{Securit} Power curtailment silently disabled by locale decimal separator

[dom-omg]

Bug: float("0,5") crashes silently, disabling power curtailment

File: src/cold_pickup_mpc/real_time/power_limit_mpc.py line 146

Code:
security_limit = float(os.getenv("SECURITY_LIMIT", "0,5"))

Problem:
Python's float() requires . as decimal separator. The default value "0,5" raises ValueError on every call
when SECURITY_LIMIT is not set in the environment. The outer try/except in run() silently catches the
exception. Result: _needs_curtailment() never returns True — power curtailment is permanently disabled in
default deployments.

Proof:

float("0,5")
ValueError: could not convert string to float: '0,5'

Fix:
security_limit = float(os.getenv("SECURITY_LIMIT", "0.5"))

Second finding — same file, line 304:
if last_limit < timestamp < first_limit: # always False
last_limit = max(...) is always ≥ first_limit = min(...), so this condition is mathematically impossible.
Out-of-range timestamps are never caught. Formally verified via Z3 SMT solver (UNSAT).

Reported by: Dominik Blain - Cobalt verification engine