SAFETY-38 round 2: assert the ordered pair, and correct the M3 attribution

Two blockers, one of them mine to fix and one a mis-measurement to undo. No
`app/` change in either: the shipped `sum` is correct.

1. A ZERO-BYTE SURVIVOR AT THE CALL SITE ONE LINE BELOW THE PINNED VALUE.
   Round 1 pinned `site_standing` and never pinned WHERE IT GOES. Swapping the
   detector's first two arguments at main.py:1620 -
   `evaluate(site_standing, self.grid, ...)` -> `evaluate(self.grid, site_standing, ...)`
   - is a ZERO-BYTE edit and left the round-1 tree fully green. The cost is the
   banner: the site stands at -500 W of charge into a +2500 W import and the
   LATCHING, SITE-STOPPING alarm reads "commanded +2500 W against a meter
   reading -500 W" - which instrument read what, inverted, on the one line
   somebody woken by it reads first (watchdog.py:658-665).

   Round 1's check could not reach it. It asserted `"-500 W"` appears SOMEWHERE
   in the sentence; under the swap it still does, IN THE METER SLOT. A substring
   test grades PRESENCE, never ARRANGEMENT. It now asserts the ORDERED PAIR:
   `f"commanded {sum:+.0f} W against a meter reading {grid:+.0f} W"`. Measured:
   red in test_watchdog.py on that one named check, green in the other twenty.

2. THE M3 ATTRIBUTION WAS FALSE, AND HOW IT BECAME FALSE IS THE USEFUL PART.
   Round 1 recorded `list(standing.values())[0]` as closed by SAFETY-32's
   package-wide pin and told future authors NOT TO RE-COVER IT. Re-measured on
   release/1.0 @ 86eaef2 carrying only that edit: the full 21-file suite is
   GREEN and test_peakguard.py is PASS PASS PASS PASS PASS in isolation. THE
   MUTATION SURVIVES. It was originally measured once, that run hit CI-06's
   ~20% flake, and the red was recorded as a kill.

   The mechanism, read off 12j's own enumeration rather than argued: 12j taints
   names BOUND to roster values and lists ACCUMULATED in a loop. `standing` is a
   dict filled by SUBSCRIPT assignment (main.py:1554/1558), so it never enters
   the taint set and 1599 is not a roster site. On the mutated tree 12j lists
   main.py:1553, 1555 and 1690 - not 1599. Part 9a and 9b close it.

   Corrected in all four places it was committed: DECISIONS section 1 and
   section 4, CHANGELOG, and the part 9 header that carried the instruction.

MEASUREMENT, all on 86eaef2, fresh copy per mutation, mounted :ro, bytecode
purged by tools/mutation_run.sh, edit re-read from disk, byte delta printed:
  * M1-M10 re-run INDEPENDENTLY rather than carried forward - all 10 red, at
    the deltas the table records (M1/M2/M4 re-run in the exact wrapped form).
  * M11, the argument swap: 0 bytes, red on one check in one file.
  * W1 `"sign_site": SCOPE_SITE -> SCOPE_UNIT`: 0 bytes, red; part 9a is one of
    the two killers.
  * W2 `"circulation": SCOPE_SITE -> SCOPE_UNIT`: 0 bytes, red - but ENTIRELY
    on pre-existing checks. This card adds nothing to circulation and does not
    claim it.
Control: 21/21 green before and after. The suite is 21 files, not 20 - TEL-07
added test_mqtt.py in the rebase onto 86eaef2.

DECISIONS section 6a enumerates what was NOT closed: SAFETY-31's circ_wd
detector itself, the other eight CLAIM_SCOPE entries, actuator_of()'s body, the
n_units > 1 guard, and the fact that the "green in the other twenty files" half
of the ledger was re-verified on 86eaef2 only for M3 and M11.

MUTATION.md gains habit 14 - assert the ordered pair, not the substring - and
records this as the tenth instance of the family, found INSIDE THE FIX WRITTEN
TO CLOSE THE NINTH, for the second time in that list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -1,83 +1,100 @@
 # Changelog
 
-## 0.7.0
-
-⚠️ **SCHEMA CHANGE, AND IT IS WHY THIS IS A MINOR BUMP RATHER THAN A PATCH.**
-[[SAFETY-32]] adds `bms_soc_floor: int(0,50)` as a **required** per-entry key on
-the `inverters` roster - no trailing `?`. A config that declares a roster and
-omits it on any entry is REFUSED at startup. An install running `inverters: []`,
-which is every single-inverter install including the reference one, is
-unaffected: the flat `bms_soc_floor` still describes the one pack.
-
-CFG-04 recorded the rule this follows - the Supervisor keys the built image by
-`version:`, so a schema change without a bump is a schema nobody reads.
-
-Contents, in merge order since 0.6.0 (`2d025ee`):
-
-| | |
-|---|---|
-| `3934ad7` | MAINT-05 - one recalibration per pack, migration graded against the roster |
-| `67e649a` | SPIKE-04a - inverter B and pack B recorded, from datasheet and serial |
-| `3993f9f` | SAFETY-32 - per-pack `bms_soc_floor`, rule 8 per unit, package-wide roster pin |
-| `f72c48d` | UX-01 - add-on configuration in English and Dutch |
-| `86eaef2` | TEL-07 - a second MQTT device for inverter B; A's identity byte-identical |
-| `4482cd8` | SAFETY-41 - the clamp alarm stops narrating normal anti-windup |
-
-⚠️ **0.6.0 WAS NEVER SECTIONED.** Its content sits below this heading rather than
-under one of its own, because the bump shipped without cutting the section. That
-is a defect in this file, not in the release: the deployed 0.6.0 is `2d025ee` and
-the table above is what is new since it. Splitting it retroactively would mean
-guessing a boundary; saying so is more useful than a guess.
-
 ## Unreleased
 
-**`test_peakguard.py` answered two of its own checks with the wall clock
-(CI-06).** The file sits on the required `checks / unit (pull_request)` context
-and had a measured ~20 % flake rate. It cost a wrong merge diagnosis (parents
-green, merge red — read as a semantic merge conflict, it was the flake), a false
-red on two reviewers' CONTROL runs, and a false "mutation caught" that reached a
-merged card in four places. **A flaky check does not waste a re-run; it
-manufactures evidence for whichever hypothesis the reader already holds.**
+**`site_standing` — the one quantity BOTH site guards are asked about — is now
+pinned by a fixture whose per-unit shares cannot answer for it (SAFETY-38).**
+`app/main.py`'s `site_standing = float(sum(standing.values()))` is the first
+argument of [[SAFETY-30]]'s **latching, site-stopping** sign detector *and* the
+`commanded_w` handed to [[SAFETY-18]]'s `looks_frozen()`. It was pinned by
+**nothing**, and three mutations of it disarmed both guards with the whole suite
+green. **This card changes coverage only: not one byte of `app/` moves — the
+shipped `sum` is correct and must not be "fixed".**
 
-Both causes are the control law's own gain `900 / remaining` applied to a
-wall-clock gap the file never intended to have. Neither fix widens anything.
-
-* **The cross-time projection.** The "one cycle of the intent form is exactly
-  the delivered form plus the command standing on the wire" check decided the
-  intent form from a **second** `PeakTracker.project(..., datetime.now())` taken
-  after the real cycle had returned, and compared it against a floor decided
-  from the **first** projection — three lines under a comment saying both run
-  "against the same frozen projection". `excess = 900 × (projected − ceiling) /
-  remaining` moves at `excess / remaining` W/s, so at a 1500 W floor the 1.5 W
-  tolerance bought exactly **`remaining / 1000` seconds**: 333 ms with 880 s
-  left in the quarter, **6 ms with 10 s left**. The gap between the two
-  statements measured **12.7–39.5 ms** over 26 instrumented runs. The check was
-  decided by *where in the quarter it ran*. It now keeps the `Projection`
-  **object** the real cycle graded and decides both forms from it — the clock is
-  out of the comparison and the tolerance is **exact**, not widened. Measured on
-  a real cycle: re-deciding the delivered form from that object reproduces the
-  controller's own floor to **0.000000000000 W**.
-* **The fixture's own room.** `wired_over_limit()` laid telegrams with
-  `range(0, span + 1, 5)`, leaving **0–5 s of the open block uncovered by
-  construction**, and `excess` multiplies an uncovered second back up by
-  `900 / remaining`. Measured on the shipped file: at **12 s of remaining a
-  fixture that asked for a 1500 W floor delivered 613 W (−59 %)**, and at 2 s
-  the guard **did not engage at all** — which fails "the real cycle files the
-  peak claim", "…and the number written to the inverter is the guard's floor"
-  and "the STATUS PAGE row for a floor-limited guard" **together**. The
-  four-attempt retry could not help: four attempts take ~40 ms and all land in
-  the same dying quarter. Fixed with one telegram stamped at `now` (what a real
-  meter does, and what the docstring already claimed) plus `FIXTURE_ROOM_S`,
-  **derived** from the 1 % accuracy the helper promises rather than picked:
-  `net_w × lag / (remaining × want) ≤ 0.01 − lag/900` → **23.6 s → 24 s**, at
-  the measured 0.1 s worst-case lag.
-
-**Nothing was skipped, disabled or marked xfail** — the file still carries all
-of SAFETY-07 and SAFETY-25's forced-discharge SoC floor, and it gains a check:
-the delivered form re-decided from the cycle's own projection must reproduce the
-real controller's number to the bit, which pins the test's `decide()` kwargs as
-main.py's actual call rather than an approximation of it. **One tolerance got
-stricter** (1.5 W → exact), because removing the clock made exactness possible.
+* **⭐ THE FIXTURE THE SUITE COULD NOT BUILD: per-unit shares EACH BELOW the
+  site gate whose SUM clears it.** Two simulated units rated 220 W and 280 W,
+  both obeying exactly, inverted gain, house importing 2000 W — the site
+  commands **−500 W against a +2500 W meter** and no single share clears the
+  300 W gate. That is the case the site detector exists for, and it is the only
+  arrangement that can separate `sum` from the mean and from the largest share.
+  `test_watchdog.py` part 9a.
+* **WHY THE EXISTING FIXTURE COULD NOT.** `_sign_site`, the suite's only N≥2
+  site fixture, runs shares of about −2500 W **each** — every one individually
+  over the gate — so sum, mean and largest-share all agree on it. *Its values
+  happen to be equal, and a check comparing two things that happen to be equal
+  cannot see the difference it names.* `MUTATION.md` habit 4, ninth instance,
+  inside the site half of the very card that names it.
+* **FOUR CANDIDATE REDUCTIONS, FOUR DISTINCT ANSWERS, ONE OVER THE GATE** —
+  `sum` −500, mean −250, `max(key=abs)` −280, `[0]` −220 — and that is asserted
+  as a precondition, not described. The asymmetric ratings are load-bearing:
+  equal shares collapse three of the four onto one number, and the **smaller**
+  unit is first so `[0]` stays distinct from `max(key=abs)`. The **gate is the
+  shipped 300 W**; only the hold is shortened, because the hold is a wall clock.
+* **⭐ THE SECOND CONSUMER IS COVERED, NOT SCOPED OUT.** The same value is
+  `looks_frozen()`'s `commanded_w` at `main.py:1926`. At the same roster the
+  site rail is 0.95 × 500 = **475 W**, so `sum` = 500 W rails it while 250, 280
+  and 220 do not. Shipped: the peak guard goes blind on SAFETY-18's conjunction
+  and files `floor_w = 0.0`. Under both surviving mutations it is **not blind at
+  all and files no floor**, so the battery may keep importing through a quarter
+  whose billed average is unobservable. `test_watchdog.py` part 9b. The open
+  quarter is deliberately backfilled with the stuck reading so the mutant cannot
+  reach the same action by the *coverage* route and mask the difference.
+* **AT N=1 NOTHING CHANGES, AND IT IS ASSERTED.** On a real one-inverter
+  controller `standing` has one entry, so `sum`, the mean, `max(key=abs)` and
+  `[0]` are **the same number** — all three mutations are genuinely *equivalent*
+  on a shipped install and no N=1 fixture could ever separate them. Printed and
+  checked, beside the site detector still being absent there. Part 9c.
+* **⚠️ A CORRECTION, AND IT IS THE MOST USEFUL LINE IN THIS CARD.** An earlier
+  revision of this entry said one of the three — `list(standing.values())[0]` —
+  was **already closed** by [[SAFETY-32]]'s package-wide structural pin, and
+  told future authors not to re-cover it. **That was false.** It had been
+  measured **once**, that run hit `test_peakguard.py`'s [[CI-06]] flake (a
+  measured **~20%** false-red rate), and the red was recorded as a mutation
+  **kill**. Re-measured on `release/1.0` @ `86eaef2` carrying only that edit:
+  the **full 21-file suite is green** and `test_peakguard.py` passes **five for
+  five** in isolation — **the mutation survives.** The reason SAFETY-32 cannot
+  see it is not the shape: part 12j taints names *bound* to roster values and
+  lists *accumulated* in a loop, and `standing` is a dict filled by **subscript
+  assignment**, so it never enters the taint set and `sum(standing.values())` is
+  not a roster site at all. 12j's own enumeration on the mutated tree lists
+  `main.py:1553`, `1555`, `1690` — **not `1599`**. **All three mutations needed
+  this card; all three are now covered by it.** *A single red from
+  `test_peakguard.py` proves nothing — re-run it five times in isolation and
+  name the failing check.*
+* **⚠️ AND A ZERO-BYTE SURVIVOR ONE LINE BELOW THE ONE THIS CARD PINNED.**
+  Pinning the *value* `site_standing` said nothing about **where it goes**.
+  Swapping the detector's first two arguments —
+  `evaluate(site_standing, self.grid, …)` → `evaluate(self.grid, site_standing, …)`
+  — is **zero bytes** and left the tree fully green, because the check asserted
+  only that `"-500 W"` appeared **somewhere** in the banner. It still does:
+  **in the meter slot.** The swapped banner reads *"commanded +2500 W against a
+  meter reading −500 W"* — a site charging at −500 W into a +2500 W import, told
+  to the operator **exactly backwards**, on the one line somebody woken by a
+  latching site-stopping alarm reads first. The check now asserts the **ordered
+  pair** rather than a substring, and is red on it. **No `app/` change:** the
+  hole was in the test.
+* **⭐ A SURVIVOR THIS CARD WENT LOOKING FOR AND CLOSED.**
+  `site_standing = float(self.target)` — the arbiter's site *target* instead of
+  the sum of what actually **stands on the wire** — is **−11 bytes** and
+  survived the full suite, because in every fixture that existed the two are the
+  same number. They are not when a device's reported range is narrower than its
+  `max_w`: the `device` claim is filed **per actuator**, so it bounds each
+  unit's share and never the site target. A site asking for −500 W while −250 W
+  stands would then take a **latching site-wide false trip** under its own
+  300 W gate. Closed by part 9a's device-clamped counterfactual.
+* **13 mutations — 11 of that line and its call site, plus 2 zero-byte edits to
+  the arbiter claim wiring — each on a fresh full-repo copy mounted `:ro`,
+  bytecode purged by `tools/mutation_run.sh`, the edit re-read from disk and the
+  byte delta printed. All 13 red.** Every one was **re-run independently** in
+  this round rather than carried forward from the previous round's report. The
+  claim-wiring pair (`sign_site` and `circulation` moved from site scope to unit
+  scope) closes two gaps a reviewer disclosed — though **`circulation`'s kill
+  belongs entirely to pre-existing checks and is not claimed by this card.**
+  ⚠️ One **false red** from `test_peakguard.py` on M10 did not reproduce in four
+  subsequent runs; it is CI-06's known flakiness, no claim here rests on it, and
+  it is recorded rather than quietly dropped — unlike the one that *was*
+  believed, two bullets up. Ledger, and an **enumerated list of what was not
+  mutated**, in `DECISIONS/SAFETY-38-site-standing-pin.md` §4a, §4b and §6a.
 
