TARIFF-12: a returned degradation is not a refresh

`run_tariff_refresh()` promised in its own docstring that "a failure does
not clear the plan", and enforced it with `except Exception` - a branch a
supplier outage never reaches. `load_prices()` states the reason in its
own words: it "RETURNS, NEVER RAISES, for every failure a site can
actually have", because a degradation arriving as a traceback into the
planning tick would stop the controller regulating over an expired
certificate. So a dead feed RETURNS a §11.4 plan, the `try` succeeds, and
the assignment below it overwrote the good plan unconditionally. With
`static_profile` unset - the shipped default, and the normal state of a
dynamic-tariff site - `_degrade()` returns `TariffPlan(no_data, None,
"none")`: a complete 48-hour plan replaced by nothing, at the FIRST
failed fetch, ~27 minutes after the last good one. `TARIFF_MAX_AGE_S`
(5400 s) never governed anything and there was no serve-stale window at
all.

Fourth card in one family: FCST-04's M4 (`not ok` only), FCST-05's HIGH
(`(JSONDecodeError, OSError)` only), FCST-06 (`not self.ok` only), and
now `except Exception` only, for a path that never raises.

The question is now asked once, after the attempt, from the evidence
that exists - FCST-06's answer, one module over. The evidence is
`TariffPlan.from_feed` (did this resolution observe the configured feed)
and the shipped `fresh_tariff_plan()`, reused rather than transcribed. A
degradation replaces a standing observation only once that observation
has aged out, so `TARIFF_MAX_AGE_S` is now the serve-stale window it
reads like.

A §11.4 static fallback does not replace a fresh provider plan either,
although it carries real prices: every point `_degrade()` builds is
`provisional=True`, so `firm_points()` is empty, `arbitrage()` refuses
and `cheap_now()` is False - everything a consumer may act on is already
off - while a day-ahead price for a given hour does not change once
published. The rule is deliberately not symmetrical: a standing plan
that is itself a degradation IS replaced, or an outage would freeze the
operator's static profile at the window it was first generated for.

`tariff_at` does not move on a kept plan. It is the moment of the fetch
that produced the plan standing, `fresh_tariff_plan()` judges the age
from it, and an unmoved timestamp is the only thing that tells a kept
plan from a freshly fetched one.

test_arbitrage.py section 8b drives the whole chain with nothing stubbed
but the socket: the transport raises the way aiohttp does, load_prices()
returns no_data, _degrade() builds the §11.4 plan, and the shipped
run_tariff_refresh() decides. A check that patched resolve_tariff to
RAISE would have passed against the defect. Ten mutations, ten reds, no
survivors; 29/29 suites green.

Out of scope and unchanged: the persisted price store still does not
back the plan during an outage (FCST-03), and the status banner and the
Arbitrage row's lag are separately carded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/app/static_tariff.py

@@ -728,6 +728,33 @@ class TariffPlan:
         self.origin = origin
 
     # -- derived facts -------------------------------------------------------
+    @property
+    def from_feed(self) -> bool:
+        """Is this series an OBSERVATION of the configured provider's feed?
+
+        TARIFF-12. `origin` names four ways a plan is obtained; this collapses
+        them to the one question a caller holding a PREVIOUS plan has to ask
+        about a new one - did this resolution see the feed, or is it standing
+        in for one that did not? Only `"provider"` saw it. `"fallback"` and
+        `"none"` are the two §11.4 rows, and `"static"` is a site with no
+        feed to observe at all, where the question does not arise.
+
+        ⚠️ IT IS NOT `has_prices`, AND THE DIFFERENCE IS THE WHOLE POINT. A
+        §11.4 fallback HAS prices - the operator's own static profile - but
+        every point `_degrade()` builds carries `provisional=True`, so
+        `firm_points()` is empty, `arbitrage()` refuses and `cheap_now()` is
+        False. It is a real tariff and it is not an observation, and a caller
+        deciding whether to REPLACE an observation with it needs the second
+        fact, not the first.
+
+        ⚠️ AND IT IS A PROPERTY HERE RATHER THAN AN `origin == "provider"` AT
+        THE CALL SITE, for `main.fresh_tariff_plan()`'s stated reason: a check
+        has to be able to assert on the shipped expression rather than on a
+        transcription that drifts, and `origin`'s vocabulary belongs to this
+        module.
+        """
+        return self.origin == "provider"
+
     @property
     def has_prices(self) -> bool:
         return self.read.match(series=lambda _r: True, no_data=lambda _r: False)