6 Commits

Include renames

Author	SHA1	Message	Date
Claude	591c35ed01	SAFETY-28: gate the write path on the allocation record, not on key count ... specs §1.5 makes "any configuration in which two writers can reach one actuator" a non-goal. That non-goal was enforced by counting config keys: validate.py's ACTUATOR_WRITE_KEYS = ("setpoint_entity",), consumed at rule 1, with a comment stating the guarantee outright - "there is exactly one such key, so a second writer is not expressible in the options schema at all". That was true and it graded THE SHAPE OF THE OPTIONS SCHEMA, not the writes. Add CFG-04's per-inverter config - a roster of inverters each with its own setpoint_entity - and there are two real writers with len() of that tuple still equal to 1. The check stays green while the property it protects is gone. sim/inject.py's two_writers scenario asserted on the same tuple, so it went green too. That is this repository's named failure mode: a check that observes something other than what it claims to observe. Demonstrated rather than argued. test_validate.py part 2 now constructs the hazardous per-inverter config, asserts that the OLD proxy is still green on it, and then asserts the new check refuses it. Against release/1.0's validator the updated sim scenario reports: "validate_startup_config() ACCEPTED a configuration in which 3 declarations reach the ONE actuator number.goodwe_setpoint ... the old proxy reports 1 write key(s) on this same config and is therefore GREEN on it". THE WRITE PATH IS NOW GATED ON THE RECORD ========================================= Controller.write_refusal() asks Allocation.authorises() whether the single allocator placed exactly this number, for this unit, on this tick. write_setpoint() refuses anything else. A second writer with arithmetic of its own cannot satisfy that - its number appears in no record - so it has to file a Claim and go through resolve(), which is the one allocator. "Exactly one allocator per shared resource" stops being a convention somebody can forget and becomes something the write path checks. The refusal is a SUBSTITUTION, not a return: 0 W goes on the wire in place of the number nothing stands behind. Returning would leave the inverter latched on its last command with the ESP32 heartbeat still being fed - holding an unauthorised setpoint quietly, which is the outcome the gate exists to stop. AC 1 is "refused at the write path, not merely logged", and test_clamp.py part 7a grades the device's writes, not the log. The gate sits BELOW the non-finite coercion and ABOVE the clamp. Below, because a nan is loss of input and rule 1 has already turned it into 0 W. Above, because the question is who chose this number, and the answer is only meaningful about the number that was asked for - gating the CLAMPED value would refuse exactly the cycles SAFETY-03 exists for, since a clamped write differs from the allocator's share by construction. Mutation M7 moves the gate below the clamp and turns nine checks red, part 6c among them. A STALE RECORD CANNOT BE REPLAYED ================================= Every Allocation now carries the `tick` it was made for. It is handed IN by the caller - plan(..., tick=) - rather than counted inside the allocator, because test_alloc.py part 10 grades that the module holds no state at all, and a serial number incremented in there would be the cached-across-ticks thing the envelope rule forbids wearing a different hat. Controller.alloc_tick advances ONCE PER RESOLUTION, not once per loop iteration, and both halves are load-bearing: * a new allocation makes the previous record stale immediately, so a record whose envelopes have moved cannot authorise a write. That is the replay half (AC 2), graded by capturing a real record, running another real cycle, putting the old one back and observing refusal. * the "inputs missing, not yet stale" hold returns BEFORE the allocator runs, exactly so one dropped meter reading does not zero the inverter, and the heartbeat re-affirms self.target through this same gate while it does. A tick incremented per loop iteration would refuse that heartbeat and turn the hold into the outage it exists to prevent. Graded. An UNSTAMPED record (tick None) authorises nothing: "I cannot say when I was made" fails closed rather than reading as tick zero. THE FAILSAFE CANNOT DEADLOCK BEHIND THE GATE, AND HERE IS WHY ============================================================= write_setpoint() is also how