6 Commits

Include renames

Author	SHA1	Message	Date
Claude dev agent	d69fd8fbfd	OPT-11 P1: per-battery mode limits, on/off, solar order ... A battery's mode is a soft unit limit (source `mode`, P_MODE 35) kept apart from the hard limits in pre_resolve(). The allocator applies it only while the site target is decided at or below 35 (new Resolution.deciding_priority), so the peak floor releases it and a mode `hi` never meets the site `lo`. At N=1 resolve() applies the same rule to the site target after stage 2. A mode range without 0 W is dropped as a software fault, so REFUSE_SIGN stays unreachable from a mode. compute() gets the loop bound (sum over live units of hard limits with modes applied), so the loop never asks for watts no battery may give and the saturation freeze never parks on them. While charging, Leftover solar weighs 0 so Solar first fills first. Store keys pack_use and pack_mode per battery, set by two new /action values; Off stops and skips maintenance with a log line. Minimal Batteries cards (EN/NL). Off by default (battery_modes_enabled); off, commands are byte-identical to a5dddad at N=1 and N=2 (test_modes.py part 1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-28 18:51:29 +02:00
glenn schrooyenandClaude Opus 5.5	fe80047235	CI-12 round 2: INFRA_READ_TOKEN for admin/goodwe; the pin tracks release/1.0 ... - checks.yml's infra checkout and infra-pin.yml's admin/goodwe ls-remote use the INFRA_READ_TOKEN secret; the self fetch keeps GITHUB_TOKEN. - infra-pin.yml compares against admin/goodwe refs/heads/release/1.0; STALE message, comments and README follow. - test_control.py / test_alloc.py: drop the claim that CI cannot reach admin/goodwe. - .gitea/infra-pin is DELIBERATELY one release/1.0 merge behind (d84ac01) for the "infra-pin / fresh goes red" proof; the next commit sets it to HEAD. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 16:08:55 +02:00
adminandClaude Opus 5	5d7e275df4	SAFETY-39: slew_w is a ratio to the rail, and gain is what is still wrong ... `slew_w: 1000` was derived on 2026-08-22 against a clamp of 1500 W, where "capping how far the loop can jump ahead of the inverter" was true because the rail itself bounded the excursion. The live install went to max_w 5000 and the constant did not move, so the loop crosses its whole output range in 10 s against a plant NOTES.md §5.10 measured at ~18 s. Measured on the owner's system 2026-09-05 11:43-11:46: a 3.4 kW export drove the setpoint 380 -> 5000 W in five 2 s ticks, the battery to -5154 W past a 5000 VA rating, and the grid from 3.4 kW of EXPORT to 2.8 kW of IMPORT. Nothing was broken; the rail moved. REPRODUCED FIRST, and one half of it is not reproducible at all. On plantsim.Plant and on an independent in-repo model: the setpoint stepping a full 1000 W per tick to the rail (48 of 51 export steps), and the meter crossing from export into import. The -5154 W figure is NOT reproducible in either model, because both clamp the plant at its rating - so the card's AC "battery no longer exceeds max_w in simulation" is unfalsifiable and was rewritten rather than met. THE DELIVERABLE IS THE RELATIONSHIP. SLEW_RAIL_FRAC = LOOP_TICK_S / PLANT_SETTLE_S = 2 s / 18 s = 1/9 slew_w = 0 now means FOLLOW THE RAIL - SLEW_RAIL_FRAC * max_w - exactly as integrator_max_w = 0 already means follow max_w. It is the shipped default: 222 W at max_w 2000, 556 W at 5000, 1067 W at a ~9600 W two-inverter site. validate.py rule 10 refuses an explicit value faster than that, graded against sum(unit_caps(opts)) - the roster sum, i.e. Controller.site_max_w - so a second inverter moves the bound with no operator action. VERIFIED BY BREAKING IT: restoring slew_w 1000 at max_w 5000 is refused, and the refusal names the rail, the crossing time, the measurement and what to do. Equality, one watt of slack, the live interim 400 and slew_w 0 at every rating all still start. GAIN IS THE CONSTANT THAT IS STILL WRONG, and it is NOT changed here. Over 51 export steps the over-absorption is FLAT in slew (958 W at 1000, 1081 W at 250) and monotone in gain (987 W at 0.6, 876 at 0.3, 435 at 0.2): slew_w bounds the OUTPUT, while the integrator moves gain*error per cycle and reaches a 5000 W rail in under three