SAFETY-125 round 2: the one-inverter maintenance charge is sized to the room too

Owner 2026-10-29: fix N=1 in this hotfix. _charge_headroom() no longer
returns early at one inverter, so the N=1 cheap-window maintenance charge
is held to charge_room_w() as at N=2; SAFETY-84's site-stop rule stays N>=2
only (at N=1 such a stop outranks the shaping anyway). The guard no longer
steps in and gives power at each quarter's end during that charge.

test_safety125.py: N=1 maintenance on 5 s and 10 s meters with late
readings, with and without a banked peak; the row in an N=2 maintenance
charge and in shadow mode; edge cases (blind past the hold, a start
mid-quarter, the summer-time change, the forecast in W, a 10 s meter, the
last second). test_safety84/87: three N=1 pins move. test_safety119: its
quarter-edge hand-back runs keep the old N=1 sizing as a fixture, plus a
check that with the new sizing nothing hands back. CHANGELOG, DECISIONS,
DOCS follow.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/CHANGELOG.md

@@ -7,18 +7,18 @@ No option was added, removed or renamed, and no default changed (86 options).
 **Existing installs need no option change:** options that start 0.19.1 also
 start 0.19.2. The change below applies with one inverter or two.
 
-**Charging from the grid now stays under this month's peak.** When a meter reading came late near the end of a 15-minute period, a grid charge could go back to full power and push that period over the peak; now it is cut back. The peak guard line no longer says "under" when the period is over the limit at the current rate.
+**Charging from the grid now stays under this month's peak.** A late meter reading near a period's end could push a grid charge to full power. That could take the 15-minute period over the peak. Now the charge is cut back, with one inverter too. The peak guard line no longer says "under" when the period is over.
 
 Contents of this release, in merge order since 0.19.1 (`2932f3a`):
 
 | | |
 |---|---|
-| `SAFETY-125` | A grid charge (a battery mode's cheap run, price trading or the maintenance charge at two inverters) counts the seconds since a late meter reading at that reading, so it is cut back near the end of a 15-minute period instead of going back to full power. Over the limit at the current rate, the peak guard row and the month peak line say so, and that the grid charge is cut back ([[SAFETY-125]]). |
+| `SAFETY-125` | A grid charge (a battery mode's cheap run, price trading or the maintenance charge, with one inverter or two) counts the seconds since a late meter reading at that reading, so it is cut back near the end of a 15-minute period instead of going back to full power. With one inverter the maintenance charge is now held to the room left in the period, as with two, so the peak guard no longer steps in and gives power at the period's end. Over the limit at the current rate, the peak guard row and the month peak line say so, and that the grid charge is cut back ([[SAFETY-125]]). |
 
 ### Known issues
 
 The list under `## 0.19.0` below still applies. The SAFETY-99 line there now
-covers the guard's discharge, and the maintenance charge with one inverter.
+covers the guard's discharge only, not a grid charge.
 
 ### If you are crossing from a version older than 0.10.0
 

goodwe_controller/DECISIONS/SAFETY-125-grid-charge-under-the-month-peak.md

@@ -5,6 +5,6 @@
 A grid charge is sized by `peakguard.charge_room_w()`, the guard's headroom
 with the seconds since a late meter reading counted at that reading (the
 projection leaves them out, SAFETY-99, the bill does not), and the guard's own
-floor is unchanged. Not at N=1: the maintenance charge there is not sized to
-the room (SAFETY-84), so SAFETY-99 still applies to it. Evidence (repro on
-0.19.1, sweep, digests): the SAFETY-125 pull request.
+floor is unchanged. At N=1 the maintenance charge is now sized too (owner
+2026-10-29; SAFETY-84 had left it out). Evidence (repro on 0.19.1, sweep,
+digests): the SAFETY-125 pull request.

