Merge release/1.0 (TARIFF-12) into TARIFF-14

Second base move while this card was open: 559f0eb -> a6e64fb. Only
CHANGELOG.md conflicted; test_arbitrage.py auto-merged (TARIFF-12 used
section 8b, this card uses 10, so the two do not collide).

CHANGELOG: both entries under the single ## Unreleased in MERGE ORDER -
TARIFF-12's row and section precede this branch's, because it landed
first. No version number is picked; PKG-06/07's note stands untouched.

WHAT TARIFF-12 CHANGES FOR THIS CARD - written out in decision note §8
rather than left silent, because the question is a fair one.

A served plan can now be up to TARIFF_MAX_AGE_S = 3 * TARIFF_REFRESH_S
= 5400 s old, where before it was at most one refresh interval, and
at() is what answers "what does it cost right now" out of that older
plan.

* PER-POINT SPAN: unaffected, structurally. Every window is derived
  from the neighbours' ABSOLUTE start instants - datetimes in a frozen
  dataclass in a tuple, which cannot move - and _cover_table() runs
  once at construction over data that cannot change. A plan's AGE is a
  property of fetched_at/tariff_at, never of a window. The index cannot
  go stale, which is a small positive under TARIFF-12: a kept plan now
  lives longer and there is nothing in it that needed recomputing.

* ONE-HOUR CAP: unaffected. It bites only at a hole; walking further
  into a series crosses more windows, each resolved on its own
  neighbours.

* THE TAIL: reachable for the first time, and §2's choice survives it.
  At the shipped 48 h horizon the tail is ~46.5 h beyond anything a
  90-minute-stale plan can be asked about. But price_horizon_h is
  int(1,72), so a 1 h horizon is a SUPPORTED configuration, and a
  90-minute serve-stale window against a 1 h series puts `now` past the
  end. Under the chosen rule a quarter-hourly 1 h series ends at :45,
  its window closes on the hour, at() raises Absence, _act() idles and
  §11.4 sends the site to the static profile. Under the REJECTED flat
  one-hour tail the same stale plan would have traded against the :45
  print for up to 45 minutes after the interval it describes had ended.
  So TARIFF-12 does not weaken the decision - it is the first thing
  that makes it reachable, and it selects the same answer. The rule
  should be re-read if TARIFF_MAX_AGE_S is ever widened again.

* TariffPlan.from_feed is a pure predicate on `origin` and TARIFF-12
  keeps or replaces a WHOLE PLAN OBJECT. It never splices two reads
  into one series, so it cannot hand at() an unsorted or duplicated
  point list.

RE-GRADED ON THIS BASE, not carried over: all 29 test files green;
app/price.py byte-identical to the TARIFF-10 merge (90d8ca31f7c0109d,
85953 B) because TARIFF-12 does not touch it; M1 re-driven at +68 B,
red on the same 24 named checks across both files; M3 re-driven at
ZERO BYTES, red on the same 4. Each purged before the run and reverted
with the fingerprint re-checked, from a card-specific harness at
/home/homelab/.cache/t14-mut/ with a mktemp backup inside it.

This branch contributes zero diff to app/main.py and app/static_tariff.py.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -17,6 +17,258 @@ if it has, it needs 0.10.0. Whoever deploys decides.
 | _this branch_ | FCST-06 - "cannot persist" stops meaning "has no /data" and starts meaning what it says |
 | _this branch_ | TARIFF-08 - the day-ahead feed is read in the shape it actually publishes, and the fixtures stop agreeing with the parser |
 | _this branch_ | TARIFF-09 - the day-ahead feed is asked for the horizon it was given, so tomorrow arrives firm instead of carried |
+| _this branch_ | TARIFF-10 - configuring a price provider is what fetches prices; trading stays its own switch |
+| _this branch_ | TARIFF-12 - a supplier outage stops deleting the plan on its first failed fetch, and TARIFF_MAX_AGE_S starts governing |
+| _this branch_ | TARIFF-14 - the price a trade is decided against is the price of the interval being traded |
+
+### TARIFF-10 - a configured provider is fetched, whether or not you trade
+
+**`amain()` started the background tariff refresh only when
+`arbitrage_enabled` was on, and that option ships `false`.**
+`run_tariff_refresh` is the only caller of `resolve_tariff()`, which is the
+only caller of `price_history.carry()` - so on a shipped install with a price
+provider configured **nothing was ever fetched**: no plan resolved,
+`/data/price_history.json` never created, the *Price history* status row
+reading `empty` for the life of the install, and TARIFF-09's short-horizon
+warning unable to fire because there was no fetch to warn about.
+
+Measured over a 40 h soak of two instances side by side on the same feed:
+
+| | shipped default + provider | same, arbitrage armed |
+|---|---|---|
+| feed requests | **0** | fetching |
+| `/data/price_history.json` | `present: false` on **all 802 samples** | written |
+| resolved plan | none | 132 points |
+
+⚠️ **`DOCS.md` has described the fixed behaviour since the commit that wrote
+the gate.** OPT-04 (`bdd7f18`) added the refresh task, the
+`arbitrage.enabled()` guard on it, and the sentence *"turning a provider on
+still fetches, validates and publishes prices and changes no charging
+decision"* — all in one change. `config.yaml` has said the same since
+TARIFF-02 (`852fc7c`). The documentation and the code have therefore disagreed
+for as long as both existed, and nothing compared them. `config.yaml` and both translations carried the same
+claim, plus a second one that had gone stale in the other direction (*"nothing
+consumes the price series yet"*, untrue since OPT-04). All four now say what
+the add-on does.
+
+**The gate is `tariff_refresh_wanted()`, and it is a STRICT WIDENING.**
+
+```
+provider_configured(opts) or arbitrage.enabled(opts)
+```
+
+Every configuration that started the refresh before still starts it. The second
+term is not redundant and is not there for symmetry: `price_provider: off` with
+a `static_profile` and `arbitrage_enabled: true` is a configuration
+`validate.py` explicitly **accepts**, and it trades - measured, at
+`cycle_cost_threshold_eur: 0.05` on a 0.20/0.284 EUR/kWh day/night profile,
+`ARBITRAGE_CHARGE -5000 W`. Gating the refresh on the provider alone would
+leave that site's `tariff_plan` at `None` forever and answer *"no tariff plan
+has been resolved yet"* on every cycle - silently disarming a strategy the UI
+says is running.
+
+⚠️ **Nothing acquires a periodic HTTPS call from this.** With `price_provider`
+off, `resolve_tariff()` answers out of the static profile without opening a
+socket; and the true shipped default - no provider, no trading - starts **no
+task at all**. What decides whether a request leaves the machine is
+`price_provider`, and only that.
+
+⚠️ **AND NOTHING TRADES THAT DID NOT TRADE BEFORE.** `cycle()`'s
+`if arbitrage.enabled(self.o):` is untouched. Graded directly rather than
+inferred from the gate having moved: `Controller.cycle()` is driven on a
+resolved provider plan whose cheapest firm hour is now, with the peak guard
+asserted clear, and `arbitrage_enabled` is the single option that moves between
+the rows.
+
+| `arbitrage_enabled` | cheapest hour is now | commanded |
+|---|---|---|
+| `false` | yes | **+180 W** (`loop -> 180 W`) |
+| `false` | no | **+180 W** (`loop -> 180 W`) |
+| `true` | yes | -5000 W (`arbitrage -> -5000 W`) |
+| `true` | no | +5000 W (`arbitrage -> 5000 W`) |
+
+**`TariffPlan.cheap_now()` is deliberately NOT wired, and that is now a
+decision rather than an inheritance.** A provider-backed plan exists on every
+configured site from this commit, so *Cheap window* - which feeds the
+maintenance cycle's grid top-up, i.e. the one place a price reaches something
+that **moves energy** without trading being armed - could now read it. It does
+not: `self.cheap` still comes from `static_status()`, and on a provider-only
+site (`static_profile` empty) that is `False` on every cycle, so no paid grid
+top-up is ever forced. Wiring it would take that from *never* to *sometimes*.
+`DECISIONS/TARIFF-10-fetching-is-not-trading.md` §4 carries the argument and
+the list of what adopting it would take.
+
+**The check that would have caught this** is `test_price.py` section 13, and it
+grades **reachability from a configuration**, not the shape of an `if`. The
+guards in `amain()` are *evaluated* against real option dicts, whatever they are
+spelled as; the call graph under `app/` is walked to see whether the tasks those
+guards start can arrive at `resolve_tariff()`, wherever it has moved to; and
+then the fetch is **driven** with a counting transport, because a graph is an
+argument and a counted request is an observation. The shipped defect - the gate
+back at `arbitrage.enabled(opts)`, **-4 B** - is red on seven named checks.
+
+### TARIFF-12 - a returned degradation is not a refresh
+
+**`run_tariff_refresh()` promised in its own docstring that "a failure does not
+clear the plan", and enforced it with `except Exception` - a branch a supplier
+outage never reaches.** `load_prices()` states the reason in its own words: it
+"RETURNS, NEVER RAISES, for every failure a site can actually have", because a
+degradation arriving as a traceback into the planning tick would stop the
+controller regulating over an expired certificate. So a dead feed **returns** a
+§11.4 plan, the `try` succeeds, and the assignment below it overwrote the good
+plan unconditionally. With `static_profile` unset - the shipped default, and the
+normal state of a dynamic-tariff site - `_degrade()` returns
+`TariffPlan(no_data, None, "none")`: **a complete 48-hour plan replaced by
+nothing.**
+
+Measured in a 40-hour soak, `static_profile` empty, a 90-minute outage driven:
+
+| Brussels | refresh | plan |
+|---|---|---|
+| 17:26:12 | 55 | `dynamic_dayahead from generic_dayahead, 141 h, provisional` |
+| **17:56:12** | **56** | **`no tariff - generic_dayahead: ClientConnectorError: Cannot connect to host`** |
+| 19:26:12 | 59 | restored, one refresh after the feed returned |
+
+`origin: none`, `n_points: 0` for all 30 outage samples. The plan was gone ~27
+minutes after the last good fetch, **at the first failure** - so
+`TARIFF_MAX_AGE_S` (5400 s) never governed anything, and there was no
+serve-stale window at all: a transient blip cost exactly what a long outage did.
+
+**The question is now asked once, after the attempt, from the evidence that
+exists** - FCST-06's answer, one module over. The evidence is
+`TariffPlan.from_feed` (did this resolution observe the configured feed) and the
+shipped `fresh_tariff_plan()` (is an observation still current). A degradation
+replaces a standing observation only once that observation has **aged out**, so
+`TARIFF_MAX_AGE_S` is now the serve-stale window it reads like.
+
+**A §11.4 static fallback does not replace a fresh provider plan either**,
+although it carries real prices. Every point `_degrade()` builds is
+`provisional=True`, so `firm_points()` is empty, `arbitrage()` refuses and
+`cheap_now()` is False - everything a consumer may act on is already off - while
+a day-ahead price for a given hour does not change once published. The fallback
+is less actionable and no more current; it takes over when the observation
+retires, which is what §11.4 is for. The rule is **not** symmetrical: a standing
+plan that is itself a degradation is replaced by the next one, or an outage
+would freeze the operator's static profile at the window it was first generated
+for.
+
+**`tariff_at` does not move on a kept plan.** It is the moment of the fetch that
+produced the plan standing, `fresh_tariff_plan()` judges the age from it, and an
+unmoved timestamp is the only thing that tells a kept plan from a freshly
+fetched one. Re-stamping it would be the refresh asserting the feed answered
+when it did not - the "freeze at its last value and look current forever" hazard
+the same docstring names.
+
+**What did NOT change.** The persisted price history still does not back the
+plan during an outage: FCST-03 exists to stop stale prices being acted on, and
+"recent" is not "current". Nothing about the control loop, the arbiter, or the
+30 s tick - `cycle()` still reads two attributes and awaits no fetch.
+
+`test_arbitrage.py` section 8b drives the whole chain with **nothing stubbed but
+the socket**: the transport raises the way aiohttp does, `load_prices()` returns
+`no_data`, `_degrade()` builds the §11.4 plan, and the shipped
+`run_tariff_refresh()` decides. A check that patched `resolve_tariff` to *raise*
+would have passed against the defect. Eleven mutations, eleven reds, no
+survivors - see `DECISIONS/TARIFF-12-a-degradation-is-not-a-refresh.md`.
+
+**Merged after TARIFF-10, which widened *which installs run this task*, and the
+two configurations it newly keeps alive are graded rather than reasoned about.**
+A provider with trading disarmed is the case this guard was designed for and is
+covered by every driven check here, because nothing in `run_tariff_refresh()`
+reads a trading option at all - asserted on the AST symbols rather than on the
+source text, after two drafts of that check went red on a correct tree for
+saying "arbitrage" in a docstring and in a log line. `price_provider: off` + a
+`static_profile` resolves to the CONFIGURED product (`origin: "static"`), so
+`standing.from_feed` is false on every refresh and the guard never latches: the
+plan is regenerated for the current window exactly as it always was. Both are
+driven, and a mutation that makes the guard depend on `arbitrage.enabled()` is
+red on five named checks.
+
+
+### TARIFF-14 - the trade was decided against the wrong price
+
+**On the only price feed that works, `_Series.at()` returned the wrong point,
+and the error grew with depth into the series.** It asked
+`s <= u < s + 1 h` of every point **in list order** and returned the **first**
+match. On the hourly shape every fixture in this repository carried before
+TARIFF-08 that is right by accident; Belgium moved to a **15-minute MTU on
+2025-10-01** and the live day-ahead feed returns **96 points at 900 s**, where
+it is wrong twice over. Measured against the shipped code at `5059e28`:
+
+```
+series: 02:00=0.10  02:15=0.11  02:30=0.12  02:45=0.13  03:00=0.14 ...
+
+ask + 0min -> 02:00  0.10
+ask +15min -> 02:00  0.10   <-- WRONG (wanted 02:15)
+ask +45min -> 02:00  0.10   <-- WRONG
+ask +60min -> 02:15  0.11   <-- WRONG (wanted 03:00)
+ask +75min -> 02:30  0.12   <-- WRONG (wanted 03:15)
+```
+
+Inside the first hour the `:00` point wins because its hour has not run out.
+**From the second hour on the answer is not even the top of the hour** - the
+first point still inside its own hour wins - so the error compounds.
+
+**What it cost is not "a slightly wrong price".** `arbitrage._act()` tests
+`here.start == v.cheapest.start` / `== v.dearest.start` to decide whether this
+interval is the buy one or the sell one. That identity almost never held, so
+**the strategy idled through exactly the interval it exists to trade**,
+reporting *"this hour is neither the buy hour nor the sell hour"* - and read
+§8.3's `here.provisional` and §17's `price < 0` off the same wrong point.
+`static_tariff.py` emits hourly points, so **static sites were never affected**;
+this was reachable only down the dynamic path TARIFF-08/09 made work.
+
+**The rule now, in one sentence: a point covers from its own start until the
+next point's start, and never more than one hour.**
+
+| | before | after |
+|---|---|---|
+| 900 s | `at(02:15)` -> the 02:00 point | -> the 02:15 point |
+| 3600 s | `at(02:30)` -> the 02:00 point | **unchanged** |
+| **mixed** `[900, 3600]` | each point one hour wide | **each point takes its own gap** |
+
+The mixed case is not an edge case: FCST-04's carry-forward emits **hourly
+carried points beside quarter-hourly firm ones**, and the soak measured spacing
+`[900, 3600]` in **70 % of samples**. A window derived from one global spacing
+would be wrong in the normal steady state.
+
+**The one-hour cap is load-bearing.** FCST-04 leaves an hour *out* of the
+series when nothing published it and yesterday has no value either, and
+`at()` raising `Absence` for that hour is what sends the caller to the static
+profile (§11.4). Uncapped, "until the next point's start" would stretch the
+point before a three-hour hole across the whole hole and answer every instant
+in it with a stale price - filling holes, introduced by the fix for a different
+defect.
+
+**The last point's window is a decision and it is written down.**
+`DECISIONS/TARIFF-14-the-window-a-point-covers.md` §2 argues it: the last point
+is given **the same span as the point before it** (one hour when it is the only
+point). A flat one-hour tail would answer **00:30 tomorrow with today's 23:45
+price**, which is reaching for a neighbour across a day boundary. The cost of
+the choice - a mixed series ending at the firm/carried seam loses its last 45
+minutes to `Absence` - is stated there rather than buried, and the direction is
+the safe one.
+
+**`at()` now reads a point's neighbours, so it would depend on the series being
+sorted - and it establishes that itself** rather than trusting the three
+producers that happen to guarantee it today. The lookup index is sorted by UTC
+start once, at construction; a series handed its 96 points in reverse order
+answers identically, which is a check. `covers()` shared the defect exactly
+(it has no rule of its own - it asks `at()`) and is fixed by the same change;
+`window()` did not (it grades a point's **start** against a range and asks
+nothing about duration), and its docstring now says so.
+
+**Nothing about §9.3 or a point's `start` changed.** `PricePoint` still has
+three fields; the span is derived from the neighbours, not stored.
+
+Graded by `test_price.py` section 14 - 900 s, 3600 s, **mixed**, holes, the
+tail, caller order, `covers()`/`window()` - and end to end by
+`test_arbitrage.py` section 10, which drives `decide()` over a 96-point
+quarter-hourly day whose cheapest and dearest quarters are deliberately **not**
+on a whole hour. Eight mutations, all red, including a **zero-byte** one on the
+tail rule; the table with byte deltas and the checks that were NOT reached is
+in the decision note §6.
+
 
 ### TARIFF-09 - the feed is asked for the range the caller wanted
 

goodwe_controller/DECISIONS/TARIFF-10-fetching-is-not-trading.md

@@ -0,0 +1,277 @@
+# TARIFF-10 — fetching a price and trading on one are two decisions
+
+**Status: DECIDED 2026-09-12 — Option A. If a price provider is configured,
+prices are fetched. Trading stays a separate switch (`arbitrage_enabled`), and
+this card moves nothing that moves energy.**
+
+Filed with TARIFF-10. Follows [[TARIFF-09]] and [[FCST-04]]; §4 settles the
+limitation FCST-04 recorded and did not decide.
+
+---
+
+## 1. The defect, and why it was invisible
+
+`app/main.py`'s `amain()` read:
+
+```
+if arbitrage.enabled(opts):
+    tasks.append(asyncio.create_task(controller.run_tariff_refresh()))
+```
+
+`run_tariff_refresh` is the **only** caller of `resolve_tariff()`, which is the
+**only** caller of `price_history.carry()`. `arbitrage_enabled` ships `false`.
+
+So on a shipped install with a provider configured:
+
+* no HTTPS request was ever made to the feed;
+* no plan was ever resolved, so `self.tariff_plan` stayed `None` forever;
+* `/data/price_history.json` was never created;
+* the *Price history* status row read `empty` for the life of the install;
+* TARIFF-09's short-horizon warning could not fire, because it is logged on a
+  fetch and there was no fetch.
+
+Measured, not inferred — a 40 h soak, two instances, one feed:
+
+| | shipped default + provider | same, arbitrage armed |
+|---|---|---|
+| feed requests | **0** | fetching |
+| `/data/price_history.json` | `present: false`, **802/802 samples** | written |
+| resolved plan | none | 132 points |
+
+⚠️ **AND FOUR SURFACES ALREADY DESCRIBED THE FIXED BEHAVIOUR.** `DOCS.md`
+§*Energy price providers*: *"With `arbitrage_enabled: false`, which is the
+shipped default, turning a provider on still fetches, validates and publishes
+prices and changes no charging decision."* `config.yaml` and both translations
+said the same, and additionally carried a claim that had gone stale in the other
+direction — *"nothing consumes the price series yet"*, untrue since OPT-04
+shipped the consumer. The code was the only surface that disagreed with all of
+them, and no check compared the two.
+
+The dating is worth being exact about, because it says this was never a
+regression. `git log -S` puts the refresh task, its `arbitrage.enabled()` guard
+**and** the DOCS sentence in the *same commit* — OPT-04, `bdd7f18`;
+`config.yaml`'s version of the claim goes back further, to TARIFF-02,
+`852fc7c`. The prose and the code disagreed from the moment both existed.
+
+## 2. Why a check on the `if` would not have caught it
+
+The `if` was exactly what somebody meant to write, and its comment argued for
+it honestly:
+
+> ⚠️ STARTED ONLY WHEN ARBITRAGE IS ARMED. Nothing else in the add-on reads the
+> resolved plan … so on a default install this task would be network traffic in
+> aid of an attribute nobody reads.
+
+That was true when OPT-04 wrote it and stopped being true when FCST-04 gave the
+plan a *store* and a *status row*. A pin on the expression would have gone red
+on the fix and green on the defect. What was wrong is the **set of
+configurations from which a fetch is reachable**, so that is what
+`test_price.py` section 13 grades:
+
+1. the guards on every `asyncio.create_task` in `amain()` are **evaluated**
+   against real option dicts — whatever the guard is spelled as;
+2. the call graph under `app/` is walked to see whether the coroutines those
+   guards start can arrive at `resolve_tariff()` — wherever it has moved to;
+3. and then the fetch is **driven**, with a counting transport, a real
+   `Controller` and a real store path, because a reachability graph is an
+   argument and a counted request is an observation.
+
+⚠️ **Step 3 grades the gate only because it starts the task the way `amain()`
+would.** The driver asks `_fetchers(opts)` — the evaluated guard — before it
+calls the coroutine. Measured: with the shipped defect restored **and** that one
+line defeated (`if False and "run_tariff_refresh" not in names:`), the four
+driven rows go **green** while only the structural rows stay red. Without it
+they are decoration, which is MUTATION.md's habit 4 in a harness.
+
+What the instrument **cannot** see is printed on every run: a coroutine started
+by anything but `create_task`; a guard that is not an enclosing `if` in
+`amain()`; anything outside `app/`; and — because the graph is keyed by **name**
+— two same-named functions as one node, which makes every *reachable* answer an
+**upper** bound and every *not reachable* answer the strong one.
+
+## 3. The gate, and why it is an `or`
+
+```
+def tariff_refresh_wanted(opts: dict) -> bool:
+    return provider_configured(opts) or arbitrage.enabled(opts)
+```
+
+The first term is what this card adds. **The second term is the old gate, kept
+verbatim, and it is not there for symmetry.**
+
+`price_provider: off` + a `static_profile` + `arbitrage_enabled: true` is a
+configuration `validate.py` explicitly **accepts** (rule 7 refuses only the
+no-prices-at-all case), and it **trades**. Measured on this branch:
+
+```
+opts: price_provider off, arbitrage_enabled true,
+      cycle_cost_threshold_eur 0.05,
+      static_profile 0.20 night / 0.284 day
+plan : static_profile from static_profile, 48 h, 48 points
+WITH  the plan -> ARBITRAGE_CHARGE -5000.0 W
+                  "cheapest firm hour at 0.2000 EUR/kWh, 0.0840 below the
+                   dearest and clear of the 0.0750 this cycle had to cover"
+WITHOUT the plan -> None  "no tariff plan has been resolved yet"
+```
+
+Gating the refresh on the provider **alone** — which is the literal reading of
+the ticket's second acceptance criterion — would leave that site's
+`tariff_plan` at `None` forever and answer *"no tariff plan has been resolved
+yet"* on every cycle. That is a strategy the UI says is running and that cannot
+fire: the exact state `validate.py`'s OPT-04 rules exist to refuse, arrived at
+from inside the code instead of from the configuration.
+
+So the gate is a **strict widening**: every configuration that started the task
+before still starts it, and `test_price.py` grades that as its own row rather
+than leaving it to prose.
+
+⚠️ **The AC's stated harm is still fully met, and it is worth being exact about
+this rather than quietly declaring victory.** The criterion reads *"with
+`price_provider: off`: no fetch task at all, whatever `arbitrage_enabled` says
+— an operator with no provider must not acquire a periodic HTTPS call."* The
+letter of it is not met in one configuration (provider off, trading armed),
+because that configuration keeps the task it already had. The harm it names is:
+
+* with `price_provider` off, `resolve_tariff()` returns `static_plan()` — pure
+  arithmetic, **no socket**. Driven and counted: **0 requests**.
+* the true shipped default — no provider, no trading — starts **no task at
+  all**.
+
+Nobody *acquires* a periodic HTTPS call from this card, and the only thing that
+decides whether a request leaves the machine is `price_provider`. **If the
+owner wants the literal reading instead, it is a one-token change** (drop the
+`or` term) **and it costs the site in the measurement above its trading.** That
+is the trade, stated rather than chosen silently.
+
+## 4. `TariffPlan.cheap_now()` — available, and deliberately NOT consumed
+
+**Decision: do not wire it in this card. `self.cheap` stays on
+`static_status()`.**
+
+FCST-04 recorded that `cheap_now()` has no production caller on the provider
+plan: `main.read_inputs()` assigns `self.cheap, self.tariff_words =
+static_status(o, now)`, which builds its **own** static plan and calls
+`cheap_now()` on that. Under Option A a provider-backed plan now exists on every
+configured site, so the limitation stops being structural and becomes a choice.
+
+**It is not cosmetic, and that is the whole reason for the decision.**
+`self.cheap` is read in `cycle()` by the maintenance cycle's cheap-window grid
+top-up — the add-on's one shiftable load, and the one place a *price* reaches
+something that **moves energy** on an install that has not armed trading.
+
+⚠️ **And the direction it would move is not "a slightly different window".**
+`static_status()` returns `(False, "no static profile")` whenever
+`static_profile` is empty, so today a provider-only site — a plausible shape
+for a dynamic-tariff install, and the shape this card makes work — has
+`self.cheap = False` on **every** cycle and never forces a paid grid top-up at
+all. Wiring `cheap_now()` would take that from *never* to *sometimes*. That is
+a strictly larger behaviour change than this card's headline, and it belongs to
+whoever owns the maintenance cycle rather than to the ticket that made it
+reachable.
+
+Three further reasons, in the order they would bite:
+
+1. **Two sources, one attribute, and the loser is silent.** `validate.py`
+   already refuses `static_profile` alongside the Home Assistant price
+   entities *because* `read_inputs()` picks one and the other disappears. A
+   provider plan would be a third writer of the same attribute with no rule
+   saying which wins.
+2. **The freshness question is not answered for this consumer.** The plan
+   retires after `TARIFF_MAX_AGE_S` and `fresh_tariff_plan()` returns `None`.
+   Arbitrage has an answer for that (refuse). The maintenance top-up has none:
+   "the plan expired" would have to mean *not cheap*, and *not cheap* on this
+   path means **wait for sun**, which is a real decision nobody has taken.
+3. **The comparison basis changes, and so does the answer on a bad feed.**
+   `cheap_now()` is strictly-below-the-mean-of-the-**firm**-hours, and it is
+   `False` when THIS hour is provisional or is not in the series at all
+   (FCST-03's rule: this hour decides, not the whole plan). So a feed that
+   published nothing, or an hour the §8.3 fill could not cover, reads *not
+   cheap* where a `static_profile` reads whatever the clock says. Defensible
+   either way — and it is a change to the shipped maintenance cycle that needs
+   its own measurement rather than a side effect of this one.
+
+**What adopting it would take**, so the next card does not start from scratch:
+
+* a rule for which source wins when both a provider plan and a
+  `static_profile` are configured, enforced in `validate.py` the way the
+  entity/profile conflict already is;
+* a decision on what an **expired** or **absent** plan means for the grid
+  top-up, stated as a default rather than left to `None`;
+* `read_inputs()` splitting `self.cheap` from `self.tariff_words`, which are
+  currently one assignment from one function;
+* a check that the maintenance top-up actually fires and does not fire on the
+  provider plan — driven through `cycle()`, not asserted on the attribute;
+* and the *Tariff* status row, which FCST-04 pinned as a **pair** with
+  `DOCS.md` in `test_price_history.py` §9: it does not report the provider
+  plan, DOCS does not claim it does, and moving one without the other is
+  already red.
+
+## 5. The *Arbitrage* status row, re-read and left alone
+
+`main.status_payload()` renders `("Arbitrage", "off (arbitrage_enabled)" if
+self.arb is None else self.arb.explain())`. `self.arb` is assigned only inside
+`if arbitrage.enabled(self.o):` and `arbitrage.decide()` never returns `None`,
+so `self.arb is None` **iff** the option is off. The string still names the
+option that is actually off, and under Option A it gains a job it did not have:
+on a site with a provider configured it is the row that tells an operator the
+prices arriving on the *Price history* row above are moving nothing. Unchanged,
+with a note at the call site saying it was checked.
+
+## 6. What this card did not do
+
+* It did not touch `run_tariff_refresh()`'s body (TARIFF-12 is there).
+* It did not change `cycle()`'s `if arbitrage.enabled(self.o):`, the sizing,
+  the thresholds, the SoC bounds or the peak interlock.
+* It did not wire the provider plan into the *Tariff* status row or into
+  `self.cheap` — §4.
+* It did not pick a version number (PKG-06).
+
+## 7. Mutation ledger
+
+Every mutation applied to a **fresh `cp -a`** of the clean worktree rather than
+reverted (habit 18: there is no revert to verify and no shared scratch path),
+`__pycache__` purged, tree mounted `:ro`, run under `python3 -B`.
+
+| id | mutation | Δ bytes | result |
+|---|---|---|---|
+| M1 | the shipped defect: gate back to `arbitrage.enabled(opts)` | **-4 B** | **RED**, 7 named checks |
+| M2 | drop the `or arbitrage.enabled(opts)` term | -27 B | **RED**, 2 named checks (strict-widening + the static-profile row) |
+| M3 | `tariff_refresh_wanted` -> always `True` | +8 B | **RED**, the AC2 reachability row |
+| M4 | `provider_configured`: `"off"` counts as configured | -6 B | **RED**, the AC2 reachability row |
+| M5 | `cycle()`'s trading gate -> `if True or arbitrage.enabled(self.o)` | +8 B | **RED**, both AC3 rows (`-5000 W` with trading off) |
+| M6 | instrument: `_reaches()` always `True` | **+0 B** | **RED**, 4 checks incl. its own calibration row |
+| M7 | instrument: `_task_sites()` returns `[]` | **+0 B** | **RED**, 10 checks incl. "it found 0 sites" |
+| M8 | fixture: 5 minutes of telegrams instead of a whole quarter | **+0 B** | **RED**, the peak-guard precondition and both armed rows |
+| M9 | M1 **plus** the harness's guard-driven start defeated | -4 B | the four DRIVEN rows go **GREEN** — see §2 |
+| M10 | `provider_id()` drops `.strip()` | -8 B | **survivor**, then CLOSED — see below |
+| M11 | `provider_configured()` -> `return True` | -32 B | **RED**, 4 checks |
+| M12 | DOCS.md's sentence reverted to the old, vaguer claim | +0 B (docs) | **RED**, the AC4 pairing row (`fetches = True, DOCS says = False`) |
+| M13 | the Dutch translation left behind while English moved | +0 B (docs) | **RED**, the both-languages row |
+
+⚠️ **M10 was a real survivor and is recorded as one.** Dropping `.strip()` left
+`test_price.py`, `test_price_history.py`, `test_static_tariff.py` and
+`test_validate.py` all green: nothing in the repository fed a `price_provider`
+with surrounding whitespace, and the `.strip()` predates this card — it was
+carried into `provider_id()` from the three call sites it replaced. The
+Supervisor's `list(off|…)` schema cannot produce `"  off  "`, but
+`validate_startup_config()` is also `sim/inject.py`'s entry point and takes any
+dict at all. Closed in the same commit by the padded-id pair in section 13;
+re-run as **M10b**, red on two named checks.
+
+⚠️ **M8 is the fixture defect this card walked into and then fenced.** The
+first draft fed five minutes of telegrams. Whether that **covers** the current
+billing quarter depends on where the wall clock sits inside it, so the peak
+guard was blind and engaged on some runs and not others — and `decide()` refuses
+outright while the guard is holding (§9.1 over §10.1). On those runs the armed
+baseline did not trade, and "trading off never trades" would have been graded
+on a fixture in which nothing could trade either way. It is now 900 s of
+telegrams, and the guard's clear state is a **check** rather than an assumption.
+
+## 8. What is still open
+
+* The literal reading of AC2 (§3). One token, and it costs a measured trading
+  configuration its plan. **Owner's call.**
+* `cheap_now()` (§4). Owner's call, with the adoption list above.
+* The *Tariff* status row still shows the static-profile sentence on a
+  provider-backed site; the provider plan's own line goes to the log. Pinned as
+  a pair with `DOCS.md` by FCST-04 and untouched here.

goodwe_controller/DECISIONS/TARIFF-12-a-degradation-is-not-a-refresh.md

@@ -0,0 +1,252 @@
+# TARIFF-12 — a returned degradation is not a refresh
+
+Three decisions. The first is what the ticket put up for judgement; the second
+and third are what fall out of it and would otherwise be decided by accident.
+
+---
+
+## 0. What was actually wrong, stated once
+
+`run_tariff_refresh()`'s docstring:
+
+> ⚠️ **AND A FAILURE DOES NOT CLEAR THE PLAN.** … Zeroing the plan here would
+> replace a coarse tariff with no tariff, which is the opposite of what §11.4
+> asks for.
+
+The guarantee was real. The condition it was enforced on was not:
+
+```python
+try:
+    plan = await resolve_tariff(...)
+    self.tariff_plan, self.tariff_at = plan, now     # unconditional
+except Exception as err:
+    _LOG.warning("tariff refresh failed (%s); keeping the plan ...")
+```
+
+`load_prices()` says in its own docstring that it **"RETURNS, NEVER RAISES, for
+every failure a site can actually have"**, because a degradation arriving as a
+traceback into the planning tick would stop the controller regulating over an
+expired certificate. So a supplier outage — the case the docstring names first —
+is a **return**: the `try` succeeds, `_degrade()` hands back a §11.4 plan, and
+the good plan is overwritten. The `except` is reachable only by something
+nobody expected, and nothing in the shipped path produces it.
+
+This is the fourth card in one family: FCST-04's M4 (`not ok` only), FCST-05's
+HIGH (`(JSONDecodeError, OSError)` only), FCST-06 (`not self.ok` only), and now
+`except Exception` only, for a path that never raises. **A guarantee enforced on
+the condition someone thought of, rather than the condition that occurs.**
+
+Reproduced before the fix, driving the shipped chain with nothing stubbed but
+the socket — 48 h horizon, `static_profile` empty, one good fetch then a
+`ClientConnectorError` 1800 s later, `TARIFF_MAX_AGE_S` = 5400 s:
+
+```
+after a good fetch      origin='provider'  n_points=48  'dynamic_dayahead from generic_dayahead, 48 h'
+after the failed fetch  origin='none'      n_points=0   'no tariff - generic_dayahead: ClientConnectorError: ...'
+tariff_at moved: True
+```
+
+and after it:
+
+```
+after the failed fetch  origin='provider'  n_points=48  'dynamic_dayahead from generic_dayahead, 48 h'
+tariff_at moved: False
+```
+
+---
+
+## 1. The question is asked ONCE, after the attempt, from the evidence that exists
+
+FCST-06's answer, one module over, and for the same reason: **the enumeration
+of failure conditions cannot be completed.** There is no pre-check that a feed
+will answer which is not itself a guess, and adding one would be a second
+symptom test beside the `except`. So the predicate is an **outcome**, read off
+the object the attempt produced:
+
+```python
+standing = self.fresh_tariff_plan(now)
+keep = (not plan.from_feed
+        and standing is not None and standing.from_feed)
+```
+
+Two facts, both of which exist by the time the question is asked:
+
+* **`plan.from_feed`** — did *this* resolution observe the configured provider?
+  `TariffPlan.origin` already names the four ways a plan is obtained; this
+  collapses them to the one question a caller holding a previous plan has to
+  ask. It lives on `TariffPlan` rather than as an `origin == "provider"` at the
+  call site for `fresh_tariff_plan()`'s own stated reason — *a check has to be
+  able to assert on the shipped expression rather than on a transcription that
+  drifts* — and because `origin`'s vocabulary belongs to `static_tariff.py`.
+* **`fresh_tariff_plan(now)`** — is a standing observation still current. It
+  already existed, it is already the one place the age is judged, and it is
+  **reused, not transcribed**. `test_arbitrage.py` 8b pins that reuse on the
+  AST; a copy of the comparison behaves identically until the day the two
+  drift, which is a claim about the code's shape, so a shape check is what
+  grades it (FCST-06's precedent for the one source check among driven ones).
+
+### What was NOT done
+
+* **Not `except Exception` widened, or a second `if` beside it.** That is the
+  defect's own shape — a place where the rule is spelt twice, so a fifth cause
+  needs a fifth branch. The `except` stays, relabelled *"not the outage path"*,
+  keeps the plan on the same terms, and is now honestly the
+  something-nobody-expected branch.
+* **Not the persisted price store as a cache.** Out of scope by the product
+  owner's call, and it is the right call: FCST-03 exists precisely to stop
+  stale prices being acted on, and "recent" is not "current". Keeping the last
+  **fetched** plan until it ages out is a different promise from serving the
+  store, and that one needs its own ticket.
+* **Not a `no_data`-only guard.** `not plan.has_prices` is the tempting
+  spelling and it is wrong — see decision 2. It leaves the §11.4 fallback free
+  to replace a fresh observation, and it is a 1-byte edit from the shipped
+  line, which is why it is in the mutation table rather than in a comment.
+
+---
+
+## 2. A §11.4 static fallback does NOT replace a fresh provider plan
+
+The ticket asked this directly, because the fallback is *not* nothing: it is
+the operator's own configured profile, with real prices, for the requested
+window. The answer is still no, and the reason is not that it is worse data —
+it is that **nothing may be acted on it, and it is no more current.**
+
+* Every point `_degrade()` builds carries `provisional=True`. So
+  `firm_points()` is empty, `arbitrage()` finds fewer than two firm hours and
+  refuses, and `cheap_now()` is False. Both of the two things `TariffPlan`
+  exposes for a consumer to act on are already off.
+* A day-ahead price for a given hour **does not change once published**. A plan
+  fetched 30 minutes ago is exactly as true about 19:00 as one fetched now; at
+  most `TARIFF_MAX_AGE_S` of its horizon has elapsed. The observation is not
+  stale in any sense the fallback is fresher than.
+
+So replacing the observation with the fallback trades a plan with firm hours
+for a plan with none, and buys no currency with it. The fallback takes over
+when the observation **retires** — which is exactly the row §11.4 describes,
+arrived at when there is no longer an observation to prefer.
+
+### And the rule is deliberately NOT symmetrical
+
+`standing.from_feed` is a term in its own right. A standing plan that is itself
+a degradation **is** replaced by the next degradation, and its timestamp moves.
+Without that term:
+
+* an outage on a static-profile site would freeze the operator's profile at the
+  window it was first generated for, and the guard would be *"never overwrite"*
+  wearing a bound's name;
+* and on a `price_provider: off` install — the shipped default — the plan would
+  flip between kept and re-derived every `TARIFF_MAX_AGE_S`, for no behavioural
+  gain, changing which reason the status page prints on a two-hour cycle.
+
+Each of the three terms is the only false one in some check in 8b, which is
+MUTATION.md habit 17's test for whether a suite can tell an `AND` from an `OR`.
+
+---
+
+## 3. `tariff_at` does not move on a kept plan
+
+The docstring's other half is that a plan must not *"freeze at its last value
+and look current forever"*. `tariff_at` is what makes that work: it is the
+moment of the fetch that produced the plan standing, and `fresh_tariff_plan()`
+judges the age from it.
+
+Re-stamping it on a kept plan would be this task asserting the feed answered
+when it did not. The plan would be re-certified as current at every refresh, an
+outage of any length would never retire it, and `TARIFF_MAX_AGE_S` would be
+**exactly as dead as it was before this card** — reachable only by the refresh
+task itself dying. Leaving it alone is what makes the bound govern: the plan is
+served for the age bound after its own fetch, and no longer.
+
+It is also the whole of **"distinguishable from a freshly-fetched one"**. A
+kept plan and a fetched plan are the same object shape; what separates them is
+that one's timestamp advanced and the other's did not, and every consumer that
+asks how old the plan is already reads that number. The kept case additionally
+logs at WARNING, naming the degradation's own reason, the fetch it is keeping,
+its age, and the deadline it retires at.
+
+⚠️ **What this does not give the operator, and why it is not here.** The status
+page has no row for "the last refresh failed" — the banner/level not moving
+when the plan is lost is separately carded, and the ticket rules it out of
+scope. This card's change makes that surface *more* truthful, not less: during
+the first `TARIFF_MAX_AGE_S` of an outage there is now a real plan behind the
+Arbitrage row instead of a no-plan refusal, so the row says something true for
+longer. The no-plan state is entered later by up to 5400 s; it is not removed,
+and the 30-minute lag reported on that row is untouched by anything here.
+
+---
+
+## 4. Merged after TARIFF-10 — what the wider gate changed, and what it did not
+
+TARIFF-10 landed on `release/1.0` while this card was open. It changed **which
+installs run this task** — `if arbitrage.enabled(opts)` became
+`tariff_refresh_wanted(opts)`, i.e. `provider_configured(opts) or
+arbitrage.enabled(opts)` — while this card changed **what the task does on a
+failed fetch**. Git auto-merged the two hunks, which is exactly when the
+interaction needs reading rather than trusting.
+
+**Nothing in the decisions above changed.** Two configurations are newly
+reachable, and both are now driven in `test_arbitrage.py` 8b rather than
+reasoned about:
+
+* **A provider configured with trading DISARMED** — TARIFF-10's headline case.
+  This is precisely the configuration the guard was designed for: the plans are
+  `origin == "provider"`, and a dead feed must not delete one that is still
+  inside `TARIFF_MAX_AGE_S`. It needs no second fixture, because **nothing on
+  this path reads `arbitrage_enabled` at all**, and that is asserted rather
+  than assumed — over the AST's symbols and the non-docstring string constants,
+  because two earlier drafts of that check were **red against a correct tree**:
+  the first matched the docstring paragraph that *says* `arbitrage_enabled` is
+  not read, the second matched the log line's "arbitrage, where it is armed".
+  A substring test over a function grades its prose as much as its behaviour,
+  which is habit 4 in a third costume. A fixture that set the option and
+  asserted no difference would have been the other defect — comparing a thing
+  against itself.
+* **`price_provider: off` + a `static_profile`** — the configuration TARIFF-10's
+  `or` exists to protect, and the one where a latching guard would do real harm.
+  `resolve_tariff()` returns `static_plan(provisional=False)`, whose origin is
+  `"static"`: the CONFIGURED product, not a §11.4 row. So `standing.from_feed`
+  is false on every refresh, `keep` is false on every refresh, and the plan is
+  regenerated for the current window every 30 minutes exactly as before this
+  card. **Driven, twice in a row**, because a guard that latched here would
+  freeze a static site's plan at its first window for the life of the install —
+  and mutation M3, which drops the `standing.from_feed` term, is red on that
+  check as well as on the fallback one.
+
+Two further facts settle the rest of the interaction:
+
+* **This decision is strictly downstream of every side effect.** The §8.3 carry
+  into `price_history` happens inside `resolve_tariff()`, on the `series`
+  branch, before `keep` is computed — so which of two plans is kept can neither
+  add nor lose a recorded day, and TARIFF-10's *Price history* row is
+  unaffected either way.
+* **The kept-plan log line was reworded.** It said "arbitrage stops with it",
+  which after TARIFF-10 is false on a site that fetches without trading; it now
+  says "arbitrage, **where it is armed**, stops with it".
+
+All eleven mutations were **re-driven on the merged tree** rather than carried
+over — the surrounding code changed, so a red against the old base is not
+evidence about the new one. Eleven red, no survivors, every revert
+fingerprinted. The added member is M11: making the guard conditional on
+`arbitrage.enabled(self.o)` (+86 B), red on five named checks.
+
+⚠️ **And one process note that belongs in this file.** This card's mutation
+harness was written to a shared scratchpad path and was **overwritten mid-run
+by another agent's harness for a different card**, pointing at a different
+worktree. That is MUTATION.md habit 18's second bullet almost verbatim. It was
+caught because the harness fingerprints the tree after every revert and the
+runs are what proved this worktree was never left mutated; the harness now
+lives at a card-specific path. **A harness that edits source must not share a
+name, a directory or a backup path with another one.**
+
+---
+
+## What this does not change
+
+* **Nothing on the 30 s tick.** `cycle()` still reads two attributes and awaits
+  no fetch; the AST pin in `test_arbitrage.py` section 8 is unchanged and green.
+* **Nothing about the prices themselves.** No series is invented, extended,
+  re-stamped or carried. The only question this card answers is *which of two
+  plans the controller holds*.
+* **A `price_provider: off` install is bit-for-bit unaffected.** Its standing
+  plan is never `origin == "provider"`, so `keep` is false on every refresh it
+  will ever run, and the assignment happens exactly as it did before.

goodwe_controller/DECISIONS/TARIFF-14-the-window-a-point-covers.md

@@ -0,0 +1,349 @@
+# TARIFF-14 — how long one price point covers, and what the last one does
+
+One defect and one genuinely open decision. The defect had no defensible
+alternative once it was measured; the decision — the **last** point's window —
+did, and the alternative is argued below rather than dismissed.
+
+---
+
+## 0. The measurement this card exists for
+
+`_Series.at()` asked `s <= u < s + 1 h` of every point **in list order** and
+returned the **first** match. Run against the shipped code at `5059e28` on a
+quarter-hourly series:
+
+```
+series: 02:00=0.10  02:15=0.11  02:30=0.12  02:45=0.13  03:00=0.14 ...
+
+ask + 0min -> 02:00  0.10
+ask +15min -> 02:00  0.10   <-- WRONG (wanted 02:15)
+ask +30min -> 02:00  0.10   <-- WRONG
+ask +45min -> 02:00  0.10   <-- WRONG
+ask +60min -> 02:15  0.11   <-- WRONG (wanted 03:00)
+ask +75min -> 02:30  0.12   <-- WRONG (wanted 03:15)
+```
+
+**Two failure modes, not one.** Inside the first hour the `:00` point wins
+because its hour has not run out. From the second hour on the answer is not
+even the top of the hour — the first point still inside its own hour wins — so
+**the error compounds with depth into the series**.
+
+Same code, same run, after the fix:
+
+```
+ask + 0min -> 02:00  0.10        ask +60min -> 03:00  0.14
+ask +15min -> 02:15  0.11        ask +75min -> 03:15  0.15
+ask +30min -> 02:30  0.12        ask +90min -> 03:30  0.16
+ask +45min -> 02:45  0.13        ask+120min -> 04:00  0.18
+```
+
+An hourly series is **unchanged at every instant**, before and after — which is
+the whole reason nothing caught this. Every price fixture in this repository
+before TARIFF-08 was the invented hourly row shape, `static_tariff.py` emits
+hourly points, and the DST checks count points on the 23- and 25-hour days
+without ever asking `at()` for a quarter-hour. **The suite had been exercising
+the one resolution on which the broken rule and the right one agree.**
+
+Belgium moved to a 15-minute MTU on 2025-10-01 and the live day-ahead feed
+returns **96 points at 900 s**, so this is reachable only down the dynamic path
+TARIFF-08/09 just made work. Static sites are immune.
+
+## 0.1 What it cost, which is not "a slightly wrong price"
+
+`arbitrage._act()` calls `_point_at(plan, now)` → `series.at(now)` and then
+tests `here.start == v.cheapest.start` / `== v.dearest.start` to decide whether
+this interval is the buy one or the sell one. That is an **identity test
+between the matched point and the point the verdict was built from**, and on a
+quarter-hourly series it almost never matched — so the strategy idled through
+exactly the interval it exists to trade, reporting *"this hour is neither the
+buy hour nor the sell hour"*. It also read `here.provisional` (§8.3) and §17's
+`price < 0` off that same wrong point.
+
+---
+
+## 1. The rule
+
+> **A point covers from its own start until the next point's start, and never
+> more than one hour.**
+
+* **900 s** → each point covers its own quarter.
+* **3600 s** → each point covers its own hour. Identical to what shipped.
+* **MIXED** → **each point takes its own gap.** FCST-04's carry-forward emits
+  hourly carried points beside quarter-hourly firm ones, and the soak measured
+  spacing `[900, 3600]` in **70 % of samples** — so a window derived from one
+  global spacing would be wrong in the **normal steady state**, not in an edge
+  case.
+
+### 1.1 Why the one-hour cap is not decoration
+
+FCST-04 **leaves holes on purpose**: an hour with no published price and no
+yesterday value is left *out* of the series, and `price_forecast.py`'s module
+note names `at()` raising `Absence` for it as the behaviour that sends the
+caller to the static profile (§11.4 for that hour).
+
+Uncapped, "until the next point's start" stretches the point **before** a
+three-hour hole across the whole hole and answers every instant in it with a
+stale price. Filling holes is the defect this module exists to refuse, and it
+would have been introduced **by the fix for a different one**. Graded in
+`test_price.py` 14d; the mutation that removes the cap is red there.
+
+---
+
+## 2. The decision: what the **last** point covers
+
+There is no next start, and §9.3 says nothing about how wide the final interval
+is — a `PricePoint` has **three fields** and must not learn a fourth, because
+that is the wire format every store, replay, fixture and captured body in this
+repository is written against. So the tail is a **choice**, and both candidates
+are defensible.
+
+**Chosen: the last point is given the same span as the point before it** (one
+hour when it is the only point).
+
+| | flat one hour | the span in front of it (**chosen**) |
+|---|---|---|
+| 96-point 900 s day, `at(23:50)` | answers 23:45 | answers 23:45 |
+| the same day, `at(00:30)` **tomorrow** | **answers with today's 23:45 price** | `Absence` |
+| 24-point hourly day, `at(23:50)` | answers 23:00 | answers 23:00 |
+| mixed series ending at the firm/carried seam | answers for an hour | `Absence` after 15 min |
+
+**The second row is why.** A flat one-hour tail reaches across a day boundary
+and prices tomorrow morning with yesterday's last print — which is
+"reaching for a neighbouring one", the single thing the `Absence` message has
+always refused to do. The chosen rule never extends a point past a span the
+series itself demonstrates.
+
+### 2.1 The cost of the choice, stated rather than buried
+
+On a **mixed** series whose last point is a carried **hourly** one sitting
+behind quarter-hourly firm ones, the tail is **900 s**, and the last 45 minutes
+of the horizon raise `Absence` for an hour something did carry a value for.
+
+That is accepted, not tolerated, and the direction is the safe one:
+
+* the caller falls back to the static profile (§11.4) instead of trading on a
+  span the series never demonstrated;
+* the point is **carried**, so §8.3 forbids any irreversible action resting on
+  it regardless;
+* it is at the far end of a 48 h horizon, where nothing is decided at 30 s.
+
+Under-covering costs a missed decision. Over-covering prices a real interval
+with a number that does not describe it. Those are not symmetric.
+
+### 2.2 The degenerate case
+
+A series of **one** point has no gap in front of it to copy and gets **one
+hour** — the shipped behaviour, kept deliberately. `test_price.py` 14e states
+it as its own check so it cannot decay into an accident.
+
+---
+
+## 3. Does `at()` now depend on sortedness? Yes — and it establishes it itself
+
+The old rule read one point at a time and did not care about order. The new one
+reads a point's **neighbours**, so it *would* depend on the series being
+ascending.
+
+It does not, because **the lookup index is sorted by UTC start at construction**
+(`_cover_table()`, called once from `_Series.__init__`). No caller's list order
+can reach `at()`.
+
+That matters because the three things that "guarantee" order today each
+guarantee it somewhere else:
+
+| | what it guarantees | where |
+|---|---|---|
+| `_validate_raw()` | strictly increasing starts | the `load_prices()` path only |
+| `price_history._parse_points()` | re-sorts by instant | the store read path only |
+| FCST-04's fill | emits ascending | that one producer only |
+| `PriceRead.series()` | **nothing** | every other caller, including tests |
+
+Three producers agreeing today is not an invariant; it is a coincidence with
+good references. `test_price.py` 14f drives a series handed its 96 points in
+**reverse** order and asserts `at()` answers identically at every one of them —
+red the moment the sort is removed.
+
+**Duplicated starts** (refused by `_validate_raw()`, constructible by hand) give
+the earlier list entry a zero-width window and the later one the real span. One
+of the pair becomes unreachable through `at()`; **nothing raises**, at
+construction or on the 30 s control path. Stated as a check rather than left to
+be discovered.
+
+---
+
+## 4. `covers()` shared it. `window()` did not
+
+* **`covers()`** has no window rule of its own — it calls `at()` — so it shared
+  the defect exactly and the same change fixes it. It is kept as a delegation
+  for that reason: a second copy of the rule is a second place for it to be
+  wrong.
+* **`window(since, until)`** grades a point's **start** against a half-open
+  range and never asks how long a point lasts, so it carries no resolution
+  assumption at all. It is **not** a coverage query — a point that starts before
+  `since` and runs into it is absent from its result by design. That is now
+  said in its docstring and pinned by a check, because the next reader will ask.
+  It has **no callers** in `app/`.
+
+---
+
+## 5. What this card does NOT fix, with its shape
+
+`price_forecast._walk()` — §8.3's irreversible-action gate — iterates
+`committed_hours()`, which steps in **whole hours**, and asks `series.at(u)` at
+each. On a quarter-hourly series that now reliably returns the hour's `:00`
+point (it previously returned something earlier and arbitrary), so the gate
+reads **one point per hour** and never looks at the `:15`/`:30`/`:45` flags.
+
+A partially-provisional hour would therefore be gated on its first quarter
+alone. **Two things keep it off every shipped install, and both are
+circumstantial rather than structural:** `price_permits()`/`begin_phase()` have
+**no caller in `app/main.py`** — the §12 price-justified entry point is built
+and not yet wired — and FCST-04 carries **whole** hours while
+`generic_dayahead` publishes whole days, so the four quarters of an hour are
+firm or carried together anyway. Both are facts about the *callers and
+producers*, not properties of the *gate*, so this is written down here rather
+than left for the first sub-hourly feed or the first wiring-up to find. Fixing it means teaching
+`committed_hours()` about resolution, which is a data-model question this card
+deliberately does not open.
+
+---
+
+## 6. Mutations
+
+Eight, each purged before the run (TEST-15), each reverted with the tree
+fingerprint checked afterwards (MUTATION.md habit 18), backup at a `mktemp`
+path per invocation.
+
+⚠️ **Re-driven in full on the MERGED tree** after TARIFF-10 landed on
+`release/1.0` (base `88c59a9` -> `559f0eb`). All eight give the same verdicts
+and the same red-check counts as before the merge, which is the answer that
+matters: TARIFF-10 added 650 lines of checks to `test_price.py` and none of
+them moves under any of these edits, because they grade `resolve_tariff()`'s
+*reachability from a configuration* and not the lookup. Clean `app/price.py` on
+the merged tree = **`90d8ca31f7c0109d`, 85953 B** (pre-merge it was
+`30d1a56f0117e571`, 83742 B; the difference is TARIFF-10's `provider_id()` /
+`provider_configured()`, which this card does not touch).
+
+| | mutation | Δ | red in |
+|---|---|---|---|
+| M1 | `at()` back to the shipped fixed one-hour scan over `self.points` | +68 B | **24 named checks**: `test_price.py` 14b ×4, 14c ×3, 14d, 14e ×3, 14f, 14g; `test_arbitrage.py` 10b ×6, 10c ×3, 10d ×2 |
+| M2 | drop the one-hour cap | −68 B | `test_price.py` 14d |
+| M3 | flat one-hour tail instead of the span in front | **+0 B** | `test_price.py` 14e ×3, 14g — 4 checks |
+| M4 | trust the caller's list order — drop the sort | −61 B | `test_price.py` 14f |
+| M5 | `covers()` grows its own hour-wide rule | +95 B | `test_price.py` 14e, 14g |
+| M6 | `window()` becomes a coverage query | −37 B | `test_price.py` 14g |
+| M7 | the window's end becomes inclusive | +1 B | `test_price.py` 14b ×4, 14c ×4, 14d, 14e ×4, 14f ×2, 14g — 16 checks |
+| M8 | the window's start becomes exclusive | −1 B | `test_price.py` 14b ×4, 14c ×4, 14d, 14f ×2, 14g, 14h, plus the pre-existing section 6 check — 14 checks |
+
+**M3 is the zero-byte one and it is the tail decision itself** — the case
+MUTATION.md names as the risky size, caught by the check written for it.
+
+**What the arbitrage file does NOT see, with sizes.** M2, M4, M5, M6 and M8
+leave `test_arbitrage.py` green, and that is honest rather than a gap to round
+off: they are `at()`-level properties (holes, caller order, `covers()`,
+`window()`, the start boundary) that no arbitrage fixture reaches, because the
+probes are seven minutes into a slot and the plans have no holes. The one that
+matters end to end — M1, the shipped rule — is red in **both** files, on the
+named check `THE PROPERTY THE DEFECT BROKE`.
+
+---
+
+## 7. TARIFF-10 landed on the base while this was open — what it changes here
+
+Base moved `88c59a9` → `559f0eb` mid-card. The question is not whether the
+branches merge; it is whether TARIFF-10 makes any sentence above **false**.
+
+**In `app/price.py` the two do not meet.** TARIFF-10 added `provider_id()` and
+`provider_configured()` beside `price_option()` and routed `load_prices()`
+through them. That is the option-reading layer; it touches nothing in
+`_Series`, `at()`, `covers()`, `window()` or `_cover_table()`. Git merged the
+file without a conflict, and the merged `at()` is byte-identical to the one the
+mutations above were driven against.
+
+**Behaviourally it widens who has a series at all, and that cuts one way only.**
+`run_tariff_refresh()` now runs on installs with `arbitrage_enabled` **off**, so
+a provider-configured site has a standing plan — and therefore a `_Series` —
+where before it had none. **It does not add a new `at()` consumer to the 30 s
+tick**, which is the claim worth checking rather than assuming:
+
+| caller of `at()`/`covers()` | reached by a non-trading install? |
+|---|---|
+| `arbitrage._point_at()` (`arbitrage.py:300`) | no — trading only |
+| `static_tariff.TariffPlan.price_at()` / `.words` `here` (`:750`, `:819`) | on the tick these are reached through `static_status()`, which builds a **`static_plan`** — hourly points, immune. `main.py` calls only `plan.words` on the fetched plan, which counts points and never looks one up |
+| `price_forecast._walk()` (`:562`, `:568`) | **`price_permits()` and `begin_phase()` have no caller in `app/main.py` at all** — §12's price-justified entry point is built and not yet wired |
+
+So TARIFF-10 neither creates nor closes any exposure this card is about. What it
+does do is make the defect's reach larger the moment such a site arms trading,
+because the series it would trade against now exists on every configured
+install rather than only on armed ones. That strengthens the case for the fix
+and changes nothing in its reasoning.
+
+**In `test_price.py` both cards appended a section 13.** Nothing is dropped:
+TARIFF-10's stays **13**, this card's is renumbered **14** (which is also this
+card's number), and the temp-directory teardown TARIFF-10 put at the end of the
+file stays at the end of the file. The two sections share no fixture, no option
+dict and no helper name; TARIFF-10's grades `resolve_tariff()`'s *reachability
+from a configuration* and drives real fetches with a counting transport, and
+**none of its checks moves under any of the eight mutations above** — measured,
+not assumed.
+
+---
+
+## 8. TARIFF-12 landed too — a plan may now be 90 minutes old when it is asked
+
+Base moved `559f0eb` → `a6e64fb` while this was open. TARIFF-12 stops a
+returned §11.4 degradation from overwriting a standing plan that is still
+inside `TARIFF_MAX_AGE_S`, so **a served plan can now be up to
+`3 × TARIFF_REFRESH_S = 5400 s` old** where before it was at most one refresh
+interval. `at()` is what answers *"what does it cost right now"* out of that
+older plan, so the question is fair and the answer is written out rather than
+assumed.
+
+**Per-point span: unaffected, structurally.** Every window is derived from the
+neighbouring points' **absolute `start` instants**. Those are `datetime`s inside
+a frozen dataclass inside a tuple — they cannot move, and `_cover_table()` runs
+once at construction over data that cannot change afterwards. A plan's *age* is
+a property of `fetched_at` / `tariff_at`, never of a window. **The index cannot
+go stale**, which is a small positive under TARIFF-12 rather than a risk: a kept
+plan now lives longer, and there is nothing in it that needed recomputing.
+
+**The one-hour cap: unaffected.** It bites only where a gap exceeds an hour,
+i.e. at a hole FCST-04 left. Walking further into a series crosses more windows;
+each is still resolved on its own neighbours.
+
+**The tail: reachable for the first time, and the choice made in §2 is the one
+that survives it.** This is the half worth spelling out.
+
+* At the **shipped 48 h horizon** the tail is unreachable by staleness. A plan
+  is served for at most 90 minutes, so `now` is at most 90 minutes into a
+  ~48 h series — the last point is still about 46½ hours away.
+* But `price_horizon_h` is `int(1,72)` in `config.yaml`, so an operator **can**
+  configure a **1 h** horizon. A 90-minute serve-stale window against a 1 h
+  series puts `now` genuinely past the end. That is not hypothetical; it is a
+  supported configuration meeting a supported outage.
+* Under the **chosen** rule a quarter-hourly 1 h series ends at `:45` and that
+  point's window closes at the top of the next hour: `at()` raises `Absence`,
+  `_point_at()` returns None, `_act()` idles with its "no price for this
+  instant" reason, and §11.4 sends the site to the static profile.
+* Under the **rejected** flat one-hour tail the same stale plan would have gone
+  on trading against the `:45` print for **up to 45 minutes after the interval
+  it describes had ended** — pricing an outage with a number for a quarter that
+  is over.
+
+So TARIFF-12 does not weaken the tail decision. It is the first thing that makes
+it reachable on a shipped configuration, and it independently selects the same
+answer. ⚠️ **Note which direction that runs**: the more stale a plan is allowed
+to be, the more the tail rule is doing real work, so it should be re-read if
+`TARIFF_MAX_AGE_S` is ever widened again.
+
+**`TariffPlan.from_feed` cannot produce a series this code has not seen.** It is
+a pure predicate on `origin` (`== "provider"`), and TARIFF-12's decision keeps or
+replaces a **whole plan object**. It never splices two reads into one series, so
+it cannot hand `at()` an unsorted or duplicated point list — the case §3 covers
+defensively and that nothing shipped produces.
+
+**Re-graded on this base.** All 29 files green. `app/price.py` is byte-identical
+to the TARIFF-10 merge (`90d8ca31f7c0109d`, 85953 B) because TARIFF-12 does not
+touch it. **M1** re-driven: +68 B, red on the same **24 named checks** across
+both files. **M3** re-driven: **+0 B**, red on the same 4. This branch
+contributes **zero diff** to `app/main.py` and `app/static_tariff.py`.

goodwe_controller/DOCS.md

@@ -1346,12 +1346,26 @@ does, and only after you have read why.
 > release ships the five provider plugins, the canonical all-in format they
 > emit, the config that selects one, and — new in OPT-04 — a price-arbitrage
 > strategy that trades on them. With `arbitrage_enabled: false`, which is the
-> shipped default, turning a provider on still fetches, validates and publishes
-> prices and changes no charging decision.
+> shipped default, **selecting a provider is what starts the fetch**: the feed
+> is read every 30 minutes, validated, and the day recorded in
+> `/data/price_history.json`, which the *Price history* status row reports and
+> the add-on log names at every refresh. No charging decision changes.
+>
+> ⚠️ **That has been the documented behaviour since OPT-04 and was not the
+> actual behaviour until TARIFF-10.** The background refresh was started only
+> when `arbitrage_enabled` was on — and it ships `false` — so an install with a
+> provider configured fetched nothing at all, never created the store, and read
+> *Price history: empty* for as long as it ran. If you configured a provider and saw an empty
+> Price history row, that is what you were looking at. Trading is unchanged and
+> is still `arbitrage_enabled` alone.
 >
 > `static_profile` below needs no network at all, so its cheap window is
 > computed on every cycle and reaches the maintenance cycle's grid top-up
-> whether or not arbitrage is armed.
+> whether or not arbitrage is armed. ⚠️ **And it is still the only source of
+> that window.** A provider-backed plan now exists on every configured site,
+> but *Cheap window* and the maintenance cycle's grid top-up read
+> `static_profile` and nothing else — a deliberate limit, recorded with what it
+> would take to change in `DECISIONS/TARIFF-10-fetching-is-not-trading.md`.
 
 | option | meaning |
 |---|---|
@@ -1439,6 +1453,14 @@ would be traded on as though it were complete. A refused fetch is the §11.4
 row — static profile, provisional plan, no arbitrage — and the reason is in the
 log.
 
+**A refused fetch does not take the plan you already have.** The last plan that
+actually came from the feed keeps standing until it is 90 minutes old (three
+missed refreshes), and only then does the §11.4 row above take over. The
+add-on logs a `WARNING` naming the failure, the fetch it is keeping, its age
+and the moment it retires; the plan's own age is **not** reset by the failed
+refresh, so a kept plan still expires on schedule and is never presented as a
+current one. One failed fetch is a blip, not a lost tariff.
+
 **`manual_csv` — the offline fallback.** It needs no internet, no supplier
 account and no HTTP stack at all, and it is the supported way to run this
 add-on price-aware on a site with no outbound connectivity. Write a file and
@@ -1670,6 +1692,14 @@ towards the firmware's 30 s failsafe. The plan refreshes every 30 minutes and
 retires itself if the refresh stops answering, at which point arbitrage stops
 with it.
 
+⚠️ **That refresh is not gated on this switch** (TARIFF-10). It runs when a
+`price_provider` is configured *or* when arbitrage is armed, so turning
+arbitrage off does not turn the price feed off — and a site with no provider
+that arms arbitrage on a `static_profile` keeps the plan it has always had. The
+only thing that decides whether a request leaves the machine is
+`price_provider`: with it `off`, the refresh resolves the static profile in
+memory and opens no connection.
+
 ### Site
 
 | option | meaning |

goodwe_controller/app/main.py

@@ -67,7 +67,7 @@ from .mqtt import (MqttPublisher, announced_units, unit_slugs,
 from . import peakguard
 from . import packshare
 from .p1 import P1Ingest, build_source, is_enabled
-from .price import Uncertainty, price_option
+from .price import Uncertainty, price_option, provider_configured
 from .price_history import PriceHistory
 from .static_tariff import resolve_tariff, static_status
 from .tariff import PeakStore, PeakTracker
@@ -138,6 +138,60 @@ TARIFF_REFRESH_S = 1800.0
 TARIFF_MAX_AGE_S = 3 * TARIFF_REFRESH_S
 
 
+def tariff_refresh_wanted(opts: dict) -> bool:
+    """TARIFF-10. Does this install need the background tariff refresh at all?
+
+    THE DEFECT THIS PREVENTS, and it shipped: the gate below used to be
+    `arbitrage.enabled(opts)` alone. That option defaults to `false`, and
+    `run_tariff_refresh` is the only caller of `resolve_tariff()`, which is the
+    only caller of `price_history.carry()` - so on a shipped install with a
+    provider configured NOTHING was ever fetched, no plan was ever resolved,
+    `/data/price_history.json` was never created, the *Price history* row read
+    `empty` forever, and TARIFF-09's short-horizon warning could not fire
+    because there was no fetch to warn about. Measured over a 40 h soak of two
+    instances side by side: zero feed requests and `present: false` across all
+    802 samples on the shipped default, against a resolved plan from the same
+    feed on the instance with arbitrage armed. ⚠️ AND `DOCS.md` HAS
+    DESCRIBED THE BEHAVIOUR BELOW SINCE THE COMMIT THAT WROTE THE GATE:
+    OPT-04 (bdd7f18) added the refresh task, the `arbitrage.enabled()` guard on
+    it, and the sentence saying a configured provider still fetches, all in one
+    change. config.yaml has said it since TARIFF-02 (852fc7c).
+
+    Two terms, and they answer two different questions:
+
+      provider_configured(opts) -> "the operator asked for a price feed", so
+                                   fetch it, validate it and record the day
+                                   (§8.3). This is the term TARIFF-10 ADDS.
+      arbitrage.enabled(opts)   -> "the operator armed trading". This term is
+                                   what the gate USED to be, kept verbatim.
+
+    ⚠️ IT IS AN `or`, SO THE GATE IS A STRICT WIDENING. Every configuration
+    that started this task before still starts it; none that did not start it
+    stops anything. That matters because the second term is not redundant:
+    `price_provider: off` + a `static_profile` + `arbitrage_enabled: true` is a
+    configuration validate.py explicitly ACCEPTS, and it trades - measured, at
+    `cycle_cost_threshold_eur: 0.05` on a 0.20/0.284 day/night profile,
+    `ARBITRAGE_CHARGE -5000 W`. Dropping that term to make the gate read
+    `provider_configured(opts)` alone would leave `self.tariff_plan` at None on
+    that site forever and `decide()` would answer "no tariff plan has been
+    resolved yet" on every cycle - silently disarming a strategy the UI says is
+    running, which is the exact failure validate.py's OPT-04 rules exist to
+    refuse.
+
+    ⚠️ AND NO CONFIGURATION ACQUIRES A PERIODIC HTTPS CALL FROM THIS TICKET.
+    With `price_provider` off, `resolve_tariff()` returns `static_plan()` - pure
+    arithmetic, no socket - so the second term starts a task that fetches
+    nothing. The true shipped default (no provider, no arbitrage) starts no
+    task at all. What is fetched is decided by the FIRST term only.
+
+    ⚠️ THIS IS NOT A TRADING SWITCH. It decides whether prices are LOOKED UP.
+    Whether they move energy is `arbitrage.enabled()` at the one call site in
+    `cycle()`, and TARIFF-10 did not touch it: `arbitrage_enabled: false` still
+    means no trade, ever, on any configuration.
+    """
+    return provider_configured(opts) or arbitrage.enabled(opts)
+
+
 def load_options() -> dict:
     try:
         with open(OPTIONS_PATH, "r", encoding="utf-8") as fh:
@@ -3480,13 +3534,64 @@ class Controller:
         raise out of here and take the task down, because then the plan freezes
         at its last value and looks current forever. That is what
         `fresh_tariff_plan()`'s age bound is the backstop for, and this is the
-        half that keeps the task alive so the bound rarely matters.
+        half that keeps the task alive. ⚠️ THE BOUND IS NO LONGER A BACKSTOP
+        ONLY: since TARIFF-12 it is also the serve-stale window an outage runs
+        on, and it is consulted below on every refresh.
 
-        ⚠️ AND A FAILURE DOES NOT CLEAR THE PLAN. `resolve_tariff()` already has
-        a §11.4 answer for a dead feed - degrade to the static profile, mark it
-        provisional, arbitrage refuses - and that answer is better than the
-        absence of one. Zeroing the plan here would replace a coarse tariff with
-        no tariff, which is the opposite of what §11.4 asks for.
+        ⚠️ AND A FAILURE DOES NOT CLEAR THE PLAN - WHICH IS A CLAIM ABOUT WHAT
+        `resolve_tariff()` RETURNS, NOT ABOUT WHAT IT RAISES (TARIFF-12). This
+        paragraph was enforced by the `except` below alone, and the `except`
+        below is the one path a supplier outage never takes. `load_prices()`
+        says so in its own words - it "RETURNS, NEVER RAISES, for every failure
+        a site can actually have" - because a degradation arriving as a
+        traceback into the planning tick would stop the controller regulating
+        over an expired certificate. So a dead feed is a RETURN: the `try`
+        succeeds, `_degrade()` hands back a §11.4 plan, and the assignment used
+        to overwrite the good one unconditionally. Measured in a 40 h soak with
+        `static_profile` unset (the shipped default, and the normal state of a
+        dynamic-tariff site): the FIRST failed fetch replaced a complete 48 h
+        plan with `TariffPlan(no_data, None, "none")` - 0 points - 27 minutes
+        after the last good one, and `TARIFF_MAX_AGE_S` governed nothing. A
+        transient blip cost the same as a 90-minute outage.
+
+        ⚠️ SO THE QUESTION IS ASKED ONCE, AFTER THE ATTEMPT, FROM THE EVIDENCE
+        THAT EXISTS - FCST-06's answer, in this file. The evidence is
+        `plan.from_feed` (did this attempt observe the feed) and
+        `fresh_tariff_plan(now)` (is an observation still current). A
+        degradation replaces a standing observation only once that observation
+        has aged out, so `TARIFF_MAX_AGE_S` is now the serve-stale window it
+        reads like rather than a bound nothing could reach.
+
+        ⚠️ AND A §11.4 STATIC FALLBACK DOES NOT REPLACE A FRESH PROVIDER PLAN
+        EITHER, although it carries real prices. Every point `_degrade()`
+        builds is `provisional=True`, so `firm_points()` is empty,
+        `arbitrage()` refuses and `cheap_now()` is False - everything a
+        consumer may act on is already off. A day-ahead price for a given hour
+        does not change once published, so a plan fetched half an hour ago is
+        exactly as true about that hour as one fetched now. The fallback is
+        less actionable and no more current; it takes over when the observation
+        retires, which is what §11.4 is for. The reverse is not symmetrical: a
+        standing plan that is ITSELF a degradation is replaced by a fresh one,
+        or an outage would freeze the operator's static profile at the window
+        it was generated for.
+
+        ⚠️ AND NOTHING HERE READS `arbitrage_enabled`, WHICH TARIFF-10 MAKES
+        WORTH SAYING. Since that card this task also runs on a site with a
+        provider configured and trading DISARMED, so "keep the plan" is a
+        decision about what the add-on has LOOKED UP, not about what it may
+        trade on. It is also strictly downstream of `resolve_tariff()`: the
+        §8.3 carry into `price_history` happens on the `series` branch inside
+        that call, before this decision exists, so which of two plans is kept
+        cannot add or lose a recorded day.
+
+        ⚠️ AND `tariff_at` DOES NOT MOVE ON A KEPT PLAN. It is the moment the
+        fetch that produced the standing plan happened, and
+        `fresh_tariff_plan()` judges the age from it - re-stamping it here
+        would be this task asserting the feed answered when it did not, and the
+        plan would "freeze at its last value and look current forever", which
+        is the hazard the paragraph above this one names. An unmoved
+        `tariff_at` is also the only thing that tells a kept plan from a
+        freshly fetched one, so it is what the check asserts.
         """
         horizon = float(price_option(self.o, "price_horizon_h"))
         while not self.stopping:
@@ -3495,11 +3600,33 @@ class Controller:
                 plan = await resolve_tariff(
                     self.o, now, now + timedelta(hours=horizon), now=now,
                     history=self.price_history)
-                self.tariff_plan, self.tariff_at = plan, now
-                _LOG.info("tariff refreshed: %s", plan.words)
+                standing = self.fresh_tariff_plan(now)
+                # Three terms, and each of them is the only false one in some
+                # check: the feed answered (replace), nothing current stands
+                # (take the degradation - this is what makes the age bound
+                # govern), or what stands is itself a degradation (replace).
+                keep = (not plan.from_feed
+                        and standing is not None and standing.from_feed)
+                if keep:
+                    _LOG.warning(
+                        "tariff refresh degraded (%s); KEEPING the plan "
+                        "resolved at %s, %.0f s ago. tariff_at is NOT moved, "
+                        "so it retires %.0f s after that fetch; arbitrage, "
+                        "where it is armed, stops with it. A kept plan is "
+                        "never presented as a current one.", plan.words,
+                        self.tariff_at,
+                        (now - self.tariff_at).total_seconds(),
+                        TARIFF_MAX_AGE_S)
+                else:
+                    self.tariff_plan, self.tariff_at = plan, now
+                    _LOG.info("tariff refreshed: %s", plan.words)
             except Exception as err:                          # noqa: BLE001
+                # ⚠️ NOT THE OUTAGE PATH - see the docstring. `load_prices()`
+                # returns on every failure a site can have, so what reaches
+                # here is something nobody expected, and the plan is kept for
+                # the same reason and on the same terms.
                 _LOG.warning(
-                    "tariff refresh failed (%s); keeping the plan resolved at "
+                    "tariff refresh raised (%s); keeping the plan resolved at "
                     "%s. It retires on its own after %.0f s and arbitrage "
                     "stops with it.", err, self.tariff_at, TARIFF_MAX_AGE_S)
             with contextlib.suppress(asyncio.TimeoutError):
@@ -4353,6 +4480,14 @@ class Controller:
             # OPT-04. The strategy's own sentence, not a re-derivation of it -
             # every refusal it can make already carries a reason a human can
             # act on, and "Arbitrage: no" would throw all of them away.
+            #
+            # ⚠️ TARIFF-10 RE-READ THIS STRING AND LEFT IT ALONE, which is worth
+            # saying because that card is about the two switches being
+            # different. `self.arb` is None if and only if
+            # `arbitrage.enabled(self.o)` was False, so `off (arbitrage_enabled)`
+            # still names the option that is actually off - and on a site with a
+            # provider configured it is now the row that says the prices
+            # arriving on the *Price history* row above are moving nothing.
             ("Arbitrage", "off (arbitrage_enabled)" if self.arb is None
              else self.arb.explain()),
         ]
@@ -4605,11 +4740,16 @@ async def amain() -> None:
         # ESP32 heartbeat. A fetch on that path is a supplier's TLS timeout able
         # to push this add-on towards layer 1's 30 s veto. See TARIFF_REFRESH_S.
         #
-        # ⚠️ STARTED ONLY WHEN ARBITRAGE IS ARMED. Nothing else in the add-on
-        # reads the resolved plan - `cheap` still comes from static_status() on
-        # the tick, which is pure - so on a default install this task would be
-        # network traffic in aid of an attribute nobody reads.
-        if arbitrage.enabled(opts):
+        # ⚠️ STARTED WHEN A PROVIDER IS CONFIGURED, *OR* WHEN TRADING IS ARMED
+        # - TARIFF-10, and it used to be the second term alone. `arbitrage_
+        # enabled` ships `false`, so a site that had selected a price feed
+        # fetched nothing at all; the whole argument, the measurement and what
+        # the `or` is protecting are in `tariff_refresh_wanted()` above.
+        #
+        # ⚠️ IT DOES NOT ARM ANYTHING. Fetching a price and trading on one are
+        # two decisions; this is the first, and `cycle()`'s
+        # `if arbitrage.enabled(self.o):` is still the only gate on the second.
+        if tariff_refresh_wanted(opts):
             tasks.append(asyncio.create_task(controller.run_tariff_refresh()))
 
         # P1 ingestion runs as its own long-lived task. ⚠️ It must not be driven

goodwe_controller/app/price.py

@@ -541,6 +541,121 @@ class PriceRead(_Outcome):
         return _NoData(reason)
 
 
+# --------------------------------------------------------------------------- #
+# How long ONE point covers - TARIFF-14
+# --------------------------------------------------------------------------- #
+
+# ⚠️ A POINT DOES NOT CARRY ITS OWN DURATION AND MUST NOT LEARN TO. §9.3 lists
+# THREE fields and `PricePoint` has three; a fourth would change the wire
+# format every store, replay, fixture and captured body in this repository is
+# written against. The span is DERIVED from the neighbours instead - here,
+# once, at construction.
+MAX_POINT_SPAN = timedelta(hours=1)
+
+
+def _cover_table(points) -> tuple:
+    """`(start_utc, end_utc, point)` per point, ascending. The `at()` index.
+
+    THE DEFECT THIS PREVENTS (TARIFF-14, HIGH). `at()` asked
+    `s <= u < s + 1 h` of every point IN LIST ORDER and returned the FIRST
+    match. On an hourly series - the only resolution any fixture carried
+    before TARIFF-08 - that is right by accident. Belgium moved to a
+    15-minute MTU on 2025-10-01 and the live day-ahead feed returns 96 points
+    at 900 s, where it is wrong twice over. Measured on shipped `5059e28`:
+
+        series: 02:00=0.10  02:15=0.11  02:30=0.12  02:45=0.13  03:00=0.14
+
+        at(02:15) -> 02:00   the :00 point's HOUR has not run out yet
+        at(03:15) -> 02:30   and from the second hour on it is not even the
+                             top of the hour: the first point still inside
+                             its own hour wins, so the error COMPOUNDS with
+                             depth into the series
+
+    `arbitrage._act()` compares `here.start` against `v.cheapest.start` and
+    `v.dearest.start` to decide whether this interval is the buy or the sell
+    one. That identity test almost never matched the extremum, so the
+    strategy idled through exactly the interval it exists to trade - and read
+    `here.provisional` and §17's `price < 0` guard off the wrong point while
+    doing it. `static_tariff.py` emits hourly points, so static sites never
+    saw it; this is reachable only down the dynamic path TARIFF-08/09 made
+    work.
+
+    THE RULE, in one sentence:
+
+        A POINT COVERS FROM ITS OWN START UNTIL THE NEXT POINT'S START, AND
+        NEVER MORE THAN ONE HOUR.
+
+      * 900 s  -> each point covers its own quarter, so `at(02:15)` is the
+        02:15 point;
+      * 3600 s -> each point covers its own hour, unchanged from shipped;
+      * MIXED  -> EACH POINT TAKES ITS OWN GAP. FCST-04's carry-forward emits
+        HOURLY carried points beside QUARTER-HOURLY firm ones, and the soak
+        measured spacing `[900, 3600]` in 70 % of samples - so mixed is the
+        normal steady state, and a window derived from one global spacing
+        would be wrong THERE rather than in an edge case.
+
+    ⚠️ WHY THE ONE-HOUR CAP, WHICH IS NOT DECORATION. FCST-04 LEAVES HOLES ON
+    PURPOSE: an hour with no published price AND no yesterday value is left
+    OUT of the series, and `price_forecast.py`'s module note names `at()`
+    raising `Absence` for it as the behaviour that sends the caller to the
+    static profile (§11.4 for that hour). Uncapped, "until the next point's
+    start" would stretch the point BEFORE a three-hour hole across the whole
+    hole and answer every instant in it with a stale price. Filling holes is
+    the defect this module exists to refuse, and it would have been
+    introduced by the fix for a different one.
+
+    ⚠️ THE LAST POINT'S WINDOW IS DECIDED, NOT INHERITED. There is no next
+    start and nothing in §9.3 says how wide the final interval is, so THE
+    LAST POINT IS GIVEN THE SAME SPAN AS THE POINT BEFORE IT - one hour when
+    it is the only point. Three consequences, all intended:
+
+      * on a 96-point 900 s day the 23:45 point covers 23:45 .. 00:00, so
+        `at(23:50)` ANSWERS and `at(00:00)` raises `Absence`. A flat one-hour
+        tail would have answered 00:30 TOMORROW with today's last price,
+        which is reaching for a neighbour across a day boundary;
+      * on an hourly series the tail is an hour, exactly as it shipped, so no
+        static or hourly site changes behaviour;
+      * on a MIXED series whose last point is a carried HOURLY one behind
+        quarter-hourly firm ones, the tail is 900 s and the last 45 minutes
+        of the horizon raise `Absence`. That is the SAFE direction and it is
+        accepted rather than tolerated: the caller falls back to the static
+        profile (§11.4) instead of trading on a span the series never
+        demonstrated, and a carried point is provisional, so §8.3 forbids any
+        irreversible action resting on it regardless.
+
+    ⚠️ ORDER IS ESTABLISHED HERE, NOT ASSUMED - and that is the difference
+    between this and the rule it replaces. `at()` now reads neighbours, so it
+    WOULD depend on sortedness; the table is therefore sorted by UTC start at
+    construction, and no caller's list order can reach it. `_validate_raw()`
+    rejects out-of-order and duplicate starts on the `load_prices()` path,
+    `price_history._parse_points()` re-sorts what it reads off disk, and
+    FCST-04's fill emits ascending - but `PriceRead.series()` itself has
+    never enforced any of that, and an assumption that holds today and is
+    unstated is how this class of defect recurs.
+
+    ⚠️ NOTHING HERE RAISES ON A MALFORMED SERIES. A duplicated start - not
+    reachable through `load_prices()`, which refuses it - gives the earlier
+    list entry a ZERO-width window and the later one the real span, so one of
+    the pair becomes unreachable through `at()` and neither the 30 s control
+    path nor construction raises.
+    """
+    rows = sorted(((p.start.astimezone(timezone.utc), i, p)
+                   for i, p in enumerate(points)),
+                  key=lambda r: (r[0], r[1]))
+    out = []
+    for n, (start, _i, point) in enumerate(rows):
+        if n + 1 < len(rows):
+            span = rows[n + 1][0] - start          # -> the next point's start
+        elif n:
+            span = start - rows[n - 1][0]          # -> the tail, see above
+        else:
+            span = MAX_POINT_SPAN                  # -> a series of one point
+        if span > MAX_POINT_SPAN:
+            span = MAX_POINT_SPAN
+        out.append((start, start + span, point))
+    return tuple(out)
+
+
 class _Series(PriceRead):
     kind = "series"
 
@@ -564,6 +679,10 @@ class _Series(PriceRead):
         self.provider = provider
         self.fetched_at = fetched_at
         self.regime = volatility_regime(product)
+        # ⚠️ TARIFF-14. Built ONCE, here, so that `at()` scans an index whose
+        # order it established itself rather than one it hopes it was handed.
+        # See `_cover_table()` for the window rule and for what the tail does.
+        self._cover = _cover_table(self.points)
         self.words = (f"{len(self.points)} points from {provider} "
                       f"({product.value}, {self.regime} thresholds)")
 
@@ -572,25 +691,47 @@ class _Series(PriceRead):
         return {"prices": [p.canonical() for p in self.points]}
 
     def at(self, instant: datetime) -> PricePoint:
-        """The point covering `instant`. Raises `Absence` if the series does not.
+        """The point whose OWN interval covers `instant`, at ANY resolution.
 
         ⚠️ RETURNS A POINT OR RAISES; it never returns None. `series.at(t) or
         fallback` is the same defaulting bug one level down, so the falsy
         answer does not exist. Ask `covers()` first if you mean to branch.
+
+        ⚠️ TARIFF-14: THE WINDOW IS NOT ONE HOUR WIDE ANY MORE, AND WAS NEVER
+        ENTITLED TO BE. It runs to the next point's start, capped at an hour -
+        `_cover_table()` above holds the rule, the tail decision and the
+        reproduction on a quarter-hourly series. A fixed `s + 1 h` here
+        returned the FIRST point still inside its own hour, which on the live
+        900 s feed is neither the covering point nor, past the first hour,
+        even the top of the hour.
+
+        A linear scan over the index, which is 192 entries on the shipped 48 h
+        horizon. This runs on the 30 s control path through
+        `arbitrage._point_at()`; a bisect would be correct and is not worth
+        the second way to be wrong at this size.
         """
         u = instant.astimezone(timezone.utc)
-        for p in self.points:
-            s = p.start.astimezone(timezone.utc)
-            if s <= u < s + timedelta(hours=1):
-                return p
+        for start, end, point in self._cover:
+            if start <= u < end:
+                return point
         raise Absence(
             f"no price point covers {u.isoformat()}; the series runs "
             f"{self.points[0].start.isoformat()} .. "
-            f"{self.points[-1].start.isoformat()}. An hour outside the series "
-            f"is an hour with no price, which is §11.4 for that hour - not a "
-            f"reason to reach for a neighbouring one.")
+            f"{self.points[-1].start.isoformat()}. An instant outside the "
+            f"series - or inside a hole FCST-04 left because nothing "
+            f"published that hour - is an instant with no price, which is "
+            f"§11.4 for it, not a reason to reach for a neighbouring one.")
 
     def covers(self, instant: datetime) -> bool:
+        """Whether `at(instant)` would answer.
+
+        ⚠️ SHARED TARIFF-14 EXACTLY, AND IS FIXED BY THE SAME CHANGE. It has
+        no window rule of its own - it asks `at()` - so on the 900 s feed it
+        answered True for instants no point covered and False for none of
+        them, because the hour-wide window is never SHORTER than the truth.
+        It is kept as a delegation for that reason: a second copy of the rule
+        is a second place for it to be wrong.
+        """
         try:
             self.at(instant)
             return True
@@ -598,7 +739,17 @@ class _Series(PriceRead):
             return False
 
     def window(self, since: datetime, until: datetime) -> tuple:
-        """Points whose start falls in [since, until). May legitimately be empty."""
+        """Points whose START falls in [since, until). May legitimately be empty.
+
+        ⚠️ DID NOT SHARE TARIFF-14, AND THE REASON IS WORTH STATING RATHER
+        THAN REDISCOVERING. This grades a point's `start` against a half-open
+        range and never asks how long a point lasts, so it carries no
+        resolution assumption to be wrong about - the same call answers the
+        same set at 900 s, at 3600 s and mixed. It is therefore NOT a
+        coverage query: a point that starts before `since` and runs into it
+        is absent from this tuple by design. `at()`/`covers()` are the
+        coverage questions.
+        """
         a = since.astimezone(timezone.utc)
         b = until.astimezone(timezone.utc)
         return tuple(p for p in self.points
@@ -766,6 +917,47 @@ def price_option(opts: dict, key: str):
     return v
 
 
+def provider_id(opts: dict) -> str:
+    """The selected plugin id, normalised. `"off"` when none is selected.
+
+    ⚠️ ONE SPELLING OF THIS EXPRESSION, AND TARIFF-10 IS WHY IT IS A FUNCTION.
+    `str(price_option(opts, "price_provider") or "off").strip()` was written out
+    twice - in `load_prices()` below and in `static_tariff.resolve_tariff()` -
+    and main.py's startup gate would have been a third. "Is a provider
+    configured" is now a DECISION the add-on takes (it is what starts the
+    background refresh), and a decision spelled out at three call sites is three
+    places to disagree about whether `"  off  "` or `None` counts.
+    ⚠️ `validate.py` deliberately keeps its own reader: it validates the RAW
+    options blob, including one the Supervisor never saw, so it must not route
+    through `price_option()`'s defaults. Note what this does NOT do: it does not
+    decide
+    whether the id names a shipped plugin - `load_prices()` and validate.py's
+    rule 7 own that, and answering "unknown" here would turn a typo into
+    "no provider" instead of into a startup refusal.
+    """
+    return str(price_option(opts, "price_provider") or "off").strip()
+
+
+def provider_configured(opts: dict) -> bool:
+    """Has the operator selected a price feed at all? (TARIFF-10)
+
+    THE DEFECT THIS PREVENTS: the background tariff refresh used to start only
+    when `arbitrage_enabled` was on, which ships `false` - so a site with a
+    provider configured fetched NOTHING, ever. `/data/price_history.json` was
+    never created, the *Price history* status row read `empty` forever, and
+    TARIFF-09's short-horizon warning could not fire because no fetch happened
+    to warn about. Measured over a 40 h two-instance soak: zero feed requests
+    and `present: false` across all 802 samples on the shipped default, against
+    a resolved plan on the same feed with arbitrage armed.
+
+    ⚠️ THIS IS NOT A TRADING SWITCH AND MUST NEVER BECOME ONE. It answers
+    "fetch prices?"; `arbitrage.enabled()` answers "move energy on them?", and
+    §10.1's priority 3 is gated on the second alone. See
+    `main.tariff_refresh_wanted()` for the one place the two meet.
+    """
+    return provider_id(opts) not in ("", "off")
+
+
 def export_price_eur_kwh(opts: dict) -> float:
     """AC4 / §9.3: the injection price is a SEPARATE SCALAR, not a second series.
 
@@ -1516,8 +1708,8 @@ async def load_prices(opts: dict, since: datetime, until: datetime,
     site condition, it is a plugin trying to read the markup, and turning it
     into "no price data" would hide the exact defect trap 1 exists to catch.
     """
-    pid = str(price_option(opts, "price_provider") or "off").strip()
-    if pid in ("", "off"):
+    pid = provider_id(opts)
+    if not provider_configured(opts):
         return PriceRead.no_data(
             "no price provider configured (price_provider is 'off'); "
             "§11.4: static profile, plan provisional, no arbitrage")

goodwe_controller/app/static_tariff.py

@@ -207,7 +207,7 @@ from datetime import datetime, timedelta, timezone
 from .price import (
     MAX_PLAUSIBLE_EUR_KWH, Absence, PricePoint, PriceProduct, PriceRead,
     Uncertainty, _Outcome, brussels, load_prices, price_option,
-    required_spread, uncertainty_of, widen_factor,
+    provider_configured, required_spread, uncertainty_of, widen_factor,
 )
 
 _LOG = logging.getLogger("goodwe.tariff.static")
@@ -728,6 +728,33 @@ class TariffPlan:
         self.origin = origin
 
     # -- derived facts -------------------------------------------------------
+    @property
+    def from_feed(self) -> bool:
+        """Is this series an OBSERVATION of the configured provider's feed?
+
+        TARIFF-12. `origin` names four ways a plan is obtained; this collapses
+        them to the one question a caller holding a PREVIOUS plan has to ask
+        about a new one - did this resolution see the feed, or is it standing
+        in for one that did not? Only `"provider"` saw it. `"fallback"` and
+        `"none"` are the two §11.4 rows, and `"static"` is a site with no
+        feed to observe at all, where the question does not arise.
+
+        ⚠️ IT IS NOT `has_prices`, AND THE DIFFERENCE IS THE WHOLE POINT. A
+        §11.4 fallback HAS prices - the operator's own static profile - but
+        every point `_degrade()` builds carries `provisional=True`, so
+        `firm_points()` is empty, `arbitrage()` refuses and `cheap_now()` is
+        False. It is a real tariff and it is not an observation, and a caller
+        deciding whether to REPLACE an observation with it needs the second
+        fact, not the first.
+
+        ⚠️ AND IT IS A PROPERTY HERE RATHER THAN AN `origin == "provider"` AT
+        THE CALL SITE, for `main.fresh_tariff_plan()`'s stated reason: a check
+        has to be able to assert on the shipped expression rather than on a
+        transcription that drifts, and `origin`'s vocabulary belongs to this
+        module.
+        """
+        return self.origin == "provider"
+
     @property
     def has_prices(self) -> bool:
         return self.read.match(series=lambda _r: True, no_data=lambda _r: False)
@@ -1071,8 +1098,7 @@ async def resolve_tariff(opts: dict, since: datetime, until: datetime,
     missing and loses the elapsed ones it should never have had.
     """
     stamp = now or datetime.now(timezone.utc)
-    pid = str(price_option(opts, "price_provider") or "off").strip()
-    if pid in ("", "off"):
+    if not provider_configured(opts):
         return static_plan(opts, since, until, provisional=False, now=stamp)
 
     read = await load_prices(opts, since, until, transport)

goodwe_controller/config.yaml

@@ -265,9 +265,17 @@ options:
   # TARIFF - what energy costs, and whether to trade on it
   # ==========================================================================
   # `off` is the shipped default and means the §11.4 no-price-data row applies:
-  # static profile, plan provisional, NO ARBITRAGE. Nothing in 0.5.x consumes
-  # the series yet - OPT-04 is the consumer - so turning this on today fetches,
-  # validates and publishes prices and changes no energy decision.
+  # static profile, plan provisional, NO ARBITRAGE.
+  #
+  # ⚠️ SELECTING A PROVIDER IS WHAT STARTS THE FETCH, AND IT IS NOT
+  # `arbitrage_enabled` (TARIFF-10). With a provider set and trading off - the
+  # shipped default - the add-on fetches the feed every 30 minutes, validates
+  # it, records the day in /data/price_history.json and reports what it holds
+  # on the *Price history* status row. It changes NO energy decision: the cheap
+  # window the maintenance cycle reads still comes from `static_profile`, and
+  # §10.1's arbitrage is gated on `arbitrage_enabled` alone. Until TARIFF-10
+  # the fetch was gated on `arbitrage_enabled` too, so this option did nothing
+  # whatsoever on a shipped install - the store was never even created.
   #
   # ⚠️ THESE DEFAULTS ARE MIRRORED ONCE, IN app/price.py's
   # PRICE_OPTION_DEFAULTS, and test_price.py reads THIS FILE and asserts the two
@@ -352,6 +360,12 @@ options:
   # configuration: this is the first strategy in the add-on that moves energy
   # against the meter on purpose, so it is armed deliberately or not at all.
   #
+  # ⚠️ IT IS NOT WHAT TURNS THE PRICE FEED ON (TARIFF-10). `price_provider`
+  # above decides whether prices are FETCHED; this decides whether they move
+  # energy. Leaving this off on a site with a provider configured is a
+  # supported, documented state: prices are fetched, validated and recorded,
+  # and nothing trades.
+  #
   # ⚠️ IT NEEDS A PRICE SOURCE AND A P1 METER, and validate.py refuses the
   # combinations that cannot work rather than letting them look armed. With
   # `price_provider: off` and no `static_profile` there is no series to trade

goodwe_controller/test_arbitrage.py

@@ -92,7 +92,9 @@ from app.price import (
     PRICE_OPTION_DEFAULTS, Absence, PricePoint, PriceProduct, PriceRead,
     Uncertainty, WIDEN_FACTOR, brussels, required_spread, widen_factor,
 )
-from app.static_tariff import TariffPlan, parse_static_profile, static_plan
+from app.static_tariff import (
+    TariffPlan, parse_static_profile, resolve_tariff, static_plan,
+)
 from app.validate import validate_startup_config
 
 UTC = timezone.utc
@@ -1284,6 +1286,323 @@ check("main.py reads every arbitrage option through app/arbitrage.py or "
                     "arbitrage_soc_ceiling")))
 
 
+# --------------------------------------------------------------------------- #
+print()
+print("8b. TARIFF-12 - a RETURNED degradation must not clear a fresh plan")
+
+# ⚠️ THE STIMULUS IS A RETURN, NOT A RAISE, AND THAT IS THE WHOLE CHECK.
+# `run_tariff_refresh()` guarded the plan with `except Exception` alone, and
+# `load_prices()` states in its own docstring that it "RETURNS, NEVER RAISES,
+# for every failure a site can actually have" - so the one case the guard was
+# written for, a supplier outage, never reached it. Everything below drives the
+# SHIPPED chain and stubs nothing but the socket: the transport raises the way
+# aiohttp does, `load_prices()` turns that into a `no_data` read, `_degrade()`
+# turns THAT into a §11.4 plan, and `run_tariff_refresh()` decides what to do
+# with it. A check that patched `resolve_tariff` to raise would have passed
+# against the defective code.
+import asyncio                                                    # noqa: E402
+from app import price as _price                                   # noqa: E402
+from app.price_history import NoHistory                           # noqa: E402
+
+
+class ClientConnectorError(Exception):
+    """aiohttp's own class name, so the §11.4 reason this drives is the
+    sentence the 40 h soak recorded at refresh 56, verbatim."""
+
+
+_T12_FEED_UP = {"up": True}
+
+
+async def _t12_transport(url, timeout_s):
+    """The socket, and nothing else, is what this replaces."""
+    if not _T12_FEED_UP["up"]:
+        raise ClientConnectorError(
+            "Cannot connect to host api.energy-charts.info:443 ssl:default")
+    t0 = datetime.now(UTC).replace(minute=0, second=0, microsecond=0)
+    return json.dumps({
+        "unix_seconds": [int((t0 + timedelta(hours=i)).timestamp())
+                         for i in range(48)],
+        "price": [80.0 + 40.0 * (i % 6) for i in range(48)],
+        "unit": "EUR / MWh"}).encode()
+
+
+class _T12Controller:
+    """Just enough Controller to run the SHIPPED refresh coroutine.
+
+    Both methods are bound off the shipped class rather than copied, for
+    `fresh_tariff_plan()`'s own stated reason: a transcription drifts.
+    """
+    run_tariff_refresh = _main.Controller.run_tariff_refresh
+    fresh_tariff_plan = _main.Controller.fresh_tariff_plan
+
+    def __init__(self, opts):
+        self.o = opts
+        self.tariff_plan = None
+        self.tariff_at = None
+        self.price_history = NoHistory()
+        self.stop_event = asyncio.Event()
+        self.stop_event.set()          # so the inter-refresh wait returns
+        self._ticks = 0
+
+    @property
+    def stopping(self):
+        self._ticks -= 1
+        return self._ticks < 0
+
+    def refresh_once(self):
+        self._ticks = 1
+        asyncio.run(self.run_tariff_refresh())
+        return self
+
+
+def _t12_opts(profile=""):
+    # `price_timeout_s` is read with a plain `.get()` by every plugin, so it
+    # has to be present - an options dict that relies on price_option()'s
+    # defaults for it fetches with `float(None)` and this section would grade
+    # a TypeError instead of an outage.
+    return {"price_provider": "generic_dayahead", "price_timeout_s": 10,
+            "price_horizon_h": 48, "static_profile": profile}
+
+
+_T12_HORIZON_H = 48
+_T12_STALE_S = _main.TARIFF_MAX_AGE_S
+_t12_saved_transport = _price.https_get
+_price.https_get = _t12_transport
+
+# -- the accepted baseline (habit 7): one good fetch, varied one thing at a
+# -- time from here.
+_T12_FEED_UP["up"] = True
+_t12_a = derived(lambda: _T12Controller(_t12_opts()).refresh_once())
+_t12_good = derived(lambda: _t12_a.tariff_plan)
+check(f"BASELINE: a fetch that succeeds stores an OBSERVATION - "
+      f"{getattr(_t12_good, 'words', _t12_good)!r}",
+      getattr(_t12_good, "origin", None) == "provider"
+      and _t12_good.from_feed is True
+      and len(_t12_good.read.points) == _T12_HORIZON_H)
+
+# -- the stimulus, graded before it is used on anything (habit 6/7) ----------
+_T12_FEED_UP["up"] = False
+_t12_now = datetime.now(UTC)
+_t12_deg = derived(lambda: asyncio.run(resolve_tariff(
+    _t12_opts(), _t12_now, _t12_now + timedelta(hours=_T12_HORIZON_H),
+    now=_t12_now, history=NoHistory())))
+check("STIMULUS: a dead feed makes resolve_tariff() RETURN a degraded plan - "
+      "it does not raise, so `except Exception` is not what was protecting "
+      "the plan and the defect was never on that branch",
+      isinstance(_t12_deg, TariffPlan))
+check(f"...and the returned plan is the §11.4 no-profile row the soak saw - "
+      f"{getattr(_t12_deg, 'words', _t12_deg)!r}",
+      isinstance(_t12_deg, TariffPlan) and _t12_deg.origin == "none"
+      and _t12_deg.from_feed is False and _t12_deg.has_prices is False
+      and "ClientConnectorError" in _t12_deg.words)
+
+# -- AC1: the degradation must not replace a plan still inside the bound -----
+# ⚠️ 1800 s IS STATED HERE, NOT DERIVED FROM THE MODULE BEING GRADED - section
+# 8's own lesson. A probe at `TARIFF_MAX_AGE_S - 1` moves with a mutation of
+# the constant; half an hour is inside any reading of a 5400 s bound, and it is
+# the interval the soak actually ran at.
+_t12_b = derived(lambda: _T12Controller(_t12_opts()))
+_t12_b.tariff_plan, _t12_b.tariff_at = _t12_good, datetime.now(UTC) - \
+    timedelta(seconds=1800)
+_t12_at_before = _t12_b.tariff_at
+check(f"PRECONDITION: the standing plan is 1800 s old and TARIFF_MAX_AGE_S is "
+      f"{_T12_STALE_S:.0f} s, so it IS fresh when the failed refresh runs - "
+      f"without this the next check grades an expired plan",
+      1800 < _T12_STALE_S
+      and _t12_b.fresh_tariff_plan(datetime.now(UTC)) is _t12_good)
+_t12_b.refresh_once()
+check("a RETURNED degradation does not replace a plan still inside "
+      "TARIFF_MAX_AGE_S - the 48 h series is still there, by identity, and "
+      "not a 0-point `origin: none` read",
+      _t12_b.tariff_plan is _t12_good
+      and _t12_b.tariff_plan.has_prices is True
+      and len(_t12_b.tariff_plan.read.points) == _T12_HORIZON_H)
+check("...and `tariff_at` did NOT move, so the kept plan still ages out from "
+      "the fetch that produced it and is distinguishable from a freshly "
+      "fetched one. Re-stamping it here is how a plan freezes at its last "
+      "value and looks current forever",
+      _t12_b.tariff_at == _t12_at_before)
+check("...and the two timestamps a successful refresh and a kept plan produce "
+      "really are different values, or the check above compares a number "
+      "against itself",
+      _t12_a.tariff_at != _t12_at_before)
+
+# -- AC3: TARIFF_MAX_AGE_S governs - the bound is where the module says ------
+_t12_c = derived(lambda: _T12Controller(_t12_opts()))
+_t12_c.tariff_plan, _t12_c.tariff_at = _t12_good, datetime.now(UTC) - \
+    timedelta(seconds=_T12_STALE_S + 5)
+_t12_c.refresh_once()
+check(f"a plan that has aged PAST {_T12_STALE_S:.0f} s IS replaced by the "
+      f"degradation - the plan is served stale for the age bound and no "
+      f"longer, so TARIFF_MAX_AGE_S governs something rather than being "
+      f"unreachable",
+      _t12_c.tariff_plan is not _t12_good
+      and _t12_c.tariff_plan.from_feed is False
+      and _t12_c.tariff_plan.has_prices is False)
+_t12_d = derived(lambda: _T12Controller(_t12_opts()))
+_t12_d.tariff_plan, _t12_d.tariff_at = _t12_good, datetime.now(UTC) - \
+    timedelta(seconds=_T12_STALE_S - 60)
+_t12_d.refresh_once()
+check("...and one minute SHORT of the bound it is still kept, so the line "
+      "above is a bound rather than 'the degradation always wins'",
+      _t12_d.tariff_plan is _t12_good)
+_t12_e = derived(lambda: _T12Controller(_t12_opts()).refresh_once())
+check("a degradation with NO plan standing at all is stored - §11.4 still "
+      "reaches an install that has never had a good fetch, and the guard is "
+      "not 'never overwrite'",
+      _t12_e.tariff_plan is not None
+      and _t12_e.tariff_plan.from_feed is False
+      and _t12_e.tariff_at is not None)
+
+# -- the §11.4 STATIC FALLBACK, which is the judgement this card had to make -
+_t12_f = derived(lambda: _T12Controller(_t12_opts(STATIC_BE)))
+_t12_fb = derived(lambda: asyncio.run(resolve_tariff(
+    _t12_opts(STATIC_BE), _t12_now,
+    _t12_now + timedelta(hours=_T12_HORIZON_H), now=_t12_now,
+    history=NoHistory())))
+check(f"PRECONDITION: with a static_profile configured the SAME dead feed "
+      f"degrades to a §11.4 FALLBACK carrying real prices, not to the "
+      f"no-profile row - {getattr(_t12_fb, 'words', _t12_fb)!r}",
+      isinstance(_t12_fb, TariffPlan) and _t12_fb.origin == "fallback"
+      and _t12_fb.has_prices is True and _t12_fb.from_feed is False)
+check("...and every one of its points is provisional, so firm_points() is "
+      "empty, arbitrage() refuses and cheap_now() is False - it is a real "
+      "tariff and nothing may be acted on it. That is why it does not replace "
+      "a fresh observation",
+      isinstance(_t12_fb, TariffPlan) and _t12_fb.provisional is True
+      and _t12_fb.firm_points() == ()
+      and _t12_fb.arbitrage(peak_guard_active=False, min_spread_eur_kwh=0.0,
+                            uncertainty=NO_WEATHER).kind == "refused")
+_t12_f.tariff_plan, _t12_f.tariff_at = _t12_good, datetime.now(UTC) - \
+    timedelta(seconds=1800)
+_t12_f_at = _t12_f.tariff_at
+_t12_f.refresh_once()
+check("a §11.4 static FALLBACK does not replace a fresh provider plan either, "
+      "although it has prices - a day-ahead price for an hour does not change "
+      "once published, so the 30-minute-old observation is no less true and "
+      "is the only one of the two that carries a firm hour",
+      _t12_f.tariff_plan is _t12_good and _t12_f.tariff_at == _t12_f_at)
+
+# -- ...and the rule is NOT symmetrical: a degradation replaces a degradation.
+_t12_g = derived(lambda: _T12Controller(_t12_opts(STATIC_BE)))
+_t12_g.tariff_plan, _t12_g.tariff_at = _t12_fb, datetime.now(UTC) - \
+    timedelta(seconds=1800)
+_t12_g_at = _t12_g.tariff_at
+_t12_g.refresh_once()
+check("a standing plan that is ITSELF a §11.4 fallback IS replaced by the "
+      "next one, and its timestamp moves - otherwise an outage would freeze "
+      "the operator's static profile at the window it was first generated "
+      "for, and the guard would be 'never overwrite' wearing a bound's name",
+      _t12_g.tariff_plan is not _t12_fb and _t12_g.tariff_plan.origin ==
+      "fallback" and _t12_g.tariff_at != _t12_g_at)
+
+# -- ...and a recovered feed replaces a kept plan, which is the third term ---
+_T12_FEED_UP["up"] = True
+_t12_h = derived(lambda: _T12Controller(_t12_opts()))
+_t12_h.tariff_plan, _t12_h.tariff_at = _t12_good, datetime.now(UTC) - \
+    timedelta(seconds=1800)
+_t12_h_at = _t12_h.tariff_at
+_t12_h.refresh_once()
+check("when the feed answers again the observation replaces the kept plan and "
+      "`tariff_at` moves - the guard keeps a plan against a DEGRADATION, not "
+      "against a fetch that worked",
+      _t12_h.tariff_plan is not _t12_good
+      and _t12_h.tariff_plan.from_feed is True
+      and _t12_h.tariff_at != _t12_h_at)
+
+# -- TARIFF-10 widened WHICH INSTALLS RUN THIS TASK, so the configurations it
+# -- newly keeps alive are graded here rather than reasoned about.
+# ⚠️ `price_provider: off` + a `static_profile` + `arbitrage_enabled: true` is a
+# configuration validate.py ACCEPTS and TARIFF-10's `or` exists to protect. On
+# it `resolve_tariff()` returns `static_plan(provisional=False)` - the
+# CONFIGURED product, origin "static" - so `standing.from_feed` is false on
+# every refresh and this card's guard must never fire. Confirmed by driving it,
+# not by reading the origin table: a guard that quietly latched here would
+# freeze a static site's plan at its first window for the life of the install.
+_t12_i = derived(lambda: _T12Controller(
+    {"price_provider": "off", "price_timeout_s": 10, "price_horizon_h": 48,
+     "static_profile": STATIC_BE}).refresh_once())
+_t12_i_plan, _t12_i_at = _t12_i.tariff_plan, _t12_i.tariff_at
+_t12_i.refresh_once()
+check("PRECONDITION: a `price_provider: off` + static_profile site resolves to "
+      "the CONFIGURED product, not to a §11.4 row - origin 'static', prices, "
+      "and from_feed false because there is no feed to have observed",
+      getattr(_t12_i_plan, "origin", None) == "static"
+      and _t12_i_plan.has_prices is True and _t12_i_plan.from_feed is False)
+check("...and TARIFF-10 now keeps this task alive on exactly that site, where "
+      "this card's guard must NEVER latch: the second refresh replaces the "
+      "first and the timestamp moves, so the plan is regenerated for the "
+      "current window every 30 minutes as it always was",
+      _t12_i.tariff_plan is not _t12_i_plan
+      and _t12_i.tariff_plan.origin == "static"
+      and _t12_i.tariff_at != _t12_i_at)
+
+# ⚠️ AND THE OTHER CONFIGURATION TARIFF-10 ADDED - a provider configured with
+# trading DISARMED - is graded by every driven check above without a second
+# fixture, because nothing on this path reads `arbitrage_enabled` at all. That
+# is a claim about the code rather than about a behaviour, so it is asserted as
+# one (habit 4's exception, FCST-06's precedent): a fixture that set the option
+# and asserted no difference would be comparing a thing against itself.
+_T12_TRADING_OPTS = ("arbitrage_enabled", "cycle_cost_threshold_eur",
+                     "arbitrage_soc_floor", "arbitrage_soc_ceiling")
+# ⚠️ AND IT IS WHAT THE FUNCTION READS THAT IS SCANNED, NOT ITS TEXT. Two
+# earlier drafts of this check were red against a CORRECT tree: the first
+# because the docstring paragraph that SAYS `arbitrage_enabled` is not read is
+# itself an occurrence of the string, the second because the log line says
+# "arbitrage, where it is armed, stops with it" - which is a sentence, not a
+# read. A substring test over a function grades its prose as much as its
+# behaviour (habit 4). So the symbols are taken from the AST, and the string
+# constants are taken separately and with the docstring dropped: naming
+# arbitrage in a message is fine, READING a trading option is the thing claimed
+# not to happen.
+_t12_syms = derived(lambda: {getattr(n, "id", None) or getattr(n, "attr", None)
+                             for n in ast.walk(_refresh)
+                             if isinstance(n, (ast.Name, ast.Attribute))})
+_t12_consts = derived(lambda: {c.value for b in _refresh.body[1:]
+                               for c in ast.walk(b)
+                               if isinstance(c, ast.Constant)
+                               and isinstance(c.value, str)})
+check("run_tariff_refresh() READS no trading option and calls nothing in "
+      "app/arbitrage.py, so keeping a plan is a decision about what the add-on "
+      "has LOOKED UP - TARIFF-10's own distinction, and why the checks above "
+      "cover a provider-configured site whether or not arbitrage is armed",
+      isinstance(_t12_syms, set)
+      and not any("arbitrage" in (n or "") for n in _t12_syms)
+      and not (_t12_consts & set(_T12_TRADING_OPTS))
+      # ...and both scanners can see what IS there, or they grade nothing: the
+      # one option this task does read, and a name it really does call.
+      and "price_horizon_h" in _t12_consts
+      and "fresh_tariff_plan" in _t12_syms
+      # ...and the docstring really was dropped, or the first draft's defect is
+      # back and the constant set is grading prose again.
+      and not any("RETURNS, NEVER RAISES" in c for c in _t12_consts))
+
+# -- the vocabulary, graded on its own so a mutation of it has a named home --
+check("TariffPlan.from_feed is true of exactly the observation - a §11.4 "
+      "fallback, a no-data read and a CONFIGURED static profile are all false, "
+      "and it is not a synonym for has_prices",
+      _t12_good.from_feed is True and _t12_fb.from_feed is False
+      and _t12_deg.from_feed is False
+      and static_plan({"static_profile": STATIC_BE}, D0,
+                      D0 + timedelta(days=2), now=D0).from_feed is False
+      and static_plan({"static_profile": STATIC_BE}, D0,
+                      D0 + timedelta(days=2), now=D0).has_prices is True)
+
+# ⚠️ A SHAPE CLAIM, AND IT IS ALLOWED TO BE ONE (FCST-06's precedent). "The age
+# is judged in ONE place" is a claim about the code, not about a behaviour: a
+# transcribed copy of the same comparison behaves identically until the day the
+# two drift. Every other check in this section is driven.
+check("run_tariff_refresh() asks fresh_tariff_plan() rather than re-deriving "
+      "the age bound - one place judges it, which is what that method's own "
+      "docstring is for",
+      _refresh is not None
+      and {n.func.attr for n in ast.walk(_refresh)
+           if isinstance(n, ast.Call) and isinstance(n.func, ast.Attribute)}
+      >= {"fresh_tariff_plan"})
+
+_price.https_get = _t12_saved_transport
+
+
 # --------------------------------------------------------------------------- #
 print()
 print("9. the startup gate - the configurations that cannot work are refused")
@@ -1376,6 +1695,312 @@ check("soc_bounds() returns the shipped pair, floor first",
                          float(PRICE_OPTION_DEFAULTS["arbitrage_soc_ceiling"])))
 
 
+# --------------------------------------------------------------------------- #
+print()
+print("10. TARIFF-14 - the QUARTER-HOURLY day, end to end through decide()")
+# ⚠️ THIS IS THE PROPERTY THE DEFECT ACTUALLY BROKE, WHICH IS WHY IT IS GRADED
+# HERE AND NOT ONLY ON `at()`. `_act()` decides whether this interval is the
+# buy one or the sell one with `here.start == v.cheapest.start` - an IDENTITY
+# test between the point `_point_at()` matched and the point the verdict was
+# built from. `_Series.at()` used to return the first point whose start was
+# within one hour BEFORE the instant, in list order, so on a 900 s series that
+# identity almost never held: the strategy idled through exactly the interval
+# it exists to trade, and read `here.provisional` and §17's `price < 0` off a
+# point that was not the one being traded.
+#
+# Belgium moved to a 15-minute MTU on 2025-10-01 and the live day-ahead feed
+# returns 96 points at 900 s. `static_tariff.py` emits HOURLY points, so every
+# fixture above this line - and every static site - is immune; this is
+# reachable only down the dynamic path TARIFF-08/09 made work.
+
+QD0 = datetime(2026, 1, 15, 0, 0, tzinfo=timezone(timedelta(hours=1)))
+QUARTER = timedelta(minutes=15)
+
+
+def qplan_of(prices, *, provisional=False, start=QD0, gaps=None):
+    """A TariffPlan over `prices` spaced by `gaps` seconds (900 s by default).
+
+    `gaps` is what makes the MIXED fixture below expressible: FCST-04's
+    carry-forward emits HOURLY carried points beside QUARTER-HOURLY firm ones,
+    and the soak measured spacing [900, 3600] in 70 % of samples.
+    """
+    g = [900] * (len(prices) - 1) if gaps is None else list(gaps)
+    flags = ([bool(provisional)] * len(prices)
+             if isinstance(provisional, bool) else list(provisional))
+    pts, t = [], start
+    for i, (p, f) in enumerate(zip(prices, flags)):
+        pts.append(PricePoint(start=brussels(t), eur_per_kwh=round(float(p), 6),
+                              provisional=bool(f)))
+        if i < len(g):
+            t += timedelta(seconds=g[i])
+    return TariffPlan(PriceRead.series(pts, PriceProduct.DAY_AHEAD,
+                                       "generic_dayahead", start),
+                      None, "provider")
+
+
+def qprobe(i, *, start=QD0, gaps=None):
+    """An instant 7 minutes into slot `i` - inside every window, never on a
+    boundary, and NOT the midpoint of an hour either, so an implementation that
+    answered per hour and one that answers per quarter differ here."""
+    g = [900] * i if gaps is None else list(gaps)[:i]
+    return start + timedelta(seconds=sum(g)) + timedelta(minutes=7)
+
+
+def shipped_at(series, u):
+    """THE RULE TARIFF-14 REPLACED, kept here as the COUNTERFACTUAL ONLY.
+
+    The first point whose start is within one hour before `u`, in list order.
+    Nothing below is graded against it; it exists so that the fixtures can be
+    shown to SEPARATE the two rules. A check whose data cannot reach the
+    failure it names is decoration (MUTATION.md), and on an hourly series the
+    two rules agree at every instant - which is why 29 files stayed green.
+    """
+    uu = u.astimezone(UTC)
+    for p in series.points:
+        s = p.start.astimezone(UTC)
+        if s <= uu < s + timedelta(hours=1):
+            return p
+    return None
+
+
+# The hourly day interpolated across its quarters, with the two extremes
+# planted OFF the hour boundary on purpose.
+QBASE = []
+for _i in range(24):
+    _a, _b = DAY[_i], DAY[(_i + 1) % 24]
+    for _q in range(4):
+        QBASE.append(round(_a + (_b - _a) * _q / 4 + 0.000001 * (_i * 4 + _q),
+                           6))
+Q_CHEAP_I = 4 * 5 + 3          # 05:45 - a :45 quarter, not a whole hour
+Q_DEAR_I = 4 * 19 + 1          # 19:15 - a :15 quarter, not a whole hour
+QDAY = list(QBASE)
+QDAY[Q_CHEAP_I] = round(min(QBASE) - 0.030, 6)
+QDAY[Q_DEAR_I] = round(max(QBASE) + 0.030, 6)
+QPLAN = qplan_of(QDAY)
+QPTS = QPLAN.read.points
+
+print("10a. the fixture is not degenerate, and it SEPARATES the two rules")
+_qgaps = sorted({int((b.start - a.start).total_seconds())
+                 for a, b in zip(QPTS, QPTS[1:])})
+check(f"the day is 96 points at {_qgaps} s - the shape the live feed has "
+      f"returned since Belgium's 2025-10-01 move to a 15-minute MTU",
+      len(QPTS) == 96 and _qgaps == [900])
+check(f"the cheapest quarter is slot {Q_CHEAP_I} and the dearest slot "
+      f"{Q_DEAR_I} - neither first, neither last, {abs(Q_CHEAP_I - Q_DEAR_I)} "
+      f"slots apart, and NEITHER ON A WHOLE HOUR, without which this section "
+      f"would grade nothing an hourly fixture does not already grade",
+      QDAY.index(min(QDAY)) == Q_CHEAP_I and QDAY.index(max(QDAY)) == Q_DEAR_I
+      and Q_CHEAP_I % 4 != 0 and Q_DEAR_I % 4 != 0
+      and Q_CHEAP_I not in (0, 95) and Q_DEAR_I not in (0, 95)
+      and abs(Q_CHEAP_I - Q_DEAR_I) > 1)
+check("...and all 96 prices are distinct, so 'the cheapest quarter' names one "
+      "quarter and no tie-break is what any check below is really grading",
+      len(set(QDAY)) == 96)
+check(f"...and its spread is {round(max(QDAY) - min(QDAY), 6):.4f} EUR/kWh, "
+      f"clear of the widened threshold, so what follows grades the strategy "
+      f"and not the spread rung",
+      round(max(QDAY) - min(QDAY), 6) > required_spread(_shipped, NO_WEATHER))
+# ⚠️ HABIT 4, AND THE ONLY REASON THIS SECTION IS WORTH ITS LINES. State, as a
+# check, that the shipped rule and the fixed one give DIFFERENT points at the
+# two probes that matter. Without it, every check below could be passing on a
+# fixture the defect could not have changed.
+_cf_buy = derived(lambda: shipped_at(QPLAN.read, qprobe(Q_CHEAP_I)))
+_cf_sell = derived(lambda: shipped_at(QPLAN.read, qprobe(Q_DEAR_I)))
+check(f"the shipped rule and this one give DIFFERENT points at both probes - "
+      f"buy: {derived(lambda: _cf_buy.eur_per_kwh)} instead of "
+      f"{QDAY[Q_CHEAP_I]}, sell: {derived(lambda: _cf_sell.eur_per_kwh)} "
+      f"instead of {QDAY[Q_DEAR_I]} - so the fixture can reach the failure it "
+      f"names",
+      _cf_buy is not QPTS[Q_CHEAP_I] and _cf_sell is not QPTS[Q_DEAR_I]
+      and _cf_buy is not None and _cf_sell is not None)
+
+print()
+print("10b. the buy/sell identity test matches the actual extremum interval")
+_qv = QPLAN.arbitrage(peak_guard_active=False, min_spread_eur_kwh=_shipped,
+                      uncertainty=NO_WEATHER)
+check("the verdict's cheapest and dearest are the two QUARTERS, not the hours "
+      "containing them - `static_tariff` reduces over every firm point and "
+      "carries no resolution assumption of its own",
+      derived(lambda: _qv.cheapest) is QPTS[Q_CHEAP_I]
+      and derived(lambda: _qv.dearest) is QPTS[Q_DEAR_I])
+_pa_buy = derived(lambda: _arb._point_at(QPLAN, qprobe(Q_CHEAP_I)))
+_pa_sell = derived(lambda: _arb._point_at(QPLAN, qprobe(Q_DEAR_I)))
+check("THE PROPERTY THE DEFECT BROKE: at the buy probe `_point_at()` returns "
+      "the verdict's OWN cheapest point, by identity - which is what makes "
+      "`_act()`'s `here.start == v.cheapest.start` true, and what made it "
+      "false on every quarter-hourly series the add-on has ever fetched",
+      _pa_buy is derived(lambda: _qv.cheapest))
+check("...and the same at the sell probe, against the verdict's dearest",
+      _pa_sell is derived(lambda: _qv.dearest))
+_qbuy = decide(QPLAN, qprobe(Q_CHEAP_I), peak_guard_active=False, soc=50.0,
+               min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+               charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+               soc_ceiling_pct=95.0)
+_qsell = decide(QPLAN, qprobe(Q_DEAR_I), peak_guard_active=False, soc=50.0,
+                min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+                charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+                soc_ceiling_pct=95.0)
+check("...so decide() CHARGES in the cheapest quarter and DISCHARGES in the "
+      "dearest one, which is the trade the strategy exists to make and the "
+      "one it slept through",
+      _qbuy.action == CHARGE and _qsell.action == DISCHARGE)
+check(f"...at THAT QUARTER's price and not at the price of the hour "
+      f"containing it (buy {_qbuy.price_now_eur_kwh}, sell "
+      f"{_qsell.price_now_eur_kwh})",
+      near(_qbuy.price_now_eur_kwh, QDAY[Q_CHEAP_I])
+      and near(_qsell.price_now_eur_kwh, QDAY[Q_DEAR_I]))
+check("...and both reasons quote that quarter's price, so the operator's log "
+      "names the interval that was actually traded",
+      f"{QDAY[Q_CHEAP_I]:.4f}" in _qbuy.reason
+      and f"{QDAY[Q_DEAR_I]:.4f}" in _qsell.reason)
+# The negative arm. Without it "it acted" could be "it acts everywhere".
+_QOFF_I = Q_CHEAP_I + 2
+check(f"the off-peak probe's own price differs from its hour's :00 price "
+      f"({QDAY[_QOFF_I]} vs {QDAY[4 * (_QOFF_I // 4)]}), so the check below "
+      f"can tell which point the decision read",
+      QDAY[_QOFF_I] != QDAY[4 * (_QOFF_I // 4)]
+      and _QOFF_I not in (Q_CHEAP_I, Q_DEAR_I))
+_qoff = decide(QPLAN, qprobe(_QOFF_I), peak_guard_active=False, soc=50.0,
+               min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+               charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+               soc_ceiling_pct=95.0)
+check("a quarter that is neither extremum still idles, for the reason that "
+      "names the right rule, and reports ITS OWN price - not the price of the "
+      "quarter the shipped scan would have matched",
+      _qoff.action is None and _qoff.reason == _arb.IDLE_OFF_PEAK_HOUR
+      and near(_qoff.price_now_eur_kwh, QDAY[_QOFF_I]))
+
+print()
+print("10c. §17 and §8.3 are evaluated on the QUARTER being traded")
+# ⚠️ §17 AT 900 s. The whole day is below zero and the dearest QUARTER is the
+# least negative one - section 2's shape, at the resolution the live feed
+# actually publishes. Under the shipped scan this probe never reached the
+# guard at all: the identity test failed first and the decision idled as
+# "neither the buy hour nor the sell hour", so §17 was not so much wrong as
+# never consulted.
+_shift = round(max(QDAY) + 0.020, 6)
+QNEG = [round(p - _shift, 6) for p in QDAY]
+QNEG_PLAN = qplan_of(QNEG)
+check(f"the negative day's dearest quarter is slot {Q_DEAR_I} and it is BELOW "
+      f"ZERO ({max(QNEG):+.4f}), and its spread still clears the widened "
+      f"threshold - so the refusal below is §17's and not the spread rung's",
+      QNEG.index(max(QNEG)) == Q_DEAR_I and max(QNEG) < 0
+      and round(max(QNEG) - min(QNEG), 6) > required_spread(_shipped,
+                                                            NO_WEATHER))
+_qneg_sell = decide(QNEG_PLAN, qprobe(Q_DEAR_I), peak_guard_active=False,
+                    soc=50.0, min_spread_eur_kwh=_shipped,
+                    uncertainty=NO_WEATHER, charge_w=MAX_W, discharge_w=MAX_W,
+                    soc_floor_pct=20.0, soc_ceiling_pct=95.0)
+check("selling into a negative-price QUARTER is refused, and the reason names "
+      "§17 and THAT QUARTER's price",
+      _qneg_sell.action is None and "§17" in _qneg_sell.reason
+      and f"{max(QNEG):+.4f}" in _qneg_sell.reason)
+# ...and the other side, so the refusal is about the sign and nothing else.
+QPOS = list(QNEG)
+QPOS[Q_DEAR_I] = round(-max(QNEG), 6)
+check("...while the SAME quarter-hourly series with that ONE price's SIGN "
+      "FLIPPED discharges instead",
+      decide(qplan_of(QPOS), qprobe(Q_DEAR_I), peak_guard_active=False,
+             soc=50.0, min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+             charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+             soc_ceiling_pct=95.0).action == DISCHARGE
+      and sum(1 for a, b in zip(QNEG, QPOS) if a != b) == 1)
+# §8.3's flag, read off the covering point. `_act`'s own provisional guard
+# stays unreachable here for section 4's reason - the extrema are firm by
+# `_firm_or_die` and starts are unique - and THAT ARGUMENT IS EXACTLY WHAT THE
+# DEFECT BROKE at 900 s, because the point `at()` returned was not the
+# verdict's point at all. It is restated here at the resolution that matters.
+check("the point matched for the buy quarter IS the verdict's own cheapest "
+      "point and is FIRM, so `_act`'s §8.3 guard is unreachable at 900 s for "
+      "the same construction section 4 states at 3600 s",
+      _pa_buy is derived(lambda: _qv.cheapest)
+      and derived(lambda: _pa_buy.provisional) is False
+      and len({p.start for p in QPTS}) == len(QPTS))
+
+print()
+print("10d. the MIXED series FCST-04 actually emits, traded end to end")
+# ⚠️ 70 % OF SOAK SAMPLES, NOT AN EDGE CASE. The carry-forward emits HOURLY
+# carried points beside QUARTER-HOURLY firm ones, so a window derived from one
+# global spacing would be wrong in the NORMAL steady state. Here: 12 carried
+# hourly points for the morning, then firm quarters for the rest of the day.
+MIX_N_H, MIX_N_Q = 12, 48
+MIX_GAPS = [3600] * MIX_N_H + [900] * (MIX_N_Q - 1)
+MIX_PRICES = [QDAY[4 * i] for i in range(MIX_N_H)] + QDAY[4 * MIX_N_H:]
+MIX_FLAGS = [True] * MIX_N_H + [False] * MIX_N_Q
+MIX_PLAN = qplan_of(MIX_PRICES, provisional=MIX_FLAGS, gaps=MIX_GAPS)
+MIX_PTS = MIX_PLAN.read.points
+_mix_gaps = sorted({int((b.start - a.start).total_seconds())
+                    for a, b in zip(MIX_PTS, MIX_PTS[1:])})
+check(f"the mixed plan really is mixed - spacing {_mix_gaps} s, "
+      f"{MIX_N_H} carried and {MIX_N_Q} firm points, so neither half is what "
+      f"the other half's window rule would give",
+      _mix_gaps == [900, 3600]
+      and sum(1 for p in MIX_PTS if p.provisional) == MIX_N_H
+      and sum(1 for p in MIX_PTS if not p.provisional) == MIX_N_Q)
+_mix_cheap_i = MIX_N_H + (MIX_PRICES[MIX_N_H:].index(min(MIX_PRICES[MIX_N_H:])))
+_mix_dear_i = MIX_N_H + (MIX_PRICES[MIX_N_H:].index(max(MIX_PRICES[MIX_N_H:])))
+check(f"...and its firm half's extremes are quarters {_mix_cheap_i} and "
+      f"{_mix_dear_i}, neither on a whole hour, so the identity test below is "
+      f"about the quarter and not about the hour",
+      (_mix_cheap_i - MIX_N_H) % 4 != 0 and (_mix_dear_i - MIX_N_H) % 4 != 0)
+_mv = MIX_PLAN.arbitrage(peak_guard_active=False, min_spread_eur_kwh=_shipped,
+                         uncertainty=NO_WEATHER)
+_mix_buy_t = qprobe(_mix_cheap_i, gaps=MIX_GAPS)
+_mix_sell_t = qprobe(_mix_dear_i, gaps=MIX_GAPS)
+check("the verdict over a MIXED series still names firm quarters, and "
+      "`_point_at()` matches them by identity at their own probes",
+      derived(lambda: _mv.cheapest) is MIX_PTS[_mix_cheap_i]
+      and derived(lambda: _mv.dearest) is MIX_PTS[_mix_dear_i]
+      and derived(lambda: _arb._point_at(MIX_PLAN, _mix_buy_t))
+      is MIX_PTS[_mix_cheap_i]
+      and derived(lambda: _arb._point_at(MIX_PLAN, _mix_sell_t))
+      is MIX_PTS[_mix_dear_i])
+check("...so the mixed day CHARGES and DISCHARGES in its firm quarters, at "
+      "their own prices",
+      decide(MIX_PLAN, _mix_buy_t, peak_guard_active=False, soc=50.0,
+             min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+             charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+             soc_ceiling_pct=95.0).action == CHARGE
+      and decide(MIX_PLAN, _mix_sell_t, peak_guard_active=False, soc=50.0,
+                 min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+                 charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+                 soc_ceiling_pct=95.0).action == DISCHARGE)
+# An instant inside a CARRIED hour of the same series. The covering point is
+# the carried one; the shipped scan answered a point from the FIRM block
+# earlier in the list, which is §8.3's flag read off the wrong point.
+_mix_carried_t = QD0 + timedelta(hours=MIX_N_H - 1, minutes=37)
+check("an instant inside a CARRIED hour of the mixed series matches the "
+      "CARRIED point, whose provisional flag is what §8.3 reads - and the "
+      "strategy does nothing there, because a carried point is not in the "
+      "firm trade set",
+      derived(lambda: _arb._point_at(MIX_PLAN, _mix_carried_t))
+      is MIX_PTS[MIX_N_H - 1]
+      and MIX_PTS[MIX_N_H - 1].provisional is True
+      and decide(MIX_PLAN, _mix_carried_t, peak_guard_active=False, soc=50.0,
+                 min_spread_eur_kwh=_shipped, uncertainty=NO_WEATHER,
+                 charge_w=MAX_W, discharge_w=MAX_W, soc_floor_pct=20.0,
+                 soc_ceiling_pct=95.0).action is None)
+
+print()
+print("10e. the HOURLY day is unchanged, which is the regression half")
+# ⚠️ A REGRESSION GUARD, NOT A WITNESS. On an hourly series the shipped rule
+# and this one agree at every instant, which is precisely why 29 files stayed
+# green through the defect. It is here so that a fix which got 900 s right by
+# breaking 3600 s cannot pass.
+_h_buy = act(PLAN, CHEAP_H, thresh=_shipped, unc=NO_WEATHER)
+_h_sell = act(PLAN, DEAR_H, thresh=_shipped, unc=NO_WEATHER)
+check("the hourly fixture still charges in its cheapest hour and discharges "
+      "in its dearest, at those hours' prices",
+      _h_buy.action == CHARGE and _h_sell.action == DISCHARGE
+      and near(_h_buy.price_now_eur_kwh, DAY[CHEAP_H])
+      and near(_h_sell.price_now_eur_kwh, DAY[DEAR_H]))
+check("...and a probe 59 minutes into an hourly slot still matches that slot, "
+      "so the hourly window did not shrink under the fix",
+      derived(lambda: _arb._point_at(
+          PLAN, D0 + timedelta(hours=CHEAP_H, minutes=59)))
+      is derived(lambda: PLAN.read.points[CHEAP_H]))
+
+
 # --------------------------------------------------------------------------- #
 print()
 if fails:

goodwe_controller/translations/en.yaml

@@ -143,7 +143,7 @@ configuration:
     description: "DERIVED, not picked (SAFETY-24): the reference pack holds 13.8 kWh usable and the worst modelled peak-shaving day asks for 878 Wh, which is 6.4 %, so 20 % sits ten points above the pack's own cut-out and still leaves the guard about 1.6 of its worst observed days of room. ⚠️ IT BOUNDS THE PEAK GUARD ONLY. It is not a reserve for the whole pack: ordinary self-consumption discharges straight past it and goes on down to the battery cut-out, and raising this number does not change that by a tenth of a percent. It must stay strictly above the battery cut-out or the add-on refuses to start. Do not change it without re-deriving it."
   price_provider:
     name: "Tariff · Dynamic price source"
-    description: "Where day-ahead or real-time prices come from. 'off' is what ships, and means this site runs on the static tariff below with no trading. ⚠️ Switching it on today fetches, checks and publishes prices and changes no energy decision - nothing consumes the price series yet. It may not be combined with the two legacy Home Assistant price entities further down: two price sources on one site, one of which silently wins, is refused at startup rather than left looking armed."
+    description: "Where day-ahead or real-time prices come from. 'off' is what ships, and means this site runs on the static tariff below with no trading. ⚠️ SWITCHING THIS ON IS WHAT STARTS THE PRICE FETCH - not the trading switch further down. With a source selected the add-on fetches the feed every half hour, checks it, records the day and shows what it holds on the Price history row, whether or not price trading is armed. On its own it still moves no energy: trading is the separate switch, and the cheap window the monthly maintenance cycle uses comes from the fixed or day/night tariff below. It may not be combined with the two legacy Home Assistant price entities further down: two price sources on one site, one of which silently wins, is refused at startup rather than left looking armed."
   price_markup_eur_kwh:
     name: "Tariff · Supplier markup (EUR/kWh)"
     description: "Your supplier's margin. The add-on adds it ONLY when the chosen price source does not already include it - under engie_dynamic, totalenergies_dynamic, eneco_eddy and manual_csv it is ignored, and logged as ignored, never applied twice."
@@ -176,7 +176,7 @@ configuration:
     description: "The average the current price is compared against. Only meaningful together with the current-price entity above, and like it, may not be combined with a dynamic price source."
   arbitrage_enabled:
     name: "Tariff · Trade on the price spread"
-    description: "Charge in the cheapest published hour and discharge in the dearest, but only when the spread covers what the round trip costs. OFF in the shipped configuration, deliberately: this is the first strategy in the add-on that moves energy against the meter on purpose, so it is armed on purpose or not at all. It needs both a price source and a P1 meter, and the add-on refuses the combinations that cannot work rather than letting them look armed."
+    description: "Charge in the cheapest published hour and discharge in the dearest, but only when the spread covers what the round trip costs. OFF in the shipped configuration, deliberately: this is the first strategy in the add-on that moves energy against the meter on purpose, so it is armed on purpose or not at all. ⚠️ LEAVING IT OFF DOES NOT TURN THE PRICE FEED OFF. A price source selected above is fetched, checked and recorded either way; this switch decides only whether the add-on ACTS on those prices. It needs both a price source and a P1 meter, and the add-on refuses the combinations that cannot work rather than letting them look armed."
   cycle_cost_threshold_eur:
     name: "Tariff · Cost of one full charge/discharge cycle (EUR/kWh)"
     description: "What one full round trip costs per kWh: wear on the pack plus conversion losses. A price spread smaller than this loses money and battery life, so it is not traded. ⚠️ THIS ONE IS NOT DERIVED FROM A MEASUREMENT. 0.10 is a product decision and it is still an open question with the owner (OPT-08). At this value a fixed day/night site does not trade at all - the realistic Belgian day/night spread is about 0.08 EUR/kWh - and that is the correct verdict at this number, not a fault."

goodwe_controller/translations/nl.yaml

@@ -123,7 +123,7 @@ configuration:
     description: "AFGELEID, niet gekozen (SAFETY-24): de referentiebatterij heeft 13,8 kWh bruikbaar en de zwaarste doorgerekende afvlakdag vraagt 878 Wh, oftewel 6,4 %, dus 20 % ligt tien punten boven de uitschakelgrens van de batterij zelf en laat de bewaking nog ongeveer 1,6 van haar zwaarste waargenomen dagen speling. ⚠️ DIT BEGRENST ALLEEN DE PIEKBEWAKING. Het is geen reserve voor de hele batterij: gewoon eigenverbruik ontlaadt er dwars doorheen en gaat door tot aan de uitschakelgrens van de batterij, en dit getal verhogen verandert daar geen tiende procent aan. Het moet strikt boven de uitschakelgrens van de batterij blijven, anders start de add-on niet op. Verander het niet zonder de afleiding opnieuw te maken."
   price_provider:
     name: "Tarief · Bron van dynamische prijzen"
-    description: "Waar day-ahead- of realtimeprijzen vandaan komen. 'off' is de standaardinstelling en betekent dat deze installatie op het vaste tarief hieronder draait, zonder handel. ⚠️ Dit vandaag aanzetten haalt prijzen op, controleert en publiceert ze, en verandert geen enkele energiebeslissing - er is nog niets dat de prijsreeks gebruikt. Het mag niet gecombineerd worden met de twee oude Home Assistant-prijsentiteiten verderop: twee prijsbronnen op één installatie, waarvan er stilzwijgend één wint, wordt bij het opstarten geweigerd in plaats van schijnbaar actief gelaten."
+    description: "Waar day-ahead- of realtimeprijzen vandaan komen. 'off' is de standaardinstelling en betekent dat deze installatie op het vaste tarief hieronder draait, zonder handel. ⚠️ DIT AANZETTEN IS WAT HET OPHALEN VAN PRIJZEN START - niet de handelsschakelaar verderop. Met een bron ingesteld haalt de add-on de feed elk half uur op, controleert die, bewaart de dag en toont op de rij Prijsgeschiedenis wat er bewaard is, of prijshandel nu aan staat of niet. Op zichzelf verplaatst dat nog geen energie: handelen is de aparte schakelaar, en het goedkope venster dat de maandelijkse onderhoudscyclus gebruikt komt uit het vaste of dag/nacht-tarief hieronder. Het mag niet gecombineerd worden met de twee oude Home Assistant-prijsentiteiten verderop: twee prijsbronnen op één installatie, waarvan er stilzwijgend één wint, wordt bij het opstarten geweigerd in plaats van schijnbaar actief gelaten."
   price_markup_eur_kwh:
     name: "Tarief · Marge van de leverancier (EUR/kWh)"
     description: "De marge van uw energieleverancier. De add-on telt die ALLEEN op wanneer de gekozen prijsbron ze niet al bevat - bij engie_dynamic, totalenergies_dynamic, eneco_eddy en manual_csv wordt ze genegeerd, en dat wordt ook gelogd, zodat ze nooit dubbel wordt aangerekend."
@@ -156,7 +156,7 @@ configuration:
     description: "Het gemiddelde waarmee de huidige prijs vergeleken wordt. Alleen zinvol samen met de entiteit hierboven en, net als die, niet te combineren met een dynamische prijsbron."
   arbitrage_enabled:
     name: "Tarief · Handelen op het prijsverschil"
-    description: "Laden in het goedkoopste gepubliceerde uur en ontladen in het duurste, maar alleen wanneer het verschil de kosten van de volledige cyclus dekt. STAAT UIT in de standaardinstelling, met opzet: dit is de eerste strategie in de add-on die bewust energie tegen de meter in verplaatst, dus ze wordt bewust aangezet of helemaal niet. Ze heeft zowel een prijsbron als een P1-meter nodig, en de add-on weigert combinaties die niet kunnen werken in plaats van ze schijnbaar actief te laten."
+    description: "Laden in het goedkoopste gepubliceerde uur en ontladen in het duurste, maar alleen wanneer het verschil de kosten van de volledige cyclus dekt. STAAT UIT in de standaardinstelling, met opzet: dit is de eerste strategie in de add-on die bewust energie tegen de meter in verplaatst, dus ze wordt bewust aangezet of helemaal niet. ⚠️ DIT UIT LATEN STAAN ZET DE PRIJSFEED NIET UIT. Een prijsbron die hierboven gekozen is, wordt hoe dan ook opgehaald, gecontroleerd en bewaard; deze schakelaar bepaalt alleen of de add-on op die prijzen HANDELT. Ze heeft zowel een prijsbron als een P1-meter nodig, en de add-on weigert combinaties die niet kunnen werken in plaats van ze schijnbaar actief te laten."
   cycle_cost_threshold_eur:
     name: "Tarief · Kostprijs van één volledige laad/ontlaadcyclus (EUR/kWh)"
     description: "Wat één volledige cyclus per kWh kost: slijtage van de batterij plus omzettingsverliezen. Een prijsverschil dat hier onder ligt, kost geld en levensduur en wordt dus niet verhandeld. ⚠️ DIT GETAL IS NIET AFGELEID UIT EEN METING. 0,10 is een productbeslissing en staat nog open bij de eigenaar (OPT-08). Bij deze waarde handelt een installatie met een vast dag/nachttarief helemaal niet - het realistische Belgische dag/nachtverschil is ongeveer 0,08 EUR/kWh - en dat is bij dit getal het juiste antwoord, geen fout."