SAFETY-52: a battery that refuses is asked for 0 W, with a 200 W probe every 15 min #141

Merged

admin merged 3 commits from SAFETY-52-refused-hold into release/1.0 2026-09-27 18:21:22 +02:00

Conversation 4 Commits 3 Files Changed 11

+894 -11

3 Commits

Author	SHA1	Message	Date
adminandClaude Opus 5.5	3c0f2b9669	SAFETY-52 review: a refusal is under 100 W, and any delivery ends it ... - Engage (and seed from a stale stop) below REFUSED_BELOW_W, the probe's own 100 W answer, not below saturation_w: a battery derated to 100-499 W was held at 0 W ~93 % of the time. - A reading of 100 W or more in the held direction ends the refusal, probe or not: at a 1 s meter SETTLE_CYCLES is 12 s, shorter than a healthy reading's lag, and that held a healthy step at 0 W until the next probe. - test_refusal part 5b and a seed test; DOCS states the N>1 limit; the DECISIONS record carries the traced cause of the replay's extra trips. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-27 18:11:42 +02:00
glenn schrooyenandClaude Opus 5.5	1d33265aac	test_price: grade the Why row of the same render, not a second read of why_words ... Since UX-10 the waiting sentence counts its seconds when it is read, so the second read could cross a second boundary on a loaded runner ("1 second" in the row, "2 seconds" in the check). CI run 953 on this PR failed that way; test_price.py passes locally on the same tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-27 17:04:55 +02:00
glenn schrooyenandClaude Opus 5.5	1f97c7652f	SAFETY-52: a battery that refuses is asked for 0 W, with a 200 W probe every 15 min ... At the BMS cut-out the saturation freeze held the last request for hours (+5000 W for 11.87 h on 09-06, +1940 W for 3 h 55 m on 09-19) until the grid error changed sign. compute() now carries a refused direction: after SETTLE_CYCLES of a ~0 W reading against a larger ask it holds that direction at 0 W, probes 200 W (below the gate's 250 W) every 15 minutes, and lets go on charge, an answered probe, stop/start or another writer. A stale-reading trip on a frozen ~0 W reading seeds the same hold, which ends SAFETY-59's ~70 s cycle. One inverter only; no SoC in the loop (SAFETY-25 Option A). test_refusal.py drives the real Controller and gate; tools/replay_refusal.py replays the 16-day capture. test_clamp.py and test_delivery.py re-baselined where they asserted the old hold. DECISIONS/SAFETY-52 has the record and what SAFETY-58/59 must take into account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-27 16:43:27 +02:00