test(control): record the early exits meeting a binding protection

[frahlg]

Test data only. No changeset — nothing ships.

The hole

Three branches of ComputeDispatch walk away from a cycle before the safety
pipeline: idle mode, the holdoff window, and the reactive deadband. The golden
corpus had no record of any of them meeting a protection that binds.

Of the 590 records, 33 returned no targets — 25 idle, 1 holdoff, 8 deadband —
and every one of the 8 deadband records ran with site_fuse_amps=0 and
peak_import_ceiling_w=0. Nothing was over any limit to defend. That is why
590 recorded ticks did not catch the deadband exit skipping every protection,
which is the bug #803 fixed. #803 left this gap open deliberately: recording
new records is a corpus change, not a fix.

What is added

early_exit_protections, 21 records, 611 in total.

Each shape appears twice — once where the protection binds, once where the same
site is configured identically and nothing is over its limit. The quiet half is
not filler. A corpus of only-firing records cannot tell a fix from an over-fire,
and a fuse-saver that discharges on every tick drains the pack as surely as one
that never fires trips the breaker.

exit	binds	quiet control
deadband	tariff peak ceiling; fuse ceiling under a peak limit misconfigured above the breaker; 3φ phase over; 1φ phase over; safety-amp margin; two batteries split by headroom; stale-plan reactive fallback	ceiling above the draw; limit under the fuse; balanced phases; 1φ under; pack below the 5 % floor; export-side phase 10 A over
idle	peak ceiling; 3φ; 1φ	both configured, neither over
holdoff	peak ceiling; 3φ; 1φ	both configured, neither over

The export-side record is the direction gate: forceFuseDischarge's only lever
is more discharge, which relieves an import-side phase and pushes an
export-side one further over. It must stay quiet, and now there is a record
that says so in watts.

Single-phase sites get their own records because the phase count is the
conversion #812 gave one owner. On one phase the aggregate meter and the phase
are the same wire, so relief is the overage once — 1610 W by both routes. Under
the bare * 3.0 #812 removed, these records would command 4830 W and drive the
meter through zero into an export-side violation.

This family records the law as fixed, not a bug

slew_limiter deliberately holds a known defect still so its fix reads as a
diff in watts. This one is the opposite: every record was taken after #803
landed and states what dispatch is supposed to do. A record here that moves is
a protection that stopped protecting. The family doc comment and the header of
golden_test.go both say so, since the corpus's standing disclaimer is that
nothing in it was reviewed as correct.

Verified against the un-fixed code

Reverting #803's dispatch.go hunk locally and replaying moves 7 of 611
records — all 7 deadband records where a protection binds, each reading as the
commanded discharge disappearing:

dispatch changed for early_exit/deadband_per_phase_3p_binds:
  per-driver targets:
    ferroamp: was -1380.00 W (clamped), now not dispatched
  site totals:
    battery_target_sum_w: was -1380.00 W, now 0.00 W (moved +1380.00 W)

The 6 quiet deadband records and all 8 idle and holdoff records hold still,
because idle and holdoff already ran the fuse-saver before #803. Restoring the
fix, all 611 replay clean.

Re-recording to silence the failure does not work either. TestGoldenDump
runs the coverage assertions over what it just wrote, and against the un-fixed
code they fail:

coverage gap: no deadband record where a protection binds — the exit is unguarded again
early_exit/deadband_per_phase_3p_binds: fleet total = 0 W, want -1380 W — 460 W over on the worst phase, across 3 phases

All 21 recorded values matched the prediction written down before recording.

Second commit: a provenance wart

slew_limiter.json carried ftw_commit: fe2c904f, a SHA that is not on master
and never was. It is the pre-squash tip of #809's branch — git cat-file finds
it locally with #809's subject, git merge-base --is-ancestor fe2c904f origin/master says it is not an ancestor, and git log -- slew_limiter.json
shows the squash c85bfe1 as the last commit to rewrite the file. So the
behaviour those 155 records hold is the behaviour at c85bfe1, which is what
the field now says. No record changes.

Why the diff adds only one corpus file

The eight existing families are byte-identical. A full re-recording on this
machine rewrites 27 of the 590 old records with float noise up to 8.5 µW — a
thousandth of the 0.01 W tolerance, and nothing a reviewer should have to read.

make verify clean on both commits.

🤖 Generated with Claude Code