Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 glenn schrooyenandClaude Opus 5
|
b6c6da31d8 | ||
|
glenn schrooyenandClaude Opus 5
|
b548525d10 | ||
 admin
|
68c5ede7b9 | ||
|
adminandClaude Opus 5
|
cb3f686555 | ||
|
admin
|
587495e143 | ||
|
glenn schrooyenandClaude Opus 5
|
e3ccd9f6ea | ||
|
admin
|
e6da478f87 |
+275
-29
@@ -1,34 +1,262 @@
|
||||
# Changelog
|
||||
|
||||
## Unreleased
|
||||
## 0.10.0
|
||||
|
||||
⚠️ **THIS HAS NO VERSION AND CANNOT REACH AN INSTALL UNTIL IT GETS ONE.**
|
||||
PKG-06's and PKG-07's rule: the Supervisor keys the built image by `version:`,
|
||||
so `ha apps update` is a silent no-op on an unbumped change. This branch
|
||||
deliberately does **not** pick the number, because the right one depends on a
|
||||
fact the branch cannot observe - whether 0.9.0's image has already been built
|
||||
and pulled. If it has not, this belongs inside 0.9.0's section before it ships;
|
||||
if it has, it needs 0.10.0. Whoever deploys decides.
|
||||
⚠️ **A CONFIG THAT IS LEGAL ON 0.9.0 IS REFUSED ON 0.10.0, AND THAT - NOT THE
|
||||
NUMBER OF TICKETS - IS WHY THIS IS A MINOR BUMP RATHER THAN A PATCH.** Same
|
||||
shape as 0.8.0's `slew_w` rule and the same test: is there a stored options
|
||||
blob the previous version started on and this one will not? There is. A refusal
|
||||
is `SystemExit(78)` (`EX_CONFIG`) - the add-on does not start, ⚠️ **and the
|
||||
ingress panel goes with it**, because the add-on serving it is not running, so
|
||||
recovery means the Supervisor UI.
|
||||
|
||||
Measured on the reference install's own exported blob (70 keys), merged over
|
||||
this version's 75 defaults the way the Supervisor merges it, inside the CI
|
||||
image. The three below are what a reader who checks only one thing should
|
||||
check.
|
||||
|
||||
* ⚠️ **[[TARIFF-07]] - THREE `price_provider` IDS ARE RETIRED, AND A SITE SET
|
||||
TO ONE OF THEM IS REFUSED BY NAME AT STARTUP.** `engie_dynamic`,
|
||||
`totalenergies_dynamic` and `eneco_eddy` are gone from `PROVIDERS`. Each was
|
||||
accepted, silently, at every startup on 0.9.0 and earlier; on 0.10.0 each is
|
||||
a refusal that names the id, the endpoint, what that endpoint actually
|
||||
answers - a 404 from a gateway with no route, a TLS handshake against a
|
||||
hostname the certificate does not cover, a 404 with an empty body - which
|
||||
tariff the site has really been running since the id was entered, and what to
|
||||
set instead. **The refusal IS the migration.** Every fetch any of the three
|
||||
ever made ended in `SourceUnavailable`, and §11.4 turns that into a SILENT
|
||||
fall back to the static profile, so there is no working behaviour to preserve
|
||||
and nothing on the status page ever differed from a provider that simply
|
||||
never found a cheap hour. ⚠️ **All three ids stay in `config.yaml`'s
|
||||
`price_provider` enum on purpose**: drop one and the Supervisor rejects the
|
||||
options file *before the add-on runs*, the operator gets an opaque `expected
|
||||
one of ...`, and `validate.py`'s message is never seen - on exactly the sites
|
||||
that need it. `PROVIDERS` is three; the enum is seven.
|
||||
⚠️ **The reference install is on `price_provider: off` and is unaffected.**
|
||||
|
||||
* **[[TARIFF-18]] - `price_taxes_eur_kwh` moves from `0.06` to `0.11736`, and
|
||||
the non-obvious half is the refusal that deliberately does NOT happen.** A
|
||||
site that *stored* `0.06` is unaffected in both directions. It keeps `0.06`,
|
||||
because `App.options` is `deepmerge(config.yaml defaults, stored options)`
|
||||
and a moved default reaches only keys the blob does not carry - so the new
|
||||
figure arrives at a **fresh** install, and at an existing one only when its
|
||||
options are re-saved. ⚠️ **AND IT DOES NOT BECOME A STARTUP REFUSAL EITHER,
|
||||
WHICH TOOK A MECHANISM.** [[TARIFF-17]] made a `price_taxes_profile` period
|
||||
table beside a **non-default** `price_taxes_eur_kwh` a refusal, comparing
|
||||
against the shipped default precisely because the Supervisor writes the key
|
||||
whether the operator typed it or not. Moving the default turns every stored
|
||||
`0.06` into "non-default" **with nobody editing anything**, so a working
|
||||
Walloon or Brussels site with a period table would have stopped starting on
|
||||
this upgrade, over an inert number the table overrides anyway.
|
||||
`price.py` carries `SUPERSEDED_TAXES_DEFAULTS_EUR_KWH = (0.06,)` and
|
||||
`validate.py` reads a superseded default as *untouched*. **The rung is not
|
||||
weakened**: the same table beside a figure that is neither the shipped nor a
|
||||
superseded default - ORES's `0.1198` - is still refused, by name, and the
|
||||
refusal now says which two figures it will accept.
|
||||
|
||||
* **[[SAFETY-10]] - a new `shadow_mode` option, shipped `auto`, and BOTH halves
|
||||
of what that does matter.** ⚠️ **AN EXISTING INSTALL THAT IS CONTROLLING DOES
|
||||
NOT CHANGE BY ONE WATT.** `auto` is not a constant the Supervisor merges; it
|
||||
is a value the add-on **resolves**, and it resolves to `not control_started`
|
||||
- `shadow.engaged()` reads `Controller.auto`, the persisted start/stop state.
|
||||
An install with `auto_start: true`, or whose operator has pressed *Start /
|
||||
stop control*, is started, so `auto` resolves to live. An install that is
|
||||
**stopped** keeps its actuator at 0 W exactly as before, from the same writer
|
||||
on the same heartbeat; what changes is what the status page says and that the
|
||||
decision path now runs and is recorded. ⚠️ **A FRESH INSTALL COMES UP
|
||||
OBSERVING**: it ships `auto_start: false`, has no stored `auto` key, and
|
||||
therefore runs its whole decision path in shadow before it is ever allowed to
|
||||
command anything. That is the "default-on" the card asked for, delivered
|
||||
where it is safe and withheld where it is not - there is no mechanism in the
|
||||
add-on options system by which one key can default differently for a new
|
||||
install and an existing one, so a literal `shadow_mode: true` default would
|
||||
have stopped the battery at the reference site on the next update.
|
||||
**Measured cross-revision** - the same stimulus through the shipped
|
||||
`Controller.cycle()` on `8f82dd4` (the merge before SAFETY-10) and on
|
||||
`e6da478` (SAFETY-10 itself), start button ON: the write streams are
|
||||
**byte-identical**, 13 / 13 / 25 writes on a 6000 W import, a 4000 W export
|
||||
and a 300 W trickle, same values in the same order. An install that is
|
||||
**stopped** is byte-identical across the same pair too, at one 0 W write.
|
||||
⚠️ The positive control is what makes that readable: the same driver with
|
||||
`shadow_mode: on` and the button ON gets 13 writes up to 5000 W on the older
|
||||
tree and **one 0 W write** on the newer, so the driver does reach shadow mode
|
||||
and an identical pair is a result rather than a silence. The shadow case is
|
||||
also graded in `test_clamp.py` part 8 on what reached `set_number()`, against
|
||||
a precondition run that puts 30 non-zero writes on the wire. ⚠️ An
|
||||
unrecognised `shadow_mode` fails toward inaction
|
||||
**and** is refused by name (rule 11), so the reinterpretation is never
|
||||
silent; no blob written before 0.10.0 can carry one.
|
||||
|
||||
⚠️ **AND IF YOU ARE UPGRADING FROM 0.7.0 - WHICH THE REFERENCE INSTALL IS -
|
||||
THE REFUSAL THAT CAN STOP YOU IS IN 0.8.0'S SECTION, NOT IN THIS ONE.** `ha
|
||||
addons update` does not walk the versions; it installs 0.10.0 in one step, so
|
||||
**every validator rule added in 0.8.0 and 0.9.0 lands at the same moment as
|
||||
0.10.0's own**, and a config that has not been looked at since 0.7.0 meets all
|
||||
of them at once. Of those, exactly one can refuse a config nobody has edited:
|
||||
|
||||
> [[SAFETY-39]]'s **rule 10**, added in 0.8.0, refuses an explicit `slew_w`
|
||||
> above `SLEW_RAIL_FRAC x` the site rail, where `SLEW_RAIL_FRAC` is
|
||||
> `LOOP_TICK_S / PLANT_SETTLE_S` = 2/18. On a 5000 W rail that ceiling is
|
||||
> **555.6 W** - and ⚠️ **0.7.0's own shipped default was `slew_w: 1000`**, so
|
||||
> an install that never touched the key and simply took the default does not
|
||||
> start on 0.10.0 until the value is lowered.
|
||||
|
||||
Measured on this tree: the reference blob with `slew_w: 1000` is refused, by
|
||||
name, and the same blob at its actual `slew_w: 400` is accepted. 0.9.0's own
|
||||
additions cannot reach a pre-0.9.0 config at all - [[OPT-09]]'s two refusals
|
||||
fire only on a roster entry that USES `capacity_kwh`, a key that did not exist
|
||||
- so 0.8.0's is the whole of the crossing. **Read the live options and check
|
||||
`slew_w` against the ceiling and `price_provider` against the withdrawn list
|
||||
BEFORE `ha addons update`**, with `tools/predeploy_check.py`, which does both.
|
||||
|
||||
✅ **RUN AGAINST THIS RELEASE: CLEARED, exit 0.**
|
||||
|
||||
docker run --rm -v <repo>:/w:ro -v <dir>:/opt:ro goodwe-addon-checks:1 \
|
||||
python3 /w/goodwe_controller/tools/predeploy_check.py \
|
||||
--deployed-version 0.7.0 --options /opt/live-options.json
|
||||
|
||||
deployed on the box : 0.7.0
|
||||
shipped in this tree: 0.10.0
|
||||
live options pass this version's validator
|
||||
CLEARED for deploy.
|
||||
|
||||
**The option surface: 71 keys -> 75, `options:` and `schema:` in step.** Four
|
||||
new keys, and none of them can refuse a blob written before it existed:
|
||||
`price_formula`, `price_export_formula` and `price_taxes_profile` are `str?` -
|
||||
**note the trailing `?`, they are OPTIONAL** - defaulting to `""`;
|
||||
`shadow_mode` is `list(auto|on|off)` with no `?`, which is the shape that
|
||||
becomes exit 78, and it is safe for the same reason 0.9.0's `delivery_hold_s`
|
||||
was: it carries an `options:` default, so the Supervisor's merge supplies it to
|
||||
every stored blob that lacks it. Nothing was removed. One default moved
|
||||
(`price_taxes_eur_kwh`, above) and one enum widened (`price_provider` gains
|
||||
`custom_formula`).
|
||||
|
||||
⚠️ **WHY 0.10.0 AND NOT 0.9.0, SINCE 0.9.0'S IMAGE NEVER REACHED THE BOX.**
|
||||
The block this section closes used to say the choice depended on whether
|
||||
0.9.0 had been built and pulled, and that if it had not, this work belonged
|
||||
*inside* 0.9.0's section. That was written before 0.9.0's section was cut. It
|
||||
has been cut since `86bdf49`, on 2026-09-07, and **28 runtime commits** have
|
||||
landed behind it; folding them in would make the string `0.9.0` name two
|
||||
different trees, and the Supervisor keys the built image on exactly that
|
||||
string. Reusing it is the PKG-06/PKG-07 no-op in its worst form - a cached
|
||||
image the Supervisor is entitled to serve while reporting success. The version
|
||||
a tree has already shipped under is not available to be re-cut.
|
||||
|
||||
⚠️ **AND THIS SECTION IS NOT THE WHOLE OF WHAT 0.10.0 SHIPS. THREE TICKETS
|
||||
WITH RUNTIME CHANGES LANDED AFTER `86bdf49` AND ARE NOT IN THE TABLE BELOW.**
|
||||
Saying so is cheaper than moving them, and moving them is [[PKG-08]]'s card,
|
||||
not this one:
|
||||
|
||||
| ticket | runtime files | where it is written down |
|
||||
|---|---|---|
|
||||
| [[SAFETY-43]] | `app/delivery.py`, `app/packshare.py`, `config.yaml` | the `## Unreleased` block **below `## 0.9.0`**, which is misfiled |
|
||||
| [[TEST-21]] | `app/delivery.py`, `config.yaml`, `translations/` | the same block |
|
||||
| [[SAFETY-44]] | `app/main.py`, `app/store.py` | ⚠️ **nowhere in this file** |
|
||||
|
||||
Five more landed that touch no runtime file and so cannot change what the
|
||||
image does - PKG-13, UX-04, SAFETY-31, ARCH-02, INSTR-01. The count that
|
||||
matters for the no-op check is `tools/predeploy_check.py`'s own: **28 runtime
|
||||
commits since `86bdf49`**, of which the table below accounts for 21.
|
||||
|
||||
Contents of this release, in merge order since 0.9.0 (`86bdf49`):
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| _this branch_ | FCST-04 - the carry-forward fill reaches the plan, and the day it carries survives a restart |
|
||||
| _this branch_ | FCST-05 - one byte stops stopping the add-on, and the write path gets the read path's standard |
|
||||
| _this branch_ | FCST-06 - "cannot persist" stops meaning "has no /data" and starts meaning what it says |
|
||||
| _this branch_ | TARIFF-08 - the day-ahead feed is read in the shape it actually publishes, and the fixtures stop agreeing with the parser |
|
||||
| _this branch_ | TARIFF-09 - the day-ahead feed is asked for the horizon it was given, so tomorrow arrives firm instead of carried |
|
||||
| _this branch_ | TARIFF-10 - configuring a price provider is what fetches prices; trading stays its own switch |
|
||||
| _this branch_ | TARIFF-12 - a supplier outage stops deleting the plan on its first failed fetch, and TARIFF_MAX_AGE_S starts governing |
|
||||
| _this branch_ | TARIFF-14 - the price a trade is decided against is the price of the interval being traded |
|
||||
| _this branch_ | TARIFF-07 - three plugins that never fetched a price are withdrawn, and a site configured on one is told so **⚠️ BACKWARD-INCOMPATIBLE** |
|
||||
| _this branch_ | TARIFF-15 - `custom_formula`: your own tariff card's two coefficients, graded against the card's own printed price |
|
||||
| _this branch_ | TARIFF-13 - the capacity-tariff row's "quarter(s) banked" stops resetting to 0 at every restart, and a tied peak's quarter stops moving |
|
||||
| _this branch_ | TARIFF-11 - the add-on's account of the tariff plan stops flattering it, and the status page is graded as a surface |
|
||||
| _this branch_ | TARIFF-17 - a price component that varies by hour has somewhere to live, so a Walloon day/night network tariff can change which hour is cheapest |
|
||||
| _this branch_ | TARIFF-18 - `price_taxes_eur_kwh` stops shipping at half the real Flemish figure **⚠️ CHANGED DEFAULT** |
|
||||
| _this branch_ | TARIFF-16 - the injection leg stops being one number: an injection formula with its own coefficients, its own VAT and no floor under zero |
|
||||
| _this branch_ | SAFETY-45 - a price-driven charge is SIZED by the capacity-tariff guard instead of being switched on and off by it **⚠️ CONTROL STABILITY** |
|
||||
| _this branch_ | SAFETY-10 - shadow mode: the whole decision path runs and nothing reaches the inverter **⚠️ NEW OPTION, DEFAULT-ON FOR A NEW INSTALL** |
|
||||
| `c2787da` | FCST-04 - the carry-forward fill reaches the plan, and the day it carries survives a restart |
|
||||
| `5059e28` | FCST-05 - one byte stops stopping the add-on, and the write path gets the read path's standard |
|
||||
| `958f5cd` | FCST-06 - "cannot persist" stops meaning "has no /data" and starts meaning what it says |
|
||||
| `4257e38` | TARIFF-08 - the day-ahead feed is read in the shape it actually publishes, and the fixtures stop agreeing with the parser |
|
||||
| `88c59a9` | TARIFF-09 - the day-ahead feed is asked for the horizon it was given, so tomorrow arrives firm instead of carried |
|
||||
| `559f0eb` | TARIFF-10 - configuring a price provider is what fetches prices; trading stays its own switch |
|
||||
| `a6e64fb` | TARIFF-12 - a supplier outage stops deleting the plan on its first failed fetch, and TARIFF_MAX_AGE_S starts governing |
|
||||
| `8d09b30` | TARIFF-14 - the price a trade is decided against is the price of the interval being traded |
|
||||
| `aade2c7` | TARIFF-07 - three plugins that never fetched a price are withdrawn, and a site configured on one is told so **⚠️ BACKWARD-INCOMPATIBLE** |
|
||||
| `068b83f` | TARIFF-15 - `custom_formula`: your own tariff card's two coefficients, graded against the card's own printed price |
|
||||
| `b4a3801` | TARIFF-13 - the capacity-tariff row's "quarter(s) banked" stops resetting to 0 at every restart, and a tied peak's quarter stops moving |
|
||||
| `c518007` | TARIFF-11 - the add-on's account of the tariff plan stops flattering it, and the status page is graded as a surface |
|
||||
| `7796f16` | TARIFF-17 - a price component that varies by hour has somewhere to live, so a Walloon day/night network tariff can change which hour is cheapest |
|
||||
| `4dcd9b0` | TARIFF-18 - `price_taxes_eur_kwh` stops shipping at half the real Flemish figure **⚠️ CHANGED DEFAULT** |
|
||||
| `478ba93` | TARIFF-16 - the injection leg stops being one number: an injection formula with its own coefficients, its own VAT and no floor under zero |
|
||||
| `8f82dd4` | SAFETY-45 - a price-driven charge is SIZED by the capacity-tariff guard instead of being switched on and off by it **⚠️ CONTROL STABILITY** |
|
||||
| `e6da478` | SAFETY-10 - shadow mode: the whole decision path runs and nothing reaches the inverter **⚠️ NEW OPTION, DEFAULT-ON FOR A NEW INSTALL** |
|
||||
| `587495e` | SAFETY-47 - what a shadow run can show you, and the watts on its status row **⚠️ CORRECTS THREE CLAIMS SAFETY-10 SHIPPED** |
|
||||
|
||||
### SAFETY-47 — what a shadow run can show you, and the watts on its status row
|
||||
|
||||
⚠️ **Nothing about the write path changed, and nothing needed to.** Shadow
|
||||
mode still holds every inverter at 0 W through the one writer. What was wrong
|
||||
is what three merged documents **said** a shadow run can show you, and a number
|
||||
on the status page that could be **6.61×** what a live controller would
|
||||
command.
|
||||
|
||||
**A shadow run cannot show you a closed-loop defect. Not partially — not at
|
||||
all.** The battery is held at 0 W, so every measured input — the meter, the
|
||||
billed-quarter accumulator behind it, the battery power, the state of charge —
|
||||
describes a plant that did not respond, and a closed-loop defect is one whose
|
||||
stimulus *is* the plant's response. That is the same property that makes shadow
|
||||
mode safe, so it is not a gap to be closed later: **the closed-loop answer
|
||||
comes from the closed-loop rig or from a live run.**
|
||||
|
||||
SAFETY-10 promised otherwise, because of a sentence that was true when it was
|
||||
written and false one commit later:
|
||||
|
||||
> the **strategies** are unaffected — they ask for a fixed power from inputs
|
||||
> that do not depend on what the battery did — so a shadow run does show you
|
||||
> the trades, the peak-guard engagements and the SoC-limit behaviour.
|
||||
|
||||
SAFETY-45 (above) sizes the buy leg to the billed quarter's charging headroom,
|
||||
and that headroom is `(900 / seconds remaining) × (ceiling − projected)` with
|
||||
the projection read off the **open quarter's meter**. The strategy became
|
||||
closed-loop the day that landed. Measured on the rig, one hour at `peak_cap_w`
|
||||
1500 under a 1200 W house:
|
||||
|
||||
| | live | shadow |
|
||||
|---|---|---|
|
||||
| charge onsets | 28 | **1** |
|
||||
| grid | −455.5 … +3200.0 W | **1200.0 W flat — the house** |
|
||||
| capacity guard engaged | 410 / 720 cycles | **0 / 720** |
|
||||
| state of charge | 50.000019 → 51.856789 % | **50.000000 → 50.000000 %** |
|
||||
|
||||
**What the documents now say.** The exemption narrows to exactly what is still
|
||||
true — **which** hour a strategy picks and **why** are unaffected, because the
|
||||
clock and the price series are not functions of the battery; **how hard** it
|
||||
trades is not. Of the three defects shadow mode was written for, one —
|
||||
TARIFF-14's wrong quarter-hour — is genuinely visible from a shadow run, and it
|
||||
is graded that way: identical live and shadow on 720 of 720 charging cycles at
|
||||
a binding cap.
|
||||
|
||||
**What you will see on the status page.** The `Shadow mode` row and the action
|
||||
log now introduce the watts as what the controller would have commanded **on
|
||||
this cycle** — in every state, because no number a shadow run records is a
|
||||
forecast of a live run. And when a **measured** billed quarter sized those
|
||||
watts, both surfaces carry:
|
||||
|
||||
> ⚠️ AND ITS SIZE CAME FROM THE BILLED-QUARTER METER, WHICH HAS ONLY THE HOUSE
|
||||
> IN IT WHILE THE BATTERY IS HELD AT 0 W. A live run sizes the same trade
|
||||
> against a meter the battery is moving, so this is an UPPER BOUND and not a
|
||||
> prediction; how far under it a live run lands is a closed-loop question and a
|
||||
> shadow run cannot answer it.
|
||||
|
||||
⚠️ **The number is caveated, not re-computed, and that was the decision.**
|
||||
Re-computing it to "look right" would mean the recorded decision was no longer
|
||||
the decision the shipped path reached — while the arbiter, the clamp, the
|
||||
write-authorisation gate, the action log and MQTT all ran on the real one. A
|
||||
shadow run's whole worth is that what it records is what the controller
|
||||
actually decided. `DECISIONS/SAFETY-47-what-a-shadow-run-can-show.md` §3
|
||||
records the three alternatives that were rejected and why.
|
||||
|
||||
⚠️ **On a site whose cap does not bind, nothing changes by one watt.** At
|
||||
`peak_cap_w` 15000 against a 350 W house the recorded figure is the live one
|
||||
exactly, and no caveat is a lie there either — the row still says the size came
|
||||
off a meter with no battery in it, which is true and is the point.
|
||||
|
||||
**And SAFETY-10's own committed evidence could never have failed.** Its
|
||||
comparison table ran at a cap the guard never reaches, *and* read only the
|
||||
first charging sample — the one instant at which the two runs agree even at a
|
||||
cap that does bind. Both had to be closed; closing either alone closes nothing.
|
||||
The table is re-taken across the whole run at a binding cap, and
|
||||
`test_arbitrage.py` part 3d is the CI-side grader so this class cannot recur.
|
||||
14 mutations, no survivors; all 29 check files green.
|
||||
|
||||
### SAFETY-10 — shadow mode, and what its default does to YOUR install
|
||||
|
||||
@@ -1557,12 +1785,30 @@ and pulled. If it has not, this belongs inside 0.8.0's section before it ships;
|
||||
if it has, it needs 0.8.1. Whoever deploys decides, and PKG-07 is the record of
|
||||
what happens when nobody does.
|
||||
|
||||
⚠️ **ANNOTATED BY PKG-14, 2026-09-16 - EVERY ROW BELOW HAS SHIPPED, AND THE
|
||||
PARAGRAPH ABOVE IS NO LONGER TRUE OF ANY OF THEM.** It is annotated rather
|
||||
than rewritten, and nothing is moved out of it, because re-filing this file's
|
||||
misplaced entries is [[PKG-08]]'s card and guessing a boundary is what that
|
||||
card exists to stop. What is measurable, and what PKG-14 measured:
|
||||
|
||||
* **UX-02 shipped in 0.9.0.** Its merge `3d29993` is an ancestor of the 0.9.0
|
||||
bump `86bdf49` and it is already listed in `## 0.9.0`'s own contents table,
|
||||
so this row is a duplicate of a released one.
|
||||
* **UX-04, TEST-21 and SAFETY-43 shipped in 0.10.0.** All three merged after
|
||||
`86bdf49`. TEST-21 (`app/delivery.py`, `config.yaml`, `translations/`) and
|
||||
SAFETY-43 (`app/delivery.py`, `app/packshare.py`, `config.yaml`) are runtime
|
||||
changes and are named in `## 0.10.0`'s preamble as shipping there and being
|
||||
written down here; UX-04 touches no runtime file.
|
||||
* ⚠️ **[[SAFETY-44]] also shipped in 0.10.0 and is nowhere in this file** -
|
||||
`app/main.py` and `app/store.py`, three commits. It is named in
|
||||
`## 0.10.0`'s preamble for the same reason.
