TEST-17: grade the status page's peak row at a stated month, not at today's

release/1.0 went red at 00:00 on 2026-09-01 on a commit nobody had
touched. `Controller.checks()` read the capacity-tariff peak with
`self.peak.peak()` - no argument - so tariff.py resolved the month from
`datetime.now()`, while test_tariff.py section 10 banks its quarter at
the fixed fixture 2026-08-30. From 1 September the page was correctly
asked for September, correctly answered NO_RECORD, and the row read "no
completed quarter recorded yet" - a string containing no "peak", which
the section's own filter required. Four checks failed.

ISOLATED BY MOVING ONLY THE CLOCK. Same commit, same shipped-deps image,
libfaketime: green at 2026-08-30, four failures at 2026-09-01. Identical
at f4914a1, 04292c4~1 and 04292c4, so this is the calendar and not a
regression. It has been latent since TARIFF-01 merged on 2026-08-30, and
every PR that ever ran this suite ran it in August.

THE PRODUCT IS RIGHT AND THE TEST WAS WRONG, so the live page is
unchanged. Section 5 of this same file calls NO_RECORD "a normal state
on the 1st of the month" and a capacity tariff is billed monthly, so a
page showing the current month is correct. `checks()` now takes
`when: datetime | None = None` and threads it into peak() and
warning_frac() - the convention PeakStore.peak(), PeakTracker.peak(),
headroom_w() and warning_frac() all already follow. The one production
caller passes nothing and still means today.

AND THE DEFECT IS NOW DETECTABLE RATHER THAN SEASONAL. Three checks:
the same controller read at two different reference months must produce
two different rows, which no clock can satisfy; the later month must
read NO_RECORD and stay distinguishable from both an observed peak and
an unreadable store; and checks() with no argument must still mean
today. Verified by mutation - a checks() that drops `when` is red at
every clock tried, where the old section went green in August. The first
draft of these checks was itself wrong in the same way and reproduced
the bug: it selected rows on "peak", which the NO_RECORD row does not
contain, so it dropped the row and then graded its absence. They select
on "quarter(s) banked" instead.

Full suite green, 15 files, at the real clock and at faked clocks in
2026-08, 2026-12, 2027-02 and 2027-03.

Left alone deliberately: only the UNREADABLE branch prefixes its row
with "capacity-tariff peak:". The NO_RECORD row carries neither that
phrase nor the word "peak". That asymmetry is what made the original
filter brittle and what broke the first draft above; it is product text
with other suites reading it, so it is reported rather than changed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 ## Unreleased
 
+**`release/1.0` went red at midnight on a commit nobody had touched (TEST-17).**
+`Controller.checks()` read the capacity-tariff peak with `self.peak.peak()` - no
+argument - so `tariff.py` resolved the month from `datetime.now()`, while
+`test_tariff.py` section 10 banks its quarter at the fixed fixture
+`2026-08-30`. From 1 September the page was correctly asked for September,
+correctly answered `NO_RECORD`, and the row read *"no completed quarter recorded
+yet"* - a string containing no `"peak"`, which the section's filter required.
+Four checks failed. The suite had been a latent time bomb since TARIFF-01
+merged on 2026-08-30 and every PR that ran it ran in August.
+
+Isolated by holding the commit and the image constant and moving only the clock
+under `libfaketime`: green at 2026-08-30, four failures at 2026-09-01, identical
+at `f4914a1`, `04292c4~1` and `04292c4`. The calendar, not a regression.
+
+**The product was right and the test was wrong**, so the fix does not change what
+the live page says. `checks()` takes `when: datetime | None = None` and threads
+it into `peak()` and `warning_frac()` - the convention every other peak query in
+`tariff.py` already follows. The single production caller passes nothing and
+still means today. Section 10 now grades at its own fixture's month.
+
+Three new checks make the defect detectable rather than seasonal: the same
+controller read at two different reference months must produce two different
+rows, which no clock can satisfy; the later month must read `NO_RECORD` and stay
+distinguishable from both an observed peak and an unreadable store; and calling
+`checks()` with no argument must still mean today. Verified by mutation - a
+`checks()` that drops `when` is now red at every clock tried, where the old
+section went green in August. Full suite green, 15 files, at the real clock and
+at faked clocks in four other months.
+
+One thing left alone deliberately: only the UNREADABLE branch prefixes its row
+with `capacity-tariff peak:`. The `NO_RECORD` row carries neither that phrase
+nor the word `peak`, which is what made the original filter brittle and what
+broke the first draft of the new checks too. It is product text with other
+suites reading it, so it is noted here rather than changed.
+
 **Thirty days of the real meter, and the acceptance criterion three cards
 deferred is now a number (DATA-01).** TARIFF-01 and SAFETY-07 both merged with
 AC 3 - *"monthly peak held under the soft limit in >= 95 % of intervals over a