FCST-04: the carry-forward fill reaches the plan, and the day it carries survives a restart

FCST-03 shipped `fill_from_yesterday()` complete and checked, and shipped the
consumers written for it - `TariffPlan.firm_points()`, `cheap_now()`'s refusal
of a provisional hour, and `arbitrage()`'s refusal 3, which drops provisional
hours from the trade set rather than refusing the whole series. It shipped NO
CALLER. Nothing in `app/` named the fill, so no series ever contained a carried
point and every one of those consumers was exercising its all-firm branch.

⚠️ THE DEFECT THAT PRODUCED WAS NOT AN ERROR ANYWHERE. `load_prices()` returns
what the feed published and nothing widened it to the requested horizon, so on
a dynamic site between midnight and the 14-16 h CET publication the plan
covered the rest of today and nothing more - measured on the fixture here, 24 h
against a 48 h request. `arbitrage()` then took `max - min` over that truncated
window and reported a spread. The number was real, the window was half the one
configured, and nothing said so: tomorrow evening's peak, the hour a morning
charge would be sold into, was not in the series to be compared against
anything. A missing hour is not a wrong price - it is an hour the optimiser
never learns exists.

WHAT THIS ADDS. `app/price_history.py` keeps the PUBLISHED prices of the last
KEEP_DAYS Brussels days in /data/price_history.json; `resolve_tariff()` gains a
required keyword-only `history` and fills every unpublished hour of the horizon
from yesterday's same-wall-clock hour, flagged. Persistence rather than a
variable on the refresh task, because the window the fill exists for is
midnight -> publication and an add-on restarted at 08:00 would otherwise spend
all of it on the truncated series. Not in state.json: the refresh runs every
1800 s and that file holds the maintenance history and SAFETY-02's latch.

⚠️ ONE CHANGE HERE MOVES ENERGY, AND IT IS NOT THE ONE THE CARD IS NAMED FOR.
Carried hours are provisional, so §8.3 keeps them out of the trade set: the
fill widens what the optimiser can SEE, never what it may DO, and
test_price_history.py checks that so it cannot be overclaimed later. What does
change a trade is that the filled series is windowed to [since, until), so
hours that have ALREADY ELAPSED are no longer in the spread. Before, a cheap
night that had gone sat in the series as the day's cheapest hour - and a cycle
cannot buy in an hour that is past, so the trade was quietly never taken.
Section 2 grades this by finding the cheapest firm hour with and without the
fill and showing it MOVES, from 02:00 UTC to 08:00 UTC on the fixture.

⚠️ A DEAD FEED IS STILL §11.4, NOT YESTERDAY. The fill runs only on a `series`
read. The two are indistinguishable to the optimiser - both 100 % provisional,
so arbitrage refuses on the firm-pair rung and `cheap_now()` is False - so
preferring yesterday's feed over the `static_profile` an operator configured
FOR that case would change a documented degradation for a difference only the
status page can see. That, and two more, in
DECISIONS/FCST-04-the-day-that-is-carried.md.

⚠️ THE ANTI-DECAY RULE IS AN ORDERING, NOT A VALIDATION, and saying so is more
useful than a guarantee that would not hold. Feeding the filled series back in
is how this rots - day 2 carries day 1's guesses, day 3 carries day 2's carry
of them, behind a `provisional` flag that stays TRUE while the NUMBER decays.
No value-level check can catch it: a carried point and `eneco_eddy`'s
published-provisional quarter are the same three fields with the same flag. So
`carry()` is the only public entry, it records BEFORE it fills, the filled
series exists only as a return value the object never sees again, and
test_price_history.py walks app/ for any other module naming `_remember` and
reads `carry()`'s AST to pin the order.

EVIDENCE. 29/29 test files pass in the CI image. Eight mutations driven against
app/price_history.py and app/static_tariff.py, __pycache__ purged before each
run per MUTATION.md/TEST-15: newest-record lookup (5 red), recording the filled
series (1), replace-instead-of-merge (10), UTC-date keying (10), removing the
fill call entirely (12), a lost price field defaulting to 0.0 (2), prune by
clock arithmetic (1), a degraded reason that stops naming its cause (1). No
survivors; baseline and revert both green. Three of those first crashed the
harness instead of reporting a FAIL - "it was refused" and "it broke on the way
to being refused" must not grade the same - so `why()` and `_priced()` were
added and the run repeated.

