OPT-34 fix (rig F-1): a replaced evening forecast does not come back

After a fresh today reading in the night (02:00 on the rig) went stale
(05:00), Hold.stand_in(as_today=True) served the 17:05 "tomorrow" figure
again until 06:00: the plan went back to 95 %, the latch took it, and
Leftover solar charged back up. read_sum() now skips that stand-in once
every today sensor has given a fresh reading for the day
(Hold.replaced()); the stale newer reading follows the OPT-27 rules.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/CHANGELOG.md

@@ -5,7 +5,7 @@
 ### Not in a release yet
 
 - The night grid charge no longer raises "Battery stopped limiting the peak" when the 15-minute period stays on the aim. A steadily rising load now alarms a little later, and with a peak margin of 0 a period can end up to 10 W over the limit without this alarm ([[SAFETY-126]]).
-- A night grid charge for *Leftover solar* no longer stops at 03:00 when the solar forecast sensors went quiet in the evening. The evening's figure is used until 06:00, and a charge that has started goes on to its level ([[OPT-34]]).
+- A night grid charge for *Leftover solar* no longer stops at 03:00 when the solar forecast sensors went quiet in the evening. The evening's figure is used until 06:00, unless a newer reading has replaced it that night, and a charge that has started goes on to its level ([[OPT-34]]).
 
 **A patch bump: two fixes, one for charging from the grid under the peak limit and one for the night charge of Leftover solar, and no option changes.**
 No option was added, removed or renamed, and no default changed (86 options).