ticks whatever the slew is. Two control-law constants moving in one release on a running house makes the next measurement uninterpretable. ⚠️ N=2: the site rail becomes sum(max_w) ~ 9600 W (inverter B FROM DATASHEET AND SERIAL, not measured, and sim/plantsim.py's INVERTER_B is A copied), and the enforced ratio produces 1067 W there automatically. But a growing rail LOOSENS this bound, and the >= 900 W symptom goes stale at N=2 the same way the constant did - both stated in the record rather than left to be discovered. Nothing reached the inverter. The live install still runs the interim slew_w 400 applied by hand on 2026-09-05, which rule 10 accepts unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-06 01:10:15 +02:00
glenn schrooyenandClaude Opus 5	e306c74cb8	DEV-02: per-instance inverter objects, so nothing is graded against a sibling ... Every piece of per-device state in the Controller was a scalar, and several of them are safety inputs. app/inverter.py introduces an `Inverter` that owns its entities, its rating, its device range, its SignWatchdog, its last_write and its last_beat, under store keys namespaced by unit name. The Controller holds a list of them and keeps only what is genuinely site-level: the P1 reading, the site integrator, and the tariff quarter. WHAT THE SCALARS WERE SILENTLY ASSERTING dev_min/dev_max one pair, read from one setpoint_entity. A second inverter's rating was NEVER READ AT ALL, so its clamp, its freeze rail and the peak guard's achievable_w were the first one's numbers. soc one reading into the maintenance FSM, SAFETY-24's pack floor and arbitrage's bounds. An average lets the emptier pack be driven below its own floor. sign_wd ONE SignWatchdog, whose own docstring says "one instance per actuator", latched under FLAT store keys - so a trip caused by B latched A across restarts and one operator press cleared both. last_beat one deadline and one serialised hass.call(), so a hung write to A ate B's 30 s layer-1 budget. actual_w BECAME SITE LEVEL WHILE THE READINGS BECAME PER-INSTANCE, and those are opposite directions on purpose. compute()'s anti-windup test is `abs(prev_w - actual_w) > saturation_w` with prev_w the SITE target, so feeding it one inverter's power compares a site number against a unit number, trips the saturation freeze permanently and leaves a standing grid error. Measured on admin/goodwe's two-master rig (tools/alloc_sim.py --splits, 2 kW load, 40 cycles), worst |delta| between splits at the meter: gain one unit's power the site sum 0.2 510 W 0 W 0.4 250 W 0 W 0.6 50 W 0 W That was ALLOC-01's disclosed finding; test_alloc.py part 8 kept its stimulus and now grades the other row. THE STORE MIGRATION IS GRADED, NOT MERELY PERFORMED. sign_tripped/sign_reason move to unit/<name>/... once, verified by READING BACK what was written, and the version marker is set only when nothing that carried state was lost. The flat keys stay in the file so a rollback still finds its latch. And __init__ compares the pre-migration flat latch against what unit A actually came up with: if the latch did not survive it is RE-ARMED from the legacy value and shouted about. A latch that silently fails to migrate is a disarmed safety guard on an install whose state file says it is protected - which is strictly worse than never persisting it, because now there is evidence saying it is fine. test_inverter.py part 2 breaks the migration and watches the guard fire. HEARTBEATS ARE INDEPENDENT AND THE BUDGET IS DERIVED. Each inverter owns its deadline, the refreshes go out concurrently, and each write is bounded by WRITE_BUDGET_S = 4 s. The inequality is graded rather than asserted: 4 + heartbeat_s's schema maximum of 25 < 30, validate.FIRMWARE_INGEST_VETO_S. Verified by injecting a transport that accepts and never answers. live_units() ANSWERS HONESTLY. A unit whose every write has been rejected for a whole layer-1 window is not commandable; the allocator drops it, the survivors carry its share, the action log names it, and the dropped unit is commanded 0 W rather than left standing on its last share. A roster entry with NO setpoint_entity is deliberately not handled there - that is a configuration that cannot be delivered, and it reaches main.py's refusal branch, which is how that branch keeps a live trigger after this card removed its old one. AT N=1 NOTHING MOVES. The removed scalars survive as read/write properties of the sole inverter, so every existing replay runs unmodified - and they REFUSE at N>=2 rather than answering for the first inverter, which is the tripwire on a consumer that was never made per-instance. EVIDENCE. 