layer 2 commands 0 W. cycle()'s two refusal branches substitute a 0 W failsafe and write it like any other cycle; shutdown() and the operator's stop button do the same. EVERY ONE OF THOSE RUNS WHILE THE ALLOCATOR HAS REFUSED - ok is False and there are no shares - so a gate that asked the allocator's permission to command zero would block the safety write behind the very component whose failure the safety write answers. A gate that can do that is worse than the hole it closes. Resolved by authorising 0 W unconditionally, and on the VALUE rather than on a failsafe=True flag: a flag is an assertion by the caller, which is exactly what a second writer would pass; the value is a fact about what will be written. The argument that this is safe and not merely convenient is that the hazard §1.5 names is N-times loop gain from BROADCAST - handing every inverter the same target so each supplies it in full (allocator.py's opening argument; TEST-19 measured a permanent 4000 W p2p limit cycle at gain 1.0 with no guard firing). At S = 0 the broadcast and the correct allocation COINCIDE: a_i = 1 for every unit gives every unit 0 W, which is exactly its share. There is no over-command to make at zero. Said at the line, in write_refusal(). test_clamp.py part 7c drives it end to end through the real cycle() and the real REFUSE_EMPTY branch: the allocator refuses every tick, the device still sees 0 W, and the action log says ARBITER: REFUSED rather than WRITE REFUSED so the two failures stay distinguishable to whoever has to debug them. unmet_w IS STILL NOT ok ======================= The gate reads ok and the unit's share and never unmet_w. allocator.py:179 says why: an allocation that could not place every watt is still safe to write, and fusing them would let one saturated inverter park the whole site. Graded on a record with 3800 W unmet and every share legal - mutation M5 adds `or self.unmet_w` to the gate and that check goes red. THE CONFIG CHECK, REPLACED RATHER THAN DELETED ============================================== actuator_writers() counts WRITERS PER ACTUATOR instead of option keys. It walks the options TREE rather than looking for a container called `inverters`, because CFG-04 has not chosen that name yet and a census that guessed wrong would go green while two writers existed - the same defect one step along. Entity ids are folded to lower case so a second writer cannot be smuggled in as Number.X versus number.x. Two inverters with two entities are ACCEPTED - that is what the per-inverter roster is for, and a validator that refuses the feature it guards is one somebody switches off. Two declarations aimed at ONE entity are refused, naming the actuator and every writer pointed at it. That includes the case an author will meet first - keeping setpoint_entity as A's and listing A again - because "they happen to be the same entity, so it is fine" is precisely the reasoning that makes two writers invisible. ACTUATOR_WRITE_KEYS survives ONLY as the enumeration a census needs, with its guarantee comment deleted; nothing asserts on its length any more. Keeping the name is also what stops admin/goodwe's current two_writers scenario failing on an AttributeError between the two merges. WHAT NEITHER CHECK OBSERVES, SAID OUT LOUD ========================================== The census sees CONFIGURED writers. A second write path added in CODE - a hass.set_number() call next to some new strategy - declares nothing and is invisible to it, exactly as it was invisible to the tuple. That half is not closed at startup and cannot be; it is closed at runtime by the record gate, which does not care what the options look like or who called the method. The two checks are deliberately different kinds, and only the runtime one survives a schema this file has not seen yet. EVIDENCE ======== * Full 18-file suite green on a purged tree (tools/mutation_run.sh). * Verified by breaking it - seven mutations, each on a purged tree, each reverted and re-verified: M1 remove the gate -> test_clamp red (4 checks) M2 make the zero exit an amnesty -> test_clamp red (12 checks) M3 drop the tick comparison -> test_clamp red (5 checks) M4 delete the census refusal -> test_validate red (3 checks) M5 fuse unmet_w into ok -> test_clamp red (1 check) M6 freeze the tick on the live path -> test_clamp red (2 checks) M7 move the gate below the clamp -> test_clamp red (9 checks) * AC 5: no existing check was weakened. The two edits to test_clamp.py are fixtures, not assertions - parts 5 and 6c call write_setpoint() directly with a number nothing allocated, which is now refused, so they say where their number came from. Every assertion in both parts is unchanged, and part 7f asserts that across part 3's sixty real cycles the gate refused zero writes. * admin/goodwe's TEST-19 norig scenarios (planner_binding, two_master_plant, two_master_broadcast) still pass against this tree - they import the add-on's control law across the repo boundary. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 13:56:48 +02:00
