admin/goodwe-addon
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

SAFETY-47: what a shadow run can show, and the watts on its status row
checks / unit (pull_request) Successful in 7m48s
Details

Browse Source 
Not a leak and not a write-path defect. Shadow mode's safety is intact -
the substitution, the re-seed, the authorisation gate and the clamp are
untouched. What was wrong is what three merged documents SAY a shadow run
can show you, and a number on the status row that can be 6.61x what a live
controller would command.

SHADOW MODE CANNOT SURFACE A CLOSED-LOOP DEFECT, AND THE DOCUMENTS NOW SAY
SO. The battery is held at 0 W and the carried command is re-seeded to it,
so every measured input - the meter, the billed-quarter accumulator behind
it, the battery power, the SoC - describes a plant that did not respond. A
closed-loop defect is one whose stimulus IS that response. This is the same
property that makes shadow mode safe, so it is not a gap to close later:
the closed-loop answer comes from the closed-loop rig or from a live run.
SAFETY-10 §5 already conceded this for the grid-following loop. It was
never the loop leg's limitation; it is the general case.

THE "STRATEGIES ARE UNAFFECTED" EXEMPTION WAS TRUE UNTIL SAFETY-45 MERGED,
ONE COMMIT EARLIER. That card sizes the buy leg as min(asked, headroom)
with headroom = (900/remaining) x (ceiling - projected), and `projected`
reads the open quarter's accumulator - the meter - which is a function of
what the battery did earlier in that quarter. Measured on TEST-23 stage 3
at peak_cap_w 1500 / house 1200 / max_w 2000, one hour at 5 s:

  SAFETY-45's limit cycle  NOT visible. 28 onsets live vs 1; grid
                           -455.5..+3200.0 W vs flat at the 1200 W house;
                           guard engaged 410/720 cycles vs 0/720.
  SAFETY-46's SoC churn    NOT visible. The SoC moves 0.000000000 pp.
  TARIFF-14's wrong hour   VISIBLE, and it is the only one: which hour, at
                           what price, clearing what spread - identical on
                           720 of 720 charging cycles at a binding cap.

The exemption narrows to exactly what survives: WHICH hour a strategy picks
and WHY are unaffected; HOW HARD it trades is not. The peak guard's ceiling
and reasons are worth reading from a shadow run; its ENGAGEMENTS are not.

THE NUMBER IS CAVEATED, NOT RE-COMPUTED, AND THAT IS THE DECISION. The
arithmetic is not wrong - 900/remaining is correct for a meter genuinely
under the ceiling, and in shadow the meter genuinely is. It is the right
answer to a question nobody asked. Both surfaces now introduce the watts as
what would have been commanded ON THIS CYCLE, in every state, and carry
shadow.SIZED_FROM_METER whenever a measured billed quarter sized them.
Rejected, and recorded in the decision doc: re-computing it (the recorded
decision would no longer be the decision the shipped path reached, while the
arbiter, clamp, SAFETY-28 gate, log and MQTT all ran on the real one - a
second controller everywhere except the wire); recording nothing (blanks the
row exactly when arbitrage is trading, and the log's edge key is the watts);
and recording the unsized ask beside it (a second number, no warning, and at
the shipped 3500/2000 both figures read 2000 W).

"UPPER BOUND" AND NOT "SMALLER", AND THE DIFFERENCE WAS MEASURED. Charging
only adds offtake, so the shadow size is >= the live size with EQUALITY at
the start of every quarter. Pairwise over 3600 charging cycles in five
configurations: 0 below, 730 exactly equal. The first draft said "smaller",
which would have been false on every one of those 730.

AND THE PREDICATE IS NOT KEYED ON WHETHER THE TRADE WAS CAPPED. arbitrage's
own sentence says "SIZED BY THE CAPACITY-TARIFF GUARD" only when the
headroom came out below the ask - in a shadow run, the START of the quarter,
where the two runs agree to the float. By the end, 900/remaining has
multiplied the headroom past the ask, the trade is not capped, the sentence
is silent, and the record is at its most wrong. A caveat keyed on it would
be quietest exactly where it is needed loudest.

SAFETY-10 §6's COMMITTED EVIDENCE COULD NEVER HAVE FAILED, FOR TWO
INDEPENDENT REASONS, AND CLOSING EITHER ALONE CLOSES NOTHING. Its fixture is
peak_cap_w 15000 against a 350 W house, so the guard never engages and the
sizing is inert - the harness's own comment says so. AND every identity row
reads the FIRST charging sample, where at elapsed=0 the projection IS the
held level and the two runs agree to the float even at a cap that does bind.
Measured: widening the fixture alone leaves that comparison passing. That
second reason is a new shape for MUTATION.md's habit-4 list - an INDEX, not
a fixture - and it is recorded there as the twelfth instance. §6 is re-taken
at a binding cap across the whole run: 716 of 720 charging cycles differ,
headroom 300.0..54000.0 W in shadow against 299.9..307.8 W live, recorded
-2000.0 W against a live -302.4 W.

THE GRADER IS test_arbitrage.py PART 3d, beside SAFETY-45's own closed-loop
regression and built on the same s45_loop() harness, so the runs differ in
one argument. Three lines stand in for _write_unit()'s substitution and
_shadow_settle()'s record and re-seed, marked as a transcription;
test_clamp.py part 8 remains the check on the shipped placement. The section
carries its own precondition into every check: a mutation that stopped
either run trading made it raise on its first min(), kill the file and
report ZERO reds - FCST-06's shape, driven rather than imagined.

