Merge release/1.0 (TARIFF-10) into TARIFF-14

CI on PR #80 was NOT a test failure. The workflow's "grade the merge, not
the branch" step refused the PR because it does not apply, and said so
itself: "REFUSED: refs/pull/80/head does not merge into release/1.0.
NOTHING HAS BEEN TESTED. This is not a test failure - no test ran."
Conflicts were CHANGELOG.md and test_price.py; app/price.py auto-merged.

CONFLICTS RESOLVED

* CHANGELOG.md - both entries belong under ## Unreleased. TARIFF-10's
  table row and section come first because it landed first. No version
  number is picked here; PKG-06/07's note stands untouched.

* test_price.py - BOTH cards appended a section "13". Nothing is
  dropped: TARIFF-10's stays 13, this card's is renumbered 14, and
  TARIFF-10's temp-directory teardown stays at the end of the file. The
  two share no fixture, option dict or helper name.

WHAT TARIFF-10 CHANGES FOR THIS CARD - nothing in the reasoning, and the
check is recorded rather than asserted (decision note §7).

In app/price.py the two do not meet: TARIFF-10 added provider_id() and
provider_configured() beside price_option() and routed load_prices()
through them - the option-reading layer, touching nothing in _Series,
at(), covers(), window() or _cover_table(). The merged at() is
byte-identical to the one the mutations were driven against.

Behaviourally TARIFF-10 makes run_tariff_refresh() run with arbitrage
OFF, so a provider-configured site now has a standing plan - and
therefore a _Series - where before it had none. It does NOT add an at()
consumer to the 30 s tick: static_status() builds a STATIC plan (hourly,
immune), main.py calls only plan.words on the fetched plan, and
price_forecast.price_permits()/begin_phase() have no caller in main.py
at all. So TARIFF-10 neither creates nor closes any exposure this card
is about - it enlarges the defect's reach the moment such a site arms
trading, which strengthens the fix without changing it.

RE-GRADED ON THE MERGED TREE, not carried over

* all 29 test files green;
* all EIGHT mutations re-driven, purged before each run, each reverted
  with the fingerprint re-checked. Same verdicts and same red-check
  counts as before the merge: M1 (the shipped one-hour scan, +68 B) red
  on 24 named checks across both files; M3 (the ZERO-BYTE tail rule) red
  on 4; M2/M4/M6 on 1 each, M5 on 2, M7 on 16, M8 on 14.
* Clean app/price.py on the merged tree: 90d8ca31f7c0109d, 85953 B.
* None of TARIFF-10's 650 new lines of checks moves under any of the
  eight - they grade resolve_tariff()'s reachability from a
  configuration, not the lookup.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/app/main.py

@@ -67,7 +67,7 @@ from .mqtt import (MqttPublisher, announced_units, unit_slugs,
 from . import peakguard
 from . import packshare
 from .p1 import P1Ingest, build_source, is_enabled
-from .price import Uncertainty, price_option
+from .price import Uncertainty, price_option, provider_configured
 from .price_history import PriceHistory
 from .static_tariff import resolve_tariff, static_status
 from .tariff import PeakStore, PeakTracker
@@ -138,6 +138,60 @@ TARIFF_REFRESH_S = 1800.0
 TARIFF_MAX_AGE_S = 3 * TARIFF_REFRESH_S
 
