Recover saved load learning after clock-jump labels

[frahlg]

Problem and result

The old wall-clock collection bug could leave bad quarter-hour labels in saved household load learning. Fixing new collection did not remove that learned state, so it could survive an update or restart and keep producing unusable forecasts.

Recover only when the retained archive contains two adjacent complete household intervals with the same capture time, both more than two minutes late. Bind older worker cohorts to the current physical learning identity through one archived issue. Reuse the durable load-only learning cutoff, so a crash resumes the same reset and later restarts keep new healthy learning.

Scope and safety

Keep solar learning, saved charging goals and raw evidence. Start the affected load model from its existing configured prior; do not cap household power at the grid fuse or reset healthy models on each boot. A clock that starts before the archive waits for the next archived capture time and checks again after time sync. Reads retain existing row, byte, decompression and time bounds.

Advance past an explicitly rejected observation only after its raw archive save succeeds. Known observation-limit rejections cannot block later valid training. Model/state/configuration errors, storage failures, transport failures and cancellation still retry with visible pipeline failure status.

Verification

• Native recovery and queue regressions pass on macOS, including an interrupted reset, worker/cohort change, backup restoration, clock sync after boot, signal isolation and continued learning after another restart.
• Focused race suite passes for forecast learning, observation queue and worker error classification.
• Eight isolated top-level regression tests pass on Raspberry Pi ARM64 with the packaged Linux worker; none skip. These are process/SQLite/backup tests, not live site control or charging proof.
• A separate synthetic Raspberry Pi test at the 8,192-row archive limit (2,004,044 JSON bytes) reads the observations in 181 ms and completes recovery in 432 ms, within the two-second work budget. It verifies the older cohort binding, worker reset, unchanged solar state and unchanged raw rows. This measures the row limit, not the separate 16 MiB byte cap.
• Independent before/after fixtures reproduce the missing historical recovery and queue starvation before the change, and verify recovery, raw evidence and solar isolation afterward. Healthy high household power does not trigger a reset.
• Native artifact checks, native boundary tests, container/release checks, protocol boundaries, protocol tests, vet and Go build pass.
• Full make verify passes without overlays on 4142cf72cfb7fc63a77dc809056eaca05c420953, rebased on master cc1ee6d73e7494598663e3610c3828cb5648a5e0. This includes the final native worker gate, all Go suites, vet, build and release/contract boundaries.

Checklist

• The change follows VISION.md and one selected scope.
• I checked overlapping PRs and coordinated shared files/contracts; based on merged fix(mpc): keep valid plans when forecast caution fails #1644.
• Relevant checks cover the changed behaviour and failure paths.
• No UI changed.
• A Changeset is included.
• Every commit has a DCO sign-off.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T04:54:09.608987Z	4142cf7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.