goodwe_controller/DECISIONS/MAIN-orchestration.md

@@ -1,51 +0,0 @@
-# MAIN - why app/main.py is built the way it is
-
-**Status: SHIPPED.** Written down by MAINT-20 part 2 from the long comments and
-docstrings of `app/main.py`, so the module can keep one line and a pointer. The
-comments that were shortened but not rewritten here are kept word for word in
-[[MAIN-orchestration-archive]], by their line in `app/main.py` at release/1.0
-`d4c01da`. Related: [[SAFETY-07-peak-guard]], [[FCST-04-the-day-that-is-carried]],
-[[SAFETY-30-per-unit-sign]], [[SAFETY-73-refusal-per-inverter]],
-[[SAFETY-121-bound-every-quarter]], [[TARIFF-10-fetching-is-not-trading]],
-[[TARIFF-24-modes-need-the-tariff-task]], [[OPT-34-the-night-charge-keeps-its-level]].
-## Controller construction
-
-- **Per-write budget (DEV-02).** Each write is dispatched concurrently and bounded, so one hung `hass.call()` cannot eat a sibling's layer-1 budget (the ESP32 zeroes after about 30 s, and a fault on A could zero a healthy B). The number is derived: `heartbeat_s` max 25 s, layer-1 veto `validate.FIRMWARE_INGEST_VETO_S` 30 s, so 25 + 4 < 30. test_inverter.py grades the inequality, so raising the heartbeat ceiling goes red instead of taking an inverter to zero. Below hass.py's 10 s HTTP timeout on purpose: abandon the write and re-issue it next tick, since `last_write` moves only on an accepted write.
-- **Tariff refresh (OPT-04).** `resolve_tariff()` may do an HTTPS fetch. The tick feeds the ESP32 heartbeat, so a supplier's TLS timeout on the tick would push the add-on into layer 1. The tick never awaits a fetch. The 30 min cadence is not about price change (day-ahead publishes once at 14-16 h CET and 8.3's carried hours go firm then); it picks the switch up within the hour at 48 fetches a day. The age bound answers another question: a failed refresh still stores a plan (the 11.4 static fallback), the bound covers the refresh task dying while a plan from hours ago stands as current. Three missed refreshes, for `p1.max_age_s`'s reason.
-- **Status rows (TARIFF-11).** The Tariff row used to be `static_status()`'s sentence alone and never saw the provider plan (read 'no static profile' at all 802 samples of a 40 h soak with a live feed). `tick_words` and `plan` are two clocks and the row says so; the plan is stamped with its own age from `tariff_at` (TARIFF-12 does not move it on a kept plan), and `age_s` is the caller's measurement. The Arbitrage row used to be `"off (arbitrage_enabled)" if self.arb is None`, under a comment saying `arb is None` iff trading was off; false, since `cycle()` returns at the input hold before `self.arb = None`: `arbitrage_enabled: true` plus a sensor answering None rendered 'off (arbitrage_enabled)', naming an option that is on, and past the first cycle the previous decision stood as current. Three states: off, armed with no decision this cycle, a decision with its age (always printed: a row that reports staleness only once stale cannot be told from one that never does).
-- **`stop` is required (review catch).** `stop=None` made a Controller that cannot stop itself the default: on the late-refusal path in `run_control()` it logged the banner, returned and left the process alive forever with no loop and no output.
-- **Action log first.** The store migration can log to it (15: how an operator finds a latch was re-armed); an AttributeError on the way to saying so would stop the add-on booting.
-- **Roster and migrations (DEV-02, SAFETY-44, MAINT-05).** Every per-device value lives on the roster objects (app/inverter.py); a `Tuning` and an integrator are deliberately not per device (6.2: one integrator on P1 above the split; a second regulating the same meter is the two-writers failure). The SAFETY-02 key migration runs before the first `Inverter` reads its latch, else a tripped install comes up armed with a green banner. SAFETY-44: it is handed `roster_names(opts)[0]`, never `UNIT_A` (on a declared roster the flat latch landed under `unit/inverter-a/`, read back under the name it was handed, stamping the marker); `roster_names()` returns `[UNIT_A]` on the flat shape so today's path is byte-identical. `misdirected` is unreachable from that call site (`unit` is a roster member by construction; dropping the `roster` argument survives 28/28), so the claim that the call site buys the refusal is gone; the argument stays for new callers and is graded in test_maintenance.py. The maintenance migration targets `self.inverters[0].name`, not `UNIT_A`: with `UNIT_A` the history would sit under a name on no roster (a nameless entry falls back to a positional `inverter-1`). Every two-pack fixture once named its first entry `inverter-a`, so swapping them left 19 files green; `migrate_maint_keys()` now grades the namespace it wrote against the names the machines read, and test_maintenance.py sections 9 and 11 use `["garage", "shed"]`.
-- **CFG-04 disclosure.** A declared `inverters:` roster ignores `soc_entity`, `batt_entity`, `batt_invert` and `max_w`, which the UI still shows. Rule 9(e) refuses the dangerous one (a flat `setpoint_entity`); the rest cannot be refused (the schema has no blank value) so one action-log line at every start names the roster and the ignored keys.
-- **Site bound.** Summed from the roster, not `opts["max_w"]`: it is the integrator bound and rail of the site loop, then split. Identical at N=1; a per-unit `max_w` binds each share through its `supervised` claim.
-- **SAFETY-39 slew fallback** is 0 ("follow the rail"); it was 1000, a stale third copy. `control.slew_limit_w()` is the one reader.
-- **CFG-03 in main.py.** Eight `opts.get(key, <literal>)` calls used to live in the maintenance setup and two disagreed with config.yaml (2500 against 2000). `MaintConfig.from_options()` reads them. A ninth key goes in config.yaml `options:`/`schema:` and `maintenance.MAINT_OPTION_DEFAULTS` only.
-- **Watchdog thresholds (SAFETY-30).** The per-unit pair is re-derived at two inverters, not carried (it grades a command against one unit's own power). The site pair is used only at N>=2: the 300 W threshold carries (meter noise, deadband), the window does not (110 s at one inverter, 215 s at two, against a 180 s hold).
-- **Latches (SAFETY-02, -31, -34, -42, -18).** SAFETY-02: one per actuator, restored from namespaced keys; graded on every start (a latch that failed to move namespace, or was taken by an older add-on in a rollback, is a disarmed guard, so a disagreement re-arms by hand and shouts). SAFETY-31: site-level, flat keys (circulating power is defined over the roster), restored because it acts. SAFETY-42's delivery latch does not act, so it is restored only so the ALARM survives (the 2026-09-02 outage went unseen 6 h 25 m with the detector correct). SAFETY-18 is not restored (does not act). SAFETY-30's site check is armed only at N>=2.
-- **PV (TEL-11).** Instrumentation only; wiring it in would be an unrequested behaviour change and would destroy the measurement.
-- **Peak guard setup (SAFETY-07, TARIFF-01, FCST-04).** See SAFETY-07-peak-guard.md and FCST-04. The windowing caveat for FCST-04: hours already elapsed leave the spread, so a cheap night that has gone no longer sets the day's cheapest hour.
-
-## Cycle state and latch repair
-
-- **Allocation record (SAFETY-28).** The tick that mints a record increments once per resolution, not per loop iteration. A cycle with no resolution (the "inputs missing, not yet stale" hold) must not bump it: that hold returns before the allocator so one missed poll does not zero the inverter, and the heartbeat re-affirms `self.target` through the write path; bumping would make that heartbeat unauthorised and drop the site to 0 W. The record is superseded, never expired.
-- **`self.arb` (TARIFF-11).** See "Status rows" above; `arb_at < cycle_at` is the derived "the latest cycle did not reach the arbitrage step".
-- **Shadow (SAFETY-10, SAFETY-47).** `shadow_would_w` is what a live controller would have put on the wire; `self.target` is what is standing on the wire (held at `shadow.WIRE_W`, re-seeded each shadow cycle). Folding them shows an operator a number nothing is doing. The "sized from the billed-quarter meter" flag is recorded where the decision was taken (the page runs on its own task); False, not None, before the first shadow cycle.
-- **ARB-03.** `units` is a property derived from the roster so a site cannot claim two actuators while holding one writer. At N=1 (6.2) the grid connection and the only inverter are one actuator; a second entry makes per-inverter claims stop being site claims (ALLOC-01).
-- **DEV-02 latch guard (`_check_sign_latch...`).** Runs on every start: gating on `rep.ran` swallowed store.py's rule-2 round trip (upgrade, downgrade with a trip in the window, upgrade; the controller came up untripped while state.json said `sign_tripped: true`; a firmware rollback path was performed on this site on 2026-09-02). The gate could go because `handle_action()` clears the flat keys with the namespaced ones and the trip mirrors them. SAFETY-44 second half: the question is whether a namespaced latch THAT A MACHINE READS is set. An earlier version accepted any `unit/*/sign_tripped`, which blinded the guard on exactly the installs the broken migration had put the latch under `unit/inverter-a/` (a key nothing reads). The first blunt fix (every off-roster latch is litter) re-armed a healthy A off B's mirrored flat key (test_inverter.py DEV-02 restart case). `UNIT_A` is the discriminator: the only name the broken migration wrote. A single flag written for two intents was defeated by one removed unit's key (roster ['garage','shed'] with `unit/old-shed/sign_tripped` drove on a state file reading `sign_tripped: true`; `tools/rehearse_roster.py` exit 1); the fixtures now hold both arrangements. Residual: a first unit really named `inverter-a`, latched and removed from the roster is re-armed on `inverters[0]` (conservative). The printed reason is the flat mirror's (whatever tripped last), so on a multi-unit site one inverter's evidence may appear under another's name; test_maintenance.py's check that the reason is not the removed unit's depends on that fixture's flat string, not on this code.
-- **Maintenance views (MAINT-05).** `maints` is one FSM per roster entry; `maint`, `maint_unit` and the button target are views of the one that holds the slot (`maintenance.arbitrate()` allows at most one out of IDLE). validate.py rule 6 grades `maintenance_charge_w` against the weakest cap on the roster.