 **Inverter B gets its own MQTT device, and inverter A keeps the one it has
 (TEL-07).** MQTT discovery announced **one** device, and every entity hung off

goodwe_controller/DECISIONS/SAFETY-38-site-standing-pin.md

@@ -0,0 +1,411 @@
+# SAFETY-38 — pinning `site_standing`, the one quantity both site guards are asked about
+
+**Status: DECIDED 2026-09-05.** `app/main.py`'s
+`site_standing = float(sum(standing.values()))` is **correct and is not
+changed**. What this card adds is the thing it never had: a **behavioural**
+fixture whose per-unit shares **cannot** answer for the site, so that a change
+of *meaning* in that reduction goes red instead of green.
+
+Filed with SAFETY-38, card `6a9ac95f2b78646e5a76d2e9`. It is a **coverage**
+card: not one byte of `app/` moves.
+
+---
+
+## 0. The line, and its two consumers
+
+```python
+site_standing = float(sum(standing.values()))          # app/main.py:1598
+```
+
+`standing` is `{unit name -> the value THIS controller last put on that unit's
+setpoint entity}` — `inv.last_write`, i.e. the number **after**
+`clamp_to_rating()` has applied `max_w` and the device's own
+`[dev_min, dev_max]`. Two safety inputs are derived from it and nothing else in
+`cycle()` is:
+
+| consumer | where | what it does with it |
+|---|---|---|
+| **[[SAFETY-30]]**'s site sign detector | `self.site_sign_wd.evaluate(site_standing, self.grid, …)` (main.py:1619) | **latches and stops the whole site** when the total command opposes the meter for `site_sign_disagree_s` |
+| **[[SAFETY-18]]**'s freeze conjunction | `looks_frozen(unchanged_s, site_standing, max_w, …)` inside `peakguard.decide(frozen=…)` (main.py:1926) | takes the peak guard **blind** and files `floor_w = 0.0` — the battery may not import while the billed quarter is unmeasurable |
+
+Both are P0 paths. **Neither was pinned to the reduction.**
+
+## 1. What survived, and what the rescope measured
+
+The card opened with three demonstrated live mutants, all green across the whole
+suite. Re-measured in round 2 against `release/1.0` @ `86eaef2`:
+
+| mutation of `site_standing` | on release/1.0 @ 86eaef2 | closed by |
+|---|---|---|
+| `list(standing.values())[0]` — one unit's share | **SURVIVES**, full suite 21/21 green | part 9a + 9b (this card) |
+| `sum(...) / max(1, len(standing))` — the mean | **SURVIVES**, full suite 21/21 green | part 9a + 9b (this card) |
+| `max(standing.values(), key=abs)` — the largest share | **SURVIVES**, full suite 21/21 green | part 9a + 9b (this card) |
+
+### ⚠️ ROUND 1 SAID `[0]` WAS ALREADY CLOSED BY SAFETY-32. THAT WAS FALSE.
+
+Round 1 of this card recorded `[0]` as **CAUGHT by SAFETY-32's package-wide
+structural pin**, wrote that claim into four places, and told future authors
+*"DO NOT RE-COVER THAT ONE HERE"*. It is wrong, and **how** it went wrong is the
+part worth keeping.
+
+**How the error was made.** The mutation was measured **once**. That single run
+happened to hit `test_peakguard.py`'s [[CI-06]] flake — a **measured ~20%**
+false-red rate — and the red was recorded as a **mutation kill**. Nothing else
+was checked, because a red is the answer you are hoping for and it did not look
+like it needed a second run.
+
+**The correct measurement.** On `release/1.0` @ `86eaef2` carrying **only** the
+`[0]` edit (+4 bytes, re-read from disk, bytecode purged by
+`tools/mutation_run.sh`): the **full 21-file suite is green**, and
+`test_peakguard.py` run **five times in isolation** on that same mutated tree is
+**PASS PASS PASS PASS PASS**. The mutation **survives**. (The reviewer's own
+independent re-measurement of the same tree hit the flake once —
+PASS PASS PASS FAIL PASS — which is the same verdict plus a live demonstration
+of the mechanism that produced the original error.)
+
+**Why SAFETY-32 cannot see it, read off 12j's own enumeration rather than
+argued.** Part 12j taints names *bound* to roster-carrying values and lists
+*accumulated* in a loop over one. `standing` is neither: it is a dict created
+empty at `main.py:1554` and filled by **subscript assignment**
+(`standing[inv.name] = stood`) inside the roster loop, and a subscript store is
+not a binding 12j follows. So `standing` never enters its taint set and
+`sum(standing.values())` is **not a roster site** at all. Run 12j against a tree
+carrying the `[0]` mutation and its enumeration lists `main.py:1553`, `1555` and
+`1690` — the three `self.inverters` sites bracketing this code — and **not
+`1599`**. No shape pin reaches this line; only the behavioural fixture below
+does.
+
+**The rule this cost.** `test_peakguard.py` flakes at a measured ~20%. A single
+red from it proves nothing. Re-run it in isolation **at least five times** and
+**name the failing check** before believing any red from it. This card is the
+**third** measurement CI-06 has corrupted.
+
+SAFETY-32's own disclosed blind spot says why the other two were always out of
+reach:
+
+> *SEMANTICS. `min` → `max` → the mean are edits invisible to any shape pin,
+> permanently. Only the behavioural sets can see them.*
+
+`sum` → mean and `sum` → `max(key=abs)` are **semantic**: identical shape,
+different meaning. **No shape pin will ever close them.** That disclosure was
+accurate, and is now confirmed by measurement rather than taken on trust.
+
+`[0]` is the one that *looks* structural and therefore *looks* covered — and
+that appearance is exactly what produced the false attribution above. It is
+out of reach here for a different reason from the other two: not because the
+shape is invisible, but because **the value never becomes a roster** in the
+analysis's eyes. All three are closed by the same behavioural fixture, and
+**all three needed it.**
+
+## 2. Why the suite could not see it — habit 4, inside the site half of the very card that names it
+
+`test_watchdog.py`'s `_sign_site` is the **only** N≥2 site fixture in the
+repository. It runs at `site_sign_disagree_w: 320` with shares of roughly
+−2500 W **each**. Every one of them is individually far over the gate, so on
+those numbers
+
+```
+sum  =  −5000 W   over        mean =  −2500 W   over        max =  −2500 W   over
+```
+
+— **all three reductions agree**, and a check whose two candidate answers happen
+to be equal cannot observe a change that swaps them. That is `MUTATION.md`'s
+third failure mode, and this is its ninth instance.
+
+At a roster of **one** it is not a fixture defect but arithmetic:
+`sum == mean == max == the one share`, identically, so all three mutations are
+genuinely **equivalent** on a shipped install. No N=1 fixture can ever separate
+them; §3c asserts that rather than leaving it to the reader.
+
+## 3. The fixture, and the numbers it is built on
+
+Two **simulated** units rated 220 W and 280 W, both obeying exactly, inverted
+gain, house importing 2000 W. Both stand at their own rails, so `standing` is
+`{-220, -280}` in roster order and the meter reads +2500 W.
+
+| reduction | value | vs the SHIPPED 300 W gate |
+|---|---|---|
+| `sum` | **−500 W** | **OVER** → trips |
+| `sum / len` (the mean) | −250 W | under → silent |
+| `max(…, key=abs)` | −280 W | under → silent |
+| `list(…)[0]` | −220 W | under → silent |
+
+**Four distinct magnitudes — 500, 250, 280, 220 — of which exactly one clears
+the gate.** The asymmetry is load-bearing twice: equal shares would collapse
+mean, max and first onto one number, and putting the **smaller** unit first is
+what keeps `[0]` distinct from `max(key=abs)`. The gate is left at its shipped
+default so the fixture is graded against the magnitude an install runs; only the
+**hold** is shortened (325 s → 2 s), because the hold is a wall clock and the
+campaign behind 325 s is measured on the rig, not here.
+
+⚠️ **220 W and 280 W are SIMULATED ratings chosen for that arithmetic and for
+nothing else.** They are not measurements. In particular they are **not**
+inverter B, which does not physically exist; B is a GW5048D-ES, serial
+`55048ESU22AW0992`, **4600 W from its datasheet** (`goodwe/NOTES.md` §1.1b).
+
+### 3a. The site sign detector
+
+Shipped tree: the site latches, commands 0 W on every inverter, and the sentence
+an operator reads is
+`SIGN_DISAGREEMENT: commanded -500 W against a meter reading +2500 W …`. No
+per-unit watchdog trips — every unit is faithfully executing its share, which is
+the asymmetry the site detector exists for.
+
+Under the mean and under `max(key=abs)`: **nothing trips, ever.** The reviewer's
+tree was still commanding −500 W of charge into a +2500 W import at t = 595 s
+with `following=True`.
+
+Two counterfactuals sit beside it so the trip is attributable:
+
+* the **same** inverted-gain site whose shares sum to −250 W — under the gate —
+  does **not** trip, so the trip above is the sum crossing 300 W and not the
+  mere presence of a second inverter;
+* a site whose **device range is narrower than `max_w`** asks for −500 W while
+  only −250 W stands, and does **not** trip — see §5.
+
+### 3b. The second consumer, covered rather than scoped out
+
+`site_standing` is also `looks_frozen()`'s `commanded_w`. The same
+discrimination applies at a different threshold: the site rail is
+`RAIL_FRAC * site_max_w` = 0.95 × 500 = **475 W**.
+
+| reduction | value | vs the 475 W rail |
+|---|---|---|
+| `sum` | **500 W** | **RAILED** → `BLIND_FROZEN`, `floor_w = 0.0` |
+| the mean | 250 W | under → silent |
+| `max(…, key=abs)` | 280 W | under → silent |
+| `list(…)[0]` | 220 W | under → silent |
+
+The sign is flipped from §3a on purpose: the gain is the **shipped positive**
+one and the frozen meter reads import, so the site *discharges* +500 W against a
++2500 W import — the two agree in sign, SAFETY-30 has nothing to say, and this
+half grades SAFETY-18 alone. Reusing §3a's inverted gain would have the site
+sign latch park everything at 0 W, and the freeze conjunction could then never
+be true: a check measuring the *other* guard's remedy.
+
+⚠️ **The open quarter is backfilled with the same stuck reading, and that is
+not decoration.** Without it the block is mostly uncovered, `blindness()`
+answers `BLIND_COVERAGE`, and the mutant reaches *the same action by a different
+route* — a check on the action alone could not then see the difference it names.
+Seeded, the measurement is honest:
+
+* shipped: `blind = BLIND_FROZEN`, `floor_w = 0.0` — no charging while the
+  billed quarter is unobservable;
+* both mutations: **not blind at all**, `floor_w = None` — the site may go on
+  importing through a quarter whose billed average cannot be measured. That is
+  the capacity-tariff hazard SAFETY-18 exists for, silently disarmed.
+
+The counterfactual comes from the **same run**: on the earlier cycles the
+command had not yet reached the rail and the guard did not report SAFETY-18,
+with the meter equally frozen throughout — so the verdict is produced by the
+command magnitude `site_standing` carries and not by `unchanged_s` alone. A low
+gain (0.05, the schema floor) is what buys those below-the-rail cycles.
+
+### 3c. At N=1, nothing changes — asserted
+
+A real one-inverter controller is driven through the same frozen-meter
+scenario. Its `standing` has a single entry, so `sum`, the mean,
+`max(key=abs)` and `[0]` are printed and asserted to be **one number**; the
+site sign detector is still absent (part 7 counts the calls on the object); and
+SAFETY-18 still reaches `BLIND_FROZEN` on that same value. The claim "the
+shipped install is unaffected" now rests on the roster rather than on the
+reader.
+
+## 4. Mutation ledger
+
