SAFETY-81 review: 10 s hold, ERROR line per episode, more scenarios

- The alarm must hold for peakguard.ALARM_HOLD_S (10 s) on the projection's
  clock. A load that tops cap + battery for ~5 s every 30 s alarmed at every
  quarter start while the quarter landed under the aim (sine4500_fast).
- A cycle with no battery reading leaves the hold alone.
- Notified once per quarter, but the ERROR line is written per episode.
- New sim scenarios (sine4500_fast, twice7000, step6500_gap) with 5a4cdc2
  digests; control still byte-identical. Unit checks for export and the
  hold across a missing reading. test_peakguard's saturated fixture moves
  the hold start back instead of waiting it out.
- DECISIONS and DOCS updated: costs of the hold, tolerance reasoning, the
  double count in control left to a follow-up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/test_safety81.py

@@ -8,20 +8,24 @@ DECISIONS/SAFETY-81-load-too-high.md has the record.
 1. Every command is byte-identical to release/1.0 5a4cdc2.
 2. No alarm on the quarter-edge spike, the last seconds, noise (margin 50
    and 0) or a burst the quarter absorbs.
-3. Real overloads still alarm, as fast as on 5a4cdc2.
+3. Real overloads still alarm, ALARM_HOLD_S after 5a4cdc2.
 4. peakguard.load_too_high() on its own.
+5. The hold across a cycle with no battery reading (review).
 
 Mutations (MUTATION.md, purged copies) are listed in the pull request.
 """
 
+import asyncio
 import os
 import sys
+from datetime import datetime, timedelta, timezone
 from types import SimpleNamespace
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, os.path.join(HERE, "tools"))
 
 import safety81_sim as sim                                    # noqa: E402
+from app.main import Controller                               # noqa: E402
 from app.peakguard import load_too_high                       # noqa: E402
 
 fails = []
@@ -48,8 +52,14 @@ BASE = {
     "miss5560": ([1201.0, 1801.0], "cd991cfe1685750598236701a5a2f2f0342d66645609c536d42ab7ba07216e6c"),
     "ramp6500": ([1296.0, 1801.0], "8db7675535f1a01abf38bd6bfb996a6fe57711d3ecca53541bb1c0870748c46b"),
     "step7500_reserve": ([], "21eb9c07a4582f47f347084d1c75a28a5d767bc068bc3f74f32433d3239e9ccb"),
+    # Added in review, printed the same way.
+    "sine4500_fast": (["112, about one per 30 s"], "710008fd8f2d33a0e2cbb9a626bedafd6d87bc23712bbc5b74a4af9b3ec21897"),
+    "twice7000": ([1001.0, 1502.0, 2699.0], "1cddda8cf35859efb2ad503f1683f744cb812a6325a390c4fa3df19d717af043"),
+    "step6500_gap": ([1201.0, 1801.0], "95e5c90e4a6814526cb4f3bea76286063b449d86a420f888c014531fb6e913a3"),
 }
-RUN = {k: sim.run(**v)[:2] for k, v in sim.SCENARIOS.items()}
+OUT = {k: sim.run(**v) for k, v in sim.SCENARIOS.items()}
+RUN = {k: v[:2] for k, v in OUT.items()}
+ERR = {k: v[4] for k, v in OUT.items()}
 
 # ============================================================================ #
 print("1. every command byte-identical to release/1.0 5a4cdc2")
@@ -60,23 +70,33 @@ for k, (alarms, digest) in RUN.items():
 # ============================================================================ #
 print("2. no false alarm (5a4cdc2's are listed)")
 for k in ("edge4600", "edge4600_m0", "const4500", "const4500_m0", "sine4500",
-          "noise5000_m50", "noise5000_m0", "burst_end"):
+          "noise5000_m50", "noise5000_m0", "burst_end", "sine4500_fast"):
     check(f"{k}: none (5a4cdc2: {BASE[k][0]})", RUN[k][0] == [])
 
