SAFETY-81 review: 10 s hold, ERROR line per episode, more scenarios

- The alarm must hold for peakguard.ALARM_HOLD_S (10 s) on the projection's
  clock. A load that tops cap + battery for ~5 s every 30 s alarmed at every
  quarter start while the quarter landed under the aim (sine4500_fast).
- A cycle with no battery reading leaves the hold alone.
- Notified once per quarter, but the ERROR line is written per episode.
- New sim scenarios (sine4500_fast, twice7000, step6500_gap) with 5a4cdc2
  digests; control still byte-identical. Unit checks for export and the
  hold across a missing reading. test_peakguard's saturated fixture moves
  the hold start back instead of waiting it out.
- DECISIONS and DOCS updated: costs of the hold, tolerance reasoning, the
  double count in control left to a follow-up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/img/ux13/README.md

@@ -4,6 +4,6 @@ Made from the real page by `goodwe_controller/tools/ux13_screenshots.sh`. Do not
 edit them by hand: run the script again.
 
 - `home-*.png`: Home, running, in Dutch, in shadow mode, at phone width, and in setup.
-- `settings-*.png`: Settings (Installer view), and the time-window editor with an overlap.
+- `settings-*.png`: Settings, Simple and Installer, and the time-window editor with an overlap.
+- `batteries*.png`: the Batteries screen with modes on, in Dutch, an Off battery helping the peak limit, a refusal at phone width, and modes off.
 - `setup-step-1*.png`: Setup, step 1.
-- Battery modes (the Batteries screen and the Simple view): not built yet (UX-13 P3), so no screenshot.

goodwe_controller/DECISIONS/OPT-11-battery-modes.md

@@ -17,5 +17,61 @@ P1 is its section 6 P1, and the pull request lists what was measured.
   capped grid charge release an Off battery. Both are graded in
   `test_arbiter.py` part 11. The loop bound leaves a side that reaches the
   rail to the rail, so SAFETY-03 still flags a loop winding into it.
+- P2 (HA entities): a select and a switch per battery, only while modes are
+  on; commands go through `handle_action()`, the page's path. A retained
+  command is dropped, not applied: the store already holds the last choice,
+  and a replay after a restart could otherwise undo a newer one. The config
+  topics announced are kept in the store (`mqtt_mode_configs`), so turning
+  modes off removes exactly those, and an install that never turned them on
+  publishes what ed739d4 did (`test_mqtt.py` part 10). A removed topic stays
+  in that list and its empty config is re-sent on each start, so a start with
+  no broker cannot lose it; re-sending is harmless. The HA options are the
+  page's English names, pinned by a test, and are not renamed with the page:
+  automations send them.
 - In P1 only Off closes a direction; Leftover solar differs by charging last.
-  Price runs, selling (`pack_sell`, reserved) and the forecast are P3/P4.
+- P3 (price runs, `priceruns.py`, `modetrade.py`): each battery's range is
+  narrowed by its role this tick (hold, give, charge, rest, sell); main.py
+  files the intersection with the switch, so it still holds 0 W. With modes on
+  the site trade is filed by the modes, sized from the loop bound (so no
+  battery a mode or a refusal holds is asked for watts, P1's unmet share) and
+  the guard's headroom; `arbitrage.decide()` runs only with modes off, which
+  stays byte-identical to 7a00f12 (`test_modes_p3.py` part 1).
+- SAFETY-46 item 2 is decided as the owner answered (2026-09-25): a trade is
+  a run of consecutive firm slots. It applies with battery modes on; the
+  modes-off trade keeps its one-period shape, because that path must not move.
+- Choices that were measured, not assumed (tools/opt11p3_replay.py):
+  - a sale needs the guard to have measured the quarter, not to be clear: a
+    5 kW discharge alone reads "engaged" on export and flipped the sale every
+    5 s;
+  - a grid charge makes the others rest, so it starts only at 500 W and, once
+    the guard or the headroom stops it, stays off for that 15-minute period
+    (without: 13 flips in 4 minutes under a 3.5 kW house);
+  - stored energy is valued at the last cheap run for 12 h, and a charge
+    needs its own run to clear the spread (without: a night charge was spent
+    on flat morning prices, then charging went on at them);
+  - a run edge reseeds the loop at the house's level (a 3 kW import spike
+    removed; about 0.1 x rating still overshoots as export).
+- Replay (tools/opt11p3_replay.py, 16 recorded days, EPEX hourly prices a
+  year earlier, modelled batteries), net EUR, lower is better: P2 19.33, P3
+  Solar first + Leftover solar 19.57, with a sale 19.60, the old one-period
+  trade 18.14. Review of #153 (same model, with a per-action split):
+  - the cheapest hours were at midday on 15 of 16 days, so Leftover solar (acting
+    as Cheap hours until P4) bought 12.2 kWh there that the sun would have
+    given: 7 kWh more exported, 12 kWh less solar stored. Holding for the
+    expensive hours saved 4 kWh of import, not enough. With no grid charge on
+    Leftover solar: 19.44;
+  - the old trade charged one hour, so the afternoon sun still fit;
+  - a sale earned the wholesale price (2.27 EUR for 11.4 kWh) and the house
+    then bought the same energy back (2.29 EUR): a wash before wear. It pays
+    only when the sale hour's wholesale price beats the later import price,
+    levies included (about 0.13 EUR/kWh above that hour's wholesale here);
+  - valuing the charge left at the end, wear and real Flemish levies make
+    selling worse and do not change the order.
+- Owner decision 2026-09-29 (option A): selling is off until it can be judged
+  on the price the grid pays (`packmode.SELLING_ENABLED`, code kept), and
+  Leftover solar takes solar only until P4's forecast
+  (`packmode.GRID_CHARGE_MODES`); Cheap hours only still charges from the grid. Replayed
+  (16 days, as above): Solar first + Leftover solar 19.44 EUR net against
+  P2's 19.33; Solar first + Cheap hours only 19.57.
+- Not done in P3: the forecast (P4), and a headroom too short for the run
+  moving the rest to the next cheap periods.

goodwe_controller/DECISIONS/SAFETY-79-peak-margin.md

@@ -0,0 +1,41 @@
+# SAFETY-79 — the peak guard keeps a margin below the peak limit
+
+**Status: DECIDED 2026-09-28 (owner decision).**
+
+## Decision
+
+The peak guard aims `peak_margin_w` under the limit it holds: under
+`peak_cap_w`, or under a month peak already banked above it
+(`quarter_target_w()`). `peak_margin_w` is a setting: default 50 W, range
+0-500 W, whole watts. An install without the key gets 50.
+
+**Why (owner):** the guard aimed exactly at the cap, and in the OPT-11 P1 test
+a quarter banked 3501.9 W against a 3500 W limit (OPT-11-P1-test-report.md,
+check 4). A peak even 1 W over still sets the billed peak. It is a setting and
+not a constant because the add-on is sold to several sites.
+
+**Banked peak (review, 2026-09-29):** the PR first aimed at a banked month
+peak as it stood. That can bank a few W over it, which raises the bill the
+same way; and a peak banked between cap - margin and the cap (common in the
+month an install upgrades, since the old guard held quarters at the cap) was
+aimed at exactly, so one overshoot went over the cap. The margin now applies
+under it too. Cost: up to `peak_margin_w` of a peak already paid for goes
+unused (more discharge, less charge headroom); no bill cost. Undo is one line
+in `quarter_target_w()`.
+
+## What uses which number
+
+- **the aim:** `peakguard.decide()` (the claim's floor, and so arbitrage's
+  `charge_headroom_w()` and OPT-11's give-way, which read it), and, as cap -
+  margin, `shaping_suspended()` and `maintenance_charge_floor()` (the forecast
+  checks, via `Controller.peak_aim_w()`).
+- **the real cap (reporting and billing):** `PeakTracker` (month peak,
+  headroom, 80 % warning), the decision's `ceiling_w` and every notice and
+  status row built from it, Home's limit, and `validate.config_notes()`.
+
+## Checks
+
+`peak_margin_w: 0` is byte-identical to ed739d4 (test_peak_margin.py part 1,
+digests from tools/safety79_identity.py, which also runs a maintenance charge
+with a forecast). validate.py rule 12 refuses a value outside 0-500, not
+whole, or not below `peak_cap_w`.

goodwe_controller/DECISIONS/SAFETY-81-load-too-high.md

@@ -0,0 +1,63 @@
+# SAFETY-81 — no false "Load too high for battery" alarms
+
+**Status: 2026-09-29, owner go for the card. Review kept the 10 W tolerance
+as a constant and added the 10 s hold.**
+
+## Defect
+
+The SAFETY-79 test (SAFETY-79-test-report.md, F1/F2) saw 6 false alarms in 7.
+The alarm fired whenever `decide()` clamped its floor to the rating
+(`saturated`). Three things set that while the quarter landed on target:
+
+- **Double count.** `decide()` sizes from the held meter reading plus the
+  battery reading. When the meter sample predates the battery's last increase,
+  the increase is counted twice. It happens under noise, and at each quarter
+  start, where the battery is back while the held sample is still the spike.
+- **The aim, not the cap.** `saturated` is graded against cap − margin, so at
+  margin 50 noise needs 50 W less to trip it (F2).
+- **Last seconds.** The gain 900 / remaining turns a few W over the aim into
+  thousands of W wanted, with the battery far from its rating.
+
+## Decision
+
+The alarm needs `saturated` and `peakguard.load_too_high()`: with the battery
+at full power from now on, the quarter still ends more than `ALARM_MISS_W`
+(10 W) over the real limit (`ceiling_w`). That is the miss itself, without the
+gain. The battery reading it uses is the lower of this cycle's and the last
+one's. It must hold for `ALARM_HOLD_S` (10 s). At most one notification per
+quarter, because near the threshold the test flickers with the meter; the
+ERROR log line is written for every episode.
+
+**Why 10 W:** at margin 0 the guard itself lands up to +5.7 W over (SAFETY-79
+test, check 5), and those misses are real but tiny; the alarm would fire in
+the last second of most guarded quarters. The margin (default 50) is the fix
+for them. Cost: a real miss of 10 W or less is not alarmed; at a capacity
+tariff of the order of EUR 50 per kW a year, 10 W in one month is cents.
+Review measured +13 W on a 10 kW two-unit site at margin 0, not saturated, so
+no alarm: the tolerance only matters when the battery is at its rating. A
+constant, not an option: `peak_margin_w` is the owner's knob.
+
+**Why the hold (review):** the test assumes the load now lasts the rest of
+the quarter. A load over cap + battery for ~5 s every 30 s (`sine4500_fast`,
+a cycling hob or heater) alarmed at each quarter start while the quarter
+landed under the aim. The hold stops that.
+
+**Cost:** a real alarm comes 10-12 s later than on 5a4cdc2 (`step6500` at
+1211 s, not 1201 s); a slow ramp 20 s later (`ramp6500`), as it waits for the
+real cap. While the battery refuses or its reading is lost, the alarm waits
+until the quarter is lost even at full battery (27-60 s later in review runs);
+those faults have their own alarms. A load over cap + battery for more than
+10 s still alarms even if the quarter later lands under. `ALARM_HOLD_S = 0`
+removes the hold.
+
+## Not changed: the 1 s spike itself
+
+The cycle after a quarter boundary and before the new quarter's first meter
+sample still sees 0 s left, files no claim, and an Off battery drops to 0 W for
+one cycle. That is the same edge tick as OPT-15 F1, so it is left to OPT-15.
+Control is unchanged here: every command in `tools/safety81_sim.py` is
+byte-identical to 5a4cdc2 (test_safety81.py part 1).
+
+The double count also moves control, not only the alarm: on a late sample the
+guard asks for the full rating for one cycle (edge4600 at 902 s: 2000 W where
+1150 W holds the aim). Left to a follow-up card.

goodwe_controller/DECISIONS/UX-13-one-layout-table.md

@@ -87,6 +87,14 @@ What UX-02 made authoritative stays authoritative:
   Configuration tab. Supervisor 2026.08.0's `AppOptions` accepted all 133
   wizard blobs, 17 of them with time windows
   (`tools/ux13_wizard_blobs.py --supervisor`, run offline on 2026-09-28).
+- P3: Settings, Simple draws the fields the table marks `simple`, with an
+  optional `note` under each (words in `settings.simple.note`), plus the
+  batteries' switches and modes. Those are store state set through the
+  existing `/action` values, not options, so the table places no key for
+  them. The Batteries screen's Now, Today and Why lines are built in
+  `homeview.py` from what the add-on knows this cycle; the plan per mode is
+  OPT-11 P3/P4, so until then Today says "Not planned yet" when no block
+  is planned for the battery (`test_batteries_screen.py`).
 
 ## 4. What this costs
 

goodwe_controller/DOCS.md

@@ -204,6 +204,7 @@ The label and description each setting shows on the Configuration tab, in tab or
 | Limits | Inverter rating (W) | `max_w` | Your own number: the most power the add-on may ever ask of the inverter. Start low and raise it after commissioning. |
 | Limits | Battery cut-out level (%) | `bms_soc_floor` | The level where the battery's own management system stops giving power. Read it off your battery rather than copying a figure. |
 | Limits | Peak limit (W) | `peak_cap_w` | Your own number: the 15-minute average power the add-on keeps the grid under. Take it from your grid contract. |
+| Limits | Margin below the peak limit (W) | `peak_margin_w` | The add-on aims this much below the peak limit, so a 15-minute period that ends a little high still stays under it. |
 | Limits | 15-minute demand forecast entity (W) | `peak_forecast_entity` | Optional. A forecast of this 15-minute period's average power. Leave it empty and there is no peak limit. |
 | Limits | Peak reserve (%) | `peak_soc_floor` | Peak limiting will not draw the battery below this level, but ordinary use can. Derived value, leave it unchanged. |
 | Tariff | Dynamic price source | `price_provider` | Where prices come from. Choosing a source starts the price fetch, even with trading off. |
@@ -274,6 +275,7 @@ When the add-on refuses to start, each reason names the setting by its label and
 - **Inverter rating** (`max_w`): your own number, not a derived one. It is not read when the inverter list is filled in, since each entry carries its own and the site limit is their sum. Several safety thresholds must stay below it, and the add-on refuses to start if one does not.
 - **Battery cut-out level** (`bms_soc_floor`, `inverters.bms_soc_floor`): measured, not chosen. Register 0x0560 reads 10 % on the reference GW5000S-BP. It exists so the add-on can refuse a “Peak reserve” at or below it, which could never take effect. Each inverter entry states its own, because one default for two different batteries protects the shallower one with the deeper one's number.
 - **Peak limit** (`peak_cap_w`): your own number, from your grid contract. In Belgium it is the capacity-tariff peak your distribution charge is billed on.
+- **Margin below the peak limit** (`peak_margin_w`): 50 W by default, 0 to 500 W (SAFETY-79). Peak limiting aims at the peak limit minus this margin, because a 15-minute period aimed exactly at the limit can end a watt or two over it (3501.9 W against 3500 W in a test), and even 1 W over sets the billed peak. Once this month's peak is already above the limit, it aims the same margin below that peak. The bill, this month's peak and the warnings still compare against the peak limit itself. 0 aims at the limit, as before.
 - **Peak reserve** (`peak_soc_floor`): derived, not picked (SAFETY-24). The reference battery holds 13.8 kWh usable and the worst modelled peak day asks for 878 Wh, or 6.4 %. 20 % sits ten points above the cut-out level and leaves about 1.6 worst days of room. It bounds peak limiting only: ordinary use goes on down to the cut-out level. It must stay above “Battery cut-out level”.
 - **Dynamic price source** (`price_provider`): selecting a provider is what starts the fetch, every half hour, whether or not trading is on. It may not be combined with the two older price entities. engie_dynamic, totalenergies_dynamic and eneco_eddy are withdrawn and refuse to start: their endpoints never existed. They stay in the list only so such a site gets that explanation.
 - **Supplier markup** (`price_markup_eur_kwh`): under manual_csv, whose prices are all in, it is ignored and logged as ignored.
@@ -515,15 +517,38 @@ below.
 
 ### Battery modes (`battery_modes_enabled`)
 
-Off by default. Turn it on, restart the add-on, and the Batteries screen gives each battery two controls. They apply at once, with no restart.
+Off by default. Turn it on, restart the add-on, and the Batteries screen (and Settings, Simple) gives each battery two controls. They apply at once, with no restart.
 
 - **On or off.** Off asks the battery for 0 W and starts no monthly cycle on it. A cycle that is running stops, and the add-on log says so. The peak limit may still use it, but only for what the other batteries cannot cover.
-- **Mode.** *Solar first* charges from spare solar before the other batteries. *Leftover solar* charges from the solar they cannot take. Both cover the house at any hour. Charging from the grid in cheap hours, and selling, come in a later update.
+- **Mode.**
+  - *Solar first* charges from spare solar before the other batteries and covers the house at any hour. It never charges from the grid and never sells.
+  - *Leftover solar* charges from the solar the others cannot take, never from the grid (until the solar forecast arrives). It saves its power for the expensive hours and covers the house then.
+  - *Cheap hours only* charges from the grid in the cheapest hours, saves its power for the expensive hours and covers the house then.
+- **Selling** is off until it can be judged on the price the grid pays (owner decision 2026-09-29, option A).
 
-The peak limit, the safety stops and the monthly cycle always come before a battery's mode.
+With battery modes on, these choices replace the *Charging and selling on price* switch (`arbitrage_enabled`); that switch is only read with modes off.
+
+**Cheap and expensive hours.** They come from the published day-ahead prices, as runs of consecutive 15-minute periods, not a single period.
+- The cheap run is the cheapest stretch long enough to fill the batteries that may charge, at their power.
+- An expensive hour costs at least *Battery cycle cost* (`cycle_cost_threshold_eur`, widened as for trading) more than the cheap run. The batteries hold their power until then.
+- The sale uses the most expensive stretch inside those hours, and never a period below 0.
+- A carried (not yet published) price is never used. A run that has started runs to its end.
+- With no prices, or too small a gap, every battery follows the house.
+
+**What always comes first.**
+- The peak limit, the safety stops and the monthly cycle come before a battery's mode.
+- A grid charge is sized so the 15-minute period stays under the peak limit less its margin (`peak_margin_w`). It starts only at 500 W or more. Once the peak limit stops it, it stays off for the rest of that 15-minute period.
+- While one battery charges from the grid, the others rest, and the house uses the grid.
+- A battery that refuses to charge or give power takes no part in a run in that direction.
+
+**In Home Assistant.** With MQTT set up, each battery also gets a *Mode* list and a *Use* switch, for example `select.goodwe_inverter_a_mode` and `switch.goodwe_inverter_a_use`. They do the same as the Batteries screen. Turn battery modes off and restart, and they are removed.
+
+*For installers:* commands arrive on `goodwe_ctl/unit/<battery>/mode/set` (a *Mode* option, such as `Solar first`) and `.../use/set` (`ON` or `OFF`). They go through the same checks as the Batteries screen. A refusal is logged once, and later refusals are counted in the log. A retained command is never applied, so the broker cannot replay an old choice after a restart; the add-on keeps the last choice itself.
 
 *For installers:* a mode is a limit at priority 35, kept apart from the hard limits. It gives way only as far as a limit above it (the peak guard) needs. A mode range always holds 0 W, so a mode can forbid a direction and never force one. With one inverter the mode also bounds the loop. The record is `DECISIONS/OPT-11-battery-modes.md`.
 
+*For installers:* when a charge or sale ends, the loop restarts at the house's own level rather than at the trade's watts. On the replay model that removes a ~3 kW import spike after a 2.5 kW charge and halves the settling time; about 0.1 × the battery's power still overshoots as export. The *Mode* list gains *Cheap hours only* in Home Assistant, at the end.
+
 ### Reading the grid-following loop: `Loop integrator`, `Loop integrator lead`, `Loop reason`
 
 The control law is a bounded integrator: an accumulator that is **not** the
@@ -1612,6 +1637,7 @@ help - see "Why the tuning is what it is".
 |---|---|
 | `peak_forecast_entity` | Quarter-hour demand forecast, for capacity-tariff markets. Empty = no cap |
 | `peak_cap_w` | The site's capacity-tariff target |
+| `peak_margin_w` (50) | Watts the peak guard aims under `peak_cap_w` (SAFETY-79). Reports and the bill use `peak_cap_w` itself |
 | `peak_soc_floor` (20) | **The percent below which the capacity-peak guard will not discharge the battery.** ⚠️ It bounds **the peak guard only** — it is **not a pack-wide reserve**, and ordinary self-consumption discharges straight past it (SAFETY-25, see below). Not optional and not the same thing as `maintenance_soc_floor` |
 | `bms_soc_floor` (10) | The pack's **own** cut-out percent, the number the BMS enforces whatever you set above. `peak_soc_floor` must be **strictly above** it or the add-on refuses to start. ⚠️ **At a declared `inverters:` roster this key moves INTO each entry and is REQUIRED there** (SAFETY-32): it describes a battery, and two packs of different models have different cut-outs, so one number for both protects the shallower pack with the deeper pack's BMS. Nothing is inherited — an entry that omits it is refused **by name** at startup, and the flat key below is then not read at all |
 | `price_now_entity`, `price_avg_entity` | Dynamic tariff. Empty = never force a paid grid top-up |
@@ -1713,7 +1739,8 @@ control action and goes to the action log and the status page. A *saturated*
 guard — asking for everything the inverter has while the quarter is still
 projected over — raises one notification (`goodwe_peak_saturated`), because that
 is the one state where the money will be spent and shedding load is the only
-thing left that changes the bill.
+thing left that changes the bill. SAFETY-81 keeps a 1 s meter spike, noise and
+a quarter's last seconds from raising it: see `peakguard.load_too_high()`.
 
 **And it sizes a price-driven charge, not only a forced discharge (SAFETY-45).**
 The same arithmetic read the other way answers *"how hard may this site charge
@@ -3185,9 +3212,12 @@ reason code `OUTPUT_CLAMP`.
 **Load too high for battery.** The capacity-peak guard (SAFETY-07) asks for
 everything the inverter can discharge and the running 15-minute average is
 still projected over the peak limit, so the month's billed peak
-(capaciteitstarief) goes up. In shadow mode the guard's projection is made on a
-plant that did not respond (SAFETY-47), and the text says so. See *The
-capacity-peak guard*.
+(capaciteitstarief) goes up. It fires only when, for 10 s, the period would
+still end more than 10 W over the real limit (not the margin's aim) with the
+battery at full power. It notifies at most once per period; later overloads
+in the same period go to the log (SAFETY-81). In shadow mode the
+guard's projection is made on a plant that did not respond (SAFETY-47), and
+the text says so. See *The capacity-peak guard*.
 
 **Battery stopped limiting the peak.** The peak guard may not discharge below
 `peak_soc_floor` (label “Peak reserve”, SAFETY-24). It also stops when the
@@ -3245,12 +3275,28 @@ The page is in Dutch when your browser's language is Dutch, and in English
 otherwise. Status lines, alarms and the start checks' messages stay in English.
 
 Screenshots of each screen are in the add-on's repository, under
-`docs/img/ux13/`. The battery-mode screens are not built yet, so there are no
-screenshots of them.
+`docs/img/ux13/`, including the Batteries screen and Settings, Simple.
 
 *For installers: regenerate the screenshots with
 `tools/ux13_screenshots.sh`, which serves the page from test fixtures.*
 
+### The Batteries screen and Settings, Simple
+
+The **Batteries** tab has a card per battery: its level, and three lines.
+**Now** says what it does, **Today** lists the blocks planned for it (price
+trades, the monthly cycle, the peak limit), and **Why** says the reason. With
+battery modes on, each card also has the On/Off switch and the mode list; both
+apply at once. Today reads "Not planned yet" until the add-on has made the
+day's price runs.
+
+An Off battery that the peak limit still needs says so, with the power it
+gives: "Off, but gives 0.5 kW for the peak limit."
+
+**Settings** opens on the **Simple** view, or on the view you last picked:
+the peak limit, the batteries' switches and modes, and shadow mode, each
+marked "Applies right away" or "Applies after a restart". **Installer** shows
+every setting.
+
 ### Setup, for a new install
 
 The **Setup** tab walks an installer through six steps: the meter, the

goodwe_controller/app/homeview.py

@@ -10,8 +10,9 @@ note, section 3.3.
 The plan shows only what the add-on does today: trading on price (the
 arbitrage verdict, the same call the control cycle makes), the monthly battery
 cycle, the peak limit and "follows the house". OPT-11 P1 adds each battery's
-switch and mode to its row; the mode plan arrives with P3/P4, so nothing here
-invents one. Every sentence is in the words
+switch and mode to its row; P3 adds each battery's price runs and its role this
+cycle (`Controller.mode_runs`, `mode_tick`), read as the control cycle left
+them, so nothing here invents a plan. Every sentence is in the words
 section at the bottom and is held to STYLE.md by test_messages.py.
 """
 
@@ -20,6 +21,7 @@ from datetime import datetime, timedelta, timezone
 from . import arbitrage, messages, peakguard, uitext
 from .maintenance import CHARGE as M_CHARGE, DRAIN as M_DRAIN, HOLD as M_HOLD
 from .maintenance import IDLE as M_IDLE
+from .packmode import CHEAP_HOURS, GRID_CHARGE_MODES, LEFTOVER_SOLAR, SOLAR_FIRST
 from .price import Absence, Uncertainty, brussels
 from .static_tariff import static_plan
 from .tariff import BILLING_TZ
@@ -284,6 +286,8 @@ def trade_runs(c, plan, verdict, day0, day1, now, shadow):
             continue
         hrs = (end - pt.start).total_seconds() / 3600.0
         for i, inv in enumerate(c.inverters):
+            if _off(c, inv):
+                continue            # OPT-11: an Off battery does not trade
             kwh = inv.max_w / 1000.0 * hrs
             cap = inv.capacity_kwh
             if cap:
@@ -309,6 +313,75 @@ def trade_runs(c, plan, verdict, day0, day1, now, shadow):
     return runs, later, None
 
 
+PRICE_MODES = (LEFTOVER_SOLAR, CHEAP_HOURS)
+
+
+def mode_runs(c, day0, day1, now, shadow):
+    """OPT-11 P3: each battery's price runs today, as the control cycle keeps
+    them (`c.mode_runs`): the cheap run on the batteries that may charge
+    from the grid, the give runs on Leftover solar and Cheap hours, and the
+    sell run on those with selling on. Amounts are upper bounds ("up to"),
+    from the battery's own room, rating and the run's length. Returns
+    `(runs, no_trade_key)`."""
+    rp = getattr(c, "mode_runs", None)
+    if getattr(c, "mode_tick", None) is None:
+        return [], None             # no cycle yet: nothing is known
+    if rp is None:
+        return [], "no_prices"
+    if not rp.on:
+        return [], "not_worth"
+    floor, ceiling = arbitrage.soc_bounds(c.o)
+    out = []
+    for i, inv in enumerate(c.inverters):
+        pm = c.pack_mode(inv)
+        if not pm.use or pm.mode not in PRICE_MODES:
+            continue
+        soc, cap = inv.soc, inv.capacity_kwh
+
+        def room(kind, hrs):
+            kwh = inv.max_w / 1000.0 * hrs
+            if cap and soc is not None:
+                kwh = min(kwh, max(0.0, (ceiling - soc) if kind == "grid"
+                                   else (soc - floor)) / 100.0 * cap)
+            return kwh
+        blocks = []
+        if rp.charge_useful() and pm.mode in GRID_CHARGE_MODES:
+            blocks.append(("grid", rp.cheap))
+        sell = rp.sell if pm.sell and pm.can_sell else None
+        for g in rp.give:
+            if sell is not None and g.start <= sell.start < g.end:
+                blocks.append(("sell", sell))
+            else:
+                blocks.append(("give", g))
+        for kind, run in blocks:
+            if run.end <= now or not (run.start < day1 and run.end > day0):
+                continue
+            hrs = (run.end - run.start).total_seconds() / 3600.0
+            kwh = room(kind, hrs)
+            if kwh < MIN_KWH:
+                continue
+            price = run.mean_eur_kwh
+            if kind == "grid":
+                what, why, amount = (run_grid_what(kwh, shadow),
+                                     run_cheap_why(price),
+                                     run_grid_amount(kwh * price))
+            elif kind == "sell":
+                # No money line: the price is what the house pays, and a sale
+                # earns the lower injection price (OPT-11 P3 review).
+                what, why, amount = (run_sell_what(kwh, shadow),
+                                     run_dear_why(price), None)
+            else:
+                what, why, amount = (run_give_what(kwh, shadow),
+                                     run_dear_why(price),
+                                     run_give_amount(kwh * price))
+            out.append(_run(i, "give" if kind == "sell" else kind,
+                            max(run.start, day0), min(run.end, day1), day0,
+                            day1, what, why, amount, kwh=kwh,
+                            eur=None if kind == "sell" else kwh * price,
+                            price=price))
+    return out, None
+
+
 def maintenance_runs(c, day0, day1, now, shadow):
     """The monthly battery cycle: under way now, or starting later today.
     The cycle starts in the hour `maintenance_start_hour` names, read as the
@@ -317,8 +390,8 @@ def maintenance_runs(c, day0, day1, now, shadow):
     waiting = []
     for i, (inv, m) in enumerate(zip(c.inverters, c.maints)):
         cfg = m.cfg
-        if not cfg.enabled:
-            continue
+        if not cfg.enabled or _off(c, inv):
+            continue            # OPT-11: no monthly cycle while it is off
         cap = inv.capacity_kwh
         if m.phase != M_IDLE:
             hours = _cycle_hours(m.phase, inv.soc, cap, cfg)
@@ -377,9 +450,10 @@ def _cycle_hours(phase, soc, cap_kwh, cfg):
 
 def peak_run(c, day0, day1, now, shadow, limit_w):
     """While the batteries hold the grid under the peak limit, one block for
-    the current 15-minute period on every battery."""
+    the current 15-minute period on every battery. An Off battery gets it
+    only while it gives power (OPT-11: Off covers only the shortfall)."""
     pg = c.peak_guard
-    if pg is None or not pg.engaged:
+    if not peak_engaged(c):
         return []
     start = now - timedelta(minutes=now.minute % 15, seconds=now.second,
                             microseconds=now.microsecond)
@@ -387,15 +461,17 @@ def peak_run(c, day0, day1, now, shadow, limit_w):
     return [_run(i, "peak", start, end, day0, day1,
                  run_peak_what(pg.ceiling_w or limit_w, shadow),
                  run_peak_why(), None)
-            for i in range(len(c.inverters))]
+            for i, inv in enumerate(c.inverters)
+            if not _off(c, inv) or flow(inv.batt) == "giving"]
 
 
-def house_runs(n, day0, day1, now, shadow):
-    """"Follows the house" for the rest of the day, drawn under the others."""
+def house_runs(n, day0, day1, now, shadow, skip=()):
+    """"Follows the house" for the rest of the day, drawn under the others.
+    `skip`: the batteries that are switched off (OPT-11)."""
     return [_run(i, "house", max(now, day0), day1, day0, day1,
                  run_house_what(shadow), run_house_why(shadow),
                  run_house_amount())
-            for i in range(n)]
+            for i in range(n) if i not in skip]
 
 
 def region_of(opts):
@@ -428,9 +504,17 @@ def build_plan(c, now, shadow, running, held=False, settled=True):
     runs, lines = [], []
     # The control cycle trades on the fresh plan only, so this does too.
     verdict, trade_why = trade_verdict(c, fresh)
+    modes_on = bool(getattr(c, "modes_on", False))
     if running:
-        runs += house_runs(len(c.inverters), day0, day1, now, shadow)
-        if verdict is not None:
+        off = {i for i, inv in enumerate(c.inverters) if _off(c, inv)}
+        runs += house_runs(len(c.inverters), day0, day1, now, shadow, off)
+        if modes_on:
+            # OPT-11 P3: with battery modes on, each battery's price runs.
+            mine, no_trade = mode_runs(c, day0, day1, now, shadow)
+            runs += mine
+            if no_trade:
+                lines.append(line_no_trade(no_trade))
+        elif verdict is not None:
             trade, later, no_trade = trade_runs(c, fresh, verdict, day0, day1,
                                                 now, shadow)
             runs += trade
@@ -507,16 +591,71 @@ def at_zero(inv) -> bool:
     return inv.last_write is not None and abs(inv.last_write) < 1.0
 
 
+def _off(c, inv) -> bool:
+    """OPT-11: is this battery switched off? Only with battery modes on."""
+    return bool(getattr(c, "modes_on", False)) and not c.pack_mode(inv).use
+
+
+def refusing(c, inv) -> int:
+    """SAFETY-52/73: the direction this battery refuses (+1 give, -1 charge,
+    0 none). Per inverter at two or more, the site's own at one."""
+    if len(c.inverters) > 1:
+        return int(getattr(inv, "refused", 0) or 0)
+    return int(getattr(c, "batt_refused", 0) or 0)
+
+
+def peak_engaged(c) -> bool:
+    """The peak guard asks the batteries for power this cycle. Not when it is
+    blind or floor-limited: those are engaged with a 0 W floor (no charging
+    only), so no battery gives power for it."""
+    pg = getattr(c, "peak_guard", None)
+    return bool(pg is not None and pg.engaged and (pg.floor_w or 0.0) > 0.0)
+
+
 def battery_rows(c, shadow, running, held=False):
     shares = {}
     alloc = getattr(c, "allocation", None)
     if shadow and alloc is not None and getattr(alloc, "shares", None):
         shares = dict(alloc.shares)
+    modes_on = bool(getattr(c, "modes_on", False))
+    pms = {inv.name: c.pack_mode(inv) for inv in c.inverters} \
+        if modes_on else {}
+    peak = peak_engaged(c)
+    # OPT-11 P3: each battery's role this cycle and the price runs, as the
+    # control cycle left them.
+    tick = getattr(c, "mode_tick", None) if modes_on else None
+    rp = getattr(c, "mode_runs", None)
+    now = datetime.now(timezone.utc)
     rows = []
     for i, inv in enumerate(c.inverters):
         m = c.maints[i] if i < len(c.maints) else None
         phase = m.phase if m is not None else M_IDLE
         cap = inv.capacity_kwh
+        pm = pms.get(inv.name)
+        off = pm is not None and not pm.use
+        # UX-13 P3: does a Solar first battery that is on come before this one?
+        sf_ahead = any(o.use and o.mode == SOLAR_FIRST
+                       for n, o in pms.items() if n != inv.name)
+        # ...and does another battery refuse to give power, so this one
+        # carries its share (SAFETY-73)?
+        other = next((o.name for o in c.inverters if o is not inv
+                      and refusing(c, o) > 0 and not _off(c, o)), None)
+        role = None if tick is None else tick.roles.get(inv.name)
+        # Only once a cycle has run with modes on (`tick`): before that
+        # nothing is known, so nothing is claimed about the prices.
+        plan = (None if tick is None or pm.mode not in PRICE_MODES
+                else "no_prices" if rp is None
+                else "no_spread" if not rp.on else None)
+        nxt = rp.next_give(now) if rp is not None and rp.on else None
+        at = "" if nxt is None else (
+            f"{hhmm(nxt.start)} - {hhmm(nxt.end)}")
+        why = battery_why(
+            modes_on=modes_on, mode=None if pm is None else pm.mode, off=off,
+            reading=inv.soc is not None and inv.batt is not None,
+            phase=phase, shadow=shadow, running=running, held=held,
+            refused=refusing(c, inv), peak=peak,
+            giving=flow(inv.batt) == "giving", other_refuses=other,
+            sf_ahead=sf_ahead, role=role, plan=plan, has_at=bool(at))
         rows.append({
             "name": inv.name,
             "level_pct": None if inv.soc is None else float(inv.soc),
@@ -530,21 +669,100 @@ def battery_rows(c, shadow, running, held=False):
             "now": battery_now(inv.soc, inv.batt, phase=phase, shadow=shadow,
                                running=running, held=held,
                                would_w=shares.get(inv.name),
-                               settled=at_zero(inv)),
-            # Per-battery reasons arrive with the plan (OPT-11 P3/P4).
-            "why": None,
+                               settled=at_zero(inv), off=off, peak=peak),
+            # UX-13 P3: why it does what "now" says, from what the add-on
+            # knows this cycle. Price and forecast reasons are OPT-11 P3/P4.
+            "why_key": why,
+            "why": why_words(why, name=other, at=at),
         })
-        if getattr(c, "modes_on", False):
+        if modes_on:
             # OPT-11 P1: the battery's switch and mode, for the Batteries
             # screen. Only with battery modes on, so the page is unchanged
-            # without them. UX-13 P3 builds the real screen on these keys.
-            pm = c.pack_mode(inv)
+            # without them.
             rows[-1].update({"use": pm.use, "mode_key": pm.key,
                              "mode_choice": pm.mode,
-                             "mode": mode_word(pm.key)})
+                             "mode": mode_word(pm.key),
+                             # P3: selling, for Leftover solar and Cheap
+                             # hours only (Solar first never sells).
+                             "sell": pm.sell, "can_sell": pm.can_sell,
+                             "role": role})
     return rows
 
 
+def battery_why(*, modes_on, mode, off, reading, phase, shadow, running,
+                held, refused, peak, sf_ahead, giving=False,
+                other_refuses=None, role=None, plan=None,
+                has_at=False) -> str:
+    """The key of one battery's "why" line (`home_words.why`), most urgent
+    first. Pure, so every branch is tested without a controller."""
+    if not reading:
+        return "no_reading"
+    if held:
+        return "held"
+    if not running:
+        return "stopped"
+    if shadow:
+        return "shadow"
+    if phase != M_IDLE:
+        return "cycle_mode" if modes_on else "cycle"
+    if off:
+        # Off gives way to the peak limit only (OPT-11 design section 2).
+        return "off_peak" if peak and giving else "off"
+    if refused:
+        return "refuses_give" if refused > 0 else "refuses_charge"
+    if peak:
+        return "peak"
+    if giving and other_refuses:
+        return "other_refuses"
+    if not modes_on:
+        return "modes_off"
+    # OPT-11 P3: the battery's role in the price runs this cycle.
+    if role in ROLE_WHY:
+        if role == "hold" and not has_at:
+            return "saves_later"
+        return ROLE_WHY[role]
+    if plan in ("no_prices", "no_spread"):
+        return plan
+    if giving:
+        return "covers_house"
+    if mode in PRICE_MODES:
+        return "leftover" if sf_ahead else "leftover_alone"
+    return "solar_first"
+
+
+# OPT-11 P3: a role (modetrade) -> its Why key.
+ROLE_WHY = {"charge": "grid_charge", "rest": "rests_charge",
+            "sell": "selling", "give": "expensive", "hold": "saves"}
+
+
+def attach_today(rows, runs, *, modes_on, running=True, held=False,
+                 shadow=False) -> None:
+    """UX-13 P3: each battery's runs today from the plan (the same blocks as
+    Home's chart), or one line saying there are none. With battery modes on,
+    a Leftover solar or Cheap hours battery with no price run left today
+    says so; the others follow the house."""
+    for i, row in enumerate(rows):
+        mine = [r for r in runs if r["battery"] == i and r["kind"] != "house"]
+        row["today"] = [{"from": r["from"], "to": r["to"], "kind": r["kind"],
+                         "what": r["what"]} for r in mine]
+        if mine:
+            row["today_line"] = ""
+        elif held:
+            row["today_line"] = today_words("held")
+        elif not running:
+            row["today_line"] = today_words("stopped")
+        elif row.get("use") is False:
+            row["today_line"] = today_words("off")
+        elif modes_on and row.get("mode_choice") in PRICE_MODES:
+            # OPT-11 P3: a price mode with no run left today, or no plan
+            # made yet (no cycle has run with modes on).
+            row["today_line"] = today_words("no_runs" if row.get("role")
+                                            else "not_planned")
+        else:
+            row["today_line"] = today_words("house_would" if shadow
+                                            else "house")
+
+
 # Row id -> the DOCS.md heading under Notifications, where one exists.
 ATTN_DOCS = {
     "meter_frozen": messages.T_METER_FROZEN,
@@ -640,6 +858,11 @@ def _build(c, *, level, checks, now):
     running = (bool(c.auto) or shadow) and not held
     settled = all(at_zero(inv) for inv in c.inverters)
     ctl = next((r for r in checks if r.get("id") == "controller"), None)
+    rows = battery_rows(c, shadow, running, held)
+    plan = build_plan(c, now, shadow, running, held=held, settled=settled)
+    attach_today(rows, plan["runs"],
+                 modes_on=bool(getattr(c, "modes_on", False)),
+                 running=running, held=held, shadow=shadow)
     return {
         "state": {"kind": kind, "pill": pill(kind),
                   "ran": ctl.get("text", "") if ctl else "",
@@ -647,9 +870,9 @@ def _build(c, *, level, checks, now):
         "now": now_block(grid_w=c.grid, pv_w=c.pv_w, batt_w=c.site_batt_w,
                          has_solar=bool(c.pv_roster), shadow=shadow,
                          settled=settled),
-        "batteries": battery_rows(c, shadow, running, held),
-        "plan": build_plan(c, now, shadow, running, held=held,
-                           settled=settled),
+        "batteries": rows,
+        "plan": plan,
+        "modes_on": bool(getattr(c, "modes_on", False)),
         "attention": ([{"severity": INFO, "id": "shadow",
                          "title": attn_shadow(), "body": attn_shadow_body(),
                          "docs": None}] if shadow else []) + attention(checks),
@@ -811,7 +1034,7 @@ def tile_batt(batt_w, shadow, settled=True) -> str:
 
 
 def battery_now(soc, batt_w, *, phase, shadow, running, held=False,
-                would_w=None, settled=True) -> str:
+                would_w=None, settled=True, off=False, peak=False) -> str:
     if soc is None or batt_w is None:
         return _t("now.no_reading")
     zero = _zero(settled)
@@ -828,6 +1051,14 @@ def battery_now(soc, batt_w, *, phase, shadow, running, held=False,
         return _t("now." + {M_DRAIN: "cycle_drain", M_CHARGE: "cycle_charge",
                             M_HOLD: "cycle_hold"}.get(phase, "cycle"))
     st = flow(batt_w)
+    if off:
+        # OPT-11: an Off battery is asked for 0 W, but the peak limit may
+        # still need it. Say which, and never "0 W" beside a power figure.
+        if st == "resting":
+            return _t("now.off_resting")
+        if st == "giving" and peak:
+            return _t("now.off_peak", kw=_kw(batt_w))
+        return _t("now.off_going", kw=_kw(batt_w))
     if st == "giving":
         return _t("now.giving", kw=_kw(batt_w))
     if st == "charging":
@@ -835,6 +1066,18 @@ def battery_now(soc, batt_w, *, phase, shadow, running, held=False,
     return _t("now.resting")
 
 
+def why_words(key, name=None, at="") -> str:
+    """One battery's "why" line (UX-13 P3), from `battery_why()`'s key.
+    `name`: the battery that refuses, for `other_refuses`; `at`: the
+    give run's time, for `saves`."""
+    return _t("why." + key, name=name or "", at=at)
+
+
+def today_words(key) -> str:
+    """One battery's "today" line when the plan has no run for it."""
+    return _t("today." + key)
+
+
 def plan_head(key, shadow, settled=True) -> str:
     if key == "held":
         return _t("head.held" if settled else "head.held_going")
@@ -859,6 +1102,18 @@ def run_grid_amount(eur) -> str:
     return _t("run.grid_amount", eur=_eur(eur))
 
 
+def run_sell_what(kwh, shadow) -> str:
+    return _w(shadow, "run.sell_what", kwh=_kwh(kwh))
+
+
+def run_cheap_why(price) -> str:
+    return _t("run.cheap_why", eur=_eur(price))
+
+
+def run_dear_why(price) -> str:
+    return _t("run.dear_why", eur=_eur(price))
+
+
 def run_give_what(kwh, shadow) -> str:
     return _w(shadow, "run.give_what", kwh=_kwh(kwh))
 
@@ -1039,6 +1294,14 @@ def _samples() -> list:
             ("plan", line_region("flanders", 2026)),
             ("plan", line_region("own", None)),
             ("plan", line_peak_not_covered())]
+    for off in (False, True):
+        for peak in (False, True):
+            for w in (2500, -2500, 0, 500):
+                out.append(("plan", battery_now(62, w, phase=M_IDLE,
+                                                shadow=False, running=True,
+                                                off=off, peak=peak)))
+    out += [("plan", why_words(k, name="Battery A")) for k in words["why"]]
+    out += [("plan", today_words(k)) for k in words["today"]]
     out += [("plan", line_no_trade(k)) for k in
             ("not_covered", "no_prices", "peak", "not_firm", "not_worth",
              "no_level")]

goodwe_controller/app/main.py

@@ -37,11 +37,13 @@ import aiohttp
 
 from . import arbitrage
 from .arbiter import (
-    P_LOOP, P_MAINT_SHAPE, P_MAINTENANCE, P_MODE, P_PEAK, P_SAFETY,
-    Claim, Resolution, actuator_for, pre_resolve, resolve,
+    ACTUATOR_SITE, P_LOOP, P_MAINT_SHAPE, P_MAINTENANCE, P_MODE, P_PEAK,
+    P_SAFETY, SET, Claim, Resolution, actuator_for, pre_resolve, resolve,
 )
 from . import allocator
+from . import modetrade
 from . import packmode
+from . import priceruns
 from . import control as _ctl
 from .control import Tuning, compute, maintenance_charge_floor, peak_at_risk
 from .delivery import (
@@ -72,14 +74,17 @@ from .maintenance import (
     IDLE, POWER_MOVING, MaintConfig, Maintenance, MaintResult,
     arbitrate as maint_arbitrate,
 )
-from .mqtt import (MqttPublisher, announced_units, optional_keys, unit_slugs,
-                   unit_state_key)
+from .mqtt import (MODE_CONFIGS_KEY, MODE_LABELS, USE_OFF, USE_ON,
+                   MqttPublisher, announced_units, mode_configs,
+                   optional_keys, parse_command, unit_slugs, unit_state_key)
 from . import peakguard
 from . import packshare
 from . import pv as pv_read
 from . import shadow
 from .p1 import P1Ingest, build_source, is_enabled
-from .price import Uncertainty, brussels, price_option, provider_configured
+from .price import Absence, Uncertainty, brussels, price_option, provider_configured
+from .price import required_spread as price_required_spread
+from .price import uncertainty_of as price_uncertainty_of
 from .price_history import PriceHistory
 from .static_tariff import resolve_tariff, static_status
 from .tariff import PeakStore, PeakTracker
@@ -225,6 +230,24 @@ def load_options() -> dict:
 
 
 
+# OPT-11 P3: how long the last cheap run stays the price stored energy is
+# valued at (`priceruns.plan(ref_eur_kwh=)`): the rest of that day.
+REF_CHEAP_KEEP = timedelta(hours=12)
+
+
+def why_raised(resolution, claims) -> bool:
+    """F2 (OPT-11 P1 test): did the limit that bound the site target push it
+    ABOVE what the winner asked (the peak floor asking for more power)? Then
+    the Why line must not say "held back". False when nothing bound it."""
+    if not resolution.bound_by or resolution.contradiction:
+        return False
+    asked = next((c.value for c in sorted(
+        (c for c in claims if c.kind == SET
+         and c.actuator == ACTUATOR_SITE and c.source == resolution.winner),
+        key=lambda c: c.priority, reverse=True)), None)
+    return asked is not None and resolution.target_w > float(asked)
+
+
 def pack_energy_of(inv):
     """OPT-09. ONE roster entry as the view `packshare` consumes.
 