AND THE FIX'S OWN FIRST DRAFT CARRIED THE SAME DEFECT. Deleting the caveat
from the action-log line left all 29 files green, because the sentence was
an f-string inside _shadow_settle() and the only suite that drives it uses a
meter_source:off fixture where no arbitrage decision exists. It is
shadow.log_line() now, for the reason words() is a function.

14 mutations, no survivors; M13 and M14 are +0 B and were confirmed on disk
by sha256 with every run purged. M14's first form was aimed at the wrong
direction and correctly survived - min->max makes the shadow record larger,
which is still an upper bound. All 29 check files green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU
This commit is contained in:
glenn schrooyen
2026-09-15 01:26:57 +02:00
co-authored by Claude Opus 5
parent e6da478f87
commit e3ccd9f6ea
10 changed files with 1446 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
goodwe_controller/test_arbitrage.py
+521 -7
View File
@@ -94,6 +94,8 @@ from app.arbitrage import (
CHARGE, DISCHARGE, ArbitrageDecision, claim, decide, enabled, soc_bounds,
threshold_eur_kwh,
)
# SAFETY-47 section 3d. The shipped shadow-mode row, not a transcription of it.
from app import shadow as _shadow
from app.price import (
PRICE_OPTION_DEFAULTS, Absence, PricePoint, PriceProduct, PriceRead,
Uncertainty, WIDEN_FACTOR, brussels, required_spread, widen_factor,
@@ -890,18 +892,61 @@ check("a ZERO headroom does not cap a DISCHARGE. §9.1: 'discharge and export "
# caller fills is a TypeError only on the one path a suite does not run. Same
# pin, same reason, as `weights=` in test_packshare.py part 10.
_S45_MAIN = open(os.path.join(HERE, "app", "main.py"), encoding="utf-8").read()
_s45_calls = [n for n in ast.walk(ast.parse(_S45_MAIN))
_S45_MAIN_TREE = ast.parse(_S45_MAIN)
_s45_calls = [n for n in ast.walk(_S45_MAIN_TREE)
if isinstance(n, ast.Call)
and ast.unparse(n.func).endswith("arbitrage.decide")]
_s45_arg = [ast.unparse(k.value) for c in _s45_calls for k in c.keywords
if k.arg == "charge_headroom_w"]
def _s45_assigned(name, clear=("None",)):
"""Every expression main.py assigns to `self.<name>` that is not a CLEAR.
⚠️ SAFETY-47 HOISTED THE HEADROOM OUT OF THE CALL, so pinning the call
argument alone stopped covering anything: the literal a mutation would put
there now goes one line up instead. Both ends are pinned.
⚠️ `clear` NAMES THE CONSTANTS THAT MEAN "NOTHING HAS ANSWERED THIS YET" -
`__init__`'s value and the per-cycle reset - and they are not a second
source for the number. Excluding them does NOT soften the pin: a mutation
that replaces the real assignment with one of those constants leaves this
list EMPTY, which matches no expected value and is red.
"""
return [ast.unparse(n.value) for n in ast.walk(_S45_MAIN_TREE)
if isinstance(n, ast.Assign)
and [ast.unparse(t) for t in n.targets] == [f"self.{name}"]
and ast.unparse(n.value) not in clear]
_s45_head_src = _s45_assigned("arb_headroom_w")
print(f" main.py has {len(_s45_calls)} `arbitrage.decide(` call site(s); "
f"charge_headroom_w= is {_s45_arg}")
f"charge_headroom_w= is {_s45_arg}, and self.arb_headroom_w is assigned "
f"from {_s45_head_src}")
check("main.py passes the guard's OWN measured headroom at its one "
"arbitrage.decide() call site - the shipped expression, not a "
"transcription of it, so a mutation back to a literal or to max_w is red "
"rather than silent",
_s45_arg == ["peakguard.charge_headroom_w(self.peak_guard)"])
_s45_arg == ["self.arb_headroom_w"]
and _s45_head_src == ["peakguard.charge_headroom_w(self.peak_guard)"])
# ⚠️ AND THE HOIST DID NOT MOVE IT OUT OF THE CYCLE. An `arb_headroom_w` set
# once in `__init__` and never refreshed would satisfy the pin above and would
# size every trade from the guard decision of whatever cycle happened to run
# last - which is the defect the hoist's own comment warns about, one level up.
_s45_cycle = next(n for n in ast.walk(_S45_MAIN_TREE)
if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
and n.name == "cycle"
and any(isinstance(c, ast.Call)
and ast.unparse(c.func).endswith("arbitrage.decide")
for c in ast.walk(n)))
check("...and the assignment is INSIDE the same `cycle()` that makes the call, "
"so the headroom the trade is sized from is this cycle's guard decision "
"and not one carried from an arbitrary earlier one",
any(isinstance(n, ast.Assign)
and [ast.unparse(t) for t in n.targets] == ["self.arb_headroom_w"]
and ast.unparse(n.value)
== "peakguard.charge_headroom_w(self.peak_guard)"
for n in ast.walk(_s45_cycle)))
# --------------------------------------------------------------------------- #
@@ -946,14 +991,26 @@ S45_T0 = D0 + timedelta(hours=CHEAP_H)
def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
seconds=S45_RUN_S):
seconds=S45_RUN_S, shadow=False):
"""One closed hour. `sized=False` is the behaviour this card removes.
