retry poweroff on actuation failure

internal/monitor/monitor.go

@@ -105,6 +105,7 @@ type Monitor struct {
 	armVolts  float64
 	inhibited bool
 	firedShut bool
+	retries   int
 }
 
 // New returns a Monitor with the given policy.
@@ -245,6 +246,26 @@ func (m *Monitor) evaluateShutdown(r sensor.Reading) ([]Log, bool) {
 		r.Volts, r.SOC, m.armCount)}}, true
 }
 
+// ActuationFailed reports that the poweroff command did not succeed.
+//
+// It clears the fired latch so a later qualifying tick tries again. Without
+// this, one failed `systemctl poweroff` — a transient polkit denial, a busy
+// D-Bus, logind restarting — would silently disarm the feature for the rest of
+// the discharge, and the battery would reach cell cutoff and hard-cut the
+// machine. That is precisely the outcome shutdown exists to prevent, so a
+// failed attempt must not be treated as a completed one.
+//
+// The arming state is left intact: the battery is still draining, so the next
+// qualifying tick retries one interval later rather than restarting the whole
+// sample window.
+func (m *Monitor) ActuationFailed() {
+	m.firedShut = false
+	m.retries++
+}
+
+// Retries reports how many times actuation has failed and been re-armed.
+func (m *Monitor) Retries() int { return m.retries }
+
 func (m *Monitor) disarm(reason string) []Log {
 	m.inhibited = false
 	if !m.armed {