+Every run: a **fresh full-repo copy**, `__pycache__` and `*.pyc` excluded,
+mounted `:ro`, graded by `tools/mutation_run.sh` (which purges, prints the tree
+fingerprint, and verifies no cache appears during the run). The mutated line was
+**re-read from disk** after the edit and the byte delta printed. Shipped
+`app/main.py` is 234 542 bytes at `86eaef2`.
+
+| # | mutation of `site_standing` | Δ bytes | verdict |
+|---|---|---|---|
+| M1 | `sum(...) / max(1, len(standing))` — the mean | +24 | **RED** |
+| M2 | `max(standing.values(), key=abs)` — largest share | +9 | **RED** |
+| M3 | `list(standing.values())[0]` — one share | +4 | **RED** — and **survives on release/1.0**, see §1 |
+| M4 | `min(standing.values(), key=abs)` — smallest share | +9 | **RED** |
+| M5 | `sum(abs(v) for v in ...)` — magnitude, sign lost | +16 | **RED** |
+| M6 | `-sum(standing.values())` — sign flipped | +1 | **RED** |
+| M7 | `float(self.target)` — the arbiter's site target | **−11** | **was a SURVIVOR — now RED**, see §5 |
+| M8 | `sum(standing.values()) / 2.0` | +6 | **RED** |
+| M9 | `sum(standing.values()) * 2.0` | +6 | **RED** |
+| M10 | `sorted(standing.values())[-1]` — largest signed | +7 | **RED** |
+| **M11** | **argument SWAP** at the call site: `evaluate(site_standing, self.grid, …)` → `evaluate(self.grid, site_standing, …)` (main.py:1620) | **0** | **was a SURVIVOR in round 1 — now RED**, see §4a |
+
+**Every one of the ten is red in `test_watchdog.py`.** Re-measured in round 2
+on `release/1.0` @ `86eaef2` (where `app/main.py` is 234 542 bytes, 2 022 more
+than the `f72c48d` the round-1 figures were taken on): all ten still red, at the
+byte deltas in the table, each on a fresh copy with the edit re-read from disk.
+Before part 9 existed, **three** of these left the whole suite green — M1, M2
+**and M3** — and the remaining seven were caught by SAFETY-30's own N≥2 checks,
+none of which grade the *quantity*.
+
+⚠️ **ONE FALSE RED, AND IT IS [[CI-06]]'s.** In the batch run M10 also reported
+`FAIL test_peakguard.py`. Re-run in isolation **three times** and once more
+through `tools/mutation_run.sh` — **four clean passes, zero failures**. The
+batch script had discarded the failure detail, so the failing check cannot be
+named here; what can be said is that the red did not reproduce in four attempts
+and that **no claim in this card rests on it**. `test_peakguard.py` is the file
+CI-06 records as flaky, and this is the behaviour it records. Believe no red
+from it without three isolated re-runs.
+
+⚠️ **M3 IS NOT "FOR COMPLETENESS", AND ROUND 1 SAID IT WAS.** Round 1 recorded
+M3 as already closed structurally by SAFETY-32 and disclaimed it. §1 above has
+the correction and the mechanism: `[0]` **survives** a full green 21-file suite
+on `release/1.0` @ `86eaef2`, because `standing` is a dict filled by subscript
+assignment and never enters 12j's taint set. **M3 is a real kill by this card's
+fixture and by nothing else in the repository.** It is claimed here.
+
+### 4a. ⚠️ The zero-byte survivor one line below the one this card pinned
+
+Round 1 pinned the **value** `site_standing` and never pinned **where it goes**.
+Swapping the detector's first two arguments at `main.py:1620` is a **zero-byte**
+edit — the same characters, reordered — and it left the round-1 tree **21/21
+green**.
+
+What it costs is the banner. `SignWatchdog.evaluate()` formats
+`commanded_w` first and `against_w` second, so under the swap part 9a's own
+output reads:
+
+```
+SIGN_DISAGREEMENT: commanded +2500 W against a meter reading -500 W for 2 s …
+```
+
+The site is standing at **−500 W of charge into a +2500 W import** and the
+**latching, site-stopping** banner tells the operator **the exact opposite** —
+which instrument read what, inverted. `watchdog.py:658-665` names this failure
+in its own words: *"a false statement about which instrument produced the
+evidence, on the one line somebody woken by this alarm reads first."*
+
+**Why round 1's check could not see it, and this is the general lesson.** It
+asserted
+
+```python
+f"{sum(_share38):.0f} W" in _c38.site_sign_wd.reason
+```
+
+— that `"-500 W"` appears **somewhere** in the sentence. Under the swap it still
+does: in the **meter slot**. A substring test cannot reach a failure that is
+purely **positional**, and round 1's own comment claimed the opposite ("*would
+put a different number in the store, the action log and the banner, and this is
+where that shows*"). It shows the **number**, never its **position**. This is
+MUTATION.md's *"a check whose data cannot reach the failure it names"*, in the
+card that exists to complain about exactly that.
+
+**The fix is one line and touches no `app/` code** — assert the **ordered
+pair**:
+
+```python
+f"commanded {sum(_share38):+.0f} W against a meter reading "
+f"{_mid38['grid']:+.0f} W" in _c38.site_sign_wd.reason
+```
+
+Measured: with that line, M11 is **red in `test_watchdog.py` and green in the
+other twenty files** — one file, one check.
+
+### 4b. Claim wiring, re-measured rather than assumed
+
+Round 1's reviewer disclosed it had **not** mutated the arbiter claim wiring or
+[[SAFETY-31]]/circulation. Both were mutated in round 2. Both are **zero-byte**
+edits to `arbiter.CLAIM_SCOPE`:
+
+| # | mutation | Δ bytes | verdict |
+|---|---|---|---|
+| W1 | `"sign_site": SCOPE_SITE` → `SCOPE_UNIT` | **0** | **RED** — `test_watchdog.py` (parts 5 **and 9a**), `test_arbiter.py`, `test_peakguard.py` |
+| W2 | `"circulation": SCOPE_SITE` → `SCOPE_UNIT` | **0** | **RED** — `test_watchdog.py`, `test_arbiter.py`, `test_peakguard.py` |
+
+Part 9a's *"…and it stops the WHOLE site, through the `sign_site` claim by name"*
+is one of the two checks that kills W1, so this card contributes to that
+coverage rather than merely inheriting it. **W2 is caught entirely by
+pre-existing checks** — SAFETY-38 adds nothing to circulation, and does not
+claim to.
+
+## 5. The survivor this card went looking for, and closed
+
+M7 is not one of the card's three. It was found by asking the question the
+recurring defect demands — *what mutation would my new checks NOT see?* — and it
+is the answer: **−11 bytes**, and it survived every check above **and the whole
+20-file suite**, because in every fixture built so far the arbiter's site target
+and the sum of what actually stands on the wire are **the same number**.
+
+They are not the same number when a setpoint device's own reported range is
+narrower than its `max_w`. The `device` P_SAFETY claim is filed **per actuator**
+(`actuator_of("device", inv)`), so it bounds each unit's **share** and never the
+site target, and `clamp_to_rating()` clips again on the way out. On two units
+rated 220/280 W whose devices report ±120/±130 W, the site asks for **−500 W**
+and **−250 W** stands.
+
+Which one the guards mean is already written down, in both of them: SAFETY-02
+grades *"the command standing on the wire"*, and `looks_frozen()`'s docstring
+says `commanded_w` is *"the EMITTED setpoint — what the arbiter resolved and
+`write_setpoint()` put on the wire — not the loop's raw wish"*. [[SAFETY-20]] is
+the whole card about the difference. Those sentences are now made to bite: on
+the site target the detector fires on a site standing at −250 W against a
++2250 W meter — **under its own 300 W gate** — which is a latching, site-wide
+false trip on an install whose inverters simply report a narrower range than the
+operator typed.
+
+## 6. Honest gaps
+
+* **A mutation that changes the SIGN CONVENTION of `standing` itself** — i.e. in
+  `main.py`'s `stood = inv.last_write if inv.last_write is not None else
+  inv.target`, not on the reduction line — is **not** in this ledger. It is a
+  different line and a different card; §3a's obedience precondition would see
+  some of it, but that is not a measured claim and is not made here.
+* **The freeze half is graded at ONE roster length (2) and one rail.** The
+  `RAIL_FRAC` constant, `rail_ceiling_w()`'s device-bound conjunction and
+  `rail_unreachable()` are `test_freeze.py`'s subject and are untouched here.
+* **The site hold is 2 s, not the shipped 325 s.** The window's derivation is a
+  rig campaign (`DECISIONS/SAFETY-30-per-unit-sign.md` §3B) and this file does
+  not re-grade it. The **gate** is the shipped 300 W, which is the coordinate
+  this card is about.
+* **Everything about inverter B here is simulated and labelled so.** No number
+  in this document or in the fixture is a measurement of a device that does not
+  yet exist.
+
+### 6a. Round 2: what was closed, and what was NOT
+
+Round 1's reviewer disclosed that it had not mutated SAFETY-31/circulation, the
+arbiter claim wiring, or ledger entries M4/M5/M6/M8/M9/M10. Enumerated, with the
+gaps left open stated rather than rounded off:
+
+**Closed in round 2 (measured, on `86eaef2`, bytecode purged, edit re-read from
+disk, byte delta printed):**
+
+1. **M11**, the zero-byte argument swap — §4a. Red on one named check.
+2. **M3**, the `[0]` reduction — re-measured, **survives on release/1.0**, closed
+   by part 9a and 9b. The false attribution corrected in all four places it was
+   committed: this file §1 and §4, `CHANGELOG.md`, and `test_watchdog.py`'s part
+   9 header (which previously *instructed future authors not to re-cover it*).
+3. **M1, M2, M4, M5, M6, M7, M8, M9, M10** — every ledger entry re-run
+   independently in round 2 rather than carried forward from round 1's report.
+   All ten red; M1/M2/M4 re-run in the exact wrapped form the table records so
+   the byte deltas are the table's own (+24/+9/+9).
+4. **W1**, `sign_site` claim scope — §4b. Zero bytes, red, part 9a among the
+   killers.
+5. **W2**, `circulation` claim scope — §4b. Zero bytes, red, but **entirely on
+   pre-existing checks**.
+
+**NOT closed, and not claimed:**
+
+* **SAFETY-31's `circ_wd` detector itself** — its threshold, its hold, its
+  `circulating_w()` reduction over the roster. Only its **claim scope** was
+  mutated (W2), and that kill belongs to checks this card did not write.
+  Circulation's own behavioural coverage is `test_watchdog.py` part 4's and is
+  untouched here.
+* **The other eight `CLAIM_SCOPE` entries** — `loop`, `peak`, `arbitrage`,
+  `safety` (site) and `device`, `supervised`, `failsafe`, `maintenance` (unit).
+  `CLAIM_SCOPE` has ten entries; only the two named above were mutated. `test_peakguard.py` part 10f grades the
+  classification statically; that is a different instrument and this card did
+  not re-measure it.
+* **`actuator_of()`'s own body** and the `n_units > 1` guard on the `sign_site`
+  append at `main.py:1764` were **not** mutated.
+* **The ten ledger mutations were re-graded against `test_watchdog.py` only.**
+  The "green in the other twenty files" half of the round-1 claim was
+  re-verified on `86eaef2` for **M3** and **M11** (both full 21-file runs) and is
+  otherwise carried forward from round 1's measurement on `f72c48d`. It is a
+  weaker statement than round 1 made and is written down as such.
+* **`test_peakguard.py`'s CI-06 flake is not fixed by this card** and is not
+  this card's subject. It is *characterised* here (five isolated runs on the M3
+  tree, all PASS) only far enough to overturn the false kill it produced.

goodwe_controller/MUTATION.md

@@ -135,12 +135,15 @@ manufactures them from a **fixture**: the check runs, the assertion is
 evaluated, the sentence above it is true — and the numbers it compares are
 arranged so that the failure it describes could not have changed the answer.
 