glenn schrooyenandClaude Opus 5	186e13ceca	ALLOC-01: allocate the site grid target, sum-invariant, never broadcast ... ARB-03 left `allocate()` as a documented seam that passed through at N<=1 and DECLINED at N>=2, with the reasoning recorded at the line: the obvious placeholder - hand the site target to each inverter - IS the ARCH-01 fault, and "a placeholder that cannot be told apart from the real thing by any guard we have is worse than no placeholder". This fills the seam. WHY A BROADCAST IS A FAULT AND NOT AN INEFFICIENCY. The control primitive is meter emulation: the master reports a FABRICATED grid reading and the inverter regulates itself to it, so one number means "the battery moves X W" to this add-on and "the grid is at X W" to the inverter - an identity that holds only at N=1. Hand two inverters the same target and each supplies it IN FULL, so the loop gain at the meter becomes N times the per-unit gain. Reproduced on admin/goodwe's two-master rig against this tree: -400 W export overshoot at gain 0.6, and at gain 1.0 - which config.yaml accepts as its documented maximum - a permanent 4000 W peak-to-peak limit cycle, commands alternating 1000/2000/1000/0 W, with NOT ONE GUARD FIRING. The sign watchdog is evaluated on every cycle and never trips, because the disagreement flips on alternate ticks and never holds its 180 s window. WHAT WAS BUILT. `app/allocator.py`, host-side and strictly above the driver seam. It consumes intervals and a number and nothing else - no claims, no priorities, and no measurement, because an allocator that read P1 would be a SECOND integrator on the site measurement. * ENVELOPE CLAMP, from ARB-03 stage 1's `UnitBounds`, read PER TICK. `plan()` is a pure function and the module holds no state, so there is nowhere for a construction-time envelope to be cached. * WATER-FILL by weight, with the surplus of a full unit moving to the others. Weights express PREFERENCE, envelopes express PERMISSION: a zero weight is honoured while another unit has headroom and overridden when it does not, because the SUM is the safety property and stranding capacity behind a comfort choice manufactures a standing error at the meter. * LARGEST-REMAINDER ROUNDING. The target is rounded ONCE, at the top; every sum below that line is integer arithmetic, so it cannot drift. Measured: a per-unit round() drifts -125 W over 50 000 ticks at three inverters. * THE ALLOCATION RECORD, with `unmet_w`, `dropped` and a per-unit reason. `ok` is one boolean for SAFETY-28 to gate on, and `unmet_w` is deliberately NOT fused into it - a saturated inverter must not park the whole site. THE STABILITY PROPERTY IS STRUCTURAL. With sum(a_i) = 1 the gain at the meter is sum(a_i * g_i), a convex combination of the per-unit gains, so it lies in [min g_i, max g_i] FOR ANY SPLIT. That is what makes the weights a comfort choice rather than a tuning parameter, and it is why a bad split cannot destabilise the site. Graded directly, and measured end to end: 90/10, 50/50 and 100/0 give a bit-identical aggregate trace at the meter, and a gain sweep to 1.0 at every split has a flat tail at all 84 combinations. THE TWO REFUSALS main.py NOW MAKES, AND WHY THERE ARE TWO. `allocated=False` no longer means "no allocator"; it means no safe split EXISTS - a mis-routed claim, an empty envelope set, or a split that could only be made by commanding one pack to charge while another discharges. Separately, and this guard is the price of making allocate() succeed rather than something inherited, main.py refuses to act on a valid split it cannot DELIVER: there is one `setpoint_entity`, so writing the site target to the one inverter it can reach would over-command that inverter by exactly the other's share. Commanding a partial site is a worse instruction than commanding nothing. DEV-02 gives it the second writer. scope_violations() IS NOW CONSUMED, AND AS A REFUSAL. ARB-03 