⚠️ THE COUNTERFACTUAL IS ONE ARGUMENT, NOT A SECOND CODE PATH. `sized=False`
hands `decide()` a headroom nothing can bind - which is exactly what the
tree did before this card, because nothing was passing one - so the two runs
below differ in one value and share every line of shipped code. Habit 7.
⚠️ SAFETY-47's `shadow=True` IS THE SAME DISCIPLINE, ONE ARGUMENT AGAIN. It
reproduces the THREE things `Controller._write_unit()` and
`_shadow_settle()` do and nothing else: the resolved command is RECORDED,
the plant is driven from `shadow.WIRE_W` instead of from it, and the
carried command is RE-SEEDED to `shadow.WIRE_W` after the record is taken.
Those three lines are a TRANSCRIPTION of main.py's placement and are marked
as one - `test_clamp.py` part 8 is the check on the shipped placement, and
it drives the real `Controller`. What is NOT transcribed is every number
that matters here: the averager, the projection, the guard, the headroom,
the strategy, the arbiter and the row's own words are all the shipped ones.
"""
avg = QuarterAverager(phases=1, max_hold_s=900.0)
tuning = Tuning(gain=0.6, max_w=MAX_W, slew_w=0.0)
t0 = S45_T0
@@ -962,6 +1019,7 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
loop_w = None
batt_cmd = batt = 0.0 # + discharge, as main.py's site_batt_w
onsets = blocks = 0
rec = []
prev_action = "<start>"
grid_lo, grid_hi = None, None
billed = []
@@ -1008,7 +1066,32 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
claims.append(Claim.limit("supervised", P_SAFETY, -MAX_W, MAX_W,
"max_w"))
claims.append(Claim.set("loop", P_LOOP, d.target_w, d.reason))
target = resolve(claims).target_w
res = resolve(claims)
target = res.target_w
head_w = _pg.charge_headroom_w(pk) if sized else HEADROOM_CLEAR
rec.append(dict(
t_s=t, action=arb.action, power_w=arb.power_w,
reason=arb.reason, price=arb.price_now_eur_kwh,
spread=arb.spread_eur_kwh, winner=res.winner,
target_w=float(res.target_w), headroom_w=head_w,
engaged=bool(pk.engaged),
sized_from_meter=_arb.sized_from_meter(
arb, head_w, winner=res.winner)))
if shadow:
# --- TRANSCRIBED 1/3: `_shadow_settle()`'s record, taken
# BEFORE the re-seed destroys its evidence.
rec[-1]["would_w"] = float(res.target_w)
rec[-1]["row"] = _shadow.words(
{"shadow_mode": "on"}, control_started=False,
would_w=float(res.target_w),
sized_from_meter=rec[-1]["sized_from_meter"],
reason=res.explain())
# --- TRANSCRIBED 2/3: `_write_unit()`'s substitution - the
# plant below is driven from WIRE_W, not from the decision.
# --- TRANSCRIBED 3/3: `_shadow_settle()`'s re-seed of the
# carried command, which is what `compute(prev_w=...)`,
# `standing_w()` and SAFETY-42 read next cycle.
target = _shadow.WIRE_W
# THE PLANT, MODELLED: an 800 W/s ramp into a 10 s first-order lag.
step = min(1.0, acc)
delta = target - batt_cmd
@@ -1020,7 +1103,9 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
grid_hi = grid if grid_hi is None else max(grid_hi, grid)
return dict(onsets=onsets, grid_lo=round(grid_lo, 1),
grid_hi=round(grid_hi, 1), swing=round(grid_hi - grid_lo, 1),
billed=billed, blocks=blocks)
billed=billed, blocks=blocks, rec=rec,
engaged=sum(1 for r in rec if r["engaged"]),
cycles=len(rec))
S45_BEFORE = derived(lambda: s45_loop(sized=False))
S45_AFTER = derived(lambda: s45_loop(sized=True))
@@ -1076,11 +1161,440 @@ S45_WIDE_S = derived(lambda: s45_loop(sized=True, cap_w=5000.0, load_w=1200.0,
print(f" peak_cap_w 5000 W, 1200 W house (load + max_w = "
f"{S45_LOAD_W + MAX_W:.0f} W, under the cap): unsized "
f"{S45_WIDE['billed']} W, sized {S45_WIDE_S['billed']} W")
def _s45_outcome(r):
"""Everything the two runs put on the PLANT and the METER.
⚠️ `rec` IS EXCLUDED AND THE EXCLUSION IS NAMED. SAFETY-47 added a
per-cycle record to this harness, and it carries `headroom_w` and
`sized_from_meter` - which are THE ONE ARGUMENT the two runs differ in, by
construction. Comparing them would make this check fail for the reason it
exists to rule out. The resolved command per cycle IS compared, below, and
that is a stronger statement than the six aggregates ever were.
