Merge release/1.0 (OPT-04) into SAFETY-24, and fix one grader the merge broke

OPT-04 landed after the previous rebase. Conflicts were CHANGELOG.md and one
IMPORT LINE in validate.py; both refusal blocks and both option sets survive
untouched, and DOCS.md, main.py and config.yaml auto-merged.

⚠️ AND THE MERGE BROKE A CHECK THAT NEITHER CARD COULD HAVE SEEN ALONE.
test_peakguard.py graded "the first `.decide(` call in main.py" and asserted
there was exactly one. That was true when SAFETY-24 was written; OPT-04 added
`arbitrage.decide(...)`, so the merged tree had two and the assertion failed.
It failed loudly rather than grading the wrong call - the guard did its job -
but it cannot ship red.

Fixed by selecting the call by QUALIFIED NAME (`peakguard.decide`) instead of
by position, and requiring exactly one of THAT. Other modules may now call
their own decide(); this grader can no longer be moved by one of them. Verified
still discriminating: a decoy `peakguard.decide` added to main.py turns it red
on 7 assertions, and the `maintenance_soc_floor` swap still turns it red on 6.

Also folded in the review's wording finding. An assertion read "a CONTROLLER
whose SoC entity does not answer hands decide() None" while driving no
Controller. The wiring property is stronger than the one claimed, and is now
asserted on the SERVICE CALL: a Controller with no SoC never reaches the guard
at all, because `inputs_ok` is False and cycle() stops at the safety claim
first - so a `float(soc or 100)` defaulting line above the call site cannot
disarm the floor. The original decide()-level check is kept, reworded to say
what it actually grades.

Full suite green on the merged tree: 15 files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015VXjA3LWccN1rJsk3okyPC

goodwe_controller/app/validate.py

@@ -178,9 +178,10 @@ WHAT IS DELIBERATELY *NOT* REFUSED, because it is untidy rather than unsafe:
 
 import logging
 
+from .arbitrage import enabled as arbitrage_on
 from .p1 import is_enabled, validate_meter_options
 from .peakguard import PEAK_OPTION_DEFAULTS
-from .price import PROVIDERS
+from .price import PRICE_OPTION_DEFAULTS, PROVIDERS
 from .static_tariff import ProfileInvalid, parse_static_profile
 
 _LOG = logging.getLogger("goodwe.config")
@@ -507,14 +508,21 @@ def _price_problems(opts: dict) -> list[str]:
     #     arbitrage verdict, so the seam is no longer inert.
     #   * main.py reads the STATIC side of that module every cycle
     #     (static_status()), which makes static_profile a real writer of `cheap`.
-    #   * main.py does NOT yet call resolve_tariff() on the control tick, and
-    #     that is deliberate: a provider fetch is network I/O and the tick is
-    #     what feeds the ESP32 heartbeat. So a configured PROVIDER still shapes
-    #     no energy decision on its own; a configured STATIC PROFILE does.
+    #   * main.py does NOT call resolve_tariff() on the control tick, and that
+    #     is still deliberate: a provider fetch is network I/O and the tick is
+    #     what feeds the ESP32 heartbeat. OPT-04 put it on a BACKGROUND REFRESH
+    #     instead (Controller.run_tariff_refresh), and the tick reads the plan
+    #     that task last stored - an attribute read, with nothing to block on.
+    #   * so a configured PROVIDER now DOES shape an energy decision, but only
+    #     through app/arbitrage.py and only while `arbitrage_enabled` is on.
+    #     With it off - the shipped configuration - the series is still fetched,
+    #     validated and published, and still moves nothing.
     #
-    # Hence two refusals below rather than one, and neither claims more than
-    # that list. When OPT-04 puts resolve_tariff() on a background refresh, the
-    # first message's middle clause is what changes - not the rule.
+    # Hence three refusals below rather than two, and none of them claims more
+    # than that list. ⚠️ THE MIDDLE CLAUSE OF THE FIRST MESSAGE IS WHAT OPT-04
+    # CHANGED, exactly as the note it replaced predicted - the RULE is
+    # untouched, because the reason it exists (main.py reads the Home Assistant
+    # pair FIRST and the other source is silent) is unchanged.
     ha_price = [k for k in ("price_now_entity", "price_avg_entity")
                 if str(opts.get(k, "") or "").strip()]
     if pid != "off" and ha_price:
@@ -523,10 +531,12 @@ def _price_problems(opts: dict) -> list[str]:
             f"{'is' if len(ha_price) == 1 else 'are'} set, which is two price "
             "sources on one site. THE HOME ASSISTANT ENTITIES WIN: they are "
             "what main.py reduces to the `cheap` flag the maintenance cycle "
-            "reads. The provider series IS consumed now - app/static_tariff.py "
-            "builds a tariff plan and an arbitrage verdict from it - but it is "
-            "not what main.py acts on, so the supplier you configured would "
-            "shape no energy decision while the status page named it. Clear "
+            "reads, and read_inputs() never looks at the other source once "
+            "they are set. The provider series is consumed - "
+            "app/static_tariff.py builds a tariff plan and an arbitrage "
+            "verdict, and app/arbitrage.py trades on it off a background "
+            "refresh - but the `cheap` flag those entities own is a separate "
+            "decision they would silently keep. Clear "
             "price_now_entity and price_avg_entity to use the "
             f"{pid!r} plugin, or set price_provider to 'off' to keep the "
             "Home Assistant sensors.")
@@ -582,6 +592,67 @@ def _price_problems(opts: dict) -> list[str]:
             "with no tariff at all rather than with a coarse one. Not refused, "
             "but filling it in is what makes that row work.", pid)
 
+    # ⚠️ OPT-04. THE THREE WAYS `arbitrage_enabled: true` CAN BE A LIE, refused
+    # rather than logged, because a strategy that is armed in the UI and cannot
+    # fire is indistinguishable from one that fires and finds no opportunity -
+    # which is the §14 warning box's case exactly. None of these can break an
+    # existing install: the option is new and ships `false`.
+    # ⚠️ CHECKED WHETHER OR NOT ARBITRAGE IS ARMED. A threshold that is not a
+    # non-negative number is a configuration error the moment it is typed, and
+    # deferring the complaint until somebody turns the strategy on would report
+    # it at the worst possible moment - the one where energy starts moving.
+    thresh = _number(opts, "cycle_cost_threshold_eur",
+                     PRICE_OPTION_DEFAULTS["cycle_cost_threshold_eur"])
+    if thresh is None or thresh < 0:
+        problems.append(
+            f"cycle_cost_threshold_eur is "
+            f"{opts.get('cycle_cost_threshold_eur')!r} and must be a "
+            f"non-negative number of EUR/kWh - it is what one round trip COSTS "
+            f"(§10.1). A negative threshold is one that every spread clears, "
+            f"including a spread of nothing, which is arbitrage with the brake "
+            f"removed rather than arbitrage tuned aggressively.")
+
+    if arbitrage_on(opts):
+        if pid == "off" and not str(opts.get("static_profile", "") or "").strip():
+            problems.append(
+                "arbitrage_enabled is on but price_provider is 'off' and "
+                "static_profile is empty, so this site has NO PRICES AT ALL. "
+                "§10.1's priority 3 is 'charge cheap, discharge expensive' and "
+                "there is nothing here to tell cheap from expensive, so the "
+                "strategy would refuse on every cycle forever while the "
+                "configuration said it was running. Configure a price_provider "
+                "or a static_profile, or turn arbitrage_enabled off.")
+        if not is_enabled(opts):
+            problems.append(
+                "arbitrage_enabled is on but meter_source is 'off', so there "
+                "is no P1 telegram stream, the capacity-tariff peak guard "
+                "never runs, and nothing measures the 15-minute average this "
+                "strategy's charging would land in. §9.1 gives peak shaving "
+                "priority over arbitrage; an unmeasured peak cannot be shaved, "
+                "so arbitrage would be deliberately creating the billed "
+                "quantity with the one guard that limits it switched off. "
+                "app/arbitrage.py refuses to trade in that state anyway - this "
+                "refuses the configuration that asks it to. Set meter_source, "
+                "or turn arbitrage_enabled off.")
+        floor = _number(opts, "arbitrage_soc_floor",
+                        PRICE_OPTION_DEFAULTS["arbitrage_soc_floor"])
+        ceiling = _number(opts, "arbitrage_soc_ceiling",
+                          PRICE_OPTION_DEFAULTS["arbitrage_soc_ceiling"])
+        if floor is None or ceiling is None:
+            problems.append(
+                f"arbitrage_soc_floor {opts.get('arbitrage_soc_floor')!r} and "
+                f"arbitrage_soc_ceiling {opts.get('arbitrage_soc_ceiling')!r} "
+                f"must both be numbers - they are percentages of pack charge.")
+        elif floor >= ceiling:
+            problems.append(
+                f"arbitrage_soc_floor is {floor:g} % and arbitrage_soc_ceiling "
+                f"is {ceiling:g} %, so there is no band left between them: "
+                f"every state of charge is either at or under the floor (no "
+                f"discharge) or at or over the ceiling (no charge), and the "
+                f"strategy can never act. The floor is the reserve it may not "
+                f"spend and the ceiling is the headroom it may not overfill, "
+                f"so the floor must be the SMALLER number.")
+
     if pid == "manual_csv" and not str(opts.get("price_csv_path", "") or "").strip():
         problems.append(
             "price_provider is 'manual_csv' but price_csv_path is empty, so "