a shadow run; its ENGAGEMENTS are not.

THE NUMBER IS CAVEATED, NOT RE-COMPUTED, AND THAT IS THE DECISION. The
arithmetic is not wrong - 900/remaining is correct for a meter genuinely
under the ceiling, and in shadow the meter genuinely is. It is the right
answer to a question nobody asked. Both surfaces now introduce the watts as
what would have been commanded ON THIS CYCLE, in every state, and carry
shadow.SIZED_FROM_METER whenever a measured billed quarter sized them.
Rejected, and recorded in the decision doc: re-computing it (the recorded
decision would no longer be the decision the shipped path reached, while the
arbiter, clamp, SAFETY-28 gate, log and MQTT all ran on the real one - a
second controller everywhere except the wire); recording nothing (blanks the
row exactly when arbitrage is trading, and the log's edge key is the watts);
and recording the unsized ask beside it (a second number, no warning, and at
the shipped 3500/2000 both figures read 2000 W).

"UPPER BOUND" AND NOT "SMALLER", AND THE DIFFERENCE WAS MEASURED. Charging
only adds offtake, so the shadow size is >= the live size with EQUALITY at
the start of every quarter. Pairwise over 3600 charging cycles in five
configurations: 0 below, 730 exactly equal. The first draft said "smaller",
which would have been false on every one of those 730.

AND THE PREDICATE IS NOT KEYED ON WHETHER THE TRADE WAS CAPPED. arbitrage's
own sentence says "SIZED BY THE CAPACITY-TARIFF GUARD" only when the
headroom came out below the ask - in a shadow run, the START of the quarter,
where the two runs agree to the float. By the end, 900/remaining has
multiplied the headroom past the ask, the trade is not capped, the sentence
is silent, and the record is at its most wrong. A caveat keyed on it would
be quietest exactly where it is needed loudest.

SAFETY-10 §6's COMMITTED EVIDENCE COULD NEVER HAVE FAILED, FOR TWO
INDEPENDENT REASONS, AND CLOSING EITHER ALONE CLOSES NOTHING. Its fixture is
peak_cap_w 15000 against a 350 W house, so the guard never engages and the
sizing is inert - the harness's own comment says so. AND every identity row
reads the FIRST charging sample, where at elapsed=0 the projection IS the
held level and the two runs agree to the float even at a cap that does bind.
Measured: widening the fixture alone leaves that comparison passing. That
second reason is a new shape for MUTATION.md's habit-4 list - an INDEX, not
a fixture - and it is recorded there as the twelfth instance. §6 is re-taken
at a binding cap across the whole run: 716 of 720 charging cycles differ,
headroom 300.0..54000.0 W in shadow against 299.9..307.8 W live, recorded
-2000.0 W against a live -302.4 W.

THE GRADER IS test_arbitrage.py PART 3d, beside SAFETY-45's own closed-loop
regression and built on the same s45_loop() harness, so the runs differ in
one argument. Three lines stand in for _write_unit()'s substitution and
_shadow_settle()'s record and re-seed, marked as a transcription;
test_clamp.py part 8 remains the check on the shipped placement. The section
carries its own precondition into every check: a mutation that stopped
either run trading made it raise on its first min(), kill the file and
report ZERO reds - FCST-06's shape, driven rather than imagined.

AND THE FIX'S OWN FIRST DRAFT CARRIED THE SAME DEFECT. Deleting the caveat
from the action-log line left all 29 files green, because the sentence was
an f-string inside _shadow_settle() and the only suite that drives it uses a
meter_source:off fixture where no arbitrage decision exists. It is
shadow.log_line() now, for the reason words() is a function.

