[frahlg]

Problem

The nightly random run on master 83c2b24 failed 8 of 10 seeds. The 27 Oct triage (section 4) traced six of the random judge's verdicts to the judge, not to Core, and asked for one new check:

• R2. A stretch over the fuse took only the windows open at its first sample. An outage or a Core restart that began inside it added nothing. Seeds 207530 (inverter offline at 888.7 s, inside the 884–896 s stretch) and 207539 (ftw:restart 1 s into the 118.7–143.7 s stretch).
• R3. The battery counted as the 2 s lever while its inverter was offline or had no spare power. Seeds 207530, 207539 (inverter offline) and 207534 (already discharging 3 266 of 5 000 W against a 2.87 A overage).
• R4. A car that starts on the charger's own 11 040 W default, before FTW's 0 A order lands, counted as FTW's own raise. Seeds 207532, 207534 and 207537.
• R5. The judge used the instant current. Under the owner rule of 27 Oct, Core lets a phase sit between In and 1.2 × In until its 60 s I² heat passes the line. Seed 207536 (27.84 A on 25 A for 15 s; heat peak 22.4 A).
• R6. The Charge-now grace ran only from the first ftw:charge_now, and an inverter outage also masked an idle car. Seeds 207534, 207536 and 207539. Seed 207533 failed once test(site): the rig expects the room the fuse rating gives #1908 moved roomA to In.
• R7. The floor check read the inverter register, not FTW's order, and used the inverter floor + 0.5 %. Seeds 207534 and 207536 (a register left over from an outage, C1), 207531 and 207532.
• R8. No check that a battery goes back to its own mode after an outage. Per the triage it would have failed 8 of 10 seeds (C1).
• test(site): rig scenarios R1-R5 and judges at the fuse rating (rig stack #1888, #1907, #1908, #1920, #1922) #1888 review. r3 and r5a measured the instant current against the fuse. Once Core works at In, they must allow what the heat model allows.

Change

All of it is in go/test/site.

• R2 (judgeInvariants). A window that opens inside a step's stretch extends the stretch's allowance, Core restarts included. The window must open before the stretch ends and while the stretch is still allowed. A window that opens after the allowance has run out excuses nothing. A window inside FTW's own raise does not extend it or turn it into a step.

• R3. The battery is the lever only if all three hold:

  • its inverter runs (plant running, and no inverter offline or silence window covers the time);
  • its spare power ((5 000 W ± battery W) ÷ 690) covers the stretch's worst overage;
  • for import, it is above the floor the floor check uses (max of the inverter floor and the planner soc_min). At or below that floor it can only charge less.

  Otherwise the lever is the charger, at max(2, command_response_s), plus what is left of any charger outage.

• R4.

  • A car whose draw rises by more than 1 kW, to more than FTW's last order + 690 W, is a step FTW did not take. The charger is the lever, from the draw start plus max(2, command_response_s) + 5 s.
  • A stretch that no window explains is FTW's own, as on test(site): the rig expects the room the fuse rating gives #1908, in either direction (import or export): it fails 3 s after its clock starts.

• Faults. Only a meter fault (meter_late) adds its length to a step's time: it blinds FTW. An inverter outage is a step whose lever is the charger. A charger outage (reconnect) delays the charger lever.

• R5 (heatOver and warm in evaluate_test.go). The judge runs Core's per-phase 60 s I² filter on the plant's currents. A phase between In and 1.2 × In is over only once its heat is over In too. Above 1.2 × In it is over at once. A stretch's clock starts at the first such sample. When the heat delays that start, the step's time runs from there, as Core's cut does.

• test(site): rig scenarios R1-R5 and judges at the fuse rating (rig stack #1888, #1907, #1908, #1920, #1922) #1888 review. judgeR3 and judgeR5a judge their budgets ("over the fuse no longer than the charger's delay + 7 s" and "over the fuse at most 3 s once under it") with the same heatOver. The instant figure is still recorded.

• R6.