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| _this branch_ | UX-02 - a configuration page in the ingress panel, where the validator's refusals can be seen |
|
||||
| _this branch_ | UX-04 - UX-01's three unmet acceptance criteria: one withdrawn, one built, one re-attributed |
|
||||
| _this branch_ | TEST-21 - `delivery_hold_s`'s floor re-derived from a harness that is now committed, and the recorded 30.0 s did not reproduce |
|
||||
| _this branch_ | SAFETY-43 - delinquency measured against the ask as well as against a flat 500 W, closing OPT-09's disclosed detection regression |
|
||||
| `3d29993` | UX-02 - a configuration page in the ingress panel, where the validator's refusals can be seen **⚠️ SHIPPED IN 0.9.0, see that section** |
|
||||
| `bb46916` | UX-04 - UX-01's three unmet acceptance criteria: one withdrawn, one built, one re-attributed **⚠️ SHIPPED IN 0.10.0** |
|
||||
| `6719bd8` | TEST-21 - `delivery_hold_s`'s floor re-derived from a harness that is now committed, and the recorded 30.0 s did not reproduce **⚠️ SHIPPED IN 0.10.0** |
|
||||
| `37dd0f0` | SAFETY-43 - delinquency measured against the ask as well as against a flat 500 W, closing OPT-09's disclosed detection regression **⚠️ SHIPPED IN 0.10.0** |
|
||||
|
||||
⚠️ **SAFETY-43 CLOSES THE DETECTION REGRESSION OPT-09 DISCLOSED, AND IT IS A
|
||||
TWO-INVERTER FIX. N=1 IS BYTE-IDENTICAL.** `delivery.delinquent()` named a unit
|
||||
|
||||
@@ -1,6 +1,12 @@
|
||||
# SAFETY-10 — shadow mode, and why "default-on" is not `true`
|
||||
|
||||
**Status:** decided and implemented on branch `SAFETY-10`.
|
||||
⚠️ **AMENDED BY SAFETY-47, and three of the claims below were false when this
|
||||
was merged.** §5's "the strategies are unaffected" exemption, §4's peak-guard
|
||||
row and §6's evidence table are corrected in place and each correction is
|
||||
marked. The amendments are marked rather than rewritten silently, because what
|
||||
this card believed is part of why the defect shipped. See
|
||||
`DECISIONS/SAFETY-47-what-a-shadow-run-can-show.md`.
|
||||
**Card:** SAFETY-10 — *"Shadow mode (default-on, log-only decisions)"*.
|
||||
**Nothing here reached the inverter.** No deployment, no `ha addons update`, no
|
||||
contact with 192.168.2.158 or 192.168.2.221. Everything below was measured in
|
||||
@@ -26,6 +32,12 @@ the CI image and on TEST-23 stage 3's closed-loop rig.
|
||||
and **latch a trip that survives into live operation and a restart**. §4.
|
||||
4. **The loop leg's shadow decision is one slew step, not a trajectory, and
|
||||
that is a real limitation of this feature.** §5.
|
||||
5. ⚠️ **SAFETY-47: and neither is anything else that depends on the plant
|
||||
answering back. A shadow run cannot surface a closed-loop defect at all**,
|
||||
by the same construction that makes it safe — the battery is held at 0 W, so
|
||||
every measured input describes a plant that did not respond. Of the three
|
||||
defects §"WHAT DEFECT THIS PREVENTS" was written for, exactly one —
|
||||
TARIFF-14's wrong quarter-hour — is visible from a shadow run. §5, §6.
|
||||
|
||||
---
|
||||
|
||||
@@ -130,9 +142,9 @@ shadow run can report *"it would have hit the rating here"*.
|
||||
| surface | what it carries |
|
||||
|---|---|
|
||||
| status banner | `SHADOW MODE - the battery is NOT being controlled...`, **first in the cascade**, amber — red, with the latch named, if one is standing |
|
||||
| status row `Shadow mode` | which rung decided, the watts it **would have commanded**, where the inverter actually is, and `Resolution.explain()` |
|
||||
| status row `Shadow mode` | which rung decided, the watts it **would have commanded on this cycle**, where the inverter actually is, and `Resolution.explain()` — plus, when a measured billed quarter sized those watts, SAFETY-47's caveat saying so (`shadow.SIZED_FROM_METER`) |
|
||||
| status row `Commanded` | `0 W` — the truth, which the row above reconciles with the `Why` row below it |
|
||||
| action log | one line when shadow mode comes on; one line per **change of decision** (winner or rounded watts), carrying the arbiter's own sentence |
|
||||
| action log | one line when shadow mode comes on; one line per **change of decision** (winner, rounded watts, or SAFETY-47's caveat state), carrying the arbiter's own sentence and the same caveat the row carries — `shadow.log_line()` is the one sentence both read |
|
||||
| MQTT | `status: shadow`, its own value, below `failsafe` |
|
||||
|
||||
The action log is **edge**-logged, not level-logged: the log holds 40 rows, and
|
||||
@@ -149,7 +161,7 @@ minutes at the 15 s cycle floor.
|
||||
| SAFETY-03 clamp | **OBSERVES** | Runs on the decision, sets `clamp_last`, logs every engagement. Changes no command |
|
||||
| SAFETY-28 write gate | **OBSERVES** | Same placement, same reason: the question is who chose the number |
|
||||
| SAFETY-18 meter freeze | **OBSERVES**, unchanged | It takes no action live either; both halves of its conjunction are as true in shadow |
|
||||
| SAFETY-07/24/25 peak guard | **OBSERVES** | Level-triggered, unlatched, files its claim as usual — SAFETY-45's limit cycle is visible from a shadow run, which is the point |
|
||||
| SAFETY-07/24/25 peak guard | **OBSERVES, AND SEES ONLY THE HOUSE** | Level-triggered, unlatched, files its claim as usual, so the recorded decision is the real one *for this meter*. ⚠️ **AMENDED BY SAFETY-47.** This row used to end "SAFETY-45's limit cycle is visible from a shadow run, which is the point". It is not: every term of `wanted = batt_w + excess` is measured, and in shadow mode the battery contributes nothing to either. Measured on the rig, same hour, same unsized code — **410 of 720 cycles engaged live, 0 of 720 in shadow** |
|
||||
| SAFETY-31 circulation | **OBSERVES AND MAY LATCH** | Its evidence is *measured* power. Packs pushing against each other while all are told 0 W is a real fault |
|
||||
| SAFETY-42 delivery | **OBSERVES AND MAY LATCH** | Same, against a share that is 0 W |
|
||||
| operator stop | **SUPPRESSED AS A CLAIM, ENFORCED AT THE WIRE** | The one deliberate change. Its `P_SAFETY` 0 W claim out-ranks everything, so leaving it in makes the recorded decision `"stopped"` on every cycle and the run answers the wrong question. The actuator ends at the same number either way, and the wire substitution is **strictly stronger**: a claim can be out-ranked, and it cannot |
|
||||
@@ -186,12 +198,47 @@ is a closed-loop property, it did not happen, and reporting it would be a
|
||||
simulation of a plant that does not exist; three cycles in, such a number
|
||||
describes nothing.
|
||||
|
||||
The strategies are unaffected: arbitrage, the peak guard and maintenance all
|
||||
file `SET` claims at a fixed power from level-triggered inputs. That is why the
|
||||
three defects this card was written for — SAFETY-45's 28 onsets an hour,
|
||||
TARIFF-14's wrong quarter-hour, SAFETY-46's ceiling churn — are all visible from
|
||||
a shadow run, and the loop's ramp is not. Graded, named, in
|
||||
`test_watchdog.py` part 10 as `RECORDED LIMITATION`.
|
||||
⚠️ **AMENDED BY SAFETY-47 — THE PARAGRAPH THAT STOOD HERE WAS THE DEFECT.**
|
||||
It read:
|
||||
|
||||
> The strategies are unaffected: arbitrage, the peak guard and maintenance all
|
||||
> file `SET` claims at a fixed power from level-triggered inputs. That is why
|
||||
> the three defects this card was written for — SAFETY-45's 28 onsets an hour,
|
||||
> TARIFF-14's wrong quarter-hour, SAFETY-46's ceiling churn — are all visible
|
||||
> from a shadow run, and the loop's ramp is not.
|
||||
|
||||
It was true until **SAFETY-45 merged, one commit before this card**. That
|
||||
change makes the buy leg `min(asked, headroom)` with
|
||||
|
||||
```
|
||||
headroom = (900 / remaining) x (ceiling - projected)
|
||||
```
|
||||
|
||||
and `projected` reads the **open quarter's accumulator** — the meter — which is
|
||||
a function of what the battery did earlier in that same quarter. The strategy
|
||||
is closed-loop, and the loop's one-slew-step limitation above is not a special
|
||||
case of anything: **it is the general case**, and the limitation is the whole
|
||||
feature's, not the loop leg's.
|
||||
|
||||
**The correct statement, and it is now graded rather than asserted:**
|
||||
|
||||
> A shadow run cannot surface a **closed-loop** defect — one whose stimulus is
|
||||
> the plant's response to the controller — because the battery is held at 0 W
|
||||
> and there is no response to be the stimulus. **Which** hour a strategy picks
|
||||
> and **why** are unaffected, because the clock and the price series are not
|
||||
> functions of the battery. **How hard** it trades is not.
|
||||
|
||||
Of the three defects this card was written for:
|
||||
|
||||
| | visible from a shadow run? | measured |
|
||||
|---|---|---|
|
||||
| SAFETY-45's limit cycle | **no** | 28 charge onsets live, **1** in shadow; grid −455.5 … +3200.0 W live, **flat at the 1200 W house** in shadow; guard engaged 410/720 live, **0/720** in shadow |
|
||||
| SAFETY-46's SoC churn | **no** | the SoC moves **0.000000000 pp** in a shadow run. No SoC limit can be *reached* in one |
|
||||
| TARIFF-14's wrong quarter-hour | **yes**, and it is the one | which hour, at what price, clearing what spread: identical live and shadow on **720 of 720** charging cycles, at a binding cap |
|
||||
|
||||
Graded in `test_arbitrage.py` part **3d** — the same closed loop part 3c uses,
|
||||
run once live and once in shadow — and the loop leg's own limitation stays
|
||||
named in `test_watchdog.py` part 10 as `RECORDED LIMITATION`.
|
||||
|
||||
---
|
||||
|
||||
@@ -218,22 +265,60 @@ The closed-loop half is `/home/homelab/s10-mut/shadowloop.py` on TEST-23 stage
|
||||
3's rig: the same hour, twice, against `plantsim.Plant` through the firmware's
|
||||
own frame encoder.
|
||||
|
||||
⚠️ **SUPERSEDED BY SAFETY-47 — THE TABLE THAT STOOD HERE COULD NEVER HAVE GONE
|
||||
RED, FOR TWO INDEPENDENT REASONS.** It read `arb_power_w` −2000 W *"identical"*,
|
||||
`arb_reason` *"identical, verbatim"*, arbiter winner *"identical"*, and
|
||||
concluded *"the decision happened, at the same instant, for the same reason, at
|
||||
the same signed power — and the battery did not move."* The battery half is
|
||||
true and is unchanged. The **decision** half was decoration:
|
||||
|
||||
1. **the fixture is `peak_cap_w: 15000` against a 350 W house**, so the
|
||||
capacity guard never engages and SAFETY-45's sizing is in the run and inert.
|
||||
The harness's own comment says so — *"at this scenario's `peak_cap_w: 15000`
|
||||
it is not binding anyway"* — which is MUTATION.md habit 4 written down
|
||||
beside the check it disables;
|
||||
2. **every identity row reads the FIRST charging sample.** At `elapsed = 0`
|
||||
the projection *is* the held level, so the two runs agree to the float there
|
||||
**even at a cap that does bind**. Measured: closing reason (1) alone leaves
|
||||
that comparison passing.
|
||||
|
||||
Both had to be closed. Re-taken below at **`peak_cap_w` 1500 / house 1200 /
|
||||
`max_w` 2000**, one hour at a 5 s cycle, **across the whole run** — harness
|
||||
`/home/homelab/s47-mut/shadowloop47.py`, same rig, same three transcribed
|
||||
lines.
|
||||
|
||||
| | live | shadow |
|
||||
|---|---|---|
|
||||
| `plant_cmd_w` | −2000 W throughout | **0 W throughout** |
|
||||
| `batt_w` | −2000 .. −40.6 W | **0.0 W, exactly** |
|
||||
| SoC | 50.000 → **62.331 %** | 50.0 → **50.0 %** |
|
||||
| grid | 390.6 .. 2350 W | **350 W = the house, exactly** |
|
||||
| `ARBITRAGE_CHARGE` samples | 3600 | **3600** |
|
||||
| first charge instant | 2026-01-15T00:00:00+00:00 | **identical** |
|
||||
| `arb_power_w` | −2000 W | **identical** |
|
||||
| `arb_reason` | the strategy's own sentence | **identical, verbatim** |
|
||||
| grid | 1224.1 … 1506.0 W — **held up at the ceiling** | **1200.0 W flat = the house, exactly** |
|
||||
| SoC | 50.000019 → **51.856789 %** | 50.000000 → **50.000000 %** |
|
||||
| `ARBITRAGE_CHARGE` cycles | 720 / 720 | **720 / 720** |
|
||||
| first charging cycle, `arb_power_w` | −300.0000 W | **identical — and this is why the old table passed** |
|
||||
| `arb_power_w`, **whole run** | −307.799 … −299.930 W | **−2000.000 … −300.000 W** |
|
||||
| …cycles where the two differ | — | **716 of 720** |
|
||||
| `arb_reason`, whole run | the strategy's own sentence | **differs on 719 of 720** |
|
||||
| measured charging headroom | 299.93 … 307.80 W | **300.0 … 54 000.0 W** |
|
||||
| final recorded command | **−302.4 W** | **−2000.0 W — 6.61× the live figure** |
|
||||
| price / spread / which hour | | **identical on 720 of 720** |
|
||||
| arbiter winner | `arbitrage` | **identical** |
|
||||
|
||||
The decision happened, at the same instant, for the same reason, at the same
|
||||
signed power — and the battery did not move.
|
||||
**What the re-taken table says.** The decision still *happens*, at the same
|
||||
instant, on the same hour, at the same price, for the same *kind* of reason,
|
||||
and the battery still does not move — those were the card's real claims and
|
||||
they hold. What does **not** hold is that the decision is the *same decision*:
|
||||
its **size** is a function of a meter the battery never moved, and at this cap
|
||||
the recorded figure is 6.61× what a live controller commands. 54 000 W of
|
||||
"headroom" under a 1500 W ceiling is `900/remaining` multiplying a gap the
|
||||
battery never closed.
|
||||
|
||||
⚠️ **Three lines of that harness are a TRANSCRIPTION and are marked as one.**
|
||||
⚠️ **And the SoC row is the second half of it.** 0.000000000 pp of movement is
|
||||
not a curiosity: it is the proof that **no SoC-limit behaviour is reachable
|
||||
from a shadow run at all**, which §5 used to promise.
|
||||
|
||||
SAFETY-47 puts the caveat on both surfaces that carry the number and narrows
|
||||
the three documents' claims; `test_arbitrage.py` part 3d is the CI-side grader
|
||||
so this class cannot recur.
|
||||
|
||||
⚠️ **Three lines of each harness are a TRANSCRIPTION and are marked as one.**
|
||||
`priceloop.Rig` has no `_write_unit()`, no clamp and no failsafe machine
|
||||
(divergence 2 of its README), so the substitution's **placement** is
|
||||
transcribed there. The shipped placement is graded by `test_clamp.py` part 8,
|
||||
|
||||
@@ -0,0 +1,319 @@
|
||||
# SAFETY-47 — what a shadow run can show, and what it cannot
|
||||
|
||||
**Status:** decided and implemented on branch `SAFETY-47`.
|
||||
**Card:** SAFETY-47 — *"shadow mode's claims, and the number on the status
|
||||
row"*.
|
||||
**Nothing here reached the inverter.** No deployment, no `ha addons update`, no
|
||||
contact with 192.168.2.158 or 192.168.2.221. Everything below was measured in
|
||||
the CI image and on TEST-23 stage 3's closed-loop rig.
|
||||
|
||||
⚠️ **This is not a write-path defect and nothing in the write path was
|
||||
touched.** SAFETY-10's substitution, re-seed, authorisation gate and clamp are
|
||||
unchanged. What was wrong is what three merged documents **say** a shadow run
|
||||
can show you, and a number on the status row that can be **6.61×** what a live
|
||||
controller would command.
|
||||
|
||||
---
|
||||
|
||||
## 0. The four things a reader should take away
|
||||
|
||||
1. **Shadow mode cannot surface a closed-loop defect. Not partially — not at
|
||||
all**, and by the same construction that makes it safe. §1.
|
||||
2. **The "strategies are unaffected" exemption was true until SAFETY-45 merged,
|
||||
one commit before SAFETY-10.** Sizing the buy leg to the billed-quarter
|
||||
headroom made the strategy closed-loop. §2.
|
||||
3. **The recorded watts are the right answer to a question nobody asked, and
|
||||
they are CAVEATED rather than re-computed.** Re-computing would mean the
|
||||
recorded decision was no longer the decision the shipped path reached, which
|
||||
is the one thing shadow mode has to be able to say. §3 records what was
|
||||
rejected.
|
||||
4. **SAFETY-10 §6's committed evidence could never have failed, for two
|
||||
independent reasons, and closing either one alone closes nothing.** §4.
|
||||
|
||||
---
|
||||
|
||||
## 1. Why the answer is "not at all", and not "not very well"
|
||||
|
||||
Shadow mode holds every actuator at `shadow.WIRE_W` and re-seeds the carried
|
||||
command to it at the end of each cycle. So every **measured** input — the
|
||||
meter, the billed-quarter accumulator behind it, the battery power, the state
|
||||
of charge — describes a plant that **did not respond**.
|
||||
|
||||
A closed-loop defect is, by definition, one whose stimulus **is** the plant's
|
||||
response to the controller. No response, no stimulus, nothing to see. This is
|
||||
not an implementation gap:
|
||||
|
||||
* feeding the guards a **simulated** plant instead is exactly what SAFETY-10 §4
|
||||
refuses for the sign watchdogs, and the reason generalises — a controller
|
||||
reacting to a plant that does not exist drifts further from reality every
|
||||
tick, and three cycles in its numbers describe nothing;
|
||||
* and SAFETY-10 §5 already conceded the same fact for the grid-following loop
|
||||
("one slew step, not a trajectory"). That was never a property of the loop.
|
||||
**It is the general case**, and the loop leg was simply where it had already
|
||||
been noticed.
|
||||
|
||||
**So the closed-loop answer comes from a closed-loop rig (TEST-23 stage 3) or
|
||||
from a live run. There is no third place, and saying that plainly is worth more
|
||||
than the three sentences it replaces.**
|
||||
|
||||
### Measured, on the rig, at a cap that binds
|
||||
|
||||
`peak_cap_w` 1500 / house 1200 / `max_w` 2000, one hour at a 5 s cycle. Of the
|
||||
three defects SAFETY-10 was written for:
|
||||
|
||||
| | visible? | measured |
|
||||
|---|---|---|
|
||||
| SAFETY-45's limit cycle | **no** | 28 charge onsets live, **1** in shadow. Grid −455.5 … +3200.0 W live, **flat at the 1200 W house** in shadow. Guard engaged 410/720 cycles live, **0/720** in shadow. (Taken with SAFETY-45 reverted — that is the defect being looked for.) |
|
||||
| SAFETY-46's SoC churn | **no** | the SoC moves **0.000000000 pp** in a shadow run. The SoC is the pack's integral of what the pack was commanded, and it was commanded 0 W. No SoC limit can be *reached* in a shadow run at all |
|
||||
| TARIFF-14's wrong quarter-hour | **yes**, and it is the only one | the price lookup's inputs are the clock and the price series, neither a function of the battery. Which hour, at what price, clearing what spread: **identical live and shadow on 720 of 720 charging cycles, at a binding cap** |
|
||||
|
||||
### What a shadow run genuinely is for
|
||||
|
||||
*Which* strategy wins, on *which* hour, at *which* price, for *which* reason,
|
||||
against which limits — the wrong-quarter-hour class, a trade armed on a day it
|
||||
should not be, a refusal whose sentence names the wrong subsystem, a clamp that
|
||||
would have engaged, a standing failsafe latch. That is a real and useful set,
|
||||
and it is the set the documents now claim.
|
||||
|
||||
---
|
||||
|
||||
## 2. The exemption, and exactly how much of it survives
|
||||
|
||||
All three documents carried a version of:
|
||||
|
||||
> The **strategies** are unaffected — price arbitrage, the capacity guard and
|
||||
> maintenance all ask for a fixed power **from inputs that do not depend on
|
||||
> what the battery did**.
|
||||
|
||||
**True before SAFETY-45, false after it.** SAFETY-45 makes the buy leg
|
||||
`min(asked, headroom)`, and
|
||||
|
||||
```
|
||||
headroom = (900 / remaining) x (ceiling - projected)
|
||||
```
|
||||
|
||||
where `projected` reads the **open quarter's accumulator** — the meter — which
|
||||
is a function of what the battery did earlier in that same quarter. SAFETY-45
|
||||
merged one commit before SAFETY-10, so the exemption was stale on the day it
|
||||
was written.
|
||||
|
||||
**What survives, and it is now graded rather than asserted:**
|
||||
|
||||
> **Which** hour a strategy picks, and **why**, are unaffected — the clock and
|
||||
> the price series are not functions of the battery.
|
||||
> **How hard** it trades is not.
|
||||
|
||||
⚠️ **The peak guard is not in the surviving half either.** Every term of
|
||||
`wanted = batt_w + excess` is measured, so in a shadow run the guard engages
|
||||
only if the *house alone* would put the quarter over the ceiling. Its
|
||||
**ceiling** and its **reasons** are worth reading from a shadow run; its
|
||||
**engagements** are not evidence of anything.
|
||||
|
||||
---
|
||||
|
||||
## 3. The number on the status row — decided, and what was rejected
|
||||
|
||||
At `peak_cap_w` 1500 under a 1200 W house the status row read **"WOULD HAVE
|
||||
COMMANDED −2 000 W"**. A live controller commands **−302.4 W**. Measured on the
|
||||
shipped build:
|
||||
|
||||
| cap / house | live commanded | shadow recorded | over by |
|
||||
|---|---|---|---|
|
||||
| 1500 / 1200 | −302.4 W | **−2000.0 W** | **6.61×** |
|
||||
| 3500 / 3000 | −502.6 W | −2000.0 W | 3.98× |
|
||||
| 3500 / 2000 *(shipped cap)* | −1502.6 W | −2000.0 W | 1.33× |
|
||||
| 3500 / 1800 | −1702.6 W | −2000.0 W | 1.17× |
|
||||
| 15000 / 350 | −2000.0 W | −2000.0 W | 1.00× |
|
||||
|
||||
⚠️ **The arithmetic is not wrong.** `900/remaining` is correct for a meter that
|
||||
is genuinely under the ceiling, and in a shadow run the meter genuinely *is*
|
||||
under it, because the battery is not charging. **The recorded number is the
|
||||
right answer to a question nobody asked** — and the last row of that table is
|
||||
the fixture SAFETY-10's own evidence was taken on, which is why nothing
|
||||
reported it.
|
||||
|
||||
### What shipped
|
||||
|
||||
1. **Unconditionally**, the row and the log line stop forecasting: the watts
|
||||
are introduced as what would have been commanded **ON THIS CYCLE**. No
|
||||
number a shadow run records is a prediction of a live run, so no state
|
||||
should read like one.
|
||||
2. **Conditionally**, whenever a **measured** billed quarter sized the number
|
||||
being recorded, both surfaces carry `shadow.SIZED_FROM_METER`:
|
||||
|
||||
> ⚠️ AND ITS SIZE CAME FROM THE BILLED-QUARTER METER, WHICH HAS ONLY THE
|
||||
> HOUSE IN IT WHILE THE BATTERY IS HELD AT 0 W. A live run sizes the same
|
||||
> trade against a meter the battery is moving, so this is an UPPER BOUND and
|
||||
> not a prediction; how far under it a live run lands is a closed-loop
|
||||
> question and a shadow run cannot answer it.
|
||||
|
||||
⚠️ **"Upper bound", and not "smaller", and the difference was measured.**
|
||||
Charging only *adds* offtake, so a live `projected` is never below a shadow one
|
||||
and the headroom never above it — with **equality at the start of every
|
||||
quarter**, where `900/remaining` is 1.0 and neither plant has moved. Measured
|
||||
pairwise over 3600 charging cycles in five configurations: **0 cycles below,
|
||||
730 exactly equal.** A sentence reading "smaller" would have been false on
|
||||
every one of those 730, and the first draft of this card said "smaller".
|
||||
|
||||
⚠️ **And it names no factor.** How far under the bound a live run lands is a
|
||||
property of the site. A number invented for the row would be a second helping
|
||||
of the defect the sentence exists to disclose.
|
||||
|
||||
⚠️ **The predicate is NOT keyed on whether the trade was capped, and that is
|
||||
the trap this card nearly walked into.** `arbitrage`'s own sentence says *"SIZED
|
||||
BY THE CAPACITY-TARIFF GUARD"* only when the headroom came out **below** the
|
||||
ask — which in a shadow run is the **start** of the quarter, where the two runs
|
||||
still agree to the float. By the end, `900/remaining` has multiplied the
|
||||
headroom **past** the ask, the trade is **not** capped, the sentence is silent,
|
||||
and the recorded number is at its **most** wrong. A caveat keyed on it would be
|
||||
quietest exactly where it is needed loudest. `arbitrage.sized_from_meter()` is
|
||||
keyed on the headroom having been **measured**, so it fires on both.
|
||||
`test_arbitrage.py` part 3d-8 drives the inversion.
|
||||
|
||||
### Rejected, and why
|
||||
|
||||
* **Re-compute the number so it does not amplify** — e.g. record
|
||||
`ceiling − projected` (gain 1.0) instead of the sized figure. It matches the
|
||||
live answer almost exactly at this cap, and it is the **worst** of the
|
||||
options. It would be a **shadow-only sizing**: the recorded decision would no
|
||||
longer be the decision the shipped path reached, while the arbiter, the
|
||||
clamp, SAFETY-28's gate, the action log and MQTT all ran on the real one. A
|
||||
second copy of the sizing arithmetic living in the display layer is
|
||||
MUTATION.md's transcribed-predicate defect on an operator-facing surface, and
|
||||
it generalises to no other strategy. SAFETY-10's whole safety argument is
|
||||
that shadow mode is a **substitution at the wire**, not a second controller;
|
||||
this would have made it a second controller everywhere except the wire.
|
||||
* **Record nothing where the sizing depends on measured state.** Tempting —
|
||||
"no number beats a number 6.61× out". Rejected on three counts: it blanks the
|
||||
row exactly when arbitrage is trading, which is when a commissioning engineer
|
||||
most wants it; the action log's edge key is the rounded watts, so blanking
|
||||
them either floods or silences the log; and a surface that flickers between a
|
||||
number and a dash is harder to read than a number with a standing caveat.
|
||||
The narrow version of this — dropping the watts only — was the closest
|
||||
runner-up.
|
||||
* **Record the unsized ask alongside the sized one.** It adds a number without
|
||||
adding a warning. The unsized ask is `max_w`, a constant the operator
|
||||
configured; on the shipped 3500/2000 row both figures are 2000 W, so the pair
|
||||
is exactly as misleading as the single figure was.
|
||||
* **A caveat on every cycle in every state.** Rejected as the *whole* answer,
|
||||
accepted as half of it: the unconditional part is a two-word narrowing of the
|
||||
verb ("on this cycle"), not a warning, and the warning proper is conditional
|
||||
so that it still means something when it appears.
|
||||
|
||||
---
|
||||
|
||||
## 4. SAFETY-10 §6's evidence, and why it could not fail
|
||||
|
||||
§6 tabulated `arb_power_w` −2000 W *"identical"*, `arb_reason` *"identical,
|
||||
verbatim"*, arbiter winner *"identical"*. Two independent reasons it could
|
||||
never have gone red:
|
||||
|
||||
1. **the fixture is `peak_cap_w: 15000` against a 350 W house**, so the guard
|
||||
never engages and SAFETY-45's sizing is in the run and inert. ⚠️ **The
|
||||
harness's own comment says so** — *"at this scenario's `peak_cap_w: 15000`
|
||||
it is not binding anyway"* — which is MUTATION.md habit 4 written down
|
||||
beside the check it disables;
|
||||
2. **every identity row reads the FIRST charging sample.** At `elapsed = 0` the
|
||||
projection *is* the held level, so the two runs agree to the float there
|
||||
**even at a cap that does bind**.
|
||||
|
||||
⚠️ **AND THAT SECOND REASON IS THE ONE A REVIEWER CANNOT SEE FROM A DIFF.**
|
||||
Widening the fixture alone — the obvious fix — leaves the `[0]` comparison
|
||||
passing. Measured, not reasoned: at 1500/1200 the first charging cycle is
|
||||
−300.0000 W in **both** runs while 716 of the 720 cycles differ. Part 3d-2
|
||||
grades that agreement **as an expectation**, so nobody rebuilds a check on
|
||||
`[0]` believing it covers something.
|
||||
|
||||
This is habit 4's **twelfth** instance in this repository, its **second**
|
||||
inside a committed evidence artifact, and — like the seventh and the eleventh —
|
||||
it was in a **measuring instrument** rather than in a check.
|
||||
|
||||
§6 is re-taken at `peak_cap_w` 1500 / house 1200 / `max_w` 2000, across the
|
||||
whole run. Harness `/home/homelab/s47-mut/shadowloop47.py`.