left it logging without changing the resolution. A mis-routed claim means the number about to be divided may itself be wrong, and dividing a number that may be wrong is worse than not dividing it - the same answer clause 3 already gives a contradiction. It is NOT promoted into an envelope: a unit-scoped claim that landed on the site names no unit, so promoting it would mean guessing one, or applying one inverter's rating to a sibling that does not have it. AT N<=1 IT IS A PASS-THROUGH, BYTE-IDENTICAL: the share is the site target, as a float, unrounded and unclamped. All 17 existing suites replay unedited. test_peakguard.py part 10h and test_arbiter.py part 7 were RE-AIMED, not deleted. PR #40's reviewer proved that refusal branch was unreachable and untested once; removing its trigger without giving it a new one would have rebuilt the hole. Part 10h now drives three real cycles - a deliverable split, a dead sibling, and every master stale - and grades all three. KNOWN AND NOT CLOSED HERE: at a roster of two the loop's `actual_w` is one inverter's power used as a site measurement, because the add-on binds a single `inverter_power` sensor. That is the SENSING half of the same N=1 identity this card removes from the COMMANDING half, and it makes the aggregate trace split-dependent below gain 1.0. Measured with its counterfactual in test_alloc.py part 8 and tools/alloc_sim.py --splits. It belongs to DEV-02. Verified: all 18 suites green in the CI image. 16 mutations run through tools/mutation_run.sh on a purged tree; 13 red, and the 3 survivors are recorded in test_alloc.py part 12 with the reason each cannot be caught. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 10:42:33 +02:00
glenn schrooyenandClaude Opus 5	38f6680639	ARB-03: pin all eight actuator call sites statically ... The independent review of PR #40 found AC 6 met at three of the eight claim construction sites while the check claimed to cover the class - this repository's named failure mode, a check observing something other than what it claimed, reproduced inside the check written to prevent it. WHAT WAS WRONG. Part 10g's only call-site check was a real two-inverter cycle. That cycle is auto, P1-healthy, no maintenance procedure, no tripped sign watchdog, the guard idle and arbitrage off, so it reaches `device`, `supervised` and `loop` and nothing else - three of the eight direct appends in `Controller.cycle()`. Its own check text nevertheless read "the line a mis-typed `actuator_of(...)` at a call site goes red on", and the PR body's mutation table presented it as covering the class. The reviewer proved the gap on the shipped tree: `actuator_of("maintenance")` -> `actuator_of("peak")` at the maintenance-shaping append left test_arbiter.py, test_peakguard.py and test_arbitrage.py ALL GREEN, while at a roster of two it built a site loop of -1500 W against the guard's site `lo` of 1500 W and the now-misrouted charge-only `hi = 0` - `lo > hi`, arbiter clause 3, 0 W IN THE BILLED QUARTER, SAFETY-25 §0a's fatal case from a one-word typo. The same mutation at the `failsafe` append survived too. The runtime detector does fire - `scope_violations()` names it - but it only logs; nothing graded it. THE FIX, over machinery already present. Part 10f's AST scan already reads each `claims.append(...)` in `Controller.cycle()`. All eight direct appends expose their actuator statically as `actuator=self.actuator_of('<literal>')`, so 10g now requires that literal to EQUAL the source the claim is filed under, read as SOURCE TEXT rather than evaluated - `actuator_of("peak")` at the maintenance append is the same VALUE at the shipped roster of one and a different string here. That pins all eight routing sites, on the line the typo is written, in every configuration and at every roster, exactly the way 10f pins the source set. Two further lines keep the scan from going vacuous: every direct append must be readable in that shape (a computed or hand-written actuator fails there), and the ten appends must still account for 10f's eight sources. The two INDIRECT appends carry no `actuator=` at the call site to mis-type. `peak_claim` and `arb_claim` are routed where their claim is built, and are pinned there - `peakguard.claim()` by the SWEEP_SITE sweep over every load x elapsed x battery x SoC x floor combination, `arbitrage.claim()` by test_arbitrage.py. 10g now says so at the line, and says which three of the eight its dynamic cycle actually sees, rather