Merge master (0.19.2, f1c9733) into sync-0.19: TARIFF-24 and SAFETY-125 reach release/1.0

Brings in 0.19.1 (TARIFF-24) and 0.19.2 (SAFETY-125). Git merged every file
without a text conflict. config.yaml's version becomes 0.19.2, the newest
CHANGELOG section: test_version_gate.py (PKG-14, 11b) requires the two to be
equal, and release/1.0 took 0.19.0 the same way (#207). The 0.19.1 and 0.19.2
CHANGELOG sections come in as history.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/app/arbitrage.py

@@ -147,7 +147,7 @@ from dataclasses import dataclass
 from datetime import datetime
 
 from .arbiter import ACTUATOR_SITE, P_ARBITRAGE, Claim
-from .price import Absence, price_option
+from .price import Absence, Uncertainty, price_option
 
 _LOG = logging.getLogger("goodwe.arbitrage")
 
@@ -267,6 +267,21 @@ def threshold_eur_kwh(opts: dict) -> float:
     return v
 
 
+def weather_uncertainty(modes_on: bool, solar_fc, held: bool = False) -> frozenset:
+    """The "no weather" doubt (x1.5) a trade must clear. TARIFF-24.
+
+    Battery modes read a solar forecast; with one read (`solar_fc` not None) the
+    doubt is gone, and `held` (a run planned with a forecast is under way, see
+    `Controller.weather_held()`) keeps it gone until that run ends. Everything
+    else, and the modes without a forecast, keep it. One rule for the run plan,
+    the charge gate and Home's mirror. See
+    DECISIONS/TARIFF-24-modes-need-the-tariff-task.md.
+    """
+    if modes_on and (solar_fc is not None or held):
+        return frozenset()
+    return frozenset({Uncertainty.NO_WEATHER})
+
+
 def soc_bounds(opts: dict) -> tuple:
     """(floor, ceiling) in percent. The reserve arbitrage may not spend."""
     return (float(price_option(opts, "arbitrage_soc_floor")),

goodwe_controller/app/homeview.py

@@ -24,7 +24,7 @@ from .dayplan import EFF
 from .maintenance import CHARGE as M_CHARGE, DRAIN as M_DRAIN, HOLD as M_HOLD
 from .maintenance import IDLE as M_IDLE, next_slot_start
 from .packmode import CHEAP_HOURS, GRID_CHARGE_MODES, LEFTOVER_SOLAR, SOLAR_FIRST
-from .price import Absence, Uncertainty, brussels, _cover_table
+from .price import Absence, brussels, _cover_table
 from .static_tariff import static_plan
 from .tariff import BILLING_TZ
 from .uimodel import REGION_PRESETS, options_to_ui
@@ -280,7 +280,11 @@ def trade_verdict(c, plan, now):
         return None, "no_prices"
     verdict = plan.arbitrage(peak_guard_active=guard,
                              min_spread_eur_kwh=arbitrage.threshold_eur_kwh(c.o),
-                             uncertainty=frozenset({Uncertainty.NO_WEATHER}),
+                             uncertainty=arbitrage.weather_uncertainty(
+                                 bool(getattr(c, "modes_on", False)),
+                                 getattr(c, "solar_fc", None),
+                                 bool(getattr(c, "weather_held",
+                                              lambda _n: False)(now))),
                              now=now)
     return verdict.match(
         allowed=lambda v: (v, "allowed"),
@@ -1058,7 +1062,8 @@ def month_peak(c, now):
         ceiling = pg.ceiling_w or limit_w
     out["line"] = line_period(out["period_w"], ceiling, c.shadow,
                               unmeasured=getattr(c, "peak_unmeasured_s", 0.0)
-                              > 0.0)
+                              > 0.0,
+                              cut=getattr(c, "room_charge", False))
     return out
 
 
@@ -1504,13 +1509,19 @@ def line_peak_not_covered() -> str:
     return _t("peak_not_covered")
 