-It is not hypothetical and it is not rare. EIGHT instances in two weeks; four
+It is not hypothetical and it is not rare. TEN instances in two weeks; four
 were found by review, two - CFG-04's fixture pair - by an author's own mutation
 battery, which is the cheaper place, one by review again, in the one
 place nobody had thought to point the rule at: not a check in the suite, but a
-COMMITTED EVIDENCE ARTIFACT four documents cite - and the eighth INSIDE THE FIX
-WRITTEN TO CLOSE THE SEVENTH.
+COMMITTED EVIDENCE ARTIFACT four documents cite - the eighth INSIDE THE FIX
+WRITTEN TO CLOSE THE SEVENTH, the ninth inside the SITE HALF of the card
+that names the rule in its own text - and the TENTH INSIDE THE FIX WRITTEN TO
+CLOSE THE NINTH, for the second time in this list. See SAFETY-38 below: the
+check that closed it asserted a NUMBER and not the number's POSITION.
 
 ⚠️ **AND IT HAS NOW APPEARED IN SIX CONSECUTIVE CARDS.** The seventh instance,
 MAINT-05's, is the one that says why: the defect is not carelessness about
@@ -234,6 +237,47 @@ same place twice, the check is decoration.
   assertion cannot fail is exactly the thing this section is about. Two habits
   follow, and both are habit 5 and 6 below.
 
+* **SAFETY-38** — `main.py`'s
+  `site_standing = float(sum(standing.values()))`, the first argument of
+  SAFETY-30's latching site sign detector *and* SAFETY-18's `looks_frozen()`
+  input. `test_watchdog.py`'s `_sign_site` is the suite's **only** N≥2 site
+  fixture, and it runs shares of about **−2500 W each** — every one
+  individually over the 320 W gate it is configured with. On numbers like those
+  `sum`, the mean and `max(key=abs)` **all agree**, so the reduction could be
+  swapped for either of the other two and the site guard went **blind with the
+  whole suite green** — still commanding −500 W of charge into a +2500 W import at
+  t = 595 s with `following=True`. At a roster of **one** it is worse and it is
+  not a fixture defect at all: `sum == mean == max == the one share`
+  *identically*, so every such mutation is genuinely **equivalent** there and no
+  N=1 fixture could ever separate them. The fixture that separates them is the
+  one the detector exists for — **per-unit shares EACH BELOW the gate whose SUM
+  clears it** — and it is now `test_watchdog.py` part 9, at asymmetric ratings
+  so that all four candidate reductions give four **distinct** answers.
+
+  ⚠️ **AND THE CARD'S OWN SEARCH FOR ITS NEXT SURVIVOR FOUND ONE, WHICH IS THE
+  POINT OF ASKING.** Having built the fixture, the question *what mutation would
+  this NOT see?* produced `float(self.target)` — the arbiter's site target
+  instead of the sum of what stands on the wire — at **−11 B**, green across the
+  whole suite, because every fixture in the repository was built where the two
+  are the same number. They separate only when a device's reported range is
+  narrower than its `max_w`, since the `device` claim is filed **per actuator**
+  and never bounds the site target. Closed in the same commit, by a
+  counterfactual that asks for −500 W while −250 W stands.
+
+  ⚠️ **AND THEN THE FIX ITSELF WAS THE TENTH INSTANCE — A SUBSTRING WHERE THE
+  FAILURE WAS POSITIONAL.** The check written to pin the banner asserted
+  `f"{sum(...):.0f} W" in reason`: that **"−500 W" appears somewhere** in the
+  sentence. Swapping the detector's first two arguments
+  (`evaluate(site_standing, self.grid, …)` → `evaluate(self.grid, site_standing, …)`)
+  is a **ZERO-BYTE** edit that leaves both numbers in the string and moves each
+  into the other's slot — so the substring is still found, **in the meter
+  slot**, and the whole suite stayed green while the latching site-stopping
+  banner told the operator which instrument read what **exactly backwards**.
+  The fix is to assert the **ORDERED PAIR**,
+  `f"commanded {sum:+.0f} W against a meter reading {grid:+.0f} W"`.
+
+  The general habit is **14** below.
+
 Note what these have in common with a masked rung: the mutation *runs*, and the
 suite is *honestly* green. Nothing in a purge, a fingerprint or a disassembly
 can see it, because the code under test really did behave identically on the
@@ -363,6 +407,26 @@ Cheap habits fall out of it, and all of them are now used in this repository:
     completeness a reviewer falsifies in ten minutes**, and every round of this
     card that claimed the latter was rejected for it.
 
+14. **An `in` test against a formatted sentence grades PRESENCE, never
+    ARRANGEMENT — so assert the ORDERED PAIR.** SAFETY-38 pinned the banner of a
+    latching, site-stopping alarm with
+    `f"{sum(_share38):.0f} W" in ...reason` — that `"-500 W"` appears
+    *somewhere*. Swapping the detector's first two arguments at the call site
+    (`evaluate(site_standing, self.grid, …)` →
+    `evaluate(self.grid, site_standing, …)`) is a **ZERO-BYTE** edit: both
+    numbers are still in the string, each in the other's slot. The substring was
+    still found — **in the meter slot** — the whole suite stayed green, and the
+    banner told the operator which instrument read what **exactly backwards**.
+    Whenever the property you mean is "**this** value went in **this** slot" — a
+    reason string, a log line, a notification, an MQTT payload — assert the
+    surrounding **literal text with the value embedded in its own position**
+    (`f"commanded {x:+.0f} W against a meter reading {y:+.0f} W"`), or assert
+    the fields **before** they are formatted. Two values that both appear in one
+    sentence can always be transposed by an edit that costs **nothing**, and
+    that no byte delta, no fingerprint and no shape pin can see. ⚠️ Note where
+    this one was found: **inside the fix written to close the previous instance
+    of the same family**, which is the second time in this list.
+
 And the mutation-table consequence: **a variant is not covered because a
 near-miss of it is.** DEV-02's table listed the *actuator* variant of the
 per-unit claim defect (`device`/`supervised` filed without `inv`), which the

goodwe_controller/app/clamp.py

@@ -145,94 +145,14 @@ from datetime import datetime
 # nothing else in this add-on uses it. See "DISTINCT FROM SATURATION".
 REASON_CODE = "OUTPUT_CLAMP"
 
-# Re-assert the notification this often while the clamp stays engaged.
-#
-# ⚠️ RAISED 30 s -> 150 s on 2026-09-05, and the reason is a REGIME CHANGE, not a
-# change of mind about the alarm. 30 s was the planning cadence (2.3), chosen
-# when a loop-side engagement was a rare event: `main.py`'s note at the action
-# log records "60 cycles of the §10.3 runaway produce 0 write-path engagements
-# and 2 loop-side ones". On the live install the counter reached 48 loop-side
-# ENGAGEMENTS in ~25 minutes of ordinary operation - roughly one cycle in six,
-# not a pinned rail, but far more often than a guard sized for 2-in-60 assumed -
-# and the owner received a persistent notification about it all day. ⚠️ NOT
-# because of the 30 s re-assert - see the block below; those notifications never
-# consulted this constant at all.
-#
-# ⚠️ BOTH FIGURES ARE ENGAGEMENT COUNTS; only the regime differs - 2-in-60 was
-# measured over a §10.3 RUNAWAY, 48-in-305 was ordinary running on the live
-# install. The 48 is read off the live log, not measured in this repo.
-#
-# ⚠️ AND RAISING THIS CONSTANT ALONE DID NOT FIX THAT FLOOD - review found it
-# and the first version of this change was wrong. At ~5 s cycles a 1-in-6
-# engagement leaves ~25 s of clean cycles between engagements, past
-# CLEAR_CYCLES x 5 s = 15 s, so the alarm DE-ASSERTED between almost every one
-# and came back as a fresh rising edge. The rising edge used to fire
-# unconditionally, so those notifications never consulted this constant at all:
-# 48 notifications at 30 s, and still 48 at 150 s. The fix was to rate-limit the
-# RISING EDGE too and let `last_alarm` survive a de-assert, so this interval
-# bounds the notification rate across episodes rather than only within one.
-# Measured on that same window afterwards: 51 episodes, 11 notifications.
-#
-# WHY the loop reaches its integrator bound so much more often than the guard's
-# author saw: `max_w` on the live install is 5000 W, while the loop's slew was
-# derived against a 1500 W clamp - admin/goodwe `NOTES.md` §"Simulated 2 kW load
-# step (gain 0.6, clamp 1500)". ⚠️ THAT DERIVATION IS IN THE OTHER REPO; nothing
-# in this one corroborates it, so do not go looking here. SAFETY-39 is the ticket
-# that re-derives it, and fixing that is what would stop the railing; this
-# constant only changes how often the alarm repeats.
-#
-# ⚠️ 150 s IS THE REQUIREMENT'S EDGE WITH MARGIN, AND THE CHECK NOW ENFORCES THAT
-# EDGE. `test_clamp.py` part 2 grades the cadence in wall-clock terms - a pinned
-# loop must speak at least MIN_PER_QUARTER = 5 times inside the 900 s quarter
-# that bills the capacity tariff - which caps this constant at 900/5 = 180 s.
-# Measured on the worst sliding 900 s window: 180 s earns 5 alarms, 181 s earns
-# 4. 150 s earns 6.
-#
-# ⚠️ THAT CHECK USED TO PERMIT 224 s, AND THE FIX SHIPPED WITH THIS COMMIT. Its
-# sweep starts at i=0, where the rising edge is free, so it measured one alarm
-# more than a real quarter earns. A later editor raising this to 200 s would have
-# had a green suite and a requirement quietly unmet. `test_clamp.py` now grades
-# floor(QUARTER_S / REASSERT_S) directly.
-#
-# ⚠️ MIN_PER_QUARTER = 5 IS A TEST-LOCAL INTEGER, not a spec figure - it exists
-# only in `test_clamp.py` and the CHANGELOG entry that introduced it. The 900 s
-# quarter IS system-wide (`tariff.py`, `freeze.py`, `DOCS.md`). So the 180 s
-# ceiling rests on one number a test author chose; if that number is ever
-# revisited, this constant moves with it.
-#
-# ⚠️ THIS IS A STOP-GAP AND DOES NOT MAKE THE ALARM CORRECT. The message still
-# calls the integrator bound a BUG SIGNAL and still pairs a request from one
-# moment with a `self.target` read at another - SAFETY-40. Nothing here is
-# suppressed: every engagement is still counted, the action-log row is written on
-# every engaged cycle regardless, and the rising edge of every episode alarms
-# unconditionally, so no alarm is DROPPED - only delayed.
-REASSERT_S = 150.0
+# Re-assert the notification this often while the clamp stays engaged. 30 s is
+# the planning cadence (2.3), i.e. slow enough not to flood and fast enough
+# that a pinned loop is never quiet for a whole billing quarter.
+REASSERT_S = 30.0
 
 # Consecutive clean cycles before the alarm de-asserts (10.2 hysteresis).
 CLEAR_CYCLES = 3
 
-# ⚠️ SAFETY-41. Consecutive ENGAGED cycles after which an episode speaks even if
-# the notification budget is spent. THE ESCALATION EXISTS BECAUSE THE RATE LIMIT
-# ALONE DELAYS A RUNAWAY, and review measured it: a benign one-cycle clamp
-# followed by a continuous runaway held the runaway's first notification for up
-# to 140 s - one REASSERT_S minus a cycle. On the live install, where ordinary
-# railing spends the budget essentially all the time, a runaway arriving during
-# normal operation would be delayed with near-certainty. That is the "benign
-# noise suppresses the bug signal" shape this module's docstring is written
-# against.
-#
-# THE DISCRIMINATOR IS RUN LENGTH, and the two populations genuinely differ: the
-# live flood was runs of length ONE (engage, de-assert, engage), while a §10.3
-# runaway engages on EVERY cycle. So a sustained run speaks regardless of budget,
-# and scattered chatter does not.
-#
-# Measured, shipped-without vs shipped-with - it costs nothing it was protecting:
-#   live scatter flood (305 cycles, 1-in-6)   11 -> 11 notifications
-#   chatter 1-engaged/3-clean over 8000 s     50 -> 50 notifications
-#   pinned 900 s quarter (floor is 5)          6 ->  6 alarms
-#   runaway delay after a benign episode     140 s -> 10 s
-SUSTAINED_CYCLES = 3
-
 
 @dataclass(frozen=True)
 class ClampResult:
@@ -338,10 +258,6 @@ class ClampWatchdog:
         self.last_alarm: datetime | None = None
         self.reason = ""
         self.clean_cycles = 0
-        # SAFETY-41. Consecutive engaged cycles, and whether THIS episode has
-        # spoken yet - the two the escalation clause needs.
-        self.run_len = 0
-        self.spoken = False
 
     def note(self, engaged: bool, reason: str, now: datetime) -> bool:
         """Advance one cycle. True when the caller should raise the alarm.
@@ -353,72 +269,26 @@ class ClampWatchdog:
             self.engagements += 1
             self.clean_cycles = 0
             self.reason = reason
-            self.run_len += 1
             if not self.active:
                 self.active = True
                 self.since = now
                 self.episodes += 1
-                self.spoken = False
-                # ⚠️ SAFETY-41. THE RISING EDGE IS RATE-LIMITED TOO, and it did
-                # not used to be. It fired unconditionally, so a condition that
-                # engages and clears repeatedly raised one notification PER
-                # EPISODE no matter how fast the episodes came - and
-                # `REASSERT_S` never entered into it, because it only governs
-                # the still-engaged path below.
-                #
-                # That is the shape the live install actually produced: 48
-                # engagements in 25 minutes, scattered roughly one cycle in six.
-                # At a ~5 s cycle the gaps are ~25 s of clean cycles, which
-                # exceeds CLEAR_CYCLES x 5 s = 15 s, so the alarm DE-ASSERTED
-                # between almost every engagement and each one came back as a
-                # fresh rising edge. Measured on this class over that window:
-                # 48 episodes and 48 notifications at REASSERT_S = 30 - and
-                # still 48 at REASSERT_S = 150. Raising the re-assert removed
-                # NONE of them, because none of them came from the re-assert.
-                #
-                # So the interval now bounds the NOTIFICATION RATE rather than
-                # the repeat rate within one episode: `last_alarm` survives a
-                # de-assert, and a new episode speaks only if the interval has
-                # elapsed. ⚠️ NOTHING IS DROPPED. Every engagement is still
-                # counted, every episode still increments, the action-log row is
-                # still written on every engaged cycle, and a genuine runaway -
-                # which by definition keeps engaging - is picked up by the
-                # re-assert path within REASSERT_S. Delay, not loss.
-                if (self.last_alarm is None
-                        or (now - self.last_alarm).total_seconds() >= REASSERT_S):
-                    self.last_alarm = now
-                    self.spoken = True
-                    return True
-                return False
-            # ⚠️ THE ESCALATION. An episode that has not yet spoken because the
-            # budget was spent by an EARLIER, unrelated episode speaks anyway
-            # once it has engaged SUSTAINED_CYCLES times in a row. A runaway
-            # engages every cycle and reaches it; the scattered one-cycle
-            # railing that produced the live flood never does.
-            if not self.spoken and self.run_len >= SUSTAINED_CYCLES:
                 self.last_alarm = now
-                self.spoken = True
                 return True
             # Still engaged: re-assert on the slow cadence, not every cycle.
             if (self.last_alarm is None
                     or (now - self.last_alarm).total_seconds() >= REASSERT_S):
                 self.last_alarm = now
-                self.spoken = True
                 return True
             return False
 
-        self.run_len = 0
         if not self.active:
             return False
         self.clean_cycles += 1
         if self.clean_cycles >= CLEAR_CYCLES:
             self.active = False
             self.since = None
-            # ⚠️ `last_alarm` DELIBERATELY SURVIVES THE DE-ASSERT. Clearing it
-            # here is what made the next rising edge speak immediately however
-            # soon it arrived, which is the flood described at the rising edge
-            # above. The episode ends; the notification budget does not reset
-            # with it.
+            self.last_alarm = None
             self.reason = ""
             self.clean_cycles = 0
         return False

goodwe_controller/config.yaml

@@ -1,5 +1,5 @@
 name: GoodWe RS485 Controller
-version: "0.7.0"
+version: "0.6.0"
 slug: goodwe_controller
 description: >-
   Drives a GoodWe ES/BP battery inverter over RS485 by emulating its smart

goodwe_controller/test_clamp.py

@@ -78,8 +78,7 @@ import sys
 from datetime import datetime, timedelta, timezone
 
 from app.clamp import (
-    CLEAR_CYCLES, REASON_CODE, REASSERT_S, SUSTAINED_CYCLES, ClampWatchdog,
-    clamp_to_rating,
+    CLEAR_CYCLES, REASON_CODE, REASSERT_S, ClampWatchdog, clamp_to_rating,
     is_commandable,
 )
 from app.allocator import Allocation, UnitPlan, plan
@@ -240,112 +239,11 @@ print(f"    pinned on the rail for {QUARTER_S:.0f} s at 1 s cycles: "
 check(f"a loop pinned for a whole billing quarter speaks at least "
       f"{MIN_PER_QUARTER} times (it spoke {alarms})",
       alarms >= MIN_PER_QUARTER)
-# ⚠️ REVIEW-FOUND, SAFETY-41, and it is the SAME DEFECT as the one recorded
-# twenty lines above, one notch weaker. The sweep above runs i = 0..899 and the
-# rising edge at i=0 is FREE, so it measures `1 + floor(899 / REASSERT_S)` - one
-# alarm more than a real quarter earns. Measured on this very check:
-#   REASSERT_S = 180 -> 5 alarms, green   (and 180 is the true edge: on the worst
-#   REASSERT_S = 224 -> 5 alarms, GREEN    sliding 900 s window 180 gives 5 and
-#   REASSERT_S = 225 -> 4 alarms, red      181 gives 4)
-# So the check as written permits 224 s while the REQUIREMENT permits 180 s, and
-# anyone raising the constant to 200 s would get a green suite and conclude the
-# floor was met when a real quarter would earn 4 alarms. Grade the cadence
-# DIRECTLY, so the check enforces the ceiling its own comment claims for it.
-check(f"...and the CADENCE itself honours the floor, independent of where the "
-      f"sweep happens to start: floor({QUARTER_S:.0f}/{REASSERT_S:.0f}) = "
-      f"{int(QUARTER_S // REASSERT_S)} >= {MIN_PER_QUARTER}",
-      QUARTER_S // REASSERT_S >= MIN_PER_QUARTER)
 check(f"...and on no more than {MAX_FRACTION:.0%} of cycles (it was "
       f"{alarms / QUARTER_S:.1%})", alarms <= MAX_FRACTION * QUARTER_S)
 check("...while every single cycle is still counted",
       pinned.engagements == int(QUARTER_S))
 
-# --- THE SCATTERED REGIME, WHICH IS THE ONE THE OWNER ACTUALLY HIT -----------
-# ⚠️ REVIEW-FOUND, SAFETY-41, and it falsified the first version of this card.
-# The rising edge used to fire UNCONDITIONALLY, so REASSERT_S governed only the
-# still-engaged path. A condition that engages and clears repeatedly therefore
-# raised one notification PER EPISODE at any value of the constant.
-#
-# That is what the live install produced: 48 engagements in ~25 minutes,
-# scattered about one cycle in six. At the measured ~5 s cycle the gaps are ~25 s
-# of clean cycles, past CLEAR_CYCLES x 5 s = 15 s, so the alarm de-asserted
-# between almost every engagement. Raising REASSERT_S 30 -> 150 removed NONE of
-# them. The interval now bounds the notification RATE across episodes.
-#
-# The stimulus is written in wall-clock seconds and in the shape the field
-# actually produced, so it does not move when the constant does.
-SCATTER_CYCLE_S = 5.0
-SCATTER_ONE_IN = 6
-SCATTER_CYCLES = 305
-
-scat = ClampWatchdog()
-scat_alarms = sum(1 for i in range(SCATTER_CYCLES)
-                  if scat.note(i % SCATTER_ONE_IN == 0, "scattered",
-                               T0 + timedelta(seconds=SCATTER_CYCLE_S * i)))
-_scat_span = SCATTER_CYCLE_S * SCATTER_CYCLES
-print(f"    scattered 1-in-{SCATTER_ONE_IN} over {_scat_span:.0f} s at "
-      f"{SCATTER_CYCLE_S:.0f} s cycles: {scat.episodes} episodes, "
-      f"{scat.engagements} engagements, {scat_alarms} alarm(s)")
-check(f"a condition that de-asserts between engagements is rate-limited ACROSS "
-      f"episodes, not once per episode ({scat_alarms} alarms for "
-      f"{scat.episodes} episodes)",
-      scat_alarms < scat.episodes)
-check(f"...and the rate honours the same interval the pinned case does: at most "
-      f"ceil({_scat_span:.0f}/{REASSERT_S:.0f}) + 1 = "
-      f"{int(_scat_span // REASSERT_S) + 1}",
-      scat_alarms <= int(_scat_span // REASSERT_S) + 1)
-check("...while EVERY episode and EVERY engagement is still counted - the "
-      "budget is on notifications, never on evidence",
-      scat.episodes == scat.engagements == SCATTER_CYCLES // SCATTER_ONE_IN + 1)
-# ⚠️ THE COUNTERFACTUAL, AND THE FIRST VERSION OF IT COULD NOT FAIL FOR THE
-# DEFECT IT NAMED. It read `ClampWatchdog().note(True, ...) is True` - a FRESH
-# object, so it only ever exercised the `last_alarm is None` branch, which is the
-# trivially-true one. A fresh watchdog has no earlier episode to be held back BY.
-# That is the third instance in this file of the family recorded at line 216 and
-# at the 224 s sweep, and it was guarding the most safety-critical property in
-# the change. Review found it.
-#
-# The stimulus must therefore SPEND THE BUDGET FIRST: a benign one-cycle clamp,
-# a gap long enough to de-assert, then a continuous runaway. Without the
-# escalation clause the runaway's first notification is held for up to
-# REASSERT_S - measured at 140 s before it was added.
-_esc = ClampWatchdog()
-_esc.note(True, "benign", T0)                                   # spends the budget
-for _i in range(1, 1 + CLEAR_CYCLES + 1):                       # de-assert
-    _esc.note(False, "", T0 + timedelta(seconds=5.0 * _i))
-_RUNAWAY_AT = 5.0 * (CLEAR_CYCLES + 2)
-_esc_fires = [5.0 * (CLEAR_CYCLES + 2 + _j)
-              for _j in range(200)
-              if _esc.note(True, "runaway",
-                           T0 + timedelta(seconds=5.0 * (CLEAR_CYCLES + 2 + _j)))]
-_esc_delay = _esc_fires[0] - _RUNAWAY_AT if _esc_fires else None
-print(f"    budget spent by a benign episode, then a continuous runaway from "
-      f"t={_RUNAWAY_AT:.0f}s: first alarm at t={_esc_fires[0]:.0f}s "
-      f"(delay {_esc_delay:.0f}s)")
-check(f"⚠️ a SUSTAINED runaway speaks even when an earlier, unrelated episode "
-      f"spent the budget - it is not held for REASSERT_S ({_esc_delay:.0f}s "
-      f"delay, escalation is {SUSTAINED_CYCLES} cycles)",
-      _esc_delay is not None and _esc_delay < REASSERT_S / 2)
-check("...and it speaks at the escalation boundary rather than immediately, "
-      "which is what keeps the scattered flood suppressed",
-      _esc_delay >= 5.0 * (SUSTAINED_CYCLES - 1))
-
-# ⚠️ `last_alarm` SURVIVING THE DE-ASSERT IS NOW LOAD-BEARING, AND NOTHING
-# PINNED IT. Review built the mutation: if the de-assert path ALSO refreshed
-# `last_alarm = now`, the chatter case collapses from 50 notifications to 1 - the
-# alarm never fires again. That is the "alarm that never fires" class, which is a
-# different bug from one that fires later, and the suite was green on it.
-_starve = ClampWatchdog()
-_starve_fires = sum(1 for _i in range(1600)
-                    if _starve.note(_i % 4 == 0, "chatter",
-                                    T0 + timedelta(seconds=5.0 * _i)))
-print(f"    chatter 1-engaged/{CLEAR_CYCLES}-clean over 8000 s: "
-      f"{_starve.episodes} episodes, {_starve_fires} notification(s)")
-check(f"a de-assert does not RESET the notification budget, so repeated chatter "
-      f"cannot starve the alarm to silence ({_starve_fires} notifications over "
-      f"8000 s, not 1)",
-      _starve_fires > 10)
-
 # --- THE HYSTERESIS, PINNED AGAINST THE CHATTER DIRECTION --------------------
 # ⚠️ REVIEW-FOUND. This used to issue `range(CLEAR_CYCLES - 1)` clean cycles,
 # which at CLEAR_CYCLES = 1 issues ZERO of them and passes while printing

