SAFETY-135: a young 15-minute period does not cost the night charge the whole period

With battery modes on, a grid charge the peak guard (or a measured headroom)
stops in the first 60 s of a period no longer latches off for the period: it
may start again once the period is 60 s old, if the guard is clear and the
headroom is over START_W. A stop after 60 s latches as before. In a young
period no charge starts while the batteries' give is still falling (over
START_W within 15 s), since the meter may not show that drop yet. The guard
itself is unchanged, so a real over-aim load is cut on the same cycle.

DECISIONS/SAFETY-135-young-period.md, test_safety135.py.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-128-late-readings.md

@@ -71,7 +71,8 @@ The fits run all the time; the pull request has the counts.
 **What it costs.**
 - Found 36-68 s after a lag starts at 1-2 s meters; at a 5 s meter 30 s late
   is found within 100 s after it starts (88 s measured) (the loop first moves 100 W after 60 s,
-  SAFETY-129) with the export above -200 W, and 10 s late is not found. Until
+  SAFETY-129) with the export above -200 W, and 10 s late is not found (SAFETY-136 calms
+  the loop at a slow meter instead). Until
   then control is as before. In a quiet house the "readings late" row stays
   about 2 minutes longer after the lag ends (126 s against 32 s on base); no
   harm measured, and it clears as early as on base when the load changes.

goodwe_controller/DECISIONS/SAFETY-135-young-period.md

@@ -0,0 +1,74 @@
+# SAFETY-135 - a young 15-minute period does not cost the night charge the whole period
+
+**Status: for review.** Code: `Controller._mode_roles()` and
+`Controller._give_falling()` (`app/ctl_trade.py`), `modetrade.decide(young=)`,
+`YOUNG_S`, `GAVE_S` (`app/modetrade.py`). Tests: `test_safety135.py`. Battery
+modes only. No option, no text change, no change to the peak guard.
+
+**Problem.** In the first seconds of a period the guard's projection is almost
+only the last reading (`held_w`). Two cases seen on TEST-23:
+- *A spike at a period's start* (UX-77 I-1, x10): a 1-3 s spike, or a charge
+  still at full power from the end of the last period, makes the guard project
+  4.3-6.6 kW and cut the night charge. The cut is right. But a cut charge
+  stays off to the period's end (the OPT-11 latch), so one 2 s spike cost 15
+  minutes of charge, about 0.16 kWh per trip on the rig.
+- *A start at the tariff edge* (SAFETY-136 rig F-4, x1): a give ends at 01:00
+  and the cheap run starts. The battery reading drops at once, the meter
+  reading a few seconds later. In between, grid + batteries reads the house
+  too low, so the charge room is too big. The charge starts and the guard cuts
+  it 4-61 s later, and the latch then holds it off for the period.
+
+**Decision.** Two small rules, both only in a young period (its first
+`YOUNG_S` = 60 s):
+1. *A stop does not latch.* A charge the guard or a measured headroom stops in
+   a young period may not start again until the period is 60 s old; then the
+   normal start rule (guard clear, over `START_W` of headroom) decides. A stop
+   after 60 s latches to the period's end as before, so there is at most one
+   restart per period and the OPT-11 flip guard keeps its job.
+2. *No start while a give is still falling.* While the batteries give over
+   `START_W` less than they did in the last `GAVE_S` = 15 s, no charge starts:
+   the meter may not show that drop yet. 15 s covers a 5 s meter twice plus
+   Home Assistant's own delay. A give that falls by `START_W` or less does not
+   hold the start: the error it leaves is under the smallest charge worth
+   starting.
+
+The guard itself is not touched: its claim, floor and projection are the same
+code, so a real over-aim load is cut on the same cycle as before. A running
+charge is never held by rule 2.
+
+**Options weighed.**
+- *A minimum data window before the latch* (no latch in the first N s): this
+  is rule 1. Alone it lets the edge start flap once more.
+- *No start in a young period within 60 s of a give or a guard action*: also
+  stops the edge flap, but delays every run start that follows a give. In the owner-shape night sim it
+  charged 0.018 kWh (N=1) and 0.003 kWh (N=2) less than base. Rule 2 holds the
+  start only while the give is still falling, and charges the same as base.
+- *Cutting the young charge room by the recent give* (instead of holding the
+  start): it double-counts once the meter catches up, cut a running charge 3 s
+  after its start in the 1 s meter edge run, and so flapped where base did not.
+- *Re-evaluation each cycle with no latch*: brings back the 13 flips in 4
+  minutes the latch was made for (2026-09-09 replay).
+- *A hysteresis band on the start*: does not help at the edge. The error there
+  is the readings' age, not a small room.
+
+**Numbers** (`scratch/SAFETY-135/dev/s135_sim.py`, real `cycle()`, TEST-23-like
+lag, 1 s cycle, two 2.5 kW batteries, cap 3 500 W, aim 3 450 W; grid
+average over each period as the sim saw it):
+
+| Scenario | Base: paused s, kWh, flaps, top period | Head |
+|---|---|---|
+| (a) 4 s spike at 01:30 and 01:45, house 2.8 kW | 1 197 s, 0.330 kWh, 1, 3 458 W | 135 s, 0.537 kWh, 0, 3 458 W |
+| (b) 01:00 edge after a give, 5 s meter, house 3.0 kW | 882 s, 0.006 kWh, 1, 3 009 W | 21 s, 0.119 kWh, 0, 3 464 W |
+| (b) the same, house 2.4 kW | 0 s, 0.266 kWh, 0, 3 461 W | 11 s, 0.266 kWh, 0, 3 461 W |
+| (c) +4 kW for 5 min from 01:30:20 | cut 01:30:22, 0.387 kWh | cut 01:30:22, 0.492 kWh |
+| Owner-shape night, N=1 / N=2 | 5.510 / 6.048 kWh, top 3 454 / 3 453 W | 5.510 / 6.048 kWh, 3 454 / 3 453 W |
+| Owner-shape day, N=1 / N=2 | top 331 / 145 W | the same |
+
+The add-on's own period averages in `test_safety135.py`: 3 450.0 W in the
+spike period (base 2 807.9 W, the charge lost), 3 450.0 W in the 01:00 period
+(base 2 996.5 W at 3.0 kW). Over the aim by a few watts in the sim's grid
+average is the landing error base has too (SAFETY-126).
+
+**Not changed.** With battery modes off, `arbitrage.decide()` has no period
+latch and sizes the charge to the headroom each cycle (SAFETY-45). Nothing
+here touches it.