  • The judge counts idle seconds with room (6 A or more under In, as test(site): the rig expects the room the fuse rating gives #1908 set it) from the moment the room appears.
  • The allowance is evRestartDwell (35 s) + command + startup + one tick (2 s), plus the 2 s for the meter and tick and the 3 s the fuse budgets also give.
  • The count starts again on each Charge now that changes power or phase (read from plan.json). Seconds while Core is down are masked.
  • A cut does not restart the count. A cut FTW had to make stops the car, and the count only starts once the car stops, so it already gets the full allowance. A cut with room is FTW's doing.
  • Only meter and charger faults excuse the car.

• R7. The floor check counts FTW's own discharge orders below −50 W (status.dispatch) at or below max(inverter floor, planner soc_min). The planner floor is Core's default of 10 % unless the scenario sets it. There is no +0.5 %. The ev-099 tolerance stays until fix(control): one SoC floor for the stale-plan fallback, fuse relief and the hourly import limit #1878 lands.

• R8 (new criterion "no forced battery mode FTW does not dispatch"). Once the inverter and Core are both up, the inverter may hold a forced charge or discharge (EMS mode 2, command 170/187, over 50 W) that FTW does not dispatch for at most 10 s. It is not tolerated: C1 is open (fix(control): resend the default when an excluded driver returns from an outage #1909, fix(drivers): retry the default on the first good poll after an outage #1915), and the check should stay red until they land.

• Re-judging saved runs. TestJudge (FTW_SITE_JUDGE) now also judges the random-<seed> runs a results directory holds, from each run's plan.json.

• Records. result.json gains over_limit_judged (each stretch the clock judged: from, end, clock start, allowed until, step or own), heat_peak_a, car_starts_ftw_did_not_order, charge_now_idle_allowed_s, floor_pct and battery_forced_without_dispatch_s.

Review follow-up (44e74f3)

The review found the first version loosened the judge more than the seeds needed. This commit:

• makes an unexplained stretch FTW's own again (the first version gave it a step's time). That let an FTW discharge push export to 1.31 × In for 6 s, and a warm fuse sit over In for 600 s split by 1 s dips, pass. ownRise is gone, since it no longer decided anything;
• stops a window inside FTW's own raise (for example a PV change) from turning it into a step;
• stops cuts from restarting the Charge now count, so FTW hunting 6 A / 0 A with room no longer hides an idle car. The restart on Core's return was dead code (the down mask already reset the count) and is gone;
• gives R3 the same floor as R7;
• limits the extra outage time to meter faults;
• adds R8.

Second review follow-up (daad277)

The second review found that the R2 growth step chained on events that raised nothing. A car held at 1.25 × In for 278 s with no cut passed, where #1908 failed it. This commit:

• lets a plain house event (no fault) extend a step's stretch only if the worst phase rose 0.5 A or more within 3 s of it. Load events that change nothing and the inverter's own online no longer extend it. Core restarts, meter faults, outages and car starts extend as before;
• treats the inverter as back at the end of its outage. Before, the outage window's end was inclusive, so the online instant still had the charger as its lever; now the battery answers in 2 s from there;
• makes an FTW car raise sent after a window's 2 s meter delay, and before the stretch begins, FTW's own: that window no longer explains the stretch. This covers a raise after an unrelated step and a raise within 60 s of a Core restart;
• keeps a stretch open across dips under In while any phase's 60 s heat is over In, so a warm fuse held 3 s over and 1 s under fails. A window that opens after the allowance, with no over-In second in between, still gives a new step its own time. That holds after a step or after FTW's own raise that was cut in time; without it the merged stretch would fail a later, separate step;
• adds tests that pin the export lever, the heat clock for steps and the 60 s restart window. Each of these survived the reviewer's mutation pass.

Third review follow-up (4985523)

The third review found that the judge still credited FTW's own raises to a step in three ways:

• a car raise sent while a step's import stretch was over the fuse passed as part of the step;
• a house event that changed nothing, opening as FTW's raise landed, took the rise and gave the stretch a fresh lever time. test(site): the rig expects the room the fuse rating gives #1908 failed this shape;
• a battery charge raise after a Core restart or after a step's meter delay was not counted (triage C2). The 60 s restart window then excused up to 60 s over the fuse.