goodwe_controller/DECISIONS/SAFETY-84-charge-at-two.md

@@ -39,7 +39,8 @@ was fine.
 **Not changed.**
 - At N=1 the charge is not sized to the headroom: the guard still suspends it
   and the battery gives until the quarter is safe. The same sizing would fit
-  there; that is an owner question, not this fix.
+  there; that is an owner question, not this fix. (SAFETY-125, 0.19.2: the
+  owner said yes, and N=1 is sized the same way.)
 - Outside a cheap window (`hi = 0`, solar only) nothing is filed, at any N.
 - A HOLD (later fixed by [[SAFETY-86]]) and the "Battery is not keeping up"
   alarm (SAFETY-85) are untouched. In the identity runs that alarm's log line

goodwe_controller/DOCS.md

@@ -1708,7 +1708,9 @@ DECISIONS/MAINT-13-full-pack-is-complete.md.
 On a capacity-tariff site the maintenance charge is capped by the headroom left
 under `peak_cap_w`, and if the forecast goes over the cap the charge-only clamp
 is dropped so the battery can shave the peak instead. Money outranks the
-maintenance schedule.
+maintenance schedule. With one battery or several, the charge also stays
+within the room left in the 15-minute period, so a late meter reading does
+not let it run at full power.
 
 With two or more batteries, the one being emptied gives its drain rate and the
 others only add power when the house needs more; none charges while it drains

goodwe_controller/app/main.py

@@ -3232,14 +3232,14 @@ class Controller:
         return floor
 
     def _charge_headroom(self, floor: float, claims) -> float:
-        """SAFETY-84: at N>=2 a cheap-window charge pulls no more than the
-        quarter's headroom under the peak aim (`charge_headroom_w()`), so it
-        yields just enough to the peak guard, and nothing under a site stop
-        (its 0 W would need the other pack to give). N=1 is unchanged."""
-        if len(self.inverters) < 2:
-            return floor
-        if any(c.kind == SET and c.actuator == ACTUATOR_SITE
-               and c.priority > P_MAINT_SHAPE for c in claims):
+        """SAFETY-84: a cheap-window charge pulls no more than the quarter's
+        room under the peak aim (`charge_room_w()`), so it yields just enough
+        to the peak guard; at N>=2 nothing under a site stop (its 0 W would
+        need the other pack to give). SAFETY-125: at N=1 too, owner
+        2026-10-29; the stop rule stays N>=2 only."""
+        if len(self.inverters) > 1 and any(
+                c.kind == SET and c.actuator == ACTUATOR_SITE
+                and c.priority > P_MAINT_SHAPE for c in claims):
             return 0.0
         room = peakguard.charge_room_w(self.peak_guard, self._peak_proj)
         floor = floor if room is None else min(floor, room)

goodwe_controller/test_safety119.py

@@ -19,7 +19,9 @@ DECISIONS/SAFETY-121-bound-every-quarter.md.
 1. The rig's shape (1 s meter that lags the battery, 1 s battery lag, house
    800 W, rating 2500 W, limit 2500 W, margin 50, charge 2000 W, no
    forecast), 2 h, three seeds: no notification, the cap held, every command
-   the same as without the fix; without the fix it warns.
+   the same as without the fix; without the fix it warns. SAFETY-125 sized
+   the N=1 charge to the room, which removed this hand-back; these runs keep
+   the old sizing, and one run checks that with it nothing hands back.
 2. A genuine integrator bound still warns: the loop in charge with the house
    over the rating (at once, as before), and the loop at its rail after a
    hand-back (after the settle).
@@ -140,10 +142,29 @@ def house(seed, base=800.0, step=None):
     return load
 