"""
return {k: v for k, v in r.items() if k != "rec"}
check("on a site where the trade cannot reach the cap the two runs are "
"IDENTICAL to the watt - so this card costs nothing on the installs it "
"is not about, and the check above is not passing because the cap "
"dominates everything",
S45_WIDE == S45_WIDE_S and S45_WIDE["onsets"] == 1)
_s45_outcome(S45_WIDE) == _s45_outcome(S45_WIDE_S)
and S45_WIDE["onsets"] == 1)
check("...and identical CYCLE BY CYCLE, not merely in the six aggregates: "
"every resolved command and every traded size matches to the float",
[(r["target_w"], r["power_w"]) for r in S45_WIDE["rec"]]
== [(r["target_w"], r["power_w"]) for r in S45_WIDE_S["rec"]])
# --------------------------------------------------------------------------- #
print()
print("3d. SAFETY-47 - the SHADOW record against a LIVE run, at a BINDING cap")
# ---------------------------------------------------------------------------
# WHAT THIS PART EXISTS FOR, AND IT IS NOT A SECOND SAFETY-45 CHECK.
#
# SAFETY-10 shipped shadow mode saying, in three merged documents, that "the
# strategies are unaffected - they ask for a fixed power from inputs that do
# not depend on what the battery did - so a shadow run does show you the
# trades, the peak-guard engagements and the SoC-limit behaviour". That was
# true until 3c's own fix merged. SAFETY-45 makes the buy leg
# `min(asked, headroom)`, and the headroom is
#
# (900 / remaining) x (ceiling - projected)
#
# where `projected` reads the OPEN QUARTER'S ACCUMULATOR - the meter - which is
# a function of what the battery did earlier in that same quarter. The strategy
# became closed-loop the day 3c landed, and shadow mode holds the battery at
# 0 W, so in a shadow run that accumulator contains THE HOUSE AND NOTHING ELSE.
#
# ⚠️ AND SAFETY-10 §6's COMMITTED EVIDENCE COULD NEVER HAVE FAILED - TWO
# INDEPENDENT REASONS, AND CLOSING EITHER ONE ALONE CLOSES NOTHING.
# (1) its fixture is `peak_cap_w: 15000` against a 350 W house, so the guard
# never engages and the sizing is inert - MUTATION.md habit 4, inside a
# merged card's own proof;
# (2) every identity row reads THE FIRST CHARGING SAMPLE, and at `elapsed=0`
# the projection IS the held level, so the two runs agree to the float
# there even AT a binding cap. 3d-2 drives that and says so.
#
# So this part is the grader for the class: a shadow run and a live run, the
# same hour, the same code, at a cap that BINDS. What is REAL and what is
# TRANSCRIBED is in `s45_loop()`'s own docstring - the three lines that stand
# in for `Controller._write_unit()` and `_shadow_settle()` are named there, and
# `test_clamp.py` part 8 is the check on the shipped placement.
# ---------------------------------------------------------------------------
S47_LIVE = derived(lambda: s45_loop(sized=True))
S47_SHAD = derived(lambda: s45_loop(sized=True, shadow=True))
# The SAFETY-45 defect itself, watched from inside shadow mode - which is what
# SAFETY-10's header claimed a shadow run would surface.
S47_UNSIZED_SHAD = derived(lambda: s45_loop(sized=False, shadow=True))
_s47_lc = derived(lambda: [r for r in S47_LIVE["rec"] if r["action"] == CHARGE])
_s47_sc = derived(lambda: [r for r in S47_SHAD["rec"] if r["action"] == CHARGE])
# ⚠️ THE SECTION CARRIES ITS OWN PRECONDITION INTO EVERY CHECK, AND THIS IS
# FCST-06's SHAPE RATHER THAN TIDINESS. A mutation that stops either run
# trading at all leaves these lists EMPTY; the first `min()` below then raises,
# the file dies before part 4, and the run reports ZERO reds - which reads
# exactly like a survivor. Measured: driving `wanted = batt_w - ex` through
# this section did precisely that. So the lists are replaced by a sentinel that
# cannot satisfy anything, and `s47check()` fails every check in the section
# when the stimulus was not produced.
_S47_DEAD = dict(action=None, power_w=0.0, reason="<no charging cycle>",
price=None, spread=None, winner=None, target_w=0.0,
headroom_w=0.0, engaged=False, sized_from_meter=False,
would_w=0.0, row="", t_s=0.0)
_S47_OK = bool(_s47_lc) and bool(_s47_sc)
if not _S47_OK:
_s47_lc = _s47_sc = [dict(_S47_DEAD)]
_s47_n = min(len(_s47_lc), len(_s47_sc))
def s47check(name, cond):
"""A 3d check, AND the section's own precondition, in one verdict."""
check(name, _S47_OK and bool(cond))
check("PRECONDITION: both runs actually reached a charging decision - without "
"this the section raises on its first `min()`, the file dies before "
"part 4 and the run reports ZERO reds, which reads exactly like a "
"survivor (MUTATION.md, FCST-06's shape). Measured, not imagined",
_S47_OK)
print(f" live : {len(_s47_lc)} charging cycles, traded "
f"{min(r['power_w'] for r in _s47_lc):+.1f} .. "
f"{max(r['power_w'] for r in _s47_lc):+.1f} W, "
f"headroom {min(r['headroom_w'] for r in _s47_lc):.1f} .. "
f"{max(r['headroom_w'] for r in _s47_lc):.1f} W, "
f"grid {S47_LIVE['grid_lo']:.0f} .. {S47_LIVE['grid_hi']:.0f} W")
print(f" shadow: {len(_s47_sc)} charging cycles, RECORDED "
f"{min(r['power_w'] for r in _s47_sc):+.1f} .. "
f"{max(r['power_w'] for r in _s47_sc):+.1f} W, "
f"headroom {min(r['headroom_w'] for r in _s47_sc):.1f} .. "
f"{max(r['headroom_w'] for r in _s47_sc):.1f} W, "
f"grid {S47_SHAD['grid_lo']:.0f} .. {S47_SHAD['grid_hi']:.0f} W")
