MAINT-05: one recalibration per pack, and only one pack moves power at a time

§12's monthly cycle drains a pack to empty and refills it to true its coulomb
counter. There was exactly one `Maintenance` and one un-namespaced history, so
at two packs only the first was ever recalibrated - and nothing prevented the
cycle draining pack A while the loop charged pack B, which is two power-moving
phases on one grid connection pulling against each other.

* ONE `Maintenance` PER ROSTER ENTRY, each with its own schedule, phase and
  history under `unit/<name>/...`. `store.migrate_maint_keys()` moves an
  install's flat history into the first pack's namespace under
  `migrate_unit_keys()`'s three rules - shared in code via `_move_flat_keys()`
  and `_verify_moves()`, not restated - on its own marker, because unlike
  DEV-02's it runs only where the roster has more than one pack. The flat keys
  are kept LIVE as the rollback view.
* ONE MAINTENANCE SLOT PER SITE (`maintenance.arbitrate()`). At most one pack
  in a power-moving phase - drain, charge AND hold. The holder is DERIVED from
  the packs' own stored phases, never persisted, so a restart mid-drain
  re-derives it. Several packs due in the same hour: the slot goes to the one
  that has gone longest without a completed cycle; roster order breaks a
  numeric tie and nothing else. Nothing preempts a cycle in flight.
* THE DEFERRED PACK IS NOT STARVED AND IS NOT A FAULT. A deferral does not
  stamp `last_start_attempt` and does not move the phase, so neither the 12 h
  drain nor the 36 h charge timeout is reachable by waiting.
* The claim is filed on the pack whose state machine produced it, and stays
  SCOPE_UNIT - ARCH-01's rule.
* `validate.py` rule 6 grades `maintenance_charge_w` against the WEAKEST cap on
  the roster now, as its own comment said it must once `maint_unit` stopped
  being `inverters[0]`.
* At a roster of one nothing changes, and it is asserted: no new store key, the
  migration does not run, the four cycle events are the shipped strings, the
  banner is the bare phase.
* RECORDED NOT FIXED: a drain pins its pack while the loop's target is a site
  claim, so below the pin the allocator refuses the split and the site parks at
  0 W. Pre-existing at 2d025ee. Pinned as a running check.

Verified: 19/19 suites green in the CI image; 17 mutations run through
tools/mutation_run.sh (bytecode purged), every one observed red.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/test_validate.py

@@ -353,6 +353,64 @@ check("...and it is refused with maintenance_enabled off, as shipped",
           base(max_w=2000, maintenance_charge_w=2500,
                maintenance_enabled=False), -5000, 5000), "THE CEILING WINS"))
 
+# ⚠️ MAINT-05: AND AT TWO PACKS IT IS THE WEAKEST CAP, NOT THE FIRST ENTRY'S.
+# The comment this replaces in validate.py said, in as many words, that it took
+# the FIRST unit's cap because there was exactly one `Maintenance` and it could
+# only ever recalibrate `inverters[0]` - and that "when `maint_unit` stops being
+# `inverters[0]`, this line moves with it". It has. Every pack is now
+# recalibrated on its own schedule, so the shaping claim can be filed on any of
+# them and the cap that contradicts it first is the smallest.
+#
+# ⚠️ THE FIXTURE'S TWO CAPS ARE DELIBERATELY DIFFERENT AND THE RATE SITS
+# BETWEEN THEM. Two equal caps could not tell "grades the first" from "grades
+# the smallest", and a rate above both would be refused by either rule - so
+# 3000 W against caps of 5000 W and 2000 W is the one arrangement where the old
+# answer and the new one disagree. ⚠️ 2000 W for the second pack is a
+# HYPOTHESIS: inverter B does not physically exist and nothing here is measured
+# from one.
+def _roster(a_max, b_max, **over):
+    o = base(**over)
+    for k in ("setpoint_entity", "soc_entity", "batt_entity", "max_w"):
+        o.pop(k, None)
+    o["inverters"] = [
+        dict(name="inverter-a", setpoint_entity="number.sp_a",
+             soc_entity="sensor.soc_a", batt_entity="sensor.batt_a",
+             max_w=a_max),
+        dict(name="inverter-b", setpoint_entity="number.sp_b",
+             soc_entity="sensor.soc_b", batt_entity="sensor.batt_b",
+             max_w=b_max)]
+    return o
+
+
+_two = _roster(5000, 2000, maintenance_charge_w=3000, maintenance_discharge_w=1000,
+               sign_disagree_w=300, unit_sign_disagree_w=300)
+_p_two = [p for p in validate_startup_config(_two, -5000, 5000)
+          if "maintenance_charge_w" in p]
+print(f"    5000 W and 2000 W packs, charge 3000 W -> {_p_two}")
+check("⚠️ A CHARGE RATE THE SMALLEST PACK CANNOT TAKE IS REFUSED, even though "
+      "the FIRST pack could. Before MAINT-05 the second pack was never "
+      "recalibrated, so its cap could not contradict anything; it is now, and "
+      "its cheap-window charge would ask for hi=-3000 against lo=-2000 - the "
+      "`lo > hi` contradiction, 0 W, on the pack nobody was watching",
+      len(_p_two) == 1 and why(_p_two, "max_w (inverter-b) is 2000 W"))
+check("...and the message names the pack the number came off, not the first "
+      "entry - an operator told to lower a number on the wrong device is being "
+      "sent to the wrong device by the message that exists to stop that",
+      not why(_p_two, "max_w (inverter-a)"))
+check("...while the same rate against two packs that can both take it starts, "
+      "so this is a comparison and not a blanket refusal of rosters",
+      [p for p in validate_startup_config(
+          _roster(5000, 4000, maintenance_charge_w=3000,
+                  maintenance_discharge_w=1000, sign_disagree_w=300,
+                  unit_sign_disagree_w=300), -5000, 5000)
+       if "maintenance_charge_w" in p] == [])
+check("...and at a ROSTER OF ONE `min()` over one cap is that cap: the same "
+      "message, the same boundary, the same refusal the flat config always got",
+      why(validate_startup_config(base(max_w=2000, maintenance_charge_w=2500),
+                                  -5000, 5000), "THE CEILING WINS")
+      and validate_startup_config(base(max_w=2000, maintenance_charge_w=2000),
+                                  -5000, 5000) == [])
+
 # ⚠️ THE SIBLING, CHECKED RATHER THAN ASSUMED. The shaping is NOT symmetric:
 # drain files Claim.set at P_MAINTENANCE and owns the actuator, so the ceiling
 # CLAMPS it (+2000 W) instead of contradicting it, and the arbiter's explain()