 
+def tariff_refresh_wanted(opts: dict) -> bool:
+    """TARIFF-10. Does this install need the background tariff refresh at all?
+
+    THE DEFECT THIS PREVENTS, and it shipped: the gate below used to be
+    `arbitrage.enabled(opts)` alone. That option defaults to `false`, and
+    `run_tariff_refresh` is the only caller of `resolve_tariff()`, which is the
+    only caller of `price_history.carry()` - so on a shipped install with a
+    provider configured NOTHING was ever fetched, no plan was ever resolved,
+    `/data/price_history.json` was never created, the *Price history* row read
+    `empty` forever, and TARIFF-09's short-horizon warning could not fire
+    because there was no fetch to warn about. Measured over a 40 h soak of two
+    instances side by side: zero feed requests and `present: false` across all
+    802 samples on the shipped default, against a resolved plan from the same
+    feed on the instance with arbitrage armed. ⚠️ AND `DOCS.md` HAS
+    DESCRIBED THE BEHAVIOUR BELOW SINCE THE COMMIT THAT WROTE THE GATE:
+    OPT-04 (bdd7f18) added the refresh task, the `arbitrage.enabled()` guard on
+    it, and the sentence saying a configured provider still fetches, all in one
+    change. config.yaml has said it since TARIFF-02 (852fc7c).
+
+    Two terms, and they answer two different questions:
+
+      provider_configured(opts) -> "the operator asked for a price feed", so
+                                   fetch it, validate it and record the day
+                                   (§8.3). This is the term TARIFF-10 ADDS.
+      arbitrage.enabled(opts)   -> "the operator armed trading". This term is
+                                   what the gate USED to be, kept verbatim.
+
+    ⚠️ IT IS AN `or`, SO THE GATE IS A STRICT WIDENING. Every configuration
+    that started this task before still starts it; none that did not start it
+    stops anything. That matters because the second term is not redundant:
+    `price_provider: off` + a `static_profile` + `arbitrage_enabled: true` is a
+    configuration validate.py explicitly ACCEPTS, and it trades - measured, at
+    `cycle_cost_threshold_eur: 0.05` on a 0.20/0.284 day/night profile,
+    `ARBITRAGE_CHARGE -5000 W`. Dropping that term to make the gate read
+    `provider_configured(opts)` alone would leave `self.tariff_plan` at None on
+    that site forever and `decide()` would answer "no tariff plan has been
+    resolved yet" on every cycle - silently disarming a strategy the UI says is
+    running, which is the exact failure validate.py's OPT-04 rules exist to
+    refuse.
+
+    ⚠️ AND NO CONFIGURATION ACQUIRES A PERIODIC HTTPS CALL FROM THIS TICKET.
+    With `price_provider` off, `resolve_tariff()` returns `static_plan()` - pure
+    arithmetic, no socket - so the second term starts a task that fetches
+    nothing. The true shipped default (no provider, no arbitrage) starts no
+    task at all. What is fetched is decided by the FIRST term only.
+
+    ⚠️ THIS IS NOT A TRADING SWITCH. It decides whether prices are LOOKED UP.
+    Whether they move energy is `arbitrage.enabled()` at the one call site in
+    `cycle()`, and TARIFF-10 did not touch it: `arbitrage_enabled: false` still
+    means no trade, ever, on any configuration.
+    """
+    return provider_configured(opts) or arbitrage.enabled(opts)
+
+
 def load_options() -> dict:
     try:
         with open(OPTIONS_PATH, "r", encoding="utf-8") as fh:
@@ -4353,6 +4407,14 @@ class Controller:
             # OPT-04. The strategy's own sentence, not a re-derivation of it -
             # every refusal it can make already carries a reason a human can
             # act on, and "Arbitrage: no" would throw all of them away.
+            #
+            # ⚠️ TARIFF-10 RE-READ THIS STRING AND LEFT IT ALONE, which is worth
+            # saying because that card is about the two switches being
+            # different. `self.arb` is None if and only if
+            # `arbitrage.enabled(self.o)` was False, so `off (arbitrage_enabled)`
+            # still names the option that is actually off - and on a site with a
+            # provider configured it is now the row that says the prices
+            # arriving on the *Price history* row above are moving nothing.
             ("Arbitrage", "off (arbitrage_enabled)" if self.arb is None
              else self.arb.explain()),
         ]
@@ -4605,11 +4667,16 @@ async def amain() -> None:
         # ESP32 heartbeat. A fetch on that path is a supplier's TLS timeout able
         # to push this add-on towards layer 1's 30 s veto. See TARIFF_REFRESH_S.
         #
-        # ⚠️ STARTED ONLY WHEN ARBITRAGE IS ARMED. Nothing else in the add-on
-        # reads the resolved plan - `cheap` still comes from static_status() on
-        # the tick, which is pure - so on a default install this task would be
-        # network traffic in aid of an attribute nobody reads.
-        if arbitrage.enabled(opts):
+        # ⚠️ STARTED WHEN A PROVIDER IS CONFIGURED, *OR* WHEN TRADING IS ARMED
+        # - TARIFF-10, and it used to be the second term alone. `arbitrage_
+        # enabled` ships `false`, so a site that had selected a price feed
+        # fetched nothing at all; the whole argument, the measurement and what
+        # the `or` is protecting are in `tariff_refresh_wanted()` above.
+        #
+        # ⚠️ IT DOES NOT ARM ANYTHING. Fetching a price and trading on one are
+        # two decisions; this is the first, and `cycle()`'s
+        # `if arbitrage.enabled(self.o):` is still the only gate on the second.
+        if tariff_refresh_wanted(opts):
             tasks.append(asyncio.create_task(controller.run_tariff_refresh()))
 
