diff --git a/.gitea/infra-pin b/.gitea/infra-pin
new file mode 100644
index 0000000..2434e5a
--- /dev/null
+++ b/.gitea/infra-pin
@@ -0,0 +1,2 @@
+# The admin/goodwe commit CI tests against. Bump: set to the full SHA of admin/goodwe release/1.0 HEAD (README.md, "CI and the infra pin").
+d637d0b1b13f1b863dc47e445e2ca4cf4a82fe10
diff --git a/.gitea/workflows/checks.yml b/.gitea/workflows/checks.yml
index 44709c0..4cffd72 100644
--- a/.gitea/workflows/checks.yml
+++ b/.gitea/workflows/checks.yml
@@ -286,8 +286,9 @@ jobs:
         run: |
           set -eu
           rm -rf "$WS" && mkdir -p "$WS/goodwe-addon" && cd "$WS/goodwe-addon"
-          git init -q .
-          git remote add origin "$(echo "$URL" | sed "s#://#://x-access-token:${TOKEN}@#")"
+          git init -q . && git remote add origin "$URL"
+          # Token as an env-set header: not in argv or .git/config (TOOL-9).
+          export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $TOKEN"
           if [ -n "$PRNUM" ]; then
             # Two fetches, not one, so that a failure to reach either ref fails
             # HERE with the ref in the message, rather than inside the merge
@@ -488,6 +489,31 @@ jobs:
           fi
           echo "OK: the \`on:\` block of the merged checks.yml carries no event filter."
 
+      # CI-12: the infra repo at the ONE pinned commit in .gitea/infra-pin (read
+      # from the merged tree), as the sibling test_freeze.py looks for. Any
+      # failure here fails the job; the tests step below refuses the stub.
+      - name: check out admin/goodwe at the pin in .gitea/infra-pin
+        env:
+          URL: ${{ github.server_url }}/admin/goodwe.git
+          # Read access to admin/goodwe only; this job's own token cannot see it.
+          TOKEN: ${{ secrets.INFRA_READ_TOKEN }}
+        run: |
+          set -eu
+          # `|| true`: under pipefail a missing or comment-only pin would skip the FAIL line (TOOL-9).
+          PIN=$(grep -v '^#' "$WS/goodwe-addon/.gitea/infra-pin" | tr -d '[:space:]') || true
+          echo "$PIN" | grep -Eq '^[0-9a-f]{40}$' || { echo "FAIL: .gitea/infra-pin holds '$PIN', not a full 40-hex SHA."; exit 1; }
+          test -n "$TOKEN" || { echo "FAIL: secret INFRA_READ_TOKEN is not available to this run (a fork PR?)."; exit 1; }
+          rm -rf "$WS/goodwe" && mkdir -p "$WS/goodwe" && cd "$WS/goodwe"
+          git init -q .
+          # The token goes in a header via env: not in argv, and not in .git/config,
+          # which is mounted into the tests' container and outlives a failed job.
+          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $TOKEN" \
+            git fetch -q "$URL" "$PIN" || { echo "FAIL: could not fetch admin/goodwe at $PIN."; exit 1; }
+          git -c advice.detachedHead=false checkout -qf FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$PIN"
+          test -f sim/hwsim.py || { echo "FAIL: admin/goodwe@$PIN has no sim/hwsim.py."; exit 1; }
+          echo "infra: admin/goodwe @ $(git log --oneline -1)"
+
       - name: build the test image (shipped deps, from apk - see .gitea/ci/Dockerfile)
         run: |
           set -eu
@@ -508,16 +534,9 @@ jobs:
       # shorter timeout - a 60 s limit was tried during CI-01 and reported
       # exactly the false hang the docstring predicts.
       #
-      # ⚠️ WHAT THIS RUN DOES NOT COVER, stated because a pass here would
-      # otherwise over-claim. test_freeze.py's third section wants the infra
-      # repo's `sim/hwsim.py` to drive a real HTTP meter through the real
-      # transport. admin/goodwe is PRIVATE (checked via the API) and this
-      # workflow's GITHUB_TOKEN is minted for THIS repository only, so hwsim is
-      # absent here and `find_hwsim()` returns None. The rest of the file runs
-      # and passes. It does so SILENTLY - the file prints nothing to say the
-      # hwsim section was skipped - so "test_freeze.py: PASS" below is a weaker
-      # claim than it looks. That belongs to whoever owns test_freeze.py next;
-      # naming it here is the least this gate can do about it.
+      # test_freeze.py part 3 runs against the real `sim/hwsim.py` from the
+      # checkout above; GOODWE_REQUIRE_HWSIM=1 makes it fail rather than use its
+      # stub (CI-12). Lines a test prints with a `CI: ` prefix are echoed on PASS.
       # ⚠️ PYTHONDONTWRITEBYTECODE=1 IS BELT AND BRACES, NOT A FIX FOR A LIVE
       # HOLE. TEST-15 measured this runner's actual exposure and found none: the
       # checkout below is bind mounted `:ro`, so the interpreter physically
@@ -533,7 +552,7 @@ jobs:
       - name: the add-on's own tests
         run: |
           set -eu
-          docker run --rm -e PYTHONDONTWRITEBYTECODE=1 -v "$WS:/w:ro" goodwe-addon-checks:1 sh -eu -c '
+          docker run --rm -e PYTHONDONTWRITEBYTECODE=1 -e GOODWE_REQUIRE_HWSIM=1 -v "$WS:/w:ro" goodwe-addon-checks:1 sh -eu -c '
             cd /w/goodwe-addon/goodwe_controller
             set -- test_*.py
             if [ "$1" = "test_*.py" ]; then
@@ -546,6 +565,7 @@ jobs:
               start=$(date +%s)
               if python3 "$f" > /tmp/out 2>&1; then
                 echo "PASS  $f  ($(( $(date +%s) - start ))s)"
+                grep "^CI: " /tmp/out || true
               else
                 echo "FAIL  $f  ($(( $(date +%s) - start ))s)"
                 tail -40 /tmp/out
diff --git a/.gitea/workflows/infra-pin.yml b/.gitea/workflows/infra-pin.yml
new file mode 100644
index 0000000..e39cd02
--- /dev/null
+++ b/.gitea/workflows/infra-pin.yml
@@ -0,0 +1,46 @@
+# CI-12: goes red when admin/goodwe release/1.0 has moved past .gitea/infra-pin.
+# It runs on add-on activity only; admin/goodwe's own `addon-pin` workflow
+# covers a move of release/1.0 there. Deliberately NOT a required check: it
+# reports; `checks / unit` stays the only gate. How to bump: README.md,
+# "CI and the infra pin".
+name: infra-pin
+
+on:
+  pull_request:
+  push:
+    branches: [release/1.0]
+
+jobs:
+  fresh:
+    runs-on: [self-hosted, goodwe-rig]
+    timeout-minutes: 30   # seconds of work; the rest is queueing for the shared slot
+    steps:
+      - name: compare .gitea/infra-pin with admin/goodwe release/1.0
+        env:
+          SELF: ${{ github.server_url }}/${{ github.repository }}.git
+          INFRA: ${{ github.server_url }}/admin/goodwe.git
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INFRA_TOKEN: ${{ secrets.INFRA_READ_TOKEN }}   # admin/goodwe is private
+        run: |
+          set -eu
+          D=$(mktemp -d) && trap 'cd / && rm -rf "$D"' EXIT && cd "$D"
+          git init -q .
+          # The pin of the commit this event is about (the PR head, or the push).
+          # Token as an env-set header: not in argv or .git/config (TOOL-9).
+          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $TOKEN" \
+            git fetch -q --depth 1 "$SELF" "$GITHUB_SHA" || { echo "FAIL: could not fetch $GITHUB_SHA here."; exit 1; }
+          # `|| true`: under the runner's pipefail a missing or comment-only pin
+          # would stop here on git's error instead of the FAIL line below (TOOL-9).
+          PIN=$(git show FETCH_HEAD:.gitea/infra-pin | grep -v '^#' | tr -d '[:space:]') || true
+          test -n "$PIN" || { echo "FAIL: .gitea/infra-pin is missing at $GITHUB_SHA, or holds only comments."; exit 1; }
+          test -n "$INFRA_TOKEN" || { echo "FAIL: secret INFRA_READ_TOKEN is not available to this run (a fork PR?)."; exit 1; }
+          # Header via env, as in checks.yml: the token stays out of argv.
+          HEAD=$(GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $INFRA_TOKEN" \
+            git ls-remote "$INFRA" refs/heads/release/1.0 | cut -f1) || true
+          test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe release/1.0."; exit 1; }
+          if [ "$PIN" != "$HEAD" ]; then
+            echo "STALE: .gitea/infra-pin is $PIN but admin/goodwe release/1.0 is $HEAD."
+            echo "       Test against $HEAD and bump the pin (README.md, \"CI and the infra pin\")."
+            exit 1
+          fi
+          echo "OK: .gitea/infra-pin $PIN is admin/goodwe release/1.0 HEAD."
diff --git a/FIELD-GUIDE.md b/FIELD-GUIDE.md
index 2f0f486..1d71b4b 100644
--- a/FIELD-GUIDE.md
+++ b/FIELD-GUIDE.md
@@ -4,6 +4,10 @@ The guide technicians carry is the PDF:
 