@@ -893,17 +916,40 @@ class Controller:
         # every option family this file builds: no numeric fallback in main.py
         # that config.yaml has not shipped.
         self.peak_guard = None
+        # SAFETY-79. The guard aims this far under `peak_cap_w`; the bill and
+        # every report keep the real cap (`self.peak.cap_w`).
+        self.peak_margin_w = float(opts.get(
+            "peak_margin_w", peakguard.PEAK_OPTION_DEFAULTS["peak_margin_w"]))
         self._peak_engaged = False
         self._peak_saturated = False
+        # SAFETY-81: what the alarm is graded on, beside the guard's decision.
+        self._peak_proj = None
+        self._peak_batt_prev = None
+        self._peak_alarm_block = None
+        self._peak_high_since = None
         self._peak_floor_limited = False
         self._maint_shape_suspended = False
         # OPT-11. Battery modes, off by default so an install that has not
         # turned them on behaves exactly as before (SAFETY-10 section 1). Each
         # battery's mode and on/off switch live in the store, not in options,
         # so a change applies at once (`pack_use`, `pack_mode` actions).
-        self.modes_on = opts.get("battery_modes_enabled") is True
+        self.modes_on = packmode.enabled(opts)
         # The units whose mode fault is logged already (edge-logged).
         self._mode_faults = set()
+        # OPT-11 P3: the price runs (`priceruns.RunPlan`, or None), the key
+        # they were built for, this tick's roles (`modetrade.Tick`), the
+        # batteries that left a run (full, or at the floor) keyed by the run,
+        # and whether last tick filed a mode trade (a run edge reseeds).
+        self.mode_runs = None
+        self._runs_key = None
+        self.mode_tick = None
+        self._run_done = {}
+        self._mode_trade_was = False
+        self._charge_blocked_q = None
+        self._ref_cheap = None
+        # OPT-11 P2: (topic, reason) of MQTT commands refused and logged once.
+        self._mqtt_refused = set()
+        self._mqtt_refused_more = 0
         # [(pack name, why)] for packs that are due and waiting their turn.
         # Empty at a roster of one, where nothing can defer anything.
         self._maint_deferred = []
@@ -1823,6 +1869,11 @@ class Controller:
         """
         return float(sum(inv.rating_w() for inv in self.inverters))
 
+    def peak_aim_w(self) -> float:
+        """SAFETY-79. `peak_cap_w` less `peak_margin_w`: what the forecast
+        checks aim at. Reports and the bill use the real cap."""
+        return float(self.o.get("peak_cap_w", 3500)) - self.peak_margin_w
+
     def site_dev_bound(self, which: str):
         """The roster's summed device floor / ceiling, or None if unknown.
 
@@ -1969,7 +2020,11 @@ class Controller:
         # OPT-11: the solar order. While the site charges, Leftover solar
         # batteries weigh 0, so Solar first batteries fill first. A comfort
         # choice like the rest of this method: permission is the mode claim.
-        return packmode.charge_weights(base, self.pack_modes(), target_w)
+        w = packmode.charge_weights(base, self.pack_modes(), target_w)
+        # P3: in a price run, the batteries whose run it is carry it first.
+        tick = self.mode_tick
+        return w if tick is None else modetrade.weights(tick.roles, w,
+                                                        target_w)
 
     def pack_mode(self, inv) -> "packmode.PackMode":
         """OPT-11. This battery's on/off switch and mode, read from the store."""
@@ -1998,6 +2053,214 @@ class Controller:
                   for u in self.units}
         return allocator.loop_bound(bounds, live=self.live_units())
 
+    # --- OPT-11 P3: price runs, per battery -------------------------------
+    def _mode_packs(self, maint_results=None) -> list:
+        """Each battery as `modetrade.Pack`, in roster order."""
+        live = set(self.live_units())
+        out = []
+        for i, inv in enumerate(self.inverters):
+            pm = self.pack_mode(inv)
+            idle = (maint_results is None
+                    or maint_results[i].phase == IDLE)
+            refused = (inv.refused if len(self.inverters) > 1
+                       else self.batt_refused) or 0
+            out.append(modetrade.Pack(
+                inv.name, pm.use, pm.mode, pm.sell and pm.can_sell,
+                float(inv.max_w), inv.soc, inv.capacity_kwh,
+                live=inv.name in live, idle=idle, refused=int(refused)))
+        return out
+
+    def _price_runs(self, now, packs, floor_pct, ceiling_pct):
+        """The kept run plan, rebuilt at most once per price slot (15 min) or
+        when the prices or a battery's choice change; a run under way is
+        kept to its end (`priceruns.keep_started()`). None with no fresh
+        firm prices: then no battery holds or trades (design section 5)."""
+        plan = self.fresh_tariff_plan(now)
+        if plan is None or not plan.has_prices:
+            self.mode_runs, self._runs_key = None, None
+            return None
+        slot = int(now.timestamp() // 900)
+        key = (id(plan), slot, tuple((p.name, p.use, p.mode, p.sell)
+                                     for p in packs))
+        if key != self._runs_key:
+            done_c = self._run_done.get("charge", (None, set()))[1]
+            done_s = self._run_done.get("sell", (None, set()))[1]
+            e = modetrade.energy(packs, floor_pct, ceiling_pct, done_c,
+                                 done_s)
+            required = price_required_spread(
+                arbitrage.threshold_eur_kwh(self.o),
+                price_uncertainty_of(plan.read.product)
+                | {Uncertainty.NO_WEATHER})
+            ref = self._ref_cheap
+            if ref is not None and now - ref.end > REF_CHEAP_KEEP:
+                ref = self._ref_cheap = None
+            new = priceruns.plan(
+                plan.read.points, now, required_eur_kwh=required,
+                charge_kwh=e[0], charge_kw=e[1], sell_kwh=e[2],
+                sell_kw=e[3],
+                ref_eur_kwh=None if ref is None else ref.mean_eur_kwh)
+            self.mode_runs = priceruns.keep_started(self.mode_runs, new, now)
+            self._runs_key = key
+        runs = self.mode_runs
+        # The cheapest cheap run under way lately is the price the stored
+        # energy was bought at; it stays the reference for REF_CHEAP_KEEP
+        # after it ends, unless a cheaper one comes.
+        ref = self._ref_cheap
+        if runs is not None and runs.cheap is not None \
+                and runs.cheap.holds(now) and (
+                    ref is None or now - ref.end > REF_CHEAP_KEEP
+                    or runs.cheap.mean_eur_kwh <= ref.mean_eur_kwh):
+            self._ref_cheap = runs.cheap
+        return runs
+
+    def _mode_roles(self, now, maint_results):
+        """OPT-11 P3: each battery's role and range this tick. Grid charging
+        and selling need a fresh plan that `TariffPlan.arbitrage()` allows
+        with the MEASURED peak guard (None refuses: nothing measures the
+        quarter), exactly the gate `arbitrage.decide()` has."""
+        floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
+        packs = self._mode_packs(maint_results)
+        runs = self._price_runs(now, packs, floor_pct, ceiling_pct)
+        guard = arbitrage.guard_state(self.peak_guard)
+        plan = self.fresh_tariff_plan(now)
+        charge_ok = sell_ok = False
+        trade_why = "not_covered"
+
+        def allowed(active):
+            return plan.arbitrage(
+                peak_guard_active=active,
+                min_spread_eur_kwh=arbitrage.threshold_eur_kwh(self.o),
+                uncertainty=frozenset({Uncertainty.NO_WEATHER})).match(
+                    allowed=lambda _v: True, refused=lambda _v: False)
+        if guard is not None and plan is not None and runs is not None:
+            # A charge asks the guard (section 9.1 interlock); a sell only
+            # needs it to have measured the quarter, since discharge is never
+            # capped by it (a big discharge alone engages it on export).
+            sell_ok = allowed(False)
+            charge_ok = sell_ok and allowed(guard)
+            trade_why = (None if charge_ok else "peak" if sell_ok
+                         else "not_worth")
+        price_now = None
+        if plan is not None:
+            try:
+                pt = plan.read.match(series=lambda r: r.at(now),
+                                     no_data=lambda _r: None)
+                price_now = (None if pt is None or pt.provisional
+                             else float(pt.eur_per_kwh))
+            except Absence:
+                price_now = None
+        house = (None if self.grid is None or self.site_batt_w is None
+                 else float(self.grid) + float(self.site_batt_w))
+        done_c = self._run_mark("charge", runs and runs.cheap, packs,
+                                lambda p: p.soc is not None
+                                and p.soc >= ceiling_pct)
+        done_s = self._run_mark("sell", runs and runs.sell, packs,
+                                lambda p: p.soc is not None
+                                and p.soc <= floor_pct)
+        quarter = int(now.timestamp() // 900)
+        was = self.mode_tick is not None and \
+            self.mode_tick.action == modetrade.CHARGE
+        self.mode_tick = modetrade.decide(
+            runs, now, packs, charge_ok=charge_ok, sell_ok=sell_ok,
+            trade_why=trade_why, price_now=price_now,
+            headroom_w=self.arb_headroom_w, floor_pct=floor_pct,
+            ceiling_pct=ceiling_pct, house_w=house, charging_now=was,
+            blocked=self._charge_blocked_q == quarter,
+            done_charge=done_c, done_sell=done_s)
+        # A charge the guard or the headroom stopped stays off this period.
+        if was and self.mode_tick.action != modetrade.CHARGE and \
+                self.mode_tick.why in ("peak", "headroom"):
+            self._charge_blocked_q = quarter
+        return self.mode_tick
+
+    def _run_mark(self, kind, run, packs, out) -> set:
+        """The batteries that left run `run` (full, or at the floor); they
+        stay out until it ends, so a level edge does not re-arm them."""
+        key = None if not run else (run.start, run.end)
+        was_key, done = self._run_done.get(kind, (None, set()))
+        if key != was_key:
+            done = set()
+        if key is not None:
+            done |= {p.name for p in packs if out(p)}
+        self._run_done[kind] = (key, done)
+        return done
+
+    def _mode_trade(self, claims, now) -> bool:
+        """OPT-11 P3: file the site trade the roles ask for, sized inside the
+        modes and the hard limits (the loop bound) and, for a charge, the
+        billed quarter's headroom (SAFETY-45, aim cap - margin, SAFETY-79).
+        So no battery that its mode or a refusal holds is asked for watts it
+        may not give (P1's unmet share). Returns True when a trade is filed.
+        """
+        tick = self.mode_tick
+        if tick is None:
+            return False
+        size = modetrade.size(tick, self.loop_bound(claims)
+                              if tick.action else None, self.arb_headroom_w)
+        runs = self.mode_runs
+        if tick.action and (size == 0.0 or runs is None):
+            # Nothing the batteries may place (a refusal, a hard limit): no
+            # trade, and the roles say so rather than "charging".
+            back = {modetrade.CHARGE: modetrade.HOLD,
+                    modetrade.REST: modetrade.HOUSE,
+                    modetrade.SELL: modetrade.GIVE}
+            tick = self.mode_tick = modetrade.Tick(
+                tick.ranges, {n: back.get(r, r) for n, r in tick.roles.items()},
+                None, 0.0, "size")
+        if size == 0.0 or runs is None:
+            reason = ("battery modes: no price run now" if tick.why is None
+                      else f"battery modes: no trade ({tick.why})")
+            self.arb = arbitrage.ArbitrageDecision(
+                action=None, power_w=None, reason=reason,
+                spread_eur_kwh=None, required_eur_kwh=None,
+                price_now_eur_kwh=None)
+        else:
+            charge = tick.action == modetrade.CHARGE
+            run = runs.cheap if charge else runs.sell
+            who = ", ".join(n for n, r in sorted(tick.roles.items())
+                            if r == tick.action)
+            act = arbitrage.CHARGE if charge else arbitrage.DISCHARGE
+            self.arb = arbitrage.ArbitrageDecision(
+                action=act, power_w=size,
+                reason=(f"{act}: battery modes, "
+                        f"{'cheap' if charge else 'sell'} run "
+                        f"{run.start.isoformat()} to {run.end.isoformat()} "
+                        f"at {run.mean_eur_kwh:.4f} EUR/kWh; "
+                        f"{abs(size):.0f} W on {who}"),
+                spread_eur_kwh=None, required_eur_kwh=runs.level_eur_kwh,
+                price_now_eur_kwh=None)
+            claims.append(arbitrage.claim(self.arb))
+        if self.arb.action != self._arb_action:
+            self._arb_action = self.arb.action
+            self.log_event(self.arb.explain(), hint=messages.hint(
+                "trade_charge" if self.arb.action == arbitrage.CHARGE else
+                "trade_give" if self.arb.action == arbitrage.DISCHARGE
+                else "trade_off"))
+        return self.arb.action is not None
+
+    def _reseed_run_edge(self, claims) -> None:
+        """OPT-11 P3: a mode trade just ended, so the loop takes over from a
+        command no loop chose. Start it at the house's own point E, the
+        command that brings the grid to its target now (`site battery + grid
+        - target`, inside the loop bound), instead of at the trade's watts
+        (the trade began with the same unslewed step). This tick's error still
+        measures the trade's command (it is exactly E - battery), so the
+        integrator is seeded that much short and lands on E after its step.
+        Measured (tools/opt11p3_replay.py, lagged battery, 2.5 kW charge
+        ending under an 800 W house): no reseed -258 W export then a 2976 W
+        import, settled in 55 s; this -257 W / +615 W, settled in 20 s.
+        """
+        batt = self.site_batt_w
+        if batt is None or self.grid is None:
+            return
+        want = float(batt) + float(self.grid) - self.tuning.target_grid_w
+        bound = self.loop_bound(claims)
+        if bound is not None:
+            want = max(bound[0], min(bound[1], want))
+        want = float(round(max(-self.site_max_w, min(self.site_max_w, want))))
+        self.target = want
+        self.i_w = want - self.tuning.gain * (want - float(batt))
+
     def _mode_fault_log(self, resolution) -> None:
         """OPT-11: say once, per battery, that its mode was dropped as a fault.
 
@@ -2019,7 +2282,8 @@ class Controller:
         self._mode_faults = now
 
     def _pack_action(self, what, unit, value, now) -> dict:
-        """OPT-11: switch one battery on or off, or set its mode.
+        """OPT-11: switch one battery on or off, set its mode, or (P3) turn
+        its selling on or off.
 
         Store state, not an option, so it applies on the next cycle with no
         restart. Written to the action log. Switching a battery off also stops
@@ -2043,6 +2307,15 @@ class Controller:
             if not value:
                 self._maint_stop_off(self.maints[self.inverters.index(inv)],
                                      now)
+        elif what == "pack_sell":
+            if not packmode.SELLING_ENABLED:
+                return {"error": messages.pack_refused("sell_off")}
+            if not isinstance(value, bool):
+                return {"error": messages.pack_refused("value")}
+            inv.store_set(packmode.SELL_KEY, value)
+            self.log_event(f"{inv.name} selling switched "
+                           f"{'on' if value else 'off'} by operator",
+                           hint=messages.hint("pack_sell", unit=inv.name))
         else:
             if value not in packmode.MODES:
                 return {"error": messages.pack_refused("value")}
@@ -2051,7 +2324,69 @@ class Controller:
                            f"by operator",
                            hint=messages.hint("pack_mode", unit=inv.name))
         pm = self.pack_mode(inv)
-        return {"unit": inv.name, "use": pm.use, "mode": pm.mode}
+        out = {"unit": inv.name, "use": pm.use, "mode": pm.mode}
+        if what == "pack_sell":
+            out["sell"] = pm.sell
+        return out
+
+    def mode_values(self) -> dict:
+        """OPT-11 P2: each battery's mode and switch, for their HA state
+        topics. Read from the store, so they are right after a restart. Empty
+        while battery modes are off."""
+        if not self.modes_on:
+            return {}
+        out = {}
+        names = [inv.name for inv in self.inverters]
+        for inv, slug in zip(self.inverters, unit_slugs(names)):
+            pm = self.pack_mode(inv)
+            out[unit_state_key(slug, "mode")] = MODE_LABELS.get(pm.mode,
+                                                               pm.mode)
+            out[unit_state_key(slug, "use")] = USE_ON if pm.use else USE_OFF
+        return out
+
+    async def mqtt_command(self, topic, payload, retained) -> None:
+        """OPT-11 P2: one command from a battery's HA switch or mode list.
+
+        It goes through handle_action(), the page's /action path, so the
+        checks and the store write are the same. A retained command (one the
+        broker replays on subscribe, e.g. after a restart) is never applied:
+        the store already holds the last choice. A refusal is logged once per
+        topic and reason, at most 32, and further refusals are counted in the
+        log at 1, 10, 100 and so on. Never raises: MQTT must not reach control.
+        """
+        try:
+            slug, action, value, why = parse_command(
+                topic, payload, retained, packmode.MODES)
+            if why is None:
+                names = [inv.name for inv in self.inverters]
+                unit = dict(zip(unit_slugs(names), names)).get(slug)
+                result = await self.handle_action(action, unit=unit,
+                                                  value=value)
+                if not (isinstance(result, dict) and "error" in result):
+                    self.mqtt.publish(self.mode_values())
+                    return
+                why = result["error"]
+            else:
+                why = messages.pack_refused(why)
+            # Printable only: a topic is sender-chosen, so no log injection.
+            topic_s = "".join(c if c.isprintable() else "?"
+                              for c in str(topic)[:128])
+            _LOG.debug("Home Assistant command %s %s refused: %s", topic_s,
+                       repr(payload)[:48], why)
+            if (topic_s, why) in self._mqtt_refused \
+                    or len(self._mqtt_refused) >= 32:
+                # Not logged again, but counted: 1, 10, 100... stay visible.
+                self._mqtt_refused_more += 1
+                more = self._mqtt_refused_more
+                if str(more).rstrip("0") == "1":
+                    _LOG.warning("Home Assistant commands still ignored: %d "
+                                 "more so far.", more)
+                return
+            self._mqtt_refused.add((topic_s, why))
+            _LOG.warning("Home Assistant command on %s ignored: %s", topic_s,
+                         why)
+        except Exception:                               # noqa: BLE001
+            _LOG.exception("Home Assistant command could not be handled")
 
     def _maint_stop_off(self, machine, now) -> None:
         """OPT-11: stop this battery's maintenance cycle because it is off."""
@@ -3382,14 +3717,17 @@ class Controller:
         # is not measured on that path, and the honest report is NOT COVERED -
         # the same answer, for the same reason, that the status page already
         # gives for SAFETY-18 on a transport that cannot see `unchanged_s`.
+        self._peak_proj = (None if not self.p1_enabled
+                           else self.peak.project(self.p1.averager, now))
         self.peak_guard = None if not self.p1_enabled else peakguard.decide(
-            self.peak.project(self.p1.averager, now),
+            self._peak_proj,
             # ⚠️ THE SITE SUM. The guard sizes a floor from what the battery is
             # ALREADY removing from the meter, and the meter sees every
             # inverter. One unit's power here would size the floor from a
             # fraction of the discharge already happening.
             batt_w=self.site_batt_w,
             cap_w=float(self.o.get("peak_cap_w", 3500)),
+            margin_w=self.peak_margin_w,
             reading=self.peak.peak(now),
             # ⚠️ SUMMED FROM THE PER-UNIT CONJUNCTION, WHICH IS AC 4. Each
             # unit contributes `min(its max_w, |its own device bounds|)`, so
@@ -3506,15 +3844,20 @@ class Controller:
         # decision presented as current.
         self.arb, self.arb_at = None, now
         self.arb_headroom_w = None
-        if arbitrage.enabled(self.o):
-            floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
-            charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
+        # OPT-11 P3: with battery modes on, each battery's mode decides who
+        # trades (`_mode_roles()`, `_mode_trade()`, below, which read the
+        # same headroom), and this site-wide trade is not run.
+        site_trade = arbitrage.enabled(self.o) and not self.modes_on
+        if site_trade or self.modes_on:
             # SAFETY-47. HOISTED OUT OF THE CALL, NOT COPIED. One evaluation of
             # the shipped expression feeds both the sizing below and
             # `arbitrage.sized_from_meter()` in `_shadow_settle()`, so the
             # caveat on the recorded watts can never be answered from a
             # different cycle's guard than the watts were.
             self.arb_headroom_w = peakguard.charge_headroom_w(self.peak_guard)
+        if site_trade:
+            floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
+            charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
             self.arb = arbitrage.decide(
                 self.fresh_tariff_plan(now), now,
                 peak_guard_active=arbitrage.guard_state(self.peak_guard),
@@ -3650,8 +3993,7 @@ class Controller:
                 # charge together, this flag would have to become per-pack - and
                 # so would the reasoning above it.
                 if peakguard.shaping_suspended(
-                        self.peak_guard, self.peak_fc,
-                        float(self.o.get("peak_cap_w", 3500))):
+                        self.peak_guard, self.peak_fc, self.peak_aim_w()):
                     # Edge-logged: level-logging here would write one line per
                     # cycle for as long as the event lasts and flush the 40-line
                     # action log of the very context that explains it.
@@ -3678,7 +4020,7 @@ class Controller:
                         # rate the pack in front of us is charging at.
                         floor = maintenance_charge_floor(
                             self.maint.cfg.charge_w,
-                            self.peak_fc, float(self.o.get("peak_cap_w", 3500)))
+                            self.peak_fc, self.peak_aim_w())
                         if floor > 0:
                             hi, reason = -floor, "cheap-window charge"
                     # PER-INVERTER, like the SET above and for the same reason -
@@ -3695,12 +4037,17 @@ class Controller:
         # apart from the hard limits, and it gives way to the peak guard's
         # site floor (P_PEAK) only as far as the floor needs, so the two never
         # meet in a `lo > hi` (arbiter._unit_modes()).
+        # P3: the range is the switch's, narrowed by the battery's role in
+        # the price runs this tick (`modetrade.decide()`); both hold 0 W.
         if self.modes_on:
+            tick = self._mode_roles(now, maint_results)
             for inv, result in zip(self.inverters, maint_results):
                 if result.phase != IDLE:
                     continue
                 pm = self.pack_mode(inv)
                 lo, hi = packmode.mode_range(pm, inv.max_w)
+                rlo, rhi = tick.ranges.get(inv.name, (lo, hi))
+                lo, hi = max(lo, rlo), min(hi, rhi)
                 claims.append(Claim.limit("mode", P_MODE, lo, hi, pm.key,
                                           actuator=self.actuator_of("mode",
                                                                     inv)))
@@ -3751,6 +4098,13 @@ class Controller:
                                           _ctl.REFUSED,
                                           actuator=self.actuator_of("refused",
                                                                     inv)))
+        # --- OPT-11 P3: the site trade, after every unit claim --------------
+        # Sized from what the batteries may place with their modes and hard
+        # limits (the loop bound), so none is asked for watts it may not give.
+        mode_trade, trade_was = False, self._mode_trade_was
+        if self.modes_on:
+            mode_trade = self._mode_trade(claims, now)
+        self._mode_trade_was = mode_trade
         if (self.auto or self.shadow) and self.inputs_ok:
             # ⚠️ prev is the ARBITER's last output, not the loop's own last
             # wish. If something outranked the loop, that is what the hardware
@@ -3768,6 +4122,9 @@ class Controller:
             # stale period as power.
             if self.loop_w is None or self.target != self.loop_w:
                 self.i_w = self.target
+            # OPT-11 P3: a run edge (a mode trade ended) reseeds the loop.
+            if trade_was and not mode_trade:
+                self._reseed_run_edge(claims)
             # SAFETY-52: another writer overrode the loop, so a refusal learned
             # against the loop's own ask no longer describes the wire. A gap
             # (`loop_w` None: blind or stopped) keeps it: the stale-reading stop
@@ -4100,7 +4457,8 @@ class Controller:
         else:
             self.why_words = messages.why(
                 _why, resolution.target_w, resolution.bound_by,
-                contradiction=resolution.contradiction)
+                contradiction=resolution.contradiction,
+                raised=why_raised(resolution, claims))
         # --- DEV-02: EACH INVERTER IS TOLD ITS OWN SHARE ---------------------
         # ⚠️ ITS OWN SHARE, NEVER THE SITE TARGET. `resolution.shares` is the
         # allocator's answer and `sum(shares) + unmet_w == round(target_w)` is
@@ -4465,22 +4823,56 @@ class Controller:
         available to it. That is the one state where the money is going to be
         spent and a human is the only remaining actuator.
 
+        SAFETY-81: `g.saturated` alone is not enough. It is graded against the
+        aim, and a 1 s meter spike, noise or the last seconds of a quarter set
+        it while the quarter lands on target; `peakguard.load_too_high()` must
+        agree too, for `ALARM_HOLD_S`. The battery reading it gets is the lower
+        of this cycle's and the last one's - see there.
+
         Edge-triggered, and de-asserting arms it again - the same shape as
         FreezeWatchdog's `evaluate()`, and for the same reason: one notification
-        per episode, not one per cycle.
+        per episode, not one per cycle. SAFETY-81: the notification and action
+        log line at most once per quarter; the ERROR line once per episode.
         """
         g = self.peak_guard
-        saturated = bool(g is not None and g.saturated)
+        batt, prev = self.site_batt_w, self._peak_batt_prev
+        if batt is None:
+            # Unknown, not "fine": the hold below neither grows nor restarts.
+            return
+        self._peak_batt_prev = batt
+        if prev is not None:
+            batt = min(float(batt), float(prev))
+        p = self._peak_proj
+        high = bool(
+            g is not None and g.saturated and p is not None
+            and p.block_start is not None
+            and peakguard.load_too_high(
+                p, batt_w=batt, ceiling_w=g.ceiling_w,
+                achievable_w=self.site_rating_w))
+        # SAFETY-81: and for ALARM_HOLD_S, on the projection's clock.
+        saturated = False
+        if high:
+            t = p.block_start + timedelta(seconds=float(p.elapsed_s))
+            if self._peak_high_since is None:
+                self._peak_high_since = t
+            saturated = ((t - self._peak_high_since).total_seconds()
+                         >= peakguard.ALARM_HOLD_S)
+        else:
+            self._peak_high_since = None
         was, self._peak_saturated = self._peak_saturated, saturated
         if not saturated or was:
             return
-        self.log_event("PEAK_GUARD_SATURATED - " + g.reason,
-                       hint=messages.hint("peak_saturated"))
         _LOG.error(
             "Switch off large loads, the battery alone cannot keep this "
             "15-minute period under the peak limit: %s.",
             messages.reason_code(g.reason))
         _LOG.debug("Evidence: %s.", g.reason)
+        # SAFETY-81: notified once per quarter; a later episode is logged only.
+        if p.block_start == self._peak_alarm_block:
+            return
+        self._peak_alarm_block = p.block_start
+        self.log_event("PEAK_GUARD_SATURATED - " + g.reason,
+                       hint=messages.hint("peak_saturated"))
         # A fixed notification_id, and a DIFFERENT one from every other alarm
         # here - check_meter_frozen() gives the reasoning. A saturated peak guard
         # is not a frozen meter and is not an out-of-range setpoint.
@@ -5144,6 +5536,8 @@ class Controller:
             values[unit_state_key(slug, "soc")] = inv.soc
             values[unit_state_key(slug, "sign_latch")] = (
                 "tripped" if inv.sign_wd.tripped else "clear")
+        # OPT-11 P2: each battery's mode and switch; nothing while modes are off.
+        values.update(self.mode_values())
         self.mqtt.publish(values)
 
     async def shutdown(self) -> None:
@@ -5860,8 +6254,11 @@ class Controller:
             # instead of inferring it, and separates "trading is off" from "no
             # decision was reached this cycle"; `cycle_at` and `arb_at` are what
             # make the second one an observation rather than a guess.
+            # OPT-11 P3: with battery modes on the modes trade, whatever the
+            # switch says, so the row reports their decision.
             ("Arbitrage", arbitrage_row(
-                on=arbitrage.enabled(self.o), decision=self.arb,
+                on=arbitrage.enabled(self.o) or self.modes_on,
+                decision=self.arb,
                 decided_at=self.arb_at, cycle_at=self.cycle_at,
                 now=datetime.now(timezone.utc), why=self.why_words)),
         ]
@@ -5893,7 +6290,7 @@ class Controller:
 
     async def handle_action(self, what: str, *, unit=None, value=None):
         now = datetime.now(timezone.utc)
-        if what in ("pack_use", "pack_mode"):
+        if what in ("pack_use", "pack_mode", "pack_sell"):
             return self._pack_action(what, unit, value, now)
         if what == "auto_toggle":
             self.auto = not self.auto
@@ -6059,6 +6456,21 @@ class ControlTaskDied(RuntimeError):
     """The control task ended while nothing had asked it to stop."""
 
 
+def mode_announcement(opts, store) -> tuple:
+    """OPT-11 P2: `(modes, retract)` for the MQTT publisher at start-up.
+
+    The config topics announced are kept in the store, so turning modes off
+    removes exactly those (`mqtt.mode_configs()`). An install that never
+    turned modes on gets nothing, and its store is not written.
+    """
+    modes = packmode.MODES if packmode.enabled(opts) else ()
+    stored = store.data.get(MODE_CONFIGS_KEY)
+    keep, retract = mode_configs(roster_names(opts), modes, stored)
+    if keep and keep != stored:
+        store.set(MODE_CONFIGS_KEY, keep)
+    return modes, retract
+
+
 def control_task_done(task: asyncio.Task, *, controller, stop: asyncio.Event,
                       died: list) -> None:
     """Done-callback on the control task: log its death now and wake amain()
@@ -6189,6 +6601,9 @@ async def amain() -> None:
         # took the control loop down with it.
         broker = None
         try:
+            # OPT-11 P2: each battery's switch and mode list, only while
+            # battery modes are on (`mode_announcement()`).
+            _modes, _retract = mode_announcement(opts, store)
             broker = await hass.mqtt_service()
             pub = MqttPublisher(
                 broker.get("host") if broker else None,
@@ -6208,6 +6623,8 @@ async def amain() -> None:
                 # is what `build_roster()` itself reads. At a roster of one this
                 # announces nothing new - see `announced_units()`.
                 units=roster_names(opts),
+                modes=_modes,
+                retract=_retract,
             )
         except Exception as err:  # noqa: BLE001
             _LOG.warning("MQTT unavailable (%s) - continuing without status entities", err)
@@ -6221,6 +6638,8 @@ async def amain() -> None:
 
         stop = asyncio.Event()
         controller = Controller(opts, hass, store, pub, stop=stop)
+        if callable(getattr(pub, "bind", None)):
+            pub.bind(asyncio.get_running_loop(), controller.mqtt_command)
         runner = await web.start(controller, port=INGRESS_PORT)
 
         loop = asyncio.get_running_loop()

goodwe_controller/app/messages.py

@@ -839,17 +839,22 @@ WHY_LIMIT = {
 }
 
 
-def why(winner, target_w, bound_by=None, *, contradiction=False) -> str:
+def why(winner, target_w, bound_by=None, *, contradiction=False,
+        raised=False) -> str:
     """`winner` is the arbiter's winning source, or its reason for the two
     that share a source ("stopped", "inputs missing", "no claim was made").
-    `bound_by` is `Resolution.bound_by`, e.g. "peak(quarter peak)"."""
+    `bound_by` is `Resolution.bound_by`, e.g. "peak(quarter peak)".
+    `raised` is True when that limit pushed the power UP (the peak limit
+    asking for more): then it did not hold anything back (OPT-11 P1 test F2).
+    """
     if contradiction:
         return "Two limits clash, so every inverter is set to 0 W"
     out = f"{WHY_WINNER.get(winner, 'Other')}: {signed_watts(target_w)}"
     if bound_by:
         limit = WHY_LIMIT.get(bound_by) or WHY_LIMIT.get(
             str(bound_by).split("(")[0], "another limit")
-        out += f", held back by {limit}"
+        out += f", raised for {limit}" if raised else \
+            f", held back by {limit}"
     return out
 
 
@@ -922,6 +927,7 @@ HINTS = {
     "pack_on": "{unit}: battery switched on",
     "pack_off": "{unit}: battery switched off, it is asked for 0 W",
     "pack_mode": "{unit}: battery mode changed",
+    "pack_sell": "{unit}: selling switched",
     "maint_off": "{unit}: maintenance stopped, the battery is switched off",
     "mode_fault": "{unit}: battery mode ignored because of a software fault",
 }
@@ -932,6 +938,13 @@ PACK_REFUSED = {
     "off": "Battery modes are off. Turn on “Battery modes” first.",
     "unit": "There is no battery with that name.",
     "value": "That choice is not possible for this battery.",
+    # OPT-11 P3, owner decision 2026-09-29: selling is off for now.
+    "sell_off": "Selling is off for now.",
+    # OPT-11 P2: a Home Assistant command dropped before it reaches a battery.
+    "retained": "An old saved command is not used.",
+    "size": "That command is too long.",
+    "encoding": "That command is not plain text.",
+    "topic": "That is not a battery command.",
 }
 
 
@@ -1152,6 +1165,7 @@ LABELS = {
     "integrator_max_w": "Catch-up limit",
     "maintenance_discharge_w": "Draw-down rate",
     "peak_cap_w": "Peak limit",
+    "peak_margin_w": "Margin below the peak limit",
     "peak_forecast_entity": "15-minute demand forecast entity",
     "meter_entity": "Grid power entity",
     "soc_entity": "Battery level entity",

goodwe_controller/app/modetrade.py

@@ -0,0 +1,231 @@
+"""OPT-11 P3: each battery's role this tick, from its mode and the price runs.
+
+Pure: no I/O, no clock. main.py hands in the run plan (`priceruns`), each
+battery's state and the peak guard's answers, files each battery's range as
+its `mode` claim (P_MODE), and files the site trade as the `arbitrage` claim
+(P_ARBITRAGE), sized inside the modes (`size()`), only with battery modes on.
+With them off, `arbitrage.decide()` runs exactly as before.
+
+Roles (the page's Why line names them):
+  off      Off: [0, 0].
+  house    follows the house: charges from spare solar, gives power at any
+           hour (Solar first always; the other modes when there is no plan).
+  hold     Leftover solar / Cheap hours outside a give run: may charge from
+           spare solar, gives nothing, so its energy is kept for the run.
+  give     the same inside a give run: covers the house.
+  sell     inside the sell run, with selling on: gives its rating, to the
+           house first and the rest to the grid.
+  charge   inside the cheap run: charges from the grid.
+  rest     another battery charges from the grid, so this one may not charge
+           (the owner's 2026-09-27 answer 3: while one battery charges from the
+           grid the others cannot give power either; the allocator never
+           splits a target both ways).
+
+Rules that keep this safe (tests: test_modes_p3.py):
+  * every range holds 0 W (a mode may forbid a direction, never force one);
+  * a Solar first battery never charges from the grid (no forecast yet, P4);
+  * grid charging needs a measured peak guard that is clear and a measured
+    headroom (SAFETY-45); the trade is sized to that headroom, whose aim is
+    `peak_cap_w - peak_margin_w` (SAFETY-79). It starts only at START_W or
+    more, and once the guard or the headroom stops it, it stays stopped for
+    the rest of that 15-minute period (`blocked`): a charge makes the other
+    batteries stop giving power, so a few watts of charge flipping on and
+    off would swing the house between them and the grid (measured on the
+    2026-09-09 replay: 13 flips in 4 minutes at a 3.5 kW house);
+  * selling needs selling on for that battery, the sell run, a price >= 0
+    now, and the battery above `arbitrage_soc_floor`; it stops there. The
+    peak guard never stops a sell (section 9.1: discharge is never capped);
+    it must only have measured the quarter;
+  * a battery out of a run (full, or at the floor) stays out until the run
+    ends, so the ceiling and the floor do not re-arm within one run;
+  * a battery that refuses a direction (SAFETY-52/73) takes no part in a
+    run in that direction: the refusal wins over the run.
+"""
+
+from dataclasses import dataclass
+
+from .packmode import (CHEAP_HOURS, GRID_CHARGE_MODES, LEFTOVER_SOLAR,
+                       SOLAR_FIRST)
+
+OFF, HOUSE, HOLD, GIVE, SELL, CHARGE, REST = (
+    "off", "house", "hold", "give", "sell", "charge", "rest")
+PRICE_MODES = (LEFTOVER_SOLAR, CHEAP_HOURS)
+
+# The smallest grid charge worth starting, in W. Under it the other batteries
+# would stop covering the house for less than they give.
+START_W = 500.0
+
+
+@dataclass(frozen=True)
+class Pack:
+    """One battery as this module needs it."""
+    name: str
+    use: bool
+    mode: str
+    sell: bool
+    rating_w: float
+    soc: float | None
+    capacity_kwh: float | None
+    live: bool = True
+    idle: bool = True           # not in a maintenance phase
+    refused: int = 0            # SAFETY-52/73: +1 refuses to give, -1 to charge
+
+
+@dataclass(frozen=True)
+class Tick:
+    ranges: dict                # name -> (lo, hi), only for idle batteries
+    roles: dict                 # name -> role
+    action: str | None          # "charge" | "sell" | None
+    ask_w: float                # signed site ask before sizing (0 if none)
+    why: str | None             # why no trade when a run is on, else None
+
+
+def _room_kwh(p: Pack, pct: float) -> float:
+    """kWh to `pct` (charging) or above it (selling); a battery with no
+    capacity set counts one hour at its rating, so a run is still sized."""
+    if p.capacity_kwh is None or p.soc is None:
+        return abs(p.rating_w) / 1000.0
+    return max(0.0, abs(pct - p.soc)) / 100.0 * float(p.capacity_kwh)
+
+
+def chargers(packs, ceiling_pct, done=()) -> list:
+    """Batteries that may charge from the grid in a cheap run: the modes in
+    `packmode.GRID_CHARGE_MODES` (Cheap hours only until P4's forecast)."""
+    return [p for p in packs
+            if p.use and p.idle and p.live and p.mode in GRID_CHARGE_MODES
+            and p.soc is not None and p.soc < ceiling_pct
+            and p.refused >= 0 and p.name not in done]
+
+
+def sellers(packs, floor_pct, done=()) -> list:
+    """Batteries that may sell in the sell run. Solar first never sells."""
+    return [p for p in packs
+            if p.use and p.idle and p.live and p.sell
+            and p.mode in PRICE_MODES
+            and p.soc is not None and p.soc > floor_pct
+            and p.refused <= 0 and p.name not in done]
+
+
+def energy(packs, floor_pct, ceiling_pct, done_charge=(), done_sell=()):
+    """`(charge_kwh, charge_kw, sell_kwh, sell_kw)` for `priceruns.plan()`."""
+    ch = chargers(packs, ceiling_pct, done_charge)
+    se = sellers(packs, floor_pct, done_sell)
+    return (sum(_room_kwh(p, ceiling_pct) for p in ch),
+            sum(abs(p.rating_w) for p in ch) / 1000.0,
+            sum(_room_kwh(p, floor_pct) for p in se),
+            sum(abs(p.rating_w) for p in se) / 1000.0)
+
+
+def decide(runs, now, packs, *, charge_ok, sell_ok, trade_why, price_now,
+           headroom_w, floor_pct, ceiling_pct, house_w, charging_now=False,
+           blocked=False, done_charge=(), done_sell=()) -> Tick:
+    """This tick's ranges, roles and site ask.
+
+    `runs` is the kept `priceruns.RunPlan` or None (no fresh prices).
+    `charge_ok` is True only when `TariffPlan.arbitrage()` allowed a trade
+    this tick with the MEASURED peak guard clear; `sell_ok` when it allowed
+    one with the guard measured (either state); else `trade_why` says why.
+    `headroom_w` is `peakguard.charge_headroom_w()` (None: unmeasured).
+    `house_w` is the measured house (grid + batteries), or None.
+    `charging_now` says last tick charged (then any headroom above 0 keeps
+    it going); `blocked` that the guard or the headroom stopped a charge in
+    this 15-minute period.
+    """
+    plan_on = runs is not None and runs.on
+    in_cheap = plan_on and runs.cheap.holds(now) and runs.charge_useful()
+    in_give = plan_on and runs.give_at(now) is not None
+    in_sell = plan_on and runs.sell is not None and runs.sell.holds(now)
+
+    why = None
+    ch = chargers(packs, ceiling_pct, done_charge) if in_cheap else []
+    charging = False
+    if ch:
+        need = 0.0 if charging_now else START_W
+        if blocked:
+            why = "headroom"
+        elif not charge_ok:
+            why = trade_why
+        elif headroom_w is None or not headroom_w > need:
+            why = "headroom"
+        else:
+            charging = True
+    se = sellers(packs, floor_pct, done_sell) if in_sell and not charging \
+        else []
+    selling = False
+    if se:
+        if not sell_ok:
+            why = why or trade_why
+        elif price_now is None or price_now < 0.0 or house_w is None:
+            why = why or "negative"
+        else:
+            selling = True
+
+    ranges, roles = {}, {}
+    ch_names = {p.name for p in ch} if charging else set()
+    se_names = {p.name for p in se} if selling else set()
+    for p in packs:
+        r = abs(float(p.rating_w))
+        if not p.use:
+            role, lo, hi = OFF, 0.0, 0.0
+        elif p.name in ch_names:
+            role, lo, hi = CHARGE, -r, 0.0
+        elif charging:
+            # Another battery charges from the grid: this one may not charge
+            # (it would be grid charging too), and cannot give (one sign).
+            role, lo, hi = REST, 0.0, (r if p.mode == SOLAR_FIRST
+                                       or not plan_on or in_give else 0.0)
+        elif p.name in se_names:
+            role, lo, hi = SELL, -r, r
+        elif p.mode == SOLAR_FIRST or not plan_on:
+            role, lo, hi = HOUSE, -r, r
+        elif in_give:
+            role, lo, hi = GIVE, -r, r
+        else:
+            role, lo, hi = HOLD, -r, 0.0
+        roles[p.name] = role
+        if p.idle:
+            ranges[p.name] = (lo, hi)
+
+    if charging:
+        ask = -sum(abs(p.rating_w) for p in ch)
+        return Tick(ranges, roles, CHARGE, ask, None)
+    if selling:
+        ask = sum(abs(p.rating_w) for p in se) + max(0.0, float(house_w))
+        return Tick(ranges, roles, SELL, ask, None)
+    return Tick(ranges, roles, None, 0.0,
+                why if (in_cheap or in_sell) else None)
+
+
+def size(tick: Tick, bound, headroom_w) -> float:
+    """The site trade in W, inside what the batteries may place with their
+    modes (`bound` = main's loop bound) and, for a charge, the billed
+    quarter's headroom. 0.0 means no trade (a 0 W trade is a park order and
+    is never filed)."""
+    if tick.action is None or bound is None:
+        return 0.0
+    lo, hi = bound
+    if tick.action == CHARGE:
+        cap = min(-float(tick.ask_w), -float(lo),
+                  float(headroom_w) if headroom_w is not None else 0.0)
+        return -max(0.0, cap)
+    return max(0.0, min(float(tick.ask_w), float(hi)))
+
+
+def weights(roles: dict, base, target_w: float):
+    """Who carries the site target first (design 3.5). Selling: the sellers.
+    Giving power: batteries in a give run before Solar first. Charging from
+    the grid: only the chargers. Otherwise `base` unchanged. Comfort only;
+    the ranges above are the permission."""
+    names = sorted(roles)
+    first = None
+    if target_w > 0 and any(r == SELL for r in roles.values()):
+        first = {n for n in names if roles[n] == SELL}
+    elif target_w > 0 and any(r == GIVE for r in roles.values()):
+        first = {n for n in names if roles[n] in (GIVE, SELL)}
+    elif target_w < 0 and any(r == CHARGE for r in roles.values()):
+        first = {n for n in names if roles[n] == CHARGE}
+    if not first:
+        return base
+    w = {n: (1.0 if base is None else float(base.get(n, 1.0))) for n in names}
+    out = {n: (w[n] if n in first else 0.0) for n in names}
+    return out if any(v > 0.0 for v in out.values()) else base

goodwe_controller/app/mqtt.py

@@ -7,8 +7,10 @@ That separation is deliberate; observability must never be able to take down
 control.
 """
 
+import asyncio
 import json
 import logging
+import re
 
 try:
     import paho.mqtt.client as mqtt
@@ -375,7 +377,26 @@ def _payload(name, object_id, unique_id, state_topic, device,
     return cfg
 
 
-def discovery_payloads(units=(), omit=(), include=()) -> list:
+def unit_unique_id(slug: str, key: str) -> str:
+    """One unit's entity `unique_id` (also its config topic's middle part)."""
+    return f"{BASE}_unit_{slug}_{key}"
+
+
+def _unit_places(names):
+    """`(slug, device, prefix)` for each roster name, in order."""
+    slugs = unit_slugs(names)
+    for i, (name, slug) in enumerate(zip(names, slugs)):
+        # ⚠️ `i == 0` IS THE ASYMMETRY, IN ONE LINE. The first roster entry
+        # keeps the device it already has and carries its name in the ENTITY
+        # name instead; every later one gets its own device and does not.
+        # Either way HA composes device-name + entity-name into the same
+        # string, which is why `object_id` can be written once for both.
+        device = DEVICE if i == 0 else unit_device(name, slug)
+        prefix = f"{_title(name)} " if i == 0 else ""
+        yield slug, device, prefix
+
+
+def discovery_payloads(units=(), omit=(), include=(), modes=()) -> list:
     """Every `(topic, payload)` this add-on announces, in announcement order.
 
     Split out of `_announce()` so that the acceptance criterion can be graded as
@@ -389,6 +410,8 @@ def discovery_payloads(units=(), omit=(), include=()) -> list:
     the output here (`_payload()`'s note, and test_mqtt.py part 1 asserts an
     ordered LIST precisely because a re-order is a zero-byte edit that
     re-announces every entity on a live install).
+
+    `modes` (OPT-11 P2) is the battery modes offered, empty when they are off.
     """
     omit = set(omit)
     include = [k for k in include if k not in omit]
@@ -400,19 +423,10 @@ def discovery_payloads(units=(), omit=(), include=()) -> list:
             f"homeassistant/sensor/{BASE}_{key}/config",
             _payload(name, object_id, f"{BASE}_{key}", f"{BASE}/{key}",
                      DEVICE, unit, dev_class, state_class, icon)))
-    names = announced_units(units)
-    slugs = unit_slugs(names)
     site_slug = _slug(DEVICE["name"])
-    for i, (name, slug) in enumerate(zip(names, slugs)):
-        # ⚠️ `i == 0` IS THE ASYMMETRY, IN ONE LINE. The first roster entry
-        # keeps the device it already has and carries its name in the ENTITY
-        # name instead; every later one gets its own device and does not.
-        # Either way HA composes device-name + entity-name into the same
-        # string, which is why `object_id` below can be written once for both.
-        device = DEVICE if i == 0 else unit_device(name, slug)
-        prefix = f"{_title(name)} " if i == 0 else ""
+    for slug, device, prefix in _unit_places(announced_units(units)):
         for key, oid, label, unit, dev_class, state_class, icon in UNIT_SENSORS:
-            unique_id = f"{BASE}_unit_{slug}_{key}"
+            unique_id = unit_unique_id(slug, key)
             out.append((
                 f"homeassistant/sensor/{unique_id}/config",
                 _payload(prefix + label,
@@ -427,12 +441,135 @@ def discovery_payloads(units=(), omit=(), include=()) -> list:
             f"homeassistant/sensor/{BASE}_{key}/config",
             _payload(name, object_id, f"{BASE}_{key}", f"{BASE}/{key}",
                      DEVICE, unit, dev_class, state_class, icon)))
+    # OPT-11 P2: last, and only when battery modes are on.
+    out.extend(mode_payloads(units, modes))
     return out
 
 
+# --- OPT-11 P2: each battery's switch and mode, as HA entities ---------------
+# Announced only when battery modes are on, after every other row, so no
+# existing row moves. A command goes through Controller.handle_action(), the
+# page's /action path. DECISIONS/OPT-11-battery-modes.md has the record.
+#
+# The select's options are these labels, in `packmode.MODES` order. A new mode
+# (P3) is a new entry here and a new option at the end; no id changes.
+MODE_LABELS = {"solar_first": "Solar first", "leftover_solar": "Leftover solar",
+               "cheap_hours": "Cheap hours only"}         # OPT-11 P3
+USE_ON, USE_OFF = "ON", "OFF"
+# A longer command payload is refused before it is decoded.
+MAX_COMMAND_BYTES = 64
+# The store key holding the mode config topics last announced, so that turning
+# modes off can remove exactly those (an empty retained config) and an install
+# that never turned them on publishes nothing new.
+MODE_CONFIGS_KEY = "mqtt_mode_configs"
+_MODE_CONFIG_RE = re.compile(
+    rf"homeassistant/(select|switch)/{BASE}_unit_[a-z0-9_]+_(mode|use)/config")
+_COMMAND_RE = re.compile(rf"{BASE}/unit/([a-z0-9_]+)/(mode|use)/set")
+# (entity key, HA component, entity name, icon)
+MODE_ENTITIES = [
+    ("mode", "select", "Mode", "mdi:battery-sync"),
+    ("use", "switch", "Use", "mdi:power"),
+]
+
+
+def mode_payloads(units, modes) -> list:
+    """The `(topic, payload)` for each battery's select and switch.
+
+    Every roster entry gets them, also at a roster of one. The device rule is
+    TEL-07's: the first battery's rows go on the site device with its name in
+    front, each later battery's on its own device. Empty when `modes` is empty.
+    """
+    if not modes:
+        return []
+    site_slug = _slug(DEVICE["name"])
+    options = [MODE_LABELS[m] for m in modes]
+    out = []
+    for slug, device, prefix in _unit_places([str(u) for u in units]):
+        for key, component, label, icon in MODE_ENTITIES:
+            unique_id = unit_unique_id(slug, key)
+            state = f"{BASE}/{unit_state_key(slug, key)}"
+            cfg = {
+                "name": prefix + label,
+                "object_id": f"{site_slug}_{slug}_{key}",
+                "unique_id": unique_id,
+                "state_topic": state,
+                "command_topic": f"{state}/set",
+            }
+            if component == "select":
+                cfg["options"] = options
+            else:
+                cfg["payload_on"] = USE_ON
+                cfg["payload_off"] = USE_OFF
+            # HA sends commands unretained; a retained one is ignored anyway.
+            cfg["retain"] = False
+            cfg["availability_topic"] = AVAILABILITY
+            cfg["device"] = device
+            cfg["icon"] = icon
+            out.append((f"homeassistant/{component}/{unique_id}/config", cfg))
+    return out
+
+
+def mode_retractions(stored, current) -> list:
+    """Config topics announced before and not now: each gets an empty
+    retained config, which removes the entity from HA. Anything in the store
+    that is not one of our mode config topics is ignored."""
+    if not isinstance(stored, list):
+        return []
+    keep = set(current)
+    return list(dict.fromkeys(t for t in stored if isinstance(t, str)
+                              and _MODE_CONFIG_RE.fullmatch(t)
+                              and t not in keep))
+
+
+def mode_configs(units, modes, stored) -> tuple:
+    """`(keep, retract)` at start-up: the mode config topics to store, and the
+    ones to remove now. A removal stays in `keep`, so a start with no broker
+    does not forget it; resending an empty config is harmless."""
+    current = [t for t, _ in mode_payloads(units, modes)]
+    retract = mode_retractions(stored, current)
+    return current + retract, retract
+
+
+def parse_command(topic, payload, retained, modes):
+    """`(slug, action, value, reject)` for one message on a command topic.
+
+    `action` is `pack_use` or `pack_mode`. `value` is what /action would be
+    sent: a bool for the switch, a mode key for the select, or None for a
+    payload that is neither (the store path then refuses it). `reject` is a
+    reason when the message is dropped here: replayed by the broker (retained),
+    too long, not UTF-8, or not a command topic.
+    """
+    m = _COMMAND_RE.fullmatch(topic) if isinstance(topic, str) else None
+    if m is None:
+        return None, None, None, "topic"
+    slug, key = m.group(1), m.group(2)
+    action = "pack_use" if key == "use" else "pack_mode"
+    if retained:
+        return slug, action, None, "retained"
+    if not isinstance(payload, (bytes, bytearray)) \
+            or len(payload) > MAX_COMMAND_BYTES:
+        return slug, action, None, "size"
+    try:
+        text = bytes(payload).decode("utf-8")
+    except UnicodeDecodeError:
+        return slug, action, None, "encoding"
+    if key == "use":
+        value = {USE_ON: True, USE_OFF: False}.get(text)
+    else:
+        value = next((k for k in modes if MODE_LABELS.get(k) == text), None)
+    return slug, action, value, None
+
+
 class MqttPublisher:
+    # OPT-11 P2. Class defaults, so a publisher built without them (and every
+    # test fixture that builds one with __new__) behaves as before.
+    modes = ()
+    retract = ()
+    _loop = None
+    _handler = None
+
     def __init__(self, host, port, username=None, password=None, omit=(),
-                 units=(), include=()):
+                 units=(), include=(), modes=(), retract=()):
         # `omit` drops sensor keys from discovery entirely. ⚠️ Announcing a
         # sensor that nothing will ever publish to is not harmless here:
         # p1_sample_age_s is a watchdog input, and an entity that exists but is
@@ -448,6 +585,10 @@ class MqttPublisher:
         # second reading of the option. Defaults to empty, so a caller that has
         # not been taught about it announces exactly what it announced before.
         self.include = [str(k) for k in include]
+        # OPT-11 P2: the modes offered (empty when battery modes are off), and
+        # the mode config topics to remove (`mode_retractions()`).
+        self.modes = tuple(modes)
+        self.retract = [str(t) for t in retract]
         self.enabled = mqtt is not None and bool(host)
         self.client = None
         if not self.enabled:
@@ -470,7 +611,8 @@ class MqttPublisher:
         # paho DROPS QoS-0 publishes when disconnected, silently. The result is
         # an add-on that logs "MQTT connected" and creates no entities at all.
         # As a bonus, this also re-announces after every reconnect.
-        self.client.on_connect = lambda *_args, **_kw: self._announce()
+        self.client.on_connect = lambda *_args, **_kw: self._on_connect()
+        self.client.on_message = self._on_message
         try:
             self.client.connect(host, int(port), keepalive=60)
             self.client.loop_start()
@@ -485,10 +627,35 @@ class MqttPublisher:
         # diffing what actually goes on the wire - and a payload built here
         # instead would be one this add-on publishes and no check has ever seen.
         for topic, cfg in discovery_payloads(self.units, self.omit,
-                                             self.include):
+                                             self.include, self.modes):
             self.client.publish(topic, json.dumps(cfg), retain=True)
+        for topic in self.retract:
+            self.client.publish(topic, "", retain=True)
         self.client.publish(AVAILABILITY, "online", retain=True)
 
+    def _on_connect(self) -> None:
+        self._announce()
+        if self.modes:
+            for key in ("mode", "use"):
+                self.client.subscribe(f"{BASE}/unit/+/{key}/set")
+
+    def bind(self, loop, handler) -> None:
+        """OPT-11 P2: hand each command to `handler(topic, payload, retained)`,
+        a coroutine function run on `loop` (the controller's)."""
+        self._loop, self._handler = loop, handler
+
+    def _on_message(self, _client, _userdata, msg) -> None:
+        # paho's network thread: nothing is done here but the handoff.
+        loop, handler = self._loop, self._handler
+        if loop is None or handler is None:
+            _LOG.debug("MQTT command before start-up ignored: %s", msg.topic)
+            return
+        try:
+            asyncio.run_coroutine_threadsafe(
+                handler(msg.topic, bytes(msg.payload), bool(msg.retain)), loop)
+        except RuntimeError as err:  # the loop has closed
+            _LOG.debug("MQTT command dropped: %s", err)
+
     def publish(self, values: dict) -> None:
         if not self.enabled or self.client is None:
             return

goodwe_controller/app/packmode.py

@@ -1,4 +1,4 @@
-"""OPT-11 P1: each battery's mode and on/off switch, as limits and weights.
+"""OPT-11: each battery's mode and on/off switch, as limits and weights.
 
 Pure: no I/O, no clock. main.py reads the store, calls these, and files the
 result as a `mode` claim (arbiter.P_MODE) and as the charge weights.
@@ -14,13 +14,11 @@ Two rules hold for every mode, and they are what keeps modes safe:
    allocator._fill()'s last-resort pass still uses it. So "may not" is a range,
    and weights only set the order among batteries that may.
 
-P1 has no price runs and no forecast (P3, P4). So both modes give power to the
-house at any hour, and the only mode that closes a direction is Off. What P1
-changes is the solar order: while the site charges, Leftover solar batteries
-weigh 0, so they get solar only once the Solar first batteries are full or at
-their power limit. Selling (the owner's 2026-09-27 answer) is a per-battery
-choice that arrives with the price runs in P3; `PackMode.sell` and the
-`pack_sell` store key are reserved for it and read by nothing yet.
+`mode_range()` is the switch alone (Off is [0, 0]). P3 adds the price runs:
+`modetrade.decide()` narrows each battery's range by its role this tick
+(hold for the expensive hours, charge from the grid, sell), and main.py files
+the intersection. Selling is a per-battery choice (`pack_sell`, the owner's
+2026-09-27 answer), for Leftover solar and Cheap hours only.
 """
 
 from dataclasses import dataclass
@@ -29,25 +27,49 @@ from .store import unit_key
 
 SOLAR_FIRST = "solar_first"
 LEFTOVER_SOLAR = "leftover_solar"
-CHEAP_HOURS = "cheap_hours"         # reserved for P3; not accepted in P1
+CHEAP_HOURS = "cheap_hours"         # OPT-11 P3
 
-# The modes a battery may be set to in this release, in the order the page
-# lists them. The first is the default when the store has no value.
-MODES = (SOLAR_FIRST, LEFTOVER_SOLAR)
+# The modes a battery may be set to, in the order the page and the HA select
+# list them. The first is the default when the store has no value. A new mode
+# is appended, never inserted: automations send the HA labels (P2).
+MODES = (SOLAR_FIRST, LEFTOVER_SOLAR, CHEAP_HOURS)
 DEFAULT_MODE = SOLAR_FIRST
 
 # Store keys, per battery: `unit/<name>/<key>` (store.unit_key()).
 USE_KEY = "pack_use"
 MODE_KEY = "pack_mode"
-SELL_KEY = "pack_sell"              # reserved for P3
+SELL_KEY = "pack_sell"              # OPT-11 P3: sell in the sell run
+
+# Owner decision 2026-09-29 (option A): selling is off until it can be judged
+# on the price the grid pays. While False, `read()` answers `sell=False`
+# whatever the store holds, the page shows no switch and `pack_sell` is
+# refused; the sell code in modetrade/priceruns stays, unreachable.
+SELLING_ENABLED = False
+
+# The modes that may charge from the grid in a cheap run. Leftover solar joins
+# when the solar forecast exists (P4); until then it takes solar only (owner
+# decision 2026-09-29, option A).
+GRID_CHARGE_MODES = (CHEAP_HOURS,)
+
+
+def enabled(opts) -> bool:
+    """Battery modes are on only when the option is exactly true. One answer,
+    read by the controller and by the MQTT announcement."""
+    return opts.get("battery_modes_enabled") is True
 
 
 @dataclass(frozen=True)
 class PackMode:
-    """One battery's choice: on or off, its mode, and (P3) selling."""
+    """One battery's choice: on or off, its mode, and selling."""
     use: bool = True
     mode: str = DEFAULT_MODE
-    sell: bool = False              # reserved for P3, never read in P1
+    sell: bool = False
+
+    @property
+    def can_sell(self) -> bool:
+        """Selling applies to the price modes only; Solar first never sells.
+        False for every battery while SELLING_ENABLED is False."""
+        return SELLING_ENABLED and self.mode in (LEFTOVER_SOLAR, CHEAP_HOURS)
 
     @property
     def key(self) -> str:
@@ -63,15 +85,15 @@ def read(data: dict, name: str) -> PackMode:
     mode = data.get(unit_key(name, MODE_KEY), DEFAULT_MODE)
     return PackMode(use=use is not False,
                     mode=mode if mode in MODES else DEFAULT_MODE,
-                    sell=data.get(unit_key(name, SELL_KEY)) is True)
+                    sell=SELLING_ENABLED
+                    and data.get(unit_key(name, SELL_KEY)) is True)
 
 
 def mode_range(pm: PackMode, rating_w: float) -> tuple:
-    """`(lo, hi)` in W for this battery's mode claim. Always holds 0 W.
+    """`(lo, hi)` in W for this battery's switch. Always holds 0 W.
 
-    Off asks for 0 W both ways. In P1 both modes may charge and give power up
-    to the battery's rating: Leftover solar holds back its power only in the
-    planned expensive hours, and there are none before P3.
+    Off asks for 0 W both ways; On allows the rating both ways. main.py files
+    this intersected with the role range from `modetrade.decide()`.
     """
     if not pm.use:
         return 0.0, 0.0
@@ -86,7 +108,7 @@ def charge_weights(base, modes: dict, target_w: float):
     charges (`target_w < 0`), a Leftover solar battery weighs 0 and a Solar
     first battery keeps its weight, so the fill gives the Solar first batteries
     everything they can take before the last-resort pass reaches the others.
-    Giving power keeps `base` (P3 adds the expensive-run order).
+    Giving power keeps `base`; `modetrade.weights()` adds the run order.
 
     When no battery that is on would keep a positive weight (all Leftover
     solar, or every Solar first one at 0), `base` is returned unchanged, so the
@@ -96,7 +118,8 @@ def charge_weights(base, modes: dict, target_w: float):
         return base
     names = sorted(modes)
     w = {n: (1.0 if base is None else float(base.get(n, 1.0))) for n in names}
-    out = {n: (0.0 if modes[n].mode == LEFTOVER_SOLAR else w[n])
+    out = {n: (0.0 if modes[n].mode in (LEFTOVER_SOLAR, CHEAP_HOURS)
+               else w[n])
            for n in names}
     if not any(out[n] > 0.0 for n in names if modes[n].use):
         return base

goodwe_controller/app/peakguard.py

@@ -143,6 +143,10 @@ because the money is spent on `max(month's peak so far, this quarter)`:
 
     ceiling_w = max(peak_cap_w, the month's banked peak)
 
+SAFETY-79: the guard AIMS `peak_margin_w` under that ceiling
+(`quarter_target_w()`), so a quarter that lands a little high still stays under
+it. `ceiling_w` stays the real limit for reports and the bill.
+
 Once a month's peak already stands at 5013 W, holding every later quarter to
 3500 W buys nothing - the bill for that month is already 5013 W - while the
 holding itself costs real charging the site wanted. Raising the ceiling to a peak
@@ -453,7 +457,13 @@ PEAK_OPTION_DEFAULTS = {
     # and it is consistent with DoD 90 on a full pack. It exists so validate.py
     # rule 8 can refuse a `peak_soc_floor` at or below it - see that rule.
     "bms_soc_floor": 10,
+    # SAFETY-79. Watts the guard aims under `peak_cap_w`, so a quarter that
+    # lands a little high still stays under the cap. Owner decision 2026-09-28.
+    "peak_margin_w": 50,
 }
+# SAFETY-79. config.yaml's schema range for `peak_margin_w`, mirrored so
+# validate.py can refuse it in words; test_peakguard.py pins it to the file.
+PEAK_MARGIN_RANGE_W = (0, 500)
 
 
 @dataclass(frozen=True)
@@ -474,6 +484,7 @@ class PeakDecision:
     projected_w: float | None = None
     excess_w: float = 0.0
     wanted_w: float | None = None    # the floor before `achievable_w` clamped it
+    target_w: float | None = None    # SAFETY-79: what the guard aims at
     saturated: bool = False
     # SAFETY-24. True when a forced discharge WAS wanted and the EMS-side SoC
     # floor refused to size it. Mutually exclusive with `saturated` by
@@ -524,6 +535,15 @@ def quarter_ceiling_w(cap_w, reading) -> tuple[float, str]:
     return cap, CEILING_CAP
 
 
+def quarter_target_w(cap_w, margin_w, reading) -> float:
+    """SAFETY-79. The average the guard AIMS at: `margin_w` under
+    `quarter_ceiling_w()`, so under a month peak already banked as well as
+    under the cap. Aiming AT a banked peak can bank a few W over it, which
+    raises the bill as surely as going over the cap. Reports and the bill keep
+    the real limit (`ceiling_w`)."""
+    return quarter_ceiling_w(cap_w, reading)[0] - float(margin_w)
+
+
 def excess_w(projection, ceiling_w) -> float:
     """Watts that must come off the meter NOW to land the quarter on the ceiling.
 
@@ -713,8 +733,8 @@ def binding_soc_floor(packs, soc_floor):
     return max(floors)
 
 
-def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
-           max_hold_s=None, frozen: bool = False) -> PeakDecision:
+def decide(projection, *, batt_w, cap_w, margin_w, reading, achievable_w, soc,
+           soc_floor, max_hold_s=None, frozen: bool = False) -> PeakDecision:
     """The whole guard. Pure: no clock, no I/O, no state carried between calls.
 
     `batt_w`       MEASURED battery power, positive = discharge. None when the
@@ -732,8 +752,13 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
                    the pack for money. REQUIRED, and deliberately without a
                    default: a default here would be CFG-03's fourth defaults
                    site and TEST-14's quiet fallback in one line.
+    `margin_w`     SAFETY-79. Watts to aim under `cap_w` (`peak_margin_w`).
+                   REQUIRED for the same reason. `ceiling_w` stays the real
+                   limit for every report; only `excess_w` uses the target.
     """
     ceiling, from_where = quarter_ceiling_w(cap_w, reading)
+    target = quarter_target_w(cap_w, margin_w, reading)
+    aim = "" if target == ceiling else f", aiming at {target:.0f} W"
     ceil_top = abs(float(achievable_w))
 
     blind = blindness(projection, max_hold_s, frozen)
@@ -743,7 +768,7 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # see", which is one-directional and cannot cost pack energy.
         return PeakDecision(
             engaged=True, floor_w=0.0, ceiling_w=ceiling, ceiling_from=from_where,
-            blind=blind, projected_w=None,
+            target_w=target, blind=blind, projected_w=None,
             reason=(f"PEAK_GUARD_BLIND: {blind}. The battery may not charge "
                     f"while this 15-minute period cannot be measured, so it "
                     f"is asked for no charging, floor 0 W"))
@@ -755,7 +780,7 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # measurement that is not there is a made-up number.
         return PeakDecision(
             engaged=False, floor_w=None, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
             reason="no battery measurement to size a floor from")
     if QUARTER_S - float(projection.elapsed_s) <= 0.0:
         # A block with no seconds left cannot be influenced. This is degenerate
@@ -763,10 +788,10 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # the battery's own current output would be a claim that says nothing.
         return PeakDecision(
             engaged=False, floor_w=None, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
             reason="the quarter has no seconds left to influence")
 
-    ex = excess_w(projection, ceiling)
+    ex = excess_w(projection, target)
     wanted = float(batt_w) + ex
     if wanted <= 0.0:
         # ⚠️ THE TEST IS ON THE FLOOR, NOT ON `excess > 0`, AND THE REPLAY IS WHY.
@@ -787,7 +812,8 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # the quantity being thresholded is simply the right one.
         return PeakDecision(
             engaged=False, floor_w=None, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected, excess_w=ex,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
+            excess_w=ex,
             wanted_w=wanted,
             reason="the load is under the level this quarter can afford")
 
@@ -805,7 +831,8 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # not the grid-following loop, which still has no SoC guard.
         return PeakDecision(
             engaged=True, floor_w=0.0, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected, excess_w=ex,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
+            excess_w=ex,
             wanted_w=wanted, floor_limited=True, soc=soc, soc_floor=soc_floor,
             soc_floor_reason=denied,
             # UX-10: plain sentences, every figure kept (test_messages.py
@@ -813,8 +840,8 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
             reason=(
                 f"PEAK_GUARD_FLOOR_LIMITED: this 15-minute period heads for "
                 f"{projected:.0f} W against a {ceiling:.0f} W limit "
-                f"({from_where}), and {wanted:+.0f} W from the battery would "
-                f"hold it. But {denied}"
+                f"({from_where}){aim}, and {wanted:+.0f} W from the battery "
+                f"would hold it. But {denied}"
                 + ("" if soc is None else f", at {float(soc):.0f} %")
                 + ("" if soc is None or soc_floor is None
                    else f" against {float(soc_floor):.0f} %")
@@ -825,11 +852,11 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
     saturated = floor < wanted
     return PeakDecision(
         engaged=True, floor_w=floor, ceiling_w=ceiling, ceiling_from=from_where,
-        blind=None, projected_w=projected, excess_w=ex, wanted_w=wanted,
-        saturated=saturated, soc=soc, soc_floor=soc_floor,
+        target_w=target, blind=None, projected_w=projected, excess_w=ex,
+        wanted_w=wanted, saturated=saturated, soc=soc, soc_floor=soc_floor,
         reason=(
             f"PEAK_GUARD: this 15-minute period heads for {projected:.0f} W "
-            f"against a {ceiling:.0f} W limit ({from_where}), with "
+            f"against a {ceiling:.0f} W limit ({from_where}){aim}, with "
             f"{QUARTER_S - projection.elapsed_s:.0f} s left, so {ex:.0f} W must "
             f"come off the meter. The battery measured {float(batt_w):+.0f} W "
             f"and is asked for {floor:+.0f} W"
@@ -839,6 +866,40 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
                if saturated else "")))
 
 
+# SAFETY-81. A quarter must end this many W over the real limit before
+# "Load too high for battery" fires. Above the guard's own landing error at
+# margin 0 (up to +5.7 W, SAFETY-79 test check 5), which margin 0 accepts.
+ALARM_MISS_W = 10.0
+# ...and for this long without a break, so a load that peaks for a few seconds
+# (a hob or heater cycling) is not read as the rest of the quarter.
+ALARM_HOLD_S = 10.0
+
+
+def load_too_high(projection, *, batt_w, ceiling_w, achievable_w) -> bool:
+    """SAFETY-81. May "Load too high for battery" fire? Only if, with the
+    battery at full power from now on, the quarter still ends more than
+    `ALARM_MISS_W` over the real limit (`ceiling_w`, not the aim).
+
+    This is the miss itself, in W of the quarter average, so it does not have
+    `decide()`'s gain (900 / remaining): near a quarter's end that gain turns
+    a watt over the aim into thousands of W wanted.
+
+    The load is the held meter reading plus `batt_w`. The caller passes the
+    lower of this cycle's and the last cycle's battery reading, so a meter
+    sample taken before the battery's last increase is not counted twice
+    (DECISIONS/SAFETY-81-load-too-high.md). A real overload shows on the meter
+    before the battery moves, so that filter costs it no cycle.
+    """
+    remaining = QUARTER_S - float(projection.elapsed_s)
+    if batt_w is None or remaining <= 0.0:
+        return False
+    rest = float(projection.held_w) + float(batt_w) - float(achievable_w)
+    done_ws = (QUARTER_S * float(projection.projected_w)
+               - max(float(projection.held_w), 0.0) * remaining)
+    ends_w = (done_ws + max(rest, 0.0) * remaining) / QUARTER_S
+    return ends_w - float(ceiling_w) > ALARM_MISS_W
+
+
 def charge_headroom_w(decision) -> float | None:
     """SAFETY-45. The hardest this SITE may charge without putting the billed
     quarter over the ceiling, in W, positive - or None when nothing measured it.

goodwe_controller/app/priceruns.py

@@ -0,0 +1,203 @@
+"""OPT-11 P3: price runs. Which consecutive firm price slots are cheap, which
+are expensive, and which one a battery may sell in.
+
+Pure: prices, the time and a few energy figures in, a `RunPlan` out. No I/O,
+no clock. `modetrade.py` turns the plan into each battery's range and the
+site's trade; main.py rebuilds the plan at most once per 15 minutes and keeps
+a run that has started until its end (`keep_started()`).
+
+The owner's SAFETY-46 answer (2026-09-25): a trade is a run of consecutive
+slots, not one 15-minute interval. OPT-11-design section 2 ("Prices") and
+DECISIONS/OPT-11-battery-modes.md have the record.
+
+* The CHEAP run is the cheapest consecutive firm window long enough to put
+  the planned energy in at the chargers' combined rating.
+* A slot is EXPENSIVE when its price is above the cheap run's mean by at
+  least the required spread (`cycle_cost_threshold_eur`, widened as
+  `TariffPlan.arbitrage()` widens it). Give runs are the maximal consecutive
+  expensive slots. Holding batteries cover the house in them. The mean is
+  the lower of the next cheap run's and `ref_eur_kwh`, the cheap run the
+  batteries last filled in (main.py keeps it for 12 h): energy bought at
+  03:00 is still worth that price at 08:00, when the next cheap run in sight
+  is today's dearer midday (measured: without it a Cheap hours battery spent
+  its night charge on flat morning prices, then had nothing at 19:00).
+* The SELL run is the dearest consecutive window inside one give run long
+  enough to sell the sellers' energy at their rating, with no slot below 0
+  (section 17 of the spec: never export at a negative price).
+* A provisional (carried) price is never part of any run (section 8.3).
+"""
+
+import math
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+
+from .price import _cover_table
+
+# How far ahead runs are looked for. A day: tonight's cheap hours and the next
+# evening's expensive ones, without holding a battery for a peak two days out.
+HORIZON = timedelta(hours=24)
+
+# No plan, and why (the page words are in homeview / ui_text).
+NO_PRICES = "no_prices"           # fewer than two firm slots ahead
+NOT_WORTH = "not_worth"           # no slot clears the required spread
+
+
+@dataclass(frozen=True)
+class Run:
+    start: datetime
+    end: datetime
+    mean_eur_kwh: float
+
+    def holds(self, when: datetime) -> bool:
+        return self.start <= when < self.end
+
+
+@dataclass(frozen=True)
+class RunPlan:
+    """What the prices say for the next day. `reason` is None when there is
+    a plan (a cheap run and at least one give run), else why there is none."""
+    cheap: Run | None
+    give: tuple
+    sell: Run | None
+    level_eur_kwh: float | None
+    reason: str | None
+    # A slot after the cheap run clears the spread over the CHEAP RUN'S OWN
+    # price (not the reference): only then is buying in it worth a cycle.
+    charge_worth: bool = False
+
+    @property
+    def on(self) -> bool:
+        return self.reason is None
+
+    def give_at(self, when):
+        return next((g for g in self.give if g.holds(when)), None)
+
+    def next_give(self, when):
+        """The give run under way at `when`, else the next one, else None."""
+        return next((g for g in self.give if g.end > when), None)
+
+    def charge_useful(self) -> bool:
+        """Charging in the cheap run pays only if, after it, a slot clears
+        the spread over the cheap run's own price."""
+        return self.cheap is not None and self.charge_worth
+
+
+def firm_slots(points, now: datetime, horizon: timedelta = HORIZON) -> list:
+    """`[(start, end, eur_kwh)]`, ascending: the firm slots that have not
+    ended and start within the horizon. A slot's span is TARIFF-14's rule
+    (`price._cover_table()`), so 15-minute and hourly series both work."""
+    out = []
+    for start, end, p in _cover_table(points):
+        if p.provisional or end <= now or start >= now + horizon:
+            continue
+        if end > start:
+            out.append((start, end, float(p.eur_per_kwh)))
+    return out
+
+
+def _segments(slots) -> list:
+    """Split slots into runs of consecutive ones (each starts where the last
+    ended). A gap or a provisional slot breaks a run."""
+    segs, cur = [], []
+    for s in slots:
+        if cur and s[0] != cur[-1][1]:
+            segs.append(cur)
+            cur = []
+        cur.append(s)
+    if cur:
+        segs.append(cur)
+    return segs
+
+
+def _hours(s) -> float:
+    return (s[1] - s[0]).total_seconds() / 3600.0
+
+
+def _mean(win) -> float:
+    h = sum(_hours(s) for s in win)
+    return sum(_hours(s) * s[2] for s in win) / h
+
+
+def _windows(segs, need_h):
+    """Every consecutive window that lasts at least `need_h` hours, shortest
+    such from each start. If no segment is that long, each whole segment."""
+    out = []
+    for seg in segs:
+        for i in range(len(seg)):
+            h, j = 0.0, i
+            while j < len(seg) and h < need_h - 1e-9:
+                h += _hours(seg[j])
+                j += 1
+            if h >= need_h - 1e-9:
+                out.append(seg[i:j])
+    return out or [seg for seg in segs]
+
+
+def need_hours(kwh, kw, slots) -> float:
+    """How long a run must last: `kwh` at `kw`, and at least one slot."""
+    one = min((_hours(s) for s in slots), default=1.0)
+    if not (kwh and kw) or kwh <= 0 or kw <= 0:
+        return one
+    return max(one, float(kwh) / float(kw))
+
+
+def plan(points, now: datetime, *, required_eur_kwh: float, charge_kwh,
+         charge_kw, sell_kwh, sell_kw, horizon: timedelta = HORIZON,
+         ref_eur_kwh=None) -> RunPlan:
+    """The run plan for the next `horizon`. Ties go to the earliest window."""
+    if not (isinstance(required_eur_kwh, (int, float))
+            and math.isfinite(required_eur_kwh) and required_eur_kwh >= 0):
+        raise ValueError("required_eur_kwh must be a finite number >= 0")
+    slots = firm_slots(points, now, horizon)
+    if len(slots) < 2:
+        return RunPlan(None, (), None, None, NO_PRICES)
+    segs = _segments(slots)
+    wins = _windows(segs, need_hours(charge_kwh, charge_kw, slots))
+    best = min(wins, key=lambda w: (round(_mean(w), 9), w[0][0]))
+    cheap = Run(best[0][0], best[-1][1], _mean(best))
+    base = cheap.mean_eur_kwh if ref_eur_kwh is None else min(
+        cheap.mean_eur_kwh, float(ref_eur_kwh))
+    level = base + float(required_eur_kwh)
+    # Expensive: clears the spread, strictly dearer than the cheap mean, and
+    # not part of the cheap run itself (a threshold of 0 must not overlap).
+    dear = [s for s in slots
+            if s[2] >= level and s[2] > cheap.mean_eur_kwh
+            and not (cheap.start <= s[0] < cheap.end)]
+    give_segs = _segments(dear)
+    give = tuple(Run(g[0][0], g[-1][1], _mean(g)) for g in give_segs)
+    worth = any(s[0] >= cheap.end and s[2] >= cheap.mean_eur_kwh
+                + float(required_eur_kwh) for s in dear)
+    if not give:
+        return RunPlan(cheap, (), None, level, NOT_WORTH)
+    # Sell: inside one give run, never over a slot priced below 0.
+    sellable = [part for g in give_segs
+                for part in _segments([s for s in g if s[2] >= 0.0])]
+    sell = None
+    if sellable:
+        sw = _windows(sellable, need_hours(sell_kwh, sell_kw, slots))
+        top = max(sw, key=lambda w: (round(_mean(w), 9),
+                                     -w[0][0].timestamp()))
+        sell = Run(top[0][0], top[-1][1], _mean(top))
+    return RunPlan(cheap, give, sell, level, None, worth)
+
+
+def keep_started(old: RunPlan | None, new: RunPlan, now: datetime) -> RunPlan:
+    """A run under way keeps going to its end (no flapping on a new plan): the
+    cheap run, the give run and the sell run each come from `old` while `old`
+    holds `now` in it. The rest is `new`. A safety or peak rule can still stop
+    a run at any tick; that is not decided here."""
+    if old is None or not old.on:
+        return new
+    cheap = old.cheap if old.cheap and old.cheap.holds(now) else new.cheap
+    sell = old.sell if old.sell and old.sell.holds(now) else new.sell
+    g_old = old.give_at(now)
+    give = new.give
+    if g_old is not None:
+        give = (g_old,) + tuple(g for g in new.give
+                                if g.start >= g_old.end)
+    if cheap is new.cheap and sell is new.sell and g_old is None:
+        return new
+    worth = old.charge_worth if cheap is old.cheap else new.charge_worth
+    return RunPlan(cheap, give, sell, new.level_eur_kwh if new.on
+                   else old.level_eur_kwh, None if give else new.reason,
+                   worth)

goodwe_controller/app/static/app.css

@@ -228,3 +228,19 @@ input.txt.time{width:5.5em;text-align:center;font-variant-numeric:tabular-nums}
 .sev.bad{background:var(--bad-bg);color:var(--bad)} .sev.warn{background:var(--warn-bg);color:var(--warn)}
 .checklist li{display:flex;gap:8px;align-items:flex-start;overflow-wrap:anywhere}
 .kettle .row{margin-top:8px}
+/* UX-13 P3: the Batteries screen and the Simple settings view */
+.bcard .hd{display:flex;align-items:center;gap:10px;margin-bottom:10px}
+.bcard .name{font-weight:700;font-size:16px}
+.bcard .modebox .lbl{display:block;margin-bottom:4px}
+.bcard .modebox .help{font-size:13px;color:var(--muted);margin-top:4px}
+.bcard.off .modebox{opacity:.6}
+.bcard .kv dd{overflow-wrap:anywhere}
+.switch:disabled{opacity:.45;cursor:not-allowed}
+select.sel:disabled{opacity:.6}
+.simple .card>.row{margin-bottom:4px}
+.vhide{display:none!important}
+.simple .card>.f{border-top:0;padding-top:0}
+.simple .f>.head{display:flex;justify-content:space-between;align-items:center;gap:8px;flex-wrap:wrap}
+.simple .card .lbl{font-weight:600;font-size:15px}
+.simple .inv .hd{border-bottom:0}
+.simple .inv .f{border-top:0;padding-top:0}

goodwe_controller/app/static/app.js

@@ -78,10 +78,12 @@
     if (!r.ok) throw new Error("action " + r.status);
     return r.json();
   }
-  async function refresh() {
+  // `force`: redraw the battery cards even under a focused mode list, after
+  // the person used it (P3).
+  async function refresh(force) {
     if (busy) return;
     busy = true;
-    try { S = await getStatus(); render(); }
+    try { S = await getStatus(); render(force === true); }
     catch (e) { offline(); }
     finally { busy = false; }
   }
@@ -104,7 +106,7 @@
     $("#pill").replaceChildren(h("span", { class: "dot" + dot, "aria-hidden": "true" }), h("span", {}, words));
   }
 
-  function render() {
+  function render(force) {
     renderPill();
     const structured = S.now && S.plan && !S.home_error;
     // UX-15: setup-only mode commands nothing and has no control to offer.
@@ -114,7 +116,8 @@
     if (structured) { renderNow(); renderPlan(); renderPeak(); renderAttention(); }
     renderControl(structured, setup);
     renderDetails(!structured && !setup);
-    renderBatteries();
+    renderBatteries(force);
+    document.dispatchEvent(new CustomEvent("ux13:status"));
   }
 
   /* ---------------- Home: now ---------------- */
@@ -308,50 +311,103 @@
     if (open) $("#c-details").open = true;
   }
 
-  /* ---------------- Batteries (placeholder until UX-13 P3) ---------------- */
-  // OPT-11 P1: with battery modes on, each card gets an On/Off switch and a
-  // mode choice (`mode_key` in /status). UX-13 P3 replaces these cards.
-  const MODES = ["solar_first", "leftover_solar"];
+  /* ---------------- Batteries (UX-13 P3) ---------------- */
+  // One card per battery. With battery modes on (`mode_key` in /status) each
+  // card has an On/Off switch and a mode list, sent as `pack_use` and
+  // `pack_mode` through /action (OPT-11 P1). Selling has no switch while it
+  // is off (owner decision 2026-09-29). The Now, Today and Why lines are
+  // homeview.py's sentences. The Simple settings view draws the same switch
+  // and list into its own card (simpleHost).
+  const MODES = ["solar_first", "leftover_solar", "cheap_hours"];
+  const say = (text, vars) => Object.keys(vars).reduce((x, k) => x.replace("{" + k + "}", vars[k]), text);
   let packBusy = false;
-  async function packAct(what, unit, value) {
+  let simpleHost = null;
+  async function packAct(what, b, value) {
     if (packBusy) return;
     packBusy = true;
     try {
       const r = await fetch("action", { method: "POST", headers: { "Content-Type": "application/json" },
-                                        body: JSON.stringify({ action: what, unit: unit, value: value }) });
+                                        body: JSON.stringify({ action: what, unit: b.name, value: value }) });
       const j = await r.json().catch(() => ({}));
-      toast(r.ok ? t("toast.done") : (j.error || t("toast.failed")));
+      if (!r.ok) toast(j.error || t("toast.failed"));
+      else if (what === "pack_use") toast(say(value ? t("batteries.toast.on") : t("batteries.toast.off"), { name: b.name }));
+      else toast(say(t("batteries.toast.mode"), { name: b.name, mode: t("batteries.choice." + value + ".name") }));
     } catch (e) { toast(t("toast.failed")); }
     finally { packBusy = false; }
-    refresh();
+    await refresh(true);
   }
-  function modeControls(b) {
-    const sw = h("button", { class: "btn" + (b.use ? " primary" : ""), type: "button", role: "switch",
-                             "aria-checked": String(b.use), "aria-label": b.name + ": " + t("batteries.use"),
-                             onclick: () => packAct("pack_use", b.name, !b.use) },
-                 b.use ? t("batteries.on") : t("batteries.off"));
-    const sel = h("select", { class: "sel", "aria-label": b.name + ": " + t("batteries.mode"), disabled: !b.use,
-                              onchange: (e) => packAct("pack_mode", b.name, e.target.value) },
+  function onSwitch(b, i, where, lid) {
+    const sw = h("button", { type: "button", class: "switch", role: "switch", id: "bsw-" + where + i,
+                             "aria-checked": String(b.use), "aria-labelledby": lid,
+                             onclick: () => packAct("pack_use", b, !b.use) });
+    return h("span", { class: "swrap" }, sw, h("span", { class: "swtext", "aria-hidden": "true" }, b.use ? t("batteries.on") : t("batteries.off")));
+  }
+  function modeSelect(b, i, where, lid) {
+    return h("select", { class: "sel", id: "bsel-" + where + i, "aria-labelledby": lid, disabled: !b.use,
+                         onchange: (e) => packAct("pack_mode", b, e.target.value) },
       ...MODES.map((k) => h("option", { value: k, selected: b.mode_choice === k }, t("batteries.choice." + k + ".name"))));
-    return [h("div", { class: "row spread", style: "margin-top:8px" }, h("span", { class: "small" }, t("batteries.use")), sw),
-            h("div", { class: "row spread", style: "margin-top:8px" }, h("span", { class: "small" }, t("batteries.mode")), sel),
-            h("p", { class: "tiny muted", style: "margin:6px 0 0" }, t("batteries.choice." + b.mode_key + ".description"))];
   }
-  function renderBatteries() {
-    if (!S.batteries) { $("#bcards").replaceChildren(); return; }
-    // Do not rebuild a card under an open mode list or a request in flight.
-    if (packBusy || ($("#bcards").contains(document.activeElement) && document.activeElement.tagName === "SELECT")) return;
-    const modes = S.batteries.some((b) => b.mode_key != null);
-    $("#batt-desc").textContent = t(modes ? "batteries.with_modes.description" : "batteries.description");
-    $("#bcards").replaceChildren(...S.batteries.map((b) => h("div", { class: "card" },
-      h("div", { class: "row spread" }, h("strong", {}, b.name), h("span", { class: "small muted" }, b.capacity_kwh ? b.capacity_kwh + " kWh" : "")),
+  function todayLines(b) {
+    if (!b.today || !b.today.length) return b.today_line || "–";
+    return b.today.map((r) => h("div", {}, r.from + " " + t("plan.time_to") + " " + r.to + ": " + r.what));
+  }
+  function batteryCard(b, i) {
+    const modes = b.mode_key != null;
+    const lid = "bname-" + i;
+    const lvl = b.level_pct == null ? "–" : Math.round(b.level_pct) + " %";
+    const stored = b.stored_kwh != null ? " · " + dec(b.stored_kwh.toFixed(1)) + " kWh " + t("batteries.stored").toLowerCase() : "";
+    return h("div", { class: "card bcard" + (modes && !b.use ? " off" : "") },
+      h("div", { class: "hd" },
+        h("div", { class: "grow" }, h("div", { class: "name", id: lid }, b.name),
+          h("div", { class: "tiny muted" }, b.capacity_kwh ? dec(Number(b.capacity_kwh).toFixed(1)) + " kWh" : "")),
+        modes ? onSwitch(b, i, "c", lid) : null),
+      modes ? h("div", { class: "modebox" },
+        h("label", { class: "lbl small", for: "bsel-c" + i }, t("batteries.mode")),
+        modeSelect(b, i, "c", null),
+        h("div", { class: "help" }, t("batteries.choice." + b.mode_key + ".description"))) : null,
       levelBar(b.level_pct, b.name),
       h("dl", { class: "kv" },
-        h("dt", {}, t("batteries.level")), h("dd", {}, b.level_pct == null ? "–" : Math.round(b.level_pct) + " %"),
-        b.stored_kwh != null ? [h("dt", {}, t("batteries.stored")), h("dd", {}, dec(b.stored_kwh.toFixed(1)) + " kWh")] : null,
+        h("dt", {}, t("batteries.level")), h("dd", {}, lvl + stored),
         h("dt", {}, t("batteries.now")), h("dd", {}, b.now),
-        b.mode_key == null ? [h("dt", {}, t("batteries.mode")), h("dd", {}, b.mode)] : null),
-      b.mode_key != null ? modeControls(b) : null)));
+        h("dt", {}, t("batteries.today")), h("dd", {}, todayLines(b)),
+        h("dt", {}, t("batteries.why")), h("dd", { class: "muted" }, b.why || "–")));
+  }
+  function simpleRow(b, i) {
+    const lid = "bsname-" + i;
+    return h("div", { class: "inv" },
+      h("div", { class: "hd" }, h("span", { class: "grow", id: lid }, b.name), onSwitch(b, i, "s", lid)),
+      h("div", { class: "f" }, h("label", { class: "lbl", for: "bsel-s" + i }, t("batteries.mode")),
+        h("div", { class: "ctl" }, modeSelect(b, i, "s", null)),
+        h("div", { class: "help" }, b.now + " " + (b.why || ""))));
+  }
+  // Rebuild without losing the focused control, and never under an open list
+  // or a request in flight.
+  function keepFocus(fn) {
+    const id = document.activeElement && document.activeElement.id;
+    fn();
+    if (id && /^bs(w|el)-/.test(id)) { const e = document.getElementById(id); if (e) e.focus(); }
+  }
+  // The modes-off card's button opens Settings on the Installer view, where
+  // the "Battery modes" switch is (settings.js sets window.UX13.settingsView).
+  $("#batt-off a").addEventListener("click", () => { if (window.UX13.settingsView) window.UX13.settingsView("installer"); });
+  function renderBatteries(force) {
+    if (!S || !S.batteries) { $("#bcards").replaceChildren(); return; }
+    const a = document.activeElement;
+    if (!force && (packBusy || (a && a.tagName === "SELECT" && /^bsel-/.test(a.id)))) return;
+    const modes = S.modes_on === true || S.batteries.some((b) => b.mode_key != null);
+    $("#batt-off").hidden = modes;
+    $("#batt-how").hidden = !modes;
+    const docs = $("#batt-docs");
+    if (S.control && S.control.docs_url) { docs.href = S.control.docs_url; docs.hidden = false; } else docs.hidden = true;
+    if (S.state && ["shadow", "stopped", "alarm"].includes(S.state.kind)) banner($("#batt-banner"), S.level, S.state.pill, S.state.sub, S.level === "bad" ? "alert" : null);
+    else $("#batt-banner").replaceChildren();
+    keepFocus(() => {
+      $("#bcards").replaceChildren(...S.batteries.map(batteryCard));
+      if (simpleHost && simpleHost.isConnected) {
+        simpleHost.replaceChildren(...(modes ? S.batteries.map(simpleRow)
+          : [h("p", { class: "small muted", style: "margin:4px 0" }, t("batteries.modes_off.name") + ". " + t("batteries.description"))]));
+      }
+    });
   }
 
   /* ---------------- control buttons ---------------- */
@@ -385,7 +441,10 @@
   // Shared with settings.js, which loads after this file.
   // `first`: the page opened with no route, so settings.js may open the setup
   // wizard on a new install (UX-13 P4).
-  window.UX13 = { h, ask, toast, t, words: WORDS, lang: LANG, maint: (what) => ask(what, () => simple(what)), first: !location.hash };
+  window.UX13 = { h, ask, toast, t, words: WORDS, lang: LANG, maint: (what) => ask(what, () => simple(what)), first: !location.hash,
+                  // P3: the Simple settings view's battery card, drawn from /status.
+                  batteries: (host) => { simpleHost = host; if (S) renderBatteries(); refresh(); },
+                  status: () => S, kw };
 