|
||||
|
||||
---
|
||||
|
||||
## 5. The grader, so this class cannot recur
|
||||
|
||||
`test_arbitrage.py` part **3d** — placed beside part 3c, which is SAFETY-45's
|
||||
own closed-loop regression, and built on the **same** `s45_loop()` harness so
|
||||
the two runs share every line of shipped code and differ in **one argument**:
|
||||
|
||||
```
|
||||
s45_loop(sized=True) the live hour
|
||||
s45_loop(sized=True, shadow=True) the same hour, battery held at WIRE_W
|
||||
s45_loop(sized=False, shadow=True) SAFETY-45's own defect, watched from
|
||||
inside shadow mode
|
||||
```
|
||||
|
||||
Three lines of `s45_loop()` stand in for `Controller._write_unit()`'s
|
||||
substitution and `_shadow_settle()`'s record and re-seed. They are marked as a
|
||||
**transcription**; `test_clamp.py` part 8 is the check on the shipped
|
||||
placement, and it drives the real `Controller`. Everything that produces a
|
||||
number — the averager, the projection, the guard, the headroom, the strategy,
|
||||
the arbiter, the row and the log sentence — is the shipped one.
|
||||
|
||||
What 3d grades, in order: that the cap **binds** (the precondition the old
|
||||
evidence lacked); that the first charging cycle agrees **anyway**; that the
|
||||
whole run diverges, and by how much; that the record is an **upper bound**, and
|
||||
the two-point arithmetic that makes it one; what survives of the exemption;
|
||||
that SAFETY-45's limit cycle and the guard's engagements are **not** visible;
|
||||
the four rungs of `sized_from_meter()`, each reached with the other three clear
|
||||
(TEST-16); both operator surfaces; the `capped`-keying trap; and main.py's
|
||||
three call sites, pinned on the AST.
|
||||
|
||||
⚠️ **The section carries its own precondition into every check.** A mutation
|
||||
that stops either run trading left the lists empty, the first `min()` raised,
|
||||
the file died before part 4 and the run reported **zero reds — which reads
|
||||
exactly like a survivor**. That is FCST-06's shape and it was **driven**, not
|
||||
imagined. `s47check()` now fails every check in the section when the stimulus
|
||||
was not produced, and the one division in it answers `nan` rather than raising.
|
||||
|
||||
---
|
||||
|
||||
## 6. The mutation battery — 14 mutations, no survivors
|
||||
|
||||
Harness `/home/homelab/s47-mut/run.py`, backups inside it. Each run restores
|
||||
from backup, purges `__pycache__` **on the host**, and grades through the CI
|
||||
image with the tree bind-mounted `:ro`, so the interpreter cannot write a cache
|
||||
into the tree under test (TEST-15). Fingerprints are printed before the first
|
||||
run and re-checked after the last restore.
|
||||
|
||||
| # | mutation | file | Δ | reds |
|
||||
|---|---|---|---|---|
|
||||
| M1 | the row drops the caveat branch | `shadow.py` | −63 B | 2 |
|
||||
| M2 | **the trap**: `sized_from_meter()` keyed on the trade being CAPPED — silent where the record is multiples out | `arbitrage.py` | +33 B | 5 |
|
||||
| M3 | the CHARGE rung dropped — a sell carries a caveat §9.1 makes false | `arbitrage.py` | −30 B | 1 |
|
||||
| M4 | the measured-headroom rung dropped | `arbitrage.py` | −18 B | 1 |
|
||||
| M5 | the arbiter-winner rung dropped — a caveat on somebody else's number | `arbitrage.py` | −33 B | 1 |
|
||||
| M6 | `main.py` renders the row with `sized_from_meter=False` | `main.py` | −23 B | 1 |
|
||||
| M7 | `main.py` drops `winner=` — the rung exists and is never reached | `main.py` | −1 B | 1 |
|
||||
| M8 | `main.py` sizes the trade from a literal — SAFETY-45 out of the shipped path, which the hoist put at risk | `main.py` | −41 B | 2 |
|
||||
| M9 | the headroom assignment moves out of `cycle()` | `main.py` | −39 B | 1 |
|
||||
| M10 | `sized_from_meter` gains a `False` default (TEST-14) | `shadow.py` | +8 B | 1 |
|
||||
| M11 | `ON THIS CYCLE` deleted — the row forecasts again | `shadow.py` | −14 B | 1 |
|
||||
| M12 | `log_line()` drops the caveat — the page discloses, the record does not | `shadow.py` | −63 B | 2 |
|
||||
| M13 ⚠️ | `main.py` re-assembles the log sentence at the call site | `main.py` | **+0 B** | 1 |
|
||||
| M14 ⚠️ | `wanted = batt_w − excess` — the headroom stops being monotone in the battery and the row's UPPER BOUND sentence becomes false | `peakguard.py` | **+0 B** | 38 |
|
||||
|
||||
**Survivors: none.**
|
||||
|
||||
⚠️ **M13 and M14 are `+0 B`, which MUTATION.md names as the risky delta.** Both
|
||||
were confirmed on disk by `sha256` before the run started — the harness prints
|
||||
the fingerprint of every graded file and the hash moved for each — and every
|
||||
run is purged, so neither is at risk of the stale-`.pyc` failure.
|
||||
|
||||
⚠️ **Two findings from driving it, both reported rather than tidied away.**
|
||||
|
||||
* **M14's first form was aimed at the wrong direction and correctly survived.**
|
||||
`min` → `max` in the buy leg's sizing makes the shadow record *larger*, which
|
||||
is still an upper bound, so 3d-3b was right not to fail. The mutation that
|
||||
actually inverts the bound is the sign of the excess term in `wanted`. A
|
||||
survivor that is right is worth more than a red aimed at the wrong claim.
|
||||
* **M12 was a survivor before the fix it forced.** Deleting the caveat from the
|
||||
action-log line left **all 29 files green**: the only check that could see
|
||||
that line drives a fixture with `meter_source: off`, where no arbitrage
|
||||
decision — and therefore no caveat — is reachable. The sentence was an
|
||||
f-string inside `Controller._shadow_settle()`, i.e. a surface no check could
|
||||
grade. It is `shadow.log_line()` now, for the reason `words()` is a function,
|
||||
and M13 is the mutation that puts it back at the call site.
|
||||
@@ -0,0 +1,182 @@
|
||||
# TEL-10 — the loop's integrator is published, as three site rows
|
||||
|
||||
**Status:** decided and implemented on branch `TEL-10`.
|
||||
**Card:** TEL-10 — *"`self.i_w` is carried between cycles and published nowhere"*.
|
||||
**Nothing here reached the inverter, and nothing here can.** `app/control.py`
|
||||
is not touched by this branch; `compute()`, its returned `Decision` and every
|
||||
constant it reads are byte-identical to `release/1.0`. The diff is a controller
|
||||
recording three values it already had, and a publisher announcing three rows.
|
||||
|
||||
---
|
||||
|
||||
## 0. The three things a reader should take away
|
||||
|
||||
1. **The row that matters is the one that is usually indistinguishable from
|
||||
`Setpoint`.** With nothing binding, the command *is* the integrator rounded
|
||||
to 10 W, so on a quiet day publishing the wrong one looks correct. §2 is
|
||||
the fixture that separates them by kilowatts, and §4 is the mutation that
|
||||
proves the separation is what the check reads.
|
||||
2. **`Loop reason` is a genuinely new sentence, not a second copy of one.** The
|
||||
status page's `Why` row and `sensor.goodwe_controller_status` both carry the
|
||||
*arbiter's* line (`loop -> -5000 W`), which prints the winning claim's NAME.
|
||||
`compute()`'s own reason has never left the process, and `slew-limited` — the
|
||||
value SAFETY-48 is about — appears in neither of the other two. §3.
|
||||
3. ⚠️ **Three entities are three entities.** This is an addition to a live
|
||||
install's entity list, which TEL-07 refused to make for four per-unit rows
|
||||
at a roster of one. The argument for making it here is in §5, and so is the
|
||||
argument that keeps it to three rather than to one per inverter.
|
||||
|
||||
---
|
||||
|
||||
## 1. Why this is a card at all
|
||||
|
||||
`self.i_w` has been a separate quantity from the command since SAFETY-04, which
|
||||
split the accumulator out of the velocity form precisely so the two could be
|
||||
bounded apart. Since then it has been:
|
||||
|
||||
* carried between cycles by `Controller.cycle()`,
|
||||
* read by nothing outside `compute()`,
|
||||
* and written to no entity, no MQTT topic, no attribute and no log line.
|
||||
|
||||
The consequence is not theoretical. The investigation behind SAFETY-48 needed to
|
||||
know what the integrator was doing during the export episodes and could only
|
||||
**reconstruct** it, from the grid trace plus a replay of the real `compute()`.
|
||||
The reconstruction reproduced about a third of the engagements it was checked
|
||||
against and was **discarded entirely** — so the card it was gathered for had to
|
||||
be argued from a measurement nobody could stand behind.
|
||||
|
||||
⚠️ **And the reconstruction could not have been made to work.** `i_w` at a given
|
||||
instant depends on every cycle before it, including every one in which the
|
||||
arbiter overrode the loop and `main.py` re-seeded `self.i_w = self.target`. That
|
||||
re-seed is invisible in the grid trace. A replay can only recover the integrator
|
||||
on a run where the loop won every arbitration, which is not the run anybody is
|
||||
investigating.
|
||||
|
||||
## 2. What is published, and against what
|
||||
|
||||
Three rows, on the SITE device, appended after `release/1.0`'s eight sensors:
|
||||
|
||||
| key | entity | what it is |
|
||||
|---|---|---|
|
||||
| `loop_i` | `sensor.goodwe_loop_integrator` | `Decision.i_w` — the accumulator AFTER this cycle, BEFORE the output clamp, the slew limit and quantisation, which is what its own docstring says it is |
|
||||
| `loop_lead` | `sensor.goodwe_loop_integrator_lead` | `decision.i_w - prev_w`, where `prev_w` is the command `compute()` was handed |
|
||||
| `loop_reason` | `sensor.goodwe_loop_reason` | `Decision.reason`, unmodified |
|
||||
|
||||
⚠️ **`loop_lead` IS NOT A SUBTRACTION OF THE OTHER TWO ROWS, WHICH IS WHY IT IS
|
||||
A ROW.** `Setpoint` is the ARBITER's output, after every other strategy has had
|
||||
its say, and it is THIS cycle's; the lead is measured against the command the
|
||||
PREVIOUS cycle left standing. On any cycle where the arbiter overrode the loop,
|
||||
subtracting the two published rows gives a different number — and that is
|
||||
exactly the cycle on which `main.py` re-seeds the integrator, i.e. the cycle a
|
||||
reader most needs the real figure for.
|
||||
|
||||
`cycle()` therefore records all three from the one `compute()` call, and names
|
||||
the command it passes (`loop_prev`) rather than re-reading `self.target` at
|
||||
publish time. `self.target` is reassigned later in the same method, so a lead
|
||||
computed at publish time would subtract a different cycle's command and call the
|
||||
answer a lead. ⚠️ **At the line as written the two expressions are the same
|
||||
value, and the mutation that swaps them is a recorded SURVIVOR** — see §4 M2.
|
||||
The name is kept for the coupling, not for a behaviour it currently buys.
|
||||
|
||||
### The not-running branch
|
||||
|
||||
`cycle()`'s `else` arm — stopped AND shadow mode off — already zeroes
|
||||
`self.i_w`, because no accumulation may survive the outage. The three rows are
|
||||
zeroed and `loop_reason` becomes `not-running` on the same branch. A row that
|
||||
kept repeating the last integrator there would say the loop was winding while
|
||||
nothing is being controlled.
|
||||
|
||||
⚠️ **`auto: false` ALONE IS NOT THAT BRANCH.** The shipped `shadow_mode: auto`
|
||||
means a stopped controller still runs the whole decision path and records it
|
||||
(SAFETY-10), so the loop is live and the integrator is real. The first draft of
|
||||
the check asserted `not-running` about a loop that was running; it reads the
|
||||
shadow case as its own claim now.
|
||||
|
||||
## 3. Why `loop_reason` is not the row that already exists
|
||||
|
||||
`self.reason` is `Resolution.explain()`:
|
||||
|
||||
```
|
||||
"loop -> -5000 W" # winner, watts
|
||||
"loop -> -5000 W, limited by soc" # ...and which limit bit
|
||||
"CONTRADICTION between limits - commanding 0 W (loop)"
|
||||
```
|
||||
|
||||
`Claim.set("loop", P_LOOP, decision.target_w, decision.reason, ...)` does carry
|
||||
the loop's reason INTO the arbiter — and `explain()` prints the winner's
|
||||
**source name**, never the claim's reason. So the loop's own word has always
|
||||
been built, handed over, and dropped one line later.
|
||||
|
||||
Measured on the fixture in `test_telemetry.py` part 2, same cycle:
|
||||
|
||||
```
|
||||
the arbiter's sentence: 'loop -> -5000 W'
|
||||
the loop's own word : 'i-clamped'
|
||||
```
|
||||
|
||||
## 4. Verified by breaking it
|
||||
|
||||
Nine mutations, run in the CI image on a purged tree, each fingerprinted before,
|
||||
after, and again after the revert. The table with byte deltas and red counts is
|
||||
in `test_telemetry.py`'s header; two entries are worth repeating here.
|
||||
|
||||
**M1 — `self.loop_i_w = loop_prev` (−3 B), the card's own named mutation:
|
||||
publish the COMMAND under the integrator's name.** The first draft of the
|
||||
acceptance check was *"the published integrator reaches its bound"*, and that
|
||||
check was **GREEN** under M1 — because the command reaches the bound too, twelve
|
||||
cycles later. MUTATION.md habit 4 in the check written to close the card. It
|
||||
asserts the **lead time** now (the integrator is at the bound at least ten
|
||||
cycles before the command is), and is red on 5 named checks.
|
||||
|
||||
**M2 — `decision.i_w - self.target` (+2 B) is a SURVIVOR, and is reported as
|
||||
one.** At that line `cycle()` has not yet executed `self.target =
|
||||
resolution.target_w`, so the two expressions denote the same value and the
|
||||
mutation changes nothing that runs. The run was purged, which is not the
|
||||
direction stale bytecode fabricates. M2b (`decision.i_w - decision.target_w`,
|
||||
+8 B) is the mutation that does change the value and is red.
|
||||
|
||||
## 5. What was rejected
|
||||
|
||||
**Publishing as an MQTT attribute on an existing entity.** There is no
|
||||
`json_attributes_topic` anywhere in this add-on; adding one would be a second
|
||||
convention for one card, and HA's recorder keeps long-term statistics for a
|
||||
state with `state_class`, not for an attribute. The reason this card exists is
|
||||
that nobody had history to read.
|
||||
|
||||
**A status-page row instead.** The page is not recorded. `Why` already carries
|
||||
the arbiter's sentence and stays that way; DOCS.md gains the section that says
|
||||
how to read the three entities.
|
||||
|
||||
**One integrator row per inverter.** §6.2's architecture is ONE integrator on
|
||||
the P1 meter whose output is then SPLIT. A per-unit copy would invent N of a
|
||||
thing there is one of, and the two copies would disagree the moment the
|
||||
allocator gave the units different shares. `test_mqtt.py` part 5 grades this at
|
||||
every roster length from 1 to 6, and the mutation that moves `loop_i` into
|
||||
`UNIT_SENSORS` is red on 8 named checks.
|
||||
|
||||
**Adding the rows at N≥2 only, the way TEL-07 gates its per-unit rows.**
|
||||
TEL-07's gate exists because at a roster of one its four rows carry information
|
||||
the site rows already carry exactly. These three carry information NOTHING
|
||||
carries, at every roster length, including one.
|
||||
|
||||
**A `## Unreleased` block in `CHANGELOG.md`.** `test_version_gate.py` part 11b
|
||||
refuses a changelog whose newest `## ` heading is not `config.yaml`'s
|
||||
`version:` — PKG-14's rule that the bump and the closed section are one act.
|
||||
Opening a section here would mean bumping the version, which is a packaging
|
||||
decision this card does not get to take. The operator-facing account is in
|
||||
DOCS.md; the release note belongs to whichever PKG ticket cuts the next
|
||||
version, and this file is what it should be written from.
|
||||
|
||||
## 6. What this card does NOT establish
|
||||
|
||||
* **It says nothing about whether the integrator's behaviour is right.** That is
|
||||
SAFETY-48. This branch adds an observable and changes no decision; the
|
||||
15.7-day replay that grades the behaviour is in that card.
|
||||
* **The three rows do not exist on the live install until the add-on is
|
||||
updated**, and this branch does not update it. `tools/rehearsal/announced-
|
||||
reference.txt` (what the BUILD announces) records them; `live-entities-
|
||||
recorded.txt` (what the INSTALL has) deliberately does not, because an id the
|
||||
build announces and the install lacks is a new entity, not an orphan.
|
||||
* **`loop_lead` is signed and is not a distance.** Where the integrator and the
|
||||
command have opposite signs it is the sum of two magnitudes. A reader wanting
|
||||
"how far behind is the command" should take the magnitude and say so.
|
||||
+139
-17
@@ -287,8 +287,10 @@ it always has.
|
||||
published — `Setpoint`, `Grid power`, `Battery power`, `Battery SoC`,
|
||||
`Circulating power`, `Maintenance phase`, `Controller status`, `P1 sample age` —
|
||||
keep their device, their `unique_id`s and therefore their **entity ids and their
|
||||
whole recorded history**. At a roster of one, nothing new is announced at all:
|
||||
no second device, no renamed entity, not one added topic.
|
||||
whole recorded history**. At a roster of one, nothing new is announced by the
|
||||
per-unit machinery at all: no second device, no renamed entity, not one added
|
||||
topic. (TEL-10's three loop rows, below, are site rows and are added at every
|
||||
roster length, including one.)
|
||||
|
||||
Declare a second inverter and **four rows per unit** appear beside them:
|
||||
|
||||
@@ -321,7 +323,53 @@ arrives, and it fails silently and looks correct.
|
||||
There is one P1 meter and one grid connection; a per-inverter copy would invent
|
||||
two of a thing there is one of, and `P1 sample age` is a safety input. Same for
|
||||
`Circulating power` (it is a property of the *set* of inverters), the controller
|
||||
status, the maintenance phase and the capacity-tariff peak.
|
||||
status, the maintenance phase, the capacity-tariff peak and the three loop rows
|
||||
below.
|
||||
|
||||
### Reading the grid-following loop: `Loop integrator`, `Loop integrator lead`, `Loop reason`
|
||||
|
||||
The control law is a bounded integrator: an accumulator that is **not** the
|
||||
command. Each cycle it moves by `gain × error`; the command is then derived
|
||||
from it and passed through the output clamp, the slew limit and a 10 W
|
||||
quantisation before anything is written. Three entities publish what the
|
||||
accumulator is doing:
|
||||
|
||||
| entity | unit | what it is |
|
||||
|---|---|---|
|
||||
| `Loop integrator` | W | the accumulator **after** this cycle — the value *before* the clamp, the slew limit and quantisation |
|
||||
| `Loop integrator lead` | W | that value minus **the command it was computed against**, i.e. the command the previous cycle left standing |
|
||||
| `Loop reason` | — | the law's own word for this cycle |
|
||||
|
||||
`Loop reason` takes one of eight values:
|
||||
|
||||
| value | what happened |
|
||||
|---|---|
|
||||
| `tracking` | ordinary regulation |
|
||||
| `deadband` | the error is inside `deadband_w`; the loop is holding |
|
||||
| `i-clamped` | the integrator hit `integrator_max_w` (which follows `max_w` by default) |
|
||||
| `clamped` | the *command* came out over `max_w` — only reachable if `integrator_max_w` is deliberately set above the rail |
|
||||
| `slew-limited` | the command could not move as far as the integrator asked for; `slew_w` is what stopped it |
|
||||
| `saturated-freeze` | the inverter is not following, so the command's magnitude may fall but not rise |
|
||||
| `freeze-released` | the freeze had run out of plant-shaped explanations and the command was let move again |
|
||||
| `not-running` | control is stopped **and** shadow mode is off, so the loop did not run |
|
||||
|
||||
⚠️ **`Loop reason` is not the `Why` row on the status page, and the two will
|
||||
often disagree.** `Why` is the *arbiter's* sentence — `loop -> -1200 W` — which
|
||||
names the strategy that won and the watts it won with. It has never carried the
|
||||
strategy's own reason, so a loop that is slew-limited or frozen says so **only**
|
||||
here.
|
||||
|
||||
⚠️ **`Loop integrator` is not `Setpoint`, even though it usually looks like
|
||||
it.** With nothing binding, the command *is* the integrator rounded to 10 W, so
|
||||
on a quiet day the two rows track each other and the difference is a rounding
|
||||
step. They separate exactly when something is wrong: a large disturbance sends
|
||||
the integrator to its bound in one or two cycles while the command may only
|
||||
travel `slew_w` per cycle, and `Loop integrator lead` is the gap. A standing,
|
||||
large lead means the loop has wound up further than the command can follow, and
|
||||
the number of cycles needed to unwind it is that lead divided by `slew_w`.
|
||||
|
||||
Both numbers are `state_class: measurement`, so Home Assistant's recorder keeps
|
||||
long-term statistics for them.
|
||||
|
||||
⚠️ **Two roster names that differ only in punctuation or case** — `inverter-b`
|
||||
and `Inverter B` — are two names to the validator and one id once slugged. The
|
||||
@@ -650,8 +698,9 @@ decisions recorded while the loop runs.
|
||||
|
||||
**What you get out of it.** The status page carries a red-amber banner saying
|
||||
the battery is not being controlled, a `Shadow mode` row saying which rung
|
||||
decided, what it **would have commanded** and why, and the `Why` row with the
|
||||
arbiter's own sentence. The action log gets one line each time the decision
|
||||
decided, what it **would have commanded on that cycle** and why — with the
|
||||
caveat below, where the number was sized from a meter the battery never
|
||||
moved — and the `Why` row with the arbiter's own sentence. The action log gets one line each time the decision
|
||||
changes — the winner or the watts — rather than one per cycle, so a 40-row log
|
||||
still contains the context of what it found. MQTT reports `status: shadow`.
|
||||
|
||||
@@ -663,7 +712,12 @@ never saw it, and **latch a trip that survives into live operation and a
|
||||
restart**. The clamp (SAFETY-03), the write-authorisation gate (SAFETY-28), the
|
||||
frozen-meter alarm (SAFETY-18) and the capacity guard all **observe**: they run
|
||||
on the number the decision path produced, so a shadow run can tell you the
|
||||
clamp would have engaged. The circulation (SAFETY-31) and delivery (SAFETY-42)
|
||||
clamp would have engaged. ⚠️ **The capacity guard observes a meter with no
|
||||
battery in it.** Every term of the quantity it thresholds is measured, so it
|
||||
engages in a shadow run only if the *house alone* would have put the quarter
|
||||
over the ceiling — 410 engaged cycles live against 0 in shadow, on the hour
|
||||
tabulated below. Its *ceiling* and its *reasons* are worth reading from a
|
||||
shadow run; its *engagements* are not evidence of anything. The circulation (SAFETY-31) and delivery (SAFETY-42)
|
||||
watchdogs observe and may legitimately latch, because their evidence is
|
||||
*measured* power, not a command. The operator stop is enforced at the wire
|
||||
instead of as a claim, so that the recorded decision is the real one.
|
||||
@@ -678,17 +732,85 @@ every cycle whether control is started or not, so they already run against a
|
||||
battery that does not move on a stopped install. Shadow mode inherits that
|
||||
exactly; it neither improves it nor makes it worse.
|
||||
|
||||
⚠️ **What a shadow run will NOT tell you.** The controller's carried command is
|
||||
re-seeded to the 0 W standing on the wire at the end of every shadow cycle —
|
||||
that is what makes turning shadow mode off safe, because the loop then resumes
|
||||
from where the battery actually is. The consequence is that the
|
||||
**grid-following loop's** recorded decision is **one slew step** and stays
|
||||
there: a shadow run answers *"what would it command now"*, not *"what
|
||||
trajectory would it have followed"*, because the trajectory depends on a
|
||||
battery responding and none did. The **strategies** are unaffected — price
|
||||
arbitrage, the capacity guard and maintenance all ask for a fixed power from
|
||||
inputs that do not depend on what the battery did — so a shadow run does show
|
||||
you the trades, the peak-guard engagements and the SoC-limit behaviour.
|
||||
⚠️ **What a shadow run will NOT tell you — and it is a whole category, not a
|
||||
footnote.** The controller's carried command is re-seeded to the 0 W standing
|
||||
on the wire at the end of every shadow cycle — that is what makes turning
|
||||
shadow mode off safe, because the loop then resumes from where the battery
|
||||
actually is. Everything below follows from the same fact.
|
||||
|
||||
**A shadow run cannot show you a closed-loop defect. Not partially — not at
|
||||
all.** The battery is held at 0 W, so every *measured* input — the meter, the
|
||||
billed-quarter accumulator behind it, the battery power, the state of charge —
|
||||
describes a plant that did not respond. A closed-loop defect is one whose
|
||||
stimulus **is** the plant's response, and there is no response to be the
|
||||
stimulus. This is not a gap waiting to be closed: feeding the guards a
|
||||
simulated plant instead is exactly what the sign-watchdog decision below
|
||||
refuses, and for the same reason — a controller reacting to a plant that does
|
||||
not exist drifts further from reality every tick. **The closed-loop answer
|
||||
comes from the closed-loop rig or from a live run, and there is no third
|
||||
place.**
|
||||
|
||||
Concretely, measured on the rig at `peak_cap_w` 1500 under a 1200 W house,
|
||||
`max_w` 2000, one hour at a 5 s cycle — the same hour run twice, live and in
|
||||
shadow, on the same code:
|
||||
|
||||
| | live | shadow |
|
||||
|---|---|---|
|
||||
| charge onsets in the hour | **28** | **1** |
|
||||
| grid | **−455.5 … +3200.0 W** | **1200.0 W flat — the house** |
|
||||
| capacity guard engaged | **410 / 720 cycles** | **0 / 720** |
|
||||
| state of charge | 50.000019 → 51.856789 % | **50.000000 → 50.000000 %** |
|
||||
|
||||
(The onset and engagement figures are taken with the trade-sizing fix reverted,
|
||||
because that is the defect being looked for; the SoC and grid figures are the
|
||||
shipped build.)
|
||||
|
||||
⚠️ **The "strategies are unaffected" exemption that used to stand here was true
|
||||
until the trade-sizing fix landed, and is now false by hours.** That fix makes
|
||||
the buy leg `min(asked, headroom)`, where the headroom is
|
||||
`(900 / seconds remaining) × (ceiling − projected quarter average)` — and the
|
||||
projection reads the **open quarter's accumulator**, i.e. the meter, i.e. a
|
||||
function of what the battery did earlier in that same quarter. What survives
|
||||
of the exemption is exactly this much:
|
||||
|
||||
> **Which** hour a strategy picks, and **why**, are unaffected — the clock and
|
||||
> the price series are not functions of the battery. Measured: identical live
|
||||
> and shadow on 720 of 720 charging cycles at a binding cap. **How hard** it
|
||||
> trades is not.
|
||||
|
||||
⚠️ **So the watts on the `Shadow mode` row are the right answer to a question
|
||||
nobody asked, and the row now says so.** In a shadow run the billed quarter
|
||||
really *is* under its ceiling, because the battery really *is* not charging, so
|
||||
`900 / remaining` multiplies a gap a live run would have closed. On the same
|
||||
rig, shipped code:
|
||||
|
||||
| cap / house | live commanded | shadow recorded | over by |
|
||||
|---|---|---|---|
|
||||
| 1500 / 1200 | −302.4 W | **−2000.0 W** | **6.61×** |
|
||||
| 3500 / 3000 | −502.6 W | −2000.0 W | 3.98× |
|
||||
| 3500 / 2000 *(shipped cap)* | −1502.6 W | −2000.0 W | 1.33× |
|
||||
| 3500 / 1800 | −1702.6 W | −2000.0 W | 1.17× |
|
||||
| 15000 / 350 | −2000.0 W | −2000.0 W | 1.00× |
|
||||
|
||||
Whenever a measured billed quarter sized the number, the row and the action log
|
||||
carry **⚠️ AND ITS SIZE CAME FROM THE BILLED-QUARTER METER, WHICH HAS ONLY THE
|
||||
HOUSE IN IT WHILE THE BATTERY IS HELD AT 0 W** — and the watts are introduced
|
||||
as what it would have commanded **on this cycle**, in every state, because no
|
||||
number a shadow run records is a forecast of a live one. The figure is **not**
|
||||
re-computed to look right: a shadow-only sizing would mean the recorded
|
||||
decision was no longer the decision the shipped path reached, which is the one
|
||||
thing this feature has to be able to say.
