goodwe-addon/goodwe_controller/DECISIONS/SAFETY-48-bounding-the-integrator-lead.md

# SAFETY-48 — the slew step ceiling reaches the integrator, and what it bounds is the LEAD

**Status:** decided and implemented on branch `SAFETY-48`, on top of `TEL-10`.
**Card:** SAFETY-48 — *"the integrator goes on winding while the command is
slew-limited"*.
**Nothing here reached the inverter.** The live install still runs `slew_w: 400`
applied by hand on 2026-09-05 12:00 and `release/1.0`'s control law. This branch
does not deploy and does not bump the version.

---

## 0. The four things a reader should take away

1. **It is a missing case, not a wrong constant, and the arithmetic says so.**
   The integrator moves `gain * error` a cycle and the command moves at most
   `slew_w`, so the integrator outruns the command whenever
   `|error| > slew_w / gain` — 667 W at the live shape. SAFETY-39's retune made
   `slew_w` **smaller**, which makes that threshold **lower**. §1.
2. ⚠️ **THE FORM THE CARD ASKED FOR RAISES THE BILLED QUANTITY, AND THAT IS WHY
   IT IS NOT WHAT SHIPPED.** Reusing the asymmetric freeze on a carried slew
   flag cuts export 13 % and moves the worst quarter-hour average **offtake**
   from 3739 W to **3935 W**, with the mean quarter +2.7 W — and on the billed
   quarter it is worse at **every plant lag where release/1.0 produces a peak
   at all** (a tie at lag 0, worse at 2.5 / 5.0 / 7.5 / 10.0 s) and at **every
   top-N cut of the quarters**, which makes this the least lag-sensitive result
   in the card. The harm is a tail redistribution inside quarters that already
   net to offtake, not a weaker answer to import in aggregate. §3, §3a.
3. **What ships bounds the LEAD at one slew step, only where the slew is what
   stopped the command, and only in the leading direction.** The robust result
   is the **export reduction — 39.6 → 34.1 kWh, and it falls at every plant and
   tuning tried** — with wasted throughput 4.67 → 3.19 kWh, sign reversals
   2992 → 2770 and median recovery 232 → 199 s. ⚠️ **The billed quarter is not
   something this card can claim.** It reads 3739 → **3434 W** at the fitted
   plant lag of 7.5 s; at every lag ≤ 5.0 s — including the one that best
   reproduces the recorded export — release/1.0 is *already* at 3434 W and this
   card moves it by exactly zero. The lag is not identified by the data. §4,
   §3a.
4. **Two committed numbers moved and neither is a silent edit.** SAFETY-13's
   released command settles lower, because there is less wound integrator to
   settle onto; and SAFETY-39's *"the slew does not own the over-absorption"* is
   now **false — inverted, on its own independent plant model.** §5, §6.

---

## 1. The defect, in the terms the code uses

`compute()` freezes the integrator with an asymmetric rule, and the comment
beside it states the requirement outright:

> the requirement is that the INTEGRATOR stop accumulating, not only the command

But `frozen` is computed from **one** signal:

```python
saturated_now = abs(prev_w - actual_w) > tuning.saturation_w   # not tracking
```

Slew-limiting never enters it. When the command hits the step ceiling the
integrator keeps winding at `gain * error` until it reaches `integrator_max_w`,
and the unwind afterwards is `integrator_max_w / slew_w` cycles — 12.5 at the
live shape, about a minute at the meter's measured tick.

⚠️ **AND THE RETUNE MADE IT MORE FREQUENT, NOT LESS.** `|error| > slew_w / gain`
is 1667 W at `slew_w: 1000` and **667 W** at `slew_w: 400`. The measured median
grid error at the onset of a recorded episode is 1114 W — above the second
threshold and below the first. This is why SAFETY-39 did not fix it, and the
mechanism is the same one §6 shows inverting.

## 2. How it was measured, and what the measurement cannot say

`tools/replay_recorded_loop.py`, over **16.00 days / 256 252 meter instants** of
the live install's own recorder, exported read-only.

