glenn schrooyenandClaude Opus 5.5
55a6d5dcdb
A later anti-windup notice could replace a write-path BUG SIGNAL notice
under the shared goodwe_output_clamp id (escalation ignores the budget).
The WARNING now uses goodwe_integrator_bound and points to DOCS; the
cadence sentence in DOCS is corrected. Tests pin both ids (red on fd14569).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.5 KiB
SAFETY-40: the integrator bound is not a bug
Decision. i_clamped (the integrator reaching integrator_max_w, i.e.
anti-windup) keeps alarming through the same ClampWatchdog: it is counted,
notified on the same cadence, and escalates on a sustained run
(SAFETY-41). It gets its own text, a WARNING and an amber status row. Only
clamped (a command over max_w) and write-path clamps keep the BUG SIGNAL,
the ERROR and the red row.
Why it still notifies. On a default install clamped is unreachable
(control.py, at the integrator bound), so the integrator bound is the only
loop-side signal of a runaway such as the 14 768 W one. Silencing it would
remove that. The card says the same: "the fix is to say the true thing, not to
say less."
Why a bug has its own budget. A genuine over-rating must not wait up to
REASSERT_S behind anti-windup notices. ClampWatchdog tracks a separate
last_bug_alarm, and a bug's text is never overwritten by later anti-windup
text within an episode. Across episodes the WARNING uses its own
notification id (goodwe_integrator_bound), so it cannot replace a BUG SIGNAL
notice still on screen (review of #130). With only bug engagements, the cadence is the same as
before (test_clamp.py part 9).
Numbers. They come from the Decision of the clamping tick (i_bound_w,
requested_w, clamped_w, target_w), not from i_w or self.target.
Open for the owner. Whether scattered one-cycle anti-windup episodes should notify at all, or only log and count. They notify now, as before.