|
||||
|
||||
The **grid-following loop** is the same story told first: its recorded decision
|
||||
is **one slew step** and stays there, because a trajectory depends on a battery
|
||||
responding and none did.
|
||||
|
||||
**What a shadow run genuinely is for**, then: *which* strategy wins, on *which*
|
||||
hour, at *which* price, for *which* reason, against which limits — the
|
||||
wrong-quarter-hour class of defect, a trade armed on a day it should not be, a
|
||||
refusal whose sentence names the wrong subsystem, a clamp that would have
|
||||
engaged, a standing failsafe latch. That is a real and useful set, and it is
|
||||
the set this feature covers.
|
||||
|
||||
#### The sign-disagreement failsafe
|
||||
|
||||
|
||||
@@ -172,7 +172,7 @@ manufactures them from a **fixture**: the check runs, the assertion is
|
||||
evaluated, the sentence above it is true — and the numbers it compares are
|
||||
arranged so that the failure it describes could not have changed the answer.
|
||||
|
||||
It is not hypothetical and it is not rare. ELEVEN instances in two weeks; four
|
||||
It is not hypothetical and it is not rare. TWELVE instances in two weeks; four
|
||||
were found by review, two - CFG-04's fixture pair - by an author's own mutation
|
||||
battery, which is the cheaper place, one by review again, in the one
|
||||
place nobody had thought to point the rule at: not a check in the suite, but a
|
||||
@@ -414,6 +414,44 @@ same place twice, the check is decoration.
|
||||
|
||||
The general habits are **14** and **15** below.
|
||||
|
||||
* ⚠️ **SAFETY-47 IS THE TWELFTH, AND IT IS THE SECOND INSIDE A COMMITTED
|
||||
EVIDENCE ARTIFACT.** `DECISIONS/SAFETY-10-shadow-mode.md` §6 tabulated a live
|
||||
run and a shadow run agreeing on `arb_power_w`, on the reason **verbatim**
|
||||
and on the arbiter's winner, and concluded that shadow mode reaches the same
|
||||
decision. **Two independent reasons it could not have gone red, and closing
|
||||
either one alone closes nothing:**
|
||||
* its fixture is `peak_cap_w: 15000` against a 350 W house, so the capacity
|
||||
guard never engages and the thing whose invariance is being claimed —
|
||||
SAFETY-45's sizing of the buy leg from the billed-quarter meter — is in the
|
||||
run and **inert**. ⚠️ **The harness's own comment says so**: *"at this
|
||||
scenario's `peak_cap_w: 15000` it is not binding anyway"*. The rule was
|
||||
written down beside the check it disabled and nobody read it as a
|
||||
disclosure;
|
||||
* and every identity row reads `_sa[0]`/`_la[0]` — **the first charging
|
||||
sample**. At `elapsed = 0` the projection **is** the held level, so the two
|
||||
runs agree **to the float even at a cap that does bind**. Measured:
|
||||
widening the fixture alone — the obvious fix — leaves that comparison
|
||||
passing.
|
||||
|
||||
⚠️ **THE SECOND REASON IS A NEW SHAPE FOR THIS LIST: AN INDEX, NOT A
|
||||
FIXTURE.** Ask of every identity claim not only *"could this data differ"*
|
||||
but *"**at the point I sampled it**, could it differ yet"*. A comparison
|
||||
taken at `t = 0` between two runs that diverge **because one of them acts**
|
||||
is a comparison of a plant with itself, and no amount of widening the fixture
|
||||
changes that. The replacement, `test_arbitrage.py` part 3d, grades the whole
|
||||
run — 716 of 720 charging cycles differ — and grades the `[0]` agreement **as
|
||||
an expectation**, so nobody rebuilds a check on it believing it covers
|
||||
something.
|
||||
|
||||
⚠️ **AND THE FIX'S OWN FIRST DRAFT CARRIED A THIRTEENTH.** The new part's
|
||||
action-log check could not reach the log line at all: the sentence was an
|
||||
f-string inside `Controller._shadow_settle()`, and the only suite that drives
|
||||
that method uses a `meter_source: off` fixture where no arbitrage decision —
|
||||
and therefore no caveat — exists. Deleting the caveat from it left **all 29
|
||||
files green**. It is `shadow.log_line()` now. *A sentence assembled at a call
|
||||
site is a sentence no check can grade*, which is CFG-04's substring lesson
|
||||
arriving from the other direction.
|
||||
|
||||
Note what these have in common with a masked rung: the mutation *runs*, and the
|
||||
suite is *honestly* green. Nothing in a purge, a fingerprint or a disassembly
|
||||
can see it, because the code under test really did behave identically on the
|
||||
|
||||
@@ -471,6 +471,67 @@ def _act(plan, now, v, soc, charge_w, discharge_w, floor_pct, ceiling_pct,
|
||||
price_now_eur_kwh=price)
|
||||
|
||||
|
||||
def sized_from_meter(decision: ArbitrageDecision, headroom_w, *,
|
||||
winner: str | None) -> bool:
|
||||
"""SAFETY-47. Was the number a shadow run just recorded SIZED FROM THE
|
||||
BILLED QUARTER - i.e. from a measurement of what the battery itself did?
|
||||
|
||||
THE ONE PLACE THIS QUESTION IS ANSWERED, and it is public for the reason
|
||||
`peakguard.charge_headroom_w()`, `discharge_permitted()` and
|
||||
`freeze.looks_frozen()` are: the check that grades it has to assert on THE
|
||||
SHIPPED EXPRESSION. A predicate transcribed into its own test is one copy
|
||||
plus a future disagreement about what the check means.
|
||||
|
||||
------------------------------------------------------------------------
|
||||
THE DEFECT IT PREVENTS
|
||||
|
||||
`shadow.words()` and the action log carry "would have commanded N W". In
|
||||
SHADOW MODE the battery is held at `shadow.WIRE_W`, so the billed quarter
|
||||
the buy leg was sized against contains THE HOUSE AND NOTHING ELSE - while
|
||||
a live run's meter rises as the trade charges. The same code, the same
|
||||
hour, `peak_cap_w` 1500 under a 1200 W house: live commands -302.4 W and a
|
||||
shadow run records -2000.0 W. 6.61x, on the status row, with no caveat.
|
||||
This is the flag that puts the caveat there.
|
||||
|
||||
⚠️ IT IS TRUE WHENEVER A MEASURED HEADROOM ENTERED THE ARITHMETIC, NOT
|
||||
ONLY WHEN IT BOUND. `_act()` sizes the buy leg as `min(asked, headroom)`,
|
||||
and "the headroom did not bind" is ITSELF a measured fact about a quarter
|
||||
the battery never entered. Keying this on `capped` - on whether the
|
||||
shipped sentence says "SIZED BY THE CAPACITY-TARIFF GUARD" - would answer
|
||||
True at the START of the quarter, where a shadow run and a live run still
|
||||
agree to the watt, and False at the END, where `(900/remaining)` has
|
||||
multiplied the headroom past the ask and the recorded number is at its
|
||||
most wrong. The quietest caveat exactly where it is needed loudest.
|
||||
|
||||
⚠️ THE BUY LEG ONLY. §9.1: "Discharge and export are never capped by the
|
||||
peak guard; only charging and import are." A sell is sized from
|
||||
`discharge_w`, which is the roster's own rating and not a measurement of
|
||||
the quarter, so a sell's recorded watts are NOT subject to this and must
|
||||
not carry a caveat that would then be false.
|
||||
|
||||
⚠️ AND THE ARBITER'S WINNER IS THE THIRD RUNG, NOT AN AFTERTHOUGHT. A trade
|
||||
that was sized from the meter and then OUT-RANKED is not the number being
|
||||
recorded - `Resolution.target_w` belongs to somebody else - and a caveat
|
||||
filed against somebody else's number is a false sentence on the status row,
|
||||
which is the defect class this whole card is about. It is in HERE and not
|
||||
in `main.py` for the reason the two rungs above are: all three answer one
|
||||
question, a check has to be able to reach each of them with the other two
|
||||
clear (TEST-16), and a rung that lives at a call site is a rung no check
|
||||
can drive.
|
||||
|
||||
`headroom_w` is whatever `peakguard.charge_headroom_w()` answered for the
|
||||
cycle this decision was taken on. ⚠️ None IS "NOTHING MEASURED IT", and
|
||||
`decide()` REFUSES the trade there (IDLE_HEADROOM_UNMEASURED), so a None
|
||||
can only ever arrive here beside a non-trading decision - but it is tested
|
||||
rather than assumed, because the caller is `main.py` and not this module.
|
||||
|
||||
`winner` is `Resolution.winner`: the source that actually set the watts.
|
||||
"""
|
||||
return (winner == SOURCE
|
||||
and decision is not None and decision.action == CHARGE
|
||||
and headroom_w is not None)
|
||||
|
||||
|
||||
def claim(decision: ArbitrageDecision) -> Claim | None:
|
||||
"""The decision as one arbiter claim, or None when nothing is to be traded.
|
||||
|
||||
|
||||
@@ -842,6 +842,18 @@ class Controller:
|
||||
# how a shadow run starts telling an operator a number nothing is
|
||||
# doing.
|
||||
self.shadow_would_w = None
|
||||
# SAFETY-47. Was the number above SIZED FROM THE BILLED-QUARTER METER
|
||||
# on the cycle it was recorded? ⚠️ IT IS RECORDED WHERE THE DECISION
|
||||
# WAS TAKEN, NOT RE-DERIVED WHERE THE PAGE IS RENDERED. The status page
|
||||
# runs on its own task and `self.peak_guard` has moved on by then, so a
|
||||
# page that asked the question again would be answering it about a
|
||||
# different cycle from the one whose watts it is displaying - which is
|
||||
# the same two-facts-one-field defect the comment above this one is
|
||||
# about. ⚠️ False AND NOT None BEFORE THE FIRST SHADOW CYCLE, unlike
|
||||
# the field above: this one is a claim ABOUT a number, and there is no
|
||||
# number yet, so the honest value is "nothing to disclose". The row's
|
||||
# `would_w is None` branch renders no watts at all there.
|
||||
self.shadow_sized_from_meter = False
|
||||
# Edge state for the action log, both of them. `_shadow_was` is None
|
||||
# until the first cycle, so an install that comes up IN shadow mode
|
||||
# says so in the log it will be read from rather than leaving the
|
||||
@@ -852,6 +864,13 @@ class Controller:
|
||||
self.target = 0.0
|
||||
self.sat_count = 0
|
||||
self.i_w = 0.0 # the loop's integrator, carried between cycles
|
||||
# TEL-10. What the last cycle's loop did, kept for publication. Seeded
|
||||
# to the SAME values the "stopped or blind" branch of `cycle()` writes,
|
||||
# because before the first cycle the loop has not run - which is the
|
||||
# thing that branch is for.
|
||||
self.loop_i_w = 0.0
|
||||
self.loop_i_lead = 0.0
|
||||
self.loop_reason = "not-running"
|
||||
self.loop_w = None # what the loop asked for last cycle, or None
|
||||
# Did the grid-following loop actually win the LAST arbitration? That is
|
||||
# the question SAFETY-02 has to ask about the command standing on the
|
||||
@@ -923,6 +942,12 @@ class Controller:
|
||||
# None (startup) or the PREVIOUS cycle's decision (an input hold), and
|
||||
# the status row rendered all three identically.
|
||||
self.arb_at = None
|
||||
# SAFETY-45/47. The billed-quarter charging headroom the arbitrage step
|
||||
# was handed on the cycle above, or None when nothing measured it. It
|
||||
# is CARRIED rather than recomputed for `arbitrage.sized_from_meter()`,
|
||||
# because `self.peak_guard` is a different cycle's decision by the time
|
||||
# the status page renders.
|
||||
self.arb_headroom_w = None
|
||||
# TARIFF-11. When the most recent cycle() STARTED. `arb_at < cycle_at`
|
||||
# is the exact, derived statement of "the latest cycle did not get as
|
||||
# far as the arbitrage step", which is the fact the *Arbitrage* row
|
||||
@@ -2818,9 +2843,16 @@ class Controller:
|
||||
# `arb_at` is then the age the status row reports rather than a
|
||||
# decision presented as current.
|
||||
self.arb, self.arb_at = None, now
|
||||
self.arb_headroom_w = None
|
||||
if arbitrage.enabled(self.o):
|
||||
floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
|
||||
charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
|
||||
# SAFETY-47. HOISTED OUT OF THE CALL, NOT COPIED. One evaluation of
|
||||
# the shipped expression feeds both the sizing below and
|
||||
# `arbitrage.sized_from_meter()` in `_shadow_settle()`, so the
|
||||
# caveat on the recorded watts can never be answered from a
|
||||
# different cycle's guard than the watts were.
|
||||
self.arb_headroom_w = peakguard.charge_headroom_w(self.peak_guard)
|
||||
self.arb = arbitrage.decide(
|
||||
self.fresh_tariff_plan(now), now,
|
||||
peak_guard_active=arbitrage.guard_state(self.peak_guard),
|
||||
@@ -2839,7 +2871,7 @@ class Controller:
|
||||
# peak block's conclusion, ~50 lines up, so it must stay after
|
||||
# it. Evaluated earlier it would size this quarter's trade from
|
||||
# the previous cycle's quarter.
|
||||
charge_headroom_w=peakguard.charge_headroom_w(self.peak_guard),
|
||||
charge_headroom_w=self.arb_headroom_w,
|
||||
# The emptiest pack again, and for the sell side that is the
|
||||
# right reduction. ⚠️ THE BUY SIDE WANTS THE FULLEST, and there
|
||||
# is one `soc` argument - `pack_floor_soc` names that residual
|
||||
@@ -3029,8 +3061,15 @@ class Controller:
|
||||
# level: the two halves of §6.2's identity break in opposite
|
||||
# directions. See `site_batt_w` and test_alloc.py part 8.
|
||||
site_batt = self.site_batt_w
|
||||
# TEL-10. ⚠️ ONE NAME FOR THE COMMAND THE LOOP WAS MEASURED
|
||||
# AGAINST. `self.target` is reassigned further down this method, so
|
||||
# a `decision.i_w - self.target` written at publish time would
|
||||
# subtract a DIFFERENT cycle's command and call the answer a lead.
|
||||
# The published lead is built from the value `compute()` was
|
||||
# actually handed, on the line that hands it over.
|
||||
loop_prev = self.target
|
||||
decision = compute(
|
||||
prev_w=self.target,
|
||||
prev_w=loop_prev,
|
||||
grid_w=self.grid,
|
||||
actual_w=site_batt,
|
||||
tuning=self.tuning,
|
||||
@@ -3043,6 +3082,41 @@ class Controller:
|
||||
self.sat_count = decision.sat_count
|
||||
self.i_w = decision.i_w
|
||||
self.loop_w = decision.target_w
|
||||
# --- TEL-10 ------------------------------------------------------
|
||||
# ⚠️ THE INTEGRATOR HAS NEVER LEFT THIS PROCESS, AND THAT IS WHAT
|
||||
# THE CARD IS. `self.i_w` is carried between cycles and published
|
||||
# nowhere - no entity, no attribute, no log line - so the only way
|
||||
# anyone has ever asked what it was doing is to RECONSTRUCT it from
|
||||
# the grid trace and a replay. That reconstruction reproduced about
|
||||
# a third of the engagements it was checked against and was thrown
|
||||
# away; a card that has to be argued from a discarded reconstruction
|
||||
# is a card that cannot be argued.
|
||||
#
|
||||
# Three rows, and the third is not derivable from the first two by
|
||||
# anyone reading the dashboard afterwards:
|
||||
#
|
||||
# `loop_i` the integrator AFTER this cycle - `Decision.i_w`,
|
||||
# which its own docstring says is the value BEFORE
|
||||
# the output clamp, the slew limit and quantisation.
|
||||
# It is therefore NOT `setpoint` and must never be
|
||||
# published from it.
|
||||
# `loop_lead` how far the integrator stands AHEAD of the command
|
||||
# it was computed against. This is the quantity
|
||||
# SAFETY-48 bounds, and `integrator_max_w / slew_w`
|
||||
# is the number of cycles it takes to unwind.
|
||||
# `loop_reason` `compute()`'s OWN reason string - `deadband`,
|
||||
# `i-clamped`, `clamped`, `slew-limited`,
|
||||
# `saturated-freeze`, `freeze-released`, `tracking`.
|
||||
#
|
||||
# ⚠️ AND `loop_reason` IS NOT `self.reason`. `self.reason` is the
|
||||
# ARBITER's sentence (`resolution.explain()`, e.g. "loop -> 1200 W")
|
||||
# and it does not carry the loop's own word at all: the Claim filed
|
||||
# below takes `decision.reason` and `Resolution.explain()` prints the
|
||||
# winner's NAME, not the winner's reason. The status page's "Why"
|
||||
# row is the arbiter's sentence and stays that way.
|
||||
self.loop_i_w = decision.i_w
|
||||
self.loop_i_lead = decision.i_w - loop_prev
|
||||
self.loop_reason = decision.reason
|
||||
# --- SAFETY-03 ---------------------------------------------------
|
||||
# ⚠️ READ THE BOOLEANS, NOT `decision.reason`. On a default install
|
||||
# the integrator bound is what bites and the output clamp is
|
||||
@@ -3067,6 +3141,15 @@ class Controller:
|
||||
# Stopped or blind: no accumulation may survive the outage.
|
||||
self.i_w = 0.0
|
||||
self.loop_w = None
|
||||
# TEL-10, and it is the same zero the line above writes rather than
|
||||
# a second opinion about it. ⚠️ `not-running` rather than a stale
|
||||
# `tracking`: a reason row that keeps repeating the last word the
|
||||
# loop said while the loop is not running is a row that reads as
|
||||
# health, which is the failure `publish()`'s own None-dropping note
|
||||
# is about one field over.
|
||||
self.loop_i_w = 0.0
|
||||
self.loop_i_lead = 0.0
|
||||
self.loop_reason = "not-running"
|
||||
# A loop that is not running cannot be winding. Clearing this here
|
||||
# rather than letting the last value stand is what makes the alarm
|
||||
# de-assert when control is stopped.
|
||||
@@ -3424,20 +3507,37 @@ class Controller:
|
||||
"%+.0f W that was standing on the wire.", shadow.WIRE_W)
|
||||
if not engaged:
|
||||
self.shadow_would_w = None
|
||||
self.shadow_sized_from_meter = False
|
||||
self._shadow_winner = None
|
||||
return
|
||||
self.shadow_would_w = float(resolution.target_w)
|
||||
# SAFETY-47. ⚠️ NO LOGIC HERE, DELIBERATELY. All three rungs - the
|
||||
# arbiter's winner, the leg being a CHARGE, and the headroom having
|
||||
# been MEASURED - live inside `arbitrage.sized_from_meter()`, which
|
||||
# says why, including why it is NOT keyed on whether the trade was
|
||||
# capped. A rung written at a call site is a rung no check can reach
|
||||
# with the other two clear, which is TEST-16's rule.
|
||||
self.shadow_sized_from_meter = arbitrage.sized_from_meter(
|
||||
self.arb, self.arb_headroom_w, winner=resolution.winner)
|
||||
# ⚠️ THE WINNER AND THE ROUNDED WATTS, NOT THE WATTS ALONE. A decision
|
||||
# that moves from the loop to the peak guard at the same number is a
|
||||
# different decision and the operator needs the line; a loop target
|
||||
# that wanders by a watt is not, and 15 s of those would be the whole
|
||||
# log.
|
||||
edge = (resolution.winner, round(float(resolution.target_w)))
|
||||
# ⚠️ SAFETY-47 ADDS THE CAVEAT FLAG TO THE EDGE. The same winner at the
|
||||
# same watts with and without the caveat are two different claims about
|
||||
# the same number, and an edge key blind to that would print the first
|
||||
# one and silently keep it standing. It cannot flood: the flag only
|
||||
# moves when arbitrage starts or stops owning the resolution, or when
|
||||
# the guard starts or stops measuring the quarter, and both of those
|
||||
# move the winner or the watts as well on every cycle measured.
|
||||
edge = (resolution.winner, round(float(resolution.target_w)),
|
||||
self.shadow_sized_from_meter)
|
||||
if edge != self._shadow_winner:
|
||||
self._shadow_winner = edge
|
||||
self.log_event(
|
||||
f"SHADOW: would have commanded {resolution.target_w:+.0f} W - "
|
||||
+ resolution.explain())
|
||||
self.log_event(shadow.log_line(
|
||||
would_w=resolution.target_w, reason=resolution.explain(),
|
||||
sized_from_meter=self.shadow_sized_from_meter))
|
||||
self.target = shadow.WIRE_W
|
||||
for inv in self.inverters:
|
||||
inv.target = shadow.WIRE_W
|
||||
@@ -4246,6 +4346,14 @@ class Controller:
|
||||
# rather than publishing a zero that would read as health.
|
||||
"circulation": (None if self.site_circulating_w is None
|
||||
else round(self.site_circulating_w)),
|
||||
# TEL-10. The loop's own three, written from the fields `cycle()`
|
||||
# recorded and not re-derived here - the page and the publisher run
|
||||
# on their own tasks and `self.target` has moved on by the time
|
||||
# either of them looks (SAFETY-47's note on `sized_from_meter`, one
|
||||
# field up, is the same hazard).
|
||||
"loop_i": round(self.loop_i_w, 1),
|
||||
"loop_lead": round(self.loop_i_lead, 1),
|
||||
"loop_reason": self.loop_reason,
|
||||
}
|
||||
# ⚠️ ONLY when P1 ingestion is actually running. The ESP32's stale-input
|
||||
# watchdog subscribes to sensor.goodwe_p1_sample_age - see the entity-id
|
||||
@@ -4865,7 +4973,12 @@ class Controller:
|
||||
# learn something is a surface you have to already know about.
|
||||
("Shadow mode", shadow.words(
|
||||
self.o, control_started=self.auto,
|
||||
would_w=self.shadow_would_w, reason=self.reason)),
|
||||
would_w=self.shadow_would_w,
|
||||
# SAFETY-47. THE FLAG THE CYCLE RECORDED, NOT ONE DERIVED HERE
|
||||
# - the page runs on its own task and `self.peak_guard` has
|
||||
# moved on. See `Controller.__init__`.
|
||||
sized_from_meter=self.shadow_sized_from_meter,
|
||||
reason=self.reason)),
|
||||
("Why", self.reason),
|
||||
("Maintenance phase", self.maint.phase if len(self.inverters) <= 1
|
||||
else f"{self.maint.phase} ({self.maint_unit.name})"),
|
||||
|
||||
@@ -85,6 +85,36 @@ SENSORS = [
|
||||
# sensor's VALUE rather than its arrival, so a dead publisher freezes the
|
||||
# number and reads permanently fresh. Filed as TEL-06.
|
||||
("p1_age", "p1_sample_age_s", "P1 sample age", "s", "duration", "measurement", None),
|
||||
# --- TEL-10: the loop's integrator, published for the first time ---------
|
||||
#
|
||||
# ⚠️ APPENDED, AND THE POSITION IS THE POINT. `discovery_payloads()` walks
|
||||
# this list in order and `_announce()` publishes what it returns, so a row
|
||||
# inserted ABOVE would move every later entity's place in the announcement.
|
||||
# Nothing existing is renamed, re-typed or re-ordered by these three; they
|
||||
# are three NEW retained topics after the nine that are already there, and
|
||||
# test_mqtt.py part 1 grades exactly that claim.
|
||||
#
|
||||
# ⚠️ AND THEY ARE SITE ROWS, NOT PER-UNIT ONES. There is one integrator -
|
||||
# §6.2's architecture is ONE integrator on the P1 meter whose output is then
|
||||
# SPLIT - so a per-unit copy would invent N of a thing there is one of, the
|
||||
# same argument `grid` and `p1_age` are site rows for.
|
||||
#
|
||||
# `state_class: measurement` on the two numbers is what puts them in the
|
||||
# recorder's statistics, which is the whole point: the reason this card
|
||||
# exists is that the last investigation had no history to read.
|
||||
("loop_i", "goodwe_loop_integrator", "Loop integrator", "W", "power", "measurement", None),
|
||||
# ⚠️ NOT DERIVABLE FROM THE TWO ROWS EITHER SIDE OF IT, which is why it is
|
||||
# its own row rather than a subtraction a dashboard could do. `setpoint` is
|
||||
# the ARBITER's output after every other strategy has had its say, and it is
|
||||
# also THIS cycle's; the lead is measured against the command `compute()`
|
||||
# was handed, which is the PREVIOUS one. Subtracting the published rows
|
||||
# gives a different number on every cycle the arbiter overrode the loop.
|
||||
("loop_lead", "goodwe_loop_integrator_lead", "Loop integrator lead", "W", "power", "measurement", None),
|
||||
# ⚠️ NOT `sensor.goodwe_controller_status` AND NOT THE "Why" ROW. Both of
|
||||
# those carry the ARBITER's sentence; this is `compute()`'s own word for
|
||||
# what the control law did with this cycle - `slew-limited` is the value
|
||||
# SAFETY-48 is about and it appears in neither of the other two.
|
||||
("loop_reason", "goodwe_loop_reason", "Loop reason", None, None, None, "mdi:sigma"),
|
||||
]
|
||||
|
||||
BASE = "goodwe_ctl"
|
||||
|
||||
+169
-12
@@ -19,6 +19,83 @@ learn nothing. Shadow mode is the third option: strategies, arbiter, clamps and
|
||||
guards all run, the decision is recorded with its reason, and NOTHING THE
|
||||
CONTROLLER DECIDES REACHES THE INVERTER.
|
||||
|
||||
⚠️ AND OF THOSE THREE, A SHADOW RUN CAN SHOW YOU EXACTLY ONE - SEE THE NEXT
|
||||
SECTION. This header used to name SAFETY-45's limit cycle as the example
|
||||
of what shadow mode surfaces. That was false, and SAFETY-47 measured it.
|
||||
|
||||
⚠️ WHAT A SHADOW RUN CAN AND CANNOT SHOW (SAFETY-47)
|
||||
=====================================================
|
||||
SHADOW MODE CANNOT SURFACE A CLOSED-LOOP DEFECT. Not badly, not partially -
|
||||
NOT AT ALL, and by the same construction that makes it safe. The actuator is
|
||||
held at WIRE_W and the carried command is re-seeded to WIRE_W, so every
|
||||
MEASURED input - the meter, the quarter accumulator behind it, the battery
|
||||
power, the state of charge - describes a plant that DID NOT RESPOND. A
|
||||
closed-loop defect is by definition one whose stimulus is the plant's response
|
||||
to the controller. No response, no stimulus, no defect to see.
|
||||
|
||||
That is not a gap to be closed later. Feeding the guards a simulated plant
|
||||
instead is what SAFETY-10 §4 refuses for the sign watchdogs, for a reason that
|
||||
applies to all of this: a controller reacting to a plant that does not exist
|
||||
drifts further from reality every tick, and three cycles in its numbers
|
||||
describe nothing. THE CLOSED-LOOP ANSWER COMES FROM A CLOSED-LOOP RIG
|
||||
(TEST-23 stage 3) OR FROM A LIVE RUN. There is no third place.
