TARIFF-16: the injection leg stops being one number

`price.py` modelled what a site is PAID for export as ONE scalar. The market
publishes a line, and the cards say so in their own words: Eneco Zon & Wind
Dynamisch `0,1 x BELPEX-H - 1,188` c EUR/kWh - "het injectietarief is dynamisch
en kan per uur wijzigen", identical on the January and the September 2026 cards;
ENGIE Dynamic `(B x eSpot_15) - A`; Aspiravi `0,07 x Belpex - 2`.
`price_export_formula` carries that line with its OWN coefficients.

⚠️ THIS IS NOT A WRONG-TRADE FIX, AND SAYING SO IS PART OF SHIPPING IT.
`arbitrage.py` does not read `export_price_eur_kwh` at all - its own comment
says so, citing §9.3's near-zero Belgian injection price as the reason the
economically sound trade on this market is charge-cheap-to-displace-expensive-
IMPORT. Both hours it compares are all-in CONSUMPTION prices. No trade this
add-on takes today is decided by an injection price and nothing here changes
one. What it changes is what an operator is told, and what a future
export-aware strategy rests on: OPT-06 and any export logic would otherwise
inherit a scalar that cannot represent the market, and the 6% VAT asymmetry
would be invisible in the arithmetic. test_price.py 17h parses every module
under app/ and goes red the day something calls an injection reader, so that
sentence is graded rather than attested.

FOUR PROPERTIES A SCALAR CANNOT HOLD. Its own factor (Eneco 0,102 consumption
against 0,100 injection; Aspiravi 0,07 against ~0,10 - not the consumption B
with a sign flip). A negative offset, which `price_markup_eur_kwh: float(0,1)`
cannot express at all. VAT-exemption - "injectietarieven zijn vrijgesteld van
btw" - against 6% on consumption, representable only because `vat_pct` is PER
SPEC. And a price that goes below zero with no floor, under 11,88 EUR/MWh of
BELPEX-H, which is the middle of a sunny day.

⚠️ A NEGATIVE INJECTION PRICE IS ACCEPTED, AND THAT NEEDED A DIFFERENT BAND
RATHER THAN A LOWER FLOOR. `implausible_all_in()` floors the consumption leg at
+0.02 EUR/kWh of energy; applied to injection that refuses the real market in
the hours it matters most. Measured rather than argued: 17c puts ONE spec
through BOTH bands and prints that the consumption band refuses -0.03008
EUR/kWh while the injection band accepts it. The floor was not decoration - it
is what catches a card read a hundred times too small, the one unit error the
card self-check cannot see because it cancels out of a comparison between the
two sides - so the bound moves OFF the price and ONTO the coefficients, where
it is index-free and sign-free: a pass-through band (Eneco's injection leg is
1.00x, Aspiravi's 0.70x; the band is 0.10-10x) and an offset magnitude bound
(0.20 EUR/kWh against published 0.01188 and 0.02). Two rungs that can both
answer a hundredfold error, so each is graded on its REASON, each gets a
stimulus the other cannot reach with the precondition asserted as its own
check, and they are mutated TOGETHER (TEST-16).

⚠️ THE CARD SELF-CHECK APPLIES WHERE THERE IS A CARD, AND WHERE THERE IS NOT
THAT IS STATED RATHER THAN WORKED AROUND. `price_formula` can require a `card`
block because a Belgian card prints the consumption formula, the reference
index AND the resulting price. Eneco's INJECTION formula is printed with no
price beside it. Requiring a block would make the published line inexpressible;
inventing the estimate would grade the coefficients against arithmetic done
with the same coefficients. So the block is OPTIONAL on this leg and unchanged
on the other, the self-check runs at the same tolerance wherever a printed
estimate exists, and validate.py says at startup - "its coefficients are
UNGRADED" - when it does not, naming the two bounds that ran instead. This is
TARIFF-15 demonstrating two tariffs end to end rather than three, one card
later. 17e also MEASURES the size of that gap: a factor of 0.070 where the
contract says 0.100 - 30% of every export payment - passes both bounds, because
0.70x is a pass-through somebody really publishes.