For import, a window no longer explains a stretch if FTW did either of these:

• raised the battery's charge (its order moved more than 100 W toward import) after the window's meter delay and before the stretch;
• raised the car or the battery while the stretch was over the fuse.

The stretch is then FTW's own. Three limits keep this from blaming FTW for the wrong thing:

• A raise sent in a dip under the fuse, while the heat keeps the stretch open, is not counted. The owner rule allows a raise when the next step fits under the line. The reviewer's candidate counted any raise in the stretch, so a later raise in a dip turned an earlier, allowed step into a failure.
• A battery order moved while the inverter is off, or inside an inverter outage, is not counted: it reaches no battery. Without this guard, seeds 207530, 207532 and 207535 flip (the reviewer's finding; 207530 at 889.4 s moved 491 → 2 984 W with the inverter off).
• Export is unchanged: raising the car into export is the right answer.

Fourth review follow-up (652df2c)

The fourth review found two new false fails in 4985523, one older false fail and one older gap:

• While Core is down, or before its first tick, status.dispatch is empty. The judge read that as a 0 W order, so a charge order Core sent again on its return counted as a raise from 0. In the shape of 207539 (a restart inside a stretch), a charging battery made the whole stretch FTW's own.
• A battery move of more than 100 W counted as a raise. Core's closed loop wobbles by more than that: 207539 at 151.7 s goes −4 999, −4 841, −5 000 W while L3 sits at the fuse. One such sample made a step that the battery answered in time FTW's own.
• The car raise check before a stretch (from daad277) also ran on export. A car raise sent after a PV step soaks up export, yet it made a later export stretch FTW's own. That contradicted the design stated above.
• On export, nothing checked FTW pushing its battery toward export. A 0 → −5 kW order after a restart, with 21 A on a 16 A fuse for 42 s, passed under the restart's minute.

This commit, following the reviewer's candidate:

• keeps the last order while status.dispatch is missing, as the inverter does (the reason for R8);
• counts a battery move from 0.5 A a phase (345 W), the same rise raisedAt uses;
• checks the car raise before a stretch only on import;
• on export, makes a stretch FTW's own if the battery order moved 345 W or more toward export after the window's meter delay and before the stretch, or while the stretch was over the fuse. The inverter guard and the dip rule apply as on import.

Owner decisions of 28 Oct 2026 (959cae3)

Fredrik decided two questions this PR left open:

1. A car cut into export is FTW's own. A car cut FTW sends that pushes export over the fuse counts as FTW's own, as a battery move toward export already did. The stretch gets FTW's 3 s, not the step's charger time. The check runs at the same points as the battery's: after the window's 2 s meter delay and before the stretch, or while the stretch is over the fuse. raisedIn became carMovedIn with a direction, so ownRaise checks car and battery the same way on import and export. A car raise into export still passes.
2. The heat caps what events add. Between In and 1.2 × In the I² heat model (tau 60 s) judges an overage; above 1.2 × In it fails at once. So the allowance that events add to a stretch (the R2 growth) stops at the heat budget, however many events come. Once a phase's 60 s heat passes In, Core's cut gets its lever's time (lever + 2 s for the meter and tick + 3 s), and no later event extends the stretch past that. Core restarts and outages are capped too. The cap reuses warm()'s heat. Two limits:
   • The cap applies only to what windows add. The windows open at the stretch's first sample keep their full time.
   • A window that opens after the allowance ran out, with the current under the fuse since, is a new step. Its cap runs from it, so a new step after a dip still gets its own time (TestInvariantsAStepAfterADipGetsItsTime). The judge now sorts the windows by time so it can tell the two apart.

This closes E3: small real rises can no longer chain a stretch's allowance.