 
-def line_period(period_w, limit_w, shadow, unmeasured=False) -> str:
+def line_period(period_w, limit_w, shadow, unmeasured=False,
+                cut=False) -> str:
     step = _w(shadow, "step_in", kw=_kw(limit_w))
     if unmeasured:
         # SAFETY-90: the add-on started during this period.
         return _t("period_unmeasured") + " " + step
     if period_w is None:
         return step
+    if period_w > limit_w:
+        # SAFETY-125: the figure is the current rate, and a grid charge is
+        # what gets cut back.
+        return _t("period_over", kw=_kw(period_w)) + " " + (
+            _w(shadow, "charge_cut", kw=_kw(limit_w)) if cut else step)
     return _t("period", kw=_kw(period_w)) + " " + step
 
 
@@ -1584,6 +1595,8 @@ def _samples() -> list:
                 ("plan", line_period(1240, 3500, sh)),
                 ("plan", line_period(None, 3500, sh)),
                 ("plan", line_period(1240, 3500, sh, unmeasured=True)),
+                ("plan", line_period(5814, 5413, sh)),
+                ("plan", line_period(5814, 5413, sh, cut=True)),
                 ("plan", control_text(True, sh)),
                 ("plan", control_text(False, sh))]
     out += [("plan", run_grid_why(0.1412)), ("plan", run_grid_amount(1.23)),

goodwe_controller/app/main.py

@@ -175,57 +175,17 @@ TARIFF_MAX_AGE_S = 3 * TARIFF_REFRESH_S
 
 
 def tariff_refresh_wanted(opts: dict) -> bool:
-    """TARIFF-10. Does this install need the background tariff refresh at all?
+    """Does this install need the background tariff refresh? (TARIFF-10, TARIFF-24)
 
-    THE DEFECT THIS PREVENTS, and it shipped: the gate below used to be
-    `arbitrage.enabled(opts)` alone. That option defaults to `false`, and
-    `run_tariff_refresh` is the only caller of `resolve_tariff()`, which is the
-    only caller of `price_history.carry()` - so on a shipped install with a
-    provider configured NOTHING was ever fetched, no plan was ever resolved,
-    `/data/price_history.json` was never created, the *Price history* row read
-    `empty` forever, and TARIFF-09's short-horizon warning could not fire
-    because there was no fetch to warn about. Measured over a 40 h soak of two
-    instances side by side: zero feed requests and `present: false` across all
-    802 samples on the shipped default, against a resolved plan from the same
-    feed on the instance with arbitrage armed. ⚠️ AND `DOCS.md` HAS
-    DESCRIBED THE BEHAVIOUR BELOW SINCE THE COMMIT THAT WROTE THE GATE:
-    OPT-04 (bdd7f18) added the refresh task, the `arbitrage.enabled()` guard on
-    it, and the sentence saying a configured provider still fetches, all in one
-    change. config.yaml has said it since TARIFF-02 (852fc7c).
-
-    Two terms, and they answer two different questions:
-
-      provider_configured(opts) -> "the operator asked for a price feed", so
-                                   fetch it, validate it and record the day
-                                   (§8.3). This is the term TARIFF-10 ADDS.
-      arbitrage.enabled(opts)   -> "the operator armed trading". This term is
-                                   what the gate USED to be, kept verbatim.
-
-    ⚠️ IT IS AN `or`, SO THE GATE IS A STRICT WIDENING. Every configuration
-    that started this task before still starts it; none that did not start it
-    stops anything. That matters because the second term is not redundant:
-    `price_provider: off` + a `static_profile` + `arbitrage_enabled: true` is a
-    configuration validate.py explicitly ACCEPTS, and it trades - measured, at
-    `cycle_cost_threshold_eur: 0.05` on a 0.20/0.284 day/night profile,
-    `ARBITRAGE_CHARGE -5000 W`. Dropping that term to make the gate read
-    `provider_configured(opts)` alone would leave `self.tariff_plan` at None on
-    that site forever and `decide()` would answer "no tariff plan has been
-    resolved yet" on every cycle - silently disarming a strategy the UI says is
-    running, which is the exact failure validate.py's OPT-04 rules exist to
-    refuse.
-
-    ⚠️ AND NO CONFIGURATION ACQUIRES A PERIODIC HTTPS CALL FROM THIS TICKET.
-    With `price_provider` off, `resolve_tariff()` returns `static_plan()` - pure
-    arithmetic, no socket - so the second term starts a task that fetches
-    nothing. The true shipped default (no provider, no arbitrage) starts no
-    task at all. What is fetched is decided by the FIRST term only.
-
-    ⚠️ THIS IS NOT A TRADING SWITCH. It decides whether prices are LOOKED UP.
-    Whether they move energy is `arbitrage.enabled()` at the one call site in
-    `cycle()`, and TARIFF-10 did not touch it: `arbitrage_enabled: false` still
-    means no trade, ever, on any configuration.
+    Yes with a price feed, with trading on price armed, or with battery modes
+    on: the modes read `self.tariff_plan` for their price runs. With
+    `price_provider` off the refresh is pure arithmetic on `static_profile`, so
+    no term here adds an HTTPS call. It decides whether prices are looked up,
+    never whether energy moves. See DECISIONS/TARIFF-10-fetching-is-not-trading.md
+    and DECISIONS/TARIFF-24-modes-need-the-tariff-task.md.
     """
-    return provider_configured(opts) or arbitrage.enabled(opts)
+    return (provider_configured(opts) or arbitrage.enabled(opts)
+            or packmode.enabled(opts))
 
 
 def load_options() -> dict:
@@ -1001,6 +961,9 @@ class Controller:
         # and whether last tick filed a mode trade (a run edge reseeds).
         self.mode_runs = None
         self._runs_key = None
+        # TARIFF-24: the end of the run that was under way while a forecast
+        # was read; until then losing the forecast does not widen the gap.
+        self._wx_free_to = None
         self.mode_tick = None
         # UX-53: why the trade gate refused a grid charge this tick (`peak`,
         # `not_worth`, `not_covered`), or None when it allowed one. Home reads
@@ -1259,6 +1222,8 @@ class Controller:
         # because `self.peak_guard` is a different cycle's decision by the time
         # the status page renders.
         self.arb_headroom_w = None
+        # SAFETY-125: a grid charge sized to the quarter's room this cycle.
+        self.room_charge = False
         # UX-13 P1: today's prices as the Home chart has seen them. Display
         # only; nothing reads it back into a decision.
         self.home_prices = homeview.DayPrices()
@@ -2274,6 +2239,28 @@ class Controller:
                 probing=probing))
         return out
 
+    def _wx_track(self, now) -> None:
+        """TARIFF-24, once per cycle, before the plan: with a forecast read,
+        remember when the run now under way (cheap, give or sell) ends."""
+        if self.solar_fc is None:
+            return
+        rp = self.mode_runs
+        ends = []
+        if rp is not None and rp.on:
+            ends = [r.end for r in (rp.cheap, rp.sell)
+                    if r is not None and r.holds(now)]
+            g = rp.give_at(now)
+            if g is not None:
+                ends.append(g.end)
+        self._wx_free_to = max(ends) if ends else None
+
+    def weather_held(self, now) -> bool:
+        """TARIFF-24: no forecast now, but a run planned with one is under
+        way: it keeps its gap to its end. The wider gap applies from the next
+        run. Pure; Home asks the same (`homeview.trade_verdict()`)."""
+        return (self.solar_fc is None and self._wx_free_to is not None
+                and now < self._wx_free_to)
+
     def _price_runs(self, now, packs, floor_pct, ceiling_pct):
         """The kept run plan, rebuilt at most once per price slot (15 min) or
         when the prices or a battery's choice change; a run under way is
@@ -2287,9 +2274,11 @@ class Controller:
         slot = int(now.timestamp() // 900)
         key = (id(plan), slot, tuple((p.name, p.use, p.mode, p.sell)
                                      for p in packs))
+        held = self.weather_held(now)
         if self.fc_entity is not None:
-            # P4: a forecast arriving or going rebuilds the plan at once.
-            key += (self.solar_fc is None,)
+            # P4: a forecast arriving or going rebuilds the plan at once (and
+            # so does the end of a run that held the gap, TARIFF-24).
+            key += (self.solar_fc is None, held)
         if key != self._runs_key:
             done_c = self._run_done.get("charge", (None, set()))[1]