**Real:** the disturbance (`D = grid + batt` at every recorded meter instant —
the house with this loop's own battery taken back out, which is exogenous and
therefore valid to drive a counterfactual with); the tick (the meter's own
recorded instants, median **5.01 s**); and the control law, imported out of the
checkout. The "before" law is the **same file** with the SAFETY-48 block removed
by a named substitution and exec'd into a fresh namespace — never a
transcription — and a missing or duplicated anchor is a **refusal** with
`NOTHING HAS BEEN MEASURED` on it, because an instrument that quietly compared
the shipped law with itself would report the card as changing nothing.

**Modelled:** the inverter (pure delay 7.5 s + first-order lag 2.0 s +
`batt = 0.973 × cmd − 22.4 W`, fitted on this same recording above the SoC
floor, residual **375 W RMS**); the pack (SoC integrated, discharge refused at
or below the floor); and **everything else the arbiter does** — the recorded
setpoint is the arbiter's output after the peak guard, the SoC clamps,
maintenance and arbitrage, while the replay runs `compute()` alone.

⚠️ **THE ABSOLUTE FIGURES ARE PESSIMISTIC BY ABOUT A THIRD AND THE TOOL PRINTS
IT ON EVERY RUN.** Replaying the before-law reproduces 39.6 kWh of export where
the install actually exported **29.4 kWh** over the same window. The delta is
what this instrument is for: both laws run on the same ticks, the same
disturbance, the same plant and the same seed.

⚠️ **THE SoC FILTER ON THE PLANT FIT IS THE WHOLE FIT, AND IT IS A FINDING IN
ITS OWN RIGHT.** This install spends **36 % of its ticks at or below a 10 % SoC
with the command standing near 2 kW and the battery delivering nothing.** Fitted
over all ticks the recording says `batt = 0.50 × cmd − 396 W, r = 0.70` — a
plant that follows half the command, which no inverter does. Above the floor the
same data says `batt = 1.00 × cmd − 28 W, r = 0.977`. The floor is the PACK and
is modelled separately.

## 3. The form the card asked for, and the number that refused it

The card asked for the asymmetric rule already in service for saturation, on a
flag carried across cycles the way `sat_count` is. It was built — from
release/1.0's own source, one substitution per change — and measured on the same
16 days through the same pipeline:

| | release/1.0 | **form A** — carried slew flag + the asymmetric freeze | **SAFETY-48** — the lead cap |
|---|---:|---:|---:|
| export kWh | 39.61 | 34.43 | **34.07** |
| import kWh | 116.07 | 110.62 | 111.20 |
| battery sign reversals | 2992 | **2656** | 2770 |
| wasted throughput kWh | 4.67 | **2.99** | 3.19 |
| **worst 15-min offtake W** | 3739 | ⚠️ **3935** | **3434** |
| mean quarter-hour offtake delta | — | ⚠️ **+2.73 W** | **−2.39 W** |
| worst quarter-hour delta | — | +992 W | +532 W |
| recovery median s | 232 | **184** | 199 |
| recovery p99 s | 849 | **781** | 850 |
| recovery max s | 901 | 890 | 898 |
| unrecovered (> 900 s) | 53 | **26** | 31 |
| \|i_w − prev_w\| p99 W | 3361 | 1534 | **800** |
| \|i_w − prev_w\| max W | 9200 | 6912 | **800** |

**Form A wins on four rows and loses on the one that is billed.** The capacity
tariff (*capaciteitstarief*) bills the month's worst quarter-hour average
offtake, and form A raises it by **196 W** — and raises the MEAN quarter by
2.7 W, so this is systematic and not one unlucky quarter. It does so in **five
of the six** plant and tuning variants in `--sensitivity`; the sixth is a tie.

The per-cycle mechanism is that a frozen integrator stops at
`prev + gain·error(first cycle)`, which is `(1 − gain)` short of what the site
needs — 40 % short at `gain: 0.6`.

⚠️ **AND THE SENTENCE THAT USED TO FOLLOW THAT ONE WAS TOO BIG FOR THE DATA.**
It read *"for an IMPORT it is offtake, so a large import is answered too weakly
for as long as the ramp lasts"*. The aggregate does not show a weaker answer to
import: form A cuts total import by **5.45 kWh** and export by **5.18 kWh**
against release/1.0, and paired tick by tick it delivers **8.56 kWh LESS**
offtake energy on the ticks release/1.0 spent importing (lower on 38 229 such
ticks, higher on 19 669). What form A moves is the **TAIL, within quarters that
already net to offtake** — the worst quarter goes 3739 → 3935 W, the top five
3260 → 3300 W, the top fifty 1880.0 → 1882.7 W. The capacity tariff bills the
worst quarter and nothing else, so a redistribution that leaves the mean alone
and lifts the maximum is exactly the trade that is refused here. The conclusion
is unchanged; the causal sentence is now the one the data supports.