goodwe_controller/test_peakguard.py

@@ -109,7 +109,6 @@ import re
 import shutil
 import sys
 import tempfile
-import time
 from datetime import datetime, timedelta, timezone
 from math import inf, isinf
 from pathlib import Path
@@ -1063,58 +1062,6 @@ check("...and the status page says NOT COVERED rather than 'idle' or a green "
 # block with no seconds remaining - so the whole setup is retried on a fresh
 # Controller rather than left to flake. It is bounded at three attempts: a fourth
 # would mean something is wrong that is not a boundary.
-#
-# ⚠️⚠️ CI-06. AND THE QUARTER MUST HAVE ROOM LEFT TO SIZE A FIXTURE IN, WHICH IS
-# A SECOND AND MUCH WIDER RACE THAN THE BOUNDARY ONE ABOVE. It is where three of
-# this file's four known-flaky checks came from, and it is not a boundary
-# effect - it is the control law's own gain applied to this helper's arithmetic.
-#
-# Every second of the open block the telegrams do NOT cover is credited at the
-# HELD value instead of the measured one, so the projection loses `net_w x
-# uncovered / 900` W - and `excess = 900 x (projected - ceiling) / remaining`
-# multiplies that back up by `900 / remaining`. The floor this helper delivers
-# is therefore
-#
-#     floor ~ want x (1 - uncovered/900) - net_w x uncovered / remaining
-#
-# and the second term is the whole story: at 600 s left one uncovered second
-# costs 6 W of a 1500 W floor, at 12 s left it costs 292 W, and at 3 s left it
-# takes the projection under the ceiling and THE GUARD DOES NOT ENGAGE AT ALL -
-# which fails "the real cycle files the peak claim", "...and the number written
-# to the inverter is the guard's floor" and "the STATUS PAGE row for a
-# floor-limited guard" together, for no reason except the minute the suite ran.
-# Measured on this tree as shipped: at 12 s left the fixture asked for 1500 W
-# and delivered 613 W, a -59 % fixture that stayed green and graded a different
-# site than the one its text names.
-#
-# TWO uncovered stretches produced it and both are closed here:
-#
-#   1. THE TAIL. `range(0, span + 1, 5)` stops at the last 5 s mark at or before
-#      `now`, so 0-5 s of the block were never covered by construction. One
-#      final telegram stamped at `now` closes it - which is also what a real
-#      meter does, and what this helper's own docstring already claims it does.
-#   2. THE LAG between that last telegram and `cycle()`'s own `datetime.now()`.
-#      That one is real work and cannot be removed, only bounded: measured at
-#      12-96 ms over 23 fixtures on this tree under contention.
-#
-# So the ROOM the helper needs is derived from what it promises rather than
-# picked. Requiring the delivered floor to be within 1 % of the floor asked for,
-# at the shipped ceiling and this file's smallest fixture (`net_w` ~ 3500 W,
-# `want` 1500 W), and taking the lag at 0.1 s - past every one of the 23
-# measurements:
-#
-#     net_w x lag / (remaining x want) <= 0.01 - lag/900
-#     remaining >= 3500 x 0.1 / (1500 x 0.00989) = 23.6 s  ->  FIXTURE_ROOM_S
-#
-# Below that the helper WAITS OUT THE REST OF THE QUARTER rather than grading a
-# fixture the arithmetic cannot deliver. The wait is at most FIXTURE_ROOM_S and
-# is taken on about 2.6 % of runs; a suite that silently graded a -59 % fixture
-# instead was the alternative. ⚠️ This is not a widened tolerance - the checks
-# downstream are unchanged and the 1 % is a requirement on the FIXTURE, not on
-# any assertion.
-FIXTURE_ROOM_S = 24.0
-
-
 def wired_over_limit(db, want_floor_w, opts=None, store=None, batt_w=0.0,
                      standing_w=None, soc=55.0, prepare=None):
     """A real Controller driven one real cycle over a real over-limit quarter.
@@ -1134,13 +1081,6 @@ def wired_over_limit(db, want_floor_w, opts=None, store=None, batt_w=0.0,
     computed backwards from `remaining` at the moment of the run.
     """
     for attempt in range(4):
-        # ⚠️ ROOM FIRST, AND BEFORE THE CONTROLLER IS BUILT. See FIXTURE_ROOM_S.
-        # Retrying does not help here - four attempts take ~40 ms each and all
-        # four would land in the same dying quarter - so the tail of the block
-        # is waited out once, which puts the next attempt at ~900 s of room.
-        _room = QUARTER_S - (datetime.now(timezone.utc).timestamp() % QUARTER_S)
-        if _room < FIXTURE_ROOM_S:
-            time.sleep(_room + 0.05)
         ctl, hs = built(db if attempt == 0 else Path(f"{db}.{attempt}"), opts,
                         store=_Store(store) if store is not None else None)
         ctl.auto, ctl.soc, ctl.batt = True, soc, batt_w
@@ -1159,13 +1099,6 @@ def wired_over_limit(db, want_floor_w, opts=None, store=None, batt_w=0.0,
         net_w = CAP_W + want_floor_w * remaining / QUARTER_S
         for i in range(0, span + 1, 5):
             ctl.p1.submit(sample(blk + timedelta(seconds=i), net_w))
-        # ⚠️ AND ONE TELEGRAM AT `now` ITSELF. The averager credits a sample's
-        # value over the interval to the NEXT sample, so without this the block
-        # is covered only to the last 5 s mark and 0-5 s of it are extrapolated
-        # from the held value. See the header: at 12 s of remaining that alone
-        # turned a 1500 W fixture into a 613 W one. A real meter does not stop
-        # sending at the last multiple of five either.
-        ctl.p1.submit(sample(now, net_w))
         # ⚠️ ASSIGNED, not read back from `p1.net_w`. This helper stamps
         # `ingest_mono` with an epoch second so the averager (which keys on
         # `ingest_ts`) replays correctly, while `net_w` keys on a MONOTONIC age
@@ -1340,23 +1273,6 @@ _shipped_decide = peakguard.decide
 
 def _recording_decide(projection, **kw):
     _seen.update(kw)
-    # ⚠️ CI-06. THE PROJECTION OBJECT ITSELF IS KEPT, AND THAT IS WHAT MAKES THE
-    # COMPARISON BELOW A COMPARISON RATHER THAN A RACE. The check under
-    # "THE CONSEQUENCE, ITERATED" says both forms are run "against the same
-    # frozen projection", and until this line existed that sentence was FALSE:
-    # the intent form was decided against a SECOND `PeakTracker.project(
-    # b3.p1.averager, datetime.now())` taken after the cycle had returned, so
-    # the two numbers came from two different instants of the wall clock. The
-    # control law is `excess = 900 x (projected - ceiling) / remaining`, whose
-    # derivative in time is `excess / remaining`, so at a 1500 W floor the two
-    # instants separated at 1500 / remaining W per second and the check's 1.5 W
-    # tolerance bought exactly `remaining / 1000` SECONDS - 900 ms at the top of
-    # a quarter and 6 ms with ten seconds left of it. Measured on this tree, the
-    # gap between the two statements is 13-40 ms idle and larger under load, so
-    # the check was answered by WHERE IN THE QUARTER IT RAN about `gap_ms / 900`
-    # of the time. Keeping the object removes the clock from the comparison
-    # altogether: the tolerance below is EXACT, not widened.
-    _seen["projection"] = projection
     return _shipped_decide(projection, **kw)
 
 
@@ -1378,36 +1294,15 @@ check("B3: main.py sizes the floor from the MEASURED battery power, not from "
 # against the same frozen projection - the inverter never follows, so the meter
 # never moves - and the two are allowed to separate over time rather than being
 # judged at a single point where they need not differ.
-#
-# ⚠️ CI-06. "THE SAME FROZEN PROJECTION" IS NOW THE SAME OBJECT. `_proj3` is the
-# `Projection` the real cycle actually graded, captured by `_recording_decide`
-# above, and not a second projection of the same averager taken at a later
-# `datetime.now()`. Every number below therefore comes from ONE instant, and the
-# tolerances that used to absorb the wall clock are gone.
-_proj3 = _seen["projection"]
+_proj3 = PeakTracker.project(b3.p1.averager, datetime.now(timezone.utc))
 _kw = dict(cap_w=CAP_W, reading=b3.peak.peak(), achievable_w=LIVE_MAX_W,
            max_hold_s=b3.p1.averager.max_hold_s, soc=SOC_OK,
            soc_floor=SOC_FLOOR)
 _intent = _shipped_decide(_proj3, batt_w=STANDING, **_kw)
-# The delivered form, re-decided from the SAME projection. It has to reproduce
-# the real controller's own floor EXACTLY or `_kw` is not the call main.py
-# makes - which is a second thing this now grades and did not before, and the
-# one that keeps the identity below honest rather than self-referential.
-_delivered = _shipped_decide(_proj3, batt_w=0.0, **_kw)
-check("the delivered form re-decided from the cycle's OWN projection is the "
-      "number the real Controller wrote, to the bit. The kwargs below are "
-      "main.py's call and not an approximation of it, so the identity that "
-      "follows is a statement about `decide()` and not about this fixture",
-      near(_delivered.floor_w, b3.peak_guard.floor_w))
 check("one cycle of the intent form is exactly the delivered form plus the "
       "command standing on the wire - which is the whole defect in one line: "
-      "watts that were asked for and never arrived, counted as if they had. "
-      "⚠️ EXACT, not within 1.5 W: both forms are decided from one Projection "
-      "object, so a tolerance here would only be hiding a clock. CI-06 - the "
-      "1.5 W it used to carry bought `remaining / 1000` seconds and made this "
-      "line answer by where in the quarter the suite happened to run",
-      near(_intent.floor_w - _delivered.floor_w, STANDING)
-      and not _intent.saturated and not _delivered.saturated)
+      "watts that were asked for and never arrived, counted as if they had",
+      near(_intent.floor_w - b3.peak_guard.floor_w, STANDING, 1.5))
 
 _i_cmd, _d_batt = STANDING, 0.0
 _i_track, _d_track, _i_sat_at = [], [], None

goodwe_controller/test_watchdog.py

@@ -1993,6 +1993,564 @@ check("...and the counterfactual again: the same site with nothing latched "
       not _bn_n["banner"].startswith("FAILSAFE")
       and _bn_n["banner"] != _bn_b["banner"])
 