 
+_SIZED_CH = Controller._charge_headroom
+
+
+def _n1_unsized(self, floor, claims):
+    """The N=1 cheap-window charge as before SAFETY-125: not sized to the
+    quarter's room, so the guard steps in at each quarter's end and hands
+    back - the shape this file grades the settle on."""
+    return floor if len(self.inverters) < 2 \
+        else _SIZED_CH(self, floor, claims)
+
+
 def run(load, *, n=1, dur=7200.0, delay=1, extra=None, cheap=True, cut=None,
-        charging=True, blind=0.0):
+        charging=True, blind=0.0, sized=False):
     """One run of `n` inverters of 2500 W; `charging=False`: no maintenance,
-    the loop in charge; `blind`: no meter reading until that second."""
+    the loop in charge; `blind`: no meter reading until that second.
+    SAFETY-125 sizes the N=1 charge to the room, so it no longer hands back
+    at a quarter's end; an N=1 charge here keeps the old sizing unless
+    `sized`, so the hand-back this file is about still happens."""
+    if n == 1 and charging and not sized:
+        return patched(Controller, "_charge_headroom", _n1_unsized)(
+            lambda: run(load, n=n, dur=dur, delay=delay, extra=extra,
+                        cheap=cheap, cut=cut, charging=charging,
+                        blind=blind, sized=True))
     extra = dict(extra or {})
     s84.OPT = dict(OPT0, peak_cap_w=int(CAP * n), peak_margin_w=50,
                    maintenance_charge_w=2000)
@@ -231,6 +252,15 @@ check("non-vacuous: without the fix every run warns, at a quarter's edge",
       all(len(notes(c)) >= 1 for _r, c in OLD.values())
       and all(min(t % QUARTER, QUARTER - t % QUARTER) <= 40
               for _r, c in OLD.values() for t in notes(c)))
+_sz = run(house(1), sized=True)
+print(f"    SAFETY-125's sizing, seed 1: guard step-ins "
+      f"{guard_steps(_sz[1])}, notifications {notes(_sz[1])}, highest "
+      f"quarter {max(quarters(_sz[1]), default=0.0):.0f} W")
+check("SAFETY-125: with the N=1 charge sized to the room the guard does not "
+      "step in at the quarter's end, nothing warns and the cap holds",
+      not any(r[-1][1] and r[-1][1][0] for r in _sz[0])
+      and notes(_sz[1]) == [] and any(r[1] < -1000.0 for r in _sz[0])
+      and len(quarters(_sz[1])) == 8 and max(quarters(_sz[1])) < CAP)
 
 # ============================================================================ #
 print("\n2. a genuine integrator bound still warns")

goodwe_controller/test_safety125.py

@@ -21,6 +21,13 @@ live), inverter-b Solar first, a house of 1 kW, cap 3500 W, margin 50 W.
 4. A healthy meter: the quarters as before, and the row and the month-peak
    line say what is true.
 5. The words on their own.
+6. One inverter: the maintenance charge is sized to the room too (owner
+   2026-10-29), on a 5 s and a 10 s meter, with and without a banked peak
+   and with late readings; the guard no longer steps in during it.
+7. The row during an N=2 maintenance charge and in shadow mode.
+8. Edge cases: a reading past its 30 s hold (blind), a start mid-quarter,
+   the summer-time change, the forecast entity in W, a 10 s meter, the
+   quarter's last second.
 
 Mutations (MUTATION.md, purged copies) are listed in the pull request.
 """
@@ -43,7 +50,7 @@ import opt11p3_replay as rp                                    # noqa: E402
 import safety84_identity as s84                                # noqa: E402
 import app.main as m                                           # noqa: E402
 import app.p1 as p1mod                                         # noqa: E402
-from named_absence import first, present                       # noqa: E402
+from named_absence import first, nth, present                  # noqa: E402
 from app import homeview, messages, peakguard, tariff          # noqa: E402
 from app import price as _price, static_tariff as _st          # noqa: E402
 from app.main import Controller                                # noqa: E402
@@ -103,9 +110,20 @@ async def _no_fetch(*a, **k):
     raise AssertionError("the tariff task reached for a price feed")
 
