fix(gateway): send each hub command once and wait for its ack

[mgazza]

Problem

PredBat's generic write_and_poll_* loop checks the read-back every 2 s and, until it matches, calls the gateway's select_event / number_event / switch_event again, up to 10 times. GatewayMQTT published the command on every call. When the inverter's dongle takes several seconds to accept a Modbus write, each re-send queues another full write on the hub. The first write usually lands, but only after PredBat's ~20 s window. By then PredBat has already logged Inverter 0 write to <x> failed, and the hub is still working through the duplicates.

The hub already publishes an ack for every command on predbat/devices/<id>/ack/<command_id>, with ok, the refusal reason, and the values it applied. PredBat never subscribed to it, so it could not tell "slow but succeeding" from "refused".

Solution (gateway component only; the shared inverter.py loop is unchanged)

• Subscribe to predbat/devices/<id>/ack/+ alongside status and online.
• Track control writes (slot times, rates, reserve, target SoC, charge/discharge enable) per entity. Once an ack has been matched on the current connection:
  • An identical command (same entity, command and payload) is published at most once per 30 s window (_COMMAND_ACK_WINDOW). This covers waiting for the ack, after an ok ack while telemetry catches up, and after a refusal. The generic loop keeps polling in the meantime, so each write normally sends the command once.
  • A different value is published immediately and replaces the tracked one.
  • A command with no ack after the window is re-sent once, which covers a dropped QoS 0 message. If the re-send is not acked either, acks stop being relied on until the next one arrives.
• ok ack: the cached slot start/end selects and enable switches are updated from applied, so the read-back matches straight away. Staged or recorded EMS slot endpoints and number entities still wait for telemetry.
• Refusal: logs Warn: GatewayMQTT: <command> for <serial> refused by hub: <error> and does not re-send that value within the window. The write is still reported as failed, but the hub is no longer hammered.
• replay rejection: the next attempt goes out immediately under a new id. The command id counter is now seeded from the clock, so ids no longer restart at PBAT1 after a restart. A restart was the main way to hit the hub's replay check, or to match a late ack meant for the previous process.
• Outcomes are recorded per command id. An ok for any send of a value counts. When one command reaches several units, a refusal from any of them outranks an ok, and it undoes an optimistic cache update by restoring the last telemetry. Every refusal restarts the window.
• Shared state (the id counter and the tracked-command map) is guarded by a lock, because acks arrive on the MQTT listener's loop while writes come from the engine thread.

Compatibility

• Receiving acks depends on the broker ACL allowing the PredBat instance token to subscribe to ack/+.
• If the subscription is denied or fails, the gateway logs one warning and control writes behave exactly as before.
• The same applies if no ack is ever seen, for example with hub firmware that does not publish acks: nothing is suppressed until an ack has been matched on the connection.

Testing

• New TestCommandAck cases in apps/predbat/tests/test_gateway.py:
  • slow ack (arrives after 10 s of polling): exactly one publish, then a matching read-back;
  • multi-unit acks: a refusal after an ok restores the cache; a staged first ok does not block a later usable one; refusals restart the window;
  • refusal: no re-send within the window, reason logged, new attempt after the window;
  • no ack: one re-send after the window, then fallback to publishing every call;
  • new value while a command is pending: published immediately, and the stale ack is ignored;
  • ok ack updates enable switches and slot times; staged/recorded/number acks leave the cache alone;
  • an ack for an earlier send of the same value; a refusal after an ok from another unit; the replay re-send;
  • no subscription, and subscribed but no ack yet (unchanged behaviour); failed publish; ack topic routing; denied subscription warns once; id seeding.
• python3 ../apps/predbat/unit_test.py -t gateway and --quick pass. pre-commit (ruff, black, cspell) passes.

🤖 Generated with Claude Code