-- **N=1 views.** Properties, not fields, and they refuse at N>=2 (6.2's identity is false there). Nothing inside main.py may read them (test_inverter.py AST scan).
-- **`_arm_sign_watchdogs` (SAFETY-30).** Called every cycle because fixtures append an `Inverter` after construction; a detector frozen at construction would be graded against the meter at a roster of two. `arm()` touches no timer or latch.
-- **Per-inverter refusal (SAFETY-73).** The probe ask is PROBE_W, not `saturation_w`: a unit's share is often small (a 400 W night load split two ways) and SAFETY-43 would name the empty battery as not delivering. The site target is restarted from the watts on the wire when a unit reopens (phase A: -1059 W).
-
-## Write path and cycle
-
-- **The write gate (SAFETY-28).** specs 1.5 makes two writers on one actuator a non-goal. `len(validate.ACTUATOR_WRITE_KEYS) == 1` is a fact about the options schema, not the writes, and goes false when CFG-04 adds per-inverter config. So the enforcement is on the write: a number reaches the wire only if the single allocator placed it, on this tick, for this unit (`Allocation.authorises()`); a second writer must file a Claim. 0 W is always authorised and the test for zero comes first and reads nothing: the failsafe branches write 0 W while the allocator has refused (`Allocation.ok` False, no shares), and a gate asking its permission would deadlock the failsafe behind the component it answers; at S = 0 broadcast and allocation coincide, so there is no over-command (the hazard is N-times loop gain from broadcast, TEST-19's `N=2 gain 1.0` limit cycle). The predicate is `value == 0.0`, not a `failsafe=True` flag, which a second writer would pass; -0.0 == 0.0 and a nan never gets here. DEV-02: the unit is an argument, not the N=1 view; the default refuses at N>=2. The refusal sits above the clamp and below the non-finite coercion.
-- **Clamp (SAFETY-03)** is on the only path to the wire, so no optimizer, maintenance or manual path routes around it. A non-finite value is loss of input (11.1), coerced to 0 W. Every engagement goes to the action log undeduplicated; the notification is deduplicated.
-- **Shadow (SAFETY-10)** suppresses in the same method, below the gate and the clamp, as a substitution not a return. It is not a second writer.
-- **Reads (DEV-02, TEL-12).** Each inverter's readings are gathered concurrently across units and sequentially within one; PV entities ride in the same gather (a slow sensor must not push a healthy battery toward layer 1's veto). P1 has no inverter-side fallback: the inverter's AC power correlates 0.998 with battery power and 0.09 with the real meter.
-- **Stale reading (SAFETY-37/56/57).** The power reading goes through the freshness gate, the SoC does not (the power feeds the sign and delivery checks, which a frozen register fools). SAFETY-57 rewrote the escape clause: "it clears itself when the register reports a different value" was false for the state announced, because the 0 W it announces is what stops the value changing. The release is reported, never silent (it withdraws a SITE STOP).
-- **TARIFF-03.** The one shiftable load is the maintenance cycle's cheap-window top-up; the static window is synchronous and I/O-free, and validate.py refuses `static_profile` together with the price entities.
-- **Cycle ordering (SAFETY-02/31/42).** The watchdog evaluations run every cycle, before the input hold, so a run of held cycles cannot leave their timers resuming from a start that predates the gap. Reason first, flag second (each `set` writes the file): a crash between persists a reason nothing reads, not a latch with no explanation. The per-unit trip mirrors the legacy flat keys (store.py rule 2 covered only the latch present at migration time). The site check is flat-keyed, armed only at N>=2. SAFETY-31's input is MEASURED power (`inv.batt`), never the allocation record, which has sign-coherence by construction.
-- **Maintenance FSMs (MAINT-05).** Each pack is ticked with its own SoC (a minimum would abort a cycle on a sibling's state, an average would declare a pack full that is not); `arbitrate()` runs first. A deferral is carried to the status page because the edge-logged line scrolls out of the 40-row log.
-- **Aggregates.** SUM for the site bound, achievable rating and the battery power the site loop regulates against (`compute()`'s saturation test compares against the site target; one unit's power trips the freeze permanently, up to 510 W of split-dependence at gain 0.2, test_alloc.py part 8). MINIMUM for the discharge permission (the emptiest pack). MEASURED power for circulating power. Unknown bounds stay unknown when any unit is silent.
-- **Trade sizing (OPT-09).** `trade_sizing` uses arbitrage's own SoC bounds, not the BMS cut-out (SAFETY-25): sizing is the trade's business, the pack envelope is the pack's. Weights are a preference, so a pack between its arbitrage floor and its cut-out can still take part of a sell; fixing it needs a per-pack envelope depending on which claim won the tick.

goodwe_controller/DECISIONS/OPT-34-the-night-charge-keeps-its-level.md

@@ -34,6 +34,13 @@ known, so the add-on does not depend on it.
    midnight, so a 09:05 reading, unusable since 21:05, does not come back for five
    minutes after midnight. Same-day figures and the daytime rule keep 12 h and 3 h.
 4. A fresh figure replaces the kept one at once, as before.
+   *Rig F-1 fix:* once every today sensor has given a fresh reading after
+   midnight, the evening figure is no stand-in for that day any more
+   (`Hold.replaced()`). When that reading goes stale (3 h), it is kept or not
+   as any today reading (OPT-27), so it is "no forecast" at night and the latch
+   keeps the level it set; the older 17:05 figure never comes back. Rig: A
+   stopped at 69.5 % after a brighter 02:00 figure, then charged back to 94.4 %
+   from 05:15 when the 17:05 figure returned. Test: `test_opt34.py` F-1.
 
 **Step 1 alone is enough for the owner's shape, steps 2-3 are still needed.**
 With the window put back to midnight + 3 h the owner's night still ends as a
@@ -59,4 +66,4 @@ A fresh figure that LOWERS the level during a charge still lowers it, as before.
 **Mutants** (all red in `test_opt34.py`): no latch; window back to midnight + 3 h;
 15 h without a limit; no "usable at midnight" rule; the latch without the narrow
 gap, without its save, or not kept through the next run; the window 6 h after
-midnight instead of 06:00 local (DST); 15 h cut to 12 h; the new screen line off or shown without a cheap run; no expiry check; no pruning of a changed mode; no night bound; a left-the-plan battery keeping its level.
+midnight instead of 06:00 local (DST); 15 h cut to 12 h; the new screen line off or shown without a cheap run; no expiry check; no pruning of a changed mode; no night bound; a left-the-plan battery keeping its level; no `replaced()` check (F-1); `replaced()` with one of several today sensors (any, not all).

goodwe_controller/app/solarfc.py

@@ -38,7 +38,8 @@ midnight, if it is at most `KEPT_MAX_AGE_S` old when used.
 Never beyond that, and never for another day: a today figure is only today's,
 a tomorrow figure is tomorrow's until midnight and then, until the bell starts
 (`BELL_FROM_H`, 06:00 local), today's (OPT-34: at most `KEPT_MORNING_MAX_AGE_S`
-old, and it must have been usable at midnight).
+old, it must have been usable at midnight, and no fresh today reading may
+have replaced it since).
 DECISIONS/OPT-27-last-fresh-forecast-for-the-night.md,
 DECISIONS/OPT-34-the-night-charge-keeps-its-level.md.
 
@@ -351,6 +352,13 @@ class Hold:
         evening = _local_hour(now) >= BELL_TO_H and now < _bounds(day0)[1]
         return (day, at, True) if evening else None
 
+    def replaced(self, entities, day0) -> bool:
+        """OPT-34 F-1: every today sensor has given a fresh reading for
+        `day0` (so after midnight, newer than any evening figure). The
+        evening's tomorrow figure is then no stand-in for today any more,
+        also once those readings are stale."""
+        return all(("today", e, day0) in self._r for e in entities)
+
     def dump(self) -> dict:
         return {"v": 1, "r": [
             [kind, ent, d.day0.isoformat(), d.kwh, at.isoformat(),
@@ -492,7 +500,8 @@ def read_sum(today, tomorrow, now: datetime, hold: Hold | None = None):
     where `Hold.stand_in()` allows it (the forecast then has `kept` set when
     that took a reading older than `FRESH_S`). After midnight, if the today
     side is still short, the tomorrow figures read before midnight are
-    today's, until the bell starts (`stand_in()`). Without a `hold` this is
+    today's, until the bell starts (`stand_in()`), unless fresh today
+    readings have replaced them (`Hold.replaced()`). Without a `hold` this is
     exactly as before."""
     if not today:
         return None, NOT_SET, ()
@@ -537,7 +546,8 @@ def read_sum(today, tomorrow, now: datetime, hold: Hold | None = None):
         # day; all of them are needed, as for any sum.
         subs = [hold.stand_in("tomorrow", ent, day0, now, as_today=True)
                 for ent, _st in tomorrow]
-        if all(r is not None for r in subs):
+        if all(r is not None for r in subs) and not hold.replaced(
+                [ent for ent, _st in today], day0):
             days = [r[0] for r in subs]
             ats = [r[1] for r in subs]
             gaps = [g for g in gaps if g[0] != "today"]

goodwe_controller/test_opt34.py

@@ -36,6 +36,8 @@ DECISIONS note and the dev report.
       and before a charge has started, up and down;
    e. the last hour, after the kept figure has ended at 06:00: the charge under
       way goes on to its level, also over a restart; the screens say so.
+   f. F-1 (rig): one fresh reading at 02:00, then silent again: when it is
+      stale (05:00) the 17:05 figure it replaced does not come back.
 3. The text, EN and NL.
 4. `_latch_charge()` alone: a battery that leaves the plan leaves the latch.
 """
@@ -193,6 +195,47 @@ for label, now in (("01:00", at(4, 1, 0)), ("04:00", at(4, 4, 0))):
           "17:05 figure again", fr is not None and fr.kept
           and fr.today.kwh == 12.0 and fr.at == at(3, 17, 5))
 