 **`docs/GoodWe-RS485-Field-Guide.pdf`** — 10 pages, A4, print it double-sided.
 
+⚠️ **Outdated: it is v0.1.0.** Its `slew_w` row is corrected in `build_guide.py`
+and `field-guide.html`, but the PDF has not been rebuilt (see below). Where the
+guide disagrees with `goodwe_controller/DOCS.md`, DOCS.md wins.
+
 It covers, in the order the work is done: pre-visit checks, hardware, firmware,
 add-on install and configuration, how to read the Web UI, the six commissioning
 gates, the e-stop (and the statement a site without one must sign), proving a
@@ -18,7 +22,8 @@ copy cannot drift from the PDF someone is holding in a cellar.
 python3 docs/build_guide.py     # regenerates field-guide.html and the PDF
 ```
 
-Requires Chrome or Chromium (used headless for print-to-PDF). Screenshots live
+Requires Chrome or Chromium (used headless for print-to-PDF); `CHROME` in the
+script is a Windows path, so edit it on any other machine. Screenshots live
 in `docs/img/` and are base64-embedded, so `field-guide.html` is standalone.
 
 ⚠️ **Every section must stay under the A4 printable height** (1039 px at 96 dpi
diff --git a/README.md b/README.md
index cd500c7..53438fc 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ goodwe_controller/         the add-on
                            returns, run against its own release image
 firmware/goodwe-master.yaml  ESPHome config for the T-CAN485
 estop/rs485_log.py           optional RS485 e-stop / bus witness
-docs/GoodWe-RS485-Field-Guide.pdf  the guide techs carry (10pp, A4)
+docs/GoodWe-RS485-Field-Guide.pdf  the guide techs carry (10pp, A4; outdated)
 docs/build_guide.py          its single source - rebuilds the HTML and PDF
 FIELD-GUIDE.md             how to edit and rebuild the guide
 docs/RELEASE.md            how a change reaches the battery - `master` is
@@ -50,6 +50,9 @@ https://gittea.kammenstraatha.duckdns.org/admin/goodwe-addon
 
 then install **GoodWe RS485 Controller**.
 
+Then turn on **Watchdog** on the add-on's Info tab — see
+[Before you start](goodwe_controller/DOCS.md#before-you-start).
+
 ⚠️ **The repository must be PUBLIC for this to work.** Home Assistant clones it
 anonymously; against a private repo the store shows nothing and gives no useful
 error. If it must stay private, install locally instead: copy
@@ -79,8 +82,8 @@ machine itself dying:
 2. **Wind-down before firmware updates** — 0 W written before the update starts.
 3. **RS485 e-stop (optional)** — writes 0 W after 30 s of total bus silence.
 
-Sites sold without the e-stop must have the acknowledgement in `FIELD-GUIDE.md`
-§10 signed.
+Sites sold without the e-stop must have the client acknowledgement in the field
+guide (Step 7b) signed.
 
 ## Development
 
@@ -102,6 +105,12 @@ has the mechanism, the measurement, and what the flags do not do. They are not u
 each assertion corresponds to a rule whose absence produced an observed failure
 on real hardware, and the comments in `control.py` say which.
 
+### CI and the infra pin
+
+CI (`.gitea/workflows/checks.yml`) runs every `test_*.py`, with `admin/goodwe` checked out next to this repo at the commit in `.gitea/infra-pin`, so `test_freeze.py` grades against the real `sim/hwsim.py`. If that checkout fails, the job fails. The local stub is used only in local runs, and it prints `STUB USED` when it is.
+The pin tracks `admin/goodwe` **release/1.0**, not master. Two non-required checks go red when release/1.0 has moved past the pin: `infra-pin / fresh` here, on any add-on PR or push to release/1.0, and `addon-pin / fresh` in `admin/goodwe`, on every push to its release/1.0. Nothing re-runs `addon-pin` after a bump, so it stays red on that admin/goodwe commit; `infra-pin / fresh` green on the bump is the all-clear.
+**Bump the pin** whenever either is red. Set `.gitea/infra-pin` to the new release/1.0 SHA (`git ls-remote <gitea>/admin/goodwe.git refs/heads/release/1.0`) in a PR, and let `checks / unit` grade the tests against it. CI reads `admin/goodwe` with the Actions secret `INFRA_READ_TOKEN`.
+
 ## Compatibility
 
 **Check the serial number, not the model name.** Characters 6-8 of the serial are
diff --git a/STYLE.md b/STYLE.md
new file mode 100644
index 0000000..d86db9a
--- /dev/null
+++ b/STYLE.md
@@ -0,0 +1,64 @@
+# STYLE.md - how user-facing text is written (UX-08)
+
+This applies to everything a home owner or installer reads: notifications, phone pushes, the add-on page, refusals, add-on log lines at WARNING and above, and the names and descriptions of options. It is enforced by `goodwe_controller/test_messages.py`. Its allowlist is empty since phase 2d and its cap is 0: a new string that breaks the rule fails the test.
+
+## 1. Shape
+- **Title**: at most 5 everyday words. It says what is wrong ("Meter reading may be stuck"). No "GoodWe:" prefix, no full stop.
+- **Body**: **one sentence** of at most 25 words, saying what happened and what to do. A **red alarm** may use up to **3 sentences** (70 words, each sentence at most 30 words), so that no action a person must take is lost.
+- **Details**: the last line links to the add-on documentation and names the section with the rest: `Details: add-on documentation, section "<title>" under Notifications.` Background, figures, reason codes and history go there or into the log, never into the body.
+- **Status row**: one sentence of at most 15 words. A **red** row may use up to 3 sentences (30 words), like a red alarm. It shows the live numbers the reader acts on and never an HA entity id. **Banner**: at most 12 words. **Refusal**: at most 30 words, naming the setting by its label and then its key, as `messages.setting()` writes it: “Inverter rating” (max_w), or “Inverter rating” for inverter-b (inverters.max_w) for one inverter in the list. **Option name**: at most 6 words, not counting the group prefix. **Option description**: at most 30 words. Where a value comes from belongs in DOCS.md.
+- **Plan line** (UX-13 Home screen: the plan, tooltips, a battery's "now" line): at most 2 sentences, each at most 12 words. Words in `app/ui_text/<lang>.json` under `home_words`, built by `app/homeview.py`, checked by `test_messages.py` part 8. The page's own words, English and Dutch, are checked by `test_ui_text.py`.
+- **Log line** (WARNING/ERROR): one line of at most 25 words **as logged**, with any built text filled in. Log lines stay in English and are not translated. A line that reports a safety reason gives one plain sentence and the reason's code (`STALE_READING`, `OUTPUT_CLAMP`), the evidence an installer searches for. The reason itself, with its figures and limits, goes on a DEBUG line right after it and into the action log, never onto the WARNING/ERROR line. It keeps the shape of a red alarm: at most 3 sentences of at most 30 words. The line as logged has no semicolon, banned word, capitals, "1 times" or "(s)". `test_messages.py` part 6 builds every such text with the real code and checks it, and lists the few non-safety families still over 25 words. A line that repeats every cycle is DEBUG. INFO lines carry no section numbers, ISO timestamps or capitals.
+- **Refusal length is counted as shown**: a setting placeholder counts as its label and key, and the long cases are driven through the validator (`test_messages.py` part 3).
+- **Event line** under the buttons: the plain words of `messages.hint()`, like a green row. The add-on's own action log stays technical and is not shown on the page. Installers read it as `events` in the `status` JSON.
+- **Sentences**: one idea each, active voice, present tense, with nothing nested in brackets and no semicolons (a semicolon is a second sentence in disguise). These translate well into Dutch and French.
+
+## 2. Numbers
+Use a number only if it helps the reader act, for example the peak limit, or what was asked and what was sent in a fault report. Write it the way `app/messages.py` does: `5 000 W`, `20 %`, `10 minutes`, `14:05`.
+
+## 3. Severity
+Severity is shown by the title and the colour, never by CAPITALS or by words like "BUG SIGNAL".
+
+| Level | Colour | When |
+|---|---|---|
+| alarm | red | Control stopped, money or energy lost now, a fault, or a person must act now. Up to 3 sentences. |
+| warning | orange | Control is still running, but something needs a look. 1 sentence. |
+| info | grey | No action needed. 1 sentence. |
+| resolved | green | An earlier alarm or warning has cleared. 1 sentence. |
+
+A rewrite never changes an alarm's severity, `notification_id` or cadence.
+
+## 4. Words - the same word for the same thing everywhere
+A setting is named by its label in `translations/en.yaml`, in quotes when it sits mid-sentence (“Inverter rating”). The words below match those labels. If a label changes, change it here and in `app/messages.py` in the same change.
+
+| Say | Not |
+|---|---|
+| the add-on (who decides), control (what it does: "start control", "Control: last ran …") | controller, loop, planner |
+| battery | pack, BMS pack |
+| inverter, or its name | unit, device, actuator |
+| meter | P1 feed, telegram |
+| peak limit / this month's peak | ceiling, capaciteitstarief, billed quarter |
+| 15-minute period | quarter |
+| battery level (setting: “Battery level entity”) | SoC, state of charge, charge level |
+| battery cut-out level, or cut-out level next to "battery" (setting: “Battery cut-out level”) | BMS floor, `bms_soc_floor` |
+| peak reserve (setting: “Peak reserve”) | `peak_soc_floor`, EMS floor, "peak guard will not discharge below" |
+| “Inverter rating” (the setting) | `max_w`, rail, inverter rating as a fact about the hardware |
+| solar production, solar entity (settings: “Solar production entity”, “Solar production entities, per inverter”, “Reversed-sign solar entities”) | PV, reversed-sign list, single sensor setting |
+| “Where the meter reading comes from” | meter source |
+| “Grid power entity”; entity for any Home Assistant sensor a setting points at | grid power sensor, sensor setting |
+| draw the battery down, give power | discharge, discharging |
+| control is stopped / every inverter is set to 0 W | failsafe, trip, latch, parked |
+| safety stop (a stop that only starting control clears) | failsafe latch |
+| software fault | BUG SIGNAL |
+| control board | master, ESP32 |
+| power request, what the add-on asks | command, setpoint (on the page) |
+| the power went the wrong way | sign disagreement, command and meter point opposite ways |
+| check for inverters working against each other | circulating power check |
+| month peak, 15-minute periods measured | billed quarter, banked, soft limit, open block |
+| shadow mode | a mode that makes every decision but commands 0 W. The name is kept. In shadow mode a text says what the add-on **would** send, never that it sent it. |
+
+**Banned in titles and bodies** (the test fails on them): SAFETY-/TARIFF-/TEL-/CFG-/FW-/HW-nn and other card ids, integrator, anti-windup, windup, clamp, clamped, saturated, BUG SIGNAL, latch, latched, arbiter, allocator, register, `0x…`, layer 1/2/3, heartbeat, watchdog, telegram, ACK, CRC, OTA, Modbus, planner, `§n`, file names, IP addresses, option keys in snake_case, **HA entity ids**, and runs of 2 or more CAPITALISED words.
+
+HA entity ids are allowed only in refusals and validator messages, where the installer has to find that entity. They are never allowed in alarms or status rows.
+
+**Glossary.** DOCS.md "Words used on this page" explains, once, the words a home owner meets without context: control board, isolator, Developer Tools, shadow mode, safety stop, peak limit, peak guard, peak reserve and cut-out level. A home-owner text may use them without explaining them again. Card ids stay out of DOCS.md headings: they go on a *For installers* line under the heading.
diff --git a/docs/build_guide.py b/docs/build_guide.py
index 82f80a8..f006f71 100644
--- a/docs/build_guide.py
+++ b/docs/build_guide.py
@@ -95,7 +95,7 @@ figcaption { font-size:9pt; color:#5b6169; margin-top:1.2mm; }
 <div class="page" id="p1">
   <div class="hdr">
     <div><h1>GoodWe RS485 Controller</h1>
-         <div class="sub">Field installation &amp; commissioning guide — v0.1.0</div></div>
+         <div class="sub">Field installation &amp; commissioning guide — v0.1.0, <b>outdated</b>: where it disagrees with DOCS.md, DOCS.md wins</div></div>
     <small>Installer copy</small>
   </div>
 
@@ -503,7 +503,7 @@ figcaption { font-size:9pt; color:#5b6169; margin-top:1.2mm; }
   <table>
     <tr><th style="width:30mm">Setting</th><th style="width:16mm">Value</th><th>Reason</th></tr>
     <tr><td><code>gain</code></td><td>0.6</td><td>Inverter needs 3–6 s to settle (1.4 s dead time, 94 % by 3.3 s) against a ~5 s cycle. <b>At the limit — do not raise</b></td></tr>
-    <tr><td><code>slew_w</code></td><td>1000</td><td>Most of a correction in the first cycle without running far ahead of the hardware</td></tr>
+    <tr><td><code>slew_w</code></td><td>0</td><td>0 follows the rail (<code>max_w</code>&nbsp;/&nbsp;9). A faster fixed value is <b>refused at startup</b> (SAFETY-39) — see DOCS.md</td></tr>
     <tr><td><code>deadband_w</code></td><td>15</td><td>Measured residual: mean 15.4 W, max 27 W. At 10 W the command never rests</td></tr>
     <tr><td><code>saturation_w</code> / <code>cycles</code></td><td>500 / 3</td><td>Divergence = inverter at a limit → magnitude may fall, never rise. <b>The 3-cycle term is essential</b>: tested instantly it fires on every large correction</td></tr>
     <tr><td><code>step_w</code></td><td>10</td><td>Register is 1 W but response lands on a ~17.6 W ladder. Finer is meaningless</td></tr>
diff --git a/docs/field-guide.html b/docs/field-guide.html
index ddbb264..77570b2 100644
--- a/docs/field-guide.html
+++ b/docs/field-guide.html
@@ -60,7 +60,7 @@ figcaption { font-size:9pt; color:#5b6169; margin-top:1.2mm; }
 <div class="page" id="p1">
   <div class="hdr">
     <div><h1>GoodWe RS485 Controller</h1>
-         <div class="sub">Field installation &amp; commissioning guide — v0.1.0</div></div>
+         <div class="sub">Field installation &amp; commissioning guide — v0.1.0, <b>outdated</b>: where it disagrees with DOCS.md, DOCS.md wins</div></div>
     <small>Installer copy</small>
   </div>
 
@@ -468,7 +468,7 @@ figcaption { font-size:9pt; color:#5b6169; margin-top:1.2mm; }
   <table>
     <tr><th style="width:30mm">Setting</th><th style="width:16mm">Value</th><th>Reason</th></tr>
     <tr><td><code>gain</code></td><td>0.6</td><td>Inverter needs 3–6 s to settle (1.4 s dead time, 94 % by 3.3 s) against a ~5 s cycle. <b>At the limit — do not raise</b></td></tr>
-    <tr><td><code>slew_w</code></td><td>1000</td><td>Most of a correction in the first cycle without running far ahead of the hardware</td></tr>
+    <tr><td><code>slew_w</code></td><td>0</td><td>0 follows the rail (<code>max_w</code>&nbsp;/&nbsp;9). A faster fixed value is <b>refused at startup</b> (SAFETY-39) — see DOCS.md</td></tr>
     <tr><td><code>deadband_w</code></td><td>15</td><td>Measured residual: mean 15.4 W, max 27 W. At 10 W the command never rests</td></tr>
     <tr><td><code>saturation_w</code> / <code>cycles</code></td><td>500 / 3</td><td>Divergence = inverter at a limit → magnitude may fall, never rise. <b>The 3-cycle term is essential</b>: tested instantly it fires on every large correction</td></tr>
     <tr><td><code>step_w</code></td><td>10</td><td>Register is 1 W but response lands on a ~17.6 W ladder. Finer is meaningless</td></tr>
diff --git a/docs/img/ux13/README.md b/docs/img/ux13/README.md
new file mode 100644
index 0000000..9a48082
--- /dev/null
+++ b/docs/img/ux13/README.md
@@ -0,0 +1,9 @@
+# UX-13 screenshots
+
+Made from the real page by `goodwe_controller/tools/ux13_screenshots.sh`. Do not
+edit them by hand: run the script again.
+
+- `home-*.png`: Home, running, in Dutch, in shadow mode, at phone width, and in setup.
+- `settings-*.png`: Settings, Simple and Installer, and the time-window editor with an overlap.
+- `batteries*.png`: the Batteries screen with modes on, in Dutch, an Off battery helping the peak limit, a refusal at phone width, and modes off.
+- `setup-step-1*.png`: Setup, step 1.
diff --git a/docs/img/ux13/batteries-modes-off.png b/docs/img/ux13/batteries-modes-off.png
new file mode 100644
index 0000000..ca3ecdf
Binary files /dev/null and b/docs/img/ux13/batteries-modes-off.png differ
diff --git a/docs/img/ux13/batteries-nl.png b/docs/img/ux13/batteries-nl.png
new file mode 100644
index 0000000..96e3a7e
Binary files /dev/null and b/docs/img/ux13/batteries-nl.png differ
diff --git a/docs/img/ux13/batteries-off-peak.png b/docs/img/ux13/batteries-off-peak.png
new file mode 100644
index 0000000..354d392
Binary files /dev/null and b/docs/img/ux13/batteries-off-peak.png differ
diff --git a/docs/img/ux13/batteries-phone.png b/docs/img/ux13/batteries-phone.png
new file mode 100644
index 0000000..b22face
Binary files /dev/null and b/docs/img/ux13/batteries-phone.png differ
diff --git a/docs/img/ux13/batteries.png b/docs/img/ux13/batteries.png
new file mode 100644
index 0000000..6e729e4
Binary files /dev/null and b/docs/img/ux13/batteries.png differ
diff --git a/docs/img/ux13/home-phone.png b/docs/img/ux13/home-phone.png
new file mode 100644
index 0000000..0a3788f
Binary files /dev/null and b/docs/img/ux13/home-phone.png differ
diff --git a/docs/img/ux13/home-running-nl.png b/docs/img/ux13/home-running-nl.png
new file mode 100644
index 0000000..21f5a47
Binary files /dev/null and b/docs/img/ux13/home-running-nl.png differ
diff --git a/docs/img/ux13/home-running.png b/docs/img/ux13/home-running.png
new file mode 100644
index 0000000..51d972d
Binary files /dev/null and b/docs/img/ux13/home-running.png differ
diff --git a/docs/img/ux13/home-setup-only.png b/docs/img/ux13/home-setup-only.png
new file mode 100644
index 0000000..be38b56
Binary files /dev/null and b/docs/img/ux13/home-setup-only.png differ
diff --git a/docs/img/ux13/home-shadow.png b/docs/img/ux13/home-shadow.png
new file mode 100644
index 0000000..a16bfa7
Binary files /dev/null and b/docs/img/ux13/home-shadow.png differ
diff --git a/docs/img/ux13/settings-installer-nl.png b/docs/img/ux13/settings-installer-nl.png
new file mode 100644
index 0000000..b8bf978
Binary files /dev/null and b/docs/img/ux13/settings-installer-nl.png differ
diff --git a/docs/img/ux13/settings-installer.png b/docs/img/ux13/settings-installer.png
new file mode 100644
index 0000000..43de13b
Binary files /dev/null and b/docs/img/ux13/settings-installer.png differ
diff --git a/docs/img/ux13/settings-simple-nl.png b/docs/img/ux13/settings-simple-nl.png
new file mode 100644
index 0000000..94e986d
Binary files /dev/null and b/docs/img/ux13/settings-simple-nl.png differ
diff --git a/docs/img/ux13/settings-simple.png b/docs/img/ux13/settings-simple.png
new file mode 100644
index 0000000..3be66f4
Binary files /dev/null and b/docs/img/ux13/settings-simple.png differ
diff --git a/docs/img/ux13/settings-time-windows-overlap.png b/docs/img/ux13/settings-time-windows-overlap.png
new file mode 100644
index 0000000..9dc9ca9
Binary files /dev/null and b/docs/img/ux13/settings-time-windows-overlap.png differ
diff --git a/docs/img/ux13/settings-time-windows.png b/docs/img/ux13/settings-time-windows.png
new file mode 100644
index 0000000..1614338
Binary files /dev/null and b/docs/img/ux13/settings-time-windows.png differ
diff --git a/docs/img/ux13/setup-step-1-nl.png b/docs/img/ux13/setup-step-1-nl.png
new file mode 100644
index 0000000..4727b1b
Binary files /dev/null and b/docs/img/ux13/setup-step-1-nl.png differ
diff --git a/docs/img/ux13/setup-step-1.png b/docs/img/ux13/setup-step-1.png
new file mode 100644
index 0000000..a51f31b
Binary files /dev/null and b/docs/img/ux13/setup-step-1.png differ
diff --git a/goodwe_controller/CHANGELOG.md b/goodwe_controller/CHANGELOG.md
index 6e298b6..f496b85 100644
--- a/goodwe_controller/CHANGELOG.md
+++ b/goodwe_controller/CHANGELOG.md
@@ -1,5 +1,95 @@
 # Changelog
 
+## 0.13.0
+
+**A minor bump: new behaviour, a new add-on page (Home, Settings, Batteries,
+Setup), and six new options.** No option was removed or renamed, and no
+default of an existing option changed (77 options -> 83). The only new
+start-up checks are on the new options, so options that start 0.12.0 also
+start 0.13.0.
+
+New options, and what they do if you leave them alone:
+
+| option | default | left alone |
+|---|---|---|
+| `peak_margin_w` | `50` | the peak guard aims 50 W below your peak limit, or below a higher peak already reached this month; `0` is the old aim ([[SAFETY-79]]) |
+| `battery_modes_enabled` | `false` | no battery modes, control as before ([[OPT-11]]) |
+| `pv_forecast_entity`, `pv_forecast_tomorrow_entity` | empty | no solar forecast is used ([[OPT-11]]) |
+| `solar_trust_pct` | `70` | only used with a solar forecast ([[OPT-11]]) |
+| `pv_invert_entities` | `[]` | PV readings as before ([[TEL-14]]) |
+
+⚠️ **Turn on Watchdog** on the add-on's Info tab. It is off by default. If
+the control loop crashes, the add-on now sets the batteries to 0 W and stops.
+Home Assistant only starts it again when Watchdog is on ([[SAFETY-61]],
+[[DOC-5]]).
+
+⚠️ **The peak guard now starts a little earlier.** It aims 50 W below your
+peak limit, so the batteries give a bit more at peak times. Set
+`peak_margin_w: 0` for the old aim ([[SAFETY-79]]).
+
+Contents of this release, in merge order since 0.12.0 (`a45ed06`):
+
+| | |
+|---|---|
+| `fa3d237` | Docs name the right P1 age entity and a battery list that starts ([[DOC-1]]) |
+| `6e65272` | If the control loop crashes, the batteries go to 0 W and the add-on stops ([[SAFETY-61]]) |
+| `3e38baf` | The check tools refuse a file they cannot read, instead of saying all clear (tools only) ([[SAFETY-60]], [[SAFETY-62]]) |
+| `43b2740` | A missing value in a check is a named failure (tests only) ([[TEST-26]]) |
+| `20260e8` | Docs: turn on Watchdog ([[DOC-5]]) |
+| `16c796f` | New option `pv_invert_entities`: flip the sign of a PV sensor that reads backwards ([[TEL-14]]) |
+| `6a8a5ff` | CI tests against the real inverter simulator (CI only) ([[CI-12]]) |
+| `82f032e` | CI pin checks report failures properly (CI only) ([[TOOL-9]]) |
+| `fe13251` | CI pin update (CI only) |
+| `397dd15` | Alarm notifications that are still active come back after a Home Assistant restart ([[SAFETY-34]]) |
+| `59415ea` | CI pin update (CI only) |
+| `2503de1` | "Battery is not keeping up" is a warning with its own notification, not a "bug" alarm; its figures are correct ([[SAFETY-40]]) |
+| `48ef06a` | Shorter, plainer notifications ([[UX-08]]) |
+| `5c151a3` | CI pin update (CI only) |
+| `d57767f` | Shorter, plainer status rows and banners ([[UX-08]]) |
+| `e1d0970` | Details link works on current Home Assistant; plainer words ([[UX-09]]) |
+| `a02cd4b` | Shorter refusals, errors and option texts ([[UX-08]]) |
+| `32b9e56` | Plainer log lines and docs ([[UX-08]]) |
+| `125b070` | CI pin update (CI only) |
+| `2b14b88` | Last plain-language fixes in logs and the status page ([[UX-10]]) |
+| `c4032eb` | CI pin update (CI only) |
+| `d1f7e33` | Safety log lines: one plain sentence and a code ([[UX-11]]) |
+| `652097a` | A battery that refuses power (e.g. empty) is asked for 0 W, and tried at 200 W for 34 s every 15 min ([[SAFETY-52]]) |
+| `afd6af0` | Groundwork for the new settings pages ([[UX-13]]) |
+| `a36dca6` | New page with a Home screen ([[UX-13]]) |
+| `28a49cc` | With two or more inverters, a battery that refuses power is held on its own; the others take over ([[SAFETY-73]]) |
+| `515c11b` | New Installer settings view ([[UX-13]]) |
+| `4de9675` | New setup wizard for installers ([[UX-13]]) |
+| `8c34647` | A new install with no inverter opens the setup wizard instead of stopping ([[UX-15]]) |
+| `a5dddad` | Dutch text and a time-period editor ([[UX-13]]) |
+| `ed739d4` | Battery modes (off by default): per-battery limits, on/off, solar order ([[OPT-11]]) |
+| `7995e4d` | Simple settings view and a Batteries screen ([[UX-13]]) |
+| `7337b79` | Battery modes in Home Assistant, when modes are on ([[OPT-11]]) |
+| `7a00f12` | New option `peak_margin_w`: the peak guard keeps a margin below the limit ([[SAFETY-79]]) |
+| `5a4cdc2` | Battery modes: charge in cheap hours, hold for expensive hours; selling is off for now ([[OPT-11]]) |
+| `4f25b24` | No false "Load too high" alarms at quarter edges or with a noisy load (10 s hold) ([[SAFETY-81]]) |
+| `35cdffe` | Maintenance drain with two batteries no longer stalls ([[SAFETY-78]]) |
+| `1145a93` | Battery modes: a solar forecast decides how much to buy from the grid ([[OPT-11]]) |
+| `9d5b7d1` | With one battery, the peak guard wins over the maintenance drain ([[SAFETY-83]]) |
+| `4ad8298` | Maintenance charge with two batteries no longer stalls; it gives way to the peak guard ([[SAFETY-84]]) |
+| `b8ddfd7` | The peak guard wins over the maintenance hold; the hold ends on time, with no top-up ([[SAFETY-86]]) |
+| `9358781` | With two or more batteries, the peak guard uses every battery that can still give; peak alarms no longer say control stopped ([[SAFETY-87]]) |
+| `61072ca` | No false "Battery is not keeping up" during maintenance; real shortfalls still warn; the status row counts each episode once ([[SAFETY-85]]) |
+
+### Known issues
+
+- A false "Battery is not keeping up" can still show when the peak guard pauses a maintenance charge ([[SAFETY-92]]).
+- Two inverters: at the end of a maintenance charge one battery can charge from the grid while the house uses a lot. Do not add a second inverter before the next release ([[SAFETY-93]]).
+- A healthy battery that turns from charging to giving can be held at 0 W for up to 15 min ([[SAFETY-94]]).
+- After a gap in the P1 meter, the peak guard is blind for the rest of that quarter hour ([[SAFETY-90]]).
+- Two batteries: one at its peak reserve can be used before a draining battery has used its room ([[SAFETY-91]]).
+
+### If you are crossing from a version older than 0.10.0
+
+`## 0.10.0` below can refuse an old config: `slew_w` above its limit, and the
+withdrawn `price_provider` ids `engie_dynamic`, `totalenergies_dynamic` and
+`eneco_eddy`. Read it before you update. Run `tools/predeploy_check.py` with the
+bare options (`jq '.data.options'`) first.
+
 ## 0.12.0
 
 **A MINOR BUMP FOR ONE NEW OPTION: `pv_entities` ([[TEL-12]]), for sites with
diff --git a/goodwe_controller/DECISIONS/MAINT-05-per-pack-maintenance.md b/goodwe_controller/DECISIONS/MAINT-05-per-pack-maintenance.md
index 546af20..305db50 100644
--- a/goodwe_controller/DECISIONS/MAINT-05-per-pack-maintenance.md
+++ b/goodwe_controller/DECISIONS/MAINT-05-per-pack-maintenance.md
@@ -285,32 +285,11 @@ cross-inverter `lo > hi` contradiction at `arbiter.py:114`. The only line this
 card changed there is **which** roster entry the claim is filed on: the one whose
 state machine produced the result, rather than `inverters[0]`.
 
-## 6. FOUND AND NOT FIXED: the site loop still contradicts a drain at N>=2
+## 6. FIXED BY SAFETY-78: the site loop contradicted a drain at N>=2
 
-Measured while wiring this card, and **pre-existing on `release/1.0` at
-`2d025ee`** — the same drain filed on `inverters[0]` produces the identical
-refusal with the two unit names swapped.
-
-The maintenance SET **pins** its pack. The loop's target is a **site** claim.
-When the site target is *below* the pin — a 2000 W drain while the house imports
-less than that, which is most of a night — the only split that sums to the site
-target asks the sibling to **charge** while the maintained pack **discharges**,
-and `allocator.plan()` refuses it by name as circulating power. The refusal is
-correct and fails safe: the whole site goes to 0 W with an `ARBITER: REFUSED`
-line in the action log.
-
-**The consequence an operator would see is a misdiagnosis.** The pack is held at
-0 W while its state machine believes it is draining, so after 12 h the DRAIN
-timeout fires and reports *"drain stuck"* — §12's words for a battery that is not
-following commands. The battery is fine; the site refused to allocate.
-
-**Why it is not fixed here.** The fix is to change what the site loop's target
-*means* while a unit is pinned — regulate the meter using only the unpinned
-packs — which is loop and allocator territory and changes the integrator's
-subject. MAINT-05 moves which pack is pinned and nothing else about it. It is
-pinned as a running check (`test_maintenance.py` part 12) rather than left as a
-comment, so it cannot be forgotten or quietly tuned away, and it wants a card of
-its own.
+Found here and pre-existing: below the pin the other pack had to charge, the
+allocator refused it and the site sat at 0 W. Fixed by a site `drain` floor;
+see [[SAFETY-78]] (`DECISIONS/SAFETY-78-drain-at-two.md`).
 
 ## 7. FOUND AND NOT FIXED: `migrate_unit_keys()` has the same hole, and it is a LATCH
 
diff --git a/goodwe_controller/DECISIONS/OPT-11-battery-modes.md b/goodwe_controller/DECISIONS/OPT-11-battery-modes.md
new file mode 100644
index 0000000..93897d6
--- /dev/null
+++ b/goodwe_controller/DECISIONS/OPT-11-battery-modes.md
@@ -0,0 +1,129 @@
+# OPT-11 - battery modes, per battery
+
+A battery's mode (on/off, Solar first, Leftover solar) is a soft unit limit at
+`P_MODE` = 35 that always holds 0 W. A SET above 35 (a safety stop) overrides
+it; a limit above 35 (the peak guard) makes it give way only as far as that
+limit needs, and a battery its mode holds back then carries only what the
+others cannot (`arbiter._unit_modes()`, `_site_mode()`). Design and owner answers: `goodwe-session/OPT-11-design.md` (2026-09-27);
+P1 is its section 6 P1, and the pull request lists what was measured.
+
+- Off by default (`battery_modes_enabled`); off, commands are byte-identical to
+  a5dddad (`test_modes.py` part 1).
+- Off is a mode range, so the peak guard can still use an Off battery when the
+  others cannot cover the floor (design sections 2-3). Whether Off should be
+  absolute is an open owner question.
+- Review (PR #149): releasing only when the peak floor bound S let a trade won
+  above the floor keep the modes and place less than the floor, and let a
+  capped grid charge release an Off battery. Both are graded in
+  `test_arbiter.py` part 11. The loop bound leaves a side that reaches the
+  rail to the rail, so SAFETY-03 still flags a loop winding into it.
+- P2 (HA entities): a select and a switch per battery, only while modes are
+  on; commands go through `handle_action()`, the page's path. A retained
+  command is dropped, not applied: the store already holds the last choice,
+  and a replay after a restart could otherwise undo a newer one. The config
+  topics announced are kept in the store (`mqtt_mode_configs`), so turning
+  modes off removes exactly those, and an install that never turned them on
+  publishes what ed739d4 did (`test_mqtt.py` part 10). A removed topic stays
+  in that list and its empty config is re-sent on each start, so a start with
+  no broker cannot lose it; re-sending is harmless. The HA options are the
+  page's English names, pinned by a test, and are not renamed with the page:
+  automations send them.
+- In P1 only Off closes a direction; Leftover solar differs by charging last.
+- P3 (price runs, `priceruns.py`, `modetrade.py`): each battery's range is
+  narrowed by its role this tick (hold, give, charge, rest, sell); main.py
+  files the intersection with the switch, so it still holds 0 W. With modes on
+  the site trade is filed by the modes, sized from the loop bound (so no
+  battery a mode or a refusal holds is asked for watts, P1's unmet share) and
+  the guard's headroom; `arbitrage.decide()` runs only with modes off, which
+  stays byte-identical to 7a00f12 (`test_modes_p3.py` part 1).
+- SAFETY-46 item 2 is decided as the owner answered (2026-09-25): a trade is
+  a run of consecutive firm slots. It applies with battery modes on; the
+  modes-off trade keeps its one-period shape, because that path must not move.
+- Choices that were measured, not assumed (tools/opt11p3_replay.py):
+  - a sale needs the guard to have measured the quarter, not to be clear: a
+    5 kW discharge alone reads "engaged" on export and flipped the sale every
+    5 s;
+  - a grid charge makes the others rest, so it starts only at 500 W and, once
+    the guard or the headroom stops it, stays off for that 15-minute period
+    (without: 13 flips in 4 minutes under a 3.5 kW house);
+  - stored energy is valued at the last cheap run for 12 h, and a charge
+    needs its own run to clear the spread (without: a night charge was spent
+    on flat morning prices, then charging went on at them);
+  - a run edge reseeds the loop at the house's level (a 3 kW import spike
+    removed; about 0.1 x rating still overshoots as export).
+- Replay (tools/opt11p3_replay.py, 16 recorded days, EPEX hourly prices a
+  year earlier, modelled batteries), net EUR, lower is better: P2 19.33, P3
+  Solar first + Leftover solar 19.57, with a sale 19.60, the old one-period
+  trade 18.14. Review of #153 (same model, with a per-action split):
+  - the cheapest hours were at midday on 15 of 16 days, so Leftover solar (acting
+    as Cheap hours until P4) bought 12.2 kWh there that the sun would have
+    given: 7 kWh more exported, 12 kWh less solar stored. Holding for the
+    expensive hours saved 4 kWh of import, not enough. With no grid charge on
+    Leftover solar: 19.44;
+  - the old trade charged one hour, so the afternoon sun still fit;
+  - a sale earned the wholesale price (2.27 EUR for 11.4 kWh) and the house
+    then bought the same energy back (2.29 EUR): a wash before wear. It pays
+    only when the sale hour's wholesale price beats the later import price,
+    levies included (about 0.13 EUR/kWh above that hour's wholesale here);
+  - valuing the charge left at the end, wear and real Flemish levies make
+    selling worse and do not change the order.
+- Owner decision 2026-09-29 (option A): selling is off until it can be judged
+  on the price the grid pays (`packmode.SELLING_ENABLED`, code kept), and
+  Leftover solar takes solar only until P4's forecast
+  (`packmode.GRID_CHARGE_MODES`); Cheap hours only still charges from the grid. Replayed
+  (16 days, as above): Solar first + Leftover solar 19.44 EUR net against
+  P2's 19.33; Solar first + Cheap hours only 19.57.
+- Not done in P3: the forecast (P4), and a headroom too short for the run
+  moving the rest to the next cheap periods.
+
+## P4: the solar forecast and the day plan (2026-09-29)
+- Input: a Home Assistant forecast sensor (`pv_forecast_entity`, kWh left
+  today; `pv_forecast_tomorrow_entity` optional), read by `app/solarfc.py`.
+  Supported shapes: Forecast.Solar (state only), Solcast (`detailedForecast`)
+  and Open-Meteo Solar Forecast (`wh_period`). The unit is read, not guessed;
+  older than 3 h is stale (one missed hourly poll must not flag it).
+- Trust: `solar_trust_pct`, default 70 (owner answer 5).
+- House use: nothing the add-on recorded fitted. `tariff.db` holds grid
+  import per quarter, which the batteries shape. So `dayplan.HouseProfile`
+  keeps grid + battery per local hour for 7 days in the store
+  (`house_profile`), median per hour. It is net of the solar the house used,
+  so the solar sum never takes it below the night median. Solar readings are
+  not used (TEL-11). The first plan needs one day of it.
+- Verdict (`dayplan.plan()`): trust x sum max(0, forecast - house) x 0.95
+  until the expensive run the cheap run is for. Solar first takes it first.
+  - Leftover solar may then charge from the grid up to min(ceiling, floor +
+    the house's use in the expensive runs / 0.95), less its sun share: only
+    the shortfall.
+  - Cheap hours only ignores the plan and fills to the ceiling (design
+    section 1; review of #156, see the replay below).
+  - Solar first never charges from the grid (owner, 2026-09-29).
+- The level is kept unless it moves by min(1 kWh, 10 %). With no plan
+  (no, stale or failed forecast, no house profile, no capacity) every mode
+  is P3 option A exactly: `test_modes_p4.py` part 1 pins 12 digests from
+  5a4cdc2 (modes on, with and without an unavailable forecast).
+- The plan is made with the runs (every 15 min, or at once when the forecast
+  comes or goes). A lost forecast drops the levels at the next cycle.
+- Not done: the design's scaling by measured solar from 10:00 (it needs the
+  solar readings TEL-11 keeps out), the HA `goodwe_<inv>_plan` sensor, and
+  FCST-01.
+- Replay (`tools/opt11p4_replay.py`, 16 recorded days, Solar first + Leftover
+  solar, net EUR, lower is better; site solar rebuilt from the recording,
+  forecast errors from Elia's day-ahead Belgian solar forecast):
+  - year-earlier hourly prices: P2 19.33, P3 option A 19.44, old one-period
+    trade 18.14, P4 19.15 (perfect forecast 19.14, 1.5 x too high 19.16,
+    missing 19.44);
+  - the days' real 2026 quarter-hourly prices (held out): P2 32.26, option A
+    32.01, old trade 31.40, P4 29.19 (perfect 29.21, too high 29.28, missing
+    32.01).
+  - Solar first + Cheap hours only, skipping its sun share (the first
+    build): 19.57 (same as P3) and 29.72 against P3's 29.41. The shorter,
+    moved runs left B lower, so later midday top-ups rested A while the sun
+    shone. Cheap hours now ignores the plan, which is P3 exactly.
+  - A forecast of no sun at all gives 19.14 and 29.33. So nearly all of the
+    gain is Leftover solar buying the evening's shortfall in the cheap run;
+    the forecast itself was worth 0.14 EUR in 16 September days.
+  - Bias: the site's solar is rebuilt from the same net use the replay
+    plays, and "recorded" keeps its hourly shape and adds only the national
+    daily error. Both favour P4; "national" (no house leakage) gives 29.25.
+  No threshold was tuned to these days. The 2026-09-24 PV recording could not
+  be replayed: it is only in the live Home Assistant.
diff --git a/goodwe_controller/DECISIONS/SAFETY-32-per-pack-bms-floor.md b/goodwe_controller/DECISIONS/SAFETY-32-per-pack-bms-floor.md
index 2b0cdc9..d9a5dce 100644
--- a/goodwe_controller/DECISIONS/SAFETY-32-per-pack-bms-floor.md
+++ b/goodwe_controller/DECISIONS/SAFETY-32-per-pack-bms-floor.md
@@ -69,6 +69,8 @@ which does not run the startup gate) the absence costs a shave and never a pack.
 
 ## 3. DECISION 2 — the site verdict is the MAXIMUM of the packs' own floors
 
+*At N>=2 one pack at its floor no longer stops the others: [[SAFETY-87]].*
+
 `Controller.pack_floor_soc` — the **minimum** measured SoC, the emptiest pack —
 **is unchanged**, exactly as the card instructed. What changed is the floor it is
 graded against. `peakguard.binding_soc_floor()` reduces the roster's per-pack
diff --git a/goodwe_controller/DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md b/goodwe_controller/DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md
new file mode 100644
index 0000000..521c806
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md
@@ -0,0 +1,28 @@
+# SAFETY-40: the integrator bound is not a bug
+
+**Decision.** `i_clamped` (the integrator reaching `integrator_max_w`, i.e.
+anti-windup) keeps alarming through the same `ClampWatchdog`: it is counted,
+notified on the same cadence, and escalates on a sustained run
+(SAFETY-41). It gets its own text, a `WARNING` and an amber status row. Only
+`clamped` (a command over `max_w`) and write-path clamps keep the BUG SIGNAL,
+the `ERROR` and the red row.
+
+**Why it still notifies.** On a default install `clamped` is unreachable
+(`control.py`, at the integrator bound), so the integrator bound is the only
+loop-side signal of a runaway such as the 14 768 W one. Silencing it would
+remove that. The card says the same: "the fix is to say the true thing, not to
+say less."
+
+**Why a bug has its own budget.** A genuine over-rating must not wait up to
+`REASSERT_S` behind anti-windup notices. `ClampWatchdog` tracks a separate
+`last_bug_alarm`, and a bug's text is never overwritten by later anti-windup
+text within an episode. Across episodes the WARNING uses its own
+notification id (`goodwe_integrator_bound`), so it cannot replace a BUG SIGNAL
+notice still on screen (review of #130). With only bug engagements, the cadence is the same as
+before (`test_clamp.py` part 9).
+
+**Numbers.** They come from the `Decision` of the clamping tick (`i_bound_w`,
+`requested_w`, `clamped_w`, `target_w`), not from `i_w` or `self.target`.
+
+**Open for the owner.** Whether scattered one-cycle anti-windup episodes should
+notify at all, or only log and count. They notify now, as before.
diff --git a/goodwe_controller/DECISIONS/SAFETY-52-a-battery-that-refuses.md b/goodwe_controller/DECISIONS/SAFETY-52-a-battery-that-refuses.md
new file mode 100644
index 0000000..07c4a58
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-52-a-battery-that-refuses.md
@@ -0,0 +1,110 @@
+# SAFETY-52 - a battery that refuses is asked for 0 W
+
+**Decided 2026-09-27 by the owner, on the phase A plan (option D3). All four
+questions answered yes.**
+
+## The defect
+
+At the BMS cut-out the battery gives ~0 W whatever it is asked. The saturation
+freeze (`control.py`, `frozen`) then holds the request where it stood, and its
+SAFETY-13 exit cannot fire, because a reading of ~0 against a large ask lies
+inside the interval a limit can produce. The request stood at +5000 W for
+11.87 h on 2026-09-06 and at +1940 W for 3 h 55 m on the bus on 2026-09-19. It
+moved again only when the grid error changed sign. SAFETY-48's lead cap only
+changes where `i_w` parks (one slew step ahead instead of at the rail). When
+the request moved after the reading went flat, the stale-reading gate won
+instead and ran SAFETY-59's ~70 s trip cycle.
+
+## What was decided
+
+1. **A refused direction is held at 0 W**, reason `battery refuses`. It engages
+   in `compute()` when the freeze has held `SETTLE_CYCLES` and the reading is
+   below `REFUSED_BELOW_W` (100 W, the probe's own answer) against an ask beyond
+   `saturation_w`. The drop to 0 skips
+   the slew limit (it only removes an ask nobody meets). The direction is
+   carried like `sat_count` (`refused=`, `Decision.refused`).
+2. **A 200 W probe every 15 minutes, 34 s long** (`PROBE_W`, `PROBE_EVERY_S`,
+   `PROBE_S`; twice `BATT_OBLIGED_S`). A reading of at least 100 W in the held
+   direction ends the refusal, during a probe or not. 200 W is below `freshness.MOVE_W` (250 W), so a probe cannot arm
+   the gate. The clock is main.py's `now_mono`; `compute()` stays clockless.
+3. **A gate trip while the loop is frozen on a ~0 W reading is a refusal** for
+   control (`Controller._refusal_from_stale`). This is what stops the ~70 s
+   cycle. The log keeps SAFETY-56's two-explanation wording.
+4. **No SoC in the loop.** SAFETY-25 Option A stands. Nothing reads SoC.
+
+Other exits: the loop wants the other direction (charge is accepted at the
+floor), control stopped or started, another writer on the wire (the arbiter
+reseed). A gap in the readings keeps the refusal, because the gate's own stop is
+what seeds it.
+
+**One inverter only.** At N>1, OPT-09's `pack` limit already closes an empty
+battery's discharge end and moves its share. There, a one-unit gate trip must
+not refuse the site. `compute()` is passed `refused=None` there, and that path
+is release/1.0's law unchanged (the `i_w=None` equivalence sweep in
+`test_control.py` still holds).
+
+## Evidence
+
+`test_refusal.py` drives the real Controller and gate (the 09-06 and 09-19
+shapes, recovery with no sign change, the probe cadence, every exit).
+`tools/replay_refusal.py` replays the 16-day capture, same model as
+`replay_recorded_loop.py`, and should be read for deltas:
+
+| plant | law | gate trips | request >1 kW above delivery | longest held | import / export kWh | worst 15-min |
+|---|---|---|---|---|---|---|
+| fitted | old | 85 | 113.3 h | 16.57 h | 112.0 / 35.2 | 3434 W |
+| fitted | new | 130 (133 after review) | 11.4 h | 0.21 h | 112.3 / 35.4 | 3456 W |
+| offset 0 W | old | 1010 | 102.2 h | 16.58 h | 112.0 / 35.2 | 3434 W |
+| offset 0 W | new | 85 | 6.1 h | 0.33 h | 111.9 / 35.1 | 3434 W |
+
+**Traced in review (#141).** The +22 W worst quarter is the old law's worst
+quarter too. There the old law stands at +2060 W on a pack giving 0 W, and the
+new law asks 0 W, which the fitted plant answers with its -22 W offset: 22 W
+charged from the grid. The fit above the floor reads `batt = cmd - 28 W`, so a
+real inverter asked 0 W may do the same. Of the 71 new-law trips with no
+old-law trip within 2 min, 59 come 85-97 s after an answered probe. The offset has lifted the modelled pack
+just above its floor, the probe is answered, control ramps, the pack empties
+again mid-ramp, and the gate trips, which re-seeds the hold. The other 12
+follow an other-direction exit the same way. On a site this is one
+`STALE_READING` ERROR line per answered probe at most, and only on a battery
+that answers a probe and then cuts out again. Catching the re-cut before the
+gate needs a faster engage than `SETTLE_CYCLES`, which accuses a healthy slow
+battery, so it is left to SAFETY-58/59. After the review changes below the
+fitted-plant row reads 133 trips (the delivery exit now also catches answers
+that arrive after the probe window); the other figures are unchanged. Rejected alternatives and their figures are in
+the phase A plan: bounding the integrator by demand made the worst quarter
++541 W worse or cycled the gate 3368 times, and an SoC envelope needs the
+configured floor to be right and needs SoC.
+
+## Review changes (#141)
+
+- **"Gives nothing" is below 100 W, not below 500 W.** At `saturation_w` a
+  battery derated to 100-499 W (cold, a tapering battery) was held at 0 W for
+  ~93 % of the time: 300 W derated gave 86 Wh in 4 h against 1 200 Wh on the
+  old law. The capture has 0.11 h in that band, so the replay does not move.
+- **Any delivery ends the hold, not only an answered probe.** With
+  `meter_poll_s: 1` the 12 cycles last 12 s, less than a healthy battery's
+  reading lag (up to `BATT_OBLIGED_S`, 17 s). That engaged on a healthy step and
+  held it for 15 min. Now the late reading ends it within seconds (2 s held in
+  `test_refusal.py` part 5b).
+- **N>1 is stated as a limit in DOCS.** The pack limit there covers an empty
+  battery only when its cut-out level is configured right.
+
+## Not covered
+
+A battery that gives a steady part of the ask (e.g. a 500 W keep-alive) is a
+genuine limit (SAFETY-13 case a) and still holds its request.
+
+## What SAFETY-58 and SAFETY-59 must take into account
+
+- **SAFETY-58** (the first read after a rest trips at once): a probe never arms
+  the gate (200 < 250 W), but the refusal seeding reads the trip. If 58 delays
+  the first verdict, the seed arrives later. The 09-19 shape then needs the
+  compute-side engagement (12 cycles) to win, which it does only while the
+  request stands still. Keep `test_refusal.py` part 4 green.
+- **SAFETY-59** (DOCS says a ~70 s pattern proves a failed register): with this
+  change a refusing battery no longer produces the pattern at one inverter. The
+  DOCS text should say so, and that the `battery refuses` reason is the
+  discriminator the add-on now has. At N>1 the old pattern can still occur.
+- If either changes `MOVE_W`, `PROBE_W` must stay below it.
+  `test_refusal.py` part 2 checks the inequality.
diff --git a/goodwe_controller/DECISIONS/SAFETY-61-control-task-death.md b/goodwe_controller/DECISIONS/SAFETY-61-control-task-death.md
new file mode 100644
index 0000000..950fe27
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-61-control-task-death.md
@@ -0,0 +1,106 @@
+# SAFETY-61 — the control task's death ends the process
+
+## 0. The defect
+
+`amain()` started `run_control()` as a bare task and waited on `stop`. Nothing
+watched the task. An uncaught exception in `read_inputs()`, `cycle()` or
+`publish()` ended the task silently, and `stop` was never set. The web UI, P1
+and tariff tasks kept running, and the Supervisor saw a healthy container. The
+traceback appeared only at shutdown. The ESP32's layer-1 veto zeroed the
+inverter about 30 s later, so the hardware was safe. The pack then sat at 0 W
+indefinitely while the add-on showed green.
+
+`test_control_task.py` reproduces this on the pre-fix tree. The child process
+reaches its 40 s deadline, has written no 0 W, and has logged nothing.
+
+## 1. Decision: exit with status 70 after the ordinary wind-down
+
+A done-callback on the control task (`control_task_done()`) handles the death.
+It logs the traceback at CRITICAL at the moment of death, then sets `stop`.
+`amain()` then runs the same wind-down that SIGTERM runs (`shutdown()` →
+`command_site_zero()`, then cancel, then clean up). After that it raises
+`ControlTaskDied`, and `main()` turns that into `SystemExit(70)` (sysexits
+EX_SOFTWARE). A normal stop and `run_control()`'s own refusal path both set
+`stop` before the task ends, so the callback ignores them. The refusal still
+exits with 78.
+
+**Why not restart the loop in the same process:**
+
+* `cycle()` writes controller state before its awaits: `cycle_at`,
+  `peak_guard`, `allocation`, then `target`/`reason`, then the writes. An
+  exception between those steps leaves the controller half-updated. A loop
+  restarted in the same process would continue from a state that no boot ever
+  produces. A process restart rebuilds the controller from the Store, which is
+  the path every boot already runs.
+* An unbounded retry is the invisible spin the card forbids. A bounded retry
+  would reimplement the Supervisor watchdog's own throttle: 10 restarts per
+  30 min, and 5 attempts with backoff (`apps/const.py`).
+
+## 2. What happens after the exit, verified rather than assumed
+
+* **Exit status reaches Docker.** The add-on image (s6-overlay, `init: false`,
+  `CMD /run.sh`) was run with `exec python3 -c 'raise SystemExit(70)'`.
+  `docker inspect` gave ExitCode 70. The same test with exit 0 gave 0, and an
+  uncaught exception gave 1.
+* **Supervisor 2026.08.0** (`ghcr.io/home-assistant/amd64-hassio-supervisor`,
+  source read from the image):
+  * A non-zero container exit is recorded as `ContainerState.FAILED`
+    (`docker/monitor.py`). The Supervisor logs *"App … exited with non-zero
+    exit code 70"* at ERROR (`apps/app.py container_state_changed`).
+  * The Supervisor restarts the add-on **only if the per-install Watchdog
+    toggle is on**. `watchdog_container()` returns when `not self.watchdog`.
+    The toggle defaults to **off** (`apps/validate.py`:
+    `vol.Optional(ATTR_WATCHDOG, default=False)`).
+  * Add-on containers get **no Docker restart policy**. The only
+    `restart_policy=` in the Supervisor belongs to the observer.
+  * `boot: auto` in `config.yaml` only controls starting at host boot. The
+    `watchdog:` key in `config.yaml` is a health-check URL, not a restart
+    policy, and this add-on does not set it.
+* **So on a default install the add-on stays stopped after this exit.** The UI
+  shows it as stopped, its log holds the traceback, and the Supervisor log holds
+  an ERROR line. The pack is at 0 W, which is the same physical state as before
+  this card. The difference is that 0 W is written immediately instead of after
+  the ~30 s veto, and the add-on no longer shows green. With the Watchdog toggle
+  on, the Supervisor restarts the add-on.
+* **Not verified:** an actual restart by a running Supervisor. That would need a
+  live Supervisor, and the only one available is the live house.
+
+## 3. Left open for the owner
+
+* Whether `DOCS.md` should tell installers to enable Watchdog. DOCS.md is not
+  this card's file.
+* Setting the Watchdog toggle from inside the add-on (`/addons/self/options`)
+  was rejected here, because it would change a user setting without the user
+  knowing.
+
+## 4. Scope: the siblings, and why they are not supervised
+
+* `run_tariff_refresh()` and the P1 HTTP and HA transports already catch
+  `Exception` inside their loops by design, and the values they feed are
+  age-bounded downstream.
+* The P1 MQTT source *returns* on purpose when it is misconfigured. Making every
+  long-lived task's end exit the process would turn that deliberate fail-safe
+  into a restart loop.
+* Only the control task is supervised.
+
+## 5. `hass.py`: an undecodable body is an absence
+
+A non-JSON `200` served as `text/html` was **already** treated as an absence,
+because aiohttp's `ContentTypeError` is a `ClientError`. The reads that actually
+escaped were these three:
+
+* a malformed body labelled `application/json`, which raises `JSONDecodeError`
+  (a `ValueError`);
+* a JSON body that is not an object, which raises `AttributeError` in
+  `number()` and `limits()`;
+* an undecodable error body in `call()`, which raises `UnicodeDecodeError`.
+
+All three were measured against aiohttp 3.13.5. The first two now read as
+`None`, and the third is now a failed write (`False`).
+
+## 6. Status row
+
+`checks()` now starts with a *control loop* row showing how long ago the loop
+last completed a pass. The row turns red once that age exceeds
+`FIRMWARE_INGEST_VETO_S`. The heartbeat is sent from this loop, so past that age
+layer 1 has zeroed the inverter.
diff --git a/goodwe_controller/DECISIONS/SAFETY-73-refusal-per-inverter.md b/goodwe_controller/DECISIONS/SAFETY-73-refusal-per-inverter.md
new file mode 100644
index 0000000..bddc1a9
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-73-refusal-per-inverter.md
@@ -0,0 +1,104 @@
+# SAFETY-73 - a battery that refuses, with two or more inverters
+
+**Decided 2026-09-27 by the owner, on the phase A plan (option R). All four
+new questions answered yes. SAFETY-52's four decisions carry over.**
+
+## The defect
+
+SAFETY-52 held a refusing battery at 0 W at one inverter only. At N>1
+(`main.py` passed `refused=None`) nothing closed a unit that gives ~0 W while
+its state of charge reads above its configured cut-out, so the allocator kept
+handing it its weighted half. Measured on the real `Controller`, two units,
+house 3000 W, A cut out:
+
+| register | law | B gives | grid | A's gate trips / h |
+|---|---|---|---|---|
+| flat -4 W | old | 533 W | +2471 W | 46 (each stops the whole site) |
+| flat -4 W | new | 2000 W (its rating) | +1004 W | 1 |
+| jitter | old | 1910 W | +1094 W | 0 |
+| jitter | new | 2000 W | +1004 W | 0 |
+
+House 1200 W, which B alone carries: old +671 W (flat) and +284 W (jitter)
+standing import, new -16 W. Both cut out: old keeps asking two empty batteries
+(+1910 W each on the jitter shape), new holds the site at 0 W.
+
+## What was decided
+
+1. **A refusing unit is closed in that direction** by its own P_SAFETY unit
+   claim, source `refused`. It engages when the unit gives under
+   `REFUSED_BELOW_W` (100 W) for `SETTLE_CYCLES` (12) cycles, spanning at least
+   `REFUSED_SPAN_S` (22 s), in one direction while asked more than `PROBE_W`
+   (200 W), or when its stale-reading gate
+   trips on a held reading under 100 W. The allocator then hands its share to
+   the others within their own limits (owner decision 1). It is a hard unit
+   limit that always intersects, so OPT-11's P_MODE layer fits inside it.
+2. **It binds every strategy's ask on that unit** (decision 2): peak guard,
+   arbitrage and maintenance are placed around it like the loop.
+3. **A refusal to give power above the configured cut-out** logs INFO plus one WARNING ending
+   in `REFUSES_ABOVE_CUT_OUT` (decision 3). SAFETY-42/43 no longer report such a
+   unit: its share is 0 W, and `account()` treats it as parked.
+4. **All units refusing the same way** pass that sign to `compute()`, so the
+   site holds 0 W with SAFETY-52's law (decision 4). Probes go one unit at a
+   time.
+5. **Probe:** every 15 min for 34 s the claim becomes a pin at +-200 W and the
+   others carry the rest. The pin stands only while the resolved site target
+   asks at least 200 W its way; otherwise it would make a sibling take the
+   opposite direction, so it falls back to the closed limit for that cycle.
+6. **Exits:** a reading of 100 W or more in the held direction (probe or not);
+   100 W or more taken the other way for 12 cycles (charge at the floor; one
+   cycle of the loop overshooting through zero is not enough); stop or start.
+   On every exit the site target and integrator restart from the watts on the
+   wire, or the reopened unit is handed a parked remainder at once.
+
+**Why 200 W and not `saturation_w`.** A unit's share is often small: a 400 W
+night load split two ways asks 200 W of each. With 500 W the empty battery
+kept a phantom share that SAFETY-43's relative arm then reported as not
+delivering, the ERROR decision 3 replaces. Shares of 200 W or less that give
+under 100 W are "too small to call" in `account()`: the sibling covers the
+meter and nothing is asked of the empty battery that matters.
+
+**Why one direction throughout.** On TEST-19's flapping family a command that
+swaps sign each cycle reads ~0 through the plant's lag: 42 engagements in 21
+no-fault runs without the rule, 0 with it.
+
+**N=1 is unchanged.** Every SAFETY-73 path is gated on `len(inverters) > 1`.
+`test_refusal_units.py` part 6 runs SAFETY-52's whole suite with every
+SAFETY-73 method made to raise.
+
+## Evidence
+
+- `test_refusal_units.py`: cases a, b and c on both register shapes against
+  the old behaviour, probes and their spacing, one-at-a-time probing, the
+  recovery reseed, each exit, the small-ask and small-site-target cases, the
+  WARNING, the status row and shadow mode. Mutations U1-U13 in its docstring.
+- **No false engagements.** TEST-19's no-fault campaign (admin/goodwe
+  `sim/delivery_window.py` families, 2640 runs at N=2 and 2640 at N=1, every
+  unit executing its share) graded with the engage clause: 0 engagements, the
+  longest qualifying streak 5 cycles against 12. The grader is
+  `goodwe-session/scratch_s73/s73_nofault.py`.
+- **Recovery.** Case a, A recovering into a house that fell below the parked
+  target: worst grid +0 W with the reseed. Phase A measured -1059 W without the
+  reseed and the site hold.
+
+## Review changes
+
+- **The evidence must span 22 s, not only 12 cycles.** At a 1 s meter the 12
+  cycles were 11 s, shorter than a healthy reading's lag (dead time plus a
+  10-17 s publish). The reviewer's harness (real `Controller`, both units with
+  6 s dead time and a 13-17 s publish, load steps 300/3000 W every 2 min) then
+  refused both healthy units 10-16 times an hour, and each time the site held
+  0 W: +50-85 Wh import an hour and a +4.6 kW grid peak against +3.7 kW without
+  the refusal. At a 2 s tick there were none. `REFUSED_SPAN_S` is
+  `(SETTLE_CYCLES - 1) * LOOP_TICK_S`, so 2 s and slower ticks are unchanged.
+- **The cut-out WARNING is for a refusal to give power only.** A full battery
+  that stops taking charge is always above its cut-out level, and the WARNING
+  told the installer to check a setting that has nothing to do with it.
+
+## Not covered
+
+- A unit that gives a steady part of its ask (100 W or more) is a limit, as at
+  N=1. SAFETY-42/43 still report it.
+- `pack_permissions` stays SoC-based, so the peak guard may size a shave with a
+  refusing battery counted. The shortfall shows as `unmet_w`.
+- A wedged unit (HW-01) reading ~0 W is now shown as a refusal, not reported as
+  not delivering. Its share still moves, which is the gain SAFETY-42 measured.
diff --git a/goodwe_controller/DECISIONS/SAFETY-78-drain-at-two.md b/goodwe_controller/DECISIONS/SAFETY-78-drain-at-two.md
new file mode 100644
index 0000000..8c8b0e0
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-78-drain-at-two.md
@@ -0,0 +1,43 @@
+# SAFETY-78 - a maintenance drain at two inverters
+
+**Status: DECIDED 2026-09-29.** Fixes MAINT-05 §6 (OPT-11 P1 F1, UX-13 P3
+check 5, OPT-11 P3 F4). Tests: `test_safety78.py`.
+