# --- 3d-1. THE PRECONDITION: the cap binds, and the meter proves it --------
# ⚠️ WITHOUT THIS EVERY CHECK BELOW IS SAFETY-10 §6's DEFECT IN A NEW FILE. At
# a cap the trade cannot reach, live and shadow agree exactly and nothing here
# could ever go red - which is precisely what the committed evidence did.
s47check("PRECONDITION: the cap BINDS - the live run's trade is sized by the "
f"guard on every charging cycle, never reaching the {MAX_W:.0f} W ask",
_s47_lc and all(abs(r["power_w"]) < MAX_W - 1.0 for r in _s47_lc))
s47check("...and the live METER is what closed the gap: it is held up at the "
f"{S45_CAP_W:.0f} W ceiling rather than sitting at the "
f"{S45_LOAD_W:.0f} W house, which is the feedback a shadow run does not "
f"have",
S47_LIVE["grid_hi"] > S45_LOAD_W + 200.0)
s47check("...and the SHADOW meter sees the house and nothing else for the whole "
"run, which is what makes its billed quarter a different quarter",
near(S47_SHAD["grid_lo"], S45_LOAD_W, 0.001)
and near(S47_SHAD["grid_hi"], S45_LOAD_W, 0.001))
# --- 3d-2. WHY THE OLD SHAPE COULD NOT FAIL --------------------------------
# Graded as an EXPECTATION rather than left as a footnote, so that nobody
# rebuilds a check on `[0]` and believes it covers something.
print(f" first charging cycle: live {_s47_lc[0]['power_w']:+.4f} W, "
f"shadow {_s47_sc[0]['power_w']:+.4f} W")
s47check("⚠️ THE FIRST CHARGING CYCLE IS IDENTICAL IN BOTH RUNS EVEN HERE, so "
"widening SAFETY-10 §6's fixture ALONE would not have made its table go "
"red: at elapsed=0 the projection IS the held level and neither plant "
"has moved yet. Both reasons had to be closed, and this is the one a "
"reviewer cannot see from a diff",
_s47_lc[0]["power_w"] == _s47_sc[0]["power_w"]
and _s47_lc[0]["reason"] == _s47_sc[0]["reason"])
# --- 3d-3. AND ACROSS THE WHOLE RUN THEY DIVERGE ---------------------------
_s47_mis = sum(1 for i in range(_s47_n)
if _s47_lc[i]["power_w"] != _s47_sc[i]["power_w"])
_s47_worst = min(_s47_sc, key=lambda r: r["power_w"])
_s47_live_worst = min(_s47_lc, key=lambda r: r["power_w"])
# ⚠️ NaN AND NOT AN EXCEPTION when the sentinel above is in play: `nan > 2.0`
# is False, so the check goes RED, while a ZeroDivisionError here would kill
# the file and report zero reds. Same defect, one line further down - it was
# driven, and it is why this is not a plain division.
_s47_over = (abs(_s47_worst["power_w"]) / abs(_s47_live_worst["power_w"])
if _s47_live_worst["power_w"] else float("nan"))
print(f" size mismatches {_s47_mis}/{_s47_n} charging cycles; the shadow "
f"run records {_s47_worst['power_w']:+.0f} W where the live run's "
f"hardest trade is {_s47_live_worst['power_w']:+.1f} W - "
f"{_s47_over:.2f}x")
s47check("ACROSS THE WHOLE RUN the recorded trade size diverges on all but the "
"first few cycles - the check SAFETY-10 §6 should have been",
_s47_mis > 0.9 * _s47_n)
s47check(f"...and the shadow run RECORDS a trade the live run never commanded, "
f"over by {_s47_over:.2f}x. `900/remaining` amplifies a "
f"(ceiling - projected) gap the battery never closed, and the row "
f"carried that number to a commissioning engineer with no caveat",
_s47_over > 2.0)
s47check("...and the amplification is IN THE HEADROOM, which is where the "
f"measurement enters: the shadow guard offers up to "
f"{max(r['headroom_w'] for r in _s47_sc):.0f} W of charging headroom "
f"against a {S45_CAP_W:.0f} W ceiling and a {S45_LOAD_W:.0f} W house, "
f"while the live guard never exceeds "
f"{max(r['headroom_w'] for r in _s47_lc):.0f} W",
max(r["headroom_w"] for r in _s47_sc) > MAX_W
and max(r["headroom_w"] for r in _s47_lc) < MAX_W)