goodwe_controller/DECISIONS/SAFETY-136-slow-meter-settle.md

@@ -0,0 +1,81 @@
+# SAFETY-136 - a slow meter gets a gentler loop until the last move shows
+
+**Status: for review.** Code: `app/settle.py`, a call in `Controller.cycle()`
+(`app/ctl_cycle.py`). Tests: `test_safety136.py`. No option, no text change.
+
+**Problem.** On a 5 s meter, Home Assistant readings 10-15 s late are not
+found (SAFETY-129): they look like a slow battery (R2-1), and a hold does not
+help (a perfect one cut the export of the oven by 7 %, SAFETY-129 review).
+With moving loads the loop answers the same stale error at each cycle and
+overshoots: an oven, a kettle and hob, the owner's day or a step export 3-10
+times what they do with no lag. The fix is a calmer loop, not a detector.
+
+**Decision.** After a move of 150 W or more, a loop on a slow meter runs at half
+its gain until the meter has fallen by half of that move, or for 2 cycles.
+Slow is judged from the readings that arrive: the usual gap
+between them, over the last 60 s and at least 5 readings, is over 3.75 s (the
+limit of SAFETY-128's fast meter fit). It counts arrivals, not changes of
+value: on the recorded day at 1-2 s the value-based test (`MeterFit.slow()`)
+called 24 % of the cycles slow, because the recorded house repeats a value
+for 5 s or more, and the commands then differed from base. So there is no
+option. At a meter with a usual gap of 3.75 s or less (1-3 s) it is false, the tuning is never touched and the
+commands are those of the tree before. A meter that Home Assistant passes on
+only when its value changes looks as slow as its changes are far apart, as it
+does to SAFETY-128's fits: a 1-2 s meter with a value that holds for 5 s or
+more is then treated as slow, and the loop is gentler for it (the cost below).
+With no lag the meter shows a move at the next reading, so the wait ends at
+once.
+
+**Candidates** (SAFETY-129 sim, real `cycle()`, 5 s meter, sum over oven,
+kettle and hob, owner shape over the oven and over the heat pump, step down,
+step up, flat; export Wh, lag 0 / 10 s / 15 s; base 64 / 340 / 363):
+
+| Candidate, only at a slow meter | 0 s | 10 s | 15 s | Import Wh, 0 / 10 / 15 s |
+|---|---|---|---|---|
+| gain 0.4 | 97 | 201 | 299 | 97 / 224 / 301 |
+| gain 0.3 | 128 | 185 | 322 | 132 / 232 / 293 |
+| step limit 500 W | 118 | 285 | 293 | 110 / 325 / 324 |
+| cut fast, raise slowly (0.6 / 0.3) | 55 | 140 | 226 | 140 / 332 / 345 |
+| ignore 1 cycle after a move | 93 | 216 | 325 | 90 / 240 / 291 |
+| ignore 2 cycles after a move, unless the meter showed half | 69 | 206 | 277 | 62 / 240 / 354 |
+| **half gain for 2 cycles after a move, unless the meter showed half** | **67** | **189** | **296** | **62 / 223 / 288** |
+
+A lower gain for good, a step limit and a fixed ignore all make a 5 s meter
+with no lag worse (export +30-110 Wh, quarter peak up to 150 W): that is the
+common case. Cutting fast and raising slowly moves export to import and peak.
+Waiting only while the last move has not shown costs nothing with no lag.
+Ignoring the meter (the 2-cycle line) was worse than half gain where the plant
+is slow, not the readings late: a 12 s dead time with one inverter went from
+250 to 841 Wh import and a quarter peak of 206 to 1 509 W, so the loop keeps
+following at half gain.
+
+**What it gives** (5 s meter; the pull request and the report have each
+scenario). Export summed over the seven houses: 10 s late 340 -> 189 Wh
+(-44 %, import 363 -> 223), 15 s late 363 -> 296 Wh (-19 %, import 281 ->
+288), together -31 %. At 15 s the oven and the owner's oven are not better
+(92 / 39 Wh against 91 / 37), the kettle and the steps are. No lag: export
+64.4 -> 66.5 Wh (kettle +2), import and peak the same.
+
+**What it costs.** The loop follows a real step more slowly: half gain for up
+to two cycles after each move of 150 W or more. Of the 136 sim runs (every
+SAFETY-129 review scenario and its 15 harm runs), 56 at 4-10 s meters differ
+from base. Together their export is 10 363 -> 9 559 Wh (-8 %) and import
+8 389 -> 7 835 Wh (-7 %). Only 5 export more than 1 Wh and 14 import more:
+export by at most 11.5 Wh (a 10 s battery lag, +10 %), import by at most
+17 Wh (a 12 s dead time, one inverter, +7 %), and the quarter average by at
+most 35 W, except two import quarters: +73 W (10 s meter, 10 s dead time,
+export -59 Wh) and +40 W (`dead10_p6`, -6 to 34 W, export -68 Wh). Slow
+batteries with a dead time of 8-10 s export 5-39 % less; a 12 s dead time is
+the same. `READINGS_LATE` holds are the same seconds in every run.
+
+**Live, a 1-2 s meter can be judged slow.** Through Home Assistant on change,
+a value that holds for 4-10 s makes a 1 s meter slow. In 20 rig scenarios the
+commands were those of base. On the recorded day (1 s, N=1, 1 day, repeats
+dropped; its values hold about 5 s) it was slow in 33 % of cycles, half gain
+in 83 cycles, 15 422 commands in both trees, 4 016 with another value (at
+most 190 W apart), cost 0.61 EUR in both (review of SAFETY-136).
+
+**Does not change.** Meters of 1-2 s: the same commands in all 63 runs (34
+at 1 s, 29 at 2 s), and the recorded-day digests (see the report). The late
+verdict, the hold and the freeze tests. 15 s late is only partly helped, and
+30 s late is the hold's (SAFETY-129).

