SAFETY-112 review: grade the waiting flag where hass.py sets it

- a 502 or refused read turns waiting on, the next good read off, and a read timeout never (two mutants survived without this) - the flag changes no write with live readings, not only with 502 ones - the page script's amber dot and batteries-tab banner for "waiting" - DECISIONS: about 5 minutes per start stage, not "at most" Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SAFETY-112: say plainly that control waits for Home Assistant to start
2026-10-13 02:10:27 +02:00 · 2026-10-13 01:07:51 +02:00 · 2026-10-11 05:49:37 +02:00 · 2026-10-11 05:12:35 +02:00 · 2026-10-11 02:55:58 +02:00 · 2026-10-11 00:58:29 +02:00
29 changed files with 2374 additions and 96 deletions
@@ -1,5 +1,49 @@
 # Changelog

+## 0.17.0
+
+**A minor bump: changed behaviour, and no option changes.** No option was
+added, removed or renamed, and no default changed (83 options). Options you
+saved work as before. The changes below apply with one inverter or two, unless
+a line says "Two inverters".
+
+**Maintenance with no battery level.** When the battery level is missing,
+battery maintenance now ends on its own time limits instead of waiting for the
+level to come back (MAINT-14, MAINT-15). You do not need to change any option.
+
+Contents of this release, in merge order since 0.16.0 (`451729c`):
+
+| | |
+|---|---|
+| `b527e99` | Two inverters: after a drain ends, the other battery no longer swings on old readings. In the test, it held steady for 23 s where 0.16.0 moved it by 720 W ([[SAFETY-103]]) |
+| `8a17711` | A full battery that stops at 98 or 99 % no longer counts as a failed charge. After 60 min with no new high, the charge counts as done; a charge that truly fails now waits 7 days and shows one notice ([[MAINT-13]]) |
+| `bf3ac79` | With no battery level, a maintenance charge still ends at its time limit and a drain waits at 0 W. The log no longer repeats a line every second ([[MAINT-14]]) |
+| `db9e231` | One inverter: when maintenance charges a battery that is already full, the log no longer repeats "The battery refuses to give power" every second. In the test, 1 line in 16 min where the code before this fix wrote about 1,700 in 15 min; the power does not change ([[SAFETY-107]]) |
+| `580c200` | The balancing hold after a charge now ends on time when the battery level is missing. Before, it waited until the level came back ([[MAINT-15]]) |
+
+### Known issues
+
+- A false "Battery is not keeping up" can still show when the peak guard pauses a maintenance charge ([[SAFETY-92]]).
+- A battery capped at a low limit with a perfectly flat reading can still trip the stale check ([[SAFETY-74]]).
+- A battery whose reading at rest is beyond about ±175 W is still not caught when it refuses ([[SAFETY-97]]).
+- The peak guard can still back off near the end of a 15-minute period when a meter reading is late, by less than 30 s ([[SAFETY-99]]).
+- Two inverters: the maintenance charge can switch on and off while the house is above the peak aim ([[SAFETY-88]]).
+- Two inverters: the "circulating" figure counts a battery's reading at rest ([[SAFETY-98]]).
+- Two inverters: a drain that starts during a big step in house use can send the other battery to full power, and about 1 kW goes to the grid for about 10 s ([[SAFETY-104]]).
+- Two inverters: when a battery comes back during a maintenance charge, the grid can step by several kW at once ([[SAFETY-101]]).
+- Two inverters: when a battery drops out during a solar surplus, the others can swing by up to 1.5 kW in a simulation ([[SAFETY-105]]).
+- Two inverters: after a drain ends, a change in house use can go unanswered for about 9 s, because some readings are old ([[SAFETY-106]]).
+- Two inverters: when one battery's level is missing, both batteries are held at 0 W, and for about 15 s the last command stays on ([[SAFETY-108]]).
+- Two inverters: if one battery's level stays missing for 12 h, the other battery's cycle can be marked failed, with a 7-day wait and a notice, though it is healthy. This comes from reading the code; it has not been seen on a site ([[MAINT-17]]).
+- One inverter: after a link drop, the battery's own safety stop to 0 W can be taken as a refusal, and the site stays at 0 W for up to 15 min ([[SAFETY-102]]).
+
+### If you are crossing from a version older than 0.10.0
+
+`## 0.10.0` below can refuse an old config: `slew_w` above its limit, and the
+withdrawn `price_provider` ids `engie_dynamic`, `totalenergies_dynamic` and
+`eneco_eddy`. Read it before you update. Run `tools/predeploy_check.py` with the
+bare options (`jq '.data.options'`) first.
+
 ## 0.16.0

 **A minor bump: changed behaviour, no option added or removed, and one default
@@ -58,10 +58,7 @@ allows discharge.

 ## What this does not cover

- **HOLD with no SoC** still holds 0 W and, as before, does not end while the
-  reading is missing: its time check sits behind the same early return. A HOLD
-  needs no level to end, so this is a candidate follow-up, not part of this fix. It is card MAINT-15. The "no battery level" line in
-  HOLD says only that the hold waits for the level.
+- **HOLD with no SoC**: closed by MAINT-15 (`MAINT-15-hold-ends-without-soc.md`).
 - It does not tell the operator why the reading is missing (sensor, register,
  link). It does not reuse the stale-input gate; it is the cycle's own rule.
 - The charge itself is still driven by the control loop, which has its own
@@ -0,0 +1,47 @@
+# MAINT-15 - the balancing hold ends on time with no SoC reading
+
+**Status: for review.** Tests: `test_maint15.py`. No option added.
+
+**The fault.** `step()` sent every tick with no SoC to `_no_soc()`, and for
+HOLD that returned 0 W without the time check. A hold that lost its reading
+never ended: `last_completed` was never written and the next due date never
+moved. Harmless for power (0 W), but the cycle was stuck. This was left open
+in MAINT-14.
+
+## Rule
+
+1. **HOLD ends at `hold_min` whether or not there is a reading.** One helper,
+   `Maintenance._hold()`, holds the time check and is used by both paths. When
+   the time is up it writes `last_completed`, goes IDLE and logs the same
+   "cycle COMPLETE" line. Before the time is up it commands 0 W as before.
+2. **Text.** The 15-min "no battery level" line in HOLD now reads "The hold
+   still ends at its normal time." Still once per episode.
+
+## Why
+
+HOLD is reached only after the charge counted as done. Every entry into HOLD
+is in `step()` or `_no_soc()` and follows a charge that reached the target,
+stalled near full (MAINT-13) or timed out near full (MAINT-13/14). Nothing else
+sets the phase to HOLD (`_enter(HOLD` has four call sites, all after a done
+charge). The hold is a wait for the BMS to balance; it never needed the level.
+So a hold that ends with no reading is a completed cycle. The "cycle COMPLETE"
+line is true without a reading: it names minutes of hold, not a level.
+
+## Cost
+
+- If the level was lost during the hold, the cycle is recorded as complete
+  without anyone seeing the final level. The charge had counted as done, so this
+  is the same trust MAINT-14 already gives a charge that ends with no reading.
+
+## What this does not cover
+
+- It does not check that the pack is still full at the end of the hold.
+- It does not say why the reading was lost.
+- With a reading, nothing changes. `test_maint15.py` section 7 compares the new
+  HOLD tick by tick with a frozen copy of the release/1.0 HOLD branch (phase,
+  setpoint, owner, events, `last_completed`) at four `hold_min` values. A wider
+  trace of the whole cycle (800 seeded runs against db9e231) was run outside the
+  repo; its script and log are kept under `scratch/MAINT-15/` of the dev
+  workspace, not in this repository.
+- A state file written by an older version with `phase: hold` loads and ends on
+  time; the file is not changed in format.
@@ -0,0 +1,79 @@
+# OPT-17 - the solar forecast from several entities, summed
+
+**Status: for review.** Tests: `test_opt17.py`. Two options added.
+
+A site whose forecast comes as several Home Assistant sensors (one per
+inverter or roof side) had to build a template sensor to sum them. Now each
+day can list them.
+
+## Options
+
+- `pv_forecast_entities` and `pv_forecast_tomorrow_entities`: lists of
+  sensors, default `[]`, the same shape as `pv_entities`.
+- `pv_forecast_entity` and `pv_forecast_tomorrow_entity` are unchanged. An
+  install that uses them needs no edit.
+- **Why new keys, not "string or list" in the old ones.** Measured on
+  Supervisor 2026.08.0 by `tools/supervisor_shape_probe.py` §J, as TEL-12's
+  §G did for `pv_entity`. Declared as a list, each forecast key refuses the
+  string an install already stores (`Invalid list for option
+  'pv_forecast_entity'`), and a `[]` default does not rescue it. The one
+  spelling that takes both, `match(.*)?`, also takes the integer 417 and
+  shows a plain text box, so a second sensor cannot be added in the UI.
+- §J also shows: a 0.17.0 blob validates unchanged with the lists at `[]`;
+  the lists render as repeatable fields; a downgrade drops them and keeps
+  the single keys.
+- `[]` in `options:` is load-bearing, as for `pv_entities`.
+
+## Rules
+
+1. **One key per day.** Setting the single key and the list for the same day
+   is refused at start, with one message: keep the list, clear the single one.
+   The list can hold that entity too. (TEL-12 lets `pv_entities` replace
+   `pv_entity` with a caution row. Here the brief asked for a refusal: a
+   doubled or dropped forecast changes what a battery buys, and no install
+   has both keys yet, so the refusal breaks nothing.)
+2. **Each member in its own unit.** Every member is read as one forecast
+   sensor is today (`solarfc._day()`): Wh, kWh or MWh, never guessed. Then the
+   day's kWh are added up. A repeated id counts once.
+3. **One member not usable means the day is not usable.** Missing,
+   unavailable, unknown, stale, not an energy unit, or a bad number: that
+   day's sum is not used, exactly as when the single sensor reads that way.
+   No today means no forecast (P3 option A). No tomorrow means today only.
+4. **Hourly split.** If every member has a split, the splits are joined
+   (overlapping periods add up). If any member has none, the sum is spread
+   over the bell, as for a state-only sensor.
+5. **Time.** The forecast is as old as its oldest member.
+6. **One read.** All members of both days are read in one gather, inside the
+   gather that reads the inverters, so a slow sensor does not delay control.
+7. **Shown and logged once.** With two or more members, each one not usable
+   is named on the status page by its place in the list (STYLE.md: no entity
+   ids on the page), as a caution row titled "Solar forecast" on Home. The
+   action log names the entity id, once when the set of failing members
+   changes.
+8. **One member is the single key.** A one-member list reads, plans, shows
+   and logs exactly as the single key with that entity.
+
+## Why
+
+- A partial sum is a smaller number that looks real. Two of three inverters'
+  forecasts read as a duller day, and Leftover solar would then buy grid
+  energy the sun was going to give. TEL-12 took the same rule for the same
+  reason. No forecast is a known state with a tested fallback.
+- The bell for a mixed list: joining one member's hours with another's total
+  has no honest shape, and the bell is the existing state-only rule.
+
+## Cost
+
+- One flaky member costs the whole day's forecast. A site with three
+  sensors loses the plan more often than one with a template sum that hides
+  gaps.
+- Two more options (85).
+
+## What this does not cover
+
+- No weighting or calibration per member; FCST-01 is still the own forecast.
+- Members on different integrations with different refresh times: each must
+  be fresh (3 h) on its own; there is no wait for a lagging one.
+- The day plan itself, the trust and the house profile are unchanged.
+- The Batteries screen still says only "no solar forecast now". The member
+  is named on the status page.
@@ -0,0 +1,96 @@
+# SAFETY-107 - a refusal held under another writer is learned once
+
+**Status: for review.** Tests: `test_safety107.py`. One inverter only; nothing
+changes at N>1 (SAFETY-73's unit refusal has no "another writer" end).
+
+**The defect** (MAINT-13 F5, MAINT-14 "seen again"). A full pack under a
+maintenance charge in a cheap window takes no charge. At N=1 the action log then
+showed "BATTERY REFUSES asked -2500 W ..." and "BATTERY REFUSES ENDED: another
+writer" every cycle: 548 + 548 lines in 15 min on the MAINT-13 rig head,
+652 + 651 in 12 min on its base, 33 + 32 in 60 s in MAINT-14's c2b. The 40-line
+log flooded and the hint under the buttons changed every second, so the
+MAINT-13 notice was gone at once.
+
+**Cause** (`main.py`, the SAFETY-52 block before `compute()`). The end tested
+`self.target != self.loop_w`: the wire differs from the loop's ask. A held
+refusal makes the loop ask 0 W, so any claim that binds (the maintenance
+charge's `hi`, the peak guard's `lo`, a trade's SET) differs from it on every
+cycle. The refusal was ended against the same writer it had been learned
+against. `sat_count` is not reset by that end, so `compute()` learned the same
+refusal again in the same cycle. Nothing about the battery or the wire had
+changed; only the log and the hint did.
+
+**Other writers.** The same flap comes from any writer that holds the wire
+while the loop is refused, as long as the evidence lasts: a trade (a SET at
+P_ARBITRAGE) into a full pack, and the peak guard over an empty pack: 335
+refusal lines in 15 min each at a 5 s meter (`test_safety107.py` part 2, run on
+release/1.0).
+A maintenance drain or hold does not flap: its SET resets `sat_count` each cycle.
+
+**The rule** (`_refusal_update()`, `rejudged`). When another writer held the
+wire, the held refusal is judged afresh: `compute()` gets `refused=0` and no
+probe, exactly as before the change. Then:
+
+1. it finds the same refusal against that writer's ask: the same episode
+   continues, with no line and no hint. The probe clock restarts, as it did on
+   the old end and start: a probe is the loop's ask, and it is not on the wire
+   while another writer is;
+2. it does not: the refusal ends, logged "another writer", or "the battery
+   gives power" when the reading shows it (it was "another writer" before);
+3. it finds the other direction: end, then a new start, as before. In
+   practice 2 comes first: SAFETY-94's evidence restarts when the ask changes
+   sign, so a writer that turns round ends the refusal at once and the other
+   way is learned ~12 cycles later (`test_safety107.py` part 3e).
+
+**Why this rule.** The end now means what SAFETY-52 meant by it: the refusal no
+longer describes what is on the wire, judged by the same test that learns it.
+`compute()` sees the same inputs as before and the state after each cycle is
+the same (`batt_refused`, `batt_refused_at`), so every command is unchanged.
+Keeping the held refusal into `compute()` instead (mutation M5) would also
+stop the lines, but it holds the loop at 0 W where the old law let it ask past
+a writer's limit, which changes commands; it also removes SAFETY-52's
+owner-decided "another writer" exit.
+
+**Evidence.**
+- Differential trace (`goodwe/scratch/SAFETY-107/probe/trace.py`, not in this
+  repo; the real Controller in the CI image, release/1.0 bf3ac79 against this
+  tree): 300 seeds, N=1 (153) and
+  N=2 (147), 1/2/5 s meter, full/empty/dead/healthy battery windows, a stepping
+  house, maintenance charge with the cheap window opening and closing, P1 and
+  the peak guard, trade windows, stop/start; 427 680 cycles, 294 seeds with a
+  refusal held. Every command, site target, integrator, `sat_count`, refusal
+  state and reason is identical. Refusal lines: 100 748 before, 2 188 after.
+- The card's case: 1 line in 15 min at N=1 and N=2, 1/2/5 s meter, house
+  importing or exporting (release/1.0: 335-1 753 at N=1; N=2 was already 1).
+
+**Mutations** (`tools/mutation_run.sh` on purged copies; reds in
+test_safety107 / test_refusal / test_refusal_units; trace = seeds of 300 whose
+commands differ from release/1.0):
+
+| | mutation | reds | trace |
+|---|---|---|---|
+| M1 | `now == rejudged` -> `False` (every such cycle ends: the old flap) | 26 / 0 / 0 | 0 |
+| M2 | `rejudged` always 0 (another writer never ends it) | 5 / 1 / 2 | 29 |
+| M3 | the probe clock is not restarted on a continued episode | 1 / 0 / 0 | 2 |
+| M4 | a probe may open while rejudged | 0 / 0 / 0 | 0 |
+| M5 | the held refusal goes into `compute()` while rejudged | 2 / 1 / 2 | 27 |
+| M6 | an end while rejudged always says "another writer" | 1 / 0 / 0 | 0 |
+
+M4 is equivalent: a probe matters only if `compute()` engages in that call,
+which needs `SETTLE_CYCLES` saturated against the writer, and each of those
+cycles restarted the clock. The line stays because it states the rule.
+
+**Cost.** None in power. A takeover by a different writer while the battery
+still refuses is logged as an end and, ~12 cycles later, a new start against
+that writer (3 lines for the episode, `test_safety107.py` part 3a).
+
+**Not covered.**
+- A perfectly flat reading under a writer. The stale-reading gate trips, stops
+  the site and seeds the refusal (SAFETY-52 decision 3). After the stop the
+  writer's ask returns fresh, `compute()` has no saturation history against it,
+  so the refusal ends at the first cycle and the next trip seeds it again: 2
+  lines per gate cycle (29 in 15 min, house exporting), the same as release/1.0.
+  The gate cycle itself (0 W, then the writer's ask) is the cause; stopping it
+  changes commands. None of the rig runs showed it: real readings move.
+- At N=1 a refusal shapes only the loop. A writer above it still asks the
+  battery; at N>1 SAFETY-73's P_SAFETY claim binds every writer.
@@ -0,0 +1,98 @@
+# SAFETY-112 - control waits for Home Assistant to finish starting
+
+**Status: for review.** Tests: `test_safety112.py`, `test_messages.py`.
+Control is unchanged. The add-on now says plainly that it is waiting.
+
+## Cause
+
+The Supervisor's proxy refuses every add-on request with 502 until Core's
+state is `RUNNING`. The add-on reads every battery reading and writes every
+power request through that proxy, so it cannot control until then. Readings
+that are already live inside Home Assistant do not help.
+
+Source, Supervisor 2026.08.0 (the image the live site ran at CFG-04):
+
+- `supervisor/api/proxy.py`, `APIProxy.api()` (REST, used for reads and
+  `number.set_value`) and `APIProxy.websocket()` both start with
+  `if not await self.sys_homeassistant.api.check_api_state(): raise HTTPBadGateway`.
+- `supervisor/homeassistant/api.py`, `check_api_state()` returns
+  `state.core_state == "RUNNING" or state.offline_db_migration`. The state
+  comes from Core's `/api/core/state`.
+- Upstream `main` has the same gate in both handlers (read 2026-10-13).
+- A Core restart restarts only the Core container
+  (`homeassistant/core.py`, `restart()`). The add-on keeps running.
+
+The add-on itself has no wait. Nothing in `app/` reads Core's state or waits
+for an event. The loop reads its inputs every second, a 502 gives `None`,
+and missing inputs give 0 W. P1 backoff is not involved: the live site reads
+the meter straight from the HomeWizard (`homewizard_local`), not through Home
+Assistant.
+
+## Measured
+
+Repro stack `safety112-*`, all removed afterwards:
+
+- Home Assistant 2026.9.4, as live.
+- A test integration whose `async_setup` sleeps, so Core stays `NOT_RUNNING`.
+- A fake meter and two fake inverters that update every 2 s from load.
+- The Supervisor's own `APIProxy` and `HomeAssistantAPI` from the 2026.08.0
+  image. Only the add-on token lookup, Core's access token and the container
+  check are stubbed.
+- The add-on on `meter_source: homewizard_local` against a fake HomeWizard.
+
+Times are seconds after `docker restart` of Home Assistant:
+
+| run | Core `NOT_RUNNING` | entities live in HA | Core `RUNNING` | proxy 502 | first write | wait from live readings |
+|---|---|---|---|---|---|---|
+| base 3050fa5, N=2 | 13.1 | 17.1 | 253.1 | 0.9-252.7 (1 132 requests) | 254.7 | 237.6 |
+| base 3050fa5, N=1 | 13.1 | 18.1 | 256.1 | 1.5-255.1 (573 requests) | 257.2 | 239.1 |
+| this change, N=2 | 12.2 | 17.2 | 313.2 | 1.4-312.5 (1 406 requests) | 317.6 | 300.4 |
+| this change, N=1 | 12.2 | 17.2 | 255.2 | 1.2-254.1 (571 requests) | 257.1 | 240.0 |
+
+The first write comes 1.0-4.4 s after `RUNNING`, so the whole wait is the
+proxy's. With a 400 s sleep Core moved on at 300.88 s on its own (bootstrap's
+stage timeout), so one slow integration holds a start stage for about 5
+minutes. The whole start can take longer: the live one took 414 s.
+
+Before this change the page said "Not ready — Battery level: no usable
+reading", which sends the reader to Developer Tools for an entity that is
+fine.
+
+## Rule
+
+1. No way around the Supervisor. The add-on still talks to Home Assistant
+   only through the proxy.
+2. While the proxy does not answer on the API (`hass.OUTAGE.waiting()`), the
+   first status row is red: "Home Assistant is not answering, perhaps it is
+   still starting. Control resumes by itself when it answers." The banner
+   reads "Not ready — Waiting for Home Assistant to finish starting". The Home
+   pill reads "Waiting for Home Assistant", in English and Dutch.
+3. A safety stop, a stalled control loop or shadow mode keeps its own banner
+   and state over the wait, because none of them clears by itself.
+4. The log has one WARNING when Home Assistant stops answering, an INFO line
+   every 5 minutes while it is down, and an INFO line with the length of the
+   wait when it answers again.
+5. Only the API counts. The meter websocket alone does not, because the meter
+   has its own row.
+
+## Why it is safe
+
+The change is text only. `cycle()`, the writes, the heartbeat, the stand-down
+on shutdown and every watchdog are untouched. `test_safety112.py` part 3 shows
+the same targets and writes with the flag on and off, for N=1 and N=2.
+
+## Open, for the owner
+
+The add-on cannot control while Home Assistant starts. These ways around it
+were not taken:
+
+- **Talk to Core directly with a long-lived token** (`http://homeassistant:8123`).
+  Core's own API answers while `NOT_RUNNING`. In the repro `/api/core/state`
+  answered from 12-13 s, and a direct `number.set_value` 10 s into
+  `NOT_RUNNING` returned 200 and set the value. The cost is a secret stored
+  at every client site, which `hass.py` exists to avoid.
+- **Talk to the control board directly** (ESPHome native API), so control
+  does not need Home Assistant at all. This is a large change.
+- **Remove the slow start at the site.** On 2026-10-12 the Solis
+  integration's discovery held the start. Fixing or disabling it shortens the
+  wait there, but not on a client site with another slow integration.
@@ -186,6 +186,8 @@ The label and description each setting shows on the Configuration tab, in tab or
 | Hardware | Battery modes | `battery_modes_enabled` | Give each battery an on and off switch and a mode, set on the Batteries screen. |
 | Hardware | Solar forecast, today (kWh) | `pv_forecast_entity` | Optional. A forecast sensor with today's remaining solar energy, such as Forecast.Solar or Solcast. A battery then buys only what the sun will not give. |
 | Hardware | Solar forecast, tomorrow (kWh) | `pv_forecast_tomorrow_entity` | Optional. The same forecast for tomorrow. It helps plan a cheap hour before midnight. |
+| Hardware | Several solar forecasts, today (kWh) | `pv_forecast_entities` | Optional. One row per forecast sensor, such as one per inverter, used instead of the single one above. They are added up. |
+| Hardware | Several solar forecasts, tomorrow (kWh) | `pv_forecast_tomorrow_entities` | Optional. The same list for tomorrow. If one sensor has no reading, that day's forecast is not used. |
 | Hardware | Trust in the forecast (%) | `solar_trust_pct` | Forecasts are often too sunny. At 70 % the add-on plans with 7 of every 10 kWh forecast. |
 | Hardware | Solar production entity (W) | `pv_entity` | Optional. Your solar inverter's power sensor, positive while producing. The add-on records it and does not use it for control. |
 | Hardware | Solar production entities, per inverter (W) | `pv_entities` | Optional. Use one row per solar inverter instead of “Solar production entity” when you have several. If one stops reporting, no total is recorded. |
@@ -539,6 +541,9 @@ With battery modes on, these choices replace the *Charging and selling on price*
 - With no prices, or too small a gap, every battery follows the house.