ONE PARSER, NOT TWO. `parse_export_formula()` is `parse_price_formula()` with
its OPTION NAME as an argument - TARIFF-17's move on `parse_static_profile()`,
exactly - and everything that differs between the legs is a string in one
`_LEGS` table. A second copy would be a second unit table, a second NaN rule, a
second unknown-key rule and a second `to_resolution()`, diverging first on the
23- and 25-hour days. test_price.py 17b pins it two ways: all 32 grammar names
are defined in exactly ONE module under app/, with the scope COMPUTED by
parsing every file rather than listed; and twelve refusal sentences for the new
option are DERIVED from the old option's own sentence rather than transcribed.
The four sentences that deliberately differ are named, with what differs, and
asserted to differ.

NOTHING CHANGES FOR A SITE THAT DOES NOT SET IT. The option ships "";
`export_price_eur_kwh()`'s body is byte-identical, pinned on the AST rather
than on the source text; `export_price_at()` falls through to it for every
index value. 17f compares seven option dicts x five index values against the
pre-TARIFF-16 expression with `==`.

`price_export_formula` joins FRAMEWORK_KEYS, BANNED_IN_PLUGIN_CODE is derived
from that set, and `code_leaks()` refuses a plugin that names it with nothing
else edited.

ALSO CORRECTED HERE: config.yaml's comment beside `export_price_eur_kwh` still
read "no shipped supplier publishes a dynamic injection curve". TARIFF-07
struck that claim from app/price.py and DOCS.md and did not reach config.yaml,
where it has been shipping since.

20 mutations, every one red on a named check, ledger in test_price.py below
section 17 - including a ZERO-byte one (the two legs transposed in the
VAT-asymmetry banner: no decision moves, only the sentence) and a ONE-byte one
(`card_required=True` on the injection leg). Three run over all 29 files and
red on test_price.py alone. 29/29 green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/test_validate.py

@@ -1553,6 +1553,175 @@ check("...and BOTH cards divided by 100 start, which is habit 7: the refusals "
                .replace("7.10", "0.0710")), -5000, 5000) == [])
 