+**The defect.** At N>=2 the drain pins its pack (a unit SET at
+`P_MAINTENANCE`) and the site target is split around the pin. Whenever the
+site target was below the pin, the other pack had to charge. The allocator
+refuses opposite directions (SAFETY-25 §0a, SAFETY-31), so the site went to
+0 W and logged `ARBITER: REFUSED` every cycle. That covers a house below the
+drain rate, a grid-charge trade, and a house above it too: after a refusal the
+loop restarts from 0 W and its 400 W slew step is below the pin again.
+
+**The fix.** While a pack drains at N>=2, main.py files a site limit
+`drain`, `lo` = what the pin really places (`allocator.pin_w()`: the drain
+rate inside that pack's own hard limits), at `P_MAINTENANCE`. So the site
+target is never below the pin and the other pack only adds power in the same
+direction. Opposite splits stay forbidden.
+
+- The order is the arbiter's own: a safety SET (100) outranks the limit and
+  the pin, so everything parks; the peak floor (50) and the drain floor are
+  both applied, so the higher wins; a trade or the loop below the drain is
+  lifted to it.
+- Below the drain rate the drained pack exports the rest, as the drain does at
+  N=1 (`maintenance.py`: "forced discharge, exports the surplus"). Holding it
+  to the house load would make N=2 drain differently from N=1; that is an
+  owner question, not this fix.
+- A draining pack that can place nothing (a refusal, a stale link) adds no
+  floor, and the wait is logged once per episode.
+- With battery modes on, no pack is a grid charger while another drains
+  (`modetrade.decide(draining=)`, why `cycle`), and the other battery's card
+  says why (`other_cycle`). Not while the drain waits: no floor is filed
+  then, so the other battery may charge from solar.
+- Not filed at N=1, where the drain is the site SET itself: byte-identical
+  (`tools/safety78_identity.py`, which hashes the claims too).
+
+**Not changed (measured in the PR #154 review, follow-ups).**
+- At N=1 a drain (60) outranked the peak floor (50): a 5000 W house imported
+  3000 W against a 2500 W limit. Fixed by [[SAFETY-83]].
+- At N=2 a maintenance CHARGE in a cheap window has the same stall: the
+  charging pack's `hi = -floor` against the loop asking the other to give is
+  refused on 141 of 261 cycles. The mirror fix is a site `hi`, which can meet
+  the peak floor's `lo` (0 W), so it is not this card. Fixed by [[SAFETY-84]].
diff --git a/goodwe_controller/DECISIONS/SAFETY-79-peak-margin.md b/goodwe_controller/DECISIONS/SAFETY-79-peak-margin.md
new file mode 100644
index 0000000..2dd7adb
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-79-peak-margin.md
@@ -0,0 +1,41 @@
+# SAFETY-79 — the peak guard keeps a margin below the peak limit
+
+**Status: DECIDED 2026-09-28 (owner decision).**
+
+## Decision
+
+The peak guard aims `peak_margin_w` under the limit it holds: under
+`peak_cap_w`, or under a month peak already banked above it
+(`quarter_target_w()`). `peak_margin_w` is a setting: default 50 W, range
+0-500 W, whole watts. An install without the key gets 50.
+
+**Why (owner):** the guard aimed exactly at the cap, and in the OPT-11 P1 test
+a quarter banked 3501.9 W against a 3500 W limit (OPT-11-P1-test-report.md,
+check 4). A peak even 1 W over still sets the billed peak. It is a setting and
+not a constant because the add-on is sold to several sites.
+
+**Banked peak (review, 2026-09-29):** the PR first aimed at a banked month
+peak as it stood. That can bank a few W over it, which raises the bill the
+same way; and a peak banked between cap - margin and the cap (common in the
+month an install upgrades, since the old guard held quarters at the cap) was
+aimed at exactly, so one overshoot went over the cap. The margin now applies
+under it too. Cost: up to `peak_margin_w` of a peak already paid for goes
+unused (more discharge, less charge headroom); no bill cost. Undo is one line
+in `quarter_target_w()`.
+
+## What uses which number
+
+- **the aim:** `peakguard.decide()` (the claim's floor, and so arbitrage's
+  `charge_headroom_w()` and OPT-11's give-way, which read it), and, as cap -
+  margin, `shaping_suspended()` and `maintenance_charge_floor()` (the forecast
+  checks, via `Controller.peak_aim_w()`).
+- **the real cap (reporting and billing):** `PeakTracker` (month peak,
+  headroom, 80 % warning), the decision's `ceiling_w` and every notice and
+  status row built from it, Home's limit, and `validate.config_notes()`.
+
+## Checks
+
+`peak_margin_w: 0` is byte-identical to ed739d4 (test_peak_margin.py part 1,
+digests from tools/safety79_identity.py, which also runs a maintenance charge
+with a forecast). validate.py rule 12 refuses a value outside 0-500, not
+whole, or not below `peak_cap_w`.
diff --git a/goodwe_controller/DECISIONS/SAFETY-81-load-too-high.md b/goodwe_controller/DECISIONS/SAFETY-81-load-too-high.md
new file mode 100644
index 0000000..c94559d
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-81-load-too-high.md
@@ -0,0 +1,63 @@
+# SAFETY-81 — no false "Load too high for battery" alarms
+
+**Status: 2026-09-29, owner go for the card. Review kept the 10 W tolerance
+as a constant and added the 10 s hold.**
+
+## Defect
+
+The SAFETY-79 test (SAFETY-79-test-report.md, F1/F2) saw 6 false alarms in 7.
+The alarm fired whenever `decide()` clamped its floor to the rating
+(`saturated`). Three things set that while the quarter landed on target:
+
+- **Double count.** `decide()` sizes from the held meter reading plus the
+  battery reading. When the meter sample predates the battery's last increase,
+  the increase is counted twice. It happens under noise, and at each quarter
+  start, where the battery is back while the held sample is still the spike.
+- **The aim, not the cap.** `saturated` is graded against cap − margin, so at
+  margin 50 noise needs 50 W less to trip it (F2).
+- **Last seconds.** The gain 900 / remaining turns a few W over the aim into
+  thousands of W wanted, with the battery far from its rating.
+
+## Decision
+
+The alarm needs `saturated` and `peakguard.load_too_high()`: with the battery
+at full power from now on, the quarter still ends more than `ALARM_MISS_W`
+(10 W) over the real limit (`ceiling_w`). That is the miss itself, without the
+gain. The battery reading it uses is the lower of this cycle's and the last
+one's. It must hold for `ALARM_HOLD_S` (10 s). At most one notification per
+quarter, because near the threshold the test flickers with the meter; the
+ERROR log line is written for every episode.
+
+**Why 10 W:** at margin 0 the guard itself lands up to +5.7 W over (SAFETY-79
+test, check 5), and those misses are real but tiny; the alarm would fire in
+the last second of most guarded quarters. The margin (default 50) is the fix
+for them. Cost: a real miss of 10 W or less is not alarmed; at a capacity
+tariff of the order of EUR 50 per kW a year, 10 W in one month is cents.
+Review measured +13 W on a 10 kW two-unit site at margin 0, not saturated, so
+no alarm: the tolerance only matters when the battery is at its rating. A
+constant, not an option: `peak_margin_w` is the owner's knob.
+
+**Why the hold (review):** the test assumes the load now lasts the rest of
+the quarter. A load over cap + battery for ~5 s every 30 s (`sine4500_fast`,
+a cycling hob or heater) alarmed at each quarter start while the quarter
+landed under the aim. The hold stops that.
+
+**Cost:** a real alarm comes 10-12 s later than on 5a4cdc2 (`step6500` at
+1211 s, not 1201 s); a slow ramp 20 s later (`ramp6500`), as it waits for the
+real cap. While the battery refuses or its reading is lost, the alarm waits
+until the quarter is lost even at full battery (27-60 s later in review runs);
+those faults have their own alarms. A load over cap + battery for more than
+10 s still alarms even if the quarter later lands under. `ALARM_HOLD_S = 0`
+removes the hold.
+
+## Not changed: the 1 s spike itself
+
+The cycle after a quarter boundary and before the new quarter's first meter
+sample still sees 0 s left, files no claim, and an Off battery drops to 0 W for
+one cycle. That is the same edge tick as OPT-15 F1, so it is left to OPT-15.
+Control is unchanged here: every command in `tools/safety81_sim.py` is
+byte-identical to 5a4cdc2 (test_safety81.py part 1).
+
+The double count also moves control, not only the alarm: on a late sample the
+guard asks for the full rating for one cycle (edge4600 at 902 s: 2000 W where
+1150 W holds the aim). Left to a follow-up card.
diff --git a/goodwe_controller/DECISIONS/SAFETY-83-peak-over-drain.md b/goodwe_controller/DECISIONS/SAFETY-83-peak-over-drain.md
new file mode 100644
index 0000000..8d12cc6
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-83-peak-over-drain.md
@@ -0,0 +1,34 @@
+# SAFETY-83 - the peak guard outranks the maintenance drain at N=1
+
+**Status: DECIDED 2026-09-29 (owner go, P1).** Follows SAFETY-78's "Not
+changed" list. Tests: `test_safety83.py`.
+
+**The defect.** At N=1 the drain is the site SET at `P_MAINTENANCE` (60). The
+peak floor is a limit at `P_PEAK` (50), and clause 2 applies only limits at or
+above the winner, so the floor was ignored and the house imported what the
+drain left. A 5000 W house under a 2500 W limit and a 2000 W drain banked
+3000 W quarters; on the owner's settings (limit 3500, drain 2500, margin 50) a
+breach starts at about 5950 W.
+
+**The fix.** While a drain owns the setpoint at N=1 and the peak floor asks
+for more than the drain rate, `main.py` (`_peak_over_drain()`) refiles that
+peak claim at `P_MAINTENANCE`. The arbiter then applies it: the target is the
+floor, still inside the safety limits, and a safety SET (100) still parks
+everything. Where the floor is at or below the drain rate nothing changes.
+
+- The order in effect is now the same at N=1 and N=2: safety limits and the
+  SAFETY-73 refusal > peak guard (with the SAFETY-79 margin) > maintenance >
+  modes > trade > loop (`arbiter.py`, beside the priorities).
+- The drain keeps counting: the battery discharges at least the drain rate on
+  every cycle, so the cycle is not reset or stalled; it only ends sooner.
+- Below the drain rate the rest is still exported (owner, 2026-09-29).
+- Identity: `tools/safety78_identity.py --diff` against 35cdffe changes only
+  cycles where the guard asked for more than the drain; after such an episode
+  the commands are identical again and only the log and the idle loop's
+  integrator differ. N=2 is unchanged.
+
+**Not changed.**
+- Between the drain rate and the peak aim, the house still imports what the
+  drain leaves (N=1 behaviour kept by the identity). At N=2 the loop covers it.
+- A maintenance HOLD (0 W, 120 min, battery full) still outranked the peak
+  guard at N=1. Fixed by [[SAFETY-86]].
diff --git a/goodwe_controller/DECISIONS/SAFETY-84-charge-at-two.md b/goodwe_controller/DECISIONS/SAFETY-84-charge-at-two.md
new file mode 100644
index 0000000..21a9af0
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-84-charge-at-two.md
@@ -0,0 +1,46 @@
+# SAFETY-84 - a maintenance charge at two inverters
+
+**Status: DECIDED 2026-09-30.** Follows SAFETY-78's "Not changed" list.
+Tests: `test_safety84.py`; identity: `tools/safety84_identity.py`.
+
+**The defect.** In a cheap window the charging pack files its own
+`hi = -charge` (P_MAINT_SHAPE). At N>=2 the loop's site target sat above it
+(a house to cover, or its 400 W slew step from 0 W), so the other pack had to
+give while this one charged. The allocator refuses opposite directions
+(SAFETY-31), so the site sat at 0 W whatever the house
+(`tools/safety84_identity.py` on 9d5b7d1: 436 of 480 cycles refused). N=1
+was fine.
+
+**The fix.**
+- While a pack's own limits make it charge at N>=2, `main.py` files a site
+  limit `charge`, `hi` = what that pack's own `hi` places
+  (`allocator.hi_w()`, whole W as the allocator rounds). The site target is
+  never above it, so the other pack only adds power in the same direction.
+  Opposite splits stay forbidden. Mirror of SAFETY-78's `drain` floor.
+- Peak guard first (owner order, SAFETY-83). The charge is sized to the
+  quarter's headroom under the aim (`charge_headroom_w()`, cap or banked peak
+  minus `peak_margin_w`), so it charges less instead of stopping: the meter
+  sits on the aim and the guard does not need to step in. Where the house
+  alone is over the aim the guard engages, the shaping is suspended as before
+  (`shaping_suspended()`) and no `charge` is filed, so the guard's `lo` and
+  this `hi` never meet in one cycle (no `lo > hi`, no park at 0 W).
+  Without the headroom sizing the aim still held (the suspension did it), but
+  a battery gave power back on 285 of 540 cycles at a 3000 W house
+  (test_safety84.py part 2).
+- A site stop (a safety SET above P_MAINT_SHAPE) sizes the charge to 0 W:
+  the unit `hi` is a hard limit, so a charge under a 0 W stop needs the other
+  pack to give. It was refused, with an ARBITER line, on most cycles of the
+  stop (test_safety84.py part 4). The stop still parked the site at 0 W.
+- A pack that cannot take the charge (a refusal, a full pack, a stale link)
+  files no ceiling; the other pack follows the loop.
+- Not filed at N=1: byte-identical (`tools/safety84_identity.py`, which hashes
+  every claim, in and out of a cheap window and under a banked peak).
+
+**Not changed.**
+- At N=1 the charge is not sized to the headroom: the guard still suspends it
+  and the battery gives until the quarter is safe. The same sizing would fit
+  there; that is an owner question, not this fix.
+- Outside a cheap window (`hi = 0`, solar only) nothing is filed, at any N.
+- A HOLD (later fixed by [[SAFETY-86]]) and the "Battery is not keeping up"
+  alarm (SAFETY-85) are untouched. In the identity runs that alarm's log line
+  comes as often at N=2 as at N=1 (2 in 480 cycles).
diff --git a/goodwe_controller/DECISIONS/SAFETY-85-no-false-not-keeping-up.md b/goodwe_controller/DECISIONS/SAFETY-85-no-false-not-keeping-up.md
new file mode 100644
index 0000000..778e326
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-85-no-false-not-keeping-up.md
@@ -0,0 +1,91 @@
+# SAFETY-85 - no false "not keeping up" while another owner sets the battery
+
+**Status: implemented 2026-10-01, for review.** Tests: `test_safety85.py`.
+
+**The defect.** "Battery is not keeping up" (SAFETY-40, `goodwe_integrator_bound`)
+fired about every 2.5 min during maintenance (drain, charge, HOLD) and under the
+peak guard, while the battery gave exactly what it was told. Each warning
+re-created the HA notification. Rig counts: 24 in an hour (SAFETY-83 F1), 43 in
+7 episodes (SAFETY-86), 35 in 16 (SAFETY-87), 12 in 6 (SAFETY-84). The page
+counter counted cycles (861), not episodes.
+
+**Cause, measured on the real Controller.**
+- N=1: when a higher claim decides, `cycle()` re-seeds the integrator from the
+  target each cycle, then `compute()` adds `gain * error` for a grid error the
+  loop does not own. Target + kick crosses the rail and sets `i_clamped`. The
+  carried integrator is not wound (SAFETY-48 caps the lead at one slew step),
+  so control comes back one slew step at a time.
+- N>=2: a maintenance pin is a unit claim. The loop stays the site winner and
+  winds to its rail for watts the pinned battery may not give. When the pin
+  lifts, the site jumps: 2500 W in one cycle when a HOLD ends under a 4500 W
+  house, 1390 W when a charge pin lifts (`s84 n2_charge_dear`, t=1800 s).
+
+**Decision.** Three rules; the alarm, its text and its id are unchanged.
+1. **The loop's clamp counts only on a cycle the loop decided.** The winner is
+   the loop. Its number is on the wire, or only a rating (`device`,
+   `supervised`) cut it. No bound held it, and nothing was unmet.
+   (`Controller._loop_alarm_input`.)
+2. **A battery another owner set to discharge alarms when it gives less than
+   it was told.** This covers every battery on a cycle the loop did not
+   decide, and a battery with its own pin otherwise. The test is more than
+   `saturation_w` short of the least it stood at over `SHORT_CYCLES` cycles
+   and `SHORT_SPAN_S` (the plant's measured settle, SAFETY-13/73), for
+   `saturation_cycles` cycles in a row (`clamp.delivery_short`). It covers a
+   real shortfall during maintenance or under the peak guard. Before, that
+   shortfall was silent unless the kick happened to reach the rail (house
+   1000 W, drain 2000 W, battery gives nothing: 0 warnings before, 4 in 10 min
+   now).
+3. **At N>=2, while maintenance holds a battery, the loop is bounded** by
+   OPT-11's `loop_bound()` (what the batteries may place). It does not wind,
+   and control comes back one slew step a cycle. Why maintenance only: that is
+   where the jump was measured and where the owner order puts maintenance
+   above the loop. Other N>=2 limits (pack cut-out, SAFETY-73 refusal) keep
+   the old law. Rule 1 still silences them (the target is unmet), so they no
+   longer warn either.
+
+Fixing the windup was chosen over only ignoring the wound part, because at
+N>=2 the wound integrator moves real watts at hand-back. At N=1 there was
+nothing to fix: re-seeding already prevents windup.
+
+**What SAFETY-03/40 protect is kept.** With the loop in charge, the integrator
+bound still warns (a runaway, a house above the rating), and a saturated
+inverter under the loop's own command still does not alarm (SAFETY-03 AC 2):
+rule 2 grades only batteries another owner set.
+
+**The counter.** `ClampWatchdog.bound_episodes` counts episodes that had a
+bound engagement. The status row shows it ("N times since start").
+`bound` (cycles) stays for the log and the tests.
+
+**Re-pinned digests.** Every change is intended; nothing at N=1 moves a watt.
+
+| digest | what changed |
+|---|---|
+| s78 `n1_drain_owner` | the false clamp rows are gone from the log; commands identical |
+| s78 `n2_drain`, s84 `n2_charge`, `n2_charge_banked`, s79 `n2_maint` (test_peak_margin) | loop reason (`mode-bound`), integrator and loop claim while bounded; commands identical |
+| opt11 `n2_maint` (test_modes) | A drops out at t=1655 s: B follows the house at once, 8 cycles differ (max 920 W) |
+| s84 `n2_charge_dear` | A's pin lifts at t=1800 s: 400 W a cycle, not a 1390 W jump; the surplus step after it; 98 cycles |
+
+test_safety86's "without the ceiling the log floods" now needs the ceiling
+and the bound both removed: either one alone keeps the loop inside what the
+batteries can give. The `alarmed()` helpers in test_safety84/86 also read
+SAFETY-81's quarter stamp, because ALLOCATOR rows can push its row out of
+the 40-row log.
+
+**Review (PR #163).** The first draft graded each battery against last
+cycle's command and graded charges too. On plantsim's battery (10 s lag) at
+the live 2 s meter, every drain or charge start warned once, and an N=2 drain
+or HOLD under the peak guard with a stepping house warned 15 times an hour. A
+maintenance charge tapering near full warned 11 times in 50 min, which
+SAFETY-42 section 7 had ruled out. With the settle window and discharge only:
+0 in all of those cases. A battery that gives nothing still warns, lagging
+or not. At a hypothetical 20 s lag, it warns at most twice an hour. The cost:
+a battery that does not take a charge another owner set is not named by this
+alarm (the same gap SAFETY-42 states; the charge has its 36 h timeout).
+`test_safety85.py` part 7.
+
+**Not changed, open for the owner.**
+- With the loop in charge and the house above the batteries' total rating,
+  it still warns (SAFETY-40). On the rig's 2 x 2000 W N=2, most of SAFETY-84's
+  count came from houses of 4500 and 6500 W.
+- TEL-10's `Loop reason` reads `mode-bound` while the maintenance bound holds
+  the loop, with modes off. DOCS lists the value with both meanings.
diff --git a/goodwe_controller/DECISIONS/SAFETY-86-peak-over-hold.md b/goodwe_controller/DECISIONS/SAFETY-86-peak-over-hold.md
new file mode 100644
index 0000000..612efb0
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-86-peak-over-hold.md
@@ -0,0 +1,47 @@
+# SAFETY-86 - the peak guard outranks the maintenance HOLD
+
+**Status: DECIDED 2026-09-30 (owner).** Follows SAFETY-83's "Not changed"
+list. Tests: `test_safety86.py`.
+
+**The defect.** The HOLD (battery resting full after the maintenance charge)
+is a SET of 0 W at `P_MAINTENANCE` (60), above the peak floor (`P_PEAK`, 50),
+so the floor did not bind. At N=1 a 6500 W house banked 6500 W quarters and
+'Load too high' fired (SAFETY-83 rig test, check 4). At N=2 only the other
+battery gave: 4500 W against a 3950 W aim (SAFETY-84 rig test, check 6).
+
+**The fix** (`main.py`, `_peak_over_hold()`).
+- N=1: during a HOLD a peak floor above 0 W is refiled at `P_MAINTENANCE`, as
+  for a drain (SAFETY-83). The battery gives the floor; the Why reads "raised
+  for the peak limit".
+- N>=2: the holding battery's pin is raised to the floor minus what the other
+  live batteries may place (their hard `hi`, or their pin). The others give
+  first, the holding one only the shortfall. Why this split and not the
+  allocator's shares: the hold is maintenance and outranks the others' use
+  (owner order), and the owner rule for an Off battery is the same, "give way
+  only for the shortfall". A battery Off by its mode (P_MODE, below
+  maintenance) therefore still gives before the holding one.
+- N>=2, while the holding battery gives: a site `hold` ceiling at the floor
+  (P_MAINTENANCE), so the loop does not ask for watts the hold keeps back.
+  Without it the moving pin re-logged the ALLOCATOR "could not be placed"
+  row each cycle and filled the action log (review, PR #161).
+- Below the aim nothing changes: the floor is 0 W, the hold is 0 W, the rows
+  are identical to before (test_safety86.py part 2).
+- A site stop (a SET above `P_PEAK`) decides alone: nothing is raised at N>=2,
+  and the refiled floor at N=1 stays under `P_SAFETY`. If another battery is
+  pinned to charge (a SAFETY-73 probe) the pin is not raised, so the site is
+  never split both ways.
+- The hold resumes by itself: the rule is evaluated each cycle, so when the
+  guard lets go the command is 0 W again.
+
+**The level dips below the target: the hold finishes anyway.** Owner
+decision 2026-10-01: the HOLD ends on its clock (`maintenance_hold_min`) even
+when the peak guard pulls the level down; no top-up. A top-up would re-enter
+CHARGE (up to 36 h, `CHARGE_TIMEOUT_MIN`) and keep the site's one maintenance
+slot meanwhile.
+
+**Not changed.**
+- The peak guard still grades the emptiest battery (SAFETY-32): at N=2 with
+  B under `peak_soc_floor` the floor is limited and A holds even when it is
+  full (SAFETY-87).
+- "Battery is not keeping up" during maintenance (SAFETY-85), the N=2 charge
+  flapping (SAFETY-88) and the N=1 charge headroom sizing are untouched.
diff --git a/goodwe_controller/DECISIONS/SAFETY-87-guard-uses-able-batteries.md b/goodwe_controller/DECISIONS/SAFETY-87-guard-uses-able-batteries.md
new file mode 100644
index 0000000..5f366c5
--- /dev/null
+++ b/goodwe_controller/DECISIONS/SAFETY-87-guard-uses-able-batteries.md
@@ -0,0 +1,83 @@
+# SAFETY-87 - the peak guard uses every battery that can still give
+
+**Status: DECIDED 2026-10-01 (owner card).** Follows SAFETY-86's "Not
+changed" list. Tests: `test_safety87.py`; identity:
+`tools/safety87_identity.py`.
+
+**The defect.** At N>=2 the guard graded the emptiest battery against the
+highest floor ([[SAFETY-32]] §3). One battery under `peak_soc_floor` made the
+whole site floor-limited: the claim asked for 0 W and the reserve alarm fired,
+even with the other battery full. Measured: a maintenance charge (A at 11 %)
+raised the alarm 10 times while both batteries gave 2000 W and the quarter
+landed on the aim (SAFETY-84 rig test, check 3); a HOLD (A at 99 %, B at
+15 %) left A at 0 W and banked 4051 W, raising the month peak (SAFETY-86
+review; rig case 7a: 4563.8 W).
+
+**The fix.**
+- `decide()` and its call are unchanged. At N>=2 `Controller._peak_on_able()`
+  then grades each battery on its own floor (`peakguard.reserve_split()`).
+  One at or under it is *held*. The others that are live and not refusing
+  (SAFETY-73) are *able*.
+- A floor-limited decision is re-taken on the able batteries
+  (`peakguard.place_on_able()`): their own permission (min SoC against max
+  floor, among them), and a floor of `min(need, able_w)`. `able_w` is their
+  rating plus the drain a held battery gives anyway (its maintenance pin).
+- The held batteries weigh 0 in the split while the site gives
+  (`arbiter.resolve(reserve=)`), so the floor lands on the able ones. During a
+  HOLD, a held battery is not counted among the "others" (`_peak_over_hold()`),
+  so the holding battery covers the need.
+- Floor-limited now means: some battery is held and the able ones cannot hold
+  the aim. The claim still asks them for `able_w`. The alarm fires only if
+  they miss the real limit at full power for `ALARM_HOLD_S`, the same test as
+  'Load too high' (`_reserve_short()`), so a one-cycle miss at a quarter's end
+  is not an alarm. With nothing able (all held, or the rest refusing or
+  dropped) it is the old state: 0 W, immediate alarm.
+- The alarm and the row name `held`, each battery graded on its own floor. The
+  old code named batteries against the site's highest floor.
+- Page: the two peak rows carry `runs`. A red `runs` row gives the banner its
+  title without "Not ready", and the Home page is not shown as held at 0 W.
+  Rows that do stop control still outrank it.
+
+**How SAFETY-32's concern is still covered.** SAFETY-32 took min(SoC) against
+max(floor) so the guard never sizes a forced discharge a battery's own BMS
+stops. Now no battery at or under its own floor is asked for the peak: it is
+graded on its own floor, and an unread SoC or unknown cut-out counts as held.
+The min/max pairing still decides permission, over the able batteries. The
+roster verdict `decide()` echoes (`soc`, `soc_floor`) is kept, so SAFETY-32's
+call-site and reduction checks still bite. What changed is only that one held
+battery no longer stops the others. One exception, with battery modes on: see
+Open.
+
+**Maintenance pins beside a held battery** (review). A draining battery that
+may still give is raised from its drain rate towards its rating for the peak
+floor, after the others (`_drain_over_reserve()`; peak > drain), else the
+floor's rest landed on the held battery. In a HOLD, a held battery counts its
+own pin (a drain) among the others, and a held battery pinned to charge stops
+the raise (never split both ways).
+
+**Before -> after** (test_safety87.py, rig of 2 x 2500 W, aim 3450 W):
+
+| case | before | after |
+|---|---|---|
+| charge, A 11 %, house 4500 | 3 reserve alarms, quarter 3450 | 0 alarms, 3450 |
+| HOLD, A 99 % / B 15 %, house 5500 | A 0 W, B 2488 W, 3 alarms | A 2054 W, B 0 W, 0 alarms, 3450 |
+| HOLD, house 6500 | A 0 W, B 2488 W, 4051 W | A 2500 W, B 0 W, 4014 W, 1 alarm (A alone is short) |
+| HOLD, month peak 4000, house 6000 | A 0 W, B 2488 W, 3551 W, alarms | A 2054 W, B 0 W, 3950 (peak - margin), 0 alarms |
+| both under the reserve | alarm | alarm (unchanged) |
+| N=1, every scenario | | byte-identical |
+
+**Open, for the owner.**
+- The loop still draws a held battery (SAFETY-25 option A: the reserve binds
+  the peak guard only). It gives last, after the able ones. So with house 6500
+  in the charge case, B alone cannot hold the aim, the alarm fires as
+  specified, and the loop then lands the quarter on the aim from A. The text
+  says "cannot keep … alone", not "will go over", so it stays true.
+- Battery modes on, A Off and B held: when B alone can place the floor, OPT-11
+  keeps A resting and B gives it. When B cannot, A gives first. Making Off give
+  before a held battery in the first case needs a third allocator tier. The
+  same at N=3: A Off, B held, C able, floor 4000 W gives C 2500, B 1500, A 0.
+  Until then, with modes on, a held battery can give for the peak.
+- The notification and row text live in `messages.py`, which has no NL layer
+  yet (UX-19). The Home page text, which has NL, is unchanged.
+
+**Not changed.** N=1. 'Load too high' (SAFETY-81). SAFETY-85, -88, -89, -90.
diff --git a/goodwe_controller/DECISIONS/TEL-11-pv-production.md b/goodwe_controller/DECISIONS/TEL-11-pv-production.md
index a941683..f5802c0 100644
--- a/goodwe_controller/DECISIONS/TEL-11-pv-production.md
+++ b/goodwe_controller/DECISIONS/TEL-11-pv-production.md
@@ -38,6 +38,8 @@ the trade [[product-not-one-house]] names.
 
 ## 2. The sign convention: **positive is production**, and there is no `pv_invert`
 
+> Reversed by TEL-14 (flag and negative caution): `DECISIONS/TEL-14-pv-sign.md`.
+
 ### The convention is derived, not assumed
 
 Two sign rules already ship, and both are recorded in `DOCS.md`'s *Sources*
diff --git a/goodwe_controller/DECISIONS/TEL-12-several-pv-inverters.md b/goodwe_controller/DECISIONS/TEL-12-several-pv-inverters.md
index e880727..b7ac7e0 100644
--- a/goodwe_controller/DECISIONS/TEL-12-several-pv-inverters.md
+++ b/goodwe_controller/DECISIONS/TEL-12-several-pv-inverters.md
@@ -357,3 +357,5 @@ the bump is PKG's call. The material an entry needs is this file.
 
 The option surface moves **76 keys → 77**, one new optional key, `pv_entities`,
 empty on every install that does not set it.
+
+**Superseded in part (UX-08, 2026-09-27):** the PV status rows no longer read 0.11.0's sentences at one entity. The owner ruled out entity ids on status rows, so 2/5 now holds for the control document only. See `UX-08-short-notifications.md`, phase 2b item 3.
diff --git a/goodwe_controller/DECISIONS/TEL-14-pv-sign.md b/goodwe_controller/DECISIONS/TEL-14-pv-sign.md
new file mode 100644
index 0000000..8325099
--- /dev/null
+++ b/goodwe_controller/DECISIONS/TEL-14-pv-sign.md
@@ -0,0 +1,83 @@
+# TEL-14 — the PV sign, declared per entity
+
+Owner report on 0.12.0: `sensor.espressif_vermogen` (ESPHome clamp) and
+`sensor.kwh_meter_actueel_vermogen` (kWh meter in the PV circuit) read
+**positive for consumption, negative for production**. At night the page said
+"✓ PV production: 13 W" — standby draw. By day production would publish negative.
+
+## 1. This reverses TEL-11 §2, and why
+
+TEL-11 §2 refused a `pv_invert` on two grounds. "PV is read by nothing in the
+control path" still holds: the flip lives in `pv.total()`, and `test_pv.py`
+part 12 re-runs part 6's 40-cycle identity with a flip set. "A reversed sensor
+announces itself" did not survive a real site: these sensors follow a different
+convention, read a plausible small positive number at night, and the only other
+fix is a template sensor, the place TEL-12 §2 says goes quietly wrong.
+
+## 2. The shape: a parallel list, `pv_invert_entities`
+
+Measured by `tools/supervisor_shape_probe.py` §H (Supervisor 2026.08.0, against
+a 0.12.0 blob); re-run it for the transcript.
+
+| shape | schema | why it lost / won |
+|---|---|---|
+| (a) `-sensor.x` prefix | accepted | invisible: the sign is a syntax only the description explains, in a field an installer fills with the entity picker's text |
+| (b) parallel list | accepted, 0.12.0 blob unchanged | **ships**: its own labelled, translated field ("PV entities whose sign is reversed"); an installer lists the odd ones out |
+| (c) dicts on `pv_entities` | **refuses 0.12.0's stored strings** | bricks the upgrade — TEL-12's trap again |
+| (c2) dicts as a third key | accepted | per-entry labels render raw (`entity`, `invert`) — probe §F; and a third PV surface |
+| (d) global bool | accepted | one sign cannot describe inverter + meter in one roster |
+
+(b)'s known cost is a typo in the second list: `pv.stray_inverts()` turns it into
+a named caution. `[]` in `options:` is load-bearing (§H, isolated counterfactual).
+Default `[]` flips nothing, so every 0.12.0 install is byte-identical (part 12).
+
+## 3. The negative caution: per entity, below −50 W
+
+The owner's two meters draw ~13 W at night, so a *correctly* signed meter reads
+about −13 W then. −50 W clears that with room for a few such devices behind one
+entity; a reversed sensor by day reads hundreds to thousands of watts below
+zero. It is tested **per entity, not on the total** (a deviation from the brief):
+three correct meters at −20 W sum to −60 W and must stay quiet, while a reversed
+−1500 W hidden inside a positive total must not. It is a caution, never `bad`;
+a wrong threshold costs a spurious or missed caution, never data. The text says
+ADD (unflipped) or REMOVE (already flipped).
+
+## 4. Mutations
+
+Fresh `cp -a` each, `__pycache__` purged, CI image, `:ro`, `--network none`;
+`test_pv.py` only unless stated. T1-T12 at 7559d21; M2/M5 are review #1628's,
+red since B1 (merged into release/1.0 @ 43b2740).
+
+| # | mutation | bytes | reds |
+|---|---|---|---|
+| T1 | flip ignored in `total()` | −45 | 9 |
+| T2 | flip applied to every member | −7 | 6 |
+| T3 | `0.0 - w` → `-w` | −5 | 1 |
+| T4 | flip written as `abs()` | −1 | 2 |
+| T5 | `_read_pv()` stops passing the flip | −26 | 7 |
+| T6 | caution threshold −50 → 0 W | −17 | 3 |
+| T7 | `[sign inverted]` marker dropped | −39 | 3 |
+| T8 | negative caution made `bad` | +1 | 1 |
+| T9 | `stray_inverts()` always empty | −50 | 1 |
+| T10 | `inverted()` stops stripping | −8 | 1 |
+| T11 | ADD/REMOVE advice swapped | +4 | 2 |
+| T12 | `pv_invert_entities: []` deleted from `options:` | −25 | 2 test_translations + 17 probe |
+| M2 | `stray_inverts()` roster ignores `pv_entity` | +15 | 2 (REPORTED CASE, PADDING) |
+| M5 | `_read_pv()` flip set not stripped | +25 | 1 (PADDING) |
+
+## 5. History
+
+OPT-10's `sensor.goodwe_pv_power` recorded since 2026-09-24 on an install with
+such sensors carries the old sign; nothing rewrites it.
+
+## 6. CHANGELOG entry for the next PKG cut
+
+Not written into `CHANGELOG.md`: `test_version_gate.py` 11b/11d refuse an
+`## Unreleased` heading (measured on this branch: 4 reds). For PKG to paste:
+
+> **`pv_invert_entities` (TEL-14).** A PV sensor that reads negative while
+> producing — typically a kWh meter or power clamp in the PV circuit — can now
+> be listed under *PV entities whose sign is reversed* in the Configuration tab;
+> its sign is flipped before the sum and the status page marks it. Empty (the
+> default) changes nothing. ⚠️ PV history recorded before you set it keeps the
+> old sign.
diff --git a/goodwe_controller/DECISIONS/UX-02-two-config-surfaces.md b/goodwe_controller/DECISIONS/UX-02-two-config-surfaces.md
index 76a57dc..81b9ee1 100644
--- a/goodwe_controller/DECISIONS/UX-02-two-config-surfaces.md
+++ b/goodwe_controller/DECISIONS/UX-02-two-config-surfaces.md
@@ -148,6 +148,11 @@ exits 78 and the panel goes with it. Recovery is the Configuration tab. That is
 the reason it stays, and the reason the panel refuses to write a blob the
 validator rejected: this surface must never be the thing that removes itself.
 
+*Amended by [[UX-15-setup-only-mode]] (2026-09-28):* one refused configuration
+keeps the panel: options that name no inverter at all and have no other
+refusal, which is what a new install ships. The add-on then serves the page in
+setup-only mode and commands nothing. Every other refusal still exits 78.
+
 **The panel shows fewer refusals than the startup gate can, never more.** Two
 of `validate.py`'s rules compare a configured ceiling against the setpoint
 device's *own* reported range, which is only knowable by asking Home Assistant.
diff --git a/goodwe_controller/DECISIONS/UX-08-short-notifications.md b/goodwe_controller/DECISIONS/UX-08-short-notifications.md
new file mode 100644
index 0000000..3d88ff4
--- /dev/null
+++ b/goodwe_controller/DECISIONS/UX-08-short-notifications.md
@@ -0,0 +1,92 @@
+# UX-08 phase 2a: short notifications, and what moved out of them
+
+The owner decided on 2026-09-27: a title of at most about 5 everyday words and a one-sentence body. A red safety alarm may use up to 3 sentences, so no action-relevant information is lost. Titles are neutral, with no "GoodWe:" prefix. HA entity ids appear only in refusals. The rule is `STYLE.md` at the repository root, the texts are in `app/messages.py`, and `test_messages.py` enforces both. The detail each notification used to carry is in DOCS.md under "Notifications", and the body links to it.
+
+**Unchanged:** every `notification_id`, every trigger and cadence (edges, SAFETY-34 re-announce, per-unit ids), every log line and every status row. The status banner and rows are phase 2b, refusals and option texts 2c, logs 2d; `ux08_allowlist.txt` lists them until then.
+
+## Where a choice was made
+1. **Severity of "not delivering" (SAFETY-42).** The notification is an *alarm*, so it may use 3 sentences. Its log line is ERROR and the alarm is latched. The page banner stays amber, as SAFETY-42 decided, because control keeps running; the two answer different questions (is control running / must a person act) and HA shows no colour on a notification. The three checks stay in their original order. Clearing it takes stop then start, and the body says so.
+2. **Figures left the bodies** of the frozen-meter card (the rail and the command), the circulating-power card (the watts and the time window) and the peak cards (the projection). None of them is needed to act, and all of them are still in the reason text that the log line and the status row carry. `test_freeze.py` and `test_watchdog.py` now pin that. The frozen-meter card can therefore no longer quote a wrong rail (SAFETY-20), because it quotes none.
+3. **The over-rating alarm keeps its numbers** (asked, sent, and which limit cut it), because they are what a fault report needs. `ClampWatchdog.facts` carries them under the same keep-the-bug rule as `reason`, so the words and the numbers always describe the same tick, with asked before sent (SAFETY-40, `test_clamp.py` part 6).
+4. **SAFETY-25 stays in the peak-reserve alarm** as its last sentence ("the reserve only limits peak shaving … down to its cut-out level"). The alarm now gives each branch its own action: at the reserve, lower it; battery level unread, check the sensor; floor unknown, set the cut-out level. That last branch is `soc_floor is None`, which happens when an inverter's cut-out level is missing, not the peak reserve (that option always has a value). Before, every branch said "lower peak_soc_floor". The title, "Battery stopped limiting the peak", is true on all three branches.
+5. **SAFETY-32 at a roster of one.** The body no longer ends in a separate "WHICH PACK" paragraph. The pack's name is part of the first sentence ("The battery of inverter-b …"), and at a roster of one that is the only difference.
+6. **Dropped as background, now in DOCS:** "charging stays blocked" (peak reserve), "why no other guard fired" (circulating power, not delivering), and the saturation-freeze distinction (over-rating). "The meter cannot see this" stays in the circulating-power card, as the owner asked.
+7. **The Details link** opens the add-on's documentation page (`/hassio/addon/<slug>/documentation`, with the slug taken from the container hostname) and names the section. A `#heading` anchor was not used because nobody has checked that Home Assistant's documentation tab renders heading ids; if it does, adding one is a one-line change. Outside an add-on container it names the section without a link.
+
+# Phase 2b: status rows and page banners
+
+Every row of the Commissioning list and every banner is now in `app/messages.py` (`row_*`, `banner_*`), and `test_messages.py` checks a rendering of each. The row and banner kinds are gone from `ux08_allowlist.txt` (200 → 168 entries). DOCS.md "Status page" explains the rows. **Unchanged:** every row's colour (ok / warn / bad), which rows show when, and the banner cascade order.
+
+## Where a choice was made
+1. **A red row may use 3 sentences (30 words).** STYLE.md gave rows 15 words; the owner allows red safety states 3 sentences. A red row needs room for what happened, the state (0 W) and how it clears. STYLE.md now says so, and the test applies it by colour.
+2. **Figures left the rows, not the product.** The reason texts (freeze, sign, circulating, delivery, peak guard) carry reason codes and limits; they stay on the ERROR/WARNING log line and the event list, as before. Rows keep the numbers a reader acts on: the stall age and the 0 W deadline, the meter age and limit, asked and sent for an over-rating, the peak limit, and "opposite for 12 of 60 seconds" while a check counts. So 2a item 2 ("also on the status row") no longer holds, and DOCS.md says "in the add-on log".
+3. **No entity id on any row**, even the green ones that used to print `sensor.x = 54`. The sensor rows name the setting (*Battery power for inverter-b*). Solar sources are numbered in the order of the settings list (*source 2 of 3*, *entry 1 of the reversed-sign list*). This retires TEL-12's rule that a one-entity site reads 0.11.0's sentence byte for byte. A `tools/tel11_pv_trace.py --compare` against a pre-UX-08 tree therefore shows the PV rows as changed telemetry, and the control documents stay equal. The per-source watts and units left the multi-source row. The total, the count and which source is missing remain.
+4. **UX-07 item 1.** `ClampWatchdog` now also counts `over_rating` and `bound` separately. After an episode, each count shows under its own alarm's title ("Power request too high: 2 times since start, not now", "Battery is not keeping up: …"). A site with both gets two amber rows where it had one.
+5. **The "Not ready" banner** is the first red row's own `banner`, or else its first sentence. The peak-reserve and over-rating rows set `banner` to their notification title. The three trips keep their own banner branches, reworded (e.g. "Inverters worked against each other. Every inverter is set to 0 W.").
+6. **How a latch clears stays on the row**, shortened: "Only starting control clears this", "A restart does not clear this", "only stopping and starting control clears this" (not delivering). SAFETY-25's sentence stays on the peak-reserve row.
+7. **Rows got an `id`** (`meter_frozen`, `direction`, `pv`, …), so tests find a row by what it is, not by its words. The page ignores it.
+8. **Left for later:** texts that rows embed from other modules and that were not flagged as rows (the month-peak line, `peakguard.explain()`, the liveness and stale notes, `shadow.banner()`). The month-peak row only lost its semicolons.
+
+# UX-09: fixes after the phase 2a test
+
+1. **The Details link follows the Home Assistant version.** HA 2026.2 added the built-in `app` panel (core #157554, frontend #28245), whose add-on pages are `/config/app/<slug>/documentation`. 2026.5 stopped registering the `hassio` panel, so `/hassio/addon/<slug>/documentation` is a 404 there (TEST-23, HA 2026.9.1). 2026.1 and older have only the old path. The one path valid on both, `/_my_redirect/supervisor_addon?addon=<slug>`, opens the Info tab, not Documentation. So the add-on reads its slug (`GET /addons/self/info`) and the HA version (`GET /info`) at start, and picks the path. An unknown version gets the current path. The hostname stays as a fallback for the slug. Phase 2a item 7 is replaced by this.
+2. **Shadow mode says "would".** The over-rating alarm and row said "sent X W" while 0 W was on the wire, and the peak alarm said "the battery is giving all it can". Both now take `shadow=`, and in shadow mode say what would have been sent and that the inverters stay at 0 W. Severity, id and cadence do not change with the mode.
+3. **"Controller" is gone from texts.** "The add-on" names who decides, and "control" names what it does, as in the existing "start control". The add-on is what the reader sees in Home Assistant, and "controller" was easy to confuse with the control board.
+4. **One term per setting, matching its label.** Four labels changed instead of the texts, because the texts' words were plainer: “Peak reserve (%)” (was "Peak guard will not discharge below"), “Battery level entity (%)” (was "Battery charge level"), and “Solar production entity / entities, per inverter / Reversed-sign solar entities” (was "PV …"). The Dutch labels already said "Zonneproductie". Option descriptions are phase 2c and were not changed, so some still say "PV".
+5. **The shadow banner and the inverter notes** are now `messages.banner_shadow()` and `row_no_setpoint` / `row_not_controllable` / `row_commands_refused`, so `test_messages.py` checks them. The red shadow banner no longer lists the latches, because 12 words cannot carry them. It says a safety stop stays on, and each latch keeps its own red row, which names it and says how it clears. The colour of a liveness row now comes from `is_live()`, not from matching "NOT COMMANDABLE" in the text.
+6. **DOCS "Notifications" and "Status page"** are written for a home owner, and the card ids, keys and log detail moved to a "For installers" part of each.
+
+# UX-08 phase 2c: refusals, error texts and option texts
+
+Validator refusals, the parse errors they carry, and every option name and description are now short. No rule, key, schema, default or exit code changed. Over 36 spoiled configurations the old and new validators refuse the same number of times. The allowlist went from 167 entries to 43, and only log lines (phase 2d) remain on it.
+
+1. **A refusal names the setting by its label and then its key**, as `messages.setting()` writes it: “Inverter rating” (max_w). The key has to stay, because `configui.problems_by_field()` shows a reason beside every key its text names. A test checks each label against en.yaml. A few reasons no longer mention keys they only named in passing, such as `price_markup_eur_kwh` in the withdrawn-provider reason, so the panel shows those reasons beside fewer settings. Each reason still names the setting that fixes it. A setting of one inverter in the list is written “Inverter rating” for inverter-b (inverters.max_w), so the panel shows it beside `inverters`, where that value is changed, and not only beside the flat `max_w` that a list does not read.
+2. **Citations moved to DOCS.** Option descriptions say "Measured value, leave it unchanged" or similar, and the record behind the value is under "For installers: where the numbers come from". The UX-01 citation check in `test_translations.py` now checks the tab for that instruction and DOCS for the record.
+3. **What left the refusals:** the shipped default in the peak-reserve reason, the superseded-default note in the levy-table reason (DOCS already covers it), the endpoints of the withdrawn providers (DOCS "Energy price providers"), the plant measurement behind `slew_w` (DOCS, beside the setting), and the leg-specific paragraphs of the tariff-formula errors. Each reason keeps the rejected value, the limit and what to change.
+4. **Not rewritten:** errors that only a code defect can raise, such as plugin-contract and argument-type checks in `price.py`, `price_forecast.py`, `static_tariff.py`, `arbitrage.py` and `main.py`, which a home owner never reads. INFO lines such as the tariff-formula preview were also left.
+
+# UX-08 phase 2d: log lines, the rest of the status page, and DOCS
+
+The allowlist is empty and its cap is 0 (43 → 0). Every WARNING and ERROR line is one plain line of at most 25 words, with no card ids, capitals or semicolons (the semicolon rule now covers log lines too). **Unchanged:** every log level, every trigger and cadence, every notification id, every row's colour and when it shows, the banner cascade, and every refusal count.
+
+1. **No code prefixes on log lines.** Nothing outside the repositories greps them, except `/home/homelab/clampwatch.sh`, a one-off site watch from 2026-09-05 that greps `OUTPUT_CLAMP` and `Engagements so far`. `OUTPUT_CLAMP` is still in the reason the line quotes; "Engagements so far" is now "Cut back N times so far". The tests that found a line by its card id (`SAFETY-37`, `SAFETY-44`, `CONTROL LOOP DIED`, `UNGRADED`) now find it by its words.
+2. **Reason texts keep their codes.** A line quotes a watchdog's reason (`%s`), such as `STALE_READING: …` or `OUTPUT_CLAMP: …`. Those are the evidence an installer searches for and many tests pin them, so they were not rewritten. The line around them is plain.
+3. **Reasoning moved to DEBUG, not deleted,** for the 10 lines marked DROP-to-DEBUG (for example the 14 768 W history behind the over-rating alarm, why SAFETY-42 reports and does not act, and the Eneco card advice). The 25-word line keeps the action and the numbers. SAFETY-57's promise stays on the ERROR line, as an ordered pair: "until it changes, or 17 s after the command drops below 250 W".
+4. **The line under the buttons** showed the newest raw action-log entry (`OUTPUT_CLAMP …`, `FAILSAFE …: SIGN_DISAGREEMENT`, `ALLOCATOR …`). Each `log_event()` call now also names a plain hint from `messages.HINTS`, and the page shows that. The action log itself is unchanged, because tests and later analysis read it, and the page no longer shows it. It stays reachable as `events` in the `status` JSON (review of #136), because some entries are written nowhere else: a dropped inverter's reason, the unplaced watts, the peak guard's projection and the shadow decision.
+5. **The top table.** *Why* is `messages.why()`: the arbiter's winner and limit in words ("Keeping the grid near zero: 440 W, held back by the peak limit"). `self.reason` keeps `Resolution.explain()` for the log and the checks. *Tariff*, *Price history*, *Arbitrage* and *Shadow mode* keep every figure TARIFF-11 and SAFETY-47 put there, each in its own slot, in words. Labels: *Battery level*, *Solar production*, *Power request*.
+6. **The month-peak row became two rows**, because one sentence of 15 words cannot hold the peak, its time, its share of the limit and TARIFF-13's coverage figure. The store's state at start (`restore_state`) left the row: it is the INFO line at start.
+7. **The peak guard rows** name the projection first and the limit second, as before (SAFETY-38). The blind row says what it means for the owner: the battery does not charge until the period can be measured again.
+8. **Wording that changed meaning-carrying words**: "command and meter point opposite ways" is now "the power went the wrong way" (banner) and "…went against what the add-on asked" (row). The N=1 banner still names the meter, the N≥2 texts still say "own power". The inverter range reads "up to 5 000 W each way" instead of "-5 000 W to 5 000 W".
+9. **Refusals are counted as shown.** Setting placeholders are expanded to label and key, and the long cases the 2c test found are driven through the validator. Seven refusals were shortened. The card refusals no longer show `c_eur_per_kwh`, `vat_pct` or "its own card", and a text that does not parse says "not valid near character N" instead of the parser's words. A missing value shows as *empty*, not `None`.
+10. **The panel's key match** no longer files `inverters.max_w` under the flat `max_w`.
+11. **The Supervisor question at start** is one INFO line with a real reason (a timeout's own text is empty, so the error type is named).
+12. **DOCS**: a glossary ("Words used on this page") explains control board, isolator and Developer Tools once. Card ids left the headings and sit on a *For installers* line under each. The links to the renamed headings were updated.
+
+# UX-10: the last plain-language leftovers (after the 2d test)
+
+**Unchanged:** every safety behaviour, every alarm's log level (WARNING and ERROR stay), every notification id, trigger and cadence, the banner cascade, and every row colour except the meter row right after a start (item 6).
+
+1. **Why the 2d scan missed the clamp lines.** Part 3 reads a log call's own literal and counts `%s` as one word. The clamp lines are `"…software fault: %s …"`, and the text in `%s` was built elsewhere, by `loop_clamp_note()` and `ClampResult.describe()`. So the scan passed a line whose logged text had a semicolon, "BUG SIGNAL", "clamped" and "1 times". The same was true of every quoted reason. Part 6 closes the gap. It lists every dynamic part of every WARNING+ line as data (a number, a name, a path, a library's own error text) or as a built text, and a new part in neither list fails. Each built text is produced by the real code (the watchdogs, `decide()`, `loop_clamp_note()`, `MigrationReport.explain()`) or, for a family of builders, by every template of it (`PriceRead.no_data`, `Gate.block`). The text and the line as logged are then checked. A mutation shows the 2d clamp text is caught on both clamp lines.
+2. **A quoted reason gets the red-alarm shape**, 3 sentences of at most 30 words, and not the 25-word line limit. It is the evidence behind an alarm, and it keeps its code and its limits, which the owner asked to keep. The alarm shape is STYLE.md's existing rule for the texts behind a safety stop, so no new limit was made up. Rewritten: `OUTPUT_CLAMP` (both kinds), `METER_FROZEN`, `CIRCULATING_POWER`, `STALE_READING` (SAFETY-56's two explanations and "cannot tell which" kept, in order), the peak guard's reasons, the state-migration report, the price feed and price history reasons, and the maintenance and trading gate reasons. "Software fault" left the clamp reason, because the ERROR line around it already says it.
+3. **Codes are one token.** `PEAK GUARD`, `PEAK GUARD FLOOR-LIMITED` and `PEAK GUARD BLIND` read as capitals, so they are now `PEAK_GUARD`, `PEAK_GUARD_FLOOR_LIMITED` and `PEAK_GUARD_BLIND`, like `OUTPUT_CLAMP`. Nothing in admin/goodwe or in the scripts under `/home/homelab` greps them (checked). `/home/homelab/clampwatch.sh` greps `OUTPUT_CLAMP`, which stays.
+4. **Top table.** *Price history* writes "96 prices over 24 hours for 26 Sep", joined by commas. *Tariff* writes the spacing as "one every 15 minutes or every hour". "Not final yet" was dropped, because a plan is provisional exactly when it holds an estimated price (`n_carried` counts the provisional points), so the estimated count already says it.
+5. **Levels and noise.** The shadow line of every cycle is DEBUG, and "Shadow mode is on/off" is INFO: it follows a setting or a button, and the banner, hint and event are unchanged. aiohttp's access log is on only at log level debug. A settings warning is logged once per start (a filter on `goodwe.config`, WARNING only, so refusals are untouched), because the validator runs twice at start. When Home Assistant restarts, `hass.Outage` says so in one WARNING line for the REST API and the meter websocket together, puts the library's text on DEBUG, and says at INFO when both answer again. INFO lines lost "§8.3", ISO timestamps, "banked" and "keys ARE", and error texts lost "NOT_OBSERVED", "did NOT land" and "AND".
+6. **Display bugs.**
+   - "Why: Other" during a latched per-inverter stop: `main.py` turns a safety winner into its claim's reason, and "sign disagreement" (and "unsplit", main.py's own refusal to split) had no entry in `WHY_WINNER`. The mapping is now `main.why_key()`, and part 7 finds every `Claim.set()` in the code and checks that every key it can produce has words.
+   - Red "Meter: no reading for 0 seconds" after a restart: until the first reading arrives, `P1Ingest.stale` is true, and the age is the time since start. The row now reads amber "waiting for the first reading" while that age is inside the limit. **Colour change, justified:** red at 0 s contradicted the limit the same row prints, and once readings exist the row is red only past that limit. Amber, not green, because control waits for the reading. Past the limit it is red as before. `stale` itself, which gates control, is unchanged.
+   - "A reading is missing for 0 seconds" stuck at 0: with the meter reading gone, the grid value stops changing, so the loop runs a cycle only every `cycle_floor_s`, and the line was computed once per cycle. The age is now counted when the page asks. The hold and its 15 s escalation are unchanged.
+7. **Review: the line as logged gets the shape too.** Part 6 first checked the quoted reason alone, so a title, a 2-sentence reason and two tails still logged as 4 sentences ("Power request too high …: OUTPUT_CLAMP: … +5000 W. The command this cycle was +1000 W. Control is still running. Cut back 1 time so far."). Part 6 now also checks the whole line: at most 3 sentences, none over 30 words. The wrappers became one sentence each, the circulation and peak guard reasons two, and `STALE_READING`'s fixed limits moved from the reason to a DEBUG line beside the ERROR (its release clause stays, pinned by test_freshness). The clamp lines for one inverter are pinned at 30 words at most: `OUTPUT_CLAMP: computed +9000 W, cut to the +5000 W rating, command now +2000 W`. Several clamped inverters read as one sentence of asked/sent pairs; which limit bound each is on its own action-log row and in the notification. Totals above 30 words remain on the direction, delivery, frozen-meter and stale lines (up to 74 words). Shortening them is a follow-up: the direction and delivery reasons are also persisted in state.json, and the direction one is pinned byte-for-byte in test_watchdog.
+8. **Home Assistant 400 while it loads** now reads "Home Assistant refused number.set_value for number.x (error 400, no details). The entity may still be loading, or the value is out of range." A body with more than "400: Bad Request" is still quoted. Still WARNING, still once a minute, still a failed write.
+9. **Witness** (admin/goodwe): the resolved push says "after no answers from … to …", as the resolved card does. The YAML with every title and message stripped is identical.
+
+# UX-11: safety log lines give the code, the figures go to DEBUG
+
+**Unchanged:** every trigger, latch, threshold and alarm log level (the WARNING and ERROR lines stay), every notification id and cadence, every row colour and the banner cascade. No notification is added.
+
+1. **One plain sentence and the code.** A WARNING/ERROR line that reports a safety reason (direction, delivery, stuck meter, stale reading, peak guard, circulation, over-rating) now ends in the reason's code, taken by `messages.reason_code()`. The reason itself, figures and limits included, is on a DEBUG line logged right after it ("Evidence for inverter-a: …"), and the action log entry carries it as before. Part 6 checks that pairing in the code. Circulation and the clamp lines were not among the five named, but they break the same 25-word rule, so they follow the same pattern. The clamp numbers stay in the notification (phase 2a item 3).
+2. **The reasons and `state.json` are unchanged.** `reason` stays the evidence text, so what is saved has the same format as before. An old state file therefore loads and displays like a new one: every saved reason has opened with its code since it was first written (checked in the git history), and that code is all the ERROR line reads. The saved text goes on the DEBUG line. A stop saved without a reason shows `REASON_NOT_SAVED`. `test_messages.py` part 7 restarts from a state file holding the old long texts. `test_watchdog.py` pins the meaning (the code first, then command, reading, time and both limits, in that order) and, since the text did not change, still the bytes.
+3. **The 25-word rule is checked as logged.** Part 6 fails any WARNING+ line over 25 words with its built text filled in. Nine non-safety families still run long (tariff plan words, price feed reasons, the state migration report, write refusals and claim scope errors that only a software fault raises, maintenance, trading gate and price history reasons). They are listed with a reason in `LONG_LINE_OK`, capped at 9, and a listed family that gets shorter fails until it is removed. Shortening them is a follow-up.