goodwe_controller/app/ctl_cycle.py

@@ -734,15 +734,21 @@ class CycleMixin:
             # TEL-10. ⚠️ ONE NAME FOR THE COMMAND THE LOOP WAS MEASURED
             # AGAINST. (DECISIONS/MAIN-orchestration-archive.md)
             loop_prev = self.target
+            # SAFETY-95: a drain's tail is not the loop's to chase.
+            # OPT-15: `loop_grid` is the grid, or the target while a run
+            # edge is held.
+            grid_in = (self._drain_grid_w(_live96) if self._drain_tail
+                       else loop_grid)
+            # SAFETY-136: on a slow meter, a gentler loop until the last move
+            # shows.
+            slow_meter = self.settle.slow()
+            if moved or mode_trade:
+                self.settle.reset()
             decision = compute(
                 prev_w=loop_prev,
-                # SAFETY-95: a drain's tail is not the loop's to chase.
-                # OPT-15: `loop_grid` is the grid, or the target while a run
-                # edge is held.
-                grid_w=(self._drain_grid_w(_live96) if self._drain_tail
-                        else loop_grid),
+                grid_w=grid_in,
                 actual_w=site_batt,
-                tuning=self.tuning,
+                tuning=self.settle.tuning(self.tuning, grid_in, slow_meter),
                 sat_count=self.sat_count,
                 i_w=self.i_w,
                 # SAFETY-52 at one inverter only: with several, OPT-09's pack
@@ -772,6 +778,7 @@ class CycleMixin:
                 self.log_event(f"saturation freeze ({self.target:.0f} W vs "
                                f"{site_batt:.0f} W)",
                                hint=messages.hint("not_keeping_up"))
+            self.settle.moved(grid_in, loop_prev, decision.target_w, slow_meter)
             self.sat_count = decision.sat_count
             self.i_w = decision.i_w
             self.loop_w = decision.target_w
@@ -811,6 +818,7 @@ class CycleMixin:
         else:
             # Stopped or blind: no accumulation may survive the outage.
             self.i_w = 0.0
+            self.settle.reset()
             self.loop_w = None
             self._live_was = frozenset(_live96)
             # TEL-10, and it is the same zero the line above writes rather than

goodwe_controller/app/ctl_inputs.py

@@ -197,6 +197,7 @@ class InputsMixin:
             # correlates 0.998 with battery power and 0.09 with the real meter
             # (a controller would regulate against its own output).
             self.grid = self.p1.net_w
+            self.settle.arrive(now_mono, self.p1.samples)   # SAFETY-136
         else:
             self.grid = await self.hass.number(o.get("meter_entity", ""),
                                                bool(o.get("meter_invert")))

goodwe_controller/app/ctl_trade.py

@@ -401,6 +401,10 @@ class TradeMixin:
         quarter = int(now.timestamp() // 900)
         was = self.mode_tick is not None and \
             self.mode_tick.action == modetrade.CHARGE
+        # SAFETY-135: a stop in a young period holds only until it is not
+        # young (no latch), and no charge starts there while a give falls.
+        young = now.timestamp() - quarter * 900 < modetrade.YOUNG_S
+        falling = self._give_falling(now)
         self.mode_tick = modetrade.decide(
             runs, now, packs, charge_ok=charge_ok, sell_ok=sell_ok,
             trade_why=trade_why, price_now=price_now,
@@ -408,7 +412,8 @@ class TradeMixin:
             ceiling_pct=ceiling_pct, house_w=house, charging_now=was,
             blocked=self._charge_blocked_q == quarter,
             done_charge=done_c, done_sell=done_s, targets=targets,
-            draining=any(r.phase == DRAIN for r in maint_results or ()))
+            draining=any(r.phase == DRAIN for r in maint_results or ()),
+            young=falling or (young and self._charge_young_q == quarter))
         self._latch_charge(now, runs, targets, packs)
         # A charge the guard or the headroom stopped stays off this period.
         # OPT-15: only a MEASURED stop latches; the first unmeasured headroom
@@ -419,11 +424,31 @@ class TradeMixin:
             gap = why == "headroom" and self.arb_headroom_w is None
             if why == "peak" or (why == "headroom" and not gap) or (
                     gap and self._charge_gap_q == quarter):
-                self._charge_blocked_q = quarter
+                if young and not gap:
+                    self._charge_young_q = quarter      # SAFETY-135
+                else:
+                    self._charge_blocked_q = quarter
             elif gap:
                 self._charge_gap_q = quarter
         return self.mode_tick
 
+    def _give_falling(self, now) -> bool:
+        """SAFETY-135: True in a young period while the batteries give over
+        START_W less than they did in the last GAVE_S s: the meter may not
+        show that yet, so a charge room read now is too big.
+        DECISIONS/SAFETY-135-young-period.md"""
+        t = now.timestamp()
+        gave = self._gave
+        if self.site_batt_w is not None:
+            gave.append((t, max(0.0, float(self.site_batt_w))))
+        while gave and not 0.0 <= t - gave[0][0] < modetrade.GAVE_S:
+            gave.popleft()
+        if self.site_batt_w is None or not gave \
+                or t % 900 >= modetrade.YOUNG_S:
+            return False
+        drop = max(w for _t, w in gave) - max(0.0, float(self.site_batt_w))
+        return drop > modetrade.START_W
+
     def _run_mark(self, kind, run, packs, out, extra=None) -> set:
         """The batteries that left run `run` (full, or at the floor); they
         stay out until it ends, so a level edge does not re-arm them.

