SAFETY-125 round 2: the one-inverter maintenance charge is sized to the room too

Owner 2026-10-29: fix N=1 in this hotfix. _charge_headroom() no longer
returns early at one inverter, so the N=1 cheap-window maintenance charge
is held to charge_room_w() as at N=2; SAFETY-84's site-stop rule stays N>=2
only (at N=1 such a stop outranks the shaping anyway). The guard no longer
steps in and gives power at each quarter's end during that charge.

test_safety125.py: N=1 maintenance on 5 s and 10 s meters with late
readings, with and without a banked peak; the row in an N=2 maintenance
charge and in shadow mode; edge cases (blind past the hold, a start
mid-quarter, the summer-time change, the forecast in W, a 10 s meter, the
last second). test_safety84/87: three N=1 pins move. test_safety119: its
quarter-edge hand-back runs keep the old N=1 sizing as a fixture, plus a
check that with the new sizing nothing hands back. CHANGELOG, DECISIONS,
DOCS follow.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.19.2
+
+**A patch bump: one fix for charging from the grid under the peak limit, and no option changes.**
+No option was added, removed or renamed, and no default changed (86 options).
+**Existing installs need no option change:** options that start 0.19.1 also
+start 0.19.2. The change below applies with one inverter or two.
+
+**Charging from the grid now stays under this month's peak.** A late meter reading near a period's end could push a grid charge to full power. That could take the 15-minute period over the peak. Now the charge is cut back, with one inverter too. The peak guard line no longer says "under" when the period is over.
+
+Contents of this release, in merge order since 0.19.1 (`2932f3a`):
+
+| | |
+|---|---|
+| `SAFETY-125` | A grid charge (a battery mode's cheap run, price trading or the maintenance charge, with one inverter or two) counts the seconds since a late meter reading at that reading, so it is cut back near the end of a 15-minute period instead of going back to full power. With one inverter the maintenance charge is now held to the room left in the period, as with two, so the peak guard no longer steps in and gives power at the period's end. Over the limit at the current rate, the peak guard row and the month peak line say so, and that the grid charge is cut back ([[SAFETY-125]]). |
+
+### Known issues
+
+The list under `## 0.19.0` below still applies. The SAFETY-99 line there now
+covers the guard's discharge only, not a grid charge.
+
+### If you are crossing from a version older than 0.10.0
+
+`## 0.10.0` below can refuse an old config: `slew_w` above its limit, and the
+withdrawn `price_provider` ids `engie_dynamic`, `totalenergies_dynamic` and
+`eneco_eddy`. Read it before you update. Run `tools/predeploy_check.py` with the
+bare options (`jq '.data.options'`) first.
+
 ## 0.19.1
 
 **A patch bump: two fixes for battery modes, and no option changes.**

goodwe_controller/DECISIONS/SAFETY-125-grid-charge-under-the-month-peak.md

@@ -0,0 +1,10 @@
+# SAFETY-125 - a grid charge under the month peak
+
+**Status: FIXED in 0.19.2 (hotfix from 0.19.1).** Tests: `test_safety125.py`.
+
+A grid charge is sized by `peakguard.charge_room_w()`, the guard's headroom
+with the seconds since a late meter reading counted at that reading (the
+projection leaves them out, SAFETY-99, the bill does not), and the guard's own
+floor is unchanged. At N=1 the maintenance charge is now sized too (owner
+2026-10-29; SAFETY-84 had left it out). Evidence (repro on 0.19.1, sweep,
+digests): the SAFETY-125 pull request.

goodwe_controller/DECISIONS/SAFETY-84-charge-at-two.md

@@ -39,7 +39,8 @@ was fine.
 **Not changed.**
 - At N=1 the charge is not sized to the headroom: the guard still suspends it
   and the battery gives until the quarter is safe. The same sizing would fit
-  there; that is an owner question, not this fix.
+  there; that is an owner question, not this fix. (SAFETY-125, 0.19.2: the
+  owner said yes, and N=1 is sized the same way.)
 - Outside a cheap window (`hi = 0`, solar only) nothing is filed, at any N.
 - A HOLD (later fixed by [[SAFETY-86]]) and the "Battery is not keeping up"
   alarm (SAFETY-85) are untouched. In the identity runs that alarm's log line

goodwe_controller/DOCS.md

@@ -1708,7 +1708,9 @@ DECISIONS/MAINT-13-full-pack-is-complete.md.
 On a capacity-tariff site the maintenance charge is capped by the headroom left
 under `peak_cap_w`, and if the forecast goes over the cap the charge-only clamp
 is dropped so the battery can shave the peak instead. Money outranks the
-maintenance schedule.
+maintenance schedule. With one battery or several, the charge also stays
+within the room left in the 15-minute period, so a late meter reading does
+not let it run at full power.
 
 With two or more batteries, the one being emptied gives its drain rate and the
 others only add power when the house needs more; none charges while it drains
@@ -3597,7 +3599,7 @@ for a new install*.
 | Meter reading may be stuck | See *Meter reading may be stuck* under Notifications. |
 | Month peak | This month's highest 15-minute average, when it happened, and how close it is to your peak limit. Amber from 80 %. |
 | 15-minute periods measured this month | How many 15-minute periods the add-on has measured and saved this month. |
-| Peak guard, Load too high for battery, Battery at its peak reserve | What the add-on does to keep your peak down. *Idle, heading for …* is where this 15-minute period is heading. *Waiting for meter readings* after a restart means the battery does not charge until the add-on can measure the period again. A red peak row is an alarm while control keeps running, so the banner shows its title without *Not ready*. |
+| Peak guard, Load too high for battery, Battery at its peak reserve | What the add-on does to keep your peak down. *Idle, heading for …* is where this 15-minute period is heading. *At this rate … over …* means it would go over at the current rate. With *grid charge limited*, a charge from the grid is cut back so it does not. *Waiting for meter readings* after a restart means the battery does not charge until the add-on can measure the period again. A red peak row is an alarm while control keeps running, so the banner shows its title without *Not ready*. |
 | Battery level, Battery power, Grid power | The reading of that entity. *No usable reading* means the entity is missing, or its reading is too old. Check it in Developer Tools before replacing it. |
 | Inverter control | Whether the inverter can be controlled, and how much it can charge and give. |
 | *name*: battery power reading stopped changing | The reading did not change while the add-on asked for a change. It may be stuck, or the battery may be refusing. The add-on sets the inverters to 0 W until it changes. |

goodwe_controller/app/homeview.py

@@ -963,7 +963,8 @@ def month_peak(c, now):
         ceiling = pg.ceiling_w or limit_w
     out["line"] = line_period(out["period_w"], ceiling, c.shadow,
                               unmeasured=getattr(c, "peak_unmeasured_s", 0.0)
-                              > 0.0)
+                              > 0.0,
+                              cut=getattr(c, "room_charge", False))
     return out
 
 
@@ -1367,13 +1368,19 @@ def line_peak_not_covered() -> str:
     return _t("peak_not_covered")
 
 
-def line_period(period_w, limit_w, shadow, unmeasured=False) -> str:
+def line_period(period_w, limit_w, shadow, unmeasured=False,
+                cut=False) -> str:
     step = _w(shadow, "step_in", kw=_kw(limit_w))
     if unmeasured:
         # SAFETY-90: the add-on started during this period.
         return _t("period_unmeasured") + " " + step
     if period_w is None:
         return step
+    if period_w > limit_w:
+        # SAFETY-125: the figure is the current rate, and a grid charge is
+        # what gets cut back.
+        return _t("period_over", kw=_kw(period_w)) + " " + (
+            _w(shadow, "charge_cut", kw=_kw(limit_w)) if cut else step)
     return _t("period", kw=_kw(period_w)) + " " + step
 
