SAFETY-90: the peak guard goes on after a P1 meter gap

A meter gap past meter_max_age_s left seconds the quarter average never
counted, so the guard was blind for the rest of the quarter (rig case 7b:
3964.8 W against a 3450 W aim). Once readings are back, the missed seconds
now count at the higher of the limit and the import seen just before and
just after the gap with the batteries at 0 W (peakguard.gap_w/fill_gaps);
the gap's first meter_max_age_s is topped up to that too. Seconds before
the add-on's first reading count at the aim, and the page says part of the
period was not measured (EN/NL). The bill record is unchanged; no option.

DECISIONS/SAFETY-90-peak-guard-after-a-gap.md, test_safety90.py.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/app/homeview.py

@@ -904,7 +904,9 @@ def month_peak(c, now):
     if pg is not None:
         out["period_w"] = pg.projected_w
         ceiling = pg.ceiling_w or limit_w
-    out["line"] = line_period(out["period_w"], ceiling, c.shadow)
+    out["line"] = line_period(out["period_w"], ceiling, c.shadow,
+                              unmeasured=getattr(c, "peak_unmeasured_s", 0.0)
+                              > 0.0)
     return out
 
 
@@ -1294,8 +1296,11 @@ def line_peak_not_covered() -> str:
     return _t("peak_not_covered")
 
 
-def line_period(period_w, limit_w, shadow) -> str:
+def line_period(period_w, limit_w, shadow, unmeasured=False) -> str:
     step = _w(shadow, "step_in", kw=_kw(limit_w))
+    if unmeasured:
+        # SAFETY-90: the add-on started during this period.
+        return _t("period_unmeasured") + " " + step
     if period_w is None:
         return step
     return _t("period", kw=_kw(period_w)) + " " + step
@@ -1369,6 +1374,7 @@ def _samples() -> list:
                 ("plan", line_peak_limit(3500, sh)),
                 ("plan", line_period(1240, 3500, sh)),
                 ("plan", line_period(None, 3500, sh)),
+                ("plan", line_period(1240, 3500, sh, unmeasured=True)),
                 ("plan", control_text(True, sh)),
                 ("plan", control_text(False, sh))]
     out += [("plan", run_grid_why(0.1412)), ("plan", run_grid_amount(1.23)),

goodwe_controller/app/main.py

@@ -947,6 +947,16 @@ class Controller:
         # SAFETY-81: what the alarm is graded on, beside the guard's decision.
         self._peak_proj = None
         self._peak_batt_prev = None
+        # SAFETY-90: what a meter gap is counted at (`_fill_peak_gaps()`).
+        self._gap_seen_w = None
+        self._gap_w = None
+        self._gap_block = None
+        self._gap_filled_s = 0.0
+        self._gap_held_ws = 0.0
+        self._gap_pre = None
+        self._unseen = None
+        self.peak_gap_s = 0.0
+        self.peak_unmeasured_s = 0.0
         self._peak_alarm_block = None
         self._peak_high_since = None
         self._peak_floor_limited = False
@@ -2693,6 +2703,58 @@ class Controller:
                                             lo=p, reason=c.reason,
                                             actuator=u)
 
+    def _fill_peak_gaps(self, proj, now, reading):
+        """SAFETY-90: `proj` with a meter gap's uncounted seconds counted at
+        `peakguard.gap_w()` of the imports seen just before and just after it,
+        and those before this run's first reading at the aim (shown as not
+        measured). DECISIONS/SAFETY-90-peak-guard-after-a-gap.md."""
+        self.peak_gap_s = self.peak_unmeasured_s = 0.0
+        avg = self.p1.averager
+        since = avg.held_since
+        if proj is None or proj.block_start is None or since is None:
+            return proj
+        if self._unseen is None and self.p1.last is not None:
+            self._unseen = (proj.block_start, max(0.0, (
+                since - proj.block_start).total_seconds() - avg.elapsed_s))
+        seen = (None if self.grid is None or self.site_batt_w is None
+                else float(self.grid) + max(0.0, float(self.site_batt_w)))
+        if proj.block_start != self._gap_block:
+            self._gap_block, self._gap_w = proj.block_start, None
+            self._gap_filled_s = self._gap_held_ws = 0.0
+        cap = float(self.o.get("peak_cap_w", 3500))
+        ceiling = peakguard.quarter_ceiling_w(cap, reading)[0]
+        kw = dict(tail_s=(now - since).total_seconds(),
+                  max_hold_s=avg.max_hold_s,
+                  unseen_s=(self._unseen[1] if self._unseen is not None
+                            and self._unseen[0] == proj.block_start else 0.0),
+                  unseen_w=peakguard.quarter_target_w(
+                      cap, self.peak_margin_w, reading))
+        _p, gap_s, _u = peakguard.fill_gaps(proj, gap_w=0.0, **kw)
+        if gap_s > self._gap_filled_s + peakguard.GAP_TOL_S:
+            self._gap_w = peakguard.gap_w(ceiling, self._gap_w,
+                                          self._gap_seen_w, seen)
+            if self._gap_pre is not None:
+                # The averager credited the gap's first max_hold_s at the
+                # reading before it; top that part up to gap_w as well.
+                s0, g0 = self._gap_pre
+                h = (min(s0 + timedelta(seconds=avg.max_hold_s), since)
+                     - max(s0, proj.block_start)).total_seconds()
+                self._gap_held_ws += max(0.0, h) * max(
+                    0.0, self._gap_w - max(0.0, g0))
+            self.log_event(f"PEAK_GUARD_GAP: the meter missed {gap_s:.0f} s "
+                           f"of this 15-minute period, counted at "
+                           f"{self._gap_w:.0f} W",
+                           hint=messages.hint("peak_gap"))
+        self._gap_filled_s = max(self._gap_filled_s, gap_s)
+        if seen is not None:
+            self._gap_seen_w = seen
+        if self.grid is not None:
+            self._gap_pre = (since, float(self.grid))
+        out, self.peak_gap_s, self.peak_unmeasured_s = peakguard.fill_gaps(
+            proj, gap_w=self._gap_w if self._gap_w is not None else ceiling,
+            held_ws=self._gap_held_ws, **kw)
+        return out
+
     def _peak_over_drain(self, claims, maint_results) -> None:
         """SAFETY-83: at N=1 a peak floor above the drain rate outranks it.
 
@@ -4218,6 +4280,10 @@ class Controller:
         # gives for SAFETY-18 on a transport that cannot see `unchanged_s`.
         self._peak_proj = (None if not self.p1_enabled
                            else self.peak.project(self.p1.averager, now))
+        _reading = self.peak.peak(now) if self.p1_enabled else None
+        # SAFETY-90: seconds a meter gap left uncounted are counted, so the
+        # guard goes on after the readings return.
+        self._peak_proj = self._fill_peak_gaps(self._peak_proj, now, _reading)
         # SAFETY-91: at N>=2 the quarter's edge is graded on the next quarter,
         # so a HOLD's ceiling does not lapse for a cycle onto a held battery.
         if self._peak_proj is not None and len(self.inverters) > 1:
@@ -4232,7 +4298,7 @@ class Controller:
             batt_w=self.site_batt_w,
             cap_w=float(self.o.get("peak_cap_w", 3500)),
             margin_w=self.peak_margin_w,
-            reading=self.peak.peak(now),
+            reading=_reading,
             # ⚠️ SUMMED FROM THE PER-UNIT CONJUNCTION, WHICH IS AC 4. Each
             # unit contributes `min(its max_w, |its own device bounds|)`, so
             # inverter B's rating bounds inverter B. Conjoining the SUMS instead
@@ -6390,6 +6456,11 @@ class Controller:
                 out.append({"ok": False, "warn": True, "id": "peak_guard",
                             "text": messages.row_peak_guard_blind(
                                 peakguard.blind_kind(_pg.blind))})
+            elif self.peak_unmeasured_s > 0.0:
+                # SAFETY-90: the start of this quarter came before the first
+                # reading, and the guard counts it at the aim.
+                out.append({"ok": False, "warn": True, "id": "peak_guard",
+                            "text": messages.row_peak_guard_unmeasured()})
             elif _pg.engaged:
                 out.append({"ok": False, "warn": True, "id": "peak_guard",
                             "text": messages.row_peak_guard_on(

goodwe_controller/app/messages.py

@@ -793,6 +793,12 @@ def row_peak_guard_blind(why: str) -> str:
             f"meanwhile")
 
 
+def row_peak_guard_unmeasured() -> str:
+    """SAFETY-90. Before the first reading; that part counts as on target."""
+    return ("Peak guard: part of this 15-minute period was not measured, "
+            "counted as on target")
+
+
 def row_peak_guard_on(floor_w, limit_w, *, shadow: bool = False) -> str:
     if shadow:
         return (f"Peak guard: would ask for {watts(floor_w)} to stay under "
@@ -912,6 +918,7 @@ HINTS = {
     "peak_on": "Peak guard started",
     "peak_off": "Peak guard idle",
     "peak_blind": "Peak guard cannot read the meter well",
+    "peak_gap": "Meter is back, the peak guard counts the missed time as high use",
     "peak_saturated": T_PEAK_SATURATED,
     "peak_reserve": T_PEAK_RESERVE,
     "meter_frozen": T_METER_FROZEN,
@@ -1097,6 +1104,7 @@ def status_samples() -> list:
         ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, True)),
         ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, False)),
         ("row_peak_guard_quiet", GREEN, row_peak_guard_quiet()),
+        ("row_peak_guard_unmeasured", AMBER, row_peak_guard_unmeasured()),
         *(("row_peak_guard_blind", AMBER, row_peak_guard_blind(k))
           for k in BLIND_WORDS),
         ("row_peak_guard_on", AMBER, row_peak_guard_on(1200, 2500)),

goodwe_controller/app/p1.py

@@ -312,6 +312,13 @@ class QuarterAverager:
         """
         return self._last_net
 
+    @property
+    def held_since(self) -> datetime | None:
+        """SAFETY-90: when the held sample arrived (its `ingest_ts`), or None."""
+        if self._last_t is None:
+            return None
+        return datetime.fromtimestamp(self._last_t, timezone.utc)
+
     @property
     def offtake_avg_w(self) -> float:
         """Average offtake over the part of the open block seen so far."""

goodwe_controller/app/peakguard.py

@@ -183,6 +183,8 @@ guard passes its own tests while being switched off:
     record). Those seconds make the projection read LOW, which is the
     under-guarding direction. The threshold is `max_hold_s` itself - the point
     p1.py already stops trusting a held sample - not a new number.
+    SAFETY-90: once readings are back, main.py counts those seconds
+    (`fill_gaps()`), so this holds only while the gap lasts.
 
   * FROZEN. SAFETY-18's conjunction, evaluated through `freeze.looks_frozen()`
     rather than re-written here. A frozen meter is the worst case of all: the
@@ -599,6 +601,57 @@ def blindness(projection, max_hold_s, frozen: bool) -> str | None:
     return None
 
 
+# SAFETY-90. Seconds of uncounted time below which nothing is filled: float
+# noise between the averager's sums and the wall clock, never a real gap.
+GAP_TOL_S = 1e-3
+
+
+def gap_w(ceiling_w, *seen_w) -> float:
+    """SAFETY-90: the watts a meter gap is counted at. The highest of the
+    limit and `seen_w`, the import with the batteries at 0 W (grid + their
+    discharge) just before and just after the gap; None entries are skipped.
+    DECISIONS/SAFETY-90-peak-guard-after-a-gap.md."""
+    return max([float(ceiling_w)] + [float(w) for w in seen_w if w is not None])
+
+
+def fill_gaps(projection, *, tail_s, max_hold_s, unseen_s, gap_w, unseen_w,
+              held_ws=0.0):
+    """SAFETY-90: `projection` with the seconds the averager did not count
+    (a meter gap past `max_hold_s`) counted at `gap_w`, and those from before
+    this run's first reading (`unseen_s`) at `unseen_w`. `held_ws` is added
+    too: what the gap's first `max_hold_s`, credited at the reading before
+    it, lacks to reach `gap_w`. Returns
+    `(projection, gap seconds filled, unseen seconds filled)`.
+
+    `tail_s` is the age of the held reading: up to `max_hold_s` of it is left
+    as before (the averager credits it once the next reading lands). Past
+    that the gap is still open, nothing is filled and `blindness()` answers
+    as before. DECISIONS/SAFETY-90-peak-guard-after-a-gap.md."""
+    if projection.block_start is None or max_hold_s is None:
+        return projection, 0.0, 0.0
+    wall = float(projection.elapsed_s)
+    tail = min(max(0.0, float(tail_s)), wall)
+    if tail > float(max_hold_s):
+        return projection, 0.0, 0.0
+    covered = wall - uncovered_s(projection)
+    missing = wall - covered - tail
+    if missing <= GAP_TOL_S:
+        missing = 0.0
+        if held_ws <= 0.0:
+            return projection, 0.0, 0.0
+    unseen = min(missing, max(0.0, float(unseen_s)))
+    gap = missing - unseen
+    add_ws = gap * float(gap_w) + unseen * float(unseen_w) + float(held_ws)
+    done = covered + missing
+    return (replace(
+        projection,
+        projected_w=float(projection.projected_w) + add_ws / QUARTER_S,
+        elapsed_w=((float(projection.elapsed_w) * covered + add_ws) / done
+                   if done > 0.0 else float(projection.elapsed_w)),
+        covered_frac=(done / wall if wall > 0.0
+                      else float(projection.covered_frac))), gap, unseen)
+
+
 def discharge_permitted(soc, soc_floor) -> str | None:
     """SAFETY-24. May the guard size a forced discharge, or why may it not?
 

goodwe_controller/app/ui_text/en.json

@@ -410,6 +410,7 @@
     "step_in": "The batteries step in above {kw}.",
     "step_in_would": "The batteries would step in above {kw}.",
     "period": "This 15-minute period is heading for {kw}.",
+    "period_unmeasured": "Part of this 15-minute period was not measured.",
     "prices": {
       "now": "Price now {eur} per kWh, all in.",
       "today": "Today: lowest {lo} at {lo_at}, highest {hi} at {hi_at}.",

goodwe_controller/app/ui_text/nl.json

@@ -347,6 +347,7 @@
     "step_in": "De batterijen springen bij boven {kw}.",
     "step_in_would": "De batterijen zouden bijspringen boven {kw}.",
     "period": "Dit kwartier gaat richting {kw}.",
+    "period_unmeasured": "Een deel van dit kwartier is niet gemeten.",
     "prices": {"now": "Prijs nu {eur} per kWh, alles inbegrepen.", "today": "Vandaag: laagste {lo} om {lo_at}, hoogste {hi} om {hi_at}.", "none": "Geen prijzen voor vandaag."},
     "tomorrow": {"known": "De prijzen van morgen zijn binnen.", "unknown": "De prijzen van morgen komen meestal na 13:00."},
     "region": {"preset": "Heffingen en btw: {region}, cijfers van {year}.", "own": "Heffingen en btw: uw eigen bedrag."},