   /* ---------------- tabs: hash routes, arrow keys ---------------- */
   const TABS = [...document.querySelectorAll(".tab")];

goodwe_controller/app/static/index.html

@@ -94,11 +94,23 @@
 </section>
 
 <section class="screen" id="s-batt" role="tabpanel" aria-labelledby="t-batt" hidden>
-  <div id="bcards"></div>
-  <div class="card">
-    <p class="small muted" style="margin:0 0 10px" id="batt-desc" data-t="batteries.description"></p>
+  <div id="batt-banner"></div>
+  <div class="card" id="batt-off" hidden>
+    <h2 data-t="batteries.modes_off.name"></h2>
+    <p class="small muted" style="margin:0 0 10px" data-t="batteries.description"></p>
     <a class="btn" href="#settings" data-t="batteries.settings"></a>
   </div>
+  <div id="bcards"></div>
+  <details class="grp" id="batt-how" hidden>
+    <summary><span class="grow"><strong data-t="batteries.how.name"></strong><span class="small muted gdesc" data-t="batteries.how.description"></span></span><span class="chev" aria-hidden="true">&#8250;</span></summary>
+    <div class="body small">
+      <p data-t="batteries.how.solar_first.description"></p>
+      <p data-t="batteries.how.leftover_solar.description"></p>
+      <p data-t="batteries.how.off.description"></p>
+      <p class="muted" data-t="batteries.how.rules.description"></p>
+      <p><a id="batt-docs" hidden target="_top" rel="noopener" data-t="control.docs"></a></p>
+    </div>
+  </details>
 </section>
 
 <section class="screen" id="s-set" role="tabpanel" aria-labelledby="t-set" hidden>
@@ -106,8 +118,15 @@
     <h2 style="margin:0" data-s="name"></h2>
     <a class="small" href="config" id="set-classic" data-s="classic"></a>
   </div>
-  <p class="small muted" style="margin:0 0 10px" data-s="description"></p>
+  <div class="row" style="margin-bottom:8px">
+    <div class="seg" role="radiogroup" id="set-view" data-s-label="view.name">
+      <button type="button" role="radio" aria-checked="true" data-v="simple" data-s="view.simple"></button>
+      <button type="button" role="radio" aria-checked="false" data-v="installer" tabindex="-1" data-s="view.installer"></button>
+    </div>
+    <span class="tiny muted grow" id="set-desc"></span>
+  </div>
   <div id="set-banner" aria-live="polite"></div>
+  <div id="simple" class="simple" hidden></div>
   <div id="set-body">
     <input class="search" id="set-search" type="search" autocomplete="off" spellcheck="false" data-s-ph="search.description" data-s-label="search.name">
     <div class="card" id="set-other" hidden><h2 data-s="other"></h2><ul class="plain small" id="set-other-list"></ul></div>

goodwe_controller/app/static/settings.js

@@ -32,6 +32,10 @@
   let FILLED = {};           // field key -> the preset field that fills it
   let view = null;           // "settings" or "setup": the tab drawing V
   let STEPS = {};            // wizard step -> refusals that block it
+  // P3: "simple" (the default, for home owners) or "installer". Remembered in
+  // this browser only; a blocked storage just means Simple each time.
+  let mode = "simple";
+  try { if (localStorage.getItem("ux13.settings.view") === "installer") mode = "installer"; } catch (e) { /* no storage */ }
   let uid = 0;
   const ROWS = [];
   const OPEN = new Set();
@@ -337,7 +341,7 @@
   function fieldRow(f, card, gid) {
     if (f.control === "inverter_list") return cardList(f, gid);
     const lid = "sf" + (++uid);
-    const keys = keyText(f, card);
+    const keys = gid === "simple" ? "" : keyText(f, card);     // Simple shows no keys
     const msg = h("div", { class: "msgs" });
     const make = CONTROLS[f.control] || text;
     const row = h("div", { class: "f" + (f.control === "toggle" ? " inline" : ""), "data-key": f.key, "data-card": card },
@@ -421,10 +425,81 @@
       d.append(body);
       host.append(d);
     }
+    renderSimple();
     paint();
     window.scrollTo(0, y);
   }
 
+  /* ---------------- Settings, Simple (P3) ---------------- */
+  // The fields the layout marks `simple`, each in its own card with when it
+  // applies, and the batteries' switches and modes (runtime state, applied at
+  // once) drawn by app.js from /status. The Installer rows stay built but
+  // hidden, so the save bar counts every unsaved change in either view.
+  const chip = (applies) => h("span", { class: "chip " + (applies === "now" ? "now" : "rs") }, ROOT.applies[applies].name);
+  // A note with {kw} is filled from /status (app.js sends ux13:status).
+  function fillNotes() {
+    const st = window.UX13.status();
+    const mp = st && st.month_peak;
+    document.querySelectorAll("#simple [data-kw-note]").forEach((e) => {
+      const ok = mp && mp.peak_w != null;
+      e.hidden = !ok;
+      e.textContent = ok ? e.dataset.kwNote.replace("{kw}", window.UX13.kw(mp.peak_w) + " kW") : "";
+    });
+  }
+  document.addEventListener("ux13:status", fillNotes);
+  function simpleField(f) {
+    const row = fieldRow(f, null, "simple");
+    row.querySelector(".head").append(chip(f.applies));
+    const n = f.note && W.simple.note[f.note];
+    if (n && n.description.includes("{kw}")) {
+      row.append(h("div", { class: "small muted", "data-kw-note": n.description, hidden: true }));
+    } else if (n) {
+      // A plain note replaces the option's installer help on this view.
+      const help = row.querySelector(".help");
+      if (help) help.textContent = n.description;
+    }
+    return h("div", { class: "card" }, row);
+  }
+  function renderSimple() {
+    const host = $("#simple");
+    host.replaceChildren();
+    if (mode !== "simple") return;
+    const cards = allFields().filter((f) => f.simple).map(simpleField);
+    const batts = h("div", {});
+    cards.splice(Math.min(1, cards.length), 0, h("div", { class: "card" },
+      h("div", { class: "row spread" }, h("div", { class: "lbl" }, W.simple.batteries.name), chip("now")), batts));
+    host.append(...cards, h("p", { class: "small muted", style: "margin:4px 2px" }, W.simple.more.description + " ",
+      h("button", { type: "button", class: "btn link", onclick: () => setMode("installer", true) }, W.simple.installer)));
+    window.UX13.batteries(batts);
+    fillNotes();
+  }
+  // `remember`: only the person's own pick of a view is kept for next time;
+  // a jump to Installer (a link, a setting to fix) is not.
+  function setMode(v, redraw, remember) {
+    mode = v;
+    if (remember) try { localStorage.setItem("ux13.settings.view", v); } catch (e) { /* no storage */ }
+    document.querySelectorAll("#set-view [role=radio]").forEach((b) => {
+      const on = b.dataset.v === v;
+      b.setAttribute("aria-checked", String(on)); b.tabIndex = on ? 0 : -1;
+    });
+    $("#set-desc").textContent = v === "simple" ? W.simple.description : W.description;
+    $("#simple").hidden = v !== "simple";
+    ["#set-search", "#groups", "#set-nomatch"].forEach((id) => { $(id).classList.toggle("vhide", v === "simple"); });
+    if (redraw && M && view === "settings") render();
+  }
+  document.querySelectorAll("#set-view [role=radio]").forEach((b, i, all) => {
+    b.addEventListener("click", () => setMode(b.dataset.v, true, true));
+    b.addEventListener("keydown", (e) => {
+      const d = { ArrowRight: 1, ArrowDown: 1, ArrowLeft: -1, ArrowUp: -1 }[e.key];
+      if (!d) return;
+      e.preventDefault();
+      const j = all[(i + d + all.length) % all.length];
+      setMode(j.dataset.v, true, true); j.focus();
+    });
+  });
+  setMode(mode, false);
+  window.UX13.settingsView = (v) => setMode(v, true);
+
   /* ---------------- messages, visibility, search, badges ---------------- */
   const ICON = { bad: "×", warn: "!", info: "i" };
   const RANK = { bad: 0, warn: 1, info: 2 };
@@ -434,11 +509,13 @@
     return m.card == null ? r.card === 0 : m.card === r.card;
   }
   function paint() {
-    const q = view === "setup" ? "" : $("#set-search").value.trim().toLowerCase();
+    const q = view === "setup" || mode === "simple" ? "" : $("#set-search").value.trim().toLowerCase();
+    // A message counts as shown only beside a row of the view on screen.
+    const onScreen = (r) => view === "setup" || (mode === "simple") === (r.gid === "simple");
     const placed = new Set();
     for (const r of ROWS) {
       r.visible = visible(r.f);
-      const msgs = MSG.filter((m, i) => { const hit = mine(r, m); if (hit && r.visible) placed.add(i); return hit; })
+      const msgs = MSG.filter((m, i) => { const hit = mine(r, m); if (hit && r.visible && onScreen(r)) placed.add(i); return hit; })
         .sort((a, z) => RANK[a.tier] - RANK[z.tier]);
       r.tiers = new Set(msgs.map((m) => m.tier));
       r.msg.replaceChildren(...msgs.map((m) => h("div", { class: "msg " + m.tier },
@@ -562,7 +639,9 @@
     validate();
   }
   function firstBad() {
-    const r = ROWS.find((x) => x.tiers && x.tiers.has("bad") && x.visible);
+    if (view === "settings" && mode === "simple" && !ROWS.some((x) => x.gid === "simple" && x.tiers && x.tiers.has("bad") && x.visible)
+        && ROWS.some((x) => x.tiers && x.tiers.has("bad") && x.visible)) setMode("installer", true);
+    const r = ROWS.find((x) => x.tiers && x.tiers.has("bad") && x.visible && (view !== "settings" || (mode === "simple") === (x.gid === "simple")));
     if (!r) { if (!$("#set-other").hidden) $("#set-other").scrollIntoView({ block: "center" }); return; }
     for (let p = r.el.parentElement; p; p = p.parentElement) if (p.tagName === "DETAILS") p.open = true;
     r.el.scrollIntoView({ block: "center" });

goodwe_controller/app/ui_text/en.json

@@ -13,7 +13,7 @@
     "inverters.modes": {"name": "Battery modes"},
     "tariff.selling": {"name": "Charging and selling on price"},
     "tariff.feed": {"name": "Price feed details"},
-    "safety.peak": {"name": "Peak limit"},
+    "safety.peak": {"name": "Peak limit", "description": "The add-on aims a little below your limit, to be safe."},
     "safety.start": {"name": "Starting and stopping"},
     "safety.stops": {"name": "Safety stops", "description": "Measured on real hardware, so leave them unchanged."},
     "maintenance.support": {"name": "Support"}
@@ -84,13 +84,22 @@
     "offline": {"name": "Cannot reach the add-on", "description": "The page tries again every 3 seconds."},
     "setup_only": {"name": "Setup: nothing is controlled yet", "description": "Nothing is sent to any inverter until setup is saved and the add-on restarts.", "control": "Control starts after setup.", "open": "Open Setup"},
     "batteries": {"name": "Batteries", "description": "To choose a mode for each battery, turn on battery modes in the settings.", "level": "Level", "now": "Now", "stored": "Stored", "mode": "Mode", "settings": "Change inverter settings",
-      "with_modes": {"description": "Each battery follows its mode, after the peak limit and safety stops."},
-      "use": "Use this battery", "on": "On", "off": "Off",
+      "on": "On", "off": "Off",
       "choice": {
         "solar_first": {"name": "Solar first", "description": "Charges from solar before the other batteries and covers the house."},
-        "leftover_solar": {"name": "Leftover solar", "description": "Charges from solar the other batteries cannot take, and covers the house."},
-        "off": {"name": "Off", "description": "The add-on asks this battery for 0 W, unless the peak limit needs it."}
-      }},
+        "leftover_solar": {"name": "Leftover solar", "description": "Gets solar the others cannot take, and gives power in expensive hours."},
+        "cheap_hours": {"name": "Cheap hours only", "description": "Charges in the cheapest hours and gives power in the expensive ones."},
+        "off": {"name": "Off", "description": "Rests, and helps only when the peak limit needs it."}
+      },
+      "today": "Today", "why": "Why",
+      "modes_off": {"name": "Battery modes are off"},
+      "how": {"name": "How the modes work", "description": "Which battery gets solar first, and when each gives power.",
+        "solar_first": {"description": "Solar first gets spare solar before the other batteries, and covers the house at any hour."},
+        "leftover_solar": {"description": "Leftover solar gets the solar the Solar first batteries cannot take, and saves its power for expensive hours."},
+        "cheap_hours": {"description": "Cheap hours only charges in the cheapest hours and gives power in the expensive ones."},
+        "off": {"description": "Off rests the battery and starts no monthly cycle, but the peak limit may still use it."},
+        "rules": {"description": "The peak limit and the safety stops come first, and while one battery charges from the grid the others rest."}},
+      "toast": {"on": "{name} is on.", "off": "{name} is off.", "mode": "{name}: {mode}."}},
     "settings": {"name": "Settings", "description": "The settings are grouped by task below.", "open": "Open the settings page"}
   },
   "choices_later": {
@@ -107,7 +116,13 @@
   },
   "settings": {
     "name": "Settings",
-    "description": "Every setting, grouped by task, and the simple view follows in a later update.",
+    "description": "Every setting, grouped by task.",
+    "view": {"name": "Settings view", "simple": "Simple", "installer": "Installer"},
+    "simple": {"description": "The choices a home owner makes.",
+      "note": {"month_peak": {"description": "This month's peak so far: {kw}."}, "shadow": {"description": "Use Always on while you test a new installation."}},
+      "batteries": {"name": "Batteries"},
+      "more": {"description": "Looking for the meter, inverters or prices?"},
+      "installer": "Open the installer view"},
     "classic": "Classic settings",
     "search": {"name": "Find a setting", "description": "Find a setting, for example peak or meter."},
     "no_match": {"description": "No setting matches your search."},
@@ -194,7 +209,7 @@
         "5": {"name": "Peak limit", "description": "The grid stays under this limit, averaged over each 15-minute period."},
         "6": {"name": "Check and start", "description": "The add-on checks everything with its own start checks, then restarts."}
       },
-      "modes_later": {"description": "Choosing a mode for each battery comes in a later update."},
+      "modes_later": {"description": "After setup, turn on battery modes to choose a mode for each battery on the Batteries screen."},
       "kettle": {
         "name": "Check the direction",
         "description": "Read the meter, switch on a kettle, then read the meter again.",
@@ -223,7 +238,6 @@
         "again": "Check again",
         "blocked": {"description": "Fix the items marked in red, then check again."}
       },
-      "shadow": {"name": "Start in shadow mode", "description": "Recommended, because every inverter then stays at 0 W until you turn shadow mode off under Settings."},
       "dialog": {"name": "Save and restart?", "description": "Every inverter is set to 0 W while the add-on restarts, and shadow mode keeps them at 0 W after that.", "yes": "Save and restart"},
       "dialog_live": {"name": "Save and restart?", "description": "Every inverter is set to 0 W while the add-on restarts, and then the new settings apply.", "yes": "Save and restart"},
       "dialog_setup": {"name": "Save and restart?", "description": "The add-on restarts with these settings, and shadow mode keeps every inverter at 0 W.", "yes": "Save and restart"},
@@ -236,7 +250,7 @@
   },
   "home_words": {
     "mode_house": "Follows the house",
-    "modes": {"solar_first": "Solar first", "leftover_solar": "Leftover solar", "off": "Off"},
+    "modes": {"solar_first": "Solar first", "leftover_solar": "Leftover solar", "cheap_hours": "Cheap hours only", "off": "Off"},
     "attn_shadow": "Shadow mode is on",
     "attn_shadow_body": "The add-on decides everything, but every inverter stays at 0 W.",
     "zero_held": "Held at 0 W",
@@ -290,7 +304,46 @@
       "cycle": "Monthly cycle under way.",
       "giving": "Giving {kw} now.",
       "charging": "Charging {kw} now.",
-      "resting": "Resting now."
+      "resting": "Resting now.",
+      "off_resting": "Off. Resting now.",
+      "off_peak": "Off, but gives {kw} for the peak limit.",
+      "off_going": "Off. Still at {kw}, going to 0 W."
+    },
+    "why": {
+      "no_reading": "No reading, so the add-on cannot tell.",
+      "held": "An alarm stopped control. See Needs attention.",
+      "stopped": "Control is stopped.",
+      "shadow": "Shadow mode: the add-on only shows what it would do.",
+      "cycle": "The monthly cycle keeps its level reading right.",
+      "cycle_mode": "The monthly cycle comes first. Its mode resumes after.",
+      "off": "You switched it off.",
+      "off_peak": "The peak limit comes before Off. It rests again after.",
+      "refuses_give": "The battery refuses to give power. The add-on tries again every 15 minutes.",
+      "refuses_charge": "The battery refuses to charge. The add-on tries again every 15 minutes.",
+      "peak": "The peak limit needs power from the batteries.",
+      "modes_off": "Battery modes are off, so it follows the house.",
+      "solar_first": "Solar first: it gets spare solar before the others.",
+      "leftover": "It gets the solar that Solar first batteries cannot take.",
+      "leftover_alone": "No Solar first battery is on, so it gets solar first.",
+      "covers_house": "It gives power to cover the house.",
+      "other_refuses": "{name} refuses to give power, so this battery takes over.",
+      "grid_charge": "Prices are low, so it charges from the grid.",
+      "rests_charge": "Another battery charges from the grid, so it rests.",
+      "selling": "Prices are high, so it sells to the grid.",
+      "expensive": "Prices are high, so it covers the house.",
+      "saves": "Saves its power for {at}.",
+      "saves_later": "Saves its power for higher prices.",
+      "no_prices": "No prices, so it follows the house.",
+      "no_spread": "Prices differ too little, so it follows the house."
+    },
+    "today": {
+      "not_planned": "Not planned yet.",
+      "no_runs": "No cheap or expensive hours left today.",
+      "off": "Off, so no monthly cycle today.",
+      "house": "Follows the house.",
+      "house_would": "Would follow the house.",
+      "stopped": "Nothing planned while control is stopped.",
+      "held": "Nothing planned until the alarm clears."
     },
     "head": {
       "held": "Every inverter is at 0 W until the alarm clears.",
@@ -312,6 +365,10 @@
       "give_what": "Gives up to {kwh}, to the house first.",
       "give_what_would": "Would give up to {kwh}, to the house first.",
       "give_why": "Highest published price, {eur} per kWh.",
+      "sell_what": "Sells up to {kwh}, to the house first.",
+      "sell_what_would": "Would sell up to {kwh}, to the house first.",
+      "cheap_why": "Cheapest hours, about {eur} per kWh.",
+      "dear_why": "Expensive hours, about {eur} per kWh.",
       "give_amount": "Worth up to {eur} at that price.",
       "cycle_start": "Starts the monthly battery cycle.",
       "cycle_start_would": "Would start the monthly battery cycle.",

goodwe_controller/app/ui_text/nl.json

@@ -13,7 +13,7 @@
     "inverters.modes": {"name": "Batterijmodi"},
     "tariff.selling": {"name": "Laden en verkopen op prijs"},
     "tariff.feed": {"name": "Details van de prijsfeed"},
-    "safety.peak": {"name": "Piekgrens"},
+    "safety.peak": {"name": "Piekgrens", "description": "De add-on mikt iets onder uw grens, voor de zekerheid."},
     "safety.start": {"name": "Starten en stoppen"},
     "safety.stops": {"name": "Veiligheidsstops", "description": "Gemeten op echte hardware, dus laat ze zoals ze zijn."},
     "maintenance.support": {"name": "Support"}
@@ -81,13 +81,22 @@
     "offline": {"name": "Add-on niet bereikbaar", "description": "De pagina probeert het elke 3 seconden opnieuw."},
     "setup_only": {"name": "Installatie: nog niets wordt geregeld", "description": "Er gaat niets naar een omvormer tot de installatie bewaard is en de add-on herstart.", "control": "De regeling start na de installatie.", "open": "Installatie openen"},
     "batteries": {"name": "Batterijen", "description": "Zet batterijmodi aan in de instellingen om per batterij een modus te kiezen.", "level": "Laadniveau", "now": "Nu", "stored": "Opgeslagen", "mode": "Modus", "settings": "Instellingen van omvormers wijzigen",
-      "with_modes": {"description": "Elke batterij volgt haar modus, na de piekgrens en de veiligheidsstops."},
-      "use": "Deze batterij gebruiken", "on": "Aan", "off": "Uit",
+      "on": "Aan", "off": "Uit",
       "choice": {
         "solar_first": {"name": "Eerst zonne-energie", "description": "Laadt met zonne-energie vóór de andere batterijen en dekt het huis."},
-        "leftover_solar": {"name": "Overschot zonne-energie", "description": "Laadt met zonne-energie die de andere batterijen niet opnemen, en dekt het huis."},
-        "off": {"name": "Uit", "description": "De add-on vraagt deze batterij 0 W, behalve als de piekgrens haar nodig heeft."}
-      }},
+        "leftover_solar": {"name": "Overschot zonne-energie", "description": "Krijgt zonne-energie die de andere niet opnemen, en levert in dure uren."},
+        "cheap_hours": {"name": "Alleen goedkope uren", "description": "Laadt in de goedkoopste uren en levert in de dure uren."},
+        "off": {"name": "Uit", "description": "Rust, en helpt alleen als de piekgrens haar nodig heeft."}
+      },
+      "today": "Vandaag", "why": "Waarom",
+      "modes_off": {"name": "Batterijmodi staan uit"},
+      "how": {"name": "Zo werken de modi", "description": "Welke batterij eerst zonne-energie krijgt, en wanneer elke batterij levert.",
+        "solar_first": {"description": "Eerst zonne-energie krijgt het overschot vóór de andere batterijen, en dekt het huis op elk uur."},
+        "leftover_solar": {"description": "Overschot zonne-energie krijgt wat de batterijen met Eerst zonne-energie niet opnemen, en spaart haar stroom voor dure uren."},
+        "cheap_hours": {"description": "Alleen goedkope uren laadt in de goedkoopste uren en levert in de dure uren."},
+        "off": {"description": "Uit laat de batterij rusten en start geen maandelijkse cyclus, maar de piekgrens mag haar nog gebruiken."},
+        "rules": {"description": "De piekgrens en de veiligheidsstops gaan voor, en terwijl een batterij van het net laadt rusten de andere."}},
+      "toast": {"on": "{name} staat aan.", "off": "{name} staat uit.", "mode": "{name}: {mode}."}},
     "settings": {"name": "Instellingen", "description": "De instellingen staan hieronder per taak.", "open": "Instellingen openen"}
   },
   "choices_later": {"region": {"wallonia": "Wallonië, nog geen standaardwaarde", "brussels": "Brussel, nog geen standaardwaarde"}},
@@ -102,7 +111,13 @@
   },
   "settings": {
     "name": "Instellingen",
-    "description": "Elke instelling, per taak, en de eenvoudige weergave volgt in een latere update.",
+    "description": "Elke instelling, per taak.",
+    "view": {"name": "Weergave van de instellingen", "simple": "Eenvoudig", "installer": "Installateur"},
+    "simple": {"description": "De keuzes die een eigenaar maakt.",
+      "note": {"month_peak": {"description": "De piek van deze maand tot nu: {kw}."}, "shadow": {"description": "Kies Altijd aan terwijl u een nieuwe installatie test."}},
+      "batteries": {"name": "Batterijen"},
+      "more": {"description": "Zoekt u de meter, de omvormers of de prijzen?"},
+      "installer": "De installateursweergave openen"},
     "classic": "Klassieke instellingen",
     "search": {"name": "Instelling zoeken", "description": "Zoek een instelling, bijvoorbeeld piek of meter."},
     "no_match": {"description": "Geen instelling past bij uw zoekopdracht."},
@@ -175,7 +190,7 @@
         "5": {"name": "Piekgrens", "description": "Het net blijft onder deze grens, gemiddeld over elk kwartier."},
         "6": {"name": "Nakijken en starten", "description": "De add-on kijkt alles na met zijn eigen startcontroles en herstart dan."}
       },
-      "modes_later": {"description": "Een modus kiezen per batterij komt in een latere update."},
+      "modes_later": {"description": "Zet na de installatie batterijmodi aan om per batterij een modus te kiezen op het scherm Batterijen."},
       "kettle": {
         "name": "Richting nakijken",
         "description": "Lees de meter af, zet een waterkoker aan en lees de meter opnieuw af.",
@@ -197,7 +212,6 @@
         "needed": {"description": "Doe eerst de waterkokertest, of sla hem over."}
       },
       "check": {"name": "Wat de add-on nakeek", "running": {"description": "Bezig met de startcontroles van de add-on."}, "pass": {"description": "De startcontroles van de add-on zijn in orde."}, "failed": {"description": "De controle liep niet, dus probeer opnieuw."}, "again": "Opnieuw nakijken", "blocked": {"description": "Los de rood gemarkeerde punten op en kijk dan opnieuw na."}},
-      "shadow": {"name": "Starten in schaduwmodus", "description": "Aanbevolen, want dan blijft elke omvormer op 0 W tot u de schaduwmodus uitzet onder Instellingen."},
       "dialog": {"name": "Bewaren en herstarten?", "description": "Elke omvormer gaat naar 0 W terwijl de add-on herstart, en de schaduwmodus houdt ze daarna op 0 W.", "yes": "Bewaren en herstarten"},
       "dialog_live": {"name": "Bewaren en herstarten?", "description": "Elke omvormer gaat naar 0 W terwijl de add-on herstart, daarna gelden de nieuwe instellingen.", "yes": "Bewaren en herstarten"},
       "dialog_setup": {"name": "Bewaren en herstarten?", "description": "De add-on herstart met deze instellingen, en de schaduwmodus houdt elke omvormer op 0 W.", "yes": "Bewaren en herstarten"},
@@ -210,7 +224,7 @@
   },
   "home_words": {
     "mode_house": "Volgt het huis",
-    "modes": {"solar_first": "Eerst zonne-energie", "leftover_solar": "Overschot zonne-energie", "off": "Uit"},
+    "modes": {"solar_first": "Eerst zonne-energie", "leftover_solar": "Overschot zonne-energie", "cheap_hours": "Alleen goedkope uren", "off": "Uit"},
     "attn_shadow": "Schaduwmodus staat aan",
     "attn_shadow_body": "De add-on beslist alles, maar elke omvormer blijft op 0 W.",
     "zero_held": "Op 0 W gehouden",
@@ -232,7 +246,46 @@
       "cycle": "Maandelijkse cyclus bezig.",
       "giving": "Levert nu {kw}.",
       "charging": "Laadt nu {kw}.",
-      "resting": "Rust nu."
+      "resting": "Rust nu.",
+      "off_resting": "Uit. Rust nu.",
+      "off_peak": "Uit, maar levert {kw} voor de piekgrens.",
+      "off_going": "Uit. Nog {kw}, gaat naar 0 W."
+    },
+    "why": {
+      "no_reading": "Geen meting, dus de add-on weet het niet.",
+      "held": "Een alarm stopte de regeling. Zie Vraagt aandacht.",
+      "stopped": "De regeling is gestopt.",
+      "shadow": "Schaduwmodus: de add-on toont alleen wat hij zou doen.",
+      "cycle": "De maandelijkse cyclus houdt de meting van het laadniveau juist.",
+      "cycle_mode": "De maandelijkse cyclus gaat voor. Daarna volgt ze weer haar modus.",
+      "off": "U hebt haar uitgezet.",
+      "off_peak": "De piekgrens gaat voor op Uit. Daarna rust ze weer.",
+      "refuses_give": "De batterij weigert te leveren. De add-on probeert het elke 15 minuten opnieuw.",
+      "refuses_charge": "De batterij weigert te laden. De add-on probeert het elke 15 minuten opnieuw.",
+      "peak": "De piekgrens vraagt vermogen van de batterijen.",
+      "modes_off": "Batterijmodi staan uit, dus ze volgt het huis.",
+      "solar_first": "Eerst zonne-energie: ze krijgt het overschot vóór de andere.",
+      "leftover": "Ze krijgt de zonne-energie die de batterijen met Eerst zonne-energie niet opnemen.",
+      "leftover_alone": "Geen batterij met Eerst zonne-energie staat aan, dus zij krijgt eerst zonne-energie.",
+      "covers_house": "Ze levert stroom om het huis te dekken.",
+      "other_refuses": "{name} weigert te leveren, dus deze batterij neemt het over.",
+      "grid_charge": "De prijs is laag, dus ze laadt van het net.",
+      "rests_charge": "Een andere batterij laadt van het net, dus deze rust.",
+      "selling": "De prijs is hoog, dus ze verkoopt aan het net.",
+      "expensive": "De prijs is hoog, dus ze dekt het huis.",
+      "saves": "Spaart haar stroom voor {at}.",
+      "saves_later": "Spaart haar stroom voor hogere prijzen.",
+      "no_prices": "Geen prijzen, dus ze volgt het huis.",
+      "no_spread": "De prijzen verschillen te weinig, dus ze volgt het huis."
+    },
+    "today": {
+      "not_planned": "Nog niet gepland.",
+      "no_runs": "Vandaag geen goedkope of dure uren meer.",
+      "off": "Uit, dus vandaag geen maandelijkse cyclus.",
+      "house": "Volgt het huis.",
+      "house_would": "Zou het huis volgen.",
+      "stopped": "Niets gepland zolang de regeling gestopt is.",
+      "held": "Niets gepland tot het alarm weg is."
     },
     "head": {
       "held": "Elke omvormer staat op 0 W tot het alarm weg is.",
@@ -254,6 +307,10 @@
       "give_what": "Levert tot {kwh}, eerst aan het huis.",
       "give_what_would": "Zou tot {kwh} leveren, eerst aan het huis.",
       "give_why": "Hoogste gepubliceerde prijs, {eur} per kWh.",
+      "sell_what": "Verkoopt tot {kwh}, eerst aan het huis.",
+      "sell_what_would": "Zou tot {kwh} verkopen, eerst aan het huis.",
+      "cheap_why": "Goedkoopste uren, ongeveer {eur} per kWh.",
+      "dear_why": "Dure uren, ongeveer {eur} per kWh.",
       "give_amount": "Tot {eur} waard aan die prijs.",
       "cycle_start": "Start de maandelijkse batterijcyclus.",
       "cycle_start_would": "Zou de maandelijkse batterijcyclus starten.",

goodwe_controller/app/uilayout.py

@@ -46,6 +46,7 @@ class Field:
     wizard: int = 0             # setup wizard step 1-6, 0 = not in the wizard
     mirror: str = ""            # a choice also copied to this field, if offered
     fills: str = ""             # a preset choice fills this field (uimodel)
+    note: str = ""              # P3: a line under it on Settings, Simple
 
     @property
     def text(self) -> str:
@@ -180,12 +181,14 @@ GROUPS = (
     Group("safety", (
         Part("peak", (
             Field("peak_cap_w", SLIDER, "kW", scale=1000, step=100,
-                  simple=True, wizard=5),
+                  simple=True, wizard=5, note="month_peak"),
+            Field("peak_margin_w", SLIDER, "W", step=10),   # SAFETY-79
             Field("peak_forecast_entity", ENTITY, kind="power_w", wizard=5),
             Field("peak_soc_floor", LOCKED, "%"),
         )),
         Part("start", (
-            Field("shadow_mode", SEGMENTED, simple=True, wizard=6),
+            Field("shadow_mode", SEGMENTED, simple=True, wizard=6,
+                  note="shadow"),
             Field("auto_start", TOGGLE),
             Field("estop_fitted", TOGGLE),
             Field("stale_input_s", SLIDER, "s"),

goodwe_controller/app/uipage.py

@@ -99,7 +99,7 @@ def _field(fld, schema_ui, translations, lang, T):
            "help": text, "unit": fld.unit, "scale": fld.scale,
            "step": fld.step, "kind": fld.kind,
            "show": [list(c) for c in fld.show], "applies": fld.applies,
-           "wizard": fld.wizard,
+           "wizard": fld.wizard, "simple": fld.simple, "note": fld.note,
            "type": value_type, "optional": not node.get("required", False),
            # A choice mirrored into a field also shows (and finds) its keys.
            "writes": sorted(k for k, how in L.DERIVED.items()

goodwe_controller/app/validate.py

@@ -243,6 +243,9 @@ NOT READY banner already names the problem, (b) does not apply.
      note below on `gain`, which is the term that owns that and which SAFETY-39
      measured and did not change.
 
+ 12. `peak_margin_w` outside 0-500 W, not whole, or not below `peak_cap_w`.
+     SAFETY-79; the Supervisor checks the range too, but not for sim/inject.py.
+
 WHAT IS DELIBERATELY *NOT* REFUSED, because it is untidy rather than unsafe:
 
   - `integrator_max_w` above `max_w`. DOCS.md is right that the only thing the
@@ -333,7 +336,7 @@ from .inverter import roster_entries
 from .maintenance import MAINT_OPTION_DEFAULTS
 from .p1 import (
     SOURCE_HA, SOURCE_HA_SIGNED, is_enabled, validate_meter_options)
-from .peakguard import PEAK_OPTION_DEFAULTS
+from .peakguard import PEAK_MARGIN_RANGE_W, PEAK_OPTION_DEFAULTS
 from .price import (
     PRICE_OPTION_DEFAULTS, PROVIDERS, RETIRED_PROVIDERS,
     SUPERSEDED_TAXES_DEFAULTS_EUR_KWH)
@@ -1194,6 +1197,9 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None,
                 f"reserve above {bms_floor:.0f} %, or correct the cut-out "
                 "level.")
 
+    # --- 12. SAFETY-79: the margin the peak guard keeps under the limit -----
+    problems += _margin_problems(opts)
+
     # --- warnings: real, but not worth refusing over -------------------------
     integ = opts.get("integrator_max_w")
     integ_w = None if not integ else _number(opts, "integrator_max_w", None)
@@ -2022,6 +2028,23 @@ def _price_check(notes, opts, running, prices_known) -> None:
                 "Prices are fetched after the restart, and Home shows them.")
 
 
+def _margin_problems(opts: dict) -> list[str]:
+    """Rule 12: `peak_margin_w` is a whole number in the schema's range, and
+    below the peak limit, which would leave nothing to aim at."""
+    raw = opts.get("peak_margin_w")
+    margin = _number(opts, "peak_margin_w",
+                     PEAK_OPTION_DEFAULTS["peak_margin_w"])
+    lo, hi = PEAK_MARGIN_RANGE_W
+    if margin is None or margin != int(margin) or not lo <= margin <= hi:
+        return [f"{S('peak_margin_w')} must be a whole number from {lo} to "
+                f"{hi} W. It is {messages.shown(raw)}."]
+    cap = _number(opts, "peak_cap_w", None)
+    if cap is not None and margin >= cap:
+        return [f"{S('peak_margin_w')} is {margin:.0f} W, not below the "
+                f"{S('peak_cap_w')} of {cap:.0f} W. Lower the margin."]
+    return []
+
+
 def _number(opts: dict, key, default):
     raw = opts.get(key, default)
     if raw is None or raw == "":

goodwe_controller/app/web.py

@@ -34,7 +34,8 @@ succeeds, so the page stops opening the wizard by itself (uipage.setup_needed).
 UX-15's setup-only mode serves these routes from `setuponly.SetupOnly`, which
 commands nothing; there `/action` answers 409.
 OPT-11 P1 adds two `/action` values, `pack_use` and `pack_mode`, which set one
-battery's on/off switch or mode in the store (Controller._pack_action). They
+battery's on/off switch or mode in the store (Controller._pack_action); P3 adds
+`pack_sell`, that battery's selling switch. They
 are the only actions that name a battery; the configuration routes still reach
 none of them.
 """
@@ -58,7 +59,7 @@ from .uimodel import DeriveError, options_to_ui
 _LOG = logging.getLogger("goodwe.web")
 
 # OPT-11: the per-battery actions, which name a battery and a value.
-PACK_ACTIONS = ("pack_use", "pack_mode")
+PACK_ACTIONS = ("pack_use", "pack_mode", "pack_sell")
 
 # UX-13 P1: the page lives in app/static/ as three files - index.html,
 # app.css, app.js - plus the page words from app/ui_text/<lang>.json (English

goodwe_controller/config.yaml

@@ -290,6 +290,8 @@ options:
   # protects the shallower pack with the deeper pack's number.
   bms_soc_floor: 10
   peak_cap_w: 3500
+  # SAFETY-79: the peak guard aims this many watts under peak_cap_w.
+  peak_margin_w: 50
   peak_forecast_entity: ""
 
   # The peak guard can COMMAND a discharge to hold a billed quarter under
@@ -1019,6 +1021,7 @@ schema:
   max_w: int(100,5000)
   bms_soc_floor: int(0,50)
   peak_cap_w: int(500,15000)
+  peak_margin_w: int(0,500)
   peak_forecast_entity: str?
 
   # SAFETY-24. No "off" value: a guard that can command a discharge does not get

goodwe_controller/test_arbitrage.py

@@ -1039,7 +1039,7 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
             now = t0 + timedelta(seconds=t)
             claims = []
             pk = _pg.decide(PeakTracker.project(avg, now), batt_w=batt,
-                            cap_w=cap_w, reading=None, achievable_w=MAX_W,
+                            cap_w=cap_w, margin_w=0.0, reading=None, achievable_w=MAX_W,
                             soc=50.0, soc_floor=20.0, max_hold_s=900.0,
                             frozen=False)
             pc = _pg.claim(pk)
@@ -1380,7 +1380,7 @@ def _s47_headroom(*, meter_w, batt_w, elapsed_s=450.0):
         t += 5.0
     pk = _pg.decide(
         PeakTracker.project(avg, S45_T0 + timedelta(seconds=elapsed_s)),
-        batt_w=batt_w, cap_w=S45_CAP_W, reading=None, achievable_w=MAX_W,
+        batt_w=batt_w, cap_w=S45_CAP_W, margin_w=0.0, reading=None, achievable_w=MAX_W,
         soc=50.0, soc_floor=20.0, max_hold_s=900.0, frozen=False)
     return _pg.charge_headroom_w(pk)
 