 
-def drive(o, *, peak=None, late=0.0, minutes=31, every=0):
-    """The real Controller from 00:00 local for `minutes` at a 1 s cycle
-    (OPT-15's lag). `late`: no P1 telegram in each quarter's last `late` s.
+class OnItsOwn(rp.Plant):
+    """Charges 5000 W whatever it is asked (shadow mode: nothing is
+    written, the inverter charges on its own)."""
+
+    def step(self, dt, floor):
+        self.cmd = -5000.0
+        super().step(dt, floor)
+
+
+def drive(o, *, peak=None, late=0.0, minutes=31, every=0, start=None,
+          period=0.0, fc_unit="kW", plant=Harder):
+    """The real Controller from `start` (00:00 local) for `minutes` at a 1 s
+    cycle (OPT-15's lag). `late`: no P1 telegram in each quarter's last
+    `late` s; `period`: one telegram every `period` s (0: every cycle).
     -> (controller, rows, {quarter start: true grid average}, samples), the
     samples taken every `every` cycles from the second quarter (the first
     starts before the first reading): (projection, ceiling, engaged,
@@ -116,27 +134,29 @@ def drive(o, *, peak=None, late=0.0, minutes=31, every=0):
         store.data[unit_key(f"inverter-{u}", "pack_mode")] = mode
         store.data[unit_key(f"inverter-{u}", "pack_sell")] = False
     rows, samples, sums = [], [], {}
+    t0 = start or START
 
     async def go():
         lag = rp.Lag()
         hass = rp.Hass(("a", "b"), lambda t: 1000.0, {"a": 11.0, "b": 10.0},
                        limits={"a": (-5000.0, 5000.0),
                                "b": (-4600.0, 4600.0)}, lag=lag)
-        hass.plants["a"].__class__ = Harder
+        hass.plants["a"].__class__ = plant
         fc_kw = [0.0]
 
         async def state(e):
             # The HA quarter projection, in kW like the live template.
             return None if e != FC else {
-                "state": f"{fc_kw[0]:.3f}",
-                "attributes": {"unit_of_measurement": "kW"}}
+                "state": (f"{fc_kw[0]:.3f}" if fc_unit == "kW"
+                          else f"{fc_kw[0] * 1000.0:.0f}"),
+                "attributes": {"unit_of_measurement": fc_unit}}
         hass.state = state
         tmp = tempfile.mkdtemp(prefix="s125-")
         db = os.path.join(tmp, "tariff.db")
         if peak is not None:
             tariff.PeakStore(db)._db.execute(
                 "INSERT INTO monthly_peak VALUES (?, ?, ?, NULL)",
-                (tariff.month_key(START), peak,
+                (tariff.month_key(t0), peak,
                  "2026-10-21T20:15:00+00:00")).connection.commit()
         c = Controller(dict(o), hass, store, rp._Pub(), stop=asyncio.Event(),
                        peak_db_path=db,
@@ -145,7 +165,7 @@ def drive(o, *, peak=None, late=0.0, minutes=31, every=0):
         c.inverters[1].dev_min, c.inverters[1].dev_max = -4600.0, 4600.0
         c.auto = True
         real = m.datetime, homeview.datetime, p1mod.time
-        clock, simt = [START], [0.0]
+        clock, simt = [t0], [0.0]
 
         class _DT(real[0]):
             @classmethod
@@ -160,7 +180,7 @@ def drive(o, *, peak=None, late=0.0, minutes=31, every=0):
             hass.advance(0.0, 10.0)
             t, n = 0.0, 0
             while t < minutes * 60:
-                now = START + timedelta(seconds=t)
+                now = t0 + timedelta(seconds=t)
                 hass.t, simt[0], clock[0] = t, t, now
                 if t == 0.0:
                     for _ in range(500):
@@ -173,7 +193,8 @@ def drive(o, *, peak=None, late=0.0, minutes=31, every=0):
                 fc_kw[0] = (acc[0] + g_now * (QUARTER_S - acc[1])) \
                     / QUARTER_S / 1000.0
                 if now.timestamp() % QUARTER_S < QUARTER_S - late \
-                        and t >= lag.p1_s:
+                        and t >= lag.p1_s \
+                        and (not period or t % period < 1e-9):
                     imp, exp = split_signed(hass._past(lag.meter_s
                                                        + lag.p1_s)[0])
                     c.p1.submit(make_sample(
@@ -305,30 +326,39 @@ check("modes off, price trading on, a reading 30 s late: every quarter at "
       and any(r[3] == "ARBITRAGE_CHARGE" for r in _ra))
 