             done_s = self._run_done.get("sell", (None, set()))[1]
@@ -2298,7 +2287,7 @@ class Controller:
             required = price_required_spread(
                 arbitrage.threshold_eur_kwh(self.o),
                 price_uncertainty_of(plan.read.product)
-                | {Uncertainty.NO_WEATHER})
+                | arbitrage.weather_uncertainty(True, self.solar_fc, held))
             ref = self._ref_cheap
             if ref is not None and now - ref.end > REF_CHEAP_KEEP:
                 ref = self._ref_cheap = None
@@ -2367,6 +2356,7 @@ class Controller:
         quarter), exactly the gate `arbitrage.decide()` has."""
         floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
         packs = self._mode_packs(maint_results)
+        self._wx_track(now)
         runs = self._price_runs(now, packs, floor_pct, ceiling_pct)
         guard = arbitrage.guard_state(self.peak_guard)
         plan = self.fresh_tariff_plan(now)
@@ -2377,7 +2367,8 @@ class Controller:
             return plan.arbitrage(
                 peak_guard_active=active,
                 min_spread_eur_kwh=arbitrage.threshold_eur_kwh(self.o),
-                uncertainty=frozenset({Uncertainty.NO_WEATHER}),
+                uncertainty=arbitrage.weather_uncertainty(
+                    True, self.solar_fc, self.weather_held(now)),
                 now=now).match(
                     allowed=lambda _v: True, refused=lambda _v: False)
         if guard is not None and plan is not None and runs is not None:
@@ -3250,17 +3241,19 @@ class Controller:
         return floor
 
     def _charge_headroom(self, floor: float, claims) -> float:
-        """SAFETY-84: at N>=2 a cheap-window charge pulls no more than the
-        quarter's headroom under the peak aim (`charge_headroom_w()`), so it
-        yields just enough to the peak guard, and nothing under a site stop
-        (its 0 W would need the other pack to give). N=1 is unchanged."""
-        if len(self.inverters) < 2:
-            return floor
-        if any(c.kind == SET and c.actuator == ACTUATOR_SITE
-               and c.priority > P_MAINT_SHAPE for c in claims):
+        """SAFETY-84: a cheap-window charge pulls no more than the quarter's
+        room under the peak aim (`charge_room_w()`), so it yields just enough
+        to the peak guard; at N>=2 nothing under a site stop (its 0 W would
+        need the other pack to give). SAFETY-125: at N=1 too, owner
+        2026-10-29; the stop rule stays N>=2 only."""
+        if len(self.inverters) > 1 and any(
+                c.kind == SET and c.actuator == ACTUATOR_SITE
+                and c.priority > P_MAINT_SHAPE for c in claims):
             return 0.0
-        room = peakguard.charge_headroom_w(self.peak_guard)
-        return floor if room is None else min(floor, room)
+        room = peakguard.charge_room_w(self.peak_guard, self._peak_proj)
+        floor = floor if room is None else min(floor, room)
+        self.room_charge = self.room_charge or floor > 0.0
+        return floor
 
