TARIFF-01: measure the month's billed peak, and make it survive a restart

The 15-minute block average was already built and unwired. p1.QuarterAverager
computes clock-aligned 900 s blocks, time-weighted over irregular telegram
spacing, offtake-only and per-phase; P1Ingest.blocks was a 96-entry list in
memory that a restart erased. So this is the persistence and the monthly
reduction, not a second accumulator - a second one would be a second source of
truth for the exact quantity the money depends on.

BLOCKS, NOT A SLIDING WINDOW. The card says "rolling"; 9.1 bills "the highest
15-minute average offtake" and states its own worked case per QUARTER - one
4998 W quarter moving a monthly peak from 4832 to 5013 W. A trailing window
reports a peak the meter never bills, and reports it HIGH: a burst straddling
:15 fills the window completely while contributing to two block averages at
partial weight.

DELIVERED, NOT INTENDED. tariff.py only ever sees P1Sample - the meter's own
reading - and never a setpoint. SAFETY-20's open question does not arise for a
capacity tariff: the utility integrates the current that flowed.

AN UNREADABLE STORE IS NOT A ZERO PEAK. peak() answers OBSERVED / NO_RECORD /
NOT_OBSERVED with peak_w None unless observed, which is riglock.holder()'s fix
applied to something that spends money. A peak read as 0 W hands SAFETY-07
maximum headroom and disarms the guard at the moment its own storage breaks.

Restart mid-block resumes the accumulator through a new snapshot()/restore()
pair, checkpointed every 15 s and cleared in the same breath as a block close.
The held sample keeps its ORIGINAL timestamp, so an outage is integrated under
the same max_hold_s rule a running process would apply. quarter_start is the
primary key and a re-bank may only ever RAISE a figure.

Calendar months are LOCAL: a quarter starting 22:15 UTC on 31 August bills in
September.

No new option (the limit is the existing peak_cap_w), so config.yaml and
validate.py are untouched and CFG-03 is not widened. No second peak entity:
peak_forecast_entity stays the input to maintenance_charge_floor(), because
repointing that consumer changes what moves energy and belongs to SAFETY-07.

AC 3 is NOT met. It asks for 30 days of replay; two days of this house's real
meter exist and are committed here. test_tariff.py part 9 replays them, reports
the percentage next to the sample size in days, and asserts nothing about 95 %.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015VXjA3LWccN1rJsk3okyPC

goodwe_controller/app/main.py

@@ -45,6 +45,7 @@ from .hass import HomeAssistant
 from .maintenance import IDLE, MaintConfig, Maintenance
 from .mqtt import MqttPublisher
 from .p1 import P1Ingest, build_source, is_enabled
+from .tariff import PeakStore, PeakTracker
 from .validate import ConfigRefused, refuse, validate_startup_config
 from .watchdog import SignWatchdog, SignWatchdogConfig, loop_is_following
 from . import web
@@ -63,7 +64,8 @@ def load_options() -> dict:
 
 
 class Controller:
-    def __init__(self, opts: dict, hass: HomeAssistant, store, mqtt_pub, *, stop):
+    def __init__(self, opts: dict, hass: HomeAssistant, store, mqtt_pub, *, stop,
+                 peak_db_path: str = "/data/tariff.db"):
         self.o = opts
         self.hass = hass
         self.store = store
@@ -163,6 +165,29 @@ class Controller:
         self.p1 = P1Ingest(phases=int(opts.get("meter_phases", 1)),
                            max_age_s=float(opts.get("meter_max_age_s", 30)))
         self.p1_enabled = is_enabled(opts)
+
+        # TARIFF-01. The capacity-tariff peak: measured from the meter, banked
+        # in SQLite, restored across a restart. It is an INSTRUMENT - it files no
+        # claim and clamps nothing. SAFETY-07 is what will read it.
+        #
+        # ⚠️ NO NEW OPTION. The soft limit is `peak_cap_w`, already shipped,
+        # already validated, already read by control.peak_at_risk(). CFG-03
+        # tracks three places option defaults live; a fourth, for a limit that
+        # already exists, is the mistake the clamp watchdog declined to make ~30
+        # lines up. config.yaml and validate.py are untouched by this ticket.
+        #
+        # ⚠️ AND NO SECOND PEAK ENTITY. `peak_forecast_entity` is the existing
+        # HA-side delegation and it stays the input to maintenance_charge_floor():
+        # repointing that consumer at this measurement CHANGES WHAT MOVES ENERGY
+        # during a maintenance charge, which belongs to SAFETY-07 with its own
+        # acceptance, not to a measurement ticket. What this adds is the MEASURED
+        # MONTH PEAK - a different quantity from a forecast entity, published
+        # nowhere as a duplicate of it.
+        self.peak_store = PeakStore(peak_db_path)
+        self.peak = PeakTracker(self.peak_store,
+                                cap_w=float(opts.get("peak_cap_w", 3500)))
+        self.peak.restore(self.p1.averager)
+        _LOG.info("capacity-tariff peak store: %s", self.peak.restore_state)
         # Set by amain() once the transport is built, so the status page can show
         # what only the transport knows (homewizard_local's unchanged_s). Stays
         # None when P1 is off, or under a transport that has no such counter.
@@ -500,6 +525,14 @@ class Controller:
         # is not, and test_freeze.py part 5 fails on exactly that.
         await self.check_meter_frozen()
 
+        # --- TARIFF-01, and it is LAST on purpose -----------------------------
+        # Banking a quarter is bookkeeping about a moment that has already
+        # happened; a slow SD card must never sit between the meter and the
+        # setpoint. Its position is unconstrained in the way SAFETY-03's and
+        # SAFETY-18's are not - it grades neither `target` nor `standing` and
+        # reads only `self.p1`, which no line in this method writes.
+        self.peak.sync(self.p1)
+
     async def check_output_clamp(self) -> None:
         """SAFETY-03. Alarm whenever a clamp actually engaged this cycle.
 
@@ -837,6 +870,27 @@ class Controller:
                                     f"{self.freeze_wd.cfg.hold_s:.0f} s unchanged "
                                     f"while the command is over "
                                     f"{rail_w(self.o.get('max_w', 2000)):.0f} W)"})
+
+            # TARIFF-01. The month's billed peak, and - the load-bearing half -
+            # a DIFFERENT row when the store could not answer. "no peak yet" is
+            # a normal state on the 1st; "unreadable" is a broken instrument, and
+            # a status page that spelled them the same way would let a 0 W read
+            # look like a quiet month right up until SAFETY-07 shaved nothing.
+            _pk = self.peak.peak()
+            if _pk.is_unreadable:
+                out.append({"ok": False, "warn": True,
+                            "text": "capacity-tariff peak: " + _pk.explain()})
+            else:
+                # §9.1's "warning entity at 80 %", as a status row rather than
+                # a second entity - see the constructor on not doubling up.
+                _frac = self.peak.warning_frac() or 0.0
+                _ok = _frac < 0.8
+                out.append({"ok": _ok, "warn": not _ok,
+                            "text": _pk.explain()
+                                    + f" - {_frac * 100:.0f} % of the "
+                                      f"{self.peak.cap_w:.0f} W soft limit"
+                                    + f"; {self.peak.recorded} quarter(s) banked"
+                                    + f"; on start: {self.peak.restore_state}"})
         rows = [("battery SoC", self.soc, o.get("soc_entity")),
                 ("battery power", self.batt, o.get("batt_entity"))]
         if not self.p1_enabled: