goodwe-addon/goodwe_controller/DECISIONS/SAFETY-107-refusal-under-another-writer.md

SAFETY-107 - a refusal held under another writer is learned once

Status: for review. Tests: test_safety107.py. One inverter only; nothing changes at N>1 (SAFETY-73's unit refusal has no "another writer" end).

The defect (MAINT-13 F5, MAINT-14 "seen again"). A full pack under a maintenance charge in a cheap window takes no charge. At N=1 the action log then showed "BATTERY REFUSES asked -2500 W ..." and "BATTERY REFUSES ENDED: another writer" every cycle: 548 + 548 lines in 15 min on the MAINT-13 rig head, 652 + 651 in 12 min on its base, 33 + 32 in 60 s in MAINT-14's c2b. The 40-line log flooded and the hint under the buttons changed every second, so the MAINT-13 notice was gone at once.

Cause (main.py, the SAFETY-52 block before compute()). The end tested self.target != self.loop_w: the wire differs from the loop's ask. A held refusal makes the loop ask 0 W, so any claim that binds (the maintenance charge's hi, the peak guard's lo, a trade's SET) differs from it on every cycle. The refusal was ended against the same writer it had been learned against. sat_count is not reset by that end, so compute() learned the same refusal again in the same cycle. Nothing about the battery or the wire had changed; only the log and the hint did.

Other writers. The same flap comes from any writer that holds the wire while the loop is refused, as long as the evidence lasts: a trade (a SET at P_ARBITRAGE) into a full pack, and the peak guard over an empty pack: 335 refusal lines in 15 min each at a 5 s meter (test_safety107.py part 2, run on release/1.0). A maintenance drain or hold does not flap: its SET resets sat_count each cycle.

The rule (_refusal_update(), rejudged). When another writer held the wire, the held refusal is judged afresh: compute() gets refused=0 and no probe, exactly as before the change. Then:

1. it finds the same refusal against that writer's ask: the same episode continues, with no line and no hint. The probe clock restarts, as it did on the old end and start: a probe is the loop's ask, and it is not on the wire while another writer is;
2. it does not: the refusal ends, logged "another writer", or "the battery gives power" when the reading shows it (it was "another writer" before);
3. it finds the other direction: end, then a new start, as before. In practice 2 comes first: SAFETY-94's evidence restarts when the ask changes sign, so a writer that turns round ends the refusal at once and the other way is learned ~12 cycles later (test_safety107.py part 3e).

Why this rule. The end now means what SAFETY-52 meant by it: the refusal no longer describes what is on the wire, judged by the same test that learns it. compute() sees the same inputs as before and the state after each cycle is the same (batt_refused, batt_refused_at), so every command is unchanged. Keeping the held refusal into compute() instead (mutation M5) would also stop the lines, but it holds the loop at 0 W where the old law let it ask past a writer's limit, which changes commands; it also removes SAFETY-52's owner-decided "another writer" exit.

Evidence.

• Differential trace (goodwe/scratch/SAFETY-107/probe/trace.py, not in this repo; the real Controller in the CI image, release/1.0 bf3ac79 against this tree): 300 seeds, N=1 (153) and N=2 (147), 1/2/5 s meter, full/empty/dead/healthy battery windows, a stepping house, maintenance charge with the cheap window opening and closing, P1 and the peak guard, trade windows, stop/start; 427 680 cycles, 294 seeds with a refusal held. Every command, site target, integrator, sat_count, refusal state and reason is identical. Refusal lines: 100 748 before, 2 188 after.
• The card's case: 1 line in 15 min at N=1 and N=2, 1/2/5 s meter, house importing or exporting (release/1.0: 335-1 753 at N=1; N=2 was already 1).

Mutations (tools/mutation_run.sh on purged copies; reds in test_safety107 / test_refusal / test_refusal_units; trace = seeds of 300 whose commands differ from release/1.0):

	mutation	reds	trace
M1	now == rejudged -> False (every such cycle ends: the old flap)	26 / 0 / 0	0
M2	rejudged always 0 (another writer never ends it)	5 / 1 / 2	29
M3	the probe clock is not restarted on a continued episode	1 / 0 / 0	2
M4	a probe may open while rejudged	0 / 0 / 0	0
M5	the held refusal goes into compute() while rejudged	2 / 1 / 2	27
M6	an end while rejudged always says "another writer"	1 / 0 / 0	0

M4 is equivalent: a probe matters only if compute() engages in that call, which needs SETTLE_CYCLES saturated against the writer, and each of those cycles restarted the clock. The line stays because it states the rule.

Cost. None in power. A takeover by a different writer while the battery still refuses is logged as an end and, ~12 cycles later, a new start against that writer (3 lines for the episode, test_safety107.py part 3a).

Not covered.

• A perfectly flat reading under a writer. The stale-reading gate trips, stops the site and seeds the refusal (SAFETY-52 decision 3). After the stop the writer's ask returns fresh, compute() has no saturation history against it, so the refusal ends at the first cycle and the next trip seeds it again: 2 lines per gate cycle (29 in 15 min, house exporting), the same as release/1.0. The gate cycle itself (0 W, then the writer's ask) is the cause; stopping it changes commands. None of the rig runs showed it: real readings move.
• At N=1 a refusal shapes only the loop. A writer above it still asks the battery; at N>1 SAFETY-73's P_SAFETY claim binds every writer.