Tests

• New unit tests in random_unit_test.go, each built on a seed's or a review case's shape:
  • R2 (207539): a restart 1 s into the stretch passes. Without it, or with a restart after the allowance, the stretch fails.
  • R3 (207534, 207530/207539): with an idle battery the stretch fails at 7 s. A battery already discharging 3 266 W, or an inverter that is not running, gives the charger's 10 s.
  • R4 (207532/207537): a car on the charger's default under a 0 A order is a step. The same draw right after FTW raised the order to 16 A fails as FTW's own.
  • R5 (207536): 27.84 A on 25 A for 15 s passes; 30.1 A fails; 27.84 A held until the heat passes the fuse fails; 25.5 A on a fuse already warm fails.
  • R6: a start after 70 s passes, after 80 s fails; a changed Charge now restarts the count; a cut over the fuse leaves the full allowance; a cut with room, and FTW hunting 6 A / 0 A with room, fail; a Core restart masks its down time; a late meter excuses the car, an inverter outage does not.
  • R7: an FTW order at 5.0 % or at 9 % fails. At 10.5 % it passes. A forced register with no FTW order passes here (R8 judges it).
  • TestInvariantsAStretchWithNoStepIsFTWsOwn: an FTW discharge holding export at 1.31 × In for 6 s, and 25.5 A on 25 A for 600 s with a 1 s dip every 7 s, both fail as own.
  • TestInvariantsAnEventInsideFTWsRaiseLeavesItOwn: FTW's raise to 1.24 × In for 10 s fails with or without a PV event at 51 s.
  • TestInvariantsLeverAndFaults: a step at 8 % SoC gets the charger's time and passes, at 11 % the battery's and fails; a step while the inverter is offline gets the charger's; a 40 s inverter outage no longer covers 15 s over, a 40 s late meter does; a 20 s charger outage delays the charger lever.
  • TestInvariantsNoForcedBatteryWithoutDispatch: a forced register 8 s after the inverter or Core is back passes, 30 s fails; one FTW dispatches passes.
  • TestRecordedRandomFindsSeedRuns.
• Added after the second review:
  • TestInvariantsOnlyARiseExtendsAStretch: a load event that raises L1 at 50 s extends the stretch; load events every 40 s that change nothing do not (fails at 55 s).
  • TestInvariantsTheInverterIsBackAtItsReturn: the online return changes nothing and the outage's 55 s holds; a rise at the return gets the battery's 2 s.
  • TestInvariantsARaiseAfterAStepIsFTWsOwn: a raise 5 s after a PV change, or 15 s after Core is back, fails; a raise 1 s after the PV change, before the meter shows it, is part of the step.
  • TestInvariantsARestartExplainsAMinute: a stretch 50 s after a restart passes, one 65 s after fails as own.
  • TestInvariantsBatteryLeverForExport: for export, a battery charging 4 kW leaves the charger as the lever; one discharging 4 kW, or idle at its floor, answers in 2 s.
  • TestInvariantsAStepAfterADipGetsItsTime: on a warm fuse a second step after a dip gets its own time, after a step or after FTW's own raise; held too long it fails as a step.
  • Extended: R5 adds 27.84 A held 7 s (passes) and 8 s (fails) after the heat passes the fuse; the R2 test adds a restart 0.2 s after the allowance (fails); TestInvariantsAStretchWithNoStepIsFTWsOwn adds 3 s over and 1 s under a warm fuse; TestInvariantsAnEventInsideFTWsRaiseLeavesItOwn adds a load step that adds 1 A inside the raise.
• Added after the third review:
  • TestInvariantsARaiseOverTheFuseIsFTWsOwn: a car raise 0 → 16 A at 1.24 × In after a PV step fails, as does a 6 → 10 A raise at 1.25 × In with a load event that changes nothing as it lands, and a battery charge raise 0 → 3 kW at 1.25 × In after a load step. A car and battery raise in a dip under the fuse, with a step after it, passes. So does a car raise into export over the fuse.
  • TestInvariantsABatteryRaiseAfterARestartIsFTWsOwn: a 0 → 4 kW battery order 5 s after Core is back, with L1 at 1.31 × In for 44 s, fails; the same order while the inverter is off passes.
• Added after the fourth review:
  • TestInvariantsABatteryOrderMovesOnlyWhenFTWMovesIt: a 1 kW order kept, or missing while Core is down and then restored, passes; a 0 W order that comes back as 1 kW after the restart fails. With the battery discharging 4 999 W, a one-sample 158 W wobble passes and a 360 W move fails.
  • TestInvariantsExportIsFTWsOwnOnlyWhenFTWPushedExport: a car raise before an export stretch keeps the step's time. A battery pushed 0 → −5 kW after a restart fails; with the inverter off it passes. A battery moved toward export while the stretch is over the fuse fails; the same move in a dip under the fuse, with a step after it, passes.
  • TestInvariantsARaiseBetweenFuseAndInstantIsOwn: a car raise sent at 1.1 × In is FTW's own (the line is In, not 1.2 × In).
• Changed tests:
  • TestInvariantsTellStepsFromOwnRaises: with no step the stretch is FTW's own, with or without a recorded raise. It uses 31 A, over 1.2 × In.
  • TestInvariantsJudgeAtTheFuse adds cool-fuse cases, which pass under the heat budget.
  • TestJudgeR3AndR5aAllowTheHeatBudget is new: 27 A on a cool fuse passes past the budget, and 30.5 A fails.
• Fail before, pass after (third review). On daad277 the three failing car and battery cases of TestInvariantsARaiseOverTheFuseIsFTWsOwn and the running case of TestInvariantsABatteryRaiseAfterARestartIsFTWsOwn pass where they should fail. On the reviewer's candidate diff the dip case fails. With the inverter guard removed, the inverter-off case fails. The reviewer's E1, E2, E6 and E4 tests, the second review's six and the first review's five all pass on this head. The reviewer's E3 (small real rises chain the allowance) still failed on 652df2c; the owner's heat cap (959cae3) closes it.
• Mutations (third review). The 21 author mutations and the new ones all break at least one test: the import check applied to export, the over-the-fuse terms for car and battery, the inverter-running guard, a 5 kW battery threshold, and the battery-before and car- or battery-inside terms. Two reviewer mutations that survived on daad277, a 3 kW car raise threshold and a 1 s rise window, are now caught.
• Fail before, pass after (second review). On 44e74f3 these fail: unchanged load events, both inverter-return cases, the raise after PV and after a restart, and 3 s over / 1 s under. The reviewer's six edge tests and the first reviewer's five pass on this head. On the reviewer's candidate diff (plain F3' and inclusive end), TestInvariantsAStepAfterADipGetsItsTime and the rise-at-return case fail, which is why this commit differs from it.
• Fail before, pass after (first review). On the first version's judge (66e1caf) the review cases fail: hunting cuts and the cut with room (Charge now), export and dips (own), the PV event, 8 % SoC and the 40 s inverter outage (lever and faults), and three R8 cases (no criterion). Earlier, every R2–R7 test failed at base on the case it targets.
• Mutations (second review). All 21 mutations break at least one test: the export lever, the heat clock for steps, the restart window at 120 s, plain events never or always extending, a 2 A rise threshold, the raise check off or without its meter delay, the inclusive outage end, no stretch across dips, windows only before the allowance, own stretches never or always growing, growth keeping own, the held-sample rule, the floor and running terms of the lever, car starts ignoring the order, the meter-only extra time, a 6 s own budget and the charger outage delay.
• Mutations (first review). Each of these breaks at least one test: the inverter term and the floor in the lever, the charger outage term, the meter-only extra time, own stretches growing, unexplained stretches as steps, the down mask, the car-start windows, the spare check, and R8's dispatch, inverter and Core masks.
• Fail before, pass after (fourth review). On 4985523 these fail: the restored order and the 158 W wobble, the car raise before export, the battery export push after a restart and the battery moved toward export over the fuse. The reviewer's five edge tests, the third review's E1, E2, E4 and E6, the second review's six and the first review's five all pass on 652df2c; E3 still failed there (closed in 959cae3).
• Mutations (fourth review). Each of these breaks at least one test: a missing order read as 0 again, a 100 W or 400 W threshold, no export check, the car check on export again, no before or no in-stretch term on export, the in-stretch term without its over-the-fuse gate, and no inverter guard.
• Added for the owner decisions of 28 Oct (959cae3):
  • TestInvariantsHeatCapsWhatEventsAdd (E3's shape): 20 A (1.25 × In) on a 16 A fuse after a load step, then a load event every 8 s, each raising L1 0.5 A from a 1 s dip. L1's heat passes In at 62 s, so the cap is 72 s with the 5 s charger. Events that end at 55 s, or at 72 s, pass. Events to 76 s, or chained for 280 s, fail. A Core restart inside the step's time passes a stretch to 55 s and fails one to 74 s, past the heat's cap.
  • TestInvariantsACarCutIntoExportIsFTWsOwn: on a 16 A fuse after a PV step, with the 40 s charger as the lever, a car cut 16 → 0 A while export is over the fuse fails. A cut 16 → 6 A after the meter shows the step and before the stretch fails too. With no cut, with the cut sent before the meter could show the step, or with a raise 6 → 16 A, it passes.
• Fail before, pass after (959cae3). On 652df2c, the events to 76 s, the 280 s chain and the restart past the cap pass, and so do both cut cases. All four should fail. Every earlier test passes on 959cae3.
• Mutations (959cae3). Without the new cap for a window after the allowance, TestInvariantsAStepAfterADipGetsItsTime fails. A cap at the heat crossing itself, with no lever time, fails four earlier tests, among them TestInvariantsOnlyARiseExtendsAStretch.
• go test -race -count=1 ./test/site/... passes, go vet and gofmt are clean, and make verify passes on 652df2c ("vet + test + build clean"; Docker steps skipped). The repo-hygiene scripts (planning docs, telemetry reads at 134 with none added, and both script unit tests) pass against master 7840c33.