 **Solar forecast** (`pv_forecast_entity`, optional). A Home Assistant sensor with the solar energy still to come today, in kWh. These work: Forecast.Solar (`sensor.energy_production_today_remaining`), Solcast PV Forecast (`sensor.solcast_pv_forecast_forecast_remaining_today`) and Open-Meteo Solar Forecast (`sensor.energy_production_today_remaining`). Set `pv_forecast_tomorrow_entity` to the matching *tomorrow* sensor to plan a cheap run before midnight.
+- **Several forecasts.** If your forecast comes as several sensors (one per inverter or roof side), list them in `pv_forecast_entities` and, for tomorrow, `pv_forecast_tomorrow_entities`, instead of the single key. They are added up, each in its own unit (Wh, kWh or MWh). Set the list or the single key for a day, not both.
+- If one of them has no reading, is stale or is not in an energy unit, that day's forecast is not used at all. A part of the sun is not counted as all of it. The status page names the source by its place in the list.
+- The hourly shape is kept only if every sensor has one. Otherwise the total is spread over the day as for Forecast.Solar.
 - Before each cheap run the add-on asks: will the sun fill the batteries before the expensive hours? It counts on `solar_trust_pct` of the forecast (70 %), less what the house uses. Solar first batteries get that sun first.
 - *Leftover solar* then charges from the grid only the shortfall: what the house will draw from it in the expensive hours, less its share of the sun. Not up to the top level.
 - *Cheap hours only* ignores the forecast and fills to the top level.
@@ -605,6 +610,10 @@ still moving towards the request, such as one turning from charging to
 giving (SAFETY-94). "Gives" is counted from what the battery's reading shows
 at rest, which the add-on learns after two quiet minutes and keeps: some
 inverters show about -100 W at rest (SAFETY-97).
+While another task sets the power, such as a maintenance charge, the peak
+guard or a trade, the refusal stays as long as the battery still refuses that
+task's request. It is logged once, and the 200 W test waits until control sets
+the power again (SAFETY-107).

 **With two or more inverters** the same rule works per inverter. An inverter
 whose battery gives less than 100 W for 12 cycles, and at least 22 s, while
@@ -618,7 +627,7 @@ If the battery refuses to give power while its level reads above its “Battery
 cut-out level”, the log adds one warning ending in `REFUSES_ABOVE_CUT_OUT`: check that setting.
 A battery that refuses is not reported as *not delivering*.

-*For installers:* SAFETY-52 and SAFETY-73. The event log reads
+*For installers:* SAFETY-52, SAFETY-73 and SAFETY-107. The event log reads
 `BATTERY REFUSES …` and `BATTERY REFUSES ENDED …` (with the inverter's name at
 N>1), and the INFO line ends in `BATTERY_REFUSES`.
 `DECISIONS/SAFETY-52-a-battery-that-refuses.md` has the replay figures and
@@ -3469,6 +3478,7 @@ for a new install*.

 | Row starts with | What it tells you |
 |---|---|
+| Home Assistant is not answering | Home Assistant is not passing readings or power requests on, usually because it is still starting. The add-on cannot control until then. It resumes by itself. Nothing to do unless it lasts. |
 | Control | When control last ran. Red when it has stopped running: the control board then sets the inverter to 0 W. |
 | Meter | The grid reading, its age, how many readings were refused, and how long its value has not changed. Just after a start it is amber and *waiting for the first reading*. Red means no reading for longer than the limit. |
 | Stuck-meter check | Whether the add-on can warn you about a stuck meter. |
@@ -3527,6 +3537,13 @@ reason code, and its full figures are on the DEBUG line right after it and in
  (TARIFF-11), in words.
 - **Solar production** reads `pv_entity` or `pv_entities` (TEL-11/12). The
  *Reversed-sign solar entities* setting is `pv_invert_entities` (TEL-14).
+- **Home Assistant is not answering** (SAFETY-112): the Supervisor answers
+  502 to every add-on read, write and websocket until Home Assistant is
+  RUNNING, even when its entities are already live. A slow integration at
+  start-up therefore holds control for as long as it holds Home Assistant's
+  start. The log has one WARNING, a "Still waiting" INFO line every 5
+  minutes and "answers again after …" at the end. See
+  `DECISIONS/SAFETY-112-waiting-for-home-assistant.md`.
 - **Shadow mode** (SAFETY-10): the banner turns red when a latch is up
  (circulating power, or a site or per-inverter sign trip), and that latch keeps
  its own red row.
@@ -11,6 +11,8 @@ import time

 import aiohttp

+from . import messages
+
 _LOG = logging.getLogger("goodwe.hass")

 CORE_API = "http://supervisor/core/api"
@@ -19,6 +21,7 @@ BAD_STATES = ("unknown", "unavailable", "none", "")
 # What the Supervisor's proxy answers while Home Assistant restarts.
 UNAVAILABLE = (502, 503, 504)
 STATES_TIMEOUT_S = 10       # UX-13's entity list, like every other read here
+STILL_WAITING_S = 300       # SAFETY-112: one reminder line per 5 minutes down


 class Outage:
@@ -29,15 +32,30 @@ class Outage:
    ("502, message='Bad Gateway', url=URL(...)", "Received message 8:1000 is
    not str"). Now the first channel to fail says it once at WARNING, the raw
    text goes to DEBUG, and the last channel to recover says so at INFO.
+
+    SAFETY-112: the Supervisor answers 502 for every read, write and
+    websocket until Home Assistant has finished starting, however live its
+    entities already are (DECISIONS/SAFETY-112-waiting-for-home-assistant.md).
+    So an outage also says, every STILL_WAITING_S, that it is still on, and
+    `waiting()` puts it on the status page.
    """

    def __init__(self):
        self.down_on = set()
+        self.since = None           # monotonic start of this outage
+        self._told = None           # when the last "still waiting" line went

    def down(self, channel: str, what: str, detail) -> None:
+        now = time.monotonic()
        if not self.down_on:
            _LOG.warning("Home Assistant is not answering (%s), perhaps it is "
-                         "restarting. The add-on keeps trying.", what)
+                         "still starting. Control waits and resumes by itself.",
+                         what)
+            self.since = self._told = now
+        elif now - self._told >= STILL_WAITING_S:
+            self._told = now
+            _LOG.info("Still waiting for Home Assistant to finish starting, "
+                      "%s so far.", messages.duration(now - self.since))
        self.down_on.add(channel)
        _LOG.debug("Home Assistant not answering on %s: %s", channel, detail)

@@ -45,7 +63,13 @@ class Outage:
        if channel in self.down_on:
            self.down_on.discard(channel)
            if not self.down_on:
-                _LOG.info("Home Assistant answers again.")
+                _LOG.info("Home Assistant answers again after %s.",
+                          messages.duration(time.monotonic() - self.since))
+
+    def waiting(self) -> bool:
+        """True while Home Assistant's API does not answer. The API, not the
+        meter websocket: every battery reading and every write rides on it."""
+        return "api" in self.down_on


 OUTAGE = Outage()
@@ -909,13 +909,14 @@ def month_peak(c, now):
    return out


-def state_of(c, level, shadow):
+def state_of(c, level, shadow, waiting=False):
    """One word for the pill and the banner's colour: running, shadow,
-    stopped, alarm or warning."""
+    stopped, alarm, waiting or warning. `waiting`: the red headline is
+    Home Assistant still starting (SAFETY-112), which needs nobody."""
    if shadow:
        return "shadow"
    if level == "bad":
-        return "alarm"
+        return "waiting" if waiting else "alarm"
    if not c.auto:
        return "stopped"
    if level == "warn":
@@ -924,20 +925,22 @@ def state_of(c, level, shadow):


 def build(c, *, level: str, checks: list, now: datetime | None = None,
-          lang: str = "en", held: bool | None = None) -> dict:
+          lang: str = "en", held: bool | None = None,
+          waiting: bool = False) -> dict:
    """The structured half of `/status`, in `lang` (UX-13 P5). Pure reads of
    the controller."""
    _LANG[0] = uitext.lang_of(lang)
    try:
-        return _build(c, level=level, checks=checks, now=now, held=held)
+        return _build(c, level=level, checks=checks, now=now, held=held,
+                      waiting=waiting)
    finally:
        _LANG[0] = "en"


-def _build(c, *, level, checks, now, held=None):
+def _build(c, *, level, checks, now, held=None, waiting=False):
    now = now or datetime.now(timezone.utc)
    shadow = bool(c.shadow)
-    kind = state_of(c, level, shadow)
+    kind = state_of(c, level, shadow, waiting)
    # A red banner means every inverter is at 0 W (the status cascade), so
    # nothing is planned until it clears. Shadow mode still plans: it is
    # what the add-on would do. `held` False: an alarm while control runs
@@ -1332,7 +1335,7 @@ def _samples() -> list:
    out += [("title", mode_word(k)) for k in words["modes"]]
    out += [("title", mode_house()), ("title", attn_shadow()),
            ("line", attn_shadow_body())]
-    for k in ("running", "shadow", "stopped", "alarm", "warning"):
+    for k in ("running", "shadow", "stopped", "alarm", "waiting", "warning"):
        out += [("title", pill(k)), ("line", banner_sub(k))]
    for sh in (False, True):
        out += [("title", tile_solar(v, s)) for v, s in
@@ -69,7 +69,7 @@ from . import messages
 from .freeze import (
    FreezeWatchdog, FreezeWatchdogConfig, looks_frozen, rail_unreachable, rail_w,
 )
-from .hass import CORE_API, HomeAssistant
+from .hass import CORE_API, OUTAGE, HomeAssistant
 # ⚠️ `LINK_STALE_S` IS RE-EXPORTED DELIBERATELY. `live_units()` reasons about it
 # and two checks read `app.main.LINK_STALE_S` to build a stale link, so the
 # window an operator would look up here is the one the roster actually uses.
@@ -992,12 +992,17 @@ class Controller:
        self._charge_blocked_q = None
        self._ref_cheap = None
        # OPT-11 P4: the solar forecast and the day plan. Only with battery
-        # modes on AND `pv_forecast_entity` set; otherwise none of this runs
-        # and every mode acts as in P3 option A.
-        self.fc_entity = (opts.get("pv_forecast_entity") or None) \
-            if self.modes_on else None
-        self.fc_tomorrow_entity = opts.get("pv_forecast_tomorrow_entity") \
-            or None
+        # modes on AND a forecast for today set; otherwise none of this runs
+        # and every mode acts as in P3 option A. OPT-17: each day may name
+        # several entities, summed (`solarfc.entities()`); `fc_entity` is
+        # the first, and None means no forecast.
+        self.fc_entities = (solarfc.entities(opts) if self.modes_on
+                            else ())
+        self.fc_tomorrow_entities = solarfc.entities(opts, tomorrow=True)
+        self.fc_entity = self.fc_entities[0] if self.fc_entities else None
+        # OPT-17: the members that are not usable, as `solarfc.read_sum()`
+        # gives them, for the status page and the action log.
+        self.solar_fc_gaps = ()
        self.solar_trust_pct = opts.get("solar_trust_pct",
                                        dayplan.DEFAULT_TRUST_PCT)
        self.solar_fc = None
@@ -1279,9 +1284,26 @@ class Controller:
        _LOG.info("The battery refusal ends, control asks for power again: %s.",
                  why)

-    def _refusal_update(self, decision, asked_w, batt_w, probe) -> None:
-        """Follow `compute()`'s carried refused direction, and say so."""
+    def _refusal_update(self, decision, asked_w, batt_w, probe,
+                        rejudged: int = 0) -> None:
+        """Follow `compute()`'s carried refused direction, and say so.
+
+        `rejudged`: the refusal held while another writer had the wire, so
+        `compute()` judged it afresh against that writer's ask (SAFETY-107).
+        """
        now = decision.refused or 0
+        if rejudged:
+            if now == rejudged:
+                # Still refused against the ask on the wire: the same episode.
+                # The probe clock restarts, as it did when this was an end and
+                # a new start: a probe is the loop's ask, and it is not on the
+                # wire while another writer is.
+                self.batt_refused_at = self._now_mono
+                return
+            gave = (rejudged * (batt_w - self._site_idle_w())
+                    >= _ctl.PROBE_ANSWER_W)
+            self._refusal_end("the battery gives power" if gave
+                              else "another writer")
        if now and not self.batt_refused:
            self._refusal_start(now, f"asked {asked_w:+.0f} W, the battery "
                                     f"gave {batt_w:+.0f} W for "
@@ -3229,18 +3251,31 @@ class Controller:
    async def _read_forecast(self) -> None:
        """OPT-11 P4: the solar forecast sensors (`solarfc.read()`). A
        failed or stale read is no forecast, never a zero."""
-        today = await self.hass.state(self.fc_entity)
-        tomorrow = (await self.hass.state(self.fc_tomorrow_entity)
-                    if self.fc_tomorrow_entity else None)
+        # OPT-17: every member of both days in one gather.
+        ents = self.fc_entities + self.fc_tomorrow_entities
+        states = await asyncio.gather(*(self.hass.state(e) for e in ents))
+        n = len(self.fc_entities)
        now = datetime.now(timezone.utc)
-        fc, why = solarfc.read(today, tomorrow, now)
-        if (fc is None) != (self.solar_fc is None) or why != self.solar_fc_why:
+        fc, why, gaps = solarfc.read_sum(
+            list(zip(self.fc_entities, states[:n])),
+            list(zip(self.fc_tomorrow_entities, states[n:])), now)
+        # A member is named only in a sum of several; one entity reads as
+        # before. Logged once per episode: on a change, never every read.
+        gaps = tuple(g for g in gaps if len(
+            self.fc_entities if g[0] == "today"
+            else self.fc_tomorrow_entities) > 1)
+        if (fc is None) != (self.solar_fc is None) \
+                or why != self.solar_fc_why or gaps != self.solar_fc_gaps:
            self.log_event(
                "solar forecast: " + ("read" if fc is not None else
-                                      f"none ({why})"),
-                hint=messages.hint("forecast_read" if fc is not None
-                                   else "forecast_none"))
+                                      f"none ({why})")
+                + "".join(f", {d} {e} not usable ({w})"
+                          for d, _i, e, w in gaps),
+                hint=messages.hint(
+                    "forecast_none" if fc is None else
+                    "forecast_no_tomorrow" if gaps else "forecast_read"))
        self.solar_fc, self.solar_fc_why = fc, why
+        self.solar_fc_gaps = gaps

    async def read_inputs(self, now_mono: float | None = None) -> None:
        """Every input this cycle needs, and SAFETY-37's freshness verdict.
@@ -4973,11 +5008,15 @@ class Controller:
            if trade_was and not mode_trade:
                self._reseed_run_edge(claims)
            # SAFETY-52: another writer overrode the loop, so a refusal learned
-            # against the loop's own ask no longer describes the wire. A gap
+            # against the loop's own ask may no longer describe the wire. A gap
            # (`loop_w` None: blind or stopped) keeps it: the stale-reading stop
            # is what seeds it, and dropping it there restarts the ~70 s cycle.
+            # SAFETY-107: it ends only if compute() no longer finds it against
+            # that writer's ask (`_refusal_update()`). A held refusal makes the
+            # loop ask 0 W, so any claim that binds differs from it every cycle.
+            rejudged = 0
            if self.loop_w is not None and self.target != self.loop_w:
-                self._refusal_end("another writer")
+                rejudged = self.batt_refused
            # SAFETY-96: a battery that dropped out of the split leaves the
            # loop's start point (SAFETY-93's own if its charge ended too).
            self._reseed_drop(_live96)
@@ -4986,7 +5025,8 @@ class Controller:
            # SAFETY-95: then a drain that ended, last (it reads the start
            # the others left).
            self._reseed_drain_end(maint_results, _live96)
-            probe = self._refusal_probe()
+            # No probe while it is judged afresh (the loop does not hold the wire).
+            probe = False if rejudged else self._refusal_probe()
            if len(self.inverters) > 1:
                probe = any(_probing.values())
            # ⚠️ `actual_w` IS THE SITE SUM AND THAT IS DEV-02's OTHER HALF.
@@ -5029,7 +5069,8 @@ class Controller:
                # limit already closes an empty battery's discharge end.
                # SAFETY-73: at N>1 the site law holds 0 W only while every
                # unit refuses the same way. Otherwise None, the old law.
-                refused=self.batt_refused if len(self.inverters) == 1
+                refused=(0 if rejudged else self.batt_refused)
+                if len(self.inverters) == 1
                else self._site_refused(),
                probe=probe,
                # SAFETY-94: at N=1 the engage also needs the reading to have
@@ -5055,7 +5096,8 @@ class Controller:
            self.loop_w = decision.target_w
            self._loop_decision = decision
            if len(self.inverters) == 1:
-                self._refusal_update(decision, loop_prev, site_batt, probe)
+                self._refusal_update(decision, loop_prev, site_batt, probe,
+                                     rejudged)
            # --- TEL-10 ------------------------------------------------------
            # ⚠️ THE INTEGRATOR HAS NEVER LEFT THIS PROCESS, AND THAT IS WHAT
            # THE CARD IS. `self.i_w` is carried between cycles and published
@@ -6548,6 +6590,14 @@ class Controller:
            else:
                out.append({"ok": True, "warn": False, "id": "controller",
                            "text": messages.row_controller_ran(_pass_age)})
+        # SAFETY-112. The headline unless control has stalled: while the
+        # Supervisor gives 502 (Home Assistant not yet RUNNING) no reading or
+        # write gets through, and the rows below that need it follow from it.
+        if OUTAGE.waiting():
+            out.insert(1 if out[0]["ok"] is False else 0,
+                       {"ok": False, "warn": False, "id": "home_assistant",
+                        "banner": messages.banner_ha_waiting(),
+                        "text": messages.row_ha_waiting()})
        if self.p1_enabled:
            age = self.p1.published_age_s
            if (self.p1.stale and self.p1.age_s() is None
@@ -6974,6 +7024,17 @@ class Controller:
            # is both is a check nobody reads.
            out.append({"ok": False, "warn": True, "id": "peak_forecast",
                        "text": messages.row_no_peak_forecast()})
+        # OPT-17: a forecast summed from several entities names, by position,
+        # each member with no usable reading. A caution: control goes on.
+        gaps = getattr(self, "solar_fc_gaps", ())
+        for day, ents in (("today", getattr(self, "fc_entities", ())),
+                          ("tomorrow",
+                           getattr(self, "fc_tomorrow_entities", ()))):
+            gone = [i for d, i, _e, _w in gaps if d == day]
+            if gone:
+                out.append({"ok": False, "warn": True, "id": "solar_forecast",
+                            "text": messages.row_forecast_gap(
+                                day, gone, len(ents))})
        # --- TEL-11 ----------------------------------------------------------
        # ⚠️ NO ROW AT ALL WHEN THE ROSTER IS EMPTY, AND THAT IS A DELIBERATE
        # DIFFERENCE FROM THE PEAK-FORECAST CAUTION DIRECTLY ABOVE. That one
@@ -7046,7 +7107,7 @@ class Controller:
        # control goes on, so it neither reads "Not ready" nor holds the page.
        runs = [c for c in bad if c.get("runs")]
        bad = [c for c in bad if not c.get("runs")]
-        running_alarm = False
+        running_alarm = waiting = False
        # --- SAFETY-10, AND IT IS FIRST IN THE CASCADE -----------------------
        # "The battery is NOT being controlled" is the one sentence on this
        # page that may never be displaced by another condition. A banner that
@@ -7097,6 +7158,10 @@ class Controller:
            # headline nobody reads. UX-08: without the key, the banner takes
            # the row's first sentence, so it stays a headline.
            level, banner = "bad", messages.banner_not_ready(bad[0])
+            # SAFETY-112: nothing to do but wait, so Home says that instead
+            # of "Needs you now". Only when it IS the headline: a safety stop
+            # above outranks it and still needs a person.
+            waiting = bad[0].get("id") == "home_assistant"
        elif not self.auto:
            level, banner = "warn", messages.banner_stopped()
        elif runs:
@@ -7243,7 +7308,7 @@ class Controller:
        # fields are served alone (the page then shows the installer details).
        try:
            out.update(homeview.build(self, level=level, checks=checks,
-                                      lang=lang, held=held))
+                                      lang=lang, held=held, waiting=waiting))
        except Exception:                               # noqa: BLE001
            # Once per process at ERROR: the page polls every 3 s.
            if not getattr(self, "_home_failed", False):
@@ -541,11 +541,29 @@ class Maintenance:
        events.append(msg)
        return MaintResult(IDLE, True, 0.0, False, events, failed=kind)

+    def _hold(self, now: datetime, events: list) -> MaintResult:
+        """HOLD for one tick, with or without a SoC reading (MAINT-15).
+
+        HOLD needs no level to end: it is reached only after the charge counted
+        as done (MAINT-13/14), so its end is a time check and nothing else.
+        """
+        elapsed = self._elapsed_min(now)
+        if elapsed >= self.cfg.hold_min:
+            self.store.set_time("last_completed", now)
+            self._enter(IDLE, now, events,
+                        f"maintenance: cycle COMPLETE ({elapsed:.0f} min hold) "
+                        "- handing back to the loop")
+            return MaintResult(IDLE, False, None, False, events)
+        # 0 W, not "do nothing": commanding zero is what stops the loop
+        # pulling the pack straight back down the moment it is full, which
+        # is exactly when the BMS needs it parked at the top.
+        return MaintResult(HOLD, True, 0.0, False, events)
+
    def _no_soc(self, now: datetime, phase: str, gate_open: bool,
                events: list) -> MaintResult:
        """MAINT-14: one tick of a pack in a moving phase with no SoC reading.

-        HOLD is unchanged (0 W). DRAIN holds at 0 W, like HOLD, and its 12 h
+        HOLD stays at 0 W and ends at its normal time (MAINT-15). DRAIN holds at 0 W, like HOLD, and its 12 h
        timeout still runs. CHARGE keeps its timeout and wall backstop: out of
        time is a failure, except when the last SoC seen was within
        CHARGE_NEAR_FULL_PCT of the target, which counts as done (MAINT-13).
@@ -563,7 +581,7 @@ class Maintenance:
        if (not self._nosoc_said and (now - self._nosoc_since).total_seconds()
                >= NOSOC_NOTE_MIN * 60):
            self._nosoc_said = True
-            tail = ("The hold waits for the level to come back."
+            tail = ("The hold still ends at its normal time."
                    if phase == HOLD else
                    f"The time limit of the {phase} still applies.")
            msg = (f"maintenance: no battery level for {NOSOC_NOTE_MIN} min. "
@@ -571,7 +589,7 @@ class Maintenance:
            _LOG.warning("%s", msg)
            events.append(msg)
        if phase == HOLD:
-            return MaintResult(HOLD, True, 0.0, False, events)
+            return self._hold(now, events)
        elapsed = self._elapsed_min(now)
        if phase == DRAIN:
            if elapsed > DRAIN_TIMEOUT_MIN:
@@ -736,16 +754,7 @@ class Maintenance:
            return MaintResult(CHARGE, False, None, True, events)

        if phase == HOLD:
-            if elapsed >= self.cfg.hold_min:
-                self.store.set_time("last_completed", now)
-                self._enter(IDLE, now, events,
-                            f"maintenance: cycle COMPLETE ({elapsed:.0f} min hold) "
-                            "- handing back to the loop")
-                return MaintResult(IDLE, False, None, False, events)
-            # 0 W, not "do nothing": commanding zero is what stops the loop
-            # pulling the pack straight back down the moment it is full, which
-            # is exactly when the BMS needs it parked at the top.
-            return MaintResult(HOLD, True, 0.0, False, events)
+            return self._hold(now, events)

        _LOG.error("maintenance: unknown phase %r, forcing idle", phase)
        events += self.abort(now, f"unknown phase {phase!r}")
@@ -436,6 +436,17 @@ def banner_shadow(latched: bool) -> str:
    return "Shadow mode: the battery is not controlled. Inverters stay at 0 W."


+def banner_ha_waiting() -> str:
+    """SAFETY-112: the Supervisor passes nothing on until Home Assistant has
+    finished starting, so the add-on can neither read nor write."""
+    return "Waiting for Home Assistant to finish starting"
+
+
+def row_ha_waiting() -> str:
+    return ("Home Assistant is not answering, perhaps it is still starting. "
+            "Control resumes by itself when it answers.")
+
+
 # Rows: control and the meter. "Control" is what the add-on does, as in
 # "start control" (STYLE.md section 4).
 def row_controller_starting() -> str:
@@ -754,6 +765,15 @@ def row_pv_partial(missing, count) -> str:
            f"reading")


+def row_forecast_gap(day, missing, count) -> str:
+    """OPT-17. `day` is "today" or "tomorrow"; `missing` are the 1-based
+    positions of the forecast entities with no usable reading."""
+    which = names([str(n) for n in missing])
+    many = len(missing) > 1
+    return (f"Solar forecast for {day}: not used, source{'s' if many else ''} "
+            f"{which} of {count} {'have' if many else 'has'} no reading")
+
+
 def row_pv_single_ignored() -> str:
    return f"Solar production: clear {PV_ONE}, the per-inverter list replaces it"

@@ -953,6 +973,7 @@ HINTS = {
    "trade_off": "Trading: waiting for a better price",
    "forecast_read": "Solar forecast read, the day plan uses it",
    "forecast_none": "No solar forecast, so Leftover solar takes solar only",
+    "forecast_no_tomorrow": "Tomorrow's solar forecast is not used, a source has no reading",
    "split": "The power split between inverters changed",
    "clash": "Two limits clash, inverters set to 0 W",
    "no_setpoint": "An inverter has no “Setpoint entity”, inverters stay at 0 W",
@@ -1045,6 +1066,10 @@ def status_samples() -> list:
        ("banner_setup_only", None, banner_setup_only()),
        ("row_setup_only", AMBER, row_setup_only()),
        ("banner_shadow", None, banner_shadow(True)),
+        ("banner_not_ready", None, banner_not_ready(
+            {"text": row_ha_waiting(), "banner": banner_ha_waiting()})),
+        ("banner_ha_waiting", None, banner_ha_waiting()),
+        ("row_ha_waiting", RED, row_ha_waiting()),
        ("row_controller_starting", GREEN, row_controller_starting()),
        ("row_controller_ran", GREEN, row_controller_ran(2)),
        ("row_controller_stalled", RED, row_controller_stalled(45, 30)),
@@ -1114,6 +1139,8 @@ def status_samples() -> list:
                                           "entity - it cannot be read in watts")),
        ("row_pv_partial", AMBER, row_pv_partial([2, 3], 3)),
        ("row_pv_partial", AMBER, row_pv_partial([2], 2)),
+        ("row_forecast_gap", AMBER, row_forecast_gap("today", [2], 3)),
+        ("row_forecast_gap", AMBER, row_forecast_gap("tomorrow", [1, 2], 2)),
        ("row_pv_single_ignored", AMBER, row_pv_single_ignored()),
        ("row_pv_negative", AMBER, row_pv_negative(2, 3, -1500, False)),
        ("row_pv_negative", AMBER, row_pv_negative(1, 1, -1500, True)),
@@ -1232,6 +1259,8 @@ LABELS = {
    "pv_entities": "Solar production entities, per inverter",
    "pv_forecast_entity": "Solar forecast, today",
    "pv_forecast_tomorrow_entity": "Solar forecast, tomorrow",
+    "pv_forecast_entities": "Several solar forecasts, today",
+    "pv_forecast_tomorrow_entities": "Several solar forecasts, tomorrow",
    "solar_trust_pct": "Trust in the forecast",
    "p1_phase_import_entities": "Import entities per phase",
    "p1_phase_export_entities": "Export entities per phase",
@@ -27,6 +27,11 @@ Without an hourly split, the day's energy is spread over a fixed bell from
 A reading older than `FRESH_S`, or from before local midnight, is stale,
 and a stale or missing forecast is no forecast: the day plan is off and
 every mode acts as in P3 option A.
+
+OPT-17: each day may instead name a list (`pv_forecast_entities`,
+`pv_forecast_tomorrow_entities`), summed by `read_sum()`. One member that is
+not usable makes that day's sum unusable, never a partial sum.
+DECISIONS/OPT-17-several-forecast-entities.md.
 """

 import math
@@ -49,6 +54,12 @@ BELL_FROM_H, BELL_TO_H = 6.0, 20.0
 NOT_SET, MISSING, UNIT, STALE, BAD = (
    "not_set", "missing", "unit", "stale", "bad")

+# OPT-17: (single key, list key) per day. A set list replaces the single key;
+# the validator refuses both set for the same day.
+TODAY_KEYS = ("pv_forecast_entity", "pv_forecast_entities")
+TOMORROW_KEYS = ("pv_forecast_tomorrow_entity",
+                 "pv_forecast_tomorrow_entities")
+

@dataclass(frozen=True)
 class Day:
@@ -223,6 +234,52 @@ def _reported(state):
    return max(ts) if ts else None


