fix(cron): observation time = oldest source that actually contributed a stored field (codex P2)

- getLatestOpen tracks per-field provenance: fromInverter if any realtime field (gen/use/grid/batt/soc/genTotal) was overridden, fromStation if any is still station-sourced; observedAtOf() = min over contributing sources, null if a contributor has no timestamp; a device snapshot that overrides nothing no longer vouches for station values
- 5 tests (110 total)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: THUNDER PHUM

.inbox/deyecloud/codex/review-df3e4c2.md

@@ -0,0 +1,24 @@
+# Review df3e4c2 — HOLD (1 remaining P2)
+
+## P2: Do not replace the bundle timestamp when station fields still contribute
+
+Location: `src/worker/deye.ts:410-418` (especially line 412).
+
+`getInverterFlow()` returns a truthy object for ANY nonempty `dataList`, even when every mapped power/SOC field is undefined. `out.observedAt = inv.observedAt` is unconditional, while the value overrides are conditional. Therefore `observedAt` does not yet describe the values actually stored when measure points are absent/partial/unmapped.
+
+Actual `getLatest` -> `pollAndStore` -> SQLite reproduction at 2026-09-22 17:20 BKK, station reading four days old and `generationPower=123`:
+
+- Device timestamp fresh, `dataList=[{key:'SOC',value:75}]`: `observedAt=now`, `genPower=123` from the stale station, current sample written, `frozen_since` cleared.
+- Device timestamp fresh, only `BatteryRatedCapacity=400`: same stale 123 W written as current despite **no value override at all**.
+- Conversely fresh station, only `BatteryRatedCapacity=400` and absent device timestamp: `observedAt=null`, drops valid station sample although the device contributes none of its values.
+
+Retain station provenance when no mapped field contributes. With partial overrides, freshness must cover every source still contributing persisted realtime fields (e.g. source set / conservative oldest usable timestamp, unknown if a contributing source lacks time), or avoid mixing stale fallback fields. Merely checking that *one* mapped inverter field is present is insufficient; the SOC-only case above still fails.
+
+Please add source-composition regression cases for no mapped override and partial override in both age directions, alongside the complete override tests.
+
+## Verified fixes and controls
+
+- All original full-override reproductions now pass: fresh/missing station + stale inverter rejected; stale station + fresh complete inverter accepted; first-deploy old observation and advancing-but-old replay rejected; millisecond normalization and missing timestamp rejected correctly.
+- Normal freeze/recovery and actual Hono purge authorization, dry-run, inclusive range, cache invalidation and daily preservation still pass.
+- Fresh 105/105 tests (14 files), typecheck, build and diff-check pass.
+- No app source/production changes. Harness extended in `.summary/review-088cb16.cjs`; it runs the actual current main source with fake upstream and in-memory SQLite, no external network.

src/lib/__tests__/freeze.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { isFrozenReading } from "../freeze";
+import { isFrozenReading, observedAtOf } from "../freeze";
 
 const NOW = 1_790_000_000, STALE = 720;
 describe("isFrozenReading — freshness of the value source, independent of monotonicity", () => {
@@ -14,3 +14,16 @@ describe("isFrozenReading — freshness of the value source, independent of mono
     expect(isFrozenReading(0, NOW, STALE).frozen).toBe(true);
   });
 });
+
+describe("observedAtOf — oldest contributing source bounds freshness", () => {
+  const S = 1_790_000_000, D = 1_789_650_000; // station fresh, device 4 days old
+  it("full inverter override → device time only", () => expect(observedAtOf([{ used: false, ts: S }, { used: true, ts: D }])).toBe(D));
+  it("no override (device contributed nothing) → station time only", () => expect(observedAtOf([{ used: true, ts: S }, { used: false, ts: null }])).toBe(S));
+  it("partial override → the OLDER of both (4-day-old device drags a fresh station record to stale)", () => {
+    expect(observedAtOf([{ used: true, ts: S }, { used: true, ts: D }])).toBe(D);
+  });
+  it("a contributing source without a timestamp → unprovable (null)", () => {
+    expect(observedAtOf([{ used: true, ts: S }, { used: true, ts: null }])).toBeNull();
+  });
+  it("nothing contributed → null", () => expect(observedAtOf([{ used: false, ts: S }])).toBeNull());
+});

src/lib/freeze.ts

@@ -16,3 +16,14 @@ export function isFrozenReading(observedAt: number | null, nowS: number, staleS:
   if (age > staleS) return { frozen: true, reason: `reading observed ${Math.round(age / 60)} min ago (${new Date(observedAt * 1000).toISOString()})` };
   return { frozen: false, reason: null };
 }
+
+// Observation time of a record assembled from several sources: the OLDEST
+// contributing source bounds its freshness, and one contributor without a
+// timestamp makes the whole record unprovable (null). Non-contributing sources
+// (a device snapshot that overrode nothing) are ignored.
+export function observedAtOf(contributors: { used: boolean; ts: number | null }[]): number | null {
+  const used = contributors.filter((c) => c.used);
+  if (!used.length) return null;
+  if (used.some((c) => c.ts == null || !Number.isFinite(c.ts) || c.ts <= 0)) return null;
+  return Math.min(...used.map((c) => c.ts as number));
+}

src/worker/deye.ts

@@ -331,6 +331,8 @@ export async function getStationMeta(env: Env): Promise<Station> {
   return picked;
 }
 
+import { observedAtOf } from "../lib/freeze";
+
 // Open API is the only data source.
 export async function getLatest(env: Env, stationId?: string): Promise<Latest> {
   return getLatestOpen(env, stationId);
@@ -407,16 +409,26 @@ async function getLatestOpen(env: Env, stationId?: string): Promise<Latest> {
   // (verified live): battery −=charge/+=discharge, grid +=import/−=export.
   try {
     const inv = await getInverterFlow(env, id);
+    // Each stored realtime field keeps a provenance flag: overridden by the
+    // inverter or left as the station value. The record's observation time is
+    // the OLDEST source that actually contributed a field (lib/freeze.ts) — a
+    // device snapshot that overrides nothing does not vouch for station values.
+    const realtime: (keyof typeof out)[] = ["genPower", "usePower", "gridPower", "battPower", "soc", "genTotal"];
+    let fromInverter = false;
     if (inv) {
-      // the stored power values now come from the inverter → so must the observation time
-      out.observedAt = inv.observedAt;
       if (inv.genPower != null) out.genPower = inv.genPower;
       if (inv.usePower != null) out.usePower = inv.usePower;
       if (inv.gridPower != null) { out.gridPower = inv.gridPower; out.gridStatus = inv.gridPower >= 0 ? "PURCHASE" : "REVERSE"; }
       if (inv.battPower != null) { out.battPower = inv.battPower; out.battStatus = inv.battPower > 20 ? "DISCHARGE" : inv.battPower < -20 ? "CHARGE" : "STATIC"; }
       if (inv.soc != null) { out.soc = inv.soc; out.socKnown = true; }
       if (inv.genTotal != null) out.genTotal = inv.genTotal; // lifetime kWh (not in station API)
+      fromInverter = realtime.some((k) => (inv as any)[k] != null);
     }
+    const fromStation = !inv || realtime.some((k) => (inv as any)[k] == null); // at least one field still station-sourced
+    out.observedAt = observedAtOf([
+      { used: fromStation, ts: toSec(d.lastUpdateTime) },
+      { used: fromInverter, ts: inv ? inv.observedAt : null },
+    ]);
   } catch {}
   return out;
 }