goodwe_controller/test_batteries_screen.py

@@ -0,0 +1,479 @@
+"""UX-13 P3: the Batteries screen and Settings, Simple.  `python3 test_batteries_screen.py`
+
+1. Each battery's Now, Today and Why lines, in English and Dutch, for the six
+   states the brief names: modes off, modes on, a battery Off, an Off battery
+   giving way to the peak limit, a refusal hold, and the monthly cycle.
+2. The OPT-11 P1 test's F2 contradictions stay gone: a battery that moves
+   power never reads "0 W" beside it, the Off help names no watts, and no
+   battery line says the peak limit "holds back" a battery it asks for power.
+3. The plan leaves an Off battery out, except for the peak limit.
+4. `battery_why()` is pure and picks the most urgent reason first.
+5. The screen's `/action` round trips over the real web app: the switch and
+   the mode list post `pack_use` and `pack_mode`, `/status` shows the result
+   in both languages, and a refused value comes back as a plain 400.
+6. The page: the cards, the Simple view and its fields come from the layout
+   table and ui_text, and the scripts post only the existing actions.
+7. The screen changes no control path: homeview.py reads the controller and
+   calls nothing that writes, and the page adds no /action value.
+The headless-browser check is in the PR, not in CI (the CI image has no
+browser). Mutating a module this file grades? Read MUTATION.md first.
+"""
+
+import ast
+import asyncio
+import io
+import json
+import os
+import re
+import socket
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import aiohttp                                                  # noqa: E402
+from aiohttp import web as aioweb                               # noqa: E402
+
+import ux13_demo as D                                           # noqa: E402
+from app import homeview, messages, packmode, uilayout as L, uipage, web  # noqa
+from app.maintenance import IDLE, DRAIN                         # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def words(lang):
+    with io.open(os.path.join(HERE, "app", "ui_text", f"{lang}.json"),
+                 encoding="utf-8") as f:
+        return json.load(f)
+
+
+EN, NL = words("en"), words("nl")
+B_NAME = D.OPTS["inverters"][1]["name"]
+LANGS = {"en": EN, "nl": NL}
+
+
+# The fixture's prices are for the day it is built, so the plan depends on
+# the hour. Pin the clock (review of #150: unpinned, this file failed every
+# morning): the fixture is built at 00:15 on 2026-09-28, Brussels time. Part 1
+# looks at 23:30, when the day's trades and cycle start are past, and part 3
+# at 00:30, with all of them ahead.
+_BUILT = datetime(2026, 9, 27, 22, 15, tzinfo=timezone.utc)
+
+
+class _Clock(datetime):
+    @classmethod
+    def now(cls, tz=None):
+        return _BUILT.astimezone(tz) if tz else _BUILT.replace(tzinfo=None)
+
+
+D.datetime = _Clock
+_DAY0 = homeview.local_day(_BUILT)[0]
+EVENING = _DAY0 + timedelta(hours=23, minutes=30)
+MORNING = _DAY0 + timedelta(minutes=30)
+
+
+def build(state, lang="en", c=None, now=None):
+    c = c or D.controller(state)
+    s = c.status_payload()
+    return homeview.build(c, level=s["level"], checks=s["checks"], lang=lang,
+                          now=now or EVENING)
+
+
+# The six states and what each battery's Why line must be.
+WANT = {
+    "running": ("modes_off", "modes_off"),
+    "modes": ("solar_first", "leftover"),
+    "off": ("solar_first", "off"),
+    "off_peak": ("peak", "off_peak"),
+    "refusal": ("refuses_give", "other_refuses"),
+    "maint": ("cycle_mode", "leftover"),
+}
+
+# ============================================================================ #
+print("1. Now, Today and Why per battery, English and Dutch")
+ROWS = {(st, lang): build(st, lang) for st in WANT for lang in LANGS}
+for st, want in WANT.items():
+    got = tuple(b["why_key"] for b in ROWS[(st, "en")]["batteries"])
+    en = ROWS[(st, "en")]["batteries"]
+    nl = ROWS[(st, "nl")]["batteries"]
+    print(f"    {st}: " + " / ".join(f"{b['now']} | {b['why']} | "
+                                     f"{b['today_line'] or b['today']}"
+                                     for b in en))
+    check(f"{st}: the Why lines are {want}, in each language's own words",
+          got == want
+          and all(b["why"] == homeview.uitext.say(
+              W["home_words"]["why"][b["why_key"]],
+              name=D.OPTS["inverters"][0]["name"])
+              for W, rows in ((EN, en), (NL, nl)) for b in rows))
+    check(f"{st}: every battery has a Now, a Why and a Today, and the Dutch "
+          f"lines differ from the English",
+          all(b["now"] and b["why"] and (b["today"] or b["today_line"])
+              for b in en + nl)
+          and all(e["why"] != n["why"] and e["now"] != n["now"]
+                  for e, n in zip(en, nl)))
+
+_modes = ROWS[("modes", "en")]
+check("modes on: each row carries its switch and mode; Today says Solar "
+      "first follows the house and, before any cycle has made the price "
+      "runs (OPT-11 P3), that Leftover solar is not planned yet",
+      _modes["modes_on"] is True
+      and [(b["use"], b["mode_key"]) for b in _modes["batteries"]]
+      == [(True, "solar_first"), (True, "leftover_solar")]
+      and [b["today_line"] for b in _modes["batteries"]]
+      == [EN["home_words"]["today"]["house"],
+          EN["home_words"]["today"]["not_planned"]])
+_off = ROWS[("running", "en")]
+check("modes off: no switch, no mode, and Today and Why say it follows the "
+      "house", _off["modes_on"] is False
+      and all("mode_key" not in b and "use" not in b
+              and b["today_line"] == EN["home_words"]["today"]["house"]
+              for b in _off["batteries"]))
+_b = ROWS[("off", "en")]["batteries"][1]
+check("a battery Off: 'Off. Resting now.', 'You switched it off.', and no "
+      "monthly cycle today", (_b["mode_key"], _b["now"], _b["why"],
+                              _b["today_line"])
+      == ("off", EN["home_words"]["now"]["off_resting"],
+          EN["home_words"]["why"]["off"], EN["home_words"]["today"]["off"]))
+_b = ROWS[("off_peak", "en")]["batteries"][1]
+_bn = ROWS[("off_peak", "nl")]["batteries"][1]
+check("Off giving way to the peak limit says so plainly, with the figure: "
+      "'Off, but gives 0.5 kW for the peak limit.'",
+      _b["now"] == "Off, but gives 0.5 kW for the peak limit."
+      and _bn["now"] == "Uit, maar levert 0,5 kW voor de piekgrens."
+      and _b["why"] == EN["home_words"]["why"]["off_peak"])
+_a, _b = ROWS[("refusal", "en")]["batteries"]
+check("a refusal hold: the refusing battery says it refuses and when it "
+      "tries again, the other says it takes over",
+      _a["why"] == EN["home_words"]["why"]["refuses_give"]
+      and _b["why"] == "Battery A refuses to give power, so this battery "
+                       "takes over.")
+_a = ROWS[("maint", "en")]["batteries"][0]
+check("maintenance: the cycle comes first, the mode resumes after, and Today "
+      "shows the cycle block", _a["maintenance"] == DRAIN
+      and _a["why"] == EN["home_words"]["why"]["cycle_mode"]
+      and [r["kind"] for r in _a["today"]] == ["cycle"])
+_sh = build("shadow")["batteries"]
+_al = build("alarm")["batteries"]
+check("shadow mode and an alarm: Why says which, and Today plans nothing "
+      "the add-on does not do",
+      all(b["why_key"] == "shadow" and b["today_line"]
+          == EN["home_words"]["today"]["house_would"] for b in _sh)
+      and all(b["why_key"] == "held" and b["today_line"]
+              == EN["home_words"]["today"]["held"] for b in _al))
+
+# ============================================================================ #
+print("\n2. the OPT-11 P1 test's F2: no line contradicts the power shown")
+ZERO = re.compile(r"\b0 W\b")
+GOING = (EN["home_words"]["zero_going"], NL["home_words"]["zero_going"],
+         "going to 0 W", "gaat naar 0 W")
+_bad = []
+for (st, lang), payload in sorted(ROWS.items()):
+    for b in payload["batteries"]:
+        moving = b["power_w"] is not None and abs(b["power_w"]) > homeview.IDLE_W
+        if moving and b.get("maintenance", IDLE) == IDLE:
+            kw = homeview._dec(f"{abs(b['power_w']) / 1000:.1f}")
+            kw = kw.replace(".", ",") if lang == "nl" else kw
+            if kw not in b["now"]:
+                _bad.append(f"{st}/{lang}/{b['name']}: no figure in {b['now']!r}")
+            for line in (b["now"], b["why"]):
+                if ZERO.search(line) and not any(g in line for g in GOING):
+                    _bad.append(f"{st}/{lang}/{b['name']}: 0 W beside power: "
+                                f"{line!r}")
+        if "held back" in b["why"] or "tegengehouden" in b["why"]:
+            _bad.append(f"{st}/{lang}/{b['name']}: {b['why']!r}")
+print(f"    {_bad}")
+check("a battery that moves power shows the figure, and no line beside it "
+      "says 0 W", not _bad)
+check("the Off help names no watts, in either language, and says the peak "
+      "limit may use the battery",
+      all(not ZERO.search(W["home"]["batteries"]["choice"]["off"]
+                          ["description"]) for W in LANGS.values())
+      and "peak limit" in EN["home"]["batteries"]["choice"]["off"]
+      ["description"])
+_going = homeview.battery_now(62, 900, phase=IDLE, shadow=False, running=True,
+                              off=True, peak=False)
+check("an Off battery still moving without the peak limit reads 'going to "
+      "0 W' with its figure, never a bare 0 W",
+      _going == "Off. Still at 0.9 kW, going to 0 W.")
+
+# ============================================================================ #
+print("\n3. the plan leaves an Off battery out, except for the peak limit")
+_c = D.controller("off")
+_c.maints[1].cfg = _c.maints[0].cfg      # both due, so both would be drawn
+_p = build("off", c=_c)
+_kinds = {i: {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == i}
+          for i in (0, 1)}
+print(f"    {_kinds}")
+check("Off: no 'follows the house', no trade, no monthly cycle for B",
+      not _kinds[1] and "house" in _kinds[0])
+_p = build("off", now=MORNING)
+# OPT-11 P3: with modes on the plan shows each battery's price runs, which a
+# control cycle makes; make them as the cycle does (`_mode_roles()`).
+_mc = D.controller("modes")
+_mc._mode_roles(MORNING, None)
+_m = build("modes", c=_mc, now=MORNING)
+_kinds = {i: {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == i}
+          for i in (0, 1)}
+print(f"    morning: {_kinds}, lines {_p['plan']['lines']}")
+check("in the morning, with trades and a cycle ahead: Solar first A follows "
+      "the house and has its cycle but no price block (OPT-11 P3: Solar first "
+      "never trades), Off B has no block and waits for no cycle; with B on "
+      "(Leftover solar) B has its expensive run but no grid block (it takes "
+      "solar only until the forecast, owner decision 2026-09-29) and waits",
+      {"house", "cycle"} == _kinds[0] and not _kinds[1]
+      and not any(B_NAME in x for x in _p["plan"]["lines"])
+      and "give" in {r["kind"] for r in _m["plan"]["runs"]
+                     if r["battery"] == 1}
+      and "grid" not in {r["kind"] for r in _m["plan"]["runs"]
+                         if r["battery"] == 1}
+      and any(B_NAME in x for x in _m["plan"]["lines"]))
+_p = build("off_peak")
+check("...but the peak block stays on it while the peak limit needs it",
+      {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == 1}
+      == {"peak"})
+# Review: an Off battery that A covers alone rests, so it gets no peak block,
+# and a card never says "every battery gives" beside it.
+_c = D.controller("off_peak")
+_c.inverters[1].batt = 0.0
+_p = build("off_peak", c=_c)
+_a, _b = _p["batteries"]
+check("peak limit covered by A alone: Off B rests, has no peak block, and "
+      "A's Why does not claim every battery gives",
+      _b["why_key"] == "off" and _b["now"] == EN["home_words"]["now"]
+      ["off_resting"] and not _b["today"]
+      and {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == 0}
+      >= {"peak"} and _a["why_key"] == "peak"
+      and "every" not in _a["why"] and "elke" not in
+      build("off_peak", "nl", c=_c)["batteries"][0]["why"])
+# Review: a blind or floor-limited guard is engaged with a 0 W floor. It
+# forbids charging only, so no battery gives power for it.
+_bad = []
+for _kw in (dict(blind="meter gap"), dict(floor_limited=True)):
+    _c = D.controller("off_peak")
+    _c.peak_guard = homeview.peakguard.PeakDecision(
+        engaged=True, floor_w=0.0, ceiling_w=3500.0, ceiling_from="cap",
+        projected_w=None, **_kw)
+    _c.inverters[1].batt = 300.0          # B still going to 0 W
+    _p = build("off_peak", c=_c)
+    _a, _b = _p["batteries"]
+    if (_a["why_key"] == "peak" or _b["why_key"] == "off_peak"
+            or "peak limit" in _b["now"]
+            or any(r["kind"] == "peak" for r in _p["plan"]["runs"])):
+        _bad.append((_kw, _a["why_key"], _b["why_key"], _b["now"]))
+print(f"    {_bad}")
+check("a blind or floor-limited peak guard (floor 0 W) draws no peak block "
+      "and no line says the peak limit takes power", not _bad)
+
+# ============================================================================ #
+print("\n4. battery_why(): pure, most urgent first")
+BASE = dict(modes_on=True, mode=packmode.SOLAR_FIRST, off=False, reading=True,
+            phase=IDLE, shadow=False, running=True, held=False, refused=0,
+            peak=False, giving=False, sf_ahead=False)
+
+
+def why(**kw):
+    return homeview.battery_why(**dict(BASE, **kw))
+
+
+_cases = [
+    (dict(reading=False, held=True), "no_reading"),
+    (dict(held=True, shadow=True), "held"),
+    (dict(running=False, off=True), "stopped"),
+    (dict(shadow=True, phase=DRAIN), "shadow"),
+    (dict(phase=DRAIN, off=True), "cycle_mode"),
+    (dict(phase=DRAIN, modes_on=False), "cycle"),
+    (dict(off=True, peak=True, giving=True), "off_peak"),
+    (dict(off=True, peak=True, giving=False), "off"),   # charging or resting
+    (dict(off=True, giving=True), "off"),
+    (dict(refused=1, peak=True), "refuses_give"),
+    (dict(refused=-1), "refuses_charge"),
+    (dict(peak=True, giving=True, other_refuses="B"), "peak"),
+    (dict(giving=True, other_refuses="B", modes_on=False), "other_refuses"),
+    (dict(modes_on=False, giving=True), "modes_off"),
+    (dict(giving=True, mode=packmode.LEFTOVER_SOLAR), "covers_house"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, sf_ahead=True), "leftover"),
+    (dict(mode=packmode.LEFTOVER_SOLAR), "leftover_alone"),
+    ({}, "solar_first"),
+    # OPT-11 P3: the battery's role in the price runs, and no plan.
+    (dict(mode=packmode.CHEAP_HOURS, role="charge"), "grid_charge"),
+    (dict(role="rest"), "rests_charge"),
+    (dict(mode=packmode.CHEAP_HOURS, role="sell", giving=True), "selling"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="give", giving=True),
+     "expensive"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="hold", has_at=True), "saves"),
+    (dict(mode=packmode.CHEAP_HOURS, role="hold"), "saves_later"),
+    (dict(mode=packmode.CHEAP_HOURS, role="house", plan="no_prices"),
+     "no_prices"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="house", plan="no_spread",
+          giving=True), "no_spread"),
+    # ...and the urgent reasons still come first.
+    (dict(role="charge", refused=-1), "refuses_charge"),
+    (dict(role="sell", peak=True), "peak"),
+    (dict(role="hold", off=True), "off"),
+]
+_wrong = [(kw, want, why(**kw)) for kw, want in _cases if why(**kw) != want]
+print(f"    {_wrong}")
+check(f"{len(_cases)} cases, each the expected reason", not _wrong)
+check("every reason it can return has words in both languages",
+      {w for _k, w in _cases} == set(EN["home_words"]["why"])
+      == set(NL["home_words"]["why"]))
+
+# ============================================================================ #
+print("\n5. /action round trips from the screen, over the real web app")
+
+
+async def _serve(state, calls):
+    c = D.controller(state)
+    stored = dict(D.defaults(D.CONFIG), **D.OPTS)
+    runner = aioweb.AppRunner(web.build_app(c, D.Supervisor(stored)))
+    await runner.setup()
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    await aioweb.TCPSite(runner, "127.0.0.1", port).start()
+    out = []
+    try:
+        async with aiohttp.ClientSession() as s:
+            root = f"http://127.0.0.1:{port}/"
+            for body, lang in calls:
+                if body is not None:
+                    async with s.post(root + "action", json=body) as r:
+                        out.append((r.status,
+                                    await r.json(content_type=None)))
+                async with s.get(root + "status?lang=" + lang) as r:
+                    out.append((r.status, await r.json(content_type=None)))
+    finally:
+        await runner.cleanup()
+    return out
+
+
+A, B = (i["name"] for i in D.OPTS["inverters"])
+# Exactly what app.js posts: {action, unit, value}.
+_r = asyncio.run(_serve("modes", [
+    ({"action": "pack_use", "unit": B, "value": False}, "en"),
+    ({"action": "pack_mode", "unit": A, "value": packmode.LEFTOVER_SOLAR},
+     "nl"),
+    ({"action": "pack_use", "unit": B, "value": True}, "en"),
+    ({"action": "pack_mode", "unit": A, "value": "cheap_hours"}, "en"),
+    ({"action": "pack_sell", "unit": A, "value": True}, "en"),
+    ({"action": "pack_sell", "unit": A, "value": "yes"}, "en"),
+    ({"action": "pack_mode", "unit": A, "value": "sell_only"}, "en"),
+]))
+(_s1, _j1), (_, _st1), (_s2, _j2), (_, _st2), (_s3, _), (_, _st3), \
+    (_s4, _j4), (_, _st4), (_s5, _j5), (_, _st5), (_s6, _j6), (_, _st6), \
+    (_s7, _j7), (_, _st7) = _r
+check("switch B off: 200, and /status shows B Off with 'You switched it off.'",
+      _s1 == 200 and _j1["result"]["use"] is False
+      and _st1["batteries"][1]["mode_key"] == "off"
+      and _st1["batteries"][1]["why"] == EN["home_words"]["why"]["off"])
+check("set A to Leftover solar: 200, and /status?lang=nl shows it in Dutch",
+      _s2 == 200 and _st2["batteries"][0]["mode_choice"]
+      == packmode.LEFTOVER_SOLAR
+      and _st2["batteries"][0]["mode"]
+      == NL["home_words"]["modes"]["leftover_solar"])
+check("switch B back on: its stored mode returns",
+      _s3 == 200 and _st3["batteries"][1]["mode_key"]
+      == packmode.LEFTOVER_SOLAR)
+check("OPT-11 P3: Cheap hours only is a mode now: 200, and /status shows it",
+      _s4 == 200 and _st4["batteries"][0]["mode_choice"]
+      == packmode.CHEAP_HOURS)
+check("owner decision 2026-09-29 (option A): selling is off, so a posted "
+      "pack_sell is refused with the plain reason 'Selling is off for now.', "
+      "and /status says no battery sells or can",
+      _s5 == 400 and _j5["error"] == messages.pack_refused("sell_off")
+      and _s6 == 400 and all(b["sell"] is False and b["can_sell"] is False
+                             for b in _st5["batteries"] + _st6["batteries"]))
+check("...a mode that does not exist is refused with a plain 400, and "
+      "nothing changes", _s7 == 400 and _j7["error"]
+      and _st7["batteries"][0]["mode_choice"] == packmode.CHEAP_HOURS)
+_r = asyncio.run(_serve("running", [
+    ({"action": "pack_use", "unit": B, "value": False}, "en")]))
+check("with battery modes off the switch is refused with the plain reason, "
+      "and the batteries stay on", _r[0][0] == 400 and _r[0][1]["error"]
+      and "mode_key" not in _r[1][1]["batteries"][1])
+
+# ============================================================================ #
+print("\n6. the page")
+PAGE = web.page()
+JS = io.open(os.path.join(HERE, "app", "static", "app.js"),
+             encoding="utf-8").read()
+SJS = io.open(os.path.join(HERE, "app", "static", "settings.js"),
+              encoding="utf-8").read()
+check("the Batteries screen has its cards, the modes-off card and 'How the "
+      "modes work'", all(f'id="{i}"' in PAGE for i in
+                         ("bcards", "batt-off", "batt-how", "batt-banner")))
+check("Settings has a Simple / Installer choice as a radio group, and Simple "
+      "comes first", re.search(r'id="set-view"[^>]*>\s*<button[^>]*'
+                               r'data-v="simple"', PAGE) is not None
+      and PAGE.count('role="radio"') >= 2 and 'id="simple"' in PAGE)
+_acts = set(re.findall(r'packAct\("(\w+)"', JS))
+check(f"the cards post only the existing actions ({sorted(_acts)}), as "
+      f"{{action, unit, value}}; selling has no control while it is off",
+      _acts == set(web.PACK_ACTIONS) - {"pack_sell"}
+      and packmode.SELLING_ENABLED is False
+      and "action: what, unit: b.name, value: value" in JS)
+check("the switch is a real switch and the list offers the three modes, "
+      "cheap hours included, with nothing greyed out",
+      'role: "switch"' in JS and '"aria-checked"' in JS
+      and 'const MODES = ["solar_first", "leftover_solar", "cheap_hours"];'
+      in JS and "batteries.later" not in JS)
+check("no selling switch anywhere on the page or in Settings, and no words "
+      "for one", "pack_sell" not in JS and "sell" not in SJS
+      and "batteries.sell" not in JS
+      and all("sell" not in W["home"]["batteries"] for W in LANGS.values()))
+_T = uipage.ui_text("en")
+_lay = uipage.layout(D.schema_ui(D.CONFIG), {"en": {}})
+_simple = [f for g in _lay["groups"] for p in g["parts"] for f in p["fields"]
+           if f.get("simple")]
+check("Settings, Simple draws the fields the layout marks, and each note "
+      "has words in both languages",
+      sorted(f["key"] for f in _simple)
+      == sorted(f.key for g in L.GROUPS for p in g.parts for f in p.fields
+                if f.simple)
+      and all(f["note"] in EN["settings"]["simple"]["note"]
+              and f["note"] in NL["settings"]["simple"]["note"]
+              for f in _simple if f["note"]))
+check("settings.js picks them by the `simple` flag and names no option key",
+      "f.simple" in SJS and not any(f'"{f.key}"' in SJS for g in L.GROUPS
+                                    for p in g.parts for f in p.fields))
+
+# ============================================================================ #
+print("\n7. no control path changes: the screen reads, it does not write")
+SRC = io.open(os.path.join(HERE, "app", "homeview.py"), encoding="utf-8").read()
+WRITES = {"set_number", "store_set", "set", "set_time", "handle_action",
+          "log_event", "abort", "tick", "publish", "call", "write",
+          "_pack_action", "_maint_stop_off"}
+_calls = sorted({n.func.attr for n in ast.walk(ast.parse(SRC))
+                 if isinstance(n, ast.Call)
+                 and isinstance(n.func, ast.Attribute)
+                 and n.func.attr in WRITES})
+check(f"homeview.py calls nothing that writes state or commands an inverter "
+      f"({_calls})", not _calls)
+_imports = sorted({(n.module or "") for n in ast.walk(ast.parse(SRC))
+                   if isinstance(n, ast.ImportFrom)})
+check(f"...and imports no module that sends power requests ({_imports})",
+      not {"main", "inverter", "hass", "control", "allocator",
+           "arbiter"} & {m.lstrip(".") for m in _imports})
+_c = D.controller("off_peak")
+_before = (json.dumps(_c.store.data, sort_keys=True, default=str),
+           [(i.last_write, i.target) for i in _c.inverters])
+for lang in LANGS:
+    build("off_peak", lang, c=_c)
+check("building the screen twice leaves the store and every power request "
+      "as it was", _before
+      == (json.dumps(_c.store.data, sort_keys=True, default=str),
+          [(i.last_write, i.target) for i in _c.inverters]))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")

goodwe_controller/test_messages.py

@@ -845,7 +845,8 @@ DATA = {
     "main.py:'cancelled' if task.cancelled() else repr(exc) if exc else 'returned'",
     "main.py:EXIT_CONTROL_DIED", "main.py:first.name", "main.py:OPTIONS_PATH",
     "main.py:err", "main.py:', '.join(sorted(stranded))",
-    "main.py:sorted(on_roster)", "main.py:inv.name",
+    "main.py:sorted(on_roster)", "main.py:inv.name", "main.py:topic_s",
+    "main.py:more",
     "main.py:inv.batt_fresh.bound.release_s", "main.py:inv.batt_fresh.bound.move_w",
     "main.py:inv.batt_fresh.bound.unchanged_s", "main.py:inv.batt_fresh.held",
     "main.py:value", "main.py:float(value)",
@@ -964,7 +965,7 @@ def _peak_texts():
     proj = Projection(projected_w=4338.0, elapsed_w=4338.0, elapsed_s=799.0,
                       covered_frac=1.0, complete=False, block_start=_T0,
                       held_w=0.0)
-    kw = dict(cap_w=3500.0, reading=None, soc_floor=30.0, max_hold_s=30.0)
+    kw = dict(cap_w=3500.0, margin_w=0.0, reading=None, soc_floor=30.0, max_hold_s=30.0)
     sat = _pg.decide(proj, batt_w=1500.0, achievable_w=5000.0, soc=80.0, **kw)
     low = _pg.decide(proj, batt_w=1500.0, achievable_w=5000.0, soc=20.0, **kw)
     unread = _pg.decide(proj, batt_w=1500.0, achievable_w=5000.0, soc=None, **kw)
@@ -1058,6 +1059,8 @@ TEXT = {
     "main.py:rep.explain()": _migration_texts,
     "store.py:rep.explain()": _migration_texts,
     "main.py:plan.words": _tariff_texts,
+    # OPT-11 P2: why an MQTT command was ignored.
+    "main.py:why": lambda: list(messages.PACK_REFUSED.values()),
     # Families: every builder of the text, as a template.
     "main.py:refusal": lambda: (_static(("main.py", "return", "write_refusal"))
                                 + _static(("allocator.py", "return", "authorises"))),

goodwe_controller/test_modes.py

@@ -335,11 +335,11 @@ _bad = [asyncio.run(_c.handle_action("pack_use", unit="inverter-z",
         asyncio.run(_c.handle_action("pack_use", unit=A, value=0)),
         asyncio.run(_c.handle_action("pack_use", unit=A, value=1)),
         asyncio.run(_c.handle_action("pack_mode", unit=A,
-                                     value=packmode.CHEAP_HOURS)),
+                                     value="sell_only")),
         asyncio.run(_c.handle_action("pack_mode", unit=A, value=None))]
 check("an unknown battery, a switch that is not true or false (0 and 1 "
       "included), and a mode "
-      "this release does not offer (Cheap hours arrives in P3) are refused, "
+      "that does not exist are refused, "
       "with a plain reason, and store nothing",
       all(isinstance(x, dict) and set(x) == {"error"} for x in _bad)
       and unit_key(A, packmode.MODE_KEY) not in _c.store.data

goodwe_controller/test_modes_p3.py

@@ -0,0 +1,722 @@
+"""Runnable check for OPT-11 P3, price runs per battery.  `python3 test_modes_p3.py`
+
+Drives the pure modules (priceruns, modetrade) and the REAL Controller
+(tools/opt11p3_replay.py: read_inputs + cycle on a P1 meter, the arbiter, the
+allocator and the peak guard, with two lagged model batteries), in simulated
+time. DECISIONS/OPT-11-battery-modes.md has the record.
+
+1. With battery modes off, every command and trade is byte-identical to
+   release/1.0 7a00f12 on the trade path P3 changed (digests measured there),
+   and the harness would see a change there.
+2. Price runs: consecutive, firm, sized by energy; give runs clear the spread;
+   the sell run sits in a give run with no slot below 0; a started run is kept.
+3. Roles: a fuzz of modetrade.decide() and size() against the invariants.
+4. The real controller over a day: no opposite-direction split, no grid
+   charge on Solar first, the quarter never above the aim while charging, no
+   sell below the floor or the spread, holding outside the expensive hours.
+5. A refusal wins over a run.
+6. No prices or too small a gap: the price modes follow the house; Solar first
+   alone never trades.
+7. A run edge reseeds the loop (handover measured with and without).
+8. The site Why row: a limit that pushes power up does not "hold it back" (F2).
+9. Selling is off (owner, 2026-09-29): `pack_sell` refused, read as false.
+10. The Batteries screen: Why and Today lines from the roles and runs.
+11. Review additions: modes on ignore the site trade switch, a battery in
+    maintenance takes no part, the headroom stop latches for the period.
+
+12. Option A: no sale in a day; Leftover solar never grid-charges (P4).
+
+Mutations (MUTATION.md, purged copies, graded over this file and the named
+tests) are listed in the pull request.
+"""
+
+import asyncio
+import logging
+import os
+import random
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+from named_absence import nth, present                         # noqa: E402
+import opt11p3_identity as ident                               # noqa: E402
+import opt11p3_replay as rp                                    # noqa: E402
+from app import homeview, messages, modetrade, packmode, priceruns  # noqa
+from app import arbitrage                                      # noqa: E402
+from app.arbiter import Claim, P_ARBITRAGE, P_LOOP, P_PEAK, Resolution  # noqa
+from app.main import Controller, why_raised                    # noqa: E402
+from app.price import PricePoint, brussels                     # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+L = timezone(timedelta(hours=2))
+A, B = "inverter-a", "inverter-b"
+
+# ============================================================================ #
+print("1. modes off: byte-identical to 7a00f12 on the trade path")
+# Printed by tools/opt11p3_identity.py on release/1.0 7a00f12 (2026-09-29),
+# goodwe-addon-checks:1. 1080 cycles each; the trade CHARGEs and DISCHARGEs.
+AT_7A00F12 = {
+    "n1": "71245b227ca40bada4f71f57ea6154475f4b0bd60239c9ad4f80bffb0094514c",
+    "n2": "56cf28010b06765c29e5479abb815d7503d570b39240d82dfc818efa90c93722",
+    "n1_off": "71245b227ca40bada4f71f57ea6154475f4b0bd60239c9ad4f80bffb0094514c",
+    "n2_off": "56cf28010b06765c29e5479abb815d7503d570b39240d82dfc818efa90c93722",
+}
+_rows = {k: ident.run(**v)[0] for k, v in ident.SCENARIOS.items()}
+_got = {k: ident.digest(v) for k, v in _rows.items()}
+for k in AT_7A00F12:
+    print(f"    {k} {'same' if _got[k] == AT_7A00F12[k] else 'DIFFERS'} "
+          f"{_got[k][:16]}")
+check("with battery modes off (option absent or false), every command, "
+      "integrator, allocation and trade sentence equals 7a00f12's, at one "
+      "inverter and at two", _got == AT_7A00F12)
+_acts = {r[-1][0] for r in _rows["n2"] if r[-1]}
+check("...and the runs reach the trade P3 now skips with modes on: a charge "
+      "and a sale", {arbitrage.CHARGE, arbitrage.DISCHARGE} <= _acts)
+
+
+def _moved(scn, patch):
+    """Does `patch` (applied before each cycle) move scenario `scn`?"""
+    real = ident._feed
+
+    def feed(c, t):
+        patch(c)
+        real(c, t)
+    ident._feed = feed
+    try:
+        return ident.digest(ident.run(**ident.SCENARIOS[scn])[0]) \
+            != AT_7A00F12[scn]
+    finally:
+        ident._feed = real
+
+
+def _as_if_trade_ended(c):
+    c._mode_trade_was = True        # the run-edge reseed, leaking to modes off
+
+
+def _moved_headroom(scn):
+    """Does an unmeasured headroom (the expression P3 hoisted) move it?"""
+    from app import peakguard
+    real = peakguard.charge_headroom_w
+    peakguard.charge_headroom_w = lambda g: None
+    try:
+        return ident.digest(ident.run(**ident.SCENARIOS[scn])[0]) \
+            != AT_7A00F12[scn]
+    finally:
+        peakguard.charge_headroom_w = real
+
+
+check("non-vacuous: a run-edge reseed leaking into modes off moves n2, and so "
+      "does the headroom P3 hoisted, if it went unmeasured",
+      _moved("n2", _as_if_trade_ended) and _moved_headroom("n1"))
+
+# ============================================================================ #
+print("\n2. price runs")
+D0 = datetime(2026, 9, 9, 0, 0, tzinfo=L)
+
+
+def pts(prices, start=D0, minutes=15, provisional=()):
+    return [PricePoint(start=brussels(start + timedelta(minutes=minutes * i)),
+                       eur_per_kwh=p, provisional=i in provisional)
+            for i, p in enumerate(prices)]
+
+
+# 24 h of quarters: cheap 02:00-04:00 (and one cheaper single quarter at
+# 05:00), dear 18:00-20:00 with a peak quarter at 19:00, flat otherwise.
+DAY = [0.30] * 96
+for i in range(8, 16):
+    DAY[i] = 0.10
+DAY[20] = 0.05
+for i in range(72, 80):
+    DAY[i] = 0.50
+DAY[76] = 0.70
+P = pts(DAY)
+NOW = D0 + timedelta(minutes=5)
+r1 = priceruns.plan(P, NOW, required_eur_kwh=0.25, charge_kwh=5.0,
+                    charge_kw=2.5, sell_kwh=0.0, sell_kw=0.0)
+r2 = priceruns.plan(P, NOW, required_eur_kwh=0.25, charge_kwh=0.0,
+                    charge_kw=0.0, sell_kwh=2.5, sell_kw=2.5)
+print(f"    2 h need: {r1.cheap}; give {r1.give}")
+check("the cheap run lasts what the energy needs at the rating (5 kWh at "
+      "2.5 kW = 2 h) and is the cheapest such consecutive window, not the "
+      "cheapest single quarter",
+      r1.cheap.start == D0 + timedelta(hours=2)
+      and r1.cheap.end == D0 + timedelta(hours=4)
+      and abs(r1.cheap.mean_eur_kwh - 0.10) < 1e-9)
+check("...with nothing to charge, one quarter: the cheapest one",
+      r2.cheap.start == D0 + timedelta(hours=5)
+      and r2.cheap.end == D0 + timedelta(hours=5, minutes=15))
+check("give runs are the consecutive quarters at least the required spread "
+      "above the cheap run (0.10 + 0.25): 18:00-20:00, one run",
+      r1.on and len(r1.give) == 1
+      and r1.give[0].start == D0 + timedelta(hours=18)
+      and r1.give[0].end == D0 + timedelta(hours=20))
+check("the sell run is the dearest window inside a give run, sized by the "
+      "sellers' energy (2.5 kWh at 2.5 kW = 1 h)",
+      r2.sell.end - r2.sell.start == timedelta(hours=1)
+      and r1.give[0].start <= r2.sell.start < r2.sell.end <= r1.give[0].end
+      and r2.sell.start <= D0 + timedelta(hours=19) < r2.sell.end)
+_flat = priceruns.plan(pts([0.3] * 96), NOW, required_eur_kwh=0.1,
+                       charge_kwh=5, charge_kw=2.5, sell_kwh=0, sell_kw=0)
+_thr0 = priceruns.plan(pts([0.3] * 96), NOW, required_eur_kwh=0.0,
+                       charge_kwh=5, charge_kw=2.5, sell_kwh=0, sell_kw=0)
+check("a flat day has no plan (`not_worth`), even with a threshold of 0: the "
+      "cheap run never counts as its own expensive run",
+      _flat.reason == priceruns.NOT_WORTH and not _flat.give
+      and _thr0.reason == priceruns.NOT_WORTH)
+_prov = priceruns.plan(pts(DAY, provisional=set(range(74, 96))), NOW,
+                       required_eur_kwh=0.25, charge_kwh=5, charge_kw=2.5,
+                       sell_kwh=2.5, sell_kw=2.5)
+check("a provisional (carried) price is never part of a run (section 8.3)",
+      all(g.end <= D0 + timedelta(hours=18, minutes=30) for g in _prov.give)
+      and (_prov.sell is None
+           or _prov.sell.end <= D0 + timedelta(hours=18, minutes=30)))
+_neg = list(DAY)
+_neg[76] = -0.05
+_rn = priceruns.plan(pts(_neg), NOW, required_eur_kwh=0.25, charge_kwh=0,
+                     charge_kw=0, sell_kwh=10.0, sell_kw=2.5)
+check("the sell run never spans a quarter priced below 0 (section 17)",
+      _rn.sell is not None and not (_rn.sell.start <= D0 + timedelta(
+          hours=19) < _rn.sell.end))
+# All prices below 0 but one: the give run holds negative quarters (they
+# clear the spread over an even lower cheap run), and the sale must skip them.
+_allneg = [-0.30] * 96
+for i in range(8, 16):
+    _allneg[i] = -0.40
+for i in range(72, 80):
+    _allneg[i] = -0.05
+_allneg[76] = 0.10
+_rneg = priceruns.plan(pts(_allneg), NOW, required_eur_kwh=0.15,
+                       charge_kwh=0, charge_kw=0, sell_kwh=2.5, sell_kw=2.5)
+check("...even when the whole give run is below 0 but one quarter: the sale "
+      "is that quarter only",
+      _rneg.on and _rneg.sell is not None
+      and _rneg.sell.start == D0 + timedelta(hours=19)
+      and _rneg.sell.end == D0 + timedelta(hours=19, minutes=15))
+# A spike inside the cheap run clears the spread over the run's own mean:
+# it must not also be a give run (charge and give would overlap).
+_sp = [0.50] * 96
+for i in range(8, 16):
+    _sp[i] = 0.02
+_sp[15] = 0.20
+_rsp = priceruns.plan(pts(_sp), NOW, required_eur_kwh=0.05, charge_kwh=5.0,
+                      charge_kw=2.5, sell_kwh=0, sell_kw=0)
+check("no give run overlaps the cheap run, even a quarter inside it that "
+      "clears the spread over the run's mean",
+      _rsp.cheap.start == D0 + timedelta(hours=2)
+      and all(g.end <= _rsp.cheap.start or g.start >= _rsp.cheap.end
+              for g in _rsp.give))
+_few = priceruns.plan(pts([0.1]), NOW, required_eur_kwh=0.1, charge_kwh=1,
+                      charge_kw=1, sell_kwh=0, sell_kw=0)
+check("fewer than two firm slots: no plan (`no_prices`)",
+      _few.reason == priceruns.NO_PRICES)
+_mid = D0 + timedelta(hours=3)
+_new = priceruns.plan(P, _mid, required_eur_kwh=0.25, charge_kwh=0.0,
+                      charge_kw=0.0, sell_kwh=0.0, sell_kw=0.0)
+_kept = priceruns.keep_started(r1, _new, _mid)
+check("a run under way is kept to its end when a new plan would move it "
+      "(no flapping), and a run not yet started is not",
+      _new.cheap != r1.cheap and _kept.cheap == r1.cheap
+      and priceruns.keep_started(r1, _new, NOW).cheap == _new.cheap)
+_late = priceruns.plan(P, D0 + timedelta(hours=20, minutes=5),
+                       required_eur_kwh=0.25, charge_kwh=5, charge_kw=2.5,
+                       sell_kwh=0, sell_kw=0)
+check("a run that has ended is not planned again, and nothing beyond the "
+      "firm prices is invented",
+      all(g.start >= D0 + timedelta(hours=20) for g in _late.give)
+      and not _late.on)
+
+# ============================================================================ #
+print("\n3. roles: modetrade.decide() fuzz")
+rnd = random.Random(311)
+_bad = []
+_seen = set()
+for _ in range(20000):
+    n = rnd.choice((1, 2, 3))
+    packs = []
+    for k in range(n):
+        packs.append(modetrade.Pack(
+            f"inv-{k}", rnd.random() > 0.15,
+            rnd.choice(packmode.MODES), rnd.random() > 0.5,
+            rnd.choice((1000.0, 2500.0, 5000.0)),
+            rnd.choice((None, 5.0, 19.0, 20.0, 21.0, 60.0, 95.0, 99.0)),
+            rnd.choice((None, 5.0, 10.0)), live=rnd.random() > 0.1,
+            idle=rnd.random() > 0.1, refused=rnd.choice((0, 0, 0, 1, -1))))
+    t = D0 + timedelta(minutes=rnd.randrange(0, 24 * 60))
+    runs = rnd.choice((None, r1, r2, _flat))
+    ok_s = rnd.random() > 0.3
+    ok_c = ok_s and rnd.random() > 0.3
+    hr = rnd.choice((None, 0.0, 100.0, 499.0, 501.0, 3000.0))
+    price = rnd.choice((None, -0.1, 0.0, 0.5))
+    house = rnd.choice((None, -500.0, 800.0))
+    was = rnd.random() > 0.7
+    blocked = rnd.random() > 0.8
+    tk = modetrade.decide(runs, t, packs, charge_ok=ok_c, sell_ok=ok_s,
+                          trade_why="x", price_now=price, headroom_w=hr,
+                          floor_pct=20.0, ceiling_pct=95.0, house_w=house,
+                          charging_now=was, blocked=blocked)
+    _seen.add(tk.action)
+    by = {p.name: p for p in packs}
+    for name, (lo, hi) in tk.ranges.items():
+        if not lo <= 0.0 <= hi:
+            _bad.append(("range without 0", name, lo, hi))
+    for name, role in tk.roles.items():
+        p = by[name]
+        if role == modetrade.CHARGE and (p.mode != packmode.CHEAP_HOURS
+                                         or p.refused < 0 or not p.use
+                                         or p.soc is None or p.soc >= 95.0):
+            _bad.append(("bad charger", p))
+        if role == modetrade.SELL and (not p.sell or p.refused > 0
+                                       or p.mode == packmode.SOLAR_FIRST
+                                       or p.soc is None or p.soc <= 20.0):
+            _bad.append(("bad seller", p))
+        if not p.use and tk.ranges.get(name, (0.0, 0.0)) != (0.0, 0.0):
+            _bad.append(("off not 0", p))
+    if tk.action == modetrade.CHARGE:
+        need = 0.0 if was else modetrade.START_W
+        if not (ok_c and hr is not None and hr > need and not blocked
+                and runs is not None and runs.cheap.holds(t)):
+            _bad.append(("charge without leave", ok_c, hr, blocked))
+        for name, (lo, hi) in tk.ranges.items():
+            if tk.roles[name] != modetrade.CHARGE and lo < 0.0:
+                _bad.append(("grid charge on a non-charger", by[name]))
+        s = modetrade.size(tk, (-7000.0, 7000.0), hr)
+        if not (s < 0 and -s <= min(-tk.ask_w, hr) + 1e-9):
+            _bad.append(("charge size", s, tk.ask_w, hr))
+        if modetrade.size(tk, (-300.0, 300.0), hr) < -300.0:
+            _bad.append(("charge over the bound",))
+    if tk.action == modetrade.SELL:
+        if not (ok_s and price is not None and price >= 0.0 and runs
+                is not None and runs.sell.holds(t) and house is not None):
+            _bad.append(("sell without leave", ok_s, price))
+        s = modetrade.size(tk, (-7000.0, 2000.0), hr)
+        if not 0.0 < s <= 2000.0:
+            _bad.append(("sell size", s))
+    if tk.action is None and modetrade.size(tk, (-1e4, 1e4), hr) != 0.0:
+        _bad.append(("no action but a size",))
+print(f"    actions seen {sorted(map(str, _seen))}; {len(_bad)} bad: {_bad[:3]}")
+check("20000 random ticks: every range holds 0 W; Off is [0, 0]; no Solar "
+      "first, refusing, full or unknown battery charges; no Solar first, "
+      "refusing or at-floor battery sells; while one charges no other may "
+      "charge; a charge needs the guard, the headroom (500 W to start) and "
+      "no stop this period, and is sized under the headroom; a sale needs a "
+      "price >= 0 in the sell run", not _bad
+      and {modetrade.CHARGE, modetrade.SELL, None} <= _seen)
+
+# ============================================================================ #
+print("\n4. the real controller over a day (A Solar first, B Cheap hours + sell)")
+# Wholesale; all-in (x + 0.12) x 1.06: cheap 0.148, flat 0.339, dear 0.551.
+# With a cycle cost of 0.20 (0.30 widened) only 19:00-20:00 clears it.
+DAYW = [0.20] * 96 * 2
+for i in list(range(4, 12)) + list(range(100, 108)):
+    DAYW[i] = 0.02                           # 01:00-03:00 wholesale
+for i in list(range(76, 80)) + list(range(172, 176)):
+    DAYW[i] = 0.40                           # 19:00-20:00
+UTC0 = D0.astimezone(timezone.utc)
+WPTS = [(UTC0 + timedelta(minutes=15 * i), 900, p) for i, p in enumerate(DAYW)]
+
+
+def house_flat(w):
+    return [(UTC0.timestamp() - 10, float(w))]
+
+
+AIM = rp.PEAK_CAP - 50
+
+
+def run_day(variant, *, house_w=2600.0, start_h=0.75, hours=21.0,
+            soc0=None, choice=None, refuse=(), n=2, check_cb=None,
+            patch=None, house=None, limits=None):
+    rows = []
+
+    def cb(c, h, now, pr):
+        sh = dict(c.allocation.shares) if c.allocation is not None and \
+            c.allocation.shares else {}
+        rows.append(dict(
+            now=now, grid=h.grid(), shares=sh,
+            action=getattr(c.arb, "action", None),
+            winner=c.reason.split(" ->")[0],
+            roles=dict(c.mode_tick.roles) if c.mode_tick else {},
+            soc={u: p.soc for u, p in h.plants.items()},
+            p={u: p.p for u, p in h.plants.items()},
+            runs=c.mode_runs, price=pr, why=c.why_words,
+            unmet=getattr(c.allocation, "unmet_w", 0) or 0))
+        if check_cb:
+            check_cb(c, h, now, pr)
+    st, c = rp.run(variant, house or house_flat(house_w), WPTS,
+                   UTC0 + timedelta(hours=start_h), 3600 * hours, check=cb,
+                   soc0=soc0, choice=choice, refuse=refuse, n=n, patch=patch,
+                   extra={"cycle_cost_threshold_eur": 0.20}, limits=limits)
+    return rows, st, c
+
+
+# Selling is off (owner, 2026-09-29, option A). Its code is kept behind
+# packmode.SELLING_ENABLED, and these checks turn it on to hold that code to
+# its invariants; part 12 checks it is unreachable with the flag as shipped.
+_SELL_SHIPPED = packmode.SELLING_ENABLED
+packmode.SELLING_ENABLED = True
+ROWS, ST, _c4 = run_day("p3_ch_sell", soc0={"a": 60.0, "b": 30.0})
+charge = [r for r in ROWS if r["action"] == arbitrage.CHARGE]
+sell = [r for r in ROWS if r["action"] == arbitrage.DISCHARGE]
+print(f"    {len(ROWS)} cycles, {len(charge)} charging, {len(sell)} selling; "
+      f"{rp.summary(ST)}")
+check("B charged from the grid in the cheap run and sold in the dear one, "
+      "and A never took part in either",
+      charge and sell
+      and all(r["roles"][A] in (modetrade.REST, modetrade.HOUSE)
+              for r in charge + sell)
+      and all(r["now"].astimezone(L).hour in (0, 1, 2, 3) for r in charge)
+      and all(r["runs"].cheap.holds(r["now"]) for r in charge)
+      and all(r["now"].astimezone(L).hour == 19 for r in sell))
+_mixed = [r for r in ROWS if any(v > 0 for v in r["shares"].values())
+          and any(v < 0 for v in r["shares"].values())]
+check("no opposite-direction split on any cycle (every share one sign)",
+      not _mixed)
+check("no grid charge on Solar first: while the site charges from the grid, "
+      "A's share is never below 0 W",
+      all(r["shares"].get(A, 0) >= 0 for r in charge))
+# The quarters the add-on itself banked (the P1 blocks, as the bill reads).
+_chq = {int(r["now"].timestamp() // 900) for r in charge}
+_qc = [b.offtake_avg_w for b in _c4.p1.blocks
+       if int(b.start.timestamp() // 900) in _chq]
+print(f"    banked quarters with a grid charge: {len(_qc)}, highest "
+      f"{max(_qc):.2f} W, aim {AIM} W")
+check("never above the SAFETY-79 aim while grid charging: every banked "
+      "15-minute period with a grid charge is at most cap - margin",
+      _qc and max(_qc) <= AIM + 0.5)
+check("...and the charge is sized to the headroom, not the rating: under a "
+      "2.6 kW house B charges well under its 2.5 kW",
+      max(-r["shares"].get(B, 0) for r in charge) < 1200)
+_sold = [r for r in sell]
+check("no sale below the floor or the spread: every sale cycle has B above "
+      "arbitrage_soc_floor (20 %) and a price at least cheap + required",
+      all(r["soc"]["b"] > 19.9 for r in _sold)
+      and all(r["price"] is not None and rp.all_in(r["price"])
+              >= r["runs"].cheap.mean_eur_kwh + 0.30 - 1e-9 for r in _sold))
+_hold = [r for r in ROWS if r["roles"].get(B) == modetrade.HOLD]
+check("outside the expensive hours B holds its power: never gives while "
+      "holding", _hold and all(r["shares"].get(B, 0) <= 0 for r in _hold))
+_give = [r for r in ROWS if r["roles"].get(B) in (modetrade.GIVE,
+                                                  modetrade.SELL)]
+check("...and gives only in the expensive hours (19:00-20:00)",
+      all(r["now"].astimezone(L).hour == 19 for r in _give))
+
+
+def starts(rows, kind):
+    return sum(1 for a, b in zip(rows, rows[1:])
+               if a["action"] != kind and b["action"] == kind)
+
+
+check("the sale starts once and runs to its end: no on-off while the two "
+      "batteries' 5 kW discharge makes the peak guard read 'engaged'",
+      starts(ROWS, arbitrage.DISCHARGE) == 1)
+
+# B's inverter can only take 1000 W: the trade asks for that, not its rating.
+ROWS_U, _, _ = run_day("p3_ch_sell", hours=1.0, house_w=800.0,
+                       soc0={"a": 60.0, "b": 30.0},
+                       limits={"b": (-1000.0, 1000.0)})
+_cu = [r for r in ROWS_U if r["action"] == arbitrage.CHARGE]
+print(f"    B limited to 1 kW: charge {min(r['shares'].get(B, 0) for r in _cu)}"
+      f" W, unmet {max(abs(r['unmet']) for r in _cu)} W")
+check("SAFETY-45 sizing inside the modes: the charge is sized to what the "
+      "batteries may place, so none of it is left unmet (P1's gap)",
+      _cu and all(abs(r["unmet"]) < 1 for r in _cu)
+      and min(r["shares"].get(B, 0) for r in _cu) >= -1000)
+
+# A house that swings over the limit every minute during the cheap run.
+_sw = [(UTC0.timestamp() + 60 * k, 2000.0 if k % 2 else 3900.0)
+       for k in range(0, 200)]
+ROWS_W, _, _ = run_day("p3_ch_sell", hours=1.5, house=_sw,
+                       soc0={"a": 60.0, "b": 30.0})
+_per_q = {}
+for a_, b_ in zip(ROWS_W, ROWS_W[1:]):
+    if a_["action"] != arbitrage.CHARGE and b_["action"] == arbitrage.CHARGE:
+        q = int(b_["now"].timestamp() // 900)
+        _per_q[q] = _per_q.get(q, 0) + 1
+print(f"    house swinging 2.0/3.9 kW each minute: charge starts per period "
+      f"{sorted(_per_q.values())}")
+check("a charge the peak guard or the headroom stopped stays off for the "
+      "rest of that 15-minute period (at most one start per period)",
+      _per_q and max(_per_q.values()) == 1)
+
+# At the floor: B starts the sale just above it.
+ROWS_F, _, _ = run_day("p3_ch_sell", start_h=18.75, hours=1.5,
+                       soc0={"a": 60.0, "b": 24.0})
+_sf = [r for r in ROWS_F if r["action"] == arbitrage.DISCHARGE]
+_after = [r for r in ROWS_F if r["now"].astimezone(L).hour == 19
+          and r["soc"]["b"] <= 20.0]
+_lastf = nth(ROWS_F, -1, "the last cycle")
+print(f"    from 24 %: sold {len(_sf)} cycles, B ends at "
+      f"{_lastf['soc']['b'] if present(_lastf) else _lastf} %")
+check("the sale stops at arbitrage_soc_floor and does not re-arm in the run",
+      _sf and _after and all(r["action"] != arbitrage.DISCHARGE
+                             for r in _after))
+packmode.SELLING_ENABLED = _SELL_SHIPPED
+
+# N=1: one Cheap hours battery.
+ROWS1, _, _ = run_day("p3_ch_sell", n=1, soc0={"a": 30.0},
+                      choice={"a": (True, "cheap_hours", False)},
+                      hours=3.0)
+_c1 = [r for r in ROWS1 if r["action"] == arbitrage.CHARGE]
+check("at one inverter the same rules: it charges in the cheap run, sized "
+      "under the aim", _c1 and max(r["grid"] for r in _c1) < AIM + 400)
+
+# ============================================================================ #
+print("\n5. a refusal wins over a run")
+ROWS_R, _, _ = run_day("p3_ch_sell", hours=1.0, soc0={"a": 60.0, "b": 30.0},
+                       refuse=("b",))
+_first = nth(ROWS_R, 0, "the first cycle")
+_ref = [r for r in ROWS_R if present(_first)
+        and r["now"] > _first["now"] + timedelta(minutes=3)]
+print(f"    B refuses to charge; after 3 min: trades "
+      f"{sorted({str(r['action']) for r in _ref})}, B roles "
+      f"{sorted({r['roles'].get(B) for r in _ref})}")
+check("B refusing to charge: no grid trade is filed after the refusal is "
+      "learned, B's role is no longer 'charge', and A covers the house",
+      _ref and all(r["action"] is None for r in _ref)
+      and all(r["roles"].get(B) != modetrade.CHARGE for r in _ref)
+      and sum(r["shares"].get(A, 0) > 0 for r in _ref) > len(_ref) / 2)
+
+# ============================================================================ #
+print("\n6. no prices, no gap, Solar first alone")
+
+
+def _no_plan(c):
+    c.tariff_plan = None
+    c.fresh_tariff_plan = lambda now: None
+
+
+ROWS_N, _, _ = run_day("p3_ch_sell", hours=1.0, patch=_no_plan,
+                       soc0={"a": 60.0, "b": 60.0}, house_w=1500.0)
+check("no prices: no trade, and Leftover solar / Cheap hours follow the "
+      "house (they give power, not held forever)",
+      all(r["action"] is None for r in ROWS_N)
+      and all(r["roles"].get(B) == modetrade.HOUSE for r in ROWS_N)
+      and any(r["shares"].get(B, 0) > 0 for r in ROWS_N))
+ROWS_S, _, _ = run_day("p3_ch_sell", hours=21.0,
+                       choice={"a": (True, "solar_first", False),
+                               "b": (True, "solar_first", True)})
+check("both batteries Solar first: never a grid charge or a sale all day, "
+      "even with selling switched on",
+      all(r["action"] is None for r in ROWS_S))
+
+# ============================================================================ #
+print("\n7. a run edge reseeds the loop")
+
+
+def _no_reseed(c):
+    c._reseed_run_edge = lambda claims: None
+
+
+def edge(rows, kind):
+    for i in range(1, len(rows)):
+        if rows[i - 1]["action"] == kind and rows[i]["action"] != kind:
+            w = [r["grid"] for r in rows[i:i + 36]]
+            return min(w), max(w)
+    return None
+
+
+_e_on = edge(run_day("p3_ch_sell", hours=3.0, house_w=800.0,
+                     soc0={"a": 60.0, "b": 70.0})[0], arbitrage.CHARGE)
+_e_off = edge(run_day("p3_ch_sell", hours=3.0, house_w=800.0,
+                      soc0={"a": 60.0, "b": 70.0}, patch=_no_reseed)[0],
+              arbitrage.CHARGE)
+print(f"    grid in the 3 min after a 2.5 kW charge ends, 800 W house: "
+      f"reseeded {_e_on}, not reseeded {_e_off}")
+check("reseeded, the loop takes over without the import spike the trade's "
+      "watts leave behind (and exports no more than without)",
+      _e_on and _e_off and _e_on[1] < 1000 and _e_off[1] > 2000
+      and _e_on[0] > _e_off[0] - 100)
+
+# ============================================================================ #
+print("\n8. the site Why row (OPT-11 P1 test, F2)")
+_cl = [Claim.set("loop", P_LOOP, 1200.0), Claim.limit("peak", P_PEAK,
+                                                      lo=2500.0)]
+_up = Resolution(2500.0, "loop", bound_by="peak(quarter peak)")
+_dn = Resolution(800.0, "loop", bound_by="peak(quarter peak)")
+check("a peak floor that raised the power reads 'raised for the peak limit', "
+      "never 'held back'",
+      why_raised(_up, _cl) is True and "held back" not in messages.why(
+          "loop", 2500.0, "peak(quarter peak)", raised=True)
+      and "raised for the peak limit" in messages.why(
+          "loop", 2500.0, "peak(quarter peak)", raised=True))
+check("...a limit that lowered it still reads 'held back'",
+      why_raised(_dn, _cl) is False
+      and "held back by" in messages.why("loop", 800.0, "pack"))
+check("...and a trade the peak floor raised reads the same way",
+      why_raised(Resolution(2000.0, "arbitrage", bound_by="peak"),
+                 [Claim.set("arbitrage", P_ARBITRAGE, -1000.0)]) is True)
+
+# ============================================================================ #
+print("\n9. the selling switch is off (owner decision 2026-09-29, option A)")
+_st = rp._Store()
+_st.data[unit_key(B, packmode.SELL_KEY)] = True     # an old stored "on"
+_st.data[unit_key(B, packmode.MODE_KEY)] = packmode.CHEAP_HOURS
+_ctl = Controller(dict(rp.options(True, False)), rp.Hass(("a", "b"),
+                  lambda t: 0.0), _st, rp._Pub(), stop=asyncio.Event())
+_r9 = [asyncio.run(_ctl.handle_action("pack_sell", unit=B, value=v))
+       for v in (True, False, "yes")]
+check("pack_sell is refused with the plain reason 'Selling is off for now.' "
+      "and stores nothing",
+      all(x == {"error": messages.pack_refused("sell_off")} for x in _r9)
+      and _st.data[unit_key(B, packmode.SELL_KEY)] is True
+      and not any("selling switched" in str(e) for e in _ctl.events))
+check("...a stored 'on' reads as false: no battery sells or can, whatever "
+      "the store holds", packmode.SELLING_ENABLED is False
+      and packmode.read(_st.data, B).sell is False
+      and packmode.read(_st.data, B).can_sell is False
+      and all(p.sell is False for p in _ctl._mode_packs()))
+
+# ============================================================================ #
+print("\n10. the Batteries screen")
+_keys = set(homeview.ROLE_WHY.values()) | {"saves_later", "no_prices",
+                                             "no_spread"}
+_en, _nl = homeview.uitext.words("en"), homeview.uitext.words("nl")
+check("every role's Why line has words in English and Dutch, and they differ",
+      all(k in _en["home_words"]["why"] and k in _nl["home_words"]["why"]
+          and _en["home_words"]["why"][k] != _nl["home_words"]["why"][k]
+          for k in _keys))
+packmode.SELLING_ENABLED = True      # the kept sell code, as in part 4
+_c10 = run_day("p3_ch_sell", start_h=18.0, hours=0.5,
+               soc0={"a": 60.0, "b": 80.0})[2]
+_now10 = D0 + timedelta(hours=18, minutes=30)
+_plan = homeview.mode_runs(_c10, *homeview.local_day(_now10.astimezone(
+    timezone.utc)), _now10.astimezone(timezone.utc), False)
+packmode.SELLING_ENABLED = _SELL_SHIPPED
+print(f"    plan blocks for B at 18:30: "
+      f"{[(r['from'], r['to'], r['kind'], r['what']) for r in _plan[0]]}")
+check("the plan draws B's expensive run, the sale inside it, and nothing "
+      "for Solar first A", _plan[0]
+      and {r["battery"] for r in _plan[0]} == {1}
+      and any(r["kind"] == "give" for r in _plan[0]))
+_sale = [r for r in _plan[0] if r["what"].startswith("Sells")]
+check("a sale block shows no money: the price shown is what the house pays, "
+      "and a sale earns the lower injection price",
+      _sale and all(r["amount"] is None and r["eur"] is None for r in _sale))
+_why = homeview.battery_why(
+    modes_on=True, mode=packmode.CHEAP_HOURS, off=False, reading=True,
+    phase="idle", shadow=False, running=True, held=False, refused=0,
+    peak=False, sf_ahead=True, role="hold", has_at=True)
+check("a holding battery's Why names when it gives power",
+      _why == "saves" and "18:00 - 19:00" in homeview.why_words(
+          _why, at="18:00 - 19:00"))
+
+# ============================================================================ #
+print("\n11. review additions (PR #153): gaps four mutants survived")
+import types                                                   # noqa: E402
+import app.main as _main                                       # noqa: E402
+
+# Modes on with the site switch on: only the modes trade (R13).
+ROWS_X, _, _ = run_day("p2_arb", hours=3.0, soc0={"a": 30.0, "b": 30.0},
+                       choice={"a": (True, "solar_first", False),
+                               "b": (True, "solar_first", False)})
+check("modes on, 'Trade on the price spread' on, both batteries Solar first: "
+      "no trade all through the cheap hours (the site trade is not run)",
+      ROWS_X and all(r["action"] is None for r in ROWS_X)
+      and all(v >= 0 for r in ROWS_X for v in r["shares"].values())
+      and not any(r["winner"].startswith("arbitrage") for r in ROWS_X))
+
+# A battery in a maintenance phase takes no part in a run (R10).
+ROWS_M, _, _cm = run_day("p3_ch_sell", hours=0.6, house_w=800.0,
+                         soc0={"a": 60.0, "b": 30.0})
+_lm = nth(ROWS_M, -1, "the last cycle")
+_nm = _lm["now"] if present(_lm) else None
+_tm = _cm._mode_roles(_nm, [types.SimpleNamespace(phase=_main.IDLE),
+                            types.SimpleNamespace(phase="CHARGE")]) \
+    if _nm is not None else None
+check("a battery in its monthly cycle is not a charger: no range, no charge "
+      "role, and no grid charge when it is the only price battery",
+      _tm is not None and B not in _tm.ranges
+      and _tm.roles.get(B) != modetrade.CHARGE and _tm.action is None)
+
+# The headroom stopping a charge latches it off for the period (R8).
+_cm2 = run_day("p3_ch_sell", hours=0.6, house_w=800.0,
+               soc0={"a": 60.0, "b": 30.0})[2]
+_ok8 = False
+if _nm is not None and _cm2.mode_tick is not None \
+        and _cm2.mode_tick.action == modetrade.CHARGE:
+    _q = int(_nm.timestamp() // 900)
+    _cm2.arb_headroom_w = 0.0
+    _t1 = _cm2._mode_roles(_nm, None)
+    _cm2.arb_headroom_w = 3000.0
+    _t2 = _cm2._mode_roles(_nm + timedelta(seconds=5), None)
+    _nq = datetime.fromtimestamp((_q + 1) * 900 + 5, timezone.utc)
+    _cm2.tariff_at = _nq
+    _t3 = _cm2._mode_roles(_nq, None)
+    _ok8 = (_t1.why == "headroom" and _cm2._charge_blocked_q in (_q, _q + 1)
+            and _t2.action is None and _t3.action == modetrade.CHARGE)
+check("a charge the headroom stopped stays off for the rest of the period, "
+      "even when the headroom comes back, and may start in the next one", _ok8)
+
+# ============================================================================ #
+print("\n12. option A: no sale, and Leftover solar takes solar only (P4)")
+ROWS_A, _, _ = run_day("p3_ch_sell", soc0={"a": 60.0, "b": 30.0},
+                       choice={"a": (True, "solar_first", False),
+                               "b": (True, "cheap_hours", True)})
+print(f"    Cheap hours B with a stored sell 'on': "
+      f"{sum(r['action'] == arbitrage.CHARGE for r in ROWS_A)} charging, "
+      f"{sum(r['action'] == arbitrage.DISCHARGE for r in ROWS_A)} selling")
+check("with selling on in the store, a whole day has no sale and no sell "
+      "role, while Cheap hours only still charges from the grid",
+      all(r["action"] != arbitrage.DISCHARGE for r in ROWS_A)
+      and all(modetrade.SELL not in r["roles"].values() for r in ROWS_A)
+      and any(r["action"] == arbitrage.CHARGE for r in ROWS_A))
+ROWS_L, _, _c12 = run_day("p3_ch_sell", soc0={"a": 60.0, "b": 30.0},
+                          choice={"a": (True, "solar_first", False),
+                                  "b": (True, "leftover_solar", True)})
+_lh = [r for r in ROWS_L if r["roles"].get(B) == modetrade.HOLD]
+_lg = [r for r in ROWS_L if r["roles"].get(B) == modetrade.GIVE]
+print(f"    Leftover solar B: {len(_lh)} holding, {len(_lg)} giving, "
+      f"grid trades {sorted({str(r['action']) for r in ROWS_L})}")
+check("Leftover solar never charges from the grid before the forecast: no "
+      "grid trade and no charge role all day, in the same cheap run",
+      all(r["action"] is None for r in ROWS_L)
+      and all(r["roles"].get(B) != modetrade.CHARGE for r in ROWS_L))
+check("...it still saves its power and gives it in the expensive hours",
+      _lh and _lg and all(r["now"].astimezone(L).hour == 19 for r in _lg))
+_pk = [modetrade.Pack("x", True, m, False, 2500.0, 30.0, 10.0)
+       for m in packmode.MODES]
+check("...only Cheap hours only is a grid charger (packmode.GRID_CHARGE_MODES)",
+      [p.mode for p in modetrade.chargers(_pk, 95.0)]
+      == [packmode.CHEAP_HOURS])
+_c12b = run_day("p3_ch_sell", start_h=0.75, hours=0.25,
+                soc0={"a": 60.0, "b": 30.0},
+                choice={"a": (True, "solar_first", False),
+                        "b": (True, "leftover_solar", True)})[2]
+_n12 = UTC0 + timedelta(hours=1)
+_plan12 = homeview.mode_runs(_c12b, *homeview.local_day(_n12), _n12,
+                             False)[0]
+print(f"    Leftover solar plan at 01:00: "
+      f"{[(r['from'], r['to'], r['kind']) for r in _plan12]}")
+check("...and the plan draws no grid block for it, only its expensive run",
+      _plan12 and all(r["kind"] != "grid" for r in _plan12))
+_enw, _nlw = homeview.uitext.words("en"), homeview.uitext.words("nl")
+check("...and its help text promises no grid charging (EN and NL)",
+      all("cheap" not in t.lower() and "goedkop" not in t.lower()
+          for t in (_enw["home"]["batteries"]["choice"]["leftover_solar"]
+                    ["description"],
+                    _nlw["home"]["batteries"]["choice"]["leftover_solar"]
+                    ["description"],
+                    _enw["home"]["batteries"]["how"]["leftover_solar"]
+                    ["description"],
+                    _nlw["home"]["batteries"]["how"]["leftover_solar"]
+                    ["description"])))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED:")
+    for f in fails:
+        print(f"  - {f}")
+    sys.exit(1)
+print("all checks passed")