+def entities(opts: dict, *, tomorrow=False) -> tuple:
+    """The forecast entities one day names, in configured order: the list
+    if it has any entry, else the single key, else (). A repeated id is
+    dropped, as `pv.entities()` does: it would count one forecast twice."""
+    one, many = TOMORROW_KEYS if tomorrow else TODAY_KEYS
+    listed = [e for e in (str(x or "").strip()
+                          for x in (opts.get(many) or [])) if e]
+    if listed:
+        return tuple(dict.fromkeys(listed))
+    e = str(opts.get(one) or "").strip()
+    return (e,) if e else ()
+
+
+def _bounds(now):
+    here = now.astimezone(BILLING_TZ)
+    d0 = datetime(here.year, here.month, here.day, tzinfo=BILLING_TZ)
+    nd = d0.date() + timedelta(days=1)
+    d1 = datetime(nd.year, nd.month, nd.day, tzinfo=BILLING_TZ)
+    return d0.astimezone(timezone.utc), d1.astimezone(timezone.utc)
+
+
+def _today(state, day0, now):
+    """`(Day, at, None)` or `(None, None, why)` for one today sensor."""
+    today, why = _day(state, day0, now, today=True)
+    if today is None:
+        return None, None, why
+    at = _reported(state)
+    # A reading from before local midnight is yesterday's "left today" (0
+    # after sunset) until the integration refreshes: stale, not a dark day.
+    if at is None or at < day0 or (now - at).total_seconds() > FRESH_S \
+            or (at - now).total_seconds() > 300:
+        return None, None, STALE
+    return today, at, None
+
+
+def _tomorrow(state, day0, day1, now):
+    """`(Day, None)` or `(None, why)` for one tomorrow sensor."""
+    t, why = _day(state, day1, now, today=False)
+    if t is None:
+        return None, why
+    t_at = _reported(state)
+    if t_at is None or t_at < day0 or (now - t_at).total_seconds() > FRESH_S:
+        return None, STALE
+    return t, None
+
+
 def read(today_state, tomorrow_state, now: datetime, *,
         configured=True):
    """`(Forecast, None)` or `(None, why)`. `tomorrow_state` may be None
@@ -230,25 +287,64 @@ def read(today_state, tomorrow_state, now: datetime, *,
    covers today only."""
    if not configured:
        return None, NOT_SET
-    here = now.astimezone(BILLING_TZ)
-    d0 = datetime(here.year, here.month, here.day, tzinfo=BILLING_TZ)
-    nd = d0.date() + timedelta(days=1)
-    d1 = datetime(nd.year, nd.month, nd.day, tzinfo=BILLING_TZ)
-    day0, day1 = d0.astimezone(timezone.utc), d1.astimezone(timezone.utc)
-    today, why = _day(today_state, day0, now, today=True)
+    day0, day1 = _bounds(now)
+    today, at, why = _today(today_state, day0, now)
    if today is None:
        return None, why
-    at = _reported(today_state)
-    # A reading from before local midnight is yesterday's "left today" (0
-    # after sunset) until the integration refreshes: stale, not a dark day.
-    if at is None or at < day0 or (now - at).total_seconds() > FRESH_S \
-            or (at - now).total_seconds() > 300:
-        return None, STALE
    tomorrow = None
    if tomorrow_state is not None:
-        t, _w = _day(tomorrow_state, day1, now, today=False)
-        t_at = _reported(tomorrow_state)
-        if t is not None and t_at is not None and t_at >= day0 \
-                and (now - t_at).total_seconds() <= FRESH_S:
-            tomorrow = t
+        tomorrow, _w = _tomorrow(tomorrow_state, day0, day1, now)
    return Forecast(today, tomorrow, at), None
+
+
+def _sum(days):
+    """One Day from several members' Days. The hourly split is kept only if
+    every member has one: the splits are then joined (`_day_between()`
+    adds overlapping periods). Else the total goes on the bell."""
+    if len(days) == 1:
+        return days[0]
+    periods = ()
+    if all(d.periods for d in days):
+        periods = tuple(sorted(p for d in days for p in d.periods))
+    return Day(days[0].day0, sum(d.kwh for d in days), periods)
+
+
+def read_sum(today, tomorrow, now: datetime):
+    """OPT-17: `(Forecast or None, why, gaps)` over lists of
+    `(entity, state)`, one per configured member, in configured order.
+
+    Each member is read exactly as `read()` reads one sensor, in its own
+    unit. A member that is missing, unavailable, stale, not in an energy
+    unit or bad makes that DAY unusable, as one such sensor does today: no
+    today means no forecast, no tomorrow means today only. A partial sum
+    would under-count the sun and mislead the day plan.
+
+    `gaps` is `((day, position, entity, why), ...)` for every unusable
+    member (`day` "today" or "tomorrow", `position` 1-based), so the page
+    and the log can name it. With one member per day the forecast is what
+    `read()` gives (test_opt17.py proves it)."""
+    if not today:
+        return None, NOT_SET, ()
+    day0, day1 = _bounds(now)
+    gaps, days, ats, why0 = [], [], [], None
+    for i, (ent, st) in enumerate(today, 1):
+        d, at, why = _today(st, day0, now)
+        if d is None:
+            gaps.append(("today", i, ent, why))
+            why0 = why0 or why
+        else:
+            days.append(d)
+            ats.append(at)
+    tdays = []
+    for i, (ent, st) in enumerate(tomorrow, 1):
+        t, why = _tomorrow(st, day0, day1, now)
+        if t is None:
+            gaps.append(("tomorrow", i, ent, why))
+        else:
+            tdays.append(t)
+    gaps = tuple(gaps)
+    if why0 is not None:
+        return None, why0, gaps
+    tday = _sum(tdays) if tomorrow and len(tdays) == len(tomorrow) else None
+    # The oldest member's report is when the sum was last fully known.
+    return Forecast(_sum(days), tday, min(ats)), None, gaps
@@ -100,7 +100,7 @@
  }
  function renderPill() {
    const st = S.state || null;
-    const dot = st ? ({ running: "", shadow: " warn", stopped: " warn", warning: " warn", alarm: " bad" }[st.kind] ?? " warn")
+    const dot = st ? ({ running: "", shadow: " warn", stopped: " warn", warning: " warn", alarm: " bad", waiting: " warn" }[st.kind] ?? " warn")
                   : (S.level === "ok" ? "" : S.level === "bad" ? " bad" : " warn");
    const words = st ? [st.pill, st.ran].filter(Boolean).join(". ") : S.setup_only === true ? t("setup_only.name") : S.banner;
    $("#pill").replaceChildren(h("span", { class: "dot" + dot, "aria-hidden": "true" }), h("span", {}, words));
@@ -399,7 +399,7 @@
    $("#batt-how").hidden = !modes;
    const docs = $("#batt-docs");
    if (S.control && S.control.docs_url) { docs.href = S.control.docs_url; docs.hidden = false; } else docs.hidden = true;
-    if (S.state && ["shadow", "stopped", "alarm"].includes(S.state.kind)) banner($("#batt-banner"), S.level, S.state.pill, S.state.sub, S.level === "bad" ? "alert" : null);
+    if (S.state && ["shadow", "stopped", "alarm", "waiting"].includes(S.state.kind)) banner($("#batt-banner"), S.level, S.state.pill, S.state.sub, S.level === "bad" ? "alert" : null);
    else $("#batt-banner").replaceChildren();
    keepFocus(() => {
      $("#bcards").replaceChildren(...S.batteries.map(batteryCard));
@@ -267,6 +267,7 @@
      "shadow": "Shadow mode",
      "stopped": "Stopped",
      "alarm": "Needs you now",
+      "waiting": "Waiting for Home Assistant",
      "warning": "Running, with a warning"
    },
    "banner_sub": {
@@ -274,6 +275,7 @@
      "shadow": "The plans below say what the add-on would do.",
      "stopped": "Start control below when you are ready.",
      "alarm": "See Needs attention below for what to do.",
+      "waiting": "Control resumes by itself when Home Assistant answers.",
      "warning": "See Needs attention below."
    },
    "tile": {
@@ -431,6 +433,7 @@
      "stopped": "Control is stopped. Every inverter is at 0 W."
    },
    "attn": {
+      "home_assistant": "Home Assistant is not answering",
      "controller": "Control is not running",
      "meter": "Meter reading",
      "meter_frozen": "Meter reading may be stuck",
@@ -449,6 +452,7 @@
      "delivery": "An inverter is not delivering",
      "estop": "Emergency stop",
      "pv": "Solar reading",
+      "solar_forecast": "Solar forecast",
      "none": "Inverter connection"
    },
    "months": ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"]
@@ -230,8 +230,8 @@
    "zero_held": "Op 0 W gehouden",
    "zero_going": "Gaat naar 0 W",
    "verdict": {"held": "Op 0 W gehouden", "stopped": "Gestopt", "cycle": "Vandaag maandelijkse cyclus", "trade": "Handelt op prijs", "house": "Volgt het huis"},
-    "pill": {"running": "Actief", "shadow": "Schaduwmodus", "stopped": "Gestopt", "alarm": "Heeft u nu nodig", "warning": "Actief, met een waarschuwing"},
-    "banner_sub": {"running": "De batterijen volgen het plan hieronder.", "shadow": "De plannen hieronder tonen wat de add-on zou doen.", "stopped": "Start de regeling hieronder als u klaar bent.", "alarm": "Zie Vraagt aandacht hieronder voor wat u moet doen.", "warning": "Zie Vraagt aandacht hieronder."},
+    "pill": {"running": "Actief", "shadow": "Schaduwmodus", "stopped": "Gestopt", "alarm": "Heeft u nu nodig", "waiting": "Wacht op Home Assistant", "warning": "Actief, met een waarschuwing"},
+    "banner_sub": {"running": "De batterijen volgen het plan hieronder.", "shadow": "De plannen hieronder tonen wat de add-on zou doen.", "stopped": "Start de regeling hieronder als u klaar bent.", "alarm": "Zie Vraagt aandacht hieronder voor wat u moet doen.", "waiting": "De regeling gaat vanzelf verder zodra Home Assistant antwoordt.", "warning": "Zie Vraagt aandacht hieronder."},
    "tile": {"not_set_up": "Niet ingesteld", "no_reading": "Geen meting", "producing": "Produceert", "not_producing": "Produceert niet", "needs_solar": "Zonnemeting nodig", "not_adding_up": "Metingen kloppen niet", "using": "Verbruikt", "taking": "Neemt af van het net", "feeding": "Injecteert", "balanced": "In evenwicht", "giving": "Levert stroom", "charging": "Laadt", "resting": "Rust"},
    "now": {
      "no_reading": "Geen meting van deze batterij.",
@@ -354,6 +354,7 @@
    "peak_not_covered": "Geen piekgrens: deze meter meet geen kwartieren.",
    "control": {"shadow": "Schaduwmodus: elke omvormer blijft op 0 W.", "running": "De regeling is actief.", "stopped": "De regeling is gestopt. Elke omvormer staat op 0 W."},
    "attn": {
+      "home_assistant": "Home Assistant antwoordt niet",
      "controller": "Regeling is niet actief",
      "meter": "Meting van de meter",
      "meter_frozen": "Meter staat mogelijk vast",
@@ -372,6 +373,7 @@
      "delivery": "Een omvormer levert niet",
      "estop": "Noodstop",
      "pv": "Meting van de zonnepanelen",
+      "solar_forecast": "Zonneprognose",
      "none": "Verbinding met de omvormer"
    },
    "months": ["januari", "februari", "maart", "april", "mei", "juni", "juli", "augustus", "september", "oktober", "november", "december"]
@@ -135,6 +135,10 @@ GROUPS = (
            Field("pv_forecast_entity", ENTITY, kind="energy", simple=True,
                  note="forecast"),
            Field("pv_forecast_tomorrow_entity", ENTITY, kind="energy"),
+            # OPT-17: several forecast sensors per day, summed.
+            Field("pv_forecast_entities", ENTITY_LIST, kind="energy"),
+            Field("pv_forecast_tomorrow_entities", ENTITY_LIST,
+                  kind="energy"),
            Field("solar_trust_pct", SLIDER, "%", step=5),
        )),
    )),
@@ -1802,12 +1802,13 @@ def _entity_notes(notes, opts: dict, entities: dict, bad=()) -> None:
            _advise(notes, "warn", (key,),
                    f"{entity} does not read in kWh, so pick a solar "
                    "forecast sensor in kWh.")
-    if any(opts.get(k) for k in FORECAST_KEYS) and \
+    today = solarfc.entities(opts)
+    tomorrow = solarfc.entities(opts, tomorrow=True)
+    if (today or tomorrow) and \
            opts.get("battery_modes_enabled") is not True:
        _advise(notes, "info", ("pv_forecast_entity",),
                "The solar forecast is used only with battery modes on.")
-    if opts.get("pv_forecast_tomorrow_entity") and \
-            not opts.get("pv_forecast_entity"):
+    if tomorrow and not today:
        _advise(notes, "warn", ("pv_forecast_tomorrow_entity",),
                "Tomorrow's forecast is used only with today's, so set "
                f"{S('pv_forecast_entity')} too.")
@@ -2069,12 +2070,13 @@ def _margin_problems(opts: dict) -> list[str]:
 TRUST_RANGE_PCT = (30, 100)
 # A Home Assistant sensor id; it goes into the /api/states/<id> path.
 _SENSOR_ID = re.compile(r"sensor\.[a-z0-9_]+")
-FORECAST_KEYS = ("pv_forecast_entity", "pv_forecast_tomorrow_entity")
+FORECAST_KEYS = solarfc.TODAY_KEYS + solarfc.TOMORROW_KEYS


 def _forecast_problems(opts: dict) -> list[str]:
    """Rule 13 (OPT-11 P4): the trust is a whole percentage in range, and
-    each forecast entity set is a sensor."""
+    each forecast entity set is a sensor. OPT-17: a day names its forecast
+    in the single key or in the list, not both."""
    out = []
    raw = opts.get("solar_trust_pct")
    trust = _number(opts, "solar_trust_pct", dayplan.DEFAULT_TRUST_PCT)
@@ -2082,14 +2084,30 @@ def _forecast_problems(opts: dict) -> list[str]:
    if trust is None or trust != int(trust) or not lo <= trust <= hi:
        out.append(f"{S('solar_trust_pct')} must be a whole number from {lo} "
                   f"to {hi} %. It is {messages.shown(raw)}.")
-    for key in FORECAST_KEYS:
-        e = opts.get(key)
-        if e is None or e == "":
-            continue
-        if not isinstance(e, str) or not _SENSOR_ID.fullmatch(e):
-            out.append(f"{S(key)} must be a sensor, like "
+    for one, many in (solarfc.TODAY_KEYS, solarfc.TOMORROW_KEYS):
+        e = opts.get(one)
+        if e is not None and e != "" and (
+                not isinstance(e, str) or not _SENSOR_ID.fullmatch(e)):
+            out.append(f"{S(one)} must be a sensor, like "
                       f"sensor.energy_production_today_remaining. It is "
                       f"{messages.shown(e)}.")
+        raw = opts.get(many)
+        if raw is None:
+            raw = []
+        if not isinstance(raw, list):
+            out.append(f"{S(many)} must be a list of sensors. It is "
+                       f"{messages.shown(raw)}.")
+            continue
+        listed = [x for x in raw if x is not None
+                  and not (isinstance(x, str) and not x.strip())]
+        for x in listed:
+            if not isinstance(x, str) or not _SENSOR_ID.fullmatch(x):
+                out.append(f"{S(many)} must list only sensors, like "
+                           f"sensor.energy_production_today_remaining. "
+                           f"It has {messages.shown(x)}.")
+        if e and listed:
+            out.append(f"Set {S(one)} or {S(many)}, not both. Keep the "
+                       f"list and clear the single one.")
    return out


@@ -1,5 +1,5 @@
 name: GoodWe RS485 Controller
-version: "0.16.0"
+version: "0.17.0"
 slug: goodwe_controller
 description: >-
  Drives a GoodWe ES/BP battery inverter over RS485 by emulating its smart
@@ -157,6 +157,11 @@ options:
  # integrations whose sensors fit.
  pv_forecast_entity: ""
  pv_forecast_tomorrow_entity: ""
+  # OPT-17: several forecast sensors per day (one per inverter or string),
+  # summed. Use the list OR the single key above, not both. `[]` is
+  # load-bearing, as for `pv_entities`.
+  pv_forecast_entities: []
+  pv_forecast_tomorrow_entities: []
  solar_trust_pct: 70

  # TEL-11 - THE SITE'S PV PRODUCTION, IN WATTS, AND IT IS READ BY NOTHING THAT
@@ -961,6 +966,13 @@ schema:
  battery_modes_enabled: bool
  pv_forecast_entity: str?
  pv_forecast_tomorrow_entity: str?
+  # OPT-17: new list keys beside the single ones. A list schema on the old
+  # keys refuses the string an install stores (tools/supervisor_shape_probe.py
+  # section J); DECISIONS/OPT-17-several-forecast-entities.md.
+  pv_forecast_entities:
+    - str
+  pv_forecast_tomorrow_entities:
+    - str
  solar_trust_pct: int(30,100)
  # TEL-11. Optional, and OPTIONAL WITHOUT A COMPANION RULE - unlike
  # `price_now_entity`/`price_avg_entity`, which are legal only while
@@ -245,8 +245,8 @@ m = in_charge()
 m.tick(T0 + MIN, 100.0)
 _, _, _, ev = run(m, T0 + 2 * MIN, 30, None)
 note = [e for e in ev if "no battery level for" in e]
-check("HOLD: the line exists and claims no time limit",
-      len(note) == 1 and "time limit" not in note[0] and "waits" in note[0])
+check("HOLD: the line exists and says the hold ends at its normal time (MAINT-15)",
+      len(note) == 1 and "normal time" in note[0] and "waits" not in note[0])
 m = in_charge()
 _, _, _, ev = run(m, T0, 30, None)
 check("charge keeps its wording", any("time limit of the charge" in e for e in ev))
@@ -268,7 +268,7 @@ _, _, out, _ = run(m, T0 + 10 * MIN, CHARGE_TIMEOUT_MIN + 20, None)
 _, _, _, ev = run(m, out[1] + MIN, 30, None)
 check("charge done with no SoC, then HOLD with no SoC: a new episode, so the "
      "HOLD line is said", out[0].phase == HOLD
-      and sum("hold waits" in e for e in ev) == 1)
+      and sum("normal time" in e for e in ev) == 1)

 print("6. restart while the SoC is missing")
 with tempfile.TemporaryDirectory() as d:
@@ -0,0 +1,299 @@
+"""MAINT-15: the HOLD ends on time with no SoC reading.
+`python3 test_maint15.py`
+
+Graded here: a HOLD that loses its SoC (at the start, mid-hold, just before
+hold_min) ends on time, writes last_completed and says the COMPLETE line; SoC
+back mid-hold changes nothing; HOLD stays 0 W; one pack's loss leaves the other
+pack alone; a restart in HOLD with no SoC and an old state file.
+See DECISIONS/MAINT-15-hold-ends-without-soc.md.
+
+Mutating what this file grades? Read MUTATION.md first (stale bytecode).
+"""
+
+import os
+import sys
+import tempfile
+from datetime import datetime, timedelta, timezone
+
+from app.maintenance import (
+    CHARGE, DRAIN, HOLD, IDLE, NOSOC_NOTE_MIN, MaintConfig, Maintenance,
+)
+from app.store import DEFAULTS, Store
+
+UTC = timezone.utc
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+CFG = MaintConfig(enabled=True, interval_days=28, start_hour=19,
+                  discharge_w=2000, charge_w=2000, soc_floor=11,
+                  soc_target=100, hold_min=120)
+T0 = datetime(2026, 10, 4, 18, 24, tzinfo=UTC)
+MIN = timedelta(minutes=1)
+
+
+class Mem:
+    def __init__(self, data=None):
+        self.data = dict(DEFAULTS, **(data or {}))
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def set_time(self, k, when):
+        self.data[k] = when.astimezone(UTC).isoformat() if when else None
+
+    def get_time(self, k):
+        raw = self.data.get(k)
+        return datetime.fromisoformat(raw) if raw else None
+
+    def save(self):
+        pass
+
+
+def in_drain(store=None, unit=None, at=T0):
+    m = Maintenance(CFG, store or Mem(), unit=unit, name=unit or "")
+    m.force_start(at)
+    assert m.phase == DRAIN
+    return m
+
+
+def in_charge(store=None, unit=None, at=T0):
+    m = in_drain(store, unit, at)
+    m.tick(at, 11.0)
+    assert m.phase == CHARGE
+    return m
+
+
+def run(m, start, minutes, soc, gate=True, step=1):
+    """Tick every `step` min; returns (last result, end time, first result that
+    is not the starting phase with its time, all events)."""
+    ph, t, res, out, ev = m.phase, start, None, None, []
+    for i in range(0, minutes, step):
+        t = start + i * MIN
+        s = soc(i) if callable(soc) else soc
+        res = m.tick(t, s, gate_open=gate)
+        ev += res.events
+        if out is None and res.phase != ph:
+            out = (res, t)
+            break
+    return res, start + minutes * MIN, out, ev
+
+
+
+HOLD_MIN = CFG.hold_min
+
+
+def in_hold(store=None, unit=None, at=T0):
+    """A pack in HOLD that started at `at` + 1 min (charge counted as done)."""
+    m = in_charge(store, unit, at)
+    m.tick(at + MIN, 100.0)
+    assert m.phase == HOLD
+    return m
+
+
+H0 = T0 + MIN            # the hold's start
+print("1. SoC lost in HOLD: the hold ends on time")
+for label, lost_at in (("at the start", 0), ("mid-hold", 60),
+                       ("just before hold_min", HOLD_MIN - 1)):
+    m = in_hold()
+    run(m, H0, lost_at, 100.0) if lost_at else None
+    res, _, out, ev = run(m, H0 + lost_at * MIN, HOLD_MIN + 5 - lost_at, None)
+    check(f"lost {label}: ends at hold_min, to IDLE, not failed",
+          out is not None and out[0].phase == IDLE and out[0].failed == ""
+          and out[1] == H0 + HOLD_MIN * MIN)
+    check("...last_completed is written at that time",
+          m.store.get_time("last_completed") == H0 + HOLD_MIN * MIN)
+    check("...the same COMPLETE line, once, and no last_failed",
+          sum("cycle COMPLETE (120 min hold)" in e for e in ev) == 1
+          and m.store.get_time("last_failed") is None)
+    check("...the pack is idle and hands the setpoint back",
+          m.phase == IDLE and not out[0].owns_setpoint)
+
+m = in_hold()
+res, _, out, _ = run(m, H0, HOLD_MIN - 1, None)
+check("before hold_min: still HOLD at 0 W, owned, nothing written",
+      out is None and res.phase == HOLD and res.owns_setpoint
+      and res.setpoint_w == 0.0 and m.store.get_time("last_completed") is None)
+check("...the pack is not due again (next due date moved after the end)",
+      (run(m, H0 + (HOLD_MIN - 1) * MIN, 3, None), m.due(H0 + 130 * MIN))[1] is False)
+
+print("2. the text")
+m = in_hold()
+_, _, out, ev = run(m, H0, HOLD_MIN + 5, None)
+note = [e for e in ev if "no battery level for" in e]
+check("one 15 min line, saying the hold ends at its normal time",
+      len(note) == 1 and "normal time" in note[0] and "waits" not in note[0]
+      and f"{NOSOC_NOTE_MIN} min" in note[0])
+check("...and the other events are the one COMPLETE line only", len(ev) == 2)
+m = in_hold()
+_, _, _, ev = run(m, H0, NOSOC_NOTE_MIN - 2, None)
+check("under the threshold the line is not said", ev == [])
+
+print("3. SoC comes back mid-hold")
+ends = {}
+for label, soc in (("no SoC", lambda i: None if i < 40 else 100.0),
+                   ("SoC the whole time", 100.0),
+                   ("a low SoC after the gap", lambda i: None if i < 40 else 55.0)):
+    m = in_hold()
+    res, _, out, ev = run(m, H0, HOLD_MIN + 5, soc)
+    ends[label] = (out[1], m.store.get_time("last_completed")) if out else None
+    check(f"{label}: ends at hold_min", out is not None
+          and out[1] == H0 + HOLD_MIN * MIN)
+check("...the end time is the same with or without the gap",
+      len(set(ends.values())) == 1)
+m = in_hold()
+run(m, H0, 40, None)
+res, _, out, _ = run(m, H0 + 40 * MIN, 30, 100.0)
+check("back mid-hold: still HOLD at 0 W until the time is up",
+      out is None and res.phase == HOLD and res.setpoint_w == 0.0)
+
+print("4. restart in HOLD with no SoC")
+with tempfile.TemporaryDirectory() as d:
+    path = os.path.join(d, "state.json")
+    m = Maintenance(CFG, Store(path))
+    m.force_start(T0)
+    m.tick(T0, 11.0)
+    m.tick(H0, 100.0)
+    run(m, H0, 50, None)
+    m2 = Maintenance(CFG, Store(path))
+    r = m2.tick(H0 + 51 * MIN, None)
+    check("a fresh process reads HOLD and holds 0 W", m2.phase == HOLD
+          and r.phase == HOLD and r.owns_setpoint and r.setpoint_w == 0.0)
+    res, _, out, _ = run(m2, H0 + 52 * MIN, HOLD_MIN, None)
+    check("...and the hold ends at hold_min from the hold start, not the restart",
+          out and out[0].phase == IDLE and out[1] == H0 + HOLD_MIN * MIN
+          and m2.store.get_time("last_completed") == H0 + HOLD_MIN * MIN)
+    import json
+    old = {"phase": "hold", "phase_started": H0.isoformat(),
+           "last_completed": None, "last_start_attempt": None, "auto": True}
+    p2 = os.path.join(d, "old.json")
+    json.dump(old, open(p2, "w"))
+    mo = Maintenance(CFG, Store(p2))
+    r = mo.tick(H0 + 10 * MIN, None)
+    check("an old state file in HOLD loads and holds 0 W", mo.phase == HOLD
+          and r.setpoint_w == 0.0)
+    res, _, out, _ = run(mo, H0 + 11 * MIN, HOLD_MIN, None)
+    check("...and ends on time, writing last_completed",
+          out and out[1] == H0 + HOLD_MIN * MIN
+          and mo.store.get_time("last_completed") == H0 + HOLD_MIN * MIN)
+    mr = Maintenance(CFG, Store(p2))
+    check("...the written file reloads as a finished cycle",
+          mr.phase == IDLE and mr.store.get_time("last_completed") is not None)
+
+print("5. two packs")
+a, b = (Maintenance(CFG, Mem(), unit="inverter-a", name="inverter-a"),
+        Maintenance(CFG, Mem(), unit="inverter-b", name="inverter-b"))
+a_ok, b_ok = (Maintenance(CFG, Mem(), unit="inverter-a", name="inverter-a"),
+              Maintenance(CFG, Mem(), unit="inverter-b", name="inverter-b"))
+for x in (a, a_ok):
+    x.force_start(T0)
+    x.tick(T0, 11.0)
+    x.tick(H0, 100.0)
+# B is idle; A's hold loses its SoC (twin site: A keeps it)
+same, a_end = True, None
+for i in range(0, HOLD_MIN + 10):
+    t = H0 + i * MIN
+    ra = a.tick(t, None)
+    rb = b.tick(t, 60.0)
+    ra2 = a_ok.tick(t, 100.0)
+    rb2 = b_ok.tick(t, 60.0)
+    same = same and (rb.phase, rb.owns_setpoint, rb.setpoint_w) == \
+        (rb2.phase, rb2.owns_setpoint, rb2.setpoint_w) and b.phase == b_ok.phase
+    if a_end is None and a.phase == IDLE:
+        a_end = t
+check("A loses SoC in HOLD: A ends on time (as the twin with a reading)",
+      a_end == H0 + HOLD_MIN * MIN and a_ok.phase == IDLE
+      and a.store.get_time("last_completed") == a_ok.store.get_time("last_completed"))
+check("...B is the same as in the twin site where A kept its SoC", same)
+# B in its own HOLD with SoC, A in HOLD without
+a, b = (Maintenance(CFG, Mem(), unit="inverter-a", name="inverter-a"),
+        Maintenance(CFG, Mem(), unit="inverter-b", name="inverter-b"))
+a.force_start(T0); a.tick(T0, 11.0); a.tick(H0, 100.0)
+b_start = H0 + 30 * MIN
+b.force_start(b_start - MIN); b.tick(b_start - MIN, 11.0); b.tick(b_start, 100.0)
+b_end = None
+for i in range(0, HOLD_MIN + 40):
+    t = H0 + i * MIN
+    a.tick(t, None)
+    if t >= b_start:
+        b.tick(t, 100.0)
+        if b_end is None and b.phase == IDLE:
+            b_end = t
+check("B (SoC present) ends at its own hold_min, A's loss changes nothing",
+      b_end == b_start + HOLD_MIN * MIN and a.phase == IDLE
+      and b.store.get_time("last_completed") == b_start + HOLD_MIN * MIN)
+check("...A's end is not delayed by B", a.store.get_time("last_completed")
+      == H0 + HOLD_MIN * MIN)
+
+print("6. other phases unchanged")
+m = in_drain()
+res, _, out, _ = run(m, T0, 60, None)
+check("DRAIN with no SoC still holds 0 W and does not end", out is None
+      and res.phase == DRAIN and res.setpoint_w == 0.0)
+m = in_charge()
+res, _, out, _ = run(m, T0, 600, None)
+check("CHARGE with no SoC still keeps charging", out is None
+      and res.phase == CHARGE and res.charge_only)
+
+
+def old_hold_branch(phase_started, last_completed, now, hold_min):
+    """FROZEN copy of release/1.0 (db9e231) HOLD branch of step(), with a
+    reading: returns (phase, owns_setpoint, setpoint_w, events,
+    last_completed). Kept as a reference for the differential check below."""
+    elapsed = (now - phase_started).total_seconds() / 60.0
+    if elapsed >= hold_min:
+        return (IDLE, False, None,
+                [f"maintenance: cycle COMPLETE ({elapsed:.0f} min hold) "
+                 "- handing back to the loop"], now)
+    return (HOLD, True, 0.0, [], last_completed)
+
+
+print("7. with a reading: the new HOLD against the frozen release/1.0 branch")
+for hm in (0, 5, 60, 120):
+    cfg = MaintConfig(enabled=True, interval_days=28, start_hour=19,
+                      discharge_w=2000, charge_w=2000, soc_floor=11,
+                      soc_target=100, hold_min=hm)
+    m = Maintenance(cfg, Mem())
+    m.force_start(T0)
+    m.tick(T0, 11.0)
+    m.tick(H0, 100.0)
+    started, last, same, end = H0, None, True, None
+    for i in range(0, hm + 15):
+        t = H0 + i * MIN
+        if m.phase != HOLD:
+            break
+        want = old_hold_branch(started, last, t, hm)
+        r = m.tick(t, 100.0 - (i % 3))
+        got = (r.phase, r.owns_setpoint, r.setpoint_w, r.events,
+               m.store.get_time("last_completed"))
+        same = same and got == want
+        last = want[4]
+        if r.phase == IDLE:
+            end = t
+    check(f"hold_min {hm}: every tick identical (phase, owns, W, events, "
+          "last_completed)", same)
+    check("...ends at hold_min, last_completed = that tick, one COMPLETE line",
+          end == H0 + hm * MIN and m.store.get_time("last_completed") == end
+          and m.phase == IDLE)
+
+m = in_hold()
+res, _, out, ev = run(m, H0, HOLD_MIN + 5, 100.0)
+check("HOLD with a reading: 0 W until the end, then IDLE at hold_min",
+      out is not None and out[1] == H0 + HOLD_MIN * MIN and out[0].phase == IDLE)
+check("...last_completed is that tick and the COMPLETE line is said once",
+      m.store.get_time("last_completed") == H0 + HOLD_MIN * MIN
+      and ev == ["maintenance: cycle COMPLETE (120 min hold) "
+                 "- handing back to the loop"])
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED:")
+    for f in fails:
+        print("  -", f)
+    sys.exit(1)
+print("all ok")
@@ -1469,8 +1469,11 @@ _info = [r.getMessage() for r in _out if r.levelno == logging.INFO]
 check(f"a Home Assistant restart is one plain WARNING line, and one INFO line "
      f"when both connections are back ({_warn}, {_info})",
      _warn[:1] == ["Home Assistant is not answering (error 502), perhaps it "
-                    "is restarting. The add-on keeps trying."]
-      and _info == ["Home Assistant answers again."] and len(_warn) == 2)
+                    "is still starting. Control waits and resumes by itself."]
+      and len(_info) == 1
+      and re.fullmatch(r"Home Assistant answers again after \d+ seconds\.",
+                       _info[0]) is not None and len(_warn) == 2)
+# SAFETY-112's reminder and its timing are graded in test_safety112.py.
 check("...and the library's own text is kept, at DEBUG",
      any("Received message 8:1000" in r.getMessage() for r in _out
          if r.levelno == logging.DEBUG)
@@ -113,19 +113,21 @@ check("the harness bites: Leftover solar grid-charging with no plan moves "
             lambda: setattr(modetrade, "GRID_CHARGE_MODES",
                             (packmode.LEFTOVER_SOLAR, packmode.CHEAP_HOURS)),
             lambda: setattr(modetrade, "GRID_CHARGE_MODES", _gcm)))
-_read = solarfc.read
+# OPT-17: the controller reads through `read_sum()`, so that is the seam.
+_read = solarfc.read_sum


 def _as_dark(today, tomorrow, now, **kw):
-    return _read({"state": "0", "attributes": {"unit_of_measurement":
-                                               "kWh"},
-                  "last_updated": now.isoformat()}, None, now)
+    return _read([("sensor.f", {"state": "0", "attributes": {
+        "unit_of_measurement": "kWh"}, "last_updated": now.isoformat()})],
+        [], now)


 check("...and an unavailable forecast read as a dark one moves "
      "n2_sf_ls_fc_down (Leftover solar would buy its shortfall)",
-      _moved("n2_sf_ls_fc_down", lambda: setattr(solarfc, "read", _as_dark),
-             lambda: setattr(solarfc, "read", _read)))
+      _moved("n2_sf_ls_fc_down",
+             lambda: setattr(solarfc, "read_sum", _as_dark),
+             lambda: setattr(solarfc, "read_sum", _read)))