19 files green. test_inverter.py is new (82 checks). Eighteen mutations were applied to the shipped modules on a purged tree via tools/mutation_run.sh and each was observed RED. Two of them SURVIVED first time and the checks were changed rather than the table: the serialised dispatch and the shared last_beat both passed while part 6 gathered its own writes and computed its own `due` list. send_heartbeats() was extracted from run_control() so the shipped dispatch is reachable by a check at all. INVERTER B STILL DOES NOT EXIST. build_roster() returns exactly one inverter from the flat options and is the one function CFG-04 changes; every two-unit figure here is architecture, and the second rating in the checks is marked a hypothesis. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-02 14:50:43 +02:00
glenn schrooyenandClaude Opus 5	3fe3c7acb0	ALLOC-01: clamp each envelope end on its own, and widen the replay that missed it ... Two blocking findings from the review of 186e13c. The second is why the first survived, and it is the one this commit is really about. THE CLAMP. `_clamp_int()` folded both ends of the interval into one `min(max(...))` and substituted `v` itself for a bound that was infinite. That reads as "an absent bound cannot bind", and it is not what it does: with `hi == inf` the expression collapses to `min(max(v, lo), v) == v`, so A MISSING CEILING SILENTLY DISCARDED THE FLOOR. `_clamp_int(0, 2142, inf)` returned 0. It reached the shares through all three call sites - the base, the pin clamp and the post-floor clamp. The worked failure: bounds `{a: [2000, +inf], b: [-5000, 5000]}` against a +1000 W site target returned `a=+500, b=+500` - inverter-a commanded at a quarter of its own 2000 W floor - while THE SAME CASE WITH A FINITE CEILING correctly REFUSES on sign coherence. So one defect broke the ticket's first named deliverable ("each share clipped to that unit's UnitBounds interval") and suppressed a circulating-power refusal that should have fired. Both now behave identically, and the refusal is the behaviour. Not reachable on the live install - N=1 is a pass-through, and via main.py the supervised claim unconditionally files a finite +/-max_w LIMIT at P_SAFETY that pre_resolve's gate can never filter because nothing outranks P_SAFETY. But `plan()` and `arbiter.allocate()` are the public envelope contract SAFETY-28 and DEV-02 are being asked to build on, and `UnitBounds()` DEFAULTS TO `(-inf, +inf)`, so a one-sided envelope is the ordinary case at N>=2 rather than an edge, and any caller with one inherited the defect. Fixed by clamping the two ends independently: cast to int, apply `lo` only if it is not -inf, apply `hi` only if it is not +inf. `_int_envelope()` already passes infinities through untouched and needed no change; it is the only other place in the module that special-cases infinity, and the rest of the tree's `isfinite` calls are input validation in unrelated modules. THE RECORD. `UnitPlan.explain()` printed `inverter-a -> +500 W in [2000, +inf] (weighted share)` - a line asserting a share is inside an interval that excludes it, in the record SAFETY-28 gates on. It now ASKS: `within_envelope` checks the share against the interval, and a violated plan prints `OUTSIDE ... - ENVELOPE VIOLATED, DO NOT WRITE` instead. A dropped unit is exempt and prints "not commanded" - it was told nothing, its interval may be a contradiction no number is inside, and a banner there would cry wolf on the one row that is working. THE REPLAY THAT COULD NOT SEE IT, WHICH IS THE FINDING THAT MATTERS. The 250 000-tick replay drew every envelope as `B(-uniform(0, RATING), uniform(0, RATING))` - finite on both ends and containing zero, every time - while the check it fed claimed "no share ever leaves the envelope it was clamped into", which reads as a