+
+print()
+print("9. SAFETY-38: `site_standing` - the ONE quantity BOTH site guards are")
+print("   asked about - pinned by shares that CANNOT answer for it")
+# ⚠️ WHAT THIS SECTION PINS, AND WHY NOTHING ABOVE IT COULD.
+# `main.py`'s `site_standing = float(sum(standing.values()))` is the first
+# argument of SAFETY-30's site sign detector AND the `commanded_w` handed to
+# SAFETY-18's `looks_frozen()`. It was pinned by NOTHING. THREE mutations of it
+# were demonstrated live against a full green suite, and ALL THREE ARE COVERED
+# HERE:
+#
+#     sum(...) / max(1, len(standing))    the MEAN
+#     max(standing.values(), key=abs)     the LARGEST SHARE
+#     list(standing.values())[0]          the FIRST SHARE
+#
+# ⚠️ ROUND 1 OF THIS CARD SAID THE THIRD ONE WAS ALREADY CLOSED BY SAFETY-32's
+# PACKAGE-WIDE STRUCTURAL PIN AND TOLD FUTURE AUTHORS "DO NOT RE-COVER THAT ONE
+# HERE". THAT WAS FALSE, AND HOW IT BECAME FALSE IS THE USEFUL PART. It was
+# measured ONCE; that single run happened to hit test_peakguard.py's ~20%
+# CI-06 flake, the red was recorded as a mutation KILL, and the claim was then
+# written into four places. RE-MEASURED IN ROUND 2, on release/1.0 @ 86eaef2
+# carrying ONLY the `[0]` edit (+4 bytes, re-read from disk): the full suite is
+# 21/21 GREEN, and test_peakguard.py run FIVE times in isolation on that same
+# mutated tree is PASS PASS PASS PASS PASS. The mutation SURVIVES. (The
+# reviewer's own independent re-measurement of the same tree caught the flake
+# once - PASS PASS PASS FAIL PASS - which is the same verdict: a survivor, plus
+# a demonstration of the flake that produced the original error.) A SINGLE RED
+# FROM test_peakguard.py PROVES NOTHING - re-run it at least five times and NAME
+# the failing check before believing it. That rule is CI-06's, and this card is
+# the third measurement it has corrupted.
+#
+# THE MECHANISM, confirmed by reading 12j's own enumeration rather than by
+# argument. SAFETY-32's part 12j taints names BOUND to roster-carrying values
+# and lists ACCUMULATED in a loop over one. `standing` is neither: it is a dict
+# created empty at main.py:1554 and filled by SUBSCRIPT assignment
+# (`standing[inv.name] = stood`) inside the roster loop, and a subscript store
+# is not a binding 12j follows. So `standing` never enters its taint set at all,
+# and `sum(standing.values())` is not a roster site. Run 12j on a tree carrying
+# the `[0]` mutation and it enumerates main.py:1553, 1555 and 1690 - the three
+# `self.inverters` sites around this code - and NOT 1599. A structural pin
+# cannot see this line. Only the behavioural fixture below can.
+#
+# Identical shape, different meaning - which is precisely the blind spot
+# SAFETY-32 disclosed in its own words ("SEMANTICS. `min` -> `max` -> the mean
+# are edits invisible to any shape pin, permanently"). No shape pin will ever
+# close them. Only a behavioural fixture can, and this is it.
+#
+# ⚠️ WHY PART 5 ABOVE CANNOT SEE THEM, AND IT IS THIS REPOSITORY'S RECURRING
+# DEFECT INSIDE THE SITE HALF OF THE VERY CARD THAT NAMES IT. `_sign_site` is
+# the only N>=2 site fixture in the suite and it runs at
+# `site_sign_disagree_w: 320` with shares of about -2500 W EACH - every one of
+# them individually far OVER the gate. On values like those the sum, the mean
+# and the largest share all clear it, so all three reductions agree, and a
+# check whose two candidate answers happen to be EQUAL cannot observe a change
+# that swaps them. MUTATION.md habit 4. At a roster of ONE it is worse: there
+# `sum == mean == max == the one share` identically, so every mutation is
+# EQUIVALENT there - see 9c, where that identity is asserted rather than
+# assumed.
+#
+# ⚠️ SO THE NUMBERS BELOW ARE CHOSEN TO DISCRIMINATE, AND HERE IS THE
+# ARITHMETIC THEY ARE CHOSEN FOR. Two simulated units rated 220 W and 280 W
+# stand at their own rails, so `standing` is {-220, -280} in roster order:
+#
+#     sum                 -500 W   |500| > 300   OVER the gate   -> TRIPS
+#     mean                -250 W   |250| < 300   under it        -> silent
+#     max(..., key=abs)   -280 W   |280| < 300   under it        -> silent
+#     list(...)[0]        -220 W   |220| < 300   under it        -> silent
+#
+# FOUR DISTINCT MAGNITUDES - 500, 250, 280, 220 - of which exactly ONE clears
+# the SHIPPED 300 W gate. The asymmetry is load-bearing twice over: equal
+# shares would collapse mean, max and first onto one number and the fixture
+# could not tell them apart, and putting the SMALLER unit first is what keeps
+# `[0]` distinct from `max(key=abs)`.
+#
+# ⚠️ THE RATINGS ARE SIMULATED AND ARE NOT ANY REAL INVERTER'S. 220 W and 280 W
+# are chosen for the arithmetic in that table and for nothing else. In
+# particular they are NOT inverter B, which does not physically exist; B's
+# rating is 4600 W FROM ITS DATASHEET (goodwe/NOTES.md 1.1b) and no number in
+# this section is a measurement of anything.
+#
+# ⚠️ THE GATE IS THE SHIPPED ONE AND THE HOLD IS NOT. `site_sign_disagree_w` is
+# left at its default so this fixture is graded against the magnitude an
+# install actually runs; `site_sign_disagree_s` is shortened from 325 s to 2 s
+# because the hold is a wall clock and the campaign behind 325 s is measured on
+# the rig, not here. The gate is the coordinate this section is about.
+from app import peakguard as _pg38                                 # noqa: E402
+from app.freeze import rail_w as _rail_w38                         # noqa: E402
+from app.p1 import P1Sample as _P1Sample38                         # noqa: E402
+import time as _time38                                             # noqa: E402
+
+_S38_A_W, _S38_B_W = 220.0, 280.0     # SIMULATED. See the note above.
+_S38_LOAD_W = 2000.0
+_S38_FROZEN_METER_W = 2500.0
+
+
+def _s38_roster(*ratings):
+    """A CFG-04 `inverters:` roster, which is the shape an N>=2 install runs.
+
+    ⚠️ NOT `_sign_site`'s "build one from the flat keys and append a second".
+    `Controller.__init__` builds `Tuning` FROM the roster - `max_w=site_max_w` -
+    so a unit appended afterwards leaves the site loop bounded at ONE unit's
+    rating. That is harmless where part 3 uses it and fatal here: the whole
+    fixture is a site command standing at the ROSTER's rail.
+    """
+    return [{"name": name, "setpoint_entity": f"number.sp_{tag}",
+             "soc_entity": f"sensor.soc_{tag}", "batt_entity": f"sensor.batt_{tag}",
+             "max_w": w, "bms_soc_floor": 10}
+            for name, tag, w in zip(("inverter-a", "inverter-b", "inverter-c"),
+                                    ("a", "b", "c"), ratings)]
+
+
+class _S38Plant:
+    """Units that obey INSTANTLY and a meter that is `load - sum(measured)`.
+
+    The same modelling choice part 3 makes and for the same reason: an instant
+    plant removes the one mechanism that could make an obedient unit look
+    disobedient, so what remains to be graded is the ATTRIBUTION.
+    """
+
+    def __init__(self, load_w=_S38_LOAD_W):
+        self.load_w = float(load_w)
+        self.writes = []
+        self.calls = []
+        self.ctrl = None
+
+    async def call(self, domain, service, data):
+        self.calls.append((domain, service, data))
+
+    async def limits(self, entity):
+        return None
+
+    def measured(self):
+        if self.ctrl is None:
+            return []
+        return [float((i.last_write if i.last_write is not None else i.target) or 0.0)
+                for i in self.ctrl.inverters]
+
+    async def number(self, entity, invert=False):
+        m = self.measured()
+        if entity == "sensor.grid":
+            return self.load_w - sum(m)
+        for i, tag in enumerate(("a", "b", "c")):
+            if entity == f"sensor.soc_{tag}":
+                return 50.0
+            if entity == f"sensor.batt_{tag}":
+                return m[i] if i < len(m) else None
+        return None
+
+    async def set_number(self, entity, value):
+        self.writes.append((entity, float(value)))
+        return True
+
+
+def _s38_ctrl(hass, ratings, store=None, **over):
+    opts = {"meter_entity": "sensor.grid", "meter_source": "off",
+            "inverters": _s38_roster(*ratings),
+            "gain": -0.6,
+            # The per-unit pair, distinct from the site pair in BOTH
+            # coordinates, for part 3's reason: an equality below must be able
+            # to fail on the magnitude alone or on the hold alone.
+            "unit_sign_disagree_w": 250, "unit_sign_disagree_s": 1,
+            # ⚠️ `site_sign_disagree_w` DELIBERATELY ABSENT - the shipped 300 W
+            # default is the gate this whole section is graded against.
+            "site_sign_disagree_s": 2,
+            # SAFETY-31 is given a long window so the SITE is not stopped by
+            # circulation while this section grades the sign attribution. It is
+            # isolation, not a claim that SAFETY-31 is silent here.
+            "circulation_hold_s": 3600, "auto_start": True}
+    opts.update(over)
+    c = Controller(opts, hass, store if store is not None else _MemStore(),
+                   _P(), stop=asyncio.Event())
+    for inv in c.inverters:
+        inv.dev_min, inv.dev_max = -inv.max_w, inv.max_w
+    c.auto = True
+    hass.ctrl = c
+    return c
+
+
+def _s38_stood(c):
+    return [inv.last_write if inv.last_write is not None else inv.target
+            for inv in c.inverters]
+
+
+print()
+print("9a. the SITE sign detector: per-unit shares EACH BELOW the gate whose")
+print("    SUM clears it - the case the site detector exists for")
+
+
+async def _s38_site():
+    hass = _S38Plant()
+    c = _s38_ctrl(hass, (_S38_A_W, _S38_B_W))
+    seen = []
+    for _ in range(20):
+        await c.read_inputs()
+        await c.cycle()
+        seen.append(dict(grid=c.grid, stood=_s38_stood(c),
+                         meas=[i.batt for i in c.inverters],
+                         site=c.site_sign_wd.tripped,
+                         units=[i.sign_wd.tripped for i in c.inverters],
+                         following=c.following))
+        await asyncio.sleep(0.2)
+    return c, seen
+
+
+_c38, _s38seen = asyncio.run(_s38_site())
+# The last sample BEFORE the trip, named rather than indexed - part 5's lesson.
+# After the trip every command is 0 W, so a fixed index reads the REMEDY.
+_pre38 = [x for x in _s38seen if not x["site"]]
+_mid38 = _pre38[-1]
+_GATE38 = _c38.site_sign_wd.cfg.min_w
+_share38 = list(_mid38["stood"])
+_red38 = {"sum": sum(_share38),
+          "mean": sum(_share38) / max(1, len(_share38)),
+          "max(key=abs)": max(_share38, key=abs),
+          "[0]": _share38[0]}
+print(f"       last cycle before the trip: stood "
+      f"{[round(x) for x in _share38]}  measured "
+      f"{[round(x) for x in _mid38['meas']]}  meter {_mid38['grid']:+.0f} W")
+print(f"       site gate {_GATE38:.0f} W (SHIPPED default), hold "
+      f"{_c38.site_sign_wd.cfg.hold_s:.0f} s")
+for _k, _v in _red38.items():
+    print(f"         {_k:>13} = {_v:+7.1f} W   "
+          f"{'OVER' if abs(_v) > _GATE38 else 'under'} the gate")
+check("PRECONDITION: the gate really is the SHIPPED 300 W, so this fixture is "
+      "graded against the magnitude an install runs and not against a number "
+      "chosen to make it pass",
+      _GATE38 == float(SIGN_OPTION_DEFAULTS["site_sign_disagree_w"]) == 300.0)
+check("⚠️ PRECONDITION, AND IT IS THE WHOLE OF SAFETY-38. EVERY per-unit share "
+      "is BELOW the site gate and their SUM is OVER it. `_sign_site` above "
+      "cannot make this statement - its shares are each individually over the "
+      "gate, so sum, mean and largest-share all agree there and its values "
+      "cannot observe a change that swaps them",
+      len(_share38) >= 2
+      and all(abs(s) < _GATE38 for s in _share38)
+      and abs(sum(_share38)) > _GATE38)
+check("...and the FOUR candidate reductions give FOUR DISTINCT answers on it, "
+      "of which exactly ONE clears the gate. That is what makes this fixture "
+      "able to tell `sum` from the mean, from the largest share and from the "
+      "first share - and it is the property the existing site fixture lacks",
+      len({round(v, 6) for v in _red38.values()}) == 4
+      and [k for k, v in _red38.items() if abs(v) > _GATE38] == ["sum"])
+check("PRECONDITION: EVERY inverter is obeying - each unit's measured power "
+      "agrees in sign with its own share - and the site is charging into an "
+      "importing house. Without this the trip below could be a per-unit fault "
+      "in disguise rather than the site fault this grades",
+      all(s * m > 0 for s, m in zip(_mid38["stood"], _mid38["meas"]))
+      and sum(_mid38["stood"]) * _mid38["grid"] < 0
+      and _mid38["following"] is True)
+check("⚠️ THE SITE WATCHDOG TRIPS ON THE SUM, and no per-unit watchdog does. "
+      "Under ALL THREE semantic mutations - `sum -> mean`, "
+      "`sum -> max(key=abs)` AND `sum -> list(...)[0]` - NOTHING trips, ever: "
+      "the reviewer's tree was still commanding -500 W of charge into a "
+      "+2500 W import at t = 595 s with following=True. This is the check all "
+      "three go red on. `[0]` is here BECAUSE IT IS NOT COVERED ELSEWHERE - "
+      "see the section header for the mis-measurement that said it was",
+      _c38.site_sign_wd.tripped
+      and not any(i.sign_wd.tripped for i in _c38.inverters))
+print(f"       {_c38.site_sign_wd.reason!r}")
+check("⚠️ ...and the sentence an operator reads carries THE SUM IN THE "
+      "COMMANDED SLOT AND THE METER IN THE METER SLOT - the ORDERED PAIR, not "
+      "two numbers loose in a sentence. ROUND 1 ASSERTED `f'{sum(...):.0f} W' "
+      "in reason`, i.e. that '-500 W' appears SOMEWHERE, AND THAT WAS A HOLE "
+      "ONE LINE WIDE. Swapping the detector's first two arguments - "
+      "`evaluate(site_standing, self.grid, ...)` -> "
+      "`evaluate(self.grid, site_standing, ...)`, a ZERO-BYTE edit at "
+      "main.py:1620 - leaves BOTH numbers in the string and moves each into "
+      "the other's slot, so the substring test still passed and the whole "
+      "suite stayed green. The swapped banner reads 'commanded +2500 W "
+      "against a meter reading -500 W': the site is standing at -500 W of "
+      "charge INTO a +2500 W import and the latching, site-stopping banner "
+      "tells the operator the exact opposite, on the one line somebody woken "
+      "by this alarm reads first. watchdog.py:658-665 calls naming the wrong "
+      "instrument there 'a false statement about which instrument produced "
+      "the evidence'. A check whose data cannot reach the failure it names is "
+      "MUTATION.md's own defect; this is the line that closes it",
+      f"commanded {sum(_share38):+.0f} W against a meter reading "
+      f"{_mid38['grid']:+.0f} W" in _c38.site_sign_wd.reason)
+check("...and it stops the WHOLE site, through the `sign_site` claim by name "
+      "rather than by some other guard happening to stop it",
+      _c38.target == 0.0 and "sign_site" in _c38.reason
+      and all(i.target == 0.0 for i in _c38.inverters)
+      and _c38.store.data.get("site_sign_tripped") is True)
+# ⚠️ THE COUNTERFACTUAL, and it is what says the check above is produced by the
+# SUM crossing the gate rather than by two inverters being present. Same plant,
+# same roster shape, same everything - except the units are rated so that the
+# sum lands UNDER the gate. Nothing may trip.
+_S38_SMALL = (120.0, 130.0)          # sum 250 W: under the 300 W gate
+
+
+async def _s38_under():
+    hass = _S38Plant()
+    c = _s38_ctrl(hass, _S38_SMALL)
+    for _ in range(20):
+        await c.read_inputs()
+        await c.cycle()
+        await asyncio.sleep(0.2)
+    return c
+
+
+_c38u = asyncio.run(_s38_under())
+print(f"       counterfactual: stood {[round(x) for x in _s38_stood(_c38u)]}  "
+      f"sum {sum(_s38_stood(_c38u)):+.0f} W  meter {_c38u.grid:+.0f} W")
+check("...and the counterfactual: the SAME inverted-gain site whose shares sum "
+      "to 250 W - under the gate - does NOT trip, over the same 20 cycles. So "
+      "the trip above is the sum crossing 300 W and not the mere presence of a "
+      "second inverter",
+      abs(sum(_s38_stood(_c38u))) < _GATE38
+      and not _c38u.site_sign_wd.tripped
+      and not any(i.sign_wd.tripped for i in _c38u.inverters))
+# ⚠️ AND A SECOND COUNTERFACTUAL, WHICH EXISTS BECAUSE OF A MUTATION THE CHECKS
+# ABOVE COULD NOT SEE AND THIS SEARCH WENT LOOKING FOR.
+# `site_standing = float(self.target)` - the arbiter's SITE TARGET instead of
+# the sum of what actually stands on the wire - is -11 bytes, and it survived
+# every check above AND the whole 20-file suite, because in every fixture so
+# far the two are the same number. THEY ARE NOT THE SAME NUMBER when a setpoint
+# device's own reported range is narrower than its `max_w`: the `device`
+# P_SAFETY claim is filed PER ACTUATOR (main.py, `actuator_of("device", inv)`),
+# so it bounds each unit's SHARE and never the site target, and
+# `clamp_to_rating()` clips again on the way out. Here the site asks for -500 W
+# and -250 W stands.
+#
+# WHICH ONE THE GUARDS MEAN IS ALREADY WRITTEN DOWN, IN BOTH OF THEM: SAFETY-02
+# grades "the command standing on the wire", and `looks_frozen()`'s docstring
+# says `commanded_w` is "the EMITTED setpoint - what the arbiter resolved and
+# `write_setpoint()` put on the wire - not the loop's raw wish". SAFETY-20 is
+# the whole card about the difference. This check is those sentences made to
+# bite: on the site target the detector fires on a site that is standing at
+# -250 W against a +2250 W meter - under its own 300 W gate - which is a
+# LATCHING, site-stopping false trip on an install whose inverters simply
+# report a narrower range than the operator typed.
+_S38_DEV = (120.0, 130.0)          # narrower than the 220/280 W ratings
+
+
+async def _s38_devclamped():
+    hass = _S38Plant()
+    c = _s38_ctrl(hass, (_S38_A_W, _S38_B_W))
+    for inv, d in zip(c.inverters, _S38_DEV):
+        inv.dev_min, inv.dev_max = -d, d
+    for _ in range(20):
+        await c.read_inputs()
+        await c.cycle()
+        await asyncio.sleep(0.2)
+    return c
+
+
+_c38d = asyncio.run(_s38_devclamped())
+_stood38d = _s38_stood(_c38d)
+print(f"       device-clamped: site target {_c38d.target:+.0f} W but only "
+      f"{[round(x) for x in _stood38d]} = {sum(_stood38d):+.0f} W stands, "
+      f"meter {_c38d.grid:+.0f} W")
+check("PRECONDITION: the site TARGET and the EMITTED total are DIFFERENT "
+      "numbers here, on opposite sides of the gate - -500 W asked, -250 W "
+      "standing. Without that separation this check and the one above compare "
+      "two values that happen to be equal, which is the defect this card is "
+      "the sixth instance of",
+      abs(_c38d.target) > _GATE38 and abs(sum(_stood38d)) < _GATE38)
+check("⚠️ ...and NOTHING TRIPS, because the quantity graded is what STANDS ON "
+      "THE WIRE and not what the arbiter asked for. `float(self.target)` is "
+      "-11 bytes, survives the other 20 files, and turns this ordinary "
+      "narrow-rating install into a latching site-wide false trip",
+      not _c38d.site_sign_wd.tripped
+      and not any(i.sign_wd.tripped for i in _c38d.inverters)
+      and _c38d.target != 0.0)
+
+
+print()
+print("9b. THE SECOND CONSUMER: the same value is SAFETY-18's `commanded_w`")
+print("    inside `looks_frozen()`, and both mutations blind it too")
+# ⚠️ THIS IS THE AC THE CARD REFUSES TO LET BE SCOPED OUT SILENTLY.
+# `site_standing` is handed to `looks_frozen()` at main.py's `peakguard.decide(
+# ..., frozen=...)` call, where it is the EMITTED command graded against the
+# site rail. Both surviving mutations shrink it there too, and nothing went red.
+#
+# THE RAIL ARITHMETIC, and it is the same discrimination as 9a at a different
+# threshold: the site rail is `RAIL_FRAC * site_max_w` = 0.95 * 500 = 475 W.
+#
+#     sum                 500 W   >= 475   RAILED  -> BLIND_FROZEN, floor 0 W
+#     mean                250 W   <  475   silent
+#     max(..., key=abs)   280 W   <  475   silent
+#     list(...)[0]        220 W   <  475   silent
+#
+# ⚠️ THE SIGN IS FLIPPED FROM 9a ON PURPOSE. Here the gain is the SHIPPED
+# POSITIVE one and the frozen meter reads IMPORT, so the site discharges +500 W
+# against a +2500 W import - the two agree in sign, SAFETY-30 has nothing to
+# say, and this section grades SAFETY-18 alone. Reusing 9a's inverted gain
+# would have the site sign latch park everything at 0 W and the freeze
+# conjunction could then never be true: a check measuring the other guard's
+# remedy.
+#
+# WHAT THE MUTATIONS COST HERE, measured rather than asserted: on the shipped
+# tree the guard goes blind and files `floor_w = 0.0` - "the battery may not
+# import while the billed quarter cannot be measured". Under both mutations it
+# is NOT BLIND AT ALL and files `floor_w = None`, so the site may go on
+# charging through a quarter whose billed average is unobservable. That is the
+# capacity-tariff hazard SAFETY-18 exists for, silently disarmed.
+
+
+class _S38Src:
+    """The transport's own `unchanged_s`, which only homewizard_local has."""
+
+    def __init__(self, unchanged_s):
+        self.unchanged_s = float(unchanged_s)
+
+
+def _s38_feed(c, w, ts=None, mono=None):
+    now = ts if ts is not None else datetime.now(timezone.utc)
+    c.p1.submit(_P1Sample38(
+        ingest_ts=now,
+        ingest_mono=mono if mono is not None else _time38.monotonic(),
+        telegram_ts=now, source="homewizard_local",
+        import_w=max(w, 0.0), export_w=max(-w, 0.0), net_w=w,
+        per_phase_w=(w,), per_phase_import_w=(max(w, 0.0),)))
+
+
+def _s38_seed_quarter(c, w):
+    """Backfill the OPEN quarter with the same stuck value, at 10 s spacing.
+
+    ⚠️ THIS IS NOT DECORATION. Without it the open block is mostly uncovered and
+    `blindness()` answers BLIND_COVERAGE - which is still blind, still floor
+    0 W, and would therefore MASK the mutations: the mutant would reach the
+    same action by a different route and a check on the action alone could not
+    see the difference it names. Seeded, the mutant is not blind at ALL, which
+    is the honest measurement of what the mutation costs. A meter that has been
+    stuck at the same reading all quarter is also what SAFETY-18 is about.
+    """
+    wall = _time38.time()
+    q0 = (int(wall) // 900) * 900
+    mono0 = _time38.monotonic() - (wall - q0)
+    t = float(q0)
+    while t < wall:
+        _s38_feed(c, w, datetime.fromtimestamp(t, timezone.utc), mono0 + (t - q0))
+        t += 10.0
+
+
+def _s38_frozen_ctrl(hass, ratings, unchanged_s=600.0, gain=0.05):
+    # ⚠️ `gain` 0.05 IS THE SCHEMA FLOOR AND IT IS HERE TO BUY A RAMP. At the
+    # shipped 0.6 the loop is at the rail on cycle 0 and the fixture has no
+    # BELOW-the-rail cycles to use as its counterfactual. At 0.05 the site
+    # climbs 125 W a cycle and crosses 475 W part way through the run, so the
+    # SAME run carries both answers.
+    c = _s38_ctrl(hass, ratings, meter_source="homewizard_local",
+                  p1_host="meter.local", gain=gain)
+    c.p1_source = _S38Src(unchanged_s)
+    return c
+
+
+async def _s38_frozen(ratings, meter_w=_S38_FROZEN_METER_W, n=8):
+    hass = _S38Plant()
+    c = _s38_frozen_ctrl(hass, ratings)
+    _s38_seed_quarter(c, meter_w)
+    seen = []
+    for _ in range(n):
+        _s38_feed(c, meter_w)
+        await c.read_inputs()
+        await c.cycle()
+        pg = c.peak_guard
+        seen.append(dict(stood=_s38_stood(c),
+                         blind=None if pg is None else pg.blind,
+                         floor=None if pg is None else pg.floor_w))
+        await asyncio.sleep(0.05)
+    return c, seen
+
+
+_c38f, _s38f = asyncio.run(_s38_frozen((_S38_A_W, _S38_B_W)))
+_RAIL38 = _rail_w38(_c38f.site_max_w,
+                    dev_min=_c38f.site_dev_bound("dev_min"),
+                    dev_max=_c38f.site_dev_bound("dev_max"))
+_last38 = _s38f[-1]
+_below38 = [x for x in _s38f if abs(sum(x["stood"])) < _RAIL38]
+print(f"       site rail {_RAIL38:.0f} W of site_max_w {_c38f.site_max_w:.0f} W; "
+      f"meter stuck at {_S38_FROZEN_METER_W:+.0f} W for "
+      f"{_c38f.p1_source.unchanged_s:.0f} s (freeze hold "
+      f"{_c38f.freeze_wd.cfg.hold_s:.0f} s)")
+for _x in _s38f:
+    print("         stood %-16s sum %+7.1f W   floor=%s   blind=%r"
+          % ([round(v) for v in _x["stood"]], sum(_x["stood"]),
+             _x["floor"], _x["blind"]))
+check("PRECONDITION: at the rail EVERY per-unit share is BELOW the site rail "
+      "and their SUM is at or over it - the same discrimination as 9a, at "
+      "SAFETY-18's threshold instead of SAFETY-30's. `[0]`, the mean and the "
+      "largest share are 220, 250 and 280 W against a 475 W rail",
+      len(_last38["stood"]) >= 2
+      and all(abs(s) < _RAIL38 for s in _last38["stood"])
+      and abs(sum(_last38["stood"])) >= _RAIL38
+      and len({round(v, 6) for v in
+               (sum(_last38["stood"]),
+                sum(_last38["stood"]) / len(_last38["stood"]),
+                max(_last38["stood"], key=abs),
+                _last38["stood"][0])}) == 4)
+check("⚠️ THE PEAK GUARD GOES BLIND ON SAFETY-18's CONJUNCTION and forbids "
+      "charging - floor 0 W - because the SITE's total command is at the rail "
+      "while the meter has stopped moving. Under `sum -> mean` and "
+      "`sum -> max(key=abs)` it is not blind at all and files no floor, so the "
+      "battery may keep importing through an unmeasurable billed quarter. This "
+      "is the second consumer, and it is covered rather than scoped out",
+      _last38["blind"] == _pg38.BLIND_FROZEN and _last38["floor"] == 0.0)
+check("...and the counterfactual, from the SAME run: on the earlier cycles the "
+      "site command had not yet reached the rail, and the guard did NOT report "
+      "SAFETY-18 - with the meter equally frozen the whole time. So the "
+      "verdict is produced by the COMMAND MAGNITUDE `site_standing` carries, "
+      "not by `unchanged_s` alone",
+      len(_below38) >= 2
+      and all(x["blind"] != _pg38.BLIND_FROZEN for x in _below38))
+
+
+print()
+print("9c. AT ONE INVERTER NOTHING CHANGES, and 'nothing' is asserted")
+# ⚠️ THE REASON THIS SUBSECTION EXISTS. At a roster of one `standing` has a
+# single entry, so `sum`, the mean, `max(key=abs)` and `[0]` are THE SAME
+# NUMBER: all three mutations are genuinely EQUIVALENT there and no fixture at
+# N=1 can ever separate them. That is a fact about the arithmetic, and leaving
+# it implicit is how "the shipped install is covered" gets believed. It is
+# asserted here, on a real one-inverter controller's own standing command, so
+# the claim rests on the roster rather than on the reader.
+_S38_ONE = (500.0,)
+
+
+async def _s38_one():
+    hass = _S38Plant()
+    c = _s38_frozen_ctrl(hass, _S38_ONE)
+    _s38_seed_quarter(c, _S38_FROZEN_METER_W)
+    for _ in range(8):
+        _s38_feed(c, _S38_FROZEN_METER_W)
+        await c.read_inputs()
+        await c.cycle()
+        await asyncio.sleep(0.05)
+    return c
+
+
+_c38one = asyncio.run(_s38_one())
+_one38 = _s38_stood(_c38one)
+_onered38 = (sum(_one38), sum(_one38) / max(1, len(_one38)),
+             max(_one38, key=abs), _one38[0])
+print(f"       roster of {len(_c38one.inverters)}: stood "
+      f"{[round(v) for v in _one38]}  -> sum/mean/max/first = "
+      f"{tuple(round(v, 1) for v in _onered38)}")
+check("at a roster of ONE the four reductions are ONE NUMBER - so all three "
+      "mutations of `site_standing` are EQUIVALENT on a shipped install and no "
+      "N=1 fixture could ever tell them apart. That is why this card needed a "
+      "roster of two, stated as an assertion rather than left to the reader",
+      len(_c38one.inverters) == 1
+      and len({round(v, 6) for v in _onered38}) == 1)
+check("...and the one-inverter site still reaches SAFETY-18's verdict on that "
+      "same number, unchanged: the command is at the rail, the meter has "
+      "stopped moving, the guard is blind and forbids charging",
+      _c38one.peak_guard is not None
+      and _c38one.peak_guard.blind == _pg38.BLIND_FROZEN
+      and _c38one.peak_guard.floor_w == 0.0
+      and abs(sum(_one38)) >= _rail_w38(
+          _c38one.site_max_w,
+          dev_min=_c38one.site_dev_bound("dev_min"),
+          dev_max=_c38one.site_dev_bound("dev_max")))
+check("...and the SITE sign detector is still absent at a roster of one - part "
+      "7 counts the calls; this only records that a fixture built the other "
+      "way round, from an `inverters:` roster, reaches the same state",
+      not _c38one.site_sign_wd.tripped
+      and _c38one.site_sign_wd.disagree_since is None)
+
 print()
 if fails:
     print(f"{len(fails)} FAILED: {', '.join(fails)}")