# WashData - Home Assistant integration for appliance cycle monitoring via smart plugs. # Copyright (C) 2026 Lukas Bandura # SPDX-License-Identifier: AGPL-3.0-or-later # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published # by the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . """Cycle detection logic for WashData.""" from __future__ import annotations import itertools import logging import math from dataclasses import dataclass from datetime import datetime, timedelta from typing import Any, Callable, cast import numpy as np from homeassistant.util import dt as dt_util from .log_utils import DeviceLoggerAdapter from .const import ( ANTI_WRINKLE_ELIGIBLE_REASONS, TerminationReason, STATE_OFF, STATE_DELAY_WAIT, STATE_STARTING, STATE_RUNNING, STATE_PAUSED, STATE_ENDING, STATE_FINISHED, STATE_ANTI_WRINKLE, STATE_INTERRUPTED, STATE_FORCE_STOPPED, STATE_UNKNOWN, DEVICE_TYPE_WASHING_MACHINE, DEVICE_TYPE_DRYER, DEVICE_TYPE_WASHER_DRYER, DEFAULT_MAX_DEFERRAL_SECONDS, DEFAULT_DEFER_FINISH_CONFIDENCE, DEFAULT_SMART_TERMINATION_DURATION_RATIO, DISHWASHER_END_SPIKE_MIN_PROGRESS, DISHWASHER_END_SPIKE_QUIET_RELEASE_SECONDS, DISHWASHER_END_SPIKE_WAIT_SECONDS, DISHWASHER_SMART_TERMINATION_DEBOUNCE_SECONDS, SMART_TERM_TAIL_MAX_RATIO, SMART_TERM_TAIL_MIN_POINTS, SMART_TERM_TAIL_WINDOW_FRAC, SMART_TERM_TAIL_WINDOW_MIN_S, SMART_TERM_TAIL_WINDOW_S, WASHER_SMART_TERMINATION_DEBOUNCE_MAX_SECONDS, STARTING_PAUSED_TRUE_OFF_TIMEOUT_SECONDS, DISHWASHER_MATCH_FREEZE_QUIET_SECONDS, DISHWASHER_MIN_CYCLE_DURATION_S, TERMINAL_DROP_OFF_DELAY_SECONDS, ENDING_HARD_FINALIZE_RATIO, ENDING_HARD_FINALIZE_MIN_QUIET_S, GATE_CADENCE_MEDIAN_FACTOR, END_GATE_LATE_RATIO, resolve_end_gate_late_ratio, END_GATE_LATE_SECONDS, STANDBY_BAND_FINALIZE_DEVICE_TYPES, STANDBY_BAND_MIN_RATIO, DEVICE_TYPE_DISHWASHER, TERMINAL_QUIET_CAP_S, STANDBY_BAND_WINDOW_S, STANDBY_BAND_MAX_FRACTION, STANDBY_BAND_FLATNESS_FRACTION, STANDBY_BAND_FLATNESS_FLOOR_W, DEFAULT_ANTI_CREASE_FINALIZE_RATIO, ANTI_CREASE_FINALIZE_RATIO_MIN, ANTI_CREASE_FINALIZE_RATIO_MAX, DEFAULT_CURVE_PREROLL_SECONDS, CURVE_PREROLL_MAX_SECONDS, PREROLL_CHAIN_BREAK_SECONDS, ANTI_CREASE_CONFIRM_WINDOW_S, ANTI_CREASE_TERMINAL_HIGH_MIN_FRAC, ANTI_CREASE_TERMINAL_MATCH_FRAC, ANTI_CREASE_SPIN_WAIT_MAX_RATIO, ) # The dishwasher end-spike wait window is shared between two code paths # (Smart Termination's wait branch and _should_defer_finish's no-end-spike # branch). They MUST release the cycle at the same instant - sanity-check # that the constants module loaded a sensible value rather than allowing the # paths to silently drift if one was changed and the other forgotten. if DISHWASHER_END_SPIKE_WAIT_SECONDS <= 0: # Runtime check (not assert: asserts are stripped under python -O). raise ValueError("DISHWASHER_END_SPIKE_WAIT_SECONDS must be positive") # Opt-in ML end-detection guard (Stage 6). When the manager injects an # end-confidence provider (only when the user enabled ML models for the device), # the cycle-end model can defer a *normal* completion if it judges the current # low-power event to be a pause rather than the true end. This is intentionally # asymmetric: it can only *delay* a completion, never end a cycle early, and it # is bounded, so a wrong model can slow a finish but can neither stop one early # nor hang the cycle. Force-stop / smart-termination / user paths never consult # it. Overridable emphasis lives here rather than const.py to keep the guard # self-contained (it is detector-internal policy, not user configuration). ML_END_GUARD_MIN_CONFIDENCE = 0.5 # P(true end) below this -> treat as a likely pause ML_END_GUARD_MAX_DEFER_SECONDS = 1800.0 # cap the extra wait the guard may add (30 min) # The opt-in ML end-guard / terminal-drop providers rebuild the trace and run # inference on every ENDING-phase evaluation. During a long quiet tail (e.g. a # dishwasher's up-to-1h soak) that is wasteful, so recompute at most this often # (data-clock seconds). Safe to cache: the guard only ever *defers* and terminal # drop only ever *shortens*, so both tolerate a value up to this window stale. ML_PROVIDER_THROTTLE_SECONDS = 30.0 if not 0 < DISHWASHER_END_SPIKE_MIN_PROGRESS < 1: raise ValueError("DISHWASHER_END_SPIKE_MIN_PROGRESS must be a fraction in (0, 1)") from .signal_processing import ( energy_gap_threshold_s, integrate_wh, quiet_run_before, ) _LOGGER = logging.getLogger(__name__) # After a user/external stop the manual-stop lockout swallows the machine's # spin-down/drain so it is not logged as a fresh cycle. The lockout normally # clears as soon as power drops to idle. As a safety net, if power instead stays # at or above the start threshold for longer than any plausible spin-down, the # device is running a genuinely new (back-to-back) load: release the lockout so # the new cycle is detected instead of being pinned until the progress-reset # window expires (issue #267). STOP_LOCKOUT_RELEASE_SECONDS = 180.0 def effective_anticrease_finalize_ratio(value: Any) -> float: """The ratio the anti-crease gate will actually use for a stored value. Only ``ws_set_options`` range-checks this option: ``import_config`` strips nulls only, a selective import writes numbers through, and the Playground sanitizer just casts to float. So the value is held to its documented range here, at every point of use, and anything unusable falls back to the default rather than disarming the gate (a stored ``0.0`` would satisfy the past-expected test for every duration). Shared with the Playground's config summary so the figure the panel shows and the figure the gate applies cannot drift apart. """ try: ratio = float(value) except (TypeError, ValueError, OverflowError): return DEFAULT_ANTI_CREASE_FINALIZE_RATIO if not math.isfinite(ratio): return DEFAULT_ANTI_CREASE_FINALIZE_RATIO return min( ANTI_CREASE_FINALIZE_RATIO_MAX, max(ANTI_CREASE_FINALIZE_RATIO_MIN, ratio) ) def effective_curve_preroll_seconds(value: Any) -> float: """The pre-roll window actually applied for a stored value (0 = off). Same reasoning as :func:`effective_anticrease_finalize_ratio`: the detector caps the window at ``CURVE_PREROLL_MAX_SECONDS`` wherever it reads it, so the summary has to report the capped figure or it describes a sim that did not run. """ try: window = float(value or 0.0) except (TypeError, ValueError, OverflowError): return 0.0 if not math.isfinite(window) or window <= 0: return 0.0 return min(window, CURVE_PREROLL_MAX_SECONDS) @dataclass class CycleDetectorConfig: """Configuration for cycle detection.""" min_power: float off_delay: int device_type: str = DEVICE_TYPE_WASHING_MACHINE smoothing_window: int = 5 interrupted_min_seconds: int = 150 completion_min_seconds: int = 600 start_duration_threshold: float = 5.0 start_energy_threshold: float = 0.005 end_energy_threshold: float = 0.05 # 0.05 Wh (50 mWh) threshold for "still active" end_repeat_count: int = 1 min_off_gap: int = 60 start_threshold_w: float = 2.0 stop_threshold_w: float = 2.0 min_duration_ratio: float = 0.8 # Default deferred finish ratio # Minimum live-match confidence for a match to be trusted by Smart Termination # and the anti-crease gate. Fed from the `profile_match_threshold` option, which # up to 0.5.5 was stored and never read - so raising it (the workaround the #288 # reporter documented) silently did nothing. Default matches the value that was # hard-coded at those two sites, so behaviour is unchanged unless the user has # deliberately tuned the option. match_confidence_threshold: float = 0.4 # Power-based Off detection (issue #284). Carried on the config so the manager # (the single owner of the terminal -> Off transition) can read them live; the # detector itself does not act on them. 0 = disabled. power_off_threshold_w: float = 0.0 power_off_delay: float = 30.0 match_interval: int = 300 # Default profile match interval profile_duration_tolerance: float = 0.25 # Default tolerance (±25%) anti_wrinkle_enabled: bool = False anti_wrinkle_max_power: float = 400.0 anti_wrinkle_max_duration: float = 60.0 anti_wrinkle_exit_power: float = 0.8 anti_wrinkle_idle_timeout: float = 120.0 # Dishwasher only: sustained-quiet seconds (after reaching expected duration) # that release the end-of-cycle pump-out/drain wait early (#379). Defaults to # the shipped constant; per-device configurable so a machine with a long silent # passive-drying phase before its final drain can absorb profile drift. dishwasher_end_spike_quiet_release: float = DISHWASHER_END_SPIKE_QUIET_RELEASE_SECONDS # Fraction of the matched profile's expected (mean) duration Smart Termination # requires before it may fire (#393). Device-type-resolved in the manager's # config builder (0.99 dishwasher / 0.98 other), so this field always carries a # real float - never None - which is what playground.effective_settings() relies # on. The dishwasher pump-out relief is combined via min(), so a configured value # can only loosen the gate. smart_termination_duration_ratio: float = DEFAULT_SMART_TERMINATION_DURATION_RATIO # Fraction of the matched profile's expected duration the anti-crease finalise # requires before it may fire (#429). A DIFFERENT gate from the ratio above: # that one gates Smart Termination, this one the finalise into # STATE_ANTI_WRINKLE. Scalar default (no device-type resolution) and always a # real float, so playground.effective_settings() never sees None. anti_crease_finalize_ratio: float = DEFAULT_ANTI_CREASE_FINALIZE_RATIO # How far back readings from aborted start probes may be carried into a # committed cycle's curve (#430). 0 disables the whole path, which is the # default and keeps the stored-duration convention unchanged. curve_preroll_seconds: float = DEFAULT_CURVE_PREROLL_SECONDS delay_detect_enabled: bool = False # Sustained seconds power must stay in the standby band (between # stop_threshold_w and start_threshold_w) before DELAY_WAIT engages. # Tuned to filter out brief menu-navigation peaks at the start of a # delayed program. delay_confirm_seconds: float = 60.0 delay_timeout_seconds: float = 28800.0 # Add other fields as needed def trim_zero_readings( readings: list[tuple[datetime, float]], threshold: float = 0.5, trim_start: bool = True, trim_end: bool = True, ) -> list[tuple[datetime, float]]: """Trim continuous zero/near-zero readings from start and end of cycle. Args: readings: List of (timestamp, power) tuples threshold: Power values below this are considered "zero" trim_start: Whether to trim zeros from the beginning trim_end: Whether to trim zeros from the end Returns: Trimmed list """ if not readings: return readings start_idx = 0 if trim_start: for i, (_, power) in enumerate(readings): if power > threshold: start_idx = i break else: # All readings are zero - return single point if list not empty return readings[:1] if readings else [] end_idx = len(readings) - 1 if trim_end: # Find last non-zero reading found_end = False for i in range(len(readings) - 1, -1, -1): if readings[i][1] > threshold: end_idx = i found_end = True break if not found_end and trim_start: # If all zeros and trim_start was checked, it would return early. # But if safety fallback needed: end_idx = start_idx elif not found_end and not trim_start: # Trimming end but not start, and all zeros? # Keep first point end_idx = 0 # Return trimmed slice (inclusive of end) return readings[start_idx : end_idx + 1] def terminal_high_for_guards( store: Any, config: "CycleDetectorConfig", cycle_max_power: Any, profile_name: str | None, ) -> tuple[float, ...] | None: """Element 10 of the match tuple: the matched profile's last high-power block. Two consumers with two different bars, and the bar has to travel with the block (register item 351): * **anti-crease** (#399) measures against ``anti_wrinkle_max_power``, the dryer's "a tumble is below this" level. Only meaningful while anti-wrinkle is on, and it returns a TRIPLE. * **the standby-band finalise** (#296 / #445) shares the same predicate and used to get nothing at all, because element 10 was supplied only when anti-wrinkle was enabled and ``DEFAULT_ANTI_WRINKLE_ENABLED`` is False. So on a washing machine ``_anticrease_spin_pending`` returned False at once and the machine could finalise on the quiet plateau before its final spin, recording that spin as a second cycle. The bar here is a share of the cycle's own peak, and it is returned as a QUAD so ``_high_power_seconds_since`` counts live seconds against the same number. **This lives here, module level, because it had two copies.** The manager builds the live match tuple and ``playground`` builds the sim's, and ``end_gate_eval.py`` drives the detector through the Playground - so an arm present in only one of them is invisible to every measurement made with that harness, which is exactly how item 352 first measured as a no-op. The copies had already drifted in their error handling before they were merged. Total by construction: every failure path returns None, which leaves the guard exactly as inert as it was. That is the fail-open direction every input here takes, and it is also what lets ``playground`` call it directly while keeping its own never-raise contract. """ if not profile_name or store is None: return None try: if config.anti_wrinkle_enabled: return store.profile_terminal_high_block( profile_name, config.anti_wrinkle_max_power ) if config.device_type not in STANDBY_BAND_FINALIZE_DEVICE_TYPES: return None ceiling = float(cycle_max_power or 0.0) * STANDBY_BAND_MAX_FRACTION if ceiling <= 0: return None block = store.profile_terminal_high_block(profile_name, ceiling) if block is None: return None return (float(block[0]), float(block[1]), float(block[2]), ceiling) except Exception: # noqa: BLE001 - a guard input must never break matching return None class CycleDetector: """Detects washing machine cycles based on power usage. Implements a robust state machine: OFF -> STARTING -> RUNNING <-> PAUSED -> ENDING -> OFF """ def __init__( self, config: CycleDetectorConfig, on_state_change: Callable[[str, str], None], on_cycle_end: Callable[[dict[str, Any]], None], profile_matcher: ( Callable[ [list[tuple[datetime, float]]], tuple[str | None, float, float, str | None] | None, ] | None ) = None, device_name: str = "", end_confidence_provider: ( Callable[[list[tuple[float, float]], float], float | None] | None ) = None, terminal_drop_provider: ( Callable[[list[tuple[float, float]], float], bool | None] | None ) = None, ) -> None: """Initialize the cycle detector.""" self._logger = DeviceLoggerAdapter(_LOGGER, device_name) self._config = config self._on_state_change = on_state_change self._on_cycle_end = on_cycle_end self._profile_matcher = profile_matcher # Opt-in ML end-guard: (points, expected_duration) -> P(true end) or None. # Injected by the manager; None disables the guard (existing behavior). self._end_confidence_provider = end_confidence_provider # Opt-in terminal-drop detector: (points, expected_duration) -> bool. # True means the current low-power event is an anomalously-early hard # cliff-to-0 (never seen this early on this device), so the cycle may be # finalized without waiting out the full soak-bridging min_off_gap. # Injected by the manager; None disables it (existing behavior). Opposite # asymmetry to the end-guard: it can only ever *shorten* the end wait. self._terminal_drop_provider = terminal_drop_provider # Throttle caches for the two providers, scoped to the cycle + expectation: # (last_reading_ts, expected_duration, cycle_start, result). Reused only # within the recompute window when expected_duration and cycle_start match. self._ml_end_cache: tuple[datetime, float, datetime, float | None] | None = None self._terminal_drop_cache: tuple[datetime, float, datetime, bool] | None = None # Cycle duration (s) at which the ML guard first deferred the current # ending episode; bounds how long the guard may keep deferring. self._ml_defer_start_duration: float | None = None # State self._state = STATE_OFF self._sub_state: str | None = None self._ignore_power_until_idle: bool = False # Sustained high-power time accrued while the stop lockout is armed; used # to release the lockout for a genuinely new back-to-back load (#267). self._lockout_high_seconds: float = 0.0 # Data self._power_readings: list[tuple[datetime, float]] = [] # (time, raw_power) # Rolling pre-cycle readings, so a start that took several probes to # commit can recover the readings the aborted probes took with them # (#430). Only appended to while no cycle is open, trimmed to # curve_preroll_seconds, and cleared at every cycle end - a previous # cycle's tail must never be carried into the next cycle's curve. self._preroll_buffer: list[tuple[datetime, float]] = [] self._current_cycle_start: datetime | None = None self._last_active_time: datetime | None = None # Last reading the POWER SENSOR actually sent, as opposed to one the # manager injected to advance the quiet timers. Deliberately not reset per # cycle: it describes the sensor, not the run. self._last_real_reading_time: datetime | None = None self._cycle_max_power: float = 0.0 # Accumulators (dt-aware) self._energy_since_idle_wh: float = 0.0 self._time_above_threshold: float = 0.0 self._time_below_threshold: float = 0.0 # As above, but restarts whenever an outage-sized gap breaks the observed # quiet tail, so it counts only quiet WashData actually saw. Used by the # dishwasher quiet-release gates so a single low sample after a telemetry # dropout can't satisfy them without the quiet having been observed. self._time_below_threshold_gapfree: float = 0.0 self._last_process_time: datetime | None = None # New State Machine trackers self._state_enter_time: datetime | None = None self._matched_profile: str | None = None self._verified_pause: bool = False self._last_power: float | None = None self._time_in_state: float = 0.0 # Smoothing buffer self._ma_buffer: list[float] = [] # Adaptive Sampling Tracker self._recent_dts: list[float] = [] # Track last 20 dt values self._p95_dt: float = 1.0 # Default assumption # The cadence as it stood BEFORE the reading currently being processed was # folded in. Every gap-vs-outage classification reads this, never _p95_dt: # an outage-sized interval that has already widened p95 would raise the very # ceiling meant to catch it (a 120 s gap after a 10 s cadence lifts p95 to # ~15.5 s -> ceiling 155 s -> the gap passes as observed time). self._prior_p95_dt: float = 1.0 # Profile Matching Tracker self._last_match_time: datetime | None = None self._expected_duration: float = 0.0 self._last_match_confidence: float = 0.0 # Element 12: the longest expected duration among the candidates the # matcher still considers plausible. `_match_prefix_ambiguous` means one # of them is materially longer than the winner, so "past the expected # end" might be "mid-soak in that longer programme" - but only up to # THIS duration. Past it there is no longer programme left to be mid-soak # in, and the guard's own rationale is spent. self._longest_candidate_duration: float = 0.0 self._end_spike_seen: bool = False self._end_spike_duration: float = 0.0 # cycle duration (s) when _end_spike_seen was last set self._match_ambiguous: bool = False # last live match was ambiguous (gates predictive end) self._match_prefix_ambiguous: bool = False # longer candidate with good shape exists (prefix guard) # The narrower #288-only half of the flag above. #364 widened # _match_prefix_ambiguous with prefix scoring, which is safe for the ENDING # Smart-Termination gate but must NOT reach the anti-crease finalize (see # _anticrease_gate_open) where blocking can re-hang a cycle (#296). self._match_prefix_ambiguous_full_shape: bool = False # Mean power the matched profile draws over the last few % of its own run # (profile_store.profile_tail_power). None = no opinion, guard stays inert. self._matched_tail_power: float | None = None # (start_frac, seconds, start_offset_s) of the matched profile's own terminal # high-power block, from profile_store.profile_terminal_high_block. None = the # profile has no such block (or we have no opinion) and the guard stays inert # (#399). A two-element payload (pre-item-196 snapshot, Playground, older # callers) is still accepted and falls back to start_frac x expected. self._matched_terminal_high: ( tuple[float, float] | tuple[float, float, float] | None ) = None # Element 11 (register item 297): how long the matched profile is MEASURED to stay quiet # after its last real activity. Bounds how much of Smart Termination's # confirmation delay may be banked into the stored duration. None means the # profile has not been measured, and for a DISHWASHER the previous # expected-end cap applies. Only a dishwasher gets that far: every other # device type returns `_last_active_time` from `_keep_tail_cap` before # this element is read at all, because nothing legitimate follows their # last activity - so for them the cap can sit EARLIER than expected_end. self._matched_terminal_quiet_s: float | None = None # One-shot per cycle, so the held-finalise reason is visible in the log # without repeating it on every reading. self._anticrease_spin_wait_logged: bool = False self._last_smart_term_block_reason: str | None = None # #346 diagnostic throttle # Anti-wrinkle tracking (dryers only) self._anti_wrinkle_candidate_start: datetime | None = None self._anti_wrinkle_candidate_peak: float = 0.0 self._anti_wrinkle_candidate_start_power: float = 0.0 self._anti_wrinkle_idle_time: float = 0.0 # Track time spent below exit_power while in ANTI_WRINKLE # Delayed-start band tracking. # _delay_band_start anchors the first reading in the standby band # [stop_threshold_w, start_threshold_w) while still in STATE_OFF. # _delay_band_seconds mirrors the anchored elapsed time for # diagnostics and tests. self._delay_band_start: datetime | None = None self._delay_band_seconds: float = 0.0 # _delay_band_peak is purely diagnostic - surfaced in the log line # when the transition fires so users can see what their machine's # actual standby plateau looked like. self._delay_band_peak: float = 0.0 # _delay_wait_true_off_seconds tracks sustained "true off" (power # below stop_threshold_w) inside DELAY_WAIT, so we can drop back to # OFF only when the machine has clearly been switched off rather # than briefly dipped. self._delay_wait_true_off_seconds: float = 0.0 # _starting_paused_off_since anchors the first below-stop reading while # a user-paused STARTING state is held (issue #306). Elapsed time is # measured from this anchor, not accumulated per-dt, so a single large # (but sub-outage) interval cannot prematurely credit minutes of quiet time. self._starting_paused_off_since: datetime | None = None # _delay_wait_high_start anchors the first high-power reading # observed inside DELAY_WAIT. We only transition to STARTING # when the high-power streak has lasted at least # start_duration_threshold real seconds - measured between two # consecutive high readings, not from the dt to the previous # (low) reading. This prevents a single isolated spike from # tripping STARTING just because the sampling interval is long. self._delay_wait_high_start: datetime | None = None self._delay_wait_high_power: float | None = None # Preserve a delayed-start candidate across a false STARTING probe # that drops back into the standby band without the machine truly # turning off. self._preserve_delay_band_on_off: bool = False @property def _gate_cadence(self) -> float: """Cadence the pause/end gates are sized from (#424/#427). ``_p95_dt`` is the 2nd-largest of the last 20 intervals by construction, so it tracks the worst *gap* rather than the reporting rate. That is the right input for the outage ceilings (a gap must be judged against the worst gap we consider normal) but the wrong one for the gates below, which multiply it by three: once a publish-on-change plug falls silent at standby, the only intervals left are the long quiet ones, p95 collapses onto them, and each gate becomes ~3x the silence it is supposed to be measuring. The accumulator advances one interval per reading, so the cycle then needs ~3 more readings - a gate that is set by, and grows with, its own input. Measured on the #427 trace: a 297 s sensor silence followed by a 481 s keepalive lifted the end gate from 45 s to 1455 s and held the cycle in PAUSED for 25.5 min. Capping p95 at a multiple of the *median* keeps the estimate robust: a genuinely slow sensor reports slowly every time, so its median equals its p95 and the cap never binds (a 300 s-cadence meter keeps its 900 s gate); a fast sensor that went quiet has a small median, so the isolated holes cannot triple the gate. Only these two gates read it - ``_p95_dt`` itself is left alone so every outage ceiling keeps the cadence snapshot it was tuned against (register items 213, 215). The cap alone was not enough, and the reason is worth keeping: it is computed over the same 20-interval window it is meant to protect. Once a publish-on-change plug falls silent the watchdog's own 0 W keepalives are the only readings left, so the median collapses onto the injection spacing too and ``5 x median`` stops binding - the gate then grows with our injection rate instead of the plug's. Fixed at the source (register item 289): ``process_reading`` no longer trains the cadence on synthetic readings, so this window describes the sensor and nothing else. """ if len(self._recent_dts) < 5: return self._p95_dt median_dt = float(np.median(self._recent_dts)) return min(self._p95_dt, GATE_CADENCE_MEDIAN_FACTOR * median_dt) @property def _dynamic_pause_threshold(self) -> float: """Calculate dynamic pause threshold based on sampling cadence.""" # User requirement: T_pause >= 3 * p95_update_interval # Default 15s or 3 * p95 return max(15.0, 3.0 * self._gate_cadence) @property def _dynamic_end_threshold(self) -> float: """Calculate dynamic end candidate threshold.""" # Keep this generic for pause->ending transitions across all device types. base = 3.0 * self._gate_cadence # Ensure end threshold is at least 15s greater than pause threshold return max(base, self._dynamic_pause_threshold + 15.0) def _update_cadence(self, dt: float) -> None: """Update rolling cadence statistics.""" if dt <= 0.1: return self._recent_dts.append(dt) if len(self._recent_dts) > 20: self._recent_dts.pop(0) # Calculate p95 if enough samples if len(self._recent_dts) >= 5: self._p95_dt = float(np.percentile(self._recent_dts, 95)) else: self._p95_dt = max(dt, 1.0) def _try_profile_match(self, timestamp: datetime, force: bool = False) -> None: """Attempt to invoke the profile matcher if conditions are met. Args: timestamp: Current timestamp. force: If True, run match immediately regardless of interval. """ if not self._profile_matcher: return if not self._power_readings: return # Terminal-tail match freeze (dishwashers): once we are in ENDING with a # profile already matched and power has been sustained-quiet, the active # cycle is over - only the passive drain/dry tail remains. Re-matching on # the growing idle tail inflates the observed duration and drifts the # Stage-4 duration-agreement toward a LONGER near-duplicate profile, # flipping the label and stalling smart-termination on the ambiguity gate. # Keep the active-phase match instead. Self-correcting: a real resume sends # a high reading that leaves ENDING, so this guard stops applying. if ( self._state == STATE_ENDING and self._config.device_type == "dishwasher" and self._matched_profile and self._time_below_threshold >= DISHWASHER_MATCH_FREEZE_QUIET_SECONDS ): return # Terminal-tail match freeze (anti-crease, #296): once a washer/dryer with # anti-wrinkle enabled is past its expected duration and has settled into # the low-power tumble tail, re-matching on the growing flat tail drifts the # label toward a LONGER near-duplicate (its expected duration grows), which # pushes the anti-crease finalize gate out and breaks Smart Termination - # the field failure that merges back-to-back washes. Keep the good # pre-tail match instead. Self-correcting: a new wash's heating burst above # anti_wrinkle_max_power leaves the tail regime, so this stops applying and # matching re-arms for the next cycle. if self._matched_profile and self._in_anticrease_freeze(timestamp): return # Rate limiting if not force and self._last_match_time: elapsed = (timestamp - self._last_match_time).total_seconds() if elapsed < self._config.match_interval: return self._last_match_time = timestamp # Call the matcher try: result = self._profile_matcher(self._power_readings) # If synchronous result returned, process it. # If None returned (async offload), the matcher is responsible for # calling update_match later. if result: self.update_match(result) except Exception as e: # pylint: disable=broad-exception-caught self._logger.debug("Profile match failed: %s", e) # Maximum reasonable cycle duration accepted by the detector. Anything # longer is rejected as corrupted data and replaced with the # _SANITIZE_INVALID_SENTINEL so downstream gates fall through to the # unmatched / no-expected-duration path. _SANITIZE_MAX_EXPECTED_DURATION = 6 * 3600.0 # 6 hours _SANITIZE_INVALID_SENTINEL = 0.0 # 0 == "no valid expected_duration" def _sanitize_expected_duration( self, raw: Any, *, source: str = "update_match" ) -> float: """Coerce ``raw`` into a finite float in (0, 6h] or return 0.0. The class invariant is that ``self._expected_duration`` is either a finite, strictly positive float ≤ 6 hours, or 0.0 meaning "no valid expected duration". Every code path that assigns ``_expected_duration`` (live profile-match callbacks AND restored snapshots) routes through this helper so the gates in STATE_ENDING and ``_should_defer_finish`` can trust the value without re-validating. Emits a DEBUG log line distinguishing the rejection reason - the ``<= 0`` and ``> 6h`` markers are part of issue #197's regression contract and tests assert on them. """ try: value = float(raw) except (TypeError, ValueError): self._logger.debug( "%s: invalid raw_expected_duration %r, defaulting to 0.0", source, raw, ) return self._SANITIZE_INVALID_SENTINEL if not math.isfinite(value): self._logger.debug( "%s: invalid raw_expected_duration %r, defaulting to 0.0", source, raw, ) return self._SANITIZE_INVALID_SENTINEL if value <= 0: self._logger.debug( "%s: invalid raw_expected_duration %r (<= 0), defaulting to 0.0", source, raw, ) return self._SANITIZE_INVALID_SENTINEL if value > self._SANITIZE_MAX_EXPECTED_DURATION: self._logger.debug( "%s: invalid raw_expected_duration %r (> 6h), defaulting to 0.0", source, raw, ) return self._SANITIZE_INVALID_SENTINEL return value @staticmethod def _sanitize_terminal_quiet(raw: Any) -> float | None: """Coerce a measured post-activity quiet span into a finite, non-negative float, else None (register item 297). Same discipline as the two siblings: None means "no opinion", and for a DISHWASHER ``_keep_tail_cap`` then behaves exactly as it did before this element existed. Other device types never reach that branch - they are capped at ``_last_active_time`` higher up - so None changes nothing for them either way. Bounded above by ``TERMINAL_QUIET_CAP_S`` so a corrupted or hand-edited value cannot license an unbounded tail - the one thing this field exists to prevent. """ if raw is None: return None try: value = float(raw) except (TypeError, ValueError, OverflowError): return None if not math.isfinite(value) or value < 0: return None return min(value, TERMINAL_QUIET_CAP_S) @staticmethod def _sanitize_longest_candidate(raw: Any) -> float: """Coerce the longest plausible candidate duration to a usable bound. Unlike the three siblings above, "no opinion" is ``0.0`` rather than ``None``: the ENDING gate reads a non-positive bound as "no information" and keeps the old refusal, which is the safe direction. Not routed through ``_sanitize_expected_duration`` because 0.0 is legitimate here and that helper logs it as invalid. """ try: value = float(raw or 0.0) except (TypeError, ValueError, OverflowError): return 0.0 if not math.isfinite(value): return 0.0 return value if 0.0 < value <= CycleDetector._SANITIZE_MAX_EXPECTED_DURATION else 0.0 @staticmethod def _sanitize_tail_power(raw: Any) -> float | None: """Coerce ``raw`` into a finite, positive float, else None (#364). None means "no opinion": ``_smart_term_power_plausible`` then leaves both Smart-Termination paths exactly as they behaved before the guard existed. """ if raw is None: return None try: value = float(raw) except (TypeError, ValueError, OverflowError): # OverflowError alongside the type errors: `json` keeps an integer # literal of any length as an unbounded `int`, and `float()` on one # raises rather than returning `inf`, so the non-finite filter below is # never reached. Both callers are the reason it matters - the restored # state snapshot is hand-editable `.storage` JSON, and # `restore_state_snapshot`'s one broad `except` answers a raise with # `self.reset()`, which discards the WHOLE restored cycle rather than # this one field. "No opinion" is the documented contract; a full reset # is not. return None if not math.isfinite(value) or value <= 0: return None return value @staticmethod def _sanitize_terminal_high( raw: Any, ) -> ( tuple[float, float] | tuple[float, float, float] | tuple[float, float, float, float] | None ): """Coerce ``raw`` into a ``(start_frac, seconds)`` pair, a ``(start_frac, seconds, start_offset_s)`` triple, or a ``(start_frac, seconds, start_offset_s, ceiling_w)`` quad, else None (#399). The fourth element is the watts the block was MEASURED against (register item 351). Anti-crease measures against ``anti_wrinkle_max_power`` and sends a triple; the standby-band path measures against a share of the cycle's own peak and must say so, because the live counter has to count seconds above the same bar or the two halves compare different things. None means "no opinion", which leaves ``_anticrease_spin_pending`` inert and the anti-crease finalise exactly as it behaved before the guard existed. The arity is PRESERVED rather than normalised (register item 196). A two-element payload is what a pre-196 state snapshot, an older caller and most tests supply, and it has to keep meaning "no absolute offset, fall back to ``start_frac x expected``" - handing it a fabricated 0.0 offset would make the guard scan the whole cycle. A malformed third element degrades to the pair for the same reason the whole method returns None on garbage: it must never be able to disarm a guard that would otherwise arm. """ if raw is None: return None # A str/bytes is iterable, so `list("11")` is `["1", "1"]` and sanitizes to # (1.0, 1.0) - a scalar string silently ARMING the guard off a malformed # snapshot, which is the one direction this method promises never to go. # Rejected before the iteration so it takes the documented garbage path. if isinstance(raw, (str, bytes, bytearray)): return None try: values = list(raw) except TypeError: return None if len(values) not in (2, 3, 4): return None try: start_frac = float(values[0]) seconds = float(values[1]) except (TypeError, ValueError, OverflowError): # Same reason as _sanitize_tail_power above: an unbounded int raises out # of float(), and a raise here costs the whole restored cycle state. return None if not math.isfinite(start_frac) or not math.isfinite(seconds): return None if not 0.0 <= start_frac <= 1.0 or seconds <= 0: return None if len(values) == 2: return (start_frac, seconds) try: start_offset = float(values[2]) except (TypeError, ValueError, OverflowError): return (start_frac, seconds) if not math.isfinite(start_offset) or start_offset < 0: return (start_frac, seconds) if len(values) == 3: return (start_frac, seconds, start_offset) try: ceiling = float(values[3]) except (TypeError, ValueError, OverflowError): return (start_frac, seconds, start_offset) # A non-positive or non-finite ceiling degrades to the triple rather than # to None: the triple still arms the guard against # ``anti_wrinkle_max_power``, and this method must never be able to # DISARM a guard that would otherwise arm. if not math.isfinite(ceiling) or ceiling <= 0: return (start_frac, seconds, start_offset) return (start_frac, seconds, start_offset, ceiling) def _trailing_mean_power(self, timestamp: datetime, window_s: float) -> float | None: """Time-weighted mean power over the trailing ``window_s``, or None when there are too few samples to judge. Time-weighted (not a plain sample mean) so an irregular reporting cadence - a plug that only pushes on change, so quiet stretches are sparse - cannot bias the result toward whichever regime happened to sample more often. """ window: list[tuple[datetime, float]] = [] for ts, power in reversed(self._power_readings): if (timestamp - ts).total_seconds() > window_s: break window.append((ts, float(power))) window.reverse() # Explicit gap handling (energy-integration rule): a reading held across an # unobserved outage would dominate the trapezoid - e.g. a stale 2000 W sample # 290 s before a 284 s dropout, then 5 W, integrates to ~1000 W though every # observed recent reading is 5 W, wrongly blocking termination. So drop # everything up to and including the most recent outage-sized gap and judge # only the clean contiguous tail, the same ceiling the standby / anti-crease # window scans reject a holed window with. if len(window) >= 2: # O(1) ceiling from the maintained p95 cadence (mirrors energy_gap_threshold_s # = clip(10x cadence, 60, 3600)), NOT _outage_threshold_s() which rebuilds a # NumPy array from every reading - this runs on the per-reading ENDING / # anti-crease path, same reasoning as the gap-free tally at L1006. max_gap = min(3600.0, max(60.0, 10.0 * self._prior_p95_dt)) cut = 0 for i in range(1, len(window)): if (window[i][0] - window[i - 1][0]).total_seconds() > max_gap: cut = i window = window[cut:] if len(window) < SMART_TERM_TAIL_MIN_POINTS: return None span = (window[-1][0] - window[0][0]).total_seconds() if span <= 0: return None energy = 0.0 for (t0, p0), (t1, p1) in zip(window, window[1:]): energy += (p0 + p1) / 2.0 * (t1 - t0).total_seconds() return energy / span def _smart_term_power_plausible(self, timestamp: datetime) -> bool: """Whether the appliance looks like it is actually FINISHING (#364). Both Smart-Termination paths fire at ``elapsed >= 0.98 * expected`` and neither asks whether the machine is still working. When the matcher has locked onto a shorter look-alike profile that anchor lands mid-wash, the cycle is cut in half and the remainder is recorded as a second cycle. The test: compare the trailing mean power against what the matched profile itself draws at its own end. Drawing several times that level is proof we are not at the end of anything - whatever the clock says. Unlike the prefix-landscape guard this needs no longer profile to exist in the pool, so it also covers the reported case where the programme actually running was never trained. Shorten-only and fail-open: any missing input returns True, leaving behaviour identical to before the guard. A False can only ever *block* an early finish - the power-based fallback timeout still ends the cycle. """ tail_power = self._matched_tail_power if tail_power is None or tail_power <= 0: return True mean_power = self._trailing_mean_power(timestamp, self._tail_window_s()) if mean_power is None: return True return mean_power <= tail_power * SMART_TERM_TAIL_MAX_RATIO def _tail_window_s(self) -> float: """Trailing window that covers the same FRACTION of the run as the profile tail it is compared against. A fixed window is not comparable across programme lengths: 300 s is 4% of a cotton wash but a third of a 15-minute spin-and-drain, whose trailing mean would then be the spin itself while its profile tail is the quiet moment after the pump stops. Measured on the full corpus, making this proportional is strictly better at every threshold. """ expected = self._expected_duration if expected <= 0: return SMART_TERM_TAIL_WINDOW_S return min( SMART_TERM_TAIL_WINDOW_S, max(SMART_TERM_TAIL_WINDOW_MIN_S, expected * SMART_TERM_TAIL_WINDOW_FRAC), ) def update_match(self, result: tuple[Any, ...] | list[Any] | Any) -> None: # type: ignore[misc] """Process a match result (synchronously). Can be called by the matcher callback directly or asynchronously. """ # Terminal-tail match freeze (anti-crease, #296). This is the single sink # for ALL match updates - the detector's own _try_profile_match AND the # manager's async 5-min matcher (manager.py calls update_match directly). # Once a washer/dryer with anti-wrinkle enabled is past its expected # duration and has settled into the low-power tumble tail, re-matching on # the growing flat tail drifts the label toward a LONGER near-duplicate (or # flips it ambiguous), which pushes out expected_duration and would block # the anti-crease finalize - the field failure that merges back-to-back # washes. Keep the good pre-tail match instead. Self-correcting: a new # wash's heating burst above anti_wrinkle_max_power leaves the tail regime, # so this stops applying and matching re-arms for the next cycle. if ( self._matched_profile and self._power_readings and self._in_anticrease_freeze(self._power_readings[-1][0]) ): return # Unpack 5 elements (or 4 for backward compatibility if needed, but wrapper is updated) # wrapper returns (name, confidence, duration, phase, is_mismatch) # Or MatchResult object if refactored, but currently wrapper returns tuple. is_match_mismatch = False match_name: str | None = None phase_name: str | None = None confidence: float = 0.0 expected_duration: float = 0.0 ambiguous: bool = False if isinstance(result, (list, tuple)): # type: ignore[misc] result_seq = cast(tuple[Any, ...] | list[Any], result) # Optional 6th element: whether the live match is ambiguous # (top-1 vs top-2 within MATCH_AMBIGUITY_MARGIN). Used to gate the # predictive