goodwe_controller/app/main.py

@@ -22,6 +22,7 @@ ctl_inputs, ctl_writes, ctl_trade, ctl_cycle, ctl_alarms, ctl_status and
 ctl_tasks (MAINT-21), the status-row functions in rows."""
 
 import asyncio
+import collections
 import contextlib
 import dataclasses
 import functools
@@ -63,6 +64,7 @@ from .clamp import (
 )
 from . import freshness
 from . import lateness
+from .settle import Settle
 from . import dayview, homeview
 from .daycurve import SolarToday
 from . import handback
@@ -527,6 +529,8 @@ class Controller(InputsMixin, WritesMixin, TradeMixin, CycleMixin, AlarmsMixin,
         self._mode_trade_was = False
         self._charge_blocked_q = None
         self._charge_gap_q = None       # OPT-15: an unmeasured stop's quarter
+        self._charge_young_q = None     # SAFETY-135: a young stop's quarter
+        self._gave = collections.deque()  # SAFETY-135: (t, W given), GAVE_S
         self._ref_cheap = None
         # OPT-15: a run edge the loop holds at E: (E, step sign, until, the
         # last battery reading).
@@ -741,6 +745,7 @@ class Controller(InputsMixin, WritesMixin, TradeMixin, CycleMixin, AlarmsMixin,
         self._arb_action = None
         self.inputs_bad_since = None
         self.answer = lateness.Answer()           # SAFETY-128
+        self.settle = Settle()                    # SAFETY-136
         self._late_logged = self._late_zero = False
         # SAFETY-03: what the loop's OWN bounds did last cycle, `(engaged,
         # note, over_rating)` (SAFETY-40 splits the last out). Site-level: the

goodwe_controller/app/modetrade.py

@@ -36,6 +36,9 @@ Rules that keep this safe (tests: test_modes_p3.py, test_price_run_fixes.py):
     makes the other batteries stop giving power, so a few watts of charge
     flipping on and off would swing the house between them and the grid
     (measured on the 2026-09-09 replay: 13 flips in 4 minutes at 3.5 kW);
+    SAFETY-135: a stop in a period's first YOUNG_S s holds only until then,
+    not to the period's end, and no charge starts then while the batteries'
+    give is still falling (`young`);
   * selling needs selling on for that battery, the sell run, a price >= 0
     now, and the battery above `arbitrage_soc_floor`; it stops there. The
     peak guard never stops a sell (section 9.1: discharge is never capped);
@@ -69,6 +72,12 @@ PRICE_MODES = (LEFTOVER_SOLAR, CHEAP_HOURS)
 # would stop covering the house for less than they give.
 START_W = 500.0
 
+# SAFETY-135: seconds a 15-minute period is young, and how far back a
+# battery's give counts as maybe not yet on the meter.
+# DECISIONS/SAFETY-135-young-period.md
+YOUNG_S = 60.0
+GAVE_S = 15.0
+
 
 @dataclass(frozen=True)
 class Pack:
@@ -164,7 +173,7 @@ def energy(packs, floor_pct, ceiling_pct, done_charge=(), done_sell=(),
 def decide(runs, now, packs, *, charge_ok, sell_ok, trade_why, price_now,
            headroom_w, floor_pct, ceiling_pct, house_w, charging_now=False,
            blocked=False, done_charge=(), done_sell=(),
-           targets=None, draining=False) -> Tick:
+           targets=None, draining=False, young=False) -> Tick:
     """This tick's ranges, roles and site ask.
 
     `runs` is the kept `priceruns.RunPlan` or None (no fresh prices).
@@ -177,7 +186,8 @@ def decide(runs, now, packs, *, charge_ok, sell_ok, trade_why, price_now,
     it going); `blocked` that the guard or the headroom stopped a charge in
     this 15-minute period. `targets` is the day plan (`charge_to()`).
     `draining` says a battery drains for its monthly cycle, so none may
-    charge from the grid (why "cycle").
+    charge from the grid (why "cycle"). `young` says no charge may start
+    yet in this young period (SAFETY-135, why "young").
     """
     plan_on = runs is not None and runs.on
     in_cheap = plan_on and runs.cheap.holds(now) and runs.charge_useful()
@@ -198,6 +208,8 @@ def decide(runs, now, packs, *, charge_ok, sell_ok, trade_why, price_now,
             why = trade_why
         elif headroom_w is None or not headroom_w > need:
             why = "headroom"
+        elif young and not charging_now:
+            why = "young"
         else:
             charging = True
     se = sellers(packs, floor_pct, done_sell) if in_sell and not charging \