# --- 3d-3b. THE SENTENCE THE ROW PRINTS, GRADED AS ARITHMETIC --------------
# ⚠️ THE ROW CLAIMS THE RECORDED NUMBER IS AN **UPPER BOUND**, and a claim on
# an operator-facing surface is a claim this file has to be able to fail.
# Charging only ADDS offtake, so a live `projected` is never below a shadow
# one and the headroom is never above it. The earlier wording said "smaller",
# which is FALSE on every cycle where the two are equal - the start of each
# quarter, where `900/remaining` is 1.0 and neither plant has moved.
_s47_below = [i for i in range(_s47_n)
if abs(_s47_sc[i]["power_w"]) < abs(_s47_lc[i]["power_w"]) - 1e-9]
_s47_equal = sum(1 for i in range(_s47_n)
if abs(_s47_sc[i]["power_w"]) == abs(_s47_lc[i]["power_w"]))
print(f" the shadow record is below the live command on "
f"{len(_s47_below)}/{_s47_n} cycles and exactly equal on {_s47_equal}")
s47check("the recorded size is an UPPER BOUND on the live one, on every compared "
"cycle - which is the sentence `shadow.SIZED_FROM_METER` puts on the "
"status row, so the row is making a claim this file can fail",
not _s47_below)
s47check("...and it is NOT strictly greater: the two are equal at the start of "
f"each quarter ({_s47_equal} cycles here), which is why the row says "
f"'upper bound' and not 'smaller' - the second would be a false "
f"sentence on exactly those cycles",
_s47_equal > 0)
# ⚠️ AND THE MECHANISM BEHIND THE BOUND, AS TWO POINTS OF THE SHIPPED
# ARITHMETIC RATHER THAN AS ONE PROPERTY OF A WHOLE RUN. Same ceiling, same
# elapsed, same house: one quarter that carried the battery's charge at the
# meter (LIVE) and one that did not (SHADOW). The closed-loop version above
# cannot be driven red by any mutation that ALSO stops the fixture trading -
# measured - so the relation it rests on is graded directly here.
def _s47_headroom(*, meter_w, batt_w, elapsed_s=450.0):
"""`charge_headroom_w()` for a quarter that banked `meter_w` for
`elapsed_s`, with `batt_w` measured at the pack. All shipped."""
avg = QuarterAverager(phases=1, max_hold_s=900.0)
t = 0.0
while t <= elapsed_s:
imp, exp = split_signed(meter_w)
avg.add(make_sample("ha_signed", imp, exp, phases=1,
ingest_ts=S45_T0 + timedelta(seconds=t),
ingest_mono=(S45_T0.timestamp() + t)))
t += 5.0
pk = _pg.decide(
PeakTracker.project(avg, S45_T0 + timedelta(seconds=elapsed_s)),
batt_w=batt_w, cap_w=S45_CAP_W, reading=None, achievable_w=MAX_W,
soc=50.0, soc_floor=20.0, max_hold_s=900.0, frozen=False)
return _pg.charge_headroom_w(pk)
_S47_TRADE_W = 300.0
_s47_h_shadow = derived(lambda: _s47_headroom(meter_w=S45_LOAD_W, batt_w=0.0))
_s47_h_live = derived(lambda: _s47_headroom(
meter_w=S45_LOAD_W + _S47_TRADE_W, batt_w=-_S47_TRADE_W))
print(f" half-way through one quarter, {S45_LOAD_W:.0f} W house under a "
f"{S45_CAP_W:.0f} W ceiling: the SHADOW meter (battery at 0 W) offers "
f"{_s47_h_shadow:.0f} W of headroom, the LIVE meter (the same house "
f"plus a {_S47_TRADE_W:.0f} W charge) offers {_s47_h_live:.0f} W")
s47check("the SHADOW meter offers STRICTLY MORE charging headroom than the "
"live one on the same house, same ceiling and same elapsed - which "
"is the whole mechanism, in two points of the shipped arithmetic "
"rather than as a property of a whole run",
_s47_h_shadow > _s47_h_live)
s47check("...and the live answer is the one that lands the block ON the "
"ceiling, so the shadow answer is the one that is wrong about the "
"bill rather than the other way round",
near(_s47_h_live, S45_CAP_W - S45_LOAD_W, 1.0))
# --- 3d-4. WHAT SURVIVES OF THE EXEMPTION, GRADED --------------------------
# The narrowed claim the three documents now make, as a check rather than as a
# sentence: WHICH hour and WHY are unaffected; HOW HARD is not.
s47check("WHICH hour the strategy picked and at WHAT price are identical on "
f"every one of the {_s47_n} compared cycles - the clock and the price "
f"series are not functions of what the battery did, which is the half "
f"of the old exemption that is still true",
all(_s47_lc[i]["price"] == _s47_sc[i]["price"] for i in range(_s47_n)))
s47check("...and so is the spread it had to clear",
all(_s47_lc[i]["spread"] == _s47_sc[i]["spread"]
for i in range(_s47_n)))