No option added, config.yaml untouched, and the CHANGELOG entry deliberately
picks no version: PKG-07's rule, and only the deployer knows whether 0.9.0's
image has been pulled.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/app/main.py

@@ -68,6 +68,7 @@ from . import peakguard
 from . import packshare
 from .p1 import P1Ingest, build_source, is_enabled
 from .price import Uncertainty, price_option
+from .price_history import PriceHistory
 from .static_tariff import resolve_tariff, static_status
 from .tariff import PeakStore, PeakTracker
 from .store import migrate_maint_keys, migrate_unit_keys
@@ -165,7 +166,8 @@ def pack_energy_of(inv):
 
 class Controller:
     def __init__(self, opts: dict, hass: HomeAssistant, store, mqtt_pub, *, stop,
-                 peak_db_path: str = "/data/tariff.db"):
+                 peak_db_path: str = "/data/tariff.db",
+                 price_history_path: str = "/data/price_history.json"):
         self.o = opts
         self.hass = hass
         self.store = store
@@ -582,6 +584,27 @@ class Controller:
         self.peak.restore(self.p1.averager)
         _LOG.info("capacity-tariff peak store: %s", self.peak.restore_state)
 
+        # FCST-04. The §8.3 carry-forward store: the published prices of the
+        # last few Brussels days, so the hours a day-ahead feed has not printed
+        # yet can be filled from yesterday's profile and FLAGGED, instead of
+        # being absent from the series entirely.
+        #
+        # ⚠️ IT IS AN INSTRUMENT'S BACKING FILE, NOT A STRATEGY. It commands
+        # nothing and claims nothing; what it changes is how many hours the
+        # plan covers. Before this, a dynamic site between midnight and the
+        # 14-16 h CET publication had a series covering only the rest of today
+        # - typically 10-24 of the 48 hours `price_horizon_h` asked for - and
+        # `TariffPlan.arbitrage()` took its spread over that truncated window
+        # without anything reporting that it had. Every carried hour is
+        # provisional, so refusal 3 drops it from the trade set: this widens
+        # what the optimiser can SEE, never what it may act on.
+        #
+        # ⚠️ A BROKEN OR ABSENT STORE IS NOT AN ERROR HERE. It answers `no_data`,
+        # the fill carries nothing, and the plan is exactly the pre-FCST-04
+        # one - short, but honest and still refusing on the same rules.
+        self.price_history = PriceHistory(price_history_path)
+        _LOG.info("§8.3 price history: %s", self.price_history.words)
+
         # SAFETY-07. The guard TARIFF-01 was built for. It is stateless by
         # design (peakguard.py holds no history between calls), so the only
         # state here is what an EDGE needs: what the last cycle concluded, so
@@ -3455,7 +3478,8 @@ class Controller:
             now = datetime.now(timezone.utc)
             try:
                 plan = await resolve_tariff(
-                    self.o, now, now + timedelta(hours=horizon), now=now)
+                    self.o, now, now + timedelta(hours=horizon), now=now,
+                    history=self.price_history)
                 self.tariff_plan, self.tariff_at = plan, now
                 _LOG.info("tariff refreshed: %s", plan.words)
             except Exception as err:                          # noqa: BLE001
@@ -4304,6 +4328,13 @@ class Controller:
             ("Maintenance due", "now" if next_due is None else next_due.strftime("%Y-%m-%d")),
             ("Cheap window", "yes" if self.cheap else "no"),
             ("Tariff", self.tariff_words),
+            # FCST-04. WHAT §8.3 HAS TO CARRY FORWARD, which is the difference
+            # between a 48-hour plan and a 12-hour one on a weekday morning.
+            # It is its own row rather than a clause of "Tariff" because it
+            # answers a different question: "Tariff" says what the plan IS, and
+            # this says what the plan could still be filled from if the feed is
+            # late again tomorrow.
+            ("Price history", self.price_history.words),
             # OPT-04. The strategy's own sentence, not a re-derivation of it -
             # every refusal it can make already carries a reason a human can
             # act on, and "Arbitrage: no" would throw all of them away.