Add rod safety backoff and staged ramp test

src/reactor_sim/control.py

@@ -68,7 +68,23 @@ class ControlSystem:
     def set_manual_mode(self, manual: bool) -> None:
         if self.manual_control != manual:
             self.manual_control = manual
-            LOGGER.info("Rod control %s", "manual" if manual else "automatic")
+        LOGGER.info("Rod control %s", "manual" if manual else "automatic")
+
+    def safety_backoff(self, subcooling_margin: float | None, dnb_margin: float | None, dt: float) -> None:
+        """Insert rods proactively when thermal margins are thin."""
+        if self.manual_control:
+            return
+        severity = 0.0
+        if subcooling_margin is not None:
+            severity = max(severity, max(0.0, 5.0 - subcooling_margin) / 5.0)
+        if dnb_margin is not None:
+            severity = max(severity, max(0.0, 1.5 - dnb_margin) / 1.5)
+        if severity <= 0.0:
+            return
+        backoff = (0.01 + 0.04 * severity) * dt
+        self.rod_target = clamp(self.rod_target + backoff, 0.0, 0.95)
+        self._advance_banks(self.rod_target, dt)
+        LOGGER.debug("Safety backoff applied: target=%.3f severity=%.2f", self.rod_target, severity)
 
     def coolant_demand(
         self,

src/reactor_sim/reactor.py

@@ -401,6 +401,8 @@ class Reactor:
         residual = max(0.0, total_power - transferred)
         self.thermal.step_core(state.core, state.primary_loop, total_power, dt, residual_power_mw=residual)
         self.thermal.step_secondary(state.secondary_loop, transferred, dt)
+        if not self.control.manual_control and not self.shutdown:
+            self.control.safety_backoff(state.core.subcooling_margin, state.core.dnb_margin, dt)
         self._apply_secondary_boiloff(state, dt)
         self._update_loop_inventory(
             state.secondary_loop, constants.SECONDARY_LOOP_VOLUME_M3, constants.SECONDARY_INVENTORY_TARGET, dt