# --- 3d-5. THE CLOSED-LOOP DEFECT THE DOCUMENTS SAID WAS VISIBLE -----------
# ⚠️ SAFETY-10's HEADER NAMED SAFETY-45's LIMIT CYCLE AS EXAMPLE #1 OF WHAT A
# SHADOW RUN SURFACES. 3c's own PRECONDITION establishes that the unsized loop
# really does run away; the same stimulus watched from inside shadow mode is
# a settled, uneventful hour.
print(f" SAFETY-45's own defect, unsized: live {S45_BEFORE['onsets']} "
f"onsets/swing {S45_BEFORE['swing']:.0f} W, guard engaged "
f"{S45_BEFORE['engaged']}/{S45_BEFORE['cycles']} -> in shadow mode "
f"{S47_UNSIZED_SHAD['onsets']} onsets/swing "
f"{S47_UNSIZED_SHAD['swing']:.0f} W, guard engaged "
f"{S47_UNSIZED_SHAD['engaged']}/{S47_UNSIZED_SHAD['cycles']}")
s47check("⚠️ SAFETY-45's LIMIT CYCLE IS NOT VISIBLE FROM A SHADOW RUN, and three "
"merged documents said it was. The same hour, the same unsized code: "
f"{S45_BEFORE['onsets']} charge onsets and a "
f"{S45_BEFORE['swing']:.0f} W grid swing live, "
f"{S47_UNSIZED_SHAD['onsets']} onsets and "
f"{S47_UNSIZED_SHAD['swing']:.0f} W in shadow",
S45_BEFORE["onsets"] >= 10 and S45_BEFORE["swing"] > 2000.0
and S47_UNSIZED_SHAD["onsets"] <= 2
and S47_UNSIZED_SHAD["swing"] < 1.0)
s47check("...and neither are the guard ENGAGEMENTS the same documents promised: "
f"{S45_BEFORE['engaged']} engaged cycles live against "
f"{S47_UNSIZED_SHAD['engaged']} in shadow. Every term of "
f"`wanted = batt_w + excess` is MEASURED, and in shadow mode the "
f"battery contributes nothing to either term",
S45_BEFORE["engaged"] > 100 and S47_UNSIZED_SHAD["engaged"] == 0)
# --- 3d-6. THE THREE RUNGS OF `sized_from_meter()`, SEPARATED --------------
# TEST-16's rule: three rungs answer one question, so each is reached with the
# other two clear. Any two of them left standing would mask the third.
_s47_chg = _s47_worst
_s47_sell = derived(lambda: act(PLAN, DEAR_H, thresh=_shipped, unc=NO_WEATHER,
headroom=0.0))
s47check("the CHARGE rung: a metered headroom that sized a buy leg answers True, "
"which is the state the caveat exists for",
_arb.sized_from_meter(
ArbitrageDecision(action=CHARGE, power_w=-300.0, reason="x",
spread_eur_kwh=1.0, required_eur_kwh=0.1,
price_now_eur_kwh=0.05),
300.0, winner=_arb.SOURCE) is True)
s47check("...the SELL rung: a DISCHARGE answers False however the headroom reads. "
"§9.1 - discharge and export are never capped by the peak guard - so a "
"caveat on a sell would be a FALSE sentence on the status row",
_s47_sell.action == DISCHARGE
and _arb.sized_from_meter(_s47_sell, 300.0, winner=_arb.SOURCE) is False)
s47check("...the UNMEASURED rung: a None headroom answers False. Nothing sized "
"anything from a meter, so there is nothing to disclose - and `decide()` "
"refuses the trade there anyway",
_arb.sized_from_meter(
ArbitrageDecision(action=CHARGE, power_w=-300.0, reason="x",
spread_eur_kwh=1.0, required_eur_kwh=0.1,
price_now_eur_kwh=0.05),
None, winner=_arb.SOURCE) is False)
s47check("...the WINNER rung: the same sized charge answers False once something "
"else owns the resolution. `Resolution.target_w` is then somebody "
"else's number and a caveat filed against it would be false",
_arb.sized_from_meter(
ArbitrageDecision(action=CHARGE, power_w=-300.0, reason="x",
spread_eur_kwh=1.0, required_eur_kwh=0.1,
price_now_eur_kwh=0.05),
300.0, winner="loop") is False)
# --- 3d-7. THE ROW, AT THE WORST CYCLE -------------------------------------
_s47_row = _s47_chg["row"]
_s47_first_row = _s47_sc[0]["row"]
print(f" worst cycle row: {_s47_row[:230]}")
s47check("the shipped row carries the caveat at the worst cycle: the operator is "
"told the number was sized from a meter with only the house in it",
_shadow.SIZED_FROM_METER in _s47_row)
s47check("...and it still carries the watts, in their own slot, and the standing "
"0 W beside them - the caveat NARROWS the claim rather than deleting "
"the record a shadow run exists to produce",
"WOULD HAVE COMMANDED" in _s47_row and "inverter held at 0 W" in _s47_row
and f"{round(_s47_chg['would_w']):+d}".replace("+", "") != "")
s47check("...and the watts are introduced as what it would have commanded ON "
"THIS CYCLE, in every shadow state and not only the caveated ones - no "
"number a shadow run records is a forecast of a live run",
"ON THIS CYCLE WOULD HAVE COMMANDED" in _s47_row
and "ON THIS CYCLE WOULD HAVE COMMANDED" in _s47_first_row)