 
+# --------------------------------------------------------------------------- #
+print()
+print("TARIFF-16 - the INJECTION leg is refused HERE, at startup, and the leg "
+      "the card cannot grade is SAID to be ungraded")
+# ⚠️ WHY IT IS REFUSED IN THIS MODULE. `export_price_at()` is the seam a future
+# export-aware strategy reads, and a formula that first fails when something
+# reads it is a defect discovered at the worst possible moment - which is
+# `static_profile`'s and `price_taxes_profile`'s argument, one option over.
+#
+# ⚠️ AND WHAT THIS OPTION DOES **NOT** DO, said before what it does: no
+# strategy in this add-on reads an injection price. `arbitrage.py` prices the
+# sell side as displaced IMPORT and compares two all-in CONSUMPTION prices.
+# test_price.py 17h grades that by parsing every module under app/; what is
+# graded HERE is that the operator is TOLD it, at startup, in the same breath
+# as the formula being accepted.
+import logging as _t16_logging                # noqa: E402
+
+
+class _T16Log(_t16_logging.Handler):
+    """Every record app.validate emits during one call, rendered."""
+
+    def __init__(self):
+        super().__init__()
+        self.lines = []
+
+    def emit(self, record):
+        self.lines.append((record.levelname, record.getMessage()))
+
+
+def _t16_start(**over):
+    """`validate_startup_config()` -> (problems, rendered log lines).
+
+    ⚠️ THE LEVEL IS FORCED TO INFO FOR THE DURATION AND RESTORED. Without it
+    the capture returns an EMPTY list on a tree that logs correctly, which
+    reads exactly like "the line is not there" - a check whose data cannot
+    reach the failure it names, in the instrument rather than in the check.
+    """
+    log = _t16_logging.getLogger("goodwe.config")
+    h = _T16Log()
+    was, log.level = log.level, _t16_logging.INFO
+    log.addHandler(h)
+    try:
+        return validate_startup_config(base(**over), -5000, 5000), h.lines
+    finally:
+        log.removeHandler(h)
+        log.level = was
+
+
+# The two published injection lines, transcribed from the cards. ⚠️ NEITHER
+# CARRIES A `card` BLOCK, because neither card prints a price beside its
+# injection formula - that is the state this section exists to grade.
+_T16_ENECO = ('{"index":"epex_be","resolution":"hourly","factor":0.1,'
+              '"offset":-1.188,"units":"c_eur_per_kwh","vat_pct":0}')
+_T16_CONS = ('{"index":"epex_be","resolution":"hourly","factor":0.102,'
+             '"offset":1.0,"units":"c_eur_per_kwh","vat_pct":6,'
+             '"card":{"month":"2026-09","index_eur_per_mwh":133.9905,'
+             '"expect_incl_vat":15.55}}')
+
+# ⚠️ THE ACCEPTED BASELINE COMES FIRST (habit 7). Every refusal below varies
+# ONE field from this line, so a refusal has nowhere else to have come from.
+_T16_OK, _T16_OK_LOG = _t16_start(price_export_formula=_T16_ENECO)
+check("Eneco's real published injection line `0,1 x BELPEX-H - 1,188` STARTS - "
+      "including the part that makes its price NEGATIVE below 11,88 EUR/MWh, "
+      "which is the market and not a misconfiguration",
+      _T16_OK == [])
+check("...and so does the shipped \"\", which is every install that exists: "
+      "the option is an addition and the scalar still answers without it",
+      _t16_start(price_export_formula="")[0] == []
+      and _t16_start()[0] == [])
+
+_T16_BAD_PT = _T16_ENECO.replace('"factor":0.1,', '"factor":10.0,')
+_T16_BAD_OFF = _T16_ENECO.replace('"offset":-1.188', '"offset":-118.8')
+_T16_P_PT = _t16_start(price_export_formula=_T16_BAD_PT)[0]
+_T16_P_OFF = _t16_start(price_export_formula=_T16_BAD_OFF)[0]
+print(f"    {(_T16_P_PT or [''])[0][:118]}")
+print(f"    {(_T16_P_OFF or [''])[0][:118]}")
+check("PRECONDITION: each of those two blobs differs from the accepted "
+      "baseline in exactly one coefficient, so the refusals below are about "
+      "the field each names",
+      _T16_BAD_PT != _T16_ENECO and _T16_BAD_OFF != _T16_ENECO
+      and _T16_BAD_PT.replace('"factor":10.0,', '"factor":0.1,') == _T16_ENECO
+      and _T16_BAD_OFF.replace('"offset":-118.8', '"offset":-1.188')
+      == _T16_ENECO)
+check("a factor 100x out is REFUSED at startup, by the pass-through rung, "
+      "naming the option the operator typed",
+      why(_T16_P_PT, "price_export_formula cannot be used:")
+      and why(_T16_P_PT, "passes through")
+      and not why(_T16_P_PT, "|offset| above"))
+check("...and an offset 100x out is refused by the OFFSET rung, so the two "
+      "rungs are graded on their reasons and cannot mask each other",
+      why(_T16_P_OFF, "price_export_formula cannot be used:")
+      and why(_T16_P_OFF, "|offset| above")