 
@@ -1446,6 +1453,8 @@ def _samples() -> list:
                 ("plan", line_period(1240, 3500, sh)),
                 ("plan", line_period(None, 3500, sh)),
                 ("plan", line_period(1240, 3500, sh, unmeasured=True)),
+                ("plan", line_period(5814, 5413, sh)),
+                ("plan", line_period(5814, 5413, sh, cut=True)),
                 ("plan", control_text(True, sh)),
                 ("plan", control_text(False, sh))]
     out += [("plan", run_grid_why(0.1412)), ("plan", run_grid_amount(1.23)),

goodwe_controller/app/main.py

@@ -1217,6 +1217,8 @@ class Controller:
         # because `self.peak_guard` is a different cycle's decision by the time
         # the status page renders.
         self.arb_headroom_w = None
+        # SAFETY-125: a grid charge sized to the quarter's room this cycle.
+        self.room_charge = False
         # UX-13 P1: today's prices as the Home chart has seen them. Display
         # only; nothing reads it back into a decision.
         self.home_prices = homeview.DayPrices()
@@ -3230,17 +3232,19 @@ class Controller:
         return floor
 
     def _charge_headroom(self, floor: float, claims) -> float:
-        """SAFETY-84: at N>=2 a cheap-window charge pulls no more than the
-        quarter's headroom under the peak aim (`charge_headroom_w()`), so it
-        yields just enough to the peak guard, and nothing under a site stop
-        (its 0 W would need the other pack to give). N=1 is unchanged."""
-        if len(self.inverters) < 2:
-            return floor
-        if any(c.kind == SET and c.actuator == ACTUATOR_SITE
-               and c.priority > P_MAINT_SHAPE for c in claims):
+        """SAFETY-84: a cheap-window charge pulls no more than the quarter's
+        room under the peak aim (`charge_room_w()`), so it yields just enough
+        to the peak guard; at N>=2 nothing under a site stop (its 0 W would
+        need the other pack to give). SAFETY-125: at N=1 too, owner
+        2026-10-29; the stop rule stays N>=2 only."""
+        if len(self.inverters) > 1 and any(
+                c.kind == SET and c.actuator == ACTUATOR_SITE
+                and c.priority > P_MAINT_SHAPE for c in claims):
             return 0.0
-        room = peakguard.charge_headroom_w(self.peak_guard)
-        return floor if room is None else min(floor, room)
+        room = peakguard.charge_room_w(self.peak_guard, self._peak_proj)
+        floor = floor if room is None else min(floor, room)
+        self.room_charge = self.room_charge or floor > 0.0
+        return floor
 
     def _charge_ceiling(self, claims):
         """SAFETY-84: the site `hi` for a cheap-window charge at N>=2, or None.
@@ -4885,6 +4889,7 @@ class Controller:
         # decision presented as current.
         self.arb, self.arb_at = None, now
         self.arb_headroom_w = None
+        self.room_charge = False
         # OPT-11 P3: with battery modes on, each battery's mode decides who
         # trades (`_mode_roles()`, `_mode_trade()`, below, which read the
         # same headroom), and this site-wide trade is not run.
@@ -4895,7 +4900,9 @@ class Controller:
             # `arbitrage.sized_from_meter()` in `_shadow_settle()`, so the
             # caveat on the recorded watts can never be answered from a
             # different cycle's guard than the watts were.
-            self.arb_headroom_w = peakguard.charge_headroom_w(self.peak_guard)
+            # SAFETY-125: a late meter reading's seconds count, as the bill.
+            self.arb_headroom_w = peakguard.charge_room_w(self.peak_guard,
+                                                          self._peak_proj)
         if site_trade:
             floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
             charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
@@ -4950,6 +4957,7 @@ class Controller:
             arb_claim = arbitrage.claim(self.arb)
             if arb_claim is not None:
                 claims.append(arb_claim)
+            self.room_charge = self.arb.action == arbitrage.CHARGE
             # Edge-logged, for the peak guard's reason: the action log holds 40
             # lines and a trade lasts a whole hour, so a line per cycle would
             # flush the context that explains it. The transition is what an
@@ -5169,6 +5177,8 @@ class Controller:
         mode_trade, trade_was = False, self._mode_trade_was
         if self.modes_on:
             mode_trade = self._mode_trade(claims, now)
+            self.room_charge = self.room_charge or (
+                mode_trade and self.arb.action == arbitrage.CHARGE)
         self._mode_trade_was = mode_trade
         self._charge_track(claims, maint_results)
         _live96 = set(self.live_units())
@@ -7062,6 +7072,15 @@ class Controller:
                             "text": messages.row_peak_guard_on(
                                 _pg.floor_w or 0.0, _pg.ceiling_w,
                                 shadow=self.shadow)})
+            elif _pg.projected_w is not None:
+                # SAFETY-125: "under" only when it is; over the limit at this
+                # rate, a grid charge is cut back to the quarter's room.
+                out.append({"ok": True, "warn": False, "id": "peak_guard",
+                            "text": messages.row_peak_guard_idle(
+                                _pg.projected_w, _pg.ceiling_w,
+                                month_peak=(_pg.ceiling_from
+                                            == peakguard.CEILING_MONTH_PEAK),
+                                cut=self.room_charge and not self.shadow)})
             else:
                 out.append({"ok": True, "warn": False, "id": "peak_guard",
                             "text": _pg.explain()})

goodwe_controller/app/messages.py

@@ -1170,8 +1170,18 @@ def row_periods_measured(n) -> str:
               f"Gemeten kwartieren deze maand: {getoond}")
 
 
-def row_peak_guard_idle(projected_w, limit_w, month_peak: bool) -> str:
-    """The projection first and the limit second (SAFETY-38's ordered pair)."""
+def row_peak_guard_idle(projected_w, limit_w, month_peak: bool,
+                        cut: bool = False) -> str:
+    """The projection first and the limit second (SAFETY-38's ordered pair).
+    SAFETY-125: over the limit at this rate it says so, and `cut` that a
+    grid charge is limited to the room left."""
+    if float(projected_w) > float(limit_w):
+        doing, doet = (("grid charge limited", "laden beperkt") if cut
+                       else ("idle", "in rust"))
+        return Bi(f"Peak guard: {doing}, at this rate {watts(projected_w)}, "
+                  f"over {watts(limit_w)}",
+                  f"Piekbewaking: {doet}, aan dit tempo "
+                  f"{watts(projected_w)}, boven {watts(limit_w)}")
     limit = (f"this month's {watts(limit_w)} peak" if month_peak
              else f"the {watts(limit_w)} peak limit")
     grens = (f"de maandpiek van {watts(limit_w)}" if month_peak
@@ -1563,6 +1573,11 @@ def status_samples() -> list:
         ("row_periods_measured", GREEN, row_periods_measured("unreadable")),
         ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, True)),
         ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, False)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(5814, 5413, True)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(5814, 5413, True,
+                                                           cut=True)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(3814, 3500, False,
+                                                           cut=True)),
         ("row_peak_guard_quiet", GREEN, row_peak_guard_quiet()),
         ("row_peak_guard_unmeasured", AMBER, row_peak_guard_unmeasured()),
         *(("row_peak_guard_blind", AMBER, row_peak_guard_blind(k))

goodwe_controller/app/peakguard.py

@@ -1136,6 +1136,21 @@ def charge_headroom_w(decision) -> float | None:
     return max(0.0, -float(decision.wanted_w))
 
 
+def charge_room_w(decision, projection) -> float | None:
+    """SAFETY-125: `charge_headroom_w()` with the seconds since the last
+    meter reading counted at that reading, so a late reading near a
+    quarter's end is not read as room for a grid charge (SAFETY-99).
+    DECISIONS/SAFETY-125-grid-charge-under-the-month-peak.md."""
+    room = charge_headroom_w(decision)
+    if not room or projection is None or projection.block_start is None:
+        return room
+    left = QUARTER_S - float(projection.elapsed_s)
+    if left <= 0.0:
+        return room
+    late_ws = max(0.0, float(projection.held_w)) * uncovered_s(projection)
+    return max(0.0, room - late_ws / left)
+
+
 def shaping_suspended(decision, peak_forecast_w, cap_w) -> bool:
     """Must the maintenance charge-only shaping stand down this cycle?
 

goodwe_controller/app/ui_text/en.json

@@ -416,6 +416,9 @@
     "step_in_would": "The batteries would step in above {kw}.",
     "period": "This 15-minute period is heading for {kw}.",
     "period_unmeasured": "Part of this 15-minute period was not measured.",
+    "period_over": "At this rate this 15-minute period reaches {kw}.",
+    "charge_cut": "The grid charge is cut back to stay under {kw}.",
+    "charge_cut_would": "The grid charge would be cut back to stay under {kw}.",
     "prices": {
       "now": "Price now {eur} per kWh, all in.",
       "today": "Today: lowest {lo} at {lo_at}, highest {hi} at {hi_at}.",

goodwe_controller/app/ui_text/nl.json

@@ -351,6 +351,9 @@
     "step_in_would": "De batterijen zouden bijspringen boven {kw}.",
     "period": "Dit kwartier gaat richting {kw}.",
     "period_unmeasured": "Een deel van dit kwartier is niet gemeten.",
+    "period_over": "Aan dit tempo komt dit kwartier op {kw}.",
+    "charge_cut": "Laadt minder van het net om onder {kw} te blijven.",
+    "charge_cut_would": "Zou minder van het net laden om onder {kw} te blijven.",
     "prices": {"now": "Prijs nu {eur} per kWh, alles inbegrepen.", "today": "Vandaag: laagste {lo} om {lo_at}, hoogste {hi} om {hi_at}.", "none": "Geen prijzen voor vandaag."},
     "tomorrow": {"known": "De prijzen van morgen zijn binnen.", "unknown": "De prijzen van morgen komen meestal na 13:00."},
     "region": {"preset": "Heffingen en btw: {region}, cijfers van {year}.", "own": "Heffingen en btw: uw eigen bedrag."},

goodwe_controller/config.yaml

@@ -1,5 +1,5 @@
 name: GoodWe RS485 Controller
-version: "0.19.1"
+version: "0.19.2"
 slug: goodwe_controller
 description: >-
   Drives a GoodWe ES/BP battery inverter over its RS485 EMS port by sending it a

goodwe_controller/test_arbitrage.py

@@ -936,6 +936,8 @@ def _s45_assigned(name, clear=("None",)):
 
 
 _s45_head_src = _s45_assigned("arb_headroom_w")
+# SAFETY-125: the guard's headroom with a late reading's seconds counted.
+S125_ROOM = "peakguard.charge_room_w(self.peak_guard, self._peak_proj)"
 print(f"    main.py has {len(_s45_calls)} `arbitrage.decide(` call site(s); "
       f"charge_headroom_w= is {_s45_arg}, and self.arb_headroom_w is assigned "
       f"from {_s45_head_src}")
@@ -944,7 +946,7 @@ check("main.py passes the guard's OWN measured headroom at its one "
       "transcription of it, so a mutation back to a literal or to max_w is red "
       "rather than silent",
       _s45_arg == ["self.arb_headroom_w"]
-      and _s45_head_src == ["peakguard.charge_headroom_w(self.peak_guard)"])
+      and _s45_head_src == [S125_ROOM])
 # ⚠️ AND THE HOIST DID NOT MOVE IT OUT OF THE CYCLE. An `arb_headroom_w` set
 # once in `__init__` and never refreshed would satisfy the pin above and would
 # size every trade from the guard decision of whatever cycle happened to run
@@ -960,8 +962,7 @@ check("...and the assignment is INSIDE the same `cycle()` that makes the call, "
       "and not one carried from an arbitrary earlier one",
       any(isinstance(n, ast.Assign)
           and [ast.unparse(t) for t in n.targets] == ["self.arb_headroom_w"]
-          and ast.unparse(n.value)
-          == "peakguard.charge_headroom_w(self.peak_guard)"
+          and ast.unparse(n.value) == S125_ROOM
           for n in ast.walk(_s45_cycle)))
 
 

goodwe_controller/test_opt20.py

@@ -243,12 +243,16 @@ check("no opposite-direction split on any of these cycles",
 # ============================================================================ #
 print("\n4. battery modes on, no probe: byte-identical to release/1.0 bf9019e")
 # Printed by tools/opt20_scen.py on release/1.0 bf9019e (2026-10-15),
-# goodwe-addon-checks:1.
+# goodwe-addon-checks:1. SAFETY-125 (0.19.2) moved the two runs that charge
+# against the peak aim: the rig's P1 sample is 0.35 s old, and a grid charge
+# now counts those seconds, so ch_ch's quarters land on 3450.0 W where they
+# landed 1.3-1.4 W over it (bf9019e: 15fc25dd...), and ch_ch_maint's first,
+# partial quarter charges a little less at its end (bf9019e: e46e3c66...).
 AT_BASE = {
     "sf_ch": "422d6578a7decf1ae3749edd1898ff3cd0541d904c95f636cdd9b1de8c1a07c9",
-    "ch_ch": "15fc25dd34186e56d34b752d37c9e8613295ba737938c92454acca08c83080fb",
+    "ch_ch": "2b5879ec95810c39a5f0f82c04b9f8e358ea03ddce4ba187cc2b7e0885dfcbfa",
     "ch_ch_maint":
-        "e46e3c666dd63ab33b56e83c0a560c07cec7774a9a70560f55c62a6ae6f55920",
+        "e56eddabdb785f81793e7afa525f8e6da237b0b2165860aa8e0f8a6499b275a9",
 }
 _got = sc.no_probe_digests()
 for _k in AT_BASE:
@@ -256,7 +260,8 @@ for _k in AT_BASE:
           f"{_got[_k][:16]}")
 check("with no refusal every share, grid, trade sentence, role and plant "
       "power of a scripted cheap run equals bf9019e's (A Solar first, A "
-      "charging, A in maintenance charge)", _got == AT_BASE)
+      "charging, A in maintenance charge; the last two as SAFETY-125 moved "
+      "them)", _got == AT_BASE)
 
 print()
 if fails:

goodwe_controller/test_price_run_fixes.py

@@ -609,6 +609,10 @@ print("\n5. modes off: byte-identical to release/1.0 e3e4ba6")
 #   AT_BASE      the same rows through `ident.trade_digest()`, equal to what
 #                e3e4ba6 gives through it;
 #   AT_NOW       this tree's own digests with nothing hidden.
+# SAFETY-125 (0.19.2) moved the two lag pins: their P1 sample is 0.35 s old on
+# every cycle, and a grid charge now counts those seconds at the held reading,
+# so 16 of 1080 cycles charge about 1.7 W less (before: n1_lag f6c67b35...
+# masked, 78aac892... full; n2_lag as n2). n1 and n2 still equal e3e4ba6.
 AT_BASE_OLD = {
     "n1": "71245b227ca40bada4f71f57ea6154475f4b0bd60239c9ad4f80bffb0094514c",
     "n2": "56cf28010b06765c29e5479abb815d7503d570b39240d82dfc818efa90c93722",
@@ -618,14 +622,14 @@ AT_BASE_OLD = {
 AT_BASE = {
     "n1": "33886ef03f364852883f0370230e6e04823fbb46a4704f88ca75bf9082d98c01",
     "n2": "666a31f41491c22750720524853d95944d5fba395d1d14040c460d71414b275f",
-    "n1_lag": "f6c67b351bd732fb69e62cafbfdb2bcff6032f5d8845836659d096b8c677d3c0",
-    "n2_lag": "666a31f41491c22750720524853d95944d5fba395d1d14040c460d71414b275f",
+    "n1_lag": "28e3182ae73c52dae0e65b2495bc04b2b71003889bf9de1a394b047d2c0e0edf",
+    "n2_lag": "45bfb095b5707a91316f56afc408dba616afc729ce4c83a10b337f36948fa3f2",
 }
 AT_NOW = {
     "n1": "939b3d47bbd64fa50e3d70538f092fb98e5c4bd5ead85a7fc696a1dbb514039e",
     "n2": "c51008213dd739e1e5142c236d9a950aa585992393e4af120086f1ba52ff3e0d",
-    "n1_lag": "78aac892975be81a7ceac0c000ed441a731bd4f42ff9f729996cbee53d6b7f02",
-    "n2_lag": "c51008213dd739e1e5142c236d9a950aa585992393e4af120086f1ba52ff3e0d",
+    "n1_lag": "1827918d570bfa0cc371c35dbbb64378b4937557061e7e1a396aba7663e68117",
+    "n2_lag": "6acc1d1b5a11f3481c7a30d384612f37b59f8e5e9cf89204edd07d09a5b90d8d",
 }
 _cmd_digest = ident.trade_digest
 _rows5 = {k: ident.run(**ident.SCENARIOS[k])[0] for k in AT_BASE}
@@ -636,7 +640,8 @@ for _k in AT_BASE:
           f"{_got[_k][:16]}")
 check("with battery modes off every command, integrator, allocation and "
       "trade action equals e3e4ba6's (the sentence masked as above), also when "
-      "every quarter boundary's cycle still sees the old P1 block",
+      "every quarter boundary's cycle still sees the old P1 block (there, as "
+      "SAFETY-125 moved it)",
       _got == AT_BASE)
 check("...the mask is needed and nothing more: unmasked, the digests differ "
       "from e3e4ba6's printed ones, and equal this tree's own pins, so a "

goodwe_controller/test_safety119.py

@@ -19,7 +19,9 @@ DECISIONS/SAFETY-121-bound-every-quarter.md.
 1. The rig's shape (1 s meter that lags the battery, 1 s battery lag, house
    800 W, rating 2500 W, limit 2500 W, margin 50, charge 2000 W, no
    forecast), 2 h, three seeds: no notification, the cap held, every command
-   the same as without the fix; without the fix it warns.
+   the same as without the fix; without the fix it warns. SAFETY-125 sized
+   the N=1 charge to the room, which removed this hand-back; these runs keep
+   the old sizing, and one run checks that with it nothing hands back.
 2. A genuine integrator bound still warns: the loop in charge with the house
    over the rating (at once, as before), and the loop at its rail after a
    hand-back (after the settle).
@@ -140,10 +142,29 @@ def house(seed, base=800.0, step=None):
     return load
 
 
+_SIZED_CH = Controller._charge_headroom
+
+
+def _n1_unsized(self, floor, claims):
+    """The N=1 cheap-window charge as before SAFETY-125: not sized to the
+    quarter's room, so the guard steps in at each quarter's end and hands
+    back - the shape this file grades the settle on."""
+    return floor if len(self.inverters) < 2 \
+        else _SIZED_CH(self, floor, claims)
+
+
 def run(load, *, n=1, dur=7200.0, delay=1, extra=None, cheap=True, cut=None,
-        charging=True, blind=0.0):
+        charging=True, blind=0.0, sized=False):
     """One run of `n` inverters of 2500 W; `charging=False`: no maintenance,
-    the loop in charge; `blind`: no meter reading until that second."""
+    the loop in charge; `blind`: no meter reading until that second.
+    SAFETY-125 sizes the N=1 charge to the room, so it no longer hands back
+    at a quarter's end; an N=1 charge here keeps the old sizing unless
+    `sized`, so the hand-back this file is about still happens."""
+    if n == 1 and charging and not sized:
+        return patched(Controller, "_charge_headroom", _n1_unsized)(
+            lambda: run(load, n=n, dur=dur, delay=delay, extra=extra,
+                        cheap=cheap, cut=cut, charging=charging,
+                        blind=blind, sized=True))
     extra = dict(extra or {})
     s84.OPT = dict(OPT0, peak_cap_w=int(CAP * n), peak_margin_w=50,
                    maintenance_charge_w=2000)
@@ -231,6 +252,15 @@ check("non-vacuous: without the fix every run warns, at a quarter's edge",
       all(len(notes(c)) >= 1 for _r, c in OLD.values())
       and all(min(t % QUARTER, QUARTER - t % QUARTER) <= 40
               for _r, c in OLD.values() for t in notes(c)))
+_sz = run(house(1), sized=True)
+print(f"    SAFETY-125's sizing, seed 1: guard step-ins "
+      f"{guard_steps(_sz[1])}, notifications {notes(_sz[1])}, highest "
+      f"quarter {max(quarters(_sz[1]), default=0.0):.0f} W")
+check("SAFETY-125: with the N=1 charge sized to the room the guard does not "
+      "step in at the quarter's end, nothing warns and the cap holds",
+      not any(r[-1][1] and r[-1][1][0] for r in _sz[0])
+      and notes(_sz[1]) == [] and any(r[1] < -1000.0 for r in _sz[0])
+      and len(quarters(_sz[1])) == 8 and max(quarters(_sz[1])) < CAP)
 
 # ============================================================================ #
 print("\n2. a genuine integrator bound still warns")

goodwe_controller/test_safety125.py

@@ -0,0 +1,565 @@
+"""Runnable check for SAFETY-125.  `python3 test_safety125.py`
+
+A meter reading that is late near a quarter's end left seconds the
+projection did not count (SAFETY-99), and `charge_headroom_w()` read them as
+room: a grid charge went back to full power in the quarter's last seconds and
+the billed quarter went over the aim, above a banked month peak or the cap.
+And the peak guard's row said "under" while the period was over the limit at
+the current rate. DECISIONS/SAFETY-125-grid-charge-under-the-month-peak.md.
+
+Drives the REAL Controller (read_inputs + cycle, the tariff task on a
+day/night profile, a P1 meter on a simulated clock) in the live shape: modes
+on, inverter-a Cheap hours at 5000 W charging harder than asked (as it did
+live), inverter-b Solar first, a house of 1 kW, cap 3500 W, margin 50 W.
+
+1. `charge_room_w()` on its own.
+2. A reading 30 s late at each quarter's end: every quarter at or under the
+   aim, with a month peak banked above the cap and with none, with the P1
+   projection and with a `peak_forecast_entity`; the charge is cut late in
+   the quarter and back in the next one.
+3. The same for a price trade with modes off, and a maintenance charge at N=2.
+4. A healthy meter: the quarters as before, and the row and the month-peak
+   line say what is true.
+5. The words on their own.
+6. One inverter: the maintenance charge is sized to the room too (owner
+   2026-10-29), on a 5 s and a 10 s meter, with and without a banked peak
+   and with late readings; the guard no longer steps in during it.
+7. The row during an N=2 maintenance charge and in shadow mode.
+8. Edge cases: a reading past its 30 s hold (blind), a start mid-quarter,
+   the summer-time change, the forecast entity in W, a 10 s meter, the
+   quarter's last second.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import asyncio
+import logging
+import os
+import sys
+import tempfile
+import types
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import opt11p3_replay as rp                                    # noqa: E402
+import safety84_identity as s84                                # noqa: E402
+import app.main as m                                           # noqa: E402
+import app.p1 as p1mod                                         # noqa: E402
+from named_absence import first, nth, present                  # noqa: E402
+from app import homeview, messages, peakguard, tariff          # noqa: E402
+from app import price as _price, static_tariff as _st          # noqa: E402
+from app.main import Controller                                # noqa: E402
+from app.p1 import make_sample, split_signed                   # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+from app.tariff import QUARTER_S, Projection                   # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+PEAK = 5413.17          # October's banked peak on the live site
+AIM_PEAK = PEAK - 50.0
+AIM_CAP = 3500.0 - 50.0
+TOL = 10.0              # W over the aim a quarter may land (SAFETY-81)
+FC = "sensor.piek_prognose_kwartier"
+L = timezone(timedelta(hours=1))
+START = datetime(2026, 10, 29, 0, 0, tzinfo=L).astimezone(timezone.utc)
+PROFILE = ('{"periods": ['
+           '{"name": "night", "days": "all", "from": "22:00", "to": "07:00",'
+           ' "eur_per_kwh": 0.2333},'
+           '{"name": "day", "days": "all", "from": "07:00", "to": "22:00",'
+           ' "eur_per_kwh": 0.2801}]}')
+
+
+def opts(*, fc=False, modes=True, arb=False):
+    o = dict(rp.options(modes, arb, 2))
+    o.update(cycle_cost_threshold_eur=0.03, static_profile=PROFILE,
+             peak_cap_w=3500, peak_margin_w=50)
+    o["inverters"][0].update(max_w=5000, capacity_kwh=15.36)
+    o["inverters"][1].update(max_w=4600, capacity_kwh=20.48)
+    if fc:
+        o["peak_forecast_entity"] = FC
+    return o
+
+
+class Harder(rp.Plant):
+    """Charges harder than asked, as inverter-a did live (asked -4271 W,
+    measured about -4750 W; asked -5000 W, about -5210 W)."""
+
+    def step(self, dt, floor):
+        c = self.cmd
+        if c < 0:
+            self.cmd = max(c * 1.11, -5216.0)
+        try:
+            super().step(dt, floor)
+        finally:
+            self.cmd = c
+
+
+async def _no_fetch(*a, **k):
+    raise AssertionError("the tariff task reached for a price feed")
+
+
+class OnItsOwn(rp.Plant):
+    """Charges 5000 W whatever it is asked (shadow mode: nothing is
+    written, the inverter charges on its own)."""
+
+    def step(self, dt, floor):
+        self.cmd = -5000.0
+        super().step(dt, floor)
+
+
+def drive(o, *, peak=None, late=0.0, minutes=31, every=0, start=None,
+          period=0.0, fc_unit="kW", plant=Harder):
+    """The real Controller from `start` (00:00 local) for `minutes` at a 1 s
+    cycle (OPT-15's lag). `late`: no P1 telegram in each quarter's last
+    `late` s; `period`: one telegram every `period` s (0: every cycle).
+    -> (controller, rows, {quarter start: true grid average}, samples), the
+    samples taken every `every` cycles from the second quarter (the first
+    starts before the first reading): (projection, ceiling, engaged,
+    peak_guard row, month-peak line)."""
+    store = rp._Store()
+    for u, mode in (("a", "cheap_hours"), ("b", "solar_first")):
+        store.data[unit_key(f"inverter-{u}", "pack_use")] = True
+        store.data[unit_key(f"inverter-{u}", "pack_mode")] = mode
+        store.data[unit_key(f"inverter-{u}", "pack_sell")] = False
+    rows, samples, sums = [], [], {}
+    t0 = start or START
+
+    async def go():
+        lag = rp.Lag()
+        hass = rp.Hass(("a", "b"), lambda t: 1000.0, {"a": 11.0, "b": 10.0},
+                       limits={"a": (-5000.0, 5000.0),
+                               "b": (-4600.0, 4600.0)}, lag=lag)
+        hass.plants["a"].__class__ = plant
+        fc_kw = [0.0]
+
+        async def state(e):
+            # The HA quarter projection, in kW like the live template.
+            return None if e != FC else {
+                "state": (f"{fc_kw[0]:.3f}" if fc_unit == "kW"
+                          else f"{fc_kw[0] * 1000.0:.0f}"),
+                "attributes": {"unit_of_measurement": fc_unit}}
+        hass.state = state
+        tmp = tempfile.mkdtemp(prefix="s125-")
+        db = os.path.join(tmp, "tariff.db")
+        if peak is not None:
+            tariff.PeakStore(db)._db.execute(
+                "INSERT INTO monthly_peak VALUES (?, ?, ?, NULL)",
+                (tariff.month_key(t0), peak,
+                 "2026-10-21T20:15:00+00:00")).connection.commit()
+        c = Controller(dict(o), hass, store, rp._Pub(), stop=asyncio.Event(),
+                       peak_db_path=db,
+                       price_history_path=os.path.join(tmp, "ph.json"))
+        c.inverters[0].dev_min, c.inverters[0].dev_max = -5000.0, 5000.0
+        c.inverters[1].dev_min, c.inverters[1].dev_max = -4600.0, 4600.0
+        c.auto = True
+        real = m.datetime, homeview.datetime, p1mod.time
+        clock, simt = [t0], [0.0]
+
+        class _DT(real[0]):
+            @classmethod
+            def now(cls, tz=None):
+                return clock[0] if tz is None else clock[0].astimezone(tz)
+        m.datetime = homeview.datetime = _DT
+        p1mod.time = types.SimpleNamespace(monotonic=lambda: 1e6 + simt[0])
+        real_load = _price.load_prices, _st.load_prices
+        _price.load_prices = _st.load_prices = _no_fetch
+        task = asyncio.create_task(c.run_tariff_refresh())
+        try:
+            hass.advance(0.0, 10.0)
+            t, n = 0.0, 0
+            while t < minutes * 60:
+                now = t0 + timedelta(seconds=t)
+                hass.t, simt[0], clock[0] = t, t, now
+                if t == 0.0:
+                    for _ in range(500):
+                        if c.tariff_plan is not None:
+                            break
+                        await asyncio.sleep(0)
+                q = int(now.timestamp() // QUARTER_S)
+                acc = sums.setdefault(q, [0.0, 0])
+                g_now = hass.grid()
+                fc_kw[0] = (acc[0] + g_now * (QUARTER_S - acc[1])) \
+                    / QUARTER_S / 1000.0
+                if now.timestamp() % QUARTER_S < QUARTER_S - late \
+                        and t >= lag.p1_s \
+                        and (not period or t % period < 1e-9):
+                    imp, exp = split_signed(hass._past(lag.meter_s
+                                                       + lag.p1_s)[0])
+                    c.p1.submit(make_sample(
+                        "ha_signed", imp, exp, phases=1,
+                        ingest_ts=now - timedelta(seconds=lag.p1_s),
+                        ingest_mono=1e6 + t))
+                await c.read_inputs(now_mono=t)
+                await c.cycle()
+                hass.advance(lag.tick, 10.0)
+                acc[0] += max(0.0, hass.grid())
+                acc[1] += 1
+                rows.append((now, c.target, hass.plants["a"].p,
+                             getattr(c.arb, "action", None)))
+                pg = c.peak_guard
+                if every and n % every == 0 and t >= QUARTER_S \
+                        and pg is not None and pg.projected_w is not None:
+                    row = first((r["text"] for r in c.checks(now)
+                                 if r["id"] == "peak_guard"), "guard row")
+                    samples.append((pg.projected_w, pg.ceiling_w, pg.engaged,
+                                    row, homeview.month_peak(c, now)["line"]))
+                t += lag.tick
+                n += 1
+        finally:
+            task.cancel()
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
+            m.datetime, homeview.datetime, p1mod.time = real
+            _price.load_prices, _st.load_prices = real_load
+        return c
+    c = asyncio.run(go())
+    full = {datetime.fromtimestamp(q * QUARTER_S, L).strftime("%H:%M"):
+            s / k for q, (s, k) in sorted(sums.items()) if k >= QUARTER_S}
+    return c, rows, full, samples
+
+
+def into(now):
+    return now.timestamp() % QUARTER_S
+
+
+# ============================================================================ #
+print("1. charge_room_w(): a late reading's seconds count at that reading")
+_dec = peakguard.decide(
+    Projection(5800.0, 5800.0, 450.0, 1.0, True, START, 5800.0),
+    batt_w=-4800.0, cap_w=3500, margin_w=50,
+    reading=types.SimpleNamespace(is_observed=True, peak_w=PEAK),
+    achievable_w=9600.0, soc=50.0, soc_floor=20.0)
+_room = peakguard.charge_headroom_w(_dec)
+_late = Projection(5800.0, 5800.0, 450.0, 430.0 / 450.0, False, START,
+                   5800.0)
+print(f"    headroom {_room:.0f} W; 20 s late, 450 s left: "
+      f"{peakguard.charge_room_w(_dec, _late):.0f} W")
+check("with every second counted it is charge_headroom_w() exactly",
+      peakguard.charge_room_w(
+          _dec, Projection(5800.0, 5800.0, 450.0, 1.0, True, START, 5800.0))
+      == _room and _room > 0.0)
+check("20 s late at a 5800 W reading with 450 s left: 5800 x 20 / 450 W "
+      "less room",
+      abs(peakguard.charge_room_w(_dec, _late)
+          - (_room - 5800.0 * 20.0 / 450.0)) < 1e-6)
+check("never below 0 W, and an export held counts nothing",
+      peakguard.charge_room_w(_dec, Projection(
+          5800.0, 5800.0, 880.0, 850.0 / 880.0, False, START, 5800.0)) == 0.0
+      and peakguard.charge_room_w(_dec, Projection(
+          5800.0, 5800.0, 450.0, 430.0 / 450.0, False, START, -900.0))
+      == _room)
+check("None, blind (0 W) and no projection pass through",
+      peakguard.charge_room_w(None, _late) is None
+      and peakguard.charge_room_w(_dec, None) == _room
+      and peakguard.charge_room_w(
+          peakguard.PeakDecision(engaged=True, floor_w=0.0, ceiling_w=3500.0,
+                                 ceiling_from="cap", blind="frozen"),
+          _late) == 0.0)
+
+
+# ============================================================================ #
+def graded(label, full, aim):
+    print(f"    {label}: quarters "
+          f"{ {k: round(v, 1) for k, v in full.items()} } W, aim {aim:.0f}")
+    return len(full) >= 2 and all(v <= aim + TOL for v in full.values())
+
+
+def cut_and_back(rows):
+    """The charge is off in each quarter's last 5 s, and back (A charging
+    over 2 kW) within the next quarter's first minute."""
+    ends = [r for r in rows if into(r[0]) >= QUARTER_S - 5]
+    starts = {}
+    for r in rows:
+        if into(r[0]) < 60:
+            q = int(r[0].timestamp() // QUARTER_S)
+            starts[q] = starts.get(q, False) or r[2] < -2000.0
+    return (present(first(iter(ends), "a quarter end"))
+            and all(r[1] > -1.0 for r in ends)
+            and len(starts) >= 2 and all(starts.values()))
+
+
+print("\n2. a reading 30 s late at each quarter's end, the live shape")
+GAP = {}
+for name, kw, aim in (
+        ("month peak 5413 W banked, P1 projection",
+         dict(peak=PEAK), AIM_PEAK),
+        ("month peak banked, peak_forecast_entity (kW)",
+         dict(peak=PEAK, fc=True), AIM_PEAK),
+        ("no peak banked (aim = cap - margin), P1 projection",
+         dict(), AIM_CAP),
+        ("no peak banked, peak_forecast_entity", dict(fc=True), AIM_CAP)):
+    fc = kw.pop("fc", False)
+    _c, _rows, _full, _s = drive(opts(fc=fc), late=30.0, **kw)
+    GAP[name] = (_c, _rows, _full)
+    check(f"{name}: every quarter at or under the aim "
+          f"({aim:.0f} W, +{TOL:.0f} W landing)", graded(name, _full, aim))
+    check(f"{name}: the charge is off in the quarter's last seconds and "
+          f"back in the next quarter", cut_and_back(_rows))
+_c_fc = GAP["month peak banked, peak_forecast_entity (kW)"][0]
+check("the forecast entity is read, in kW, as the live template (SAFETY-118), "
+      "and the cheap run's charge does not depend on it",
+      _c_fc.peak_fc is not None and _c_fc.peak_fc > 1000.0
+      and [r[1] for r in GAP["month peak banked, peak_forecast_entity (kW)"]
+           [1]] == [r[1] for r in GAP[
+               "month peak 5413 W banked, P1 projection"][1]])
+
+
+# ============================================================================ #
+print("\n3. the same for a price trade (modes off) and a maintenance charge")
+_ca, _ra, _fa = drive(opts(modes=False, arb=True), peak=PEAK, late=30.0)[:3]
+check("modes off, price trading on, a reading 30 s late: every quarter at "
+      "or under the aim", graded("trade", _fa, AIM_PEAK)
+      and any(r[3] == "ARBITRAGE_CHARGE" for r in _ra))
+
+
+def late_feed(gap, every=0.0, look=None):
+    """safety84's cheap-window feed, no telegram in each quarter's last
+    `gap` s, and one only every `every` s (0: every cycle). `look(c, t)`
+    runs first, on the state the previous cycle left."""
+    feed = s84.feed(True)
+
+    def before(c, t):
+        if look is not None:
+            look(c, t)
+        if ((rig.BASE.timestamp() + t) % QUARTER_S < QUARTER_S - gap
+                and (not every or t % every < 1e-9)) \
+                or not getattr(c.hass, "_s84", False):
+            feed(c, t)
+    return before
+
+
+def rig_quarters(rows, load):
+    """The safety84 rig's whole quarters: the true average import (W)."""
+    qs = {}
+    for r in rows:
+        q = int((rig.BASE.timestamp() + r[0]) // QUARTER_S)
+        a = qs.setdefault(q, [0.0, 0])
+        a[0] += max(0.0, load(r[0]) - sum(v for _u, v in r[2]))
+        a[1] += 1
+    return {datetime.fromtimestamp(q * QUARTER_S, L).strftime("%H:%M"):
+            s / k for q, (s, k) in sorted(qs.items())
+            if k * rig.TICK >= QUARTER_S}
+
+
+for peak, house, aim in ((5413.0, 4000.0, 5363.0), (None, 2500.0, AIM_CAP)):
+    _mr, _mc = s84.run(2, load=lambda t, h=house: h, dur=2700.0,
+                       month_peak=peak, before=late_feed(30.0))
+    _mf = rig_quarters(_mr, lambda t, h=house: h)
+    check(f"N=2 maintenance charge, house {house:.0f} W, "
+          f"{'peak banked' if peak else 'no peak banked'}, a reading 30 s "
+          f"late: every quarter at or under the aim",
+          graded("maintenance", _mf, aim)
+          and any(mm.phase == "charge" for mm in _mc.maints))
+
+
+# ============================================================================ #
+print("\n4. a healthy meter: the quarters, and the words")
+for name, kw, aim, kw_text in (("month peak banked", dict(peak=PEAK),
+                                AIM_PEAK, "5.4 kW"),
+                               ("no peak banked", dict(), AIM_CAP, "3.5 kW")):
+    _c, _rows, _full, _s = drive(opts(), every=10, **kw)
+    check(f"{name}: every quarter at or under the aim",
+          graded(name, _full, aim))
+    over = [s for s in _s if not s[2] and s[0] > s[1]]
+    under = [s for s in _s if not s[2] and s[0] <= s[1]]
+    _o, _u = first(iter(over), "an over sample"), \
+        first(iter(under), "an under sample")
+    print(f"    over the limit at this rate ({len(over)} samples): "
+          f"{_o[3] if present(_o) else _o!s} / "
+          f"{_o[4] if present(_o) else _o!s}")
+    print(f"    under it ({len(under)}): "
+          f"{_u[3] if present(_u) else _u!s} / "
+          f"{_u[4] if present(_u) else _u!s}")
+    check(f"{name}: over the limit at this rate the guard row never says "
+          f"'under'; it says the grid charge is limited",
+          present(_o) and all(
+              "under" not in s[3] and "Peak guard: grid charge limited, "
+              "at this rate" in s[3] and " over " in s[3] for s in over))
+    check(f"{name}: ...and the month-peak line says the rate, and that the "
+          f"grid charge is cut back to stay under {kw_text}",
+          present(_o) and all(
+              s[4].startswith("At this rate this 15-minute period reaches")
+              and s[4].endswith("The grid charge is cut back to stay "
+                                f"under {kw_text}.") for s in over))
+    check(f"{name}: under the limit both read as before",
+          present(_u) and all(
+              s[3].startswith("Peak guard: idle, heading for")
+              and " under " in s[3]
+              and s[4].startswith("This 15-minute period is heading for")
+              and s[4].endswith(f"The batteries step in above {kw_text}.")
+              for s in under))
+
+
+# ============================================================================ #
+print("\n5. the words on their own")
+_en = messages.row_peak_guard_idle(5814.0, 5413.0, month_peak=True)
+_cut = messages.row_peak_guard_idle(5814.0, 5413.0, month_peak=True,
+                                    cut=True)
+_ok = messages.row_peak_guard_idle(5200.0, 5413.0, month_peak=True)
+print(f"    {_en}\n    {_cut}\n    {_ok}")
+check("over, nothing cut: 'idle, at this rate ..., over ...'",
+      _en == "Peak guard: idle, at this rate 5 814 W, over 5 413 W")
+check("over, a grid charge cut",
+      _cut == "Peak guard: grid charge limited, at this rate 5 814 W, "
+              "over 5 413 W")
+check("under: the 0.19.1 sentence, unchanged",
+      _ok == "Peak guard: idle, heading for 5 200 W, under this month's "
+             "5 413 W peak")
+check("the Dutch forms say the same",
+      _cut.nl == "Piekbewaking: laden beperkt, aan dit tempo 5 814 W, "
+                 "boven 5 413 W"
+      and _en.nl.startswith("Piekbewaking: in rust, aan dit tempo"))
+check("the month-peak line in shadow mode says 'would'",
+      homeview.line_period(5814.0, 5413.0, True, cut=True).endswith(
+          "The grid charge would be cut back to stay under 5.4 kW.")
+      and homeview.line_period(5814.0, 5413.0, False).endswith(
+          "The batteries step in above 5.4 kW."))
+
+
+# ============================================================================ #
+print("\n6. one inverter: the maintenance charge is sized to the room too")
+# The start-up quarter on a 10 s meter: the charge's first step is not seen
+# until the second reading, so it may land up to START_TOL over the aim; the
+# same at N=2 and before this fix. Every later quarter is graded at TOL.
+START_TOL = 15.0
+N1 = {}
+for peak, house, aim in ((5413.0, 4000.0, 5363.0), (None, 2500.0, AIM_CAP)):
+    for late, every in ((0.0, 0.0), (30.0, 0.0), (20.0, 10.0)):
+        _r, _c = s84.run(1, load=lambda t, h=house: h, dur=2700.0,
+                         month_peak=peak, before=late_feed(late, every))
+        _q = rig_quarters(_r, lambda t, h=house: h)
+        N1[peak, late, every] = (_r, _c)
+        _vals = list(_q.values())
+        _tag = (f"N=1, {'peak banked' if peak else 'no peak banked'}, "
+                f"{'10 s' if every else '5 s'} meter, "
+                f"{'late ' + format(late, '.0f') + ' s' if late else 'healthy'}")
+        print(f"    {_tag}: quarters "
+              f"{ {k: round(v, 1) for k, v in _q.items()} } W, aim {aim:.0f}")
+        check(f"{_tag}: every quarter at or under the aim",
+              len(_vals) == 3
+              and all(v <= aim + TOL for v in _vals[1:])
+              and nth(_vals, 0, "a first quarter")
+              <= aim + (START_TOL if every else TOL)
+              and any(mm.phase == "charge" for mm in _c.maints))
+_hr, _hc = N1[5413.0, 0.0, 0.0]
+_eng = sum(1 for r in _hr if r[-1][1] and r[-1][1][0])
+print(f"    healthy, peak banked: guard engaged on {_eng} of {len(_hr)} "
+      f"cycles; A charges on "
+      f"{sum(1 for r in _hr if dict(r[2])['a'] < -1.0)} cycles")
+check("N=1: the guard no longer steps in during the charge (no hand-back), "
+      "and the battery charges on every cycle, at no more than its rate",
+      _eng == 0 and all(-2000.0 <= dict(r[2])["a"] < -1.0 for r in _hr)
+      and not any("suspended" in e for e in _hc.events))
+
+
+# ============================================================================ #
+print("\n7. the row during an N=2 maintenance charge and in shadow mode")
+_rows7 = []
+
+
+def _look(c, t):
+    pg = c.peak_guard
+    if t >= QUARTER_S and pg is not None and pg.projected_w is not None \
+            and not pg.engaged and pg.projected_w > pg.ceiling_w:
+        _rows7.append(first((r["text"] for r in c.checks()
+                             if r["id"] == "peak_guard"), "guard row"))
+
+
+def _steps(t):
+    """4000 W, 800 W more for the first 30 s of every minute."""
+    return 4000.0 + (800.0 if t % 60.0 < 30.0 else 0.0)
+
+
+_m2r, _m2c = s84.run(2, load=_steps, dur=1800.0, month_peak=5413.0,
+                     before=late_feed(0.0, look=_look))
+_m2q = rig_quarters(_m2r, _steps)
+print(f"    N=2 maintenance charge, house steps 4000/4800 W: "
+      f"{len(_rows7)} over-the-limit rows, e.g. "
+      f"{first(iter(_rows7), 'a row')}; quarters "
+      f"{ {k: round(v, 1) for k, v in _m2q.items()} } W")
+check("N=2 maintenance charge, over the limit at this rate: the row says the "
+      "grid charge is limited",
+      present(first(iter(_rows7), "a row")) and all(
+          r.startswith("Peak guard: grid charge limited, at this rate")
+          for r in _rows7)
+      and all(v <= 5363.0 + TOL for v in _m2q.values()))
+_sh_o = dict(opts(), shadow_mode="on")
+_csh, _rsh, _fsh, _ssh = drive(_sh_o, peak=PEAK, minutes=17, every=10,
+                               plant=OnItsOwn)
+_sh_over = [s for s in _ssh if not s[2] and s[0] > s[1]]
+_sh1 = first(iter(_sh_over), "an over sample")
+print(f"    shadow mode, the inverter charging 5000 W on its own: "
+      f"{len(_sh_over)} over samples, e.g. "
+      f"{_sh1[3] if present(_sh1) else _sh1!s} / "
+      f"{_sh1[4] if present(_sh1) else _sh1!s}")
+check("shadow mode: nothing is cut on the wire, so the row says 'idle', "
+      "never 'grid charge limited', and the line says 'would'",
+      _csh.shadow and present(_sh1) and all(
+          s[3].startswith("Peak guard: idle, at this rate")
+          and "would" in s[4] for s in _sh_over))
+
+
+# ============================================================================ #
+print("\n8. edge cases")
+_e45 = drive(opts(), peak=PEAK, late=45.0)
+check("a reading 45 s late, past the 30 s hold (the guard goes blind): every "
+      "quarter at or under the aim", graded("late 45 s", _e45[2], AIM_PEAK))
+_e07 = drive(opts(), peak=PEAK, late=30.0, minutes=24,
+             start=START + timedelta(minutes=7))
+check("a start at 00:07, mid-quarter, then 30 s late: the next quarter at or "
+      "under the aim",
+      len(_e07[2]) == 1 and all(v <= AIM_PEAK + TOL
+                                for v in _e07[2].values()))
+print(f"    start at 00:07: {_e07[2]}")
+_dst = drive(opts(), peak=PEAK, late=30.0,
+             start=datetime(2026, 10, 25, 0, 45, tzinfo=timezone.utc))
+check("across the end of summer time (2026-10-25 01:00 UTC), 30 s late: "
+      "every quarter at or under the aim", graded("DST", _dst[2], AIM_PEAK))
+_ew = drive(opts(fc=True), peak=PEAK, late=30.0, fc_unit="W")
+check("the forecast entity in W: read as W, and the charge as with kW",
+      _ew[0].peak_fc is not None and _ew[0].peak_fc > 1000.0
+      and [r[1] for r in _ew[1]] == [r[1] for r in GAP[
+          "month peak banked, peak_forecast_entity (kW)"][1]])
+_e10 = drive(opts(), peak=PEAK, period=10.0)
+_e10v = list(_e10[2].values())
+print(f"    10 s meter: {_e10[2]}")
+check("a 10 s meter: every quarter after the start-up one at or under the "
+      "aim, and that one within START_TOL",
+      len(_e10v) == 2 and all(v <= AIM_PEAK + TOL for v in _e10v[1:])
+      and nth(_e10v, 0, "a first quarter") <= AIM_PEAK + START_TOL)
+_p_end = Projection(5800.0, 5800.0, 899.5, 898.5 / 899.5, False, START,
+                    5800.0)
+check("0.5 s left and 1 s late: finite, the formula, at its floor of 0 W",
+      peakguard.charge_room_w(_dec, _p_end) == max(
+          0.0, _room - 5800.0 * 1.0 / 0.5))
+_d_end = peakguard.decide(
+    Projection(5800.0, 5800.0, 900.0, 1.0, True, START, 5800.0),
+    batt_w=-4800.0, cap_w=3500, margin_w=50,
+    reading=types.SimpleNamespace(is_observed=True, peak_w=PEAK),
+    achievable_w=9600.0, soc=50.0, soc_floor=20.0)
+check("no second left: no room is measured (None), and nothing divides by 0",
+      peakguard.charge_room_w(_d_end, Projection(
+          5800.0, 5800.0, 900.0, 890.0 / 900.0, False, START, 5800.0))
+      is None)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED:")
+    for f in fails:
+        print(f"  - {f}")
+    sys.exit(1)
+print("all checks passed")

goodwe_controller/test_safety84.py

@@ -476,13 +476,18 @@ print("\n8. the N=1 and N=2 digests")
 # loop's bound just after the guard hands back are gone; every command and
 # claim is the same (test_safety119.py part 6). SAFETY-121 re-pinned all six
 # again: only OUTPUT_CLAMP rows (test_safety119.py part 6).
+# SAFETY-125 (0.19.2, owner 2026-10-29) re-pinned n1_charge and
+# n1_charge_banked: at N=1 the cheap-window charge is now sized to the
+# quarter's room, as at N=2, so the guard no longer steps in and discharges.
+# The banked quarters go 3461.9 -> 3450.0 W (aim 3450) and 3938.9 -> 3950.0
+# W (aim 3950). n1_charge_dear (no cheap window) is unchanged.
 PINNED = {
     "n1_charge":
-        "0ed25c856456b97acb07a39299a8cb7b1a762c4d0005b88a0823c03057a80be5",
+        "00f0a16b3ac1bd2830e9e0aaac8923fd9d1736c2bc6c543669bdd35b2fb542e9",
     "n1_charge_dear":
         "c25340b56060d4581f7204e200b07e7c8618711be2baca3b1667b7ebeb600dc3",
     "n1_charge_banked":
-        "2619acdd06b04e56c000b168d64e1d044346c6ba3f929c94258d6ad8189ec609",
+        "09a08298d35195380ff427cdd2448d9212119be4692db26b2b1a45957fdf3300",
     "n2_charge":
         "b16d692128f14bcce3d87b142d290e0d6b13724289680e44a05215c9eaa24a7c",
     "n2_charge_dear":
@@ -496,8 +501,9 @@ for k in PINNED:
           f"{_now[k][:16]}")
 check("⭐ at N=1 a charge in and out of a cheap window and under a banked "
       "month peak is byte-identical to 9d5b7d1 (commands, reasons and every "
-      "claim; the log as re-pinned by SAFETY-121), and N=2 outside a cheap "
-      "window matches its SAFETY-85 pin",
+      "claim; the log as re-pinned by SAFETY-121; in a cheap window as "
+      "SAFETY-125 re-pinned it), and N=2 outside a cheap window matches its "
+      "SAFETY-85 pin",
       all(_now[k] == PINNED[k] for k in ("n1_charge", "n1_charge_dear",
                                          "n1_charge_banked",
                                          "n2_charge_dear")))

goodwe_controller/test_safety87.py

@@ -522,7 +522,9 @@ print("\n9. N=1 is byte-identical to release/1.0 b8ddfd7")
 # log. The loop's bound just after a hand-back is not counted, so OUTPUT_CLAMP
 # rows are gone or count fewer; every command and claim is the same
 # (test_safety119.py part 6). SAFETY-121 re-pinned the same three again:
-# only OUTPUT_CLAMP rows (test_safety119.py part 6).
+# only OUTPUT_CLAMP rows (test_safety119.py part 6). SAFETY-125 (0.19.2)
+# re-pinned n1_charge_low: the N=1 cheap-window charge is sized to the
+# quarter's room, so the banked quarter goes 3458.9 -> 3450.0 W (aim 3450).
 PINNED = {   # tools/safety87_identity.py on b8ddfd7
     "n1_under":
         "d2395ef8d74fb23607ad864d5a4bf62c03044bbd9367e873675d7ad10e8c169f",
@@ -533,7 +535,7 @@ PINNED = {   # tools/safety87_identity.py on b8ddfd7
     "n1_under_banked":
         "a2876c7cc873bc4c974d2b4bd98e23bba2d007b84545587d2fe0b713b0a6249b",
     "n1_charge_low":
-        "91336e3c0314985a3b00f314c79b5ffb5a740d218de3ad44f88a4db6e4235b32",
+        "c3af6218cc14c072e08b09550b153502dafec806009a92ba9032738b9ac9fa61",
     "n1_hold":
         "0a1df347754c69166b20d04c15ee878bbcefb02abb824b9b452334f68f03e46d",
 }
@@ -542,8 +544,8 @@ for k in PINNED:
     print(f"    {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'}")
 check("⭐ every N=1 digest (claims, commands, the guard's decision and the "
       "log) equals b8ddfd7's (the log as re-pinned by SAFETY-121), under, "
-      "crossing and above the reserve, in a charge and a HOLD, and under a "
-      "banked peak",
+      "crossing and above the reserve, in a charge (as SAFETY-125 re-pinned "
+      "it) and a HOLD, and under a banked peak",
       _now == PINNED)
 
 # ============================================================================ #