+# F-1 (rig): a fresh today reading at 02:00 replaces the 17:05 figure; once
+# that reading is stale (05:00) the 17:05 figure must not come back.
+for label, kwh in (("brighter", 40.0), ("darker", 1.0)):
+    hn = hold_of(at(3, 17, 5))
+    f2 = rs(st(kwh, at(4, 2, 0)), st(kwh, at(4, 2, 0)), at(4, 2, 1), hn)[0]
+    f4 = rs(GONE, GONE, at(4, 4, 59), hn)[0]
+    snap = json.loads(json.dumps(hn.dump()))
+    f5 = [rs(GONE, GONE, t, hn)[0] for t in (at(4, 5, 1), at(4, 5, 59))]
+    f5s = [rs(st(kwh, at(4, 2, 0)), st(12.0, at(3, 17, 5)), t, hn)[0]
+           for t in (at(4, 5, 1), at(4, 5, 30))]
+    check(f"F-1 {label} 02:00 reading: used fresh at 02:01 and kept for "
+          "a missing sensor to 04:59 (3 h)",
+          f2 is not None and not f2.kept and f2.today.kwh == kwh
+          and f4 is not None and f4.today.kwh == kwh and not f4.kept)
+    check("... and from 05:01 (stale) to 05:59: no forecast, never the "
+          "17:05 figure (sensors gone, or showing their old readings)",
+          all(x is None for x in f5 + f5s))
+    back = solarfc.Hold(snap)
+    check("... also after a restart at 03:00 (the saved hold keeps the "
+          "02:00 reading)", rs(GONE, GONE, at(4, 3, 0), back)[0] is not None
+          and rs(GONE, GONE, at(4, 5, 1), back)[0] is None)
+# Two today sensors, only one read fresh: the sum never had a fresh figure,
+# so the evening one still stands in (as before).
+h2 = solarfc.Hold()
+td2 = [("sensor.t1", st(0.2, at(3, 17, 5))),
+       ("sensor.t2", st(0.2, at(3, 17, 5)))]
+tm2 = [("sensor.m1", st(6.0, at(3, 17, 5))),
+       ("sensor.m2", st(6.0, at(3, 17, 5)))]
+gone2 = [(e, GONE) for e, _s in td2], [(e, GONE) for e, _s in tm2]
+solarfc.read_sum(td2, tm2, at(3, 17, 10), h2)
+solarfc.read_sum([("sensor.t1", st(9.0, at(4, 2, 0))), td2[1]], tm2,
+                 at(4, 2, 1), h2)
+g5 = solarfc.read_sum(*gone2, at(4, 5, 1), h2)[0]
+check("two today sensors, only one read fresh at 02:00: the evening sum "
+      "(12.0) still stands in at 05:01", g5 is not None and g5.kept
+      and g5.today.kwh == 12.0)
+solarfc.read_sum([td2[0], ("sensor.t2", st(9.0, at(4, 2, 10)))], tm2,
+                 at(4, 2, 11), h2)
+check("... and once both have read fresh, it does not",
+      solarfc.read_sum(*gone2, at(4, 5, 20), h2)[0] is None)
+
 # DST: the 25 h autumn day and the 23 h spring day. The window ends at 06:00
 # LOCAL, not 6 h after midnight.
 for (y, mo, d), label in (((2026, 10, 25), "25 h day 2026-10-25"),
@@ -431,6 +474,19 @@ SCEN = {
                        soc={"a": 65.0, "b": 95.0},
                        marks=[at(4, 5, 50), at(4, 6, 10), at(4, 6, 45)]),
 }
+# F-1 (rig 4v): silent from 17:05, one fresh reading at 02:00, silent again.
+# It is stale at 05:00, before the 06:00 bell: the 17:05 figure it replaced
+# must not come back. Brighter (A's level drops), with a restart at 03:00,
+# and darker (the level rises).
+F1_MARKS = [at(4, 1, 55)] + [at(4, 2, 15) + timedelta(minutes=15 * i)
+                             for i in range(19)]
+for k, kwh, rst, hw in (("f1_bright", 30.0, (), 700.0),