⚠️ **THE CARD SAID "do not invent a second rule", AND THE MEASUREMENT SAYS TO.**
That instruction is recorded here rather than quietly dropped. What ships is a
different rule; the paragraph above is why.

## 3a. ⚠️ The plant lag is NOT identified by this recording, and the billed quarter is the claim that depends on it

`fit_plant()` picks `lag 7.5 s` because it minimises **battery-power RMS**. That
objective barely distinguishes the candidates — 375.3 W at 7.5 s against 376.4 W
at 2.5 s, **0.3 %** — while the tool's *own* printed fidelity measure, replayed
export against the **29.43 kWh this install actually exported**, prefers 2.5 s by
the whole of the 35 % gap the header warns about. Two measures on the same data
disagree, and nothing here breaks the tie.

So the sweep has to be read as a sensitivity, not as a confirmation:

| plant lag | fit RMS W | replayed export kWh (release/1.0) | **worst 15-min offtake W:** release/1.0 | form A | SAFETY-48 | mean quarter ΔW |
|---:|---:|---:|---:|---:|---:|---:|
| 0.0 | 392.3 | 23.5 | **3434** | 3434 | **3434** | +0.53 |
| 2.5 | **376.4** | **28.9** ← nearest 29.43 | **3434** | ⚠️ 3732 | **3434** | −0.59 |
| 5.0 | 378.0 | 32.1 | **3434** | ⚠️ 3711 | **3434** | −1.02 |
| 7.5 | **375.3** ← chosen | 39.6 | 3739 | ⚠️ 3935 | **3434** | −2.39 |
| 10.0 | 384.2 | 75.4 | 3954 | ⚠️ 4326 | **3434** | −4.65 |

(The RMS column is `fit_plant()`'s own inner sweep pinned to one lag — best `tau`
and a re-fitted gain/offset at that lag. The export and quarter columns follow
`--sensitivity`'s convention instead: only the lag is substituted into the
global fit, everything else held. That is why the lag 5.0 and 10.0 export
figures are the ones already printed in §7b.)

⚠️ **AT EVERY LAG ≤ 5.0 s THE IMPROVEMENT IS NOT AN IMPROVEMENT — IT IS AN
ABSENCE.** release/1.0's worst quarter is *already* 3434 W there and SAFETY-48
changes it by **exactly zero**. §7b's paragraph used to read the `3434 → 3434`
rows as "the direction does not move"; that is the wrong reading. The direction
has nothing to move: at those plants release/1.0 never produces a quarter worse
than 3434 W in the first place, and the 3739 → 3434 W headline exists only at
the single longest lag `fit_plant()` happens to select. **The peak claim is a
property of the plant model, not of the card.** What the card can claim on the
billed quantity is that it does not make it worse, at any lag.

⚠️ **AND THE ONE RESULT HERE THAT IS NOT LAG-SENSITIVE IS THE FORM-A
REJECTION.** Form A's worst quarter is the worst of the three at **every lag
where release/1.0 produces a peak at all** — 3732, 3711, 3935, 4326 against
release/1.0's 3434, 3434, 3739, 3954 at lags 2.5 / 5.0 / 7.5 / 10.0, and a tie
at lag 0.0 where both sit at 3434. It is worse at every top-N cut of the
quarters at the fitted plant (top-1 3934.6 against 3738.7, top-5 3299.7 against
3260.5, top-10 2890.6 against 2871.0, top-50 1882.7 against 1880.0, top-100
1481.7 against 1479.0), and it raises the mean quarter. §3 understated this: the rejection does not rest on one unlucky
quarter at one plant, which is exactly the objection a lag-sensitive result
invites.

⚠️ **WHAT WOULD SETTLE IT IS NOT IN THIS RECORDING.** Both objectives above are
computed from the same four recorded entities, and they disagree; nothing else
in the capture breaks the tie, and this card did not go looking for a third
objective after seeing which lag each of the first two preferred. A driven step
response — the command timestamped where it is written rather than where Home
Assistant recorded it — is what identifies a lag. That is a rig measurement and
it is not this card. Until it exists, the export reduction is what this card
delivers and the peak figure is a plant-model artefact.