Smart Termination below. if len(result_seq) >= 6: ambiguous = bool(result_seq[5]) if len(result_seq) >= 5: ( raw_name, raw_confidence, raw_expected_duration, raw_phase_name, raw_mismatch, ) = result_seq[:5] match_name = str(raw_name) if raw_name is not None else None try: confidence = float(raw_confidence) if not math.isfinite(confidence): confidence = 0.0 self._logger.debug("update_match: invalid raw_confidence %r, defaulting to 0.0", raw_confidence) except (TypeError, ValueError): confidence = 0.0 self._logger.debug("update_match: invalid raw_confidence %r, defaulting to 0.0", raw_confidence) expected_duration = self._sanitize_expected_duration( raw_expected_duration, source="update_match" ) phase_name = str(raw_phase_name) if raw_phase_name is not None else None is_match_mismatch = raw_mismatch if isinstance(raw_mismatch, bool) else bool(raw_mismatch) else: # Fallback for old signature if len(result_seq) >= 4: ( raw_name, raw_confidence, raw_expected_duration, raw_phase_name, ) = result_seq[:4] match_name = str(raw_name) if raw_name is not None else None try: confidence = float(raw_confidence) if not math.isfinite(confidence): confidence = 0.0 self._logger.debug("update_match: invalid raw_confidence %r, defaulting to 0.0", raw_confidence) except (TypeError, ValueError): confidence = 0.0 self._logger.debug("update_match: invalid raw_confidence %r, defaulting to 0.0", raw_confidence) expected_duration = self._sanitize_expected_duration( raw_expected_duration, source="update_match" ) phase_name = ( str(raw_phase_name) if raw_phase_name is not None else None ) is_match_mismatch = False # Store confidence + ambiguity for Smart Termination checks self._last_match_confidence = confidence or 0.0 self._match_ambiguous = ambiguous self._match_prefix_ambiguous = bool(result_seq[6]) if len(result_seq) >= 7 else False # Element 8 (#364): the narrower legacy verdict. A shorter tuple # (Playground, older callers, most tests) falls back to the widened # value, which reproduces pre-#364 behaviour exactly. self._match_prefix_ambiguous_full_shape = ( bool(result_seq[7]) if len(result_seq) >= 8 else self._match_prefix_ambiguous ) # Element 9 (#364): the matched profile's own tail power level. Absent # or non-finite leaves the power-plausibility guard inert - so a shorter # tuple (Playground, older callers, most tests) must CLEAR it, not keep # the previous match's value: retaining it would let the guard compare # the live tail against the wrong profile and block a valid termination. self._matched_tail_power = ( self._sanitize_tail_power(result_seq[8]) if len(result_seq) >= 9 else None ) # Element 10 (#399): the matched profile's own terminal high-power # block. Cleared by a shorter tuple for the same reason as element 9 - # keeping the previous profile's block would make the anti-crease guard # wait for a spin the newly-matched program does not have. self._matched_terminal_high = ( self._sanitize_terminal_high(result_seq[9]) if len(result_seq) >= 10 else None ) # Element 11 (register item 297): cleared by a shorter tuple for the same reason as # elements 9 and 10 - a newly matched programme must not inherit the # previous one's tail. self._matched_terminal_quiet_s = ( self._sanitize_terminal_quiet(result_seq[10]) if len(result_seq) >= 11 else None ) # Element 12: longest plausible candidate duration (see the attribute's # own comment). A shorter tuple clears it, like elements 9-11, so a # stale value can never license a shortening for a different match. # Coerced quietly, not through _sanitize_expected_duration: 0.0 is a # legitimate "no candidate durations to compare" here, and that helper # logs it as invalid. self._longest_candidate_duration = self._sanitize_longest_candidate( result_seq[11] if len(result_seq) >= 12 else 0.0 ) else: # Assume MatchResult object or similar (future proofing) # But for now wrapper returns tuple return if is_match_mismatch and self._matched_profile: # Confident non-match - revert to detecting if previously matched self._matched_profile = None self._match_ambiguous = False self._match_prefix_ambiguous = False self._match_prefix_ambiguous_full_shape = False self._matched_tail_power = None self._matched_terminal_high = None self._matched_terminal_quiet_s = None elif match_name: # If sanitization rejected the expected_duration, treat the match # as invalid: setting _matched_profile while _expected_duration is # the 0.0 sentinel would let Smart Termination fire on the # `current_duration >= 0` always-true comparison. Drop both so # the cycle stays in detecting/unmatched mode. if expected_duration == self._SANITIZE_INVALID_SENTINEL: self._logger.debug( "update_match: match %r ignored - expected_duration " "sanitized to invalid sentinel; treating as unmatched", match_name, ) self._matched_profile = None self._expected_duration = self._SANITIZE_INVALID_SENTINEL else: self._matched_profile = match_name # Sub-state can be set from phase_name if available if phase_name: self._sub_state = phase_name # Wrapper provides it self._expected_duration = expected_duration def set_verified_pause(self, verified: bool) -> None: """Set or clear the verified pause flag.""" self._verified_pause = verified def reset(self, target_state: str = STATE_OFF) -> None: """Force reset the detector state to target state.""" self._transition_to(target_state, dt_util.now()) self._power_readings = [] # #430: the pre-roll buffer is pre-CYCLE context, never cross-cycle. A # reset that left it populated would let the previous cycle's tail be # spliced into the front of the next cycle's curve. self._preroll_buffer = [] self._current_cycle_start = None self._last_active_time = None self._cycle_max_power = 0.0 self._ma_buffer = [] self._energy_since_idle_wh = 0.0 self._time_above_threshold = 0.0 # Only reset time_below_threshold if not transitioning to ANTI_WRINKLE # (ANTI_WRINKLE needs to track idle time to determine true-off) if target_state != STATE_ANTI_WRINKLE: self._time_below_threshold = 0.0 self._time_below_threshold_gapfree = 0.0 self._last_match_time = None self._matched_profile = None # Clear stale match state so the next cycle starts with clean defaults. # _expected_duration left at 0 tells the dishwasher end-spike gate that # no profile is matched yet; stale non-zero would mis-gate the spike check. self._expected_duration = 0.0 self._last_match_confidence = 0.0 self._match_ambiguous = False self._match_prefix_ambiguous = False self._match_prefix_ambiguous_full_shape = False self._matched_tail_power = None self._matched_terminal_high = None self._matched_terminal_quiet_s = None # Element 12 belongs with them: its own comment claims a stale value can # never license a shortening for a different match, and that was only # true of the tuple path. Left here across a reset, a small positive # bound survives into the next cycle, where it is neither greater than # `_expected_duration` (so the bar is not raised) nor <= 0 (so the "no # information" refusal does not fire) - the one combination that lets an # ambiguous match shorten `effective_off_delay` on no evidence. self._longest_candidate_duration = 0.0 self._anticrease_spin_wait_logged = False # Per-cycle diagnostic throttle (#346): the "Smart Termination not applied" # line only logs when the reason CHANGES. Carrying the previous cycle's # reason across a reset swallows the new cycle's very first diagnostic # whenever it happens to be blocked for the same reason. self._last_smart_term_block_reason = None self._ignore_power_until_idle = False # Reset lockout self._lockout_high_seconds = 0.0 # Clear the verified-pause flag so it can't leak into the next cycle (B6): # a stale True would make an early low-power dip look like a verified pause # before the first live match of the new cycle runs. self._verified_pause = False self._anti_wrinkle_candidate_start = None self._anti_wrinkle_candidate_peak = 0.0 self._anti_wrinkle_candidate_start_power = 0.0 # Reset idle time tracker for anti-wrinkle self._anti_wrinkle_idle_time = 0.0 # Reset delayed-start tracking self._delay_band_seconds = 0.0 self._delay_band_peak = 0.0 self._delay_wait_true_off_seconds = 0.0 self._starting_paused_off_since = None self._delay_wait_high_start = None @property def state(self) -> str: """Return current state.""" return self._state @property def sub_state(self) -> str | None: """Return current sub-state.""" return self._sub_state @property def config(self) -> CycleDetectorConfig: """Return current configuration.""" return self._config @property def matched_profile(self) -> str | None: """Return the name of the matched profile, if any.""" return self._matched_profile @property def current_cycle_start(self) -> datetime | None: """Return the start timestamp of the current cycle.""" return self._current_cycle_start @property def samples_recorded(self) -> int: """Return the number of power samples recorded in current cycle.""" return len(self._power_readings) @property def expected_duration_seconds(self) -> float: """Return the expected duration of the current cycle in seconds.""" return self._expected_duration @staticmethod def _smart_term_block_reason( current_duration: float, expected: float, smart_ratio: float, is_confident: bool, ambiguous: bool, prefix_ambiguous: bool, power_plausible: bool = True, ) -> str | None: """Why the Smart-Termination fast end-path did NOT fire, for diagnostics. Returns None when the gate would pass, or when no expected duration is known yet (nothing meaningful to report). Mirrors the gate's conditions in order so the first blocking reason is surfaced. Pure and side-effect-free; the detector logs the result (throttled to reason changes) - no behaviour change (#346, extended with "still_active" for #364). """ if expected <= 0: return None if current_duration < expected * smart_ratio: return "duration_not_reached" if not is_confident: return "low_confidence" if ambiguous: return "match_ambiguous" if prefix_ambiguous: return "prefix_ambiguous" if not power_plausible: return "still_active" return None @staticmethod def _resolve_smart_ratio( device_type: str, configured_ratio: float, end_spike_seen: bool, end_spike_duration: float, expected_duration: float, ) -> float: """Resolve the Smart-Termination duration-ratio gate (#393). ``configured_ratio`` is the per-device option, already resolved in the config builder to the device-type default (0.99 dishwasher / 0.98 other) unless the user tuned it - so it is always a real float here. For a dishwasher whose most-recent in-ENDING spike landed at >=90% of the expected duration, that spike is the terminal pump-out (not a mid-cycle rinse drain): once it is confirmed the gate is loosened to the 0.90 pump-out relief, because individual cycles can be a few % shorter than the rolling average and still terminate cleanly. Keeping the configured gate for spikes at <90% prevents premature closes during the passive Dry phase that follows the pre-final-rinse drain. The relief is combined with the configured value via ``min()`` so a configured ratio can only ever LOOSEN the gate, never tighten it. Pure and side-effect-free (unit-testable). """ # Clamp to the documented [0.50, 1.00] range (the WS write path clamps, but a # value persisted by an import or an older schema is read here unclamped): a # 0.0 would drop the duration floor entirely and let Smart Termination fire the # moment its other conditions pass. configured_ratio = min(1.0, max(0.5, configured_ratio)) if ( device_type == "dishwasher" and end_spike_seen and expected_duration > 0 and end_spike_duration >= expected_duration * 0.90 ): return min(configured_ratio, 0.90) return configured_ratio def process_reading( self, power: float, timestamp: datetime, synthetic: bool = False, observed: bool = True, ) -> None: """Process a new power reading using robust dt-aware logic. ``synthetic=True`` marks a reading the *manager* injected rather than one the power sensor sent: the watchdog and anti-wrinkle keepalives, which exist to advance the quiet timers while a change-only plug says nothing. They must keep doing exactly that, so this flag does not change the quiet accumulators. What it does change is the two places that reason about what the SENSOR did (#424): * ``_update_cadence`` is skipped. The cadence estimate feeds ``_gate_cadence`` and therefore the pause/end gates, so training it on our own injections makes those gates a function of how often we inject - see the note on ``_gate_cadence``. * **with ``observed=True``**, the gap-free tally treats the interval as observed, because the watchdog re-anchored on the sensor's live state (``_resync_power_from_state``) before injecting - so the keepalive is a moment we looked rather than a hole in the record. ``observed=False`` says the sensor state could NOT be read when this keepalive was injected (unavailable / unknown / non-finite). The second bullet is then false: the interval it closes is a genuine outage, and the gap-free tally is reset like any other hole - at ANY step size, since the watchdog injects far more often than the outage ceiling. (The `_keep_tail_cap` use this flag was originally added for, register item 238, was implemented, measured and reverted: after ``_last_active_time`` every reading is below the stop threshold anyway, so a plug still reporting cannot separate a drying phase from standby - it only shows the plug is chatty. See item 260 for two more that were measured and rejected.) """ if not synthetic: self._last_real_reading_time = timestamp # Calculate dt (needed by the stop lockout below and the state machine). dt = 0.0 if self._last_process_time: dt = (timestamp - self._last_process_time).total_seconds() # Sanity check for negative dt if dt < 0: # Logged because this is the one exit from process_reading that leaves # NO trace: the accumulators do not advance, `_power_readings` does not # grow, and every downstream gate therefore stays silent too. A cycle # wedged behind it looks exactly like a cycle whose end gate is simply # not satisfied - which is how much of register item 320 was spent. self._logger.debug( "Ignoring reading %.1fW: timestamp %s is %.1fs before the last " "processed reading %s", power, timestamp, -dt, self._last_process_time, ) self._last_process_time = timestamp return # Manual Stop Lockout: # If user/external stop forced an end, ignore the machine's spin-down so # it is not logged as a new cycle. The lockout clears the moment power # drops to idle. As a safety net, if power instead stays high far longer # than any plausible spin-down, treat it as a genuinely new back-to-back # load and release the lockout so the cycle is detected immediately # rather than pinned until the progress-reset window expires (#267). if self._ignore_power_until_idle: if power < self._config.start_threshold_w: self._ignore_power_until_idle = False self._lockout_high_seconds = 0.0 self._logger.debug( "Power dropped below start threshold. Manual stop lockout cleared." ) else: self._lockout_high_seconds += dt if self._lockout_high_seconds < STOP_LOCKOUT_RELEASE_SECONDS: # Still within the spin-down window - ignore reading. # The reading is withheld from the state machine, but it is # still a real observation of the power level, so record it # (#403): the accumulator below judges each interval against # the previous observation, and a release reading compared to # a pre-stop sample up to the full lockout window old would # lose the credit for its own interval (#267 back-to-back # start whose stop happened in a low-power trough). self._last_process_time = timestamp self._last_power = power return self._ignore_power_until_idle = False self._lockout_high_seconds = 0.0 self._logger.info( "Manual stop lockout released after sustained power " "(>= %.1fs at/above start threshold): treating as a new " "cycle (#267).", STOP_LOCKOUT_RELEASE_SECONDS, ) # Fall through: the state machine will start a new cycle. # Snapshot the cadence BEFORE folding this reading in: the gap-free tally # below classifies `dt` against a ceiling derived from the cadence, and an # outage that has already widened p95 would raise the very threshold that # is supposed to catch it (a 120 s gap after a 10 s cadence lifts p95 to # ~15.5 s -> ceiling 155 s -> the gap counts as observed quiet). self._prior_p95_dt = self._p95_dt # Only the SENSOR trains the cadence estimator (#424). The watchdog's 0 W # keepalives exist because the plug fell silent, so once it does every # interval left in `_recent_dts` is one we manufactured: p95 AND the # median both collapse onto the injection spacing, the `5 x median` cap in # `_gate_cadence` stops binding, and the pause/end gates - three times that # cadence - grow with our own injection rate. Measured on the #424 # reporter's v0.5.6 cycle: the gate climbed 192 s -> 530 s on injected # readings alone, taking the end gate to 1605 s and holding PAUSED for # 1060 s. Skipping them leaves the estimate describing the plug, which is # the only thing it is supposed to describe; the accumulators below still # advance on every reading, synthetic or not. if not synthetic: self._update_cadence(dt) self._last_process_time = timestamp # 1b. Pre-roll buffer (#430): record every reading seen while no cycle is # open, so a start that needed several probes can recover what the aborted # ones took with them. Cheap and bounded; inert while the option is off. self._record_preroll(power, timestamp) # 1. Smoothing (Legacy buffer for debug/display, logic uses raw + time accumulators) self._ma_buffer.append(power) if len(self._ma_buffer) > self._config.smoothing_window: self._ma_buffer.pop(0) # 2. Accumulators Update # Hysteresis Logic if self._state in (STATE_OFF, STATE_DELAY_WAIT, STATE_STARTING, STATE_UNKNOWN): threshold = self._config.start_threshold_w else: threshold = self._config.stop_threshold_w is_high = power >= threshold # Last observation carried forward (#403): `dt` is the interval that # ENDED at this reading, so the appliance sat at the PREVIOUS sample's # level for it, not at this one. With a change-only (send-on-delta) # power sensor a low -> high crossing carries the whole idle gap, and # crediting it at the new high power let a single blip after minutes of # silence satisfy both start gates on the next reading. So the interval # only counts as high-power evidence when the previous observation was # also at or above the threshold those gates measure against. A densely # sampled device is unaffected: there the previous sample is already # high and the interval keeps its full credit. # # This is the same principle the surrounding code already applies - the # low branch restarts its gap-free tally rather than credit an outage, # DELAY_WAIT and the paused-STARTING anchor (#306) anchor on the first # high reading, and `integrate_wh`/`energy_gap_threshold_s` drop # outage-sized segments - applied to the one branch that still credited # unobserved time. An outage heuristic cannot substitute for it: a # 511 s gap on a 70 s idle cadence is legitimate change-only silence, # well inside the outage ceiling, and only the credit direction # separates it from real high-power time. # # A reading inside the hysteresis band (>= stop_threshold_w but # < start_threshold_w) therefore earns no evidence toward the start # gates, which is correct: the band is by definition below the # threshold the gates measure against, and it is exactly where a # waiting machine idles. The cost is one extra report before # confirmation on a band-crossing ramp; no start is lost. prev_high = self._last_power is not None and self._last_power >= threshold high_dt = dt if prev_high else 0.0 # ...and the ENERGY for that interval at the level the appliance actually sat # at, which is the same argument applied to the second start gate. Crediting # it at the NEW reading's power let a sample barely above the threshold, # followed by a spike, bank the spike's power for the whole preceding # interval and satisfy start_energy_threshold on its own. Computed here, not # at the three use sites, because `self._last_power` is overwritten a few # lines below - before the two STARTING seeds further down would read it. # The sibling paths already do this: the DELAY_WAIT seed credits at # `start_power` and the anti-wrinkle window uses the trapezoid average. high_step_wh = ( (self._last_power or 0.0) * (high_dt / 3600.0) if high_dt > 0 else 0.0 ) if is_high: self._time_above_threshold += high_dt self._time_below_threshold = 0.0 self._time_below_threshold_gapfree = 0.0 # Energy for the guarded interval, computed with high_dt above. self._energy_since_idle_wh += high_step_wh self._last_active_time = timestamp else: self._time_below_threshold += dt # Gap-free tally: an outage-sized step is unobserved time, so restart # the observed-quiet tally from this sample instead of crediting the # gap. Ceiling mirrors energy_gap_threshold_s (clip(10x cadence, 60, # 3600)) but reuses the maintained p95 cadence to stay O(1) in this # per-reading hot path. Uses the cadence as it stood BEFORE this # reading, so a gap cannot widen its own acceptance threshold. # A synthetic keepalive is normally not an outage: the watchdog # resyncs against the sensor's live state before injecting, so the # interval it closes IS observed. This matters because the ceiling is # derived from the p95 cadence, which synthetic readings no longer # train - without the exemption a 106 s keepalive on a 2 s-cadence # plug would look like a 106 s hole and reset the tally on every # tick, starving the two consumers that can only ever SHORTEN the # wait (the dishwasher end-spike quiet release and the ENDING hard # finalize). # # `observed` is what makes that premise true rather than assumed. # `_resync_power_from_state` returns early when the sensor is # unavailable / unknown / non-finite, but the watchdog injects anyway # - it only checks the silence interval. So during a real telemetry # outage every keepalive was exempt and the gap-free tally grew # through quiet nobody ever saw, which is exactly what that tally # exists not to count. The caller now says whether the sensor state # could actually be read, and an unread sensor is an outage. # An unread sensor is an outage HOWEVER SHORT each keepalive step # is, which is why this is its own clause and not a qualifier on the # ceiling test. The watchdog injects once per `watchdog_interval` # (floor 30 s, effective 30-60 s) and the ceiling is at least 60 s, # so during a real outage every individual `dt` sits under the # ceiling - qualifying the ceiling test left the tally accumulating # exactly as before, which is the bug this is meant to fix. outage_ceiling = min(3600.0, max(60.0, 10.0 * self._prior_p95_dt)) if (synthetic and not observed) or (dt > outage_ceiling and not synthetic): self._time_below_threshold_gapfree = 0.0 else: self._time_below_threshold_gapfree += dt self._time_above_threshold = 0.0 self._time_in_state += dt self._last_power = power anti_wrinkle_active = ( self._config.anti_wrinkle_enabled and self._config.device_type in ( DEVICE_TYPE_WASHING_MACHINE, DEVICE_TYPE_DRYER, DEVICE_TYPE_WASHER_DRYER, ) ) # 3. State Machine if self._state in ( STATE_OFF, STATE_FINISHED, STATE_INTERRUPTED, STATE_FORCE_STOPPED, STATE_ANTI_WRINKLE, ): started_from_anti_wrinkle = False if anti_wrinkle_active and self._state == STATE_ANTI_WRINKLE and is_high: if self._anti_wrinkle_candidate_start is None: self._anti_wrinkle_candidate_start = timestamp self._anti_wrinkle_candidate_peak = power self._anti_wrinkle_candidate_start_power = power else: self._anti_wrinkle_candidate_peak = max( self._anti_wrinkle_candidate_peak, power ) candidate_duration = ( timestamp - self._anti_wrinkle_candidate_start ).total_seconds() exceeds = ( self._anti_wrinkle_candidate_peak > self._config.anti_wrinkle_max_power or power > self._config.anti_wrinkle_max_power or candidate_duration > self._config.anti_wrinkle_max_duration ) if exceeds: candidate_start = self._anti_wrinkle_candidate_start candidate_peak = self._anti_wrinkle_candidate_peak candidate_start_power = self._anti_wrinkle_candidate_start_power self._anti_wrinkle_candidate_start = None self._anti_wrinkle_candidate_peak = 0.0 self._anti_wrinkle_candidate_start_power = 0.0 self._transition_to(STATE_STARTING, timestamp) started_from_anti_wrinkle = True self._current_cycle_start = candidate_start or timestamp # Preserve the anti-wrinkle candidate window instead of dropping ramp-up samples. if candidate_start and candidate_start < timestamp: start_power = candidate_start_power if candidate_start_power > 0 else power self._power_readings = [(candidate_start, start_power), (timestamp, power)] interval_s = (timestamp - candidate_start).total_seconds() avg_power = (start_power + power) / 2.0 self._energy_since_idle_wh = max(0.0, avg_power * (interval_s / 3600.0)) else: self._power_readings = [(timestamp, power)] # Guarded interval (#403): the gap between anti-wrinkle # tumbles was spent at the previous (idle) level. self._energy_since_idle_wh = high_step_wh self._cycle_max_power = max(candidate_peak, power) elif self._state != STATE_ANTI_WRINKLE: self._anti_wrinkle_candidate_start = None self._anti_wrinkle_candidate_peak = 0.0 self._anti_wrinkle_candidate_start_power = 0.0 if self._state == STATE_ANTI_WRINKLE: # Track time in idle (below exit_power threshold) effective_exit = max(self._config.anti_wrinkle_exit_power, self._config.stop_threshold_w) if power < effective_exit: # Low-power gap invalidates any burst candidate collected while in anti-wrinkle. self._anti_wrinkle_candidate_start = None self._anti_wrinkle_candidate_peak = 0.0 self._anti_wrinkle_candidate_start_power = 0.0 self._anti_wrinkle_idle_time += dt anti_wrinkle_end_threshold = max( self._dynamic_end_threshold, float(self._config.anti_wrinkle_idle_timeout), ) if self._anti_wrinkle_idle_time >= anti_wrinkle_end_threshold: self._transition_to(STATE_OFF, timestamp) return else: # Reset idle timer when power rises (burst detected) self._anti_wrinkle_idle_time = 0.0 # Exit conditions: # 1. Idle duration exceeded (handled above), OR # 2. Safety timeout (2 hours in anti-wrinkle), OR # 3. External trigger (user_stop, external triggers handled by manager) if ( self._state_enter_time and (timestamp - self._state_enter_time).total_seconds() > 7200 ): # Safety timeout: 2 hours in anti-wrinkle self._transition_to(STATE_OFF, timestamp) return # Delayed-start "standby band" detection (only from STATE_OFF). # # A machine in delayed-start mode sits in a power band between # the off-noise floor (stop_threshold_w) and the cycle-start # threshold (start_threshold_w) - display, electronics, the # occasional anti-damp tumble - for minutes to hours. We # track anchored elapsed time while power is in that band; once # it crosses delay_confirm_seconds we transition to DELAY_WAIT. # # Brief high-power excursions (menu navigation, button presses) # don't break the candidate: they fall through to the normal # start logic below, and unless they sustain for # start_duration_threshold they get aborted as a false start # and we re-enter the band on the next reading. Excursions # below stop_threshold_w (machine momentarily idle on the noise # floor) DO reset the candidate, because that's the same # signal we use to define "off". if ( self._config.delay_detect_enabled and self._state == STATE_OFF and not started_from_anti_wrinkle and self._config.stop_threshold_w < self._config.start_threshold_w ): in_band = ( self._config.stop_threshold_w <= power < self._config.start_threshold_w ) if in_band: if self._delay_band_start is None: self._delay_band_start = timestamp self._delay_band_seconds = 0.0 else: self._delay_band_seconds = ( timestamp - self._delay_band_start ).total_seconds() self._delay_band_peak = max(self._delay_band_peak, power) if self._delay_band_seconds >= self._config.delay_confirm_seconds: self._logger.info( "Delayed start detected: standby band held for %.0fs " "(peak %.1fW, current %.1fW) → DELAY_WAIT", self._delay_band_seconds, self._delay_band_peak, power, ) self._transition_to(STATE_DELAY_WAIT, timestamp) return # Stay in OFF while we accumulate evidence - do not # fall through to the high-power start logic, the # reading is below threshold by definition. return elif power < self._config.stop_threshold_w: # Machine genuinely idle: forget any band history. self._delay_band_start = None self._delay_band_seconds = 0.0 self._delay_band_peak = 0.0 self._preserve_delay_band_on_off = False # power >= start_threshold_w: fall through to the normal # start path below. If it turns out to be a brief peak, # STATE_STARTING will abort it as a false start and we'll # re-enter the band check on the next sample without # losing accumulated time (we don't reset on a high # excursion - most users' "menu navigation" peaks last # less than a sample interval anyway). if is_high and not started_from_anti_wrinkle: # Transition to STARTING self._preserve_delay_band_on_off = self._delay_band_start is not None self._transition_to(STATE_STARTING, timestamp) self._current_cycle_start = timestamp self._power_readings = [(timestamp, power)] # Seed from the guarded interval (#403), not raw dt: this seed # OVERWRITES the accumulator (it has to - entering STARTING from # a terminal state carries the previous cycle's total), so an # unguarded seed would reinstate the idle gap the accumulator # just declined to credit. self._energy_since_idle_wh = high_step_wh self._cycle_max_power = power self._apply_curve_preroll(timestamp, power) # NOTE: terminal-state expiry (Finished/Interrupted/Force-Stopped -> Off) # is owned solely by the manager (WashDataManager._handle_state_expiry), # which has a wall-clock timer that also fires when a change-only power # sensor stops reporting, plus the opt-in power-based Off (issue #284). # The detector used to auto-expire here after a hardcoded 30 min, but that # duplicated the manager timer (a weaker, per-reading subset) and left the # manager's bookkeeping (progress, clean overlay, notifications) dangling. # ANTI_WRINKLE -> Off is handled by its own idle/timeout logic above. elif self._state == STATE_DELAY_WAIT: if power >= self._config.start_threshold_w: # Power is in cycle-start territory. Require at least # two consecutive high readings spanning # start_duration_threshold real seconds before committing # to STARTING, so a single isolated spike (a heavy menu # interaction, an anti-damp pulse briefly crossing the # threshold) doesn't false-trigger. We anchor on the # FIRST high reading instead of accumulating dt, because # dt to the previous (low) reading is unrelated to how # long the high power has actually persisted. self._delay_wait_true_off_seconds = 0.0 if self._delay_wait_high_start is None: self._delay_wait_high_start = timestamp self._delay_wait_high_power = power else: elapsed_high = ( timestamp - self._delay_wait_high_start ).total_seconds() if elapsed_high >= self._config.start_duration_threshold: self._logger.info( "Delayed start: cycle starting (power %.1fW sustained ≥ %.1fW for %.0fs)", power, self._config.start_threshold_w, elapsed_high, ) self._transition_to(STATE_STARTING, timestamp) start_timestamp = self._delay_wait_high_start or timestamp start_power = self._delay_wait_high_power or power self._current_cycle_start = start_timestamp self._power_readings = [(start_timestamp, start_power)] elapsed_from_anchor = (timestamp - start_timestamp).total_seconds() self._energy_since_idle_wh = ( start_power * (elapsed_from_anchor / 3600.0) if elapsed_from_anchor > 0 else 0.0 ) if timestamp != start_timestamp: self._power_readings.append((timestamp, power)) self._cycle_max_power = max(start_power, power) # #430: the buffer records in DELAY_WAIT too, so the # readings between the anchor and this confirmation exist # and would otherwise be dropped - the curve would span the # confirmation window with two points. Never moves the # anchor forward (see _apply_curve_preroll), and is a no-op # while the option is off, which is the default. self._apply_curve_preroll(timestamp, power) else: # Power dropped back below start threshold - clear the # high-power streak anchor so the next high reading # starts a fresh confirmation window. self._delay_wait_high_start = None self._delay_wait_high_power = None if power < self._config.stop_threshold_w: # Power near zero: machine genuinely turned off, not # just waiting. self._delay_wait_true_off_seconds += dt if self._delay_wait_true_off_seconds >= 30.0: self._logger.info( "Delayed start cancelled: power dropped to off (%.1fW) for %.0fs", power, self._delay_wait_true_off_seconds, ) self._transition_to(STATE_OFF, timestamp) return else: self._delay_wait_true_off_seconds = 0.0 # Safety timeout if ( self._state_enter_time and (timestamp - self._state_enter_time).total_seconds() >= self._config.delay_timeout_seconds ): self._logger.info( "Delayed start timeout after %.0fh → OFF", self._config.delay_timeout_seconds / 3600.0, ) self._transition_to(STATE_OFF, timestamp) elif self._state == STATE_STARTING: self._power_readings.append((timestamp, power)) self._cycle_max_power = max(self._cycle_max_power, power) if is_high: # Power back up - clear any accumulated "true off" hold time. self._starting_paused_off_since = None if self._time_above_threshold >= self._config.start_duration_threshold: if self._energy_since_idle_wh >= self._config.start_energy_threshold: self._transition_to(STATE_RUNNING, timestamp) # Abort if power drops below threshold before confirmation. # Skip the abort when the user has explicitly paused the cycle # (issue #306): a user pause sets verified_pause=True, which signals # that the low power is intentional, not a false start. if not is_high and self._time_below_threshold > 1.0: # 1s grace period if getattr(self, "_verified_pause", False): # User pause holds; wait for Resume Cycle (issue #306). But a # genuinely paused appliance keeps standby power above the stop # threshold - sustained power *below* it means the machine was # switched off, so fall back to OFF rather than pinning STARTING # forever. if power < self._config.stop_threshold_w: # An outage-sized gap since the last reading is NOT observed # quiet (the machine may still be paused, we just lost # telemetry): reset anchor so only genuinely-sampled # sustained-off time can cancel a paused STARTING. if dt > self._outage_threshold_s(): self._starting_paused_off_since = None elif self._starting_paused_off_since is None: # First below-stop reading: anchor the timestamp. # Don't credit the preceding dt interval — we only # know the device is off *now*, not how long before # this sample it went quiet. self._starting_paused_off_since = timestamp observed_off_s = ( (timestamp - self._starting_paused_off_since).total_seconds() if self._starting_paused_off_since is not None else 0.0 ) if observed_off_s >= STARTING_PAUSED_TRUE_OFF_TIMEOUT_SECONDS: self._logger.info( "Paused STARTING cancelled: power off (%.1fW) for " "%.0fs → OFF", power, observed_off_s, ) self._transition_to(STATE_OFF, timestamp) return else: # Power recovered — clear the off anchor. self._starting_paused_off_since = None else: # False start self._logger.debug( "False start detected: power dropped after %.2fs", self._time_above_threshold, ) # Do NOT reset _delay_band_* here — _transition_to(STATE_OFF) will # preserve the band via _preserve_delay_band_on_off if it was set # at STARTING entry (line 838), so a brief high-power peak (menu # navigation) doesn't restart the delayed-start accumulation from zero. self._transition_to(STATE_OFF, timestamp) elif self._state == STATE_RUNNING: self._power_readings.append((timestamp, power)) self._cycle_max_power = max(self._cycle_max_power, power) # Anti-crease finalize (#296): a matched cycle past its expected # duration that has settled into the low-power tumble tail is done - # finalize into anti-wrinkle now instead of letting the periodic # bursts keep reviving RUNNING until a second wash merges in. if self._maybe_finalize_anticrease_tail(timestamp): return # Use dynamic threshold thresh = self._dynamic_pause_threshold if self._time_below_threshold >= thresh: self._try_profile_match(timestamp, force=True) # Refine match on pause self._transition_to(STATE_PAUSED, timestamp) # Periodic profile matching self._try_profile_match(timestamp) # Standby-band stuck finalize (#296): an appliance holding a flat # low standby draw ABOVE stop_threshold never accumulates # _time_below_threshold, so it never reaches PAUSED/ENDING. Detect # the plateau and finalize as a normal completion (so anti-wrinkle # still engages). Cheaply gated on being well past expected before # the window scan runs. if self._is_standby_band_stuck(timestamp): start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() # The plateau sits ABOVE stop_threshold, so it keeps advancing # _last_active_time and the default keep_tail=False trim would NOT # remove it - inflating the stored duration/energy with minutes of # standby. Snap the end back to the last real activity (the last # reading above the plateau ceiling) and drop the trailing plateau. level_ceiling = float(self._cycle_max_power) * STANDBY_BAND_MAX_FRACTION plateau_start_idx = None for i in range(len(self._power_readings) - 1, -1, -1): if float(self._power_readings[i][1]) > level_ceiling: plateau_start_idx = i break if ( plateau_start_idx is not None and plateau_start_idx < len(self._power_readings) - 1 ): self._power_readings = self._power_readings[: plateau_start_idx + 1] self._last_active_time = self._power_readings[-1][0] current_duration = ( self._last_active_time - start_time ).total_seconds() self._logger.info( "Standby-band finalize: flat plateau ~%.1fW (peak %.0fW) held " "past expected %.0fs — appliance finished but holds a standby " "draw above stop_threshold; finalizing (plateau trimmed, " "duration %.0fs).", power, self._cycle_max_power, self._expected_duration, current_duration, ) self._finish_cycle( timestamp, status="completed", termination_reason=TerminationReason.TIMEOUT, keep_tail=False, ) return # Max duration safety if ( self._current_cycle_start and (timestamp - self._current_cycle_start).total_seconds() > 28800 ): # 8h safety self._finish_cycle( timestamp, status="force_stopped", termination_reason=TerminationReason.FORCE_STOPPED, ) elif self._state == STATE_PAUSED: self._power_readings.append((timestamp, power)) # Anti-crease finalize (#296) - see the RUNNING branch. if self._maybe_finalize_anticrease_tail(timestamp): return if is_high: # Resume to RUNNING self._transition_to(STATE_RUNNING, timestamp) else: # Periodic profile matching during pause self._try_profile_match(timestamp) thresh = self._dynamic_end_threshold if self._time_below_threshold >= thresh: self._transition_to(STATE_ENDING, timestamp) elif self._state == STATE_ENDING: self._power_readings.append((timestamp, power)) # Hard cap: ENDING must not run longer than RUNNING's 8 h safety limit. # Without this a standby baseline can hold the state open indefinitely. if ( self._current_cycle_start and (timestamp - self._current_cycle_start).total_seconds() > 28800 ): self._finish_cycle( timestamp, status="force_stopped", termination_reason=TerminationReason.FORCE_STOPPED, ) return # Anti-crease finalize (#296) - see the RUNNING branch. Fires ahead of # the is_high end-spike handling so a sub-max_power tail burst finalizes # into anti-wrinkle instead of reviving RUNNING. if self._maybe_finalize_anticrease_tail(timestamp): return if is_high: start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() is_dishwasher = self._config.device_type == "dishwasher" # Issue #43: only treat this as a *terminal* end spike (which then # pre-arms Smart Termination) when it occurs near the end of the # expected cycle. Mid-cycle spikes - e.g. the dishwasher # wash→drying drain wind-down at ~50% of expected duration - must # not arm smart termination, otherwise the cycle finishes at 99% # of expected *before* the real end-of-cycle pump-out, and that # pump-out is then misread as a brand-new cycle. Without a # matched profile (expected==0) the gating is bypassed so the # legacy "any spike counts" behaviour is preserved for unmatched # cycles (relied on by the dishwasher unmatched-cap path). if ( self._expected_duration <= 0 or current_duration >= self._expected_duration * DISHWASHER_END_SPIKE_MIN_PROGRESS ): self._end_spike_seen = True self._end_spike_duration = current_duration self._logger.debug( "End spike detected (power high in ENDING state, " "%.0fs/%.0fs)", current_duration, self._expected_duration, ) else: self._logger.debug( "Mid-cycle spike in ENDING ignored for end-spike " "tracking (%.0fs < %.0f%% of expected %.0fs)", current_duration, DISHWASHER_END_SPIKE_MIN_PROGRESS * 100, self._expected_duration, ) # Sanity check: if expected_duration is unreasonable (>6 hours), use fallback max_reasonable = 21600.0 # 6 hours effective_expected = self._expected_duration if effective_expected <= 0 or effective_expected > max_reasonable: # Fallback: use current duration + buffer if we've run > 3 hours # (Assumes any cycle over 3 hours running is near completion when in ENDING) if current_duration > 10800: # 3 hours effective_expected = current_duration * 0.99 # Always past threshold self._logger.debug( "End spike check using fallback: expected_duration=%ds is unreasonable, " "using current_duration=%ds as reference", int(self._expected_duration), int(current_duration) ) past_expected = ( effective_expected > 0 and current_duration >= (effective_expected * 0.98) ) # If ENDING has already lasted long enough, treat any power burst as # terminal (applies to all device types). Dishwashers additionally check # proximity to the expected duration. long_ending_tail = self._time_in_state >= 120.0 terminal_spike = long_ending_tail if is_dishwasher: near_expected = ( effective_expected > 0 and current_duration >= (effective_expected * 