than rounding up. MEASURED, NOT ARGUED. Each of the eight direct appends mutated in turn to a wrong actuator - device->loop, supervised->peak, failsafe->safety, safety(stopped)->device, safety(inputs missing)->maintenance, maintenance(SET)->loop, maintenance(shaping)->peak, loop->supervised - each on a purged tree via tools/mutation_run.sh over all 17 files. All eight RED, every one of them on the new line. TWO SURVIVING MUTATIONS OF THE SAME CLASS, ALSO CLOSED. * `resolve()` did not have to honour the roster it was given: `if units is None:` -> `if True:` left the whole suite green. Ignoring the argument makes a unit that filed nothing this cycle cease to exist - a site of two reads as a site of one and stage 3 passes the whole grid target through to the inverter that spoke, which is ARCH-01's fault with its own evidence removed. test_arbiter.py part 7 now grades it on the one case that separates the two, a SILENT unit. Mutation RED in test_arbiter.py and test_peakguard.py. * main.py's N>=2 refusal was unreachable and ungraded: `if not resolution.allocated:` -> `if False:` left the whole suite green, so the right instinct was one refactor away from being deleted as dead code. The guard is KEPT - the alternative default is the ARCH-01 fault - and new part 10h grades it on the two-inverter cycle that already existed: the 0 W, the `failsafe` winner, the log line naming the roster size, and the write that follows. Mutation RED. AND THE WORDING CORRECTED. main.py does not "refuse to write" on `allocated=False`. It SUBSTITUTES a 0 W failsafe and then calls `write_setpoint(0.0)` like any other cycle. 0 W is the correct fail-toward-inaction direction and the log text is accurate about what it refuses - to BROADCAST the site target - but "refuses to write" overstates the code. Said as what it does, in the CHANGELOG, at the branch in main.py, and in 10h's own check text. `resolve()`'s docstring now says the roster argument has to be HONOURED, which is not the same as existing. 17/17 green on a purged tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 03:46:40 +02:00
adminandClaude Opus 5	06f95e0a64	ARB-03: restore Claim.actuator and make resolve() three-stage ... specs.md:467 declares `actuator: str` as the FIRST field of `Claim`. app/arbiter.py:55 had no such field. The specification designed per-actuator claims and the implementation dropped it, so every claim was implicitly about "the one and only actuator", resolve() returned one scalar Resolution.target_w, and main.py assigned it to one self.target. THERE WAS NO SEAM AN ALLOCATOR COULD OCCUPY - and ARCH-01 (specs.md §6.2, 2026-09-02) decided the site grid target is ALLOCATED across several inverters and never broadcast. This is a regression fix against the written design; creating that seam is the whole of the change. WHY IT MATTERS, IN THE UNITS THE SYSTEM IS BILLED IN. The control primitive is meter emulation: the master reports a fabricated grid reading and the inverter regulates itself to it, so one number means "the battery moves X W" to the add-on and "the grid is at X W" to the inverter - an identity that holds only at N=1. Broadcast one target to two inverters and each supplies it in full; the loop gain at the meter becomes N times the per-unit gain, which at the gain config.yaml:374 accepts is a permanent limit cycle with every watchdog in §11.2 reporting healthy. And a per-inverter reserve filed as a site `hi` against the peak guard's site `lo` is `lo > hi`, arbiter clause 3, 0 W IN THE BILLED QUARTER - the parked battery SAFETY-25's memo calls fatal. THE SPLIT, VERIFIED AT EACH CONSTRUCTION SITE RATHER THAN ACCEPTED FROM THE SURVEY. Four sources are about the GRID CONNECTION and are SITE claims: `loop` (compute() regulates grid_w, the P1 measurement, and §6.2's whole architecture is one integrator on P1 whose output is then split), `peak` (the 15-minute average offtake AT the grid connection, which is what the capacity tariff bills - one quarter-hour peak per site, not one per pack), `arbitrage` (buys and sells at the grid against a day-ahead price; the price is a property of the connection and the energy crosses the meter) and `safety` (both construction sites read: "stopped" is the operator switching control off for the site, "inputs missing" is the site's own meter gone - neither is about a pack, and both must stop every inverter). Four are about a pack, a device or one write and are PER-INVERTER: `device` (one inverter's own