goodwe_controller/test_mqtt.py

@@ -42,6 +42,7 @@ part is a diff against it, reported as `N topics, M missing, C changed, A added`
           re-executed from mutated source, each one named with the property it
           breaks. A property nothing breaks is a property nothing is watching.
   Part 9  What these checks CANNOT see, enumerated and sized.
+  Part 10 OPT-11 P2: each battery's select and switch, commands, removal.
 
 ⚠️ THE FIXTURE GIVES A AND B DIFFERENT NAMES, DIFFERENT RATINGS, DIFFERENT SoC,
 DIFFERENT BATTERY POWER AND DIFFERENT LATCH STATES, ON PURPOSE. A fixture whose
@@ -821,8 +822,8 @@ MUTATIONS = [
     ("per-unit entities announced at a roster of ONE",
      [("PER_UNIT_MIN_ROSTER = 2", "PER_UNIT_MIN_ROSTER = 1")]),
     ("the unit is dropped from the unique_id",
-     [('unique_id = f"{BASE}_unit_{slug}_{key}"',
-       'unique_id = f"{BASE}_unit_{key}"')]),
+     [('return f"{BASE}_unit_{slug}_{key}"',
+       'return f"{BASE}_unit_{key}"')]),
     ("the unit is dropped from the state topic",
      [('return f"unit/{slug}/{key}"', 'return f"unit/{key}"')]),
     ("the slug de-collision is removed (rule 9(c) does not cover this)",
@@ -944,6 +945,540 @@ for line in [
 ]:
     print("    " + line)
 
+# ---------------------------------------------------------------------------
+print("\n10. OPT-11 P2: each battery's switch and mode as HA entities")
+# ---------------------------------------------------------------------------
+import logging     # noqa: E402
+import os          # noqa: E402
+import tempfile    # noqa: E402
+
+from app import messages, packmode    # noqa: E402
+from app.store import Store, unit_key  # noqa: E402
+
+
+def announce_p2(units=(), omit=(), include=(), modes=(), retract=(),
+                module=mqtt):
+    """What `_on_connect()` sends: the announcement, then any subscriptions."""
+    pub = module.MqttPublisher.__new__(module.MqttPublisher)
+    pub.omit, pub.units, pub.include = set(omit), [str(u) for u in units], \
+        [str(k) for k in include]
+    pub.modes, pub.retract = tuple(modes), list(retract)
+    pub.enabled, pub.client = True, FakeClient()
+    subs = []
+    pub.client.subscribe = lambda topic, *a: subs.append(topic)
+    pub._on_connect()
+    return pub.client.msgs, subs
+
+
+# --- 10a. modes off: byte-identical to ed739d4 --------------------------------
+# The digest below is GENERATED from release/1.0 at ed739d4 (the base of this
+# PR): the same matrix run through that commit's `_announce()`. Reproduce with
+# `git show ed739d4:goodwe_controller/app/mqtt.py` and this loop.
+ROSTERS = [[], ["inverter-a"], ["inverter-a", "inverter-b"], ["a", "b", "c"],
+           ["inverter-b", "Inverter B", "x", "y"], ["café"]]
+ED739D4_OFF = "501a7d93782a260b"
+_h, _n, _subs_off = hashlib.sha256(), 0, []
+for _r in ROSTERS:
+    for _om in [(), ("p1_age",), ("p1_age", "grid")]:
+        for _inc in [(), ("pv",)]:
+            _m, _s = announce_p2(_r, _om, _inc)
+            _h.update(repr(_m).encode())
+            _subs_off += _s
+            _n += 1
+print(f"    modes off, {_n} configurations: digest {_h.hexdigest()[:16]} "
+      f"(ed739d4: {ED739D4_OFF})")
+check("modes off: every configuration announces byte-for-byte what ed739d4 "
+      "announces, in the same order, and subscribes to nothing",
+      _h.hexdigest()[:16] == ED739D4_OFF and not _subs_off)
+
+
+# --- 10b. modes on: the ordered payload diff ----------------------------------
+MODES = packmode.MODES
+ON1, SUB1 = announce_p2(["inverter-a"], modes=MODES)
+m, c, a = report("roster of one, modes on", ON1)
+# P2 announced the first two; OPT-11 P3 appended "Cheap hours only".
+_opt = '["Solar first", "Leftover solar", "Cheap hours only"]'
+MODE_N1 = [
+    ("homeassistant/select/goodwe_ctl_unit_inverter_a_mode/config",
+     '{"name": "Inverter A Mode", "object_id": "goodwe_inverter_a_mode", '
+     '"unique_id": "goodwe_ctl_unit_inverter_a_mode", '
+     '"state_topic": "goodwe_ctl/unit/inverter_a/mode", '
+     '"command_topic": "goodwe_ctl/unit/inverter_a/mode/set", '
+     '"options": ' + _opt + ', "retain": false, '
+     '"availability_topic": "goodwe_ctl/availability", "device": ' + _DEV + ', '
+     '"icon": "mdi:battery-sync"}', True),
+    ("homeassistant/switch/goodwe_ctl_unit_inverter_a_use/config",
+     '{"name": "Inverter A Use", "object_id": "goodwe_inverter_a_use", '
+     '"unique_id": "goodwe_ctl_unit_inverter_a_use", '
+     '"state_topic": "goodwe_ctl/unit/inverter_a/use", '
+     '"command_topic": "goodwe_ctl/unit/inverter_a/use/set", '
+     '"payload_on": "ON", "payload_off": "OFF", "retain": false, '
+     '"availability_topic": "goodwe_ctl/availability", "device": ' + _DEV + ', '
+     '"icon": "mdi:power"}', True),
+]
+check("modes on at a roster of one: every existing message byte-identical and "
+      "in place, then exactly the select and the switch, then availability",
+      ON1 == SITE_NOW[:-1] + MODE_N1 + SITE_NOW[-1:])
+check("...and it subscribes to the two command topics, and nothing else",
+      SUB1 == ["goodwe_ctl/unit/+/mode/set", "goodwe_ctl/unit/+/use/set"])
+
+ON2, _ = announce_p2(NAMES2, modes=MODES)
+m, c, a = report("roster of two, modes on", ON2, TWO)
+check("modes on at a roster of two: nothing missing or changed, four added, "
+      "and the modes-off list is an unchanged prefix",
+      (m, c) == ([], []) and len(a) == 4 and ON2[:len(TWO) - 1] == TWO[:-1]
+      and ON2[-1] == TWO[-1])
+_mc = cfgs(ON2)[-4:]
+check("...A's two stay on the site device with its name in front; B's two are "
+      "on B's own device, as TEL-07's rule has it",
+      [c_["name"] for c_ in _mc] == ["Inverter A Mode", "Inverter A Use",
+                                      "Mode", "Use"]
+      and _mc[0]["device"] == mqtt.DEVICE == _mc[1]["device"]
+      and _mc[2]["device"] == _mc[3]["device"]
+      == mqtt.unit_device("inverter-b", "inverter_b"))
+check("...unique_ids are stable per battery and distinct from every other id",
+      [c_["unique_id"] for c_ in _mc]
+      == ["goodwe_ctl_unit_inverter_a_mode", "goodwe_ctl_unit_inverter_a_use",
+          "goodwe_ctl_unit_inverter_b_mode", "goodwe_ctl_unit_inverter_b_use"]
+      and len({c_["unique_id"] for c_ in cfgs(ON2)}) == len(cfgs(ON2)))
+_ids = [compose(c_["device"]["name"], c_["name"]).split(".", 1)[1]
+        for c_ in _mc]
+print(f"    composed ids: {_ids}")
+check("...and HA composes the ids the design names: "
+      "goodwe_inverter_<x>_mode and goodwe_inverter_<x>_use",
+      _ids == ["goodwe_inverter_a_mode", "goodwe_inverter_a_use",
+               "goodwe_inverter_b_mode", "goodwe_inverter_b_use"])
+check("every mode has a plain label, in MODES order, and a later mode only "
+      "appends an option: no existing option or id changes",
+      all(k in mqtt.MODE_LABELS for k in MODES)
+      and len(set(mqtt.MODE_LABELS.values())) == len(mqtt.MODE_LABELS)
+      and json.loads(MODE_N1[0][1])["options"]
+      == [mqtt.MODE_LABELS[k] for k in MODES])
+# Review of #152: the HA options are what automations send, so they are kept
+# apart from the page's words on purpose. They start equal; if the page's
+# English changes, this goes red and the author decides: keep the HA option
+# (and change this pin) or rename it (a breaking change, in DECISIONS).
+_en = json.loads((HERE / "app" / "ui_text" / "en.json").read_text())
+check("each HA mode option is the page's English name for that mode, in "
+      "both places the page names it",
+      all(mqtt.MODE_LABELS[k] == _en["home_words"]["modes"][k]
+          == _en["home"]["batteries"]["choice"][k]["name"] for k in MODES))
+# OPT-11 P3 added `cheap_hours`: against P2's two modes (7a00f12), only the
+# options list changes, by one entry at its end; no topic, id or label moves.
+_p3 = mqtt.mode_payloads(NAMES2, MODES)
+_orig = mqtt.MODE_LABELS
+mqtt.MODE_LABELS = {k: v for k, v in _orig.items() if k != "cheap_hours"}
+try:
+    _p2 = mqtt.mode_payloads(NAMES2, MODES[:2])
+finally:
+    mqtt.MODE_LABELS = _orig
+check("...P3 appended `cheap_hours`: against P2's list only the options "
+      "change, by one entry at the end, and P2's two labels are unchanged",
+      MODES[:2] == ("solar_first", "leftover_solar")
+      and _p2[0][1]["options"] == ["Solar first", "Leftover solar"] and
+      [t for t, _ in _p3] == [t for t, _ in _p2]
+      and all({k: v for k, v in x.items() if k != "options"}
+              == {k: v for k, v in y.items() if k != "options"}
+              for (_, x), (_, y) in zip(_p3, _p2))
+      and _p3[0][1]["options"] == _p2[0][1]["options"] + ["Cheap hours only"])
+
+
+# --- 10c. modes turned off: removal ------------------------------------------
+_cur2 = [t for t, _ in mqtt.mode_payloads(NAMES2, MODES)]
+_ret = mqtt.mode_retractions(_cur2, [])
+OFF2, _subs = announce_p2(NAMES2, retract=_ret)
+check("modes turned off: the modes-off list, then an EMPTY retained config "
+      "for each of the four, then availability, and no subscription",
+      OFF2 == TWO[:-1] + [(t, "", True) for t in _cur2] + TWO[-1:]
+      and not _subs)
+check("...the store keeps what was announced, so a roster that shrinks removes "
+      "only the battery that left",
+      mqtt.mode_retractions(_cur2, [t for t, _ in
+                                    mqtt.mode_payloads(["inverter-a"], MODES)])
+      == _cur2[2:])
+check("...and nothing from the store is removed that is not one of our mode "
+      "configs: a non-list, a number, a site sensor, another add-on's select",
+      mqtt.mode_retractions("homeassistant/select/x/config", []) == []
+      and mqtt.mode_retractions(
+          [3, None, "homeassistant/sensor/goodwe_ctl_grid/config",
+           "homeassistant/select/other_mode/config",
+           "homeassistant/select/goodwe_ctl_unit_a_mode/config/x",
+           "homeassistant/select/goodwe_ctl_unit_a_mode/config"], [])
+      == ["homeassistant/select/goodwe_ctl_unit_a_mode/config"])
+
+
+_on1 = [t for t, _ in mqtt.mode_payloads(["inverter-a"], MODES)]
+_k, _r = mqtt.mode_configs(["inverter-a"], MODES, _cur2)
+check("start-up (`mode_configs`): a battery that left is removed, and stays "
+      "in the store, so a start with no broker does not forget it",
+      _r == _cur2[2:] and _k == _on1 + _cur2[2:])
+_k, _r = mqtt.mode_configs(NAMES2, (), _cur2 + _cur2[:1])
+check("...modes turned off: all four are removed, once each, and kept",
+      _r == _cur2 and _k == _cur2)
+check("...never turned on: nothing to store and nothing to remove, so the "
+      "store is not written",
+      mqtt.mode_configs(NAMES2, (), None) == ([], []))
+_k, _r = mqtt.mode_configs(NAMES2, MODES, _cur2)
+check("...turned on again: nothing removed, and the list does not grow",
+      _r == [] and _k == _cur2)
+
+
+from app.main import mode_announcement  # noqa: E402
+_st = Store(os.path.join(tempfile.mkdtemp(), "ann.json"))
+_OPTS1M = dict(OPTS2, battery_modes_enabled=True,
+               inverters=OPTS2["inverters"][:1])
+_seen = [mode_announcement(dict(OPTS2), _st),
+         dict(_st.data)]
+_seen += [mode_announcement(dict(OPTS2, battery_modes_enabled=True), _st),
+          list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])]
+_seen += [mode_announcement(_OPTS1M, _st),
+          list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])]
+_seen += [mode_announcement(dict(OPTS2, battery_modes_enabled=False), _st),
+          list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])]
+check("main's start-up, through a real Store: never on announces and stores "
+      "nothing; on stores the four; a roster of one removes B's two and keeps "
+      "them; off removes all four and the store keeps them",
+      _seen[0] == ((), []) and mqtt.MODE_CONFIGS_KEY not in _seen[1]
+      and _seen[2] == (MODES, []) and _seen[3] == _cur2
+      and _seen[4] == (MODES, _cur2[2:]) and sorted(_seen[5]) == sorted(_cur2)
+      and _seen[6] == ((), _seen[5])
+      and sorted(_seen[7]) == sorted(_cur2))
+_st = Store(os.path.join(tempfile.mkdtemp(), "ren.json"))
+mode_announcement(dict(OPTS2, battery_modes_enabled=True), _st)
+_ren = dict(OPTS2, battery_modes_enabled=True, inverters=[
+    OPTS2["inverters"][0], dict(OPTS2["inverters"][1], name="inverter-c")])
+_r = mode_announcement(_ren, _st)[1]
+_kept = list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])
+check("...B renamed C while on: B's two are removed and stay stored beside "
+      "A's and C's, so a start with no broker does not forget them",
+      _r == _cur2[2:] and _kept[-2:] == _cur2[2:] and len(_kept) == 6
+      and mode_announcement(_ren, _st)[1] == _cur2[2:])
+check("battery modes are on only for exactly `true`: not \"true\", 1 or "
+      "\"false\"",
+      [packmode.enabled({"battery_modes_enabled": v})
+       for v in (True, "true", 1, "false", None)]
+      == [True, False, False, False, False])
+
+
+# --- 10d. state topics, from the store ----------------------------------------
+_tmp = tempfile.mkdtemp()
+OPTS2M = dict(OPTS2, battery_modes_enabled=True)
+
+
+def ctl_for(opts, path):
+    pub = _Pub()
+    pub.sent = []
+    pub.publish = lambda values, _p=pub: (_p.sent.append(dict(values)),
+                                          setattr(_p, "last", dict(values)))
+    return Controller(dict(opts), None, Store(path), pub,
+                      stop=asyncio.Event()), pub
+
+
+_path = os.path.join(_tmp, "state.json")
+ctlm, pubm = ctl_for(OPTS2M, _path)
+ctlm.publish()
+_fed = {f"{mqtt.BASE}/{k}" for k in pubm.last
+        if k.endswith("/mode") or k.endswith("/use")}
+check("every announced mode entity is fed, and nothing else is: the state "
+      "topics published are exactly the ones announced",
+      _fed == {c_["state_topic"] for c_ in _mc})
+check("...defaults with nothing in the store: both On, both Solar first",
+      [pubm.last[k] for k in ("unit/inverter_a/mode", "unit/inverter_a/use",
+                              "unit/inverter_b/mode", "unit/inverter_b/use")]
+      == ["Solar first", "ON", "Solar first", "ON"])
+_c_off, _p_off = ctl_for(dict(OPTS2, battery_modes_enabled=False),
+                         os.path.join(_tmp, "off2.json"))
+_c_off.publish()
+_c_abs, _p_abs = ctl_for(OPTS2, os.path.join(_tmp, "off3.json"))
+_c_abs.publish()
+check("modes off (false or absent): the controller publishes the same keys as "
+      "before, with no mode or switch topic",
+      set(_p_off.last) == set(_p_abs.last) == set(vals2)
+      and not [k for k in _p_off.last if k.endswith(("/mode", "/use"))])
+
+
+# --- 10e. commands: the /action path, validated -------------------------------
+class _Logs(logging.Handler):
+    def __init__(self):
+        super().__init__(logging.DEBUG)
+        self.rows = []
+
+    def emit(self, record):
+        self.rows.append((record.levelno, record.getMessage()))
+
+
+_logs = _Logs()
+logging.getLogger("goodwe").addHandler(_logs)
+logging.getLogger("goodwe").setLevel(logging.DEBUG)
+_calls = []
+_real_handle = ctlm.handle_action
+
+
+async def _spy(what, **kw):
+    _calls.append((what, kw))
+    return await _real_handle(what, **kw)
+
+
+ctlm.handle_action = _spy
+
+
+def cmd(topic, payload, retained=False, ctl=None):
+    ctl = ctl or ctlm
+    asyncio.run(ctl.mqtt_command(topic, payload, retained))
+
+
+def stored(ctl=None):
+    d = (ctl or ctlm).store.data
+    return {k: d.get(k) for k in (unit_key("inverter-a", "pack_use"),
+                                  unit_key("inverter-a", "pack_mode"),
+                                  unit_key("inverter-b", "pack_use"),
+                                  unit_key("inverter-b", "pack_mode"))}
+
+
+T_A = "goodwe_ctl/unit/inverter_a"
+T_B = "goodwe_ctl/unit/inverter_b"
+pubm.sent.clear()
+cmd(f"{T_B}/use/set", b"OFF")
+cmd(f"{T_A}/mode/set", b"Leftover solar")
+check("good commands go through handle_action() with the /action arguments",
+      _calls == [("pack_use", {"unit": "inverter-b", "value": False}),
+                 ("pack_mode", {"unit": "inverter-a",
+                                "value": "leftover_solar"})])
+check("...and reach the store under P1's keys, and nowhere else",
+      stored() == {unit_key("inverter-a", "pack_use"): None,
+                   unit_key("inverter-a", "pack_mode"): "leftover_solar",
+                   unit_key("inverter-b", "pack_use"): False,
+                   unit_key("inverter-b", "pack_mode"): None})
+check("...and the state topics say so at once, from the store",
+      pubm.sent and pubm.sent[-1] == {
+          "unit/inverter_a/mode": "Leftover solar", "unit/inverter_a/use": "ON",
+          "unit/inverter_b/mode": "Solar first", "unit/inverter_b/use": "OFF"})
+check("...and the action log records each change",
+      any("inverter-b switched off" in e for e in ctlm.events)
+      and any("inverter-a mode set to leftover solar" in e
+              for e in ctlm.events))
+
+_before = stored()
+_n_calls = len(_calls)
+BAD = [
+    (f"{T_A}/use/set", b"on"), (f"{T_A}/use/set", b"ON\n"),
+    (f"{T_A}/use/set", b"true"), (f"{T_A}/use/set", b"1"),
+    (f"{T_A}/use/set", b""),
+    (f"{T_A}/mode/set", b"solar_first"),          # a key, not the option
+    (f"{T_A}/mode/set", b"Sell only"),            # not an offered mode
+    (f"{T_A}/mode/set", b"solar first"),
+    (f"{T_A}/mode/set", "Sοlar first".encode()),  # Greek omicron
+    (f"{T_A}/mode/set", b"Solar first\x00"),
+    (f"{T_A}/mode/set", b'{"action": "pack_use", "value": false}'),
+    (f"{T_A}/mode/set", b"Solar first; rm -rf /"),
+    (f"{T_A}/mode/set", b"' OR 1=1 --"),
+    (f"{T_A}/use/set", b"\xff\xfe"),              # not UTF-8
+    (f"{T_A}/mode/set", b"Solar first" * 10),     # too long
+    ("goodwe_ctl/unit/inverter_z/use/set", b"OFF"),   # no such battery
+    ("goodwe_ctl/unit/../use/set", b"OFF"),
+    ("goodwe_ctl/unit/inverter_a/soc/set", b"OFF"),
+    ("goodwe_ctl/unit/inverter_a/use/set/x", b"OFF"),
+    ("goodwe_ctl/unit/Inverter_A/use/set", b"OFF"),
+    (f"{T_A}/use/set", None),
+]
+for _t, _p in BAD:
+    cmd(_t, _p)
+check(f"all {len(BAD)} bad commands are refused: the store is unchanged",
+      stored() == _before)
+_passed = [c_ for c_ in _calls[_n_calls:]]
+check("...those that reach handle_action() carry a value /action also refuses "
+      "(None) or no known battery; nothing is coerced into a valid choice",
+      all(kw["value"] is None or kw["unit"] is None for _, kw in _passed))
+
+# Log once per topic and reason.
+_logs.rows.clear()
+for _ in range(5):
+    cmd(f"{T_B}/use/set", b"maybe")
+_warn = [r for r in _logs.rows if r[0] >= logging.WARNING]
+check("a refused command repeated 5 times is logged once at WARNING, in plain "
+      "words, and at DEBUG the other times",
+      len(_warn) == 1 and messages.pack_refused("value") in _warn[0][1]
+      and len([r for r in _logs.rows if r[0] == logging.DEBUG]) == 5)
+_logs.rows.clear()
+_flood, _ = ctl_for(OPTS2M, os.path.join(_tmp, "flood.json"))
+for _i in range(100):
+    cmd(f"goodwe_ctl/unit/x{_i}/use/set", b"OFF", ctl=_flood)
+_w = [r[1] for r in _logs.rows if r[0] >= logging.WARNING]
+_per = [w for w in _w if "still ignored" not in w]
+_more = [w for w in _w if "still ignored" in w]
+print(f"    flood: {len(_per)} per-topic WARNINGs, then {_more}")
+check("...and a flood of 100 different bad topics logs 32 WARNINGs, then the "
+      "rest only as a count, at 1 and 10 more (review of #152)",
+      len(_per) == 32 and len(_more) == 2
+      and "1 more so far" in _more[0] and "10 more so far" in _more[1])
+_logs.rows.clear()
+for _ in range(100):
+    cmd(f"{T_B}/use/set", b"maybe", ctl=_flood)
+_more = [r[1] for r in _logs.rows
+         if r[0] >= logging.WARNING and "still ignored" in r[1]]
+check("...so a repeated attack on ONE topic still shows it goes on: the count "
+      "reaches 100 in 3 lines, not 100",
+      len(_more) == 1 and "100 more so far" in _more[0])
+_logs.rows.clear()
+_inj, _ = ctl_for(OPTS2M, os.path.join(_tmp, "inj.json"))
+cmd("goodwe_ctl/unit/a\nERROR forged line\x1b[31m/use/set", b"OFF", ctl=_inj)
+_w = [r[1] for r in _logs.rows if r[0] >= logging.WARNING]
+check("...and a topic with a newline or an escape code cannot forge a log "
+      "line: it is logged printable only",
+      len(_w) == 1 and "\n" not in _w[0] and "\x1b" not in _w[0]
+      and "a?ERROR forged line?[31m" in _w[0])
+
+# Modes off: refused on the same path, even if a message arrives.
+cmd(f"{T_A}/use/set", b"OFF", ctl=_c_off)
+check("with modes off a command is refused by the same check /action makes",
+      stored(_c_off)[unit_key("inverter-a", "pack_use")] is None)
+
+
+# --- 10f. a retained command after a restart ----------------------------------
+_logs.rows.clear()
+_before = stored()
+_n_calls = len(_calls)
+cmd(f"{T_A}/use/set", b"OFF", retained=True)
+cmd(f"{T_B}/use/set", b"ON", retained=True)
+check("a RETAINED command (the broker replays it on subscribe, e.g. after a "
+      "restart) is never applied, and never reaches handle_action()",
+      stored() == _before and len(_calls) == _n_calls)
+check("...and it is logged once, in plain words",
+      any(messages.pack_refused("retained") in r[1]
+          for r in _logs.rows if r[0] >= logging.WARNING))
+ctl_r, pub_r = ctl_for(OPTS2M, _path)      # a restart: same state file
+ctl_r.publish()
+check("after a restart the state topics come from the store: A Leftover solar "
+      "and on, B off",
+      [pub_r.last[k] for k in ("unit/inverter_a/mode", "unit/inverter_a/use",
+                               "unit/inverter_b/use")]
+      == ["Leftover solar", "ON", "OFF"])
+logging.getLogger("goodwe").removeHandler(_logs)
+
+
+# --- 10g. the paho side ----------------------------------------------------------
+class _Msg:
+    def __init__(self, topic, payload, retain):
+        self.topic, self.payload, self.retain = topic, payload, retain
+
+
+_got = []
+
+
+async def _handler(*args):
+    _got.append(args)
+
+
+async def _drive():
+    pub = mqtt.MqttPublisher.__new__(mqtt.MqttPublisher)
+    pub._on_message(None, None, _Msg("t", b"x", 0))      # not bound: dropped
+    pub.bind(asyncio.get_running_loop(), _handler)
+    pub._on_message(None, None, _Msg(f"{T_A}/use/set", b"OFF", 1))
+    await asyncio.sleep(0.05)
+
+asyncio.run(_drive())
+check("paho's thread hands (topic, bytes, retained) to the controller's loop, "
+      "and drops a message that arrives before the controller exists",
+      _got == [(f"{T_A}/use/set", b"OFF", True)])
+
+_kws = {k.arg: ast.unparse(k.value) for c_ in _call for k in c_.keywords}
+_main_src = (HERE / "app" / "main.py").read_text()
+check("(source read) main() passes modes and retractions to the publisher, "
+      "and binds its commands to the controller",
+      _kws.get("modes") == "_modes" and _kws.get("retract") == "_retract"
+      and "pub.bind(asyncio.get_running_loop(), controller.mqtt_command)"
+      in _main_src
+      and "_modes, _retract = mode_announcement(opts, store)" in _main_src)
+
+
+# --- 10h. the guards, broken one at a time --------------------------------------
+def p2_properties(mod):
+    out = {}
+    try:
+        off, s_off = announce_p2(NAMES2, module=mod)
+        on1, s_on = announce_p2(["inverter-a"], modes=MODES, module=mod)
+        on2, _ = announce_p2(NAMES2, modes=MODES, module=mod)
+        out["off identical"] = off == TWO and not s_off
+        out["on payloads"] = on1 == ON1 and on2 == ON2
+        out["subscribes when on"] = s_on == SUB1
+        cur = [t for t, _ in mod.mode_payloads(NAMES2, MODES)]
+        out["retract filters store"] = mod.mode_retractions(
+            [3, "homeassistant/sensor/goodwe_ctl_grid/config",
+             "homeassistant/select/other/config"] + cur, cur) == []
+        out["retract keeps current"] = mod.mode_retractions(cur, cur) == []
+        out["retract published"] = announce_p2(
+            NAMES2, retract=cur[:1], module=mod)[0] == \
+            TWO[:-1] + [(cur[0], "", True)] + TWO[-1:]
+        pc = mod.parse_command
+        out["retained dropped"] = pc(f"{T_A}/use/set", b"OFF", True,
+                                     MODES)[3] == "retained"
+        out["size capped"] = pc(f"{T_A}/mode/set", b"Solar first" * 10,
+                                False, MODES)[3] == "size"
+        out["utf-8 only"] = pc(f"{T_A}/use/set", b"\xff", False,
+                               MODES)[3] == "encoding"
+        out["switch exact"] = (
+            pc(f"{T_A}/use/set", b"on", False, MODES)[2] is None
+            and pc(f"{T_A}/use/set", b"OFF", False, MODES)[2] is False)
+        out["select labels only"] = (
+            pc(f"{T_A}/mode/set", b"solar_first", False, MODES)[2] is None
+            and pc(f"{T_A}/mode/set", b"Leftover solar", False,
+                   MODES)[2] == "leftover_solar")
+        out["select offered only"] = pc(
+            f"{T_A}/mode/set", b"Solar first", False, ("leftover_solar",))[2] \
+            is None
+        out["topic exact"] = all(
+            pc(t, b"OFF", False, MODES)[3] == "topic"
+            for t in ("goodwe_ctl/unit/../use/set", "goodwe_ctl/unit/a/b/use/set",
+                      "goodwe_ctl/unit/a/use/set/x", "x/goodwe_ctl/unit/a/use/set"))
+    except Exception as err:  # noqa: BLE001
+        out["did not raise"] = False
+        out["__error__"] = repr(err)[:70]
+    return out
+
+
+P2_SHIPPED = p2_properties(mqtt)
+check("the shipped module has every P2 property (so a red below is the "
+      "mutation)", all(v is True for v in P2_SHIPPED.values()))
+P2_MUTATIONS = [
+    ("mode entities announced with modes off",
+     [("    if not modes:\n        return []\n", "    modes = modes or ('solar_first', 'leftover_solar')\n")]),
+    ("subscribed with modes off", [("        if self.modes:\n", "        if True:\n")]),
+    ("retained commands applied", [("    if retained:\n", "    if False:\n")]),
+    ("no payload size cap", [("or len(payload) > MAX_COMMAND_BYTES", "or False")]),
+    ("bad UTF-8 replaced, not refused",
+     [('.decode("utf-8")', '.decode("utf-8", "replace")')]),
+    ("switch payload case-folded",
+     [("{USE_ON: True, USE_OFF: False}.get(text)",
+       "{USE_ON: True, USE_OFF: False}.get(text.upper())")]),
+    ("select accepts mode keys too",
+     [("if MODE_LABELS.get(k) == text", "if text in (k, MODE_LABELS.get(k))")]),
+    ("select accepts any labelled mode, offered or not",
+     [("(k for k in modes if MODE_LABELS.get(k) == text)",
+       "(k for k in MODE_LABELS if MODE_LABELS.get(k) == text)")]),
+    ("command topic loosened", [('/([a-z0-9_]+)/(mode|use)/set")', '/(.+)/(mode|use)/set")')]),
+    ("command topic matched as a prefix",
+     [("_COMMAND_RE.fullmatch(topic)", "_COMMAND_RE.search(topic)")]),
+    ("store list not filtered",
+     [("and _MODE_CONFIG_RE.fullmatch(t)\n", "and True\n")]),
+    ("current configs also removed", [("and t not in keep))", "))")]),
+    ("commands published retained by HA", [('cfg["retain"] = False', 'cfg["retain"] = True')]),
+    ("retractions not published",
+     [('            self.client.publish(topic, "", retain=True)\n', "            pass\n")]),
+]
+_p2_surv = []
+for label, pairs in P2_MUTATIONS:
+    got = properties(load(pairs))
+    got.update(p2_properties(load(pairs)))
+    broke = sorted(k for k, v in {**SHIPPED, **P2_SHIPPED}.items()
+                   if v is True and got.get(k) is not True)
+    print(f"    {'RED ' if broke else 'GREEN'} {label}"
+          + (f"  (breaks: {', '.join(broke)})" if broke else ""))
+    if not broke:
+        _p2_surv.append(label)
+check(f"all {len(P2_MUTATIONS)} P2 mutations of app/mqtt.py are red",
+      not _p2_surv)
+
+
 # ---------------------------------------------------------------------------
 print()
 if fails:

