SAFETY-90: the peak guard goes on after a P1 meter gap

A meter gap past meter_max_age_s left seconds the quarter average never
counted, so the guard was blind for the rest of the quarter (rig case 7b:
3964.8 W against a 3450 W aim). Once readings are back, the missed seconds
now count at the higher of the limit and the import seen just before and
just after the gap with the batteries at 0 W (peakguard.gap_w/fill_gaps);
the gap's first meter_max_age_s is topped up to that too. Seconds before
the add-on's first reading count at the aim, and the page says part of the
period was not measured (EN/NL). The bill record is unchanged; no option.

DECISIONS/SAFETY-90-peak-guard-after-a-gap.md, test_safety90.py.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/app/main.py

@@ -947,6 +947,16 @@ class Controller:
         # SAFETY-81: what the alarm is graded on, beside the guard's decision.
         self._peak_proj = None
         self._peak_batt_prev = None
+        # SAFETY-90: what a meter gap is counted at (`_fill_peak_gaps()`).
+        self._gap_seen_w = None
+        self._gap_w = None
+        self._gap_block = None
+        self._gap_filled_s = 0.0
+        self._gap_held_ws = 0.0
+        self._gap_pre = None
+        self._unseen = None
+        self.peak_gap_s = 0.0
+        self.peak_unmeasured_s = 0.0
         self._peak_alarm_block = None
         self._peak_high_since = None
         self._peak_floor_limited = False
@@ -2693,6 +2703,58 @@ class Controller:
                                             lo=p, reason=c.reason,
                                             actuator=u)
 
+    def _fill_peak_gaps(self, proj, now, reading):
+        """SAFETY-90: `proj` with a meter gap's uncounted seconds counted at
+        `peakguard.gap_w()` of the imports seen just before and just after it,
+        and those before this run's first reading at the aim (shown as not
+        measured). DECISIONS/SAFETY-90-peak-guard-after-a-gap.md."""
+        self.peak_gap_s = self.peak_unmeasured_s = 0.0
+        avg = self.p1.averager
+        since = avg.held_since
+        if proj is None or proj.block_start is None or since is None:
+            return proj
+        if self._unseen is None and self.p1.last is not None:
+            self._unseen = (proj.block_start, max(0.0, (
+                since - proj.block_start).total_seconds() - avg.elapsed_s))
+        seen = (None if self.grid is None or self.site_batt_w is None
+                else float(self.grid) + max(0.0, float(self.site_batt_w)))
+        if proj.block_start != self._gap_block:
+            self._gap_block, self._gap_w = proj.block_start, None
+            self._gap_filled_s = self._gap_held_ws = 0.0
+        cap = float(self.o.get("peak_cap_w", 3500))
+        ceiling = peakguard.quarter_ceiling_w(cap, reading)[0]
+        kw = dict(tail_s=(now - since).total_seconds(),
+                  max_hold_s=avg.max_hold_s,
+                  unseen_s=(self._unseen[1] if self._unseen is not None
+                            and self._unseen[0] == proj.block_start else 0.0),
+                  unseen_w=peakguard.quarter_target_w(
+                      cap, self.peak_margin_w, reading))
+        _p, gap_s, _u = peakguard.fill_gaps(proj, gap_w=0.0, **kw)
+        if gap_s > self._gap_filled_s + peakguard.GAP_TOL_S:
+            self._gap_w = peakguard.gap_w(ceiling, self._gap_w,
+                                          self._gap_seen_w, seen)
+            if self._gap_pre is not None:
+                # The averager credited the gap's first max_hold_s at the
+                # reading before it; top that part up to gap_w as well.
+                s0, g0 = self._gap_pre
+                h = (min(s0 + timedelta(seconds=avg.max_hold_s), since)
+                     - max(s0, proj.block_start)).total_seconds()
+                self._gap_held_ws += max(0.0, h) * max(
+                    0.0, self._gap_w - max(0.0, g0))
+            self.log_event(f"PEAK_GUARD_GAP: the meter missed {gap_s:.0f} s "
+                           f"of this 15-minute period, counted at "
+                           f"{self._gap_w:.0f} W",
+                           hint=messages.hint("peak_gap"))
+        self._gap_filled_s = max(self._gap_filled_s, gap_s)
+        if seen is not None:
+            self._gap_seen_w = seen
+        if self.grid is not None:
+            self._gap_pre = (since, float(self.grid))
+        out, self.peak_gap_s, self.peak_unmeasured_s = peakguard.fill_gaps(
+            proj, gap_w=self._gap_w if self._gap_w is not None else ceiling,
+            held_ws=self._gap_held_ws, **kw)
+        return out
+
     def _peak_over_drain(self, claims, maint_results) -> None:
         """SAFETY-83: at N=1 a peak floor above the drain rate outranks it.
 
@@ -4218,6 +4280,10 @@ class Controller:
         # gives for SAFETY-18 on a transport that cannot see `unchanged_s`.
         self._peak_proj = (None if not self.p1_enabled
                            else self.peak.project(self.p1.averager, now))
+        _reading = self.peak.peak(now) if self.p1_enabled else None
+        # SAFETY-90: seconds a meter gap left uncounted are counted, so the
+        # guard goes on after the readings return.
+        self._peak_proj = self._fill_peak_gaps(self._peak_proj, now, _reading)
         # SAFETY-91: at N>=2 the quarter's edge is graded on the next quarter,
         # so a HOLD's ceiling does not lapse for a cycle onto a held battery.
         if self._peak_proj is not None and len(self.inverters) > 1:
@@ -4232,7 +4298,7 @@ class Controller:
             batt_w=self.site_batt_w,
             cap_w=float(self.o.get("peak_cap_w", 3500)),
             margin_w=self.peak_margin_w,
-            reading=self.peak.peak(now),
+            reading=_reading,
             # ⚠️ SUMMED FROM THE PER-UNIT CONJUNCTION, WHICH IS AC 4. Each
             # unit contributes `min(its max_w, |its own device bounds|)`, so
             # inverter B's rating bounds inverter B. Conjoining the SUMS instead
@@ -6390,6 +6456,11 @@ class Controller:
                 out.append({"ok": False, "warn": True, "id": "peak_guard",
                             "text": messages.row_peak_guard_blind(
                                 peakguard.blind_kind(_pg.blind))})
+            elif self.peak_unmeasured_s > 0.0:
+                # SAFETY-90: the start of this quarter came before the first
+                # reading, and the guard counts it at the aim.
+                out.append({"ok": False, "warn": True, "id": "peak_guard",
+                            "text": messages.row_peak_guard_unmeasured()})
             elif _pg.engaged:
                 out.append({"ok": False, "warn": True, "id": "peak_guard",
                             "text": messages.row_peak_guard_on(