reported min/max - there is no site rating), `supervised` (max_w caps what may be WRITTEN to one setpoint entity, §11.3, so it is scoped like `device` for the same reason), `maintenance` (§12's recalibration is a pack procedure - drain THIS pack, charge THIS pack, recalibrate THIS pack's counter) and `failsafe`. `failsafe` is the entry that needed the reading rather than the survey: SAFETY-02's EVIDENCE is site-wide (it compares P1 against the standing command) but its CONCLUSION is "the unit I am driving is pushing power the wrong way" and its remedy is to park that unit. At N>=2 the same evidence cannot be attributed to a sibling this controller never commanded, so a site-wide stop would park an inverter this watchdog never graded. The reasoning for all eight is recorded AT THE LINE, in arbiter.CLAIM_SCOPE and again at each claims.append in main.py. WHAT WAS BUILT. resolve() is three stages, each a separate function so a test can construct a case at any one of them: pre_resolve() - one inverter's own claims -> that unit's interval. Clauses 1 and 2 transposed: the unit's own winning SET gates its own limits. The SET's value travels BESIDE the interval, not inside it - folding a -2500 W drain into [-2500, -2500] would turn "clamped to max_w" into "contradicts max_w", a different and wrong answer. site_resolve() - THE SHIPPED ARBITER, UNCHANGED. Same code, new name. allocate() - THE SEAM, AND DELIBERATELY NOT AN ALLOCATOR. ALLOC-01 builds it. At N<=1 it passes the target through (§6.2's identity). At N>=2 it DECLINES - no shares, allocated=False - and main.py refuses to write rather than broadcast, because the obvious placeholder (hand the target to each) is the fault ARCH-01 was filed about and no guard we have can tell it apart from the real thing. THE CONTRADICTION IS NOT GUARDED AGAINST, IT CANNOT BE WRITTEN DOWN. The partition is by `actuator` and it is a partition: a unit's `hi` and the site's `lo` are never both terms of one `lo > hi` test. Constructed and swept - 40 filings (every per-inverter source x unit x bound, including a unit contradicting ITSELF at lo 900 > hi 100) against a live site floor, and not one moves the site target or raises a contradiction. A unit's own impossible pair parks that unit and says so on its own bounds; it does not park the site. That is SAFETY-25 §0c's table made mechanical. AT N=1 THIS IS A PURE REFACTOR, AND THAT IS PROVEN RATHER THAN ASSERTED. With one inverter the fabricated grid reading and the battery setpoint are the same number, so the grid connection and the only unit ARE one actuator: actuator_for() routes every source to the site, no claim is filed on a unit, stage 2 sees the whole list and answers what the shipped arbiter answered. All 17 suites replay UNEDITED above the ARB-03 sections and are green on the same numbers; test_arbiter.py additionally runs 13 claim lists through both resolve() and site_resolve() and compares target, winner, binder, contradiction flag, the considered list and the operator line. EVIDENCE, BY BREAKING EACH THING (tools/mutation_run.sh, purged tree): * Claim's dataclass default emptied -> RED (test_arbiter) ...and it survived until the check was added: the two helpers pass their own default down, so the FIELD's default never ran. Now checked directly. * `peak` reclassified SCOPE_UNIT -> RED (arbiter x4, peakguard x2) * `maintenance` reclassified SCOPE_SITE -> RED (arbiter x4, peakguard) * the N=1 identity dropped in actuator_for() -> RED (arbiter, peakguard incl. the maintenance/peak suppression checks, freeze) - which is the measurement that says splitting at N=1 would be a behaviour change * resolve() stops partitioning -> RED (arbiter x4) * allocate() broadcasts at N>=2 -> RED (arbiter x2) * stage 1 drops clause-2 gating -> RED (arbiter) * a call site routes `device` through `loop` -> RED (peakguard 10g) * SAFETY-25 Option B built as a ninth source -> RED (peakguard 10f, both halves, plus 10g) - the tripwire still bites SAFETY-24's asymmetry proof is re-run and holds: 0 negative floors over the shipped sweep, `hi` still +inf on every claim the guard files, and it now also asserts every one of them is on the SITE actuator - a floor bound to one inverter's share would leave the site, the thing the capacity tariff meters, with no floor at all. test_peakguard.py part 10f is kept, not adapted around. `source` is still Claim.set()'s first positional argument precisely so its AST scan keeps reading it, which is why `actuator` is