retry poweroff on actuation failure

internal/monitor/monitor.go

@@ -105,6 +105,7 @@ type Monitor struct {
 	armVolts  float64
 	inhibited bool
 	firedShut bool
+	retries   int
 }
 
 // New returns a Monitor with the given policy.
@@ -245,6 +246,26 @@ func (m *Monitor) evaluateShutdown(r sensor.Reading) ([]Log, bool) {
 		r.Volts, r.SOC, m.armCount)}}, true
 }
 
+// ActuationFailed reports that the poweroff command did not succeed.
+//
+// It clears the fired latch so a later qualifying tick tries again. Without
+// this, one failed `systemctl poweroff` — a transient polkit denial, a busy
+// D-Bus, logind restarting — would silently disarm the feature for the rest of
+// the discharge, and the battery would reach cell cutoff and hard-cut the
+// machine. That is precisely the outcome shutdown exists to prevent, so a
+// failed attempt must not be treated as a completed one.
+//
+// The arming state is left intact: the battery is still draining, so the next
+// qualifying tick retries one interval later rather than restarting the whole
+// sample window.
+func (m *Monitor) ActuationFailed() {
+	m.firedShut = false
+	m.retries++
+}
+
+// Retries reports how many times actuation has failed and been re-armed.
+func (m *Monitor) Retries() int { return m.retries }
+
 func (m *Monitor) disarm(reason string) []Log {
 	m.inhibited = false
 	if !m.armed {

internal/monitor/monitor_test.go

@@ -270,6 +270,61 @@ func TestWithoutDischargeGuardAFalseACReadingIsEnough(t *testing.T) {
 	}
 }
 
+// A failed poweroff must not count as a completed one. If it latched, the
+// battery would reach cell cutoff and the HAT would hard-cut the machine —
+// exactly what the feature prevents.
+func TestFailedActuationRetriesOnTheNextTick(t *testing.T) {
+	m := New(shutdownConfig())
+	settle(t, m)
+
+	for i := 0; i < 3; i++ {
+		m.Tick(onBattery(i), nil)
+	}
+	if !m.Tick(onBattery(3), nil).Shutdown {
+		t.Fatal("expected the first shutdown")
+	}
+
+	// systemctl poweroff failed: polkit denied it, or D-Bus was busy.
+	m.ActuationFailed()
+
+	res := m.Tick(onBattery(4), nil)
+	if !res.Shutdown {
+		t.Fatal("a failed poweroff must be retried on the next qualifying tick")
+	}
+	if m.Retries() != 1 {
+		t.Errorf("Retries() = %d, want 1", m.Retries())
+	}
+
+	// Still latched while the retry is outstanding.
+	if m.Tick(onBattery(5), nil).Shutdown {
+		t.Error("must not fire again before the second attempt is reported failed")
+	}
+}
+
+// Retrying must not defeat the safety guards: if AC returns between attempts,
+// the machine must stay up.
+func TestRetryStillRespectsACReturn(t *testing.T) {
+	m := New(shutdownConfig())
+	settle(t, m)
+
+	for i := 0; i < 3; i++ {
+		m.Tick(onBattery(i), nil)
+	}
+	if !m.Tick(onBattery(3), nil).Shutdown {
+		t.Fatal("expected the first shutdown")
+	}
+	m.ActuationFailed()
+
+	if m.Tick(onMains(), nil).Shutdown {
+		t.Fatal("AC returned; a pending retry must not power the machine off")
+	}
+	for i := 4; i < 7; i++ {
+		if m.Tick(onBattery(i), nil).Shutdown {
+			t.Fatalf("fired at tick %d; the window must restart after AC returned", i)
+		}
+	}
+}
+
 func TestLowSOCAloneCanArm(t *testing.T) {
 	m := New(shutdownConfig())
 	settle(t, m)