The 10 nightly seeds judged again (FTW_SITE_JUDGE on a copy of the 83c2b24 results)

Seed	Base (#1908)	This PR	What fails, and why
207530	fail: outside step (884–896 s)	known	floor (tolerated): FTW's discharge orders at 7.8–10 %: C7
207531	known (floor)	known	floor: orders at 5.0 % for 122 s: C7
207532	fail: own raise 32.7–40.7 s	fail	over the limit: L2 at 21 A on 16 A, 890.7–924.7 s, 4.6 s past the inverter outage's charger time. The car resumed under FTW's standing 10 A offer while L2 carried 11.1 A: C4. Forced battery 145 s: C1. Floor (tolerated): C7
207533	fail: Charge now 38 s	fail	forced battery 236 s (from 653.7 s): C1
207534	fail: outside step, Charge now	fail	Charge now: on the 1p Charge now FTW orders 0 A fuse_limit with 6–10 A of room: C6. Forced battery 163 s: C1. Floor (tolerated): C7
207535	pass	fail	forced battery 234 s (charge, from 579.5 s): C1
207536	fail: outside step, Charge now	fail	Charge now on the 1p Charge now: C6. Forced battery 272 s: C1. Floor (tolerated): C7
207537	fail: own raise, Charge now, stale meter	fail	Charge now after the restart: C6. Stale meter: an EV raise at 107.2 s: C5. Forced battery 266 s: C1
207538	pass	fail	forced battery 230 s, from when the inverter came back (161.4 s on the plant clock): C1
207539	fail: outside step, Home use, Charge now	fail	Home use estimated for 253 s after the inverter outage (D1). Forced battery 76 s: C1

Times are seconds from the run's start mark. The second review's fixes change no verdict here. Two allowances shrink: 207535's stretch (994.5–1027.5 s) is now allowed until 1074.5 s instead of 1091.6 s, since the inverter's online at 1026.6 s raised nothing; 207539's (118.7–143.7 s) until 179.7 s instead of 187.6 s, since the load drop at 151.9 s raised nothing. No seed has a stretch that runs on across a dip. The third and fourth reviews' fixes change no verdict and no allowance on any seed. Nor do the owner decisions of 28 Oct (959cae3): every seed's metrics are identical to 652df2c's, here and on #1922's merged head. Every remaining failure maps to a Core or driver item: C1 (8 seeds, #1909/#1915), C4 (207532), C5 (207537), C6 (207534, 207536, 207537), D1 (207539), and the tolerated C7. The review fixes did not change any limit, Charge now or floor verdict except 207532, where the inverter outage no longer adds its 52.7 s.

