Test coverage inverts the risk: 6 of 8 test files cover v5b markets; plant, EKF, EMS, MPC and ledger share one smoke test

[dim-sous]

What is wrong

tests/ today:

file	covers
test_greek_settlement.py	v5b settlement
test_milp_bidding_invariants.py	v5b MILP planner
test_milp_phase4_stress.py	v5b stress
test_greek_milp_bidding_e2e.py	v5b end-to-end (+ the bit-identity proof for pre-v5b traces)
test_clearing.py	v5b clearing
test_imbalance.py	v5b imbalance
test_simulation_smoke.py	everything else

Six of eight files cover the newest code. The 980-line plant model (core/physics/plant.py), the EKF, the stochastic EMS, the economic MPC and the ledger — the physics and control that every number in every gate report rests on — are covered by one smoke test between them. The parts hardest to reason about after months away are the parts with least protection.

This is not a request for coverage percentage. It is that the seam work (#2–#5) has no safety net where it cuts. Every seam issue says "proof: bit-identical traces before and after" — that proof needs a pinned reference trace per component, and none exists.

What it should be

Tests of the kind RCWS uses to hold structure, not just behaviour:

• A frozen-trace regression per component: canonical synthetic day, each strategy, traces pinned to a checked-in reference (hash or .npz). This is the instrument every seam issue's proof runs on. Do this first, before any seam is cut.
• Structural tests: the one-way import rule (The repo has no ships / never-ships boundary: plant, prices, ledger and the loop sit beside the controller in core/ #1), the frozen src/ inventory (The repo has no ships / never-ships boundary: plant, prices, ledger and the loop sit beside the controller in core/ #1), every registered entity carries provenance (The estimator has no seam: EKF hardcoded in the loop, EKFParams welded into run_simulation, its name baked into the traces — a UKF touches 6–10 files #2, The plant is a type switch: BatteryPack if use_pack else BatteryPlant — a third plant model is another branch in the core #3), no strategy-specific branch in the loop.
• Physics invariants on the plant: energy balance across a charge–discharge cycle, SOC bounds, temperature monotone under constant current — the properties a UKF (The estimator has no seam: EKF hardcoded in the loop, EKFParams welded into run_simulation, its name baked into the traces — a UKF touches 6–10 files #2) will later be validated against, so they should exist before the swap.
• Estimator: consistency (NEES/NIS-style) on the EKF against plant truth — the check that will tell EKF and UKF apart, so it should exist before there are two.

Done when

• A reference-trace test exists for the canonical synthetic day per strategy, and fails on a one-bit change.
• Structural tests from The repo has no ships / never-ships boundary: plant, prices, ledger and the loop sit beside the controller in core/ #1 exist.
• At least the energy-balance and SOC-bounds invariants on the plant.

Precondition for phase 1 of the platform epic — the net goes up before the seams are cut.