     def _charge_ceiling(self, claims):
         """SAFETY-84: the site `hi` for a cheap-window charge at N>=2, or None.
@@ -4910,6 +4903,7 @@ class Controller:
         # decision presented as current.
         self.arb, self.arb_at = None, now
         self.arb_headroom_w = None
+        self.room_charge = False
         # OPT-11 P3: with battery modes on, each battery's mode decides who
         # trades (`_mode_roles()`, `_mode_trade()`, below, which read the
         # same headroom), and this site-wide trade is not run.
@@ -4920,7 +4914,9 @@ class Controller:
             # `arbitrage.sized_from_meter()` in `_shadow_settle()`, so the
             # caveat on the recorded watts can never be answered from a
             # different cycle's guard than the watts were.
-            self.arb_headroom_w = peakguard.charge_headroom_w(self.peak_guard)
+            # SAFETY-125: a late meter reading's seconds count, as the bill.
+            self.arb_headroom_w = peakguard.charge_room_w(self.peak_guard,
+                                                          self._peak_proj)
         if site_trade:
             floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
             charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
@@ -4975,6 +4971,7 @@ class Controller:
             arb_claim = arbitrage.claim(self.arb)
             if arb_claim is not None:
                 claims.append(arb_claim)
+            self.room_charge = self.arb.action == arbitrage.CHARGE
             # Edge-logged, for the peak guard's reason: the action log holds 40
             # lines and a trade lasts a whole hour, so a line per cycle would
             # flush the context that explains it. The transition is what an
@@ -5194,6 +5191,8 @@ class Controller:
         mode_trade, trade_was = False, self._mode_trade_was
         if self.modes_on:
             mode_trade = self._mode_trade(claims, now)
+            self.room_charge = self.room_charge or (
+                mode_trade and self.arb.action == arbitrage.CHARGE)
         self._mode_trade_was = mode_trade
         self._charge_track(claims, maint_results)
         _live96 = set(self.live_units())
@@ -7087,6 +7086,15 @@ class Controller:
                             "text": messages.row_peak_guard_on(
                                 _pg.floor_w or 0.0, _pg.ceiling_w,
                                 shadow=self.shadow)})
+            elif _pg.projected_w is not None:
+                # SAFETY-125: "under" only when it is; over the limit at this
+                # rate, a grid charge is cut back to the quarter's room.
+                out.append({"ok": True, "warn": False, "id": "peak_guard",
+                            "text": messages.row_peak_guard_idle(
+                                _pg.projected_w, _pg.ceiling_w,
+                                month_peak=(_pg.ceiling_from
+                                            == peakguard.CEILING_MONTH_PEAK),
+                                cut=self.room_charge and not self.shadow)})
             else:
                 out.append({"ok": True, "warn": False, "id": "peak_guard",
                             "text": _pg.explain()})
@@ -8080,11 +8088,9 @@ async def amain() -> None:
         # ESP32 heartbeat. A fetch on that path is a supplier's TLS timeout able
         # to push this add-on towards layer 1's 30 s veto. See TARIFF_REFRESH_S.
         #
-        # ⚠️ STARTED WHEN A PROVIDER IS CONFIGURED, *OR* WHEN TRADING IS ARMED
-        # - TARIFF-10, and it used to be the second term alone. `arbitrage_
-        # enabled` ships `false`, so a site that had selected a price feed
-        # fetched nothing at all; the whole argument, the measurement and what
-        # the `or` is protecting are in `tariff_refresh_wanted()` above.
+        # ⚠️ STARTED FOR A PROVIDER, FOR ARMED TRADING OR FOR BATTERY MODES:
+        # see `tariff_refresh_wanted()` above and DECISIONS/TARIFF-10 and
+        # TARIFF-24 for why each term is there.
         #
         # ⚠️ IT DOES NOT ARM ANYTHING. Fetching a price and trading on one are
         # two decisions; this is the first, and `cycle()`'s

goodwe_controller/app/messages.py

@@ -1170,8 +1170,18 @@ def row_periods_measured(n) -> str:
               f"Gemeten kwartieren deze maand: {getoond}")
 