+                        ("f1_bright_rs", 30.0, (at(4, 3, 0),), 700.0),
+                        ("f1_dark", 1.0, (), 500.0)):
+    SCEN[k] = dict(start=at(4, 1, 30), hours=5.5, house_w=hw,
+                   soc={"a": 50.0, "b": 50.0}, fresh_from=at(4, 2, 0),
+                   fresh_until=at(4, 2, 0), fresh=(kwh, kwh),
+                   restarts=list(rst), marks=F1_MARKS)
 t0 = time.time()
 with ProcessPoolExecutor(max_workers=min(6, os.cpu_count() or 2),
                          mp_context=get_context("fork")) as pool:
@@ -563,6 +619,45 @@ check("(control: the same latch, still valid until tomorrow 07:15, does "
       f"charge both: A {sl_['soc'][0]:.1f}, B {sl_['soc'][1]:.1f} %)",
       sl_["soc"][0] > 11.0 and sl_["soc"][1] > 11.0
       and sl_["marks"]["22:20"]["state"] == "latched")
+for k in ("f1_bright", "f1_bright_rs"):
+    fb = R[k]
+    mk = fb["marks"]
+    lo_t = mk["02:15"]["target_a"]
+    after = [mk[h] for h in sorted(mk) if h >= "02:15"]
+    print(f"    {k}: A level 01:55 {mk['01:55']['target_a']} -> 02:15 "
+          f"{lo_t}; A {fb['soc_at']['02:15'][0]:.1f} % at 02:15, "
+          f"{fb['soc_at']['06:55'][0]:.1f} % at 06:55; lines "
+          + " | ".join(sorted({x['line'] for x in after})))
+    check(f"F-1 {k}: a brighter fresh figure at 02:00 lowers A's level "
+          "below its SoC and A stops",
+          lo_t is not None and mk["01:55"]["target_a"] is not None
+          and lo_t < mk["01:55"]["target_a"] - 10.0
+          and lo_t < mk["02:15"]["soc_a"])
+    check(f"... after 02:00 the screen never says 'read 17:05' and from "
+          "05:15 there is no forecast, with the LOWERED level",
+          all("17:05" not in x["line"] and not (x["kept"] and
+                                                 not x["fc_none"])
+              for x in after)
+          and all(mk[h]["fc_none"] and near(mk[h]["target_a"], lo_t, 0.5)
+                  for h in mk if "05:15" <= h < "07:00"))
+    check(f"... so A stays at its lowered level to 07:00 "
+          f"({fb['soc_at']['02:30'][0]:.1f} -> "
+          f"{fb['soc_at']['06:55'][0]:.1f} %)",
+          fb["soc_at"]["06:55"][0] < fb["soc_at"]["02:30"][0] + 1.0)
+fd = R["f1_dark"]
+md = fd["marks"]
+print(f"    f1_dark: A level 01:55 {md['01:55']['target_a']} -> 02:15 "
+      f"{md['02:15']['target_a']}; A {fd['soc_at']['06:55'][0]:.1f} % "
+      "at 06:55")
+check("F-1 darker fresh figure at 02:00: the level rises, is held after "
+      "05:00 with no forecast (never 'read 17:05'), and A charges to it",
+      md["02:15"]["target_a"] is not None
+      and md["01:55"]["target_a"] is not None
+      and md["02:15"]["target_a"] > md["01:55"]["target_a"] + 3.0
+      and all("17:05" not in md[h]["line"] for h in md if h >= "02:15")
+      and all(md[h]["fc_none"] for h in md if "05:15" <= h < "07:00")
+      and near(fd["soc_at"]["06:55"][0], md["02:15"]["target_a"], 1.5))
+
 tb = R["tail_bfull"]
 check("B full: the run ends at 06:33 before A is at its level, so the next "
       "slice is only A's, planned after the figure has ended with A's "