statement about `UnitBounds`. The data could only exercise a symmetric closed interval around zero. That is why it reported 0 escapes against a live defect while the reviewer's own 120 000 ticks reported 6 254. The generator now draws from every shape `UnitBounds` can express: finite straddling zero, half-open above, half-open below, finite excluding zero in each direction, half-open AND excluding zero, and bare `UnitBounds()`. Over the same seed and the same 250 000 ticks it draws 166 657 half-open intervals, 55 233 bare ones and 222 082 that exclude zero, and those counts are PRINTED and asserted so "the replay covers half-open intervals" is a number a reader can see rather than a sentence the file asserts about itself. The escape check also dropped its 1 W tolerance: `_int_envelope()` narrows inward, so there is nothing for slack to absorb except a defect. GRADED, NOT MERELY APPLIED - the acceptance bar for this round. A/B on one seed and one tick count, against the defective clamp: THE OLD GENERATOR SEES 0 ESCAPES, THE NEW ONE SEES 39 991. Reverting the fix under the widened generator takes test_alloc.py RED on four checks (the escape count, the record check, and both halves of the new half-open block); re-applying it takes it green. The collapse is now a row in part 12's mutation table, recorded as the mutation that actually shipped rather than a hypothetical one. TWO CHECKS RE-AIMED RATHER THAN LOOSENED. * Part 6's "the sign gate never fires on an ordinary tick" counted refusals over the whole replay. Envelopes that EXCLUDE zero are precisely what that gate is for, so the widened generator makes refusals correct there. It now counts an ORDINARY tick explicitly - no pin, every envelope contains zero - and asserts 0 refusals over 77 533 of them, half-open and bare envelopes among them. That is stronger than what it replaced, not weaker. * Part 1's third check summed `sum_w - sum(shares)` over ticks where `unmet_w == 0`, and `unmet_w` IS that difference - so it was true by construction and would have gone quiet rather than red. It now measures the one rounding that is actually left: the site-level `quantisation_w`, totalling -39.8 W over 137 964 allocations, i.e. -0.0003 W per tick. Largest remainder against the per-unit alternative is still graded in part 2, where the counterfactual drifts -125 W over 50 000 ticks at three inverters. Verified: all 18 suites green in the CI image on a tree with no bytecode cache; test_alloc.py also re-run through tools/mutation_run.sh, which purges. AC 2 and AC 3 are untouched by this change - the rig and part 8 use symmetric finite envelopes, which the old and new clamp treat identically - and part 8 is green. No hardware touched; admin/goodwe not fetched, not modified, not pushed to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 11:49:18 +02:00
glenn schrooyenandClaude Opus 5	186e13ceca	ALLOC-01: allocate the site grid target, sum-invariant, never broadcast ... ARB-03 left `allocate()` as a documented seam that passed through at N<=1 and DECLINED at N>=2, with the reasoning recorded at the line: the obvious placeholder - hand the site target to each inverter - IS the ARCH-01 fault, and "a placeholder that cannot be told apart from the real thing by any guard we have is worse than no placeholder". This fills the seam. WHY A BROADCAST IS A FAULT AND NOT AN INEFFICIENCY. The control primitive is meter emulation: the master reports a FABRICATED grid reading and the inverter regulates itself to it, so one number means "the battery moves X W" to this add-on and "the grid is at X W" to the inverter - an identity that holds only at N=1. Hand two inverters the same target and each supplies it IN FULL, so the loop gain at the meter becomes N times the per-unit gain. Reproduced on admin/goodwe's two-master rig against this tree: -400 W export overshoot at gain 0.6, and at gain 1.0 - which config.yaml accepts as its documented maximum - a permanent 4000 W peak-to-peak limit cycle, commands alternating 1000/2000/1000/0 W, with NOT ONE GUARD FIRING. The sign watchdog is evaluated on every cycle and never trips, because the disagreement flips on alternate ticks and never holds its 180 s window. WHAT WAS BUILT. `app/allocator.py`, host-side