test(control): pin the golden scenario clock to one instant

[frahlg]

Credit

This work is not mine. It was written and verified by the Codex effort that
paused mid-flight and documented itself in
#790 (comment).
It sat finished and uncommitted in a detached worktree at 31232f25. I read
every hunk, moved it onto current master, audited the seam, re-ran the
verification and added the numbers below. The design and the code are theirs;
the only thing I added is a doc comment on State.now(). Their worktree is
untouched.

What the seam is

control.State gains one unexported field:

// clock is nil in production. Tests may set it to keep a dispatch
// scenario on one instant even when the test runner is delayed.
clock func() time.Time

and State.now() returns it when set, time.Now() when nil. All 17 ambient
time reads in internal/control now go through it.

Why

The golden recorder anchored a slot directive on time.Now() at the moment the
directive was asked for, and ComputeDispatch then read time.Now() again
further down. Energy-path targets are Wh × 3600 / seconds-remaining, so
anything that happens between those two reads shortens the slot and moves the
target. The scenario was never one instant; it was two, with a race between
them.

Measured on master, injecting a pause between the slot-directive request and
dispatch, on seeded_planner/095_planner_arbitrage:

pause	target	moved
none	−4768.4804 W	—
50 ms	−4768.9371 W	−0.4567 W
250 ms	−4770.7275 W	−2.2471 W
1 s	−4777.4496 W	−8.9692 W

The replay tolerance is 0.01 W. A 50 ms scheduler pause — nothing on a
contended CI box — already exceeds it by 45×. That is a golden gate that fails
for reasons that have nothing to do with dispatch.

With the seam, the same three pauses:

pause	target	moved
50 ms	−4768.4803 W	0.0000 W
250 ms	−4768.4803 W	0.0000 W
1 s	−4768.4803 W	0.0000 W

Bit-identical. TestGoldenPlannerScenarioIgnoresSchedulingDelay ships that as a
standing assertion, with a deliberate 50 ms sleep inside the slot-directive
closure.

What it buys the corpus

Three fresh recordings on each side, 703 targets each, split by whether the
record carries a slot directive:

	master	this branch
275 slot-bearing targets	1.6e-5 W drift	0 — exact
428 non-slot targets	4.5e-13 W	9.1e-13 W

All clock drift lived in the energy path, and it is now gone entirely.

The residual is not clock, and this PR does not claim to fix it. The
~1e-12 W on non-slot targets is float summation order over a Go map in the
weighted distributor. I confirmed it is pre-existing by recording master eight
times: it shows up there too (4.5e-13 W on seeded_reactive/071_weighted). It
is ten orders of magnitude under the tolerance. Recording it here so the next
person does not go hunting for it.

So the honest headline is the corpus no longer depends on the wall clock, not
the corpus is bit-reproducible. The 0.01 W tolerance stays and stays
load-bearing, and both doc comments in the diff say exactly that.

Production behaviour is unchanged

Not "unchanged as far as the tests can tell" — unchanged by construction:

• The field is unexported. Only package control can assign it, and the
  only assignment in the package is in golden_dump_test.go.
• go/cmd/ftw/control_state.go:9 is the only non-test caller of
  control.NewState. It is in a different package and could not set the field
  if it tried.
• With clock nil, State.now() is time.Now(). Every converted line reads
  the wall clock exactly where it read it before.
• time.Since(x) → state.now().Sub(x) is the documented identity, monotonic
  reading included.

Completeness of the conversion

I checked whether the diff missed anything rather than assuming it had not.
Master has 17 time.Now() / time.Since() calls in the package's non-test
files, all in dispatch.go; the diff converts all 17. Afterwards the only
wall-clock read left in internal/control is State.now()'s own fallback.

Outside the package, ComputeDispatch reaches telemetry only through
Store.Get, ReadingsByType, SumOnlineEVW and DriverHealth. None reads the
clock — Get is a map read and IsOnline() tests stored fields the watchdog
sets. Store.IsStale is the one clock-reading method and dispatch never calls
it. So there is no ambient read left in the call graph, and nothing to disclaim.

Interaction with #799

#799 is open and touches both of these test files, so it has right of way. I
did not rewrite anything under it:

• git merge-tree against 63bb04e8 auto-merges, no conflicts.
• I built the merged tree and ran it. go test ./internal/control -count=20
  passes with all 590 records, and test(control): record the slew limiter in the golden corpus #799's own coverage line is unchanged:
  slew coverage: 123 records bind (>50 W), 123 of them at a production-realistic rate (<= 3000 W/tick); largest effect 6345 W on slew/seeded_034_priority.

#799's 155 records were recorded under the old recorder and replay clean under
the seam, which is what the 0.01 W tolerance is for. Either PR can land first.

Verification

• go test ./internal/control -count=1 — ok, 0.744s
• go test ./internal/control -run TestGolden -count=100 — ok, 29.6s
• go test ./internal/control -run TestGolden -race -count=10 — ok, 6.7s
• make verify — clean (Python 3.12.13 venv via uv)
• gofmt clean on all three files

Changeset

No changeset — no-changeset label. .changeset/README.md gates on "every
PR that ships behavior to users", and lists "internal test plumbing" under
skipping. This touches production code, but it ships no behaviour: the field is
unexported and nil in production, and the seam exists solely so a test can pin
an instant. It is not even a perf tweak — one nil check per ambient read on a
1 Hz loop. Same call as #790 and #799 made for the corpus itself.

Flagging it as a judgement call rather than a formality, since the file is
dispatch.go. If a reviewer would rather have the seam recorded in the
changelog, a patch changeset is fine by me.

🤖 Generated with Claude Code