goodwe_controller/test_peak_margin.py

@@ -0,0 +1,298 @@
+"""Runnable check for SAFETY-79, the margin under the peak limit.
+`python3 test_peak_margin.py`
+
+The peak guard aims at `peak_cap_w - peak_margin_w` (default 50 W); the bill
+and every report keep the real `peak_cap_w`. DECISIONS/SAFETY-79-peak-margin.md
+has the record. Drives the REAL Controller through tools/safety79_identity.py.
+
+1. `peak_margin_w: 0` is byte-identical to release/1.0 ed739d4.
+2. The guard aims at cap - margin at N=1 and N=2, and with OPT-11 modes on an
+   Off battery covers the shortfall to cap - margin.
+3. The bill and the reports still use the real cap.
+4. Each call site in main.py passes the value its side needs.
+5. The setting: default, range, refusals in plain words.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import ast
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import safety79_identity as rig                               # noqa: E402
+from named_absence import nth, present                        # noqa: E402
+from style_rules import text_problems                         # noqa: E402
+from app import messages, peakguard                 # noqa: E402
+from app.control import maintenance_charge_floor              # noqa: E402
+from app.peakguard import (PEAK_MARGIN_RANGE_W,               # noqa: E402
+                           PEAK_OPTION_DEFAULTS, quarter_target_w)
+from app.validate import config_notes, validate_startup_config  # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+CAP = float(rig.CAP_W)
+
+# ============================================================================ #
+print("1. peak_margin_w 0: byte-identical to release/1.0 ed739d4")
+# Printed by `python3 tools/safety79_identity.py 0` on the ed739d4 tree (the
+# tool copied in, nothing else changed; that tree ignores the key), in the CI
+# image; re-printed 2026-09-29 (review) after adding the charge headroom, the
+# shaping suspension and the two maintenance scenarios. 540 cycles each.
+ED739D4 = {
+    "n1": "82316f7d4362fae4c035a1bed5e7907cf362faba994c634d0b1c356c501f53e5",
+    "n2": "0dc24e16a8390ec42edacf735eaf20273847b33b9c67d7cdc536df0ca739e421",
+    "n1_off": "eed44f058f3fcc6e7651c5c84c6fa6313e7520035ad7cac282012cf6909668a0",
+    "n2_off": "69796c107b9f78892e04d282b754f889590acf9fe1b96f09525f5ea2005e9c0a",
+    "n1_maint":
+        "bd4a88a10aa840a360ac781ac04e30b040a5aac5426fabba1fb259d71dfeba67",
+    "n2_maint":
+        "0656bc5a4a2fa3a7455822fdd7da5f68f57fd9593f374e869a0d30ba7e429275",
+}
+_zero = rig.digests(0)
+_default = rig.digests()
+for k in ED739D4:
+    print(f"    {k:7} margin 0 {'same' if _zero[k] == ED739D4[k] else 'DIFFERS'}"
+          f" {_zero[k][:16]}, default {_default[k][:16]}")
+check("⭐ at N=1 and N=2, with and without battery modes and with a "
+      "maintenance charge, margin 0 is "
+      "byte-identical to ed739d4", _zero == ED739D4)
+check("...and the default (key absent) changes every scenario, so the "
+      "scenarios do reach the margin", all(_default[k] != ED739D4[k]
+                                          for k in ED739D4))
+
+# ============================================================================ #
+print("\n2. the guard aims at cap - margin")
+_runs = {}
+for name, spec in rig.SCENARIOS.items():
+    for m in (None, 0, 120):
+        _runs[name, m] = rig.run(**spec, margin=m, dur=3600.0)
+for name in rig.SCENARIOS:
+    g = _runs[name, None][1].peak_guard
+    print(f"    {name}: margin {_runs[name, None][1].peak_margin_w:.0f} W, "
+          f"aims at {g.target_w:.0f} W, limit {g.ceiling_w:.0f} W")
+check("test_target_is_cap_minus_margin: with the key absent every scenario "
+      "(N=1, N=2, modes on and off) aims at cap - 50 and reports the cap",
+      all(_runs[n, None][1].peak_margin_w == 50.0
+          and _runs[n, None][1].peak_guard.target_w == CAP - 50
+          and _runs[n, None][1].peak_guard.ceiling_w == CAP
+          for n in rig.SCENARIOS))
+check("...and a margin of 120 moves the aim to cap - 120, a margin of 0 to "
+      "the cap", all(_runs[n, 120][1].peak_guard.target_w == CAP - 120
+                     and _runs[n, 0][1].peak_guard.target_w == CAP
+                     for n in rig.SCENARIOS))
+
+
+def banked(ctl):
+    return {b.start.strftime("%H:%M"): round(b.offtake_avg_w, 2)
+            for b in ctl.p1.blocks}
+
+
+_b = {m: banked(_runs["n1_off", m][1]) for m in (0, None, 120)}
+print(f"    N=1, the battery Off: quarters banked {_b}")
+check("test_off_battery_n1: at N=1 with the battery Off, the guard makes it "
+      "give just enough to bank the 11:30 quarter at cap - margin (2500, "
+      "2450, 2380 W for margins 0, 50, 120)",
+      [_b[m]["11:30"] for m in (0, None, 120)]
+      == [CAP, CAP - 50, CAP - 120])
+
+
+def meter_at(rows, t):
+    row = next((r for r in rows if r[0] == t), None)
+    if row is None:
+        return None, {}
+    return rig.load(t) - sum(w for _u, w in row[2]), dict(row[2])
+
+
+_g0, _c0 = meter_at(_runs["n2_off", 0][0], 1800.0)
+_g50, _c50 = meter_at(_runs["n2_off", None][0], 1800.0)
+print(f"    N=2, B Off, 6000 W house: margin 0 -> {_c0}, meter {_g0} W; "
+      f"margin 50 -> {_c50}, meter {_g50} W")
+check("test_off_battery_n2: at N=2 with B Off and A at its rating, B covers "
+      "the shortfall to cap - margin, not to the cap",
+      _c0["b"] == 1000.0 and _g0 == CAP
+      and _c50["b"] == 1050.0 and _g50 == CAP - 50)
+
+def _peak(w, observed=True):
+    return type("R", (), {"is_observed": observed, "peak_w": w})()
+
+
+# Review (SAFETY-79 point 2): the margin applies under a month peak already
+# banked, too. Aiming AT it can bank a few W over it, which raises the bill;
+# and a banked peak between cap - margin and the cap (a quarter the old guard
+# held at the cap, say) was aimed at exactly, so one overshoot crossed the cap.
+check("test_margin_under_banked_peak: the aim is the margin under the limit "
+      "that holds - the cap, or a month peak already banked above it",
+      quarter_target_w(CAP, 50, _peak(2499.0)) == CAP - 50
+      and quarter_target_w(CAP, 50, _peak(3000.0)) == 2950.0
+      and quarter_target_w(CAP, 50, _peak(3000.0, observed=False)) == CAP - 50
+      and quarter_target_w(CAP, 50, None) == CAP - 50
+      and quarter_target_w(CAP, 0, _peak(3000.0)) == 3000.0)
+
+
+def _decide(banked_w, projected_w):
+    """Half a quarter at `projected_w`, battery idle, a month peak banked."""
+    from datetime import datetime, timezone
+    from app.tariff import Projection
+    pr = Projection(projected_w, projected_w, 450.0, 1.0, False,
+                    datetime(2026, 9, 1, 12, 0, tzinfo=timezone.utc),
+                    projected_w)
+    return peakguard.decide(pr, batt_w=0.0, cap_w=CAP, margin_w=50,
+                            reading=_peak(banked_w), achievable_w=5000.0,
+                            soc=60.0, soc_floor=20.0)
+
+
+_d1, _d2 = _decide(2499.0, 2600.0), _decide(3000.0, 3100.0)
+print(f"    banked 2499 W: floor {_d1.floor_w}, limit {_d1.ceiling_w}; "
+      f"banked 3000 W: floor {_d2.floor_w}, limit {_d2.ceiling_w}")
+check("...and decide() sizes the floor to land the quarter 50 W under it "
+      "(2449 and 2950 W), while the reported limit stays the cap or the peak",
+      _d1.floor_w == 2 * (2600.0 - 2450.0) and _d1.ceiling_w == CAP
+      and _d2.floor_w == 2 * (3100.0 - 2950.0) and _d2.ceiling_w == 3000.0)
+
+# ============================================================================ #
+print("\n3. the bill and the reports keep the real cap")
+_c = _runs["n1_off", None][1]
+_pk = _c.peak.peak().peak_w
+print(f"    month peak {_pk:.0f} W, tracker cap {_c.peak.cap_w:.0f} W, "
+      f"warning {_c.peak.warning_frac():.3f}, headroom "
+      f"{_c.peak.headroom_w():.0f} W")
+check("test_billing_uses_cap: the month-peak tracker (bill, headroom, 80 % "
+      "warning) is built on the real cap, not cap - margin",
+      _c.peak.cap_w == CAP and _c.peak.warning_frac() == _pk / CAP
+      and _c.peak.headroom_w() == CAP - _pk)
+_eng = [g for r in _runs["n1_off", None][0] for g in (r[-1][1],)
+        if g and g[0] and g[1]]
+print(f"    {len(_eng)} engaged cycles; one: {_eng[0][4] if _eng else None}")
+check("test_reports_use_cap: every engaged sentence names the real limit and "
+      "the aim beside it", _eng and all(
+          g[2] == CAP and "against a 2500 W limit (peak_cap_w), aiming at "
+          "2450 W" in g[4] for g in _eng))
+check("...and the settings note compares the month peak with the real cap: "
+      "a 2480 W peak under a 2500 W cap is no warning, 2520 W is",
+      config_notes({"peak_cap_w": 2500, "peak_margin_w": 50},
+                   month_peak_w=2480) == []
+      and [n.keys for n in config_notes({"peak_cap_w": 2500,
+                                         "peak_margin_w": 50},
+                                        month_peak_w=2520)]
+      == [("peak_cap_w",)])
+_lim = _eng[0][2] if _eng else 0.0
+_notice = messages.peak_saturated(_lim)
+check("...and the user-facing peak notice built from the decision's limit "
+      "says the cap", messages.watts(CAP) in _notice.body
+      and messages.watts(CAP - 50) not in _notice.body)
+
+# ============================================================================ #
+print("\n4. each call site in main.py")
+with open(os.path.join(HERE, "app", "main.py"), encoding="utf-8") as f:
+    _src = f.read()
+_tree = ast.parse(_src)
+
+
+def calls(name):
+    return [n for n in ast.walk(_tree) if isinstance(n, ast.Call)
+            and isinstance(n.func, (ast.Attribute, ast.Name))
+            and getattr(n.func, "attr", getattr(n.func, "id", "")) == name]
+
+
+def kw(call, key):
+    if not present(call):
+        return "absent"
+    return next((ast.get_source_segment(_src, k.value) for k in call.keywords
+                 if k.arg == key), "absent")
+
+
+def arg(call, i):
+    if not present(call) or len(call.args) <= i:
+        return "absent"
+    return ast.get_source_segment(_src, call.args[i])
+
+
+_dec = [c for c in calls("decide")
+        if getattr(c.func, "value", None) is not None
+        and getattr(c.func.value, "id", "") == "peakguard"]
+_shape = calls("shaping_suspended")
+_maint = calls("maintenance_charge_floor")
+_tracker = calls("PeakTracker")
+_d, _s, _m, _t = (nth(_dec, 0, "peakguard.decide()"),
+                  nth(_shape, 0, "shaping_suspended()"),
+                  nth(_maint, 0, "maintenance_charge_floor()"),
+                  nth(_tracker, 0, "PeakTracker()"))
+print(f"    decide(cap_w={kw(_d, 'cap_w')}, margin_w={kw(_d, 'margin_w')})")
+print(f"    shaping_suspended(..., {arg(_s, 2)})")
+print(f"    maintenance_charge_floor(..., {arg(_m, 2)})")
+print(f"    PeakTracker(cap_w={kw(_t, 'cap_w')})")
+check("test_call_sites: the guard gets the real cap AND the margin; the "
+      "forecast checks get cap - margin; the month-peak tracker gets the "
+      "real cap",
+      len(_dec) == 1 and "peak_cap_w" in kw(_d, "cap_w")
+      and kw(_d, "margin_w") == "self.peak_margin_w"
+      and len(_shape) == 1 and len(_maint) == 1
+      and arg(_s, 2) == "self.peak_aim_w()"
+      and arg(_m, 2) == "self.peak_aim_w()"
+      and len(_tracker) == 1
+      and kw(_t, "cap_w") == 'float(opts.get("peak_cap_w", 3500))')
+check("test_aim_w: `peak_aim_w()` is cap - margin, and the forecast sizing "
+      "gives a maintenance charge only what is left under it",
+      _c.peak_aim_w() == CAP - 50
+      and maintenance_charge_floor(2000.0, 2400.0, _c.peak_aim_w()) == 50.0
+      and peakguard.shaping_suspended(None, 2470.0, _c.peak_aim_w())
+      and not peakguard.shaping_suspended(None, 2470.0, CAP))
+
+# ============================================================================ #
+print("\n5. the setting")
+
+
+with open(os.path.join(HERE, "config.yaml"), encoding="utf-8") as f:
+    _hits = re.findall(r"^  peak_margin_w:\s*(\S+)", f.read(), re.M)
+print(f"    config.yaml: {_hits}")
+check("config.yaml ships 50, int(0,500), and the in-code mirror matches",
+      _hits == ["50", "int(0,500)"]
+      and PEAK_OPTION_DEFAULTS["peak_margin_w"] == 50
+      and PEAK_MARGIN_RANGE_W == (0, 500))
+
+BASE = {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+        "max_w": 2000, "peak_cap_w": 3500}
+_base_problems = validate_startup_config(BASE)
+
+
+def refused(value, **more):
+    opts = dict(BASE, peak_margin_w=value, **more)
+    return [p for p in validate_startup_config(opts)
+            if p not in _base_problems]
+
+
+_ok = {v: refused(v) for v in (0, 50, 500)}
+_bad = {v: refused(v) for v in (-1, 501, 12.5, "abc")}
+for v, p in _bad.items():
+    print(f"    {v!r}: {p}")
+check("test_margin_range: 0, 50 and 500 are accepted, and so is the key "
+      "absent", not any(_ok.values()) and _base_problems == [])
+check("...and below 0, above 500, not whole, or not a number is refused, "
+      "once, naming the setting and the range",
+      all(len(p) == 1 and "“Margin below the peak limit” (peak_margin_w)"
+          in p[0] and "from 0 to 500 W" in p[0] for p in _bad.values()))
+_high = refused(500, peak_cap_w=500)
+print(f"    500 under a 500 W limit: {_high}")
+check("...and a margin that leaves nothing under the limit is refused",
+      len(_high) == 1 and "not below" in _high[0])
+_style = [text_problems(p[0], keys=("peak_margin_w", "peak_cap_w"),
+                        entities=False) for p in list(_bad.values()) + [_high]]
+check(f"...in plain words (STYLE.md): {_style}", not any(_style))
+
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: {', '.join(fails)}")
+    sys.exit(1)
+print("all checks passed")

goodwe_controller/test_peakguard.py

@@ -368,7 +368,7 @@ check("...and it grows monotonically through the quarter, so the guard is at "
 BATT_NOW = 400.0
 a_edge = averager_at(CEIL, 450.0)
 p_edge = PeakTracker.project(a_edge, B + timedelta(seconds=450))
-d_edge = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_edge = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 e_edge = excess_w(p_edge, CEIL)
 print(f"    held exactly AT the ceiling for 450 s: projected "
@@ -383,7 +383,7 @@ check("at the engagement boundary the excess is zero, so the floor is exactly "
 # than on the excess. Re-derived here rather than described: a guard that
 # released as soon as `excess <= 0` hands the actuator back at the exact instant
 # it is working, and the load springs straight back.
-released = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+released = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 would_release_on_excess = excess_w(p_edge, CEIL) <= 0.0
 # ⚠️ `floor_w` IS FORMATTED DEFENSIVELY, AND MUTATION.md's OWN LEDGER IS WHY.
@@ -404,7 +404,7 @@ check("...and the claim is held there, not released. `excess` falls to zero as "
       "arithmetic read as a level", would_release_on_excess and released.engaged)
 d_gone = decide(PeakTracker.project(averager_at(500.0, 450.0),
                                     B + timedelta(seconds=450)),
-                batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+                batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 check("...and it DOES release once the load falls under what the quarter can "
       "afford, so 'threshold the floor' is not 'never let go'",
@@ -413,7 +413,7 @@ check("...and it DOES release once the load falls under what the quarter can "
 # A hair over, and the floor is the battery plus the excess. Not a constant.
 a_over = averager_at(CEIL + 200.0, 450.0)
 p_over = PeakTracker.project(a_over, B + timedelta(seconds=450))
-d_over = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_over = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    200 W over for 450 s: {d_over.explain()}")
 check("a quarter projected over the ceiling engages, and the floor is the "
@@ -422,7 +422,7 @@ check("a quarter projected over the ceiling engages, and the floor is the "
       and near(d_over.floor_w, BATT_NOW + excess_w(p_over, CEIL), 1e-6))
 check("...and the floor moves with the battery measurement, so it is a claim "
       "about delivered power rather than a fixed setpoint",
-      not near(decide(p_over, batt_w=BATT_NOW + 250.0, cap_w=CAP_W, reading=None,
+      not near(decide(p_over, batt_w=BATT_NOW + 250.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                       achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR).floor_w,
                d_over.floor_w, 1.0))
 
@@ -433,7 +433,7 @@ intent = 0.0
 delivered_floor = []
 intent_floor = []
 for _ in range(5):
-    d_del = decide(p_over, batt_w=stuck_batt, cap_w=CAP_W, reading=None,
+    d_del = decide(p_over, batt_w=stuck_batt, cap_w=CAP_W, margin_w=0.0, reading=None,
                    achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
     delivered_floor.append(d_del.floor_w)
     intent = intent + excess_w(p_over, CEIL)     # what the intent form would do
@@ -516,7 +516,7 @@ check(f"a loop already discharging harder ({BIG:.0f} W) than the floor is not "
 absurd = averager_at(LIVE_MAX_W * 4, 870.0)
 p_absurd = PeakTracker.project(absurd, B + timedelta(seconds=870))
 DEV_MAX = LIVE_MAX_W - 500.0        # a device rating tighter than max_w
-d_absurd = decide(p_absurd, batt_w=1000.0, cap_w=CAP_W, reading=None,
+d_absurd = decide(p_absurd, batt_w=1000.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=min(LIVE_MAX_W, DEV_MAX), max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 r6 = resolve([Claim.limit("device", P_SAFETY, -DEV_MAX, DEV_MAX, "rating"),
               Claim.limit("supervised", P_SAFETY, -LIVE_MAX_W, LIVE_MAX_W, "max_w"),
@@ -599,7 +599,7 @@ print(f"    a real PeakStore on a missing volume: state={rd_broken.state}, "
       f"headroom_w()={tr_broken.headroom_w(B)}")
 check("the real store answers NOT_OBSERVED rather than a peak of 0 W",
       rd_broken.state == NOT_OBSERVED and rd_broken.peak_w is None)
-d_broken = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, reading=rd_broken,
+d_broken = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=rd_broken,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    {d_broken.explain()}")
 check("AND THE GUARD STILL ENGAGES ON IT. An unreadable peak must not disarm "
@@ -627,7 +627,7 @@ print("4. blindness: three ways a projection is not evidence")
 # (a) NO OPEN BLOCK. A fresh averager projects 0 W - under every ceiling.
 fresh = QuarterAverager(phases=1, max_hold_s=MAX_HOLD_S)
 p_fresh = PeakTracker.project(fresh, B)
-d_fresh = decide(p_fresh, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_fresh = decide(p_fresh, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    fresh averager: projected {p_fresh.projected_w:.0f} W, "
       f"block_start={p_fresh.block_start}; {d_fresh.explain()}")
@@ -655,7 +655,7 @@ p_frozen = PeakTracker.project(frozen_av, B + timedelta(seconds=600))
 RAILED = LIVE_MAX_W                          # the loop has wound to the rail
 is_frozen = looks_frozen(FREEZE_S + 1.0, -RAILED, LIVE_MAX_W,
                          FreezeWatchdogConfig(hold_s=FREEZE_S))
-d_frozen = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, reading=None,
+d_frozen = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR,
                   frozen=is_frozen)
 print(f"    meter stuck at -4000 W with the command at {-RAILED:+.0f} W: "
@@ -680,7 +680,7 @@ check("...and the same command NOT frozen is left alone, so the blind branch is
       "not simply always on",
       near(resolve(SAFE + [Claim.set("loop", P_LOOP, -RAILED, "grid"),
                            peakguard.claim(decide(
-                               p_frozen, batt_w=-RAILED, cap_w=CAP_W,
+                               p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0,
                                reading=None, achievable_w=LIVE_MAX_W,
                                max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR, frozen=False))
                            or Claim.limit("noop", P_PEAK)]).target_w,
@@ -692,7 +692,7 @@ gapped = averager_at(4200.0, 600.0, gap_at=200.0, gap_s=GAP)
 p_gap = PeakTracker.project(gapped, B + timedelta(seconds=600))
 clean = averager_at(4200.0, 600.0)
 p_clean = PeakTracker.project(clean, B + timedelta(seconds=600))
-d_gap = decide(p_gap, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_gap = decide(p_gap, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    a {GAP:.0f} s hole at 4200 W: uncovered {uncovered_s(p_gap):.0f} s, "
       f"projected {p_gap.projected_w:.0f} W vs {p_clean.projected_w:.0f} W with "
@@ -756,7 +756,7 @@ check("a renamed held value now raises AttributeError on the first cycle. The "
 OLD = (p_held.partial_ws if hasattr(p_held, "partial_ws")
        else HELD * 300.0)   # acc, which the old form would still have had
 old_projected = (HELD * 300.0 + 0.0 * (QUARTER_S - 300.0)) / QUARTER_S
-d_true = decide(p_held, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_true = decide(p_held, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    same fixture: shipped projection {p_held.projected_w:.0f} W "
       f"(engaged={d_true.engaged}), the defaulted form's "
@@ -832,7 +832,7 @@ def replay(path, *, guarded: bool, cap_w=CAP_W, max_w=LIVE_MAX_W, pack=None,
         next_cycle = t + timedelta(seconds=CYCLE_S)
         cycles += 1
         d = decide(PeakTracker.project(ing.averager, t),
-                   batt_w=batt, cap_w=cap_w, reading=tracker.peak(t),
+                   batt_w=batt, cap_w=cap_w, margin_w=0.0, reading=tracker.peak(t),
                    achievable_w=max_w, max_hold_s=MAX_HOLD_S, soc=soc,
                    soc_floor=floor_pct, frozen=False)
         if d.floor_w is not None and d.floor_w < 0.0:
@@ -1175,7 +1175,9 @@ def wired_over_limit(db, want_floor_w, opts=None, store=None, batt_w=0.0,
             int(now.timestamp() // QUARTER_S) * QUARTER_S, timezone.utc)
         span = int((now - blk).total_seconds())
         remaining = max(1.0, QUARTER_S - (now - blk).total_seconds())
-        net_w = CAP_W + want_floor_w * remaining / QUARTER_S
+        # SAFETY-79: sized against what the guard aims at, cap - margin.
+        net_w = (CAP_W - ctl.peak_margin_w
+                 + want_floor_w * remaining / QUARTER_S)
         for i in range(0, span + 1, 5):
             ctl.p1.submit(sample(blk + timedelta(seconds=i), net_w))
         # ⚠️ AND ONE TELEGRAM AT `now` ITSELF. The averager credits a sample's
@@ -1257,6 +1259,13 @@ check(f"the saturating fixture ({NET2:.0f} W) is a load the real ingest "
       f"accepts, not one it rejects as implausible", NET2 < PLAUSIBLE_MAX_W)
 print(f"    saturated case: {c2.peak_guard.explain()}")
 check("a load larger than the inverter saturates the guard", c2.peak_guard.saturated)
+# SAFETY-81 review: the alarm must hold ALARM_HOLD_S first. The fixture runs on
+# the wall clock, so the start of the hold is moved back instead of waited out.
+check("...but not on its first cycle: it must hold peakguard.ALARM_HOLD_S "
+      "(SAFETY-81)", hass2.notifications.count("goodwe_peak_saturated") == 0
+      and c2._peak_high_since is not None)
+c2._peak_high_since -= timedelta(seconds=peakguard.ALARM_HOLD_S)
+asyncio.get_event_loop_policy().new_event_loop().run_until_complete(c2.cycle())
 check("...and THAT raises exactly one notification, with its own id - the one "
       "state where the money will be spent and a human is the only remaining "
       "actuator", hass2.notifications.count("goodwe_peak_saturated") == 1)
@@ -1417,7 +1426,8 @@ check("B3: main.py sizes the floor from the MEASURED battery power, not from "
 # `datetime.now()`. Every number below therefore comes from ONE instant, and the
 # tolerances that used to absorb the wall clock are gone.
 _proj3 = _seen["projection"]
-_kw = dict(cap_w=CAP_W, reading=b3.peak.peak(), achievable_w=LIVE_MAX_W,
+_kw = dict(cap_w=CAP_W, margin_w=b3.peak_margin_w, reading=b3.peak.peak(),
+           achievable_w=LIVE_MAX_W,
            max_hold_s=b3.p1.averager.max_hold_s, soc=SOC_OK,
            soc_floor=SOC_FLOOR)
 _intent = _shipped_decide(_proj3, batt_w=STANDING, **_kw)
@@ -1554,7 +1564,8 @@ check("SAFETY-24 adds exactly the two keys it names and no more: §14's kW/W "
       "trap `capacity_peak_limit_kw` stays declined, and no speculative "
       "`peak_guard`/`peak_shave` block appeared beside it",
       _peak_keys == []
-      and sorted(PEAK_OPTION_DEFAULTS) == ["bms_soc_floor", "peak_soc_floor"])
+      and sorted(PEAK_OPTION_DEFAULTS) == ["bms_soc_floor", "peak_margin_w",
+                                           "peak_soc_floor"])   # + SAFETY-79
 # Graded on the parsed call syntax, not on the text: the module docstring names
 # `peak_cap_w` while arguing that it does not read it, so a grep would be
 # satisfied by deleting the explanation and would fail on writing one.
@@ -1634,13 +1645,13 @@ check("...and the defaulting form that was ACTUALLY shipped once in this "
       discharge_permitted(float(None or 100), SOC_FLOOR) is None)
 
 # --- the decision -----------------------------------------------------------
-d_ok = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_ok = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
               achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK,
               soc_floor=SOC_FLOOR)
-d_lim = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_lim = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                soc=SOC_FLOOR, soc_floor=SOC_FLOOR)
-d_unread = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_unread = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=None,
                   soc_floor=SOC_FLOOR)
 print(f"    with battery:  {d_ok.explain()}")
@@ -1682,7 +1693,7 @@ check("floor-limited and saturated are MUTUALLY EXCLUSIVE, by construction: the
 # notification that matters.
 d_quiet = decide(PeakTracker.project(averager_at(500.0, 450.0),
                                      B + timedelta(seconds=450)),
-                 batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+                 batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                  soc=SOC_FLOOR - 5.0, soc_floor=SOC_FLOOR)
 print(f"    an EMPTY pack on a quiet quarter: {d_quiet.explain()}")
@@ -1694,7 +1705,7 @@ check("an empty pack on a quarter that does not need shaving is IDLE, not "
       and d_quiet.floor_w is None)
 # And the BLIND branch is untouched: it never forces a discharge, so there is
 # nothing for an energy floor to bound there.
-d_blind_low = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, reading=None,
+d_blind_low = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0, reading=None,
                      achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                      soc=SOC_FLOOR - 5.0, soc_floor=SOC_FLOOR, frozen=True)
 check("...and an empty pack does not disturb the BLIND branch either: SAFETY-"
@@ -1751,7 +1762,7 @@ for load in (0.0, CEIL - 500.0, CEIL, CEIL + 300.0, CEIL + 3000.0,
         for bw in (-2000.0, 0.0, 400.0, 4000.0):
             for sc in (None, 0.0, BMS_FLOOR, SOC_FLOOR, SOC_FLOOR + 0.5, 100.0):
                 for fl in (SOC_FLOOR, BMS_FLOOR + 1.0, 55.0):
-                    _d = decide(_pr, batt_w=bw, cap_w=CAP_W, reading=None,
+                    _d = decide(_pr, batt_w=bw, cap_w=CAP_W, margin_w=0.0, reading=None,
                                 achievable_w=LIVE_MAX_W,
                                 max_hold_s=MAX_HOLD_S, soc=sc, soc_floor=fl)
                     SWEEP_N += 1
@@ -1798,8 +1809,8 @@ check("`soc` and `soc_floor` are REQUIRED keyword-only arguments of decide() "
       "with no default. A default on either is TEST-14's exact shape and would "
       "be the quiet fallback this card exists to remove - and a default on "
       "`soc_floor` would additionally be CFG-03's fourth defaults site",
-      _required_kw == {"batt_w", "cap_w", "reading", "achievable_w", "soc",
-                       "soc_floor"})
+      _required_kw == {"batt_w", "cap_w", "margin_w", "reading",
+                       "achievable_w", "soc", "soc_floor"})
 _req_fields = tuple(f.name for f in dataclasses.fields(PeakDecision)
                     if f.default is dataclasses.MISSING
                     and f.default_factory is dataclasses.MISSING)
@@ -1948,7 +1959,7 @@ check("...and it reaches the action log too", any("FLOOR_LIMITED" in e
                                                   for e in c24.events))
 # A missing SoC sensor, through the same real cycle. `inputs_ok` stops the loop
 # at 0 W in that state, so the guard's own answer is what is graded here.
-d_nosoc = decide(p_hungry, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_nosoc = decide(p_hungry, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                  soc=None, soc_floor=SOC_FLOOR)
 check("decide() handed soc=None answers floor-limited rather than a full "
@@ -2226,7 +2237,7 @@ def replay_loop(window, *, start_soc, soc_floor, usable_wh=REF_PACK_WH):
         next_cycle = t + timedelta(seconds=CYCLE_S)
         cycles += 1
         d = decide(PeakTracker.project(ing.averager, t), batt_w=batt,
-                   cap_w=CAP_W, reading=tracker.peak(t),
+                   cap_w=CAP_W, margin_w=0.0, reading=tracker.peak(t),
                    achievable_w=LOOP_MAX_W, max_hold_s=MAX_HOLD_S, soc=soc,
                    soc_floor=soc_floor, frozen=False)
         dec = compute(prev_w, w - batt, batt, LOOP_TUNING, sat_count=sat,
@@ -5462,7 +5473,7 @@ MUT.append(("blindness() returns None - the degenerate 0 W projection is graded"
 
 # 2. the frozen term dropped from the guard's inputs.
 MUT.append(("frozen=False - SAFETY-18's term dropped",
-            not decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, reading=None,
+            not decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0, reading=None,
                        achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR,
                        frozen=False).engaged and d_frozen.engaged,
             "part 4: 'THE BACKSTOP: SAFETY-18's runaway ... cut to 0 W'"))
@@ -5533,7 +5544,7 @@ _early = sum(1 for _t in (500.0, 1000.0, 2000.0)
              if discharge_permitted(SOC_FLOOR - 1.0, SOC_FLOOR) is not None
              and not decide(PeakTracker.project(
                  averager_at(_t, 450.0), B + timedelta(seconds=450)),
-                 batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+                 batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                  soc=SOC_FLOOR - 1.0, soc_floor=SOC_FLOOR).engaged)
 MUT.append((f"the SoC gate moved above the `wanted > 0` test ({_early} quiet "
@@ -5963,7 +5974,7 @@ print("13. SAFETY-38 round 4: the ORDERED PAIR inside PeakDecision.explain()")
 _S38_PROJ = PeakTracker.project(averager_at(CAP_W - 1200.0, 450.0),
                                 B + timedelta(seconds=450))
 _S38_CEIL_W, _S38_CEIL_FROM = quarter_ceiling_w(CAP_W, obs_hi)
-_S38_IDLE = decide(_S38_PROJ, batt_w=0.0, cap_w=CAP_W, reading=obs_hi,
+_S38_IDLE = decide(_S38_PROJ, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=obs_hi,
                    achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                    soc=SOC_OK, soc_floor=SOC_FLOOR)
 # UX-08 2d: the row is in plain words now, and the pair is still ordered.
@@ -6042,7 +6053,7 @@ def _proj_at(net_w, elapsed):
 
 def _decide_on(projection, *, batt_w, soc=SOC_OK, cap_w=CAP_W,
                achievable_w=LIVE_MAX_W, reading=None, frozen=False):
-    return decide(projection, batt_w=batt_w, cap_w=cap_w, reading=reading,
+    return decide(projection, batt_w=batt_w, cap_w=cap_w, margin_w=0.0, reading=reading,
                   achievable_w=achievable_w, soc=soc, soc_floor=SOC_FLOOR,
                   max_hold_s=MAX_HOLD_S, frozen=frozen)
 

goodwe_controller/test_safety81.py

@@ -0,0 +1,171 @@
+"""Runnable check for SAFETY-81, no false "Load too high for battery" alarms.
+`python3 test_safety81.py`
+
+Drives the REAL Controller through tools/safety81_sim.py (a 1 s cycle on a
+plant shaped like the SAFETY-79 rig, one sample in ten late).
+DECISIONS/SAFETY-81-load-too-high.md has the record.
+
+1. Every command is byte-identical to release/1.0 5a4cdc2.
+2. No alarm on the quarter-edge spike, the last seconds, noise (margin 50
+   and 0) or a burst the quarter absorbs.
+3. Real overloads still alarm, ALARM_HOLD_S after 5a4cdc2.
+4. peakguard.load_too_high() on its own.
+5. The hold across a cycle with no battery reading (review).
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import asyncio
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import safety81_sim as sim                                    # noqa: E402
+from app.main import Controller                               # noqa: E402
+from app.peakguard import load_too_high                       # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+# Printed by `python3 tools/safety81_sim.py` on release/1.0 5a4cdc2 (the tool
+# copied in, nothing else changed), in the CI image: (alarm times, digest).
+BASE = {
+    "const4500": ([2699.0], "6ba6b8634f0df9526adc04f03c82db7d083973268deda0d1f07c5519bc2e5e9d"),
+    "const4500_m0": ([2699.0], "2bede28f3ea6ba9294be134c9b9733e43d22a7c24deac3bf8210bbbbe09b2039"),
+    "sine4500": ([2699.0], "bf70c2c23a0eede40c34478d1354b7daa1858e0a0f920693e2dd15fb5046120f"),
+    "edge4600": ([2.0, 902.0, 1802.0, 2699.0], "3cc0c6fec0c70f138530955babc2b416fe7307373037c1b2e927b6ccdaad3a4d"),
+    "edge4600_m0": ([2.0, 902.0, 1802.0, 2699.0], "ba9ba2c042ee42b043315b996ece38b3478dc9866aaf833256c9c29c02f0fe9f"),
+    "burst_end": ([881.0, 1781.0, 2681.0], "5f70e1eb4244820f1d44b494cb80e51f1a4486dee03357c9a8e8f7d371c5d9af"),
+    "noise5000_m50": ([292.0, 2551.0, 2698.0], "48b446e1a78e6d6032b31cb68a4eadb0f74e3aec4cc1e184162e9c65449bfdc5"),
+    "noise5000_m0": ([292.0, 2552.0, 2698.0], "1a0527dee6c2b03dc95a90b4682858c7bf5edf7205c2aced249112f04328c960"),
+    "step6500": ([1201.0, 1801.0], "95e5c90e4a6814526cb4f3bea76286063b449d86a420f888c014531fb6e913a3"),
+    "miss5560": ([1201.0, 1801.0], "cd991cfe1685750598236701a5a2f2f0342d66645609c536d42ab7ba07216e6c"),
+    "ramp6500": ([1296.0, 1801.0], "8db7675535f1a01abf38bd6bfb996a6fe57711d3ecca53541bb1c0870748c46b"),
+    "step7500_reserve": ([], "21eb9c07a4582f47f347084d1c75a28a5d767bc068bc3f74f32433d3239e9ccb"),
+    # Added in review, printed the same way.
+    "sine4500_fast": (["112, about one per 30 s"], "710008fd8f2d33a0e2cbb9a626bedafd6d87bc23712bbc5b74a4af9b3ec21897"),
+    "twice7000": ([1001.0, 1502.0, 2699.0], "1cddda8cf35859efb2ad503f1683f744cb812a6325a390c4fa3df19d717af043"),
+    "step6500_gap": ([1201.0, 1801.0], "95e5c90e4a6814526cb4f3bea76286063b449d86a420f888c014531fb6e913a3"),
+}
+OUT = {k: sim.run(**v) for k, v in sim.SCENARIOS.items()}
+RUN = {k: v[:2] for k, v in OUT.items()}
+ERR = {k: v[4] for k, v in OUT.items()}
+
+# ============================================================================ #
+print("1. every command byte-identical to release/1.0 5a4cdc2")
+check("the same scenarios as 5a4cdc2", set(RUN) == set(BASE))
+for k, (alarms, digest) in RUN.items():
+    check(f"{k}: digest {digest[:12]}", digest == BASE[k][1])
+
+# ============================================================================ #
+print("2. no false alarm (5a4cdc2's are listed)")
+for k in ("edge4600", "edge4600_m0", "const4500", "const4500_m0", "sine4500",
+          "noise5000_m50", "noise5000_m0", "burst_end", "sine4500_fast"):
+    check(f"{k}: none (5a4cdc2: {BASE[k][0]})", RUN[k][0] == [])
+
+# ============================================================================ #
+print("3. real overloads still alarm, ALARM_HOLD_S after 5a4cdc2")
+# ALARM_HOLD_S (10 s) plus up to 2 s of late meter samples; at 1800 s the
+# quarter-edge tick restarts the hold.
+for k, want in (("step6500", [1211.0, 1813.0]),
+                ("miss5560", [1213.0, 1813.0])):
+    print(f"    {k}: load steps up at 1200 s; alarms at {RUN[k][0]}, "
+          f"5a4cdc2 {BASE[k][0]}")
+    check(f"{k}: after the hold, and again only at the next quarter",
+          RUN[k][0] == want)
+check("step6500_gap: cycles stopped by a lost battery reading do not "
+      "restart the hold",
+      RUN["step6500_gap"][0] == [1215.0, 1813.0])
+check("twice7000: notified once in the quarter (5a4cdc2: "
+      f"{BASE['twice7000'][0]})", RUN["twice7000"][0] == [1011.0])
+check("twice7000: the ERROR line for both overloads",
+      ERR["twice7000"] == [1011.0, 1512.0])
+# By design: until 1306 s (then the hold) this quarter would end at most
+# ALARM_MISS_W over the real 3500 W cap; 5a4cdc2 alarmed at the aim (cap - 50).
+print(f"    ramp6500: alarms at {RUN['ramp6500'][0]}, "
+      f"5a4cdc2 {BASE['ramp6500'][0]}")
+check("ramp6500: alarms once the quarter will end over the real cap by "
+      "more than ALARM_MISS_W",
+      RUN["ramp6500"][0] == [1316.0, 1813.0])
+check("step7500 under the peak reserve: not this alarm (the guard is not "
+      "allowed to discharge)", RUN["step7500_reserve"][0] == [])
+
+# ============================================================================ #
+print("4. load_too_high()")
+
+
+def proj(elapsed, done_avg, held):
+    """A projection `elapsed` s in, averaging `done_avg` so far."""
+    r = 900.0 - elapsed
+    return SimpleNamespace(elapsed_s=elapsed, held_w=held,
+                           projected_w=(done_avg * elapsed + max(held, 0) * r)
+                           / 900.0)
+
+
+def ltl(p, batt, cap=3500.0, rail=2000.0):
+    return load_too_high(p, batt_w=batt, ceiling_w=cap, achievable_w=rail)
+
+
+check("load 6000 W vs 3500 + 2000: yes", ltl(proj(300, 3450, 4000), 2000))
+check("already over, the battery can carry the load but not catch up: yes",
+      ltl(proj(450, 7200, 7200), 0, rail=5000))
+check("the last second, a 7 W miss (under ALARM_MISS_W): no",
+      not ltl(proj(899, 3509, 2500), 1000))
+check("a miss of exactly ALARM_MISS_W: no",
+      not ltl(proj(450, 3520, 3500), 2000))
+check("...and 1 W more: yes", ltl(proj(450, 3522, 3500), 2000))
+check("over cap + battery, but the quarter lands under the cap: no",
+      not ltl(proj(880, 3450, 4000), 2000))
+check("...and when it does not: yes", ltl(proj(700, 3450, 4000), 2000))
+check("no battery reading: no", not ltl(proj(300, 3450, 5000), None))
+check("no seconds left: no", not ltl(proj(900, 4000, 5000), 2000))
+check("a quarter already over is not won back by export: yes",
+      ltl(proj(800, 3950, 1000), 0))
+
+# ============================================================================ #
+print("5. the hold across a cycle with no battery reading")
+# A reading the stale detector drops (STALE_READING) reaches the alarm as None
+# while the cycle still runs. Unknown is not "fine": it must not restart the
+# hold. Driven on Controller.check_peak_saturated() itself, with stubs.
+Q0 = datetime(2026, 9, 20, 11, 0, tzinfo=timezone.utc)
+notes = []
+
+
+async def _call(domain, service, data):
+    notes.append(data.get("notification_id"))
+
+
+stub = SimpleNamespace(
+    peak_guard=SimpleNamespace(saturated=True, ceiling_w=3500.0,
+                               reason="PEAK_GUARD: fixture"),
+    site_rating_w=2000.0, shadow=False, events=[],
+    _peak_batt_prev=None, _peak_alarm_block=None, _peak_high_since=None,
+    _peak_saturated=False, hass=SimpleNamespace(call=_call),
+    log_event=lambda msg, hint=None: None)
+first = None
+for sec in range(0, 30):
+    stub.site_batt_w = None if 4 <= sec < 8 else 2000.0
+    p = proj(300 + sec, 3450, 6000)
+    p.block_start = Q0
+    stub._peak_proj = p
+    asyncio.run(Controller.check_peak_saturated(stub))
+    if notes and first is None:
+        first = sec
+check(f"a 4 s gap in the battery reading: alarm at {first} s, not 18 s",
+      first == 10)
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)} check(s)")
+    sys.exit(1)
+print("all checks passed")

goodwe_controller/test_setup.py

@@ -76,8 +76,8 @@ check("the mockup's six steps: meter, inverters, solar, prices, peak limit, "
       and [WS["steps"][str(n)]["name"] for n in range(1, 7)]
       == ["Your meter", "Inverters and batteries", "Solar", "Prices",
           "Peak limit", "Check and start"])
-check("battery modes are not a step yet (OPT-11): step 5 says they come later",
-      "later update" in WS["modes_later"]["description"]
+check("battery modes are not a wizard step (OPT-11): step 5 points to the Batteries screen",
+      "Batteries screen" in WS["modes_later"]["description"]
       and not any("mode" in k for k in BY_STEP[5]))
 SPEC = uipage.setup_spec()
 check("the spec the page reads is the table's",

goodwe_controller/tools/opt11p3_identity.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+"""OPT-11 P3: with battery modes off, is every command byte-identical to
+release/1.0 7a00f12, on the paths P3 changed?
+
+    python3 tools/opt11p3_identity.py          # prints one digest per scenario
+
+tools/safety79_identity.py's harness (the REAL Controller on a P1 meter, so
+the peak guard runs) plus a day-ahead price series and `arbitrage_enabled`,
+so the site trade P3 now skips with modes on (`arbitrage.decide()`, its
+claim, the sizing to the guard's headroom) runs on every cycle, with a buy
+period, a sell period and periods in between, and a house that goes over the
+limit. Each row hashes safety79's fields plus the trade's action, watts and
+sentence. Uses only the API 7a00f12 has, so the same file runs on both trees;
+test_modes_p3.py part 1 holds this tree to the digests printed on 7a00f12.
+"""
+
+import functools
+import hashlib
+import os
+import sys
+import tempfile
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import safety79_identity as s79                            # noqa: E402
+from app.price import PricePoint, PriceProduct, PriceRead, brussels  # noqa
+from app.static_tariff import TariffPlan                   # noqa: E402
+
+DUR = 5400.0
+
+
+def prices():
+    """15-minute firm prices: the cheapest period 15-30 min into the run,
+    the dearest 75-90 min in, and ones in between."""
+    pts = []
+    for i in range(-8, 40):
+        s = rig.BASE + timedelta(minutes=15 * i)
+        p = 0.08 if i == 1 else 0.52 if i == 5 else 0.20 + 0.003 * (i % 7)
+        pts.append(PricePoint(start=brussels(s), eur_per_kwh=p,
+                              provisional=False))
+    return TariffPlan(PriceRead.series(pts, PriceProduct.DAY_AHEAD,
+                                       "generic_dayahead", rig.BASE), None,
+                      "provider")
+
+
+PLAN = prices()
+
+
+def _feed(c, t):
+    c.tariff_plan, c.tariff_at = PLAN, rig.BASE + timedelta(seconds=t)
+    s79._feed(c, t)
+
+
+def load(t):
+    """Under the limit, over it, a surplus, a big evening load."""
+    k = int(t // 600) % 5
+    return (900.0, 3200.0, -2200.0, 1500.0, 4200.0)[k]
+
+
+def soc(u, t):
+    return 55.0 if u == "a" else 45.0
+
+
+ARB = {"arbitrage_enabled": True, "cycle_cost_threshold_eur": 0.05}
+SCENARIOS = {
+    "n1": dict(n=1),
+    "n2": dict(n=2),
+    # The option present and false: an install that saved it off.
+    "n1_off": dict(n=1, extra={"battery_modes_enabled": False}),
+    "n2_off": dict(n=2, extra={"battery_modes_enabled": False}),
+}
+
+
+def run(n, *, extra=None, dur=DUR):
+    opts = dict(s79.P1, **ARB, **(extra or {}))
+    trade = []
+
+    def on_cycle(c, t):
+        a = c.arb
+        trade.append(None if a is None else (a.action, a.power_w, a.reason))
+    db = os.path.join(tempfile.mkdtemp(prefix="p3id-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        rows, c = rig.run(n, extra=opts, dur=dur, load=load, soc=soc,
+                          cut=lambda u, t: False, before=_feed,
+                          on_cycle=on_cycle)
+    finally:
+        rig.Controller = real
+    return [r + (x,) for r, x in zip(rows, trade)], c
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+def digests() -> dict:
+    return {k: digest(run(**v)[0]) for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    if "--summary" in sys.argv:
+        for k, v in SCENARIOS.items():
+            rows = run(**v)[0]
+            acts = sorted({str(r[-1][0]) if r[-1] else "None" for r in rows})
+            print(f"{k}: {len(rows)} cycles, trade actions {acts}")
+    for k, v in digests().items():
+        print(f"{k} {v}")