## 4. What ships

```python
    slew = slew_limit_w(tuning)
    slewed = max(prev_w - slew, min(prev_w + slew, target))
    if slewed != target:
        reason = "slew-limited"
        _lead_cap = SLEW_LEAD_STEPS * slew
        if target > slewed:
            i_w = min(i_w, slewed + _lead_cap)
        elif target < slewed:
            i_w = max(i_w, slewed - _lead_cap)
    target = slewed
```

Four properties, and each of them is a decision:

* **It is inside the branch**, and ⚠️ **that placement was a SURVIVOR of all
  thirty files until a check was written for it.** Applying it to every cycle
  instead — `i_w = max(target - cap, min(target + cap, i_w))` after
  `target = slewed`, −92 B — is **bit-identical on the shipped configuration**:
  0 of 256 246 ticks differ over the 16-day recording. The two separate **only**
  where `integrator_max_w` is set ABOVE `max_w` — the configuration `control.py`
  says is the only way its `clamped` reason is reachable. There the integrator
  is *deliberately* allowed above the rail, and an unconditional cap would drag
  it back to the command every cycle and make the option inert.
  `test_telemetry.py` part 4 drives that configuration, and the unconditional
  form is red on it.

  ⚠️ **THE COUNT OF SEPARABLE STATES IS DECORATION AND THREE SWEEPS DISAGREE
  ABOUT IT.** This card's grid gave **2050 of 257 400**; an independent review
  measured **1220 of 246 064**; a third, smaller grid (four tunings × 7 `prev_w`
  × 9 `grid_w` × 5 `actual_w` × 8 `i_w` including `None` × 4 `sat_count`) gives
  **776 of 40 320** — and that third one is spelled out here precisely because
  the first two are not, which is the whole reason they cannot be reconciled.
  No count here should be read as exact without the grid beside it. All three
  agree on the load-bearing part, which is **where**: every separable state sits
  in the `integrator_max_w > max_w` tuning and nowhere else.

  ⚠️ **AND AN EARLIER DRAFT OF THIS BULLET GAVE THE WRONG REASON AND THE WRONG
  NUMBER.** It said the two forms differ on 118 ticks because an unconditional
  cap would pull the integrator toward a command the SATURATION freeze is
  pinning. That 118 was measured against a *different* pair — a band applied
  after quantisation, at the very end of `compute()` — and the saturation story
  does not apply to the placement actually being compared, which sits before
  the freeze. The figures above are the ones that were measured on the pair the
  sentence names.

  ⚠️ **AND THE SATURATION STORY IS NOT MERELY INAPPLICABLE — IT IS BACKWARDS.
  THE NARROW CAP THAT SHIPPED *DOES* MOVE A SATURATION-FROZEN INTEGRATOR.** It
  sits before the freeze block and is not gated on `frozen`. Measured on the
  same 16 days at the live shape: of **79 160** frozen ticks the cap changed
  `i_w` on **1095**, and on **679** of those it moved it further out on the side
  it was already on — putting back magnitude the freeze had just let fall, which
  is the one direction the freeze's rule ("may fall, never rise") exists to
  forbid. Worst case **2424 W**, at
  `prev_w −3400 W, grid +4697 W, actual −4144 W, sat_count 2 → 3`: the freeze
  leaves the integrator at **−176 W**, the slew binds, and the cap drags it to
  **−2600 W**. It never overrides a *same-cycle* refusal — the freeze clipped
  `moved` on 75 512 ticks and the slew bound on none of them — but the claim
  that this placement leaves the frozen path alone is false, and §5 is where
  that shows up in a committed number.
* **It is written one-sided, and that is a CLARITY choice, not a correctness
  one.** ⚠️ **An earlier draft of this file and of the comment in `control.py`
  said the two-sided band `max(slewed - cap, min(slewed + cap, i_w))` was a bug
  that would drag a TRAILING integrator up toward the command. That was
  invented, and the sweep said so: the two spellings agree on 205 920 of
  205 920 cases** across four tunings, every sign of `prev_w`, `grid_w`,
  `actual_w` and `i_w`, and the `i_w=None` path. `target` is monotone in `i_w`,
  so when the slew binds `i_w` lies on the same side of `slewed` as `target`
  does and the other clamp cannot reach. The one-sided form stays because it
  NAMES the side the lead is on; the equivalence is recorded so the next reader
  finds a measurement instead of an argument.
* **It moves `i_w` and not `target`.** This cycle's command is already decided;
  what is bounded is what gets CARRIED. That is also why the exhaustive
  `i_w=None` equivalence sweep in `test_control.py` is untouched — it compares
  `(target_w, sat_count, frozen, reason)`, none of which this moves.
* **The cap is in STEPS, not watts**, for SAFETY-39's reason: a watt figure is a
  constant that outlives the `slew_w` it was derived against. `SLEW_LEAD_STEPS`
  moves with `slew_limit_w()` and therefore with the rail.