0.90) ) terminal_spike = near_expected or long_ending_tail if terminal_spike: self._logger.debug( "End spike kept in ENDING (duration %.0fs/%.0fs, time_in_ending %.0fs)", current_duration, effective_expected, self._time_in_state, ) return if past_expected: self._logger.debug( "End spike ignored for state transition (past expected duration %.0fs/%.0fs)", current_duration, effective_expected ) # Stay in ENDING, the spike is recorded but doesn't resume cycle else: # Resume -> RUNNING (spike is genuine mid-cycle activity) self._transition_to(STATE_RUNNING, timestamp) else: # Periodic profile matching during ending self._try_profile_match(timestamp) # --- SMART TERMINATION CHECK --- # If we have a confident profile match and duration meets expectations, # we terminate early (after appropriate debounce), ignoring long arbitrary timeouts. if self._matched_profile: start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() # --- ROBUSTNESS UPGRADE --- # 1. Require higher duration ratio for Smart path # 2. Require debounce to be measured FROM entry into ENDING state # Per-appliance configurable gate (#393): the ratio is resolved # in the config builder to the device-type default (0.99 # dishwasher / 0.98 other) unless the user tuned it, and the # dishwasher pump-out relief is folded in via a pure helper so # the gate logic stays unit-testable (see _resolve_smart_ratio). smart_ratio = self._resolve_smart_ratio( self._config.device_type, self._config.smart_termination_duration_ratio, getattr(self, "_end_spike_seen", False), getattr(self, "_end_spike_duration", 0.0), self._expected_duration, ) is_confident_match = ( getattr(self, "_last_match_confidence", 0.0) >= self._config.match_confidence_threshold ) # Compute the #364 power-plausibility once per reading and reuse it # for the diagnostic reason and the gate below - the helper walks the # trailing window, so calling it two/three times per reading is waste. _power_plausible = self._smart_term_power_plausible(timestamp) # Gate the predictive end on match certainty. # _match_ambiguous: top-1 vs top-2 score gap is too small to # trust the matched profile's expected duration — fall through # to the power-based fallback timeout instead. # _match_prefix_ambiguous: a longer candidate with a similar # shape score exists in the pool. The current trace may be a # prefix of that longer program (e.g. Quick 46 min matched # while the machine is actually running Normal 88 min and # happens to be in a mid-cycle soak dip at the 46-min mark). # Blocking Smart Termination here means a true Quick cycle # waits for the fallback timeout instead of getting an early # close — an acceptable trade-off against the alternative of # splitting a Normal wash into two separate cycle records. # Surface why the fast end-path is (not) firing, throttled to # reason changes so a stuck cycle's cause is visible in the log # without spamming every reading. Pure diagnostic (#346). _block_reason = self._smart_term_block_reason( current_duration, self._expected_duration, smart_ratio, is_confident_match, self._match_ambiguous, self._match_prefix_ambiguous, _power_plausible, ) if _block_reason != self._last_smart_term_block_reason: self._last_smart_term_block_reason = _block_reason if _block_reason is not None: self._logger.debug( "Smart Termination not applied (%s): dur=%.0fs/%.0fs conf=%.2f " "ambiguous=%s prefix_ambiguous=%s trailing_power=%s profile_tail=%s", _block_reason, current_duration, self._expected_duration * smart_ratio, getattr(self, "_last_match_confidence", 0.0), self._match_ambiguous, self._match_prefix_ambiguous, self._trailing_mean_power(timestamp, self._tail_window_s()), self._matched_tail_power, ) if ( current_duration >= (self._expected_duration * smart_ratio) and is_confident_match and not self._match_ambiguous and not self._match_prefix_ambiguous # #364: the clock says "done", but if we are still drawing # several times what this profile draws at its own end, the # match is a shorter look-alike and we are mid-wash. Block; # the power-based fallback timeout decides instead. and _power_plausible ): # Dynamic confirmation window if self._config.device_type == "dishwasher": # Fixed - NOT off_delay-derived. off_delay is sized to # bridge the long drying "pause", but must not delay the # end; see DISHWASHER_SMART_TERMINATION_DEBOUNCE_SECONDS. smart_debounce = DISHWASHER_SMART_TERMINATION_DEBOUNCE_SECONDS elif self._config.device_type in ( DEVICE_TYPE_WASHING_MACHINE, DEVICE_TYPE_WASHER_DRYER, ): # Washing machines and washer-dryers have soak and # rinse gaps that can dip for several minutes between # programme phases. Require quiet time equal to half # the soak-bridging min_off_gap before committing # Smart Termination, so a near-duplicate profile # doesn't cut a long cycle short during a mid-cycle # power trough. Bounded above so a large suggested / # hand-set min_off_gap can't inflate the quiet-time # requirement and starve end-detection (see # WASHER_SMART_TERMINATION_DEBOUNCE_MAX_SECONDS). smart_debounce = min( WASHER_SMART_TERMINATION_DEBOUNCE_MAX_SECONDS, max(180.0, self._config.min_off_gap * 0.5), ) else: smart_debounce = 120.0 if self._time_in_state >= smart_debounce: # --- END SPIKE WAIT PERIOD (Dishwashers) --- # Dishwashers should see the real end-of-cycle # pump-out (which arms _end_spike_seen via the 85% # progress gate) before Smart Termination fires - # otherwise the pump-out arrives AFTER the cycle # has already closed and registers as a brand-new # "ghost" cycle. User reports (issue #43) showed # the original 5-min past_wait_period escape hatch # closing the cycle ~4 min before the real pump-out # at ~99.5% of expected. Widen the escape hatch # substantially (DISHWASHER_END_SPIKE_WAIT_SECONDS, # currently 30 min past expected) so it cannot # short-circuit a pump-out that fires within a # reasonable window around expected end, but still # guarantees the cycle terminates eventually for # dishwashers that have no pump-out at all. end_spike_seen = getattr(self, "_end_spike_seen", False) # Release the pump-out wait once EITHER the cycle has run # DISHWASHER_END_SPIKE_WAIT_SECONDS past its expected # duration OR it has already reached its expected duration # AND power has since stayed sustained-quiet for # DISHWASHER_END_SPIKE_QUIET_RELEASE_SECONDS. The second arm # closes cycles that finish shorter than the profile's # (drifted-up) average and whose terminal pump-out lands # *before* the drop into ENDING, so no in-ENDING end-spike # ever arms - without it they hang to the fallback timeout # (~30-44 min late) and their label can even drift to a longer # near-duplicate profile. It is gated on # ``current_duration >= expected`` so it can NOT fire during a # long passive-drying phase that precedes a genuinely-late # pump-out (e.g. an ECO cycle quiet from 50%-99% of expected): # while still short of expected the cycle keeps waiting, and a # real pump-out at ~99% arms the end-spike first. Takes the # SOONER of the two anchors, so it can only ever shorten the # wait, never extend it. _spike_wait = self._dishwasher_end_spike_wait_s() past_wait_period = current_duration >= ( self._expected_duration + _spike_wait ) or ( current_duration >= self._expected_duration and self._time_below_threshold_gapfree >= self._config.dishwasher_end_spike_quiet_release ) if ( self._config.device_type == "dishwasher" and not end_spike_seen and not past_wait_period ): self._logger.debug( "Waiting for end spike (duration %.0fs, " "expected %.0fs + %.0fs wait)", current_duration, self._expected_duration, _spike_wait, ) return # Don't finish yet, wait for spike self._logger.info( "Smart Termination: Profile '%s' match confirmed (duration %.0fs, " "conf %.2f, spike_seen=%s), ending.", self._matched_profile, current_duration, getattr(self, "_last_match_confidence", 0.0), end_spike_seen, ) # Keep tail when smart terminating (matches profile # duration), but only as far as the program can # actually reach - see _keep_tail_cap (#424). self._finish_cycle( timestamp, status="completed", termination_reason=TerminationReason.SMART, keep_tail=True, tail_cap=self._keep_tail_cap(start_time), ) return # --- DURATION-ANCHORED HARD FINALIZE (backstop) --- # Separate safety net for a matched cycle whose Smart # Termination is blocked (ambiguous / prefix-ambiguous match) # and whose fallback energy gate is held open by a low standby # baseline: without this it sits in ENDING until the 8 h cap / # zombie-kill (#296/#311). Fires only well past the expected # duration AND after a long *continuous* sub-threshold span, so # it can never truncate a longer program mismatched to a shorter # profile (a real longer program has high-power phases that keep # resetting the quiet timer) — asymmetric, shorten-only. Not # for user-paused cycles. required_quiet = max( self._ending_hard_finalize_quiet_s(), float(max(self._config.off_delay, self._config.min_off_gap)), ) # Require the required_quiet tail to be actually SAMPLED (no # outage-sized gap): otherwise a telemetry outage that inflated # _time_below_threshold could finalize an active cycle early. # Walk in reverse so we can capture the boundary reading (the # first reading outside the window) — an outage right before the # window would be invisible if we only passed in-window timestamps. quiet_ts: list[datetime] = [] _boundary_q: datetime | None = None for _ts, _ in reversed(self._power_readings): if (timestamp - _ts).total_seconds() <= required_quiet: quiet_ts.append(_ts) elif quiet_ts: _boundary_q = _ts break if _boundary_q is not None: quiet_ts.append(_boundary_q) if ( self._expected_duration > 0 and current_duration >= self._expected_duration * ENDING_HARD_FINALIZE_RATIO and self._time_below_threshold >= required_quiet and not self._verified_pause and not self._window_has_outage_gap(quiet_ts) ): self._logger.info( "Duration-anchored finalize: cycle in ENDING at %.0fs " "(%.1fx expected %.0fs), quiet %.0fs — Smart Termination " "was blocked (ambiguous=%s prefix=%s); finalizing.", current_duration, current_duration / self._expected_duration, self._expected_duration, self._time_below_threshold, self._match_ambiguous, self._match_prefix_ambiguous, ) self._finish_cycle( timestamp, status="completed", termination_reason=TerminationReason.TIMEOUT, keep_tail=False, ) return # --- FALLBACK TIMEOUT CHECK --- # Rule: To separate cycles, we must wait at least min_off_gap. effective_off_delay = max(self._config.off_delay, self._config.min_off_gap) # Progress-aware shortening (register item 306). `min_off_gap` is # there to bridge mid-cycle soak periods; once the run is past the # matched programme's OWN expected length there is no soak left to # bridge, so continuing to wait out a blind per-device prior just # reports the end late. # # Measured on `devtools/end_gate_eval.py`, which IS committed. # **`cycle_data/` is not**, so every n below depends on the local # corpus and two different counts get quoted: cycles REPLAYED, # and the subset that reached an ENDING exit, which is the only # one that yields a lag and is what the harness table's `n` # column reports. Current corpus: 273 replayed, 263 measured. # Figures attributed below to "211/221" predate the #445 / #427 / # #424 reporter exports being added mid-PR-#448, when the same # corpus was 221 replayed / 211 measured. They are the same # harness over a smaller corpus, not a drift. # # Re-cut on the current corpus (`--no-shortening` vs shipped, # paired over 273 cycles): median end lag 13.43 -> 12.00 min # overall and 27.50 -> 26.00 for washing machines, dishwasher p90 # 33.50 -> 19.70, and early ends (1.14% / 0.00%) and splits # (2.66%) **identical in every scope**. It moves 32 of 273 # cycles: it buys little because it reaches few, and it costs # nothing. Item 306's original figures (427 cycles, washing # machines 12.9 -> 7.5 min, splits 3.75%) came from a harness # that was never committed and **do not reproduce**; the safety # half reproduces exactly. Treat the 427-cycle numbers as # unverified; register item 329 holds that reconciliation, taken # on the 211-measured corpus. Re-cut anything new with # `end_gate_eval.py` rather than a throwaway script. # # Asymmetric and bounded, in the same spirit as _keep_tail_cap: it # can only ever shorten, keeps the user's explicit `off_delay` as # the floor (only the blind prior shrinks), and is inert when # nothing matched. The bar it waits for is DEVICE-RESOLVED, not a # fixed 1.05x (register item 355): `resolve_end_gate_late_ratio` # returns 0.90 for `washing_machine` / `washer_dryer` and # `END_GATE_LATE_RATIO` (1.05) for everything else - so on a washer # the shortening starts BEFORE the expected end. That is the point: # a washer's programme is load-adaptive, so a run sits below its # profile mean about half the time by definition and the median # washer reaches only 0.83 of a 1.05 bar, which put the rule out of # reach for the device type that needed it most. Early ends stayed # at 0.00% for washers at every ratio measured; the dishwashers, # which do produce early ends below 1.0, keep 1.05. # Gated on the SAME guards Smart Termination respects. The rule # keys on `_expected_duration`, so it must not fire while the # matcher says that duration is in doubt: `_match_prefix_ambiguous` # means a much longer look-alike is still plausible, and then "past # the expected end" may really be "mid-soak in a longer programme". # Without this the fallback timeout walks straight through the # prefix-landscape guard and re-opens the #288 split-cycle bug - # caught by test_smart_termination_blocked_by_prefix_ambiguous, # where a 450 s soak dip sits right at the short profile's end. # NOT also gated on `_last_match_confidence >= # match_confidence_threshold`, and that is deliberate, not an # oversight - the paragraph above says "the SAME guards Smart # Termination respects" and means the two ambiguity flags. # Smart Termination does check confidence, because it ENDS a cycle # early on a prediction; this rule only shortens a wait that is # already past the programme's own expected end, so the asymmetry # is intended. Adding the check was tried (PR #448 round 6) and # measured on `devtools/end_gate_eval.py` over 221 replayed real # cycles (211 of them measurable, the pre-reporter-export corpus # described above): it moves **2 of them**, delaying one by 10.5 # min and one by 21 min, while early ends (1.42% / 0.00% at the >1 # and >5 min marks) and splits (3.32%) stay **exactly** where they # were. It # prevented no split and no early end - pure cost, so it was # reverted. The corpus carries only 4 matched cycles under 0.4 # confidence, so it cannot prove the guard harmless either; the # exposure is real (cycle `7c4598310016` is a 3h37m wash matched at # 0.372 to a profile named "1:07", i.e. running the shortened gate # for over two hours) and it still did not split. Re-run the # harness before re-litigating this. if ( self._matched_profile and self._expected_duration > 0 and self._current_cycle_start is not None ): _elapsed = (timestamp - self._current_cycle_start).total_seconds() # The bar this run has to clear. Normally the matched # programme's own expected end; while the matcher still thinks # a materially LONGER programme is plausible, that longer one's # end instead (register item 330). # # Blocking outright on the two ambiguity flags - which is what # this did until item 330 - was costing almost every cycle the # shortening. Measured on `devtools/end_gate_eval.py`: of the # 94 cycles that ever pass 1.05x their own expected duration, # **84 (89%) were blocked by an ambiguity flag**, so the rule # reached 4.7% of cycles (10 of the 211 measurable on the # pre-reporter-export corpus) and the median cycle still # waited out the full `min_off_gap`. # # The flags are not wrong, they are too coarse. Both exist to # protect `_expected_duration` against "this is really a prefix # of something longer" (#288 / #364) - a statement about # DURATION, not about which label wins. Two programmes that # score within the ambiguity margin and run the same length # leave "past the expected end" true either way. So instead of # refusing, raise the bar to the longest duration still in # play: past THAT, no candidate is left for this to be a # mid-soak of, which is exactly the condition the guard was # standing in for. # # Absent information keeps the OLD refusal. A caller that does # not send element 12 (an older Playground, most tests, any # short tuple) leaves `_longest_candidate_duration` at 0.0, # and an ambiguous match with no candidate durations to # compare must block exactly as it did before - otherwise the # #288 split-cycle reproduction # `test_smart_termination_blocked_by_prefix_ambiguous` walks # straight through, which is how the first draft of this was # caught. _bar = self._expected_duration _blocked = False _bar_raised = False if self._match_prefix_ambiguous or self._match_ambiguous: if self._longest_candidate_duration > _bar: _bar = self._longest_candidate_duration _bar_raised = True elif self._longest_candidate_duration <= 0.0: # No information: a caller that does not send element # 12 keeps the old refusal (see below). The bound # itself is now derived from the FULL candidate # population, the same one `_match_prefix_ambiguity` # judges, so a longer candidate ranked sixth or lower # can no longer set the flag while hiding from the # bar - which it could when this read # `MatchResult.candidates`, i.e. `candidates[:5]`. _blocked = True # Device-resolved (register item 355): 1.05 is out of reach # for a load-adaptive washer, which reaches a median 0.83 of # its EXPECTED duration before it stops. # # **But never against a RAISED bar.** When the match is # ambiguous and a longer candidate exists, `_bar` is no longer # the expected duration - it is the longest plausible # programme, and it was raised precisely to say "a much longer # look-alike is still on the table, so past the expected end # does not mean done". Discounting that by 0.90 would shorten # the wait 10% BEFORE the candidate it represents could even # finish, and on the shipped washer defaults that drops the # wait from `min_off_gap` to `max(off_delay, 300)` - one quiet # interval away from finalising mid-programme and recording the # rest as a second cycle, which is #288. The item-355 measurement # was taken against the expected duration and says nothing about # this case, so a raised bar keeps the original 1.05. _late_ratio = ( END_GATE_LATE_RATIO if _bar_raised else resolve_end_gate_late_ratio(self._config.device_type) ) if not _blocked and _elapsed >= _late_ratio * _bar: effective_off_delay = max( self._config.off_delay, min(self._config.min_off_gap, END_GATE_LATE_SECONDS), ) # Energy gate always looks back off_delay seconds by default; # overridden below for the dishwasher cap case so the window # is consistent with the shortened effective_off_delay. gate_window = self._config.off_delay # Dishwasher-specific: after a terminal end spike (pump-out), an # unmatched cycle doesn't need to wait the full min_off_gap (up to # 9000s) before closing. Cap at 30 min so cycle 3 ends cleanly # ~30 min after the pump-out rather than sitting open for hours. if ( self._config.device_type == "dishwasher" and not self._matched_profile and self._end_spike_seen ): effective_off_delay = min(effective_off_delay, 1800) gate_window = effective_off_delay # Opt-in terminal-drop fast finalize (asymmetric, shorten-only): # a hard cliff-to-~0 sustained for TERMINAL_DROP_OFF_DELAY_SECONDS # that began earlier than this device has ever legitimately gone # quiet is almost certainly a real stop (plug pulled / cancelled), # not a soak. Finalize now instead of waiting out the full # soak-bridging min_off_gap. Only consulted when there is a longer # wait to shorten and the provider is wired (ML/anomaly opt-in); # the energy/defer gates are bypassed because the sustained sub- # threshold span already proves the appliance is off, and the # anomaly check has ruled out a legitimate early pause. if ( self._terminal_drop_provider is not None and not self._verified_pause and effective_off_delay > TERMINAL_DROP_OFF_DELAY_SECONDS and self._time_below_threshold >= TERMINAL_DROP_OFF_DELAY_SECONDS and self._is_terminal_drop() ): start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() self._logger.info( "Terminal drop: anomalously-early power cliff after %.0fs " "(device never quiet this early) - finalizing without the " "full %.0fs soak wait.", current_duration, effective_off_delay, ) self._finish_cycle( timestamp, status="interrupted", termination_reason=TerminationReason.TERMINAL_DROP, keep_tail=False, ) return if self._time_below_threshold >= effective_off_delay: # Walk from the tail — readings are chronological so we can # break as soon as we exceed the gate window (O(window) not O(n)). recent_window = [] for r in reversed(self._power_readings): if (timestamp - r[0]).total_seconds() <= gate_window: recent_window.append(r) else: break recent_window.reverse() if not recent_window: # Check deferred finish for matched profiles start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() if self._should_defer_finish(current_duration): return # For dishwashers, use the timeout timestamp as end_time # (keep_tail=True) so that the stored cycle duration includes # the passive drying phase. Without this, end_time snaps back # to _last_active_time which may be set by a terminal drain # spike mid-ENDING, producing a falsely short cycle duration. keep_tail = self._config.device_type == "dishwasher" self._finish_cycle( timestamp, status="completed", keep_tail=keep_tail, tail_cap=self._keep_tail_cap(start_time), ) return # Compute energy in recent window recent_ts = np.array([r[0].timestamp() for r in recent_window]) recent_p = np.array([r[1] for r in recent_window]) max_gap_s = energy_gap_threshold_s(recent_ts) recent_e = integrate_wh(recent_ts, recent_p, max_gap_s=max_gap_s) if recent_e <= self.config.end_energy_threshold: start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() if self._should_defer_finish(current_duration): return keep_tail = self._config.device_type == "dishwasher" self._finish_cycle( timestamp, status="completed", keep_tail=keep_tail, tail_cap=self._keep_tail_cap(start_time), ) else: self._logger.debug( "Cycle ending prevented by energy gate: %.4fWh > %.4fWh", recent_e, self._config.end_energy_threshold, ) def _record_preroll(self, power: float, timestamp: datetime) -> None: """Buffer a reading seen before a cycle commits (#430). Only while no cycle is open - once RUNNING, ``_power_readings`` is the curve and this buffer would just duplicate it. STARTING counts as "not open": a probe in STARTING may still abort, and those are precisely the readings worth keeping. Bounded by ``curve_preroll_seconds`` (itself capped at ``CURVE_PREROLL_MAX_SECONDS``), so the buffer holds seconds of data, not an unbounded history. """ window = effective_curve_preroll_seconds(self._config.curve_preroll_seconds) if window <= 0: # Option off: keep the buffer empty rather than paying to fill one # nothing will read, and so that enabling it mid-run cannot splice in # readings from before the option was turned on. if self._preroll_buffer: self._preroll_buffer = [] return if self._state not in ( STATE_OFF, STATE_STARTING, STATE_DELAY_WAIT, STATE_UNKNOWN, ): return self._preroll_buffer.append((timestamp, float(power))) cutoff = timestamp - timedelta(seconds=window) # Readings arrive in order, so the stale prefix is contiguous. drop = 0 for ts, _p in self._preroll_buffer: if ts < cutoff: drop += 1 else: break if drop: del self._preroll_buffer[:drop] def _preroll_for_commit( self, timestamp: datetime, power: float ) -> list[tuple[datetime, float]]: """Readings to prepend to a cycle committing at ``timestamp`` (#430). Walks the buffer backwards from the commit and stops at the first quiet gap longer than ``PREROLL_CHAIN_BREAK_SECONDS`` - "the same start, probed twice" rather than "an unrelated blip earlier". Then anchors on the EARLIEST reading in that chain that is at or above ``start_threshold_w``: anchoring on the window edge instead would drag standby into the curve and move the cycle start to a moment the appliance was not yet doing anything. Returns [] whenever there is nothing to add, so the caller's fast path is a single emptiness test. """ window = effective_curve_preroll_seconds(self._config.curve_preroll_seconds) if window <= 0 or not self._preroll_buffer: return [] # Everything strictly before this commit, most recent first. prior = [(ts, p) for ts, p in self._preroll_buffer if ts < timestamp] if not prior: return [] chain: list[tuple[datetime, float]] = [] next_ts = timestamp for ts, p in reversed(prior): if (next_ts - ts).total_seconds() > PREROLL_CHAIN_BREAK_SECONDS: break chain.append((ts, p)) next_ts = ts if not chain: return [] chain.reverse() # chronological threshold = float(self._config.start_threshold_w) anchor = next( (i for i, (_ts, p) in enumerate(chain) if p >= threshold), None ) if anchor is None: return [] # the chain is all standby - nothing of this cycle in it return chain[anchor:] def _apply_curve_preroll(self, timestamp: datetime, power: float) -> None: """Prepend buffered pre-commit readings to the freshly-started cycle (#430). Moves ``_current_cycle_start`` back with them, and that is not optional: the stored duration is ``end_time - _current_cycle_start`` while matching resamples ``_power_readings``, so a curve that started earlier than the pointer would describe a different run from the one whose duration is recorded. The two existing back-anchors (the anti-wrinkle candidate window and the DELAY_WAIT high-start anchor) move the pointer for exactly the same reason. **Record-only: this must never make a cycle easier to START.** ``_energy_since_idle_wh`` is deliberately left alone. Despite the name it is not the cycle's energy - the stored figure is integrated from ``power_data`` at persistence, so it picks the pre-roll up for free - it is the accumulator the STARTING -> RUNNING gate reads (``>= start_energy_threshold``). Feeding it the pre-roll would let an aborted probe's energy be re-spent on the next probe's start gate, so two blips that each failed the gate could together pass it: exactly the phantom cycle #403 was fixed to prevent. The same argument covers ``_time_above_threshold``, which is likewise untouched. ``_cycle_max_power`` IS updated, because that is a property of the run being recorded (it gates the anti-crease path), not of admitting it. """ preroll = self._preroll_for_commit(timestamp, power) if not preroll: return start_ts = preroll[0][0] # Callers do not all commit with the pointer at ``timestamp``. The # DELAY_WAIT confirmation has already back-anchored it to its first # sustained-high reading, and a pre-roll window shorter than # ``start_duration_threshold`` would otherwise move that pointer FORWARD # and shorten the delayed start. So keep whatever the caller anchored # before the chain, and only ever move the pointer earlier. earlier = [(ts, p) for ts, p in self._power_readings if ts < start_ts] self._power_readings = [*earlier, *preroll, (timestamp, power)] self._current_cycle_start = min( start_ts, self._current_cycle_start or start_ts ) self._cycle_max_power = max(p for _ts, p in self._power_readings) self._logger.debug( "Curve pre-roll: carried %d reading(s) covering %.0fs from aborted " "start probe(s) into this cycle (start moved back to %s).", len(preroll), (timestamp - start_ts).total_seconds(), start_ts.isoformat(), ) def _transition_to(self, new_state: str, timestamp: datetime) -> None: """Handle state transitions.""" if self._state == new_state: return old_state = self._state self._state = new_state self._state_enter_time = timestamp self._time_in_state = 0.0 self._sub_state = new_state.capitalize() # Default substate # Bound each ENDING episode's ML-guard deferral independently: clear the # tracker whenever we are not in ENDING (e.g. on resume back to RUNNING). if new_state != STATE_ENDING: self._ml_defer_start_duration = None # Reset energy accumulator on transition to OFF if new_state == STATE_OFF: self._energy_since_idle_wh = 0.0 # Also reset idle time tracker when leaving ANTI_WRINKLE self._anti_wrinkle_idle_time = 0.0 if not self._preserve_delay_band_on_off: self._delay_band_start = None self._delay_band_seconds = 0.0 self._delay_band_peak = 0.0 self._delay_wait_true_off_seconds = 0.0 self._delay_wait_high_start = None self._delay_wait_high_power = None self._preserve_delay_band_on_off = False # Clear the paused-STARTING true-off accumulator so a later STARTING # cycle cannot inherit stale hold time and finalize to OFF prematurely # (this path is also reached via the paused-STARTING cancellation). self._starting_paused_off_since = None # Reset end spike tracker when entering ENDING state if new_state == STATE_ENDING: self._end_spike_seen = False self._end_spike_duration = 0.0 elif new_state == STATE_DELAY_WAIT: # Band-accumulation tracker already played its role getting us # here; reset it so a future OFF→band cycle starts fresh. self._delay_band_start = None self._delay_band_seconds = 0.0 self._delay_band_peak = 0.0 self._delay_wait_true_off_seconds = 0.0 self._delay_wait_high_start = None self._delay_wait_high_power = None self._sub_state = "Waiting to Start" self._preserve_delay_band_on_off = False elif new_state == STATE_ANTI_WRINKLE: self._anti_wrinkle_candidate_start = None self._anti_wrinkle_candidate_peak = 0.0 self._anti_wrinkle_candidate_start_power = 0.0 self._anti_wrinkle_idle_time = 0.0 # Reset idle time when entering ANTI_WRINKLE self._sub_state = "Anti-Wrinkle" elif new_state == STATE_STARTING: # Reset idle time if exiting ANTI_WRINKLE to STARTING (high-power burst resumed) self._anti_wrinkle_idle_time = 0.0 # Fresh STARTING cycle: never inherit a prior cycle's true-off hold. self._starting_paused_off_since = None elif new_state == STATE_RUNNING: self._delay_band_start = None self._delay_band_seconds = 0.0 self._delay_band_peak = 0.0 self._preserve_delay_band_on_off = False self._logger.debug("Transition: %s -> %s at %s", old_state, new_state, timestamp) self._on_state_change(old_state, new_state) def _ml_end_confidence(self) -> float | None: """P(the current low-power event is the true end) from the opt-in ML guard. Builds the offset-second trace from the current cycle's readings and asks the injected provider. Returns None when there is no provider, no cycle start, or the provider declines (ML off / unmatched / model unavailable), so the caller keeps the existing power/energy-based behavior. """ provider = self._end_confidence_provider start = self._current_cycle_start if provider is None or start is None or not self._power_readings: return None # Throttle: reuse the last result within the recompute window, but only when # it was computed for THIS cycle and the same expected_duration (which can # change under overrun) — otherwise recompute. now_ts = self._power_readings[-1][0] exp = float(self._expected_duration) cache = self._ml_end_cache if ( cache is not None and cache[1] == exp and cache[2] == start and (now_ts - cache[0]).total_seconds() < ML_PROVIDER_THROTTLE_SECONDS ): return cache[3] points = [ ((ts - start).total_seconds(), float(power)) for ts, power in self._power_readings ] try: result = provider(points, exp) except Exception: # noqa: BLE001 - ML must never break detection result = None self._ml_end_cache = (now_ts, exp, start, result) return result def _window_has_outage_gap(self, window_ts: list[datetime]) -> bool: """Whether a 'sustained window' contains a data-outage-sized hole. The span + coverage checks in the standby / anti-crease window scans accept e.g. three readings spanning the window even if a long unobserved gap sits between them (a sensor dropout, or a sparse burst next to one old reading). Finalizing on such a window could wrongly cut an active cycle, so reject it. The gap ceiling is the sensor's own data-driven outage threshold (``energy_gap_threshold_s`` over the full trace), so a change-only sensor's legitimately-sparse stable stretches (tens of seconds between reports) are NOT rejected while a genuine dropout is. """ if len(window_ts) < 2: return True # too few points to trust as a sustained window max_gap = self._outage_threshold_s() ordered = sorted(t.timestamp() for t in window_ts) return any((b - a) > max_gap for a, b in itertools.pairwise(ordered)) def _outage_threshold_s(self) -> float: """Sensor-adaptive gap ceiling (seconds): intervals longer than this are treated as telemetry outages, not observed quiet. Data-driven from the trace's own cadence (`energy_gap_threshold_s`), so a change-only sensor's sparse-but-real stable stretches are not mistaken for a dropout. """ all_ts = np.array( [r[0].timestamp() for r in self._power_readings], dtype=float ) return energy_gap_threshold_s(all_ts) def _is_standby_band_stuck(self, timestamp: datetime) -> bool: """Whether a RUNNING cycle is stuck on a flat standby plateau (#296). Returns True only when ALL of the following hold, so this can never end an active low-power phase: * the device is a wet appliance where a stuck baseline is unambiguously anomalous (``STANDBY_BAND_FINALIZE_DEVICE_TYPES``); * a profile is matched and elapsed >= ``STANDBY_BAND_MIN_RATIO`` x the expected duration (well past when it should have ended); * not user-paused; * the most recent >= ``STANDBY_BAND_WINDOW_S`` of readings are ALL at or below ``STANDBY_BAND_MAX_FRACTION`` of the cycle's own peak power AND span no more than ``STANDBY_BAND_FLATNESS_FRACTION`` of the peak (a flat plateau, not fluctuating activity). The expensive window scan runs only after the cheap duration gate passes, so normal cycles never pay for it. """ if self._config.device_type not in STANDBY_BAND_FINALIZE_DEVICE_TYPES: return False if getattr(self, "_verified_pause", False): return False if not (self._matched_profile and self._expected_duration > 0): return False start = self._current_cycle_start if start is None: return False current_duration = (timestamp - start).total_seconds() if current_duration < self._expected_duration * STANDBY_BAND_MIN_RATIO: return False # #399 interaction, load-bearing since the gate above dropped from 2.0x to # 1.0x expected (#445): a washer can sit quiet below anti_wrinkle_max_power # for minutes BEFORE its final spin, and that quiet is a flat sub-10%-of-peak # plateau like any other. Finalising there is exactly the failure #399 fixed # - the spin then arrives and opens a second cycle record. Defer while the # matched profile still owes this run its terminal high-power block. Shares # the predicate with the anti-crease finalise so the two release together, # and it fails open on every missing input (no profile block, non-terminal # block, past the ANTI_CREASE_SPIN_WAIT_MAX_RATIO cap), so an appliance that # never spins - the #445 Miele, which has no terminal block at all - is not # delayed by it. # # **This used to be inert on the devices it exists for (register item # 351).** `_anticrease_spin_pending` needs element 10, and the manager # supplied it only when `anti_wrinkle_enabled` was true - # `DEFAULT_ANTI_WRINKLE_ENABLED` is False, so on a washer the predicate # returned False immediately and none of the above happened. Measured on # the 273-cycle replay corpus: the band fired 14 times, 11 with the guard # inert, and 6 of those 11 had a reading above `min_power` still ahead, # i.e. would split. `terminal_high_for_guards` (module level in this file, # shared by the manager's live match tuple and the Playground's sim tuple # since round 31 - it used to be two hand-copies) now arms it for # `STANDBY_BAND_FINALIZE_DEVICE_TYPES` against a share of the cycle's own # peak - the same `STANDBY_BAND_MAX_FRACTION` used below, so the rule is # "wait while the profile still owes a block above the plateau you are # sitting on" and there is no new tunable. The bar travels WITH the block # as element 4, because `_high_power_seconds_since` has to count live # seconds above the same number. # # Measured end to end on `devtools/end_gate_eval.py`: washing-machine # splits 4.49% -> 1.90%, median end lag 26.00 -> 24.74 min (it does not # cost time - a cycle that used to split now finishes once), match rate # 89.7% -> 92.4%, early ends unchanged at 0.00%, dishwashers identical. # A ceiling of 0.15 caught the 6th split too but deferred 10 of the 11 # firings, and a deferral with no spin ahead waits out # ANTI_CREASE_SPIN_WAIT_MAX_RATIO (1.25x expected, ~32 min on a 2:09 # wash), so it bought the last split for three long waits. 0.10 was the # maintainer's call. if self._anticrease_spin_pending(timestamp): return False peak = float(self._cycle_max_power) if peak <= 0: return False level_ceiling = peak * STANDBY_BAND_MAX_FRACTION # Walk the tail; readings are chronological so we can break once outside # the window (O(window), not O(n)). window: list[float] = [] window_ts: list[datetime] = [] oldest_in_window: datetime | None = None saw_older = False # a reading older than the window exists -> full coverage _standby_boundary_ts: datetime | None = None for ts, p in reversed(self._power_readings): if (timestamp - ts).total_seconds() <= STANDBY_BAND_WINDOW_S: window.append(float(p)) window_ts.append(ts) oldest_in_window = ts else: saw_older = True _standby_boundary_ts = ts # boundary: last reading before the window break # The plateau must actually SPAN the required window (data exists from # before it), not just a couple of recent samples, and have enough points # to judge. `saw_older` (rather than an exact span >= WINDOW check) is # robust to sample phase/granularity: with e.g. 30 s sampling the oldest # in-window reading is typically only ~570-599 s old, which an exact check # would wrongly reject. A coverage sanity (oldest >= 90% of the window) # plus an adjacent-gap check (``_window_has_outage_gap``) guard against a # sparse burst of samples sitting next to one old reading across a dropout. if ( oldest_in_window is None or not saw_older or len(window) < 3 or (timestamp - oldest_in_window).total_seconds() < STANDBY_BAND_WINDOW_S * 0.9 or self._window_has_outage_gap( [_standby_boundary_ts, *window_ts] if _standby_boundary_ts is not None else window_ts ) ): return False hi = max(window) lo = min(window) if hi > level_ceiling: return False # a real active reading in the window - not standby flatness_limit = max( STANDBY_BAND_FLATNESS_FLOOR_W, peak * STANDBY_BAND_FLATNESS_FRACTION ) if (hi - lo) > flatness_limit: return False # fluctuating - still doing work return True def _anticrease_gate_open(self, timestamp: datetime) -> bool: """Core anti-crease gate (#296): everything except the current power level and the low-power-window check. Shared by the match freeze (``_in_anticrease_freeze``) and the finalise (``_is_anticrease_tail``). True only when a genuinely energetic, confidently-matched cycle for an anti-wrinkle device is PAST its expected duration - the discriminator that separates the post-wash anti-crease tail from a mid-wash low-power trough (a washer spends most of its cycle below ``anti_wrinkle_max_power``, but a mid-wash trough is always BEFORE the expected duration, the tail after it). That "past expected" fraction is per-appliance since #429 (``anti_crease_finalize_ratio``, default 0.98). **Lowering it trades away exactly the guarantee in the paragraph above**, so it is meant for dryers whose sensor-dry runtime follows the load and whose tumble tail would otherwise sit until the fallback timeout. Nothing downstream can stand in for it on a washer: the low-power window check cannot separate a trough from a tail (both are below ``anti_wrinkle_max_power`` by definition), ``_smart_term_power_plausible`` compares the trailing mean against the matched profile's OWN tail level, which is equally low, and ``_anticrease_spin_pending`` fails open when the profile carries no terminal high block. """ if not self._config.anti_wrinkle_enabled: return False if self._config.device_type not in ( DEVICE_TYPE_WASHING_MACHINE, DEVICE_TYPE_DRYER, DEVICE_TYPE_WASHER_DRYER, ): return False if getattr(self, "_verified_pause", False): return False if not (self._matched_profile and self._expected_duration > 0): return False if self._last_match_confidence < self._config.match_confidence_threshold: return False # Deliberately the NARROW #288-only verdict, not the #364-widened flag: a # false block here disables the finalise AND the match freeze, and because # the tumble bursts recur faster than off_delay neither the fallback timeout # nor ENDING_HARD_FINALIZE can close the cycle - that is the #296 hang. if self._match_ambiguous or self._match_prefix_ambiguous_full_shape: return False if self._cycle_max_power <= float(self._config.anti_wrinkle_max_power): return False # never a hot/energetic cycle - leave low-power programs alone # Cheap clock test first, so the trailing-power scan below is skipped for the # whole mid-wash phase (it only matters once we are past-expected). start = self._current_cycle_start if start is None: return False current_duration = (timestamp - start).total_seconds() # Held to the documented 0.50-1.00 range on READ, not at construction: the # manager assigns this field directly on an options reload, and the value can # arrive from an import or the Playground, neither of which range-checks it. # A stored 0.0 would satisfy the test below for every duration and hand the # gate a mid-wash trough. finalize_ratio = effective_anticrease_finalize_ratio( self._config.anti_crease_finalize_ratio ) if current_duration < self._expected_duration * finalize_ratio: return False # #364: "past expected" only means "past the wash" when expected belongs to # the RIGHT profile. A whole washer wash phase sits below # anti_wrinkle_max_power, so with a mis-matched shorter profile this