 # ============================================================================ #
-print("3. real overloads still alarm, as fast as 5a4cdc2")
-for k in ("step6500", "miss5560"):
+print("3. real overloads still alarm, ALARM_HOLD_S after 5a4cdc2")
+# ALARM_HOLD_S (10 s) plus up to 2 s of late meter samples; at 1800 s the
+# quarter-edge tick restarts the hold.
+for k, want in (("step6500", [1211.0, 1813.0]),
+                ("miss5560", [1213.0, 1813.0])):
     print(f"    {k}: load steps up at 1200 s; alarms at {RUN[k][0]}, "
           f"5a4cdc2 {BASE[k][0]}")
-    check(f"{k}: the same second as 5a4cdc2, and again only at the next "
-          f"quarter (at most once per quarter)", RUN[k][0] == BASE[k][0])
-# By design: until 1306 s this quarter would end at most ALARM_MISS_W over the
-# real 3500 W cap; 5a4cdc2 alarmed when it crossed the aim (cap - 50).
+    check(f"{k}: after the hold, and again only at the next quarter",
+          RUN[k][0] == want)
+check("step6500_gap: cycles stopped by a lost battery reading do not "
+      "restart the hold",
+      RUN["step6500_gap"][0] == [1215.0, 1813.0])
+check("twice7000: notified once in the quarter (5a4cdc2: "
+      f"{BASE['twice7000'][0]})", RUN["twice7000"][0] == [1011.0])
+check("twice7000: the ERROR line for both overloads",
+      ERR["twice7000"] == [1011.0, 1512.0])
+# By design: until 1306 s (then the hold) this quarter would end at most
+# ALARM_MISS_W over the real 3500 W cap; 5a4cdc2 alarmed at the aim (cap - 50).
 print(f"    ramp6500: alarms at {RUN['ramp6500'][0]}, "
       f"5a4cdc2 {BASE['ramp6500'][0]}")
 check("ramp6500: alarms once the quarter will end over the real cap by "
       "more than ALARM_MISS_W",
-      RUN["ramp6500"][0] == [1306.0, 1801.0])
+      RUN["ramp6500"][0] == [1316.0, 1813.0])
 check("step7500 under the peak reserve: not this alarm (the guard is not "
       "allowed to discharge)", RUN["step7500_reserve"][0] == [])
 
@@ -109,6 +129,40 @@ check("over cap + battery, but the quarter lands under the cap: no",
 check("...and when it does not: yes", ltl(proj(700, 3450, 4000), 2000))
 check("no battery reading: no", not ltl(proj(300, 3450, 5000), None))
 check("no seconds left: no", not ltl(proj(900, 4000, 5000), 2000))
+check("a quarter already over is not won back by export: yes",
+      ltl(proj(800, 3950, 1000), 0))
+
+# ============================================================================ #
+print("5. the hold across a cycle with no battery reading")
+# A reading the stale detector drops (STALE_READING) reaches the alarm as None
+# while the cycle still runs. Unknown is not "fine": it must not restart the
+# hold. Driven on Controller.check_peak_saturated() itself, with stubs.
+Q0 = datetime(2026, 9, 20, 11, 0, tzinfo=timezone.utc)
+notes = []
+
+
+async def _call(domain, service, data):
+    notes.append(data.get("notification_id"))
+
+
+stub = SimpleNamespace(
+    peak_guard=SimpleNamespace(saturated=True, ceiling_w=3500.0,
+                               reason="PEAK_GUARD: fixture"),
+    site_rating_w=2000.0, shadow=False, events=[],
+    _peak_batt_prev=None, _peak_alarm_block=None, _peak_high_since=None,
+    _peak_saturated=False, hass=SimpleNamespace(call=_call),
+    log_event=lambda msg, hint=None: None)
+first = None
+for sec in range(0, 30):
+    stub.site_batt_w = None if 4 <= sec < 8 else 2000.0
+    p = proj(300 + sec, 3450, 6000)
+    p.block_start = Q0
+    stub._peak_proj = p
+    asyncio.run(Controller.check_peak_saturated(stub))
+    if notes and first is None:
+        first = sec
+check(f"a 4 s gap in the battery reading: alarm at {first} s, not 18 s",
+      first == 10)
 
 print()
 if fails: