TARIFF-12: a returned degradation is not a refresh

`run_tariff_refresh()` promised in its own docstring that "a failure does
not clear the plan", and enforced it with `except Exception` - a branch a
supplier outage never reaches. `load_prices()` states the reason in its
own words: it "RETURNS, NEVER RAISES, for every failure a site can
actually have", because a degradation arriving as a traceback into the
planning tick would stop the controller regulating over an expired
certificate. So a dead feed RETURNS a §11.4 plan, the `try` succeeds, and
the assignment below it overwrote the good plan unconditionally. With
`static_profile` unset - the shipped default, and the normal state of a
dynamic-tariff site - `_degrade()` returns `TariffPlan(no_data, None,
"none")`: a complete 48-hour plan replaced by nothing, at the FIRST
failed fetch, ~27 minutes after the last good one. `TARIFF_MAX_AGE_S`
(5400 s) never governed anything and there was no serve-stale window at
all.

Fourth card in one family: FCST-04's M4 (`not ok` only), FCST-05's HIGH
(`(JSONDecodeError, OSError)` only), FCST-06 (`not self.ok` only), and
now `except Exception` only, for a path that never raises.

The question is now asked once, after the attempt, from the evidence
that exists - FCST-06's answer, one module over. The evidence is
`TariffPlan.from_feed` (did this resolution observe the configured feed)
and the shipped `fresh_tariff_plan()`, reused rather than transcribed. A
degradation replaces a standing observation only once that observation
has aged out, so `TARIFF_MAX_AGE_S` is now the serve-stale window it
reads like.

A §11.4 static fallback does not replace a fresh provider plan either,
although it carries real prices: every point `_degrade()` builds is
`provisional=True`, so `firm_points()` is empty, `arbitrage()` refuses
and `cheap_now()` is False - everything a consumer may act on is already
off - while a day-ahead price for a given hour does not change once
published. The rule is deliberately not symmetrical: a standing plan
that is itself a degradation IS replaced, or an outage would freeze the
operator's static profile at the window it was first generated for.

`tariff_at` does not move on a kept plan. It is the moment of the fetch
that produced the plan standing, `fresh_tariff_plan()` judges the age
from it, and an unmoved timestamp is the only thing that tells a kept
plan from a freshly fetched one.

test_arbitrage.py section 8b drives the whole chain with nothing stubbed
but the socket: the transport raises the way aiohttp does, load_prices()
returns no_data, _degrade() builds the §11.4 plan, and the shipped
run_tariff_refresh() decides. A check that patched resolve_tariff to
RAISE would have passed against the defect. Ten mutations, ten reds, no
survivors; 29/29 suites green.

Out of scope and unchanged: the persisted price store still does not
back the plan during an outage (FCST-03), and the status banner and the
Arbitrage row's lag are separately carded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/app/main.py

@@ -3480,13 +3480,55 @@ class Controller:
         raise out of here and take the task down, because then the plan freezes
         at its last value and looks current forever. That is what
         `fresh_tariff_plan()`'s age bound is the backstop for, and this is the
-        half that keeps the task alive so the bound rarely matters.
+        half that keeps the task alive. ⚠️ THE BOUND IS NO LONGER A BACKSTOP
+        ONLY: since TARIFF-12 it is also the serve-stale window an outage runs
+        on, and it is consulted below on every refresh.
 
-        ⚠️ AND A FAILURE DOES NOT CLEAR THE PLAN. `resolve_tariff()` already has
-        a §11.4 answer for a dead feed - degrade to the static profile, mark it
-        provisional, arbitrage refuses - and that answer is better than the
-        absence of one. Zeroing the plan here would replace a coarse tariff with
-        no tariff, which is the opposite of what §11.4 asks for.
+        ⚠️ AND A FAILURE DOES NOT CLEAR THE PLAN - WHICH IS A CLAIM ABOUT WHAT
+        `resolve_tariff()` RETURNS, NOT ABOUT WHAT IT RAISES (TARIFF-12). This
+        paragraph was enforced by the `except` below alone, and the `except`
+        below is the one path a supplier outage never takes. `load_prices()`
+        says so in its own words - it "RETURNS, NEVER RAISES, for every failure
+        a site can actually have" - because a degradation arriving as a
+        traceback into the planning tick would stop the controller regulating
+        over an expired certificate. So a dead feed is a RETURN: the `try`
+        succeeds, `_degrade()` hands back a §11.4 plan, and the assignment used
+        to overwrite the good one unconditionally. Measured in a 40 h soak with
+        `static_profile` unset (the shipped default, and the normal state of a
+        dynamic-tariff site): the FIRST failed fetch replaced a complete 48 h
+        plan with `TariffPlan(no_data, None, "none")` - 0 points - 27 minutes
+        after the last good one, and `TARIFF_MAX_AGE_S` governed nothing. A
+        transient blip cost the same as a 90-minute outage.
+
+        ⚠️ SO THE QUESTION IS ASKED ONCE, AFTER THE ATTEMPT, FROM THE EVIDENCE
+        THAT EXISTS - FCST-06's answer, in this file. The evidence is
+        `plan.from_feed` (did this attempt observe the feed) and
+        `fresh_tariff_plan(now)` (is an observation still current). A
+        degradation replaces a standing observation only once that observation
+        has aged out, so `TARIFF_MAX_AGE_S` is now the serve-stale window it
+        reads like rather than a bound nothing could reach.
+
+        ⚠️ AND A §11.4 STATIC FALLBACK DOES NOT REPLACE A FRESH PROVIDER PLAN
+        EITHER, although it carries real prices. Every point `_degrade()`
+        builds is `provisional=True`, so `firm_points()` is empty,
+        `arbitrage()` refuses and `cheap_now()` is False - everything a
+        consumer may act on is already off. A day-ahead price for a given hour
+        does not change once published, so a plan fetched half an hour ago is
+        exactly as true about that hour as one fetched now. The fallback is
+        less actionable and no more current; it takes over when the observation
+        retires, which is what §11.4 is for. The reverse is not symmetrical: a
+        standing plan that is ITSELF a degradation is replaced by a fresh one,
+        or an outage would freeze the operator's static profile at the window
+        it was generated for.
+
+        ⚠️ AND `tariff_at` DOES NOT MOVE ON A KEPT PLAN. It is the moment the
+        fetch that produced the standing plan happened, and
+        `fresh_tariff_plan()` judges the age from it - re-stamping it here
+        would be this task asserting the feed answered when it did not, and the
+        plan would "freeze at its last value and look current forever", which
+        is the hazard the paragraph above this one names. An unmoved
+        `tariff_at` is also the only thing that tells a kept plan from a
+        freshly fetched one, so it is what the check asserts.
         """
         horizon = float(price_option(self.o, "price_horizon_h"))
         while not self.stopping:
@@ -3495,11 +3537,32 @@ class Controller:
                 plan = await resolve_tariff(
                     self.o, now, now + timedelta(hours=horizon), now=now,
                     history=self.price_history)
-                self.tariff_plan, self.tariff_at = plan, now
-                _LOG.info("tariff refreshed: %s", plan.words)
+                standing = self.fresh_tariff_plan(now)
+                # Three terms, and each of them is the only false one in some
+                # check: the feed answered (replace), nothing current stands
+                # (take the degradation - this is what makes the age bound
+                # govern), or what stands is itself a degradation (replace).
+                keep = (not plan.from_feed
+                        and standing is not None and standing.from_feed)
+                if keep:
+                    _LOG.warning(
+                        "tariff refresh degraded (%s); KEEPING the plan "
+                        "resolved at %s, %.0f s ago. tariff_at is NOT moved, "
+                        "so it retires %.0f s after that fetch and arbitrage "
+                        "stops with it - a kept plan is never presented as a "
+                        "current one.", plan.words, self.tariff_at,
+                        (now - self.tariff_at).total_seconds(),
+                        TARIFF_MAX_AGE_S)
+                else:
+                    self.tariff_plan, self.tariff_at = plan, now
+                    _LOG.info("tariff refreshed: %s", plan.words)
             except Exception as err:                          # noqa: BLE001
+                # ⚠️ NOT THE OUTAGE PATH - see the docstring. `load_prices()`
+                # returns on every failure a site can have, so what reaches
+                # here is something nobody expected, and the plan is kept for
+                # the same reason and on the same terms.
                 _LOG.warning(
-                    "tariff refresh failed (%s); keeping the plan resolved at "
+                    "tariff refresh raised (%s); keeping the plan resolved at "
                     "%s. It retires on its own after %.0f s and arbitrage "
                     "stops with it.", err, self.tariff_at, TARIFF_MAX_AGE_S)
             with contextlib.suppress(asyncio.TimeoutError):