the LAST field of Claim and not the first - moving `source` off position 0 would silently blind the tripwire that guards SAFETY-25's deferred option. The one adaptation is `**kw` on its spy, so main.py's roster passes through unread rather than being silently dropped. New part 10g pins CLAIM_SCOPE to the same eight-source set and grades a REAL two-inverter cycle, which is the only place a mis-typed actuator_of(...) at a call site is observable - at N=1 every source legitimately routes to the site, so a swap there is invisible by construction. No config key, no option, no operator surface, no default moved. Inverter B does not exist yet and nothing here measures it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-02 01:54:29 +02:00
glenn schrooyenandClaude Opus 5	bdd7f18a54	OPT-04: charge cheap, discharge expensive - and only when it pays ... Four cards built the price stack and nothing traded on it. app/arbitrage.py is §10.1's priority 3, and it consumes all four rather than re-deciding anything: whether a trade is permitted at all, on which two hours, against which widened threshold is TariffPlan.arbitrage()'s answer, and that answer cannot be obtained without first saying whether the peak guard is holding. §9.1's "peak shaving outranks arbitrage" is therefore honoured structurally - there is no path to a spread that skips the question - and again in the arbiter, where P_PEAK (50) clamps a claim filed at P_ARBITRAGE (30). A guard that never ran is not a guard that is clear. On meter_source off the peak guard is never evaluated; that third state is carried as None and refuses, because charging at the rail creates the billed quantity while nothing measures the quarter. validate.py refuses that configuration too, along with arbitrage armed with no price source and a SoC floor at or above the ceiling. §17: never export into a negative price. The guard is on the hour being sold into, not on the spread - a day priced -0.30 .. -0.05 clears any threshold and its dearest hour is still negative. Buying in a negative hour stays allowed. resolve_tariff() may open an HTTPS connection and the tick feeds the ESP32 heartbeat, so the fetch runs in its own task at a 30 min cadence and the tick reads an attribute and an age bound. test_arbitrage.py section 8 asserts that structurally on the shipped AST: a fetch put back on cycle() is red. AC4 is NOT met and is not restated - this repository holds no price history. Section 7 replays a synthetic year and asserts the property that does not need real prices: every executed round trip cleared its own widened requirement, and zero discharges landed in the 522 negative-priced hours. At the shipped 0.10 EUR/kWh threshold a realistic Belgian day/night site does not trade at all. Reported, not tuned: that number and FCST-03's widening factors are one product decision and it is the owner's. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015VXjA3LWccN1rJsk3okyPC	2026-08-31 01:36:09 +02:00
adminandClaude Opus 5	017b798fe6	Precedence arbiter: one rule instead of an if/else ladder ... Two controllers writing one actuator is the failure this system exists to avoid. "Exactly one writer" was true, but only as a convention held up by careful reading - which does not survive an EV charger and a heat pump wanting the same battery. Strategies now return claims and arbiter.py resolves them: highest-priority `set` wins (none at all means 0 W), then every `limit` whose priority is >= that set's applies, most restrictive first; contradictory limits command 0 W and are flagged as the bug they are. The second clause is the whole point. "Money outranks maintenance" used to be a hand-written exception inside a Jinja template; it is now a consequence of the priorities - the charge-only limit binds the loop but cannot bind a higher-priority peak claim. Also: maintenance shaping moved out of control.py, which is a controller again and not a policy engine; the loop now tracks the arbiter's actual output rather than its own last wish, so it does not jump when it regains control; and every decision explains itself ("loop -> 0 W, limited by maintenance(charge-only)") in the UI and the log. 19 new assertions in test_arbiter.py, each one a precedence question someone will eventually ask in the field. Deployed to the reference site as 0.2.0 and holding grid within a few watts of zero. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016NckgXecasQb2eSsPYNSW6	2026-08-23 02:45:32 +02:00