goodwe-addon/goodwe_controller/DECISIONS/SAFETY-94-lagging-battery.md

SAFETY-94 - a battery that lags or reverses is not frozen or refusing

Status: implemented 2026-10-03, for review. Tests: test_safety94.py (rig: tools/safety94_rig.py). Also closes SAFETY-58. SAFETY-74 stays open.

The defects

1. Stale-reading gate (SAFETY-37). Its 35 s ran from the register's last change. After a rest that clock was already past 35 s, so the first read after a new command tripped it, before the register could answer. Live 2026-10-03 (0.14.0, N=2): 17:39:16 B and 17:39:25 A (load ramp after a rest), 19:00:04 A (drain start), 21:21:22 B (drain -> charge). Each was 1 s after its command; each register answered within 11 s. This is SAFETY-58's shape.
2. Refusal at N=1 (SAFETY-52). compute() engaged after SETTLE_CYCLES frozen cycles if the reading was under 100 W at that moment. The frozen cycles include a reversal through the battery's lag. At a 1 s meter the 12th cycle comes as a battery reversing out of a charge passes 0 W (SAFETY-85 rig, O1: "gave -20 W for 13 cycles"). The refusal then held 0 W, the battery settled at 0 W, never gave 100 W, and waited for the 15-minute probe. N>1 already required 22 s in the band, so it was safe at a 10 s lag but not at 20 s.

What changed

• The gate counts only time the register was asked to move (freshness.Freshness._oblige). A read counts the time since the last read when, at that read, the command is 250 W or more and has moved 250 W from where it stood at the register's last change. A register change (or a SAFETY-57 release) restarts the count. A command flapping in and out of the ask still adds up (frozen register, 0/1500 W every 5 s: trip at 69 s). The conjunction, MOVE_W and RELEASE_S are unchanged.
• The bound is unchanged at 35 s and now means what its derivation says. The floor was always "how long a healthy register takes to answer a command": 6 s plant + 10 s publish + 1 s read = 17 s. The band [2 x 17, 0.5 x 75] = [34, 37.5] holds. Live answers measured: 1.4, 3, 6 and 11 s after the command.
• Refusal evidence is the same at every roster size (main.Controller._gave_nothing, SAFETY-73's count moved into a method). The reading must stay under 100 W, one way, while asked over 200 W, for 12 cycles spanning 22 s. At N=1 compute() gets this as gave_nothing and needs it on top of its own freeze test. None (compute alone) keeps the old law.
• The evidence restarts when the reading moves 50 W towards the ask (REFUSED_PROGRESS_W). A refusing battery reads flat (-3/-4 W live). Live readings wander by under 25 W at rest. A first-order lag crossing the band gains 50 W in at most 0.4 tau, so it cannot fill 22 s unless tau > 54 s. This also covers B, whose reading is 100 W below its power.

Bounds and worst-case catch

fault	before	after	budget
register frozen, then asked to move	0-35 s after the ask (often 1 s)	35 s after the ask (+1 read)	SAFETY-37: 35 s, under the 75/85 s consumer holds
register frozen at rest reading ~0 W	stale 1 s after the ask	refused or stale, 0 W within 23-35 s	the same
refusing battery, 1 s meter, N=1	11-16 s	22-28 s	SAFETY-73's 22 s span (+ one 10 s publish)
refusing battery, 2 s meter	22-28 s	22-28 s	unchanged
refusing battery, 5 s meter	N=1 35-41 s, N=2 41-55 s	N=1 40-45 s, N=2 50-55 s	12 cycles = 55-60 s

Rig: test_safety94.py part 3. A release after SAFETY-57 still exposes the held number for one 35 s window of asking, so 35 < 75 < 85 still holds.

Before -> after

• Live replay (part 1): 4 trips -> 0.
• Refusing B (its -100 W idle reading): see SAFETY-97.
• Rig, 10 s lag, N=1 and N=2, 1/2/5 s meters, two register shapes, 48 runs (part 2): before 27 stale trips and 1 refusal, after 0 and 0.
• Reversals, lag 10 and 20 s, 1 s meter (part 2): before N=1 6 stale / 3 refused, N=2 6 / 1; after 0 / 0.
• 16-day loop capture (test_freshness.py part 8): 93 trips -> 59. Trips answered within 20 s: 21 -> 1. Two of the removed trips were not quick: a register held 351 s under a command hovering at the 250 W travel edge (under 35 s of asking before it moved; survivor 2's shape), and a refusing battery the gate had caught only on a passing ramp (SAFETY-52's refusal covers it).

SAFETY-58 and SAFETY-74

• SAFETY-58 is fixed by this change: its card asks for the clock to start with the obligation and for the bound to be re-derived. Both are done above. test_freshness.py survivor 5 is now graded as closed.
• SAFETY-74 is not fixed. A battery capped at 300 W with a perfectly flat reading, 5 s meter, house stepping: 50 trips/h at N=1 and 80 at N=2 before, 37 and 60 after. With +-1 W dither: 0. A flat reading under a command that moved is exactly what the gate is for; telling "limited" from "frozen" needs a second signal (the meter, or SoC).

Known gaps

• B's standby offset (-95 to -118 W at idle) puts a refusing B outside the 100 W band, so a refusing B never latched (review F1: at N=1 new, at N=2 as before). Fixed by SAFETY-97 in the same PR: the band is centred on each unit's learned idle reading. SAFETY-97-idle-offset.md.
• A command that asks only part of the time (a fraction d) is caught after 35 s of asking, which is 35/d s of wall time (0/1500 W every 5 s: 69 s). SAFETY-30's per-unit check restarts when its command stops opposing the held reading, which a lapsing ask normally does, so 35 < 85 holds there. SAFETY-31's circulation check (75 s) ignores the command, so its margin holds only while d >= 0.47.
• A register frozen under a command that stays near the 250 W travel edge is caught late or not at all (survivor 2).