+      and not why(_T16_P_OFF, "passes through"))
+check("...and a malformed blob is refused as a malformed blob, naming the "
+      "field rather than 'invalid configuration'",
+      why(_t16_start(price_export_formula='{"index":"belpex_h"}')[0],
+          "price_export_formula.index is 'belpex_h'"))
+
+# ⚠️ THE HONEST HALF, AND IT IS A WARNING RATHER THAN A REFUSAL. Eneco prints
+# its injection formula with NO price beside it, so on that card there is
+# nothing for the self-check to reproduce. Requiring a `card` block would make
+# the published line inexpressible; inventing the estimate would grade the
+# coefficients against arithmetic done with the same coefficients. So the leg
+# starts, and the operator is told WHICH check did not run.
+_T16_UNGRADED = [m for lvl, m in _T16_OK_LOG
+                 if lvl == "WARNING" and "UNGRADED" in m]
+print(f"    {(_T16_UNGRADED or [''])[0][:118]}")
+check("a leg with no card block starts, and says at startup that its "
+      "coefficients are UNGRADED - naming what was checked instead, so the "
+      "gap is stated rather than worked around",
+      len(_T16_UNGRADED) == 1
+      and "no \"card\" block" in _T16_UNGRADED[0]
+      and "pass-through" in _T16_UNGRADED[0])
+_T16_WITH_CARD, _T16_CARD_LOG = _t16_start(
+    price_export_formula=_T16_CONS, price_formula=_T16_CONS,
+    price_provider="custom_formula")
+# ...and a SECOND run with the two legs genuinely different, for the ordered
+# pair below. ⚠️ THE FIRST ONE PUTS THE CONSUMPTION CARD ON BOTH LEGS, so
+# 0.102/6 appears twice and an assertion about arrangement would pass on a
+# TRANSPOSED rendering - MUTATION.md habit 4, in the fixture of a habit-14
+# check. The precondition is asserted below rather than trusted.
+_T16_BOTH_LEGS, _T16_BOTH_LOG = _t16_start(
+    price_export_formula=_T16_ENECO, price_formula=_T16_CONS,
+    price_provider="custom_formula")
+check("...and a leg that DOES carry a card does NOT print it, or the sentence "
+      "would be noise an operator learns to ignore rather than a report of "
+      "which check ran",
+      _T16_WITH_CARD == []
+      and not [m for lvl, m in _T16_CARD_LOG if "UNGRADED" in m])
+# ⚠️ AND A CARD ON THIS LEG IS STILL GRADED, at startup, by the same rung.
+check("...and a card ON THIS LEG that the coefficients do not reproduce is "
+      "REFUSED at startup, so the optional block is optional and not inert",
+      why(_t16_start(price_export_formula=_T16_CONS.replace(
+          '"expect_incl_vat":15.55', '"expect_incl_vat":15.05'))[0],
+          "price_export_formula does not reproduce its own card"))
+
+# ⚠️ THE SENTENCE DOCS.md RESTS ON, AND IT IS THE ONE MOST LIKELY TO ROT.
+_T16_INFO = [m for lvl, m in _T16_OK_LOG if lvl == "INFO"
+             and "NO STRATEGY IN THIS ADD-ON READS IT" in m]
+check("the startup line says, in so many words, that NO STRATEGY IN THIS "
+      "ADD-ON READS IT - the operator is told what the option does not do in "
+      "the same breath as it being accepted",
+      len(_T16_INFO) == 1 and "displaced IMPORT" in _T16_INFO[0])
+# ⚠️ THE ASYMMETRY IS ASSERTED AS AN ORDERED PAIR, NOT AS TWO NUMBERS IN ONE
+# SENTENCE (MUTATION.md habit 14). "6 and 0 appear somewhere" is satisfied by
+# the two legs TRANSPOSED - which is the sentence telling an operator that the
+# add-on has their VAT treatment exactly backwards, on the one line where they
+# could have seen it.
+_T16_PAIR = [m for _l, m in _T16_BOTH_LOG if "priced independently" in m]
+print(f"    {(_T16_PAIR or [''])[0][:118]}")
+check("PRECONDITION: the two legs of that run carry DIFFERENT factors and "
+      "DIFFERENT VAT rates (0.102 at 6 against 0.1 at 0), or the ordered-pair "
+      "assertion below would be satisfied by the transposed rendering it "
+      "exists to refuse",
+      _T16_BOTH_LEGS == [] and '"factor":0.102' in _T16_CONS
+      and '"vat_pct":6' in _T16_CONS and '"factor":0.1,' in _T16_ENECO
+      and '"vat_pct":0' in _T16_ENECO)
+check("and the 6% asymmetry is reported as an ORDERED PAIR: the transposed "
+      "rendering would read `consumption factor 0.1 at vat_pct 0, injection "
+      "factor 0.102 at vat_pct 6`, which is a DIFFERENT string - so an "
+      "argument swap at the call site cannot hide behind `0.102 is in there "
+      "somewhere`",
+      len(_T16_PAIR) == 1
+      and "consumption factor 0.102 at vat_pct 6, injection factor 0.1 at "
+          "vat_pct 0" in _T16_PAIR[0]
+      and "consumption factor 0.1 at vat_pct 0, injection factor 0.102 at "
+          "vat_pct 6" not in _T16_PAIR[0])
+
+
 # --------------------------------------------------------------------------- #
 print()
 if fails: