From 4ac5ec1afee0accd3e7ffded5ef4e95edfd187ca Mon Sep 17 00:00:00 2001 From: xmap <16776958+xmap@users.noreply.github.com> Date: Wed, 19 Aug 2026 09:21:30 -0500 Subject: [PATCH] Say what the permit observer's Bad floor does and does not catch at restart The floor's docstring argued at length for Bad-not-Good, because 2-BM's SecureM sits at MAJOR whenever the hutch is unsecured, but never said what else the floor is holding. An earlier draft of this commit claimed it guards the IOC-restart window outright. Measurement says otherwise, so the note now records the limit instead of the reassurance. A record that has never had a value assigned reports STAT=UDF with SEVR=INVALID, arrives as Bad, and closes the gate. A record given a value without processing does not: a field(VAL, ...) default at load, or an autosave restore at boot, clears UDF and leaves SEVR=NO_ALARM, so it reads Good while still carrying no substrate timestamp. Measured on a scratch IOC, base 7.0.8 with autosave R5-11. Which group SecureM falls into is unconfirmed, so the floor must not be treated as a restart guard. produced_at is the only signal that separates the two, and this path carries it as evidence without gating on it. Mechanism confirmed on tomography/tomoscan#182. Co-Authored-By: Claude Opus 5 (1M context) --- .../src/cora/api/_enclosure_permit_observer.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/apps/api/src/cora/api/_enclosure_permit_observer.py b/apps/api/src/cora/api/_enclosure_permit_observer.py index ba798f306ca..129ae14e6dd 100644 --- a/apps/api/src/cora/api/_enclosure_permit_observer.py +++ b/apps/api/src/cora/api/_enclosure_permit_observer.py @@ -97,6 +97,22 @@ def permit_status_from_reading(reading: Measurement) -> str: because CORA's permit status records what the interlock reports and actuates nothing; the PSS, not CORA, is what holds the hutch. + The floor also bears on the IOC-restart window, but it covers less + of that than it first appears, so do not lean on it. A record that + has never had a value assigned reports `STAT=UDF` with + `SEVR=INVALID`, which arrives here as `Bad` and flattens to + `Unknown`, closing the gate. A record that was GIVEN a value + without ever processing does not: a `field(VAL, ...)` default at + load, or an autosave restore at boot, clears `UDF` and leaves + `SEVR=NO_ALARM`, so it arrives as `Good` while still carrying no + substrate timestamp. Measured on a scratch IOC, base 7.0.8 with + autosave R5-11, 2026-08; see `tomography/tomoscan#182`. + + Which group 2-BM's SecureM falls into is unconfirmed, so this floor + is not a restart guard. The only signal separating a stamped + reading from an unstamped one is `produced_at`, which this path + carries as evidence and never gates on. + Both shapes a CA adapter can hand back are accepted, because a real SecureM is a `bi` record and arrives as `kind="Categorical"`. For DBR_ENUM, `EpicsCaControlPort` resolves the index to its label