+4. **The meter row's "the add-on log shows why" is now true.** When the meter goes quiet past its limit, the add-on logs one WARNING per episode, not one per cycle, and an INFO line when readings return. A meter that flaps (on `ha_signed` a healthy meter under a flat load can go 42–97 s between changes) logs at most one such pair per 10 minutes, and the episodes in between go to DEBUG. This is a new log line, not a new alarm: it has no notification and changes no decision.
+5. **The Why line past the 15 s hold** names the missing reading ("No usable meter reading for over 15 seconds: 0 W", or the battery power or level of an inverter), instead of "A reading is missing: 0 W".
+6. **Action log:** "25 engagement(s)" is "25 engagements", and "SHADOW MODE OFF - …" is "Shadow mode off: …". "SHADOW MODE ON" was not named in the card and is left as it is.
+7. **Review: after a restart the figures go on the action log too.** `log_level` defaults to `info`, so the DEBUG evidence line is not seen by default, and `events` starts empty. Each restored stop (direction per inverter and site, delivery, circulation) now also writes its saved reason to the action log ("FAILSAFE inverter-a, saved before the restart: …"), and the page's event line gets the same plain words the live stop gives. `LONG_LINE_OK` also refuses a key whose text is a safety reason, not only a `reason_code` key.
diff --git a/goodwe_controller/DECISIONS/UX-13-one-layout-table.md b/goodwe_controller/DECISIONS/UX-13-one-layout-table.md
new file mode 100644
index 0000000..72118a4
--- /dev/null
+++ b/goodwe_controller/DECISIONS/UX-13-one-layout-table.md
@@ -0,0 +1,104 @@
+# UX-13 — one layout table, and why UI code may now name an option key
+
+**Status: DECIDED 2026-09-27 (owner approved the UX-13 design and mockup).**
+Card 6ab979852f3eca02fb40f69e. Amends [[UX-02]] §3.1. Design note and
+mockup: `goodwe-session/UX-13-design.md`, `UX-13-mockup.html`.
+
+## 1. What UX-02 said, and why it no longer fits
+
+UX-02 built the configuration panel from the Supervisor's schema, so
+`app/configui.py` contains "no option key, no label and no rule", and
+test_selfconfig.py part 5 checks that the page script names no key. That kept
+a second copy of the option surface from drifting, and it is why the panel is
+a flat list of fields in schema order.
+
+UX-13 needs things a schema cannot say: groups and sub-groups, a slider in kW
+for a value stored in W, a picker for an entity, a field shown only for one
+meter source, locked measured values, a Simple view and a setup wizard. It
+also needs page fields that are not options at all: one inverter card that is
+stored as six flat keys, solar rows that become `pv_entity` or `pv_entities`,
+a contract and two prices that become `static_profile` JSON, and a region
+that becomes the levies figure. None of that can be read off the schema, so
+some code has to name option keys.
+
+## 2. The decision
+
+Option keys may appear in UI code in exactly two files:
+
+- **`app/uilayout.py`**, the layout table: screen → group → part → field, with
+  control, unit, display scale, step, entity kind, when it is shown, whether it
+  is on the Simple view or a wizard step, and whether it applies now or after a
+  restart. Every option in `config.yaml` is a field, `DERIVED` or `HIDDEN`,
+  exactly once.
+- **`app/uimodel.py`**, the derivations the table names: `options_to_ui()` and
+  `ui_to_options()`. It may name only the keys it writes.
+
+What UX-02 made authoritative stays authoritative:
+
+- **Ranges** come from the schema (`uilayout.range_of()`); the table writes
+  none. A unit holds no digit.
+- **Labels and help** come from `translations/*.yaml` by key. Page-only fields,
+  group titles and choices are in `app/ui_text/*.json`, held to STYLE by
+  test_messages.py.
+- **Rules** stay in `validate.py`. It gains a warning tier (`validate.Note`,
+  "warn" or "info") for the page. A note never blocks a save, and passing the
+  notes list does not change the refusals returned.
+- **The stored blob** is still the one truth. The page model carries the stored
+  values of every derived key (`keep`). A derivation whose page fields are
+  unchanged writes those values back untouched, so a blob the page cannot
+  express survives a save of another field.
+
+## 3. How it is held
+
+- test_uilayout.py fails when `config.yaml` gains an option, or an inverter
+  field, that the table does not place. It also checks that uimodel.py names
+  only the keys it writes and that web.py and haentities.py name none.
+- test_uimodel.py round-trips options → page model → JSON → options for every
+  validator call the suite made at 652097a (`scenarios/ux13/`), the TEST-23
+  option files and config.yaml's defaults. All must be identical.
+- `tools/ux13_validator_calls.py compare` runs those calls through the old and
+  new validator. At P0: 261 calls, 158 refused, no refusal changed.
+- test_selfconfig.py part 5 still checks the old page script; P1 moves the page
+  into `app/static/` and the same check applies there.
+- P2: the Installer view (`app/static/settings.js`) draws from
+  `app/uipage.py`, which serialises the table and names no key itself
+  (test_uilayout part 5, test_settings part 2). The view posts its page model
+  to the existing `/config/validate` and `/config/save`, which turn it into
+  options with `ui_to_options()` before the shipped validator runs. No route
+  was added.
+- P4: the setup wizard draws the same model by each field's `wizard` step.
+  Its tables (`KETTLE`, `SHADOW`) are in `uilayout.py`, and its live checks
+  are rules, so they are in `validate.py` (`setup_checks`). settings.js still
+  names no key. See [[UX-13-setup-wizard]].
+- P5: the page words are in `app/ui_text/en.json` and `nl.json`, one key set,
+  loaded by `app/uitext.py` with an English fallback per key. The page picks
+  Dutch when the browser's language is `nl`, as the classic page does. Home's
+  sentences moved from `homeview.py` into `home_words`, so `/status?lang=nl`
+  builds them in Dutch. Status rows, banners, hints and validator sentences
+  (`messages.py`, `validate.py`) stay English: they are shared with
+  notifications, the log and the start refusal. `test_ui_text.py` checks both
+  files against STYLE.md and each other, using the rules in
+  `tools/style_rules.py`, which it shares with test_messages.py.
+- P5: "Other time windows" is a list editor (`ui.periods`, control
+  `period_list`). `uimodel._periods_json()` builds `static_profile` and names
+  the first bad time, empty price, overlap or gap. Its tiling rule matches
+  `static_tariff._check_tiling`. A stored profile whose days the editor has no
+  choice for (for example "mon,wed") is still kept as stored and edited in the
+  Configuration tab. Supervisor 2026.08.0's `AppOptions` accepted all 133
+  wizard blobs, 17 of them with time windows
+  (`tools/ux13_wizard_blobs.py --supervisor`, run offline on 2026-09-28).
+- P3: Settings, Simple draws the fields the table marks `simple`, with an
+  optional `note` under each (words in `settings.simple.note`), plus the
+  batteries' switches and modes. Those are store state set through the
+  existing `/action` values, not options, so the table places no key for
+  them. The Batteries screen's Now, Today and Why lines are built in
+  `homeview.py` from what the add-on knows this cycle; the plan per mode is
+  OPT-11 P3/P4, so until then Today says "Not planned yet" when no block
+  is planned for the battery (`test_batteries_screen.py`).
+
+## 4. What this costs
+
+The table is a second place that knows the option surface, which UX-02 set
+out to avoid. The cost is bounded by the coverage test: an option added to
+config.yaml and not placed here fails CI, rather than silently missing from
+the page. Changing a key's type or range needs no change here.
diff --git a/goodwe_controller/DECISIONS/UX-13-setup-wizard.md b/goodwe_controller/DECISIONS/UX-13-setup-wizard.md
new file mode 100644
index 0000000..2fa8570
--- /dev/null
+++ b/goodwe_controller/DECISIONS/UX-13-setup-wizard.md
@@ -0,0 +1,101 @@
+# UX-13 P4 — the setup wizard, and when it opens by itself
+
+**Status: DECIDED 2026-09-28 (P4 dev; the design and mockup were approved
+2026-09-27).** Card 6ab979852f3eca02fb40f69e. Builds on
+[[UX-13-one-layout-table]]. Design note: `goodwe-session/UX-13-design.md` §1, §3.6.
+
+## 1. What the wizard is
+
+The Setup tab draws the Installer view's page model one step at a time: a
+field is on step *n* when its `uilayout.Field` says `wizard=n`. It uses P2's
+controls, `/config/validate` and `/config/save`. No route was added.
+`uilayout.py` holds what a field cannot say: the kettle table (`KETTLE`), the
+optional step and the shadow switch (`SHADOW`). Step 5 has no battery modes
+yet (OPT-11); it says they come later.
+
+A step moves on when no refusal is anchored to one of its shown fields
+(`uipage.step_problems`). A refusal on a hidden field, a field on no step or
+no field at all blocks the last step, which lists every refusal.
+
+## 2. When it opens by itself (`uipage.setup_needed`)
+
+The page opens `#setup` only when it is opened with no route, and only when
+`/config/model` gives a reason:
+
+- **`no_power_request`**: the stored options name no inverter to control.
+- **`first_start`**: this boot found no `/data/state.json` (`Store.fresh`), the
+  Store has no `setup_done` and no `auto` key, and control is not started.
+  `auto` is the key Start/Stop writes. Neither the startup gate's exit 78 nor
+  setup-only mode (UX-15) writes the Store, so a new install's first good boot
+  is fresh.
+
+"Never started" alone is not enough: both TEST-23 add-ons have `auto_start`
+off and no `auto` key, and one has run in shadow for weeks (review of PR #146,
+R1). So a Store read from a file is an old site, and it is never sent to the
+wizard. A new install that restarts before the page is opened is not sent
+either, and its Setup tab still works. A site that runs control, or ever
+started or stopped it, is never sent. Without a Store the answer is no. The wizard's save writes
+`setup_done` (an ISO time) to the Store. A save from the Installer view does
+not.
+
+**Decided since, in [[UX-15-setup-only-mode]] (owner, 2026-09-28):** a
+brand-new install ships `setpoint_entity: ""`, and it no longer exits 78. When
+naming no inverter is the gate's only refusal, the add-on serves the page in
+setup-only mode, which commands nothing, and the wizard opens with
+`no_power_request`. Setup-only mode writes no Store file, so the first-run
+rule above still holds for an install set up on the Configuration tab.
+
+## 3. The kettle test and the sign checks
+
+Step 1 reads the meter's entities now (`GET ha/entities?entity=`, one
+`hass.state()` read, in W) before and after a kettle is switched on. The
+change, not the sign, decides: a rise of at least 500 W keeps `meter_invert`
+off, a fall turns it on. For a net entity or import and export, a fall cannot
+be fixed by an option, so the step is not passed and the page says what to
+check. A meter the add-on reads itself (HomeWizard, MQTT) cannot be read by
+the page, so the test is skipped and Home shows the direction after the
+restart. The installer may skip the test, because a cloud can fake a fall;
+the last step then warns, and after a fall it says the reading went down.
+
+The battery and solar signs cannot be forced from the page, which never
+commands an inverter. The last step reports each battery's reading with its
+direction ("reads 800 W charging now, so check the inverter shows the same")
+and warns when a solar entity reads below zero without its "reads negative"
+switch. It also warns when meter + solar + battery, all known, add up to a
+house using less than -300 W: a battery sensor reversed while giving power.
+An idle or charging battery cannot be judged that way.
+
+## 4. The last step
+
+`validate.setup_checks()` sits beside the rules because it names option keys.
+It reads nothing itself: `web.py` passes a Home Assistant entity list at most
+5 s old, the running options, the running meter reading and today's price
+count. Tiers are ok, info, warn and bad. A power request entity missing from
+Home Assistant is **bad**, because a write to it is answered 200 (SAFETY-77)
+and only the entity list can tell. So is Home Assistant not answering, since
+the list is then unknown. The wizard does not save while anything is
+bad. It then saves through P2's path (`setup: "done"`) and asks for the
+restart as the second, confirmed request, with a dialog that names the 0 W.
+The shadow switch is on by default and writes `shadow_mode: on`, which holds
+every inverter at 0 W after a restart even if control is started. Off keeps the
+stored value, or `auto` if that was `on`. The switch goes only on the model the
+wizard posts, never into the page model the Installer view also saves.
+
+## 5. The stale save lists only what moved (P2 test, finding a)
+
+`/config/model` remembers the last 16 blobs it handed out, by fingerprint. On a
+stale save the add-on compares that blob with what is stored now, so the banner
+lists only the other surface's changes. `changed` (stored against the posted
+blob) is unchanged for the classic page's "theirs → mine" list. When the
+fingerprint was not handed out by this process, it falls back to `changed`.
+
+## 6. How it is held
+
+- test_setup.py: the steps and tables, the kettle logic (and the page's copy of
+  it), step blocking, the first-run rule on new and TEST-23 sites, the live
+  checks, the save through the P2 path, the stale fix, and the words.
+- tools/ux13_wizard_blobs.py produces every blob the wizard can save from a new
+  install and three TEST-23 sites (88 accepted by the shipped validator).
+  UX-15 added the shipped defaults as a start (setup-only mode). At P4
+  all 88 were accepted by Supervisor 2026.08.0's `AppOptions`, offline, 78
+  keys each.
diff --git a/goodwe_controller/DECISIONS/UX-15-setup-only-mode.md b/goodwe_controller/DECISIONS/UX-15-setup-only-mode.md
new file mode 100644
index 0000000..d733a4c
--- /dev/null
+++ b/goodwe_controller/DECISIONS/UX-15-setup-only-mode.md
@@ -0,0 +1,114 @@
+# UX-15 — setup-only mode: a new install serves the wizard
+
+**Status: DECIDED 2026-09-28 (owner decision; UX-15 dev).** Card
+6aba0053d27a32cb3f210dcc. Changes the CFG-01 startup gate and closes the open
+question in [[UX-13-setup-wizard]] §2. Amends [[UX-02-two-config-surfaces]] §4.
+
+## 1. The rule
+
+`config.yaml` ships `setpoint_entity: ""`, so a new install's options are
+refused by rule 1 of `validate_startup_config()`: no inverter to control.
+Until now that was exit 78 before any page was served, and the installer had
+to fill in the entity on the Configuration tab before the wizard could open.
+
+The add-on now starts in **setup-only mode** when, and only when
+(`setuponly.applies()`):
+
+- the options name no inverter at all: no flat `setpoint_entity` and no
+  `inverters` entry, and
+- rule 1's refusal (`no_power_request_problem()`) is the gate's **only**
+  refusal.
+
+In setup-only mode it serves the page, says it is in setup (banner, `/status`
+`setup_only: true`, a WARNING log line) and opens the wizard when the page is
+opened with no route (`setup_needed` is `no_power_request`). After the
+wizard's save and restart the normal gate applies to the saved options.
+
+## 2. What still exits 78, and why
+
+Everything else the gate refuses, including:
+
+- a complete configuration that is refused, e.g. `maintenance_charge_w` above
+  `max_w`;
+- no power request entity **and** any other refusal;
+- an `inverters` list whose entry has a blank power request entity.
+
+These are configurations somebody edited. The Configuration tab stored them,
+the log's refusal banner names each problem, and the tab is where they are
+fixed (UX-02 §4). Serving the wizard there would put a six-step setup in
+front of someone who needs to change one field. A narrow rule also keeps the
+setup-only decision to one comparison against one known sentence, so a new
+validator rule cannot widen it by accident: any other refusal fails the
+equality and exits 78.
+
+The cost: an installer who first sets, say, a DSMR meter with no entities on
+the Configuration tab and leaves the power request entity empty gets exit 78,
+not the wizard. The log then names both fields.
+
+## 3. Why it cannot command
+
+Setup-only mode builds nothing that commands. `amain()` branches to
+`setuponly.serve()` before the MQTT broker, the controller, the meter task and
+the tariff task are built, and it returns from there when the Supervisor
+stops it. What serves the page is `SetupOnly`, which holds no inverter.
+
+Three checks make it structural rather than a convention:
+
+1. **The HomeAssistant is read-only** (`HomeAssistant(read_only=True)`).
+   `call()` refuses before it sends anything, and every service call goes
+   through it: `number.set_value` (`set_number()`), notifications, all of
+   them. The flag is fixed at construction, and there is no setter.
+2. **`SetupOnly` refuses a HomeAssistant that can write, and `Controller`
+   refuses one that cannot.** So neither can be built on the wrong one.
+3. **`/action` answers 409** in setup-only mode, before
+   `handle_action()`. Start, Stop and the battery cycle do nothing.
+
+No MQTT client is created, so nothing is published. The page's other routes
+already read only, or write the add-on's own options (UX-02 §6).
+
+Setup-only mode writes no Store file. The wizard's save writes `setup_done`,
+as in any mode. So a new install that is set up on the Configuration tab
+instead still has a fresh Store on its first normal boot, and the first-run
+rule (UX-13 §2) sends it to the wizard as before.
+
+## 4. How it is held
+
+- `test_setup_only.py` part 1: when it applies, including the three exit-78
+  cases above. Part 2: the read-only write path refuses with nothing sent,
+  and the two constructors refuse. Part 3 boots the real `main()` on the
+  shipped defaults against a fake Supervisor and Home Assistant over HTTP and
+  logs every request: the page is served, `/status` says setup-only, Start
+  and the cycle get 409, and there are 0 service calls and no MQTT request,
+  also with `auto_start` on and a Store that says control was started. The
+  wizard's save is then booted: it passes the normal gate, does not open the
+  wizard again, and every write is 0 W (shadow). Part 4: the refused
+  configurations exit 78 and serve nothing.
+- Mutations, each red: `applies()` always false or always true, the
+  read-only refusal removed, the Controller's check removed, `amain()` giving
+  setup-only mode a writable HomeAssistant, `/action`'s 409 removed, and the
+  `return` after `serve()` removed.
+- TEST-23 (PR #147 review, 2026-09-28): the add-on image on the shipped
+  defaults and an empty `/data` made 0 service calls and no MQTT request in
+  3.5 minutes of setup-only mode, counted in both the stand-in and the rig
+  shim logs. The wizard save then passed Supervisor 2026.08.0's `AppOptions`,
+  and after the restart it ran in shadow: 11 of 11 writes were
+  `set_value 0.0`.
+
+## 5. The wizard fixes in the same card
+
+- **F1.** `/config/validate` converts what it can of a page model
+  (`uimodel.ui_to_options_partial()`), so a conversion error blocks its own
+  step beside its field and the live checks still run on the rest. A refusal
+  about a key the failed conversion writes is left out, because it would
+  judge the stored value. The save still refuses such a model (422, with
+  `steps`).
+- **F2.** A save from the page model sends `base`, the model it opened. The
+  add-on writes only the keys whose value differs from `base`, onto the blob
+  stored now (`uipage.only_edits()`). So "save again to keep yours" after a
+  409 keeps the other surface's changes. A key both surfaces changed takes
+  this page's value, which is what the second press after the banner means.
+- **Meter entity.** On the last step a meter entity Home Assistant does not
+  have is red, like a missing power request entity, so a skipped kettle test
+  cannot let it through. In the Installer view it stays a warning.
+- **Step 1 after a skip.** When the kettle test saw the reading fall and was
+  then skipped, step 1 says the reading went down. The skip stays (UX-13 §3).
diff --git a/goodwe_controller/DOCS.md b/goodwe_controller/DOCS.md
index 0ca2edb..2d0964b 100644
--- a/goodwe_controller/DOCS.md
+++ b/goodwe_controller/DOCS.md
@@ -4,8 +4,30 @@ Drives a GoodWe ES/BP battery inverter over its RS485 meter bus: holds net grid
 exchange at zero, and runs a monthly battery maintenance cycle so the BMS can
 balance cells and recalibrate its coulomb counter.
 
-Installers: read `FIELD-GUIDE.md` in the repository. It is not optional reading —
-it contains the commissioning gates and the failure modes.
+Installers: the printed field guide (`docs/GoodWe-RS485-Field-Guide.pdf`) is
+v0.1.0 and outdated; where it disagrees with this page, this page wins.
+
+## Words used on this page
+
+- **Control board**: the small computer on the inverter's meter cable. It
+  passes the add-on's power request to the inverter. If the add-on goes quiet
+  for about 30 seconds, it sets the inverter to 0 W by itself. (For
+  installers: a T-CAN485 board with an ESP32 chip on the RS485 bus.)
+- **Isolator**: the switch that cuts an inverter off from the mains. Switching
+  it off stops the inverter, whatever the add-on or the control board asks.
+- **Developer Tools**: the Home Assistant page that lists every entity and its
+  current value, on its *States* tab. Use it to check that a sensor the add-on
+  reads is really there and updating.
+- **Shadow mode**: the add-on makes every decision but sends nothing, so every
+  inverter stays at 0 W. Pages and notifications say what it *would* have done.
+- **Safety stop**: the add-on has set one inverter, or all of them, to 0 W and
+  keeps it there until you start control on the add-on page.
+- **Peak limit**: the 15-minute average grid use you want to stay under this
+  month, because your capacity tariff bills the highest one.
+- **Peak guard**: the part of the add-on that uses the battery to keep each
+  15-minute period under the peak limit.
+- **Peak reserve** and **battery cut-out level**: the charge the peak guard
+  keeps back, and the level where the battery switches itself off.
 
 ## Before you start
 
@@ -13,34 +35,45 @@ You need:
 
 - A GoodWe **ES / BP family** inverter (AA55 / RS485 meter-bus generation)
 - The vendor's meter-emulating controller **disconnected** from the bus
-- A T-CAN485 (ESP32) flashed with `firmware/goodwe-master.yaml`
+- A control board: a T-CAN485 (ESP32) flashed with
+  `firmware/goodwe-master.yaml`
 - A grid-power sensor already working in Home Assistant, updating every ~5–10 s
 
+After installing, turn on **Watchdog** on the add-on's Info tab. If control
+stops by accident, the add-on sets the inverters to 0 W and exits, and Home
+Assistant starts it again only when Watchdog is on. It is off by default.
+
 ## The safety model, in short
 
-The inverter **holds its last command forever** — it has no meter-timeout. So:
+The inverter **keeps its last power request forever**. It has no timeout of its
+own. So:
 
-- The ESP32 commands 0 W if this add-on stops refreshing for ~30 s, and keeps
-  commanding it.
-- This add-on commands 0 W when its inputs go missing, when you stop control,
-  and when it shuts down.
-- This add-on commands 0 W **and latches there** if what it is commanding and
-  what the meter reads point opposite ways for three minutes — see "The
+- The control board sets the inverter to 0 W if this add-on stops sending for
+  about 30 seconds, and keeps it there.
+- This add-on sets the inverters to 0 W when a reading goes missing, when you
+  stop control, and when it shuts down.
+- This add-on sets the inverters to 0 W **and keeps them there** if the power
+  goes the opposite way to what it asks for three minutes. See "The
   sign-disagreement failsafe" below.
-- The **optional RS485 e-stop** is the only thing that covers this machine
-  dying. Without it, a failed host leaves the battery latched at its last
-  command until someone intervenes.
-- This add-on **raises an alarm — and nothing more —** when the meter keeps
-  answering with a reading that never changes while the command sits at the
-  rail. See "The frozen-meter alarm" and, before you rely on it, "Capacity-tariff
-  exposure of the grid-following loop".
+- The **optional emergency stop** is the only thing that covers this computer
+  failing. Without it, the battery keeps its last power request until someone
+  steps in.
+- This add-on **raises an alarm, and does nothing more,** when the meter keeps
+  answering with a value that never changes while the battery is asked for
+  full power. See "The frozen-meter alarm" and, before you rely on it,
+  "Capacity-tariff exposure of the grid-following loop".
 
-**If anything looks wrong: stop the add-on.** That commands 0 W and the
-hardware holds it there.
+**If anything looks wrong: stop the add-on.** That sets the inverters to 0 W,
+and the control board keeps them there.
+
+*For installers: a crashed control task is SAFETY-61, see
+`DECISIONS/SAFETY-61-control-task-death.md`.*
 
 ## Configuration
 
-### ⚠️ There are TWO places to configure this add-on (UX-02)
+### ⚠️ There are TWO places to configure this add-on
+
+*For installers: card UX-02.*
 
 Since **UX-02** the ingress panel has a **Configuration** page of its own,
 beside Home Assistant's *Configuration* tab. Both edit the **same** settings —
@@ -103,7 +136,9 @@ One column, big targets, sections collapsed until you open them, and the
 refusals pinned where you cannot scroll past them. It is the screen for
 standing in front of the inverter.
 
-### What the Configuration tab actually shows you (UX-01)
+### What the Configuration tab actually shows you
+
+*For installers: card UX-01.*
 
 Since **UX-01** the add-on ships `translations/en.yaml` and `translations/nl.yaml`,
 so Home Assistant's *Configuration* tab renders human labels and a description
@@ -120,7 +155,7 @@ whole rendered list, in both languages.
 | **Order comes from `schema:`** | `App.schema_ui` is `UiOptions(...)(data["schema"])`, so the **schema half** of `config.yaml` decides the order the tab renders in — not the `options:` half |
 | **There are no section headers** | Add-on options are a flat list: no header primitive, no per-option advanced flag, no units on the input, no sliders. Grouping is approximated by **order** plus the `Group · ` prefix in each label, and by nothing else |
 | **Groups, in task order** | Hardware → Meter → Limits → Tariff → Maintenance → Safety → Advanced |
-| **The description says whether to touch it** | A number that was **derived** names the campaign it came from and says not to change it without re-deriving; a number that is genuinely yours (`max_w`, `peak_cap_w`) says **"THIS IS YOUR NUMBER"**; and `cycle_cost_threshold_eur`, which is neither, says it is an open product question |
+| **The description says whether to touch it** | One or two plain sentences. A measured or derived value says "leave it unchanged", a number that is genuinely yours (`max_w`, `peak_cap_w`) says "Your own number", and `cycle_cost_threshold_eur` says it is a product choice. Where each number comes from is under [For installers](#for-installers-where-the-numbers-come-from) |
 | **Dutch falls back per key** | `translations[your language]?.name \|\| translations["en"]?.name \|\| the raw key`. A key missing from `nl.yaml` degrades to English; a key present but wrong does not degrade at all |
 | **⚠️ The per-entry keys inside `inverters:` still render raw** | Measured, and negative. A list-of-objects becomes an `object` selector with `multiple: true`, and `ha-selector-object` labels its fields `fields[name].label \|\| name` — the converter sets no `label` and no `translation_key`. The `fields:` translations are shipped and validated (they are the shape Supervisor's own schema defines) but on frontend 20250925.1 they do **not** reach the screen. The `inverters` label and description themselves do |
 
@@ -128,6 +163,154 @@ whole rendered list, in both languages.
 option that does not exist, or an option with no translation, fails CI — in
 either direction, and the check is mutation-tested both ways.
 
+### Settings at a glance
+
+The label and description each setting shows on the Configuration tab, in tab order. `translations/en.yaml` is the source, and `test_translations.py` keeps this table in step with it.
+
+| Group | Setting | Key | What it does |
+|---|---|---|---|
+| Hardware | Inverter setpoint entity | `setpoint_entity` | The ESPHome number entity the add-on writes the inverter's power to. Leave it empty when you fill in the inverter list. |
+| Hardware | Battery level entity (%) | `soc_entity` | The sensor with the battery level in percent. Use the control board's own reading. |
+| Hardware | Battery power entity (W) | `batt_entity` | The sensor with this inverter's battery power. Positive must mean the battery is giving power. |
+| Hardware | Battery power sign is reversed | `batt_invert` | Switch this on only if your battery power sensor shows giving power as a negative number. |
+| Hardware | Inverter list | `inverters` | Leave it empty if you have one inverter. With two or more, add one entry per inverter, which replaces the inverter settings above. |
+| Hardware · Inverter list | Name | `inverters.name` | A short, unique name for this inverter, for example inverter-a. |
+| Hardware · Inverter list | Setpoint entity | `inverters.setpoint_entity` | This inverter's own ESPHome setpoint entity. Two entries may not use the same one. |
+| Hardware · Inverter list | Inverter rating (W) | `inverters.max_w` | The most power the add-on may ask of this inverter. The site total is the sum of the list. |
+| Hardware · Inverter list | Battery cut-out level (%) | `inverters.bms_soc_floor` | The level at which this battery's own management system stops giving power. Read it off the battery that is installed. |
+| Hardware · Inverter list | Battery level entity (%) (optional) | `inverters.soc_entity` | This battery's own level sensor. Leave it empty if this inverter has none. |
+| Hardware · Inverter list | Battery power entity (W) (optional) | `inverters.batt_entity` | This inverter's own battery power sensor. Leave it empty if it has none. |
+| Hardware · Inverter list | Battery power sign is reversed (optional) | `inverters.batt_invert` | Switch this on if this inverter's sensor shows giving power as a negative number. |
+| Hardware · Inverter list | Usable battery capacity (kWh) (optional) | `inverters.capacity_kwh` | This battery's usable capacity from its datasheet. Fill it in on every inverter or on none. The add-on then shares the work by the energy each battery has left. |
+| Hardware | RS485 emergency stop is fitted | `estop_fitted` | Switch this on if the emergency stop is installed. It only changes a warning on the status page. |
+| Hardware | Battery modes | `battery_modes_enabled` | Give each battery an on and off switch and a mode, set on the Batteries screen. |
+| Hardware | Solar forecast, today (kWh) | `pv_forecast_entity` | Optional. A forecast sensor with today's remaining solar energy, such as Forecast.Solar or Solcast. A battery then buys only what the sun will not give. |
+| Hardware | Solar forecast, tomorrow (kWh) | `pv_forecast_tomorrow_entity` | Optional. The same forecast for tomorrow. It helps plan a cheap hour before midnight. |
+| Hardware | Trust in the forecast (%) | `solar_trust_pct` | Forecasts are often too sunny. At 70 % the add-on plans with 7 of every 10 kWh forecast. |
+| Hardware | Solar production entity (W) | `pv_entity` | Optional. Your solar inverter's power sensor, positive while producing. The add-on records it and does not use it for control. |
+| Hardware | Solar production entities, per inverter (W) | `pv_entities` | Optional. Use one row per solar inverter instead of “Solar production entity” when you have several. If one stops reporting, no total is recorded. |
+| Hardware | Reversed-sign solar entities | `pv_invert_entities` | Optional. Add each solar entity above that reads negative while producing, spelled the same way. Its sign is flipped before adding up. |
+| Meter | Where the meter reading comes from | `meter_source` | How the add-on reads your meter. 'off' uses “Grid power entity” below, and only homewizard_local can spot a stuck meter. |
+| Meter | Grid power entity (W) | `meter_entity` | Used when the meter source is 'off'. Positive must mean drawing from the grid. |
+| Meter | Grid power sign is reversed | `meter_invert` | Switch this on if your grid sensor shows drawing from the grid as a negative number. |
+| Meter | Number of phases (1 or 3) | `meter_phases` | Must match your grid connection. Meter readings with a different number of phases are rejected. |
+| Meter | HomeWizard P1 address | `p1_host` | For homewizard_local only. The meter's address on your network, as host or host:port. |
+| Meter | Time between meter reads (s) | `meter_poll_s` | For homewizard_local only. The meter updates every 5 s, so lower gains nothing. Keep it well below “Reading too old after”. |
+| Meter | Reading too old after (s) | `meter_max_age_s` | After this a meter reading counts as missing. The “Missing inputs time limit” starts only after this one runs out. |
+| Meter | MQTT topic | `meter_mqtt_topic` | For mqtt_p1 only. The topic your meter readings are published on. |
+| Meter | Grid import entity (W) | `p1_import_entity` | The sensor for power drawn from the grid, never negative. The add-on works out the net value itself. |
+| Meter | Grid export entity (W) | `p1_export_entity` | The sensor for power fed into the grid, never negative. It pairs with “Grid import entity”. |
+| Meter | Signed net power entity (W) | `p1_net_entity` | For ha_signed only. One sensor that is positive when drawing from the grid and negative when feeding in. |
+| Meter | Import entities per phase (L1-L3) | `p1_phase_import_entities` | Optional, in L1, L2, L3 order. Needed for the peak limit on a three-phase connection, one entry per phase. |
+| Meter | Export entities per phase (L1-L3) | `p1_phase_export_entities` | Optional, in L1, L2, L3 order, next to the import entities per phase. One entry per phase. |
+| Meter | Net entities per phase (L1-L3) | `p1_phase_net_entities` | For ha_signed only. Optional, in L1, L2, L3 order, signed like “Signed net power entity”, one entry per phase. |
+| Limits | Inverter rating (W) | `max_w` | Your own number: the most power the add-on may ever ask of the inverter. Start low and raise it after commissioning. |
+| Limits | Battery cut-out level (%) | `bms_soc_floor` | The level where the battery's own management system stops giving power. Read it off your battery rather than copying a figure. |
+| Limits | Peak limit (W) | `peak_cap_w` | Your own number: the 15-minute average power the add-on keeps the grid under. Take it from your grid contract. |
+| Limits | Margin below the peak limit (W) | `peak_margin_w` | The add-on aims this much below the peak limit, so a 15-minute period that ends a little high still stays under it. |
+| Limits | 15-minute demand forecast entity (W) | `peak_forecast_entity` | Optional. A forecast of this 15-minute period's average power. Leave it empty and there is no peak limit. |
+| Limits | Peak reserve (%) | `peak_soc_floor` | Peak limiting will not draw the battery below this level, but ordinary use can. Derived value, leave it unchanged. |
+| Tariff | Dynamic price source | `price_provider` | Where prices come from. Choosing a source starts the price fetch, even with trading off. |
+| Tariff | Supplier markup (EUR/kWh) | `price_markup_eur_kwh` | Your supplier's margin. It is added only when the price source does not already include it. |
+| Tariff | Distribution, levies and VAT (EUR/kWh) | `price_taxes_eur_kwh` | Grid costs, levies and VAT per kWh, preset for Flanders. Check it against your own grid operator's rates. |
+| Tariff | Injection price (EUR/kWh) | `export_price_eur_kwh` | What you are paid per kWh fed into the grid, all in. It may be negative. |
+| Tariff | Fixed or day/night tariff | `static_profile` | Your fixed or day/night contract on one line, prices all in, as the documentation shows. Fill it in even on a dynamic contract, as the fallback. |
+| Tariff | Day/night levies and VAT | `price_taxes_profile` | Leave it empty unless your grid operator charges a different day and night rate, as in Wallonia and Brussels. Set this or the flat figure above, not both. |
+| Tariff | Your own tariff formula | `price_formula` | For custom_formula only. Type the numbers from your supplier's tariff card on one line, as the documentation shows. The add-on checks them against the card. |
+| Tariff | Your own injection formula | `price_export_formula` | Optional. The injection formula from your tariff card, in the same shape as your own tariff formula. Leave it empty to use the flat injection price. |
+| Tariff | Price CSV file | `price_csv_path` | For manual_csv only. Where in /share the add-on reads your price file. |
+| Tariff | Price feed URL override | `price_feed_url` | Leave it empty to use the source's own feed. An override is sent exactly as typed and often returns only one day. |
+| Tariff | Price look-ahead (hours) | `price_horizon_h` | How many hours of prices to ask the source for. |
+| Tariff | Price request timeout (s) | `price_timeout_s` | How long one request to the price source may take before it is given up. |
+| Tariff | Current price entity (older) | `price_now_entity` | The older way to get a price, used only to charge in a cheap window during maintenance. Do not combine it with a dynamic price source. |
+| Tariff | Average price entity (older) | `price_avg_entity` | The average the current price is compared with. Use it only with the current price entity, not with a dynamic price source. |
+| Tariff | Trade on the price spread | `arbitrage_enabled` | Charge in the cheapest hour and draw the battery down in the dearest, when the spread covers the cost. Turning it off does not turn the price feed off. |
+| Tariff | Battery cycle cost (EUR/kWh) | `cycle_cost_threshold_eur` | What one full battery cycle costs per kWh. A smaller price spread is not traded, and the value is a product choice, not a measured one. |
+| Tariff | Trading keeps at least (%) | `arbitrage_soc_floor` | Price trading will not draw the battery below this level. It is separate from the maintenance settings. |
+| Tariff | Trading charges at most (%) | `arbitrage_soc_ceiling` | Price trading will not charge the battery above this level. |
+| Maintenance | Run the monthly battery cycle | `maintenance_enabled` | Once a month, empty the battery deeply, charge it full and hold it there, so its level reading stays accurate. Off by default. |
+| Maintenance | Minimum days between cycles | `maintenance_interval_days` | The shortest gap between two maintenance cycles. |
+| Maintenance | Start hour | `maintenance_start_hour` | The local hour, 0 to 23, at which a due cycle starts. |
+| Maintenance | Draw-down rate (W) | `maintenance_discharge_w` | How fast the cycle empties the battery. Above “Inverter rating” it is cut back to the rating, and the cycle just takes longer. |
+| Maintenance | Recharge rate (W) | `maintenance_charge_w` | How fast the cycle recharges the battery. It must be at or below “Inverter rating”, or the add-on will not start. |
+| Maintenance | Draw down to (%) | `maintenance_soc_floor` | The level the monthly cycle empties the battery to. It is not the “Peak reserve”, and the two differ on purpose. |
+| Maintenance | Recharge up to (%) | `maintenance_soc_target` | The level the recharge aims for before the hold starts. |
+| Maintenance | Hold at full for (minutes) | `maintenance_hold_min` | How long the battery stays full so its cells can balance. |
+| Safety | Wrong-direction threshold (W) | `sign_disagree_w` | Part of the safety stop for an inverter pushing the wrong way. It counts only when command and meter reading both exceed this. Measured value, leave it unchanged. |
+| Safety | Wrong-direction time (s) | `sign_disagree_s` | How long a wrong direction may last before a safety stop sets every inverter to 0 W. Measured value, leave it unchanged. |
+| Safety | Per-inverter wrong-direction threshold (W) | `unit_sign_disagree_w` | For two or more inverters: the wrong-direction threshold for each inverter. Derived value, leave it unchanged. |
+| Safety | Per-inverter wrong-direction time (s) | `unit_sign_disagree_s` | For two or more inverters: how long one inverter may push the wrong way before it is set to 0 W. Derived value, leave it unchanged. |
+| Safety | Site wrong-direction threshold (W) | `site_sign_disagree_w` | For two or more inverters: the wrong-direction threshold for the whole site. Measured value, leave it unchanged. |
+| Safety | Site wrong-direction time (s) | `site_sign_disagree_s` | For two or more inverters: how long the whole site may push the wrong way before a safety stop. Derived value, leave it unchanged. |
+| Safety | Stuck meter alarm after (s) | `meter_freeze_s` | An alarm when the meter repeats one reading this long while the command is at full power, with homewizard_local only. Measured value, leave it unchanged. |
+| Safety | Opposing inverters threshold (W) | `circulation_w` | For two or more inverters: how much power one may push against another before it counts. Measured value, leave it unchanged. |
+| Safety | Opposing inverters time (s) | `circulation_hold_s` | For two or more inverters: how long they may push against each other before a safety stop. Derived value, leave it unchanged. |
+| Safety | Not delivering alarm after (s) | `delivery_hold_s` | For two or more inverters: how long one may fall short of its share before an alarm, which changes nothing. Derived value, leave it unchanged. |
+| Safety | Shadow mode | `shadow_mode` | The add-on makes every decision but keeps every inverter at 0 W. 'auto' does this while control is stopped, 'on' always, 'off' never. |
+| Advanced | Start control on boot | `auto_start` | Off by default. Leave it off until the site is commissioned, so someone presses Start after each restart. |
+| Advanced | Control gain | `gain` | How much of the remaining error control corrects each cycle. Measured on real hardware, do not raise it. |
+| Advanced | Largest change per cycle (W) | `slew_w` | How far the command may move in one cycle. 0 follows “Inverter rating” and is recommended. |
+| Advanced | Ignore errors below (W) | `deadband_w` | Errors smaller than this are ignored. Keep it small, since any resting point inside it holds. |
+| Advanced | Meter resting point (W) | `target_grid_w` | What the meter should show when nothing happens. A slight export avoids paying for tiny imports all day. |
+| Advanced | Command rounding (W) | `step_w` | The command is rounded to a multiple of this, so noise does not change it every cycle. |
+| Advanced | At-limit shortfall (W) | `saturation_w` | When an inverter delivers this much less than asked, it counts as at its limit. The per-inverter wrong-direction threshold is half of this. |
+| Advanced | Cycles at limit before freezing | `saturation_cycles` | How many cycles in a row at the limit before control stops building up error. Do not set it to 1. |
+| Advanced | Catch-up limit (W) | `integrator_max_w` | Limits how hard control keeps pushing while the battery falls behind. 0 means “Inverter rating”. Do not raise it above the rating. |
+| Advanced | Command refresh interval (s) | `heartbeat_s` | How often the command is sent again even when unchanged. Keep it well under the control board's own 30 s limit. |
+| Advanced | Missing inputs time limit (s) | `stale_input_s` | How long inputs may be missing before every inverter is set to 0 W. With a P1 meter it starts after “Reading too old after”. |
+| Advanced | Longest time between cycles (s) | `cycle_floor_s` | A deadline between control cycles that a healthy meter never reaches. Raise it only for a meter slower than about 10 s. |
+| Advanced | Log level | `log_level` | How much detail the add-on writes to its log. 'debug' and 'trace' are for finding a problem. |
+
+### For installers: where the numbers come from
+
+The Configuration tab keeps each description to one or two sentences. The detail that used to sit there is here, one entry per setting. A value marked *measured* or *derived* in its description came from the record named below; change it only after re-deriving it from a new measurement.
+
+When the add-on refuses to start, each reason names the setting by its label and then its key, for example “Inverter rating” (max_w), and adds the inverter's name when there is a list. The configuration panel shows a reason beside every setting it names.
+
+- **Battery power entity** (`batt_entity`): on the reference installation this is holding register 0x0518, read by the control board. The wrong-direction checks and the opposing-inverters alarm both grade each inverter against it.
+- **Inverter list** (`inverters`): empty means the single-inverter settings describe the one inverter you have. Filled in, the list replaces them and nothing is inherited: each entry names its own setpoint entity, rating and cut-out level, so no inverter is judged by another's numbers. “Inverter setpoint entity” must then be empty, and the add-on refuses to start when both are set. Each entry's name keys its own safety stop and records in the add-on's state, so two entries may not share one.
+- **Usable battery capacity** (`inverters.capacity_kwh`): read only to share the site target by the energy each battery has left rather than by its rating. The reference batteries are 5000 W with 15.36 kWh and 4600 W with 20.48 kWh, so the two ways of sharing give the work to different batteries. Stated on some entries and not others, the add-on refuses to start.
+- **Solar production entities** (`pv_entity`, `pv_entities`, `pv_invert_entities`): measurement only, no control behaviour changes. The unit is read off each entity, so a sensor without one is refused rather than guessed. With several entities, one that stops reporting gives no site total at all, because a partial sum looks like a real one. Setting `pv_entities` ignores `pv_entity`.
+- **Where the meter reading comes from** (`meter_source`): 'off' keeps “Grid power entity”. ha_dsmr follows the DSMR integration, mqtt_p1 reads an MQTT topic, ha_signed reads one signed entity (what a HomeWizard P1 publishes), and homewizard_local polls the meter's own local API. Only homewizard_local can tell "the meter did not answer" from "the value did not change", so the stuck-meter alarm only means something there.
+- **Grid import and export entities** (`p1_import_entity`, `p1_export_entity`, `p1_net_entity`): the add-on computes net power itself, so the sign convention lives in tested code rather than in a template sensor.
+- **Number of phases** (`meter_phases`): a reading whose phase count disagrees is rejected and logged as it arrives, so a wrong value shows up at once. The range accepts 2, which is not a real Belgian connection.
+- **Time between meter reads, Reading too old after** (`meter_poll_s`, `meter_max_age_s`): the add-on refuses to start if the poll interval is at or above the age limit. 30 s is six polls of headroom at the default 5 s. The reading-age limit on its own does not command 0 W. “Missing inputs time limit” starts after it, so the two add up.
+- **Inverter rating** (`max_w`): your own number, not a derived one. It is not read when the inverter list is filled in, since each entry carries its own and the site limit is their sum. Several safety thresholds must stay below it, and the add-on refuses to start if one does not.
+- **Battery cut-out level** (`bms_soc_floor`, `inverters.bms_soc_floor`): measured, not chosen. Register 0x0560 reads 10 % on the reference GW5000S-BP. It exists so the add-on can refuse a “Peak reserve” at or below it, which could never take effect. Each inverter entry states its own, because one default for two different batteries protects the shallower one with the deeper one's number.
+- **Peak limit** (`peak_cap_w`): your own number, from your grid contract. In Belgium it is the capacity-tariff peak your distribution charge is billed on.
+- **Margin below the peak limit** (`peak_margin_w`): 50 W by default, 0 to 500 W (SAFETY-79). Peak limiting aims at the peak limit minus this margin, because a 15-minute period aimed exactly at the limit can end a watt or two over it (3501.9 W against 3500 W in a test), and even 1 W over sets the billed peak. Once this month's peak is already above the limit, it aims the same margin below that peak. The bill, this month's peak and the warnings still compare against the peak limit itself. 0 aims at the limit, as before.
+- **Peak reserve** (`peak_soc_floor`): derived, not picked (SAFETY-24). The reference battery holds 13.8 kWh usable and the worst modelled peak day asks for 878 Wh, or 6.4 %. 20 % sits ten points above the cut-out level and leaves about 1.6 worst days of room. It bounds peak limiting only: ordinary use goes on down to the cut-out level. It must stay above “Battery cut-out level”.
+- **Dynamic price source** (`price_provider`): selecting a provider is what starts the fetch, every half hour, whether or not trading is on. It may not be combined with the two older price entities. engie_dynamic, totalenergies_dynamic and eneco_eddy are withdrawn and refuse to start: their endpoints never existed. They stay in the list only so such a site gets that explanation.
+- **Supplier markup** (`price_markup_eur_kwh`): under manual_csv, whose prices are all in, it is ignored and logged as ignored.
+- **Distribution, levies and VAT** (`price_taxes_eur_kwh`): 0.11736 EUR/kWh, derived in TARIFF-18 from the Eneco residential card for Flanders of September 2026 with 6 % VAT: Fluvius distribution for Antwerpen 5,35 plus excise 4,876 plus green power and CHP levy 1,51 c/kWh. Check it against your own DSO: across the eight Fluvius areas distribution runs from 5,28 to 6,70 c/kWh, so the Flemish total runs from about 0.117 to 0.131. Changing it moves no trading decision, because the same amount lands on every hour. It does move every price shown, and the rule that refuses to draw the battery down into an hour priced below zero. See [What `price_taxes_eur_kwh` is made of](#what-price_taxes_eur_kwh-is-made-of-and-why-yours-is-different).
+- **Day/night levies and VAT** (`price_taxes_profile`): for Wallonia and Brussels, where distribution has a day and a night rate (ORES 13,27 against 7,39 c/kWh, AIESH 15,17 against 8,21, Sibelga 9,39 against 7,10). The figures are levies alone, added to the market price. The add-on refuses to start if it and the flat figure disagree. See [Levies and VAT by time of day](#levies-and-vat-by-time-of-day-price_taxes_profile).
+- **Injection price** (`export_price_eur_kwh`): one number because no supplier here publishes a dynamic injection curve. In Belgium it is often near zero, and at a sunny midday it can be negative.
+- **Fixed or day/night tariff** (`static_profile`): the periods must cover every day type exactly once with no gap and no overlap, and a gap is refused rather than filled. A window 22:00-07:00 on mon-fri does not cover Saturday morning, so a weekend row is required. See [Static day/night and fully-fixed tariffs](#static-daynight-and-fully-fixed-tariffs-static_profile).
+- **Your own tariff and injection formula** (`price_formula`, `price_export_formula`): type the card's numbers in the card's units. The `card` block is required on the tariff formula: the add-on recomputes the card's example price and refuses to start if it does not come out. Injection is VAT-exempt in Belgium, so `vat_pct` there is normally 0. See [Your own tariff formula](#your-own-tariff-formula-custom_formula) and [`price_export_formula`, field by field](#price_export_formula-field-by-field).
+- **Price feed URL override** (`price_feed_url`): only a host the chosen source declares is accepted. Nothing is added to the URL, not even the date range, so an override often returns one day and the rest of the plan is carried over and excluded from trading. The log warns on every refresh.
+- **Current and average price entities** (`price_now_entity`, `price_avg_entity`): kept because removing them would take the maintenance cycle's only price signal away from a live site.
+- **Trade on the price spread** (`arbitrage_enabled`): off as shipped, on purpose, because it moves energy against the meter by design. It needs a price source and a P1 meter, and the add-on refuses combinations that cannot work.
+- **Battery cycle cost** (`cycle_cost_threshold_eur`): wear plus conversion losses. It is not derived from a measurement: 0.10 is a product decision still open with the owner (OPT-08). At this value a fixed day/night site does not trade, since a realistic Belgian day/night spread is about 0.08 EUR/kWh.
+- **Trading keeps at least, Trading charges at most** (`arbitrage_soc_floor`, `arbitrage_soc_ceiling`): kept apart from the maintenance levels, so one setting does not couple two unrelated policies.
+- **Draw-down and recharge rate** (`maintenance_discharge_w`, `maintenance_charge_w`): the draw-down rate above the rating is cut back, not refused. A recharge rate above the rating would ask for more than the limit allows and resolve to 0 W, so maintenance would never charge. That is why the add-on refuses it.
+- **Draw down to** (`maintenance_soc_floor`): the monthly cycle goes this deep on purpose, while “Peak reserve” is a depth peak limiting never reaches. 11 % against 20 % is why they are two settings.
+- **Wrong-direction threshold and time** (`sign_disagree_w`, `sign_disagree_s`): measured, not chosen (SAFETY-02). On the captured healthy day (2026-08-23) signs agree on 93.4 % of gated samples, on the fault day (2026-08-20) 0.0-10.5 %, with opposed runs up to 1752 s. The longest legitimate opposed run is 30 s, and the fault day still trips 13 times at 300 s, so 180 s sits in a wide gap. The threshold must stay below “Inverter rating”.
+- **Per-inverter wrong-direction threshold and time** (`unit_sign_disagree_w`, `unit_sign_disagree_s`): two or more inverters only. Derived from 1890 closed-loop test runs (SAFETY-30) with nothing faulty. 250 W is half the at-limit shortfall. 85 s is 8.5 times the worst legitimate opposition (10.0 s) and 2.8 times the control board's 30 s link limit.
+- **Site wrong-direction threshold** (`site_sign_disagree_w`): the single-inverter 300 W carried across deliberately (SAFETY-30), because near zero the sign is noise whatever is behind the one meter.
+- **Site wrong-direction time** (`site_sign_disagree_s`): derived from the same 1890 runs (SAFETY-30). The worst legitimate opposition at 300 W is 110 s with one inverter and 215 s with two, so 180 s would false-trip. 325 s is 1.51 times that and inside the 900 s billing period.
+- **Stuck meter alarm after** (`meter_freeze_s`): measured, not chosen (SAFETY-18). Over 2399 s of this house at its operating point, the longest run without a new reading is 15.4 s, and 300 s is 19.5 times that. It raises an alarm only and does not set 0 W.
+- **Opposing inverters threshold** (`circulation_w`): measured on 924 closed-loop test runs (SAFETY-31). The worst legitimate opposition drops from 505 s at 100 W to 5 s at 400 W, the lowest value accepted. 700 W is 1.75 times that knee, with margin because the second inverter is still a copy of the first.
+- **Opposing inverters time** (`circulation_hold_s`): derived (SAFETY-31). 75 s is fifteen control cycles, 15 times the worst legitimate episode, and 2.5 times the control board's 30 s link limit.
+- **Not delivering alarm after** (`delivery_hold_s`): two or more inverters only. It reports only (SAFETY-42): nothing is commanded differently. Derived from 2640 closed-loop test runs with nothing faulty. The worst legitimate episode is 35.0 s and 185 s is 5.29 times that. The schema allows 30 s, below that, so expect false reports there. A battery at or below its own cut-out level is never reported, and neither is one that gives under 100 W (SAFETY-73: it is a battery that refuses). Re-derive with admin/goodwe `sim/delivery_window.py --campaign --blag`.
+- **Shadow mode** (`shadow_mode`): the whole decision path runs and nothing reaches the inverter. The status page and action log show what would have been sent. A safety stop that is already up stays up. See [Shadow mode](#shadow-mode-shadow_mode).
+- **Control gain** (`gain`): measured on real hardware and already at the limit.
+- **Largest change per cycle** (`slew_w`): 0 means follow the rating: about a ninth of it, derived (SAFETY-39) from a measured ~18 s step response against a 2 s meter tick. A fixed value faster than the rating allows is refused. At 1000 W against a 5000 W rating control swung the meter from 3.4 kW export to 2.8 kW import on 2026-09-05.
+- **Ignore errors below, Meter resting point** (`deadband_w`, `target_grid_w`): the meter's import counter bills every positive watt, so a resting point at 0 W leaks about half the deadband as billed import, roughly 0.2-0.35 kWh a day at 15 W. -10 W moves that leak to export.
+- **At-limit shortfall** (`saturation_w`): the per-inverter wrong-direction threshold is derived as half of it, so moving this moves that argument too.
+- **Catch-up limit** (`integrator_max_w`): measured on the closed-loop simulator with a 4000 W load dropped to zero: at a limit equal to the rating the command is 1000 W two cycles later, at 1.5 times the rating 1800 W. Lowering it is the useful direction.
+- **Command refresh interval** (`heartbeat_s`): the control board refuses a link that has been quiet for 30 s.
+- **Longest time between cycles** (`cycle_floor_s`): keep it under “Reading too old after”, since past that there is no reading left to act on.
+
 ### Sources
 
 | option | required | meaning |
@@ -139,8 +322,9 @@ either direction, and the check is mutation-tested both ways.
 | `batt_invert` | | Flip if needed |
 | `capacity_kwh` | | This pack's usable capacity. Read only to divide the site target between packs by **energy** headroom — see below |
 | `setpoint_entity` | yes | The ESPHome `number.*_goodwe_setpoint_w` |
-| `pv_entity` | | Optional. **One** solar inverter's power sensor, `+` = producing. Measurement only — it changes no control behaviour. See [PV production](#pv-production-pv_entity-tel-11) |
-| `pv_entities` | | Optional. **Several** solar inverters, one row each — use this instead of `pv_entity` when your roof has more than one. Setting it **ignores** `pv_entity`. See [Several PV inverters](#several-pv-inverters-pv_entities-tel-12) |
+| `pv_entity` | | Optional. **One** solar inverter's power sensor, `+` = producing. Measurement only — it changes no control behaviour. See [PV production](#pv-production-pv_entity) |
+| `pv_entities` | | Optional. **Several** solar inverters, one row each — use this instead of `pv_entity` when your roof has more than one. Setting it **ignores** `pv_entity`. See [Several PV inverters](#several-pv-inverters-pv_entities) |
+| `pv_invert_entities` | | Optional. The PV entities above that read **negative** while producing; each one's sign is flipped. See [The sign](#the-sign-and-pv_invert_entities) |
 
 Use the ESP32's readings rather than the inverter's cloud or dongle sensors:
 those serve cached values, and a stale reading here ends the maintenance charge
@@ -165,12 +349,14 @@ inverters:
     soc_entity: sensor.goodwe_a_soc
     batt_entity: sensor.goodwe_a_battery_power
     max_w: 5000
+    bms_soc_floor: 10
     capacity_kwh: 15.36
   - name: inverter-b
     setpoint_entity: number.goodwe_b_setpoint_w
     soc_entity: sensor.goodwe_b_soc
     batt_entity: sensor.goodwe_b_battery_power
     max_w: 4600
+    bms_soc_floor: 10
     capacity_kwh: 20.48
 ```
 