⚠️ **ONE STEP, AND NOT ZERO.** `i_w = slewed` is full back-calculation, and
`control.py`'s own docstring says what that costs: passing `i_w=None` *"reduces
this function to the exact velocity form it replaced"*. A zero cap makes `i_w`
identically the command on every cycle, which is that collapse written from the
other end. Measured, it is **better** — export 32.02 kWh against 34.07, mean
quarter −3.69 W against −2.39 — and it is still refused, because it throws away
the reason the accumulator was split out at all. That 2 kWh is the price of
keeping the bounded form, and it is stated rather than hidden.

⚠️ **TWO LEADS, AND CONFUSING THEM IS HOW A CHECK GETS WRITTEN WRONG.** The cap
bounds `i_w − target`, the command this cycle EMITS, at one step — which is what
makes the unwind one cycle. `Decision.i_w − prev_w`, which is what TEL-10's
`loop_lead` publishes, is measured against the command the PREVIOUS cycle left
standing, and the emitted command is itself one step further on: the published
figure is bounded by **two** steps. Both bounds are asserted, each against its
own number.

### The two recorded deadlocks, driven rather than argued

`control.py` names two encodings that produce a permanently stuck loop, and a
gate written on the integrator is exactly the edit that brings them back.
Neither is reachable here and both are test cases in `test_telemetry.py` part 4:

* **the shrink-only encoding** — *"only corrections that shrink |i_w|"* is
  unsatisfiable for both signs whenever the correction is larger than twice the
  integrator, and the loop then sits at its last value forever (measured before
  the fix: 0 W held indefinitely into a 2 kW import). SAFETY-48 is not a shrink
  rule; it caps the lead beyond one slew step and only while the slew binds.
* **`i_w == 0.0`** — `main.py` resets the integrator to exactly 0.0 on every
  stop and every reseed, and *"may not wind further in the direction it is
  already pushing"* has no referent there. SAFETY-48 does not touch that gate;
  the first push from zero is driven and asserted to move.

And a third, specific to this card: **the cap cannot latch.** The flag is not
carried, and after the cap `|i_w − slewed| = cap`, so the next cycle's command
covers it in one step and the slew stops binding — after which the integrator
accumulates freely again. The driven check asserts the command still walks all
the way to the rail on a railed export.

## 5. What this card COSTS, stated rather than smoothed

**SAFETY-13's release buys back less.** That card's own scenario — a second
writer holding the pack at +700 W, the command pinned, then released — settles
at **−800 W** where release/1.0 settled at −1190 W against an integrator of
−1194 W; and its sibling run settles at **−1200 W** where release/1.0 settled at
−2390 W. The property AC 4 asserts is unchanged: the released command stops at
the frozen integrator and not at the rail.

⚠️ **AND THE TWO MOVED FOR TWO DIFFERENT REASONS, WHICH THE ONE-LINE EXPLANATION
"how far that integrator had been allowed to wind" COVERS ONLY HALF OF.** Gating
the cap on `not frozen` — one line, `if frozen: _lead_cap = float("inf")`, so
the cap becomes a no-op while frozen — puts **part 5 back at release/1.0's
−1190 W exactly**. That run moved because the cap **fires on frozen cycles**
(§4). **Part 4(b) does not come back**: it is −1200 W gated and −1200 W shipped,
against release/1.0's −2390 W, because *that* one moved for the winding reason.
Both literals in `test_control.py` were re-baselined **with the reason beside
them**, and the second is now asserted against `i_w` rather than against a
number.