 
-def late_feed(gap):
+def late_feed(gap, every=0.0, look=None):
     """safety84's cheap-window feed, no telegram in each quarter's last
-    `gap` s."""
+    `gap` s, and one only every `every` s (0: every cycle). `look(c, t)`
+    runs first, on the state the previous cycle left."""
     feed = s84.feed(True)
 
     def before(c, t):
-        if (rig.BASE.timestamp() + t) % QUARTER_S < QUARTER_S - gap \
+        if look is not None:
+            look(c, t)
+        if ((rig.BASE.timestamp() + t) % QUARTER_S < QUARTER_S - gap
+                and (not every or t % every < 1e-9)) \
                 or not getattr(c.hass, "_s84", False):
             feed(c, t)
     return before
 
 
+def rig_quarters(rows, load):
+    """The safety84 rig's whole quarters: the true average import (W)."""
+    qs = {}
+    for r in rows:
+        q = int((rig.BASE.timestamp() + r[0]) // QUARTER_S)
+        a = qs.setdefault(q, [0.0, 0])
+        a[0] += max(0.0, load(r[0]) - sum(v for _u, v in r[2]))
+        a[1] += 1
+    return {datetime.fromtimestamp(q * QUARTER_S, L).strftime("%H:%M"):
+            s / k for q, (s, k) in sorted(qs.items())
+            if k * rig.TICK >= QUARTER_S}
+
+
 for peak, house, aim in ((5413.0, 4000.0, 5363.0), (None, 2500.0, AIM_CAP)):
     _mr, _mc = s84.run(2, load=lambda t, h=house: h, dur=2700.0,
                        month_peak=peak, before=late_feed(30.0))
-    _qs = {}
-    for r in _mr:
-        q = int((rig.BASE.timestamp() + r[0]) // QUARTER_S)
-        a = _qs.setdefault(q, [0.0, 0])
-        a[0] += max(0.0, house - sum(v for _u, v in r[2]))
-        a[1] += 1
-    _mf = {datetime.fromtimestamp(q * QUARTER_S, L).strftime("%H:%M"): s / k
-           for q, (s, k) in sorted(_qs.items())
-           if k * rig.TICK >= QUARTER_S}
+    _mf = rig_quarters(_mr, lambda t, h=house: h)
     check(f"N=2 maintenance charge, house {house:.0f} W, "
           f"{'peak banked' if peak else 'no peak banked'}, a reading 30 s "
           f"late: every quarter at or under the aim",
@@ -399,6 +429,133 @@ check("the month-peak line in shadow mode says 'would'",
       and homeview.line_period(5814.0, 5413.0, False).endswith(
           "The batteries step in above 5.4 kW."))
 