@@ -190,16 +376,18 @@ inverter's own **AC** power. If it is DC the AC-side ceiling is nearer 4324 W.
 | `name` | yes | Short identifier. It namespaces this unit's SAFETY-02 latch, heartbeat and write bookkeeping in the add-on's state file, so **two units may not share one** |
 | `setpoint_entity` | yes | This inverter's own ESPHome `number.*_goodwe_setpoint_w` |
 | `max_w` | yes | The supervised cap on what may be written to **this** inverter. The site's ceiling is the **sum** |
+| `bms_soc_floor` | yes | This pack's own BMS cut-out percent (SAFETY-32). See [`bms_soc_floor`](#tariff-all-optional) |
 | `soc_entity` | | This pack's state of charge |
 | `batt_entity` | | This unit's battery power, `+` = discharging |
 | `batt_invert` | | Flip if needed |
+| `capacity_kwh` | | This pack's usable capacity. State it on every entry or on none — see [OPT-09](#how-the-site-target-is-divided-between-the-packs) |
 
 ⚠️ **Nothing is inherited.** An entry that leaves out `soc_entity` has **no SoC
 sensor** — it does *not* fall back to the flat one. That is deliberate: every
 per-device value became per-instance in 0.5.x precisely so that no inverter is
 ever graded against a sibling's numbers, and a silent fallback would rebuild
-that in YAML. `name`, `setpoint_entity` and `max_w` are required of every entry
-for the same reason: there is no rating to borrow.
+that in YAML. `name`, `setpoint_entity`, `max_w` and `bms_soc_floor` are required
+of every entry for the same reason: there is no rating or cut-out to borrow.
 
 ⚠️ **Clear the flat `setpoint_entity` when you declare a roster,** or the add-on
 refuses to start and says so. It is the single-inverter form and it is not read
@@ -235,7 +423,9 @@ in the log rather than silent, but it is an outage until someone puts the
 single-inverter entity back in that field. **Before downgrading, write down the
 `setpoint_entity` of the unit you want to keep running.**
 
-#### How the site target is divided between the packs (OPT-09)
+#### How the site target is divided between the packs
+
+*For installers: card OPT-09.*
 
 Two packs do not get half each **from 0.8.0 onwards**. ⚠️ **On 0.7.0 and every
 version before it the split is a fixed 50/50 regardless of what either pack can
@@ -328,6 +518,51 @@ two of a thing there is one of, and `P1 sample age` is a safety input. Same for
 status, the maintenance phase, the capacity-tariff peak and the three loop rows
 below.
 
+### Battery modes (`battery_modes_enabled`)
+
+Off by default. Turn it on, restart the add-on, and the Batteries screen (and Settings, Simple) gives each battery two controls. They apply at once, with no restart.
+
+- **On or off.** Off asks the battery for 0 W and starts no monthly cycle on it. A cycle that is running stops, and the add-on log says so. The peak limit may still use it, but only for what the other batteries cannot cover.
+- **Mode.**
+  - *Solar first* charges from spare solar before the other batteries and covers the house at any hour. It never charges from the grid and never sells.
+  - *Leftover solar* charges from the solar the others cannot take. With a solar forecast it may also charge from the grid, but only what the sun will not give (see below). It saves its power for the expensive hours and covers the house then.
+  - *Cheap hours only* charges from the grid in the cheapest hours, saves its power for the expensive hours and covers the house then.
+- **Selling** is off until it can be judged on the price the grid pays (owner decision 2026-09-29, option A).
+
+With battery modes on, these choices replace the *Charging and selling on price* switch (`arbitrage_enabled`); that switch is only read with modes off.
+
+**Cheap and expensive hours.** They come from the published day-ahead prices, as runs of consecutive 15-minute periods, not a single period.
+- The cheap run is the cheapest stretch long enough to fill the batteries that may charge, at their power.
+- An expensive hour costs at least *Battery cycle cost* (`cycle_cost_threshold_eur`, widened as for trading) more than the cheap run. The batteries hold their power until then.
+- The sale uses the most expensive stretch inside those hours, and never a period below 0.
+- A carried (not yet published) price is never used. A run that has started runs to its end.
+- With no prices, or too small a gap, every battery follows the house.
+
+**Solar forecast** (`pv_forecast_entity`, optional). A Home Assistant sensor with the solar energy still to come today, in kWh. These work: Forecast.Solar (`sensor.energy_production_today_remaining`), Solcast PV Forecast (`sensor.solcast_pv_forecast_forecast_remaining_today`) and Open-Meteo Solar Forecast (`sensor.energy_production_today_remaining`). Set `pv_forecast_tomorrow_entity` to the matching *tomorrow* sensor to plan a cheap run before midnight.
+- Before each cheap run the add-on asks: will the sun fill the batteries before the expensive hours? It counts on `solar_trust_pct` of the forecast (70 %), less what the house uses. Solar first batteries get that sun first.
+- *Leftover solar* then charges from the grid only the shortfall: what the house will draw from it in the expensive hours, less its share of the sun. Not up to the top level.
+- *Cheap hours only* ignores the forecast and fills to the top level.
+- *Solar first* never charges from the grid.
+- The house use is the add-on's own measurement (grid + battery power) per hour, over the last 7 days. It needs one day of it before the first plan.
+- The plan is checked every 15 minutes. A planned level moves only by 1 kWh or 10 %, so a wobbling forecast does not flip it.
+- No forecast, one older than 3 hours or from before midnight, or no house use yet: *Leftover solar* takes solar only and *Cheap hours only* fills to the top level. The Batteries screen says so.
+- A battery needs its capacity (`inverters.capacity_kwh`) for a plan.
+
+**What always comes first.**
+- The peak limit, the safety stops and the monthly cycle come before a battery's mode.
+- A grid charge is sized so the 15-minute period stays under the peak limit less its margin (`peak_margin_w`). It starts only at 500 W or more. Once the peak limit stops it, it stays off for the rest of that 15-minute period.
+- While one battery charges from the grid, the others rest, and the house uses the grid.
+- While one battery empties for its monthly cycle, no battery charges from the grid.
+- A battery that refuses to charge or give power takes no part in a run in that direction.
+
+**In Home Assistant.** With MQTT set up, each battery also gets a *Mode* list and a *Use* switch, for example `select.goodwe_inverter_a_mode` and `switch.goodwe_inverter_a_use`. They do the same as the Batteries screen. Turn battery modes off and restart, and they are removed.
+
+*For installers:* commands arrive on `goodwe_ctl/unit/<battery>/mode/set` (a *Mode* option, such as `Solar first`) and `.../use/set` (`ON` or `OFF`). They go through the same checks as the Batteries screen. A refusal is logged once, and later refusals are counted in the log. A retained command is never applied, so the broker cannot replay an old choice after a restart; the add-on keeps the last choice itself.
+
+*For installers:* a mode is a limit at priority 35, kept apart from the hard limits. It gives way only as far as a limit above it (the peak guard) needs. A mode range always holds 0 W, so a mode can forbid a direction and never force one. With one inverter the mode also bounds the loop. The record is `DECISIONS/OPT-11-battery-modes.md`.
+
+*For installers:* when a charge or sale ends, the loop restarts at the house's own level rather than at the trade's watts. On the replay model that removes a ~3 kW import spike after a 2.5 kW charge and halves the settling time; about 0.1 × the battery's power still overshoots as export. The *Mode* list gains *Cheap hours only* in Home Assistant, at the end.
+
 ### Reading the grid-following loop: `Loop integrator`, `Loop integrator lead`, `Loop reason`
 
 The control law is a bounded integrator: an accumulator that is **not** the
@@ -342,7 +577,7 @@ accumulator is doing:
 | `Loop integrator lead` | W | that value minus **the command it was computed against**, i.e. the command the previous cycle left standing |
 | `Loop reason` | — | the law's own word for this cycle |
 
-`Loop reason` takes one of eight values:
+`Loop reason` takes one of eleven values:
 
 | value | what happened |
 |---|---|
@@ -353,11 +588,42 @@ accumulator is doing:
 | `slew-limited` | the command could not move as far as the integrator asked for; `slew_w` is what stopped it |
 | `saturated-freeze` | the inverter is not following, so the command's magnitude may fall but not rise |
 | `freeze-released` | the freeze had run out of plant-shaped explanations and the command was let move again |
+| `mode-bound` | the batteries' limits set the command, not the meter: their battery modes, or, with two or more inverters, a battery in its monthly maintenance |
 | `not-running` | control is stopped **and** shadow mode is off, so the loop did not run |
+| `battery refuses` | the battery gave less than 100 W for 12 cycles (a minute at a 5-second meter) while asked for more than 500 W, so the add-on asks 0 W in that direction (see below) |
+| `battery probe` | the add-on asks 200 W to test whether a refusing battery gives power again |
+
+**When the battery refuses.** At its cut-out level the battery gives nothing,
+whatever it is asked. The add-on then asks 0 W instead of repeating its last
+request, and the `Why` row reads *The battery refuses to give power: 0 W*. Every
+15 minutes it asks 200 W for about half a minute. Control resumes as soon as
+the battery gives 100 W or more, when the grid needs charging instead, and when
+control is stopped or started. 200 W is below the 250 W the stale-reading check
+needs, so a test never trips it. A battery that gives some power, even 100 W,
+is not refusing and keeps its request.
+
+**With two or more inverters** the same rule works per inverter. An inverter
+whose battery gives less than 100 W for 12 cycles, and at least 22 s, while
+asked for more than 200 W is asked 0 W, and the other inverters take over its share, each up to
+its own limits. The status page names it: *inverter-a: the battery refuses to
+give power, the others take over*. It is tested at 200 W every 15 minutes, one
+inverter at a time, and only while the site asks at least 200 W that way.
+It still accepts charge, and 12 cycles of charging end the refusal. When every
+inverter refuses the same way, the whole site asks 0 W as with one inverter.
+If the battery refuses to give power while its level reads above its “Battery
+cut-out level”, the log adds one warning ending in `REFUSES_ABOVE_CUT_OUT`: check that setting.
+A battery that refuses is not reported as *not delivering*.
+
+*For installers:* SAFETY-52 and SAFETY-73. The event log reads
+`BATTERY REFUSES …` and `BATTERY REFUSES ENDED …` (with the inverter's name at
+N>1), and the INFO line ends in `BATTERY_REFUSES`.
+`DECISIONS/SAFETY-52-a-battery-that-refuses.md` has the replay figures and
+`DECISIONS/SAFETY-73-refusal-per-inverter.md` the two-inverter ones.
 
 ⚠️ **`Loop reason` is not the `Why` row on the status page, and the two will
-often disagree.** `Why` is the *arbiter's* sentence — `loop -> -1200 W` — which
-names the strategy that won and the watts it won with. It has never carried the
+often disagree.** `Why` is the *arbiter's* answer in words — *Keeping the grid
+near zero: -1 200 W* — which names the strategy that won and the watts it won
+with. The log keeps the arbiter's own `loop -> -1200 W`. It has never carried the
 strategy's own reason, so a loop that is slew-limited or frozen says so **only**
 here.
 
@@ -415,10 +681,12 @@ and `Inverter B` — are two names to the validator and one id once slugged. The
 add-on gives the second one a `_2` suffix so nothing collides, but the ids you
 get then depend on roster order. Give your inverters plainly different names.
 
-### PV production (`pv_entity`, TEL-11)
+### PV production (`pv_entity`)
+
+*For installers: card TEL-11.*
 
 > **More than one solar inverter?** Use `pv_entities` instead — see
-> [Several PV inverters](#several-pv-inverters-pv_entities-tel-12) below. The
+> [Several PV inverters](#several-pv-inverters-pv_entities) below. The
 > rest of this section applies to both.
 
 
@@ -452,28 +720,24 @@ Only the third is a software defect, and **none of them can be told apart
 without a record of production.** This entity is that record. The attribution
 itself is OPT-10's, with a week of history behind it.
 
-#### The sign, and why there is no `pv_invert`
+#### The sign, and `pv_invert_entities`
 
-**Positive must mean producing.** That is the same convention as the two sign
-rules the add-on already ships — `meter_entity` is positive when **importing**
-and `batt_entity` is positive when **discharging**, both of which are "power
-arriving at the house" — and production arrives there too.
+*For installers: card TEL-14.*
 
-`meter_invert` and `batt_invert` exist because those two quantities are
-**bipolar and are read by the control path**: a reversed battery sensor is a
-perfectly plausible number that the per-inverter sign failsafe then acts on.
-Production is unipolar and is read by **nothing**, so a reversed sensor here
-cannot mislead a decision — and it announces itself immediately as −4 kW at
-noon in the very history this entity creates. A flag would only hide it, so
-there is not one. If your sensor really is inverted, fix it where it is
-produced.
+**Positive must mean producing.** Some sensors — typically a kWh meter or an
+ESPHome power clamp in the PV circuit — read negative while producing and a few
+watts positive at night: list each of those in `pv_invert_entities`, spelled as
+in `pv_entity`/`pv_entities`, and its sign is flipped before the sum; the status
+page marks it `[sign inverted]` and cautions on any entity reading below −50 W.
+History recorded before you set it keeps the old sign. See
+`DECISIONS/TEL-14-pv-sign.md`.
 
 #### The unit is read off the entity
 
 The add-on reads your entity's own `unit_of_measurement` and converts: `mW`,
 `W`, `kW`, `MW`, `GW`, `TW` — Home Assistant's own power units. A sensor with
 **no** unit, or with a unit that is not one of those, is **refused**, and the
-status page says which entity and which unit. That is deliberate: there is no
+status page says so (*the sensor has no unit*). That is deliberate: there is no
 magnitude test that can separate 30 W of dusk from 30 kW of noon, so a guess
 here would be a silent factor of 1000 in the one channel that exists to be
 believed a week later.
@@ -496,7 +760,9 @@ pictures, which is exactly the distinction the whole card exists to preserve.
 A failed read also **clears** the previous good one: the value never outlives
 its own sensor.
 
-### Several PV inverters (`pv_entities`, TEL-12)
+### Several PV inverters (`pv_entities`)
+
+*For installers: card TEL-12.*
 
 A multi-string or multi-orientation roof routinely carries **two or three PV
 inverters**, each publishing its own power sensor into Home Assistant. List them
@@ -530,7 +796,7 @@ about:
 |---|---|---|
 | all three reporting 1200 / 2100 / 450 W | `3750.0` | `PV  3 750 W` |
 | all three reporting, one of them **0 W** | `1650.0` | `PV  1 650 W` |
-| one of the three `unavailable` | `unknown` | `PV  —`, plus a caution naming which entity, why, and what the others reported |
+| one of the three `unavailable` | `unknown` | `PV  —`, plus a caution naming which source is missing |
 | all three gone | `unknown` | as above |
 
 **It does not publish the sum of the ones that answered.** Two inverters out of
@@ -542,8 +808,8 @@ it say something false. So the total goes to `unknown` and the recorder stores a
 gap, exactly as it does for a single dead sensor.
 
 The diagnostic is not thrown away — it is put where a person will see it. The
-status page names the entity that is missing, the reason, **and** what the
-others reported. That page is read live by a human who wants to fix something;
+status page names the missing source by its place in the `pv_entities` list
+(*source 2 of 3*). That page is read live by a human who wants to fix something;
 the recorded number is read cold by an analysis that would believe it.
 
 Note the **third row against the second**: a member honestly reporting `0 W` is
@@ -565,7 +831,7 @@ It is **instrumentation**. It is not an input to the control law, the
 allocator, the arbiter, the peak guard, the maintenance cycle or any watchdog;
 it is not part of `inputs_ok`, so a PV integration that breaks cannot stop the
 battery being regulated; and its status row is a **caution**, never a
-`NOT READY`. Wiring production into the control law would be a behaviour change
+*Not ready*. Wiring production into the control law would be a behaviour change
 on a system driving a real battery — and it would destroy the measurement,
 because the loop would then be reacting to the thing being measured.
 
@@ -600,7 +866,7 @@ than in YAML nobody reviews underneath a safety input.
 > `ha_signed`.** It reads the same meter and produces the same numbers, but it
 > polls the meter directly instead of watching a Home Assistant entity — and
 > that is the difference between an age sensor a watchdog can threshold and one
-> it cannot. See "`sensor.p1_sample_age_s`" below; `ha_signed` remains for
+> it cannot. See "`sensor.goodwe_p1_sample_age`" below; `ha_signed` remains for
 > installs where the meter is only reachable through Home Assistant.
 
 > ⚠️ **`ha_dsmr` and `mqtt_p1` have never processed a telegram from real
@@ -755,7 +1021,7 @@ connection-level reading is still accepted on its own.
 
 **Why this mode exists:** every HTTP response is an *arrival*. The meter
 answered, now, with its current reading — whether or not the number moved. That
-is the signal `sensor.p1_sample_age_s` needs and the one Home Assistant cannot
+is the signal `sensor.goodwe_p1_sample_age` needs and the one Home Assistant cannot
 give it at all (see the note below). It is also simply fewer moving parts: the
 five-second cadence is the meter's own, rather than an integration's polling of
 it re-published as a state change.
@@ -787,17 +1053,18 @@ repeats. Thresholding that at 30 s would rebuild the false-trip limit cycle at
 the exact operating point the controller aims for. Freeze detection is a
 separate problem and needs the low-power case solved first.
 
-You read it yourself instead: the add-on's status page shows it on the P1 line,
-as `… 4 rejected, measurement unchanged for 312 s`. On a house drawing real
+You read it yourself instead: the add-on's status page shows it on the Meter
+row, as `… 4 readings refused, unchanged for 5 minutes`. On a house drawing real
 power that figure stays in the seconds; minutes of it while the load is clearly
 not near zero is the meter to go and look at.
 
-#### `sensor.p1_sample_age_s`
+#### `sensor.goodwe_p1_sample_age`
 
 Published over MQTT discovery whenever a broker is available: **seconds since the
 newest accepted telegram**, refreshed every second rather than only when a
 telegram lands. The ESP32's stale-input watchdog subscribes to this exact entity
-id, so do not rename it.
+id; do not rename the `GoodWe` device or this entity, since HA composes the id
+from both (see [What appears in Home Assistant at two inverters](#what-appears-in-home-assistant-at-two-inverters)).
 
 The reason it is recomputed against the clock is that Home Assistant only pushes
 a state when the state *changes*. A meter sitting at a genuinely constant reading
@@ -833,7 +1100,7 @@ behind it would trip the firmware watchdog on a system that is working fine.
 > went **42.2 s and 97.0 s** between changes, and 23 Aug peaks at 29.1 s — all
 > past the default `meter_max_age_s` of 30.
 >
-> So `sensor.p1_sample_age_s` on `ha_signed` is safe to *read*, and it is
+> So `sensor.goodwe_p1_sample_age` on `ha_signed` is safe to *read*, and it is
 > correct whenever the value is moving, but it must not yet be thresholded by
 > the ESP32 stale-input watchdog: a quiet house would trip the battery to 0 W.
 > Raising `meter_max_age_s` is **not** the fix — the two conditions produce an
@@ -878,7 +1145,9 @@ behind it would trip the firmware watchdog on a system that is working fine.
 | `delivery_hold_s` | 185 | **Two or more inverters only.** How long one inverter may stand at a discharge share it is not producing - short by more than `saturation_w`, with no reason this add-on can read - while at least one sibling is **not** in that state, before it is named. **It reports; it does not act.** Nothing is commanded differently and the site goes on running short by that unit's share |
 | `shadow_mode` | `auto` | **Run every decision and command nothing.** `auto` = shadow mode while control is stopped, ordinary control once you press Start; `on` = shadow mode always; `off` = ordinary control. See *Shadow mode* below |
 
-#### Shadow mode (`shadow_mode`, SAFETY-10)
+#### Shadow mode (`shadow_mode`)
+
+*For installers: card SAFETY-10.*
 
 Shadow mode runs the **whole** decision path — the price strategy, the capacity
 guard, the maintenance shaping, the grid-following loop, the arbiter that ranks
@@ -1045,11 +1314,13 @@ If the setpoint this add-on is emitting and the grid figure it is regulating on
 point **opposite ways** — charging the battery while the house imports, or
 discharging it while the house exports — with both over `sign_disagree_w`, for
 `sign_disagree_s` **continuously**, the add-on commands **0 W** and holds it
-there. The banner reads `FAILSAFE`, the commissioning list says which two
-numbers disagreed and for how long, and the `Controller status` entity reports
-`failsafe`.
+there. The banner reads *The meter saw power go the wrong way*, the add-on
+log says which two numbers disagreed and for how long, and the `Controller
+status` entity reports `failsafe`.
 
-#### ⚠️ At two or more inverters this is TWO checks, not one (SAFETY-30)
+#### ⚠️ At two or more inverters this is TWO checks, not one
+
+*For installers: card SAFETY-30.*
 
 The paragraph above describes what a **one-inverter** install does, and it is
 unchanged: there is one meter, one actuator, and comparing the command against
@@ -1138,7 +1409,9 @@ agreement is 93.4 %; on the four captured fault clusters it is 0.3 %, 0.9 %,
 says so.
 
 
-#### ⚠️ A unit that stops DELIVERING is a third fault again (SAFETY-42)
+#### ⚠️ A unit that stops DELIVERING is a third fault again
+
+*For installers: card SAFETY-42.*
 
 The two checks above both key on **direction**. A unit sitting at **0 W against
 a non-zero share** has no direction: it is not pushing the wrong way, it is
@@ -1189,7 +1462,8 @@ start, because a `persistent_notification` is in memory and that is precisely ho
 the 2026-09-02 outage went unseen. It is cleared by pressing **Start**, like the
 other latches.
 
-The banner reads **`NOT DELIVERING — <unit> …`** as a *warning*, not a failure,
+The banner reads **`<unit> is not delivering. Control keeps running.`** as a
+*warning*, not a failure,
 and it **displaces** `Running — holding grid at zero`. That last sentence is a
 claim the site cannot make while a unit is absent, and a page that goes on
 reading healthy while the fault runs is the whole shape this check exists to
@@ -1245,7 +1519,9 @@ correct toward that wrong value instead of holding a stale command. It is bounde
 happened to a lying meter whose value merely jittered — bit-exact repetition was never a
 safety property.
 
-#### When the freeze lets go, and when it deliberately never does (SAFETY-13)
+#### When the freeze lets go, and when it deliberately never does
+
+*For installers: card SAFETY-13.*
 
 While the loop is frozen the command's **magnitude may fall but never rise**. That is
 the anti-windup rule, and at `prev_w == 0` it reads as a refusal to *start*: with
@@ -1364,7 +1640,7 @@ help - see "Why the tuning is what it is".
 | `maintenance_enabled` | false | Enable the monthly cycle |
 | `maintenance_interval_days` | 28 | Minimum gap between cycles |
 | `maintenance_start_hour` | 10 | Hour of day a due cycle begins |
-| `maintenance_discharge_w` | 2000 | Drain rate (exports the surplus). Above `max_w` it is **clamped** to `max_w` — the drain phase SETs the setpoint and the arbiter bounds it, saying so on the status page (`limited by supervised(max_w)`). Warned about, not refused: the cycle still completes, just slower |
+| `maintenance_discharge_w` | 2000 | Drain rate (exports the surplus). The peak guard may ask for more (SAFETY-83; at N≥2 while another battery is at its peak reserve, SAFETY-87). Above `max_w` it is **clamped** to `max_w` — the drain phase SETs the setpoint and the arbiter bounds it, saying so on the status page (`limited by supervised(max_w)`). Warned about, not refused: the cycle still completes, just slower |
 | `maintenance_charge_w` | 2000 | Charge ceiling, capped again by peak headroom. Must stay **at or below `max_w`** or the cheap-window shaping (`hi = -maintenance_charge_w`) contradicts the supervised limit (`lo = -max_w`), the arbiter resolves it to **0 W**, and maintenance silently never charges in a cheap window — **the add-on refuses to start** |
 | `maintenance_soc_floor` | 11 | Drain target — stay just above the inverter's own floor. ⚠️ **This is not `peak_soc_floor`.** It is the depth the monthly recalibration deliberately goes to, once, on purpose; `peak_soc_floor` is the depth a money-saving discharge may never reach on any day. The right values differ (11 vs 20 as shipped), which is why they are two keys |
 | `maintenance_soc_target` | 99 | Charge target |
@@ -1376,6 +1652,7 @@ help - see "Why the tuning is what it is".
 |---|---|
 | `peak_forecast_entity` | Quarter-hour demand forecast, for capacity-tariff markets. Empty = no cap |
 | `peak_cap_w` | The site's capacity-tariff target |
+| `peak_margin_w` (50) | Watts the peak guard aims under `peak_cap_w` (SAFETY-79). Reports and the bill use `peak_cap_w` itself |
 | `peak_soc_floor` (20) | **The percent below which the capacity-peak guard will not discharge the battery.** ⚠️ It bounds **the peak guard only** — it is **not a pack-wide reserve**, and ordinary self-consumption discharges straight past it (SAFETY-25, see below). Not optional and not the same thing as `maintenance_soc_floor` |
 | `bms_soc_floor` (10) | The pack's **own** cut-out percent, the number the BMS enforces whatever you set above. `peak_soc_floor` must be **strictly above** it or the add-on refuses to start. ⚠️ **At a declared `inverters:` roster this key moves INTO each entry and is REQUIRED there** (SAFETY-32): it describes a battery, and two packs of different models have different cut-outs, so one number for both protects the shallower pack with the deeper pack's BMS. Nothing is inherited — an entry that omits it is refused **by name** at startup, and the flat key below is then not read at all |
 | `price_now_entity`, `price_avg_entity` | Dynamic tariff. Empty = never force a paid grid top-up |
@@ -1385,6 +1662,19 @@ under `peak_cap_w`, and if the forecast goes over the cap the charge-only clamp
 is dropped so the battery can shave the peak instead. Money outranks the
 maintenance schedule.
 
+With two or more batteries, the one being emptied gives its drain rate and the
+others only add power when the house needs more; none charges while it drains
+(SAFETY-78). Below the drain rate the rest is exported, as with one battery.
+If the house would still go over the peak limit, the battery being emptied
+gives more than its drain rate, with one battery too (SAFETY-83).
+In a cheap window the battery being filled charges and the others only add
+charge; none gives while it charges. The charge is cut to what keeps the
+15-minute peak at the limit minus `peak_margin_w` (SAFETY-84).
+While a full battery rests after its charge (the hold), it gives just enough
+to keep the 15-minute peak at that aim if the house needs it; with two
+batteries the other one gives first. The hold still ends on its clock
+(SAFETY-86).
+
 #### Capacity-tariff exposure of the grid-following loop
 
 ⚠️ **This section described the exposure BEFORE SAFETY-07. The loop is now
@@ -1423,7 +1713,7 @@ What exists today, and what does not:
 | SoC guard on the loop | ❌ — the BMS is the only energy backstop |
 
 On the legacy `meter_source: off` path there are no P1 telegrams, so there is no
-quarter-hour average to guard, and the status page says **NOT COVERED**. There
+quarter-hour average to guard, and the status page says *Peak guard: off*. There
 the mitigation is still operational: set `max_w` no higher than the loop actually
 needs (the tuning was measured at 2000 W and a 1.78 kW load step is tracked fine
 there), fit the e-stop, and watch for the alarm.
@@ -1444,7 +1734,7 @@ is the design rather than an accident: it is 1.0 at the top of the quarter and
 grows, so the guard is gentlest when its projection rests on the least evidence
 and becomes aggressive only once the quarter is nearly measured.
 
-**The ceiling** is `peak_cap_w`, raised to the month's banked peak when that
+**The ceiling** is `peak_cap_w`, raised to this month's recorded peak when that
 already stands higher — once a month's bill is set at 5013 W, holding later
 quarters to 3500 W buys nothing and costs real charging. **That relaxation is
 granted only by an OBSERVED reading:** a peak store that cannot be read leaves the
@@ -1477,7 +1767,8 @@ control action and goes to the action log and the status page. A *saturated*
 guard — asking for everything the inverter has while the quarter is still
 projected over — raises one notification (`goodwe_peak_saturated`), because that
 is the one state where the money will be spent and shedding load is the only
-thing left that changes the bill.
+thing left that changes the bill. SAFETY-81 keeps a 1 s meter spike, noise and
+a quarter's last seconds from raising it: see `peakguard.load_too_high()`.
 
 **And it sizes a price-driven charge, not only a forced discharge (SAFETY-45).**
 The same arithmetic read the other way answers *"how hard may this site charge
@@ -1520,8 +1811,9 @@ exactly like the SoC drift the monthly maintenance cycle exists to correct.
   capacity-peak guard will not spend the pack for money below 20 %"*, and
   **nothing more**. See below for what that costs on a real evening.
 - **When it binds you are told**, once per episode, with notification
-  `goodwe_peak_soc_floor` and a status-page row reading `PEAK GUARD
-  FLOOR-LIMITED`: the quarter **will** go over the ceiling, so shedding load is
+  `goodwe_peak_soc_floor` and a red status-page row reading *Battery at its
+  peak reserve* (`PEAK_GUARD_FLOOR_LIMITED` in the log): the quarter **will**
+  go over the ceiling, so shedding load is
   the only thing left that changes the bill. Failing to shave is never silent —
   the euro figure is the whole point of the guard.
 - **An unreadable SoC is treated as floor-limited, not as a full battery.** A
@@ -1537,7 +1829,9 @@ Why 20 %: the reference pack is 13.8 kWh usable, so 10 points of margin over the
 BMS cut-out is about 1.6× the guard's worst measured day. If your pack is
 smaller, or your quarters are worse, raise it.
 
-#### ⚠️ What `peak_soc_floor` does **not** protect (SAFETY-25)
+#### ⚠️ What `peak_soc_floor` does **not** protect
+
+*For installers: card SAFETY-25.*
 
 **On a sustained-load evening this add-on will take your battery to the BMS
 cut-out, whatever `peak_soc_floor` says.** That is measured, not argued. Replayed
@@ -1560,7 +1854,7 @@ because the guard it bounds is not the thing doing the discharging.
 
 **And the two can happen in the same cycle.** On the high-load block of the same
 day (15:00–17:00 UTC) with the pack below the floor, the guard reports
-`PEAK GUARD FLOOR-LIMITED` — *"commanding no forced discharge"* — on 49 cycles,
+`PEAK_GUARD_FLOOR_LIMITED` — *"there is no forced discharge"* — on 49 cycles,
 and on **all 49 of them** the loop is simultaneously being granted a discharge of
 up to 2000 W by the arbiter. The status page is telling you the truth about the
 guard while the battery empties.
@@ -1625,7 +1919,9 @@ share no reason code, no notification id, no status row and no counter.
 running - this is not the sign-disagreement failsafe, which commands 0 W. You
 get a persistent notification (`goodwe_output_clamp`, replaced rather than
 stacked), an `ERROR` in the log with the reason code `OUTPUT_CLAMP`, a row in
-the event list, and a red status banner while it is engaged. Once it clears, a
+the event list, and a red status banner while it is engaged. The message quotes
+the command the loop computed and the value it was clamped to, both from the
+cycle that clamped. Once it clears, a
 warning row keeps the engagement count so the evidence does not vanish with the
 condition. Consecutive engagements share one event row carrying the exact count,
 because the event list keeps only 40 rows and a row per cycle would flush every
@@ -1634,9 +1930,11 @@ other guard's entries out of it.
 **There is nothing to configure**, deliberately. The bound is `max_w`, which you
 already set; giving the guard a limit of its own would be a second number that
 can disagree with the first, which is exactly the failure the startup validation
-exists to prevent. The alarm's cadence - first engagement, then re-asserted every
-30 s while it persists, cleared after 3 clean cycles - is fixed for the same
-reason `RAIL_FRAC` is: it describes the notification bus, not the plant.
+exists to prevent. The alarm's cadence - normally at most one notification per
+150 s (an episode that has not yet notified does so once it has engaged 3
+cycles in a row, and an over-rating has its own 150 s budget), cleared after 3
+clean cycles - is fixed for the same reason `RAIL_FRAC` is: it describes the
+notification bus, not the plant.
 
 WARNING: **on a default install the engagement you will see is the integrator's,
 not the output's.** The control law bounds the integrator to `max_w` and *then*
@@ -1645,6 +1943,26 @@ rating unless `integrator_max_w` has been deliberately raised above `max_w`.
 Both are watched. A guard that watched only the emitted value would be silent on
 every standard configuration.
 
+**The integrator bound is not a bug, and it is reported as what it is.** It
+reads *"the correction the add-on builds up reached its +5000 W limit,
+command now +2000 W"*, titled *"Battery is not keeping up"*, logged
+as a `WARNING`, with an amber (not red) status row and its own notification
+(`goodwe_integrator_bound`), so it never replaces a software-fault notice still
+on screen. Brief engagements after a large load or solar step are normal. If it
+stays engaged, check that the battery is following its commands. Only a command
+over the rating is logged as a software fault, at `ERROR`, and it has its own
+notification budget.
+Why: [`DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md`](DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md).
+
+The integrator bound counts only on a cycle the loop decided. While
+maintenance, the peak guard or a safety limit sets a battery to discharge, the
+same alarm fires only when that battery gives more than `saturation_w` less
+than the least it was told over the plant's settle time (at least 23 s), for
+`saturation_cycles` cycles. A charge is not graded: a full battery takes less
+as it tops up. At two or more inverters the loop does not wind while
+maintenance holds a battery.
+Why: [`DECISIONS/SAFETY-85-no-false-not-keeping-up.md`](DECISIONS/SAFETY-85-no-false-not-keeping-up.md).
+
 ### The frozen-meter alarm
 
 A meter that has died is easy — it stops answering, the sample age climbs past
@@ -1692,13 +2010,13 @@ the add-on UI.
 
 ⚠️ **Only `meter_source: homewizard_local` is covered.** It is the only transport
 that reads the meter's own document; on `ha_dsmr`, `mqtt_p1`, `ha_signed` and
-`off` there is no signal to threshold and the status page says **NOT COVERED**
-rather than pretending the guard is armed.
+`off` there is no signal to threshold and the status page says *Stuck-meter
+check: off* rather than pretending the guard is armed.
 
 The same row appears for a second reason: a setpoint device that reports a range
 from which no command magnitude is available in both directions leaves no rail
 to measure at all, and a 0 W rail would be satisfied by *every* command. That is
-reported as **NOT COVERED** too, and the detector stays silent rather than
+reported as *off* too, and the detector stays silent rather than
 degenerating into the bare "unchanged for N seconds" rule this design exists to
 avoid.
 
@@ -1715,7 +2033,9 @@ unchanged is 12 W, which is inside the 15 W deadband — so the command there is
 parked at 0 W and the two halves of the rule cannot both be true. At the schema
 floor of 60 s that figure is 60 W and only the margin is left.
 
-### The circulating-power alarm (SAFETY-31)
+### The circulating-power alarm
+
+*For installers: card SAFETY-31.*
 
 > **Only at two or more inverters.** At the shipped roster of one this quantity
 > is identically zero for every reading, no claim is ever filed, and the status
@@ -2182,7 +2502,9 @@ distinct state from "prices, all of them zero": the plan is marked provisional
 and arbitrage is disabled, per the degradation matrix. It never falls back to a
 price of zero, which would read as free electricity.
 
-#### The hours the feed has not published yet (FCST-04)
+#### The hours the feed has not published yet
+
+*For installers: card FCST-04.*
 
 A day-ahead auction publishes tomorrow's prices once a day, at **14–16 h CET**.
 Before that, the feed is serving today and nothing else — so a `price_horizon_h`
@@ -2225,29 +2547,29 @@ firm/provisional split whenever that split is what refused a trade. And
 since TARIFF-11 that row carries the provider plan itself:
 
 ```
-Tariff: no static profile (recomputed this tick); provider plan fetched 412 s
-        ago for a 48 h horizon: dynamic_dayahead from generic_dayahead,
-        60 points over 33 h, 36 firm / 24 carried, 900+3600 s spacing,
-        provisional
+Tariff: No fixed tariff set. Price plan from 412 s ago, for 48 hours ahead:
+        day-ahead prices from the price feed, 60 prices over 33 hours,
+        36 published and 24 estimated, one every 15 minutes or every hour
 ```
 
 ⚠️ **The two halves of that row are not computed at the same moment, and the
-row says so.** Everything before the semicolon is the static-profile or Home
+row says so.** Everything before "Price plan" is the static-profile or Home
 Assistant price-entity sentence, regenerated on the **30 s tick** from options
 alone — no network. Everything after it is the **background refresh's**
 resolution, which runs every 1800 s and is served for up to 5400 s before it is
-retired; `fetched N s ago` is the age of the fetch that produced it and is the
+retired; `Price plan from N s ago` is the age of the fetch that produced it and is the
 only figure in the row that tells you whether the feed is still answering. On a
 site with a provider configured and no usable plan the row says that too,
 rather than falling silently back to the static half.
 
 Read the plan half as five separate facts: which *product* the feed publishes
-and which *plugin* read it, how many **points** it carries and how many **whole
-hours** those points cover, how many of the points are **firm** (published for
-their own interval) against **carried** (filled from yesterday under §8.3), the
-**spacing** of the points in seconds — `900+3600` is the normal mixed steady
-state, quarter-hourly firm points beside hourly carried ones — and `provisional`
-whenever any point is carried.
+and whether it came from the feed or from your fixed tariff, how many
+**prices** it carries and how many **whole hours** they cover, how many are
+**published** (firm, for their own interval) against **estimated** (carried
+from yesterday under §8.3), and how far **apart** they are — "one every 15
+minutes or every hour" is the normal mixed steady state, quarter-hourly firm
+points beside hourly carried ones. The plan is provisional exactly when some
+prices are estimated, so the estimated count says it.
 
 ⚠️ **Points and hours are two different numbers and this row used to print one
 of them under the other's name.** `words` was `f"… {len(points)} h"`, so a
@@ -2422,7 +2744,9 @@ uses the result as a cheap-window hint for the maintenance charge. They are
 — configure two of them and the add-on refuses to start, naming the conflict,
 because the add-on reads exactly one and the loser is silent. Use one.
 
-### The three buckets — which price components can move a decision (TARIFF-17)
+### The three buckets — which price components can move a decision
+
+*For installers: card TARIFF-17.*
 
 **Read this before adding a price component of any kind.** The optimiser reads
 exactly two quantities off a price series, and nothing else:
@@ -2478,7 +2802,9 @@ Three consequences worth having in mind:
 is the only ORDER component the add-on has. Anything added next belongs in one
 of the three, and saying which is part of adding it.
 
-### What `price_taxes_eur_kwh` is made of, and why yours is different (TARIFF-18)
+### What `price_taxes_eur_kwh` is made of, and why yours is different
+
+*For installers: card TARIFF-18.*
 
 **It ships at `0.11736` EUR/kWh.** That is the all-in non-energy part of a
 Flemish residential bill — everything on your invoice that is *not* the energy
@@ -2636,6 +2962,12 @@ works under hourly pricing is an EMS for a minority. `static_profile` is how a
 two-period day/night tariff or a single fixed price becomes a first-class
 configuration rather than "turn the price feature off and hope".
 
+On the add-on page, choose **Other time windows** under Settings, Tariff and
+prices, or in Setup step 4. Add one row per time window, with its start, end,
+days and price. The page names any overlap, gap or empty price before you can
+save. You only need the JSON below for days the page cannot choose, such as
+Monday and Wednesday only.
+
 It is one option, holding a JSON object, on one line:
 
 ```json
@@ -2782,18 +3114,356 @@ it.
 | `estop_fitted` | Whether the RS485 e-stop is installed. Drives the warning banner |
 | `log_level` | `trace`/`debug`/`info`/`warning`/`error` |
 
+## Notifications
+
+The add-on tells you about a problem with a Home Assistant notification. Each
+one has a short title, one to three sentences, and a **Details** link to this
+page. The link opens the add-on's Documentation tab. Look for the section with
+the same name as the notification title below. A repeat of the same problem
+replaces the notification rather than adding a new one.
+
+In **shadow mode** the add-on makes every decision but sends nothing: every
+inverter stays at 0 W. Notifications then say what the add-on *would* have
+sent.
+
+### Battery is not keeping up
+
+The battery gives less power than the add-on asks for. This is normal for a
+short time, for example just after a large load switches on or the sun comes
+out. It is not a fault, and control keeps running. If it keeps coming back,
+check that the battery is switched on, and that it is not empty (when it should
+give power) or full (when it should charge). During the monthly maintenance or
+while the peak limit is guarded, it only shows when the battery gives
+clearly less than it was told. The status page counts how many times it
+happened.
+
+### Power request too high
+
+The add-on worked out a power request above what is allowed, and cut it back
+before sending it. The notification shows what was asked and what was sent,
+and which limit cut it: the “Inverter rating” setting, or the inverter's own
+limit. In shadow mode it shows what *would* have been sent. Control keeps
+running. This should never happen, so it is a software fault: please send the
+notification and the add-on log to your installer.
+
+### Load too high for battery
+
+Your home uses more power than the battery can supply, so this 15-minute
+period will go over your peak limit and raise this month's peak. The battery
+is already giving all it can. This is not a fault. Switch off large loads,
+such as an oven, a car charger or a heat pump, for the next few minutes. In
+shadow mode the battery gives nothing, so this can happen with a much smaller
+load.
+
+### Battery stopped limiting the peak
+
+The add-on stopped using the battery to keep your peak down, so this
+15-minute period will go over your peak limit and raise this month's peak.
+Switch off large loads for the next few minutes. The notification says why,
+and what to do:
+
+- **The battery is at its peak reserve.** The “Peak reserve” setting keeps
+  that much charge back from peak limiting. Lower it if you accept a lower
+  battery level.
+- **The battery level cannot be read.** Check the “Battery level entity”
+  setting and that sensor in Home Assistant.
+- **A battery cut-out level is not known.** Fill in “Battery cut-out level”
+  for each inverter in the settings.
+
+With several inverters, a battery at its peak reserve does not give for the
+peak and the others do. This alarm then comes only when the others cannot
+keep the period under the limit alone. Control keeps running meanwhile.
+
+The peak reserve only applies to keeping the peak down. Normal home use can
+still draw the battery below it, down to the battery cut-out level, where the
+battery switches itself off.
+
+### Inverters working against each other
+
+With several inverters, one was charging its battery from another. Your meter
+cannot see this, because the two flows cancel out, but it wastes energy. The
+add-on has stopped control and set every inverter to 0 W. If the grid power
+does not change after that, switch the inverters off at the isolator. A
+restart does not clear this. Find out why, then start control on the add-on
+page.
+
+### An inverter is not delivering
+
+With several inverters, one gives much less power than it is asked for, while
+the others do. Nothing is changed: control keeps running, and the other
+inverters carry on. Check, in this order:
+
+1. Is the inverter on and connected?
+2. Is its battery empty or cold? If it is emptier than its “Battery cut-out
+   level” says, that setting does not match this battery.
+3. Is anything else controlling it?
+
+A restart does not clear this. Once you know why, stop and then start control
+on the add-on page.
+
+### Meter reading may be stuck
+
+The meter keeps answering, but its value has not changed for a long time while
+the add-on asks the battery for full power. That usually means the meter
+reading is stuck. Control keeps running and keeps following the reading, so a
+stuck reading can raise this month's peak. Check the meter. If it is stuck,
+stop control on the add-on page.
+
+### For installers: notifications
+
+This part is for installers. The texts live in `app/messages.py` and follow
+`STYLE.md`. Every notification keeps a fixed `notification_id`, so a repeat
+replaces the card. The ERROR or WARNING line of the add-on log names the
+reason code. The full figures are in `events` in the `status` JSON, also for a
+stop restored after a restart, and on the DEBUG line logged right after it.
+That DEBUG line only shows with “Log level” (log_level) set to `debug`; the
+default `info` hides it.
+
+| Title | Severity | id | Card |
+|---|---|---|---|
+| Battery is not keeping up | warning | `goodwe_integrator_bound` | SAFETY-40 |
+| Power request too high | alarm | `goodwe_output_clamp` | SAFETY-03 |
+| Load too high for battery | alarm | `goodwe_peak_saturated` | SAFETY-07 |
+| Battery stopped limiting the peak | alarm | `goodwe_peak_soc_floor` | SAFETY-24/25/32 |
+| Inverters working against each other | alarm | `goodwe_circulating_power` | SAFETY-31 |
+| *name* is not delivering | alarm | `goodwe_not_delivering_<name>` | SAFETY-42 |
+| Meter reading may be stuck | alarm | `goodwe_meter_frozen` | SAFETY-18 |
+
+**The Details link.** Home Assistant 2026.2 and newer show add-on pages at
+`/config/app/<slug>/documentation`; 2026.5 removed the old
+`/hassio/addon/<slug>/documentation`, which 2026.1 and older still use. At
+start the add-on reads its slug from `GET /addons/self/info` and the Home
+Assistant version from `GET /info`, and builds the link for that version. If
+the version cannot be read it uses the new path. If the slug cannot be read it
+falls back to the container hostname, and outside an add-on the line names the
+section without a link. The documentation tab adds no heading anchors, so the
+link cannot jump to the section.
+
+**Battery is not keeping up.** The grid-following loop's integrator reached its
+anti-windup bound (`integrator_max_w`, SAFETY-40), or a battery that another
+owner set to discharge gave less than it was told (SAFETY-85). No command went
+over the rating. The log line is a WARNING with reason code `OUTPUT_CLAMP`. See *The
+winding-loop alarm*.
+
+**Power request too high.** A computed command above a limit was cut before it
+was written (SAFETY-03). The limits are `max_w` (label “Inverter rating”), the
+setpoint device's own range, or the rating on the loop side. Asked always comes
+first. The old wording was "BUG SIGNAL". It is not the inverter failing to
+follow a legal command, which is the saturation freeze and does not alarm. In
+shadow mode the clamp still grades the decision (SAFETY-10), so the alarm can
+fire while 0 W is on the wire, and the text says "would have sent". ERROR line,
+reason code `OUTPUT_CLAMP`.
+
+**Load too high for battery.** The capacity-peak guard (SAFETY-07) asks for
+everything the inverter can discharge and the running 15-minute average is
+still projected over the peak limit, so the month's billed peak
+(capaciteitstarief) goes up. It fires only when, for 10 s, the period would
+still end more than 10 W over the real limit (not the margin's aim) with the
+battery at full power. It notifies at most once per period; later overloads
+in the same period go to the log (SAFETY-81). In shadow mode the
+guard's projection is made on a plant that did not respond (SAFETY-47), and
+the text says so. See *The capacity-peak guard*.
+
+**Battery stopped limiting the peak.** The peak guard may not discharge below
+`peak_soc_floor` (label “Peak reserve”, SAFETY-24). It also stops when the
+state of charge is unread, or when an inverter's `bms_soc_floor` (label
+“Battery cut-out level”) is missing, because the reserve is graded against it.
+Charging from the grid stays blocked meanwhile. With several inverters the
+notification names the battery at its limit (SAFETY-32), each graded against
+its own cut-out level. That battery is held (weight 0 while the site gives)
+and the guard's need goes to the others, up to their rating; the alarm fires
+only if they miss the limit at full power for `ALARM_HOLD_S` (SAFETY-87). ⚠️ **The reserve binds the peak guard only
+(SAFETY-25).** Self-consumption has no such floor. See *What `peak_soc_floor`
+does not protect*.
+
+**Inverters working against each other.** SAFETY-31. The flows cancel at the
+P1 meter, so every other guard, which reads that net figure, stays quiet. This
+has happened on this hardware once for 6 h 25 min. The alarm is latched,
+survives restarts, and is raised again every 5 min until control is started.
+The watts and the time window are in the log. The *Check for inverters working
+against each other* row shows the live watts. See *The circulating-power alarm*.
+
+**An inverter is not delivering.** SAFETY-42. The unit stood well short of its
+share of the site target for longer than `delivery_hold_s`. A unit at 0 W is
+absent rather than pushing the wrong way, so the per-unit sign check and the
+circulation check stay quiet. The guard only reports: commanding an inverter
+that has stopped listening achieves nothing. Check first whether it answers on
+RS485. The alarm is latched and survives restarts; stop then start clears it.
+See *A unit that stops DELIVERING is a third fault again*.
+
+**Meter reading may be stuck.** SAFETY-18. The value has not changed for
+longer than `meter_freeze_s` while the command stands at the power limit, and
+the age is still fresh, so no other guard stops it. Only `meter_source:
+homewizard_local` can tell a silent meter from an unchanged value. The limit
+and command figures are in the log. See *The frozen-meter alarm*.
+
 ## The Web UI
 
-The ingress panel shows live values, why the controller is commanding what it
-is, and a **Commissioning** checklist that names any problem in words. It also
-carries the three buttons: start/stop control, force a maintenance cycle, and
-abort one.
+The add-on page shows live values, why the battery does what it does, and a
+**Commissioning** checklist that names any problem in words. It also has three
+buttons: start or stop control, force a maintenance cycle, and abort one.
+Under the buttons is the last thing that happened, in a few words.
 
-Since **UX-02** it has a second page, **Configuration** — see *There are TWO
-places to configure this add-on*, above. ⚠️ **It adds nothing you can do to the
-inverter.** The configuration page reads and writes the add-on's own settings
-and can restart the add-on; the set of commands that reach the hardware is
-exactly the three buttons it always had.
+It has a second page, **Configuration**. See *There are TWO places to configure
+this add-on*, above. **It adds nothing you can do to the inverter.** It reads
+and writes the add-on's own settings and can restart the add-on. Only the three
+buttons reach the inverter.
+
+*For installers: the Configuration page is UX-02. The line under the buttons is
+`messages.hint()`, the plain form of the newest entry of the add-on's own
+action log (`Controller.events`). The page no longer shows that log, but the
+`status` JSON still carries its last 40 entries as `events`: open the add-on
+page and add `status` to its address. The action-log tables in this document
+refer to it.*
+
+### Language and screenshots
+
+The page is in Dutch when your browser's language is Dutch, and in English
+otherwise. Status lines, alarms and the start checks' messages stay in English.
+
+Screenshots of each screen are in the add-on's repository, under
+`docs/img/ux13/`, including the Batteries screen and Settings, Simple.
+
+*For installers: regenerate the screenshots with
+`tools/ux13_screenshots.sh`, which serves the page from test fixtures.*
+
+### The Batteries screen and Settings, Simple
+
+The **Batteries** tab has a card per battery: its level, and three lines.
+**Now** says what it does, **Today** lists the blocks planned for it (price
+trades, the monthly cycle, the peak limit), and **Why** says the reason. With
+battery modes on, each card also has the On/Off switch and the mode list; both
+apply at once. Today reads "Not planned yet" until the add-on has made the
+day's price runs.
+
+An Off battery that the peak limit still needs says so, with the power it
+gives: "Off, but gives 0.5 kW for the peak limit."
+
+**Settings** opens on the **Simple** view, or on the view you last picked:
+the peak limit, the batteries' switches and modes, and shadow mode, each
+marked "Applies right away" or "Applies after a restart". **Installer** shows
+every setting.
+
+### Setup, for a new install
+
+The **Setup** tab walks an installer through six steps: the meter, the
+inverters and batteries, solar (optional), prices, the peak limit, and a last
+check. Each step shows the same fields as Settings, and nothing is saved until
+the last step.
+
+- **The kettle test** on the meter step reads the meter, then reads it again
+  after you switch on a kettle. If the reading goes down, the add-on flips its
+  sign for you; with a net or import/export meter it tells you what to change.
+- **The last step** runs the add-on's own start checks and reads Home
+  Assistant: the meter reading, that each power request entity exists, the
+  battery levels, and whether prices are known. A missing power request or
+  meter entity is red, so it cannot be saved.
+- **Save and restart** saves, then restarts the add-on. Every inverter is set
+  to 0 W while it restarts, and with "Start in shadow mode" on (the default) it
+  stays at 0 W until you turn shadow mode off under Settings.
+
+Setup opens by itself on a new install's first start, until Setup finishes or
+control is started, and whenever the stored settings name no inverter to
+control. A site that already ran before is never sent there.
+
+A new install names no inverter yet, so the add-on starts **in setup**: it
+serves the page and sends nothing to any inverter. Home says "Setup: nothing
+is controlled yet", and there is no Start button. The installer's steps:
+
+1. Install the add-on, turn on **Watchdog** on its Info tab, and start it.
+   Leave the Configuration tab as it is.
+2. Open the add-on's page. Setup opens by itself.
+3. Go through the six steps and press **Save and restart**. With "Start in
+   shadow mode" on, every inverter stays at 0 W after the restart.
+4. On Home, check the meter direction and what the add-on would do. Turn
+   shadow mode off under Settings when it looks right.
+
+Any other problem in the stored settings still stops the add-on (exit code 78),
+and the log names each one. Fix those on the Configuration tab.
+
+*For installers: cards UX-13 and UX-15, `DECISIONS/UX-13-setup-wizard.md` and
+`DECISIONS/UX-15-setup-only-mode.md`. In setup the `status` JSON has
+`setup_only: true`, and no MQTT entity is published.*
+
+## Status page
+
+The add-on page shows a banner at the top and a **Commissioning** list below
+it. The banner says in one line what matters most now. Each row of the list is
+one check: ✓ green is fine, ! amber needs a look, ✗ red needs action. Rows name
+settings by their label, never by a Home Assistant entity id.
+
+In **shadow mode** the banner says so first, whatever else is going on: the
+add-on makes every decision but the battery is not controlled, and every
+inverter stays at 0 W. If the banner is red and says a safety stop stays on,
+one of the red rows below is a stop that will still be there when shadow mode
+ends. That row says how to clear it.
+
+In **setup** (a new install that names no inverter yet) the banner says
+nothing is controlled yet, and the one row says to finish Setup. See *Setup,
+for a new install*.
+
+| Row starts with | What it tells you |
+|---|---|
+| Control | When control last ran. Red when it has stopped running: the control board then sets the inverter to 0 W. |
+| Meter | The grid reading, its age, how many readings were refused, and how long its value has not changed. Just after a start it is amber and *waiting for the first reading*. Red means no reading for longer than the limit. |
+| Stuck-meter check | Whether the add-on can warn you about a stuck meter. |
+| Meter reading may be stuck | See *Meter reading may be stuck* under Notifications. |
+| Month peak | This month's highest 15-minute average, when it happened, and how close it is to your peak limit. Amber from 80 %. |
+| 15-minute periods measured this month | How many 15-minute periods the add-on has measured and saved this month. |
+| Peak guard, Load too high for battery, Battery at its peak reserve | What the add-on does to keep your peak down. *Idle, heading for …* is where this 15-minute period is heading. *Waiting for meter readings* after a restart means the battery does not charge until the add-on can measure the period again. A red peak row is an alarm while control keeps running, so the banner shows its title without *Not ready*. |
+| Battery level, Battery power, Grid power | The reading of that entity. *No usable reading* means the entity is missing, or its reading is too old. Check it in Developer Tools before replacing it. |
+| Inverter control | Whether the inverter can be controlled, and how much it can charge and give. |
+| *name*: battery power reading stopped changing | The reading did not change while the add-on asked for a change. It may be stuck, or the battery may be refusing. The add-on sets the inverters to 0 W until it changes. |
+| *name*: … cannot be controlled, commands refused, “Setpoint entity” is not set | Whether each inverter still takes commands. |
+| Power request too high, Battery is not keeping up | See those titles under Notifications. Each shows how often it happened since the add-on started, and *fine now* once it has cleared. In shadow mode the row says what *would* have been sent. |
+| Direction check, Site direction check | Whether each inverter's power goes the way the add-on asks. *Opposite for 12 of 60 seconds* counts toward a stop. When it stops, the inverter, or every inverter, is set to 0 W until you start control. |
+| Check for inverters working against each other, Inverters worked against each other | Only with several inverters. See *Inverters working against each other*. |
+| Delivery check, *name* is not delivering | Only with several inverters. See *An inverter is not delivering*. |
+| Solar production | Your solar production. Sources are numbered in the order of “Solar production entities, per inverter”. A strongly negative reading by day means that entity reads the wrong way round: add it to “Reversed-sign solar entities”. |
+
+### For installers: status page
+
+The texts are in `app/messages.py`. An alarm's ERROR or WARNING line names its
+reason code, and its full figures are on the DEBUG line right after it and in
+`events` in the `status` JSON.
+
+- **Stuck-meter check: off** needs `meter_source: homewizard_local` (label
+  “Where the meter reading comes from”), a `max_w` (“Inverter rating”) and a
+  power range the inverter can reach. *The inverter's own limit* means the
+  setpoint device's range sets the threshold, below `max_w`.
+- **Peak guard: off** means `meter_source` is `off`, so there is no 15-minute
+  average to guard.
+- **Battery level / Battery power / Grid power** are `soc_entity`,
+  `batt_entity` and `meter_entity`. *No usable reading* is SAFETY-56: missing
+  **or** held back as stale, and a separate stale-reading row then says which.
+- **Inverter control** is the `setpoint_entity` and the range it accepts.
+- ***name* cannot be controlled** (red): every write was rejected for
+  `LINK_STALE_S`, so the unit is dropped and the others carry its share
+  (DEV-02). ***name*: commands refused** (amber) is the same before that limit.
+  ***name*: “Setpoint entity” is not set** (amber): a roster entry nobody can
+  write, so the site refuses to run at part strength and holds 0 W.
+- **Direction check, Site direction check** are the sign checks (SAFETY-02/30).
+  **Check for inverters working against each other** is SAFETY-31, **Delivery
+  check** SAFETY-42.
+- **Month peak** and **15-minute periods measured** are TARIFF-01 and
+  TARIFF-13. The store's state at start is the INFO line `Month peak store:
+  …`, and the peak guard's full reason is on the DEBUG line after its ERROR.
+- ***name*: battery power reading stopped changing** is SAFETY-37/56/57. The
+  ERROR line says when it clears and names `STALE_READING`. The full reason,
+  with both possible causes, is on the DEBUG line after it.
+- **Meter: no reading for …** (red): the add-on logs one WARNING when the
+  meter goes quiet, "No meter reading for …", and an INFO line when readings
+  return, at most once every 10 minutes. Past `stale_input_s` the **Why**
+  line names the missing reading.
+- The table at the top: **Why** is `messages.why()`, the arbiter's answer in
+  words (`Resolution.explain()` stays on the log). **Tariff**, **Price
+  history**, **Arbitrage** and **Shadow mode** keep every figure they had
+  (TARIFF-11), in words.
+- **Solar production** reads `pv_entity` or `pv_entities` (TEL-11/12). The
+  *Reversed-sign solar entities* setting is `pv_invert_entities` (TEL-14).
+- **Shadow mode** (SAFETY-10): the banner turns red when a latch is up
+  (circulating power, or a site or per-inverter sign trip), and that latch keeps
+  its own red row.
 
 ## Status entities
 
@@ -2802,7 +3472,9 @@ battery power, circulating power, state of charge, maintenance phase and
 controller status by MQTT discovery. This is observability only — the controller works fine without a
 broker, and MQTT problems can never affect control.
 
-## Before you commission inverter B: `tools/rehearse_roster.py` (ARCH-02)
+## Before you commission inverter B
+
+*For installers: card ARCH-02. The tool is `tools/rehearse_roster.py`.*
 
 The day the `inverters:` roster is declared, two things change that are
 **one-way on a live box and invisible until after the restart that applies
@@ -2820,8 +3492,8 @@ a **copy** of the state file and reports the difference.
         --live-entities /w/live-entities.txt \
         --reverse --round-trip'
 
-Exit `0` clean · `1` at least one finding · `2` could not run. ⚠️ **`2` is not a
-pass.**
+Exit `0` clean · `1` at least one finding · `2` could not run · `3` clean but
+degraded (`--no-live-entities`). ⚠️ **`2` and `3` are not a pass.**
 
 ### The owner steps, because this session could not take them
 
@@ -2843,7 +3515,8 @@ check, **before** the roster is declared:
 
 2. **The options blob**, as `--before`. It is not reachable through the Home
    Assistant REST API and no entity carries it; export it from the Supervisor,
-   the same way `tools/predeploy_check.py` needs it. Write the roster you intend
+   the same way `tools/predeploy_check.py` needs it: the bare options object,
+   not the `ha apps info` wrapper, which is refused. Write the roster you intend
    to deploy into a second file and pass it as `--after`.
 
 3. **The entity list**, as `--live-entities` — one entity id per line:
@@ -2857,7 +3530,8 @@ check, **before** the roster is declared:
    hand back a clean bill of health for a half of the transition it did not
    check. If you genuinely have to run without it, pass `--no-live-entities`:
    the run then carries a standing banner in the report header **and** on the
-   exit line saying the orphan check was not graded. The asymmetry used to be
+   exit line saying the orphan check was not graded, and a clean result exits
+   3, not 0. The asymmetry used to be
    the other way round — an unreadable file refused, a missing flag passed with
    exit 0 and no disclosure at all — and the owner runs this once, at
    commissioning, under time pressure.
@@ -2981,7 +3655,9 @@ maintenance bookkeeping — and if a cycle ran during it, correct
 `unit/<first>/last_completed` by hand before advancing again.** This is a stated
 decision, not a discovery made at the inverter.
 
-## Before you deploy: `tools/predeploy_check.py` (PKG-09)
+## Before you deploy
+
+*For installers: card PKG-09. The tool is `tools/predeploy_check.py`.*
 
 Two ways a deploy has gone wrong on this system, both of which the Supervisor
 reports as success:
@@ -3005,7 +3681,9 @@ Run it inside the container, so the validator half actually runs:
       --deployed-version 0.7.0 --options /w/live-options.json
 
 Export `live-options.json` from the Supervisor first — the options blob is not
-reachable through the Home Assistant REST API, and no entity carries it.
+reachable through the Home Assistant REST API, and no entity carries it. Pass the
+bare object (`ha apps info <slug> --raw-json | jq .data.options`); the wrapped
+output is refused.
 
 **Exit codes.** `0` cleared · `1` REFUSED, do not deploy · `2` NOT CLEARED,
 meaning a check did not run. ⚠️ **2 is not a pass.** On a bare host without the
diff --git a/goodwe_controller/app/allocator.py b/goodwe_controller/app/allocator.py
index 2bc9b22..5640fbf 100644
--- a/goodwe_controller/app/allocator.py
+++ b/goodwe_controller/app/allocator.py
@@ -98,6 +98,12 @@ DROP_STALE = "stale link"
 DROP_CONTRADICTION = "contradicts itself"
 DROP_NO_INTEGER = "no integer setpoint in its interval"
 
+# OPT-11: why a unit's MODE layer was not applied this tick. Only the first is
+# a fault; the other two are the rule working.
+MODE_FAULT = "mode range leaves out 0 W"
+MODE_RELEASED = "mode released by a higher claim"
+MODE_OUTRANKED = "hard limit leaves no room for the mode"
+
 REFUSE_SCOPE = "mis-routed claim"
 REFUSE_EMPTY = "no unit available"
 REFUSE_SIGN = "opposite directions"
@@ -213,6 +219,10 @@ class Allocation:
     # that calls `plan()` for its arithmetic gets None and does not care;
     # main.py stamps every record it puts on the write path.
     tick: int | None = None
+    # OPT-11: ((unit, why), ...) for each unit whose mode range left out 0 W
+    # this tick. That mode was dropped (see `unit_interval()`); main.py logs it
+    # as a software fault. Empty on every tick without a mode.
+    mode_faults: tuple = ()
 
     @property
     def ok(self) -> bool:
@@ -246,11 +256,11 @@ class Allocation:
         block the failsafe is worse than the hole it closes.
         """
         if tick is None or self.tick is None or self.tick != tick:
-            return (f"the allocation record on hand was made on tick "
-                    f"{self.tick!r} and this is tick {tick!r} - a record whose "
-                    f"envelopes have moved cannot authorise a write")
+            return (f"the power split on hand is from tick {self.tick!r}, "
+                    f"not this tick {tick!r}, and an old split cannot allow a "
+                    f"write")
         if not self.ok:
-            return f"the allocator refused this tick ({self.explain()})"
+            return f"no power split was possible this tick ({self.explain()})"
         if unit not in self.shares:
             return (f"{unit} has no share in this tick's allocation "
                     f"({self.explain()})")
@@ -290,6 +300,99 @@ class Allocation:
         return out
 
 
+def unit_interval(b, deciding_priority=None):
+    """OPT-11. `(lo, hi, note)`: the interval a unit is allocated into.
+
+    The hard limits (`b.lo`, `b.hi`) always apply. The unit's MODE range
+    (`b.mode_lo`, `b.mode_hi`) narrows them unless `deciding_priority` is
+    above the mode's own priority (arbiter._unit_modes() passes None when the
+    modes hold, and the yielding limit's priority when they give way). `note` says why the
+    mode did not apply, or is None when it did or there is none:
+
+    * MODE_FAULT: the mode range leaves out 0 W. A mode may forbid a direction
+      and never force one, so this is a software fault and the mode is dropped.
+      It is what keeps REFUSE_SIGN unreachable from a mode: the fill below
+      moves every free unit away from 0 in ONE direction, and it starts from 0
+      only while every interval holds 0.
+    * MODE_RELEASED: a higher claim (the peak floor) decided the target.
+    * MODE_OUTRANKED: the hard limits and the mode do not overlap. The hard
+      limits win, as they always do.
+
+    A unit without mode fields (`mode_priority` absent or None) gets its hard
+    limits, unchanged: that is every unit when battery modes are off.
+    """
+    lo, hi = b.lo, b.hi
+    prio = getattr(b, "mode_priority", None)
+    if prio is None:
+        return lo, hi, None
+    mlo, mhi = b.mode_lo, b.mode_hi
+    if not (mlo <= 0.0 <= mhi):
+        return lo, hi, MODE_FAULT
+    if deciding_priority is not None and deciding_priority > prio:
+        return lo, hi, MODE_RELEASED
+    nlo, nhi = max(lo, mlo), min(hi, mhi)
+    if nlo > nhi:
+        return lo, hi, MODE_OUTRANKED
+    return nlo, nhi, None
+
+
+class _Narrowed:
+    """A unit's bounds with its interval replaced by `unit_interval()`'s."""
+    __slots__ = ("lo", "hi")
+
+    def __init__(self, lo, hi):
+        self.lo, self.hi = lo, hi
+
+
+def pin_w(b):
+    """The watts a unit's own SET places once held inside its hard limits,
+    as `plan()` places a standing pin, or None when the unit has no SET."""
+    pv = getattr(b, "pinned_w", None)
+    if getattr(b, "gate", None) is None or pv is None:
+        return None
+    lo, hi = _int_envelope(b)
+    return float(pv) if lo > hi else float(_clamp_int(round(float(pv)), lo, hi))
+
+
+def hi_w(b):
+    """A unit's upper hard limit as `plan()` narrows it to whole W (SAFETY-84)."""
+    return float(_int_envelope(b)[1])
+
+
+def loop_bound(bounds, live=None):
+    """OPT-11. `(lo, hi)`: what the units can place when the LOOP decides.
+
+    The sum, over live units that do not contradict themselves, of each unit's
+    interval with its mode applied (`unit_interval()` with no higher claim). A
+    pinned unit adds the span from 0 to its pin, so a probe or a maintenance
+    pin stays reachable. Every term holds 0, so the sum does too.
+
+    `compute()` keeps the site target inside this, so the loop never asks for
+    watts no battery may give: the allocator would report them as unmet and the
+    saturation freeze would park the target on them (SAFETY-73 section 1).
+    Pure, like `plan()`: it reads numbers and intervals and nothing else.
+    """
+    lo_sum, hi_sum = 0.0, 0.0
+    for u in sorted(bounds):
+        b = bounds[u]
+        if live is not None and u not in live:
+            continue
+        if getattr(b, "contradiction", False):
+            continue
+        p = pin_w(b)
+        if p is not None:
+            lo_sum += min(0.0, p)
+            hi_sum += max(0.0, p)
+            continue
+        lo, hi, _ = unit_interval(b)
+        lo, hi = _int_envelope(_Narrowed(lo, hi))
+        if lo > hi:
+            continue
+        lo_sum += min(0.0, lo)
+        hi_sum += max(0.0, hi)
+    return lo_sum, hi_sum
+
+
 def _int_envelope(b):
     """A unit's interval, narrowed to the integers a 1 W register can hold.
 
@@ -385,7 +488,8 @@ def _fill(order, weights, cap, amount):
 
 
 def plan(target_w, bounds, *, weights=None, live=None, scope_errors=(),
-         site_priority=None, site_key="site", tick=None) -> Allocation:
+         site_priority=None, site_key="site", tick=None,
+         deciding_priority=None) -> Allocation:
     """Divide the site grid target `target_w` across the units in `bounds`.
 
     `bounds`   unit name -> that unit's interval for THIS TICK (arbiter stage 1,
@@ -411,6 +515,9 @@ def plan(target_w, bounds, *, weights=None, live=None, scope_errors=(),
     `site_priority` the priority of the SITE claim that chose `target_w`. It is
                what a unit's own winning SET is weighed against - see PINS.
     `site_key` the name to use when there are no units at all.
+    `deciding_priority` OPT-11: the priority that decided `target_w`
+               (`Resolution.deciding_priority`). Each unit's mode range applies
+               only at or below it - see `unit_interval()`. None applies them.
     `tick`     an opaque token identifying the tick this record is FOR, handed
                straight back on the record. SAFETY-28's write gate compares it
                against the tick it is writing on, so that a record cannot be
@@ -497,6 +604,7 @@ def plan(target_w, bounds, *, weights=None, live=None, scope_errors=(),
     dropped = []
     ilo, ihi = {}, {}
     considered = []
+    mode_faults = []
     for u in units:
         b = bounds[u]
         if live is not None and u not in live:
@@ -512,7 +620,12 @@ def plan(target_w, bounds, *, weights=None, live=None, scope_errors=(),
             # has no interval to allocate into.
             dropped.append((u, DROP_CONTRADICTION))
             continue
-        lo, hi = _int_envelope(b)
+        # OPT-11: the mode layer, when it applies, narrows the hard limits.
+        # A unit with no mode gets exactly its hard limits, as before.
+        nlo, nhi, note = unit_interval(b, deciding_priority)
+        if note == MODE_FAULT:
+            mode_faults.append((u, MODE_FAULT))
+        lo, hi = _int_envelope(_Narrowed(nlo, nhi))
         if lo > hi:
             # An interval that contains no integer. The register is 1 W, so
             # there is no number this unit could be commanded that both bounds
@@ -526,7 +639,7 @@ def plan(target_w, bounds, *, weights=None, live=None, scope_errors=(),
         return Allocation(
             target_w=float(target_w), sum_w=sum_w, shares={}, plans=(),
             dropped=tuple(dropped), unmet_w=sum_w, quantisation_w=quant,
-            refused=why, tick=tick)
+            refused=why, tick=tick, mode_faults=tuple(mode_faults))
 
     # --- REFUSAL 2: nobody is available ------------------------------------
     if not considered:
@@ -659,4 +772,5 @@ def plan(target_w, bounds, *, weights=None, live=None, scope_errors=(),
 
     return Allocation(target_w=float(target_w), sum_w=sum_w, shares=shares,
                       plans=tuple(plans), dropped=tuple(dropped),
-                      unmet_w=int(unmet), quantisation_w=quant, tick=tick)
+                      unmet_w=int(unmet), quantisation_w=quant, tick=tick,
+                      mode_faults=tuple(mode_faults))
diff --git a/goodwe_controller/app/arbiter.py b/goodwe_controller/app/arbiter.py
index 2ecfc36..e9136b9 100644
--- a/goodwe_controller/app/arbiter.py
+++ b/goodwe_controller/app/arbiter.py
@@ -76,6 +76,12 @@ from . import allocator
 P_SAFETY = 100        # stopped, inputs missing, shutting down, device limits
 P_MAINTENANCE = 60    # maintenance owns the actuator outright (drain, hold)
 P_PEAK = 50           # capacity-tariff peak shaving - costs real money
+# The order in effect: safety limits and the SAFETY-73 refusal > the peak
+# guard > maintenance > modes > trade > loop. A peak floor above a drain still
+# binds: the `drain` site floor at N>=2 (SAFETY-78), refiled at P_MAINTENANCE
+# at N=1 (SAFETY-83); over a HOLD, `_peak_over_hold()` (SAFETY-86).
+# A cheap-window charge is suspended while the peak guard holds and, at N>=2,
+# sized to the quarter's headroom (SAFETY-84).
 P_MAINT_SHAPE = 40    # maintenance shaping the loop (charge-only)
 # OPT-04. §10.1 priority 3 - price arbitrage. ⚠️ ITS POSITION IS THE SPEC, NOT A
 # preference: P_PEAK (50) is ABOVE it so clause 2 lets the capacity-tariff floor
@@ -86,8 +92,17 @@ P_MAINT_SHAPE = 40    # maintenance shaping the loop (charge-only)
 # because trading against the meter is the entire point - the grid-following
 # loop would otherwise cancel every charge the moment it created import.
 P_ARBITRAGE = 30      # price arbitrage - trades against the meter on purpose
+# OPT-11. A battery's mode (Solar first, Leftover solar, Off): a SOFT unit
+# limit, kept apart from the hard ones. Above arbitrage, so a trade stays inside
+# each battery's mode; below the peak guard, to which a mode gives way only as
+# far as the floor needs (`_unit_modes()`, `_site_mode()`).
+# DECISIONS/OPT-11-battery-modes.md.
+P_MODE = 35
 P_LOOP = 10           # ordinary grid-following
 
+# The one source filed at P_MODE. pre_resolve() keeps it out of the hard limits.
+MODE_SOURCE = "mode"
+
 SET = "set"
 LIMIT = "limit"
 
@@ -175,6 +190,22 @@ CLAIM_SCOPE = {
     # the banner and the claim an install has had since SAFETY-02 shipped.
     # `Controller.cycle()` does not even arm the site detector there.
     "sign_site": SCOPE_SITE,
+    # main.py: `Claim.limit("drain", P_MAINTENANCE, lo=...)`, SAFETY-78. At
+    # N>=2, while a pack's maintenance drain is pinned, the site target may
+    # not go below what that pin places: below it a sibling would have to
+    # charge against the drain (circulation, refused, 0 W). A site `lo`,
+    # never filed at N=1. DECISIONS/SAFETY-78-drain-at-two.md.
+    "drain": SCOPE_SITE,
+    # main.py: `Claim.limit("charge", P_MAINT_SHAPE, hi=...)`, SAFETY-84. The
+    # mirror of `drain` for a cheap-window maintenance charge at N>=2: the site
+    # target may not go above what the charging pack's own `hi` asks, or a
+    # sibling would have to give against it. Never filed at N=1.
+    # DECISIONS/SAFETY-84-charge-at-two.md.
+    "charge": SCOPE_SITE,
+    # main.py: `Claim.limit("hold", P_MAINTENANCE, hi=...)`, SAFETY-86. While a
+    # holding pack gives the peak shortfall at N>=2, the site target stays at
+    # the peak floor, what the pin and the others place. Never filed at N=1.
+    "hold": SCOPE_SITE,
 
     # --- UNIT: about one pack, one inverter, one device -------------------
     # main.py: `Claim.limit("device", P_SAFETY, self.dev_min, self.dev_max,
@@ -226,12 +257,25 @@ CLAIM_SCOPE = {
     # reaches the allocator, so a unit-scoped claim is the shape that sentence
     # asks for rather than an evasion of it.
     "pack": SCOPE_UNIT,
+    # main.py: `Claim.limit("refused", P_SAFETY, ...)` and, during a probe,
+    # `Claim.set("refused", P_SAFETY, +-PROBE_W)`. SAFETY-73: THIS battery gives
+    # nothing in one direction, measured on THIS unit's own reading. A hard unit
+    # limit that always intersects, so the share goes to the siblings. Filed at
+    # N>1 only; at N=1 SAFETY-52's law in compute() does the same job.
+    "refused": SCOPE_UNIT,
     # main.py: `Claim.set("maintenance", P_MAINTENANCE, ...)` when the cycle owns
     # the setpoint, and `Claim.limit("maintenance", P_MAINT_SHAPE, hi=...)` when
     # it only shapes. §12's monthly recalibration is a PACK procedure - drain
     # this pack to its floor, charge this pack to full, recalibrate this pack's
     # coulomb counter. Two packs recalibrate on their own schedules.
     "maintenance": SCOPE_UNIT,
+    # main.py: `Claim.limit("mode", P_MODE, lo, hi, ...)`, OPT-11. THIS
+    # battery's mode, chosen per battery by its owner. A unit claim that never
+    # enters a `lo > hi` test with a site limit: stage 1 keeps it apart from the
+    # hard limits, and it gives way to a site limit above P_MODE only as far as
+    # that limit needs (`_unit_modes()`). At N=1 it routes to the site, and
+    # `resolve()` takes it out of stage 2 for the same reason.
+    "mode": SCOPE_UNIT,
 }
 
 
@@ -359,6 +403,13 @@ class UnitBounds:
     pinned_w: float | None = None
     pinned_by: str | None = None
     contradiction: bool = False
+    # OPT-11: the mode layer, APART from `lo`/`hi` above, which stay the hard
+    # limits. `mode_priority` is None when no mode claim applies. Whether the
+    # mode binds is decided at stage 3 (`allocator.unit_interval()`), because it
+    # depends on the priority that decided the SITE target.
+    mode_lo: float = -inf
+    mode_hi: float = inf
+    mode_priority: int | None = None
 
     def explain(self) -> str:
         if self.contradiction:
@@ -404,6 +455,15 @@ class Resolution:
     # rules drifting apart: this is set by the same line that picks the winner
     # `explain()` names.
     winner_priority: int | None = None
+    # OPT-11. The higher of the winning set's priority and the priority of the
+    # limit that bound `target_w`. Whether the modes hold is decided from the
+    # limits themselves (`_site_mode()`, `_unit_modes()`): a mode gives way
+    # only as far as a limit above it (the peak floor) needs, so a mode `hi`
+    # never meets a site `lo`.
+    deciding_priority: int | None = None
+    # OPT-11 at N=1: why the site's mode layer was dropped this tick, or None.
+    # At N>1 the same fact is on `allocation.mode_faults`, per unit.
+    mode_fault: str | None = None
 
     def explain(self) -> str:
         """One line an operator can act on - this is the point of the module."""
@@ -427,7 +487,8 @@ def pre_resolve(unit_claims: list) -> UnitBounds:
     of the fault this card removes, and the reason `resolve()` partitions rather
     than filters twice.
     """
-    sets = sorted((c for c in unit_claims if c.kind == SET),
+    sets = sorted((c for c in unit_claims
+                   if c.kind == SET and c.source != MODE_SOURCE),
                   key=lambda c: c.priority, reverse=True)
     gate = pinned_w = pinned_by = None
     if sets:
@@ -435,19 +496,30 @@ def pre_resolve(unit_claims: list) -> UnitBounds:
 
     lo, hi = -inf, inf
     lo_src = hi_src = None
+    # OPT-11: a mode claim never joins the hard limits, so a mode cannot make a
+    # unit contradict itself or narrow a pin. A mode SET is not a thing: only
+    # limits are read. The lowest mode priority is kept (the first to release).
+    mode_lo, mode_hi, mode_priority = -inf, inf, None
     for c in unit_claims:
         if c.kind != LIMIT or (gate is not None and c.priority < gate):
             continue
+        if c.source == MODE_SOURCE:
+            mode_lo, mode_hi = max(mode_lo, c.lo), min(mode_hi, c.hi)
+            mode_priority = (c.priority if mode_priority is None
+                             else min(mode_priority, c.priority))
+            continue
         if c.lo > lo:
             lo, lo_src = c.lo, c.source
         if c.hi < hi:
             hi, hi_src = c.hi, c.source
     return UnitBounds(lo, hi, lo_src, hi_src, gate, pinned_w, pinned_by,
-                      contradiction=lo > hi)
+                      contradiction=lo > hi, mode_lo=mode_lo, mode_hi=mode_hi,
+                      mode_priority=mode_priority)
 
 
 def allocate(target_w: float, bounds: dict, *, weights=None, live=None,
-             scope_errors=(), site_priority=None) -> tuple:
+             scope_errors=(), site_priority=None,
+             deciding_priority=None) -> tuple:
     """STAGE 3. THE SEAM, AND SINCE ALLOC-01 IT IS OCCUPIED. `(shares, allocated)`.
 
     ⚠️ THE ALLOCATOR ITSELF IS `app/allocator.py` AND THE REASONING LIVES THERE.
@@ -485,11 +557,13 @@ def allocate(target_w: float, bounds: dict, *, weights=None, live=None,
     """
     return allocate_record(target_w, bounds, weights=weights, live=live,
                            scope_errors=scope_errors,
-                           site_priority=site_priority)[:2]
+                           site_priority=site_priority,
+                           deciding_priority=deciding_priority)[:2]
 
 
 def allocate_record(target_w: float, bounds: dict, *, weights=None, live=None,
-                    scope_errors=(), site_priority=None, tick=None) -> tuple:
+                    scope_errors=(), site_priority=None, tick=None,
+                    deciding_priority=None) -> tuple:
     """`allocate()` plus the record - `(shares, allocated, allocation)`.
 
     `tick` is SAFETY-28's freshness token: it identifies the tick the record is
@@ -501,7 +575,7 @@ def allocate_record(target_w: float, bounds: dict, *, weights=None, live=None,
     rec = allocator.plan(target_w, bounds, weights=weights, live=live,
                          scope_errors=scope_errors,
                          site_priority=site_priority, site_key=ACTUATOR_SITE,
-                         tick=tick)
+                         tick=tick, deciding_priority=deciding_priority)
     return rec.shares, rec.ok, rec
 
 
@@ -538,23 +612,30 @@ def site_resolve(claims: list) -> Resolution:
     considered = [f"{c.source}:{c.kind}" for c in claims]
 
     if lo > hi:
+        # OPT-11: 0 W here, and every limit that took part counts as deciding.
         return Resolution(0.0, winner.source, bound_by=None,
                           contradiction=True, considered=considered,
-                          winner_priority=winner.priority)
+                          winner_priority=winner.priority,
+                          deciding_priority=max(winner.priority,
+                                                lo_src.priority,
+                                                hi_src.priority))
 
     target = max(lo, min(hi, winner.value))
     bound_by = None
+    deciding = winner.priority
     if target != winner.value:
         binder = lo_src if target == lo else hi_src
         if binder is not None:
             bound_by = f"{binder.source}({binder.reason})" if binder.reason else binder.source
+            deciding = max(deciding, binder.priority)
 
     return Resolution(float(target), winner.source, bound_by, False, considered,
-                      winner_priority=winner.priority)
+                      winner_priority=winner.priority,
+                      deciding_priority=deciding)
 
 
 def resolve(claims: list, *, units=None, weights=None, live=None,
-            tick=None) -> Resolution:
+            tick=None, reserve=()) -> Resolution:
     """The three stages, in order, over one cycle's claims.
 
     `units` is the site's roster of inverters. Left None it is derived from the
@@ -600,6 +681,12 @@ def resolve(claims: list, *, units=None, weights=None, live=None,
     written down.
     """
     site_claims = [c for c in claims if c.actuator == ACTUATOR_SITE]
+    # OPT-11: a mode claim on the site (N=1, where every source routes there)
+    # never enters stage 2's `lo > hi` test. It is applied after it, below, by
+    # the same release rule stage 3 uses.
+    site_modes = [c for c in site_claims if c.source == MODE_SOURCE]
+    if site_modes:
+        site_claims = [c for c in site_claims if c.source != MODE_SOURCE]
     if units is None:
         units = {c.actuator for c in claims if c.actuator != ACTUATOR_SITE}
     units = tuple(sorted(units))
@@ -611,6 +698,8 @@ def resolve(claims: list, *, units=None, weights=None, live=None,
     # STAGE 2 - the site claims become the grid target. At N=1 `site_claims` IS
     # `claims`, so this is the shipped arbiter on the shipped list.
     out = site_resolve(site_claims)
+    if site_modes:
+        _site_mode(out, site_modes, site_claims)
 
     # STAGE 3 - the seam, and since ALLOC-01 the allocator behind it.
     #
@@ -643,10 +732,132 @@ def resolve(claims: list, *, units=None, weights=None, live=None,
     # nothing. See `packshare.weights()` on the residual this leaves (the fill's
     # own direction can differ from the target's sign under a pin, in which case
     # the weighting is a worse preference and still cannot be unsafe).
+    # OPT-11: whether each unit's mode holds this tick (`_unit_modes()`).
+    # Before the weights, because a limit above the modes may move the target.
+    gate, held = _unit_modes(out, site_claims, bounds, live)
     if callable(weights):
         weights = weights(out.target_w)
+    # SAFETY-87: units under their peak reserve weigh 0 while the site gives,
+    # so the others carry the peak floor. An Off battery gives the peak's
+    # shortfall, so it goes before them when no other unit is left.
+    reserve = set(reserve) if out.target_w > 0.0 else set()
+    if held and reserve and not set(bounds) - held - reserve:
+        held = set()
+    held = held | reserve
+    if held:
+        weights = {u: (0.0 if u in held else
+                       (1.0 if weights is None else weights.get(u, 1.0)))
+                   for u in bounds}
     out.shares, out.allocated, out.allocation = allocate_record(
         out.target_w, bounds, weights=weights, live=live,
         scope_errors=out.scope_errors, site_priority=out.winner_priority,
-        tick=tick)
+        tick=tick, deciding_priority=gate)
     return out
+
+
+def _limits_above(site_claims: list, prio: int) -> tuple:
+    """OPT-11: `(lo, lo_src, hi, hi_src)` over the site LIMITs above `prio`.
+
+    These are what a mode may never take the site target outside of: the peak
+    guard (P_PEAK), maintenance shaping (P_MAINT_SHAPE) and the hard limits.
+    """
+    lo, hi = -inf, inf
+    lo_src = hi_src = None
+    for c in site_claims:
+        if c.kind != LIMIT or c.priority <= prio:
+            continue
+        if c.lo > lo:
+            lo, lo_src = c.lo, c
+        if c.hi < hi:
+            hi, hi_src = c.hi, c
+    return lo, lo_src, hi, hi_src
+
+
+def _yield_to(out: Resolution, t1: float, above: tuple):
+    """OPT-11: the target `t1` the modes allow, moved only as far as the limits
+    above the mode need (`_limits_above()`). Returns the claim that moved it,
+    or None when `t1` already satisfies them, and sets `out.target_w`."""
+    lo, lo_src, hi, hi_src = above
+    t2 = max(lo, min(hi, t1))
+    out.target_w = float(t2)
+    if t2 == t1:
+        return None
+    binder = lo_src if t2 == lo else hi_src
+    out.bound_by = (f"{binder.source}({binder.reason})" if binder.reason
+                    else binder.source)
+    out.deciding_priority = max(out.deciding_priority or binder.priority,
+                                binder.priority)
+    return binder
+
+
+def _site_mode(out: Resolution, modes: list, site_claims: list) -> None:
+    """OPT-11 at N=1: the one battery's mode bounds the SITE target, after stage 2.
+
+    A SET above the mode (a safety stop) decides alone. Otherwise the target is
+    clamped into the mode range and then back into the site limits above the
+    mode, so the mode gives way only as far as those limits need: a peak floor
+    of 2000 W over an Off battery asks it for 2000 W, whether a trade or the
+    loop won stage 2, and a charge the peak guard merely caps stays at 0 W. A
+    range without 0 W is a software fault that drops the mode
+    (`out.mode_fault`). Clamping one number cannot contradict anything.
+    """
+    out.considered = out.considered + [f"{c.source}:{c.kind}" for c in modes]
+    lims = [c for c in modes if c.kind == LIMIT]
+    if not lims or out.contradiction:
+        return
+    lo = max(c.lo for c in lims)
+    hi = min(c.hi for c in lims)
+    prio = min(c.priority for c in lims)
+    if not (lo <= 0.0 <= hi):
+        out.mode_fault = f"mode range [{lo:.0f}, {hi:.0f}] leaves out 0 W"
+        return
+    if out.winner_priority is not None and out.winner_priority > prio:
+        return
+    before = out.target_w
+    t1 = max(lo, min(hi, before))
+    if _yield_to(out, t1, _limits_above(site_claims, prio)) is None \
+            and t1 != before:
+        c = lims[0]
+        out.bound_by = f"{c.source}({c.reason})" if c.reason else c.source
+
+
+def _unit_modes(out: Resolution, site_claims: list, bounds: dict, live):
+    """OPT-11 at N>1: `(gate, held)` for stage 3.
+
+    `gate` is the `deciding_priority` handed to the allocator: None applies
+    every unit's mode, a number above P_MODE releases them. `held` is the set
+    of units whose mode holds them back in the target's direction; while the
+    modes are released they weigh 0, so they carry only what the other units
+    cannot (the allocator's last-resort pass).
+
+    The rule matches N=1: a SET above the mode decides alone. Otherwise the
+    target is clamped into what the units can place with their modes
+    (`allocator.loop_bound()`) and back into the site limits above the mode.
+    If that point is still placeable with the modes, they hold and the target
+    is unchanged (what they cannot place is reported unmet, as before). If a
+    limit above the mode needs more, the target moves only that far, and the
+    modes are released for it.
+    """
+    mode_units = [u for u, b in bounds.items()
+                  if getattr(b, "mode_priority", None) is not None]
+    if not mode_units or out.contradiction:
+        return out.deciding_priority, set()
+    prio = min(bounds[u].mode_priority for u in mode_units)
+    if out.winner_priority is not None and out.winner_priority > prio:
+        return out.deciding_priority, set()
+    clo, chi = allocator.loop_bound(bounds, live)
+    t1 = max(clo, min(chi, out.target_w))
+    before = out.target_w
+    binder = _yield_to(out, t1, _limits_above(site_claims, prio))
+    if binder is None:
+        out.target_w = float(before)
+        return None, set()
+    held = set()
+    for u in mode_units:
+        b = bounds[u]
+        nlo, nhi, note = allocator.unit_interval(b)
+        if note is not None:
+            continue
+        if (nhi < b.hi) if out.target_w > 0 else (nlo > b.lo):
+            held.add(u)
+    return binder.priority, held
diff --git a/goodwe_controller/app/arbitrage.py b/goodwe_controller/app/arbitrage.py
index ff417f1..da18309 100644
--- a/goodwe_controller/app/arbitrage.py
+++ b/goodwe_controller/app/arbitrage.py
@@ -262,10 +262,8 @@ def threshold_eur_kwh(opts: dict) -> float:
     v = float(price_option(opts, "cycle_cost_threshold_eur"))
     if not math.isfinite(v) or v < 0:
         raise ValueError(
-            f"cycle_cost_threshold_eur is {v!r}. It is what a round trip COSTS, "
-            f"in EUR/kWh, so it is non-negative and finite - a negative "
-            f"threshold is one every spread clears, which is arbitrage with the "
-            f"brake removed.")
+            f"“Battery cycle cost” (cycle_cost_threshold_eur) is {v!r}. Set "
+            f"it to 0 or more, in EUR/kWh.")
     return v
 
 
diff --git a/goodwe_controller/app/circulation.py b/goodwe_controller/app/circulation.py
index 41df103..8990376 100644
--- a/goodwe_controller/app/circulation.py
+++ b/goodwe_controller/app/circulation.py
@@ -325,12 +325,13 @@ class CirculationWatchdog:
             return False
 
         self.tripped = True
+        # UX-10: plain sentences, every figure kept (test_messages.py part 6).
         self.reason = (
             f"CIRCULATING_POWER: {circ_w:.0f} W measured going round between "
-            f"the inverters (peak {self.peak_w:.0f} W) for {held:.0f} s "
-            f"continuously - the meter cannot see it, because it nets to zero "
-            f"there (limits: over {self.cfg.min_w:.0f} W, held over "
-            f"{self.cfg.hold_s:.0f} s)")
+            f"the inverters for {held:.0f} s, peaking at {self.peak_w:.0f} W, "
+            f"over the limits of {self.cfg.min_w:.0f} W and "
+            f"{self.cfg.hold_s:.0f} s. The meter cannot see it, because it "
+            f"nets to zero there")
         return True
 
     def held_s(self, now: datetime) -> float:
diff --git a/goodwe_controller/app/clamp.py b/goodwe_controller/app/clamp.py
index d787108..16816a3 100644
--- a/goodwe_controller/app/clamp.py
+++ b/goodwe_controller/app/clamp.py
@@ -73,6 +73,7 @@ An alarm wired only to this module's `ClampResult.engaged` would therefore be
 silent on the exact configuration the whole ticket is about. The winding is
 visible one layer up, at the integrator bound, and that is why `Decision` now
 carries `i_clamped` / `clamped` BOOLEANS and the caller ORs them in here.
+They alarm in different words: see `loop_clamp_note()` (SAFETY-40).
 
 AND WHY BOOLEANS RATHER THAN `Decision.reason`. `reason` is a single string that
 later stages overwrite: a cycle that clamps the integrator and is then slew
@@ -141,6 +142,8 @@ import math
 from dataclasses import dataclass
 from datetime import datetime
 
+from . import messages
+
 # The reason code, distinct from any saturation-freeze code by construction:
 # nothing else in this add-on uses it. See "DISTINCT FROM SATURATION".
 REASON_CODE = "OUTPUT_CLAMP"
@@ -200,9 +203,8 @@ REASON_CODE = "OUTPUT_CLAMP"
 # ceiling rests on one number a test author chose; if that number is ever
 # revisited, this constant moves with it.
 #
-# ⚠️ THIS IS A STOP-GAP AND DOES NOT MAKE THE ALARM CORRECT. The message still
-# calls the integrator bound a BUG SIGNAL and still pairs a request from one
-# moment with a `self.target` read at another - SAFETY-40. Nothing here is
+# ⚠️ THIS WAS A STOP-GAP; the wording and the numbers were SAFETY-40's, fixed
+# in `loop_clamp_note()` below. Nothing here is
 # suppressed: every engagement is still counted, the action-log row is written on
 # every engaged cycle regardless, and the rising edge of every episode alarms
 # unconditionally, so no alarm is DROPPED - only delayed.
@@ -234,6 +236,62 @@ CLEAR_CYCLES = 3
 SUSTAINED_CYCLES = 3
 
 
+# UX-10: the reasons below are quoted by a WARNING or ERROR line, so they
+# follow STYLE.md's rule for a quoted reason (test_messages.py part 6): no
+# final full stop, the line adds it. The line around them says "software
+# fault" for an over-rating, so the reason does not. Each is one sentence, so
+# the logged line stays within 3 sentences and about 30 words.
+
+
+def loop_clamp_note(d) -> str:
+    """The loop-side alarm text for one `control.Decision`, or "".
+
+    SAFETY-40: the integrator bound is anti-windup doing its job and says so;
+    only a command over the rating is a software fault. Every number is the
+    decision's own, i.e. from the tick that clamped.
+    """
+    if d.clamped:
+        return (f"{REASON_CODE}: computed {d.requested_w:+.0f} W, cut to the "
+                f"{d.clamped_w:+.0f} W rating, command now {d.target_w:+.0f} W")
+    if d.i_clamped:
+        return (f"{REASON_CODE}: the correction the add-on builds up reached "
+                f"its {d.i_bound_w:+.0f} W limit, command now "
+                f"{d.target_w:+.0f} W")
+    return ""
+
+
+def shortfall_note(named) -> str:
+    """SAFETY-85: the alarm text while another owner sets the batteries.
+    `named` is `[(inverter name or None, asked W, given W)]`, one per battery
+    that gave less than asked."""
+    return f"{REASON_CODE}: " + ", ".join(
+        f"{name or 'the battery'} gives {given:+.0f} W of the {asked:+.0f} W "
+        f"asked" for name, asked, given in named)
+
+
+def delivery_short(asked_w, given_w, margin_w) -> bool:
+    """SAFETY-85: did a battery asked to discharge give more than `margin_w`
+    less? A charge is never short: a full pack tapers (SAFETY-42 section 7)."""
+    asked, given = float(asked_w), float(given_w)
+    return asked > 0.0 and asked - given > abs(float(margin_w))
+
+
+def write_clamp_note(named) -> str:
+    """The write-side alarm text: `named` is `[(inverter name or None,
+    ClampResult)]` for every inverter whose write was cut back this cycle.
+
+    One inverter reads as `describe()`. Several read as one sentence of
+    asked/sent pairs, so the line stays one sentence however many inverters
+    there are. Which limit cut each one back is on its own action-log row
+    (`describe()`) and in the notification."""
+    if len(named) == 1:
+        name, r = named[0]
+        return f"{name}: {r.describe()}" if name else r.describe()
+    return f"{REASON_CODE}: " + ", ".join(
+        f"{name} asked {r.requested_w:+.0f} W and sent {r.applied_w:+.0f} W"
+        for name, r in named)
+
+
 @dataclass(frozen=True)
 class ClampResult:
     """What the guard did, with the RAW value preserved.
@@ -250,10 +308,12 @@ class ClampResult:
     bound: str = ""          # "" | "max_w" | "device" - which stage bit
 
     def describe(self) -> str:
-        return (f"{REASON_CODE}: the computed setpoint {self.requested_w:+.0f} W "
-                f"was clamped to {self.applied_w:+.0f} W by the {self.bound} "
-                f"bound (rating {self.limit_w:.0f} W) - something upstream is "
-                f"winding")
+        # The sent value IS the limit that bound, so the rating is not
+        # repeated: on "max_w" it equals the rating, and on "device" the
+        # rating was not what cut it back.
+        return (f"{REASON_CODE}: asked {self.requested_w:+.0f} W and sent "
+                f"{self.applied_w:+.0f} W, "
+                f"{messages.LIMIT_WORDS.get(self.bound, self.bound)}")
 
 
 def is_commandable(value) -> bool:
@@ -333,32 +393,80 @@ class ClampWatchdog:
     def __init__(self):
         self.active = False
         self.engagements = 0      # every engagement, never deduplicated
+        # UX-08: the same count split by alarm type, so the status page names
+        # each with its own alarm's title after the episode clears.
+        self.over_rating = 0      # bug=True: "Power request too high"
+        self.bound = 0            # bug=False: "Battery is not keeping up"
         self.episodes = 0         # rising edges
+        # SAFETY-85: episodes with a bug=False engagement. The status row
+        # counts these; counting cycles read 861 on one rig run.
+        self.bound_episodes = 0
+        self._bound_counted = False
         self.since: datetime | None = None
         self.last_alarm: datetime | None = None
         self.reason = ""
+        # UX-08: the numbers behind `reason`, for the notification - set under
+        # the same rule as `reason`, so both always describe the same tick.
+        self.facts = ()
         self.clean_cycles = 0
         # SAFETY-41. Consecutive engaged cycles, and whether THIS episode has
         # spoken yet - the two the escalation clause needs.
         self.run_len = 0
         self.spoken = False
+        # SAFETY-40. Did this episode include a genuine over-rating (`bug`), and
+        # has THAT spoken? A bug has its own budget, so anti-windup notices can
+        # never delay it; with bug=True throughout, cadence is as before.
+        self.bug = False
+        self.bug_spoken = False
+        self.last_bug_alarm: datetime | None = None
 
-    def note(self, engaged: bool, reason: str, now: datetime) -> bool:
+    def _due(self, last, now) -> bool:
+        return last is None or (now - last).total_seconds() >= REASSERT_S
+
+    def _speak(self, now, bug) -> bool:
+        self.last_alarm = now
+        self.spoken = True
+        if bug:
+            self.last_bug_alarm = now
+            self.bug_spoken = True
+        return True
+
+    def note(self, engaged: bool, reason: str, now: datetime,
+             bug: bool = True, facts=()) -> bool:
         """Advance one cycle. True when the caller should raise the alarm.
 
         `now` is the caller's clock, the same discipline as
-        `SignWatchdog.evaluate()` and `FreezeWatchdog.evaluate()`.
+        `SignWatchdog.evaluate()` and `FreezeWatchdog.evaluate()`. `bug` False
+        is the integrator bound (SAFETY-40): counted and notified like the
+        rest, but it never replaces a bug's text within an episode.
         """
         if engaged:
             self.engagements += 1
+            if bug:
+                self.over_rating += 1
+            else:
+                self.bound += 1
             self.clean_cycles = 0
-            self.reason = reason
             self.run_len += 1
-            if not self.active:
+            rising = not self.active
+            if rising:
                 self.active = True
                 self.since = now
                 self.episodes += 1
                 self.spoken = False
+                self.bug = False
+                self.bug_spoken = False
+                self._bound_counted = False
+            if not bug and not self._bound_counted:
+                self._bound_counted = True
+                self.bound_episodes += 1
+            if bug or not self.bug:
+                self.reason = reason
+                self.facts = tuple(facts)
+            self.bug = self.bug or bug
+            if bug and not self.bug_spoken and self._due(self.last_bug_alarm, now):
+                return self._speak(now, True)
+            if rising:
                 # ⚠️ SAFETY-41. THE RISING EDGE IS RATE-LIMITED TOO, and it did
                 # not used to be. It fired unconditionally, so a condition that
                 # engages and clears repeatedly raised one notification PER
@@ -384,11 +492,8 @@ class ClampWatchdog:
                 # still written on every engaged cycle, and a genuine runaway -
                 # which by definition keeps engaging - is picked up by the
                 # re-assert path within REASSERT_S. Delay, not loss.
-                if (self.last_alarm is None
-                        or (now - self.last_alarm).total_seconds() >= REASSERT_S):
-                    self.last_alarm = now
-                    self.spoken = True
-                    return True
+                if self._due(self.last_alarm, now):
+                    return self._speak(now, self.bug)
                 return False
             # ⚠️ THE ESCALATION. An episode that has not yet spoken because the
             # budget was spent by an EARLIER, unrelated episode speaks anyway
@@ -396,15 +501,10 @@ class ClampWatchdog:
             # engages every cycle and reaches it; the scattered one-cycle
             # railing that produced the live flood never does.
             if not self.spoken and self.run_len >= SUSTAINED_CYCLES:
-                self.last_alarm = now
-                self.spoken = True
-                return True
+                return self._speak(now, self.bug)
             # Still engaged: re-assert on the slow cadence, not every cycle.
-            if (self.last_alarm is None
-                    or (now - self.last_alarm).total_seconds() >= REASSERT_S):
-                self.last_alarm = now
-                self.spoken = True
-                return True
+            if self._due(self.last_alarm, now):
+                return self._speak(now, self.bug)
             return False
 
         self.run_len = 0
@@ -420,5 +520,7 @@ class ClampWatchdog:
             # above. The episode ends; the notification budget does not reset
             # with it.
             self.reason = ""
+            self.facts = ()
+            self.bug = False
             self.clean_cycles = 0
         return False
diff --git a/goodwe_controller/app/config_page.py b/goodwe_controller/app/config_page.py
index f596886..953c3f8 100644
--- a/goodwe_controller/app/config_page.py
+++ b/goodwe_controller/app/config_page.py
@@ -413,10 +413,9 @@ function showProblems(payload){
   save.disabled = total > 0;
   if(total){
     note(banner, 'bad', 'This configuration would not start.',
-      'The add-on refuses to run on it and would stop with exit 78. '
-      + 'Saving is blocked until these are fixed; nothing has been written. '
-      + 'Each message below is the add-on\\u2019s own words, from the same '
-      + 'check that runs at startup.');
+      'The add-on would refuse to start on it. Saving is blocked until these '
+      + 'are fixed, and nothing has been written. Each message below comes '
+      + 'from the same check that runs at start.');
     banner.insertBefore(banner.lastChild, banner.firstChild);
     msg(total + (total === 1 ? ' problem' : ' problems')
         + ' - saving is blocked', 'bad');
diff --git a/goodwe_controller/app/configui.py b/goodwe_controller/app/configui.py
index df6fa1d..5437bd0 100644
--- a/goodwe_controller/app/configui.py
+++ b/goodwe_controller/app/configui.py
@@ -289,7 +289,10 @@ def problems_by_field(problems, keys):
     cross-field rule is about all of its fields, and hiding it from one of them
     would be this card's own defect in miniature.
     """
-    patterns = [(key, re.compile(r"(?<![A-Za-z0-9_])" + re.escape(key)
+    # ⚠️ `.` BEFORE THE KEY DOES NOT COUNT (UX-08 2d): `inverters.max_w`
+    # names a setting of one inverter in the list, which is changed under
+    # `inverters`, and it must not also land beside the flat `max_w`.
+    patterns = [(key, re.compile(r"(?<![A-Za-z0-9_.])" + re.escape(key)
                                  + r"(?![A-Za-z0-9_])")) for key in keys]
     by_key, unanchored = {}, []
     for problem in problems:
diff --git a/goodwe_controller/app/control.py b/goodwe_controller/app/control.py
index fa89464..1f2713a 100644
--- a/goodwe_controller/app/control.py
+++ b/goodwe_controller/app/control.py
@@ -17,6 +17,7 @@ exists because its absence produced a specific, observed failure.
 """
 
 import math
+from math import inf
 from dataclasses import dataclass
 
 # ---------------------------------------------------------------------------
@@ -265,6 +266,38 @@ _SAT_COUNT_CAP = SETTLE_CYCLES + 1                           # 13
 # `slew_limit_w()` and therefore with the rail.
 SLEW_LEAD_STEPS = 1
 
+# ---------------------------------------------------------------------------
+# SAFETY-52. A BATTERY THAT REFUSES IS ASKED FOR 0 W, NOT HELD AT ITS LAST ASK.
+#
+# At the BMS cut-out the pack delivers ~0 W whatever it is asked, so the
+# saturation freeze below holds the command where it stood (the recorded
+# 09-06 case: +5000 W for 11.87 h) until the grid error changes sign. The
+# freeze's own exit cannot help: a reading of ~0 against a large ask is inside
+# the interval a limit can produce. So a refused DIRECTION is held at 0 W,
+# carried between cycles like `sat_count`, and left again when the loop wants
+# the other direction, when a small probe is answered, or when the caller
+# resets it (stop, start, another writer). The record is DECISIONS/SAFETY-52.
+#
+# PROBE_W is below freshness.MOVE_W (250 W) on purpose: a probe that small can
+# never arm the stale-reading gate, so it cannot start the gate's ~70 s cycle.
+# test_refusal.py pins the inequality. The cadence and length are the owner's
+# 2026-09-27 answer (every 15 minutes) and freshness.BATT_OBLIGED_S twice over
+# (17 s is how long a healthy reading needs to show a command).
+REFUSED = "battery refuses"
+PROBING = "battery probe"
+PROBE_W = 200.0
+PROBE_ANSWER_W = PROBE_W / 2
+# "Gives nothing" is below the probe's own answer, not below `saturation_w`: a
+# pack derated to 100-499 W is a limit, and at 500 W it kept ~7 % of its power
+# (review of #141). The capture's refusals read -4 W.
+REFUSED_BELOW_W = PROBE_ANSWER_W
+PROBE_EVERY_S = 900.0
+PROBE_S = 34.0
+
+# OPT-11. The loop's reason when the battery modes, not the meter, set the
+# command: every battery that may move this way is at its mode's limit.
+MODE_BOUND = "mode-bound"
+
 
 @dataclass(frozen=True)
 class Tuning:
@@ -340,6 +373,18 @@ class Decision:
     # the comment at the bound below, and clamp.py.
     i_clamped: bool = False
     clamped: bool = False
+    # SAFETY-40. The alarm's numbers, taken at the clamp so they are one tick's:
+    # the bound the integrator reached, and the command before/after the
+    # rating clamp. `target_w` is this tick's emitted command.
+    i_bound_w: float = 0.0
+    requested_w: float = 0.0
+    clamped_w: float = 0.0
+    # SAFETY-52. The refused direction to carry back in (+1 discharge, -1
+    # charge, 0 none), or None when the caller does not carry it.
+    refused: int | None = None
+    # SAFETY-85. The `bound` held the integrator or the command this cycle,
+    # so the batteries' limits, not the loop, decided it.
+    held: bool = False
 
 
 def slew_limit_w(tuning: Tuning) -> float:
@@ -436,6 +481,9 @@ def compute(
     tuning: Tuning,
     sat_count: int = 0,
     i_w: float | None = None,
+    refused: int | None = None,
+    probe: bool = False,
+    bound: tuple | None = None,
 ) -> Decision:
     """One control cycle. A cycle is one meter update (~5 s on a HomeWizard P1).
 
@@ -443,8 +491,27 @@ def compute(
     `grid_w`   net grid power, + = importing
     `actual_w` what the inverter reports it is doing, + = discharging
     `i_w`      the carried integrator, or None to seed it from `prev_w`
+    `refused`  SAFETY-52's carried refused direction, or None to leave it out
+               (the `i_w=None` equivalence path does)
+    `probe`    the caller's clock says a refused direction may try PROBE_W now
+    `bound`    OPT-11: `(lo, hi)`, what the batteries may place this tick with
+               their modes applied (`allocator.loop_bound()`), or None. See
+               MODE_BOUND below. None is the law as it was.
     """
     reason = "tracking"
+    # OPT-11: a bound that leaves out 0 W would FORCE a direction, which no
+    # mode may do. It is dropped rather than obeyed (a software fault, and
+    # main.py never builds one: every term of `loop_bound()` holds 0).
+    if bound is not None and not (bound[0] <= 0.0 <= bound[1]):
+        bound = None
+    # ...and a side of it that reaches the rail is left to the rail, so that
+    # SAFETY-03's `i_clamped` still fires when the loop winds into it. With
+    # every battery on, the bound IS the rail, and the law is exactly as it was.
+    if bound is not None:
+        _rail = min(tuning.max_w, tuning.max_w if tuning.integrator_max_w is None
+                    else tuning.integrator_max_w)
+        bound = (float(bound[0]) if bound[0] > -_rail else -inf,
+                 float(bound[1]) if bound[1] < _rail else inf)
 
     # --- saturation, WITH the duration term -------------------------------
     # Command and actual diverging means the inverter cannot follow - it is at
@@ -547,6 +614,17 @@ def compute(
         else:
             i_w = max(moved, i_w)
 
+    # OPT-11: the integrator does not wind past what the modes let the
+    # batteries place. Only a side tighter than the rail is left in `bound`
+    # (above), so this never takes SAFETY-03's `i_clamped` away from the rail.
+    held_by_bound = False
+    if bound is not None:
+        held = max(float(bound[0]), min(float(bound[1]), i_w))
+        if held != i_w:
+            i_w = held
+            reason = MODE_BOUND
+            held_by_bound = True
+
     # ⚠️ Applied EVERY cycle, frozen or not: the freeze is conditional, this
     # bound is not. It is what makes the worst-case unwind time finite and
     # knowable instead of a function of how long the error happened to stand.
@@ -563,6 +641,7 @@ def compute(
         # winding, "clamped" is a command that came out over the rating anyway.
         reason = "i-clamped"
     i_w = bounded
+    i_bound_w = bounded if i_clamped else 0.0
     want = i_w
 
     # ⚠️ Maintenance shaping (charge-only, cheap-window floor) used to live
@@ -574,6 +653,7 @@ def compute(
     # An early draft applied a floor after the clamp and let demand escape it.
     target = max(-tuning.max_w, min(tuning.max_w, want))
     clamped = target != want
+    clamped_w = target
     if clamped:
         reason = "clamped"
 
@@ -731,6 +811,44 @@ def compute(
             target = min(target, prev_w) if prev_w > 0 else max(target, prev_w)
             reason = "saturated-freeze"
 
+    # --- SAFETY-52: a refused direction is held at 0 W ----------------------
+    # Engages only where the freeze has held for SETTLE_CYCLES and the unit
+    # delivers ~nothing: a reading below REFUSED_BELOW_W against an ask beyond
+    # `saturation_w` is a refusal, not a slow plant. The drop to 0 skips the slew
+    # limit because it only removes an ask the battery is not meeting.
+    if refused is not None:
+        if (refused == 0 and frozen and sat_count >= SETTLE_CYCLES
+                and abs(prev_w) > tuning.saturation_w
+                and abs(actual_w) < REFUSED_BELOW_W):
+            refused = 1 if prev_w > 0 else -1
+        if refused and refused * i_w < 0:
+            refused = 0                          # the loop wants the other way
+        elif refused and refused * actual_w >= PROBE_ANSWER_W:
+            refused = 0                          # it delivers: a probe answered,
+            #                                     or a slow reading arriving
+        elif refused:
+            wants = refused * i_w > 0
+            i_w = 0.0
+            target = refused * PROBE_W if probe and wants else 0.0
+            reason = PROBING if probe and wants else REFUSED
+
+    # --- OPT-11: the command stays inside what the modes allow -------------
+    # Applied after the slew limit and the freeze, so a mode that closes drops
+    # the ask at once rather than one slew step per cycle. That moves no
+    # battery further than the allocator would: it places at most this bound
+    # when the loop decides. What it removes is the unmet part, which would
+    # otherwise hold `prev_w` away from `actual_w` and trip the saturation
+    # freeze on watts no battery was allowed to give.
+    if bound is not None:
+        inside = max(float(bound[0]), min(float(bound[1]), target))
+        if inside != target:
+            target = inside
+            reason = MODE_BOUND
+            held_by_bound = True
+        # SAFETY-48's lead cap above may pull the integrator back toward the
+        # slewed command; what is CARRIED stays inside the bound too.
+        i_w = max(float(bound[0]), min(float(bound[1]), i_w))
+
     # --- quantise ----------------------------------------------------------
     # 10 W. The register is 1 W and the inverter reports at 1 W, but its
     # response lands on a coarser ladder (~17.6 W measured at ~900 W, consistent
@@ -738,9 +856,17 @@ def compute(
     # 10 W simply avoids a visible staircase on dashboards.
     step = max(1, int(tuning.step_w))
     target = round(target / step) * step
+    if bound is not None:
+        # OPT-11: rounding must not step outside the bound. The bound holds
+        # 0 W, so one step toward 0 is always inside it.
+        if target > bound[1]:
+            target -= step
+        elif target < bound[0]:
+            target += step
 
     return Decision(float(target), sat_count, frozen, reason, float(i_w),
-                    i_clamped, clamped)
+                    i_clamped, clamped, float(i_bound_w), float(want),
+                    float(clamped_w), refused, held_by_bound)
 
 
 def maintenance_charge_floor(
diff --git a/goodwe_controller/app/custom_formula.py b/goodwe_controller/app/custom_formula.py
index 2ee0069..b233295 100644
--- a/goodwe_controller/app/custom_formula.py
+++ b/goodwe_controller/app/custom_formula.py
@@ -175,6 +175,8 @@ import math
 from dataclasses import dataclass
 from datetime import date, datetime, timezone
 
+from . import messages
+
 
 class FormulaInvalid(Exception):
     """`price_formula` cannot be used. Raised by the parser, refused by
@@ -199,7 +201,7 @@ RESOLUTIONS: tuple = ("hourly", "quarter_hourly")
 # index id -> the human name of the series it refers to. One entry today; a
 # second index is a new row here plus a fetch path, not a new grammar.
 INDEXES: dict = {
-    "epex_be": "EPEX BE day-ahead, EUR/MWh",
+    "epex_be": "Belgian day-ahead price, EUR/MWh",
 }
 
 # ⚠️ 0.01 IN THE CARD'S OWN UNITS, WHICH IS THE LAST DIGIT BOTH REAL CARDS
@@ -285,87 +287,28 @@ _LEGS = {
                  '"offset":1.00,"units":"c_eur_per_kwh","vat_pct":6,'
                  '"card":{"month":"2026-09","index_eur_per_mwh":133.9905,'
                  '"expect_incl_vat":15.55}}'),
-        when="Leave it empty unless price_provider is 'custom_formula'.",
-        zero_factor=("every spread is exactly 0, and arbitrage can never "
-                     "clear any threshold - a strategy that silently never "
-                     "fires rather than one that is off"),
-        flat=("that is `static_profile` with a single period covering "
-              "00:00-24:00 on all days and price_provider 'off'; the add-on "
-              "then says so at startup instead of leaving you to find out "
-              "from a year of unchanged bills"),
-        neg_factor=("No consumption tariff is indexed negatively; if your "
-                    "card shows a minus sign it is on the OFFSET (`A`), "
-                    "which is allowed here and common on injection"),
+        when="Leave it empty unless “Dynamic price source” is 'custom_formula'.",
+        zero_factor=" and trading never finds a price difference",
+        flat="use “Fixed or day/night tariff” (static_profile) instead",
+        neg_factor="Put the minus sign on the offset, not on the factor",
         card_required=True,
-        card_note=("It is the only thing that can tell a correct pair of "
-                   "coefficients from a plausible-looking wrong one"),
-        card_causes=(
-            "or - the expensive one - network charges, levies or excise "
-            "folded into `offset`. ⚠️ THEY DO NOT BELONG THERE: a Belgian "
-            "card's Tariefformule line is the ENERGY component alone (Eneco "
-            "tabulates network tariffs and levies separately; ENGIE says in "
-            "so many words that the formula excludes network, distribution, "
-            "transport, levies and excise), the add-on adds "
-            "price_taxes_eur_kwh on top of it, and folding ~12 c EUR/kWh of "
-            "network charge into `offset` bills you for it twice. That is "
-            "the error this check exists to catch, and it is why it cannot "
-            "be switched off."),
+        card_note="The add-on needs it to check your two numbers",
+        card_causes=("the units, the VAT, and that network charges are not "
+                     "in the offset"),
     ),
     EXPORT_FORMULA_OPTION: _Leg(
         option=EXPORT_FORMULA_OPTION,
         what="injection",
-        # ⚠️ NO `card` BLOCK IN THE EXAMPLE, because Eneco's injection line has
-        # none to copy - the formula is printed with no price beside it. An
-        # example carrying one would invite an operator to compute the figure
-        # themselves, which is the one thing this leg must not encourage.
         example=('{"index":"epex_be","resolution":"hourly","factor":0.1,'
                  '"offset":-1.188,"units":"c_eur_per_kwh","vat_pct":0}'),
-        when=("Leave it empty unless your supplier pays you an injection "
-              "price that moves with the market; a flat one is "
-              "export_price_eur_kwh. ⚠️ This option is read whatever "
-              "price_provider is set to - it is the leg you are PAID on, not "
-              "the one you buy on."),
-        zero_factor=("every hour pays the same, which is a FLAT injection "
-                     "price written as a formula. ⚠️ Note this is NOT the "
-                     "arbitrage argument the consumption leg gives: no "
-                     "strategy in this add-on reads an injection price at "
-                     "all, so a flat one here fires nothing and declines "
-                     "nothing - it is simply the wrong option"),
-        flat=("that is `export_price_eur_kwh`, the flat injection scalar, "
-              "which is what every site used before this option existed and "
-              "which still answers when this one is empty"),
-        neg_factor=("No Belgian injection tariff is indexed negatively - you "
-                    "are paid MORE when the market is dearer, not less. The "
-                    "minus sign on an injection card is on the OFFSET (`A`): "
-                    "Eneco prints `0,1 x BELPEX-H - 1,188` and Aspiravi "
-                    "`0,07 x Belpex - 2`, and a negative offset is accepted "
-                    "here"),
+        when="Fill it in only if your injection price follows the market.",
+        zero_factor="",
+        flat="use “Injection price” (export_price_eur_kwh) instead",
+        neg_factor="Put the minus sign on the offset, not on the factor",
         card_required=False,
-        card_note=(
-            "⚠️ IT IS OPTIONAL ON THIS LEG, AND THAT IS A STATED GAP RATHER "
-            "THAN A RELAXED RULE. A Belgian card prints the CONSUMPTION "
-            "formula with the reference index and the resulting price beside "
-            "it, which is what makes `price_formula`'s self-check possible. "
-            "Eneco's injection line has NO printed price beside it, so on "
-            "that card there is nothing to grade against and requiring a "
-            "`card` block would make the market's own published formula "
-            "inexpressible - or, worse, invite an operator to compute the "
-            "estimate themselves, at which point the check grades the "
-            "coefficients against arithmetic done with the same coefficients. "
-            "Supply it if YOUR card prints one; when it is absent the add-on "
-            "says at startup that this leg is UNGRADED and the two "
-            "coefficient bounds below are all there is"),
-        card_causes=(
-            "or VAT added where there is none. ⚠️ INJECTION IS VAT-EXEMPT IN "
-            "BELGIUM - \"Injectietarieven zijn vrijgesteld van btw\" - while "
-            "consumption is at 6%, so `vat_pct` on THIS option is 0 on every "
-            "Belgian card the research found, and a 6 typed here because it "
-            "is 6 on the consumption leg is a ratio of exactly 1.06. Nothing "
-            "is added to this leg by the framework: price_taxes_eur_kwh is a "
-            "CONSUMPTION component and is not applied to what you are paid "
-            "for export, so an offset carrying network charges is a "
-            "different error here than it is on price_formula and this "
-            "check cannot tell you which one you made."),
+        card_note=("It is optional here. Without it the add-on only checks "
+                   "the size of your two numbers"),
+        card_causes="the units, and that the VAT is 0 for injection",
     ),
 }
 
@@ -488,16 +431,12 @@ def _finite(value, field: str, option: str = "price_formula") -> float:
     """
     if isinstance(value, bool) or not isinstance(value, (int, float)):
         raise FormulaInvalid(
-            f"{option}.{field} is {value!r}, which is not a number. "
-            f"Write the coefficient as a bare JSON number - 0.102, not "
-            f"\"0.102\" and not an expression: this provider takes FIXED "
-            f"coefficients and evaluates nothing.")
+            f"{option}.{field} is {value!r}, which is not a number. Write a "
+            f"plain number, for example 0.102.")
     if not math.isfinite(float(value)):
         raise FormulaInvalid(
-            f"{option}.{field} is {value!r}, which is not finite. A NaN "
-            f"or an infinity here makes every price NaN, every price "
-            f"comparison False, and an arbitrage strategy that never fires "
-            f"while reporting that it is armed.")
+            f"{option}.{field} is {value!r}, which is not finite. Write a "
+            f"plain number, for example 0.102.")
     return float(value)
 
 
@@ -517,11 +456,8 @@ def _card(raw, leg: _Leg = None) -> tuple:
         if not leg.card_required:
             return ("", None, None)
         raise FormulaInvalid(
-            f"{leg.option} has no \"card\" block, and it is REQUIRED. "
-            f"{leg.card_note}: the add-on recomputes your "
-            "supplier's own printed example from the numbers you typed and "
-            "refuses to start if it does not come out. Copy the three figures "
-            "off the same tariff card as the coefficients: "
+            f"{leg.option} has no \"card\" block. {leg.card_note}. Copy "
+            "the three figures from your tariff card, for example "
             "{\"month\": \"2026-09\", \"index_eur_per_mwh\": 133.9905, "
             "\"expect_incl_vat\": 15.55}.")
     if not isinstance(raw, dict):
@@ -531,16 +467,13 @@ def _card(raw, leg: _Leg = None) -> tuple:
     unknown = sorted(set(raw) - set(_CARD_KEYS))
     if unknown:
         raise FormulaInvalid(
-            f"{leg.option}.card has no field(s) {unknown}. The fields it "
-            f"takes are {list(_CARD_KEYS)}; a key that is merely ignored is a "
-            f"number the operator believes took effect.")
+            f"{leg.option}.card has unknown field(s) {unknown}. It takes "
+            f"only {list(_CARD_KEYS)}.")
     month = str(raw.get("month", "") or "").strip()
     if not _month_date(month):
         raise FormulaInvalid(
-            f"{leg.option}.card.month is {raw.get('month')!r}; write the "
-            f"month the card is dated as \"YYYY-MM\", e.g. \"2026-09\". It is "
-            f"not used in any price - it is what lets the add-on tell you "
-            f"your card has gone stale.")
+            f"{leg.option}.card.month is {raw.get('month')!r}. Write the "
+            f"month of the card as \"YYYY-MM\", for example \"2026-09\".")
     return (month,
             _finite(raw.get("index_eur_per_mwh"), "card.index_eur_per_mwh",
                     leg.option),
@@ -594,10 +527,8 @@ def parse_price_formula(value, *, option: str = "price_formula"):
             value = json.loads(text)
         except ValueError as e:
             raise FormulaInvalid(
-                f"{option} is not valid JSON ({e}). It is a JSON object "
-                f"on one line, e.g.\n"
-                f"  {leg.example}\n"
-                f"{leg.when}")
+                f"{messages.not_valid(option, e)}. Copy the example from the "
+                f"documentation. {leg.when}")
     if not isinstance(value, dict):
         raise FormulaInvalid(
             f"{option} is {type(value).__name__}, not a JSON object with "
@@ -612,34 +543,21 @@ def parse_price_formula(value, *, option: str = "price_formula"):
     unknown = sorted(set(value) - set(_TOP_KEYS))
     if unknown:
         raise FormulaInvalid(
-            f"{option} has no field(s) {unknown}. The fields it takes "
-            f"are {list(_TOP_KEYS)}. ⚠️ There is deliberately NO field that "
-            f"takes an expression: this provider multiplies and adds two "
-            f"FIXED coefficients and evaluates nothing, because two "
-            f"coefficients can be graded against your card's printed price "
-            f"and an arbitrary expression cannot be graded against anything. "
-            f"If your contract needs a shape this cannot express, it needs a "
-            f"new named field here - say which shape.")
+            f"{option} has unknown field(s) {unknown}. It takes only "
+            f"{list(_TOP_KEYS)}.")
 
     index = str(value.get("index", "") or "").strip()
     if index not in INDEXES:
         raise FormulaInvalid(
-            f"{option}.index is {value.get('index')!r}. The reference "
-            f"series this add-on can fetch are "
-            f"{', '.join(f'{k!r} ({v})' for k, v in sorted(INDEXES.items()))}. "
-            f"If your card names a different index, the add-on cannot get it "
-            f"and guessing which series your supplier meant would price your "
-            f"battery against the wrong curve.")
+            f"{option}.index is {value.get('index')!r}. The add-on can only "
+            f"fetch "
+            f"{', '.join(f'{k!r} ({v})' for k, v in sorted(INDEXES.items()))}.")
 
     resolution = str(value.get("resolution", "") or "").strip()
     if resolution not in RESOLUTIONS:
         raise FormulaInvalid(
-            f"{option}.resolution is {value.get('resolution')!r}; it "
-            f"must be one of {list(RESOLUTIONS)}. Belgium has been on a "
-            f"15-minute MTU since 2025-10-01 and the feed publishes 96 points "
-            f"a day; a contract written against the HOURLY series is priced "
-            f"on the mean of each hour's quarters. Which one your contract "
-            f"uses is on your card and cannot be inferred from the feed.")
+            f"{option}.resolution is {value.get('resolution')!r}. Choose one "
+            f"of {list(RESOLUTIONS)}, as your tariff card says.")
 
     # ⚠️ `units` IS REQUIRED AND HAS NO DEFAULT. A default here would be the
     # factor-1000 class with a friendly face: the add-on would silently assume
@@ -648,12 +566,8 @@ def parse_price_formula(value, *, option: str = "price_formula"):
     units = str(value.get("units", "") or "").strip()
     if units not in UNITS:
         raise FormulaInvalid(
-            f"{option}.units is {value.get('units')!r} and is REQUIRED - "
-            f"there is no default, on purpose. It must be one of "
-            f"{sorted(UNITS)}. Your card prints the formula in ONE of these "
-            f"and two suppliers use two different conventions for the same "
-            f"shape, so assuming one would be a factor of 100 or 1000 on "
-            f"every hour with nothing able to notice.")
+            f"{option}.units is {value.get('units')!r}. Choose one of "
+            f"{sorted(UNITS)}, as printed beside the formula on your card.")
 
     factor = _finite(value.get("factor"), "factor", option)
     offset = _finite(value.get("offset"), "offset", option)
@@ -667,10 +581,8 @@ def parse_price_formula(value, *, option: str = "price_formula"):
     # the operator at it rather than let them build it by accident.
     if factor == 0.0:
         raise FormulaInvalid(
-            f"{option}.factor is 0, so the index would not enter the "
-            "price at all: every hour of every day comes out at "
-            f"{offset:g} x (1 + {vat_pct:g}/100), {leg.zero_factor}. If "
-            f"your {leg.what} tariff really is one flat price, {leg.flat}.")
+            f"{option}.factor is 0, so every hour gets the same {leg.what} "
+            f"price{leg.zero_factor}. For one flat price, {leg.flat}.")
 
     # ⚠️ A NEGATIVE FACTOR INVERTS THE MARKET, and the direction is the danger:
     # the dearest hour becomes the cheapest one, so the battery is told to
@@ -678,22 +590,16 @@ def parse_price_formula(value, *, option: str = "price_formula"):
     # mispriced site, it is a site actively trading against itself.
     if factor < 0.0:
         raise FormulaInvalid(
-            f"{option}.factor is {factor:g}, which is NEGATIVE. That "
-            f"inverts the market: the dearest hour of the day comes out as "
-            f"the cheapest one, so the battery would charge at the evening "
-            f"peak and discharge at 03:00 - trading against itself on every "
-            f"cycle. {leg.neg_factor}.")
+            f"{option}.factor is {factor:g}, which turns the market upside "
+            f"down. {leg.neg_factor}.")
 
     # ⚠️ 0 IS LEGITIMATE AND MUST STAY SO: injection is VAT-exempt in Belgium,
     # and some cards are already quoted VAT-inclusive. The bound exists for the
     # 106 / 1.06 / 6 confusion, not to make VAT compulsory.
     if not 0.0 <= vat_pct <= 30.0:
         raise FormulaInvalid(
-            f"{option}.vat_pct is {vat_pct:g} and must be between 0 and "
-            f"30. It is a PERCENTAGE, so Belgian residential electricity is "
-            f"6, not 0.06 and not 106. Zero is legitimate and is not refused: "
-            f"injection is VAT-exempt, and a card that already quotes "
-            f"VAT-inclusive coefficients needs no second multiplication.")
+            f"{option}.vat_pct is {vat_pct:g}. Write a percentage between 0 "
+            f"and 30, for example 6.")
 
     month, card_index, card_expect = _card(value.get("card"), leg)
     spec = FormulaSpec(index=index, resolution=resolution, factor=factor,
@@ -771,33 +677,15 @@ def parse_export_formula(value):
 def card_refusal(spec: FormulaSpec, delta: float) -> str:
     """The sentence an operator reads when their formula misses its own card.
 
-    ⚠️ IT NAMES THE DISCREPANCY AND THE SIX WAYS IT HAPPENS. "Invalid
-    configuration" would be true and useless: every one of these errors looks
-    exactly like a working tariff from the status page, which is why the check
-    exists at all.
+    It names both numbers and what to check. The usual causes are in DOCS.md,
+    because each of these errors looks like a working tariff on the status page.
     """
     got = in_card_units(spec, spec.card_index_eur_per_mwh)
-    ratio = (got / spec.card_expect_incl_vat
-             if spec.card_expect_incl_vat else float("inf"))
     leg = _LEGS[spec.option]
     return (
-        f"{spec.option} does not reproduce its own card, so the add-on will "
-        f"NOT start on it. Your contract's arithmetic is "
-        f"price = (factor x index_eur_per_mwh + offset) x (1 + vat_pct/100); "
-        f"on the card's own index that is "
-        f"({spec.factor:g} x {spec.card_index_eur_per_mwh:g} + "
-        f"{spec.offset:g}) x (1 + {spec.vat_pct:g}/100) = {got:.4f} "
-        f"{spec.units}, but card.expect_incl_vat says "
-        f"{spec.card_expect_incl_vat:g} - OUT BY {delta:+.4f} {spec.units} "
-        f"(ratio {ratio:.4g}; the tolerance is {CARD_TOLERANCE}, which is the "
-        f"last digit a card prints). One of the two sides is wrong and the "
-        f"add-on cannot tell which, so it refuses rather than price a battery "
-        f"on it. The usual causes, in the order they happen: the coefficients "
-        f"and the expected price are in DIFFERENT units (ratio 10, 100 or "
-        f"1000 - `units` must be the one the formula line is printed in); VAT "
-        f"left out or applied twice (ratio 1.06 or 1/1.06); a transposed "
-        f"digit; the two sides copied off DIFFERENT cards or different "
-        f"months; {leg.card_causes}")
+        f"{spec.option} gives {got:.4f} "
+        f"{messages.UNIT_WORDS.get(spec.units, spec.units)}, the card says "
+        f"{spec.card_expect_incl_vat:g}. Check {leg.card_causes}.")
 
 
 # --------------------------------------------------------------------------- #
@@ -852,20 +740,10 @@ def implausible_all_in(spec: FormulaSpec, taxes_eur_kwh: float):
     if energy >= PLAUSIBLE_LO_EUR_KWH and all_in <= PLAUSIBLE_HI_EUR_KWH:
         return None
     return (
-        f"{spec.option}'s own card works out at {energy:.5f} EUR/kWh of "
-        f"energy ({spec.card_expect_incl_vat:g} {spec.units} as the card "
-        f"prints it) and {all_in:.5f} EUR/kWh all-in once "
-        f"price_taxes_eur_kwh is added, which is outside the plausible band "
-        f"{PLAUSIBLE_LO_EUR_KWH}-{PLAUSIBLE_HI_EUR_KWH} EUR/kWh for a Belgian "
-        f"retail tariff. The card self-check passed, so the coefficients and "
-        f"the printed price AGREE - they simply agree on a number no Belgian "
-        f"bill carries, which is what a whole card read in the wrong units "
-        f"looks like (a factor of 10, 100 or 1000 applied to BOTH sides at "
-        f"once cancels out of that check and cannot cancel out of this one). "
-        f"Check `units` against the unit printed beside your formula. "
-        f"⚠️ This bounds the CARD'S OWN POINT, not every hour: a live hour may "
-        f"legitimately fall outside the band, and a negative day-ahead hour - "
-        f"the best charging opportunity of the year - is never refused.")
+        f"{spec.option} gives {energy:.5f} EUR/kWh for energy and "
+        f"{all_in:.5f} EUR/kWh with “Distribution, levies and VAT” "
+        f"(price_taxes_eur_kwh), outside the plausible band of "
+        f"{PLAUSIBLE_LO_EUR_KWH}-{PLAUSIBLE_HI_EUR_KWH} EUR/kWh. Check \"units\" against the unit beside your formula.")
 
 
 def implausible_injection(spec: FormulaSpec):
@@ -914,36 +792,16 @@ def implausible_injection(spec: FormulaSpec):
     """
     if not PASSTHROUGH_LO <= spec.passthrough <= PASSTHROUGH_HI:
         return (
-            f"{spec.option}.factor is {spec.factor:g} {spec.units} per "
-            f"EUR/MWh, which passes through {spec.passthrough:.4g}x the "
-            f"wholesale price - outside the plausible "
-            f"{PASSTHROUGH_LO}-{PASSTHROUGH_HI}x for an injection tariff. A "
-            f"Belgian injection formula pays a share of the market price a "
-            f"little under or about equal to it: Eneco's "
-            f"`0,1 x BELPEX-H - 1,188` c EUR/kWh is 1.00x and Aspiravi's "
-            f"`0,07 x Belpex - 2` is 0.70x. {spec.passthrough:.4g}x is what a "
-            f"factor typed in the wrong units looks like - check `units` "
-            f"({spec.units!r}) against the unit printed beside your formula, "
-            f"because the card self-check cannot see a factor of 10, 100 or "
-            f"1000 applied to BOTH sides at once. ⚠️ This bounds the "
-            f"COEFFICIENT and not the price: an injection price below zero is "
-            f"accepted and is the real market - Eneco's goes negative under "
-            f"11.88 EUR/MWh of BELPEX-H, which is the middle of a sunny day.")
+            f"{spec.option}.factor passes through {spec.passthrough:.4g}x the "
+            f"market price, outside {PASSTHROUGH_LO}-{PASSTHROUGH_HI}x. Check "
+            f"\"units\" ({spec.units!r}) against the unit beside your "
+            f"formula.")
     if abs(spec.offset_eur_kwh) > INJECTION_OFFSET_MAX_EUR_KWH:
         return (
-            f"{spec.option}.offset is {spec.offset:g} {spec.units} = "
-            f"{spec.offset_eur_kwh:+.5f} EUR/kWh, and |offset| above "
-            f"{INJECTION_OFFSET_MAX_EUR_KWH} EUR/kWh is not a Belgian "
-            f"injection tariff in either direction. The published ones are "
-            f"small and NEGATIVE - Eneco -1,188 c EUR/kWh (-0.01188), "
-            f"Aspiravi -2 c (-0.02) - so a minus sign here is expected and is "
-            f"not what this refuses; a MAGNITUDE two orders out is. The usual "
-            f"cause is the offset typed in a different unit from `units` "
-            f"({spec.units!r}), or a consumption offset copied onto the "
-            f"injection leg: they are different numbers on the same card. "
-            f"⚠️ Network charges and levies do not belong here either - "
-            f"nothing is added to what you are PAID for export, so an offset "
-            f"carrying them is simply wrong rather than double-counted.")
+            f"{spec.option}.offset is {spec.offset:g} {spec.units}, which is "
+            f"{spec.offset_eur_kwh:+.5f} EUR/kWh and larger than "
+            f"{INJECTION_OFFSET_MAX_EUR_KWH} EUR/kWh either way. Check its "
+            f"unit.")
     return None
 
 
@@ -957,15 +815,9 @@ def stale_card(spec: FormulaSpec, today=None):
     if dated is None or (now - dated).days <= CARD_STALE_DAYS:
         return None
     return (
-        f"{spec.option}'s card is dated {spec.card_month}, which is "
-        f"{(now - dated).days} days ago. Suppliers reprice: if your contract "
-        f"has been renewed or rolled over since then, the coefficients here "
-        f"are last year's and every price this add-on computes is wrong by "
-        f"however far they moved - and the card self-check cannot see it, "
-        f"because it grades your coefficients against the card you typed, not "
-        f"the card against your current contract. Not refused: ENGIE freezes "
-        f"coefficients for the contract's duration, so an old card is often "
-        f"exactly right. Worth re-reading your klantenzone once.")
+        f"{spec.option}'s card is dated {spec.card_month}, "
+        f"{(now - dated).days} days ago. The add-on still starts, but if your "
+        f"contract changed since, copy the new figures from your supplier.")
 
 
 # --------------------------------------------------------------------------- #
diff --git a/goodwe_controller/app/dayplan.py b/goodwe_controller/app/dayplan.py
new file mode 100644
index 0000000..4bd8ecc
--- /dev/null
+++ b/goodwe_controller/app/dayplan.py
@@ -0,0 +1,262 @@
+"""OPT-11 P4: the day plan. Will the sun fill each battery before the
+expensive hours? If not, how much should it take from the grid?
+
+Pure: the forecast (`solarfc`), the house profile, the price runs and the
+batteries in; a level per battery (`Plan.targets`) out. `modetrade.charge_to()`
+turns the level into permission to charge from the grid; main.py rebuilds the
+plan with the price runs (at most every 15 minutes) and keeps a level unless
+it moves by `HYST_KWH` or `HYST_FRAC` (`hold()`).
+
+The sums (OPT-11-design section 1, "Excess solar", with the owner's answers):
+* `sun`: trust x the solar the house will not use, between now and the
+  expensive run the cheap run is for, x the charge efficiency:
+  `trust x sum_h max(0, forecast_h - house_h) x EFF`.
+* Solar first batteries take it first, up to the ceiling. What is left is
+  shared by the Leftover solar batteries by their room.
+* Cheap hours only ignores the plan and fills to the ceiling, as in P3 and
+  the design (section 1). Skipping the sun's share cost money in the replay
+  (PR #156 review: 29.72 against 29.41 EUR on real 2026 prices).
+* A Leftover solar battery charges only up to what the house will draw from
+  it in the expensive runs before the next cheap run, less its share:
+  `min(ceiling, floor + house use / EFF) - share`. So it buys only the
+  shortfall, not up to the ceiling.
+* Solar first never charges from the grid (owner, 2026-09-29).
+
+The house profile is the add-on's own measurement, grid + battery power, per
+local hour, over the last `PROFILE_DAYS` days; the estimate for an hour is the
+median of that hour. It is net of the solar the house used itself, so for
+the solar sum it is never taken below the night-time median (`base()`).
+The site's own solar readings are not used: TEL-11 keeps them out of every
+control decision.
+"""
+
+import statistics
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+
+from .packmode import LEFTOVER_SOLAR, SOLAR_FIRST
+from .tariff import BILLING_TZ
+
+EFF = 0.95                  # charge (and discharge) efficiency
+HYST_KWH = 1.0              # a kept level moves only by this much...
+HYST_FRAC = 0.10            # ...or this share of the battery's shortfall
+PROFILE_DAYS = 7
+MIN_HOURS = 20              # hours of a day recorded before it counts
+NIGHT_HOURS = (0, 1, 2, 3, 4, 5, 22, 23)
+DEFAULT_TRUST_PCT = 70
+
+# Site verdicts (the page's forecast line).
+SUNNY, PARTLY, DARK = "sunny", "partly", "dark"
+
+
+# --------------------------------------------------------------------------- #
+# The house profile
+# --------------------------------------------------------------------------- #
+def _local(t: datetime):
+    return t.astimezone(BILLING_TZ)
+
+
+class HouseProfile:
+    """Hourly means of the house's net use (grid + battery power), kept per
+    local day and hour: `{"YYYY-MM-DD": {hour: [mean_w, samples]}}`. The
+    store holds `dump()`; `load()` takes it back and drops what is bad."""
+
+    def __init__(self, data=None):
+        self.days = {}
+        self._cur = None            # (day, hour, sum, n)
+        if isinstance(data, dict):
+            self.load(data)
+
+    def load(self, data):
+        for day, hours in data.items():
+            try:
+                datetime.strptime(str(day), "%Y-%m-%d")
+            except ValueError:
+                continue
+            if not isinstance(hours, dict):
+                continue
+            row = {}
+            for h, v in hours.items():
+                try:
+                    hi, w = int(h), float(v)
+                except (TypeError, ValueError):
+                    continue
+                if 0 <= hi < 24 and abs(w) < 1e6:
+                    row[hi] = w
+            if row:
+                self.days[str(day)] = row
+
+    def dump(self) -> dict:
+        return {d: {str(h): round(w, 1) for h, w in sorted(r.items())}
+                for d, r in sorted(self.days.items())}
+
+    def add(self, now: datetime, house_w) -> bool:
+        """One reading. Returns True when an hour closed (then store it)."""
+        lt = _local(now)
+        key = (lt.strftime("%Y-%m-%d"), lt.hour)
+        closed = False
+        if self._cur is not None and self._cur[:2] != key:
+            day, hour, s, n = self._cur
+            if n >= 60:                 # about 5 minutes of readings
+                self.days.setdefault(day, {})[hour] = s / n
+                closed = True
+            self._cur = None
+            self._prune(lt)
+        if house_w is None:
+            return closed
+        if self._cur is None:
+            self._cur = (key[0], key[1], 0.0, 0)
+        d, h, s, n = self._cur
+        self._cur = (d, h, s + float(house_w), n + 1)
+        return closed
+
+    def _prune(self, lt):
+        """Keep the last `PROFILE_DAYS` days; a day after today (the clock
+        was wrong once) would never age out, so it goes too."""
+        keep = (lt.date() - timedelta(days=PROFILE_DAYS)).isoformat()
+        today = lt.date().isoformat()
+        for d in [d for d in self.days if d < keep or d > today]:
+            del self.days[d]
+
+    def ready(self) -> bool:
+        """At least one day with `MIN_HOURS` hours recorded."""
+        return any(len(r) >= MIN_HOURS for r in self.days.values())
+
+    def hour_w(self, hour: int):
+        vals = [r[hour] for r in self.days.values() if hour in r]
+        return statistics.median(vals) if vals else None
+
+    def base(self):
+        vals = [w for h in NIGHT_HOURS if (w := self.hour_w(h)) is not None]
+        return statistics.median(vals) if vals else None
+
+    def estimator(self):
+        """`f(hour) -> W`, or None when not ready. Fixed at call time."""
+        if not self.ready():
+            return None
+        base = self.base() or 0.0
+        table = {}
+        for h in range(24):
+            w = self.hour_w(h)
+            table[h] = base if w is None else w
+        return lambda h: table[h], max(0.0, base)
+
+
+# --------------------------------------------------------------------------- #
+# The plan
+# --------------------------------------------------------------------------- #
+@dataclass(frozen=True)
+class Plan:
+    verdict: str                # SUNNY / PARTLY / DARK
+    sun_kwh: float              # solar the batteries can count on
+    fc_kwh: float               # the forecast over the same span
+    until: datetime             # the expensive run the plan is for
+    targets: dict               # name -> level % (Leftover solar only)
+    need_kwh: dict              # name -> kWh from the grid (0: none)
+    share_kwh: dict             # name -> kWh of solar counted for it
+
+
+def _hour_slices(t0, t1):
+    """Local-hour slices of [t0, t1): (start, end, local hour)."""
+    out, t = [], t0
+    while t < t1:
+        lt = _local(t)
+        nxt = (lt.replace(minute=0, second=0, microsecond=0)
+               + timedelta(hours=1)).astimezone(timezone.utc)
+        e = min(nxt, t1)
+        out.append((t, e, lt.hour))
+        t = e
+    return out
+
+
+def _room(p, to_pct):
+    if p.capacity_kwh is None or p.soc is None:
+        return 0.0
+    return max(0.0, float(to_pct) - float(p.soc)) / 100.0 * float(
+        p.capacity_kwh)
+
+
+def plan(forecast, house, runs, now, packs, *, trust_pct, floor_pct,
+         ceiling_pct):
+    """The day plan, or None when there is none to make: no forecast, no
+    house profile yet, no price plan, or no expensive run after the cheap
+    run. `house` is `HouseProfile.estimator()`'s answer. `packs` are
+    `modetrade.Pack`s."""
+    if forecast is None or house is None or runs is None or not runs.on \
+            or runs.cheap is None:
+        return None
+    house_w, base_w = house
+    until = next((g for g in runs.give if g.start >= runs.cheap.end), None)
+    if until is None:
+        return None
+    trust = max(0.0, min(1.0, float(trust_pct) / 100.0))
+    sun = fc_sum = 0.0
+    for s, e, h in _hour_slices(now, until.start):
+        pv = forecast.between(s, e)
+        if pv is None:
+            return None             # the span reaches a day with no forecast
+        hrs = (e - s).total_seconds() / 3600.0
+        use = max(house_w(h), base_w) * hrs / 1000.0
+        sun += max(0.0, pv - use)
+        fc_sum += pv
+    sun *= trust * EFF
+
+    usable = [p for p in packs if p.use and p.live and p.idle
+              and p.soc is not None and p.capacity_kwh]
+    sf = [p for p in usable if p.mode == SOLAR_FIRST]
+    price = [p for p in usable if p.mode == LEFTOVER_SOLAR]
+    sf_room = sum(_room(p, ceiling_pct) for p in sf)
+    excess = max(0.0, sun - sf_room)
+    rooms = {p.name: _room(p, ceiling_pct) for p in price}
+    total_room = sum(rooms.values())
+
+    # What the house draws in the expensive runs from the one this plan is
+    # for until the next cheap run (or a day), from the profile.
+    horizon = until.start + timedelta(hours=24)
+    use_kwh = 0.0
+    for g in runs.give:
+        if g.start < until.start or g.start >= horizon:
+            continue
+        for s, e, h in _hour_slices(g.start, g.end):
+            use_kwh += max(0.0, house_w(h)) * (
+                e - s).total_seconds() / 3600.0 / 1000.0
+    caps = {p.name: float(p.capacity_kwh) for p in price}
+    cap_sum = sum(caps.values()) or 1.0
+
+    targets, need, share = {}, {}, {}
+    for p in price:
+        sh = excess * rooms[p.name] / total_room if total_room > 0 else 0.0
+        sh_pct = sh / caps[p.name] * 100.0
+        want = use_kwh * caps[p.name] / cap_sum / EFF
+        top = min(float(ceiling_pct),
+                  float(floor_pct) + want / caps[p.name] * 100.0)
+        level = max(0.0, top - sh_pct)
+        targets[p.name] = round(level, 2)
+        need[p.name] = round(_room(p, level), 3)
+        share[p.name] = round(sh, 3)
+    if sun < sf_room:
+        verdict = DARK
+    elif any(v > 0.05 for v in need.values()):
+        verdict = PARTLY
+    else:
+        verdict = SUNNY
+    return Plan(verdict, round(sun, 3), round(fc_sum, 3), until.start,
+                targets, need, share)
+
+
+def hold(old: dict | None, new: dict, capacity: dict) -> dict:
+    """Hysteresis: a battery keeps its old level unless the new one differs
+    by at least `HYST_KWH`, or by `HYST_FRAC` of the larger level's energy
+    (whichever is less). A battery new to the plan takes its level at once;
+    one that left the plan is dropped at once."""
+    out = {}
+    for name, level in new.items():
+        was = (old or {}).get(name)
+        cap = float(capacity.get(name) or 0.0)
+        if was is None or cap <= 0:
+            out[name] = level
+            continue
+        moved = abs(level - was) / 100.0 * cap
+        step = min(HYST_KWH, HYST_FRAC * max(was, level) / 100.0 * cap)
+        out[name] = level if moved >= step else was
+    return out
diff --git a/goodwe_controller/app/freeze.py b/goodwe_controller/app/freeze.py
index 3e1c46d..b07199a 100644
--- a/goodwe_controller/app/freeze.py
+++ b/goodwe_controller/app/freeze.py
@@ -424,15 +424,17 @@ class FreezeWatchdog:
         # page was telling, printed into the log and the HA notification where
         # it would outlive the page.
         ceiling = rail_ceiling_w(max_w, dev_min=dev_min, dev_max=dev_max)
+        # UX-10: plain sentences, every figure kept (test_messages.py part 6).
         capped = ("" if ceiling >= abs(float(max_w))
                   else f", capped from max_w {float(max_w):.0f} W by the "
-                       f"setpoint device's own rating")
+                       f"inverter's own rating")
         self.reason = (
-            f"METER_FROZEN: the meter has answered {float(unchanged_s):.0f} s "
-            f"without its measurement changing while the command stands at "
-            f"{float(commanded_w):+.0f} W, at the {ceiling:.0f} W rail{capped} "
-            f"(limits: unchanged over {self.cfg.hold_s:.0f} s, command over "
-            f"{rail_w(max_w, dev_min=dev_min, dev_max=dev_max):.0f} W)")
+            f"METER_FROZEN: the meter has not changed for "
+            f"{float(unchanged_s):.0f} s while the command is "
+            f"{float(commanded_w):+.0f} W, at the {ceiling:.0f} W limit"
+            f"{capped}. Limits: unchanged over {self.cfg.hold_s:.0f} s, "
+            f"command over "
+            f"{rail_w(max_w, dev_min=dev_min, dev_max=dev_max):.0f} W")
         if self.active:
             return False
         self.active = True
diff --git a/goodwe_controller/app/freshness.py b/goodwe_controller/app/freshness.py
index 4527243..7281d7a 100644
--- a/goodwe_controller/app/freshness.py
+++ b/goodwe_controller/app/freshness.py
@@ -594,31 +594,26 @@ class Freshness:
         # ("what did the register do" against "can I trust this entity"). One
         # helper serving both would have to drop whichever half the other does
         # not need, and the half it dropped would be the operator's next step.
-        self.reason = (
-            f"STALE_READING: {self.held:+.0f} unchanged for {shown_s:.0f} s "
-            f"while the standing command moved {moved_w:.0f} W to "
-            f"{standing_w:+.0f} W. TWO THINGS LOOK LIKE THIS AND THIS GATE "
-            f"CANNOT TELL THEM APART: the register may have stopped reporting "
-            f"reality, or the source may be unable to comply with the command "
-            f"- a pack the BMS is refusing holds still under any setpoint, and "
-            f"an honest register then reads exactly like a frozen one. Either "
-            f"way the number cannot be read as this command's effect, so it is "
-            f"reported as MISSING rather than as a measurement (limits: "
-            f"unchanged over {self.bound.unchanged_s:.0f} s, command over "
-            f"{self.bound.move_w:.0f} W and moved by over "
-            f"{self.bound.move_w:.0f} W)")
+        # UX-10: two plain sentences (test_messages.py part 6). SAFETY-56's
+        # two explanations stay, in this order, and so does the admission
+        # that this check cannot tell them apart. The reading is treated as
+        # missing either way, which the log line around this says. The
+        # limits (`self.bound`) are on main.py's DEBUG line beside it, so the
+        # logged line stays within 3 sentences.
         # ⚠️ SAFETY-57, AND THE THREE DURATIONS ARE THREE DIFFERENT FACTS, each
-        # in its own slot: the register's unchanged time is in the sentence
-        # above, the WINDOW this verdict actually rests on is here, and so is
-        # how many times this unit has been round the loop. Without the second
-        # one the sentence reads as though 92 s of unchanged register were what
-        # was compared against the 35 s limit, and it was not.
-        if self.releases:
-            self.reason += (
-                f" [re-graded: the {held_s:.0f} s window this verdict rests on "
-                f"opened when the previous one was withdrawn, not when the "
-                f"register last moved - this unit has now been graded "
-                f"{self.releases + 1} times]")
+        # in its own slot: the register's unchanged time, the WINDOW this
+        # verdict actually rests on after a release (`regraded`), and how many
+        # times this unit has been round the loop. Without the second one the
+        # sentence reads as though 92 s of unchanged register were what was
+        # compared against the 35 s limit, and it was not.
+        regraded = (f", checked {self.releases + 1} times over a {held_s:.0f} s "
+                    f"window since the last stop was withdrawn"
+                    if self.releases else "")
+        self.reason = (
+            f"STALE_READING: {self.held:+.0f} W unchanged for {shown_s:.0f} s "
+            f"while the command moved {moved_w:.0f} W to {standing_w:+.0f} W"
+            f"{regraded}. The reading may have stopped, or the battery may be "
+            f"unable to follow the command, and this check cannot tell which")
 
     def unchanged_s(self, now_mono) -> float | None:
         """Seconds since an arrival carried a different number. Status page.
diff --git a/goodwe_controller/app/haentities.py b/goodwe_controller/app/haentities.py
new file mode 100644
index 0000000..4aa47d8
--- /dev/null
+++ b/goodwe_controller/app/haentities.py
@@ -0,0 +1,115 @@
+"""UX-13: Home Assistant's entities, for the settings page's entity picker.
+
+A read of `GET /api/states` through the add-on's own session (hass.states()),
+cached for 30 s and trimmed to what a picker shows. Nothing here writes, so
+UX-02 §6 holds. When Home Assistant does not answer, the last good list is
+served with its age, or an empty one that says why: the route never fails.
+"""
+
+import asyncio
+import time
+
+CACHE_S = 30.0
+DOWN_TEXT = "Home Assistant is not answering, so the entity list is empty."
+STALE_TEXT = "Home Assistant is not answering, so this list may be old."
+_POWER_UNITS = ("mW", "W", "kW", "MW", "GW", "TW")
+_TO_W = {"mW": 0.001, "W": 1.0, "kW": 1000.0, "MW": 1e6}
+_ENERGY_UNITS = ("Wh", "kWh", "MWh", "GWh")
+
+
+def row(state: dict) -> dict | None:
+    """One state object -> {entity_id, name, state, unit, device_class}."""
+    if not isinstance(state, dict) or not isinstance(state.get("entity_id"), str):
+        return None
+    attrs = state.get("attributes") if isinstance(state.get("attributes"), dict) else {}
+    return {"entity_id": state["entity_id"],
+            "name": str(attrs.get("friendly_name") or state["entity_id"]),
+            "state": state.get("state"),
+            "unit": attrs.get("unit_of_measurement"),
+            "device_class": attrs.get("device_class")}
+
+
+def watts(r: dict | None):
+    """A power entity's reading in W, or None when it is not a number in a
+    power unit (the setup wizard's kettle test)."""
+    if not r or r.get("unit") not in _TO_W:
+        return None
+    try:
+        value = float(r.get("state"))
+    except (TypeError, ValueError):
+        return None
+    return value * _TO_W[r["unit"]] if value == value else None
+
+
+def matches(r: dict, kind: str) -> bool:
+    """Is `r` what a picker of this kind offers first? `kind` is one of
+    uilayout.ENTITY_KINDS; "" or "any" offers everything."""
+    unit, cls = r.get("unit"), r.get("device_class")
+    if kind in ("power", "power_w"):
+        return cls == "power" or unit in _POWER_UNITS
+    if kind == "energy":
+        return cls == "energy" or unit in _ENERGY_UNITS
+    if kind == "pct":
+        return unit == "%"
+    if kind == "number":
+        return r["entity_id"].startswith(("number.", "input_number."))
+    return True
+
+
+class EntityCache:
+    """The last entity list read from Home Assistant, at most CACHE_S old."""
+
+    def __init__(self, hass, clock=time.monotonic):
+        self.hass = hass
+        self.clock = clock
+        self.rows: dict | None = None
+        self.read_at: float | None = None
+        self.tried_at: float | None = None
+        self._lock = asyncio.Lock()
+
+    async def get(self, max_age: float = CACHE_S
+                  ) -> tuple[dict | None, float | None]:
+        """(rows by entity id, age in s), or (None, None) if never read.
+        `max_age` is how old a try may be before HA is asked again: the setup
+        wizard's last step asks for a list at most a few seconds old."""
+        async with self._lock:      # one HA read however many pickers ask
+            now = self.clock()
+            # A failed read also waits CACHE_S, so polls while HA is down do
+            # not queue one 10 s read each behind this lock.
+            if self.tried_at is None or now - self.tried_at >= max_age:
+                self.tried_at = now
+                states = await self.hass.states()
+                if states is not None:
+                    rows = (row(s) for s in states)
+                    self.rows = {r["entity_id"]: r for r in rows if r}
+                    self.read_at = now
+            if self.read_at is None:
+                return None, None
+            return self.rows, now - self.read_at
+
+    async def reading(self, entity_id: str) -> dict:
+        """One entity read now, not from the list: the kettle test compares
+        two readings seconds apart, which a 30 s list cannot. A read only."""
+        r = row(await self.hass.state(entity_id)) if entity_id else None
+        return {"entity_id": entity_id, "found": r is not None,
+                "state": r and r["state"], "unit": r and r["unit"],
+                "watts": watts(r)}
+
+    def peek(self) -> dict | None:
+        """The cached rows if they are fresh, without asking Home Assistant."""
+        if self.read_at is None or self.clock() - self.read_at >= CACHE_S:
+            return None
+        return self.rows
+
+    async def payload(self, kind: str = "") -> dict:
+        """The route's JSON: matching entities first, then the rest."""
+        rows, age = await self.get()
+        if rows is None:
+            return {"available": False, "text": DOWN_TEXT, "entities": []}
+        ordered = sorted(rows.values(), key=lambda r: r["entity_id"])
+        first = [dict(r, match=True) for r in ordered if matches(r, kind)]
+        rest = [dict(r, match=False) for r in ordered if not matches(r, kind)]
+        out = {"available": True, "age_s": round(age, 1), "entities": first + rest}
+        if age >= CACHE_S:
+            out["text"] = STALE_TEXT
+        return out
diff --git a/goodwe_controller/app/hass.py b/goodwe_controller/app/hass.py
index 7ea8bb1..2f75fa7 100644
--- a/goodwe_controller/app/hass.py
+++ b/goodwe_controller/app/hass.py
@@ -16,12 +16,53 @@ _LOG = logging.getLogger("goodwe.hass")
 CORE_API = "http://supervisor/core/api"
 SUPERVISOR_API = "http://supervisor"
 BAD_STATES = ("unknown", "unavailable", "none", "")
+# What the Supervisor's proxy answers while Home Assistant restarts.
+UNAVAILABLE = (502, 503, 504)
+STATES_TIMEOUT_S = 10       # UX-13's entity list, like every other read here
+
+
+class Outage:
+    """UX-10: Home Assistant not answering, said in one plain line per outage.
+
+    A restart takes the REST API and the meter websocket down together, and
+    each used to log the library's own text for every entity and service
+    ("502, message='Bad Gateway', url=URL(...)", "Received message 8:1000 is
+    not str"). Now the first channel to fail says it once at WARNING, the raw
+    text goes to DEBUG, and the last channel to recover says so at INFO.
+    """
+
+    def __init__(self):
+        self.down_on = set()
+
+    def down(self, channel: str, what: str, detail) -> None:
+        if not self.down_on:
+            _LOG.warning("Home Assistant is not answering (%s), perhaps it is "
+                         "restarting. The add-on keeps trying.", what)
+        self.down_on.add(channel)
+        _LOG.debug("Home Assistant not answering on %s: %s", channel, detail)
+
+    def up(self, channel: str) -> None:
+        if channel in self.down_on:
+            self.down_on.discard(channel)
+            if not self.down_on:
+                _LOG.info("Home Assistant answers again.")
+
+
+OUTAGE = Outage()
+
+
+class ReadOnly(RuntimeError):
+    """A service call on a read-only HomeAssistant (UX-15 setup-only mode)."""
 
 
 class HomeAssistant:
-    def __init__(self, session: aiohttp.ClientSession, token: str | None = None):
+    def __init__(self, session: aiohttp.ClientSession, token: str | None = None,
+                 *, read_only: bool = False):
         self.session = session
         self.token = token or os.environ.get("SUPERVISOR_TOKEN", "")
+        # UX-15: setup-only mode reads Home Assistant and calls no service.
+        # Fixed at construction; `call()` refuses before it sends anything.
+        self._read_only = bool(read_only)
         self._last_moan: dict[str, float] = {}
         if not self.token:
             _LOG.error("SUPERVISOR_TOKEN missing - is this running as an add-on?")
@@ -58,13 +99,61 @@ class HomeAssistant:
             async with self.session.get(
                 f"{CORE_API}/states/{entity_id}", headers=self._headers, timeout=10
             ) as resp:
+                if resp.status in UNAVAILABLE:
+                    OUTAGE.down("api", f"error {resp.status}",
+                                f"read {entity_id}: {resp.status}")
+                    return None
+                OUTAGE.up("api")
                 if resp.status == 404:
                     return None
                 resp.raise_for_status()
-                return await resp.json()
-        except (aiohttp.ClientError, TimeoutError) as err:
+                obj = await resp.json()
+        except aiohttp.ClientConnectionError as err:
+            OUTAGE.down("api", "no connection", f"read {entity_id}: {err}")
+            return None
+        # SAFETY-61: an undecodable body is an absence like any other failed
+        # read, never an exception into the control loop.
+        except (aiohttp.ClientError, TimeoutError, ValueError) as err:
             self._moan(f"read:{entity_id}", "read %s failed: %s", entity_id, err)
             return None
+        if not isinstance(obj, dict):
+            self._moan(f"shape:{entity_id}", "read %s: not a state object: %.80r",
+                       entity_id, obj)
+            return None
+        return obj
+
+    async def states(self) -> list | None:
+        """Every entity's state object (`GET /api/states`), or None when Home
+        Assistant does not answer. A read only (UX-13 entity picker)."""
+        try:
+            async with self.session.get(
+                f"{CORE_API}/states", headers=self._headers,
+                timeout=STATES_TIMEOUT_S
+            ) as resp:
+                if resp.status in UNAVAILABLE:
+                    OUTAGE.down("api", f"error {resp.status}",
+                                f"read all states: {resp.status}")
+                    return None
+                OUTAGE.up("api")
+                resp.raise_for_status()
+                obj = await resp.json()
+        except aiohttp.ClientConnectionError as err:
+            OUTAGE.down("api", "no connection", f"read all states: {err}")
+            return None
+        # A timeout's own text is empty, so the line names the wait instead
+        # (UX-13 P1 test, c).
+        except TimeoutError:
+            self._moan("read:*", "Reading the entity list failed: no answer "
+                       "within %s seconds.", STATES_TIMEOUT_S)
+            return None
+        except (aiohttp.ClientError, ValueError) as err:
+            self._moan("read:*", "Reading the entity list failed: %s",
+                       str(err) or type(err).__name__)
+            return None
+        if not isinstance(obj, list):
+            self._moan("shape:*", "The entity list is not a list: %.80r", obj)
+            return None
+        return obj
 
     async def number(self, entity_id: str, invert: bool = False) -> float | None:
         """Numeric state, or None. Never substitutes a default."""
@@ -100,24 +189,55 @@ class HomeAssistant:
                 return None
         return (_f("min"), _f("max"), _f("step"))
 
+    @property
+    def read_only(self) -> bool:
+        return self._read_only
+
     async def call(self, domain: str, service: str, data: dict) -> bool:
+        if self._read_only:
+            # Every service call, `number.set_value` included, goes through
+            # here, so setup-only mode has no way to command (DECISIONS UX-15).
+            _LOG.error("Setup-only mode called no service, because it may not "
+                       "command anything.")
+            raise ReadOnly(f"{domain}.{service} refused: setup-only mode")
         try:
             async with self.session.post(
                 f"{CORE_API}/services/{domain}/{service}",
                 headers=self._headers, json=data, timeout=10,
             ) as resp:
+                if resp.status in UNAVAILABLE:
+                    OUTAGE.down("api", f"error {resp.status}",
+                                f"service {domain}.{service}: {resp.status}")
+                    return False
+                OUTAGE.up("api")
                 if resp.status >= 400:
                     body = await resp.text()
                     # 400 here usually means out-of-range for the entity - the
                     # value is rejected outright, not clamped. Always log it:
                     # silently dropped commands are how a controller ends up
                     # believing something the hardware never did.
+                    # UX-10: plain words. While Home Assistant loads its
+                    # entities it answers 400 with only "400: Bad Request",
+                    # which says nothing, so only a body with more is quoted.
+                    said = body.strip()[:200]
+                    if said.lower() in (f"{resp.status}: {resp.reason}".lower(),
+                                        ""):
+                        said = "no details"
+                    entity = (data.get("entity_id", "no entity")
+                              if isinstance(data, dict) else "no entity")
                     self._moan(f"svc:{domain}.{service}",
-                               "service %s.%s rejected (%s): %s",
-                               domain, service, resp.status, body[:200])
+                               "Home Assistant refused %s.%s for %s (error %s, "
+                               "%s). The entity may still be loading, or the "
+                               "value is out of range.", domain, service,
+                               entity, resp.status, said)
                     return False
                 return True
-        except (aiohttp.ClientError, TimeoutError) as err:
+        except aiohttp.ClientConnectionError as err:
+            OUTAGE.down("api", "no connection",
+                        f"service {domain}.{service}: {err}")
+            return False
+        # ValueError: an undecodable error body (SAFETY-61) is a failed write.
+        except (aiohttp.ClientError, TimeoutError, ValueError) as err:
             self._moan(f"svcerr:{domain}.{service}", "service %s.%s failed: %s",
                        domain, service, err)
             return False
diff --git a/goodwe_controller/app/homeview.py b/goodwe_controller/app/homeview.py
new file mode 100644
index 0000000..6cfccc7
--- /dev/null
+++ b/goodwe_controller/app/homeview.py
@@ -0,0 +1,1402 @@
+"""UX-13 P1: the Home screen's part of `/status`, built from what the add-on
+already knows and already plans. Reads only; commands nothing.
+
+`build(controller)` returns `now`, `batteries`, `plan`, `attention`,
+`month_peak`, `control` and `state`. The old fields (`banner`, `rows`,
+`checks`, ...) stay beside them for the installer details and for anything
+that reads the JSON. See DECISIONS/UX-13-one-layout-table.md and the design
+note, section 3.3.
+
+The plan shows only what the add-on does today: trading on price (the
+arbitrage verdict, the same call the control cycle makes), the monthly battery
+cycle, the peak limit and "follows the house". OPT-11 P1 adds each battery's
+switch and mode to its row; P3 adds each battery's price runs and its role this
+cycle (`Controller.mode_runs`, `mode_tick`), read as the control cycle left
+them, so nothing here invents a plan. Every sentence is in the words
+section at the bottom and is held to STYLE.md by test_messages.py.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+from . import arbitrage, messages, peakguard, uitext
+from .maintenance import CHARGE as M_CHARGE, DRAIN as M_DRAIN, HOLD as M_HOLD
+from .maintenance import IDLE as M_IDLE
+from .packmode import CHEAP_HOURS, GRID_CHARGE_MODES, LEFTOVER_SOLAR, SOLAR_FIRST
+from .price import Absence, Uncertainty, brussels
+from .static_tariff import static_plan
+from .tariff import BILLING_TZ
+from .uimodel import REGION_PRESETS, options_to_ui
+
+# A battery at or under this many watts is resting, not charging or giving.
+IDLE_W = 50.0
+# Display only: the lowest third of today's price range is "cheap", the top
+# third "expensive". A price range under this is flat, and nothing is marked.
+FLAT_EUR_KWH = 0.01
+
+# Severity words the page shows; the same four as STYLE.md section 3.
+ALARM, WARNING, INFO = messages.ALARM, messages.WARNING, messages.INFO
+
+
+# --------------------------------------------------------------------------- #
+# Time: today's local day, on the billing calendar
+# --------------------------------------------------------------------------- #
+def local_day(now: datetime):
+    """`(midnight_utc, next_midnight_utc)` of the local day holding `now`."""
+    here = now.astimezone(BILLING_TZ)
+    start = datetime(here.year, here.month, here.day, tzinfo=BILLING_TZ)
+    nxt = start.date() + timedelta(days=1)
+    end = datetime(nxt.year, nxt.month, nxt.day, tzinfo=BILLING_TZ)
+    return start.astimezone(timezone.utc), end.astimezone(timezone.utc)
+
+
+def _hours(t: datetime, day0: datetime) -> float:
+    return (t - day0).total_seconds() / 3600.0
+
+
+def hhmm(t: datetime) -> str:
+    return f"{brussels(t):%H:%M}"
+
+
+# --------------------------------------------------------------------------- #
+# Now
+# --------------------------------------------------------------------------- #
+def flow(w, *, shadow=False):
+    """`charging` / `giving` / `resting` / None for one battery power."""
+    if w is None:
+        return None
+    if shadow:
+        return "resting"
+    if w > IDLE_W:
+        return "giving"
+    if w < -IDLE_W:
+        return "charging"
+    return "resting"
+
+
+def now_block(*, grid_w, pv_w, batt_w, has_solar, shadow, settled=True):
+    """The four tiles. `house_w` needs all three readings, so without a solar
+    reading it is None rather than a number that leaves the sun out."""
+    house, disagree = None, False
+    if has_solar and None not in (grid_w, pv_w, batt_w):
+        house = float(grid_w) + float(pv_w) + float(batt_w)
+        # The three are read at slightly different moments, so the sum can dip
+        # under zero. Inside the idle band that is 0 W; beyond it the readings
+        # disagree and no house figure is shown.
+        if house < -IDLE_W:
+            house, disagree = None, True
+        elif house < 0.0:
+            house = 0.0
+    return {
+        "solar_w": None if pv_w is None else float(pv_w),
+        "house_w": house,
+        "grid_w": None if grid_w is None else float(grid_w),
+        "batt_w": None if batt_w is None else float(batt_w),
+        "has_solar": bool(has_solar),
+        "lines": {
+            "solar": tile_solar(pv_w, has_solar),
+            "house": tile_house(house, has_solar, disagree),
+            "grid": tile_grid(grid_w),
+            "batt": tile_batt(batt_w, shadow, settled),
+        },
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Prices for today's chart
+# --------------------------------------------------------------------------- #
+def _points(plan):
+    if plan is None:
+        return ()
+    return plan.read.match(series=lambda r: tuple(r.points),
+                           no_data=lambda _r: ())
+
+
+def _spans(points):
+    """`[(point, end)]`: each point runs until the next one starts, and the
+    last one for the series' own spacing (15 minutes or an hour)."""
+    pts = sorted(points, key=lambda p: p.start)
+    gaps = [b.start - a.start for a, b in zip(pts, pts[1:])]
+    step = min([g for g in gaps if g > timedelta(0)] or [timedelta(hours=1)])
+    step = min(step, timedelta(hours=1))
+    out = []
+    for i, p in enumerate(pts):
+        nxt = pts[i + 1].start if i + 1 < len(pts) else None
+        end = nxt if nxt is not None and nxt - p.start <= timedelta(hours=1) \
+            else p.start + step
+        out.append((p, end))
+    return out
+
+
+def _day_prices(c):
+    cache = getattr(c, "home_prices", None)
+    if cache is None:
+        cache = c.home_prices = DayPrices()
+    return cache
+
+
+class DayPrices:
+    """Today's prices as seen so far. The refresh keeps only the hours ahead,
+    so the hours already past are remembered here for the chart. Display only:
+    nothing reads this back into a decision."""
+
+    def __init__(self):
+        self.day = None
+        self.points = {}
+
+    def see(self, points, day0, day1):
+        if self.day != day0:
+            self.day, self.points = day0, {}
+        for p in points:
+            if day0 <= p.start < day1:
+                self.points[p.start] = p
+        return sorted(self.points.values(), key=lambda p: p.start)
+
+
+def hour_bars(points, day0, day1):
+    """One bar per local hour: the mean of its prices, or None when unknown.
+    `kind` is cheap / dear / mid by thirds of today's range (display only).
+    The page calls these "low price" and "high price", not cheap hours: the
+    add-on trades in the one cheapest and one dearest hour, not in a third."""
+    n = int(round(_hours(day1, day0)))
+    bars = []
+    for k in range(n):
+        a, b = day0 + timedelta(hours=k), day0 + timedelta(hours=k + 1)
+        inside = [p for p in points if a <= p.start < b]
+        price = (sum(p.eur_per_kwh for p in inside) / len(inside)
+                 if inside else None)
+        bars.append({"h": k, "start": a.isoformat(), "label": hhmm(a),
+                     "end_label": hhmm(b), "points": len(inside),
+                     "eur_kwh": None if price is None else round(price, 4),
+                     "estimate": bool(inside) and any(p.provisional
+                                                      for p in inside),
+                     "kind": None})
+    known = [b["eur_kwh"] for b in bars if b["eur_kwh"] is not None]
+    if known and max(known) - min(known) >= FLAT_EUR_KWH:
+        lo, hi = min(known), max(known)
+        third = (hi - lo) / 3.0
+        for b in bars:
+            p = b["eur_kwh"]
+            if p is None:
+                continue
+            b["kind"] = ("cheap" if p <= lo + third else
+                         "dear" if p >= hi - third else "mid")
+    elif known:
+        for b in bars:
+            if b["eur_kwh"] is not None:
+                b["kind"] = "mid"
+    return bars
+
+
+def day_range(points):
+    """(lowest, highest) of today's published points, as {eur_kwh, label},
+    or (None, None). The feed's own points, like the trade legs, not the
+    chart's hour averages."""
+    firm = [p for p in points if not p.provisional]
+    if not firm:
+        return None, None
+    lo = min(firm, key=lambda p: p.eur_per_kwh)
+    hi = max(firm, key=lambda p: p.eur_per_kwh)
+    return ({"eur_kwh": round(lo.eur_per_kwh, 4), "label": hhmm(lo.start)},
+            {"eur_kwh": round(hi.eur_per_kwh, 4), "label": hhmm(hi.start)})
+
+
+# --------------------------------------------------------------------------- #
+# The plan, per battery
+# --------------------------------------------------------------------------- #
+def _run(i, kind, start, end, day0, day1, what, why, amount, *, kwh=None,
+         eur=None, price=None):
+    a = max(0.0, _hours(start, day0))
+    z = min(_hours(day1, day0), _hours(end, day0))
+    return {"battery": i, "kind": kind, "start": start.isoformat(),
+            "end": end.isoformat(), "from": hhmm(start),
+            "to": "24:00" if end == day1 else hhmm(end),
+            "start_h": round(a, 3), "end_h": round(z, 3),
+            "what": what, "why": why, "amount": amount,
+            "kwh": None if kwh is None else round(kwh, 2),
+            "eur": None if eur is None else round(eur, 2),
+            "eur_kwh": None if price is None else round(price, 4)}
+
+
+def trade_verdict(c, plan):
+    """The arbitrage verdict the control cycle would reach on this plan, or a
+    reason there is none. The SAME call and inputs as `Controller.cycle()`:
+    `plan.arbitrage()` with the peak guard's state, the cycle cost and the
+    no-weather uncertainty. Returns `(verdict_or_None, why_key)`."""
+    if not arbitrage.enabled(c.o):
+        return None, "off"
+    guard = arbitrage.guard_state(c.peak_guard)
+    if guard is None:
+        return None, "not_covered"
+    if plan is None:
+        return None, "no_prices"
+    verdict = plan.arbitrage(peak_guard_active=guard,
+                             min_spread_eur_kwh=arbitrage.threshold_eur_kwh(c.o),
+                             uncertainty=frozenset({Uncertainty.NO_WEATHER}))
+    return verdict.match(
+        allowed=lambda v: (v, "allowed"),
+        refused=lambda _v: (None, refusal_key(plan, guard)))
+
+
+def refusal_key(plan, guard):
+    """Which of `TariffPlan.arbitrage()`'s refusals fired, in its own order:
+    the peak guard, no prices, under two published points, then the gap."""
+    if guard:
+        return "peak"
+    if not plan.has_prices:
+        return "no_prices"
+    if sum(1 for p in _points(plan) if not p.provisional) < 2:
+        return "not_firm"
+    return "not_worth"
+
+
+def _point_end(plan, point):
+    for p, end in _spans(_points(plan)):
+        if p.start == point.start:
+            return end
+    return point.start + timedelta(hours=1)
+
+
+# Under this many kWh a block is not drawn: the cycle would not move it.
+MIN_KWH = 0.05
+
+
+def trade_runs(c, plan, verdict, day0, day1, now, shadow):
+    """A charge block and a give block on each battery, where the verdict put
+    them. The site trades as one; each battery's share is capped by its own
+    rating and by the room its level leaves (arbitrage's own floor/ceiling).
+    Only what `arbitrage.decide()` would still do is drawn: no block on a
+    battery with no room, no sale at a negative price, and no sale while the
+    emptiest battery is at the floor (the cycle's `soc` is the emptiest).
+    With a level unknown the cycle does not trade, so nothing is drawn."""
+    floor, ceiling = arbitrage.soc_bounds(c.o)
+    if any(inv.soc is None for inv in c.inverters):
+        return [], [], "no_level"
+    level = [float(inv.soc) for inv in c.inverters]
+    legs = sorted((("grid", verdict.cheapest), ("give", verdict.dearest)),
+                  key=lambda kp: kp[1].start)
+    runs, later = [], []
+    for kind, pt in legs:
+        end = _point_end(plan, pt)
+        if end <= now:
+            continue
+        if not (day0 <= pt.start < day1):
+            later.append((kind, pt))
+            continue
+        if kind == "give" and (pt.eur_per_kwh < 0 or min(level) <= floor):
+            continue
+        hrs = (end - pt.start).total_seconds() / 3600.0
+        for i, inv in enumerate(c.inverters):
+            if _off(c, inv):
+                continue            # OPT-11: an Off battery does not trade
+            kwh = inv.max_w / 1000.0 * hrs
+            cap = inv.capacity_kwh
+            if cap:
+                room = (ceiling - level[i] if kind == "grid"
+                        else level[i] - floor)
+                kwh = min(kwh, max(0.0, room) / 100.0 * cap)
+                # A later give may use what this charge put in: an upper
+                # bound, like every amount here ("up to").
+                level[i] += (kwh if kind == "grid" else -kwh) / cap * 100.0
+            if kwh < MIN_KWH:
+                continue
+            eur = kwh * pt.eur_per_kwh
+            if kind == "grid":
+                what, why, amount = (run_grid_what(kwh, shadow),
+                                     run_grid_why(pt.eur_per_kwh),
+                                     run_grid_amount(eur))
+            else:
+                what, why, amount = (run_give_what(kwh, shadow),
+                                     run_give_why(pt.eur_per_kwh),
+                                     run_give_amount(eur))
+            runs.append(_run(i, kind, pt.start, end, day0, day1, what, why,
+                             amount, kwh=kwh, eur=eur, price=pt.eur_per_kwh))
+    return runs, later, None
+
+
+PRICE_MODES = (LEFTOVER_SOLAR, CHEAP_HOURS)
+
+
+def mode_runs(c, day0, day1, now, shadow):
+    """OPT-11 P3: each battery's price runs today, as the control cycle keeps
+    them (`c.mode_runs`): the cheap run on the batteries that may charge
+    from the grid, the give runs on Leftover solar and Cheap hours, and the
+    sell run on those with selling on. Amounts are upper bounds ("up to"),
+    from the battery's own room, rating and the run's length. Returns
+    `(runs, no_trade_key)`."""
+    rp = getattr(c, "mode_runs", None)
+    if getattr(c, "mode_tick", None) is None:
+        return [], None             # no cycle yet: nothing is known
+    if rp is None:
+        return [], "no_prices"
+    if not rp.on:
+        return [], "not_worth"
+    floor, ceiling = arbitrage.soc_bounds(c.o)
+    out = []
+    for i, inv in enumerate(c.inverters):
+        pm = c.pack_mode(inv)
+        if not pm.use or pm.mode not in PRICE_MODES:
+            continue
+        soc, cap = inv.soc, inv.capacity_kwh
+
+        def room(kind, hrs):
+            kwh = inv.max_w / 1000.0 * hrs
+            if cap and soc is not None:
+                kwh = min(kwh, max(0.0, (ceiling - soc) if kind == "grid"
+                                   else (soc - floor)) / 100.0 * cap)
+            return kwh
+        blocks = []
+        # P4: with a day plan, the grid block is the planned shortfall.
+        need = plan_need(c, inv.name)
+        if rp.charge_useful() and (need > 0.0 if need is not None
+                                   else pm.mode in GRID_CHARGE_MODES):
+            blocks.append(("grid", rp.cheap))
+        sell = rp.sell if pm.sell and pm.can_sell else None
+        for g in rp.give:
+            if sell is not None and g.start <= sell.start < g.end:
+                blocks.append(("sell", sell))
+            else:
+                blocks.append(("give", g))
+        for kind, run in blocks:
+            if run.end <= now or not (run.start < day1 and run.end > day0):
+                continue
+            hrs = (run.end - run.start).total_seconds() / 3600.0
+            kwh = room(kind, hrs)
+            if kind == "grid" and need is not None:
+                kwh = min(kwh, need)
+            if kwh < MIN_KWH:
+                continue
+            price = run.mean_eur_kwh
+            if kind == "grid":
+                what, why, amount = (run_grid_what(kwh, shadow),
+                                     run_cheap_why(price),
+                                     run_grid_amount(kwh * price))
+            elif kind == "sell":
+                # No money line: the price is what the house pays, and a sale
+                # earns the lower injection price (OPT-11 P3 review).
+                what, why, amount = (run_sell_what(kwh, shadow),
+                                     run_dear_why(price), None)
+            else:
+                what, why, amount = (run_give_what(kwh, shadow),
+                                     run_dear_why(price),
+                                     run_give_amount(kwh * price))
+            out.append(_run(i, "give" if kind == "sell" else kind,
+                            max(run.start, day0), min(run.end, day1), day0,
+                            day1, what, why, amount, kwh=kwh,
+                            eur=None if kind == "sell" else kwh * price,
+                            price=price))
+    return out, None
+
+
+def plan_need(c, name):
+    """P4: kWh this battery buys from the grid by the day plan, or None when
+    there is no plan for it (then P3 option A applies)."""
+    targets = c.plan_targets() if hasattr(c, "plan_targets") else None
+    if not targets or name not in targets:
+        return None
+    inv = next((i for i in c.inverters if i.name == name), None)
+    if inv is None or inv.soc is None or not inv.capacity_kwh:
+        return None
+    return max(0.0, targets[name] - float(inv.soc)) / 100.0 * float(
+        inv.capacity_kwh)
+
+
+def plan_state(c):
+    """P4: `"plan"` (a day plan is made), `"learning"` (no house profile
+    yet), `"no_forecast"` (set but missing or stale), or None (not set, or
+    battery modes off)."""
+    if not getattr(c, "modes_on", False) or \
+            getattr(c, "fc_entity", None) is None:
+        return None
+    if getattr(c, "solar_fc", None) is None:
+        return "no_forecast"
+    hp = getattr(c, "house_profile", None)
+    if hp is not None and not hp.ready():
+        return "learning"
+    return "plan" if getattr(c, "day_plan", None) is not None else None
+
+
+def solar_block(c, now):
+    """P4: the solar forecast line for the Batteries screen and the Simple
+    settings view: `{state, fc_kwh, count_kwh, updated, line}`."""
+    st = plan_state(c)
+    out = {"state": st, "fc_kwh": None, "count_kwh": None, "updated": None,
+           "line": ""}
+    if st is None and getattr(c, "solar_fc", None) is None:
+        return out
+    fc = getattr(c, "solar_fc", None)
+    if fc is not None:
+        trust = float(getattr(c, "solar_trust_pct", 70)) / 100.0
+        out.update(fc_kwh=round(fc.today.kwh, 1),
+                   count_kwh=round(fc.today.kwh * trust, 1),
+                   updated=hhmm(fc.at))
+    if st in ("no_forecast", "learning"):
+        out["line"] = _t("solar." + st)
+    elif fc is not None:
+        out["line"] = line_solar(fc.today.kwh, out["count_kwh"],
+                                 out["updated"])
+    return out
+
+
+def maintenance_runs(c, day0, day1, now, shadow):
+    """The monthly battery cycle: under way now, or starting later today.
+    The cycle starts in the hour `maintenance_start_hour` names, read as the
+    control cycle reads it (UTC hour of `now`), shown in local time."""
+    runs, lines = [], []
+    waiting = []
+    for i, (inv, m) in enumerate(zip(c.inverters, c.maints)):
+        cfg = m.cfg
+        if not cfg.enabled or _off(c, inv):
+            continue            # OPT-11: no monthly cycle while it is off
+        cap = inv.capacity_kwh
+        if m.phase != M_IDLE:
+            hours = _cycle_hours(m.phase, inv.soc, cap, cfg)
+            end = now + timedelta(hours=hours or 1.0)
+            runs.append(_run(i, "cycle", now, end, day0, day1,
+                             run_cycle_what(m.phase, shadow),
+                             run_cycle_why(shadow),
+                             run_cycle_amount(hours)))
+            continue
+        if not m.due(now) and (m.next_due(now) is None
+                               or m.next_due(now) >= day1):
+            continue
+        start = now.replace(hour=cfg.start_hour, minute=0, second=0,
+                            microsecond=0)
+        if start + timedelta(hours=1) <= now:
+            start += timedelta(days=1)
+        due_at = m.next_due(now)
+        if due_at is not None and due_at > start:
+            continue
+        if not (day0 <= start < day1):
+            continue
+        waiting.append((m.waited_days(now), i, start))
+    # One battery cycles at a time (maintenance.arbitrate); the one waiting
+    # longest goes first, and none starts while another is under way.
+    busy = any(m.phase != M_IDLE for m in c.maints)
+    waiting.sort(key=lambda t: (-t[0], t[1]))
+    for n, (_w, i, start) in enumerate(waiting):
+        inv, m = c.inverters[i], c.maints[i]
+        hours = _cycle_hours(M_DRAIN, inv.soc, inv.capacity_kwh, m.cfg)
+        if n == 0 and not busy:
+            end = start + timedelta(hours=hours or 1.0)
+            runs.append(_run(i, "cycle", start, end, day0, day1,
+                             run_cycle_what(M_IDLE, shadow),
+                             run_cycle_why(shadow),
+                             run_cycle_amount(hours)))
+        else:
+            lines.append(line_cycle_waits(inv.name))
+    return runs, lines
+
+
+def _cycle_hours(phase, soc, cap_kwh, cfg):
+    """Hours left in a cycle, or None when the capacity or level is unknown."""
+    if phase == M_HOLD:
+        return cfg.hold_min / 60.0
+    if not cap_kwh or soc is None:
+        return None
+    hours = cfg.hold_min / 60.0
+    fill_from = soc if phase == M_CHARGE else cfg.soc_floor
+    hours += (max(0.0, cfg.soc_target - fill_from) / 100.0 * cap_kwh
+              / max(cfg.charge_w / 1000.0, 0.1))
+    if phase not in (M_CHARGE,):
+        hours += (max(0.0, soc - cfg.soc_floor) / 100.0 * cap_kwh
+                  / max(cfg.discharge_w / 1000.0, 0.1))
+    return hours
+
+
+def peak_run(c, day0, day1, now, shadow, limit_w):
+    """While the batteries hold the grid under the peak limit, one block for
+    the current 15-minute period on every battery. An Off battery gets it
+    only while it gives power (OPT-11: Off covers only the shortfall)."""
+    pg = c.peak_guard
+    if not peak_engaged(c):
+        return []
+    start = now - timedelta(minutes=now.minute % 15, seconds=now.second,
+                            microseconds=now.microsecond)
+    end = start + timedelta(minutes=15)
+    return [_run(i, "peak", start, end, day0, day1,
+                 run_peak_what(pg.ceiling_w or limit_w, shadow),
+                 run_peak_why(), None)
+            for i, inv in enumerate(c.inverters)
+            if not _off(c, inv) or flow(inv.batt) == "giving"]
+
+
+def house_runs(n, day0, day1, now, shadow, skip=()):
+    """"Follows the house" for the rest of the day, drawn under the others.
+    `skip`: the batteries that are switched off (OPT-11)."""
+    return [_run(i, "house", max(now, day0), day1, day0, day1,
+                 run_house_what(shadow), run_house_why(shadow),
+                 run_house_amount())
+            for i in range(n) if i not in skip]
+
+
+def region_of(opts):
+    """The levies preset and its year, as the page model has it (UX-13 P0)."""
+    try:
+        ui = options_to_ui(opts)
+    except Exception:                                   # noqa: BLE001
+        return {"id": None, "year": None}
+    rid = ui.get("ui.region")
+    return {"id": rid, "year": ui.get("region_year")
+            if rid in REGION_PRESETS else None}
+
+
+def build_plan(c, now, shadow, running, held=False, settled=True):
+    day0, day1 = local_day(now)
+    fresh = c.fresh_tariff_plan(now)
+    plan = fresh
+    if plan is None or plan.origin == "static":
+        # A static profile is pure arithmetic: price the whole day from it.
+        try:
+            static = static_plan(c.o, day0, day1, now=now)
+            if static.has_prices:
+                plan = static
+        except Exception:                               # noqa: BLE001
+            pass
+    seen = _day_prices(c).see(_points(plan), day0, day1)
+    bars = hour_bars(seen, day0, day1)
+
+    limit_w = c.peak.cap_w  # the limit the controller parsed at start
+    runs, lines = [], []
+    # The control cycle trades on the fresh plan only, so this does too.
+    verdict, trade_why = trade_verdict(c, fresh)
+    modes_on = bool(getattr(c, "modes_on", False))
+    if running:
+        off = {i for i, inv in enumerate(c.inverters) if _off(c, inv)}
+        runs += house_runs(len(c.inverters), day0, day1, now, shadow, off)
+        if modes_on:
+            # OPT-11 P3: with battery modes on, each battery's price runs.
+            mine, no_trade = mode_runs(c, day0, day1, now, shadow)
+            runs += mine
+            if no_trade:
+                lines.append(line_no_trade(no_trade))
+        elif verdict is not None:
+            trade, later, no_trade = trade_runs(c, fresh, verdict, day0, day1,
+                                                now, shadow)
+            runs += trade
+            if no_trade:
+                lines.append(line_no_trade(no_trade))
+            for kind, pt in later:
+                lines.append(line_trade_tomorrow(kind, hhmm(pt.start),
+                                                 pt.eur_per_kwh, shadow))
+        else:
+            lines.append(line_no_trade(trade_why))
+        cyc, waits = maintenance_runs(c, day0, day1, now, shadow)
+        runs += cyc
+        lines += waits
+        runs += peak_run(c, day0, day1, now, shadow, limit_w)
+        if c.p1_enabled:
+            # The guard's ceiling: the cap, or this month's peak once above it.