# --- 3d-7b. THE ACTION LOG, WHICH IS THE RECORD READ AFTERWARDS -----------
# ⚠️ THE TWO SURFACES ARE GRADED SEPARATELY BECAUSE THEY FAILED SEPARATELY.
# Driven as one mutation, deleting the caveat from the log line alone left all
# 29 files green: the only check that could see that line drives a fixture with
# `meter_source: off`, where no arbitrage decision - and therefore no caveat -
# is reachable. The sentence is `shadow.log_line()` now, so it can be graded.
_s47_log = derived(lambda: _shadow.log_line(
would_w=_s47_chg["would_w"], reason="arbitrage -> -2000 W",
sized_from_meter=_s47_chg["sized_from_meter"]))
_s47_log_plain = derived(lambda: _shadow.log_line(
would_w=_s47_chg["would_w"], reason="loop -> -300 W",
sized_from_meter=False))
print(f" action log: {_s47_log[:190]}")
s47check("the ACTION LOG line carries the same caveat the row does - a page that "
"discloses and a 40-row record that does not is the worse half of the "
"two, because the record is what is read after the run",
_shadow.SIZED_FROM_METER in _s47_log)
s47check("...and it is the SAME constant, not a second wording of it, so the two "
"surfaces cannot start disagreeing about which cycles are caveated",
_shadow.SIZED_FROM_METER in _s47_row and _shadow.SIZED_FROM_METER
in _s47_log)
s47check("...and an uncaveated cycle gets the plain sentence, so the caveat is "
"not simply printed on everything",
_shadow.SIZED_FROM_METER not in _s47_log_plain
and "would have commanded" in _s47_log_plain
and "ON THIS CYCLE" in _s47_log_plain)
# --- 3d-8. ⚠️ AND IT IS NOT KEYED ON WHETHER THE TRADE WAS CAPPED ----------
# THE TRAP THIS PART EXISTS TO SPRING. `arbitrage`'s own sentence says "SIZED
# BY THE CAPACITY-TARIFF GUARD" only when the headroom came out BELOW the ask.
# In a shadow run that is the START of the quarter - where the two runs still
# agree to the float. By the end `900/remaining` has multiplied the headroom
# PAST the ask, the trade is NOT capped, the sentence is silent, and the
# recorded number is at its most wrong. A caveat keyed on that sentence would
# be quietest exactly where it is needed loudest.
_S47_CAPPED = "SIZED BY THE CAPACITY-TARIFF GUARD"
print(f" at the worst cycle the shipped trade sentence says "
f"{'' if _S47_CAPPED in _s47_chg['reason'] else 'NOT '}capped; at the "
f"first it says "
f"{'' if _S47_CAPPED in _s47_sc[0]['reason'] else 'NOT '}capped")
s47check("PRECONDITION: the shipped 'capped' sentence IS present at the first "
"charging cycle, where the shadow number is RIGHT - so the inverse "
"below is a real inversion and not an absence everywhere",
_S47_CAPPED in _s47_sc[0]["reason"])
s47check("⚠️ ...and ABSENT at the worst cycle, where the shadow number is "
f"{_s47_over:.2f}x out. A caveat keyed on `capped` would fire only "
f"where the record is accurate and go silent where it is multiples "
f"wrong; `sized_from_meter()` is keyed on the headroom having been "
f"MEASURED, so it fires on both",
_S47_CAPPED not in _s47_chg["reason"]
and _s47_chg["sized_from_meter"] is True
and _s47_sc[0]["sized_from_meter"] is True)
# --- 3d-9. main.py's CALL SITES, PINNED ------------------------------------
# ⚠️ THE CALL SITE IS THE UNIT OF COVERAGE (habit 15), same as 3b's. Nothing
# behavioural in this file can see main.py render the row with a hard-coded
# False, because every check above calls `shadow.words()` itself.
_s47_words = [n for n in ast.walk(_S45_MAIN_TREE)
if isinstance(n, ast.Call)
and ast.unparse(n.func).endswith("shadow.words")]
_s47_flag = [ast.unparse(k.value) for c in _s47_words for k in c.keywords
if k.arg == "sized_from_meter"]
_s47_flag_src = _s45_assigned("shadow_sized_from_meter",
clear=("None", "False"))
print(f" main.py: shadow.words(sized_from_meter={_s47_flag}), and "
f"self.shadow_sized_from_meter is assigned from {_s47_flag_src}")
s47check("main.py renders the row from the flag THE CYCLE RECORDED, at its one "
"shadow.words() call site - not from a literal and not re-derived on "
"the status task, where `self.peak_guard` is a different cycle's",
_s47_flag == ["self.shadow_sized_from_meter"])
s47check("...and that flag comes from the SHIPPED predicate with all three of its "
"arguments - the decision, the headroom the trade was sized from, and "
"the arbiter's winner - so a mutation to `False`, to a literal or to a "
"two-argument transcription is red rather than silent",
_s47_flag_src == ["arbitrage.sized_from_meter("
"self.arb, self.arb_headroom_w, "
"winner=resolution.winner)"])
_s47_logcalls = [n for n in ast.walk(_S45_MAIN_TREE)
if isinstance(n, ast.Call)
and ast.unparse(n.func).endswith("shadow.log_line")]
_s47_logflag = [ast.unparse(k.value) for c in _s47_logcalls for k in c.keywords
if k.arg == "sized_from_meter"]
print(f" main.py: shadow.log_line(sized_from_meter={_s47_logflag})")
s47check("...and the ACTION LOG line comes from the shipped sentence with the "
"same flag, at main.py's one call site - not re-assembled as an "
"f-string where no check can reach it, which is how it survived a whole "
"mutation battery once already",
_s47_logflag == ["self.shadow_sized_from_meter"])
# ⚠️ AND THE PARAMETER HAS NO DEFAULT. TEST-14's rule, and this card is the
# reason it matters here: a caller that FORGOT the caveat and a caller that
# DECIDED it did not apply would render the identical row.
_s47_sig = inspect.signature(_shadow.words)
_s47_logsig = inspect.signature(_shadow.log_line)
s47check("`shadow.words()` and `shadow.log_line()` BOTH require "
"`sized_from_meter` - no default on either, so a caller cannot omit the "
"caveat by accident and get the un-caveated surface",
"sized_from_meter" in _s47_sig.parameters
and _s47_sig.parameters["sized_from_meter"].default
is inspect.Parameter.empty
and "sized_from_meter" in _s47_logsig.parameters
and _s47_logsig.parameters["sized_from_meter"].default
is inspect.Parameter.empty)
# --------------------------------------------------------------------------- #