fix(gateway): never enable discharge/export after a failed window write

[mgazza]

Bug

For a direct Hub (gateway) battery, adjust_force_export writes the discharge start and end as two separate set_discharge_slot commands, then turns on scheduled_discharge_enable and calls adjust_inverter_mode (export mode) regardless of whether those endpoint writes were applied. schedule_write_ok only withheld the later commit record.

When the Hub accepts the start but refuses the end, it is left enabled on a stale window. In the reproduction below that window is 02:55–00:01, which wraps for about 21 hours, and export mode is active.

Reproduction

This runs the actual Inverter.adjust_force_export, GatewayMQTT command path and ACK cache. The transport is synthetic: it accepts the start and refuses any set_discharge_slot carrying end (modbus_write_failed).

	before (main 40b9ce2)	after
wire	{start:255}, {end:301} (refused), set_discharge_enable true	one {start:255,end:301} (refused)
read-back	02:55:00 – 00:01:00	00:00:00 – 00:01:00 (unchanged)
discharge enable	on	off
export mode called	yes	no
commit pending	yes	yes (next cycle retries)

Fix

This mirrors the charge-window fix in #5531.

• GatewayMQTT.update_discharge_window sends both endpoints in one full-serial set_discharge_slot. It refuses read-only mode, non-slot1 or unpaired entities, mismatched serials, coordinators and unparsable times. True only means the command was published.
• GatewayMQTT.discharge_window_uses_staging picks the coordinator path synchronously, before the async bridge. A swallowed exception in the run_async thread therefore returns None, which counts as a publish failure. It never sends the caller to the legacy individual writes.
• Inverter.write_and_poll_gateway_discharge_window runs when both endpoint entities are owned by gateway.
  • Mixed ownership is an error, not a fallback.
  • Both endpoint read-backs (applied ACK or telemetry) must match before it returns success.
  • It records both endpoints in the control ledger, or clears them on failure, and uses one write-backoff key for the pair.
• In adjust_force_export, any failure returns before the discharge target, the enable write, export mode and the commit, and leaves export_window commit pending. Coordinators (GATEWAY_COORDINATOR_TYPES), other providers, the disable path and midnight windows keep their existing sequence.

Tests

apps/predbat/tests/test_gateway_discharge_window.py adds 15 tests, registered in run_gateway_tests. They cover:

• the refused endpoint, plus refused, partial, staged, timeout and exception outcomes, all failing closed with the ledger cleared
• the pair applied before enable, with the full serial
• a retry after refusal recovering
• read-only, ownership and serial refusals
• an async-bridge exception that does not fall back
• the coordinator and non-Hub sequence preserved, including a coordinator whose end entity is not gateway-owned (staging is detected before ownership checks)
• disable and the midnight window
• the success ledger and backoff key
• the write/moved counters
• an armed schedule turned off when its move is refused, left running when the move is only unconfirmed (timeout, partial or staged ACK), and kept enabled when the move applies
• a refusal that ends the attempt at once (one poll, no re-send inside the ack window)

Results:

• unit_test.py -t gateway: PASSED (434 OK). -t inverter_write_poll and -t inverter_multi: PASSED.
• On unfixed main, 7 of the 9 new tests fail. The two that pass there are the preservation tests (coordinator/non-Hub, disable/midnight).
• -t inverter stops on the same pre-existing adjust_target50 write_and_poll_switch unpack error locally, with and without this change. The adjust_force_export* cases before it pass.
• Pre-commit (ruff, black, cspell) passes.

Notes

• This conflicts textually with fix(gateway): apply direct battery charge windows as paired slots #5531 (adjacent hunks in gateway.py, inverter.py and the run_gateway_tests import). The resolution is to keep both.
• Fail-safe for an armed schedule: if export is already enabled and the Hub explicitly refuses the exact paired window, scheduled export is turned off and the mode returns to Eco (except in read-only mode). Previously the old window kept exporting. Test: 02:00–04:00 enabled, plan 02:30–03:00, refused → enable off, adjust_inverter_mode(False). An unconfirmed write (slow or missing ACK, telemetry lag) may have applied, so the running export is left alone and the pending commit retries. After a refusal, execute.py still reports "Exporting" for that cycle.
• An independent adversarial review found nothing blocking. Mutation testing caught 11 of 13 mutations. Fixed from that review: the coordinator ordering (529e6f8), and in 57b7b4a the armed-export fail-safe, refusal no longer polled to timeout, the unreachable serial check removed, counter tests added, and the async exception path documented. The coordinator ordering also applies to fix(gateway): apply direct battery charge windows as paired slots #5531.
• MQTT transport, ACKs and inverter state are synthetic in these tests. No physical hardware validation has been done.

🤖 Generated with Claude Code

https://claude.ai/code/session_018BaJjLpuMEtQYfvmTRcFJf