8 Commits

Include renames

Author	SHA1	Message	Date
glenn schrooyenandClaude	9ac3a9d2bc	PRICE-01: price_service provider, fallback chain, and the gate read from it ... A new price source, `price_provider: price_service`: the owner's price server, one fixed HTTPS host, a bearer token (new password option `price_service_token`), wholesale energy only so markup and taxes are added as for generic_dayahead. The chain is server, then energy-charts, then the prices the history store kept. A step counts only if it has a price for now. Each step down and back up is one log line. With every source down a site plans from what it saved. No price for now: one status row, one Home plan line and one notification, in English and Dutch, cleared when a price returns. With this provider the maintenance charge gate reads the provider's prices and keeps the Home Assistant rule: the current 15-minute price is at or below today's average. The token is hidden on the settings page, refused when missing, and taken out of any error text. Other providers, `off` and the Home Assistant pair take the road they always took (scripted-day probe against 0ce7d35: one line differs, the refusal that lists the known providers). See DECISIONS/PRICE-01-own-price-server.md. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC	2026-10-14 16:22:24 +02:00
glenn schrooyenandClaude Opus 5.5	23a3a3f5b5	UX-10: the last plain-language leftovers: log lines, two table rows, 'Why: Other', red at 0 s ... - test_messages.py part 6: every dynamic part of a WARNING+ line is classified as data or as a built text, and every built text is produced by the real code and checked. This is the gap the 2d scan had: it counted `%s` as one word, so reasons built by loop_clamp_note() and friends were never seen. - Quoted reasons rewritten to STYLE.md (red-alarm shape, codes kept): OUTPUT_CLAMP, METER_FROZEN, CIRCULATING_POWER, STALE_READING, the peak guard (codes now PEAK_GUARD*), the migration report, price feed, price history and gate reasons. Plurals via messages.times()/count(). - Top table: Price history "96 prices over 24 hours for 26 Sep", Tariff "one every 15 minutes or every hour", "not final yet" dropped. - Levels and noise: per-cycle shadow line DEBUG, shadow on/off INFO, aiohttp access log only at log level debug, settings warnings once per start, one plain line per Home Assistant outage (hass.Outage). - INFO jargon and error texts: no "§8.3", ISO times, "banked", "keys ARE", "NOT_OBSERVED", "did NOT land", "AND". - Display bugs: WHY_WINNER covers every winner and safety reason (main.why_key(), part 7 finds them in the code); the meter row is amber "waiting for the first reading" inside its limit after a start; the missing-reading age is counted when the page asks. - STYLE.md and DECISIONS/UX-08-short-notifications.md (UX-10 section). No change to safety behaviour, alarm levels, notification ids, triggers, cadence or the banner cascade. One row colour changes (meter at start), justified in DECISIONS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-27 10:58:43 +02:00
adminandClaude Opus 5.5	6a95447248	UX-08 2d: plain log lines, the rest of the status page, and DOCS ... Every WARNING and ERROR line is one plain line of at most 25 words, with no card ids, capitals or semicolons; the reasoning of the ten longest is on a DEBUG line. The ux08 allowlist is empty and its cap is 0 (43 -> 0). The status page: the month-peak and peak-guard rows, the stale-reading row, the top table (Why, Tariff, Arbitrage, Shadow mode, labels), the Stopped banner and the line under the buttons, which now shows the plain hint of each event instead of the raw action log. The Supervisor question at start logs one line with a real reason. Refusals are counted as shown (labels expanded, long cases driven), seven were shortened, the card and parse errors lost their internals, a blank value reads "empty", and the panel no longer files inverters.max_w under the flat max_w. Option names lose "(JSON)", the NL texts are checked too. DOCS gets a glossary (control board, isolator, Developer Tools) and card ids move from headings to a "For installers" line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LyR88rXETvwhTgx6yHE39p	2026-09-27 08:01:16 +02:00
adminandClaude Opus 5	f620f7cf80	TARIFF-07: three plugins that never fetched a price are withdrawn, and a site configured on one is told so ... engie_dynamic, totalenergies_dynamic and eneco_eddy are removed from PROVIDERS and from every surface that listed them. They did not stop working - they never worked. Re-verified by hand on 2026-09-13 before deleting anything: 404 with Kong's "no Route matched with those values"; a TLS handshake that fails because api.totalenergies.be is absent from the certificate's SAN list; 404 with an empty body. All three are also structurally impossible - the coefficients are per-contract and behind a customer login, there is no regulator index, and "Eddy" is not an Eneco product at all. ⚠️ BACKWARD-INCOMPATIBLE. A config legal on the current version is refused on the next. That is the point of the change: §11.4 turned every failed fetch into a silent fall back, so a site on one of these ids has been running on static_profile - or on nothing - since the day it was set, with nothing on its status page ever differing from a working provider that never found a cheap hour. validate.py now refuses a retired id with a message naming the id, the endpoint, what that endpoint answers, which tariff has really been in force, and what to set instead. No version number is picked here; that depends on a fact about the live box. ⚠️ config.yaml's price_provider enum deliberately KEEPS all three ids. The Supervisor validates the options file against that enum before the add-on starts, so removing them would make an existing config schema-invalid and the refusal above would never be reached on exactly the sites that need it. PROVIDERS is two; the enum stays six; test_price.py asserts the schema offers exactly PROVIDERS | RETIRED_PROVIDERS | {"off"}, derived rather than typed, and register() refuses to re-register a retired id. PriceProduct.REALTIME, _WIDE, Uncertainty.REALTIME_PRODUCT and WIDEN_FACTOR's 2.5 are KEPT with no shipped declarer - it is the AC2 seam, and a reviewer finding a mechanism with zero callers would reasonably delete it. Recorded in DECISIONS/TARIFF-07-withdrawing-three-plugins.md and pinned by a check. False claims corrected: every "Belgian imbalance product" claim about eneco_eddy (DOCS.md, price_forecast.py, price_history.py, static_tariff.py, FCST-04, CHANGELOG - the two released entries annotated in place rather than rewritten); the quarter-hourly examples now cite Belgian day-ahead, which really does settle per quarter since the 15-minute MTU; and export_price_eur_kwh's "no shipped supplier publishes a dynamic injection curve", which is false - Eneco publishes 0,1 x BELPEX-H - 1,188 and ENGIE (B x eSpot_15) - A, same two-coefficient shape with its own coefficients and its own VAT treatment, so the scalar is a simplification and not the market. DOCS.md's provider table is two rows and now says honestly what a Belgian dynamic customer should do today, including that generic_dayahead cannot express B x spot + A and that price_markup_eur_kwh: float(0,1) could not hold a negative offset. The formula provider is referenced as planned, not built. _points_from_json() went with the plugins it served: it read a shape no feed anybody here has ever reached publishes. The one place it survives is a negative stimulus, named row_shape_body(). Nine mutations driven, all red; table in the decision record. 29/29 suites green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-13 02:46:15 +02:00
adminandClaude Opus 5	c45893ffad	FCST-06: "cannot persist" becomes one question, asked once, about the outcome ... price_history.py's docstring states its rule unconditionally - "A store that cannot persist now records nothing, and both of its answers say the same thing" - and FCST-04 enforced it against `not self.ok` only, which is one SYMPTOM: the durable volume is missing. `ok` is about the DIRECTORY, and a read-only remount and a full disk both leave it True. Reproduced on 5059e28 against two real volumes, a /data bind-mounted read-only and a full tmpfs: last_error = 'could not write ([Errno 30] Read-only file system)' words = '2026-01-14 (24 points over 24 h); 2026-01-15 (24 points over 24 h) [could not write (...)]' yesterday()= series, 24 points ON DISK = {} `words` and `yesterday()` were describing two different stores, and the 24 points were gone on the next restart with nothing saying so - the silently-forgetting cache that rule exists to refuse, reached by the condition it did not name. No shipped path reaches it: /data is the Supervisor's durable volume and this module is its only writer. The defect is that a guarantee the module states about itself did not hold in one condition. Route taken: `_remember()` refuses to retain what it could not write, and the docstring's claim stands as written. It is now ONE derived predicate rather than two places testing two symptoms. "Can this store persist?" cannot be answered BEFORE the attempt - a directory that existed and was writable a moment ago is not a write that completed - so it is answered after it, once, by the only thing holding the evidence: `_save()` returns whether the file now holds what memory holds. No volume is one False, an OSError is another. `_remember()` keeps only what that one answer says was kept, and the `not self.ok` test in `_remember()` is GONE rather than joined by a second one. FCST-04's M4 and FCST-05's HIGH were the same shape, so a third cause now needs no third branch. What is undone is the MERGE, not the store. The state restored is the last one that IS on disk, so a site whose volume fills at 14:00 goes on answering the yesterday it wrote at 13:30 - that record survives a restart, so answering it is not a promise the store cannot keep. It stops adding to it. The snapshot is copy.deepcopy: a one-level copy shares the day record the merge rebinds `points` on, and measured with one, a store holding 12 persisted points answered 24 after a failed merge. Not fatal, deliberately: §6 and this module's opening - a broken cache must not be a broken controller, and an add-on that will not start because /data filled up is a worse defect than this one. `_save()` reports and returns; the shipped resolve_tariff() path still gives a provider plan with no §11.4 degradation. What changed is that the failure is now acted on rather than only logged. test_price_history.py section 5d drives it on two REAL failures with different syscalls and different errnos - a directory where the file goes (os.replace, EISDIR) and a volume moved out from under an open store (mkstemp, ENOENT) - because the rule is enforced on the outcome and one cause would grade a coincidence. DOCS.md's "where there is no /data" sentence is widened to the condition the code now holds to. MUTATION.md gains what M4 exposed: a mutation whose red is a TRACEBACK reports however many checks ran before it and grades none after it. M4 first printed 1 FAIL; the true figure is 3. An f-string operand read `len(read.points)`, and `.points` on a no_data raises `Absence` by design - why()'s rule arriving in what a check PRINTS rather than in what it asserts. `npts()` is now beside why(), and a red count is a lower bound until the run is seen to reach the end of its section. 6 mutations, purged tree, every one RED on named checks, no survivors: M1 self._days = before -> dict(self._days) +10 B 9 red M2 _save() OSError handler returns True -1 B 9 red M3 _save() returns True on `not self.ok` -1 B 3 red M4 self._days = before -> self._days = {} -4 B 3 red M5 copy.deepcopy -> dict -9 B 3 red M6 `if not self.ok: return` back in _remember() +43 B 1 red All 29 test files green. Nothing deployed; no option added; config.yaml and app/ behaviour on a healthy /data untouched. No version number picked - that is the open decision the Unreleased block names. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-10 08:43:17 +02:00
glenn schrooyenandClaude Opus 5	375a1e29d2	FCST-05: one byte stops stopping the add-on, and the write path gets the read path's standard ... HIGH - a non-UTF-8 byte in /data/price_history.json stopped the add-on from starting. `_load()` caught `(json.JSONDecodeError, OSError)`. `UnicodeDecodeError` is `ValueError -> UnicodeError -> UnicodeDecodeError`: neither of those, and `issubclass(UnicodeDecodeError, OSError)` is False. So it escaped `_load()` -> `_open()` -> `PriceHistory.__init__`, which `Controller.__init__` does not guard - breaking `_load()`'s own stated contract, "a corrupt cache must not stop the controller". The handler now names the ValueError FAMILY (the file's content) beside OSError (its bytes), because a third subclass nobody has thought of is how this arrived the first time. The suite could not see it: its "unreadable file" fixture writes "{ this is not json", which is valid UTF-8 and fails one step later, in `json`. A fixture holding a genuinely undecodable byte is now beside it, with the difference between the two asserted as a precondition. MEDIUM - a malformed `start` under the day the feed is writing to killed the tariff plan permanently. `_remember()` merged with `{q["start"]: q ...}` and sorted on `q["start"]`, trusting a value read off /data to be a hashable, sortable string. An int, null, a dict or a list raised TypeError out of `carry()` -> `resolve_tariff()` -> `run_tariff_refresh`, which catches Exception - so the add-on stayed UP while every refresh raised forever, the plan retiring after TARIFF_MAX_AGE_S with arbitrage and the cheap window off for good, and no self-heal because `_remember()` raised before `_save()`. The read path was properly defensive throughout, which is why `yesterday()` survived and the existing fixture passed - it files its malformed rows under a day the feed is NOT writing to. Both paths now share one validator, `_point_of()`. A row that is not a point is dropped, reported, and written back out clean. ...and the status row said the store was healthy while the plan was dead: `words` read '2026-01-15 (1 h)'. `_load()` now counts the rows inside a kept record as well as the record itself, so the store stops reporting plain health from the moment it is opened; the note names what was FOUND at open and what was DROPPED by the refresh, and clears once the file is rewritten. ...and the merge key is the validated INSTANT rather than its spelling, which is what rule 4 already said. The lexicographic sort beside the string key also put the second 02:00 of the 25-hour October day (+01:00) before the first (+02:00); stored order only, since `_parse_points()` re-sorts. LOW - the status row counted POINTS and printed them under the HOUR's name: '2026-01-13 (96 h)' for a 24-hour day on the quarter-hourly feed this add-on already supports. It is now '96 points over 24 h' - two facts, each under its own unit. LOW - two stated reasons were false. `_audit`'s "WHY IT IS STRICTER" claimed the rework refused the same published point emitted twice and a carried point sharing a published hour, "which the old count never looked at". A differential over the whole domain the audit can express finds ZERO divergence in both directions: the old `seen` count already refused the first (one point twice is one hour twice) and the old IDENTITY rule already refused the second. The reworked audit is EQUAL to FCST-03's, not stronger; the only behavioural change is the intended relaxation, and it stays. The differential is committed as a check rather than left as prose. ...and the audit's real limit is named: it does not check COMPLETENESS. Fed the decimation defect FCST-04 was raised for it ACCEPTS, and it accepts an empty output. So `_audit` is not what stops that recurring - the count and identity checks are, and the text now points at them. Not made complete: `published` is the whole read while the fill emits only [since, until), so the rule as stated is wrong, and building it takes the 1/12/48 h horizon checks red on a healthy feed. Measured, not assumed. 12 mutations, purged tree, every one RED, no survivors. All 29 test files green. Nothing deployed; no option added; config.yaml untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-10 01:04:30 +02:00
glenn schrooyenandClaude Opus 5	b59f5ce31b	FCST-04: the carry-forward stops decimating a quarter-hourly feed, and a broken cache stops stopping the add-on ... Rework of the FCST-04 branch against review. Every finding below was proven by a runnable script before it was touched and re-run after; every check added or repaired was driven red by a mutation, `__pycache__` purged first (MUTATION.md, TEST-15). 29/29 test files green. ⚠️ H1 - A SUB-HOURLY FEED WAS DECIMATED TO ONE POINT AN HOUR, AND THE SPREAD WENT WITH IT. `fill_from_yesterday()` keyed the published set as `{_utc_hour(p.start): p for p in r.points}` - LAST POINT OF THE HOUR WINS, the other three dropped. `eneco_eddy` is the Belgian imbalance product and settles per QUARTER, and `_validate_raw()` accepts any strictly-increasing spacing, so this is a shape the product supports today. Measured on a 96-point quarter-hourly feed - ALL FIRM, FULLY PUBLISHED, nothing to carry: the plan reached the optimiser as 15 points, the arbitrage spread fell from 0.143 to 0.014 EUR/kWh, and the cheapest "hour" became a `:45` point whose `at()` window runs into the next one. Not the windowing effect this card is about; a feed losing 84 % of its own prints, with no flag anywhere reporting it. The fill now decides only WHICH WHOLE HOURS NEED CARRYING: every published point inside the window passes through BY IDENTITY, and a carried point is added only for a whole hour with no published coverage at all. Same feed, same fixture: 60 of 60 firm points kept, spread 0.134 over the hours still ahead. ⚠️ AND `_audit()` GOT STRICTER, NOT LOOSER - that was the condition on doing it at all. The old post-condition refused any repeated `_utc_hour`, a count that cannot express four points in one hour. Two rules replace it and SUBSUME it: a published point must BE one of that hour's published points by identity and may be emitted only once; a carried point may stand only in an hour absent from the published set, must be flagged True, and may not repeat. So the duplicated carried hour it existed to catch still raises, the same published point emitted twice now raises, and a carried point sharing an hour with a real print now raises too - which the count never looked at. Three mutations, three reds. ⚠️ H2 - A DAY RECORD THAT WAS NOT A RECORD STOPPED THE ADD-ON FROM STARTING. `_load()` validated `version` and that `days` is a dict, never that each VALUE is one. `{"version": 1, "days": {"2026-01-14": "oops"}}` loaded as ok=True, last_error=None, and then `rec.get(...)` raised AttributeError out of `words`, `yesterday()` and `resolve_tariff()` alike. `PriceHistory(...)` and `.words` are both unguarded in `Controller.__init__`, so the controller did not come up - and it never self-healed, because `_remember()` raised on the same record before it could reach `_save()`. That falsifies the CHANGELOG's "A BROKEN CACHE IS NOT A BROKEN CONTROLLER" in the one direction that matters. The asymmetry that produced it is visible in the file: `_parse_points()` is carefully defensive about every field of a POINT and `_load()` was not defensive about the record holding them. Unusable records are now dropped and REPORTED (`words` says how many and why), and `words` is total by construction as a second line. M3 - `yesterday()` WAS OFF BY ONE DAY FOR 00:00-00:59 AFTER SPRING-FORWARD. `brussels()` renders at the FIXED offset for that instant, so `brussels(stamp) - timedelta(days=1)` subtracts 24 ABSOLUTE hours - and the Brussels day before the March transition is 23 hours long. At 2026-03-30T00:30+02:00 it returned 2026-03-28's prices as "yesterday", or `no_data` naming a date that is not yesterday. The arithmetic is now on the local DATE, which has no offset to lose, and both transitions have a check - the module's headline claim had none. M4 - WITH NO /data THE STORE STILL FILLED, IN MEMORY. `_save()` short-circuited on `not ok` while `_remember()` populated `self._days` anyway: `words` said "unavailable" and `yesterday()` answered A SERIES that is gone on the next restart. The module docstring rejects exactly that ("a yesterday that silently forgets") as its reason for not calling makedirs, so the code now matches the docstring rather than contradicting it. M5 - THE PRUNE MUTATION SURVIVED BECAUSE THE STIMULUS WAS DEGENERATE. §8's clock-jump check seeded ONE day, so `if len(self._days) <= KEEP_DAYS: return` fired and the body it is named after never ran: pruning by arithmetic against the clock - which empties the store on exactly the morning the fill is for - passed the whole 29-file suite. The fixture is now written to a file and reopened (`_load()` does not prune, which is how a store legitimately holds more than the cap) with KEEP_DAYS + 2 days, and the mutant is red. M6 - THE AST ORDERING CHECK COULD NOT CATCH A REVERSAL, AND TWO DOCUMENTS CITED IT AS A GUARANTEE. `_calls.index("_remember") < _calls.index("yesterday")` grades `ast.walk` BFS DEPTH: `self._remember(...)` is a statement and `self.yesterday(...)` is an ARGUMENT of the fill, one level deeper, so `_remember` came out first whichever statement was written first - shipped and reversed both scored True. It is now line numbers AND, the half that matters, the behaviour: a feed carrying yesterday alongside today into an EMPTY store must fill the whole horizon; reversed, the lookup finds nothing and the plan is only the published hours. Reversing the two statements is red on both. L14/L9 - KEEP_DAYS = 3 IS THE STEADY STATE EXACTLY, so a newest-N cap has no slack: a feed publishing to D+2, or ONE stray point in the wrong year - which sorts LAST and can never age out - pushes yesterday out for good. `_prune()` now PINS the two days a lookup can actually ask for on top of the cap. Pinning is additive, so it can only RETAIN and the WITNESS-03 property (nothing is deleted by clock arithmetic) is preserved by construction; `stamp` stops being a dead parameter; the store is bounded at KEEP_DAYS + 2. L8 - the horizon end was not floored while `since` was, so a 48 h request made at any instant off the hour returned 49 points. §1's count was green only because its NOW was exactly :00:00, a shape production never has; the fixture now sits at :17:43. L10 - a failed `_save()` leaked its temp file; at 48 writes a day a persistent write failure leaked 48 inodes a day onto the volume that was already the problem. L15 - `{"version": 1.0}` passed, since `1.0 == 1`. L16 - the `_remember` tree walk scanned `app/*.py` only and matched a bare string; it now parses `app/`, `tools/`, `scenarios/` and `estop/` and looks for the NAME, so a comment does not fail it and a call in `tools/` cannot pass unseen. CLAIM-ACCURACY DEFECTS, WHICH THIS REPO TREATS AS REAL: * L7. DOCS said "*Tariff* on the status page reads `provisional` through the morning". FALSE - `tariff_words` is assigned only from the HA price-entity branch and from `static_status()`, both on the 30 s tick, and the plan's own sentence reaches `_LOG.info`. The doc now says what an operator can see (the Price history row, the Arbitrage row's own refusal sentence, the refresh log line) and a check pins the PAIRING - wiring the plan into the row is fine, correcting the doc is fine, doing one without the other is red. * L11. "fills EVERY unpublished hour" is conditional: a partial yesterday leaves the local hours it never held out of the series (§11.4 for those hours, and `at()` raises rather than answering). Correct behaviour, overclaimed wording, and untested - all three fixed. * L12. DECISIONS §1 leaned on `TariffPlan.cheap_now()`, which has NO PRODUCTION CALLER on the provider plan (`self.cheap` comes from `static_status()`, which builds its own). The conclusion holds on `arbitrage()`'s firm-pair refusal alone, which does reach control; the evidence is now stated at the reach it has. * L13. §1's "passed through by identity" check compared `eur_per_kwh` between two SEPARATE `resolve_tariff()` calls, where `is` could never have held. The value comparison is kept and now says what it grades; identity is graded on a read the file constructs and still holds. * L17. `PriceHistory.words` and the new status row had no check at all - and `words` is one of the two things H2 crashed. Both now have one. * L18. main.py's inline note carried the "widens what the optimiser can SEE, never what it may act on" guarantee without the windowing caveat that the CHANGELOG, DOCS and `resolve_tariff()`'s docstring all carry. It is the one place a maintainer reads it unqualified. EVIDENCE. All eight reviewer proofs re-run: p1/p1b return 29 March, p4 keeps 60 of 60 firm points at spread 0.134, p5 starts and reports, p6 D leaves no temp, p6 E refuses 1.0, p6 F records nothing, p7 returns 48 for 48. p2's script still scores True/True because it re-implements the OLD algorithm - the reversal is now driven as a mutation instead, and is red. p3's script always showed the shipped code correct; what was wrong was the fixture, and its mutant is now red. Twenty mutations driven, no survivors, tree fingerprinted and `__pycache__` purged before each: decimation (2 suites red), audit x3, unfloored `until` (2), unvalidated day records (7 checks), instant-subtraction yesterday, in-memory fill on a volume-less store, clock-arithmetic prune, cap without the pin, leaked temp, loose schema type, empty `words` (5), reversed `carry()` (2), a `_remember` leak in tools/ spelled two ways, a neighbour-filling fallback, a copy instead of identity (2), the DOCS claim in both directions, and the caveat removed from main.py. Baseline and the unmutated tree both green. No option added, config.yaml untouched, and the CHANGELOG entry still picks no version: PKG-07's rule, and only the deployer knows whether 0.9.0's image has been pulled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-09 23:54:23 +02:00