goodwe_controller/tools/maint20_same_code.py

@@ -5,19 +5,12 @@
 
 For each FILE (default: every goodwe_controller/app/*.py that differs from
 BASE_REF, default release/1.0) the ast.dump() of the tree with docstrings
-removed must be identical at BASE_REF and in the working tree, and so must
-the `python -OO` compiled code (a wholly removed docstring leaves a no-op
-there). An added or removed app/*.py file is a code difference. The diff
-against BASE_REF may touch only goodwe_controller/app/*.py,
-goodwe_controller/DECISIONS/*.md and this script. Also prints code lines vs
-comment-only + docstring lines (whole lines, via tokenize) before and after,
-and the docstrings removed entirely or added. Run from the repository root.
-Exit 1 on any difference.
+removed must be identical at BASE_REF and in the working tree. Also prints
+code lines vs comment-only + docstring lines (whole lines, via tokenize) before
+and after. Run from the repository root. Exit 1 on any code difference.
 """
 import ast
 import io
-import os
-import re
 import subprocess
 import sys
 import tokenize
@@ -60,87 +53,29 @@ def counts(src):
     return len(code), len(doc) + len(com - code - doc)
 
 
-def qualnames(src):
-    out = {}
-
-    def walk(node, prefix):
-        for n in ast.iter_child_nodes(node):
-            if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef,
-                              ast.ClassDef)):
-                q = prefix + n.name
-                out[q] = docstring(n) is not None
-                walk(n, q + ".")
-    out["<module>"] = docstring(ast.parse(src)) is not None
-    walk(ast.parse(src), "")
-    return out
-
-
-def code_sig(co):
-    consts = tuple(code_sig(c) if hasattr(c, "co_code") else c
-                   for c in co.co_consts)
-    return (co.co_name, co.co_code, consts, co.co_names, co.co_varnames,
-            co.co_freevars, co.co_cellvars, co.co_flags, co.co_argcount,
-            co.co_stacksize, co.co_exceptiontable)
-
-
-def oo_same(old, new):
-    return (code_sig(compile(old, "f", "exec", optimize=2))
-            == code_sig(compile(new, "f", "exec", optimize=2)))
-
-
 def git(*a):
     return subprocess.run(["git", *a], check=True, capture_output=True,
                           text=True).stdout
 
 
-def exists(base, f):
-    return subprocess.run(["git", "cat-file", "-e", f"{base}:{f}"],
-                          capture_output=True).returncode == 0
-
-
-ALLOWED = re.compile(r"^goodwe_controller/(app/[^/]+\.py|DECISIONS/[^/]+\.md|"
-                     r"tools/maint20_same_code\.py)$")
-
-
-def ratio(m, c):
-    return f"{m / c:.2f}" if c else "n/a"
-
-
 def main(argv):
     base = argv[0] if argv else "release/1.0"
+    files = argv[1:] or [
+        f for f in git("diff", "--name-only", base, "--",
+                       "goodwe_controller/app").split()
+        if f.endswith(".py")]
     bad = 0
     print(f"base {base} = {git('rev-parse', base).strip()}")
-    changed = git("diff", "--name-only", base).split()
-    for f in changed:
-        if not ALLOWED.match(f):
-            print(f"FAIL: diff touches {f}, outside app/*.py, DECISIONS/*.md "
-                  "and this script")
-            bad += 1
-    files = argv[1:] or [f for f in changed if re.match(
-        r"^goodwe_controller/app/[^/]+\.py$", f)]
     for f in files:
-        in_base, in_head = exists(base, f), os.path.exists(f)
-        if in_base != in_head:
-            print(f"CODE DIFFERS  {f}  "
-                  f"{'removed' if in_base else 'added'} file")
-            bad += 1
-            continue
         old = git("show", f"{base}:{f}")
         new = open(f, encoding="utf-8").read()
         same = dump(old) == dump(new)
-        oo = oo_same(old, new)
         (c0, m0), (c1, m1) = counts(old), counts(new)
         print(f"{'SAME CODE' if same else 'CODE DIFFERS'}  {f}  "
               f"code {c0}->{c1}  comment+doc {m0}->{m1}  "
-              f"ratio {ratio(m0, c0)}->{ratio(m1, c1)}  "
-              f"-OO {'same' if oo else 'DIFFERS'}")
-        bad += (not same) + (not oo)
-        qo, qn = qualnames(old), qualnames(new)
-        for q in sorted(q for q in qo if qo[q] and not qn.get(q, True)):
-            print(f"  docstring REMOVED: {f}:{q}")
-        for q in sorted(q for q in qn if qn[q] and not qo.get(q, True)):
-            print(f"  docstring ADDED:   {f}:{q}")
-    print("OK: no code change" if not bad else f"FAIL: {bad} problem(s)")
+              f"ratio {m0 / c0:.2f}->{m1 / c1:.2f}")
+        bad += not same
+    print("OK: no code change" if not bad else f"FAIL: {bad} file(s) differ")
     return 1 if bad else 0