gate # would open mid-wash. Requiring the trailing power to look like this # profile's own tail restores the guarantee the ratio alone used to give. if not self._smart_term_power_plausible(timestamp): return False return True def _in_anticrease_freeze(self, timestamp: datetime) -> bool: """Whether match updates should be frozen (#296): the anti-crease gate is open AND the most recent reading is in the low-power regime (at or below ``anti_wrinkle_max_power``). Deliberately lighter than ``_is_anticrease_tail`` - it does NOT wait for the full ``ANTI_CREASE_CONFIRM_WINDOW_S``, so the confident pre-tail match is preserved from the instant the cycle crosses its expected duration in a low-power state, before the window accrues. Without this a match that degrades to ambiguous within the first window's worth of tail would deadlock both the freeze and the finalise (both require an unambiguous match). Self-correcting: a heating burst above ``anti_wrinkle_max_power`` leaves the regime and re-arms matching. """ if not self._power_readings: return False if float(self._power_readings[-1][1]) > float( self._config.anti_wrinkle_max_power ): return False return self._anticrease_gate_open(timestamp) def _is_anticrease_tail(self, timestamp: datetime) -> bool: """Whether a matched, past-expected cycle has settled into the anti-crease tumble tail (#296) - the trigger for the finalise into STATE_ANTI_WRINKLE. Miele-style "Knitterschutz": after the wash proper ends, the machine holds a constant baseline plus periodic sub-``anti_wrinkle_max_power`` tumble bursts (no heating) until the door is opened. Because those bursts recur faster than off_delay they keep reviving the cycle out of ENDING, so the normal power-off path never finalises it and STATE_ANTI_WRINKLE - which is built to absorb the tail and split off the next wash - never engages. Recognising the tail lets us finalise into anti-wrinkle directly. Requires the core gate (``_anticrease_gate_open``) AND that the most recent >= ``ANTI_CREASE_CONFIRM_WINDOW_S`` of readings are ALL at or below ``anti_wrinkle_max_power`` (we are in the low-power tail, clear of the final spin and not mid-heating). The expensive window scan runs only after the cheap gate passes, so normal cycles never pay for it. """ if not self._anticrease_gate_open(timestamp): return False # #399: only the finalise, never _anticrease_gate_open. A false block in the # shared gate would also kill the match freeze, and because the tumble bursts # recur faster than off_delay neither the fallback timeout nor # ENDING_HARD_FINALIZE could then close the cycle - that is the #296 hang. if self._anticrease_spin_pending(timestamp): return False max_power = float(self._config.anti_wrinkle_max_power) # Walk the tail; readings are chronological so we can break once outside the # window (O(window), not O(n)). window: list[float] = [] window_ts: list[datetime] = [] oldest_in_window: datetime | None = None saw_older = False _ac_boundary_ts: datetime | None = None for ts, p in reversed(self._power_readings): if (timestamp - ts).total_seconds() <= ANTI_CREASE_CONFIRM_WINDOW_S: window.append(float(p)) window_ts.append(ts) oldest_in_window = ts else: saw_older = True _ac_boundary_ts = ts # boundary: last reading before the window break # The low-power tail must actually SPAN the window (data exists from before # it) and have enough points to judge - not just a couple of recent samples. # ``saw_older`` plus a coverage sanity and an adjacent-gap check # (``_window_has_outage_gap``) is robust to sample phase/granularity while # rejecting a dropout-sized hole (mirrors _is_standby_band_stuck). if ( oldest_in_window is None or not saw_older or len(window) < 3 or (timestamp - oldest_in_window).total_seconds() < ANTI_CREASE_CONFIRM_WINDOW_S * 0.9 or self._window_has_outage_gap( [_ac_boundary_ts, *window_ts] if _ac_boundary_ts is not None else window_ts ) ): return False if max(window) > max_power: return False # a heating / high-spin reading in the window - still washing return True def _anticrease_spin_pending(self, timestamp: datetime) -> bool: """Whether the matched profile still owes this run a terminal high-power event - i.e. the anti-crease finalise must wait (#399). ``_is_anticrease_tail``'s two conditions both look backwards: past expected, and quiet for the confirm window. A programme whose final spin lands just past 0.98 x expected, after a long sub-``anti_wrinkle_max_power`` rinse stretch, satisfies both while the spin is still ahead - so the wash was finalised into anti-wrinkle and the spin opened a SECOND cycle record. The profile carries the missing information: where its own last high-power block sits and how long it runs. If that block is terminal (starts at or after ``ANTI_CREASE_TERMINAL_HIGH_MIN_FRAC`` of the profile) and this run has not yet produced a comparable amount of high-power time at or after the same position, the spin is still ahead. Deliberately compares EVENTS, not clock positions: mapping the profile's last high sample onto elapsed time and clearing there delays the reported finalise by 16 s and then splits the wash anyway, because a run's spin can arrive hundreds of seconds later than the profile's (the same load-dependent duration spread behind #393). Delay-only and bounded: never blocks past ``ANTI_CREASE_SPIN_WAIT_MAX_RATIO`` x expected, and fails open on any missing input, so it cannot reproduce the #296 hang. """ block = self._matched_terminal_high if block is None: return False start_frac, block_seconds = block[0], block[1] if start_frac < ANTI_CREASE_TERMINAL_HIGH_MIN_FRAC: return False # the profile's tail is genuinely low-power (#296 shape) expected = self._expected_duration start = self._current_cycle_start if expected <= 0 or start is None: return False current_duration = (timestamp - start).total_seconds() if current_duration >= expected * ANTI_CREASE_SPIN_WAIT_MAX_RATIO: return False # cap: waited long enough, let the finalise through needed = block_seconds * ANTI_CREASE_TERMINAL_MATCH_FRAC if needed <= 0: return False # Register item 196: scan from the block's ABSOLUTE offset on the profile's # own grid when the store supplied one (element 3). `start_frac` is measured # against the quiet-TRIMMED span - it has to be, or a capture's idle tail # disarms the terminal gate above - while `expected` is the profile's # avg_duration, which tracks the UNTRIMMED span. Their product is therefore a # systematically LATE offset, and a late offset means the run's own spin sits # BEFORE the scan window and is never counted, so the hold ran out the # ANTI_CREASE_SPIN_WAIT_MAX_RATIO cap instead of releasing on the event. Over # 36 real armed profile/cycle pairs the product recognised the spin 3 times # and the absolute offset 14, with zero cases in either where the credited # seconds exceeded the run's own terminal block (so no new premature-release # exposure). The fallback keeps a pre-196 payload - an old state snapshot, the # Playground, older callers - behaving exactly as before. offset_s = float(block[2]) if len(block) >= 3 else start_frac * expected # Element 4, when the store sent one, is the watts the block was measured # against. Count the live seconds above the SAME bar or the two halves # describe different things (register item 351). ceiling_w = float(block[3]) if len(block) >= 4 else None seen = self._high_power_seconds_since(offset_s, ceiling_w=ceiling_w) if seen >= needed: return False if not self._anticrease_spin_wait_logged: self._anticrease_spin_wait_logged = True self._logger.debug( "Finalize held, terminal high-power block still owed: '%s' ends " "with a %.0fs block above %.0fW at %.0f%% of its run (scanning " "from %.0fs); this cycle has %.0fs of it so far (elapsed %.0fs of " "%.0fs expected).", self._matched_profile, block_seconds, ( float(self._config.anti_wrinkle_max_power) if ceiling_w is None else ceiling_w ), start_frac * 100.0, offset_s, seen, current_duration, expected, ) return True def _high_power_seconds_since( self, offset_s: float, ceiling_w: float | None = None ) -> float: """Seconds this cycle has spent above ``ceiling_w`` at or after ``offset_s`` from its start (#399); ``anti_wrinkle_max_power`` when None. The caller supplies the ceiling so both halves of the comparison use one bar: the profile's block was measured against it too. The standby-band path passes a share of the cycle's own peak (register item 351), the anti-crease path passes nothing and keeps the dryer's tumble level. Walks the readings backwards and stops at the offset, so the scan is bounded by the tail of the trace rather than its whole length. Each reading covers the interval up to the following one, which matches how the profile's own block length is measured. Two corrections to that per-interval credit, both of which decide whether the guard releases: * An outage-sized interval is unobserved time, not high-power time. Counting it in full let a silent plug bank minutes of "spin" it never reported, satisfy ``seen >= needed`` and release the finalise before the real terminal spin - the #399 failure, reached by a different route. Same treatment (and the same p95-derived ceiling) the tail scan at ``_smart_term_tail_stats`` and the gap-free quiet tally already apply. Deliberately NOT ``_outage_threshold_s()``, which rebuilds a NumPy array from every reading; this runs on the per-reading anti-crease path. * When ``offset_s`` falls inside an interval, only the part after the offset counts. Breaking out of the loop dropped that remainder entirely, and the offset is ``start_frac * expected``, so a boundary reading is the norm rather than an edge case. """ start = self._current_cycle_start if start is None or not self._power_readings: return 0.0 ceiling = ( float(self._config.anti_wrinkle_max_power) if ceiling_w is None else float(ceiling_w) ) max_gap = min(3600.0, max(60.0, 10.0 * self._prior_p95_dt)) total = 0.0 readings = self._power_readings for i in range(len(readings) - 1, -1, -1): ts, power = readings[i] elapsed = (ts - start).total_seconds() if i + 1 >= len(readings): continue # last reading covers no interval yet next_elapsed = (readings[i + 1][0] - start).total_seconds() if next_elapsed <= offset_s: break # this interval ends at or before the offset, as do all earlier ones interval = next_elapsed - elapsed if interval > max_gap: if elapsed < offset_s: break continue # unobserved time, not evidence of anything if float(power) > ceiling: # Credit only the portion at or after the offset. total += next_elapsed - max(elapsed, offset_s) return total def _maybe_finalize_anticrease_tail(self, timestamp: datetime) -> bool: """Finalise a cycle that has entered the anti-crease tail into STATE_ANTI_WRINKLE (#296). Returns True if the cycle was finalised. Shared by the RUNNING / PAUSED / ENDING branches so the finalise fires no matter which state a burst left the detector in. Uses Smart Termination (in ``ANTI_WRINKLE_ELIGIBLE_REASONS``) so ``_finish_cycle`` routes into STATE_ANTI_WRINKLE, which then absorbs the tail and splits off any next wash on its first heating burst above ``anti_wrinkle_max_power``. """ if not self._is_anticrease_tail(timestamp): return False start_time = self._current_cycle_start or timestamp current_duration = (timestamp - start_time).total_seconds() self._logger.info( "Anti-crease finalize: matched '%s' past expected %.0fs (elapsed %.0fs), " "settled into the low-power tumble tail — finalizing into anti-wrinkle.", self._matched_profile, self._expected_duration, current_duration, ) self._finish_cycle( timestamp, status="completed", termination_reason=TerminationReason.SMART, keep_tail=True, # Capped like the three sibling keep_tail finishes (#424). This path can # fire on a window of *watchdog* keepalives: a change-only plug that has # gone silent emits nothing, the injected 0 W readings satisfy the "all # at or below anti_wrinkle_max_power" window, and `timestamp` is then # the moment the watchdog noticed rather than the moment the appliance # stopped - post-cycle standby banked as cycle time, which feeds # avg_duration and self-amplifies. # # The tumble tail itself is never cut into, which is why this is safe # here: an anti-crease baseline sits ABOVE stop_threshold # (const.py:811-812, a ~2.5-3.2 W draw against a ~1.2 W threshold), so # every one of those readings refreshes `_last_active_time`, and for a # non-dishwasher `_keep_tail_cap` returns exactly that - the last # tumble. A real tail therefore loses only the trailing quiet gap # between its last reading and this finalize, which is time the # appliance drew nothing, and a tail of genuinely-0 W readings is # dropped at `_last_active_time`. # # NB: the cap is no longer `max(expected_end, _last_active_time)` and # so is NOT bounded below by the expected end - on a washer or dryer # the stored end can now land earlier than the matched profile's # expected duration. Shorten-only still holds; "never earlier than # expected_end" no longer does, and this paragraph used to claim it. tail_cap=self._keep_tail_cap(start_time), ) return True def _is_terminal_drop(self) -> bool: """Whether the current low-power event is an anomalously-early hard drop. Mirrors ``_ml_end_confidence``: builds the offset-second trace from the current cycle's readings and asks the injected terminal-drop provider. Returns ``False`` when there is no provider, no cycle start, or the provider declines/raises (ML off / too little history / not anomalous), so the caller keeps the proven soak-bridging end-detection. """ provider = self._terminal_drop_provider start = self._current_cycle_start if provider is None or start is None or not self._power_readings: return False # Throttle: reuse within the window, scoped to this cycle + expected_duration. now_ts = self._power_readings[-1][0] exp = float(self._expected_duration) cache = self._terminal_drop_cache if ( cache is not None and cache[1] == exp and cache[2] == start and (now_ts - cache[0]).total_seconds() < ML_PROVIDER_THROTTLE_SECONDS ): return cache[3] points = [ ((ts - start).total_seconds(), float(power)) for ts, power in self._power_readings ] try: result = bool(provider(points, exp)) except Exception: # noqa: BLE001 - ML must never break detection result = False self._terminal_drop_cache = (now_ts, exp, start, result) return result def _should_defer_finish(self, duration: float) -> bool: """Check if we should defer termination based on expected duration.""" # Check explicit verified pause override from manager if getattr(self, "_verified_pause", False): self._logger.debug("Deferring cycle finish: Verified pause active") return True # Dishwasher minimum-duration floor: even without a matched profile (e.g. # first cycle of a program, or the 5-min matcher hasn't fired yet) a # dishwasher cycle should never end before it has crossed the minimum # reasonable programme duration. This prevents a dip during the fill or # early wash phase from being read as the end of a complete cycle. # # A MATCHED profile overrides the blanket constant with its own learned # length, because the constant is a stand-in for exactly the knowledge a # match supplies - as this comment's own "even without a matched profile" # says. Blanket, it is wrong for real hardware: the community catalogue # carries a 6.0 min Smeg "Delay- prewash", which a 30 min floor defers by # half an hour. The floor still applies unmatched, and a matched profile # can only ever LOWER it (`min`), never license a longer deferral - the # 39.4 min Electrolux "Rapido" already clears it and is unaffected. # # Gated on a TRUSTED match, not merely a present one. This floor is an # anti-premature-end guard, so the risk is the opposite way round from # the ENDING fallback gate (item 329, where a confidence check measured # as pure cost): getting this wrong ends a dishwasher during its fill or # early-wash dip and records the rest of the programme as a second # cycle, which is the expensive failure. A low-confidence match to a # short look-alike is exactly how that happens, so it does not get to # lower the bar. Uses the WIDER `_match_prefix_ambiguous`, not the # narrow full-shape flag Smart Termination takes: a false block here # only keeps the 30 min floor, where for the anti-crease finalize it can # re-hang the cycle (#296). No-op on the whole corpus either way - every # corpus dishwasher profile is over 90 minutes. _dw_floor = DISHWASHER_MIN_CYCLE_DURATION_S if ( self._matched_profile and self._expected_duration > 0 and self._last_match_confidence >= self._config.match_confidence_threshold and not self._match_ambiguous and not self._match_prefix_ambiguous ): _dw_floor = min(_dw_floor, float(self._expected_duration)) if self._config.device_type == "dishwasher" and duration < _dw_floor: self._logger.debug( "Deferring dishwasher cycle end: elapsed %.0fs < minimum %.0fs", duration, _dw_floor, ) return True if not self._matched_profile or self._expected_duration <= 0: return False # Safety: Don't defer forever if duration > (self._expected_duration + DEFAULT_MAX_DEFERRAL_SECONDS): self._logger.warning( "Deferral limit exceeded (%.0fs > expected %.0f + %s), allowing finish", duration, self._expected_duration, DEFAULT_MAX_DEFERRAL_SECONDS, ) return False # Opt-in ML end-guard (asymmetric anti-premature-stop, bounded). If the # cycle-end model judges this low-power event to be more likely a pause # than the true end, defer the normal completion - but only for a bounded # extra window, so a wrong model can delay, never hang, the cycle. As the # low-power run lengthens the model's confidence rises, so a genuine end # is released once the model agrees or the cap is reached. if ( self._end_confidence_provider is not None and self._last_match_confidence >= DEFAULT_DEFER_FINISH_CONFIDENCE ): confidence = self._ml_end_confidence() if confidence is not None and confidence < ML_END_GUARD_MIN_CONFIDENCE: if self._ml_defer_start_duration is None: self._ml_defer_start_duration = duration if (duration - self._ml_defer_start_duration) < ML_END_GUARD_MAX_DEFER_SECONDS: self._logger.debug( "Deferring cycle finish: ML end-guard (P(true end)=%.2f < %.2f)", confidence, ML_END_GUARD_MIN_CONFIDENCE, ) return True elif confidence is not None: # Model is confident this is the true end -> stop ML-deferring. self._ml_defer_start_duration = None # Dishwasher passive drying protection: # Dishwashers can have 2+ hour passive drying phases at near-0W. A terminal # drain spike that fires early in the ENDING state (e.g. at 120 min of a # 233-min ECO cycle) resets _time_below_threshold, and the subsequent 60-min # silence timeout would otherwise end the cycle at ~180 min - well before the # real finish. Defer until the cycle reaches the late-phase threshold (the # same one used by the end-spike arm gate, so both move together) so that # smart termination can catch the true end (~99% of expected) instead. # Confidence may be low this early, so the normal confidence gate is # bypassed here. if ( self._config.device_type == "dishwasher" and self._matched_profile and self._expected_duration > 0 and duration < (self._expected_duration * DISHWASHER_END_SPIKE_MIN_PROGRESS) ): self._logger.debug( "Deferring cycle finish: dishwasher drying phase protection " "(%.0fs < %.0f%% of expected %.0fs, profile: %s, conf %.2f)", duration, DISHWASHER_END_SPIKE_MIN_PROGRESS * 100, self._expected_duration, self._matched_profile, self._last_match_confidence, ) return True # Issue #43: dishwasher end-spike wait protection. Once past the 85% # passive-drying gate above, we still keep the cycle deferred until # the real end-of-cycle pump-out fires (sets _end_spike_seen=True via # the 85% progress gate in STATE_ENDING) or we cross the # smart-termination wait window (expected + 30 min) - whichever comes # first. Shares DISHWASHER_END_SPIKE_WAIT_SECONDS with Smart # Termination's wait branch so the two paths release the cycle at the # same instant. Beyond the wait window, Smart Termination's # past_wait_period kicks in and finalises; below it, the fallback # timeout's energy gate is the safety net for cycles whose pump-out # never arrives. # Mirrors the STATE_ENDING pump-out wait so both paths release together. # Keep deferring while we are still inside the wait window, UNLESS the cycle # has already reached its expected duration and has since been sustained-quiet # for DISHWASHER_END_SPIKE_QUIET_RELEASE_SECONDS - in which case any terminal # pump-out has already happened, so a cycle that finished slightly short of the # profile's (drifted-up) average is released here instead of hanging to # expected + 30 min. The ``duration >= expected`` gate keeps a long # passive-drying phase that still precedes a late pump-out deferred. quiet_released = ( duration >= self._expected_duration and self._time_below_threshold_gapfree >= self._config.dishwasher_end_spike_quiet_release ) if ( self._config.device_type == "dishwasher" and self._matched_profile and self._expected_duration > 0 and not self._end_spike_seen and duration < (self._expected_duration + self._dishwasher_end_spike_wait_s()) and not quiet_released ): # Report the gap-free tally: that is what `quiet_released` above reads, # and after a telemetry outage the two diverge - logging the plain one # would show quiet time that played no part in the decision. self._logger.debug( "Deferring cycle finish: dishwasher waiting for end-of-cycle " "pump-out (%.0fs < expected %.0fs + %.0fs wait, observed quiet " "%.0fs of %.0fs needed, profile: %s)", duration, self._expected_duration, self._dishwasher_end_spike_wait_s(), self._time_below_threshold_gapfree, self._config.dishwasher_end_spike_quiet_release, self._matched_profile, ) return True # If matched profile, enforce min duration ratio ratio = self._config.min_duration_ratio # --- STRICTER DEFERRAL --- # If we are NOT in a verified pause, but power has been low for a long time (ENDING state), # we only defer if we are VERY confident this profile is correct. # This prevents hanging on too-long profiles that matched early but are now diverging. if self._last_match_confidence < DEFAULT_DEFER_FINISH_CONFIDENCE: self._logger.debug( "Not deferring finish: confidence %.2f too low for unverified pause (profile: %s)", self._last_match_confidence, self._matched_profile, ) return False # Also use profile tolerance to handle variable cycle lengths (e.g. long drying) # Allow deferral up to Expected * (1 + tolerance) upper_threshold = self._expected_duration * ( 1.0 + self._config.profile_duration_tolerance ) # Primary check: Is duration significantly below expectation? if duration < (self._expected_duration * ratio): self._logger.debug( "Deferring cycle finish: duration %.0fs < %.0f%% of expected %.0fs (profile: %s, confidence %.2f)", duration, ratio * 100, self._expected_duration, self._matched_profile, self._last_match_confidence, ) return True # Secondary check: If within valid completion window (ratio to tolerance), allow finish. if duration <= upper_threshold: return False # Tertiary check: If duration exceeded max tolerance, allow finish (failsafe). return False def _dishwasher_end_spike_wait_s(self) -> float: """Grace past the expected end while waiting for the terminal pump-out. Capped at the programme's OWN expected length - the same ``min()`` shape register item 331 gave ``DISHWASHER_MIN_CYCLE_DURATION_S``, for the same reason. A flat 1800 s is 20% of a 150 min ECO cycle but **five times** a 6 min Smeg "Delay- prewash", and the community catalogue carries exactly that programme. Asymmetric: the cap can only ever SHORTEN the wait, never extend it, so no cycle waits longer than it does today. A no-op across the maintainer's corpus, where every dishwasher profile is >90 min and the cap therefore never binds (register item 357). Unmatched cycles keep the flat constant: with no expected duration there is nothing to be proportional to. """ expected = float(self._expected_duration or 0.0) if expected <= 0: return DISHWASHER_END_SPIKE_WAIT_SECONDS return min(DISHWASHER_END_SPIKE_WAIT_SECONDS, expected) def _ending_hard_finalize_quiet_s(self) -> float: """Continuous sub-threshold span the ENDING backstop requires. Same cap, same reason: 600 s of required quiet is a third of a 30 min programme and longer than a 6 min one, which would disarm the backstop entirely on a short programme - the opposite of what a safety net is for. The ``off_delay`` / ``min_off_gap`` floor is applied by the caller and is unaffected. """ expected = float(self._expected_duration or 0.0) if expected <= 0: return ENDING_HARD_FINALIZE_MIN_QUIET_S return min(ENDING_HARD_FINALIZE_MIN_QUIET_S, expected) def _keep_tail_cap(self, start_time: datetime) -> datetime | None: """Latest end time a *kept* tail may claim (#424). The paths that keep their tail do so because the tail can be real cycle time: a dishwasher's near-0 W passive drying phase sits between the last drain spike and the actual end of the programme (issue #43), so snapping back to ``_last_active_time`` would store a falsely short cycle. But they fire on accumulated quiet time, and on a publish-on-change plug that wait is minutes of *post-appliance* standby - which stamping ``timestamp`` as the end time banked as cycle time. Measured on the #424 reporter's dishwasher: every cycle that ended via `timeout` stored a 0-29 s tail (237-239 min, matching the appliance), and every cycle that ended via `smart` stored a 96-1239 s tail (240-260 min), with ``_last_active_time`` unchanged across the whole history - only the termination path differed. It also self-amplifies, because the inflated duration feeds ``avg_duration``, which raises ``expected_duration``, which delays the next Smart Termination further (the second reporter's profile had already drifted 63 -> 70.5 min). The cap used to be the matched profile's **expected end**. That is the mean of these same stored durations, so it moved with the thing it was bounding: a banked tail raised ``avg_duration``, the higher average allowed a longer tail, and the reported end drifted later every run. Measured over 375 cycles from 16 devices, smart-terminated cycles banked a median **12.6 min** of post-appliance time (washing machines **22.7 min**, p90 40.4 min) against ~0 min for every other termination path, and the profiles carried a mean **+5.3%** duration inflation as a result - on the #427 reporter's washer, +20.2 min on a 108 min programme, which is also why their ETA read 131 min for a ~105 min wash. So anchor on the last real activity instead. Where a passive phase can legitimately follow it, allow only what this programme has been **measured** to do (``profile_terminal_quiet_seconds``, element 11) - a statistic taken from the traces, not from the stored durations, so it cannot be inflated by the tail it bounds, and gated on having been seen repeatedly rather than once. **Only a dishwasher has a passive terminal phase.** Every other type ends on activity - a washer's spin, a dryer's drum - which ``_last_active_time`` already marks, so there is nothing legitimate to bank after it. That is not a new assumption: the fallback-timeout path beside this one has always read ``keep_tail = device_type == "dishwasher"``. Smart Termination was the one path that kept a tail for every type, which is exactly where the 22.7 min washing-machine median came from. Within the dishwasher case, two sub-cases, and the difference matters: * the run produced its terminal pump-out (``_end_spike_seen``). ``_last_active_time`` already sits on it, so that IS the end. * it did not, so the programme ended in its passive drying phase. Allow up to the profile's measured quiet span past the last activity. Falls back to the old expected-end cap when that span has not been measured, rather than truncating a drying phase on no evidence - the measured corpus shows the pump-out missing in a substantial minority of runs on some machines, and in those runs the drying IS the tail. Still asymmetric and shorten-only; still None for an unmatched cycle. """ if self._expected_duration <= 0: return None expected_end = start_time + timedelta(seconds=self._expected_duration) last_active = self._last_active_time if last_active is None: return expected_end if self._config.device_type != DEVICE_TYPE_DISHWASHER: return last_active # Only a spike LATE enough to be the terminal pump-out licenses snapping # the stored end back to the last activity. `_end_spike_seen` is set from # DISHWASHER_END_SPIKE_MIN_PROGRESS (0.85), but this file does not treat # every such spike as terminal: `_resolve_smart_ratio` relaxes its gate # only at `>= expected * 0.90`, because below that the spike can be the # pre-final-rinse drain with a passive Dry phase still to come. Capping # at `last_active` for an 87% drain cuts that drying off, which lowers # `avg_duration`, which makes the NEXT Smart Termination fire earlier - # the error compounds in the direction that splits cycles. Same 0.90 # test here, so a pre-rinse drain falls through to the measured quiet # span or the expected-end fallback below. if getattr(self, "_end_spike_seen", False) and getattr( self, "_end_spike_duration", 0.0 ) >= self._expected_duration * 0.90: return last_active quiet = self._matched_terminal_quiet_s if quiet is None: return max(expected_end, last_active) # ...and if the drying ALREADY happened, adding the allowance on top # counts the same quiet twice. The 0.90 test above only catches a spike # late enough to be unambiguously terminal; a pump-out at 85-90% of # expected falls through it, and on a machine that dries BEFORE its final # drain that banks a second drying period into the stored duration, which # feeds `avg_duration` - the exact drift item 297 exists to remove. # `ProfileStore.async_repair_banked_tails` has always asked the trace this # question; this path did not, so the same cycle got one duration live and # another when the repair re-judged it. Same helper, same 0.5 bar, so the # two cannot drift again (register item 347). if self._current_cycle_start is not None and self._power_readings: _start = self._current_cycle_start _pts = [ ((ts - _start).total_seconds(), float(pw)) for ts, pw in self._power_readings ] _last_off = (last_active - _start).total_seconds() if quiet_run_before( _pts, _last_off, self._config.stop_threshold_w ) >= 0.5 * float(quiet): return last_active return last_active + timedelta(seconds=min(quiet, TERMINAL_QUIET_CAP_S)) def _finish_cycle( self, timestamp: datetime, status: str = "completed", termination_reason: str = TerminationReason.TIMEOUT, keep_tail: bool = False, tail_cap: datetime | None = None, ) -> None: """Finalize cycle. Args: timestamp: Time of completion status: Cycle status string termination_reason: Reason for termination keep_tail: If True, use current timestamp as end time and preserve trailing zero readings (e.g. Smart Termination). If False (default), snap back to last active time and trim trailing zeros (e.g. Timeout). tail_cap: Latest end time a kept tail may claim. Ignored when ``keep_tail`` is False or when it is not earlier than ``timestamp``; readings past it are dropped so the stored trace and the stored duration stay consistent. """ # Capture data before reset readings = self._power_readings if keep_tail: end_time = timestamp if tail_cap is not None and tail_cap < end_time: end_time = tail_cap readings = [r for r in readings if r[0] <= end_time] else: end_time = self._last_active_time or timestamp if not self._current_cycle_start: self.reset() return duration = (end_time - self._current_cycle_start).total_seconds() # "Interrupted" logic (short cycle etc) if duration < self._config.interrupted_min_seconds: status = "interrupted" elif duration < self._config.completion_min_seconds: status = "interrupted" # Trim leading/trailing zero readings for cleaner data # If we keep tail, we explicitly do NOT trim end zeros trimmed_readings = trim_zero_readings( readings, threshold=self._config.stop_threshold_w, trim_end=not keep_tail, ) # Ensure power_data covers the full duration until end_time # (especially important for manual recordings or drying phases with no sensor updates) final_readings = list(trimmed_readings) if final_readings: last_t, last_p = final_readings[-1] if last_t < end_time: final_readings.append((end_time, last_p)) start_ts = self._current_cycle_start.timestamp() # Store timestamps in canonical UTC (#369). Reading timestamps arrive from # dt_util.now() (HA-local-aware) while trim/split paths emit UTC, which left # past_cycles with a mix of offsets. Normalizing here (instant-preserving) # keeps stored cycles consistent and safe for cross-device/store transfer. cycle_data: dict[str, Any] = { "start_time": dt_util.as_utc(self._current_cycle_start).isoformat(), "end_time": dt_util.as_utc(end_time).isoformat(), "duration": duration, "max_power": self._cycle_max_power, "status": status, "termination_reason": termination_reason, "power_data": [[round(t.timestamp() - start_ts, 1), p] for t, p in final_readings], } self._logger.info("Cycle Finished: %s, %.1f min", status, duration / 60) self._on_cycle_end(cycle_data) target = STATE_FINISHED if status == "interrupted": target = STATE_INTERRUPTED elif status == "force_stopped": target = STATE_FORCE_STOPPED elif ( status == "completed" and termination_reason in ANTI_WRINKLE_ELIGIBLE_REASONS and self._config.anti_wrinkle_enabled and self._config.device_type in ( DEVICE_TYPE_WASHING_MACHINE, DEVICE_TYPE_DRYER, DEVICE_TYPE_WASHER_DRYER, ) ): target = STATE_ANTI_WRINKLE self.reset(target_state=target) # Stub methods for compatibility or simpler logic def force_end(self, timestamp: datetime) -> None: """Force the cycle to end immediately.""" if self._state != STATE_OFF: self._finish_cycle( timestamp, status="force_stopped", termination_reason=TerminationReason.FORCE_STOPPED, keep_tail=False, # Force stop usually implies snap back to reality ) self._ignore_power_until_idle = False def user_stop(self) -> None: """Handle user-initiated stop.""" if self._state != STATE_OFF: now = dt_util.now() self._finish_cycle( now, status="completed", termination_reason=TerminationReason.USER, keep_tail=True, # User implies "Done Now" ) # Prevent immediate restart if power is still high self._ignore_power_until_idle = True # Anchor the lockout clock to this stop instant. The next reading's # dt is measured from the last processed sample, which predates the # stop, so without this the high-power accumulator would count the # pre-stop gap and release the lockout early (#267). self._lockout_high_seconds = 0.0 self._last_process_time = now def get_power_trace(self) -> list[tuple[datetime, float]]: """Return the current power trace.""" return list(self._power_readings) def get_state_snapshot(self) -> dict[str, Any]: """Get a snapshot of the current state for persistence.""" return { "state": self._state, "sub_state": self._sub_state, "current_cycle_start": ( self._current_cycle_start.isoformat() if self._current_cycle_start else None ), "power_readings": [(t.isoformat(), p) for t, p in self._power_readings], "accumulated_energy_wh": self._energy_since_idle_wh, "time_above": self._time_above_threshold, "time_below": self._time_below_threshold, "time_below_gapfree": self._time_below_threshold_gapfree, "cycle_max_power": self._cycle_max_power, "last_active_time": ( self._last_active_time.isoformat() if self._last_active_time else None ), "expected_duration": self._expected_duration, "matched_profile": self._matched_profile, "state_enter_time": ( self._state_enter_time.isoformat() if self._state_enter_time else None ), "end_spike_seen": self._end_spike_seen, "end_spike_duration": self._end_spike_duration, "match_ambiguous": self._match_ambiguous, "match_prefix_ambiguous": self._match_prefix_ambiguous, "match_prefix_ambiguous_full_shape": self._match_prefix_ambiguous_full_shape, "matched_tail_power": self._matched_tail_power, "matched_terminal_high": self._matched_terminal_high, "matched_terminal_quiet_s": self._matched_terminal_quiet_s, "longest_candidate_duration": self._longest_candidate_duration, "ml_defer_start_duration": self._ml_defer_start_duration, } def get_elapsed_seconds(self) -> float: """Return seconds elapsed in current cycle.""" if self._current_cycle_start: return (dt_util.now() - self._current_cycle_start).total_seconds() return 0.0 def is_waiting_low_power(self) -> bool: """Return True if we are pending end/pause due to low power.""" return ( self._state in (STATE_RUNNING, STATE_PAUSED, STATE_ENDING) and self._time_below_threshold > 0 ) def restore_state_snapshot(self, snapshot: dict[str, Any]) -> None: """Restore state from snapshot.""" try: self._state = snapshot.get("state", STATE_OFF) self._sub_state = snapshot.get("sub_state") self._energy_since_idle_wh = snapshot.get("accumulated_energy_wh", 0.0) self._time_above_threshold = snapshot.get("time_above", 0.0) self._time_below_threshold = snapshot.get("time_below", 0.0) # Old snapshots lack the gap-free tally, and the plain value they do # carry may already include outage-sized intervals — the exact # contamination this field exists to exclude — so it must NOT be used # as the fallback. 0.0 is also the honest value on a restore in # general: the restart itself is unobserved time (the manager records # it as a restart gap), so no quiet observed before it still counts. self._time_below_threshold_gapfree = float( snapshot.get("time_below_gapfree", 0.0) or 0.0 ) self._cycle_max_power = snapshot.get("cycle_max_power", 0.0) # Sanitize via the same helper as update_match so the class # invariant on _expected_duration holds across restarts and the # gates in STATE_ENDING / _should_defer_finish can trust the value. # If sanitization rejects the snapshot's expected_duration, also # clear the matched_profile so we don't restore a half-valid state # where Smart Termination can fire on _expected_duration == 0.0. restored_match = snapshot.get("matched_profile") sanitized_expected = self._sanitize_expected_duration( snapshot.get("expected_duration", 0.0), source="restore_state_snapshot", ) if ( restored_match is not None and sanitized_expected == self._SANITIZE_INVALID_SENTINEL ): self._logger.debug( "restore_state_snapshot: dropping matched_profile %r " "because expected_duration sanitized to invalid sentinel", restored_match, ) self._matched_profile = None else: self._matched_profile = restored_match self._expected_duration = sanitized_expected self._end_spike_seen = snapshot.get("end_spike_seen", False) self._end_spike_duration = float(snapshot.get("end_spike_duration", 0.0)) self._match_ambiguous = snapshot.get("match_ambiguous", False) self._match_prefix_ambiguous = snapshot.get("match_prefix_ambiguous", False) # A pre-#364 snapshot has no narrow flag: fall back to the widened # value so a restart cannot loosen the anti-crease gate. self._match_prefix_ambiguous_full_shape = snapshot.get( "match_prefix_ambiguous_full_shape", self._match_prefix_ambiguous ) self._matched_tail_power = self._sanitize_tail_power( snapshot.get("matched_tail_power") ) self._matched_terminal_high = self._sanitize_terminal_high( snapshot.get("matched_terminal_high") ) self._matched_terminal_quiet_s = self._sanitize_terminal_quiet( snapshot.get("matched_terminal_quiet_s") ) # Unconditionally, because the hazard is the value already on the # object, not the one in the snapshot: this restores the ambiguity # flags the ENDING gate reads, so leaving the bound untouched pairs # them with whatever a previous cycle left behind. A snapshot written # before this key existed yields 0.0, i.e. the old refusal. self._longest_candidate_duration = self._sanitize_longest_candidate( snapshot.get("longest_candidate_duration") ) self._ml_defer_start_duration = snapshot.get("ml_defer_start_duration") # Restore state enter time and recompute time_in_state from it enter_time = snapshot.get("state_enter_time") if enter_time: try: self._state_enter_time = dt_util.parse_datetime(enter_time) if self._state_enter_time: elapsed = (dt_util.now() - self._state_enter_time).total_seconds() self._time_in_state = max(0.0, elapsed) except Exception: # pylint: disable=broad-exception-caught self._logger.warning("Failed to parse state enter time") start = snapshot.get("current_cycle_start") self._current_cycle_start = None if start: try: dt_start = dt_util.parse_datetime(start) if dt_start and dt_start.tzinfo is None: # Fix Naive Timestamp (Legacy Data) dt_start = dt_start.replace(tzinfo=dt_util.now().tzinfo) self._logger.warning("Restored Naive start_time, assuming local: %s", dt_start) self._current_cycle_start = dt_start except Exception: # pylint: disable=broad-exception-caught self._logger.warning("Failed to parse start time: %s", start) readings = snapshot.get("power_readings", []) self._power_readings = [] # Detect naive readings once has_naive_readings = False for r in readings: if isinstance(r, (list, tuple)): reading = cast(list[Any] | tuple[Any, ...], r) if len(reading) < 2: continue try: t = dt_util.parse_datetime(str(reading[0])) if t: if t.tzinfo is None: t = t.replace(tzinfo=dt_util.now().tzinfo) has_naive_readings = True value = float(reading[1]) if math.isfinite(value): self._power_readings.append((t, value)) except (TypeError, ValueError) as exc: self._logger.debug("Skipping malformed power reading %s: %s", r, exc) if has_naive_readings: self._logger.warning( "Restored %d power readings with Naive timestamps (fixed to local)", len(self._power_readings), ) # Restore last active last_active = snapshot.get("last_active_time") if last_active: dt_last = dt_util.parse_datetime(last_active) if dt_last and dt_last.tzinfo is None: dt_last = dt_last.replace(tzinfo=dt_util.now().tzinfo) self._last_active_time = dt_last else: self._last_active_time = self._current_cycle_start except Exception as e: # pylint: disable=broad-exception-caught self._logger.error("Failed restore: %s", e) self.reset()