|
||||
|
||||
So, of the three defects above, measured on that rig at `peak_cap_w` 1500 /
|
||||
house 1200 / `max_w` 2000, one hour at a 5 s cycle:
|
||||
|
||||
* SAFETY-45's limit cycle NOT VISIBLE. Live: 28 charge onsets, the grid
|
||||
swinging -455.5 .. +3200.0 W, the guard engaged
|
||||
on 410 of 720 cycles. Shadow, same hour, same
|
||||
code: 1 onset, the grid flat at the 1200 W
|
||||
house, the guard engaged on 0 of 720. Every
|
||||
term of `wanted = batt_w + excess` is measured.
|
||||
* SAFETY-46's SoC churn NOT VISIBLE. The SoC moves 0.000000000 pp in a
|
||||
shadow run, because it is the pack's integral of
|
||||
what the pack was commanded and the pack was
|
||||
commanded 0 W. No SoC limit can be REACHED in a
|
||||
shadow run; the ones already crossed when it
|
||||
started are reported, and that is all.
|
||||
* TARIFF-14's wrong quarter VISIBLE, and it is the one. The price lookup's
|
||||
inputs are the CLOCK and the PRICE SERIES, and
|
||||
neither is a function of what the battery did.
|
||||
Measured: which hour the strategy picked, its
|
||||
price and the spread it cleared are identical
|
||||
live and shadow on 720 of 720 charging cycles,
|
||||
AT A BINDING CAP.
|
||||
|
||||
⚠️ THE EXEMPTION THAT USED TO BE HERE WAS TRUE UNTIL SAFETY-45 MERGED. This
|
||||
module, DOCS.md and DECISIONS/SAFETY-10-shadow-mode.md all said "the strategies
|
||||
are unaffected - they ask for a fixed power from inputs that do not depend on
|
||||
what the battery did". SAFETY-45 made the buy leg `min(asked, headroom)` with
|
||||
|
||||
headroom = (900 / remaining) x (ceiling - projected)
|
||||
|
||||
and `projected` reads the OPEN QUARTER'S ACCUMULATOR - the meter - which is a
|
||||
function of what the battery did earlier in that same quarter. The strategy
|
||||
became closed-loop the day that landed. What survives of the exemption, and
|
||||
only this:
|
||||
|
||||
WHICH hour a strategy picks, and WHY, are unaffected.
|
||||
HOW HARD it trades is not.
|
||||
|
||||
⚠️ AND THE SIZE A SHADOW RUN RECORDS IS THE RIGHT ANSWER TO A QUESTION NOBODY
|
||||
ASKED. `900/remaining` is correct arithmetic for a meter that is genuinely
|
||||
under the ceiling - and in shadow the meter genuinely IS under it, because the
|
||||
battery is not charging. So the number is not a bug; it is an answer computed
|
||||
for a plant that did not exist. Measured on the same rig, shipped code:
|
||||
|
||||
cap / house live commanded shadow recorded over
|
||||
1500 / 1200 -302.4 W -2000.0 W 6.61x
|
||||
3500 / 3000 -502.6 W -2000.0 W 3.98x
|
||||
3500 / 2000 -1502.6 W -2000.0 W 1.33x
|
||||
3500 / 1800 -1702.6 W -2000.0 W 1.17x
|
||||
15000 / 350 -2000.0 W -2000.0 W 1.00x
|
||||
|
||||
The last row is the fixture SAFETY-10's own evidence was taken on, which is why
|
||||
nothing reported this. `words()` carries the caveat rather than a re-computed
|
||||
number, and `DECISIONS/SAFETY-47-what-a-shadow-run-can-show.md` §3 records the
|
||||
three alternatives that were rejected and why.
|
||||
|
||||
⚠️ "REACHES NOTHING" IS NOT "WRITES NOTHING", AND THE DIFFERENCE IS THE WHOLE
|
||||
SAFETY ARGUMENT
|
||||
=======================================================================
|
||||
@@ -138,11 +215,18 @@ THE FAILSAFES, ONE BY ONE (the card asks for each to be decided and recorded)
|
||||
| | resolved intent against a meter that has |
|
||||
| | stopped moving, and both halves are as |
|
||||
| | true in shadow as out of it. |
|
||||
| SAFETY-07/24/25 peak guard | OBSERVES. Level-triggered, unlatched, and |
|
||||
| | it files its claim as usual so the |
|
||||
| | recorded decision is the real one. |
|
||||
| | SAFETY-45's limit cycle is visible from a |
|
||||
| | shadow run; that is the point. |
|
||||
| SAFETY-07/24/25 peak guard | OBSERVES, AND SEES ONLY THE HOUSE. It is |
|
||||
| | level-triggered and unlatched and it files|
|
||||
| | its claim as usual, so the recorded |
|
||||
| | decision is the real one FOR THIS METER - |
|
||||
| | but every term of `wanted = batt_w + |
|
||||
| | excess` is measured, and in shadow mode |
|
||||
| | the battery contributes nothing to either.|
|
||||
| | ⚠️ SAFETY-47: this row used to claim |
|
||||
| | SAFETY-45's limit cycle was visible from a|
|
||||
| | shadow run. It is not - 410/720 engaged |
|
||||
| | cycles live against 0/720 in shadow, on |
|
||||
| | the same hour and the same code. |
|
||||
| SAFETY-31 circulation | OBSERVES AND MAY LATCH, legitimately. Its |
|
||||
| SAFETY-42 delivery | evidence is MEASURED power, not a |
|
||||
| | command: packs pushing against each other |
|
||||
@@ -215,6 +299,29 @@ MODES = ("auto", "on", "off")
|
||||
#: commanding it so the inverter cannot be left latched on anything else.
|
||||
WIRE_W = 0.0
|
||||
|
||||
#: SAFETY-47. What the recorded watts mean when a MEASURED billed quarter sized
|
||||
#: them.
|
||||
#:
|
||||
#: ⚠️ "UPPER BOUND" AND NOT "SMALLER", AND THE DIFFERENCE WAS MEASURED RATHER
|
||||
#: THAN ARGUED. Charging only ADDS offtake, so a live meter's `projected` is
|
||||
#: never below a shadow meter's and the headroom is never above it: the shadow
|
||||
#: size is >= the live size, with EQUALITY at the start of every quarter, where
|
||||
#: `900/remaining` is 1.0 and neither plant has moved. Measured pairwise over
|
||||
#: 3600 charging cycles in five configurations - 0 cycles below, 730 exactly
|
||||
#: equal. A sentence reading "smaller" would have been false on every one of
|
||||
#: those 730.
|
||||
#:
|
||||
#: ⚠️ AND IT NAMES NO FACTOR. How far under the bound a live run lands is a
|
||||
#: property of the site - 6.61x at a 1500 W cap under a 1200 W house, 1.00x at
|
||||
#: a cap that does not bind - and a number invented for the row would be a
|
||||
#: second helping of the defect this constant exists to disclose.
|
||||
SIZED_FROM_METER = (
|
||||
"⚠️ AND ITS SIZE CAME FROM THE BILLED-QUARTER METER, WHICH HAS ONLY THE "
|
||||
"HOUSE IN IT WHILE THE BATTERY IS HELD AT 0 W. A live run sizes the same "
|
||||
"trade against a meter the battery is moving, so this is an UPPER BOUND "
|
||||
"and not a prediction; how far under it a live run lands is a closed-loop "
|
||||
"question and a shadow run cannot answer it")
|
||||
|
||||
|
||||
def mode(opts: dict) -> str:
|
||||
"""The configured `shadow_mode`, normalised to one of `MODES`.
|
||||
@@ -279,7 +386,7 @@ def why(opts: dict, *, control_started: bool) -> str:
|
||||
|
||||
|
||||
def words(opts: dict, *, control_started: bool, would_w: float | None,
|
||||
reason: str = "") -> str:
|
||||
sized_from_meter: bool, reason: str = "") -> str:
|
||||
"""The status page's `Shadow mode` row.
|
||||
|
||||
⚠️ THE ROW IS RENDERED IN EVERY STATE, INCLUDING `off`. A surface whose
|
||||
@@ -288,10 +395,35 @@ def words(opts: dict, *, control_started: bool, would_w: float | None,
|
||||
what gets graded, so there has to be text in both states.
|
||||
|
||||
`would_w` is the decision the path reached this cycle - what a live
|
||||
controller would have put on the wire - and `reason` is
|
||||
`Resolution.explain()`, the same sentence the `Why` row carries. Together
|
||||
they are the whole of "what would it have done, and why"; without them the
|
||||
row would say a shadow run happened and nothing about what it found.
|
||||
controller would have put on the wire GIVEN THIS METER AND A BATTERY AT
|
||||
0 W - and `reason` is `Resolution.explain()`, the same sentence the `Why`
|
||||
row carries. Together they are the whole of "what would it have done, and
|
||||
why"; without them the row would say a shadow run happened and nothing
|
||||
about what it found.
|
||||
|
||||
⚠️ `sized_from_meter` HAS NO DEFAULT, AND THAT IS SAFETY-47's WHOLE POINT.
|
||||
It is True when a MEASURED billed-quarter headroom sized the number being
|
||||
recorded - `arbitrage.sized_from_meter()` answers it, and it is the one
|
||||
place the question is asked. A default of False here would be a caller
|
||||
that forgot the caveat rendering a row that reads exactly like a caller
|
||||
that decided it did not apply, which is the shape of defect this card is
|
||||
about. TEST-14's rule with a new name on it.
|
||||
|
||||
⚠️ AND THE PHRASE IS "ON THIS CYCLE", UNCONDITIONALLY, NOT ONLY WHEN THE
|
||||
CAVEAT FIRES. Every number a shadow run records was reached from a plant
|
||||
that did not respond; "WOULD HAVE COMMANDED -2 000 W" reads as a forecast
|
||||
of a live run and no number here is one. The ⚠️ below is the STRONGER,
|
||||
conditional statement about the cycles where the answer can be multiples
|
||||
out - see this module's header for the measured table.
|
||||
|
||||
⚠️ AND IT IS NOT KEYED ON WHETHER THE TRADE WAS CAPPED. `arbitrage`'s own
|
||||
sentence says "SIZED BY THE CAPACITY-TARIFF GUARD" only when the headroom
|
||||
came out BELOW the ask - which in a shadow run is the START of the
|
||||
quarter, where the two runs still agree. By the end of the quarter
|
||||
`900/remaining` has multiplied the headroom past the ask, the trade is
|
||||
NOT capped, the sentence is silent and the recorded number is at its most
|
||||
wrong. A caveat keyed on that sentence would be quietest exactly where it
|
||||
is needed loudest. `test_arbitrage.py` part 3d-8 drives that.
|
||||
"""
|
||||
head = why(opts, control_started=control_started)
|
||||
if not engaged(opts, control_started=control_started):
|
||||
@@ -304,13 +436,38 @@ def words(opts: dict, *, control_started: bool, would_w: float | None,
|
||||
# half that says WHICH RUNG decided, which is the claim MUTATION.md's
|
||||
# masking rule says must survive.
|
||||
num = f"{float(would_w):+,.0f}".replace(",", " ")
|
||||
out = (f"{head}; WOULD HAVE COMMANDED {num} W, inverter held at "
|
||||
f"{WIRE_W:.0f} W")
|
||||
out = (f"{head}; ON THIS CYCLE WOULD HAVE COMMANDED {num} W, inverter "
|
||||
f"held at {WIRE_W:.0f} W")
|
||||
if sized_from_meter:
|
||||
out += f" {SIZED_FROM_METER}"
|
||||
if reason:
|
||||
out += f" - {reason}"
|
||||
return out
|
||||
|
||||
|
||||
def log_line(*, would_w: float, reason: str, sized_from_meter: bool) -> str:
|
||||
"""The action-log line for one change of shadow decision.
|
||||
|
||||
⚠️ IT IS A FUNCTION FOR THE REASON `words()` IS ONE, AND SAFETY-47 LEARNED
|
||||
IT THE EXPENSIVE WAY. This sentence used to be an f-string inside
|
||||
`Controller._shadow_settle()`. Deleting the caveat from it there left all
|
||||
29 files GREEN - the only check that could see the line drove a fixture
|
||||
with `meter_source: off`, where no arbitrage decision and therefore no
|
||||
caveat can ever be reached. A sentence assembled at a call site is a
|
||||
sentence no check can grade, and the page would have said one thing while
|
||||
the record a later analysis reads said another.
|
||||
|
||||
⚠️ AND IT IS THE SAME `SIZED_FROM_METER` CONSTANT THE ROW CARRIES, not a
|
||||
second wording of it. Two sentences meaning one thing is how the two
|
||||
surfaces start disagreeing about which cycles are caveated.
|
||||
"""
|
||||
out = (f"SHADOW: would have commanded {float(would_w):+.0f} W ON THIS "
|
||||
f"CYCLE - {reason}")
|
||||
if sized_from_meter:
|
||||
out += f" {SIZED_FROM_METER}"
|
||||
return out
|
||||
|
||||
|
||||
def banner(opts: dict, *, control_started: bool, latched: tuple = ()) -> tuple:
|
||||
"""`(level, text)` for the top of the status page, or `None` when live.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: GoodWe RS485 Controller
|
||||
version: "0.9.0"
|
||||
version: "0.10.0"
|
||||
slug: goodwe_controller
|
||||
description: >-
|
||||
Drives a GoodWe ES/BP battery inverter over RS485 by emulating its smart
|
||||
|
||||
@@ -94,6 +94,8 @@ from app.arbitrage import (
|
||||
CHARGE, DISCHARGE, ArbitrageDecision, claim, decide, enabled, soc_bounds,
|
||||
threshold_eur_kwh,
|
||||
)
|
||||
# SAFETY-47 section 3d. The shipped shadow-mode row, not a transcription of it.
|
||||
from app import shadow as _shadow
|
||||
from app.price import (
|
||||
PRICE_OPTION_DEFAULTS, Absence, PricePoint, PriceProduct, PriceRead,
|
||||
Uncertainty, WIDEN_FACTOR, brussels, required_spread, widen_factor,
|
||||
@@ -890,18 +892,61 @@ check("a ZERO headroom does not cap a DISCHARGE. §9.1: 'discharge and export "
|
||||
# caller fills is a TypeError only on the one path a suite does not run. Same
|
||||
# pin, same reason, as `weights=` in test_packshare.py part 10.
|
||||
_S45_MAIN = open(os.path.join(HERE, "app", "main.py"), encoding="utf-8").read()
|
||||
_s45_calls = [n for n in ast.walk(ast.parse(_S45_MAIN))
|
||||
_S45_MAIN_TREE = ast.parse(_S45_MAIN)
|
||||
_s45_calls = [n for n in ast.walk(_S45_MAIN_TREE)
|
||||
if isinstance(n, ast.Call)
|
||||
and ast.unparse(n.func).endswith("arbitrage.decide")]
|
||||
_s45_arg = [ast.unparse(k.value) for c in _s45_calls for k in c.keywords
|
||||
if k.arg == "charge_headroom_w"]
|
||||
|
||||
|
||||
def _s45_assigned(name, clear=("None",)):
|
||||
"""Every expression main.py assigns to `self.<name>` that is not a CLEAR.
|
||||
|
||||
⚠️ SAFETY-47 HOISTED THE HEADROOM OUT OF THE CALL, so pinning the call
|
||||
argument alone stopped covering anything: the literal a mutation would put
|
||||
there now goes one line up instead. Both ends are pinned.
|
||||
|
||||
⚠️ `clear` NAMES THE CONSTANTS THAT MEAN "NOTHING HAS ANSWERED THIS YET" -
|
||||
`__init__`'s value and the per-cycle reset - and they are not a second
|
||||
source for the number. Excluding them does NOT soften the pin: a mutation
|
||||
that replaces the real assignment with one of those constants leaves this
|
||||
list EMPTY, which matches no expected value and is red.
|
||||
"""
|
||||
return [ast.unparse(n.value) for n in ast.walk(_S45_MAIN_TREE)
|
||||
if isinstance(n, ast.Assign)
|
||||
and [ast.unparse(t) for t in n.targets] == [f"self.{name}"]
|
||||
and ast.unparse(n.value) not in clear]
|
||||
|
||||
|
||||
_s45_head_src = _s45_assigned("arb_headroom_w")
|
||||
print(f" main.py has {len(_s45_calls)} `arbitrage.decide(` call site(s); "
|
||||
f"charge_headroom_w= is {_s45_arg}")
|
||||
f"charge_headroom_w= is {_s45_arg}, and self.arb_headroom_w is assigned "
|
||||
f"from {_s45_head_src}")
|
||||
check("main.py passes the guard's OWN measured headroom at its one "
|
||||
"arbitrage.decide() call site - the shipped expression, not a "
|
||||
"transcription of it, so a mutation back to a literal or to max_w is red "
|
||||
"rather than silent",
|
||||
_s45_arg == ["peakguard.charge_headroom_w(self.peak_guard)"])
|
||||
_s45_arg == ["self.arb_headroom_w"]
|
||||
and _s45_head_src == ["peakguard.charge_headroom_w(self.peak_guard)"])
|
||||
# ⚠️ AND THE HOIST DID NOT MOVE IT OUT OF THE CYCLE. An `arb_headroom_w` set
|
||||
# once in `__init__` and never refreshed would satisfy the pin above and would
|
||||
# size every trade from the guard decision of whatever cycle happened to run
|
||||
# last - which is the defect the hoist's own comment warns about, one level up.
|
||||
_s45_cycle = next(n for n in ast.walk(_S45_MAIN_TREE)
|
||||
if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
|
||||
and n.name == "cycle"
|
||||
and any(isinstance(c, ast.Call)
|
||||
and ast.unparse(c.func).endswith("arbitrage.decide")
|
||||
for c in ast.walk(n)))
|
||||
check("...and the assignment is INSIDE the same `cycle()` that makes the call, "
|
||||
"so the headroom the trade is sized from is this cycle's guard decision "
|
||||
"and not one carried from an arbitrary earlier one",
|
||||
any(isinstance(n, ast.Assign)
|
||||
and [ast.unparse(t) for t in n.targets] == ["self.arb_headroom_w"]
|
||||
and ast.unparse(n.value)
|
||||
== "peakguard.charge_headroom_w(self.peak_guard)"
|
||||
for n in ast.walk(_s45_cycle)))
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- #
|
||||
@@ -946,14 +991,26 @@ S45_T0 = D0 + timedelta(hours=CHEAP_H)
|
||||
|
||||
|
||||
def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
|
||||
seconds=S45_RUN_S):
|
||||
seconds=S45_RUN_S, shadow=False):
|
||||
"""One closed hour. `sized=False` is the behaviour this card removes.
|
||||
|
||||
⚠️ THE COUNTERFACTUAL IS ONE ARGUMENT, NOT A SECOND CODE PATH. `sized=False`
|
||||
hands `decide()` a headroom nothing can bind - which is exactly what the
|
||||
tree did before this card, because nothing was passing one - so the two runs
|
||||
below differ in one value and share every line of shipped code. Habit 7.
|
||||
|
||||
⚠️ SAFETY-47's `shadow=True` IS THE SAME DISCIPLINE, ONE ARGUMENT AGAIN. It
|
||||
reproduces the THREE things `Controller._write_unit()` and
|
||||
`_shadow_settle()` do and nothing else: the resolved command is RECORDED,
|
||||
the plant is driven from `shadow.WIRE_W` instead of from it, and the
|
||||
carried command is RE-SEEDED to `shadow.WIRE_W` after the record is taken.
|
||||
Those three lines are a TRANSCRIPTION of main.py's placement and are marked
|
||||
as one - `test_clamp.py` part 8 is the check on the shipped placement, and
|
||||
it drives the real `Controller`. What is NOT transcribed is every number
|
||||
that matters here: the averager, the projection, the guard, the headroom,
|
||||
the strategy, the arbiter and the row's own words are all the shipped ones.
|
||||
"""
|
||||
|
||||
avg = QuarterAverager(phases=1, max_hold_s=900.0)
|
||||
tuning = Tuning(gain=0.6, max_w=MAX_W, slew_w=0.0)
|
||||
t0 = S45_T0
|
||||
@@ -962,6 +1019,7 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
|
||||
loop_w = None
|
||||
batt_cmd = batt = 0.0 # + discharge, as main.py's site_batt_w
|
||||
onsets = blocks = 0
|
||||
rec = []
|
||||
prev_action = "<start>"
|
||||
grid_lo, grid_hi = None, None
|
||||
billed = []
|
||||
@@ -1008,7 +1066,32 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
|
||||
claims.append(Claim.limit("supervised", P_SAFETY, -MAX_W, MAX_W,
|
||||
"max_w"))
|
||||
claims.append(Claim.set("loop", P_LOOP, d.target_w, d.reason))
|
||||
target = resolve(claims).target_w
|
||||
res = resolve(claims)
|
||||
target = res.target_w
|
||||
head_w = _pg.charge_headroom_w(pk) if sized else HEADROOM_CLEAR
|
||||
rec.append(dict(
|
||||
t_s=t, action=arb.action, power_w=arb.power_w,
|
||||
reason=arb.reason, price=arb.price_now_eur_kwh,
|
||||
spread=arb.spread_eur_kwh, winner=res.winner,
|
||||
target_w=float(res.target_w), headroom_w=head_w,
|
||||
engaged=bool(pk.engaged),
|
||||
sized_from_meter=_arb.sized_from_meter(
|
||||
arb, head_w, winner=res.winner)))
|
||||
if shadow:
|
||||
# --- TRANSCRIBED 1/3: `_shadow_settle()`'s record, taken
|
||||
# BEFORE the re-seed destroys its evidence.
|
||||
rec[-1]["would_w"] = float(res.target_w)
|
||||
rec[-1]["row"] = _shadow.words(
|
||||
{"shadow_mode": "on"}, control_started=False,
|
||||
would_w=float(res.target_w),
|
||||
sized_from_meter=rec[-1]["sized_from_meter"],
|
||||
reason=res.explain())
|
||||
# --- TRANSCRIBED 2/3: `_write_unit()`'s substitution - the
|
||||
# plant below is driven from WIRE_W, not from the decision.
|
||||
# --- TRANSCRIBED 3/3: `_shadow_settle()`'s re-seed of the
|
||||
# carried command, which is what `compute(prev_w=...)`,
|
||||
# `standing_w()` and SAFETY-42 read next cycle.
|
||||
target = _shadow.WIRE_W
|
||||
# THE PLANT, MODELLED: an 800 W/s ramp into a 10 s first-order lag.
|
||||
step = min(1.0, acc)
|
||||
delta = target - batt_cmd
|
||||
@@ -1020,7 +1103,9 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
|
||||
grid_hi = grid if grid_hi is None else max(grid_hi, grid)
|
||||
return dict(onsets=onsets, grid_lo=round(grid_lo, 1),
|
||||
grid_hi=round(grid_hi, 1), swing=round(grid_hi - grid_lo, 1),
|
||||
billed=billed, blocks=blocks)
|
||||
billed=billed, blocks=blocks, rec=rec,
|
||||
engaged=sum(1 for r in rec if r["engaged"]),
|
||||
cycles=len(rec))
|
||||
|
||||
S45_BEFORE = derived(lambda: s45_loop(sized=False))
|
||||
S45_AFTER = derived(lambda: s45_loop(sized=True))
|
||||
@@ -1076,11 +1161,440 @@ S45_WIDE_S = derived(lambda: s45_loop(sized=True, cap_w=5000.0, load_w=1200.0,
|
||||
print(f" peak_cap_w 5000 W, 1200 W house (load + max_w = "
|
||||
f"{S45_LOAD_W + MAX_W:.0f} W, under the cap): unsized "
|
||||
f"{S45_WIDE['billed']} W, sized {S45_WIDE_S['billed']} W")
|
||||
|
||||
|
||||
|
||||
def _s45_outcome(r):
|
||||
"""Everything the two runs put on the PLANT and the METER.
|
||||
|
||||
⚠️ `rec` IS EXCLUDED AND THE EXCLUSION IS NAMED. SAFETY-47 added a
|
||||
per-cycle record to this harness, and it carries `headroom_w` and
|
||||
`sized_from_meter` - which are THE ONE ARGUMENT the two runs differ in, by
|
||||
construction. Comparing them would make this check fail for the reason it
|
||||
exists to rule out. The resolved command per cycle IS compared, below, and
|
||||
that is a stronger statement than the six aggregates ever were.
|
||||
"""
|
||||
return {k: v for k, v in r.items() if k != "rec"}
|
||||
|
||||
|
||||
check("on a site where the trade cannot reach the cap the two runs are "
|
||||
"IDENTICAL to the watt - so this card costs nothing on the installs it "
|
||||
"is not about, and the check above is not passing because the cap "
|
||||
"dominates everything",
|
||||
S45_WIDE == S45_WIDE_S and S45_WIDE["onsets"] == 1)
|
||||
_s45_outcome(S45_WIDE) == _s45_outcome(S45_WIDE_S)
|
||||
and S45_WIDE["onsets"] == 1)
|
||||
check("...and identical CYCLE BY CYCLE, not merely in the six aggregates: "
|
||||
"every resolved command and every traded size matches to the float",
|
||||
[(r["target_w"], r["power_w"]) for r in S45_WIDE["rec"]]
|
||||
== [(r["target_w"], r["power_w"]) for r in S45_WIDE_S["rec"]])
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- #
|
||||
print()
|
||||
print("3d. SAFETY-47 - the SHADOW record against a LIVE run, at a BINDING cap")
|
||||
# ---------------------------------------------------------------------------
|
||||
# WHAT THIS PART EXISTS FOR, AND IT IS NOT A SECOND SAFETY-45 CHECK.
|
||||
#
|
||||
# SAFETY-10 shipped shadow mode saying, in three merged documents, that "the
|
||||
# strategies are unaffected - they ask for a fixed power from inputs that do
|
||||
# not depend on what the battery did - so a shadow run does show you the
|
||||
# trades, the peak-guard engagements and the SoC-limit behaviour". That was
|
||||
# true until 3c's own fix merged. SAFETY-45 makes the buy leg
|
||||
# `min(asked, headroom)`, and the headroom is
|
||||
#
|
||||
# (900 / remaining) x (ceiling - projected)
|
||||
#
|
||||
# where `projected` reads the OPEN QUARTER'S ACCUMULATOR - the meter - which is
|
||||
# a function of what the battery did earlier in that same quarter. The strategy
|
||||
# became closed-loop the day 3c landed, and shadow mode holds the battery at
|
||||
# 0 W, so in a shadow run that accumulator contains THE HOUSE AND NOTHING ELSE.
|
||||
#
|
||||
# ⚠️ AND SAFETY-10 §6's COMMITTED EVIDENCE COULD NEVER HAVE FAILED - TWO
|
||||
# INDEPENDENT REASONS, AND CLOSING EITHER ONE ALONE CLOSES NOTHING.
|
||||
# (1) its fixture is `peak_cap_w: 15000` against a 350 W house, so the guard
|
||||
# never engages and the sizing is inert - MUTATION.md habit 4, inside a
|
||||
# merged card's own proof;
|
||||
# (2) every identity row reads THE FIRST CHARGING SAMPLE, and at `elapsed=0`
|
||||
# the projection IS the held level, so the two runs agree to the float
|
||||
# there even AT a binding cap. 3d-2 drives that and says so.
|
||||
#
|
||||
# So this part is the grader for the class: a shadow run and a live run, the
|
||||
# same hour, the same code, at a cap that BINDS. What is REAL and what is
|
||||
# TRANSCRIBED is in `s45_loop()`'s own docstring - the three lines that stand
|
||||
# in for `Controller._write_unit()` and `_shadow_settle()` are named there, and
|
||||
# `test_clamp.py` part 8 is the check on the shipped placement.
|
||||
# ---------------------------------------------------------------------------
|
||||
S47_LIVE = derived(lambda: s45_loop(sized=True))
|
||||
S47_SHAD = derived(lambda: s45_loop(sized=True, shadow=True))
|
||||
# The SAFETY-45 defect itself, watched from inside shadow mode - which is what
|
||||
# SAFETY-10's header claimed a shadow run would surface.
|
||||
S47_UNSIZED_SHAD = derived(lambda: s45_loop(sized=False, shadow=True))
|
||||
|
||||
_s47_lc = derived(lambda: [r for r in S47_LIVE["rec"] if r["action"] == CHARGE])
|
||||
_s47_sc = derived(lambda: [r for r in S47_SHAD["rec"] if r["action"] == CHARGE])
|
||||
|
||||
# ⚠️ THE SECTION CARRIES ITS OWN PRECONDITION INTO EVERY CHECK, AND THIS IS
|
||||
# FCST-06's SHAPE RATHER THAN TIDINESS. A mutation that stops either run
|
||||
# trading at all leaves these lists EMPTY; the first `min()` below then raises,
|
||||
# the file dies before part 4, and the run reports ZERO reds - which reads
|
||||
# exactly like a survivor. Measured: driving `wanted = batt_w - ex` through
|
||||
# this section did precisely that. So the lists are replaced by a sentinel that
|
||||
# cannot satisfy anything, and `s47check()` fails every check in the section
|
||||
# when the stimulus was not produced.
|
||||
_S47_DEAD = dict(action=None, power_w=0.0, reason="<no charging cycle>",
|
||||
price=None, spread=None, winner=None, target_w=0.0,
|
||||
headroom_w=0.0, engaged=False, sized_from_meter=False,
|
||||
would_w=0.0, row="", t_s=0.0)
|
||||
_S47_OK = bool(_s47_lc) and bool(_s47_sc)
|
||||
if not _S47_OK:
|
||||
_s47_lc = _s47_sc = [dict(_S47_DEAD)]
|
||||
_s47_n = min(len(_s47_lc), len(_s47_sc))
|
||||
|
||||
|
||||
def s47check(name, cond):
|
||||
"""A 3d check, AND the section's own precondition, in one verdict."""
|
||||
check(name, _S47_OK and bool(cond))
|
||||
|
||||
|
||||
check("PRECONDITION: both runs actually reached a charging decision - without "
|
||||
"this the section raises on its first `min()`, the file dies before "
|
||||
"part 4 and the run reports ZERO reds, which reads exactly like a "
|
||||
"survivor (MUTATION.md, FCST-06's shape). Measured, not imagined",
|
||||
_S47_OK)
|
||||
print(f" live : {len(_s47_lc)} charging cycles, traded "
|
||||
f"{min(r['power_w'] for r in _s47_lc):+.1f} .. "
|
||||
f"{max(r['power_w'] for r in _s47_lc):+.1f} W, "
|
||||
f"headroom {min(r['headroom_w'] for r in _s47_lc):.1f} .. "
|
||||
f"{max(r['headroom_w'] for r in _s47_lc):.1f} W, "
|
||||
f"grid {S47_LIVE['grid_lo']:.0f} .. {S47_LIVE['grid_hi']:.0f} W")
|
||||
print(f" shadow: {len(_s47_sc)} charging cycles, RECORDED "
|
||||
f"{min(r['power_w'] for r in _s47_sc):+.1f} .. "
|
||||
f"{max(r['power_w'] for r in _s47_sc):+.1f} W, "
|
||||
f"headroom {min(r['headroom_w'] for r in _s47_sc):.1f} .. "
|
||||
f"{max(r['headroom_w'] for r in _s47_sc):.1f} W, "
|
||||
f"grid {S47_SHAD['grid_lo']:.0f} .. {S47_SHAD['grid_hi']:.0f} W")
|
||||
|
||||
# --- 3d-1. THE PRECONDITION: the cap binds, and the meter proves it --------
|
||||
# ⚠️ WITHOUT THIS EVERY CHECK BELOW IS SAFETY-10 §6's DEFECT IN A NEW FILE. At
|
||||
# a cap the trade cannot reach, live and shadow agree exactly and nothing here
|
||||
# could ever go red - which is precisely what the committed evidence did.
|
||||
s47check("PRECONDITION: the cap BINDS - the live run's trade is sized by the "
|
||||
f"guard on every charging cycle, never reaching the {MAX_W:.0f} W ask",
|
||||
_s47_lc and all(abs(r["power_w"]) < MAX_W - 1.0 for r in _s47_lc))
|
||||
s47check("...and the live METER is what closed the gap: it is held up at the "
|
||||
f"{S45_CAP_W:.0f} W ceiling rather than sitting at the "
|
||||
f"{S45_LOAD_W:.0f} W house, which is the feedback a shadow run does not "
|
||||
f"have",
|
||||
S47_LIVE["grid_hi"] > S45_LOAD_W + 200.0)
|
||||
s47check("...and the SHADOW meter sees the house and nothing else for the whole "
|
||||
"run, which is what makes its billed quarter a different quarter",
|
||||
near(S47_SHAD["grid_lo"], S45_LOAD_W, 0.001)
|
||||
and near(S47_SHAD["grid_hi"], S45_LOAD_W, 0.001))
|
||||
|
||||
# --- 3d-2. WHY THE OLD SHAPE COULD NOT FAIL --------------------------------
|
||||
# Graded as an EXPECTATION rather than left as a footnote, so that nobody
|
||||
# rebuilds a check on `[0]` and believes it covers something.
|
||||
print(f" first charging cycle: live {_s47_lc[0]['power_w']:+.4f} W, "
|
||||
f"shadow {_s47_sc[0]['power_w']:+.4f} W")
|
||||
s47check("⚠️ THE FIRST CHARGING CYCLE IS IDENTICAL IN BOTH RUNS EVEN HERE, so "
|
||||
"widening SAFETY-10 §6's fixture ALONE would not have made its table go "
|
||||
"red: at elapsed=0 the projection IS the held level and neither plant "
|
||||
"has moved yet. Both reasons had to be closed, and this is the one a "
|
||||
"reviewer cannot see from a diff",
|
||||
_s47_lc[0]["power_w"] == _s47_sc[0]["power_w"]
|
||||
and _s47_lc[0]["reason"] == _s47_sc[0]["reason"])
|
||||
|
||||
# --- 3d-3. AND ACROSS THE WHOLE RUN THEY DIVERGE ---------------------------
|
||||
_s47_mis = sum(1 for i in range(_s47_n)
|
||||
if _s47_lc[i]["power_w"] != _s47_sc[i]["power_w"])
|
||||
_s47_worst = min(_s47_sc, key=lambda r: r["power_w"])
|
||||
_s47_live_worst = min(_s47_lc, key=lambda r: r["power_w"])
|
||||
# ⚠️ NaN AND NOT AN EXCEPTION when the sentinel above is in play: `nan > 2.0`
|
||||
# is False, so the check goes RED, while a ZeroDivisionError here would kill
|
||||
# the file and report zero reds. Same defect, one line further down - it was
|
||||
# driven, and it is why this is not a plain division.
|
||||
_s47_over = (abs(_s47_worst["power_w"]) / abs(_s47_live_worst["power_w"])
|
||||
if _s47_live_worst["power_w"] else float("nan"))
|
||||
print(f" size mismatches {_s47_mis}/{_s47_n} charging cycles; the shadow "
|
||||
f"run records {_s47_worst['power_w']:+.0f} W where the live run's "
|
||||
f"hardest trade is {_s47_live_worst['power_w']:+.1f} W - "
|
||||
f"{_s47_over:.2f}x")
|
||||
s47check("ACROSS THE WHOLE RUN the recorded trade size diverges on all but the "
|
||||
"first few cycles - the check SAFETY-10 §6 should have been",
|
||||
_s47_mis > 0.9 * _s47_n)
|
||||
s47check(f"...and the shadow run RECORDS a trade the live run never commanded, "
|
||||
f"over by {_s47_over:.2f}x. `900/remaining` amplifies a "
|
||||
f"(ceiling - projected) gap the battery never closed, and the row "
|
||||
f"carried that number to a commissioning engineer with no caveat",
|
||||
_s47_over > 2.0)
|
||||
s47check("...and the amplification is IN THE HEADROOM, which is where the "
|
||||
f"measurement enters: the shadow guard offers up to "
|
||||
f"{max(r['headroom_w'] for r in _s47_sc):.0f} W of charging headroom "
|
||||
f"against a {S45_CAP_W:.0f} W ceiling and a {S45_LOAD_W:.0f} W house, "
|
||||
f"while the live guard never exceeds "
|
||||
f"{max(r['headroom_w'] for r in _s47_lc):.0f} W",
|
||||
max(r["headroom_w"] for r in _s47_sc) > MAX_W
|
||||
and max(r["headroom_w"] for r in _s47_lc) < MAX_W)
|
||||
|
||||
# --- 3d-3b. THE SENTENCE THE ROW PRINTS, GRADED AS ARITHMETIC --------------
|
||||
# ⚠️ THE ROW CLAIMS THE RECORDED NUMBER IS AN **UPPER BOUND**, and a claim on
|
||||
# an operator-facing surface is a claim this file has to be able to fail.
|
||||
# Charging only ADDS offtake, so a live `projected` is never below a shadow
|
||||
# one and the headroom is never above it. The earlier wording said "smaller",
|
||||
# which is FALSE on every cycle where the two are equal - the start of each
|
||||
# quarter, where `900/remaining` is 1.0 and neither plant has moved.
|
||||
_s47_below = [i for i in range(_s47_n)
|
||||
if abs(_s47_sc[i]["power_w"]) < abs(_s47_lc[i]["power_w"]) - 1e-9]
|
||||
_s47_equal = sum(1 for i in range(_s47_n)
|
||||
if abs(_s47_sc[i]["power_w"]) == abs(_s47_lc[i]["power_w"]))
|
||||
print(f" the shadow record is below the live command on "
|
||||
f"{len(_s47_below)}/{_s47_n} cycles and exactly equal on {_s47_equal}")
|
||||
s47check("the recorded size is an UPPER BOUND on the live one, on every compared "
|
||||
"cycle - which is the sentence `shadow.SIZED_FROM_METER` puts on the "
|
||||
"status row, so the row is making a claim this file can fail",
|
||||
not _s47_below)
|
||||
s47check("...and it is NOT strictly greater: the two are equal at the start of "
|
||||
f"each quarter ({_s47_equal} cycles here), which is why the row says "
|
||||
f"'upper bound' and not 'smaller' - the second would be a false "
|
||||
f"sentence on exactly those cycles",
|
||||
_s47_equal > 0)
|
||||
|
||||
# ⚠️ AND THE MECHANISM BEHIND THE BOUND, AS TWO POINTS OF THE SHIPPED
|
||||
# ARITHMETIC RATHER THAN AS ONE PROPERTY OF A WHOLE RUN. Same ceiling, same
|
||||
# elapsed, same house: one quarter that carried the battery's charge at the
|
||||
# meter (LIVE) and one that did not (SHADOW). The closed-loop version above
|
||||
# cannot be driven red by any mutation that ALSO stops the fixture trading -
|
||||
# measured - so the relation it rests on is graded directly here.
|
||||
def _s47_headroom(*, meter_w, batt_w, elapsed_s=450.0):
|
||||
"""`charge_headroom_w()` for a quarter that banked `meter_w` for
|
||||
`elapsed_s`, with `batt_w` measured at the pack. All shipped."""
|
||||
avg = QuarterAverager(phases=1, max_hold_s=900.0)
|
||||
t = 0.0
|
||||
while t <= elapsed_s:
|
||||
imp, exp = split_signed(meter_w)
|
||||
avg.add(make_sample("ha_signed", imp, exp, phases=1,
|
||||
ingest_ts=S45_T0 + timedelta(seconds=t),
|
||||
ingest_mono=(S45_T0.timestamp() + t)))
|
||||
t += 5.0
|
||||
pk = _pg.decide(
|
||||
PeakTracker.project(avg, S45_T0 + timedelta(seconds=elapsed_s)),
|
||||
batt_w=batt_w, cap_w=S45_CAP_W, reading=None, achievable_w=MAX_W,
|
||||
soc=50.0, soc_floor=20.0, max_hold_s=900.0, frozen=False)
|
||||
return _pg.charge_headroom_w(pk)
|
||||
|
||||
|
||||
_S47_TRADE_W = 300.0
|
||||
_s47_h_shadow = derived(lambda: _s47_headroom(meter_w=S45_LOAD_W, batt_w=0.0))
|
||||
_s47_h_live = derived(lambda: _s47_headroom(
|
||||
meter_w=S45_LOAD_W + _S47_TRADE_W, batt_w=-_S47_TRADE_W))
|
||||
print(f" half-way through one quarter, {S45_LOAD_W:.0f} W house under a "
|
||||
f"{S45_CAP_W:.0f} W ceiling: the SHADOW meter (battery at 0 W) offers "
|
||||
f"{_s47_h_shadow:.0f} W of headroom, the LIVE meter (the same house "
|
||||
f"plus a {_S47_TRADE_W:.0f} W charge) offers {_s47_h_live:.0f} W")
|
||||
s47check("the SHADOW meter offers STRICTLY MORE charging headroom than the "
|
||||
"live one on the same house, same ceiling and same elapsed - which "
|
||||
"is the whole mechanism, in two points of the shipped arithmetic "
|
||||
"rather than as a property of a whole run",
|
||||
_s47_h_shadow > _s47_h_live)
|
||||
s47check("...and the live answer is the one that lands the block ON the "
|
||||
"ceiling, so the shadow answer is the one that is wrong about the "
|
||||
"bill rather than the other way round",
|
||||
near(_s47_h_live, S45_CAP_W - S45_LOAD_W, 1.0))
|
||||
|
||||
# --- 3d-4. WHAT SURVIVES OF THE EXEMPTION, GRADED --------------------------
|
||||
# The narrowed claim the three documents now make, as a check rather than as a
|
||||
# sentence: WHICH hour and WHY are unaffected; HOW HARD is not.
|
||||
s47check("WHICH hour the strategy picked and at WHAT price are identical on "
|
||||
f"every one of the {_s47_n} compared cycles - the clock and the price "
|
||||
f"series are not functions of what the battery did, which is the half "
|
||||
f"of the old exemption that is still true",
|
||||
all(_s47_lc[i]["price"] == _s47_sc[i]["price"] for i in range(_s47_n)))
|
||||
s47check("...and so is the spread it had to clear",
|
||||
all(_s47_lc[i]["spread"] == _s47_sc[i]["spread"]
|
||||
for i in range(_s47_n)))
|
||||
|
||||
# --- 3d-5. THE CLOSED-LOOP DEFECT THE DOCUMENTS SAID WAS VISIBLE -----------
|
||||
# ⚠️ SAFETY-10's HEADER NAMED SAFETY-45's LIMIT CYCLE AS EXAMPLE #1 OF WHAT A
|
||||
# SHADOW RUN SURFACES. 3c's own PRECONDITION establishes that the unsized loop
|
||||
# really does run away; the same stimulus watched from inside shadow mode is
|
||||
# a settled, uneventful hour.
|
||||
print(f" SAFETY-45's own defect, unsized: live {S45_BEFORE['onsets']} "
|
||||
f"onsets/swing {S45_BEFORE['swing']:.0f} W, guard engaged "
|
||||
f"{S45_BEFORE['engaged']}/{S45_BEFORE['cycles']} -> in shadow mode "
|
||||
f"{S47_UNSIZED_SHAD['onsets']} onsets/swing "
|
||||
f"{S47_UNSIZED_SHAD['swing']:.0f} W, guard engaged "
|
||||
f"{S47_UNSIZED_SHAD['engaged']}/{S47_UNSIZED_SHAD['cycles']}")
|
||||
s47check("⚠️ SAFETY-45's LIMIT CYCLE IS NOT VISIBLE FROM A SHADOW RUN, and three "
|
||||
"merged documents said it was. The same hour, the same unsized code: "
|
||||
f"{S45_BEFORE['onsets']} charge onsets and a "
|
||||
f"{S45_BEFORE['swing']:.0f} W grid swing live, "
|
||||
f"{S47_UNSIZED_SHAD['onsets']} onsets and "
|
||||
f"{S47_UNSIZED_SHAD['swing']:.0f} W in shadow",
|
||||
S45_BEFORE["onsets"] >= 10 and S45_BEFORE["swing"] > 2000.0
|
||||
and S47_UNSIZED_SHAD["onsets"] <= 2
|
||||
and S47_UNSIZED_SHAD["swing"] < 1.0)
|
||||
s47check("...and neither are the guard ENGAGEMENTS the same documents promised: "
|
||||
f"{S45_BEFORE['engaged']} engaged cycles live against "
|
||||
f"{S47_UNSIZED_SHAD['engaged']} in shadow. Every term of "
|
||||
f"`wanted = batt_w + excess` is MEASURED, and in shadow mode the "
|
||||
f"battery contributes nothing to either term",
|
||||
S45_BEFORE["engaged"] > 100 and S47_UNSIZED_SHAD["engaged"] == 0)
|
||||
|
||||
# --- 3d-6. THE THREE RUNGS OF `sized_from_meter()`, SEPARATED --------------
|
||||
# TEST-16's rule: three rungs answer one question, so each is reached with the
|
||||
# other two clear. Any two of them left standing would mask the third.
|
||||
_s47_chg = _s47_worst
|
||||
_s47_sell = derived(lambda: act(PLAN, DEAR_H, thresh=_shipped, unc=NO_WEATHER,
|
||||
headroom=0.0))
|
||||
s47check("the CHARGE rung: a metered headroom that sized a buy leg answers True, "
|
||||
"which is the state the caveat exists for",
|
||||
_arb.sized_from_meter(
|
||||
ArbitrageDecision(action=CHARGE, power_w=-300.0, reason="x",
|
||||
spread_eur_kwh=1.0, required_eur_kwh=0.1,
|
||||
price_now_eur_kwh=0.05),
|
||||
300.0, winner=_arb.SOURCE) is True)
|
||||
s47check("...the SELL rung: a DISCHARGE answers False however the headroom reads. "
|
||||
"§9.1 - discharge and export are never capped by the peak guard - so a "
|
||||
"caveat on a sell would be a FALSE sentence on the status row",
|
||||
_s47_sell.action == DISCHARGE
|
||||
and _arb.sized_from_meter(_s47_sell, 300.0, winner=_arb.SOURCE) is False)
|
||||
s47check("...the UNMEASURED rung: a None headroom answers False. Nothing sized "
|
||||
"anything from a meter, so there is nothing to disclose - and `decide()` "
|
||||
"refuses the trade there anyway",
|
||||
_arb.sized_from_meter(
|
||||
ArbitrageDecision(action=CHARGE, power_w=-300.0, reason="x",
|
||||
spread_eur_kwh=1.0, required_eur_kwh=0.1,
|
||||
price_now_eur_kwh=0.05),
|
||||
None, winner=_arb.SOURCE) is False)
|
||||
s47check("...the WINNER rung: the same sized charge answers False once something "
|
||||
"else owns the resolution. `Resolution.target_w` is then somebody "
|
||||
"else's number and a caveat filed against it would be false",
|
||||
_arb.sized_from_meter(
|
||||
ArbitrageDecision(action=CHARGE, power_w=-300.0, reason="x",
|
||||
spread_eur_kwh=1.0, required_eur_kwh=0.1,
|
||||
price_now_eur_kwh=0.05),
|
||||
300.0, winner="loop") is False)
|
||||
|
||||
# --- 3d-7. THE ROW, AT THE WORST CYCLE -------------------------------------
|
||||
_s47_row = _s47_chg["row"]
|
||||
_s47_first_row = _s47_sc[0]["row"]
|
||||
print(f" worst cycle row: {_s47_row[:230]}")
|
||||
s47check("the shipped row carries the caveat at the worst cycle: the operator is "
|
||||
"told the number was sized from a meter with only the house in it",
|
||||
_shadow.SIZED_FROM_METER in _s47_row)
|
||||
s47check("...and it still carries the watts, in their own slot, and the standing "
|
||||
"0 W beside them - the caveat NARROWS the claim rather than deleting "
|
||||
"the record a shadow run exists to produce",
|
||||
"WOULD HAVE COMMANDED" in _s47_row and "inverter held at 0 W" in _s47_row
|
||||
and f"{round(_s47_chg['would_w']):+d}".replace("+", "") != "")
|
||||
s47check("...and the watts are introduced as what it would have commanded ON "
|
||||
"THIS CYCLE, in every shadow state and not only the caveated ones - no "
|
||||
"number a shadow run records is a forecast of a live run",
|
||||
"ON THIS CYCLE WOULD HAVE COMMANDED" in _s47_row
|
||||
and "ON THIS CYCLE WOULD HAVE COMMANDED" in _s47_first_row)
|
||||
|
||||
# --- 3d-7b. THE ACTION LOG, WHICH IS THE RECORD READ AFTERWARDS -----------
|
||||
# ⚠️ THE TWO SURFACES ARE GRADED SEPARATELY BECAUSE THEY FAILED SEPARATELY.
|
||||
# Driven as one mutation, deleting the caveat from the log line alone left all
|
||||
# 29 files green: the only check that could see that line drives a fixture with
|
||||
# `meter_source: off`, where no arbitrage decision - and therefore no caveat -
|
||||
# is reachable. The sentence is `shadow.log_line()` now, so it can be graded.
|
||||
_s47_log = derived(lambda: _shadow.log_line(
|
||||
would_w=_s47_chg["would_w"], reason="arbitrage -> -2000 W",
|
||||
sized_from_meter=_s47_chg["sized_from_meter"]))
|
||||
_s47_log_plain = derived(lambda: _shadow.log_line(
|
||||
would_w=_s47_chg["would_w"], reason="loop -> -300 W",
|
||||
sized_from_meter=False))
|
||||
print(f" action log: {_s47_log[:190]}")
|
||||
s47check("the ACTION LOG line carries the same caveat the row does - a page that "
|
||||
"discloses and a 40-row record that does not is the worse half of the "
|
||||
"two, because the record is what is read after the run",
|
||||
_shadow.SIZED_FROM_METER in _s47_log)
|
||||
s47check("...and it is the SAME constant, not a second wording of it, so the two "
|
||||
"surfaces cannot start disagreeing about which cycles are caveated",
|
||||
_shadow.SIZED_FROM_METER in _s47_row and _shadow.SIZED_FROM_METER
|
||||
in _s47_log)
|
||||
s47check("...and an uncaveated cycle gets the plain sentence, so the caveat is "
|
||||
"not simply printed on everything",
|
||||
_shadow.SIZED_FROM_METER not in _s47_log_plain
|
||||
and "would have commanded" in _s47_log_plain
|
||||
and "ON THIS CYCLE" in _s47_log_plain)
|
||||
|
||||
# --- 3d-8. ⚠️ AND IT IS NOT KEYED ON WHETHER THE TRADE WAS CAPPED ----------
|
||||
# THE TRAP THIS PART EXISTS TO SPRING. `arbitrage`'s own sentence says "SIZED
|
||||
# BY THE CAPACITY-TARIFF GUARD" only when the headroom came out BELOW the ask.
|
||||
# In a shadow run that is the START of the quarter - where the two runs still
|
||||
# agree to the float. By the end `900/remaining` has multiplied the headroom
|
||||
# PAST the ask, the trade is NOT capped, the sentence is silent, and the
|
||||
# recorded number is at its most wrong. A caveat keyed on that sentence would
|
||||
# be quietest exactly where it is needed loudest.
|
||||
_S47_CAPPED = "SIZED BY THE CAPACITY-TARIFF GUARD"
|
||||
print(f" at the worst cycle the shipped trade sentence says "
|
||||
f"{'' if _S47_CAPPED in _s47_chg['reason'] else 'NOT '}capped; at the "
|
||||
f"first it says "
|
||||
f"{'' if _S47_CAPPED in _s47_sc[0]['reason'] else 'NOT '}capped")
|
||||
s47check("PRECONDITION: the shipped 'capped' sentence IS present at the first "
|
||||
"charging cycle, where the shadow number is RIGHT - so the inverse "
|
||||
"below is a real inversion and not an absence everywhere",
|
||||
_S47_CAPPED in _s47_sc[0]["reason"])
|
||||
s47check("⚠️ ...and ABSENT at the worst cycle, where the shadow number is "
|
||||
f"{_s47_over:.2f}x out. A caveat keyed on `capped` would fire only "
|
||||
f"where the record is accurate and go silent where it is multiples "
|
||||
f"wrong; `sized_from_meter()` is keyed on the headroom having been "
|
||||
f"MEASURED, so it fires on both",
|
||||
_S47_CAPPED not in _s47_chg["reason"]
|
||||
and _s47_chg["sized_from_meter"] is True
|
||||
and _s47_sc[0]["sized_from_meter"] is True)
|
||||
|
||||
# --- 3d-9. main.py's CALL SITES, PINNED ------------------------------------
|
||||
# ⚠️ THE CALL SITE IS THE UNIT OF COVERAGE (habit 15), same as 3b's. Nothing
|
||||
# behavioural in this file can see main.py render the row with a hard-coded
|
||||
# False, because every check above calls `shadow.words()` itself.
|
||||
_s47_words = [n for n in ast.walk(_S45_MAIN_TREE)
|
||||
if isinstance(n, ast.Call)
|
||||
and ast.unparse(n.func).endswith("shadow.words")]
|
||||
_s47_flag = [ast.unparse(k.value) for c in _s47_words for k in c.keywords
|
||||
if k.arg == "sized_from_meter"]
|
||||
_s47_flag_src = _s45_assigned("shadow_sized_from_meter",
|
||||
clear=("None", "False"))
|
||||
print(f" main.py: shadow.words(sized_from_meter={_s47_flag}), and "
|
||||
f"self.shadow_sized_from_meter is assigned from {_s47_flag_src}")
|
||||
s47check("main.py renders the row from the flag THE CYCLE RECORDED, at its one "
|
||||
"shadow.words() call site - not from a literal and not re-derived on "
|
||||
"the status task, where `self.peak_guard` is a different cycle's",
|
||||
_s47_flag == ["self.shadow_sized_from_meter"])
|
||||
s47check("...and that flag comes from the SHIPPED predicate with all three of its "
|
||||
"arguments - the decision, the headroom the trade was sized from, and "
|
||||
"the arbiter's winner - so a mutation to `False`, to a literal or to a "
|
||||
"two-argument transcription is red rather than silent",
|
||||
_s47_flag_src == ["arbitrage.sized_from_meter("
|
||||
"self.arb, self.arb_headroom_w, "
|
||||
"winner=resolution.winner)"])
|
||||
_s47_logcalls = [n for n in ast.walk(_S45_MAIN_TREE)
|
||||
if isinstance(n, ast.Call)
|
||||
and ast.unparse(n.func).endswith("shadow.log_line")]
|
||||
_s47_logflag = [ast.unparse(k.value) for c in _s47_logcalls for k in c.keywords
|
||||
if k.arg == "sized_from_meter"]
|
||||
print(f" main.py: shadow.log_line(sized_from_meter={_s47_logflag})")
|
||||
s47check("...and the ACTION LOG line comes from the shipped sentence with the "
|
||||
"same flag, at main.py's one call site - not re-assembled as an "
|
||||
"f-string where no check can reach it, which is how it survived a whole "
|
||||
"mutation battery once already",
|
||||
_s47_logflag == ["self.shadow_sized_from_meter"])
|
||||
# ⚠️ AND THE PARAMETER HAS NO DEFAULT. TEST-14's rule, and this card is the
|
||||
# reason it matters here: a caller that FORGOT the caveat and a caller that
|
||||
# DECIDED it did not apply would render the identical row.
|
||||
_s47_sig = inspect.signature(_shadow.words)
|
||||
_s47_logsig = inspect.signature(_shadow.log_line)
|
||||
s47check("`shadow.words()` and `shadow.log_line()` BOTH require "
|
||||
"`sized_from_meter` - no default on either, so a caller cannot omit the "
|
||||
"caveat by accident and get the un-caveated surface",
|
||||
"sized_from_meter" in _s47_sig.parameters
|
||||
and _s47_sig.parameters["sized_from_meter"].default
|
||||
is inspect.Parameter.empty
|
||||
and "sized_from_meter" in _s47_logsig.parameters
|
||||
and _s47_logsig.parameters["sized_from_meter"].default
|
||||
is inspect.Parameter.empty)
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- #
|
||||
|
||||
+123
-26
@@ -151,6 +151,47 @@ BASELINE = [
|
||||
('goodwe_ctl/availability', 'online', True),
|
||||
]
|
||||
|
||||
# --- TEL-10's three, and they are DELIBERATELY NOT IN `BASELINE` -------------
|
||||
#
|
||||
# ⚠️ `BASELINE` IS WHAT release/1.0 PUBLISHES AND NOTHING MAY BE ADDED TO IT.
|
||||
# Every strong claim in this file rests on that list being a record of another
|
||||
# tree; append a row this branch invented and "byte-identical to release/1.0"
|
||||
# quietly becomes "identical to itself", which is the defect MUTATION.md's
|
||||
# habit 4 is about - a check whose data cannot reach the failure it names.
|
||||
#
|
||||
# So TEL-10's arrival is TWO claims and gets two checks: the nine release/1.0
|
||||
# messages did not move, and EXACTLY these three arrived after them.
|
||||
#
|
||||
# ⚠️ AND THIS LIST IS A REGRESSION PIN, NOT EVIDENCE OF CORRECTNESS - the same
|
||||
# status as part 3's sha256 over the per-unit payloads, for the same reason:
|
||||
# there is no released version of these bytes to diff against, so all it can
|
||||
# say is "these three payloads have not changed since the PR was reviewed".
|
||||
_TEL10_NUM = ('"availability_topic": "goodwe_ctl/availability", "device": ' + _DEV
|
||||
+ ', "unit_of_measurement": "W", "device_class": "power", '
|
||||
'"state_class": "measurement"}')
|
||||
TEL10 = [
|
||||
('homeassistant/sensor/goodwe_ctl_loop_i/config',
|
||||
'{"name": "Loop integrator", "object_id": "goodwe_loop_integrator", '
|
||||
'"unique_id": "goodwe_ctl_loop_i", "state_topic": "goodwe_ctl/loop_i", '
|
||||
+ _TEL10_NUM, True),
|
||||
('homeassistant/sensor/goodwe_ctl_loop_lead/config',
|
||||
'{"name": "Loop integrator lead", "object_id": "goodwe_loop_integrator_lead", '
|
||||
'"unique_id": "goodwe_ctl_loop_lead", "state_topic": "goodwe_ctl/loop_lead", '
|
||||
+ _TEL10_NUM, True),
|
||||
('homeassistant/sensor/goodwe_ctl_loop_reason/config',
|
||||
'{"name": "Loop reason", "object_id": "goodwe_loop_reason", '
|
||||
'"unique_id": "goodwe_ctl_loop_reason", "state_topic": "goodwe_ctl/loop_reason", '
|
||||
'"availability_topic": "goodwe_ctl/availability", "device": ' + _DEV + ', '
|
||||
'"icon": "mdi:sigma"}', True),
|
||||
]
|
||||
|
||||
# What THIS branch announces at a roster of one: release/1.0's eight sensor
|
||||
# configs, then TEL-10's three, then the availability message - which stays
|
||||
# LAST, because `_announce()` publishes it after every config and a broker
|
||||
# replaying the retained set must see availability arrive after the entities it
|
||||
# is the availability OF.
|
||||
SITE_NOW = BASELINE[:-1] + TEL10 + BASELINE[-1:]
|
||||
|
||||
|
||||
class FakeClient:
|
||||
"""Captures what `_announce()` actually hands paho."""
|
||||
@@ -177,7 +218,7 @@ def announce(units=(), omit=(), module=mqtt):
|
||||
return pub.client.msgs
|
||||
|
||||
|
||||
def diff(got, want=BASELINE):
|
||||
def diff(got, want=SITE_NOW):
|
||||
"""`(missing, changed, added)` between two announcement lists, by topic."""
|
||||
g, w = dict((t, (p, r)) for t, p, r in got), dict((t, (p, r)) for t, p, r in want)
|
||||
missing = [t for t in w if t not in g]
|
||||
@@ -186,7 +227,7 @@ def diff(got, want=BASELINE):
|
||||
return sorted(missing), sorted(changed), sorted(added)
|
||||
|
||||
|
||||
def report(label, got, want=BASELINE):
|
||||
def report(label, got, want=SITE_NOW):
|
||||
m, c, a = diff(got, want)
|
||||
print(f" {label}: {len(want)} topics, {len(m)} missing, {len(c)} changed, "
|
||||
f"{len(a)} added")
|
||||
@@ -231,11 +272,33 @@ print("\n1. the recorded baseline, and a roster of one")
|
||||
# entity on a live install.
|
||||
m, c, a = report("roster of one (`inverters:` empty, i.e. every install today)",
|
||||
announce(units=roster_names({})))
|
||||
check("⭐ AT THE SHIPPED ROSTER OF ONE THE ANNOUNCEMENT IS BYTE-IDENTICAL TO "
|
||||
"release/1.0: same topics, same unique_ids, same payload bytes, same "
|
||||
"retain flags, in the same order - no second device, no renamed entity, "
|
||||
"no added topic",
|
||||
(m, c, a) == ([], [], []) and announce(units=roster_names({})) == BASELINE)
|
||||
# ⚠️ THE HEADLINE SAYS EIGHT, NOT NINE, AND THE SLICE UNDER IT IS WHY.
|
||||
# release/1.0 announces NINE messages; the ninth is `goodwe_ctl/availability`,
|
||||
# which `_announce()` publishes LAST and which TEL-10 therefore MOVES - it is
|
||||
# byte-identical but no longer at index 8. So what is asserted here is the eight
|
||||
# entity CONFIGS, `[:len(BASELINE) - 1] == BASELINE[:-1]`, and the word "nine"
|
||||
# above it named an assertion this file does not make. The ninth is not
|
||||
# unguarded: the `== SITE_NOW` on the next check pins it byte-for-byte in its
|
||||
# new last position. Two sentences, two checks.
|
||||
check("⭐ AT THE SHIPPED ROSTER OF ONE EVERY ONE OF release/1.0's EIGHT ENTITY "
|
||||
"CONFIGS IS STILL BYTE-IDENTICAL AND STILL FIRST: same topics, same "
|
||||
"unique_ids, same payload bytes, same retain flags, in the same order - "
|
||||
"no second device, no renamed entity, nothing re-ordered. TEL-10 adds "
|
||||
"rows AFTER them; it may not move one of them. (release/1.0's NINTH "
|
||||
"message, `availability`, is byte-identical too and deliberately moves "
|
||||
"to LAST; the `== SITE_NOW` below is what pins it)",
|
||||
announce(units=roster_names({}))[:len(BASELINE) - 1] == BASELINE[:-1])
|
||||
|
||||
# ⚠️ AND THE ADDITION IS ITS OWN CLAIM, WITH A COUNT. "Nothing moved" and
|
||||
# "exactly three arrived" are different sentences and a single `== SITE_NOW`
|
||||
# would let a fourth row hide inside whichever of the two a reader had in mind.
|
||||
_m1, _c1, _a1 = diff(announce(units=roster_names({})), BASELINE)
|
||||
check("⭐ TEL-10 ADDS EXACTLY THREE TOPICS AND CHANGES NONE: the integrator, "
|
||||
"the lead and the loop's own reason string, all NEW, all on the SITE "
|
||||
"device - nothing of release/1.0's is missing and nothing of it changed",
|
||||
(_m1, _c1) == ([], [])
|
||||
and sorted(_a1) == sorted(t for t, _p, _r in TEL10)
|
||||
and announce(units=roster_names({})) == SITE_NOW)
|
||||
|
||||
check("...and the roster-of-one path is the one every install actually reads: "
|
||||
"an empty `inverters:` names exactly one unit",
|
||||
@@ -244,11 +307,11 @@ check("...and the roster-of-one path is the one every install actually reads: "
|
||||
check("...and a publisher told NOTHING about the roster announces the same "
|
||||
"thing, so a caller that has not been taught about units cannot change "
|
||||
"what a live install sees",
|
||||
announce(units=()) == BASELINE)
|
||||
announce(units=()) == SITE_NOW)
|
||||
|
||||
m, c, a = report("roster of one, P1 off (`omit=('p1_age',)`)",
|
||||
announce(units=roster_names({}), omit=("p1_age",)),
|
||||
[row for row in BASELINE if "p1_age" not in row[0]])
|
||||
[row for row in SITE_NOW if "p1_age" not in row[0]])
|
||||
check("...and the `omit` path is unchanged too: with P1 ingestion off the "
|
||||
"watchdog input is still not announced, and nothing else moved",
|
||||
(m, c, a) == ([], [], []))
|
||||
@@ -280,11 +343,18 @@ check("⭐ AC 1: AT A ROSTER OF TWO, EVERY ONE OF A's NINE MESSAGES IS STILL "
|
||||
(m, c) == ([], []))
|
||||
check("...and the eight additions are all B's and A's own per-unit rows, and "
|
||||
"all of them are NEW topics", len(a) == 8)
|
||||
check("...and A's nine messages are still the FIRST nine, in the same order, "
|
||||
"so a broker replaying retained messages sees them unchanged",
|
||||
check("...and A's eight entity configs are still the FIRST eight, in the same "
|
||||
"order, so a broker replaying retained messages sees them unchanged "
|
||||
"(the ninth, `availability`, is byte-identical and last - the check "
|
||||
"above is the one that covers it, as a diff rather than a prefix)",
|
||||
TWO[:len(BASELINE) - 1] == BASELINE[:-1])
|
||||
|
||||
site_ids = {c_["unique_id"] for c_ in cfgs(BASELINE)}
|
||||
# ⚠️ THE SITE SET IS `SITE_NOW`, NOT `BASELINE`. Read from `BASELINE` it would
|
||||
# be short by TEL-10's three, and those three would then be counted as PER-UNIT
|
||||
# rows by every line below that says "not a site id" - which silently changes
|
||||
# what the sha256 pin, the uniqueness checks and part 7's fed/announced set are
|
||||
# taken over.
|
||||
site_ids = {c_["unique_id"] for c_ in cfgs(SITE_NOW)}
|
||||
unit_cfgs = [c_ for c_ in cfgs(TWO) if c_["unique_id"] not in site_ids]
|
||||
a_cfgs = [c_ for c_ in unit_cfgs if "inverter_a" in c_["unique_id"]]
|
||||
b_cfgs = [c_ for c_ in unit_cfgs if "inverter_b" in c_["unique_id"]]
|
||||
@@ -330,7 +400,7 @@ def field(rows, key):
|
||||
|
||||
for key in ("unique_id", "object_id", "state_topic"):
|
||||
av, bv = set(field(a_cfgs, key)), set(field(b_cfgs, key))
|
||||
sv = set(field(cfgs(BASELINE), key))
|
||||
sv = set(field(cfgs(SITE_NOW), key))
|
||||
check(f"⭐ AC 2: no `{key}` is shared between A's entities and B's, and "
|
||||
f"none of B's collides with a SITE entity that already exists",
|
||||
len(av) == 4 and len(bv) == 4 and not (av & bv) and not (bv & sv)
|
||||
@@ -340,10 +410,10 @@ all_ids = field(cfgs(TWO), "unique_id")
|
||||
check("...and across the WHOLE announcement every unique_id is distinct - an "
|
||||
"HA discovery collision is not an error, it DROPS the second entity, so "
|
||||
"one inverter's telemetry would silently stop existing",
|
||||
len(all_ids) == len(set(all_ids)) == 16)
|
||||
len(all_ids) == len(set(all_ids)) == 19)
|
||||
|
||||
all_topics = [t for t, _, _ in TWO]
|
||||
check("...and so is every topic", len(all_topics) == len(set(all_topics)) == 17)
|
||||
check("...and so is every topic", len(all_topics) == len(set(all_topics)) == 20)
|
||||
|
||||
# ⚠️ THE SLUG COLLISION rule 9(c) DOES NOT REFUSE. `inverter-b` and `Inverter B`
|
||||
# are two different names by the validator's test and one string once slugged.
|
||||
@@ -363,8 +433,14 @@ print("\n5. site-scoped sensors stay site-scoped")
|
||||
# firmware's ingest guard). A second copy of it is a second answer to "is the
|
||||
# meter fresh?", one of which is always the one nobody is looking at. `grid` is
|
||||
# the same argument without the safety edge: there is ONE grid connection.
|
||||
# ⚠️ TEL-10's THREE ARE IN HERE, AND THE ARGUMENT IS `grid`'s. There is ONE
|
||||
# integrator - §6.2's architecture is one integrator on the P1 meter whose
|
||||
# output is then SPLIT - so a per-inverter copy of it would invent N of a thing
|
||||
# there is one of, and two of them would disagree the moment the allocator gave
|
||||
# the units different shares.
|
||||
SITE_ONLY = ("goodwe_ctl_grid", "goodwe_ctl_p1_age", "goodwe_ctl_circulation",
|
||||
"goodwe_ctl_phase", "goodwe_ctl_status")
|
||||
"goodwe_ctl_phase", "goodwe_ctl_status",
|
||||
"goodwe_ctl_loop_i", "goodwe_ctl_loop_lead", "goodwe_ctl_loop_reason")
|
||||
rows = []
|
||||
for n in range(1, 7):
|
||||
names = [f"inverter-{chr(ord('a') + i)}" for i in range(n)]
|
||||
@@ -377,8 +453,8 @@ check("⭐ AC 3: `grid` and `p1_sample_age_s` are announced EXACTLY ONCE at ever
|
||||
"two of a thing there is one of, and would duplicate a safety signal",
|
||||
all(counts == [1] * len(SITE_ONLY) for _n, counts, _t in rows))
|
||||
check("...and the site set does not grow with the roster while the per-unit "
|
||||
"set does: 8 site entities always, 4 more per unit past the first",
|
||||
[t for _n, _c, t in rows] == [8, 16, 20, 24, 28, 32])
|
||||
"set does: 11 site entities always, 4 more per unit past the first",
|
||||
[t for _n, _c, t in rows] == [11, 19, 23, 27, 31, 35])
|
||||
|
||||
site_devices = {json.dumps(c_["device"], sort_keys=True)
|
||||
for c_ in cfgs(announce(units=NAMES2))
|
||||
@@ -420,7 +496,7 @@ for c_, eid in zip(cfgs(TWO), composed):
|
||||
f"name {c_['name']!r}")
|
||||
check("⭐ every composed entity_id at a roster of two is DISTINCT: no per-unit "
|
||||
"entity can land on top of a site entity that already has history",
|
||||
len(composed) == len(set(composed)) == 16)
|
||||
len(composed) == len(set(composed)) == 19)
|
||||
|
||||
base_composed = [compose(c_["device"]["name"], c_["name"]) for c_ in cfgs(BASELINE)]
|
||||
check("...and the eight ids that exist today are unchanged by adding B, which "
|
||||
@@ -620,9 +696,9 @@ def properties(mod):
|
||||
bc = [c_ for c_ in uc if "inverter_b" in c_["unique_id"]]
|
||||
ac = [c_ for c_ in uc if "inverter_a" in c_["unique_id"]]
|
||||
comp = [compose(c_["device"]["name"], c_["name"]) for c_ in tc]
|
||||
out["A byte-identical at N=1"] = base == BASELINE
|
||||
out["A byte-identical at N=1"] = base == SITE_NOW
|
||||
out["A byte-identical at N=2"] = diff(two)[:2] == ([], [])
|
||||
out["N=1 adds no topic"] = len(base) == len(none) == len(BASELINE)
|
||||
out["N=1 adds no topic"] = len(base) == len(none) == len(SITE_NOW)
|
||||
out["unique_ids all distinct"] = (
|
||||
len(set(c_["unique_id"] for c_ in tc)) == len(tc))
|
||||
out["slug-alike names still distinct"] = (
|
||||
@@ -703,6 +779,25 @@ MUTATIONS = [
|
||||
' ("grid", "grid_power", "Grid power", "W", "power", "measurement", None),\n')]),
|
||||
("B's device drops `via_device`",
|
||||
[(' "via_device": DEVICE["identifiers"][0],\n', "")]),
|
||||
# --- TEL-10 ------------------------------------------------------------
|
||||
("TEL-10's integrator row is DROPPED (published to a topic nothing "
|
||||
"announced, which AC 4 forbids in the other direction)",
|
||||
[(' ("loop_i", "goodwe_loop_integrator", "Loop integrator", "W", "power", "measurement", None),\n', "")]),
|
||||
("TEL-10's integrator is announced PER INVERTER - two answers to a "
|
||||
"question §6.2 says there is one integrator for",
|
||||
[(' ("sign_latch", "sign_latch", "Sign latch", None, None, None, "mdi:flash-alert"),\n',
|
||||
' ("sign_latch", "sign_latch", "Sign latch", None, None, None, "mdi:flash-alert"),\n'
|
||||
' ("loop_i", "loop_integrator", "Loop integrator", "W", "power", "measurement", None),\n')]),
|
||||
# ⚠️ THE ONE THAT CHANGES NO BYTE OF ANY PAYLOAD. Every id, name, unit and
|
||||
# topic is identical; only the POSITION of the integrator row moves. A
|
||||
# broker replaying the retained set then hands HA a different sequence, and
|
||||
# part 1's claim is about order as much as about bytes - which is why it is
|
||||
# asserted as a LIST and not as a set.
|
||||
("TEL-10's integrator row is announced BEFORE release/1.0's nine",
|
||||
[(' ("loop_i", "goodwe_loop_integrator", "Loop integrator", "W", "power", "measurement", None),\n', ""),
|
||||
(' ("setpoint", "goodwe_setpoint", "Setpoint", "W", "power", "measurement", None),\n',
|
||||
' ("loop_i", "goodwe_loop_integrator", "Loop integrator", "W", "power", "measurement", None),\n'
|
||||
' ("setpoint", "goodwe_setpoint", "Setpoint", "W", "power", "measurement", None),\n')]),
|
||||
]
|
||||
|
||||
survivors = []
|
||||
@@ -757,11 +852,13 @@ for line in [
|
||||
"resolve it, because it renames no device and no entity, and the byte-diff "
|
||||
"protects both spellings equally. SIZE: unresolved, 8 live entity ids; it "
|
||||
"wants one look at the live registry, which this branch must not take.",
|
||||
"3. THE PER-UNIT PAYLOADS HAVE NO RELEASED BASELINE. A's are diffed against "
|
||||
"release/1.0; B's can only be diffed against this branch (the sha256 pin in "
|
||||
"part 3). A wrong `device_class` or unit on a per-unit sensor is therefore "
|
||||
"caught as a CHANGE from review, not as an error. SIZE: 4 sensors x 4 "
|
||||
"optional fields.",
|
||||
"3. THE PER-UNIT PAYLOADS HAVE NO RELEASED BASELINE, AND NEITHER DO "
|
||||
"TEL-10's THREE. A's are diffed against release/1.0; B's can only be "
|
||||
"diffed against this branch (the sha256 pin in part 3), and `TEL10` above "
|
||||
"is the same kind of pin for the three site rows this branch adds. A wrong "
|
||||
"`device_class` or unit on any of them is therefore caught as a CHANGE "
|
||||
"from review, not as an error. SIZE: 4 per-unit sensors x 4 optional "
|
||||
"fields, plus 3 site sensors x 4.",
|
||||
"4. NO CHECK HERE RUNS A BROKER. `_announce()` is graded through a fake "
|
||||
"paho client, so QoS, retain semantics on a real broker, and what HA does "
|
||||
"with a retained config for a device it has never seen are all out of "
|
||||
|
||||
@@ -0,0 +1,370 @@
|
||||
"""Runnable check for TEL-10: the loop's integrator, published.
|
||||
|
||||
`self.i_w` is carried between cycles of `Controller.cycle()` and, before this
|
||||
card, left the process nowhere at all - no entity, no MQTT attribute, no log
|
||||
line. The last investigation into what it does had to RECONSTRUCT it from the
|
||||
grid trace; the reconstruction reproduced about a third of the engagements it
|
||||
was checked against and was discarded.
|
||||
|
||||
⚠️ WHAT THIS FILE REFUSES TO DO, SAID FIRST. It does not assert that a row
|
||||
EXISTS. `publish()` handing a dict with `loop_i` in it is satisfied by
|
||||
`loop_i: 0.0` forever, by `loop_i: setpoint`, and by a row that reports the
|
||||
command under the integrator's name - which is exactly the confusion the card
|
||||
is about, because on a default install the two are within a quantisation step
|
||||
of each other for most of every day. Every check below therefore drives REAL
|
||||
CYCLES through the real `Controller.cycle()` until the two quantities are
|
||||
MEASURABLY DIFFERENT, and grades the published number at a tick where reading
|
||||
the wrong one gives the wrong answer. MUTATION.md habit 4.
|
||||
|
||||
VERIFIED BY BREAKING IT. Every check below was driven by the mutation that
|
||||
defeats the claim it names, in the CI image, on a tree purged of `__pycache__`
|
||||
before each run, with the file's sha256 taken before, after, and again after
|
||||
the revert (MUTATION.md's reporting rules, and habit 18's unique backup path).
|
||||
|
||||
# mutation bytes reds file
|
||||
-- ---------------------------------------------- ----- ---- -----------
|
||||
M1 `self.loop_i_w = loop_prev` - publish the -3 B 5 this file
|
||||
COMMAND under the integrator's name
|
||||
M2 `decision.i_w - self.target` for the lead +2 B 0 SURVIVOR
|
||||
M2b `decision.i_w - decision.target_w` for the lead +8 B 1 this file
|
||||
M3 `"loop_reason": self.reason` - the ARBITER's -5 B 5 this file
|
||||
sentence in the loop's row
|
||||
M4 delete `self.loop_reason = "not-running"` -45 B 1 this file
|
||||
M5 delete the not-running branch's two zeroes -67 B 1 this file
|
||||
M6 `"loop_i": round(self.target, 1)` -2 B 4 this file
|
||||
M7 the `loop_i` row deleted from `SENSORS` -96 B 10+1 test_mqtt
|
||||
+ this file
|
||||
M8 `loop_i` announced PER INVERTER +89 B 8 test_mqtt
|
||||
M9 `loop_i` announced BEFORE release/1.0's nine +0 B 7 test_mqtt
|
||||
|
||||
⚠️ A RED COUNT IS A PROPERTY OF THE SUITE AS MUCH AS OF THE MUTATION, SO EVERY
|
||||
ONE ABOVE NAMES A TREE - this one, at this commit. A later card that adds a
|
||||
check, re-baselines one or deletes one moves the number with the mutation
|
||||
untouched. Re-measure rather than inherit: `tools/mutation_run.sh` on a `cp -a`
|
||||
of the tree, one file at a time, and say which tree. M7's count was written as
|
||||
8 and is 10 on a re-run, on both trees - the direction was right and the count
|
||||
was decoration, which is the half of MUTATION.md's reporting rule 3 that is
|
||||
easiest to let rot.
|
||||
|
||||
⚠️ M9 IS ZERO BYTES AND CHANGES NO PAYLOAD. Every id, name, unit and topic is
|
||||
identical; only the ORDER of the retained messages moves. No fingerprint and no
|
||||
byte delta can see it, which is why part 1 asserts the announcement as an
|
||||
ordered LIST and not as a set.
|
||||
|
||||
⚠️ M2 IS A REAL SURVIVOR AND IS REPORTED AS ONE. At the line it edits,
|
||||
`loop_prev` and `self.target` are the same value: `cycle()` does not reassign
|
||||
`self.target` until `self.target = resolution.target_w`, further down. The
|
||||
mutation therefore changes nothing that runs, on a purged tree, which is not
|
||||
the direction stale bytecode fabricates. `loop_prev` is kept anyway - it is the
|
||||
name the `compute()` call is made with, so the lead cannot be measured against
|
||||
a different cycle's command by anybody moving a line - and M2b is the mutation
|
||||
that DOES change the value, aimed at exactly that.
|
||||
|
||||
⚠️ AND THE FIRST DRAFT OF THIS FILE HAD TWO CHECKS OF ITS OWN THAT COULD NOT
|
||||
REACH THE FAILURE THEY NAMED. Both are MUTATION.md habit 4:
|
||||
|
||||
* "the published integrator reaches its bound" was GREEN under M1, because
|
||||
the command reaches the bound too - twelve cycles later. The check now
|
||||
asserts the LEAD TIME, not the value.
|
||||
* "a stopped controller publishes `not-running`" was GREEN under M4 and M5,
|
||||
because the fixture STARTED stopped and `__init__` writes the same values.
|
||||
It stops the controller part-way through a run that has already wound the
|
||||
integrator to -5000 W, so a row left standing is a WRONG row.
|
||||
|
||||
⚠️ MUTATING THE MODULE THIS FILE GRADES? PURGE `__pycache__` FIRST - or run
|
||||
`tools/mutation_run.sh`, which does. `python3 -B` alone does NOT save you: it
|
||||
stops bytecode being WRITTEN, not a stale one being READ, and a size-preserving
|
||||
edit reverted inside one second is invisible to CPython's staleness test. That
|
||||
is TEST-15, and it has already turned one live mutation into a false survivor.
|
||||
Read MUTATION.md before you report a survivor.