What the judge still cannot see:

• An FTW raise sent before a step that lands inside the step's charger time (207535 at 1016–1022 s, C4) passes, since the stretch started with the step.
• On export, a car raise does not make a stretch FTW's own, by design: raising the car is the answer there.
• Until a phase's heat passes In, events can still chain a stretch over 1.2 × In. The stretch is short then: at 1.25 × In from half load, the heat passes In in about 50 s.
• A car whose 1p Charge now stalls (C6) for less than the allowance passes. FTW hunting 10 s on and 60 s off with room passes too: the check limits each idle run, not the share of time the car charges.
• A car that ramps up in 690 W steps on the charger's default is judged FTW's own, since a car start needs a jump of more than 1 kW in one sample. This can only fail too often, never pass wrongly.

Risk

Low. Only tests change, and the PR carries no-changeset. The nightly random run turns red on C1 for most seeds until #1909 and #1915 land; that is the point of R8.

What loosens:

• A stretch between In and 1.2 × In passes until the heat passes In (owner rule).
• A window that opens inside a step's stretch extends its allowance.
• The charger is the lever when the battery cannot answer.
• A car starting above FTW's order is a step.

What tightens:

• A plain house event extends a stretch only if the current rose; FTW's raise after a step or a restart is its own; a warm fuse split by dips is one stretch.
• On import, a car or battery raise sent while the stretch is over the fuse, or a battery charge raise after a step's meter delay or a restart, makes the stretch FTW's own. On export, a battery move toward export at the same points does.
• The Charge now allowance is shorter, at about 47–112 s instead of 100–170 s.
• Inverter faults no longer excuse an idle car, and inverter or charger outages no longer add their length to a step's time.
• The floor is the planner's 10 %, with no +0.5 % (tolerated as ev-099 until fix(control): one SoC floor for the stale-plan fallback, fuse relief and the hourly import limit #1878).
• R8 is new.
• A car cut into export over the fuse is FTW's own (owner, 28 Oct).
• What events add to a stretch stops once the heat passes In, plus Core's lever time (owner, 28 Oct).

Stack and merge order

master ← #1888 (w0-4-rig-scenarios-r1-r5) ← #1907 (e1-rig-judges-at-fuse) ← #1908 (e2-rig-room-at-fuse) ← this PR. Merge it after #1908.

Open PRs on the same files:

• test(site): rig runs Energyplan in passive arbitrage on pinned prices #1875 (W0-3) edits go/test/site/README.md (other rows), scenarios_test.go and stack_test.go. This PR touches only two README lines, nowhere near its hunks.
• test(site): R8 counts a forced battery from when Core has the inverter back #1922 (rig-r8-forced-mode-after-return) is stacked on this PR; 959cae3 is merged into it (55286e3, no conflicts; its tests pass and the 10 seeds judge as before).
• fix(control): resend the default when an excluded driver returns from an outage #1909 and fix(drivers): retry the default on the first good poll after an outage #1915 fix C1, which R8 checks. Once they land, the R8 failures should clear with no change here.

No other open PR touches these files.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T18:51:42.369140Z	66e1caf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66e1caf50f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Stop the overload clock when the heat budget covers the current again

If a brief spike above 1.2 × the fuse is followed by a thermally permitted current still above the fuse, clock remains latched and the entire remaining stretch counts as an overload. For example, on a cool 25 A fuse, one second at 31 A followed by 29 seconds at 26 A keeps heat below 19 A, but this judge fails the outside-step criterion after its allowance expires, even though heatOver was true for only one second. End or split the judged interval when heatOver becomes false, as heatRunsOver already does, rather than waiting for instantaneous current to fall below the fuse.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Integrate the previous sample's current into fuse heat

At a current change, this calculation applies the new reading retroactively to the preceding interval. Core's fuseHeat.step in go/internal/control/fuse_heat.go instead integrates its stored previous currents before accepting the new reading. Consequently, the new judge advances heating and cooling transitions by a sample and can change boundary verdicts: starting at 25 A heat, four one-second samples at 25.1 A followed by 24 A produce a four-second judged overload here, whereas Core's model produces three seconds, flipping R5a's three-second criterion. Use the previous sample's phase current for the elapsed interval so the promised Core-equivalent filter has the same timing.

Useful? React with 👍 / 👎.