retry poweroff on actuation failure

internal/monitor/monitor_test.go

@@ -270,6 +270,61 @@ func TestWithoutDischargeGuardAFalseACReadingIsEnough(t *testing.T) {
 	}
 }
 
+// A failed poweroff must not count as a completed one. If it latched, the
+// battery would reach cell cutoff and the HAT would hard-cut the machine —
+// exactly what the feature prevents.
+func TestFailedActuationRetriesOnTheNextTick(t *testing.T) {
+	m := New(shutdownConfig())
+	settle(t, m)
+
+	for i := 0; i < 3; i++ {
+		m.Tick(onBattery(i), nil)
+	}
+	if !m.Tick(onBattery(3), nil).Shutdown {
+		t.Fatal("expected the first shutdown")
+	}
+
+	// systemctl poweroff failed: polkit denied it, or D-Bus was busy.
+	m.ActuationFailed()
+
+	res := m.Tick(onBattery(4), nil)
+	if !res.Shutdown {
+		t.Fatal("a failed poweroff must be retried on the next qualifying tick")
+	}
+	if m.Retries() != 1 {
+		t.Errorf("Retries() = %d, want 1", m.Retries())
+	}
+
+	// Still latched while the retry is outstanding.
+	if m.Tick(onBattery(5), nil).Shutdown {
+		t.Error("must not fire again before the second attempt is reported failed")
+	}
+}
+
+// Retrying must not defeat the safety guards: if AC returns between attempts,
+// the machine must stay up.
+func TestRetryStillRespectsACReturn(t *testing.T) {
+	m := New(shutdownConfig())
+	settle(t, m)
+
+	for i := 0; i < 3; i++ {
+		m.Tick(onBattery(i), nil)
+	}
+	if !m.Tick(onBattery(3), nil).Shutdown {
+		t.Fatal("expected the first shutdown")
+	}
+	m.ActuationFailed()
+
+	if m.Tick(onMains(), nil).Shutdown {
+		t.Fatal("AC returned; a pending retry must not power the machine off")
+	}
+	for i := 4; i < 7; i++ {
+		if m.Tick(onBattery(i), nil).Shutdown {
+			t.Fatalf("fired at tick %d; the window must restart after AC returned", i)
+		}
+	}
+}
+
 func TestLowSOCAloneCanArm(t *testing.T) {
 	m := New(shutdownConfig())
 	settle(t, m)