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
import sys
|
||||
|
||||
from app import mqtt
|
||||
from app.control import Tuning, slew_limit_w
|
||||
from app.main import Controller
|
||||
|
||||
fails = []
|
||||
|
||||
# The live install's shape, and every number in it is measured rather than
|
||||
# chosen: `max_w` and `slew_w` are read straight off the recorder (the setpoint
|
||||
# sensor's extremes are exactly +-5000 and 11 226 recorded steps are exactly
|
||||
# 400 W), `gain` and `target_grid_w` are what the options carry.
|
||||
LIVE = {"max_w": 5000.0, "gain": 0.6, "slew_w": 400.0, "target_grid_w": -10.0,
|
||||
"deadband_w": 15, "step_w": 10}
|
||||
# The integrator's bound on a default install: `integrator_max_w` is None, which
|
||||
# control.py resolves to `max_w`. Written as a literal on purpose (habit 2) -
|
||||
# `== c.tuning.max_w` would compare the thing under test against itself.
|
||||
BOUND_W = 5000.0
|
||||
# `slew_w / gain`: the error above which the integrator moves further in one
|
||||
# cycle than the command is allowed to. 400 / 0.6.
|
||||
OUTRUN_W = 666.67
|
||||
|
||||
|
||||
def check(name, cond):
|
||||
print(f" {'ok ' if cond else 'FAIL'} {name}")
|
||||
if not cond:
|
||||
fails.append(name)
|
||||
|
||||
|
||||
class _Store:
|
||||
def __init__(self):
|
||||
self.data = {}
|
||||
|
||||
def set(self, *a):
|
||||
pass
|
||||
|
||||
def get_time(self, *a):
|
||||
return None
|
||||
|
||||
|
||||
class _Pub:
|
||||
"""Captures what `Controller.publish()` hands the publisher, every cycle."""
|
||||
|
||||
enabled = False
|
||||
|
||||
def __init__(self):
|
||||
self.frames = []
|
||||
|
||||
def publish(self, values):
|
||||
self.frames.append(dict(values))
|
||||
|
||||
def close(self):
|
||||
pass
|
||||
|
||||
|
||||
class _Hass:
|
||||
"""A scripted meter and an inverter that follows what it is told.
|
||||
|
||||
⚠️ THE PLANT FOLLOWS EXACTLY AND WITH NO LAG, WHICH IS DELIBERATE AND IS
|
||||
THE HARDER CASE FOR EVERY CHECK HERE. A lagging inverter trips the
|
||||
SATURATION freeze (`|prev_w - actual_w| > saturation_w`), and the
|
||||
saturation freeze already holds the integrator - so a laggy fixture would
|
||||
let SAFETY-13's mechanism pass for SAFETY-48's. Nothing below may be
|
||||
explained by saturation, and part 4 asserts `frozen` is False throughout.
|
||||
"""
|
||||
|
||||
def __init__(self, grid, soc=50.0):
|
||||
self.grid_seq = grid if callable(grid) else (lambda _n: grid)
|
||||
self.soc = soc
|
||||
self.batt = 0.0
|
||||
self.n = 0
|
||||
self.writes = []
|
||||
self.calls = []
|
||||
|
||||
async def limits(self, entity):
|
||||
return (-LIVE["max_w"], LIVE["max_w"], 1.0)
|
||||
|
||||
async def number(self, entity, invert=False):
|
||||
return {"sensor.grid": self.grid_seq(self.n), "sensor.soc": self.soc,
|
||||
"sensor.batt": self.batt}.get(entity)
|
||||
|
||||
async def set_number(self, entity, value):
|
||||
self.writes.append(float(value))
|
||||
self.batt = float(value)
|
||||
return True
|
||||
|
||||
async def call(self, domain, service, data):
|
||||
self.calls.append((domain, service, data))
|
||||
return True
|
||||
|
||||
|
||||
def run(grid, cycles=30, auto=True, stop_after=None, **over):
|
||||
"""`cycles` real `Controller.cycle()`s, and every published frame.
|
||||
|
||||
`stop_after` presses stop part-way through - which is not the same run as
|
||||
starting stopped, and is the only one that can tell a row that was WRITTEN
|
||||
on the not-running branch from a row that was never written at all.
|
||||
"""
|
||||
async def go():
|
||||
hass = _Hass(grid)
|
||||
pub = _Pub()
|
||||
c = Controller(dict(
|
||||
{"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
|
||||
"soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
|
||||
"meter_source": "off", "heartbeat_s": 10, "stale_input_s": 15},
|
||||
**LIVE, **over),
|
||||
hass, _Store(), pub, stop=asyncio.Event())
|
||||
c.auto = auto
|
||||
c.dev_min, c.dev_max = -LIVE["max_w"], LIVE["max_w"]
|
||||
for k in range(cycles):
|
||||
if stop_after is not None and k == stop_after:
|
||||
c.auto = False
|
||||
await c.read_inputs()
|
||||
await c.cycle()
|
||||
c.publish()
|
||||
hass.n += 1
|
||||
return c, hass, pub.frames
|
||||
return asyncio.run(go())
|
||||
|
||||
|
||||
# ==============================================================================
|
||||
print("1. TEL-10: the integrator is published, and it is NOT the command")
|
||||
# ==============================================================================
|
||||
# A standing 6 kW export against a 5 kW rail and a 400 W slew step. The
|
||||
# integrator moves `gain * error` = 3.6 kW on the first cycle and reaches its
|
||||
# 5000 W bound on the second; the command may only move 400 W a cycle, so it is
|
||||
# at 800 W when the integrator is already railed and needs twelve more cycles to
|
||||
# get there. That gap is the fixture: for ten cycles the two numbers differ by
|
||||
# kilowatts, and a row published from the wrong one is wrong by kilowatts.
|
||||
ctl, hass, frames = run(-6000.0, cycles=30)
|
||||
i_row = [f["loop_i"] for f in frames]
|
||||
sp_row = [f["setpoint"] for f in frames]
|
||||
lead_row = [f["loop_lead"] for f in frames]
|
||||
why_row = [f["loop_reason"] for f in frames]
|
||||
print(" cycle loop_i setpoint loop_lead loop_reason")
|
||||
for k in range(8):
|
||||
print(f" {k:<5d}{i_row[k]:8.0f} {sp_row[k]:9.0f} {lead_row[k]:10.0f}"
|
||||
f" {why_row[k]}")
|
||||
|
||||
first_at_bound = next((k for k, v in enumerate(i_row) if abs(v) >= BOUND_W), None)
|
||||
first_cmd_at_bound = next((k for k, v in enumerate(sp_row) if abs(v) >= BOUND_W),
|
||||
len(sp_row))
|
||||
print(f" the integrator reaches {-BOUND_W:.0f} W at cycle "
|
||||
f"{first_at_bound}; the command reaches it at cycle "
|
||||
f"{first_cmd_at_bound}")
|
||||
|
||||
# ⚠️ THE LEAD TIME IS PART OF THE CLAIM, NOT A NICETY. "The published number
|
||||
# reaches the bound" is satisfied by publishing the COMMAND too - it gets there
|
||||
# as well, twelve cycles later - so a check written on the value alone grades
|
||||
# nothing and the mutation that publishes `prev_w` walks straight through it.
|
||||
# Measured: with `self.loop_i_w = loop_prev` this line is red and the value-only
|
||||
# form was green.
|
||||
check("⭐ THE PUBLISHED INTEGRATOR REACHES ITS BOUND, AND REACHES IT TEN CYCLES "
|
||||
f"BEFORE THE COMMAND DOES. A 6 kW export winds it to exactly "
|
||||
f"{BOUND_W:.0f} W - `integrator_max_w` is None, which control.py resolves "
|
||||
"to `max_w` - while the command is still travelling 400 W a cycle",
|
||||
first_at_bound is not None and i_row[first_at_bound] == -BOUND_W
|
||||
and first_cmd_at_bound - first_at_bound >= 10)
|
||||
|
||||
# ⚠️ THE PRECONDITION, AS ITS OWN CHECK (habit 1). If the command happened to be
|
||||
# at the bound too, the line above would be satisfied by publishing EITHER
|
||||
# number and would be grading nothing.
|
||||
check("...and the command is NOWHERE NEAR it at that tick, so the two are "
|
||||
f"separable: setpoint {sp_row[first_at_bound]:.0f} W against an "
|
||||
f"integrator of {i_row[first_at_bound]:.0f} W",
|
||||
abs(sp_row[first_at_bound]) <= BOUND_W / 2)
|
||||
check("...and the gap is the slew limit and not an accident: the command is "
|
||||
"still travelling 400 W a cycle while the integrator stands still",
|
||||
abs(sp_row[first_at_bound + 1] - sp_row[first_at_bound])
|
||||
== slew_limit_w(Tuning(**LIVE)))
|
||||
|
||||
# The lead is `i_w - prev_w`, and `prev_w` is the command the LAST cycle left
|
||||
# standing - which is the setpoint this file captured one frame earlier. Graded
|
||||
# as that identity rather than as a magnitude, because a magnitude cannot tell
|
||||
# a lead from the integrator itself.
|
||||
ident = [k for k in range(1, 12)
|
||||
if round(lead_row[k], 1) != round(i_row[k] - sp_row[k - 1], 1)]
|
||||
check("⭐ AND `loop_lead` IS THE INTEGRATOR MINUS THE COMMAND IT WAS COMPUTED "
|
||||
"AGAINST - the PREVIOUS cycle's setpoint, not this one's. Checked as an "
|
||||
f"identity over cycles 1..11 ({len(ident)} disagreements)", not ident)
|
||||
check("...and it is large while the command is catching up, so the row is not "
|
||||
f"a permanent zero: worst lead {min(lead_row):.0f} W",
|
||||
min(lead_row) <= -2000.0)
|
||||
|
||||
|
||||
# ==============================================================================
|
||||
print()
|
||||
print("2. TEL-10: the reason row is compute()'s OWN word, not the arbiter's")
|
||||
# ==============================================================================
|
||||
# ⚠️ THE TWO SENTENCES EXIST SIDE BY SIDE AND ONE OF THEM ALREADY HAD A ROW.
|
||||
# `self.reason` is `Resolution.explain()` - "loop -> -800 W" - and it prints the
|
||||
# winning claim's NAME, never the claim's reason. So a publisher wired to
|
||||
# `self.reason` would produce a row that is never wrong-looking and never once
|
||||
# says `slew-limited`, which is the value SAFETY-48 is about.
|
||||
print(f" the arbiter's sentence: {ctl.reason!r}")
|
||||
print(f" the loop's own word : {ctl.loop_reason!r}")
|
||||
check("⭐ THE LOOP'S REASON REACHES THE WIRE, and on a slew-limited cycle it is "
|
||||
"the string `slew-limited` - a value the arbiter's sentence does not "
|
||||
"contain at all",
|
||||
"slew-limited" in why_row and "slew-limited" not in ctl.reason)
|
||||
check("...and the two rows are DIFFERENT STRINGS on the same cycle, so one "
|
||||
"cannot have been published from the other",
|
||||
frames[-1]["loop_reason"] != ctl.reason)
|
||||
check("...and every published reason is one `compute()` can actually produce",
|
||||
set(why_row) <= {"tracking", "deadband", "i-clamped", "clamped",
|
||||
"slew-limited", "saturated-freeze", "freeze-released",
|
||||
"not-running"})
|
||||
|
||||
# A converged site: the error is inside the deadband and the law says so.
|
||||
calm = run(-10.0, cycles=6)[2]
|
||||
check("...and a site resting inside the deadband publishes `deadband`, not the "
|
||||
"last exciting word the loop said", calm[-1]["loop_reason"] == "deadband")
|
||||
|
||||
# ⚠️ THE NOT-RUNNING PATH IS A DIFFERENT BRANCH OF `cycle()` AND IS GRADED AS
|
||||
# ONE (habit 9). That branch zeroes `self.i_w`, so a row that kept repeating the
|
||||
# last integrator there would say the loop was winding while nothing is being
|
||||
# controlled at all.
|
||||
#
|
||||
# ⚠️ AND `auto: False` IS NOT THAT BRANCH, WHICH IS WHY BOTH ARE HERE. The
|
||||
# shipped `shadow_mode: auto` means a STOPPED controller still runs the whole
|
||||
# decision path and records it - SAFETY-10 - so the loop is live, the
|
||||
# integrator is real, and a check that assumed otherwise would have been
|
||||
# asserting `not-running` about a loop that was running. It took `auto: False`
|
||||
# AND `shadow_mode: off` to reach the arm that zeroes it.
|
||||
shadowed = run(-6000.0, cycles=6, auto=False)[2]
|
||||
print(f" stopped, shadow_mode auto: status {shadowed[-1]['status']!r}, "
|
||||
f"loop_i {shadowed[-1]['loop_i']:+.0f} W, "
|
||||
f"reason {shadowed[-1]['loop_reason']!r}")
|
||||
check("a STOPPED controller in shadow mode still publishes a live integrator - "
|
||||
"the decision path runs, so the row must report it rather than a zero "
|
||||
"that would read as 'nothing is winding'",
|
||||
shadowed[-1]["status"] == "shadow"
|
||||
and shadowed[-1]["loop_i"] < -1000.0
|
||||
and shadowed[-1]["loop_reason"] != "not-running")
|
||||
|
||||
# ⚠️ AND IT IS STOPPED PART-WAY, NOT STARTED STOPPED, WHICH IS THE WHOLE
|
||||
# DIFFERENCE. A controller that never ran carries `__init__`'s values, so a run
|
||||
# that begins stopped is satisfied by a branch that writes NOTHING - measured:
|
||||
# deleting `self.loop_reason = "not-running"` from `cycle()` outright was a
|
||||
# -45 B SURVIVOR of the first draft of this check. The loop has to wind first,
|
||||
# so that a row left standing is a row that says the wrong thing.
|
||||
stopped = run(-6000.0, cycles=12, stop_after=6, shadow_mode="off")[2]
|
||||
print(f" while running : loop_i {stopped[5]['loop_i']:+.0f} W, "
|
||||
f"reason {stopped[5]['loop_reason']!r}, status {stopped[5]['status']!r}")
|
||||
print(f" after stopping : loop_i {stopped[-1]['loop_i']:+.0f} W, "
|
||||
f"reason {stopped[-1]['loop_reason']!r}, status {stopped[-1]['status']!r}")
|
||||
check("...and the precondition: the loop really was winding before stop was "
|
||||
"pressed, so a stale row afterwards would be a WRONG row and not merely "
|
||||
"an unset one",
|
||||
stopped[5]["loop_i"] <= -1000.0
|
||||
and stopped[5]["loop_reason"] != "not-running")
|
||||
check("⭐ AND ONCE THE DECISION PATH IS GENUINELY OFF THE ROWS SAY SO: "
|
||||
"`not-running` and a zero integrator - the same zero `cycle()` writes to "
|
||||
"`self.i_w` on that branch, not the number it was carrying a cycle ago",
|
||||
stopped[-1]["status"] == "stopped"
|
||||
and stopped[-1]["loop_reason"] == "not-running"
|
||||
and stopped[-1]["loop_i"] == 0.0 and stopped[-1]["loop_lead"] == 0.0)
|
||||
|
||||
|
||||
# ==============================================================================
|
||||
print()
|
||||
print("3. TEL-10: announced and published are the same three topics")
|
||||
# ==============================================================================
|
||||
# mqtt.py's `omit` note: an entity that exists and is never fed is a worse
|
||||
# signal than one that does not exist. This is that claim for TEL-10's rows,
|
||||
# taken off the SHIPPED announcement and the SHIPPED `publish()`.
|
||||
announced = {t.rsplit("/", 2)[-2].replace(f"{mqtt.BASE}_", "")
|
||||
for t, _ in mqtt.discovery_payloads()}
|
||||
published = set(frames[-1])
|
||||
TEL10 = {"loop_i", "loop_lead", "loop_reason"}
|
||||
print(f" announced keys: {sorted(announced & TEL10)}")
|
||||
print(f" published keys: {sorted(published & TEL10)}")
|
||||
check("all three rows are announced AND published - no entity nothing feeds, "
|
||||
"no topic nothing declared",
|
||||
TEL10 <= announced and TEL10 <= published)
|
||||
check("...and they are on the SITE device, not per unit - there is one "
|
||||
"integrator",
|
||||
all(c["device"] == mqtt.DEVICE
|
||||
for t, c in mqtt.discovery_payloads(["inverter-a", "inverter-b"])
|
||||
if c["unique_id"].replace(f"{mqtt.BASE}_", "") in TEL10))
|
||||
|
||||
print()
|
||||
if fails:
|
||||
print(f"{len(fails)} FAILED:")
|
||||
for f in fails:
|
||||
print(f" - {f}")
|
||||
sys.exit(1)
|
||||
print("all checks passed")
|
||||
@@ -272,6 +272,136 @@ check("REFUSED is exactly 1, not merely non-zero",
|
||||
print("\nthe shipped tree's own version is readable")
|
||||
check("shipped_version() finds a version", bool(shipped_version(HERE)))
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- #
|
||||
# PKG-14 - THE OTHER HALF OF THE NO-OP, AND NOTHING GRADED IT.
|
||||
#
|
||||
# PKG-09 refuses a deploy whose `version:` did not move. It cannot see the
|
||||
# mirror failure, which this repository has now produced twice: the version
|
||||
# DOES move and the changelog's `## Unreleased` block is never closed, so the
|
||||
# operator who opens the file to find out what they are about to install reads
|
||||
# "THIS HAS NO VERSION AND CANNOT REACH AN INSTALL UNTIL IT GETS ONE" about a
|
||||
# tree that is being installed. `## 0.8.0` records one such block that
|
||||
# accumulated across three releases; `## 0.9.0` was cut with a second one left
|
||||
# standing underneath it.
|
||||
#
|
||||
# ⚠️ THE TWO SIDES COME FROM DIFFERENT FILES ON PURPOSE (MUTATION.md habit 4).
|
||||
# config.yaml's `version:` and CHANGELOG.md's newest heading are written by
|
||||
# different hands at different times, and the whole defect is that they drift.
|
||||
# A check that read the number once and compared it with itself would be the
|
||||
# DEV-02 fixture again: a number against itself.
|
||||
#
|
||||
# ⚠️ AND IT IS NOT A SUBSTRING SCAN OVER THE WHOLE FILE. Every id this section
|
||||
# looks for occurs dozens of times lower down, so a scan of the file would pass
|
||||
# on any tree whatever the newest section said - CFG-04's defect, which asserted
|
||||
# against the TEXT of the thing under test. The section is SLICED first, and
|
||||
# part 11a grades the slicer against a sentinel that exists only below it.
|
||||
print("\n11. PKG-14 - the bump and the closed section are one act")
|
||||
|
||||
_CHANGELOG = os.path.join(HERE, "CHANGELOG.md")
|
||||
with open(_CHANGELOG, encoding="utf-8") as fh:
|
||||
_cl_lines = fh.read().splitlines()
|
||||
|
||||
_heads = [(i, l[3:].strip()) for i, l in enumerate(_cl_lines)
|
||||
if l.startswith("## ")]
|
||||
check(f"precondition: the file has {len(_heads)} `## ` headings, so the "
|
||||
f"quantifiers below are not over an empty set", len(_heads) >= 8)
|
||||
|
||||
# 11a. THE SLICE, AND TWO CONTROLS ON THE SLICER.
|
||||
# ARCH-02's fifteenth instance: a splitter that never closes attributes
|
||||
# everything to the last thing it opened, and every per-section check
|
||||
# downstream silently becomes a total over the whole file. Both controls below
|
||||
# exist because 11b/11c would go on passing for a tree in which nothing they
|
||||
# name is true.
|
||||
|
||||
|
||||
def slice_newest(lines):
|
||||
"""(heading text, the lines of the FIRST `## ` section) - closing at the
|
||||
next `## `, which is the half that has to be graded rather than assumed."""
|
||||
heads = [i for i, l in enumerate(lines) if l.startswith("## ")]
|
||||
if not heads:
|
||||
return None, []
|
||||
start = heads[0]
|
||||
end = heads[1] if len(heads) > 1 else len(lines)
|
||||
return lines[start][3:].strip(), lines[start:end]
|
||||
|
||||
|
||||
# CONTROL ONE, run on every invocation rather than attested in a commit
|
||||
# message: a synthetic document whose token appears ONLY below the first
|
||||
# section. A slicer that runs to the end of the file finds it; this one must
|
||||
# not. test_defaults_pin.py part 5 plants a literal for the same reason.
|
||||
_SYNTH = ["# Changelog", "", "## 9.9.9", "", "the newest section.", "",
|
||||
"## 9.9.8", "", "PLANTED-ONLY-BELOW", ""]
|
||||
_syn_name, _syn_body = slice_newest(_SYNTH)
|
||||
check("11a. the slicer CLOSES - on a synthetic document it excludes a token "
|
||||
"that exists only in the section BELOW the newest one",
|
||||
_syn_name == "9.9.9" and "PLANTED-ONLY-BELOW" in "\n".join(_SYNTH)
|
||||
and "PLANTED-ONLY-BELOW" not in "\n".join(_syn_body))
|
||||
|
||||
_top_name, _top_body = slice_newest(_cl_lines)
|
||||
_newest = "\n".join(_top_body)
|
||||
_SENTINEL = "## 0.8.0"
|
||||
check(f"...and on the shipped file too: it does not contain {_SENTINEL!r}, "
|
||||
f"which the file does", _SENTINEL in "\n".join(_cl_lines)
|
||||
and _SENTINEL not in _newest)
|
||||
check(f"...and it is not empty: {len(_top_body)} lines under {_top_name!r}",
|
||||
len(_top_body) > 20)
|
||||
|
||||
# CONTROL TWO - and this is the one that catches a LOST HEADING rather than a
|
||||
# loose slicer. Every version section in this file carries exactly one
|
||||
# "in merge order since" contents table. Delete a released section's `## `
|
||||
# heading and its table is swallowed by the section above, which is a released
|
||||
# record disappearing into an unreleased one - the shape `## 0.7.0` already
|
||||
# records for 0.6.0, and the one PKG-08 is left holding.
|
||||
_tables = [l for l in _top_body if "in merge order since" in l]
|
||||
check(f"...and it carries EXACTLY ONE contents table, not {len(_tables)} - a "
|
||||
f"second one means a released section below lost its `## ` heading and "
|
||||
f"was absorbed into this one", len(_tables) == 1)
|
||||
|
||||
# 11b. THE BLOCK IS CLOSED, AND IT CARRIES THE SHIPPED NUMBER.
|
||||
check("11b. the newest `## ` heading is a VERSION and not `Unreleased` - the "
|
||||
"block was closed by whoever bumped the version",
|
||||
_top_name.lower() != "unreleased")
|
||||
_shipped = shipped_version(HERE)
|
||||
check(f"...and it is exactly config.yaml's `version:` ({_shipped!r} in "
|
||||
f"config.yaml, {_top_name!r} in CHANGELOG.md) - two files, so a bump "
|
||||
f"without a section, or a section without a bump, is red",
|
||||
_top_name == _shipped)
|
||||
|
||||
# 11c. A WITHDRAWN price_provider IS NAMED IN THE SECTION THAT WITHDRAWS IT.
|
||||
# ⚠️ READ OFF app/price.py BY AST, NOT TYPED HERE. A list transcribed into this
|
||||
# file would go on passing after a fourth id was retired and documented
|
||||
# nowhere, which is the exact failure TARIFF-07 exists to prevent: an id the
|
||||
# add-on refuses at startup and no release note mentions.
|
||||
import ast # noqa: E402
|
||||
_price_src = open(os.path.join(HERE, "app", "price.py"),
|
||||
encoding="utf-8").read()
|
||||
_retired = []
|
||||
for _node in ast.walk(ast.parse(_price_src)):
|
||||
if isinstance(_node, ast.AnnAssign) and getattr(
|
||||
_node.target, "id", None) == "RETIRED_PROVIDERS":
|
||||
_retired = [k.value for k in _node.value.keys]
|
||||
elif isinstance(_node, ast.Assign) and any(
|
||||
getattr(t, "id", None) == "RETIRED_PROVIDERS" for t in _node.targets):
|
||||
_retired = [k.value for k in _node.value.keys]
|
||||
check(f"11c. precondition: RETIRED_PROVIDERS was read off app/price.py and is "
|
||||
f"not empty - {sorted(_retired)}", len(_retired) > 0)
|
||||
_unnamed = sorted(p for p in _retired if p not in _newest)
|
||||
check(f"...and every one of the {len(_retired)} withdrawn id(s) is named in "
|
||||
f"`## {_top_name}` - an id the validator refuses at startup that no "
|
||||
f"release note mentions is the TARIFF-07 defect with the sign flipped",
|
||||
_unnamed == [])
|
||||
|
||||
# 11d. THE LEDGER OF BLOCKS STILL MISFILED, FROZEN RATHER THAN FIXED.
|
||||
# PKG-08 owns splitting them; this file owns the promise that the number can
|
||||
# only go DOWN. A release that cuts its section and leaves a second
|
||||
# `## Unreleased` standing is red here on the commit that does it.
|
||||
_stale = [n for _, n in _heads[1:] if n.lower() == "unreleased"]
|
||||
check(f"11d. exactly {len(_stale)} `## Unreleased` block(s) remain BELOW the "
|
||||
f"newest section, and the count is pinned EXACTLY so the ledger can "
|
||||
f"only shrink - splitting them is PKG-08, not this file",
|
||||
len(_stale) == 1)
|
||||
|
||||
for d in tmpdirs:
|
||||
shutil.rmtree(d, ignore_errors=True)
|
||||
|
||||
|
||||
@@ -2938,10 +2938,19 @@ check("...and it is inert BY CONSTRUCTION, not by a special case: the value it "
|
||||
# controller command NOW, from a battery at 0 W" - ONE STEP - and not "what
|
||||
# trajectory would it have followed". The trajectory is a closed-loop property
|
||||
# and it did not happen; reporting it would be a simulation of a plant that
|
||||
# does not exist. The strategies are unaffected: arbitrage, the peak guard and
|
||||
# maintenance all file SET claims at a fixed power from level-triggered inputs,
|
||||
# which is why the three defects this card was written for are all visible from
|
||||
# a shadow run and this one is not.
|
||||
# does not exist.
|
||||
#
|
||||
# ⚠️ AMENDED BY SAFETY-47. The three lines that stood here said "the strategies
|
||||
# are unaffected ... which is why the three defects this card was written for
|
||||
# are all visible from a shadow run and this one is not." That was true until
|
||||
# SAFETY-45 merged, one commit earlier: the buy leg is now sized from the
|
||||
# BILLED-QUARTER METER, which is a function of what the battery did. So this is
|
||||
# NOT the loop leg's own limitation - it is the GENERAL case, and the loop leg
|
||||
# is merely where it had already been noticed. A shadow run cannot surface any
|
||||
# closed-loop defect, and of the three this card was written for exactly one -
|
||||
# TARIFF-14's wrong quarter-hour - is visible from one. `test_arbitrage.py`
|
||||
# part 3d grades that; this check keeps grading the loop leg, which is what it
|
||||
# has always been for.
|
||||
check("RECORDED LIMITATION: the loop leg's shadow decision is ONE slew step "
|
||||
"from the standing command and stays there, while the live run RAMPS. A "
|
||||
"shadow run answers 'what would it do now', not 'what trajectory would "
|
||||
|
||||
@@ -38,6 +38,14 @@
|
||||
#
|
||||
# Editing this file is how you say "the announcement changed on purpose". Do not
|
||||
# edit it to make a check pass.
|
||||
#
|
||||
# ⚠️ TEL-10 ADDED THE LAST THREE ROWS, AND THEY ARE ADDITIONS RATHER THAN A
|
||||
# RE-COMPOSITION. Nothing above them moved: same entity_ids, same unique_ids,
|
||||
# same device. They are recorded here - the BUILD's reference - and deliberately
|
||||
# NOT in `live-entities-recorded.txt`, because the install does not have them
|
||||
# yet and an id the build announces that the install lacks is a NEW entity, not
|
||||
# an orphan. `test_mqtt.py` part 1 grades the same two claims on the payload
|
||||
# bytes.
|
||||
sensor.goodwe_setpoint goodwe_ctl_setpoint goodwe_rs485_controller
|
||||
sensor.goodwe_grid_power goodwe_ctl_grid goodwe_rs485_controller
|
||||
sensor.goodwe_battery_power goodwe_ctl_battery goodwe_rs485_controller
|
||||
@@ -46,3 +54,6 @@ sensor.goodwe_circulating_power goodwe_ctl_circulation goodwe_rs485_controlle
|
||||
sensor.goodwe_maintenance_phase goodwe_ctl_phase goodwe_rs485_controller
|
||||
sensor.goodwe_controller_status goodwe_ctl_status goodwe_rs485_controller
|
||||
sensor.goodwe_p1_sample_age goodwe_ctl_p1_age goodwe_rs485_controller
|
||||
sensor.goodwe_loop_integrator goodwe_ctl_loop_i goodwe_rs485_controller
|
||||
sensor.goodwe_loop_integrator_lead goodwe_ctl_loop_lead goodwe_rs485_controller
|
||||
sensor.goodwe_loop_reason goodwe_ctl_loop_reason goodwe_rs485_controller
|
||||
|
||||
Reference in New Issue
Block a user