glenn schrooyenandClaude Opus 5	0618194d9c	FCST-04: the carry-forward fill reaches the plan, and the day it carries survives a restart ... FCST-03 shipped `fill_from_yesterday()` complete and checked, and shipped the consumers written for it - `TariffPlan.firm_points()`, `cheap_now()`'s refusal of a provisional hour, and `arbitrage()`'s refusal 3, which drops provisional hours from the trade set rather than refusing the whole series. It shipped NO CALLER. Nothing in `app/` named the fill, so no series ever contained a carried point and every one of those consumers was exercising its all-firm branch. ⚠️ THE DEFECT THAT PRODUCED WAS NOT AN ERROR ANYWHERE. `load_prices()` returns what the feed published and nothing widened it to the requested horizon, so on a dynamic site between midnight and the 14-16 h CET publication the plan covered the rest of today and nothing more - measured on the fixture here, 24 h against a 48 h request. `arbitrage()` then took `max - min` over that truncated window and reported a spread. The number was real, the window was half the one configured, and nothing said so: tomorrow evening's peak, the hour a morning charge would be sold into, was not in the series to be compared against anything. A missing hour is not a wrong price - it is an hour the optimiser never learns exists. WHAT THIS ADDS. `app/price_history.py` keeps the PUBLISHED prices of the last KEEP_DAYS Brussels days in /data/price_history.json; `resolve_tariff()` gains a required keyword-only `history` and fills every unpublished hour of the horizon from yesterday's same-wall-clock hour, flagged. Persistence rather than a variable on the refresh task, because the window the fill exists for is midnight -> publication and an add-on restarted at 08:00 would otherwise spend all of it on the truncated series. Not in state.json: the refresh runs every 1800 s and that file holds the maintenance history and SAFETY-02's latch. ⚠️ ONE CHANGE HERE MOVES ENERGY, AND IT IS NOT THE ONE THE CARD IS NAMED FOR. Carried hours are provisional, so §8.3 keeps them out of the trade set: the fill widens what the optimiser can SEE, never what it may DO, and test_price_history.py checks that so it cannot be overclaimed later. What does change a trade is that the filled series is windowed to [since, until), so hours that have ALREADY ELAPSED are no longer in the spread. Before, a cheap night that had gone sat in the series as the day's cheapest hour - and a cycle cannot buy in an hour that is past, so the trade was quietly never taken. Section 2 grades this by finding the cheapest firm hour with and without the fill and showing it MOVES, from 02:00 UTC to 08:00 UTC on the fixture. ⚠️ A DEAD FEED IS STILL §11.4, NOT YESTERDAY. The fill runs only on a `series` read. The two are indistinguishable to the optimiser - both 100 % provisional, so arbitrage refuses on the firm-pair rung and `cheap_now()` is False - so preferring yesterday's feed over the `static_profile` an operator configured FOR that case would change a documented degradation for a difference only the status page can see. That, and two more, in DECISIONS/FCST-04-the-day-that-is-carried.md. ⚠️ THE ANTI-DECAY RULE IS AN ORDERING, NOT A VALIDATION, and saying so is more useful than a guarantee that would not hold. Feeding the filled series back in is how this rots - day 2 carries day 1's guesses, day 3 carries day 2's carry of them, behind a `provisional` flag that stays TRUE while the NUMBER decays. No value-level check can catch it: a carried point and `eneco_eddy`'s published-provisional quarter are the same three fields with the same flag. So `carry()` is the only public entry, it records BEFORE it fills, the filled series exists only as a return value the object never sees again, and test_price_history.py walks app/ for any other module naming `_remember` and reads `carry()`'s AST to pin the order. EVIDENCE. 29/29 test files pass in the CI image. Eight mutations driven against app/price_history.py and app/static_tariff.py, __pycache__ purged before each run per MUTATION.md/TEST-15: newest-record lookup (5 red), recording the filled series (1), replace-instead-of-merge (10), UTC-date keying (10), removing the fill call entirely (12), a lost price field defaulting to 0.0 (2), prune by clock arithmetic (1), a degraded reason that stops naming its cause (1). No survivors; baseline and revert both green. Three of those first crashed the harness instead of reporting a FAIL - "it was refused" and "it broke on the way to being refused" must not grade the same - so `why()` and `_priced()` were added and the run repeated. No option added, config.yaml untouched, and the CHANGELOG entry deliberately picks no version: PKG-07's rule, and only the deployer knows whether 0.9.0's image has been pulled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU	2026-09-09 19:37:45 +02:00