 # ============================================================================ #
 print("2. the forecast sensors")
@@ -0,0 +1,498 @@
+"""Runnable check for OPT-17, the solar forecast summed from several entities.
+`python3 test_opt17.py`
+
+1. `solarfc.read_sum()`: sums in mixed units, refusals, a member down or
+   stale makes that day unusable (never a partial sum), hourly splits, today
+   and tomorrow, an empty list, and one member equal to `read()`.
+2. `solarfc.entities()`: which key a day uses.
+3. Options: the validator, the settings notes and config.yaml.
+4. The REAL controller (tools/opt11p3_replay.py): a one-member list runs
+   exactly like the single key, two halves like one whole, a member down
+   like a forecast down; the status row and the action log name the member
+   once; every member is read in one gather; modes off reads nothing.
+
+DECISIONS/OPT-17-several-forecast-entities.md has the rules. Mutations
+(MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import asyncio
+import logging
+import os
+import re
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11p3_replay as rp                                    # noqa: E402
+from app import (dayplan, homeview, messages, solarfc, uitext,  # noqa: E402
+                 validate)
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+L = timezone(timedelta(hours=2))
+UTC0 = datetime(2026, 9, 21, tzinfo=L).astimezone(timezone.utc)
+TOM = UTC0 + timedelta(days=1)
+NOW = datetime(2026, 9, 21, 9, 0, tzinfo=L).astimezone(timezone.utc)
+END = UTC0 + timedelta(days=1)
+OLD = NOW - timedelta(seconds=solarfc.FRESH_S + 1)
+
+
+def st(state, unit="kWh", at=NOW, **attrs):
+    a = dict(attrs)
+    if unit is not None:
+        a["unit_of_measurement"] = unit
+    return {"state": state, "attributes": a,
+            "last_updated": at.isoformat(), "last_reported": at.isoformat()}
+
+
+def members(*states):
+    return [(f"sensor.fc_{i}", s) for i, s in enumerate(states, 1)]
+
+
+def near(a, b, eps=1e-6):
+    return a is not None and b is not None and abs(a - b) < eps
+
+
+# ============================================================================ #
+print("1. read_sum")
+fc, why, gaps = solarfc.read_sum(members(st("5"), st("7500", "Wh")), [], NOW)
+check("two members, kWh + Wh: 5 + 7.5 = 12.5 kWh",
+      fc is not None and near(fc.today.kwh, 12.5) and why is None
+      and gaps == ())
+check("...and the rest of the day adds up to the sum",
+      near(fc.between(NOW, END), 12.5))
+fc, why, gaps = solarfc.read_sum(
+    members(st("5"), st("2500", "Wh"), st("0.005", "MWh")), [], NOW)
+check("three members, kWh + Wh + MWh: 5 + 2.5 + 5 = 12.5 kWh",
+      fc is not None and near(fc.today.kwh, 12.5))
+for unit in ("W", None, "kW", "%"):
+    fc, why, gaps = solarfc.read_sum(members(st("5"), st("5", unit)), [],
+                                     NOW)
+    check(f"a member in {unit or 'no unit'} makes today unusable (unit), "
+          f"and is named",
+          fc is None and why == solarfc.UNIT
+          and gaps == (("today", 2, "sensor.fc_2", solarfc.UNIT),))
+for bad, w in (("unavailable", solarfc.MISSING), ("unknown", solarfc.MISSING),
+               (None, solarfc.MISSING), ("-1", solarfc.BAD),
+               ("lots", solarfc.BAD)):
+    s2 = None if bad is None else st(bad)
+    fc, why, gaps = solarfc.read_sum(members(st("5"), s2, st("4")), [], NOW)
+    check(f"a member that reads {bad!r}: no forecast at all ({w}), not "
+          f"the 9 kWh of the others",
+          fc is None and why == w
+          and gaps == (("today", 2, "sensor.fc_2", w),))
+fc, why, gaps = solarfc.read_sum(members(st("5"), st("4", at=OLD)), [], NOW)
+check("a stale member (older than 3 h): no forecast (stale), named",
+      fc is None and why == solarfc.STALE
+      and gaps == (("today", 2, "sensor.fc_2", solarfc.STALE),))
+EVE = datetime(2026, 9, 20, 23, 30, tzinfo=L).astimezone(timezone.utc)
+MID = datetime(2026, 9, 21, 0, 10, tzinfo=L).astimezone(timezone.utc)
+fc, why, gaps = solarfc.read_sum(members(st("5", at=MID), st("0", at=EVE)),
+                                 [], MID)
+check("a member from before local midnight is stale, not a dark member",
+      fc is None and why == solarfc.STALE)
+fc, why, gaps = solarfc.read_sum(members(st("unavailable"), st("4", at=OLD)),
+                                 [], NOW)
+check("two members down: both named, the first reason is the day's",
+      fc is None and why == solarfc.MISSING and [g[1] for g in gaps] == [1, 2])
+check("an empty list is not set", solarfc.read_sum([], [], NOW)
+      == (None, solarfc.NOT_SET, ())
+      and solarfc.read_sum([], members(st("5")), NOW)[1] == solarfc.NOT_SET)
+fc, _w, _g = solarfc.read_sum(members(st("5", at=NOW - timedelta(hours=2)),
+                                      st("4")), [], NOW)
+check("the forecast's time is the oldest member's report",
+      fc.at == NOW - timedelta(hours=2))
+
+# Tomorrow.
+fc, why, gaps = solarfc.read_sum(members(st("5"), st("4")),
+                                 members(st("12"), st("8000", "Wh")), NOW)
+check("tomorrow: 12 + 8 = 20 kWh, and today is 9",
+      fc is not None and near(fc.tomorrow.kwh, 20.0) and near(fc.today.kwh,
+                                                              9.0)
+      and near(fc.between(TOM, TOM + timedelta(days=1)), 20.0))
+for name, t2, w in (("unavailable", st("unavailable"), solarfc.MISSING),
+                    ("stale", st("8", at=OLD), solarfc.STALE),
+                    ("in W", st("8", "W"), solarfc.UNIT)):
+    fc, why, gaps = solarfc.read_sum(members(st("5"), st("4")),
+                                     members(st("12"), t2), NOW)
+    check(f"a tomorrow member {name}: tomorrow is not used (not 12 kWh), "
+          f"today is kept, the member is named",
+          fc is not None and fc.tomorrow is None and near(fc.today.kwh, 9.0)
+          and why is None
+          and gaps == (("tomorrow", 2, "sensor.fc_2", w),)
+          and fc.between(NOW, TOM + timedelta(hours=9)) is None)
+fc, _w, gaps = solarfc.read_sum(members(st("5"), st("4")), [], NOW)
+check("no tomorrow list: today only, nothing named",
+      fc.tomorrow is None and gaps == ())
+
+# Hourly splits.
+sol = [{"period_start": (UTC0 + timedelta(minutes=30 * i)).isoformat(),
+        "pv_estimate": 2.0 if 20 <= i < 36 else 0.0} for i in range(48)]
+wh = {(UTC0 + timedelta(hours=h)).isoformat(): (1000.0 if 8 <= h < 16
+                                                 else 0.0)
+      for h in range(24)}
+fc, _w, _g = solarfc.read_sum(members(st("8.0", detailedForecast=sol),
+                                      st("7.0", wh_period=wh)), [], NOW)
+one_s = solarfc.read(st("8.0", detailedForecast=sol), None, NOW)[0]
+one_w = solarfc.read(st("7.0", wh_period=wh), None, NOW)[0]
+spans = [(NOW, END)] + [
+    (datetime(2026, 9, 21, h, tzinfo=L), datetime(2026, 9, 21, h + 1,
+                                                  tzinfo=L))
+    for h in range(9, 20)]
+check("every member has a split: the splits are merged (hour by hour, the "
+      "sum of each member's own split)",
+      fc.today.periods and near(fc.today.kwh, 15.0)
+      and all(near(fc.between(a, b), one_s.between(a, b)
+                   + one_w.between(a, b)) for a, b in spans))
+check("...so 10:00-12:00 is 2 (Solcast) + 2 (Open-Meteo) = 4 kWh",
+      near(fc.between(datetime(2026, 9, 21, 10, tzinfo=L),
+                      datetime(2026, 9, 21, 12, tzinfo=L)), 4.0))
+fc, _w, _g = solarfc.read_sum(members(st("8.0", detailedForecast=sol),
+                                      st("7.0")), [], NOW)
+bell = solarfc.read(st("15.0"), None, NOW)[0]
+check("one member without a split: the sum goes on the bell, as one "
+      "state-only sensor of 15 kWh would",
+      fc.today.periods == () and near(fc.today.kwh, 15.0)
+      and all(near(fc.between(a, b), bell.between(a, b)) for a, b in spans))
+wht = {(TOM + timedelta(hours=h)).isoformat(): (500.0 if 8 <= h < 16 else 0)
+       for h in range(24)}
+fc, _w, _g = solarfc.read_sum(members(st("5")),
+                              members(st("4", wh_period=wht),
+                                      st("4", wh_period=wht)), NOW)
+check("tomorrow's splits are merged too (8 x 0.5 kWh each, 8 in all)",
+      fc.tomorrow.periods and near(fc.between(TOM, TOM + timedelta(days=1)),
+                                   8.0)
+      and near(fc.between(TOM + timedelta(hours=8),
+                          TOM + timedelta(hours=10)), 2.0))
+fc, _w, _g = solarfc.read_sum(members(st("5")),
+                              members(st("4", wh_period=wht), st("4")), NOW)
+check("...and fall back to the bell when one has none",
+      fc.tomorrow.periods == () and near(fc.tomorrow.kwh, 8.0))
+
+# One member is read().
+TODAYS = [st("12.5"), st("12500", "Wh"), st("0.0125", "MWh"), st("12.5", "W"),
+          st("12.5", None), st("unavailable"), st("unknown"), None, st("-1"),
+          st("lots"), st("12.5", at=OLD), st("12.5", at=NOW + timedelta(
+              hours=1)), st("8.0", detailedForecast=sol),
+          st("7.0", wh_period=wh), st("0")]
+TOMS = [None, st("20"), st("20", at=OLD), st("unavailable"), st("20", "W"),
+        st("4", wh_period=wht)]
+WHENS = [NOW, MID, datetime(2026, 9, 21, 19, 30, tzinfo=L)]
+same, n = True, 0
+for now in WHENS:
+    for a in TODAYS:
+        for b in TOMS:
+            n += 1
+            one = solarfc.read(a, b, now)
+            got = solarfc.read_sum([("sensor.f", a)],
+                                   [("sensor.t", b)] if b is not None
+                                   else [], now)
+            same = same and got[:2] == one
+check(f"one member per day gives exactly what read() gives ({n} cases: "
+      f"units, refusals, stale, splits, tomorrow)", same and n == 270)
+
+# ============================================================================ #
+print("2. entities")
+E = solarfc.entities
+check("the single key alone", E({"pv_forecast_entity": "sensor.a"})
+      == ("sensor.a",))
+check("the list alone, in order", E({"pv_forecast_entities": [
+    "sensor.b", "sensor.a"]}) == ("sensor.b", "sensor.a"))
+check("a list with an entry replaces the single key",
+      E({"pv_forecast_entity": "sensor.a",
+         "pv_forecast_entities": ["sensor.b"]}) == ("sensor.b",))
+check("an empty list or blank rows use the single key",
+      E({"pv_forecast_entity": "sensor.a", "pv_forecast_entities": []})
+      == ("sensor.a",)
+      and E({"pv_forecast_entity": "sensor.a",
+             "pv_forecast_entities": ["", " "]}) == ("sensor.a",))
+check("a repeated id counts once (it would double that forecast)",
+      E({"pv_forecast_entities": ["sensor.a", "sensor.b", "sensor.a"]})
+      == ("sensor.a", "sensor.b"))
+check("tomorrow reads its own keys",
+      E({"pv_forecast_entities": ["sensor.a"],
+         "pv_forecast_tomorrow_entities": ["sensor.t1", "sensor.t2"]},
+        tomorrow=True) == ("sensor.t1", "sensor.t2")
+      and E({"pv_forecast_tomorrow_entity": "sensor.t"}, tomorrow=True)
+      == ("sensor.t",))
+check("nothing set: ()", E({}) == () and E({}, tomorrow=True) == ())
+
+# ============================================================================ #
+print("3. options")
+F = validate._forecast_problems
+for one, many in (solarfc.TODAY_KEYS, solarfc.TOMORROW_KEYS):
+    p = F({one: "sensor.a", many: ["sensor.b", "sensor.c"]})
+    check(f"{one} and {many} both set: refused, one plain message that "
+          f"says which to keep",
+          len(p) == 1 and "not both" in p[0] and "Keep the list" in p[0]
+          and one in p[0] and many in p[0] and len(p[0].split()) <= 30)
+    check(f"...{many} alone is fine, and so is {one} alone",
+          not F({many: ["sensor.b", "sensor.c"]}) and not F({one: "sensor.a"})
+          and not F({one: "sensor.a", many: []})
+          and not F({one: "", many: ["sensor.b"]}))
+    check(f"...blank rows in {many} are ignored, alone or beside {one}",
+          not F({many: ["", None, "sensor.b"]})
+          and not F({one: "sensor.a", many: ["", None]}))
+    p = F({many: ["sensor.b", "number.x"]})
+    check(f"...an entry in {many} that is not a sensor is refused",
+          len(p) == 1 and "only sensors" in p[0] and "number.x" in p[0])
+    check(f"...and {many} that is not a list is refused",
+          F({many: "sensor.b"}) and "list of sensors" in F({many: "x"})[0])
+with open(os.path.join(HERE, "translations", "en.yaml"),
+          encoding="utf-8") as fh:
+    EN = fh.read()
+for k in solarfc.TODAY_KEYS + solarfc.TOMORROW_KEYS:
+    name = re.search(rf"^  {k}:\n    name: \"Hardware · ([^\"(]+?)"
+                     rf"(?: \(kWh\))?\"$", EN, re.M)
+    check(f"the refusal names {k} by its label on the tab",
+          name is not None
+          and f"“{name.group(1)}” ({k})" in validate.S(k))
+print("    " + F({"pv_forecast_entity": "sensor.a",
+                  "pv_forecast_entities": ["sensor.b"]})[0])
+VBASE = {"setpoint_entity": "number.goodwe_setpoint", "max_w": 2000,
+         "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+         "meter_source": "off", "maintenance_charge_w": 2000,
+         "maintenance_discharge_w": 2000, "battery_modes_enabled": True}
+check("the start-up check refuses both keys set for a day",
+      any("not both" in p for p in validate.validate_startup_config(
+          dict(VBASE, pv_forecast_tomorrow_entity="sensor.a",
+               pv_forecast_tomorrow_entities=["sensor.b"])))
+      and validate.validate_startup_config(
+          dict(VBASE, pv_forecast_entities=["sensor.a", "sensor.b"],
+               pv_forecast_tomorrow_entities=["sensor.c", "sensor.d"]))
+      == [])
+notes = []
+validate._entity_notes(notes, dict(VBASE, pv_forecast_entities=[
+    "sensor.a", "sensor.b", "sensor.gone"]),
+    {"sensor.a": {"unit": "kWh"}, "sensor.b": {"unit": "W"}})
+check("settings notes: a listed sensor not in kWh, and one Home Assistant "
+      "does not have, are each named",
+      any("sensor.b" in n.text and "kWh" in n.text for n in notes)
+      and any("sensor.gone" in n.text for n in notes)
+      and not any("sensor.a " in n.text for n in notes))
+notes = []
+validate._entity_notes(notes, dict(VBASE, pv_forecast_tomorrow_entities=[
+    "sensor.t"]), {"sensor.t": {"unit": "kWh"}})
+check("a tomorrow list without today's forecast gets the same warning as "
+      "the single key", any("used only with today's" in n.text
+                            for n in notes))
+notes = []
+validate._entity_notes(notes, {"pv_forecast_entities": ["sensor.a"]},
+                       {"sensor.a": {"unit": "kWh"}})
+check("a list with battery modes off gets the 'unused' note",
+      any("battery modes on" in n.text for n in notes))
+with open(os.path.join(HERE, "config.yaml"), encoding="utf-8") as fh:
+    CFG = fh.read()
+for k in ("pv_forecast_entities", "pv_forecast_tomorrow_entities"):
+    check(f"config.yaml: {k} defaults to [] (load-bearing) and is a list "
+          f"of str",
+          re.search(rf"^  {k}: \[\]$", CFG, re.M) is not None
+          and re.search(rf"^  {k}:\n    - str$", CFG, re.M) is not None)
+for k in solarfc.TODAY_KEYS[:1] + solarfc.TOMORROW_KEYS[:1]:
+    check(f"config.yaml: {k} is unchanged (str?, default \"\")",
+          re.search(rf"^  {k}: \"\"$", CFG, re.M) is not None
+          and re.search(rf"^  {k}: str\?$", CFG, re.M) is not None)
+
+# ============================================================================ #
+print("4. the real controller")
+A, B = "inverter-a", "inverter-b"
+# Prices as in test_modes_p4: cheap 01:00-03:00, dear 19:00-20:00 local.
+DAYW = [0.20] * 96 * 2
+for i in list(range(4, 12)) + list(range(100, 108)):
+    DAYW[i] = 0.02
+for i in list(range(76, 80)) + list(range(172, 176)):
+    DAYW[i] = 0.40
+WPTS = [(UTC0 + timedelta(minutes=15 * i), 900, p)
+        for i, p in enumerate(DAYW)]
+SF_LS = {"a": (True, "solar_first", False),
+         "b": (True, "leftover_solar", False)}
+# Each fake sensor: (share of the day's sun, has a split, status).
+SENSORS = {}
+FC_KWH = [1.0]
+START = [UTC0]
+CALLS = []
+
+
+async def _sensor(self, e):
+    CALLS.append(("start", e))
+    await asyncio.sleep(0)
+    CALLS.append(("end", e))
+    now = START[0] + timedelta(seconds=self.t)
+    share, split, status = SENSORS[e]
+    if status == "down":
+        return {"state": "unavailable", "attributes": {},
+                "last_updated": now.isoformat()}
+    at = now - timedelta(hours=4) if status == "stale" else now
+    loc = now.astimezone(L)
+    d0 = loc.replace(hour=0, minute=0, second=0, microsecond=0)
+    if e.startswith("sensor.tom"):
+        d0 += timedelta(days=1)
+    wh = {(d0 + timedelta(hours=h)).astimezone(timezone.utc).isoformat():
+          (FC_KWH[0] * 100.0 * share if 8 <= h < 18 else 0.0)
+          for h in range(24)}
+    left = sum(v for k, v in wh.items()
+               if datetime.fromisoformat(k) >= now) / 1000.0
+    attrs = {"unit_of_measurement": "kWh"}
+    if split:
+        attrs["wh_period"] = wh
+    return {"state": f"{left:.6f}", "attributes": attrs,
+            "last_updated": at.isoformat(), "last_reported": at.isoformat()}
+
+
+rp.Hass.state = _sensor
+
+
+def seed(c):
+    if c.house_profile is not None:
+        hp = dayplan.HouseProfile()
+        t = UTC0 - timedelta(days=1)
+        while t < UTC0:
+            h = t.astimezone(L).hour
+            hp.add(t, 3000.0 if 17 <= h < 22 else 600.0)
+            t += timedelta(seconds=5)
+        hp.add(t, None)
+        c.house_profile = hp
+
+
+def run(opts, hours=4.0, modes=True):
+    start = UTC0 + timedelta(hours=0.75)
+    START[0] = start
+    rows = []
+
+    def cb(c, h, now, pr):
+        sh = dict(c.allocation.shares) if c.allocation is not None and \
+            c.allocation.shares else {}
+        rows.append((now, round(h.grid(), 6), tuple(sorted(sh.items())),
+                     getattr(c.arb, "action", None),
+                     tuple(sorted(c.mode_tick.roles.items()))
+                     if c.mode_tick else (),
+                     tuple(sorted((u, round(p.soc, 6))
+                                  for u, p in h.plants.items())),
+                     tuple(sorted((c.plan_targets() or {}).items())),
+                     None if c.day_plan is None else c.day_plan.verdict))
+    _st, c = rp.run("p3_ls" if modes else "modes_off", [(UTC0.timestamp()
+                                                         - 10, 800.0)],
+                    WPTS, start, 3600 * hours, check=cb,
+                    soc0={"a": 60.0, "b": 30.0}, choice=SF_LS,
+                    extra=dict({"cycle_cost_threshold_eur": 0.20}, **opts),
+                    patch=seed)
+    return rows, c
+
+
+def fc_rows(c):
+    return [r for r in c.checks() if r["id"] == "solar_forecast"]
+
+
+def fc_events(c):
+    return [e for e in c.events if "solar forecast" in e]
+
+
+SENSORS.update({
+    "sensor.all": (1.0, True, "ok"), "sensor.h1": (0.5, True, "ok"),
+    "sensor.h2": (0.5, True, "ok"), "sensor.h2_flat": (0.5, False, "ok"),
+    "sensor.down": (0.5, True, "down"), "sensor.stale": (0.5, True, "stale"),
+    "sensor.tom_all": (1.0, True, "ok"), "sensor.tom_h1": (0.5, True, "ok"),
+    "sensor.tom_down": (0.5, True, "down"), "sensor.none": (1.0, True, "down"),
+})
+single, c_single = run({"pv_forecast_entity": "sensor.all"})
+listed, c_listed = run({"pv_forecast_entities": ["sensor.all"]})
+plans = [r for r in single if r[6]]
+check(f"the run makes a day plan with a level ({len(plans)} of "
+      f"{len(single)} cycles), so the forecast steers something",
+      plans and any(r[7] is not None for r in single))
+check("a one-member list runs exactly like the single key: every grid "
+      "figure, share, action, role, level and plan, cycle by cycle",
+      single == listed and len(single) > 2000)
+check("...and says the same on the status page and in the action log",
+      fc_rows(c_single) == fc_rows(c_listed) == []
+      and fc_events(c_single) == fc_events(c_listed))
+halves, c_halves = run({"pv_forecast_entities": ["sensor.h1", "sensor.h2"]})
+check("two members of half the sun each run like one sensor of all of it",
+      [r[:6] + (r[7],) for r in halves] == [r[:6] + (r[7],) for r in single]
+      and all(len(a[6]) == len(b[6]) and all(
+          k1 == k2 and abs(v1 - v2) < 1e-6 for (k1, v1), (k2, v2)
+          in zip(a[6], b[6])) for a, b in zip(halves, single)))
+none_, c_none = run({"pv_forecast_entity": "sensor.none"})
+check("(the comparison bites: no forecast runs differently)",
+      [r[:6] for r in none_] != [r[:6] for r in single])
+for name, mem in (("unavailable", "sensor.down"), ("stale", "sensor.stale")):
+    rows, c = run({"pv_forecast_entities": ["sensor.h1", mem]})
+    check(f"a member {name}: the controller runs exactly as with the single "
+          f"forecast unavailable (no partial sum)", rows == none_)
+    check(f"...the status page names it by place, in one short line",
+          [r["text"] for r in fc_rows(c)] == [
+              "Solar forecast for today: not used, source 2 of 2 has no "
+              "reading"] and fc_rows(c)[0]["warn"])
+    ev = fc_events(c)
+    check(f"...and the action log names it once in {len(single)} cycles",
+          len(ev) == 1 and mem in ev[0] and "today" in ev[0])
+one_down, c_one_down = run({"pv_forecast_entities": ["sensor.none"]})
+check("a one-member list that is down runs, shows and logs exactly like the "
+      "single key down", one_down == none_
+      and fc_rows(c_one_down) == fc_rows(c_none)
+      and fc_events(c_one_down) == fc_events(c_none))
+# A forecast missing from the start logs nothing (the start state is
+# already "missing"); that is release/1.0's behaviour, kept.
+check("the single key down: no new row and no new log line",
+      fc_rows(c_none) == [] and fc_events(c_none) == [])
+CALLS.clear()
+rows, c = run({"pv_forecast_entities": ["sensor.h1", "sensor.h2"],
+               "pv_forecast_tomorrow_entities": ["sensor.tom_h1",
+                                                 "sensor.tom_down"]},
+              hours=0.2)
+check("a tomorrow member down: today is used, tomorrow is not, and the row "
+      "says so",
+      c.solar_fc is not None and c.solar_fc.tomorrow is None
+      and [r["text"] for r in fc_rows(c)] == [
+          "Solar forecast for tomorrow: not used, source 2 of 2 has no "
+          "reading"]
+      and len(fc_events(c)) == 1 and "sensor.tom_down" in fc_events(c)[0])
+check("...and the page hint says tomorrow's forecast is not used",
+      (c.hint or "").endswith(messages.hint("forecast_no_tomorrow")))
+check("...and Home titles the row as the solar forecast, in EN and NL",
+      [a["title"] for a in homeview.attention(fc_rows(c))]
+      == ["Solar forecast"]
+      and uitext.words("nl")["home_words"]["attn"]["solar_forecast"]
+      == "Zonneprognose")
+first = CALLS[:8]
+check("every member of both days is read in one gather (all four start "
+      "before any ends)",
+      [k for k, _e in first] == ["start"] * 4 + ["end"] * 4
+      and sorted(e for _k, e in first[:4]) == sorted(
+          ["sensor.h1", "sensor.h2", "sensor.tom_h1", "sensor.tom_down"]))
+rows, c = run({"pv_forecast_entities": ["sensor.h1"],
+               "pv_forecast_tomorrow_entities": ["sensor.tom_all"]},
+              hours=0.2)
+check("tomorrow: a one-member list is read and counted",
+      c.solar_fc is not None and c.solar_fc.tomorrow is not None)
+rows, c = run({"pv_forecast_entities": ["sensor.h1", "sensor.h2_flat"]},
+              hours=0.2)
+check("a member without a split: the controller's forecast is on the bell",
+      c.solar_fc is not None and c.solar_fc.today.periods == ())
+CALLS.clear()
+run({"pv_forecast_entities": ["sensor.h1", "sensor.h2"]}, hours=0.2,
+    modes=False)
+check("battery modes off: no forecast member is read", CALLS == [])
+check("the status row is a STYLE status row (<= 15 words, no entity id)",
+      all(len(t.split()) <= 15 and "sensor." not in t for t in (
+          messages.row_forecast_gap("today", [2, 3], 3),
+          messages.row_forecast_gap("tomorrow", [1], 2))))
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)}")
+    for f in fails:
+        print("  -", f)
+    sys.exit(1)
+print("all checks passed")
@@ -0,0 +1,307 @@
+"""Runnable check for SAFETY-107: a refusal held while another writer has the
+wire is learned once. `python3 test_safety107.py`
+
+A full pack under a maintenance charge in a cheap window took no charge. At
+one inverter SAFETY-52's "another writer" end then fired every cycle, and
+compute() learned the refusal again in the same cycle: "BATTERY REFUSES" and
+"BATTERY REFUSES ENDED: another writer" each second on the rig (MAINT-13 F5).
+Now another writer ends a refusal only if compute(), judging it afresh
+against that writer's ask, no longer finds it. DECISIONS/SAFETY-107.
+
+Drives the REAL Controller (read_inputs + cycle) on opt11_identity's rig.
+1. The card's case: 15 min of a full pack under a maintenance charge, N=1
+   and N=2, at a 1, 2 and 5 s meter: at most 2 refusal lines, held throughout.
+2. Other writers: a trade and the peak guard over a battery that gives
+   nothing. One episode each, no flap.
+3. A refusal still ends: a different writer really takes over, the battery
+   delivers again, a writer asks the other way, stop. The probe clock.
+
+4. Not covered, pinned: a perfectly flat reading under a writer.
+
+Mutations (MUTATION.md, purged copies) are listed in DECISIONS/SAFETY-107.
+"""
+
+import functools
+import logging
+import os
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import safety79_identity as s79                                # noqa: E402
+import app.main as app_main                                    # noqa: E402
+from app import control                                        # noqa: E402
+from app.arbiter import Claim, P_ARBITRAGE                     # noqa: E402
+from app.main import Controller                                # noqa: E402
+from named_absence import nth, present                         # noqa: E402
+
+fails = []
+QUARTER = 900.0
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def run(n=1, *, plant, house, dur=QUARTER, tick=5.0, maint=True,
+        cheap=lambda c, t: True, trade=lambda t: None, p1=False, cap=2500,
+        auto=lambda t: True):
+    """Rows (t, commands, site target, loop reason, refused, refused_at,
+    unit refusals) and every action-log line as (t, line, hint).
+
+    `plant(u, t, cmd)` is battery u's reading. `cheap(c, t)` opens the cheap
+    window. `trade(t)` is a SET claim at P_ARBITRAGE added to the claim list
+    (a writer above the loop), or None."""
+    log, rows, now = [], [], [0.0]
+    real_power, real_tick = rig._Hass.power, rig.TICK
+    real_log, real_resolve, real_c = (Controller.log_event, app_main.resolve,
+                                      rig.Controller)
+
+    def power(self, u):
+        return float(plant(u, self.t, self.cmd[u]))
+
+    def log_event(self, msg, hint=None):
+        log.append((now[0], msg, hint))
+        return real_log(self, msg, hint)
+
+    def resolve(claims, **kw):
+        v = trade(now[0])
+        if v is not None:
+            claims.append(Claim.set("arbitrage", P_ARBITRAGE, v, "trade"))
+        return real_resolve(claims, **kw)
+
+    def before(c, t):
+        now[0] = t
+        if not getattr(c.hass, "_s107", False):
+            read = c.hass.number
+
+            async def number(e, invert=False):
+                if e == "sensor.pnow":
+                    return 0.05 if cheap(c, c.hass.t) else 0.30
+                if e == "sensor.pavg":
+                    return 0.20
+                return await read(e, invert)
+            c.hass.number, c.hass._s107 = number, True
+        if p1:
+            s79._feed(c, t)
+        c.auto = auto(t)
+
+    def on_cycle(c, t):
+        rows.append((t, tuple(c.hass.cmd[u] for u in "ab"[:n]), c.target,
+                     c.loop_reason, c.batt_refused, c.batt_refused_at,
+                     tuple(i.refused for i in c.inverters)))
+
+    extra = {"price_now_entity": "sensor.pnow",
+             "price_avg_entity": "sensor.pavg"}
+    if maint:
+        extra.update({"maintenance_enabled": True,
+                      "maintenance_start_hour": 11,
+                      "maintenance_charge_w": 2000})
+    if p1:
+        extra.update(s79.P1, peak_cap_w=cap)
+    db = os.path.join(tempfile.mkdtemp(prefix="s107-"), "tariff.db")
+    rig._Hass.power, rig.TICK = power, tick
+    Controller.log_event, app_main.resolve = log_event, resolve
+    rig.Controller = functools.partial(real_c, peak_db_path=db)
+    try:
+        _, c = rig.run(n, extra=extra, dur=dur, load=house,
+                       soc=lambda u, t: 50.0, cut=lambda u, t: False,
+                       before=before, on_cycle=on_cycle,
+                       store=s79.store_charging(n) if maint else rig._Store())
+    finally:
+        rig._Hass.power, rig.TICK = real_power, real_tick
+        Controller.log_event, app_main.resolve = real_log, real_resolve
+        rig.Controller = real_c
+    return rows, log, c
+
+
+def full_a(u, t, cmd):
+    """A takes no charge (a full pack), its reading jittering by a few watts
+    as a real one does; B follows."""
+    return -1.0 - int(t) % 3 if u == "a" and cmd < 0 else round(cmd)
+
+
+def flat_a(u, t, cmd):
+    """`full_a` with a perfectly flat reading (the stale-reading gate trips)."""
+    return -1.0 if u == "a" and cmd < 0 else round(cmd)
+
+
+def empty_a(u, t, cmd):
+    """A gives nothing (an empty pack), its reading jittering by a few watts
+    (SAFETY-73's jitter shape, so the stale-reading gate stays out of it);
+    B follows."""
+    return -4.0 - int(t) % 3 if u == "a" and cmd >= -4.0 else round(cmd)
+
+
+def lines(log, word="REFUSES"):
+    return [x for x in log if word in x[1]]
+
+
+def ends(log):
+    return [x for x in log if "REFUSES ENDED" in x[1]]
+
+
+def refused(r):
+    """Row r holds a refusal (site at N=1, any unit at N>1)."""
+    return bool(r[4]) or any(r[6])
+
+
+def held_from(rows):
+    """True when, once learned, the refusal is held on every later row."""
+    first = next((k for k, r in enumerate(rows) if refused(r)), None)
+    return first is not None and all(refused(r) for r in rows[first:])
+
+
+# ==============================================================================
+print("1. the card: a full pack under a maintenance charge, 15 min")
+# ==============================================================================
+for n, tick, house in ((n, k, h) for n in (1, 2) for k in (1.0, 2.0, 5.0)
+                   for h in (800.0, -1500.0)):
+    rows, log, c = run(n, plant=full_a, house=lambda t: house, tick=tick)
+    ref = lines(log)
+    tag = f"N={n}, {tick:.0f} s meter, house {house:+.0f} W"
+    print(f"    {tag}: {len(ref)} refusal line(s): "
+          + " / ".join(x[1][:60] for x in ref))
+    check(f"{tag}: at most 2 refusal lines in 15 min (rig: 548 + 548)",
+          1 <= len(ref) <= 2)
+    check(f"{tag}: no end line", not ends(log))
+    check(f"{tag}: learned once and held to the end", held_from(rows))
+    # N=1: the charge's ceiling stays on the wire. N=2: SAFETY-73 closes A
+    # in the refused direction, as before.
+    check(f"{tag}: still in its charge, the wire as before",
+          c.maints[0].phase == "charge"
+          and all(r[1][0] == (-2000.0 if n == 1 else 0.0)
+                  for r in rows[-10:]))
+    # The hint under the buttons is set at most once for the refusal.
+    check(f"{tag}: the refusal hint is set once",
+          sum(1 for x in ref if x[2] is not None) == 1)
+
+# The probe clock: while the charge holds the wire no probe is tried (the
+# loop's ask is not on the wire), so the action log stays quiet.
+rows, log, _ = run(1, plant=full_a, house=lambda t: 800.0, dur=3600.0)
+check("N=1, an hour: still one line, no probe tried under the charge",
+      len(lines(log)) == 1
+      and not any(r[3] == control.PROBING for r in rows))
+
+# ==============================================================================
+print("\n2. other writers: a trade and the peak guard, no flap")
+# ==============================================================================
+# A trade (a SET above the loop) asks a full pack to charge for 15 min.
+rows, log, _ = run(1, plant=full_a, house=lambda t: 800.0, maint=False,
+                   trade=lambda t: -1500.0)
+print(f"    trade into a full pack: {len(lines(log))} line(s)")
+check("a trade into a full pack: learned once, held, no end",
+      len(lines(log)) == 1 and not ends(log) and held_from(rows))
+# The peak guard asks an empty pack to give while the house is over the limit.
+rows, log, c = run(1, plant=empty_a, house=lambda t: 4500.0, maint=False,
+                   p1=True)
+print(f"    peak guard on an empty pack: {len(lines(log))} line(s), "
+      f"guard floor {c.peak_guard.floor_w if c.peak_guard else None}")
+check("the peak guard on an empty pack: the guard holds the wire",
+      c.peak_guard is not None and c.peak_guard.engaged)
+check("the peak guard on an empty pack: at most 2 lines, held to the end",
+      1 <= len(lines(log)) <= 2 and held_from(rows))
+
+# ==============================================================================
+print("\n3. a refusal still ends")
+# ==============================================================================
+# a. Learned by the loop on an empty pack; at 300 s a trade really takes the
+#    wire and asks it to give 2000 W. The refusal was learned against the
+#    loop's ask: it ends, then is learned against the trade, once.
+rows, log, _ = run(1, plant=empty_a, house=lambda t: 2000.0, maint=False,
+                   trade=lambda t: 2000.0 if 300.0 <= t < 900.0 else None,
+                   dur=1200.0)
+e = ends(log)
+print("    " + " / ".join(f"{x[0]:.0f} s {x[1][:45]}" for x in lines(log)))
+check("a different writer takes over: the refusal ends, 'another writer'",
+      len(e) == 1 and "another writer" in e[0][1] and 300.0 < e[0][0] < 320.0)
+check("...and is learned again against the trade, once, and held",
+      len(lines(log)) == 3 and held_from([r for r in rows if r[0] > 400.0]))
+check("...and the loop keeps it when the trade leaves (no line)",
+      all(x[0] < 900.0 for x in lines(log)) and refused(nth(rows, -1)))
+# The writer asks the other way, which the empty pack takes.
+rows, log, _ = run(1, plant=empty_a, house=lambda t: 2000.0, maint=False,
+                   trade=lambda t: -1500.0 if t >= 300.0 else None)
+e = ends(log)
+check("a writer that asks the other way ends it ('another writer')",
+      len(e) == 1 and "another writer" in e[0][1] and present(nth(rows, -1))
+      and not refused(nth(rows, -1)))
+# b. The full pack starts taking charge again under the same writer.
+rows, log, _ = run(1, plant=lambda u, t, cmd: (
+    round(cmd) if t >= 400.0 else full_a(u, t, cmd)), house=lambda t: 800.0)
+e = ends(log)
+print("    " + " / ".join(f"{x[0]:.0f} s {x[1][:45]}" for x in lines(log)))
+check("the battery takes charge again: the refusal ends once, on its reading",
+      len(e) == 1 and "the battery gives power" in e[0][1]
+      and 400.0 <= e[0][0] < 430.0 and present(nth(rows, -1))
+      and not refused(nth(rows, -1)))
+# c. Stop and start still end it.
+rows, log, _ = run(1, plant=full_a, house=lambda t: 800.0,
+                   auto=lambda t: not 500.0 <= t < 520.0)
+e = ends(log)
+check("stopping control still ends it", any("control stopped" in x[1]
+                                            for x in e))
+# d. The probe clock. Learned under the charge; the cheap window closes when
+#    the refusal is 910 s old, and the loop holds the wire (a surplus, so it
+#    wants to charge). The first probe is a full PROBE_EVERY_S after the
+#    window closed, as before: never at once.
+close = [None]
+
+
+def window(c, t):
+    if close[0] is None and c.batt_refused:
+        close[0] = t + 910.0
+    return close[0] is None or t < close[0]
+
+
+rows, log, _ = run(1, plant=full_a, house=lambda t: -1500.0, cheap=window,
+                   dur=3000.0)
+probes = [r[0] for r in rows if r[3] == control.PROBING]
+print("    " + " / ".join(f"{x[0]:.0f} s {x[1][:45]}" for x in lines(log)))
+print(f"    window closed at {close[0]} s, first probe at "
+      f"{probes[0] if probes else None} s")
+check("the refusal carries over to the loop with no line",
+      len(lines(log)) == 1 and held_from(rows))
+check("the first probe after the writer left comes PROBE_EVERY_S later",
+      close[0] is not None and bool(probes)
+      and probes[0] >= close[0] + control.PROBE_EVERY_S - 10.0)
+# e. A writer turns round on a dead pack with no gap. The evidence restarts
+#    on the new sign (SAFETY-94), so the old refusal ends at once and the
+#    other way is learned once, ~12 cycles later.
+rows, log, _ = run(1, plant=lambda u, t, cmd: (
+    -2.0 - int(t) % 3 if u == "a" else round(cmd)), house=lambda t: 2000.0,
+    maint=False, trade=lambda t: 2000.0 if t < 300.0 else -2000.0)
+e = ends(log)
+print("    " + " / ".join(f"{x[0]:.0f} s {x[1][:45]}" for x in lines(log)))
+check("a writer turns round on a dead pack: one end, then the other way",
+      len(lines(log)) == 3 and len(e) == 1 and 300.0 < e[0][0] < 400.0
+      and present(nth(rows, -1)) and nth(rows, -1)[4] == -1)
+
+# ==============================================================================
+print("\n4. not covered: a perfectly flat reading under a writer")
+# ==============================================================================
+# The stale-reading gate trips on a flat reading while the command moves,
+# stops the site and seeds the refusal (SAFETY-52 decision 3). After the stop
+# the writer's ask comes back fresh, compute() has no saturation history
+# against it yet, so the refusal ends at the first cycle and the next trip
+# seeds it again: one pair per gate cycle, as on release/1.0 (the commands
+# are the same; DECISIONS/SAFETY-107 "Not covered"). Pinned so a change shows.
+rows, log, _ = run(1, plant=flat_a, house=lambda t: -1500.0)
+trips = len(lines(log, "STALE inverter"))
+print(f"    flat reading, house -1500 W: {trips} gate trips, "
+      f"{len(lines(log))} refusal lines in 15 min")
+check("flat reading: no per-cycle flap, at most one pair per gate trip",
+      trips >= 1 and len(lines(log)) <= 2 * trips)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all SAFETY-107 checks passed")
@@ -0,0 +1,440 @@
+"""SAFETY-112: waiting for Home Assistant to finish starting.  `python3 -B test_safety112.py`
+
+The Supervisor answers 502 to every add-on read, write and websocket until
+Home Assistant is RUNNING (DECISIONS/SAFETY-112-waiting-for-home-assistant.md),
+so the add-on cannot control then. This file grades what it says meanwhile:
+
+1. The log: one WARNING when Home Assistant stops answering, one INFO line
+   every 5 minutes while it stays down, one INFO line with the wait when it
+   answers again. Only the API channel counts as "waiting": a 502 or a
+   refused connection turns it on, the next good read off, a timeout never.
+2. The status page, N=1 and N=2: the waiting row is first and red, and is the
+   banner. Home says "Waiting for Home Assistant" in English and Dutch, not
+   "Needs you now", unless a safety stop outranks it. The page script has it.
+3. Control is unchanged: the same readings give the same writes with the
+   waiting flag on or off, with 502 readings and with live ones.
+
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import asyncio
+import logging
+import os
+import re
+from types import SimpleNamespace
+
+from app import hass as _hass
+from app import messages
+from app.main import Controller
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+class _Rec(logging.Handler):
+    def __init__(self):
+        super().__init__(logging.DEBUG)
+        self.records = []
+
+    def emit(self, record):
+        self.records.append(record)
+
+
+def captured(fn):
+    rec, lg = _Rec(), logging.getLogger("goodwe.hass")
+    old = lg.level
+    lg.addHandler(rec)
+    lg.setLevel(logging.DEBUG)
+    try:
+        fn()
+    finally:
+        lg.removeHandler(rec)
+        lg.setLevel(old)
+    return [(r.levelno, r.getMessage()) for r in rec.records
+            if r.levelno >= logging.INFO]
+
+
+class Clock:
+    """`hass.time` stand-in: only `monotonic` is read by Outage."""
+
+    def __init__(self):
+        self.t = 1000.0
+
+    def monotonic(self):
+        return self.t
+
+
+def with_clock(fn):
+    clock, real = Clock(), _hass.time
+    _hass.time = SimpleNamespace(monotonic=clock.monotonic)
+    try:
+        return fn(clock)
+    finally:
+        _hass.time = real
+
+
+# --------------------------------------------------------------------------- #
+print("1. the log while Home Assistant does not answer")
+W, I = logging.WARNING, logging.INFO
+
+
+def outage(clock):
+    o = _hass.Outage()
+    o.down("api", "error 502", "read sensor.x: 502")
+    for t in (1, 60, 299):
+        clock.t = 1000 + t
+        o.down("api", "error 502", "read sensor.x: 502")
+    clock.t = 1300
+    o.down("api", "error 502", "")          # 5 minutes: the first reminder
+    clock.t = 1301
+    o.down("websocket", "the meter connection closed", "")
+    clock.t = 1599
+    o.down("api", "error 502", "")          # 299 s after the reminder: none
+    clock.t = 1600
+    o.down("api", "error 502", "")          # 10 minutes: the second
+    clock.t = 1640
+    o.up("api")
+    o.up("websocket")                       # 640 s in all
+    clock.t = 2000
+    o.down("api", "no connection", "")      # a new outage starts afresh
+    clock.t = 2030
+    o.up("api")
+
+
+lines = with_clock(lambda c: captured(lambda: outage(c)))
+check(f"one WARNING per outage, in plain words ({lines})",
+      [m for lv, m in lines if lv == W] == [
+          "Home Assistant is not answering (error 502), perhaps it is still "
+          "starting. Control waits and resumes by itself.",
+          "Home Assistant is not answering (no connection), perhaps it is "
+          "still starting. Control waits and resumes by itself."])
+check("one 'still waiting' line per 5 minutes down, with the time so far",
+      [m for lv, m in lines if lv == I and m.startswith("Still")] == [
+          "Still waiting for Home Assistant to finish starting, 5 minutes "
+          "so far.",
+          "Still waiting for Home Assistant to finish starting, 10 minutes "
+          "so far."])
+check("one INFO line when the last channel is back, with the wait, and a new "
+      "outage counts from its own start",
+      [m for lv, m in lines if lv == I and m.startswith("Home")] == [
+          "Home Assistant answers again after 11 minutes.",
+          "Home Assistant answers again after 30 seconds."])
+
+
+def channels(_clock):
+    o = _hass.Outage()
+    seen = [o.waiting()]
+    o.down("websocket", "the meter connection closed", "")
+    seen.append(o.waiting())
+    o.down("api", "error 502", "")
+    seen.append(o.waiting())
+    o.up("websocket")
+    seen.append(o.waiting())
+    o.up("api")
+    seen.append(o.waiting())
+    return seen
+
+
+check("waiting() follows the API channel only, not the meter websocket",
+      with_clock(channels) == [False, False, True, True, False])
+
+
+# The flag as `HomeAssistant.state()` sets it: a 502 or a refused connection
+# turns it on, the next good read turns it off, and a timeout (a slow Home
+# Assistant, not a starting one) leaves it alone.
+class _Answer:
+    def __init__(self, what):
+        self.what = what
+
+    async def __aenter__(self):
+        if isinstance(self.what, BaseException):
+            raise self.what
+        return self
+
+    async def __aexit__(self, *_a):
+        return False
+
+    @property
+    def status(self):
+        return self.what
+
+    def raise_for_status(self):
+        pass
+
+    async def json(self):
+        return {"state": "1"}
+
+
+class _Session:
+    def __init__(self, answers):
+        self.answers = list(answers)
+
+    def get(self, *_a, **_k):
+        return _Answer(self.answers.pop(0))
+
+
+def reads(answers):
+    async def go():
+        real, _hass.OUTAGE = _hass.OUTAGE, _hass.Outage()
+        lg = logging.getLogger("goodwe.hass")
+        lg.disabled = True
+        try:
+            h = _hass.HomeAssistant(_Session(answers), token="t")
+            seen = []
+            for _ in answers:
+                await h.state("sensor.x")
+                seen.append(_hass.OUTAGE.waiting())
+            return seen
+        finally:
+            _hass.OUTAGE = real
+            lg.disabled = False
+    return asyncio.run(go())
+
+
+check("a 502 read turns waiting on and the next good read turns it off",
+      reads([502, 200, 503, 404]) == [True, False, True, False])
+check("a refused connection is waiting too",
+      reads([_hass.aiohttp.ClientConnectionError(), 200]) == [True, False])
+check("a read timeout is not waiting",
+      reads([TimeoutError(), TimeoutError()]) == [False, False])
+
+
+# --------------------------------------------------------------------------- #
+print("2. the status page, N=1 and N=2")
+
+
+class _Hass:
+    session = None
+    token = ""
+
+    def __init__(self):
+        self.writes = []
+
+    async def limits(self, _e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def number(self, _e, invert=False):
+        return None                     # what a 502 read gives
+
+    async def state(self, _e):
+        return None
+
+    async def set_number(self, e, v):
+        self.writes.append((e, float(v)))
+        return False                    # what a 502 write gives
+
+    async def call(self, *_a):
+        return False
+
+    async def states(self):
+        return None
+
+
+class _Store:
+    def __init__(self):
+        self.data = {}
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def get(self, k, d=None):
+        return self.data.get(k, d)
+
+    def set_time(self, k, v):
+        self.data[k] = v.isoformat()
+
+    def get_time(self, k):
+        return None
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, *_a, **_k):
+        pass
+
+    def close(self):
+        pass
+
+
+ONE = {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+       "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+       "meter_source": "off", "max_w": 5000, "shadow_mode": "off",
+       "maintenance_enabled": False, "stale_input_s": 15}
+TWO = dict(ONE, setpoint_entity="", soc_entity="", batt_entity="", inverters=[
+    {"name": "inverter-a", "setpoint_entity": "number.a", "soc_entity":
+     "sensor.soc_a", "batt_entity": "sensor.batt_a", "max_w": 2500,
+     "bms_soc_floor": 10},
+    {"name": "inverter-b", "setpoint_entity": "number.b", "soc_entity":
+     "sensor.soc_b", "batt_entity": "sensor.batt_b", "max_w": 2500,
+     "bms_soc_floor": 10}])
+
+
+def make(opts, hass=None):
+    c = Controller(dict(opts), hass or _Hass(), _Store(), _Pub(),
+                   stop=asyncio.Event())
+    c.auto = True
+    for inv in c.inverters:
+        inv.dev_min, inv.dev_max = -5000.0, 5000.0
+    return c
+
+
+def waiting_on():
+    _hass.OUTAGE.down_on = {"api"}
+    _hass.OUTAGE.since = _hass.OUTAGE._told = _hass.time.monotonic()
+
+
+def waiting_off():
+    _hass.OUTAGE.down_on = set()
+
+
+BANNER = "Not ready — Waiting for Home Assistant to finish starting"
+for label, opts in (("N=1", ONE), ("N=2", TWO)):
+    c = make(opts)
+    waiting_off()
+    plain = c.checks()
+    pay_off = c.status_payload()
+    waiting_on()
+    rows = c.checks()
+    pay = c.status_payload()
+    pay_nl = c.status_payload(lang="nl")
+    waiting_off()
+    check(f"{label}: no waiting row while Home Assistant answers",
+          not [r for r in plain if r.get("id") == "home_assistant"]
+          and pay_off["state"]["kind"] != "waiting")
+    check(f"{label}: while it does not, the waiting row is first and red",
+          rows[0] == {"ok": False, "warn": False, "id": "home_assistant",
+                      "banner": messages.banner_ha_waiting(),
+                      "text": messages.row_ha_waiting()}
+          and rows[1:] == plain)
+    check(f"{label}: ...and it is the banner ({pay['banner']!r})",
+          pay["banner"] == BANNER and pay["level"] == "bad")
+    check(f"{label}: Home says waiting, not 'Needs you now' "
+          f"({pay['state']['pill']!r}, {pay['state']['sub']!r})",
+          pay["state"]["kind"] == "waiting"
+          and pay["state"]["pill"] == "Waiting for Home Assistant"
+          and pay["state"]["sub"] == "Control resumes by itself when Home "
+                                     "Assistant answers.")
+    check(f"{label}: ...and in Dutch ({pay_nl['state']['pill']!r})",
+          pay_nl["state"]["pill"] == "Wacht op Home Assistant"
+          and pay_nl["state"]["sub"] == "De regeling gaat vanzelf verder "
+                                        "zodra Home Assistant antwoordt.")
+    check(f"{label}: Needs attention lists it first, with its own title",
+          pay["attention"][0]["id"] == "home_assistant"
+          and pay["attention"][0]["title"] == "Home Assistant is not answering"
+          and pay_nl["attention"][0]["title"] == "Home Assistant antwoordt "
+                                                  "niet")
+
+# A safety stop outranks the wait: it still needs a person.
+c = make(TWO)
+c.inverters[1].sign_wd.tripped = True
+waiting_on()
+pay = c.status_payload()
+waiting_off()
+check(f"a safety stop keeps its banner and 'Needs you now' over the wait "
+      f"({pay['banner']!r}, {pay['state']['kind']!r})",
+      pay["banner"] == messages.banner_direction(True)
+      and pay["state"]["kind"] == "alarm")
+# A stalled control loop does not resume by itself, so it stays the headline.
+c = make(ONE)
+c.loop_pass_mono = 0.0
+waiting_on()
+rows, pay = c.checks(), c.status_payload()
+waiting_off()
+check(f"a stalled control loop stays first and keeps 'Needs you now' "
+      f"({pay['banner']!r})",
+      [r["id"] for r in rows[:2]] == ["controller", "home_assistant"]
+      and pay["state"]["kind"] == "alarm")
+c = make(dict(ONE, shadow_mode="on"))
+waiting_on()
+pay = c.status_payload()
+waiting_off()
+check("shadow mode keeps its own state over the wait",
+      pay["state"]["kind"] == "shadow")
+
+
+# The page script, read as text (the image has no JS engine): an amber dot,
+# and the batteries tab carries the banner like the other held states.
+JS = open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "app",
+                       "static", "app.js"), encoding="utf-8").read()
+check("the page script gives 'waiting' an amber dot",
+      re.search(r'alarm: " bad", waiting: " warn" \}\[st\.kind\]', JS)
+      is not None)
+check("...and shows it as the batteries-tab banner",
+      '["shadow", "stopped", "alarm", "waiting"].includes(S.state.kind)'
+      in JS)
+
+
+# --------------------------------------------------------------------------- #
+print("3. control is unchanged by the waiting flag")
+
+
+def run(opts, flag):
+    async def go():
+        h = _Hass()
+        c = make(opts, h)
+        (waiting_on if flag else waiting_off)()
+        targets = []
+        for _ in range(4):
+            await c.read_inputs()
+            await c.cycle()
+            await c.send_heartbeats(asyncio.get_running_loop().time(), 10.0)
+            targets.append(c.target)
+        waiting_off()
+        return targets, h.writes
+    return asyncio.run(go())
+
+
+for label, opts in (("N=1", ONE), ("N=2", TWO)):
+    off, on = run(opts, False), run(opts, True)
+    check(f"{label}: same targets and writes with the flag on or off "
+          f"({on[0]}, {len(on[1])} writes)", off == on)
+    check(f"{label}: ...and every write while Home Assistant does not answer "
+          f"asks 0 W", on[1] and all(v == 0.0 for _e, v in on[1]))
+
+
+# With 502 readings every write is 0 W whatever the flag says, so the check
+# above cannot see a flag that forces 0 W. Live readings can: the flag alone
+# must not change a non-zero write.
+class _LiveHass(_Hass):
+    async def number(self, e, invert=False):
+        v = {"sensor.grid": 900.0}.get(e, 50.0 if "soc" in e else 0.0)
+        return -v if invert else v
+
+    async def set_number(self, e, v):
+        self.writes.append((e, float(v)))
+        return True
+
+
+def run_live(opts, flag):
+    async def go():
+        h = _LiveHass()
+        c = make(opts, h)
+        (waiting_on if flag else waiting_off)()
+        for _ in range(4):
+            await c.read_inputs()
+            await c.cycle()
+            await c.send_heartbeats(asyncio.get_running_loop().time(), 10.0)
+        waiting_off()
+        return h.writes
+    return asyncio.run(go())
+
+
+for label, opts in (("N=1", ONE), ("N=2", TWO)):
+    off, on = run_live(opts, False), run_live(opts, True)
+    check(f"{label}: with live readings the flag changes no write "
+          f"({on[-2:]})", off == on and any(v != 0.0 for _e, v in on))
+
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    for f in fails:
+        print("  -", f)
+    raise SystemExit(1)
+print("all passed")
@@ -767,6 +767,79 @@ ok_i4, out_i4 = validate(dict(defaults, **{_mk: 24}))
 show("the range is unchanged: 24 is refused (`at most 23`)",
     (not ok_i4) and "at most 23" in str(out_i4), out_i4)