14 mutations, no survivors; M13 and M14 are +0 B and were confirmed on disk
by sha256 with every run purged. M14's first form was aimed at the wrong
direction and correctly survived - min->max makes the shadow record larger,
which is still an upper bound. All 29 check files green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -29,6 +29,84 @@ if it has, it needs 0.10.0. Whoever deploys decides.
 | _this branch_ | TARIFF-16 - the injection leg stops being one number: an injection formula with its own coefficients, its own VAT and no floor under zero |
 | _this branch_ | SAFETY-45 - a price-driven charge is SIZED by the capacity-tariff guard instead of being switched on and off by it **⚠️ CONTROL STABILITY** |
 | _this branch_ | SAFETY-10 - shadow mode: the whole decision path runs and nothing reaches the inverter **⚠️ NEW OPTION, DEFAULT-ON FOR A NEW INSTALL** |
+| _this branch_ | SAFETY-47 - what a shadow run can show you, and the watts on its status row **⚠️ CORRECTS THREE CLAIMS SAFETY-10 SHIPPED** |
+
+### SAFETY-47 — what a shadow run can show you, and the watts on its status row
+
+⚠️ **Nothing about the write path changed, and nothing needed to.** Shadow
+mode still holds every inverter at 0 W through the one writer. What was wrong
+is what three merged documents **said** a shadow run can show you, and a number
+on the status page that could be **6.61×** what a live controller would
+command.
+
+**A shadow run cannot show you a closed-loop defect. Not partially — not at
+all.** The battery is held at 0 W, so every measured input — the meter, the
+billed-quarter accumulator behind it, the battery power, the state of charge —
+describes a plant that did not respond, and a closed-loop defect is one whose
+stimulus *is* the plant's response. That is the same property that makes shadow
+mode safe, so it is not a gap to be closed later: **the closed-loop answer
+comes from the closed-loop rig or from a live run.**
+
+SAFETY-10 promised otherwise, because of a sentence that was true when it was
+written and false one commit later:
+
+> the **strategies** are unaffected — they ask for a fixed power from inputs
+> that do not depend on what the battery did — so a shadow run does show you
+> the trades, the peak-guard engagements and the SoC-limit behaviour.
+
+SAFETY-45 (above) sizes the buy leg to the billed quarter's charging headroom,
+and that headroom is `(900 / seconds remaining) × (ceiling − projected)` with
+the projection read off the **open quarter's meter**. The strategy became
+closed-loop the day that landed. Measured on the rig, one hour at `peak_cap_w`
+1500 under a 1200 W house:
+
+| | live | shadow |
+|---|---|---|
+| charge onsets | 28 | **1** |
+| grid | −455.5 … +3200.0 W | **1200.0 W flat — the house** |
+| capacity guard engaged | 410 / 720 cycles | **0 / 720** |
+| state of charge | 50.000019 → 51.856789 % | **50.000000 → 50.000000 %** |
+
+**What the documents now say.** The exemption narrows to exactly what is still
+true — **which** hour a strategy picks and **why** are unaffected, because the
+clock and the price series are not functions of the battery; **how hard** it
+trades is not. Of the three defects shadow mode was written for, one —
+TARIFF-14's wrong quarter-hour — is genuinely visible from a shadow run, and it
+is graded that way: identical live and shadow on 720 of 720 charging cycles at
+a binding cap.
+
+**What you will see on the status page.** The `Shadow mode` row and the action
+log now introduce the watts as what the controller would have commanded **on
+this cycle** — in every state, because no number a shadow run records is a
+forecast of a live run. And when a **measured** billed quarter sized those
+watts, both surfaces carry:
+
+> ⚠️ AND ITS SIZE CAME FROM THE BILLED-QUARTER METER, WHICH HAS ONLY THE HOUSE
+> IN IT WHILE THE BATTERY IS HELD AT 0 W. A live run sizes the same trade
+> against a meter the battery is moving, so this is an UPPER BOUND and not a
+> prediction; how far under it a live run lands is a closed-loop question and a
+> shadow run cannot answer it.
+
+⚠️ **The number is caveated, not re-computed, and that was the decision.**
+Re-computing it to "look right" would mean the recorded decision was no longer
+the decision the shipped path reached — while the arbiter, the clamp, the
+write-authorisation gate, the action log and MQTT all ran on the real one. A
+shadow run's whole worth is that what it records is what the controller
+actually decided. `DECISIONS/SAFETY-47-what-a-shadow-run-can-show.md` §3
+records the three alternatives that were rejected and why.
+
+⚠️ **On a site whose cap does not bind, nothing changes by one watt.** At
+`peak_cap_w` 15000 against a 350 W house the recorded figure is the live one
+exactly, and no caveat is a lie there either — the row still says the size came
+off a meter with no battery in it, which is true and is the point.
+
+**And SAFETY-10's own committed evidence could never have failed.** Its
+comparison table ran at a cap the guard never reaches, *and* read only the
+first charging sample — the one instant at which the two runs agree even at a
+cap that does bind. Both had to be closed; closing either alone closes nothing.
+The table is re-taken across the whole run at a binding cap, and
+`test_arbitrage.py` part 3d is the CI-side grader so this class cannot recur.
+14 mutations, no survivors; all 29 check files green.
 
 ### SAFETY-10 — shadow mode, and what its default does to YOUR install