goodwe_controller/app/settle.py

@@ -0,0 +1,74 @@
+"""SAFETY-136: on a slow meter, follow the meter gently until the last move shows.
+
+A meter whose usual gap between readings is over 3.75 s (a 4-5 s meter), read
+through Home Assistant, can be 10-15 s late. The loop then answers the same error again at each cycle
+and overshoots. After a move of MOVE_W or more the loop therefore runs at
+WAIT_SHARE of its gain until the meter has fallen SHOWN of the move, or for at
+most WAIT_CYCLES cycles. Off for a meter with a usual gap of 3.75 s or less, so those sites run as
+before. DECISIONS/SAFETY-136-slow-meter-settle.md.
+"""
+
+from collections import deque
+from dataclasses import replace
+
+from .lateness import M_FIT_S, M_ROWS
+
+# A meter is slow when its readings come further apart than this (the usual
+# gap, over the last 60 s and at least 5 readings): the fast meter fit's own
+# limit (SAFETY-128), 3.75 s.
+SLOW_GAP_S = M_FIT_S / M_ROWS
+SLOW_ROWS = 5
+# A move this big is waited for (above the house noise of about 80 W).
+MOVE_W = 150.0
+# The meter has shown a move once it fell by this share of it.
+SHOWN = 0.5
+# Meanwhile the loop runs at this share of its gain.
+WAIT_SHARE = 0.5
+# Wait at most this many cycles (10 s at a 5 s meter).
+WAIT_CYCLES = 2
+
+
+class Settle:
+    def __init__(self):
+        self.pend = None          # (meter at the move, the move in W, cycles waited)
+        self._n = None            # readings taken in so far
+        self._at = deque()        # when the last ones arrived, over M_FIT_S
+
+    def arrive(self, now, n):
+        """Each read: `n` is the count of meter readings taken in. A reading
+        counts when it arrives, not when its value changes, so a steady load on
+        a 1 s meter is not a slow meter."""
+        if n != self._n:
+            self._n = n
+            self._at.append(now)
+        while self._at and self._at[0] < now - M_FIT_S:
+            self._at.popleft()
+
+    def slow(self):
+        """The usual gap between readings is over SLOW_GAP_S."""
+        ts = list(self._at)
+        if len(ts) < SLOW_ROWS:
+            return False
+        gaps = sorted(b - a for a, b in zip(ts, ts[1:]))
+        return gaps[len(gaps) // 2] > SLOW_GAP_S
+
+    def reset(self):
+        self.pend = None
+
+    def tuning(self, tuning, grid_w, slow):
+        """The tuning for this cycle: `tuning`, or with the gain cut while the
+        last move has not shown on the meter (`grid_w`)."""
+        p = self.pend
+        if p is None:
+            return tuning
+        g0, move, waited = p
+        if not slow or (g0 - grid_w) / move >= SHOWN or waited >= WAIT_CYCLES:
+            self.pend = None
+            return tuning
+        self.pend = (g0, move, waited + 1)
+        return replace(tuning, gain=tuning.gain * WAIT_SHARE)
+
+    def moved(self, grid_w, prev_w, new_w, slow):
+        """After a cycle: start waiting if the loop moved by MOVE_W or more."""
+        if slow and self.pend is None and abs(new_w - prev_w) >= MOVE_W:
+            self.pend = (float(grid_w), float(new_w - prev_w), 0)

goodwe_controller/test_safety129.py

@@ -38,6 +38,7 @@ logging.disable(logging.WARNING)
 import safety128_rig as R                                      # noqa: E402
 import app.main as app_main                                    # noqa: E402
 from app import lateness                                       # noqa: E402
+from app import settle                                         # noqa: E402
 
 fails = []
 
@@ -58,6 +59,17 @@ def no_gate(fn):
         app_main.Controller._readings_late = real
 
 
+def no_settle(fn):
+    """`fn()` without SAFETY-136's gentler loop: the tree this card was written
+    against (with it the same run exports -645 W, not -1 325 W)."""
+    real = settle.Settle.moved
+    settle.Settle.moved = lambda self, *a, **k: None
+    try:
+        return fn()
+    finally:
+        settle.Settle.moved = real
+
+
 def run_late(**kw):
     """Run the rig; (rig, seconds the verdict stood, first second it stood)."""
     dur = kw.pop("dur")
@@ -91,7 +103,7 @@ for units, house in ((AB, 1800.0), (A, 1500.0)):
     if len(units) == 2:
         old = R.Rig(house=house, lag_s=30.0, lag_on=ON, lag_off=ON + 300.0,
                     units=units, p1_s=5.0)
-        no_gate(lambda: old.run(ON + 300.0))
+        no_settle(lambda: no_gate(lambda: old.run(ON + 300.0)))
         check(f"{n}: without the gate the export goes below -1 kW",
               grid_min(old.rows, ON, ON + 300.0) < -1000.0)
 