+print("\n== J. OPT-17: several solar forecast entities per day ==")
+# The same question as §G, for `pv_forecast_entity` /
+# `pv_forecast_tomorrow_entity` (`str?` since 0.15.0). Each refusal is
+# varied from the accepted baseline and asserted on the key's name.
+# DECISIONS/OPT-17-several-forecast-entities.md.
+FC_STORED = {"pv_forecast_entity": "sensor.energy_production_today_remaining",
+             "pv_forecast_tomorrow_entity": "sensor.energy_production_tomorrow"}
+_fc_old = {k: v for k, v in defaults.items()
+           if k not in ("pv_forecast_entities", "pv_forecast_tomorrow_entities")}
+_fc_base = MERGER.merge(copy.deepcopy(defaults),
+                        dict(_fc_old, **FC_STORED))
+ok_j, out_j = validate(_fc_base)
+show("a 0.17.0 blob (single forecast keys set, no list keys) validates "
+     "unchanged, and both new keys default to []",
+     ok_j and out_j.get("pv_forecast_entity") == FC_STORED["pv_forecast_entity"]
+     and out_j.get("pv_forecast_entities") == []
+     and out_j.get("pv_forecast_tomorrow_entities") == [],
+     "" if ok_j else out_j)
+for _k in ("pv_forecast_entity", "pv_forecast_tomorrow_entity"):
+    _s1 = dict(schema, **{_k: ["str"]})
+    ok_j1, out_j1 = validate_with(_s1, _fc_base)
+    show(f"`{_k}` declared as a LIST refuses the string an install stores",
+         (not ok_j1) and f"Invalid list for option '{_k}'" in str(out_j1),
+         out_j1)
+    _m1 = MERGER.merge(copy.deepcopy(dict(defaults, **{_k: []})),
+                       copy.deepcopy(FC_STORED))
+    ok_j2, out_j2 = validate_with(_s1, _m1)
+    show("...and a `[]` default does not rescue it (list merge is override)",
+         _m1[_k] == FC_STORED[_k] and not ok_j2, out_j2)
+    _sm = dict(schema, **{_k: "match(.*)?"})
+    _ok_s, _ = validate_with(_sm, _fc_base)
+    _ok_l, _ = validate_with(_sm, dict(_fc_base, **{_k: ["sensor.a",
+                                                         "sensor.b"]}))
+    _ok_n, _ = validate_with(_sm, dict(_fc_base, **{_k: 417}))
+    _ui_m = _ui_of(_sm, _k)
+    show(f"...`match(.*)?` on `{_k}` takes a string AND a list, but also the "
+         "integer 417, and renders as a plain text box (no second row)",
+         _ok_s and _ok_l and _ok_n and _ui_m
+         and _ui_m[0].get("multiple") is not True,
+         f"string={_ok_s} list={_ok_l} integer-417={_ok_n} "
+         f"ui={json.dumps(_ui_m)}")
+_two = ["sensor.fc_east", "sensor.fc_west"]
+ok_j3, out_j3 = validate(MERGER.merge(copy.deepcopy(defaults), dict(
+    _fc_old, pv_forecast_entities=_two,
+    pv_forecast_tomorrow_entities=_two)))
+show("⭐ SHIPPED: two-entity lists for today and tomorrow validate",
+     ok_j3 and out_j3.get("pv_forecast_entities") == _two
+     and out_j3.get("pv_forecast_tomorrow_entities") == _two,
+     "" if ok_j3 else out_j3)
+for _k in ("pv_forecast_entities", "pv_forecast_tomorrow_entities"):
+    ok_j4, out_j4 = validate({k: v for k, v in defaults.items() if k != _k})
+    show(f"...and the `options:` block with ONLY `{_k}` removed is refused "
+         "by name, so its `[]` default is load-bearing",
+         (not ok_j4) and f"Missing option '{_k}' in root" in str(out_j4),
+         out_j4)
+    _ui_j = _ui_of(schema, _k)
+    show(f"...and `{_k}` renders as a repeatable string field",
+         len(_ui_j) == 1 and _ui_j[0].get("multiple") is True
+         and _ui_j[0].get("type") == "string", json.dumps(_ui_j))
+_flat_j = {k: v for k, v in schema.items()
+           if k not in ("pv_forecast_entities", "pv_forecast_tomorrow_entities")}
+try:
+    _rj = vol.Schema(vol.All(dict, AppOptions(
+        None, _flat_j, cfg["name"], "local_goodwe_controller")))(
+            MERGER.merge(copy.deepcopy(defaults), dict(
+                FC_STORED, pv_forecast_entities=_two)))
+    show("a DOWNGRADE to 0.17.0's schema drops the list keys and keeps the "
+         "single ones",
+         "pv_forecast_entities" not in _rj
+         and _rj.get("pv_forecast_entity") == FC_STORED["pv_forecast_entity"])
+except vol.Invalid as e:
+    show("a DOWNGRADE to 0.17.0's schema drops the list keys", False, str(e))
+
 # ⚠️ THE EXIT CODE IS PART OF THE INSTRUMENT. Without it the probe prints FAIL
 # and still succeeds, and a transcript is only evidence if a wrong answer is
 # distinguishable from a right one by something other than reading it.
@@ -91,6 +91,12 @@ configuration:
  pv_forecast_tomorrow_entity:
    name: "Hardware · Solar forecast, tomorrow (kWh)"
    description: "Optional. The same forecast for tomorrow. It helps plan a cheap hour before midnight."
+  pv_forecast_entities:
+    name: "Hardware · Several solar forecasts, today (kWh)"
+    description: "Optional. One row per forecast sensor, such as one per inverter, used instead of the single one above. They are added up."
+  pv_forecast_tomorrow_entities:
+    name: "Hardware · Several solar forecasts, tomorrow (kWh)"
+    description: "Optional. The same list for tomorrow. If one sensor has no reading, that day's forecast is not used."
  solar_trust_pct:
    name: "Hardware · Trust in the forecast (%)"
    description: "Forecasts are often too sunny. At 70 % the add-on plans with 7 of every 10 kWh forecast."
@@ -72,6 +72,12 @@ configuration:
  pv_forecast_tomorrow_entity:
    name: "Hardware · Zonneprognose, morgen (kWh)"
    description: "Optioneel. Dezelfde prognose voor morgen. Ze helpt een goedkoop uur voor middernacht te plannen."
+  pv_forecast_entities:
+    name: "Hardware · Meerdere zonneprognoses, vandaag (kWh)"
+    description: "Optioneel. Eén rij per prognosesensor, bijvoorbeeld per omvormer, in plaats van de losse sensor hierboven. Ze worden opgeteld."
+  pv_forecast_tomorrow_entities:
+    name: "Hardware · Meerdere zonneprognoses, morgen (kWh)"
+    description: "Optioneel. Dezelfde lijst voor morgen. Heeft één sensor geen meting, dan wordt de prognose voor die dag niet gebruikt."
  solar_trust_pct:
    name: "Hardware · Vertrouwen in de prognose (%)"
    description: "Prognoses zijn vaak te zonnig. Bij 70 % plant de add-on met 7 van elke 10 kWh uit de prognose."
Author	SHA1	Message	Date
adminandClaude Opus 5.5	df6bc0f76b	SAFETY-112 review: grade the waiting flag where hass.py sets it checks / unit (pull_request) Successful in 36m27s Details infra-pin / fresh (pull_request) Successful in 1s Details - a 502 or refused read turns waiting on, the next good read off, and a read timeout never (two mutants survived without this) - the flag changes no write with live readings, not only with 502 ones - the page script's amber dot and batteries-tab banner for "waiting" - DECISIONS: about 5 minutes per start stage, not "at most" Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 02:10:27 +02:00
adminandClaude Opus 5.5	d94cb0c263	SAFETY-112: say plainly that control waits for Home Assistant to start checks / unit (pull_request) Successful in 36m38s Details infra-pin / fresh (pull_request) Successful in 2s Details The Supervisor proxy answers 502 to every add-on read, write and websocket until Core is RUNNING (proxy.py api()/websocket() -> check_api_state()), so the add-on cannot control while a slow integration holds HA's start, even with its entities live. Measured on a safety112 repro stack with the 2026.08.0 proxy code: first write 1.0-4.4 s after RUNNING, 238-300 s after live readings. Not routed around (DECISIONS/SAFETY-112-...). While the API does not answer, the first status row is red and is the banner ("Waiting for Home Assistant to finish starting"), Home shows a "waiting" state in EN/NL instead of "Needs you now", and the log adds a "still waiting" line every 5 minutes and the wait's length at the end. A safety stop, a stalled loop or shadow mode keeps its own headline. Control, writes, heartbeat and the stand-down are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 01:07:51 +02:00
admin	3050fa5208	OPT-17: the solar forecast can come from several entities, summed (#187 ) infra-pin / fresh (push) Successful in 1s Details	2026-10-11 05:49:37 +02:00
adminandClaude Opus 5.5	92a80c09b2	OPT-17 review: title the forecast row on Home; test the hint and blank rows checks / unit (pull_request) Successful in 36m20s Details infra-pin / fresh (pull_request) Successful in 2s Details The new status row's id `solar_forecast` had no Home title, so Home showed it under the fallback "Inverter connection". Add "Solar forecast" / "Zonneprognose" to ui_text, and checks for the title, the tomorrow-gap hint and blank list rows (review mutations R7, R9, R14 now killed). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC	2026-10-11 05:12:35 +02:00
glenn schrooyenandClaude Opus 5.5	9b1fa758ad	OPT-17: the solar forecast can come from several entities, summed checks / unit (pull_request) Successful in 36m13s Details infra-pin / fresh (pull_request) Successful in 1s Details New list options pv_forecast_entities and pv_forecast_tomorrow_entities (same shape as pv_entities); the single-entity keys are unchanged. - Each member is read in its own unit (Wh/kWh/MWh) in one gather and the day is summed. Hourly splits are merged when every member has one, else the total goes on the bell. - A member missing, unavailable, stale, non-energy or bad makes that day's forecast unusable (no partial sum). A caution row names it by position; the action log names the entity once per change. - Single key and list both set for one day: refused at start. - A one-member list behaves exactly like the single key (test_opt17.py); the single-key path is byte-identical to `e36565f` over 24 scenarios. - Supervisor shape measured: tools/supervisor_shape_probe.py section J. DECISIONS/OPT-17-several-forecast-entities.md has the rules. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC	2026-10-11 02:55:58 +02:00
admin	e36565fe39	Merge pull request #185 : Release 0.17.0 infra-pin / fresh (push) Successful in 2s Details checks / unit (pull_request) Successful in 35m11s Details infra-pin / fresh (pull_request) Successful in 1s Details	2026-10-11 00:58:29 +02:00
goodwe-review	808ec04dc4	REL-0.17.0 review: CHANGELOG wording fixes checks / unit (pull_request) Successful in 35m16s Details infra-pin / fresh (pull_request) Successful in 2s Details SAFETY-107 row names the tested base; MAINT-17 says code reading only; SAFETY-105 figure is from a simulation; SAFETY-97 edge is 175 W; the maintenance note cites MAINT-14 and MAINT-15; SAFETY-108 "about 15 s". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 00:21:39 +02:00
glenn schrooyenandClaude Opus 5.5	35432ce065	Release 0.17.0 checks / unit (pull_request) Successful in 35m11s Details infra-pin / fresh (pull_request) Successful in 2s Details Bump version to 0.17.0 and add the closed 0.17.0 CHANGELOG section. No code change, no option change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 23:29:13 +02:00
adminandClaude Opus 5.5	580c200527	Merge pull request #184 : MAINT-15 the balancing hold ends on time with no SoC reading infra-pin / fresh (push) Successful in 1s Details Reviewed at 35b2a69; CI run 1238 green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 01:38:29 +02:00
adminandClaude Opus 5.5	35b2a699de	MAINT-15 round 2: in-repo differential check, full-hold with-reading check checks / unit (pull_request) Successful in 35m8s Details infra-pin / fresh (pull_request) Successful in 1s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 00:42:01 +02:00
adminandClaude Opus 5.5	cd1bf2a694	MAINT-15: the balancing hold ends on time with no SoC reading checks / unit (pull_request) Successful in 35m22s Details infra-pin / fresh (pull_request) Successful in 1s Details HOLD's time check moves into Maintenance._hold(), used by step() and _no_soc(). A hold that loses its SoC now ends at hold_min, writes last_completed and logs the same COMPLETE line. The 15 min HOLD line says the hold still ends at its normal time. Behaviour with a reading is unchanged (differential trace against `db9e231`). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 23:56:29 +02:00
adminandClaude Opus 5.5	db9e2315d1	SAFETY-107: a refusal held under another writer is learned once (#183 ) infra-pin / fresh (push) Successful in 1s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 04:29:47 +02:00
adminandClaude Opus 5.5	848140c29f	SAFETY-107 review: test a writer that turns round on a dead pack; say when rule 3 applies checks / unit (pull_request) Successful in 35m22s Details infra-pin / fresh (pull_request) Successful in 2s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 03:52:39 +02:00
glenn schrooyenandClaude Opus 5.5	d12228d986	SAFETY-107: a refusal held under another writer is learned once checks / unit (pull_request) Successful in 35m8s Details infra-pin / fresh (pull_request) Successful in 2s Details At one inverter SAFETY-52's "another writer" end tested target != loop_w. A held refusal makes the loop ask 0 W, so any binding claim (maintenance charge, peak guard, trade) ended it every cycle, and compute() learned it again in the same cycle: "BATTERY REFUSES" / "ENDED: another writer" each second on the rig. Now the held refusal is judged afresh against the writer's ask (compute() gets the same inputs as before); it ends only if compute() no longer finds it. Commands unchanged: 300-seed differential trace against release/1.0, N=1 and N=2, every command and refusal state identical. DECISIONS/SAFETY-107. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC	2026-10-09 03:03:06 +02:00
admin	bf3ac7998c	MAINT-14: maintenance with no SoC reading: charge still times out, drain holds at 0 W (#182 ) infra-pin / fresh (push) Successful in 2s Details	2026-10-08 22:50:52 +02:00