+
+# ============================================================================ #
+print("\n6. one inverter: the maintenance charge is sized to the room too")
+# The start-up quarter on a 10 s meter: the charge's first step is not seen
+# until the second reading, so it may land up to START_TOL over the aim; the
+# same at N=2 and before this fix. Every later quarter is graded at TOL.
+START_TOL = 15.0
+N1 = {}
+for peak, house, aim in ((5413.0, 4000.0, 5363.0), (None, 2500.0, AIM_CAP)):
+    for late, every in ((0.0, 0.0), (30.0, 0.0), (20.0, 10.0)):
+        _r, _c = s84.run(1, load=lambda t, h=house: h, dur=2700.0,
+                         month_peak=peak, before=late_feed(late, every))
+        _q = rig_quarters(_r, lambda t, h=house: h)
+        N1[peak, late, every] = (_r, _c)
+        _vals = list(_q.values())
+        _tag = (f"N=1, {'peak banked' if peak else 'no peak banked'}, "
+                f"{'10 s' if every else '5 s'} meter, "
+                f"{'late ' + format(late, '.0f') + ' s' if late else 'healthy'}")
+        print(f"    {_tag}: quarters "
+              f"{ {k: round(v, 1) for k, v in _q.items()} } W, aim {aim:.0f}")
+        check(f"{_tag}: every quarter at or under the aim",
+              len(_vals) == 3
+              and all(v <= aim + TOL for v in _vals[1:])
+              and nth(_vals, 0, "a first quarter")
+              <= aim + (START_TOL if every else TOL)
+              and any(mm.phase == "charge" for mm in _c.maints))
+_hr, _hc = N1[5413.0, 0.0, 0.0]
+_eng = sum(1 for r in _hr if r[-1][1] and r[-1][1][0])
+print(f"    healthy, peak banked: guard engaged on {_eng} of {len(_hr)} "
+      f"cycles; A charges on "
+      f"{sum(1 for r in _hr if dict(r[2])['a'] < -1.0)} cycles")
+check("N=1: the guard no longer steps in during the charge (no hand-back), "
+      "and the battery charges on every cycle, at no more than its rate",
+      _eng == 0 and all(-2000.0 <= dict(r[2])["a"] < -1.0 for r in _hr)
+      and not any("suspended" in e for e in _hc.events))
+
+
+# ============================================================================ #
+print("\n7. the row during an N=2 maintenance charge and in shadow mode")
+_rows7 = []
+
+
+def _look(c, t):
+    pg = c.peak_guard
+    if t >= QUARTER_S and pg is not None and pg.projected_w is not None \
+            and not pg.engaged and pg.projected_w > pg.ceiling_w:
+        _rows7.append(first((r["text"] for r in c.checks()
+                             if r["id"] == "peak_guard"), "guard row"))
+
+
+def _steps(t):
+    """4000 W, 800 W more for the first 30 s of every minute."""
+    return 4000.0 + (800.0 if t % 60.0 < 30.0 else 0.0)
+
+
+_m2r, _m2c = s84.run(2, load=_steps, dur=1800.0, month_peak=5413.0,
+                     before=late_feed(0.0, look=_look))
+_m2q = rig_quarters(_m2r, _steps)
+print(f"    N=2 maintenance charge, house steps 4000/4800 W: "
+      f"{len(_rows7)} over-the-limit rows, e.g. "
+      f"{first(iter(_rows7), 'a row')}; quarters "
+      f"{ {k: round(v, 1) for k, v in _m2q.items()} } W")
+check("N=2 maintenance charge, over the limit at this rate: the row says the "
+      "grid charge is limited",
+      present(first(iter(_rows7), "a row")) and all(
+          r.startswith("Peak guard: grid charge limited, at this rate")