**The alternative that avoids it was measured and rejected.** Gating the cap on
`not frozen` as above gives export **34.71 kWh** (against 34.07), worst quarter
**3434 W** (the same as shipped), wasted **3.49 kWh** (against 3.19) — and a
worst observed lead of **4961 W**, i.e. no bound at all on the quantity this
card exists to bound. A bound with an exception large enough to drive a truck
through is not a bound. ⚠️ These four figures replace an earlier set (34.9,
3461 W, 3.5 kWh, 4966 W) that does not reproduce on this tree with the gate
spelled as above; the gate spelling is written out here so the next reader can
re-run it rather than re-derive it.

**One quarter-hour in 1534 is 532 W worse.** The billed figure is a MAXIMUM, and
at the fitted plant lag the maximum improves (3739 → 3434 W); no quarter under
SAFETY-48 reaches release/1.0's own worst. The mean moves the right way. The
tail is reported because a maximum over 1534 quarters is decided by one of them
— and §3a is the reason that improvement is not claimed as a benefit of the
card: at every shorter plant lag release/1.0's own maximum is already 3434 W.

## 6. The independent confirmation, which arrived as a failing check

`test_control.py`'s SAFETY-39 section drives a family of 51 synthetic export
steps through a **first-order plant this file writes itself** — no relation to
the replay, no recorded data in it at all. It carried this assertion:

> ⚠️ THE SLEW DOES NOT OWN THE OVER-ABSORPTION … Quartering the slew from 1000
> to 250 does not reduce the over-absorption at all

and it was right about the mechanism and therefore wrong about the conclusion:
`slew_w` bounds the OUTPUT while the integrator accumulates `gain · error`, so a
slower slew left the integrator winding for longer. Worst case over the family:

| `slew_w` | release/1.0 | this branch |
|---|---:|---:|
| 1000 | 1005 W | **729 W** |
| 0 (the rail, 556) | 1109 W | **550 W** |
| 400 (the live interim) | 1285 W | **424 W** |
| 250 | 1330 W | **326 W** |

**The ranking inverts.** Before: slower is worse, monotonically. After: slower is
better, monotonically. Two plant models that share nothing agree on the sign,
which is worth more than either alone — and it means SAFETY-39's *"gain is the
next constant to re-derive"* is now only half true: with the lead bounded, the
slew owns a share of the over-absorption it did not own before. `gain` is still
not touched here, for SAFETY-39's own reason: two live control-law constants
moving in one release makes the next measurement uninterpretable.

⚠️ **AND THE RIG SAYS THE SAME THING, WHICH MEANS TWO COMMITTED TRANSCRIPTS
CHANGED MEANING UNDER THIS CARD.** `tools/slew_sim.py --slew` runs the same
derivation on admin/goodwe's `plantsim.Plant`, a third model again. Worst-case
over-absorption over its 51-step family, `slew_w` from 1000 down to 250:

| `slew_w` | 1000 | 800 | 700 | 600 | 556 | 500 | 400 | 300 | 250 |
|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|
| release/1.0 | 958 | 1107 | 1133 | 1058 | 987 | 1029 | 1150 | 1143 | 1081 |
| **this branch** | 777 | 734 | 663 | 563 | 553 | 507 | 435 | 358 | 321 |

release/1.0's row is flat and non-monotone and **800 really is better than 556**
on that column — SAFETY-39 measured it correctly and its §3 sentence is true of
the law it was written against. This branch's row falls monotonically. So
SAFETY-39's record is not retracted; it is given a **forward reference**, and
`slew_sim.py`'s own narration now reads `SLEW_LEAD_STEPS` out of the control law
it imported and says which of the two tables it is printing. MUTATION.md habit 8
— a committed transcript is a check, and a transcript whose prose contradicts
its own table is a failing one.

## 7. Verified by breaking it

**The law.** `test_telemetry.py` part 4 and `test_control.py`'s SAFETY-39
section. The mutation table is in `test_telemetry.py`'s header.

**The instrument** (MUTATION.md habit 8 — anything under `tools/` that a
document quotes is subject to the battery):

| # | mutation to `app/control.py` | what the instrument did |
|---|---|---|
| I2 | the whole SAFETY-48 block deleted | **REFUSED**, exit 1, `NOTHING HAS BEEN MEASURED` — not a zero delta |
| I3 | the anchor line itself edited | **REFUSED**, same message |
| I3b | `SLEW_LEAD_STEPS = 1000` — the cap present but inert | **every row +0.00**, which is the honest report that the block is doing nothing |
| I4 | `SLEW_LEAD_STEPS = 0` — full back-calculation | every row moves further; this is the rejected form's number in §4 |

I3b is the one that matters: it proves the delta in §3 is caused by the block
and not by the two runs differing for some other reason.