 
-def row_peak_guard_idle(projected_w, limit_w, month_peak: bool) -> str:
-    """The projection first and the limit second (SAFETY-38's ordered pair)."""
+def row_peak_guard_idle(projected_w, limit_w, month_peak: bool,
+                        cut: bool = False) -> str:
+    """The projection first and the limit second (SAFETY-38's ordered pair).
+    SAFETY-125: over the limit at this rate it says so, and `cut` that a
+    grid charge is limited to the room left."""
+    if float(projected_w) > float(limit_w):
+        doing, doet = (("grid charge limited", "laden beperkt") if cut
+                       else ("idle", "in rust"))
+        return Bi(f"Peak guard: {doing}, at this rate {watts(projected_w)}, "
+                  f"over {watts(limit_w)}",
+                  f"Piekbewaking: {doet}, aan dit tempo "
+                  f"{watts(projected_w)}, boven {watts(limit_w)}")
     limit = (f"this month's {watts(limit_w)} peak" if month_peak
              else f"the {watts(limit_w)} peak limit")
     grens = (f"de maandpiek van {watts(limit_w)}" if month_peak
@@ -1563,6 +1573,11 @@ def status_samples() -> list:
         ("row_periods_measured", GREEN, row_periods_measured("unreadable")),
         ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, True)),
         ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, False)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(5814, 5413, True)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(5814, 5413, True,
+                                                           cut=True)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(3814, 3500, False,
+                                                           cut=True)),
         ("row_peak_guard_quiet", GREEN, row_peak_guard_quiet()),
         ("row_peak_guard_unmeasured", AMBER, row_peak_guard_unmeasured()),
         *(("row_peak_guard_blind", AMBER, row_peak_guard_blind(k))

goodwe_controller/app/peakguard.py

@@ -1136,6 +1136,21 @@ def charge_headroom_w(decision) -> float | None:
     return max(0.0, -float(decision.wanted_w))
 
 
+def charge_room_w(decision, projection) -> float | None:
+    """SAFETY-125: `charge_headroom_w()` with the seconds since the last
+    meter reading counted at that reading, so a late reading near a
+    quarter's end is not read as room for a grid charge (SAFETY-99).
+    DECISIONS/SAFETY-125-grid-charge-under-the-month-peak.md."""
+    room = charge_headroom_w(decision)
+    if not room or projection is None or projection.block_start is None:
+        return room
+    left = QUARTER_S - float(projection.elapsed_s)
+    if left <= 0.0:
+        return room
+    late_ws = max(0.0, float(projection.held_w)) * uncovered_s(projection)
+    return max(0.0, room - late_ws / left)
+
+
 def shaping_suspended(decision, peak_forecast_w, cap_w) -> bool:
     """Must the maintenance charge-only shaping stand down this cycle?
 

goodwe_controller/app/ui_text/en.json

@@ -437,6 +437,9 @@
     "step_in_would": "The batteries would step in above {kw}.",
     "period": "This 15-minute period is heading for {kw}.",
     "period_unmeasured": "Part of this 15-minute period was not measured.",
+    "period_over": "At this rate this 15-minute period reaches {kw}.",
+    "charge_cut": "The grid charge is cut back to stay under {kw}.",
+    "charge_cut_would": "The grid charge would be cut back to stay under {kw}.",
     "prices": {
       "now": "Price now {eur} per kWh, all in.",
       "today": "Today: lowest {lo} at {lo_at}, highest {hi} at {hi_at}.",

goodwe_controller/app/ui_text/nl.json

@@ -372,6 +372,9 @@
     "step_in_would": "De batterijen zouden bijspringen boven {kw}.",
     "period": "Dit kwartier gaat richting {kw}.",
     "period_unmeasured": "Een deel van dit kwartier is niet gemeten.",
+    "period_over": "Aan dit tempo komt dit kwartier op {kw}.",
+    "charge_cut": "Laadt minder van het net om onder {kw} te blijven.",
+    "charge_cut_would": "Zou minder van het net laden om onder {kw} te blijven.",
     "prices": {"now": "Prijs nu {eur} per kWh, alles inbegrepen.", "today": "Vandaag: laagste {lo} om {lo_at}, hoogste {hi} om {hi_at}.", "none": "Geen prijzen voor vandaag."},
     "tomorrow": {"known": "De prijzen van morgen zijn binnen.", "unknown": "De prijzen van morgen komen meestal na 13:00."},
     "day": {