goodwe_controller/tools/opt11p3_replay.py

@@ -0,0 +1,394 @@
+#!/usr/bin/env python3
+"""OPT-11 P3: replay days of recorded house load and real prices through the
+REAL Controller (read_inputs + cycle, the arbiter, the allocator, the peak
+guard on a P1 meter), with two modelled batteries, and report energy, cycles
+and money, plus the P3 invariants on every tick.
+
+    python3 tools/opt11p3_replay.py --days 16 --variant p3_ls
+    python3 tools/opt11p3_replay.py --captured          # 2026-09-09/10
+
+The same file runs on release/1.0 7a00f12 (the P2 baseline) and on this
+branch: it uses only the Controller API 7a00f12 has, and sets the batteries'
+choices through the store keys P1 defined (`pack_sell` was reserved there).
+
+REAL: the house (grid + battery power recorded 2026-09-02..17 on the live
+install, scenarios/loop-2026-09-02_2026-09-17: the house's own net demand,
+solar included), the prices (EPEX BE day-ahead, hourly, same weekday one year
+earlier (364 days), or the captured quarter-hourly energy-charts bodies for
+2026-09-09/10), the decision code.
+MODELLED: the batteries (a first-order lag, 3 s, 800 W/s ramp, SoC
+integrated, 95 % each way, a reading that jitters by a few watts, and
+optionally a device limit or a refusal to charge), the all-in price (the EPEX file's own stated
+assumption: (wholesale + 0.02 + 0.10) x 1.06), export paid at the wholesale
+price, tomorrow's prices known from 13:00 local. The absolute money is
+therefore an estimate; the comparison between variants is the point.
+"""
+
+import argparse
+import asyncio
+import gzip
+import json
+import math
+import os
+import sys
+import time
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, HERE)
+
+import app.main as m                                      # noqa: E402
+from app.main import Controller                           # noqa: E402
+from app.p1 import make_sample, split_signed               # noqa: E402
+from app.price import PricePoint, PriceProduct, PriceRead, brussels  # noqa
+from app.static_tariff import TariffPlan                  # noqa: E402
+from app.store import unit_key                            # noqa: E402
+
+LOOP = os.path.join(HERE, "scenarios", "loop-2026-09-02_2026-09-17")
+EPEX = os.path.join(HERE, "scenarios",
+                    "epex-be-dayahead-2025-09-01_2026-09-01.json")
+QH = os.path.join(HERE, "scenarios",
+                  "energy-charts-be-price-2026-09-09_2026-09-10-twoday.json")
+TICK = 5.0
+CAP_KWH = 10.0
+RATING = 2500.0
+PEAK_CAP = 3500
+
+
+def all_in(wholesale_kwh):
+    return round((wholesale_kwh + 0.02 + 0.10) * 1.06, 6)
+
+
+def load_house(days):
+    """[(t_utc_epoch, house_w)] from the recording: grid + battery power."""
+    out = []
+    for d in days:
+        def rd(kind):
+            f = os.path.join(LOOP, f"{d}-{kind}.jsonl.gz")
+            rows = []
+            with gzip.open(f, "rt") as fh:
+                for line in fh:
+                    r = json.loads(line)
+                    try:
+                        v = float(r["v"])
+                    except ValueError:
+                        continue
+                    rows.append((datetime.fromisoformat(r["t"]).timestamp(),
+                                 v))
+            return rows
+        g, b = rd("grid"), rd("batt")
+        j = 0
+        for t, gw in g:
+            while j + 1 < len(b) and b[j + 1][0] <= t:
+                j += 1
+            bw = b[j][1] if b and b[j][0] <= t else 0.0
+            out.append((t, gw + bw))
+    out.sort()
+    return out
+
+
+def epex_points(shift_days=364):
+    d = json.load(open(EPEX))["prices"]
+    pts = []
+    for r in d:
+        s = datetime.fromisoformat(r["start"]) + timedelta(days=shift_days)
+        pts.append((s.astimezone(timezone.utc), 3600,
+                    float(r["eur_per_kwh"])))
+    return pts
+
+
+def qh_points():
+    d = json.load(open(QH))
+    return [(datetime.fromtimestamp(t, timezone.utc), 900, p / 1000.0)
+            for t, p in zip(d["unix_seconds"], d["price"])
+            if p is not None]
+
+
+class Plant:
+    def __init__(self, soc, refuse_charge=False):
+        self.cmd, self.p, self.soc = 0.0, 0.0, float(soc)
+        self.refuse_charge = refuse_charge
+
+    def step(self, dt, floor):
+        c = self.cmd
+        if c > 0 and self.soc <= floor:
+            c = 0.0
+        if c < 0 and (self.soc >= 100.0 or self.refuse_charge):
+            c = 0.0
+        want = self.p + (c - self.p) * (1 - math.exp(-dt / 3.0))
+        dp = max(-800.0 * dt, min(800.0 * dt, want - self.p))
+        self.p += dp
+        e = self.p * dt / 3600.0 / 1000.0            # kWh, + = out
+        eff = 1 / 0.95 if e > 0 else 0.95
+        self.soc -= e * eff / CAP_KWH * 100.0
+        self.soc = max(0.0, min(100.0, self.soc))
+
+
+class Hass:
+    def __init__(self, units, house_at, soc0=None, refuse=(), limits=None):
+        self.units = units
+        self.lim = limits or {}
+        self.plants = {u: Plant((soc0 or {}).get(u, 50.0), u in refuse)
+                       for u in units}
+        self.house_at = house_at
+        self.t = 0.0
+
+    def grid(self):
+        return self.house_at(self.t) - sum(p.p for p in self.plants.values())
+
+    async def limits(self, e):
+        lo, hi = self.lim.get(e[-1], (-5000.0, 5000.0))
+        return (lo, hi, 1.0)
+
+    async def call(self, *a):
+        return True
+
+    async def number(self, e, invert=False):
+        if e == "sensor.grid":
+            return self.grid()
+        u = e[-1]
+        if e.startswith("sensor.soc"):
+            return round(self.plants[u].soc, 1)
+        if e.startswith("sensor.batt"):
+            # A real reading jitters by a few watts; a dead-flat one is a
+            # stale register to the add-on (SAFETY-37), which is not modelled.
+            j = (ord(u) * 31 + int(self.t)) % 7 - 3
+            return float(round(self.plants[u].p) + j)
+        return None
+
+    async def set_number(self, e, v):
+        self.plants[e[-1]].cmd = float(v)
+        return True
+
+
+class _Store:
+    def __init__(self):
+        from app.store import DEFAULTS
+        self.data = dict(DEFAULTS)
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def get_time(self, k):
+        v = self.data.get(k)
+        return datetime.fromisoformat(v) if v else None
+
+    def set_time(self, k, when):
+        self.data[k] = when.isoformat() if when else None
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, *a, **k):
+        pass
+
+    def close(self):
+        pass
+
+
+VARIANTS = {
+    # (modes on, arbitrage_enabled, {unit: (use, mode, sell)})
+    "modes_off": (False, False, {}),
+    "arb_only": (False, True, {}),
+    "p2_sf_ls": (True, False, {"a": (True, "solar_first", False),
+                               "b": (True, "leftover_solar", False)}),
+    "p2_arb": (True, True, {"a": (True, "solar_first", False),
+                            "b": (True, "leftover_solar", False)}),
+    "p3_ls": (True, False, {"a": (True, "solar_first", False),
+                            "b": (True, "leftover_solar", False)}),
+    "p3_ch_sell": (True, False, {"a": (True, "solar_first", False),
+                                 "b": (True, "cheap_hours", True)}),
+    "p3_both_ch": (True, False, {"a": (True, "cheap_hours", False),
+                                 "b": (True, "cheap_hours", True)}),
+}
+
+
+def options(modes, arb, n=2):
+    o = {"meter_entity": "sensor.grid", "meter_source": "ha_signed",
+         "p1_net_entity": "sensor.net", "meter_phases": 1,
+         "peak_cap_w": PEAK_CAP, "gain": 0.6, "slew_w": 400,
+         "target_grid_w": -10, "deadband_w": 15, "step_w": 10,
+         "heartbeat_s": 10, "stale_input_s": 15, "auto_start": True,
+         "battery_modes_enabled": modes, "arbitrage_enabled": arb,
+         "cycle_cost_threshold_eur": 0.10,
+         "inverters": [{"name": f"inverter-{u}",
+                        "setpoint_entity": f"number.sp_{u}",
+                        "soc_entity": f"sensor.soc_{u}",
+                        "batt_entity": f"sensor.batt_{u}",
+                        "max_w": int(RATING), "bms_soc_floor": 10,
+                        "capacity_kwh": CAP_KWH} for u in "ab"[:n]]}
+    return o
+
+
+def plan_at(now, pts):
+    """The firm day-ahead points a site holds at `now`: today, and tomorrow
+    once published (13:00 local)."""
+    loc = brussels(now)
+    day0 = loc.replace(hour=0, minute=0, second=0, microsecond=0)
+    end = day0 + timedelta(days=2 if loc.hour >= 13 else 1)
+    sel = [PricePoint(start=brussels(s), eur_per_kwh=all_in(p),
+                      provisional=False)
+           for s, span, p in pts if day0 <= s < end]
+    if len(sel) < 2:
+        return None
+    return TariffPlan(PriceRead.series(sel, PriceProduct.DAY_AHEAD,
+                                       "generic_dayahead", now), None,
+                      "provider")
+
+
+def run(variant, house, pts, start, dur, *, check=None, stride=1, n=2,
+        soc0=None, refuse=(), extra=None, choice=None, patch=None,
+        limits=None):
+    modes, arb, var_choice = VARIANTS[variant]
+    choice = var_choice if choice is None else choice
+    units = tuple("ab"[:n])
+    import bisect
+    ts = [h[0] for h in house]
+
+    def house_at(t):
+        i = bisect.bisect_right(ts, start.timestamp() + t) - 1
+        return house[max(0, i)][1]
+
+    wholesale = {s: (span, p) for s, span, p in pts}
+    starts = sorted(wholesale)
+
+    def price_at(now):
+        i = bisect.bisect_right(starts, now) - 1
+        if i < 0:
+            return None
+        s = starts[i]
+        span, p = wholesale[s]
+        return p if now < s + timedelta(seconds=span) else None
+
+    store = _Store()
+    for u, (use, mode, sell) in choice.items():
+        store.data[unit_key(f"inverter-{u}", "pack_use")] = use
+        store.data[unit_key(f"inverter-{u}", "pack_mode")] = mode
+        store.data[unit_key(f"inverter-{u}", "pack_sell")] = sell
+    stats = dict(imp_kwh=0.0, exp_kwh=0.0, cost=0.0, exp_rev=0.0,
+                 out_kwh={u: 0.0 for u in "ab"[:n]},
+                 in_kwh={u: 0.0 for u in "ab"[:n]},
+                 ticks=0, quarters={}, trade_ticks=0)
+
+    async def go():
+        hass = Hass(units, house_at, soc0, refuse, limits)
+        import tempfile
+        db = os.path.join(tempfile.mkdtemp(prefix="p3r-"), "tariff.db")
+        c = Controller(dict(options(modes, arb, n), **(extra or {})), hass,
+                       store, _Pub(), stop=asyncio.Event(), peak_db_path=db)
+        for i in c.inverters:
+            i.dev_min, i.dev_max = (limits or {}).get(i.name[-1],
+                                                      (-5000.0, 5000.0))
+        if patch is not None:
+            patch(c)
+        c.auto = True
+        real_dt = m.datetime
+        clock = [start]
+
+        class _DT(real_dt):
+            @classmethod
+            def now(cls, tz=None):
+                return clock[0] if tz is None else clock[0].astimezone(tz)
+
+        m.datetime = _DT
+        plan_hour = None
+        try:
+            t = 0.0
+            while t < dur:
+                now = start + timedelta(seconds=t)
+                hass.t = t
+                clock[0] = now
+                if plan_hour != now.replace(minute=0, second=0,
+                                            microsecond=0):
+                    plan_hour = now.replace(minute=0, second=0,
+                                            microsecond=0)
+                    c.tariff_plan, c.tariff_at = plan_at(now, pts), now
+                else:
+                    c.tariff_at = now
+                imp, exp = split_signed(hass.grid())
+                c.p1.submit(make_sample("ha_signed", imp, exp, phases=1,
+                                        ingest_ts=now,
+                                        ingest_mono=time.monotonic()))
+                await c.read_inputs(now_mono=t)
+                await c.cycle()
+                for p in hass.plants.values():
+                    p.step(TICK, 10.0)
+                g = hass.grid()
+                pr = price_at(now)
+                dt_h = TICK / 3600.0
+                if g > 0:
+                    stats["imp_kwh"] += g / 1000 * dt_h
+                    stats["cost"] += g / 1000 * dt_h * (all_in(pr) if pr
+                                                         is not None else 0)
+                else:
+                    stats["exp_kwh"] += -g / 1000 * dt_h
+                    stats["exp_rev"] += -g / 1000 * dt_h * (pr or 0.0)
+                for u, p in hass.plants.items():
+                    if p.p > 0:
+                        stats["out_kwh"][u] += p.p / 1000 * dt_h
+                    else:
+                        stats["in_kwh"][u] -= p.p / 1000 * dt_h
+                q = int(now.timestamp() // 900)
+                acc = stats["quarters"].setdefault(q, [0.0, 0, False])
+                acc[0] += max(0.0, g)
+                acc[1] += 1
+                if (getattr(c.arb, "action", None) or "").endswith("CHARGE"):
+                    acc[2] = True
+                    stats["trade_ticks"] += 1
+                stats["ticks"] += 1
+                if check is not None:
+                    check(c, hass, now, pr)
+                t += TICK
+        finally:
+            m.datetime = real_dt
+        return c
+    c = asyncio.run(go())
+    return stats, c
+
+
+def summary(stats):
+    qs = stats["quarters"]
+    worst = max((a[0] / a[1] for a in qs.values()), default=0.0)
+    worst_trade = max((a[0] / a[1] for a in qs.values() if a[2]),
+                      default=0.0)
+    cyc = {u: round(v / CAP_KWH, 2) for u, v in stats["out_kwh"].items()}
+    return {"import_kwh": round(stats["imp_kwh"], 2),
+            "export_kwh": round(stats["exp_kwh"], 2),
+            "import_eur": round(stats["cost"], 2),
+            "export_eur": round(stats["exp_rev"], 2),
+            "net_eur": round(stats["cost"] - stats["exp_rev"], 2),
+            "cycles": cyc, "worst_quarter_w": round(worst, 1),
+            "worst_charge_quarter_w": round(worst_trade, 1),
+            "charge_ticks": stats["trade_ticks"]}
+
+
+LOOP_DAYS = [f"2026-09-{d:02d}" for d in range(2, 18)]
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--variant", default="p3_ls")
+    ap.add_argument("--days", type=int, default=16)
+    ap.add_argument("--captured", action="store_true")
+    a = ap.parse_args()
+    if a.captured:
+        days = ["2026-09-09", "2026-09-10"]
+        pts = qh_points()
+    else:
+        days = LOOP_DAYS[:a.days]
+        pts = epex_points()
+    house = load_house(days)
+    start = datetime.fromisoformat(days[0] + "T00:00:00+02:00") \
+        .astimezone(timezone.utc)
+    dur = 86400.0 * len(days)
+    t0 = time.time()
+    stats, _c = run(a.variant, house, pts, start, dur)
+    out = summary(stats)
+    out["variant"], out["days"] = a.variant, len(days)
+    out["wall_s"] = round(time.time() - t0, 1)
+    print(json.dumps(out))
+
+
+if __name__ == "__main__":
+    main()

goodwe_controller/tools/replay_ac3.py

@@ -176,7 +176,7 @@ def replay(paths, *, guarded: bool, cap_w, max_w, max_hold_s, cycle_s,
             next_cycle = t + timedelta(seconds=cycle_s)
             cycles += 1
             d = decide(PeakTracker.project(ing.averager, t), batt_w=batt,
-                       cap_w=cap_w, reading=tracker.peak(t),
+                       cap_w=cap_w, margin_w=0.0, reading=tracker.peak(t),
                        achievable_w=max_w, max_hold_s=max_hold_s, soc=soc,
                        soc_floor=soc_floor, frozen=False)
             if d.engaged:

goodwe_controller/tools/safety79_identity.py

@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""SAFETY-79: with `peak_margin_w: 0`, is every command byte-identical to before?
+
+    python3 tools/safety79_identity.py          # prints one digest per scenario
+
+tools/opt11_identity.py's harness (the REAL Controller, read_inputs + cycle, in
+simulated time) with a P1 meter, so the peak guard runs, and a peak limit the
+house goes over. Each row hashes opt11_identity's fields plus the guard's floor,
+limit and sentence, its charge headroom (what arbitrage is sized to) and the
+maintenance shaping's suspension. The two `_maint` scenarios run a maintenance
+charge in a cheap window with a demand forecast that crosses cap - 50 .. cap,
+so `shaping_suspended()` and `maintenance_charge_floor()` are both reached.
+It uses only the API release/1.0 ed739d4 already had, so
+the same file runs on the old tree (which ignores `peak_margin_w`) and the new.
+test_peak_margin.py part 1 holds the new tree to the digests printed on ed739d4.
+"""
+
+import functools
+import hashlib
+import os
+import sys
+import tempfile
+import time
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+from app import packmode, peakguard                       # noqa: E402
+from app.p1 import make_sample, split_signed              # noqa: E402
+from app.store import unit_key                            # noqa: E402
+
+CAP_W = 2500
+
+
+def load(t):
+    """A house under the limit, over it, a solar surplus, far over, over."""
+    if t < 300:
+        return 800.0
+    if t < 900:
+        return 3200.0
+    if t < 1500:
+        return -2600.0
+    if t < 2100:
+        return 6000.0
+    return 4200.0
+
+
+def soc(u, t):
+    return 60.0         # above the peak reserve: the guard may discharge
+
+
+def _feed(c, t):
+    """One P1 telegram per cycle: the meter reads what the house and the
+    batteries' measured power leave."""
+    imp, exp = split_signed(c.hass.grid())
+    c.p1.submit(make_sample("ha_signed", imp, exp, phases=1,
+                            ingest_ts=rig.BASE + timedelta(seconds=t),
+                            ingest_mono=time.monotonic()))
+
+
+def store_off(name):
+    """A store where battery `name` is switched Off (OPT-11)."""
+    s = rig._Store()
+    s.data[unit_key(name, packmode.USE_KEY)] = False
+    return s
+
+
+def forecast(t):
+    """A demand forecast that sweeps 2300-2600 W every 10 minutes: across
+    cap - 50 and the cap, so the margin moves the forecast checks."""
+    return 2300.0 + (t % 600) / 600 * 300
+
+
+def _feed_maint(c, t):
+    """`_feed`, plus the forecast and a cheap price (now under average)."""
+    if not getattr(c.hass, "_s79", False):
+        read = c.hass.number
+        fixed = {"sensor.pnow": 0.05, "sensor.pavg": 0.20}
+
+        async def number(e, invert=False):
+            if e == "sensor.fc":
+                return forecast(c.hass.t)
+            if e in fixed:
+                return fixed[e]
+            return await read(e, invert)
+        c.hass.number, c.hass._s79 = number, True
+    _feed(c, t)
+
+
+def store_charging(n):
+    """A store where the first battery is in its maintenance CHARGE phase."""
+    s = rig._Store()
+    for k in ("phase", "phase_started"):
+        s.data[k if n == 1 else unit_key("inverter-a", k)] = (
+            "charge" if k == "phase" else rig.BASE.isoformat())
+    return s
+
+
+P1 = {"meter_source": "ha_signed", "p1_net_entity": "sensor.net",
+      "meter_phases": 1, "peak_cap_w": CAP_W}
+MODES = {"battery_modes_enabled": True}
+MAINT = {"maintenance_enabled": True, "maintenance_start_hour": 11,
+         "peak_forecast_entity": "sensor.fc", "price_now_entity": "sensor.pnow",
+         "price_avg_entity": "sensor.pavg"}
+
+SCENARIOS = {
+    "n1": dict(n=1),
+    "n2": dict(n=2),
+    # OPT-11: the only battery Off, so only the peak guard makes it give.
+    "n1_off": dict(n=1, modes=True, off="inverter-a"),
+    # OPT-11: B Off, so B covers what A cannot.
+    "n2_off": dict(n=2, modes=True, off="inverter-b"),
+    # A maintenance charge in a cheap window, with a demand forecast.
+    "n1_maint": dict(n=1, maint=True),
+    "n2_maint": dict(n=2, maint=True),
+}
+
+
+def run(n, *, margin=None, modes=False, off=None, maint=False, dur=2700.0):
+    """Rows for one scenario; `margin=None` leaves the key out."""
+    extra = dict(P1, **(MODES if modes else {}), **(MAINT if maint else {}))
+    if margin is not None:
+        extra["peak_margin_w"] = margin
+    guard = []
+
+    def on_cycle(c, t):
+        g = c.peak_guard
+        guard.append((c._maint_shape_suspended, None if g is None else (
+            g.engaged, g.floor_w, g.ceiling_w, g.ceiling_from, g.reason,
+            peakguard.charge_headroom_w(g))))
+    db = os.path.join(tempfile.mkdtemp(prefix="s79-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        rows, c = rig.run(n, extra=extra, dur=dur, load=load, soc=soc,
+                          cut=lambda u, t: False,
+                          before=_feed_maint if maint else _feed,
+                          on_cycle=on_cycle,
+                          store=(store_off(off) if off else
+                                 store_charging(n) if maint else None))
+    finally:
+        rig.Controller = real
+    return [r + (g,) for r, g in zip(rows, guard)], c
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+def digests(margin=None) -> dict:
+    return {k: digest(run(**v, margin=margin)[0]) for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    m = None if len(sys.argv) < 2 else int(sys.argv[1])
+    for k, v in digests(m).items():
+        print(f"{k} {v}")

goodwe_controller/tools/safety81_sim.py

@@ -0,0 +1,229 @@
+#!/usr/bin/env python3
+"""SAFETY-81: when does "Load too high for battery" fire?
+
+    python3 tools/safety81_sim.py            # alarms and a control digest per run
+
+The REAL Controller (read_inputs + cycle) at a 1 s cycle, on a plant shaped
+like the SAFETY-79 test rig: one battery switched Off (so only the peak guard
+makes it give, max 2000 W), a 3500 W cap, and a P1 meter that publishes
+0.3 s before each cycle. The battery reaches a new command 0.5 s after it is
+written. One meter sample in ten arrives late (the add-on still holds the one
+before), so the held meter reading can predate the battery's last change:
+the double count behind the rig's false alarms. The cycle on a quarter
+boundary, before the new quarter's first sample, files no peak claim, which
+is the rig's 1 s grid spike at each quarter change. Each run returns the
+alarm times and a digest of every command, so the same runs show both what
+changed and what did not.
+"""
+
+import asyncio
+import hashlib
+import logging
+import os
+import random
+import sys
+import tempfile
+import time
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import app.main as m                                       # noqa: E402
+from app import packmode                                   # noqa: E402
+from app.main import Controller                            # noqa: E402
+from app.p1 import make_sample, split_signed               # noqa: E402
+from app.store import unit_key                             # noqa: E402
+
+TICK = 1.0
+SAMPLE_LEAD_S = 0.3     # the meter publishes this long before each cycle
+RESPONSE_S = 0.5        # a new command reaches the battery this much later
+LATE_P = 0.1            # share of meter samples that arrive late
+ALARM = "goodwe_peak_saturated"
+
+
+def constant(w):
+    return lambda t: w
+
+
+def noisy(mean, amp, seed=81):
+    """`mean` +/- `amp`, a new uniform value every second."""
+    rnd = random.Random(seed)
+    table = {}
+
+    def f(t):
+        k = int(t)
+        if k not in table:
+            table[k] = mean + rnd.uniform(-amp, amp)
+        return table[k]
+    return f
+
+
+def sine(mean, amp, period=120.0, noise=50.0):
+    import math
+    n = noisy(0.0, noise, seed=79)
+    return lambda t: mean + amp * math.sin(2 * math.pi * t / period) + n(t)
+
+
+def step(before, after, at):
+    return lambda t: before if t < at else after
+
+
+def ramp(before, after, at, secs):
+    return lambda t: before + (after - before) * min(max(t - at, 0.0) / secs, 1.0)
+
+
+class _Plant:
+    """One battery that reaches its command RESPONSE_S after the write."""
+
+    def __init__(self, load, rating, soc, batt_gap=()):
+        self.load, self.rating, self.soc = load, rating, soc
+        self.batt_gap = batt_gap      # (from, to): the battery reading is lost
+        self.t = 0.0
+        self.hist = [(-1e9, 0.0)]     # (time the command takes effect, W)
+        self.notes = []
+        self.meter = 0.0              # the last meter reading delivered
+
+    def batt(self, at):
+        w = 0.0
+        for when, v in self.hist:
+            if when <= at:
+                w = v
+        return max(-self.rating, min(self.rating, float(round(w))))
+
+    def grid(self, at):
+        return self.load(at) - self.batt(at)
+
+    async def limits(self, e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def call(self, domain, service, data):
+        if service == "create":
+            self.notes.append((self.t, data.get("notification_id")))
+        return True
+
+    async def number(self, e, invert=False):
+        if e in ("sensor.grid", "sensor.net"):
+            return self.meter
+        if e.startswith("sensor.soc"):
+            return self.soc
+        if e.startswith("sensor.batt"):
+            if self.batt_gap and self.batt_gap[0] <= self.t < self.batt_gap[1]:
+                return None
+            return self.batt(self.t)
+        return None
+
+    async def set_number(self, e, v):
+        self.hist.append((self.t + RESPONSE_S, float(v)))
+        return True
+
+
+def run(load, *, margin=50, dur=2700.0, rating=2000.0, cap=3500.0,
+        late_at=(), soc=60.0, batt_gap=()):
+    """Alarm times (s from the start of the first quarter), a digest of every
+    cycle's target and written command, the Controller, the rows, and the
+    times of the ERROR log line. A sample is also late at each `t % 900` in
+    `late_at`."""
+    opts = rig._options(1, {
+        "meter_source": "ha_signed", "p1_net_entity": "sensor.net",
+        "meter_phases": 1, "peak_cap_w": cap, "peak_margin_w": margin,
+        "battery_modes_enabled": True, "max_w": rating})
+    store = rig._Store()
+    store.data[unit_key("inverter-a", packmode.USE_KEY)] = False
+    store.data[packmode.USE_KEY] = False
+    db = os.path.join(tempfile.mkdtemp(prefix="s81-"), "tariff.db")
+
+    async def go():
+        plant = _Plant(load, rating, soc, batt_gap)
+        c = Controller(opts, plant, store, rig._Pub(), stop=asyncio.Event(),
+                       peak_db_path=db)
+        for i in c.inverters:
+            i.dev_min, i.dev_max = -5000.0, 5000.0
+        c.auto = True
+        real_dt, clock = m.datetime, [0.0]
+
+        class _DT(real_dt):
+            @classmethod
+            def now(cls, tz=None):
+                return rig.BASE + timedelta(seconds=clock[0])
+        m.datetime = _DT
+        rows, late = [], random.Random(8100)
+        errors = []
+
+        class _Err(logging.Handler):
+            def emit(self, r):
+                if "battery alone cannot keep" in r.getMessage():
+                    errors.append(plant.t)
+        h = _Err()
+        logging.getLogger("goodwe").addHandler(h)
+        try:
+            t = 0.0
+            while t < dur:
+                plant.t = clock[0] = t
+                ts = t - SAMPLE_LEAD_S
+                if late.random() >= LATE_P and t % 900 not in late_at:
+                    plant.meter = plant.grid(ts)
+                    imp, exp = split_signed(plant.meter)
+                    c.p1.submit(make_sample(
+                        "ha_signed", imp, exp, phases=1,
+                        ingest_ts=rig.BASE + timedelta(seconds=ts),
+                        ingest_mono=time.monotonic()))
+                await c.read_inputs(now_mono=t)
+                await c.cycle()
+                rows.append((t, c.target, round(plant.hist[-1][1], 6)))
+                t += TICK
+        finally:
+            m.datetime = real_dt
+            logging.getLogger("goodwe").removeHandler(h)
+        return plant, c, rows, errors
+    plant, c, rows, errors = asyncio.run(go())
+    alarms = [t for t, nid in plant.notes if nid == ALARM]
+    return (alarms, hashlib.sha256(repr(rows).encode()).hexdigest(), c, rows,
+            errors)
+
+
+# Three quarters each (2700 s); a new quarter starts at 900 s and 1800 s.
+SCENARIOS = {
+    # F1: constant and sine loads the battery carries, across quarter edges.
+    "const4500": dict(load=constant(4500.0)),
+    "const4500_m0": dict(load=constant(4500.0), margin=0),
+    "sine4500": dict(load=sine(4500.0, 400.0)),
+    # F1 at the start of a quarter: the sample after the battery's return
+    # is late, so the held reading is the 1 s spike (the battery at 0 W).
+    "edge4600": dict(load=constant(4600.0), late_at=(2.0,)),
+    "edge4600_m0": dict(load=constant(4600.0), margin=0, late_at=(2.0,)),
+    # 6000 W in a quarter's last 20 s: over cap + battery, but the quarter
+    # still lands between the aim and the cap.
+    "burst_end": dict(load=lambda t: 6000.0 if t % 900 >= 880 else 4500.0),
+    # F2: a noisy load the battery carries, at margin 50 and 0.
+    "noise5000_m50": dict(load=noisy(5000.0, 150.0)),
+    "noise5000_m0": dict(load=noisy(5000.0, 150.0), margin=0),
+    # Real: from 1200 s the house needs 1000 W more than cap + battery.
+    "step6500": dict(load=step(4500.0, 6500.0, 1200.0)),
+    # Real, small: from 1200 s, 60 W (+/- 20 W noise) more than cap + battery.
+    "miss5560": dict(load=lambda t: step(4500.0, 5560.0, 1200.0)(t)
+                     + noisy(0.0, 20.0)(t)),
+    # Real, slow: 4500 -> 6500 W over 200 s from 1200 s, through the band
+    # between the aim (cap - 50) and the real cap.
+    "ramp6500": dict(load=ramp(4500.0, 6500.0, 1200.0, 200.0)),
+    # The pack under its peak reserve (20 %), and a load far over cap +
+    # battery: that is "Battery stopped limiting the peak", not this alarm.
+    "step7500_reserve": dict(load=step(4500.0, 7500.0, 1200.0), soc=15.0),
+    # Review: a load swinging 4500 +/- 1200 W every 30 s (a hob or heater
+    # cycling). It tops cap + battery for about 5 s a swing, and the quarter
+    # still lands under the aim.
+    "sine4500_fast": dict(load=sine(4500.0, 1200.0, period=30.0, noise=200.0)),
+    # Review: two real overloads in one quarter, 1000-1100 s and 1500-1700 s.
+    "twice7000": dict(load=lambda t: 7000.0 if (1000 <= t < 1100
+                                                or 1500 <= t < 1700)
+                      else 4500.0),
+    # Review: step6500, and the battery reading is lost 1203-1215 s.
+    "step6500_gap": dict(load=step(4500.0, 6500.0, 1200.0),
+                         batt_gap=(1203.0, 1215.0)),
+}
+
+
+if __name__ == "__main__":
+    for k, v in SCENARIOS.items():
+        a, d, _, _, _ = run(**v)
+        print(f"{k:16s} alarms at {a} digest {d}")

goodwe_controller/tools/ux13_browser_check.py

@@ -0,0 +1,233 @@
+"""UX-13 P3: the headless-browser check of the Batteries screen and Settings,
+Simple. Run by `CHECK=1 tools/ux13_screenshots.sh`, like the screenshots.
+
+For every battery-mode fixture (tools/ux13_demo.py) it opens both screens at
+phone and desktop width, light and dark, in English and Dutch, and fails on a
+page error, a console error or a sideways scroll. Then it clicks the switch
+and the mode list on both screens and checks what was posted and what the
+cards show after.
+
+    python3 ux13_browser_check.py        # DEMO_<STATE> = the fixture's URL
+"""
+
+import json
+import os
+import sys
+
+from playwright.sync_api import sync_playwright
+
+STATES = ("running", "modes", "off", "off_peak", "refusal", "maint")
+SIZES = {"phone": {"width": 390, "height": 844},
+         "desktop": {"width": 1000, "height": 900}}
+FAILS = []
+
+
+def url(state):
+    return os.environ[f"DEMO_{state.upper()}"]
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        FAILS.append(name)
+
+
+def open_page(browser, state, route, *, size, scheme, lang):
+    ctx = browser.new_context(locale=lang, viewport=SIZES[size],
+                              color_scheme=scheme, reduced_motion="reduce")
+    page = ctx.new_page()
+    errors = []
+    page.on("pageerror", lambda e: errors.append(f"pageerror {e}"))
+    page.on("console", lambda m: errors.append(f"console {m.text}")
+            if m.type == "error" else None)
+    page.goto(url(state) + route)
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1200)
+    return ctx, page, errors
+
+
+def sweep(browser):
+    n = 0
+    for state in STATES:
+        for route in ("#batteries", "#settings"):
+            for size in SIZES:
+                for scheme in ("light", "dark"):
+                    for lang in ("en-GB", "nl-BE"):
+                        ctx, page, errors = open_page(
+                            browser, state, route, size=size, scheme=scheme,
+                            lang=lang)
+                        wide = page.evaluate(
+                            "document.documentElement.scrollWidth > "
+                            "document.documentElement.clientWidth")
+                        if route == "#batteries":
+                            cards = page.locator("#bcards .bcard").count()
+                            texts = page.locator("#bcards dd").all_inner_texts()
+                            ok = cards == 2 and all(t.strip() for t in texts)
+                        else:
+                            ok = (page.locator("#simple .card").count() >= 3
+                                  and page.locator("#groups").is_hidden())
+                        where = f"{state} {route} {size} {scheme} {lang}"
+                        if errors or wide or not ok:
+                            FAILS.append(f"{where}: errors={errors} "
+                                         f"wide={wide} drawn={ok}")
+                            print(f"  FAIL {where}: {errors} wide={wide} "
+                                  f"drawn={ok}")
+                        n += 1
+                        ctx.close()
+    check(f"{n} views: 0 page errors, 0 console errors, no sideways scroll, "
+          f"every card drawn", not [f for f in FAILS if " #" in f])
+
+
+def posts(page):
+    sent = []
+    page.on("request", lambda r: sent.append(json.loads(r.post_data))
+            if r.url.endswith("/action") and r.method == "POST" else None)
+    return sent
+
+
+def actions(browser):
+    # The Batteries screen: switch B off, then set A to Leftover solar.
+    ctx, page, errors = open_page(browser, "modes", "#batteries",
+                                  size="desktop", scheme="light", lang="en-GB")
+    sent = posts(page)
+    page.locator("#bsw-c1").click()
+    page.wait_for_timeout(1500)
+    card_b = page.locator("#bcards .bcard").nth(1)
+    check("Batteries: B's switch posts pack_use false, and B's card turns Off "
+          "with its mode list greyed out",
+          sent[-1:] == [{"action": "pack_use", "unit": "Battery B",
+                         "value": False}]
+          and "off" in (card_b.get_attribute("class") or "")
+          and page.locator("#bsel-c1").is_disabled()
+          and "You switched it off." in card_b.inner_text())
+    page.locator("#bsel-c0").focus()
+    page.locator("#bsel-c0").select_option("leftover_solar")
+    page.wait_for_timeout(1500)
+    check("...A's list posts pack_mode leftover_solar and the card keeps it",
+          sent[-1:] == [{"action": "pack_mode", "unit": "Battery A",
+                         "value": "leftover_solar"}]
+          and page.locator("#bsel-c0").input_value() == "leftover_solar"
+          and "Leftover solar" in page.locator("#bcards .bcard").nth(0)
+          .inner_text())
+    check("...the cheap-hours choice and the selling switch are greyed out",
+          page.locator("#bsel-c0 option[disabled]").count() == 1
+          and page.locator("#bcards .bcard .f .switch[disabled]").count() == 2)
+    check("...and the focus stays on the control that was used",
+          page.evaluate("document.activeElement.id") == "bsel-c0")
+    check("...with 0 page errors", not errors)
+    ctx.close()
+    # Settings, Simple: the same switch, and the Installer view is one tap.
+    ctx, page, errors = open_page(browser, "modes", "#settings",
+                                  size="phone", scheme="dark", lang="nl-BE")
+    sent = posts(page)
+    page.locator("#bsw-s1").click()
+    page.wait_for_timeout(1500)
+    check("Simple (NL, phone, dark): B's switch posts pack_use true and reads "
+          "Aan", sent[-1:] == [{"action": "pack_use", "unit": "Battery B",
+                                "value": True}]
+          and page.locator("#bsw-s1").get_attribute("aria-checked") == "true")
+    page.locator("#set-view [data-v=installer]").click()
+    page.wait_for_timeout(500)
+    check("...Installer shows the groups and hides Simple",
+          page.locator("#groups").is_visible()
+          and page.locator("#simple").is_hidden())
+    check("...with 0 page errors", not errors)
+    ctx.close()
+
+
+def switching(browser):
+    # Review: an unsaved change survives the view switch both ways, the
+    # Installer's locked values still need "Change", and only the person's
+    # own pick of a view is remembered.
+    ctx, page, errors = open_page(browser, "modes", "#settings",
+                                  size="desktop", scheme="light", lang="en-GB")
+    chips = [c.locator(".chip").first.inner_text()
+             for c in page.locator("#simple > .card").all()]
+    check(f"Simple's badges: the peak limit and shadow mode need a restart, "
+          f"the batteries apply at once ({chips})",
+          chips == ["Applies after a restart", "Applies right away",
+                    "Applies after a restart"])
+    num = page.locator("#simple .card input.num").first
+    num.fill("4.2")
+    num.dispatch_event("change")
+    page.wait_for_timeout(600)
+    n1 = page.locator("#sb-text").inner_text()
+    page.locator("#set-view [data-v=installer]").click()
+    page.wait_for_timeout(600)
+    val = page.locator("#groups [data-key=peak_cap_w] input.num").input_value()
+    n2 = page.locator("#sb-text").inner_text()
+    locked = (page.locator("#groups [data-key=peak_soc_floor] input").count(),
+              page.locator("#groups [data-key=peak_soc_floor] button.link")
+              .count())
+    page.locator("#set-view [data-v=simple]").click()
+    page.wait_for_timeout(600)
+    back = page.locator("#simple .card input.num").first.input_value()
+    n3 = page.locator("#sb-text").inner_text()
+    check("an unsaved peak limit survives Simple -> Installer -> Simple, and "
+          "the save bar counts it once", n1.startswith("1 ") and n2 == n1
+          and n3 == n1 and val == "4.2" and back == "4.2"
+          and page.locator("#savebar").is_visible())
+    check("...the Installer's locked value has no input until 'Change'",
+          locked == (0, 1))
+    ctx.close()
+    ctx, page, errors = open_page(browser, "running", "#batteries",
+                                  size="desktop", scheme="light", lang="en-GB")
+    page.locator("#batt-off a").click()
+    page.wait_for_timeout(800)
+    page.reload()
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1200)
+    check("a jump to Installer from a link is not remembered: Settings "
+          "opens on Simple again", page.locator("#simple").is_visible()
+          and page.locator("#groups").is_hidden() and not errors)
+    ctx.close()
+
+
+def modes_off(browser):
+    ctx, page, errors = open_page(browser, "running", "#batteries",
+                                  size="phone", scheme="light", lang="en-GB")
+    page.locator("#batt-off a").click()
+    page.wait_for_timeout(1500)
+    check("modes off: the card's button opens Settings on the Installer view",
+          page.url.endswith("#settings") and page.locator("#groups")
+          .is_visible() and not errors)
+    ctx.close()
+
+
+def month_peak(browser):
+    # The fixture has no month peak yet, so give /status one on the way in.
+    ctx = browser.new_context(locale="en-GB", viewport=SIZES["desktop"])
+    page = ctx.new_page()
+
+    def with_peak(route):
+        r = route.fetch()
+        body = r.json()
+        body["month_peak"]["peak_w"] = 2860.0
+        route.fulfill(response=r, json=body)
+    page.route("**/status*", with_peak)
+    page.goto(url("modes") + "#settings")
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1500)
+    check("Simple: the peak card shows this month's peak from /status",
+          "This month's peak so far: 2.9 kW." in page.locator("#simple")
+          .inner_text())
+    ctx.close()
+
+
+def main():
+    with sync_playwright() as p:
+        b = p.chromium.launch()
+        sweep(b)
+        actions(b)
+        month_peak(b)
+        switching(b)
+        modes_off(b)
+        b.close()
+    if FAILS:
+        print(f"{len(FAILS)} FAILED")
+        sys.exit(1)
+    print("all passed")
+
+
+if __name__ == "__main__":
+    main()

goodwe_controller/tools/ux13_demo.py

@@ -2,7 +2,9 @@
 headless browser check.  `python3 tools/ux13_demo.py STATE PORT [HOST]`
 
 STATE is running, shadow, alarm, new (P4) or setup (UX-15's setup-only
-mode, P5). The controller is the shipped `Controller`
+mode, P5). P3 adds the battery-mode states in `P3`: modes (on, B on Leftover
+solar), off (B switched off), off_peak (B off but giving for the peak limit),
+refusal (A refuses to give power) and maint (A in its monthly cycle). The controller is the shipped `Controller`
 with its readings set by hand (two batteries, solar, today's prices in the
 mockup's shape, trading on). Nothing here talks to Home Assistant or to an
 inverter: `/action` changes only this fixture. Used for the P1 render check
@@ -34,8 +36,9 @@ sys.path.insert(0, os.path.join(HERE, "tools"))
 
 from aiohttp import web as aioweb                                # noqa: E402
 
-from app import homeview, web                                    # noqa: E402
+from app import homeview, packmode, web                          # noqa: E402
 from app.main import Controller                                  # noqa: E402
+from app.maintenance import DRAIN                                # noqa: E402
 from app.setuponly import SetupOnly                              # noqa: E402
 from app.peakguard import PeakDecision                           # noqa: E402
 from app.price import PricePoint, PriceProduct, PriceRead        # noqa: E402
@@ -231,8 +234,14 @@ OPTS = {"meter_entity": "sensor.grid", "meter_source": "off",
              "max_w": 2500, "capacity_kwh": 5.4}]}
 
 
+# UX-13 P3: the battery-mode states, each with battery modes on.
+P3 = ("modes", "off", "off_peak", "refusal", "maint")
+
+
 def controller(state):
     opts = dict(OPTS, shadow_mode="on" if state == "shadow" else "off")
+    if state in P3:
+        opts["battery_modes_enabled"] = True
     c = Controller(opts, Hass(), Store(), Pub(), stop=asyncio.Event())
     c.auto = True
     now = datetime.now(timezone.utc)
@@ -255,6 +264,29 @@ def controller(state):
     c.pv_w = 3900.0
     if state == "alarm":
         c.inverters[0].sign_wd.tripped = True
+    if state in P3:
+        a, b = c.inverters
+        b.store_set(packmode.MODE_KEY, packmode.LEFTOVER_SOLAR)
+        if state in ("off", "off_peak"):
+            b.store_set(packmode.USE_KEY, False)
+            b.batt = 0.0
+        if state == "off_peak":
+            # A cloudy evening: the house takes 6 kW and the peak limit needs
+            # both batteries, so B gives 0.5 kW although it is switched off.
+            c.pv_w, c.grid = 0.0, 3490.0
+            a.batt, b.batt = 2000.0, 510.0
+            c.peak_guard = PeakDecision(engaged=True, floor_w=2500.0,
+                                        ceiling_w=3500.0, ceiling_from="cap",
+                                        projected_w=3600.0)
+        if state == "refusal":
+            # A is at its cut-out level and refuses: asked 0 W, B takes over.
+            c.pv_w, c.grid = 0.0, 5.0
+            a.soc, a.batt, a.refused = 9.0, -4.0, 1
+            b.batt = 1210.0
+        if state == "maint":
+            c.maints[0].store.set("phase", DRAIN)   # MAINT-05: A's own key
+            c.pv_w, c.grid = 0.0, 0.0
+            a.batt, b.batt = 2000.0, 0.0
     return c
 
 
@@ -290,6 +322,7 @@ async def main(state, port, host="127.0.0.1"):
                   p1_net_entity="sensor.grid", price_provider="generic_dayahead",
                   peak_forecast_entity="sensor.peak_forecast",
                   shadow_mode=c.o.get("shadow_mode", "off"),
+                  battery_modes_enabled=state in P3,
                   inverters=[dict(i, bms_soc_floor=10)
                              for i in OPTS["inverters"]])
     runner = aioweb.AppRunner(web.build_app(c, Supervisor(stored)))

goodwe_controller/tools/ux13_screenshots.py

@@ -6,8 +6,8 @@ error, so a broken screen is never pictured.
 
     python3 ux13_screenshots.py OUT_DIR    # DEMO_<STATE> = the fixture's URL
 
-The battery-mode screens (P3) are not built, so there is no shot of them:
-DOCS.md says so instead of showing a mock-up.
+P3 adds the Batteries screen and Settings, Simple (the default Settings
+view), so the Installer shots click Installer first.
 """
 
 import os
@@ -48,7 +48,12 @@ def shot(browser, name, state, route, *, lang="en-GB", size=DESKTOP,
     print(f"  {name}.png")
 
 
+def installer(page):
+    page.locator("#set-view [data-v=installer]").click()
+
+
 def open_tariff(page):
+    installer(page)
     page.locator("details.grp[data-g=tariff] > summary").click()
     page.locator("details.grp[data-g=meter] > summary").click()   # close it
     # The fixture site is on a dynamic contract: its fallback gets windows.
@@ -80,8 +85,17 @@ def main():
         shot(b, "home-shadow", "shadow", "#home")
         shot(b, "home-phone", "running", "#home", size=PHONE)
         shot(b, "home-setup-only", "setup", "#home", full=False)
-        shot(b, "settings-installer", "running", "#settings")
-        shot(b, "settings-installer-nl", "running", "#settings", lang="nl-BE")
+        shot(b, "settings-installer", "running", "#settings", act=installer)
+        shot(b, "settings-installer-nl", "running", "#settings", lang="nl-BE",
+             act=installer)
+        shot(b, "batteries", "modes", "#batteries")
+        shot(b, "batteries-nl", "modes", "#batteries", lang="nl-BE")
+        shot(b, "batteries-off-peak", "off_peak", "#batteries")
+        shot(b, "batteries-phone", "refusal", "#batteries", size=PHONE,
+             full=False)
+        shot(b, "batteries-modes-off", "running", "#batteries", full=False)
+        shot(b, "settings-simple", "modes", "#settings")
+        shot(b, "settings-simple-nl", "modes", "#settings", lang="nl-BE")
         tariff = "details.grp[data-g=tariff]"
         shot(b, "settings-time-windows", "running", "#settings",
              act=windows, only=tariff)

goodwe_controller/tools/ux13_screenshots.sh

@@ -2,6 +2,7 @@
 # UX-13 P5: regenerate the DOCS screenshots in docs/img/ux13/ from the real page.
 #
 #   sh goodwe_controller/tools/ux13_screenshots.sh [OUT_DIR]
+#   CHECK=1 sh goodwe_controller/tools/ux13_screenshots.sh   # P3 browser check
 #
 # Serves tools/ux13_demo.py's fixtures (running, shadow, new, setup) in the CI
 # test image, then runs tools/ux13_screenshots.py in the Playwright image on a
@@ -14,7 +15,9 @@ HERE=$(cd "$(dirname "$0")/.." && pwd)
 OUT=${1:-$HERE/../docs/img/ux13}
 PW=mcr.microsoft.com/playwright/python:v1.55.0-noble
 NET=ux13-shots-$$
-STATES="running shadow new setup"
+STATES="running shadow new setup modes off off_peak refusal maint"
+RUN=/t/ux13_screenshots.py
+[ "${CHECK:-}" = 1 ] && RUN=/t/ux13_browser_check.py
 mkdir -p "$OUT"
 OUT=$(cd "$OUT" && pwd)
 
@@ -39,5 +42,5 @@ docker run --rm --network "$NET" --user "$(id -u):$(id -g)" -e HOME=/tmp \
     $ENVS -v "$HERE/tools:/t:ro" -v "$OUT:/out" "$PW" \
     sh -euc 'pip install -q --disable-pip-version-check --target /tmp/pw \
                  playwright==1.55.0
-             PYTHONPATH=/tmp/pw python3 /t/ux13_screenshots.py /out'
+             PYTHONPATH=/tmp/pw python3 '"$RUN"' /out'
 echo "screenshots in $OUT"

goodwe_controller/translations/en.yaml

@@ -145,6 +145,9 @@ configuration:
   peak_cap_w:
     name: "Limits · Peak limit (W)"
     description: "Your own number: the 15-minute average power the add-on keeps the grid under. Take it from your grid contract."
+  peak_margin_w:
+    name: "Limits · Margin below the peak limit (W)"
+    description: "The add-on aims this much below the peak limit, so a 15-minute period that ends a little high still stays under it."
   peak_forecast_entity:
     name: "Limits · 15-minute demand forecast entity (W)"
     description: "Optional. A forecast of this 15-minute period's average power. Leave it empty and there is no peak limit."

goodwe_controller/translations/nl.yaml

@@ -126,6 +126,9 @@ configuration:
   peak_cap_w:
     name: "Grenzen · Piekgrens (W)"
     description: "Uw eigen getal: het gemiddelde vermogen per kwartier waaronder de add-on de afname houdt. Neem het over uit uw netcontract."
+  peak_margin_w:
+    name: "Grenzen · Marge onder de piekgrens (W)"
+    description: "De add-on mikt zoveel onder de piekgrens, zodat een kwartier dat iets hoger uitvalt er toch onder blijft."
   peak_forecast_entity:
     name: "Grenzen · Entiteit kwartierprognose (W)"
     description: "Optioneel. Een prognose van het gemiddelde vermogen in het lopende kwartier. Laat u dit leeg, dan is er geen piekgrens."