+          for r in _rows7)
+      and all(v <= 5363.0 + TOL for v in _m2q.values()))
+_sh_o = dict(opts(), shadow_mode="on")
+_csh, _rsh, _fsh, _ssh = drive(_sh_o, peak=PEAK, minutes=17, every=10,
+                               plant=OnItsOwn)
+_sh_over = [s for s in _ssh if not s[2] and s[0] > s[1]]
+_sh1 = first(iter(_sh_over), "an over sample")
+print(f"    shadow mode, the inverter charging 5000 W on its own: "
+      f"{len(_sh_over)} over samples, e.g. "
+      f"{_sh1[3] if present(_sh1) else _sh1!s} / "
+      f"{_sh1[4] if present(_sh1) else _sh1!s}")
+check("shadow mode: nothing is cut on the wire, so the row says 'idle', "
+      "never 'grid charge limited', and the line says 'would'",
+      _csh.shadow and present(_sh1) and all(
+          s[3].startswith("Peak guard: idle, at this rate")
+          and "would" in s[4] for s in _sh_over))
+
+
+# ============================================================================ #
+print("\n8. edge cases")
+_e45 = drive(opts(), peak=PEAK, late=45.0)
+check("a reading 45 s late, past the 30 s hold (the guard goes blind): every "
+      "quarter at or under the aim", graded("late 45 s", _e45[2], AIM_PEAK))
+_e07 = drive(opts(), peak=PEAK, late=30.0, minutes=24,
+             start=START + timedelta(minutes=7))
+check("a start at 00:07, mid-quarter, then 30 s late: the next quarter at or "
+      "under the aim",
+      len(_e07[2]) == 1 and all(v <= AIM_PEAK + TOL
+                                for v in _e07[2].values()))
+print(f"    start at 00:07: {_e07[2]}")
+_dst = drive(opts(), peak=PEAK, late=30.0,
+             start=datetime(2026, 10, 25, 0, 45, tzinfo=timezone.utc))
+check("across the end of summer time (2026-10-25 01:00 UTC), 30 s late: "
+      "every quarter at or under the aim", graded("DST", _dst[2], AIM_PEAK))
+_ew = drive(opts(fc=True), peak=PEAK, late=30.0, fc_unit="W")
+check("the forecast entity in W: read as W, and the charge as with kW",
+      _ew[0].peak_fc is not None and _ew[0].peak_fc > 1000.0
+      and [r[1] for r in _ew[1]] == [r[1] for r in GAP[
+          "month peak banked, peak_forecast_entity (kW)"][1]])
+_e10 = drive(opts(), peak=PEAK, period=10.0)
+_e10v = list(_e10[2].values())
+print(f"    10 s meter: {_e10[2]}")
+check("a 10 s meter: every quarter after the start-up one at or under the "
+      "aim, and that one within START_TOL",
+      len(_e10v) == 2 and all(v <= AIM_PEAK + TOL for v in _e10v[1:])
+      and nth(_e10v, 0, "a first quarter") <= AIM_PEAK + START_TOL)
+_p_end = Projection(5800.0, 5800.0, 899.5, 898.5 / 899.5, False, START,
+                    5800.0)
+check("0.5 s left and 1 s late: finite, the formula, at its floor of 0 W",
+      peakguard.charge_room_w(_dec, _p_end) == max(
+          0.0, _room - 5800.0 * 1.0 / 0.5))
+_d_end = peakguard.decide(
+    Projection(5800.0, 5800.0, 900.0, 1.0, True, START, 5800.0),
+    batt_w=-4800.0, cap_w=3500, margin_w=50,
+    reading=types.SimpleNamespace(is_observed=True, peak_w=PEAK),
+    achievable_w=9600.0, soc=50.0, soc_floor=20.0)
+check("no second left: no room is measured (None), and nothing divides by 0",
+      peakguard.charge_room_w(_d_end, Projection(
+          5800.0, 5800.0, 900.0, 890.0 / 900.0, False, START, 5800.0))
+      is None)
+
 print()
 if fails:
     print(f"{len(fails)} FAILED:")