goodwe_controller/test_safety135.py

@@ -0,0 +1,202 @@
+"""Runnable check for SAFETY-135: a young 15-minute period does not cost the
+night charge the whole period.  `python3 test_safety135.py`
+
+The REAL Controller (tools/opt11p3_replay.py, read_inputs + cycle, battery
+modes, the peak guard on a P1 meter) with TEST-23-like lag: 1 s cycles,
+readings 1 s old, a 5 s old meter in part 2. "Off" is the same run with
+`modetrade.YOUNG_S = 0`: the tree before this card.
+DECISIONS/SAFETY-135-young-period.md.
+
+1. A peak-bound night charge; a period starts with a 4 s kettle spike. The
+   guard cuts at once, and the charge resumes in that period (off: it stays
+   off to the period's end). The period stays at or under the aim.
+2. A cheap run starts at 01:00 right after a give run, with a 5 s meter: no
+   start-then-cut within 60 s (off: one), and no period over the aim.
+3. A real over-aim load: the guard and the charge stop on the same cycle as
+   off, and the charge stays off while the load is on.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import logging
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11p3_replay as rp                                    # noqa: E402
+from app import arbitrage, modetrade, packmode                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+L = timezone(timedelta(hours=1))
+D0 = datetime(2026, 11, 3, tzinfo=L)
+UTC0 = D0.astimezone(timezone.utc)
+# Local quarters: dear 00:00-01:00 (a give run), cheap 01:00-07:00, 0.30 else.
+PRICES = [0.40 if q < 4 else 0.10 if q < 28 else 0.30 for q in range(96)] * 2
+WPTS = [(UTC0 + timedelta(minutes=15 * i), 900, p)
+        for i, p in enumerate(PRICES)]
+AIM = rp.PEAK_CAP - 50
+CH = {"a": (True, packmode.CHEAP_HOURS, False),
+      "b": (True, packmode.CHEAP_HOURS, False)}
+T1 = D0 + timedelta(hours=1)                    # 01:00 local, the cheap edge
+
+
+def off(fn):
+    """`fn()` with SAFETY-135 off: no period is young."""
+    real = getattr(modetrade, "YOUNG_S", None)
+    if real is None:
+        return fn()
+    modetrade.YOUNG_S = 0.0
+    try:
+        return fn()
+    finally:
+        modetrade.YOUNG_S = real
+
+
+def run(house_w, start, secs, meter_s=1.0):
+    """Rows per cycle and the Controller, for `house_w(seconds since 01:00)`."""
+    t0 = start.timestamp()
+    house = [(t0 + k, house_w(t0 + k - T1.timestamp()))
+             for k in range(int(secs) + 5)]
+    rows = []
+
+    def cb(c, h, now, pr):
+        g = c.peak_guard
+        rows.append(dict(now=now, s=now.timestamp() - T1.timestamp(),
+                         grid=h.grid(),
+                         charge=getattr(c.arb, "action", None)
+                         == arbitrage.CHARGE,
+                         engaged=g is not None and g.engaged))
+    _st, c = rp.run("p3_ch_sell", house, WPTS, start.astimezone(timezone.utc),
+                    secs, check=cb, soc0={"a": 30.0, "b": 30.0}, choice=CH,
+                    extra={"slew_w": 0, "cycle_cost_threshold_eur": 0.03},
+                    lag=rp.Lag(meter_s=meter_s))
+    return rows, c
+
+
+def banked(c, frm):
+    """The add-on's own P1 period averages from `frm` (seconds after 01:00)."""
+    return [b.offtake_avg_w for b in c.p1.blocks
+            if b.start.timestamp() - T1.timestamp() >= frm]
+
+
+def flaps(rows, frm, to):
+    """Charge starts in [frm, to) s that stopped again within 60 s."""
+    out = []
+    for i in range(1, len(rows)):
+        r = rows[i]
+        if frm <= r["s"] < to and r["charge"] and not rows[i - 1]["charge"]:
+            if any(not x["charge"] for x in rows[i:]
+                   if x["s"] - r["s"] <= 60):
+                out.append(r["s"])
+    return out
+
+
+# ============================================================================ #
+print("1. a 4 s spike at the start of a peak-bound night charge's period")
+
+
+def spike(s):
+    return 2800.0 + (2500.0 if s >= 1800 and (s - 1800) % 900 < 4 else 0.0)
+
+
+R1, C1 = run(spike, T1 + timedelta(minutes=20), 1560)
+R1o, C1o = off(lambda: run(spike, T1 + timedelta(minutes=20), 1560))
+
+
+def period(rows, frm):
+    return [r for r in rows if frm <= r["s"] < frm + 900]
+
+
+for tag, rows, c in (("on", R1, C1), ("off", R1o, C1o)):
+    p = period(rows, 1800)
+    cut = next((r["s"] - 1800 for r in p if r["engaged"]), None)
+    on = sum(r["charge"] for r in p)
+    print(f"    {tag}: guard cut at +{cut} s, charging {on} of {len(p)} s, "
+          f"period {banked(c, 1800)[:1]}")
+_p = period(R1, 1800)
+_cut = next((i for i, r in enumerate(_p) if r["engaged"]), None)
+check("the spike trips the guard in the period's first seconds and the "
+      "charge stops there",
+      _cut is not None and _p[_cut]["s"] - 1800 <= 5
+      and not _p[_cut]["charge"])
+_back = [r["s"] - 1800 for r in _p[(_cut or 0):] if r["charge"]]
+check("the charge resumes in the same period, within 90 s of its start",
+      _back and _back[0] <= 90)
+_po = period(R1o, 1800)
+check("off, the same spike keeps the charge off to the period's end (the "
+      "defect this card fixes)",
+      any(r["engaged"] for r in _po[:5])
+      and not any(r["charge"] for r in _po[10:]))
+check("every period with the charge is at or under the aim (lag allows 2 W)",
+      banked(C1, 0) and max(banked(C1, 0)) <= AIM + 2.0)
+
+# ============================================================================ #
+print("\n2. a cheap run at 01:00 right after a give run, 5 s meter")
+for house in (2400.0, 3000.0):
+    def flat(s, w=house):
+        return w
+    R2, C2 = run(flat, T1 - timedelta(minutes=5), 1260, meter_s=5.0)
+    R2o, C2o = off(lambda: run(flat, T1 - timedelta(minutes=5), 1260,
+                               meter_s=5.0))
+    f2, f2o = flaps(R2, 0, 900), flaps(R2o, 0, 900)
+    p2, p2o = banked(C2, 0)[:1], banked(C2o, 0)[:1]
+    on2 = sum(r["charge"] for r in period(R2, 0))
+    on2o = sum(r["charge"] for r in period(R2o, 0))
+    print(f"    house {house:.0f} W: on flaps {f2} charging {on2} s period "
+          f"{p2}; off flaps {f2o} charging {on2o} s period {p2o}")
+    check(f"house {house:.0f} W: no charge start is cut within 60 s in the "
+          f"01:00 period", not f2)
+    check(f"house {house:.0f} W: the 01:00 period is at or under the aim "
+          f"(lag allows 2 W)", p2 and p2[0] <= AIM + 2.0)
+    check(f"house {house:.0f} W: the charge still runs in the 01:00 period",
+          on2 >= 800)
+    if house == 3000.0:
+        check("off, the 3 000 W house starts on the young period and is cut "
+              "within 60 s (the defect this card fixes)", bool(f2o))
+
+# ============================================================================ #
+print("\n3. a real over-aim load still cuts on the same cycle")
+
+
+def load(s):
+    return 2800.0 + (4000.0 if 1820 <= s < 2120 else 0.0)
+
+
+R3, C3 = run(load, T1 + timedelta(minutes=20), 1500)
+R3o, C3o = off(lambda: run(load, T1 + timedelta(minutes=20), 1500))
+
+
+def first(rows, key, val, frm):
+    return next((r["s"] for r in rows if r["s"] >= frm and r[key] == val),
+                None)
+
+
+_g, _go = first(R3, "engaged", True, 1800), first(R3o, "engaged", True, 1800)
+_s, _so = first(R3, "charge", False, 1800), first(R3o, "charge", False, 1800)
+print(f"    guard cut at {_g} s (off {_go} s), charge stop at {_s} s "
+      f"(off {_so} s)")
+check("the guard cuts on the same cycle as off, and the charge stops on it",
+      _g is not None and _g == _go and _s == _so == _g)
+check("the charge stays off while the load is on",
+      not any(r["charge"] for r in R3 if _g <= r["s"] < 2120))
+check("every period is at or under the aim (lag allows 2 W)",
+      banked(C3, 0) and max(banked(C3, 0)) <= AIM + 2.0)
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)}")
+    sys.exit(1)
+print("all SAFETY-135 checks passed")

goodwe_controller/test_safety136.py

@@ -0,0 +1,263 @@
+"""Runnable check for SAFETY-136: a calmer loop on a slow meter.
+`python3 test_safety136.py`
+
+With a 5 s meter and Home Assistant readings 10-15 s late the loop answers the
+same error again at each cycle and overshoots: with an oven, a kettle and hob,
+or a step the export was 3-10 times that of a meter with no lag. After a move
+of 150 W or more `app/settle.py` now runs the loop at half its gain (at most
+2 cycles) until the meter shows half of it. It is off for a meter under 4 s.
+DECISIONS/SAFETY-136-slow-meter-settle.md.
+
+The REAL Controller on TEST-23's plant (tools/safety128_rig.py). "Off" is the
+same run with `Settle.moved` doing nothing: the tree before this card.
+
+1. `Settle` alone.
+2. 5 s meter, readings 10 s late: oven, kettle and hob, a step down and a step
+   up export clearly less than with it off.
+3. 5 s meter, no lag: the same houses are no worse than a small margin.
+4. 1 s and 2 s meters: the commands are those of the run with it off, and the
+   loop never waits.
+5. The slow meter is told by its observed interval, at 4 s and 5 s.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import logging
+import os
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import safety128_rig as R                                      # noqa: E402
+from app.control import Tuning                                # noqa: E402
+from named_absence import nth, present                         # noqa: E402
+from app import settle                                         # noqa: E402
+from app.lateness import MeterFit                              # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def off(fn):
+    """`fn()` with the settle wait off: the tree before this card."""
+    real = settle.Settle.moved
+    settle.Settle.moved = lambda self, *a, **k: None
+    try:
+        return fn()
+    finally:
+        settle.Settle.moved = real
+
+
+def oven(t):
+    return 1800.0 + (2000.0 if (t >= 300.0 and (t - 300.0) % 105 < 45) else 0.0)
+
+
+def kettle(t):
+    w = 600.0
+    if t % 400 < 120:
+        w += 2200
+    if t >= 900 and t % 90 < 30:
+        w += 1500
+    return w
+
+
+def step(t):
+    return 1800.0 if t < 320.0 else 300.0
+
+
+def stepup(t):
+    return 300.0 if t < 320.0 else 2500.0
+
+
+# name: (house, noise, run length, lag end)
+HOUSES = {"oven": (oven, 80.0, 900.0, 900.0),
+          "kettle": (kettle, 80.0, 1500.0, 1500.0),
+          "step": (step, 50.0, 700.0, 600.0),
+          "stepup": (stepup, 50.0, 700.0, 600.0)}
+ON = 300.0
+
+
+def wh(rows, t0, t1, sign):
+    """Export (sign -1) or import (sign +1) energy in Wh over [t0, t1)."""
+    return sum((-min(r[1], 0.0) if sign < 0 else max(r[1], 0.0))
+               for r in rows if t0 <= r[0] < t1) / 3600.0
+
+
+def run(name, lag, p1_s=5.0, units=("a", "b"), dur=None):
+    house, noise, length, lag_off = HOUSES[name]
+    r = R.Rig(house=house, noise=noise, p1_s=p1_s, units=units, lag_s=lag,
+              lag_on=ON, lag_off=lag_off)
+    waits = []
+    r.run(dur or length + 20.0,
+          lambda rig, c, t: waits.append(1) if c.settle.pend else None)
+    return r, len(waits)
+
+
+# --------------------------------------------------------------------------- #
+print("1. Settle alone")
+T = Tuning()
+s = settle.Settle()
+check("no move: the tuning is untouched", s.tuning(T, 500.0, True) is T)
+s.moved(500.0, 0.0, 100.0, True)
+check("a move under 150 W is not waited for", s.pend is None)
+s.moved(500.0, 0.0, 600.0, False)
+check("a meter that is not slow is not waited for", s.pend is None)
+s.moved(500.0, 0.0, 600.0, True)
+check("a move of 600 W is waited for: half the gain",
+      s.tuning(T, 500.0, True).gain == T.gain * 0.5)
+check("the meter fell 200 W of 600 W: still half the gain",
+      s.tuning(T, 300.0, True).gain == T.gain * 0.5)
+check("two cycles waited: the third has the whole gain",
+      s.tuning(T, 300.0, True) is T and s.pend is None)
+s.moved(500.0, 0.0, 600.0, True)
+check("the meter went the other way by half the move: the wait stands",
+      s.tuning(T, 800.0, True).gain == T.gain * 0.5)
+s.reset()
+s.moved(500.0, 0.0, -600.0, True)
+check("a move down, the meter rose half the move: the whole gain",
+      s.tuning(T, 800.0, True) is T)
+s.reset()
+s.moved(500.0, 0.0, 600.0, True)
+check("the meter fell half the move: the whole gain at once",
+      s.tuning(T, 200.0, True) is T and s.pend is None)
+s.moved(500.0, 0.0, -600.0, True)
+check("a move down is waited for too",
+      s.tuning(T, 500.0, True).gain == T.gain * 0.5)
+s.reset()
+check("reset ends the wait", s.pend is None)
+s.moved(500.0, 0.0, 600.0, True)
+check("a meter that turns out not to be slow ends the wait",
+      s.tuning(T, 500.0, False) is T and s.pend is None)
+check("the numbers are pinned",
+      (settle.MOVE_W, settle.SHOWN, settle.WAIT_SHARE, settle.WAIT_CYCLES)
+      == (150.0, 0.5, 0.5, 2))
+
+# --------------------------------------------------------------------------- #
+print("\n2. 5 s meter, readings 10 s late")
+tot_on = tot_off = 0.0
+for name, (_h, _n, length, lag_off) in HOUSES.items():
+    a, waited = run(name, 10.0)
+    b, _w = off(lambda: run(name, 10.0))
+    ea, eb = wh(a.rows, ON, lag_off, -1), wh(b.rows, ON, lag_off, -1)
+    tot_on, tot_off = tot_on + ea, tot_off + eb
+    print(f"    {name}: export {ea:.1f} Wh, off {eb:.1f} Wh, waited {waited} s")
+    check(f"{name}: waits at some point", waited > 0)
+    check(f"{name}: exports at most 75 % of the run with it off",
+          ea <= 0.75 * eb)
+print(f"    sum: {tot_on:.1f} Wh, off {tot_off:.1f} Wh")
+check("the four together export at most 65 % of the run with it off",
+      tot_on <= 0.65 * tot_off)
+
+# --------------------------------------------------------------------------- #
+print("\n2b. Another writer overrides the loop: the wait ends")
+halved = []
+real_tuning = settle.Settle.tuning
+
+
+def watch_tuning(self, tuning, grid_w, slow):
+    r = real_tuning(self, tuning, grid_w, slow)
+    halved.append(r is not tuning)
+    return r
+
+
+settle.Settle.tuning = watch_tuning
+try:
+    mark = []
+
+    def bump(rig, c, t):
+        # right after a cycle that started a wait, another writer moves the
+        # command, so the next cycle sees `target != loop_w`
+        if not mark and c.settle.pend and t > 330.0:
+            mark.append(len(halved))
+            c.target = c.target + 300.0
+
+    r = R.Rig(house=oven, noise=80.0, p1_s=5.0, lag_s=10.0, lag_on=ON,
+              lag_off=900.0)
+    r.run(500.0, bump)
+finally:
+    settle.Settle.tuning = real_tuning
+nxt = nth(halved, mark[0] if mark else 10 ** 6)
+check("the cycle after an override has the whole gain",
+      bool(mark) and present(nxt) and nxt is False)
+
+# --------------------------------------------------------------------------- #
+print("\n3. 5 s meter, no lag")
+for name in ("oven", "kettle", "step", "stepup"):
+    _h, _n, length, lag_off = HOUSES[name]
+    a, _w = run(name, 0.0)
+    b, _w = off(lambda: run(name, 0.0))
+    ea, eb = wh(a.rows, ON, lag_off, -1), wh(b.rows, ON, lag_off, -1)
+    ia, ib = wh(a.rows, ON, lag_off, 1), wh(b.rows, ON, lag_off, 1)
+    print(f"    {name}: export {ea:.1f} Wh (off {eb:.1f}), import {ia:.1f} Wh "
+          f"(off {ib:.1f})")
+    check(f"{name}: export at most 6 Wh over the run with it off",
+          ea <= eb + 6.0)
+    check(f"{name}: import at most 1 Wh over the run with it off",
+          ia <= ib + 1.0)
+
+# --------------------------------------------------------------------------- #
+print("\n4. 1 s and 2 s meters")
+for p1 in (1.0, 2.0):
+    for lag in (0.0, 10.0):
+        for units in (("a", "b"), ("a",)):
+            a, waited = run("oven", lag, p1_s=p1, units=units, dur=700.0)
+            b, _w = off(lambda: run("oven", lag, p1_s=p1, units=units,
+                                    dur=700.0))
+            same = ([(r[0], r[1], r[2]) for r in a.rows]
+                    == [(r[0], r[1], r[2]) for r in b.rows])
+            check(f"{p1:.0f} s meter, {lag:.0f} s late, N={len(units)}: "
+                  f"same commands, never waits", same and waited == 0)
+
+# --------------------------------------------------------------------------- #
+print("\n5. The slow meter is told by its observed interval")
+s = settle.Settle()
+for k in range(30):
+    s.arrive(float(k), k)
+check("a reading each second is not a slow meter", not s.slow())
+s = settle.Settle()
+for k in range(30):
+    s.arrive(5.0 * k, k)
+check("a reading every 5 s is a slow meter", s.slow())
+s = settle.Settle()
+for k in range(4):
+    s.arrive(5.0 * k, k)
+check("fewer than 5 readings in a minute tell nothing", not s.slow())
+s = settle.Settle()
+for k in range(30):
+    s.arrive(5.0 * k, 0 if k else 1)
+check("the same count again is no new reading", not s.slow())
+for p1, expect in ((1.0, False), (2.0, False), (3.0, False), (4.0, True),
+                   (5.0, True), (10.0, True)):
+    r = R.Rig(house=1800.0, p1_s=p1)
+    seen = []
+    r.run(120.0, lambda rig, c, t: seen.append(c.settle.slow()))
+    last = nth(seen, -1)
+    check(f"{p1:.0f} s meter: slow is {expect}",
+          present(last) and last is expect)
+# A 1 s meter on a house that changes every 5 s repeats its value 4 times in 5.
+# Where every reading arrives (the rig, a polled meter) it is not slow; where
+# Home Assistant sends a reading only when the value changes (ha_signed) the
+# same meter is slow (T3 of the review; DECISIONS).
+s, m, h = settle.Settle(), MeterFit(), settle.Settle()
+for k in range(60):
+    s.arrive(float(k), k)
+    h.arrive(float(k), k // 5)
+    m.add(float(k), 0.0, 1800.0 + 100.0 * (k // 5))
+check("every reading arrives, value changes every 5 s: not slow (the value "
+      "fit says slow)", not s.slow() and m.slow())
+check("the same meter through Home Assistant on change (a reading per "
+      "change): slow", h.slow())
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all checks passed")