**The law**, driven in the CI image on a purged tree, fingerprinted before,
after and after the revert:

| # | mutation to `app/control.py` | bytes | reds |
|---|---|---:|---|
| L1 | the whole SAFETY-48 block deleted | −195 B | 5 in `test_telemetry.py`, 4 in `test_control.py` |
| L2 | `SLEW_LEAD_STEPS = 0` — the velocity form | +0 B | 4 + 3 |
| L3 | `SLEW_LEAD_STEPS = 12` — a cap above the rail | +1 B | 4 + 3 |
| L4 | the cap applied unconditionally, outside the slew branch | −92 B | 1 + 0 — **and it was a SURVIVOR of all thirty files before that check existed** |
| L5a | the `min`/`max` FUNCTION names exchanged | +0 B | 5 + 5, one of them `test_control.py`'s own "frozen integrator never deadlocks" over 13 041 states |
| L5b | the two BRANCH BODIES exchanged — the other reading of "the cap on the wrong side" | +0 B | 5 + 4, and it does **not** reach the deadlock sweep |
| L6 | the lead measured against `prev_w` rather than the command emitted | +0 B | 6 + 3 |

⚠️ **L5 AND L6 ARE BOTH ZERO BYTES** — `min`/`max` and `slewed`/`prev_w` are
each the same length — so no fingerprint and no byte delta can see either, and
one of L5a's reds is `test_control.py`'s own *"frozen integrator never
deadlocks"* sweep over 13 041 states, written by SAFETY-13 for a different
reason.

⚠️ **THREE OF THESE COUNTS WERE WRONG AND ARE RE-MEASURED ABOVE, WHICH IS
MUTATION.md's REPORTING RULE 3 APPLIED TO THIS CARD'S OWN TABLE.** The earlier
row gave L5 as 2 + 5 and L6 as 4 + 3; driven again in the CI image on a `cp -a`
of this tree, purged, `:ro`, one file at a time, they are **5 + 5** and
**6 + 3**. ⚠️ **AND "L5" NAMED TWO DIFFERENT MUTATIONS.** "`min`/`max` swapped"
can mean the function names exchanged or the branch bodies exchanged; they are
both red, they are both the cap on the wrong side, and they give different
counts (5 + 5 against 5 + 4) and reach different checks. A row that writes one
number for a mutation a reader cannot re-derive from its own description is a
row that cannot be re-run, so both spellings are listed. The directions in the
original table were all correct; the counts were decoration, and decoration in
a mutation table reads as evidence.

## 7b. The transcript, quoted rather than summarised

`python3 tools/replay_recorded_loop.py --sensitivity`, on this branch, 58 s:

```
THE RECORDING: 256252 meter instants over 16.00 days, loop-2026-09-02_2026-09-17
    tick   p5 4.77 s   median 5.01 s   p95 7.86 s   (control.LOOP_TICK_S says 2.0)
    the recorded command: extremes -5000 / +5000 W  ->  max_w 5000;  most common step above 100 W is 400 W, 9924 times  ->  slew_w 400
    the fitted inverter: lag 7.5 s, tau 2.0 s, batt = 0.9731 x cmd -22.4 W, residual 375 W RMS above the SoC floor

FIDELITY - the BEFORE law replayed against the recording it came from
    setpoint  r=0.887  mean     +601 W simulated vs     +739 W recorded
    grid      r=0.682  mean     +195 W simulated vs     +239 W recorded
    export       39.61 kWh simulated vs    29.43 kWh recorded  ->  the model is +35 % PESSIMISTIC about the loop's tracking

THE A/B, same ticks, same disturbance, same plant, same seed
                                 release/1.0     SAFETY-48       delta
    export kWh                         39.61         34.07       -5.54   the cost
    import kWh                        116.07        111.20       -4.86
    battery sign reversals           2992.00       2770.00     -222.00
    wasted throughput kWh               4.67          3.19       -1.48
    worst 15-min offtake W           3738.67       3433.94     -304.74   ⚠️ THE BILLED ONE
    recovery events                   549.00        612.00      +63.00
    recovery median s                 232.06        199.04      -33.01
    recovery p99 s                    849.00        849.94       +0.94
    recovery max s                    901.06        898.40       -2.66
    unrecovered (>900 s)               53.00         31.00      -22.00
    |i_w - prev_w| p99 W             3361.12        800.00    -2561.12
    |i_w - prev_w| max W             9200.00        800.00    -8400.00
    slew-limited ticks              16392.00      11654.00    -4738.00
    mean quarter delta W                                         -2.39   over 1534 quarters
    worst quarter delta W                                      +532.27

SENSITIVITY - the ranking, not the watts
      variant                               export kWh           worst quarter W   mean quarter dW
      plant lag 5.0 s                32.1 ->     27.2         3434 ->     3434             -1.02
      plant lag 10.0 s               75.4 ->     68.3         3954 ->     3434             -4.65
      plant tau 8 s                  56.5 ->     49.8         3995 ->     3605             -3.30
      gain 1.0135, offset -26        46.8 ->     39.3         3713 ->     3434             -3.27
      slew_w 555.6 (the rail)        36.5 ->     34.4         3434 ->     3434             -0.17
      gain 0.3                       28.1 ->     27.0         3434 ->     3434             +0.16

    (58 s)
```