goodwe_controller/test_safety84.py

@@ -476,13 +476,18 @@ print("\n8. the N=1 and N=2 digests")
 # loop's bound just after the guard hands back are gone; every command and
 # claim is the same (test_safety119.py part 6). SAFETY-121 re-pinned all six
 # again: only OUTPUT_CLAMP rows (test_safety119.py part 6).
+# SAFETY-125 (0.19.2, owner 2026-10-29) re-pinned n1_charge and
+# n1_charge_banked: at N=1 the cheap-window charge is now sized to the
+# quarter's room, as at N=2, so the guard no longer steps in and discharges.
+# The banked quarters go 3461.9 -> 3450.0 W (aim 3450) and 3938.9 -> 3950.0
+# W (aim 3950). n1_charge_dear (no cheap window) is unchanged.
 PINNED = {
     "n1_charge":
-        "0ed25c856456b97acb07a39299a8cb7b1a762c4d0005b88a0823c03057a80be5",
+        "00f0a16b3ac1bd2830e9e0aaac8923fd9d1736c2bc6c543669bdd35b2fb542e9",
     "n1_charge_dear":
         "c25340b56060d4581f7204e200b07e7c8618711be2baca3b1667b7ebeb600dc3",
     "n1_charge_banked":
-        "2619acdd06b04e56c000b168d64e1d044346c6ba3f929c94258d6ad8189ec609",
+        "09a08298d35195380ff427cdd2448d9212119be4692db26b2b1a45957fdf3300",
     "n2_charge":
         "b16d692128f14bcce3d87b142d290e0d6b13724289680e44a05215c9eaa24a7c",
     "n2_charge_dear":
@@ -496,8 +501,9 @@ for k in PINNED:
           f"{_now[k][:16]}")
 check("⭐ at N=1 a charge in and out of a cheap window and under a banked "
       "month peak is byte-identical to 9d5b7d1 (commands, reasons and every "
-      "claim; the log as re-pinned by SAFETY-121), and N=2 outside a cheap "
-      "window matches its SAFETY-85 pin",
+      "claim; the log as re-pinned by SAFETY-121; in a cheap window as "
+      "SAFETY-125 re-pinned it), and N=2 outside a cheap window matches its "
+      "SAFETY-85 pin",
       all(_now[k] == PINNED[k] for k in ("n1_charge", "n1_charge_dear",
                                          "n1_charge_banked",
                                          "n2_charge_dear")))

goodwe_controller/test_safety87.py

@@ -522,7 +522,9 @@ print("\n9. N=1 is byte-identical to release/1.0 b8ddfd7")
 # log. The loop's bound just after a hand-back is not counted, so OUTPUT_CLAMP
 # rows are gone or count fewer; every command and claim is the same
 # (test_safety119.py part 6). SAFETY-121 re-pinned the same three again:
-# only OUTPUT_CLAMP rows (test_safety119.py part 6).
+# only OUTPUT_CLAMP rows (test_safety119.py part 6). SAFETY-125 (0.19.2)
+# re-pinned n1_charge_low: the N=1 cheap-window charge is sized to the
+# quarter's room, so the banked quarter goes 3458.9 -> 3450.0 W (aim 3450).
 PINNED = {   # tools/safety87_identity.py on b8ddfd7
     "n1_under":
         "d2395ef8d74fb23607ad864d5a4bf62c03044bbd9367e873675d7ad10e8c169f",
@@ -533,7 +535,7 @@ PINNED = {   # tools/safety87_identity.py on b8ddfd7
     "n1_under_banked":
         "a2876c7cc873bc4c974d2b4bd98e23bba2d007b84545587d2fe0b713b0a6249b",
     "n1_charge_low":
-        "91336e3c0314985a3b00f314c79b5ffb5a740d218de3ad44f88a4db6e4235b32",
+        "c3af6218cc14c072e08b09550b153502dafec806009a92ba9032738b9ac9fa61",
     "n1_hold":
         "0a1df347754c69166b20d04c15ee878bbcefb02abb824b9b452334f68f03e46d",
 }
@@ -542,8 +544,8 @@ for k in PINNED:
     print(f"    {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'}")
 check("⭐ every N=1 digest (claims, commands, the guard's decision and the "
       "log) equals b8ddfd7's (the log as re-pinned by SAFETY-121), under, "
-      "crossing and above the reserve, in a charge and a HOLD, and under a "
-      "banked peak",
+      "crossing and above the reserve, in a charge (as SAFETY-125 re-pinned "
+      "it) and a HOLD, and under a banked peak",
       _now == PINNED)
 
 # ============================================================================ #