         # P1 ingestion runs as its own long-lived task. ⚠️ It must not be driven

goodwe_controller/app/price.py

@@ -917,6 +917,47 @@ def price_option(opts: dict, key: str):
     return v
 
 
+def provider_id(opts: dict) -> str:
+    """The selected plugin id, normalised. `"off"` when none is selected.
+
+    ⚠️ ONE SPELLING OF THIS EXPRESSION, AND TARIFF-10 IS WHY IT IS A FUNCTION.
+    `str(price_option(opts, "price_provider") or "off").strip()` was written out
+    twice - in `load_prices()` below and in `static_tariff.resolve_tariff()` -
+    and main.py's startup gate would have been a third. "Is a provider
+    configured" is now a DECISION the add-on takes (it is what starts the
+    background refresh), and a decision spelled out at three call sites is three
+    places to disagree about whether `"  off  "` or `None` counts.
+    ⚠️ `validate.py` deliberately keeps its own reader: it validates the RAW
+    options blob, including one the Supervisor never saw, so it must not route
+    through `price_option()`'s defaults. Note what this does NOT do: it does not
+    decide
+    whether the id names a shipped plugin - `load_prices()` and validate.py's
+    rule 7 own that, and answering "unknown" here would turn a typo into
+    "no provider" instead of into a startup refusal.
+    """
+    return str(price_option(opts, "price_provider") or "off").strip()
+
+
+def provider_configured(opts: dict) -> bool:
+    """Has the operator selected a price feed at all? (TARIFF-10)
+
+    THE DEFECT THIS PREVENTS: the background tariff refresh used to start only
+    when `arbitrage_enabled` was on, which ships `false` - so a site with a
+    provider configured fetched NOTHING, ever. `/data/price_history.json` was
+    never created, the *Price history* status row read `empty` forever, and
+    TARIFF-09's short-horizon warning could not fire because no fetch happened
+    to warn about. Measured over a 40 h two-instance soak: zero feed requests
+    and `present: false` across all 802 samples on the shipped default, against
+    a resolved plan on the same feed with arbitrage armed.
+
+    ⚠️ THIS IS NOT A TRADING SWITCH AND MUST NEVER BECOME ONE. It answers
+    "fetch prices?"; `arbitrage.enabled()` answers "move energy on them?", and
+    §10.1's priority 3 is gated on the second alone. See
+    `main.tariff_refresh_wanted()` for the one place the two meet.
+    """
+    return provider_id(opts) not in ("", "off")
+
+
 def export_price_eur_kwh(opts: dict) -> float:
     """AC4 / §9.3: the injection price is a SEPARATE SCALAR, not a second series.
 
@@ -1667,8 +1708,8 @@ async def load_prices(opts: dict, since: datetime, until: datetime,
     site condition, it is a plugin trying to read the markup, and turning it
     into "no price data" would hide the exact defect trap 1 exists to catch.
     """
-    pid = str(price_option(opts, "price_provider") or "off").strip()
-    if pid in ("", "off"):
+    pid = provider_id(opts)
+    if not provider_configured(opts):
         return PriceRead.no_data(
             "no price provider configured (price_provider is 'off'); "
             "§11.4: static profile, plan provisional, no arbitrage")

goodwe_controller/app/static_tariff.py

@@ -207,7 +207,7 @@ from datetime import datetime, timedelta, timezone
 from .price import (
     MAX_PLAUSIBLE_EUR_KWH, Absence, PricePoint, PriceProduct, PriceRead,
     Uncertainty, _Outcome, brussels, load_prices, price_option,
-    required_spread, uncertainty_of, widen_factor,
+    provider_configured, required_spread, uncertainty_of, widen_factor,
 )
 
 _LOG = logging.getLogger("goodwe.tariff.static")
@@ -1071,8 +1071,7 @@ async def resolve_tariff(opts: dict, since: datetime, until: datetime,
     missing and loses the elapsed ones it should never have had.
     """
     stamp = now or datetime.now(timezone.utc)
-    pid = str(price_option(opts, "price_provider") or "off").strip()
-    if pid in ("", "off"):
+    if not provider_configured(opts):
         return static_plan(opts, since, until, provisional=False, now=stamp)
 
     read = await load_prices(opts, since, until, transport)