⚠️ **`--sensitivity` IS THE RANKING AND NOT THE WATTS.** The export figure moves
by a factor of two across these plants; what does not move is the direction —
**on export**. ⚠️ **THE `worst quarter W` COLUMN IS NOT THE SAME KIND OF
EVIDENCE AND THIS PARAGRAPH USED TO TREAT IT AS IF IT WERE.** Three of its six
rows read `3434 -> 3434`, and that is not "the direction holds": it is
release/1.0 *already sitting at 3434 W* on those plants, with nothing for the
card to improve. §3a sweeps the lag properly and finds the same thing at every
lag ≤ 5.0 s. The billed-quarter improvement in the A/B table above exists at one
plant, the one `fit_plant()` selects by an objective that separates it from its
neighbour by 0.3 %.

Two rows deserve naming rather than rounding: at `slew_w: 555.6` (the rail) and
at `gain: 0.3` the mean quarter-hour delta is −0.17 W and **+0.16 W** — ties,
not improvements. Both are regimes where `|error| > slew_w / gain` is rarely
satisfied (1333 W at `gain: 0.3`, 926 W at the rail against a measured median
onset error of 1114 W), so there is little for the card to bite on. That is the
mechanism agreeing with itself, and it is also the honest answer to "would this
still be worth shipping if the tuning moved": at `gain: 0.3` it would not be.

## 8. What this card does NOT establish

* **Nothing here drives an inverter.** The replay is a model with a 375 W
  residual and no arbiter in it. The closed-loop answer comes from the rig or
  from a live run — SAFETY-47 records why a shadow run cannot give it.
* **The live tick is 5.0 s, not `LOOP_TICK_S`'s 2.0 s**, measured off 9924
  recorded 400 W steps and off the meter's own cadence. It is wrong in the SAFE
  direction (a slower meter makes `validate.py` rule 10 conservative) and is NOT
  changed here — re-deriving `SLEW_RAIL_FRAC` is a refusal boundary on a live
  install and belongs to its own card. It is recorded in the tool's header and
  printed on every run.
* **The brief's plant figure was close but not exact.** It quoted
  `delivered = 1.0135 × command − 26 W, r = 0.992` at a 4–6 s publish lag. On
  this 16-day window, above the SoC floor, the same relation measures
  `1.00 × command − 28 W, r = 0.977` at a best-fit pure delay of **7.5 s**. The
  conclusion — the inverter is a pure follower and the plant is not the problem
  — survives; the coefficients are the ones in §2.
* **The brief's cost figure is larger than this measurement.** It quoted ~14 kWh
  of avoidable export and 65 % of site export inside 7.9 % of the time. Measured
  here: **5.5 kWh** avoidable of 39.6 kWh modelled (29.4 kWh recorded), with
  42 % of export inside the 6.3 % of ticks that are slew-limited and 69 % within
  ±60 s of one, over 15.3 % of the time. The concentration claim holds; the
  avoidable-kWh figure does not, and the difference is not reconcilable from
  here because the reconstruction it came from was discarded.