ADR 0014: Auto-dosing safety
Draft. This page describes intended behaviour that has not been verified on a real Gardyn yet.
Status: Proposed Date: 2026-10-31
Decision
Phase 6.3 adds peristaltic dosing (pH-down, nutrients A/B) as dose_<n>
actuators. Each passes through hal_core::safety::DoseGuard: per-dose volume
cap, hard daily volume cap, minimum interval between doses, lockout after N
doses without a measured response, and a latched fault on any sensor loss.
Dosing is disabled by default and enabled per pump in hal.toml; the core
controller (target bands with hysteresis) is a later phase and also defaults
off.
Consequences
- No dosing ever happens from a schedule alone; a measured pH/EC is required.
Amendment (2026-10-31): dose_fault
Dosing lockouts and faults now raise their own dose_fault alert kind
(contract fixture alert_dose_fault.json) instead of sharing pump_fault.
alert/dose_fault/ack clears only the dosers; alert/pump_fault/ack clears
only the circulation pump, so re-arming one can never silently re-arm the
other. The long button press, which needs someone at the unit, clears both.
Core no longer raises per-doser dose_N_fault rows; the single dose_fault
alert names the doser and its acknowledge reaches hald.
Sources: sleepypod/core (conventions and ADR precedents) · iot-root/garden-of-eden (reference implementation)
Imported from docs/adr/0014-auto-dosing-safety.md in seedypod/core. Edit it there, not here.