and strictly above the driver seam. It consumes intervals and a number and nothing else - no claims, no priorities, and no measurement, because an allocator that read P1 would be a SECOND integrator on the site measurement. * ENVELOPE CLAMP, from ARB-03 stage 1's `UnitBounds`, read PER TICK. `plan()` is a pure function and the module holds no state, so there is nowhere for a construction-time envelope to be cached. * WATER-FILL by weight, with the surplus of a full unit moving to the others. Weights express PREFERENCE, envelopes express PERMISSION: a zero weight is honoured while another unit has headroom and overridden when it does not, because the SUM is the safety property and stranding capacity behind a comfort choice manufactures a standing error at the meter. * LARGEST-REMAINDER ROUNDING. The target is rounded ONCE, at the top; every sum below that line is integer arithmetic, so it cannot drift. Measured: a per-unit round() drifts -125 W over 50 000 ticks at three inverters. * THE ALLOCATION RECORD, with `unmet_w`, `dropped` and a per-unit reason. `ok` is one boolean for SAFETY-28 to gate on, and `unmet_w` is deliberately NOT fused into it - a saturated inverter must not park the whole site. THE STABILITY PROPERTY IS STRUCTURAL. With sum(a_i) = 1 the gain at the meter is sum(a_i * g_i), a convex combination of the per-unit gains, so it lies in [min g_i, max g_i] FOR ANY SPLIT. That is what makes the weights a comfort choice rather than a tuning parameter, and it is why a bad split cannot destabilise the site. Graded directly, and measured end to end: 90/10, 50/50 and 100/0 give a bit-identical aggregate trace at the meter, and a gain sweep to 1.0 at every split has a flat tail at all 84 combinations. THE TWO REFUSALS main.py NOW MAKES, AND WHY THERE ARE TWO. `allocated=False` no longer means "no allocator"; it means no safe split EXISTS - a mis-routed claim, an empty envelope set, or a split that could only be made by commanding one pack to charge while another discharges. Separately, and this guard is the price of making allocate() succeed rather than something inherited, main.py refuses to act on a valid split it cannot DELIVER: there is one `setpoint_entity`, so writing the site target to the one inverter it can reach would over-command that inverter by exactly the other's share. Commanding a partial site is a worse instruction than commanding nothing. DEV-02 gives it the second writer. scope_violations() IS NOW CONSUMED, AND AS A REFUSAL. ARB-03 left it logging without changing the resolution. A mis-routed claim means the number about to be divided may itself be wrong, and dividing a number that may be wrong is worse than not dividing it - the same answer clause 3 already gives a contradiction. It is NOT promoted into an envelope: a unit-scoped claim that landed on the site names no unit, so promoting it would mean guessing one, or applying one inverter's rating to a sibling that does not have it. AT N<=1 IT IS A PASS-THROUGH, BYTE-IDENTICAL: the share is the site target, as a float, unrounded and unclamped. All 17 existing suites replay unedited. test_peakguard.py part 10h and test_arbiter.py part 7 were RE-AIMED, not deleted. PR #40's reviewer proved that refusal branch was unreachable and untested once; removing its trigger without giving it a new one would have rebuilt the hole. Part 10h now drives three real cycles - a deliverable split, a dead sibling, and every master stale - and grades all three. KNOWN AND NOT CLOSED HERE: at a roster of two the loop's `actual_w` is one inverter's power used as a site measurement, because the add-on binds a single `inverter_power` sensor. That is the SENSING half of the same N=1 identity this card removes from the COMMANDING half, and it makes the aggregate trace split-dependent below gain 1.0. Measured with its counterfactual in test_alloc.py part 8 and tools/alloc_sim.py --splits. It belongs to DEV-02. Verified: all 18 suites green in the CI image. 16 mutations run through tools/mutation_run.sh on a purged tree; 13 red, and the 3 survivors are recorded in test_alloc.py part 12 with the reason each cannot be caught. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 10:42:33 +02:00