+            pg = c.peak_guard
+            lines.append(line_peak_limit(
+                (pg.ceiling_w if pg is not None else None) or limit_w, shadow))
+    lines = [x for x in lines if x]
+
+    kinds = {r["kind"] for r in runs}
+    if held:
+        verdict_key = "held"
+    elif not running:
+        verdict_key = "stopped"
+    elif "cycle" in kinds:
+        verdict_key = "cycle"
+    elif "grid" in kinds or "give" in kinds:
+        verdict_key = "trade"
+    else:
+        verdict_key = "house"
+
+    known = [b for b in bars if b["eur_kwh"] is not None]
+    price_now = None
+    try:
+        if plan is not None:
+            price_now = plan.price_at(now)
+    except Absence:
+        price_now = None
+    feed = fresh is not None and fresh.from_feed
+    tomorrow = any(not p.provisional and p.start >= day1
+                   for p in _points(fresh))
+    region = region_of(c.o)
+    return {
+        "day": brussels(now).date().isoformat(),
+        "now_h": round(_hours(now, day0), 3),
+        "hours": int(round(_hours(day1, day0))),
+        "verdict": verdict_words(verdict_key, settled),
+        "verdict_key": verdict_key,
+        "head": plan_head(verdict_key, shadow, settled),
+        "prices": bars,
+        "runs": runs,
+        "lines": lines,
+        "why": c.why_words,
+        "price_line": line_prices(price_now, *day_range(seen)),
+        "tomorrow_line": line_tomorrow(tomorrow) if feed else "",
+        "region": region,
+        "region_line": (line_region(region["id"], region["year"])
+                         if feed else ""),
+        "has_prices": bool(known),
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Batteries, attention, month peak, control
+# --------------------------------------------------------------------------- #
+def at_zero(inv) -> bool:
+    """Has this inverter accepted a 0 W power request? A stop or an alarm asks
+    for 0 W at once, but the inverter gets it with the next write, so until
+    then the page says "Going to 0 W" (UX-13 P1 test, a). Before the first
+    accepted write nothing is known to be held; the heartbeat writes every
+    `heartbeat_s`, stopped or not, so this does not stick."""
+    return inv.last_write is not None and abs(inv.last_write) < 1.0
+
+
+def _off(c, inv) -> bool:
+    """OPT-11: is this battery switched off? Only with battery modes on."""
+    return bool(getattr(c, "modes_on", False)) and not c.pack_mode(inv).use
+
+
+def refusing(c, inv) -> int:
+    """SAFETY-52/73: the direction this battery refuses (+1 give, -1 charge,
+    0 none). Per inverter at two or more, the site's own at one."""
+    if len(c.inverters) > 1:
+        return int(getattr(inv, "refused", 0) or 0)
+    return int(getattr(c, "batt_refused", 0) or 0)
+
+
+def peak_engaged(c) -> bool:
+    """The peak guard asks the batteries for power this cycle. Not when it is
+    blind or floor-limited: those are engaged with a 0 W floor (no charging
+    only), so no battery gives power for it."""
+    pg = getattr(c, "peak_guard", None)
+    return bool(pg is not None and pg.engaged and (pg.floor_w or 0.0) > 0.0)
+
+
+def battery_rows(c, shadow, running, held=False):
+    shares = {}
+    alloc = getattr(c, "allocation", None)
+    if shadow and alloc is not None and getattr(alloc, "shares", None):
+        shares = dict(alloc.shares)
+    modes_on = bool(getattr(c, "modes_on", False))
+    pms = {inv.name: c.pack_mode(inv) for inv in c.inverters} \
+        if modes_on else {}
+    peak = peak_engaged(c)
+    # OPT-11 P3: each battery's role this cycle and the price runs, as the
+    # control cycle left them.
+    tick = getattr(c, "mode_tick", None) if modes_on else None
+    rp = getattr(c, "mode_runs", None)
+    now = datetime.now(timezone.utc)
+    rows = []
+    for i, inv in enumerate(c.inverters):
+        m = c.maints[i] if i < len(c.maints) else None
+        phase = m.phase if m is not None else M_IDLE
+        cap = inv.capacity_kwh
+        pm = pms.get(inv.name)
+        off = pm is not None and not pm.use
+        # UX-13 P3: does a Solar first battery that is on come before this one?
+        sf_ahead = any(o.use and o.mode == SOLAR_FIRST
+                       for n, o in pms.items() if n != inv.name)
+        # ...and does another battery refuse to give power, so this one
+        # carries its share (SAFETY-73)?
+        other = next((o.name for o in c.inverters if o is not inv
+                      and refusing(c, o) > 0 and not _off(c, o)), None)
+        # SAFETY-78: another battery drains for its monthly cycle, so this
+        # one never charges now. Not while that drain waits: it files no
+        # floor then, so this battery may charge from solar.
+        waits = getattr(c, "_drain_waits", ())
+        cycling = next((o.name for j, o in enumerate(c.inverters)
+                        if o is not inv and j < len(c.maints)
+                        and c.maints[j].phase == M_DRAIN
+                        and o.name not in waits), None)
+        role = None if tick is None else tick.roles.get(inv.name)
+        # Only once a cycle has run with modes on (`tick`): before that
+        # nothing is known, so nothing is claimed about the prices.
+        plan = (None if tick is None or pm.mode not in PRICE_MODES
+                else "no_prices" if rp is None
+                else "no_spread" if not rp.on else None)
+        nxt = rp.next_give(now) if rp is not None and rp.on else None
+        at = "" if nxt is None else (
+            f"{hhmm(nxt.start)} - {hhmm(nxt.end)}")
+        why = battery_why(
+            modes_on=modes_on, mode=None if pm is None else pm.mode, off=off,
+            reading=inv.soc is not None and inv.batt is not None,
+            phase=phase, shadow=shadow, running=running, held=held,
+            refused=refusing(c, inv), peak=peak,
+            giving=flow(inv.batt) == "giving", other_refuses=other,
+            sf_ahead=sf_ahead, role=role, plan=plan, has_at=bool(at),
+            other_cycle=cycling,
+            day=None if pm is None or pm.mode not in PRICE_MODES
+            else day_key(c, inv.name))
+        rows.append({
+            "name": inv.name,
+            "level_pct": None if inv.soc is None else float(inv.soc),
+            "power_w": None if inv.batt is None else float(inv.batt),
+            "capacity_kwh": cap,
+            "stored_kwh": (None if cap is None or inv.soc is None
+                           else round(cap * float(inv.soc) / 100.0, 2)),
+            "state": flow(inv.batt, shadow=shadow),
+            "mode": mode_house(),
+            "maintenance": phase,
+            "now": battery_now(inv.soc, inv.batt, phase=phase, shadow=shadow,
+                               running=running, held=held,
+                               would_w=shares.get(inv.name),
+                               settled=at_zero(inv), off=off, peak=peak),
+            # UX-13 P3: why it does what "now" says, from what the add-on
+            # knows this cycle. Price and forecast reasons are OPT-11 P3/P4.
+            "why_key": why,
+            "why": why_words(why, name=cycling if why == "other_cycle"
+                             else other, at=at),
+        })
+        if modes_on:
+            # OPT-11 P1: the battery's switch and mode, for the Batteries
+            # screen. Only with battery modes on, so the page is unchanged
+            # without them.
+            rows[-1].update({"use": pm.use, "mode_key": pm.key,
+                             "mode_choice": pm.mode,
+                             "mode": mode_word(pm.key),
+                             # P3: selling, for Leftover solar and Cheap
+                             # hours only (Solar first never sells).
+                             "sell": pm.sell, "can_sell": pm.can_sell,
+                             "role": role})
+    return rows
+
+
+def day_key(c, name):
+    """P4: the day plan's word for one Leftover solar or Cheap hours
+    battery: `sun_fills`, `tops_up`, `no_forecast`, or None."""
+    st = plan_state(c)
+    if st == "no_forecast":
+        mode = c.pack_mode(next(i for i in c.inverters if i.name == name))
+        return "no_forecast" if mode.mode == LEFTOVER_SOLAR else None
+    if st != "plan":
+        return None
+    need = plan_need(c, name)
+    if need is None:
+        return None
+    return "tops_up" if need >= MIN_KWH else "sun_fills"
+
+
+def battery_why(*, modes_on, mode, off, reading, phase, shadow, running,
+                held, refused, peak, sf_ahead, giving=False,
+                other_refuses=None, role=None, plan=None,
+                has_at=False, other_cycle=None, day=None) -> str:
+    """The key of one battery's "why" line (`home_words.why`), most urgent
+    first. Pure, so every branch is tested without a controller."""
+    if not reading:
+        return "no_reading"
+    if held:
+        return "held"
+    if not running:
+        return "stopped"
+    if shadow:
+        return "shadow"
+    if phase != M_IDLE:
+        return "cycle_mode" if modes_on else "cycle"
+    if off:
+        # Off gives way to the peak limit only (OPT-11 design section 2).
+        return "off_peak" if peak and giving else "off"
+    if refused:
+        return "refuses_give" if refused > 0 else "refuses_charge"
+    if peak:
+        return "peak"
+    if other_cycle:
+        return "other_cycle"
+    if giving and other_refuses:
+        return "other_refuses"
+    if not modes_on:
+        return "modes_off"
+    # OPT-11 P3: the battery's role in the price runs this cycle.
+    if role == "hold" and day is not None:
+        return day              # P4: what the day plan decided
+    if role in ROLE_WHY:
+        if role == "hold" and not has_at:
+            return "saves_later"
+        return ROLE_WHY[role]
+    if plan in ("no_prices", "no_spread"):
+        return plan
+    if giving:
+        return "covers_house"
+    if mode in PRICE_MODES:
+        return "leftover" if sf_ahead else "leftover_alone"
+    return "solar_first"
+
+
+# OPT-11 P3: a role (modetrade) -> its Why key.
+ROLE_WHY = {"charge": "grid_charge", "rest": "rests_charge",
+            "sell": "selling", "give": "expensive", "hold": "saves"}
+
+
+def attach_today(rows, runs, *, modes_on, running=True, held=False,
+                 shadow=False) -> None:
+    """UX-13 P3: each battery's runs today from the plan (the same blocks as
+    Home's chart), or one line saying there are none. With battery modes on,
+    a Leftover solar or Cheap hours battery with no price run left today
+    says so; the others follow the house."""
+    for i, row in enumerate(rows):
+        mine = [r for r in runs if r["battery"] == i and r["kind"] != "house"]
+        row["today"] = [{"from": r["from"], "to": r["to"], "kind": r["kind"],
+                         "what": r["what"]} for r in mine]
+        if mine:
+            row["today_line"] = ""
+        elif held:
+            row["today_line"] = today_words("held")
+        elif not running:
+            row["today_line"] = today_words("stopped")
+        elif row.get("use") is False:
+            row["today_line"] = today_words("off")
+        elif modes_on and row.get("mode_choice") in PRICE_MODES:
+            # OPT-11 P3: a price mode with no run left today, or no plan
+            # made yet (no cycle has run with modes on).
+            row["today_line"] = today_words("no_runs" if row.get("role")
+                                            else "not_planned")
+        else:
+            row["today_line"] = today_words("house_would" if shadow
+                                            else "house")
+
+
+# Row id -> the DOCS.md heading under Notifications, where one exists.
+ATTN_DOCS = {
+    "meter_frozen": messages.T_METER_FROZEN,
+    "power_too_high": messages.T_OUTPUT_CLAMP,
+    "not_keeping_up": messages.T_LOOP_BOUND,
+    "circulating": messages.T_CIRCULATING,
+    "delivery": messages.S_NOT_DELIVERING,
+}
+
+
+def attention(checks):
+    """Every row that is not plain green: red rows as alarms, amber rows as
+    warnings, and green-but-amber rows (a state still settling) as info.
+    Most urgent first; within a level, the page's own row order."""
+    rank = {ALARM: 0, WARNING: 1, INFO: 2}
+    out = []
+    for row in checks:
+        ok, warn = bool(row.get("ok")), bool(row.get("warn"))
+        if ok and not warn:
+            continue
+        sev = INFO if ok else (WARNING if warn else ALARM)
+        rid = row.get("id")
+        out.append({"severity": sev, "id": rid,
+                    "title": attn_title(rid),
+                    "body": row.get("text", ""),
+                    "docs": ATTN_DOCS.get(rid)})
+    out.sort(key=lambda a: rank[a["severity"]])
+    return out
+
+
+def month_peak(c, now):
+    """This month's peak against the limit, and the 15-minute period so far."""
+    limit_w = c.peak.cap_w  # the limit the controller parsed at start
+    local = brussels(now)
+    out = {"month": month_name(local), "limit_w": limit_w, "peak_w": None,
+           "pct": None, "period_w": None, "state": "not_covered",
+           "line": ""}
+    if not c.p1_enabled:
+        out["line"] = line_peak_not_covered()
+        return out
+    reading = c.peak.peak(now)
+    if reading.is_unreadable:
+        out["state"] = "unreadable"
+    elif reading.is_observed:
+        out["state"] = "observed"
+        out["peak_w"] = float(reading.peak_w)
+        out["pct"] = round(100.0 * float(reading.peak_w) / limit_w, 1) \
+            if limit_w > 0 else None
+    else:
+        out["state"] = "none"
+    pg = c.peak_guard
+    ceiling = limit_w
+    if pg is not None:
+        out["period_w"] = pg.projected_w
+        ceiling = pg.ceiling_w or limit_w
+    out["line"] = line_period(out["period_w"], ceiling, c.shadow)
+    return out
+
+
+def state_of(c, level, shadow):
+    """One word for the pill and the banner's colour: running, shadow,
+    stopped, alarm or warning."""
+    if shadow:
+        return "shadow"
+    if level == "bad":
+        return "alarm"
+    if not c.auto:
+        return "stopped"
+    if level == "warn":
+        return "warning"
+    return "running"
+
+
+def build(c, *, level: str, checks: list, now: datetime | None = None,
+          lang: str = "en", held: bool | None = None) -> dict:
+    """The structured half of `/status`, in `lang` (UX-13 P5). Pure reads of
+    the controller."""
+    _LANG[0] = uitext.lang_of(lang)
+    try:
+        return _build(c, level=level, checks=checks, now=now, held=held)
+    finally:
+        _LANG[0] = "en"
+
+
+def _build(c, *, level, checks, now, held=None):
+    now = now or datetime.now(timezone.utc)
+    shadow = bool(c.shadow)
+    kind = state_of(c, level, shadow)
+    # A red banner means every inverter is at 0 W (the status cascade), so
+    # nothing is planned until it clears. Shadow mode still plans: it is
+    # what the add-on would do. `held` False: an alarm while control runs
+    # (SAFETY-87, the peak alarms).
+    held = level == "bad" and not shadow and held is not False
+    running = (bool(c.auto) or shadow) and not held
+    settled = all(at_zero(inv) for inv in c.inverters)
+    ctl = next((r for r in checks if r.get("id") == "controller"), None)
+    rows = battery_rows(c, shadow, running, held)
+    plan = build_plan(c, now, shadow, running, held=held, settled=settled)
+    attach_today(rows, plan["runs"],
+                 modes_on=bool(getattr(c, "modes_on", False)),
+                 running=running, held=held, shadow=shadow)
+    return {
+        "solar": solar_block(c, now),
+        "state": {"kind": kind, "pill": pill(kind),
+                  "ran": ctl.get("text", "") if ctl else "",
+                  "sub": banner_sub(kind)},
+        "now": now_block(grid_w=c.grid, pv_w=c.pv_w, batt_w=c.site_batt_w,
+                         has_solar=bool(c.pv_roster), shadow=shadow,
+                         settled=settled),
+        "batteries": rows,
+        "plan": plan,
+        "modes_on": bool(getattr(c, "modes_on", False)),
+        "attention": ([{"severity": INFO, "id": "shadow",
+                         "title": attn_shadow(), "body": attn_shadow_body(),
+                         "docs": None}] if shadow else []) + attention(checks),
+        "month_peak": month_peak(c, now),
+        "control": {"running": bool(c.auto), "shadow": shadow,
+                    "text": control_text(bool(c.auto), shadow),
+                    "maintenance": c.maint.phase,
+                    "docs_url": _docs_url()},
+    }
+
+
+def _docs_url():
+    slug = messages.addon_slug()
+    return None if slug is None else messages.docs_url(slug,
+                                                       messages._site["ha"])
+
+
+# =========================================================================== #
+# The words. STYLE.md: plain, short, present tense. A plan line is at most
+# two sentences of at most 12 words each (UX-13 design, section 4); a title at
+# most 5 words; everything else one sentence of at most 25 words. In shadow
+# mode a text says what the add-on WOULD do. The sentences themselves are in
+# app/ui_text/<lang>.json under `home_words` (UX-13 P5: English and Dutch).
+# test_messages.py and test_ui_text.py render every function below through
+# `text_samples()` in each language and check it.
+# =========================================================================== #
+_LANG = ["en"]          # the language of the build in progress (build())
+_WORDS: dict = {}
+
+
+def _hw() -> dict:
+    lang = _LANG[0]
+    if lang not in _WORDS:
+        _WORDS[lang] = uitext.words(lang)
+    return _WORDS[lang]
+
+
+def _t(path, **values) -> str:
+    node = _hw()["home_words"]
+    for k in path.split("."):
+        node = node[k]
+    return uitext.say(node, **values)
+
+
+def _dec(text) -> str:
+    """A decimal comma in Dutch."""
+    return text.replace(".", ",") if _LANG[0] == "nl" else text
+
+
+def _kw(w) -> str:
+    return _dec(f"{abs(float(w)) / 1000:.1f}") + " kW"
+
+
+def _eur(v) -> str:
+    return "€" + _dec(f"{float(v):.2f}")
+
+
+def _kwh(v) -> str:
+    return _dec(f"{float(v):.1f}") + " kWh"
+
+
+# Row id -> the title on Home. The row's own sentence is the body, and it stays
+# in English (app/messages.py). Five titles are the notification's own title,
+# which test_ui_text.py checks.
+_EN = uitext.words("en")["home_words"]
+ATTN_TITLES = {(None if k == "none" else k): v for k, v in _EN["attn"].items()}
+ATTN_FROM_MESSAGES = {
+    "meter_frozen": messages.T_METER_FROZEN,
+    "power_too_high": messages.T_OUTPUT_CLAMP,
+    "not_keeping_up": messages.T_LOOP_BOUND,
+    "circulating": messages.T_CIRCULATING,
+    "delivery": messages.S_NOT_DELIVERING,
+}
+VERDICT = dict(_EN["verdict"])
+MODE_HOUSE, ATTN_SHADOW = _EN["mode_house"], _EN["attn_shadow"]
+ZERO_HELD, ZERO_GOING = _EN["zero_held"], _EN["zero_going"]
+
+
+def mode_house() -> str:
+    return _t("mode_house")
+
+
+def mode_word(key) -> str:
+    """OPT-11: a battery's mode, or Off, in the page's language."""
+    return _t("modes." + key)
+
+
+def attn_shadow() -> str:
+    return _t("attn_shadow")
+
+
+def attn_shadow_body() -> str:
+    return _t("attn_shadow_body")
+
+
+def verdict_words(key, settled=True) -> str:
+    return _t("verdict." + key) if settled or key != "held" \
+        else _t("zero_going")
+
+
+def attn_title(rid) -> str:
+    table = _hw()["home_words"]["attn"]
+    return table.get(rid or "none", table["none"])
+
+
+def month_name(local) -> str:
+    return _hw()["home_words"]["months"][local.month - 1]
+
+
+def _w(shadow, key, **values) -> str:
+    """`key`, or its `key_would` form in shadow mode."""
+    return _t(key + "_would" if shadow else key, **values)
+
+
+def pill(kind) -> str:
+    return _t("pill." + kind)
+
+
+def banner_sub(kind) -> str:
+    return _t("banner_sub." + kind)
+
+
+def tile_solar(pv_w, has_solar) -> str:
+    if not has_solar:
+        return _t("tile.not_set_up")
+    if pv_w is None:
+        return _t("tile.no_reading")
+    return _t("tile.producing") if pv_w > IDLE_W else _t("tile.not_producing")
+
+
+def tile_house(house_w, has_solar, disagree=False) -> str:
+    if not has_solar:
+        return _t("tile.needs_solar")
+    if disagree:
+        return _t("tile.not_adding_up")
+    return _t("tile.no_reading") if house_w is None else _t("tile.using")
+
+
+def tile_grid(grid_w) -> str:
+    if grid_w is None:
+        return _t("tile.no_reading")
+    if grid_w > IDLE_W:
+        return _t("tile.taking")
+    if grid_w < -IDLE_W:
+        return _t("tile.feeding")
+    return _t("tile.balanced")
+
+
+def _zero(settled) -> str:
+    return _t("zero_held") if settled else _t("zero_going")
+
+
+def tile_batt(batt_w, shadow, settled=True) -> str:
+    if shadow:
+        return _zero(settled)
+    return _t("tile." + {"giving": "giving", "charging": "charging",
+                         "resting": "resting",
+                         None: "no_reading"}[flow(batt_w)])
+
+
+def battery_now(soc, batt_w, *, phase, shadow, running, held=False,
+                would_w=None, settled=True, off=False, peak=False) -> str:
+    if soc is None or batt_w is None:
+        return _t("now.no_reading")
+    zero = _zero(settled)
+    if shadow:
+        if would_w is None or abs(would_w) <= IDLE_W:
+            return _t("now.would_rest", zero=zero)
+        verb = "would_give" if would_w > 0 else "would_charge"
+        return _t("now." + verb, zero=zero, kw=_kw(would_w))
+    if held:
+        return _t("now.held", zero=zero)
+    if not running:
+        return _t("now.stopped", zero=zero)
+    if phase != M_IDLE:
+        return _t("now." + {M_DRAIN: "cycle_drain", M_CHARGE: "cycle_charge",
+                            M_HOLD: "cycle_hold"}.get(phase, "cycle"))
+    st = flow(batt_w)
+    if off:
+        # OPT-11: an Off battery is asked for 0 W, but the peak limit may
+        # still need it. Say which, and never "0 W" beside a power figure.
+        if st == "resting":
+            return _t("now.off_resting")
+        if st == "giving" and peak:
+            return _t("now.off_peak", kw=_kw(batt_w))
+        return _t("now.off_going", kw=_kw(batt_w))
+    if st == "giving":
+        return _t("now.giving", kw=_kw(batt_w))
+    if st == "charging":
+        return _t("now.charging", kw=_kw(batt_w))
+    return _t("now.resting")
+
+
+def why_words(key, name=None, at="") -> str:
+    """One battery's "why" line (UX-13 P3), from `battery_why()`'s key.
+    `name`: the battery that refuses, for `other_refuses`; `at`: the
+    give run's time, for `saves`."""
+    return _t("why." + key, name=name or "", at=at)
+
+
+def today_words(key) -> str:
+    """One battery's "today" line when the plan has no run for it."""
+    return _t("today." + key)
+
+
+def plan_head(key, shadow, settled=True) -> str:
+    if key == "held":
+        return _t("head.held" if settled else "head.held_going")
+    if key == "stopped":
+        return _t("head.stopped")
+    if not shadow:
+        return _t("head." + key)
+    return _t("head.shadow") + " " + _t("head." + key + "_would")
+
+
+def run_grid_what(kwh, shadow) -> str:
+    return _w(shadow, "run.grid_what", kwh=_kwh(kwh))
+
+
+# The trade legs and the price line use the feed's own points (a 15-minute
+# period on a quarter-hourly feed), so both name the same price and time.
+def run_grid_why(price) -> str:
+    return _t("run.grid_why", eur=_eur(price))
+
+
+def run_grid_amount(eur) -> str:
+    return _t("run.grid_amount", eur=_eur(eur))
+
+
+def run_sell_what(kwh, shadow) -> str:
+    return _w(shadow, "run.sell_what", kwh=_kwh(kwh))
+
+
+def run_cheap_why(price) -> str:
+    return _t("run.cheap_why", eur=_eur(price))
+
+
+def run_dear_why(price) -> str:
+    return _t("run.dear_why", eur=_eur(price))
+
+
+def run_give_what(kwh, shadow) -> str:
+    return _w(shadow, "run.give_what", kwh=_kwh(kwh))
+
+
+def run_give_why(price) -> str:
+    return _t("run.give_why", eur=_eur(price))
+
+
+def run_give_amount(eur) -> str:
+    return _t("run.give_amount", eur=_eur(eur))
+
+
+def run_cycle_what(phase, shadow) -> str:
+    return _w(shadow, "run.cycle_start" if phase == M_IDLE else "run.cycle_now")
+
+
+def run_cycle_why(shadow=False) -> str:
+    return _w(shadow, "run.cycle_why")
+
+
+def run_cycle_amount(hours) -> str:
+    if hours is None:
+        return _t("run.cycle_amount_unknown")
+    return _t("run.cycle_amount", hours=max(1, round(hours)))
+
+
+def run_peak_what(limit_w, shadow) -> str:
+    return _w(shadow, "run.peak_what", kw=_kw(limit_w))
+
+
+def run_peak_why() -> str:
+    return _t("run.peak_why")
+
+
+def run_house_what(shadow) -> str:
+    return _w(shadow, "run.house_what")
+
+
+def run_house_why(shadow=False) -> str:
+    return _w(shadow, "run.house_why")
+
+
+def run_house_amount() -> str:
+    return _t("run.house_amount")
+
+
+def line_solar(fc_kwh, count_kwh, at) -> str:
+    return _t("solar.line", kwh=_kwh(fc_kwh), count=_kwh(count_kwh), at=at)
+
+
+def line_no_trade(key) -> str:
+    return "" if key == "off" else _t("no_trade." + key)
+
+
+def line_trade_tomorrow(kind, at, price, shadow) -> str:
+    return _w(shadow, "tomorrow_trade." + kind, at=at, eur=_eur(price))
+
+
+def line_cycle_waits(name) -> str:
+    return _t("cycle_waits", name=name)
+
+
+def line_peak_limit(limit_w, shadow) -> str:
+    return _w(shadow, "step_in", kw=_kw(limit_w))
+
+
+def line_prices(now_eur, lo, hi) -> str:
+    parts = []
+    if now_eur is not None:
+        parts.append(_t("prices.now", eur=_eur(now_eur)))
+    if lo is not None and hi is not None:
+        parts.append(_t("prices.today", lo=_eur(lo["eur_kwh"]),
+                        lo_at=lo["label"], hi=_eur(hi["eur_kwh"]),
+                        hi_at=hi["label"]))
+    return " ".join(parts) or _t("prices.none")
+
+
+def line_tomorrow(known) -> str:
+    return _t("tomorrow.known" if known else "tomorrow.unknown")
+
+
+def line_region(rid, year) -> str:
+    if rid in REGION_PRESETS and year:
+        name = _hw()["choices"]["region"].get(rid, rid)
+        return _t("region.preset", region=name, year=year)
+    return _t("region.own")
+
+
+def line_peak_not_covered() -> str:
+    return _t("peak_not_covered")
+
+
+def line_period(period_w, limit_w, shadow) -> str:
+    step = _w(shadow, "step_in", kw=_kw(limit_w))
+    if period_w is None:
+        return step
+    return _t("period", kw=_kw(period_w)) + " " + step
+
+
+def control_text(running, shadow) -> str:
+    if shadow:
+        return _t("control.shadow")
+    if running:
+        return _t("control.running")
+    return _t("control.stopped")
+
+
+def text_samples(lang="en") -> list:
+    """`(kind, text)` for every sentence above in `lang`, rendered with real
+    values, so test_messages.py can hold each to its STYLE limit. Kinds: title,
+    plan (2 sentences of 12 words), line (1 sentence of 25 words)."""
+    _LANG[0] = uitext.lang_of(lang)
+    try:
+        return _samples()
+    finally:
+        _LANG[0] = "en"
+
+
+def _samples() -> list:
+    words = _hw()["home_words"]
+    out = [("title", t) for t in words["verdict"].values()]
+    out += [("title", _t("zero_going")), ("title", _t("zero_held"))]
+    out += [("title", t) for t in words["attn"].values()]
+    out += [("title", mode_word(k)) for k in words["modes"]]
+    out += [("title", mode_house()), ("title", attn_shadow()),
+            ("line", attn_shadow_body())]
+    for k in ("running", "shadow", "stopped", "alarm", "warning"):
+        out += [("title", pill(k)), ("line", banner_sub(k))]
+    for sh in (False, True):
+        out += [("title", tile_solar(v, s)) for v, s in
+                ((None, False), (None, True), (3900, True), (0, True))]
+        out += [("title", tile_house(v, s)) for v, s in
+                ((None, False), (None, True), (1100, True))]
+        out.append(("title", tile_house(None, True, True)))
+        out += [("title", tile_grid(v)) for v in (None, 1200, -800, 5)]
+        out += [("title", tile_batt(v, sh)) for v in (None, 2500, -2500, 0)]
+        out.append(("title", tile_batt(0, sh, settled=False)))
+        for phase in (M_IDLE, M_DRAIN, M_CHARGE, M_HOLD):
+            for w in (2500, -2500, 0):
+                out.append(("plan", battery_now(62, w, phase=phase,
+                                                shadow=sh, running=True,
+                                                would_w=-2400)))
+        out.append(("plan", battery_now(62, 0, phase=M_IDLE, shadow=sh,
+                                        running=False)))
+        for settled in (True, False):
+            out.append(("plan", battery_now(62, 0, phase=M_IDLE, shadow=False,
+                                            running=False, held=True,
+                                            settled=settled)))
+            out.append(("plan", battery_now(62, 0, phase=M_IDLE, shadow=sh,
+                                            running=False, would_w=-2400,
+                                            settled=settled)))
+        out.append(("plan", plan_head("held", sh, settled=False)))
+        out.append(("plan", battery_now(None, None, phase=M_IDLE, shadow=sh,
+                                        running=True)))
+        for k in VERDICT:
+            out.append(("plan", plan_head(k, sh)))
+        out += [("plan", run_grid_what(12.34, sh)),
+                ("plan", run_give_what(9.6, sh)),
+                ("plan", run_cycle_what(M_IDLE, sh)),
+                ("plan", run_cycle_what(M_DRAIN, sh)),
+                ("plan", run_peak_what(3500, sh)),
+                ("plan", run_house_what(sh)),
+                ("plan", line_trade_tomorrow("grid", "02:00", 0.1234, sh)),
+                ("plan", line_trade_tomorrow("give", "19:00", 0.3612, sh)),
+                ("plan", line_peak_limit(3500, sh)),
+                ("plan", line_period(1240, 3500, sh)),
+                ("plan", line_period(None, 3500, sh)),
+                ("plan", control_text(True, sh)),
+                ("plan", control_text(False, sh))]
+    out += [("plan", run_grid_why(0.1412)), ("plan", run_grid_amount(1.23)),
+            ("plan", run_give_why(0.3612)), ("plan", run_give_amount(3.47)),
+            ("plan", run_cycle_why()), ("plan", run_cycle_why(True)),
+            ("plan", run_cycle_amount(None)),
+            ("plan", run_cycle_amount(5.4)), ("plan", run_peak_why()),
+            ("plan", run_house_why()), ("plan", run_house_why(True)),
+            ("plan", run_house_amount()),
+            ("plan", line_cycle_waits("Battery B")),
+            ("plan", line_prices(0.16, {"eur_kwh": 0.14, "label": "13:00"},
+                                 {"eur_kwh": 0.36, "label": "19:00"})),
+            ("plan", line_prices(None, None, None)),
+            ("plan", line_tomorrow(True)), ("plan", line_tomorrow(False)),
+            ("plan", line_region("flanders", 2026)),
+            ("plan", line_region("own", None)),
+            ("plan", line_peak_not_covered())]
+    for off in (False, True):
+        for peak in (False, True):
+            for w in (2500, -2500, 0, 500):
+                out.append(("plan", battery_now(62, w, phase=M_IDLE,
+                                                shadow=False, running=True,
+                                                off=off, peak=peak)))
+    out += [("plan", why_words(k, name="Battery A")) for k in words["why"]]
+    out += [("plan", today_words(k)) for k in words["today"]]
+    out += [("plan", line_solar(9.2, 6.4, "10:15")),
+            ("plan", _t("solar.no_forecast")), ("plan", _t("solar.learning"))]
+    out += [("plan", line_no_trade(k)) for k in
+            ("not_covered", "no_prices", "peak", "not_firm", "not_worth",
+             "no_level")]
+    return out
diff --git a/goodwe_controller/app/inverter.py b/goodwe_controller/app/inverter.py
index eb886f7..328c9fa 100644
--- a/goodwe_controller/app/inverter.py
+++ b/goodwe_controller/app/inverter.py
@@ -123,6 +123,7 @@ from datetime import datetime
 
 from .clamp import ClampResult
 from .delivery import DeliveryConfig, DeliveryWatchdog
+from . import messages
 # SAFETY-37. The freshness policy, and the ONE place its bounds are written.
 # freshness.py imports nothing from this package, so the direction is one-way.
 from .freshness import BOUNDS, Freshness
@@ -316,6 +317,18 @@ class Inverter:
             tripped=bool(data.get(self.key("delivery_tripped"), False)),
             reason=str(data.get(self.key("delivery_reason"), "") or ""))
 
+        # SAFETY-73. The direction this unit's battery refuses (+1 give, -1
+        # take, 0 none), when that refusal or its last probe started, the
+        # current probe's start, and the cycles of evidence so far and when
+        # they began. Memory only, like SAFETY-52's: stop and start end it.
+        # Used at N>1 only.
+        self.refused = 0
+        self.refused_at = None
+        self.probe_from = None
+        self.ref_count = 0
+        self.ref_since = None
+        self.ref_sign = 0
+
     # -- store ---------------------------------------------------------------
     def key(self, name: str) -> str:
         """This unit's namespaced Store key for `name`. See store.unit_key()."""
@@ -407,21 +420,31 @@ class Inverter:
         stop the site (`inputs_ok`). Folding one into the other is how a
         measurement fault ends up handing a sibling extra power.
         """
-        return self.batt_fresh.note(self.name)
+        return (messages.row_battery_stuck(self.name) if self.batt_fresh.stale
+                else "")
+
+    def refusal_note(self) -> str:
+        """SAFETY-73's status row while this unit's battery refuses."""
+        if not self.refused:
+            return ""
+        return messages.row_battery_refuses(self.name, self.refused,
+                                            self.probe_from is not None)
 
     def link_note(self, now: datetime) -> str:
-        """One line for the status page. Empty when there is nothing to say."""
+        """One line for the status page. Empty when there is nothing to say.
+
+        The words are `app/messages.py`'s (UX-09). main.py colours the row red
+        exactly when `is_live()` is False.
+        """
         if not self.has_writer():
-            return (f"{self.name}: NO SETPOINT ENTITY - this controller cannot "
-                    f"command it, and the site refuses rather than running at "
-                    f"part strength")
-        live, why = self.is_live(now)
+            return messages.row_no_setpoint(self.name)
+        live, _why = self.is_live(now)
+        held = (0.0 if self.rejected_since is None
+                else (now - self.rejected_since).total_seconds())
         if not live:
-            return f"{self.name}: NOT COMMANDABLE - {why}"
+            return messages.row_not_controllable(self.name, held, LINK_STALE_S)
         if self.rejected_since is not None:
-            held = (now - self.rejected_since).total_seconds()
-            return (f"{self.name}: writes rejected for {held:.0f} s - still "
-                    f"commandable until {LINK_STALE_S:.0f} s")
+            return messages.row_commands_refused(self.name, held, LINK_STALE_S)
         return ""
 
     def __repr__(self) -> str:
diff --git a/goodwe_controller/app/main.py b/goodwe_controller/app/main.py
index 71bf8d3..a673fe3 100644
--- a/goodwe_controller/app/main.py
+++ b/goodwe_controller/app/main.py
@@ -25,18 +25,29 @@ battery to zero on its own. Never "hold the last value to be safe".
 
 import asyncio
 import contextlib
+import dataclasses
+import functools
 import json
 import logging
+import math
 import signal
+import time
 from datetime import datetime, timedelta, timezone
 
 import aiohttp
 
 from . import arbitrage
 from .arbiter import (
-    P_LOOP, P_MAINT_SHAPE, P_MAINTENANCE, P_PEAK, P_SAFETY,
-    Claim, Resolution, actuator_for, resolve,
+    ACTUATOR_SITE, P_LOOP, P_MAINT_SHAPE, P_MAINTENANCE, P_MODE, P_PEAK,
+    P_SAFETY, SET, Claim, Resolution, actuator_for, pre_resolve, resolve,
 )
+from . import allocator
+from . import dayplan
+from . import modetrade
+from . import packmode
+from . import priceruns
+from . import solarfc
+from . import control as _ctl
 from .control import Tuning, compute, maintenance_charge_floor, peak_at_risk
 from .delivery import (
     DELIVERY_OPTION_DEFAULTS, DeliveryConfig, UnitDelivery,
@@ -47,9 +58,13 @@ from .circulation import (
     circulating_w, opposing,
 )
 from .clamp import (
-    REASON_CODE as CLAMP_REASON, ClampWatchdog, clamp_to_rating, is_commandable,
+    REASON_CODE as CLAMP_REASON, ClampWatchdog,
+    clamp_to_rating, delivery_short, is_commandable, loop_clamp_note,
+    shortfall_note, write_clamp_note,
 )
 from . import freshness
+from . import homeview
+from . import messages
 from .freeze import (
     FreezeWatchdog, FreezeWatchdogConfig, looks_frozen, rail_unreachable, rail_w,
 )
@@ -60,29 +75,35 @@ from .hass import HomeAssistant
 from .inverter import (LINK_STALE_S, UNIT_A, build_roster,
                        roster_entries, roster_names)
 from .maintenance import (
-    IDLE, POWER_MOVING, MaintConfig, Maintenance, arbitrate as maint_arbitrate,
+    DRAIN, HOLD, IDLE, POWER_MOVING, MaintConfig, Maintenance, MaintResult,
+    arbitrate as maint_arbitrate,
 )
-from .mqtt import (MqttPublisher, announced_units, optional_keys, unit_slugs,
-                   unit_state_key)
+from .mqtt import (MODE_CONFIGS_KEY, MODE_LABELS, USE_OFF, USE_ON,
+                   MqttPublisher, announced_units, mode_configs,
+                   optional_keys, parse_command, unit_slugs, unit_state_key)
 from . import peakguard
 from . import packshare
 from . import pv as pv_read
 from . import shadow
 from .p1 import P1Ingest, build_source, is_enabled
-from .price import Uncertainty, price_option, provider_configured
+from .price import Absence, Uncertainty, brussels, price_option, provider_configured
+from .price import required_spread as price_required_spread
+from .price import uncertainty_of as price_uncertainty_of
 from .price_history import PriceHistory
 from .static_tariff import resolve_tariff, static_status
 from .tariff import PeakStore, PeakTracker
 from .store import migrate_maint_keys, migrate_unit_keys
-from .validate import (ConfigRefused, refuse, validate_startup_config,
-                       validate_unit_ranges)
+from .validate import (FIRMWARE_INGEST_VETO_S, ConfigRefused, refuse,
+                       validate_startup_config, validate_unit_ranges)
 from .watchdog import (
     AGAINST_METER, AGAINST_OWN_POWER, SIGN_OPTION_DEFAULTS,
     SignWatchdog, SignWatchdogConfig, loop_is_following,
 )
+from . import setuponly
 from . import web
 
 OPTIONS_PATH = "/data/options.json"
+INGRESS_PORT = 8099
 _LOG = logging.getLogger("goodwe")
 
 # ⚠️ `UNIT_A` NOW LIVES IN app/inverter.py AND IS RE-EXPORTED HERE, because the
@@ -111,6 +132,15 @@ __all__ = ["UNIT_A", "Controller", "amain", "main"]
 # the re-issue happens by itself) than hold the control loop for ten seconds.
 WRITE_BUDGET_S = 4.0
 
+# SAFETY-34: a Core-only restart wipes persistent_notification and does NOT
+# restart this add-on (measured on TEST-23), so a latched alarm is re-asserted
+# this often. Why: goodwe docs/DECISIONS.md, SAFETY-34.
+REANNOUNCE_S = 300.0
+# UX-11 review: a quiet meter logs at most one WARNING this often, because on
+# `ha_signed` a healthy meter under a flat load can go 42-97 s between changes.
+METER_QUIET_REPEAT_S = 600.0
+_mono = time.monotonic          # patched by the checks; asyncio keeps the real one
+
 # --------------------------------------------------------------------------- #
 # OPT-04: THE BACKGROUND TARIFF REFRESH, AND WHY IT IS NOT OPTIONAL
 #
@@ -204,6 +234,29 @@ def load_options() -> dict:
 
 
 
+# OPT-11 P3: how long the last cheap run stays the price stored energy is
+# valued at (`priceruns.plan(ref_eur_kwh=)`): the rest of that day.
+REF_CHEAP_KEEP = timedelta(hours=12)
+
+# OPT-11 P4: the store key of the house profile (dayplan.HouseProfile), and
+# how often the forecast sensors are read (they change hourly at most).
+HOUSE_PROFILE_KEY = "house_profile"
+FORECAST_READ_S = 60.0
+
+
+def why_raised(resolution, claims) -> bool:
+    """F2 (OPT-11 P1 test): did the limit that bound the site target push it
+    ABOVE what the winner asked (the peak floor asking for more power)? Then
+    the Why line must not say "held back". False when nothing bound it."""
+    if not resolution.bound_by or resolution.contradiction:
+        return False
+    asked = next((c.value for c in sorted(
+        (c for c in claims if c.kind == SET
+         and c.actuator == ACTUATOR_SITE and c.source == resolution.winner),
+        key=lambda c: c.priority, reverse=True)), None)
+    return asked is not None and resolution.target_w > float(asked)
+
+
 def pack_energy_of(inv):
     """OPT-09. ONE roster entry as the view `packshare` consumes.
 
@@ -220,6 +273,45 @@ def pack_energy_of(inv):
                                 inv.capacity_kwh, inv.max_w)
 
 
+# SAFETY-73 review: the evidence must also span this long, not only
+# SETTLE_CYCLES cycles. SETTLE_CYCLES was derived at the 2 s meter tick (22 s
+# from its first to its twelfth cycle). A 1 s meter makes 12 cycles only 11 s,
+# shorter than a healthy battery reading's lag (BATT_OBLIGED_S, 17 s, plus the
+# plant's dead time), and both inverters of a site were then refused after
+# ordinary load steps. At 2 s and slower this changes nothing.
+REFUSED_SPAN_S = (_ctl.SETTLE_CYCLES - 1) * _ctl.LOOP_TICK_S
+
+# SAFETY-85 review: a battery another owner set is graded against the least it
+# was told over the same span as above (the plant's measured settle time), so
+# a healthy battery still settling on a new command is not short.
+SHORT_CYCLES, SHORT_SPAN_S = _ctl.SETTLE_CYCLES, REFUSED_SPAN_S
+
+
+def _refused_interval(sign: int) -> tuple:
+    """SAFETY-73: the (lo, hi) a refusing unit may be asked: 0 W that way."""
+    return (-math.inf, 0.0) if sign > 0 else (0.0, math.inf)
+
+
+def why_key(winner: str, claims) -> str:
+    """The key of `messages.WHY_WINNER` for a resolution's winner.
+
+    "safety" and "failsafe" each stand for several causes, so for those the
+    winning claim's own reason is the key ("stopped", "inputs missing", "sign
+    disagreement"). A failsafe with no claim of its own is the arbiter's "no
+    claim was made", or main.py's refusal to split the power ("unsplit").
+    """
+    if winner == "loop":
+        # SAFETY-52: a loop holding a refused direction says so.
+        return next((c.reason for c in claims if c.source == "loop"
+                     and c.reason in (_ctl.REFUSED, _ctl.PROBING)), winner)
+    if winner in ("safety", "failsafe"):
+        return next((c.reason for c in claims
+                     if c.source == winner and c.kind == "set"),
+                    "no claim was made" if not any(
+                        c.kind == "set" for c in claims) else "unsplit")
+    return winner
+
+
 def tariff_plan_row(plan, tick_words: str, *, age_s, horizon_h: float,
                     provider: bool, max_age_s: float) -> str:
     """The *Tariff* status row: the 30 s tick's sentence AND the provider plan.
@@ -257,14 +349,15 @@ def tariff_plan_row(plan, tick_words: str, *, age_s, horizon_h: float,
     past `max_age_s`, is the exact state the soak measured; rendering it as
     the bare static sentence is how it stayed invisible for 802 samples.
     """
+    # UX-08: plain words, every figure kept. The tick's sentence is "now";
+    # the plan carries its own age.
     if plan is None:
         if not provider:
             return tick_words
-        return (f"{tick_words} (recomputed this tick); NO provider plan - "
-                f"none has been resolved yet, or the last one is older than "
-                f"{max_age_s:.0f} s")
-    return (f"{tick_words} (recomputed this tick); provider plan fetched "
-            f"{age_s:.0f} s ago for a {horizon_h:.0f} h horizon: {plan.words}")
+        return (f"{tick_words}. No price plan: none yet, or the last one is "
+                f"over {max_age_s:.0f} s old")
+    return (f"{tick_words}. Price plan from {age_s:.0f} s ago, for "
+            f"{horizon_h:.0f} hours ahead: {plan.words}")
 
 
 def arbitrage_row(*, on: bool, decision, decided_at, cycle_at, now,
@@ -302,21 +395,21 @@ def arbitrage_row(*, on: bool, decision, decided_at, cycle_at, now,
     render, from one that never reports it - and the bound TARIFF-10's
     comment claimed did not exist is ~15 s of it.
     """
+    # UX-08: plain words; the setting is named by its label.
     if not on:
-        return "off - `arbitrage_enabled` is false, so nothing trades"
+        return (f"Off, “{messages.LABELS['arbitrage_enabled']}” is not "
+                f"switched on")
     if decided_at is None:
-        return (f"ON (`arbitrage_enabled`), but NO DECISION has been reached "
-                f"yet - no cycle has run as far as the arbitrage step. The "
-                f"loop's own reason: {why or 'none recorded'}")
+        return (f"On, but no decision yet, because control has not got that "
+                f"far. Control says: {why or 'no reason recorded'}")
     age = (now - decided_at).total_seconds()
     stale = cycle_at is not None and decided_at < cycle_at
-    head = (f"no decision this cycle ({why or 'no reason recorded'}); the "
-            f"last one was taken {age:.0f} s ago: " if stale else
-            f"decided {age:.0f} s ago: ")
+    head = (f"On, no decision this cycle ({why or 'no reason recorded'}), "
+            f"the last one {age:.0f} s ago: " if stale else
+            f"On, decided {age:.0f} s ago: ")
     if decision is None:
-        return (f"ON (`arbitrage_enabled`), no decision this cycle "
-                f"({why or 'no reason recorded'}), and none stands from an "
-                f"earlier one")
+        return (f"On, no decision this cycle ({why or 'no reason recorded'}) "
+                f"and none before")
     return head + decision.explain()
 
 
@@ -324,6 +417,11 @@ class Controller:
     def __init__(self, opts: dict, hass: HomeAssistant, store, mqtt_pub, *, stop,
                  peak_db_path: str = "/data/tariff.db",
                  price_history_path: str = "/data/price_history.json"):
+        # UX-15: a read-only HomeAssistant belongs to setup-only mode, which
+        # builds no controller. Refused here so no controller can hold one.
+        if getattr(hass, "read_only", False) is True:
+            raise ValueError("a controller cannot run on a read-only "
+                             "HomeAssistant (setup-only mode)")
         self.o = opts
         self.hass = hass
         self.store = store
@@ -344,6 +442,8 @@ class Controller:
         # their behalf, and a guard that raises AttributeError on the way to
         # saying so is a guard that stops the add-on booting.
         self.events: list[str] = []
+        # UX-08: the last event in plain words, for the page. See log_event().
+        self.hint = ""
 
         # --- DEV-02: THE ROSTER, BUILT BEFORE ANYTHING THAT READS A RATING ---
         # ⚠️ EVERY PER-DEVICE VALUE IN THIS CONTROLLER LIVES ON ONE OF THESE
@@ -457,7 +557,8 @@ class Controller:
                 "soc_entity / batt_entity / batt_invert / max_w keys are NOT "
                 "read in this shape; each entry carries its own."
                 % (len(self.inverters),
-                   ", ".join(f"{i.name} {i.max_w:.0f} W" for i in self.inverters)))
+                   ", ".join(f"{i.name} {i.max_w:.0f} W" for i in self.inverters)),
+                hint=messages.hint("roster", n=len(self.inverters)))
 
         self.tuning = Tuning(
             gain=float(opts.get("gain", 0.6)),
@@ -530,8 +631,9 @@ class Controller:
             # re-arm anything. It is still the difference between a pack that is
             # recalibrated on schedule and one that silently is not, which is
             # §12's opening sentence, so it is said where an operator looks.
-            self.log_event("maintenance history did NOT migrate cleanly: "
-                           + self.maint_migration.explain())
+            self.log_event("maintenance history did not move over cleanly: "
+                           + self.maint_migration.explain(),
+                           hint=messages.hint("maint_history"))
         # ⚠️ ONE CONFIG, N MACHINES. The `maintenance_*` options describe the
         # PROCEDURE - how hard to drain, how full to charge, how long to hold -
         # and the procedure is the same on every pack in the roster; what is per
@@ -580,12 +682,21 @@ class Controller:
         self._grade_store_migration(store)
         for inv in self.inverters:
             if inv.sign_wd.tripped:
-                _LOG.error("SAFETY-02 was TRIPPED on %s before this restart and "
-                           "stays tripped: %s. That inverter is held at 0 W. "
-                           "Restarting the add-on does not clear this - start "
-                           "control from the UI once you know why the command "
-                           "opposed the meter.", inv.name,
+                # UX-11: the plain sentence and the code. The saved reason,
+                # with its figures, is on the DEBUG line beside it.
+                _LOG.error("%s stays at 0 W after the restart because its "
+                           "power went the wrong way, so find out why before "
+                           "you start control: %s.", inv.name,
+                           messages.reason_code(inv.sign_wd.reason))
+                _LOG.debug("Evidence for %s: %s.", inv.name,
                            inv.sign_wd.reason or "(reason not recorded)")
+                # UX-11 review: `events` starts empty and DEBUG is off by
+                # default, so the saved figures go on the action log too.
+                saved = inv.sign_wd.reason or messages.NO_REASON_SAVED
+                self.log_event(f"FAILSAFE {inv.name}, saved before the "
+                               f"restart: {saved}",
+                               hint=messages.hint("stop_restored",
+                                                  unit=inv.name))
 
         # --- SAFETY-42 + SAFETY-34 -------------------------------------------
         # ⚠️ A LATCH THAT DOES NOT ACT, WHICH IS THE ONE ASYMMETRY WITH EVERY
@@ -606,12 +717,17 @@ class Controller:
         for inv in self.inverters:
             if inv.delivery_wd.tripped:
                 _LOG.error(
-                    "SAFETY-42 was TRIPPED on %s before this restart and stays "
-                    "tripped: %s. NOTHING IS BEING COMMANDED DIFFERENTLY - this "
-                    "guard reports and does not act - so if that inverter is "
-                    "still not delivering, the site is still short by its "
-                    "share. Restarting does not clear this.",
-                    inv.name, inv.delivery_wd.reason or "(reason not recorded)")
+                    "%s is still marked as not delivering after the restart "
+                    "while control keeps running, and only stopping and "
+                    "starting control clears this: %s.",
+                    inv.name, messages.reason_code(inv.delivery_wd.reason))
+                _LOG.debug("Evidence for %s: %s.", inv.name,
+                           inv.delivery_wd.reason or "(reason not recorded)")
+                saved = inv.delivery_wd.reason or messages.NO_REASON_SAVED
+                self.log_event(f"NOT DELIVERING {inv.name}, saved before the "
+                               f"restart: {saved}",
+                               hint=messages.hint("not_delivering",
+                                                  unit=inv.name))
 
         # --- SAFETY-30: THE SITE HALF OF THE SIGN CHECK ----------------------
         # ⚠️ ONE PER SITE, BESIDE THE ONE PER INVERTER, AND ARMED ONLY AT N>=2.
@@ -640,11 +756,15 @@ class Controller:
             reason=str(store.data.get("site_sign_reason", "") or ""))
         if self.site_sign_wd.tripped:
             _LOG.error(
-                "SAFETY-30 (site) was TRIPPED before this restart and stays "
-                "tripped: %s. Every inverter is held at 0 W. Restarting does "
-                "not clear this - start control from the UI once you know why "
-                "the site's total command opposed the meter.",
-                self.site_sign_wd.reason or "(reason not recorded)")
+                "After the restart every inverter stays at 0 W, as the total "
+                "power went the wrong way, so find out why before starting "
+                "control: %s.", messages.reason_code(self.site_sign_wd.reason))
+            _LOG.debug("Evidence for the site: %s.",
+                       self.site_sign_wd.reason or "(reason not recorded)")
+            self.log_event("FAILSAFE site, saved before the restart: "
+                           + (self.site_sign_wd.reason
+                              or messages.NO_REASON_SAVED),
+                           hint=messages.hint("site_direction"))
         # And the per-unit detectors are told which question they are asking,
         # here as well as in `cycle()`. `checks()` and the status page read
         # `inv.sign_wd.cfg` and can be called before the first cycle has run, so
@@ -689,13 +809,21 @@ class Controller:
         # does, so the latch alone is not the alarm - re-raising it is.
         # `run_control()` does that, once, before the first cycle.
         self._circ_announced = False
+        # SAFETY-34: when each latched alarm was last put in front of HA, by
+        # notification_id - see REANNOUNCE_S.
+        self._announced_mono = {}
         if self.circ_wd.tripped:
             _LOG.error(
-                "SAFETY-31 was TRIPPED before this restart and stays tripped: "
-                "%s. Every inverter is held at 0 W. Restarting does not clear "
-                "this - start control from the UI once you know why two "
-                "inverters were pushing against each other.",
-                self.circ_wd.reason or "(reason not recorded)")
+                "After the restart every inverter stays at 0 W, as the "
+                "inverters worked against each other, so find out why before "
+                "starting control: %s.",
+                messages.reason_code(self.circ_wd.reason))
+            _LOG.debug("Evidence for the site: %s.",
+                       self.circ_wd.reason or "(reason not recorded)")
+            self.log_event("CIRCULATING POWER, saved before the restart: "
+                           + (self.circ_wd.reason
+                              or messages.NO_REASON_SAVED),
+                           hint=messages.hint("circulating"))
 
         # SAFETY-03. The output clamp's alarm - see clamp.py for why the clamp
         # itself is the cheap half.
@@ -738,7 +866,7 @@ class Controller:
         self.peak = PeakTracker(self.peak_store,
                                 cap_w=float(opts.get("peak_cap_w", 3500)))
         self.peak.restore(self.p1.averager)
-        _LOG.info("capacity-tariff peak store: %s", self.peak.restore_state)
+        _LOG.info("Month peak store: %s", self.peak.restore_state)
 
         # FCST-04. The §8.3 carry-forward store: the published prices of the
         # last few Brussels days, so the hours a day-ahead feed has not printed
@@ -774,7 +902,7 @@ class Controller:
         # `.words` read below are unguarded, and a cache that raises here is an
         # add-on that does not start.
         self.price_history = PriceHistory(price_history_path)
-        _LOG.info("§8.3 price history: %s", self.price_history.words)
+        _LOG.info("Price history: %s", self.price_history.words)
 
         # SAFETY-07. The guard TARIFF-01 was built for. It is stateless by
         # design (peakguard.py holds no history between calls), so the only
@@ -802,13 +930,68 @@ class Controller:
         # every option family this file builds: no numeric fallback in main.py
         # that config.yaml has not shipped.
         self.peak_guard = None
+        # SAFETY-79. The guard aims this far under `peak_cap_w`; the bill and
+        # every report keep the real cap (`self.peak.cap_w`).
+        self.peak_margin_w = float(opts.get(
+            "peak_margin_w", peakguard.PEAK_OPTION_DEFAULTS["peak_margin_w"]))
         self._peak_engaged = False
         self._peak_saturated = False
+        # SAFETY-81: what the alarm is graded on, beside the guard's decision.
+        self._peak_proj = None
+        self._peak_batt_prev = None
+        self._peak_alarm_block = None
+        self._peak_high_since = None
         self._peak_floor_limited = False
+        # SAFETY-87: the reserve alarm's hold, as SAFETY-81's above.
+        self._reserve_batt_prev = None
+        self._reserve_high_since = None
         self._maint_shape_suspended = False
+        # OPT-11. Battery modes, off by default so an install that has not
+        # turned them on behaves exactly as before (SAFETY-10 section 1). Each
+        # battery's mode and on/off switch live in the store, not in options,
+        # so a change applies at once (`pack_use`, `pack_mode` actions).
+        self.modes_on = packmode.enabled(opts)
+        # The units whose mode fault is logged already (edge-logged).
+        self._mode_faults = set()
+        # OPT-11 P3: the price runs (`priceruns.RunPlan`, or None), the key
+        # they were built for, this tick's roles (`modetrade.Tick`), the
+        # batteries that left a run (full, or at the floor) keyed by the run,
+        # and whether last tick filed a mode trade (a run edge reseeds).
+        self.mode_runs = None
+        self._runs_key = None
+        self.mode_tick = None
+        self._run_done = {}
+        self._mode_trade_was = False
+        self._charge_blocked_q = None
+        self._ref_cheap = None
+        # OPT-11 P4: the solar forecast and the day plan. Only with battery
+        # modes on AND `pv_forecast_entity` set; otherwise none of this runs
+        # and every mode acts as in P3 option A.
+        self.fc_entity = (opts.get("pv_forecast_entity") or None) \
+            if self.modes_on else None
+        self.fc_tomorrow_entity = opts.get("pv_forecast_tomorrow_entity") \
+            or None
+        self.solar_trust_pct = opts.get("solar_trust_pct",
+                                        dayplan.DEFAULT_TRUST_PCT)
+        self.solar_fc = None
+        self.solar_fc_why = (solarfc.NOT_SET if self.fc_entity is None
+                             else solarfc.MISSING)
+        self._fc_read_mono = None
+        self.day_plan = None
+        self._plan_targets = None
+        self.house_profile = None
+        if self.fc_entity is not None:
+            self.house_profile = dayplan.HouseProfile(
+                (getattr(store, "data", None) or {}).get(HOUSE_PROFILE_KEY))
+        # OPT-11 P2: (topic, reason) of MQTT commands refused and logged once.
+        self._mqtt_refused = set()
+        self._mqtt_refused_more = 0
         # [(pack name, why)] for packs that are due and waiting their turn.
         # Empty at a roster of one, where nothing can defer anything.
         self._maint_deferred = []
+        # SAFETY-78: names of draining packs that cannot give power now, so
+        # the "waits" line is logged once, not every cycle.
+        self._drain_waits = set()
         # Set by amain() once the transport is built, so the status page can show
         # what only the transport knows (homewizard_local's unchanged_s). Stays
         # None when P1 is off, or under a transport that has no such counter.
@@ -865,6 +1048,12 @@ class Controller:
         self.target = 0.0
         self.sat_count = 0
         self.i_w = 0.0        # the loop's integrator, carried between cycles
+        # SAFETY-52. The direction the battery refuses (+1 / -1 / 0), carried
+        # like `i_w`, and when the refusal (or its last probe) started.
+        self.batt_refused = 0
+        self.batt_refused_at = None
+        self._now_mono = None
+        self._refusal_auto = False
         # TEL-10. What the last cycle's loop did, kept for publication. Seeded
         # to the SAME values the "stopped or blind" branch of `cycle()` writes,
         # because before the first cycle the loop has not run - which is the
@@ -900,6 +1089,12 @@ class Controller:
         # than re-derived a cycle later. Starts False: nothing is on the wire.
         self.following = False
         self.reason = "starting"
+        self.why_words = "Starting"
+        # UX-11: has this meter episode's WARNING been logged? See read_inputs.
+        self._meter_quiet_logged = False
+        # ...when the last WARNING was, and whether this episode logged one.
+        self._meter_quiet_warned = None
+        self._meter_quiet_loud = False
         # ALLOC-01. The allocation record from the last resolution, or None
         # before the first cycle. ⚠️ IT IS KEPT SO THAT SOMETHING CAN GATE ON
         # IT: SAFETY-28 puts the write path behind this record, and DEV-02 reads
@@ -946,7 +1141,7 @@ class Controller:
         # TARIFF-03. One line of prose for the status page saying WHICH tariff
         # window we are in and why it is or is not cheap - so "Cheap window:
         # no" is an evidenced answer rather than a bare no.
-        self.tariff_words = "no static profile"
+        self.tariff_words = "No fixed tariff set"
 
         # OPT-04. The tariff plan the BACKGROUND task last resolved, and when.
         # cycle() reads these two attributes and never awaits a fetch - see
@@ -970,6 +1165,9 @@ class Controller:
         # because `self.peak_guard` is a different cycle's decision by the time
         # the status page renders.
         self.arb_headroom_w = None
+        # UX-13 P1: today's prices as the Home chart has seen them. Display
+        # only; nothing reads it back into a decision.
+        self.home_prices = homeview.DayPrices()
         # TARIFF-11. When the most recent cycle() STARTED. `arb_at < cycle_at`
         # is the exact, derived statement of "the latest cycle did not get as
         # far as the arbitrage step", which is the fact the *Arbitrage* row
@@ -983,14 +1181,216 @@ class Controller:
         # the counterpart to `clamp_last` moving onto the Inverter: the integrator
         # that wound is the SITE integrator, of which there is exactly one, while
         # the value a clamp bit is a value written to ONE device.
-        self.loop_clamped: tuple[bool, str] = (False, "")
+        # (engaged, note, over_rating) - SAFETY-40 splits the last one out.
+        self.loop_clamped: tuple[bool, str, bool] = (False, "", False)
+        # UX-08: the numbers of a loop-side over-rating, for the notification.
+        self.loop_clamp_facts: tuple = ()
+        # SAFETY-85: this cycle's loop Decision, each battery's recent
+        # standing commands, and how many cycles in a row a battery set by
+        # another owner gave less than asked.
+        self._loop_decision = None
+        self._asked_hist: dict = {}
+        self._short_run = 0
         self.stopping = False
+        # SAFETY-61. time.monotonic() at the end of the last run_control() pass.
+        self.loop_pass_mono = None
 
     # -- helpers -------------------------------------------------------------
-    def log_event(self, msg: str) -> None:
+    # --- SAFETY-52: a battery that refuses is asked for 0 W ------------------
+    def _refusal_probe(self) -> bool:
+        """True while a refused direction may try `PROBE_W` (every 15 min)."""
+        if (not self.batt_refused or self.batt_refused_at is None
+                or self._now_mono is None):
+            return False
+        held = self._now_mono - self.batt_refused_at
+        if held >= _ctl.PROBE_EVERY_S + _ctl.PROBE_S:
+            self.batt_refused_at = self._now_mono
+            return False
+        return held >= _ctl.PROBE_EVERY_S
+
+    def _refusal_start(self, sign: int, evidence: str) -> None:
+        self.batt_refused = sign
+        self.batt_refused_at = self._now_mono
+        self.log_event(f"BATTERY REFUSES {evidence}",
+                       hint=messages.hint("battery_refuses"))
+        _LOG.info("The battery refuses to give power, so the add-on asks 0 W "
+                  "and tries %.0f W every %.0f minutes: BATTERY_REFUSES.",
+                  _ctl.PROBE_W, _ctl.PROBE_EVERY_S / 60)
+        _LOG.debug("Evidence: BATTERY_REFUSES: %s.", evidence)
+
+    def _refusal_end(self, why: str) -> None:
+        if not self.batt_refused:
+            return
+        self.batt_refused, self.batt_refused_at = 0, None
+        self.log_event(f"BATTERY REFUSES ENDED: {why}",
+                       hint=messages.hint("battery_gives"))
+        _LOG.info("The battery refusal ends, control asks for power again: %s.",
+                  why)
+
+    def _refusal_update(self, decision, asked_w, batt_w, probe) -> None:
+        """Follow `compute()`'s carried refused direction, and say so."""
+        now = decision.refused or 0
+        if now and not self.batt_refused:
+            self._refusal_start(now, f"asked {asked_w:+.0f} W, the battery "
+                                     f"gave {batt_w:+.0f} W for "
+                                     f"{decision.sat_count} cycles")
+        elif self.batt_refused and not now:
+            gave = self.batt_refused * batt_w >= _ctl.PROBE_ANSWER_W
+            self._refusal_end("the probe was answered" if gave and probe
+                              else "the battery gives power" if gave
+                              else "the grid now asks the other direction")
+
+    def _refusal_from_stale(self, inv, now_mono) -> None:
+        """A stale-reading stop while the loop is frozen on ~0 W is a refusal.
+
+        Only at one inverter: with several, one empty battery must not stop the
+        site (OPT-09's pack limit moves its share to the others).
+        """
+        t = self.tuning
+        standing = inv.standing_w()
+        if len(self.inverters) > 1:
+            # SAFETY-73: at N>1 the same trip refuses THIS unit only.
+            if ((self.auto or self.shadow) and not inv.refused
+                    and inv.ref_count >= t.saturation_cycles
+                    and inv.batt_fresh.held is not None
+                    and abs(inv.batt_fresh.held) < _ctl.REFUSED_BELOW_W
+                    and abs(standing) > _ctl.PROBE_W):
+                self._now_mono = now_mono
+                self._unit_refusal_start(
+                    inv, 1 if standing > 0 else -1,
+                    f"stale reading {inv.batt_fresh.held:+.0f} W while asked "
+                    f"{standing:+.0f} W")
+            return
+        if (len(self.inverters) == 1 and (self.auto or self.shadow)
+                and not self.batt_refused
+                and self.sat_count >= t.saturation_cycles
+                and inv.batt_fresh.held is not None
+                and abs(inv.batt_fresh.held) < _ctl.REFUSED_BELOW_W
+                and abs(standing) > t.saturation_w):
+            self._now_mono = now_mono
+            self._refusal_start(1 if standing > 0 else -1,
+                                f"stale reading {inv.batt_fresh.held:+.0f} W "
+                                f"while asked {standing:+.0f} W")
+
+    # --- SAFETY-73: the same refusal, per inverter, at N>1 -------------------
+    # SAFETY-52's decisions applied to one unit of several: a unit that gives
+    # < REFUSED_BELOW_W for SETTLE_CYCLES while asked > PROBE_W is closed in
+    # that direction by a P_SAFETY unit limit, so the allocator hands its share
+    # to the others; it is probed at PROBE_W every PROBE_EVERY_S, one unit at a
+    # time. The ask is PROBE_W, not `saturation_w`: a unit's share is often
+    # small (a 400 W night load split two ways) and SAFETY-43 would otherwise
+    # name the empty battery as not delivering. DECISIONS/SAFETY-73.
+    def _unit_refusal_start(self, inv, sign: int, evidence: str) -> None:
+        inv.refused, inv.refused_at = sign, self._now_mono
+        inv.probe_from, inv.ref_count = None, 0
+        self.log_event(f"BATTERY REFUSES {inv.name}: {evidence}",
+                       hint=messages.hint("unit_refuses", unit=inv.name))
+        _LOG.info("%s: the battery refuses power, so it is asked 0 W and the "
+                  "other inverters take over: BATTERY_REFUSES.", inv.name)
+        _LOG.debug("Evidence for %s: BATTERY_REFUSES: %s.", inv.name, evidence)
+        # Only a refusal to GIVE: a full battery that stops taking charge is
+        # above its cut-out level by definition and says nothing about it.
+        if (sign > 0 and inv.soc is not None and inv.bms_soc_floor is not None
+                and float(inv.soc) > float(inv.bms_soc_floor)):
+            # Owner decision 3: a refusal above the configured cut-out level
+            # may mean that level is set wrong. One line, no safety stop.
+            _LOG.warning("%s refuses power above its battery cut-out level, "
+                         "check its cut-out level: REFUSES_ABOVE_CUT_OUT.",
+                         inv.name)
+            _LOG.debug("Evidence for %s: REFUSES_ABOVE_CUT_OUT: battery level "
+                       "%.0f %%, cut-out level %.0f %%.", inv.name,
+                       float(inv.soc), float(inv.bms_soc_floor))
+
+    def _unit_refusal_end(self, inv, why: str) -> None:
+        if not inv.refused:
+            return
+        inv.refused, inv.refused_at, inv.probe_from = 0, None, None
+        inv.ref_count = 0
+        self.log_event(f"BATTERY REFUSES ENDED {inv.name}: {why}",
+                       hint=messages.hint("unit_gives", unit=inv.name))
+        _LOG.info("%s: the battery refusal ends, it is asked for power again: "
+                  "%s.", inv.name, why)
+        # The site target may stand above what was placed (the refused share
+        # was unmet). Restart it from the watts on the wire, or the reopened
+        # unit is handed the parked remainder at once (phase A: -1059 W).
+        placed = float(sum(i.standing_w() for i in self.inverters))
+        self.target = self.i_w = placed
+        self.sat_count = 0
+
+    def _unit_probe(self, inv) -> bool:
+        """True while `inv` may try PROBE_W. One unit probes at a time."""
+        now = self._now_mono
+        if not inv.refused or inv.refused_at is None or now is None:
+            return False
+        if inv.probe_from is not None:
+            if now - inv.probe_from < _ctl.PROBE_S:
+                return True
+            inv.probe_from, inv.refused_at = None, now
+            return False
+        if now - inv.refused_at < _ctl.PROBE_EVERY_S or any(
+                i.probe_from is not None for i in self.inverters):
+            return False
+        inv.probe_from = now
+        return True
+
+    def _unit_refusals(self) -> None:
+        """Engage and end each unit's refusal from its own reading."""
+        for inv in self.inverters:
+            b = inv.batt
+            if inv.refused:
+                if b is not None and inv.refused * b >= _ctl.PROBE_ANSWER_W:
+                    self._unit_refusal_end(
+                        inv, "the probe was answered"
+                        if inv.probe_from is not None
+                        else "the battery gives power")
+                    continue
+                # The other direction: the battery takes PROBE_ANSWER_W or more
+                # the other way (charge at the floor) for SETTLE_CYCLES. Counted
+                # on its own reading, so one cycle of the loop overshooting
+                # through zero does not hand it its share back.
+                inv.ref_count = (inv.ref_count + 1 if b is not None and
+                                 -inv.refused * b >= _ctl.PROBE_ANSWER_W else 0)
+                if inv.ref_count >= _ctl.SETTLE_CYCLES:
+                    self._unit_refusal_end(
+                        inv, "the battery takes power the other way")
+                continue
+            if b is None:
+                continue        # a gap keeps the count: the gate's trip seeds
+            standing = inv.standing_w()
+            sign = 1 if standing > 0 else -1
+            # One direction throughout: a command that swaps sign every cycle
+            # (a flapping load) reads ~0 through the plant's own lag, and that
+            # is a battery following, not refusing (TEST-19 flapping family).
+            if abs(standing) > _ctl.PROBE_W and abs(b) < _ctl.REFUSED_BELOW_W:
+                if sign != inv.ref_sign or not inv.ref_count:
+                    inv.ref_count, inv.ref_since = 0, self._now_mono
+                inv.ref_count = min(inv.ref_count + 1, _ctl.SETTLE_CYCLES)
+            else:
+                inv.ref_count = 0
+            inv.ref_sign = sign
+            if inv.ref_count >= _ctl.SETTLE_CYCLES and (
+                    inv.ref_since is None or self._now_mono is None
+                    or self._now_mono - inv.ref_since >= REFUSED_SPAN_S):
+                self._unit_refusal_start(
+                    inv, sign,
+                    f"asked {standing:+.0f} W, the battery gave {b:+.0f} W "
+                    f"for {_ctl.SETTLE_CYCLES} cycles")
+
+    def _site_refused(self):
+        """Owner decision 4: every unit refuses the same way, so the site law
+        holds 0 W (SAFETY-52's, in compute()). Otherwise None, the old law."""
+        signs = {inv.refused for inv in self.inverters}
+        return signs.pop() if len(signs) == 1 and 0 not in signs else None
+
+    def log_event(self, msg: str, hint: str | None = None) -> None:
+        """`msg` goes on the action log, the add-on's own technical record.
+        `hint` is `messages.hint()`'s plain words for the same event, and is
+        what the page shows under the buttons (UX-08)."""
         stamp = datetime.now(timezone.utc).strftime("%H:%M:%S")
         self.events.insert(0, f"{stamp} {msg}")
         del self.events[40:]
+        if hint is not None:
+            self.hint = f"{datetime.now().astimezone():%H:%M} {hint}"
 
     def _grade_store_migration(self, store) -> None:
         """DEV-02. Did SAFETY-02's latch actually survive the key rename?
@@ -1048,9 +1448,9 @@ class Controller:
         """
         rep = self.store_migration
         if rep.ran and not rep.ok:
-            _LOG.error("SAFETY-02: the per-inverter store migration did not "
-                       "verify (%s). The latch is being re-derived from the "
-                       "legacy keys.", rep.explain())
+            _LOG.error("The saved safety stops did not copy over cleanly, so "
+                       "they are read again from the older saved state: %s.",
+                       rep.explain())
         data = getattr(store, "data", {})
         legacy_tripped = bool(data.get("sign_tripped", False))
         if not legacy_tripped or not self.inverters:
@@ -1176,10 +1576,8 @@ class Controller:
             return
         if stranded:
             _LOG.error(
-                "SAFETY-44: this store carries a LATCHED sign-disagreement "
-                "failsafe under %s, and that unit is NOT on today's roster "
-                "%s - so no machine reads it and the site came up DRIVING on "
-                "a state file that says it is latched. Re-arming below.",
+                "A saved safety stop belongs to %s, which is not in the "
+                "inverter list %s, so it is set again on the first inverter.",
                 ", ".join(sorted(stranded)), sorted(on_roster))
         first = self.inverters[0]
         # The one state this method exists for.
@@ -1191,17 +1589,19 @@ class Controller:
         first.store_set("sign_reason", first.sign_wd.reason)
         first.store_set("sign_tripped", True)
         _LOG.error(
-            "SAFETY-02 LATCH GUARD: this store carries a LATCHED "
-            "sign-disagreement failsafe under the pre-DEV-02 flat key and NO "
-            "inverter came up latched. Either the per-inverter migration lost "
-            "it, or it was written by an older add-on while this install was "
-            "rolled back. Both are a disarmed safety guard on an install whose "
-            "state file says it is protected, so the latch has been re-armed "
-            "on %s from the legacy value: %s. %s is held at 0 W until control "
-            "is started from the UI.",
-            first.name, first.sign_wd.reason, first.name)
+            "%s is set to 0 W again because an older saved safety stop was "
+            "found, so find out why before you start control: %s.",
+            first.name, messages.reason_code(first.sign_wd.reason))
+        _LOG.debug("Evidence for %s: %s.", first.name, first.sign_wd.reason)
+        _LOG.debug(
+            "SAFETY-02 latch guard: the pre-DEV-02 flat key says the "
+            "sign-disagreement failsafe is latched and no inverter came up "
+            "latched. Either the per-inverter migration lost it, or an older "
+            "add-on wrote it during a rollback. Both would be a disarmed "
+            "guard, so the latch is re-armed on %s.", first.name)
         self.log_event("FAILSAFE re-armed from the pre-DEV-02 store keys - "
-                       + first.sign_wd.reason)
+                       + first.sign_wd.reason,
+                       hint=messages.hint("stop_restored", unit=first.name))
 
     # -- the roster, and the N=1 views of it ---------------------------------
     @property
@@ -1514,6 +1914,11 @@ class Controller:
         """
         return float(sum(inv.rating_w() for inv in self.inverters))
 
+    def peak_aim_w(self) -> float:
+        """SAFETY-79. `peak_cap_w` less `peak_margin_w`: what the forecast
+        checks aim at. Reports and the bill use the real cap."""
+        return float(self.o.get("peak_cap_w", 3500)) - self.peak_margin_w
+
     def site_dev_bound(self, which: str):
         """The roster's summed device floor / ceiling, or None if unknown.
 
@@ -1654,7 +2059,698 @@ class Controller:
         that have nothing to do with the allocator, and a weighting held from
         construction prefers a pack that has since emptied.
         """
-        return packshare.weights(self.pack_energy, target_w)
+        base = packshare.weights(self.pack_energy, target_w)
+        if not self.modes_on:
+            return base
+        # OPT-11: the solar order. While the site charges, Leftover solar
+        # batteries weigh 0, so Solar first batteries fill first. A comfort
+        # choice like the rest of this method: permission is the mode claim.
+        w = packmode.charge_weights(base, self.pack_modes(), target_w)
+        # P3: in a price run, the batteries whose run it is carry it first.
+        tick = self.mode_tick
+        return w if tick is None else modetrade.weights(tick.roles, w,
+                                                        target_w)
+
+    def pack_mode(self, inv) -> "packmode.PackMode":
+        """OPT-11. This battery's on/off switch and mode, read from the store."""
+        return packmode.read(getattr(self.store, "data", None) or {}, inv.name)
+
+    def pack_modes(self) -> dict:
+        return {inv.name: self.pack_mode(inv) for inv in self.inverters}
+
+    def loop_bound(self, claims):
+        """OPT-11. `(lo, hi)`: what the batteries may place if the loop decides.
+
+        The sum over live units of each unit's hard limits with its mode
+        applied (`allocator.loop_bound()`), from THIS cycle's unit claims. At
+        one inverter every claim is on the site, so it is the mode range
+        itself, or None when no mode is filed (maintenance) or the range
+        leaves out 0 W (a fault `resolve()` reports).
+        """
+        if len(self.inverters) <= 1:
+            modes = [c for c in claims if c.source == "mode"]
+            if not modes:
+                return None
+            lo = max(c.lo for c in modes)
+            hi = min(c.hi for c in modes)
+            return (lo, hi) if lo <= 0.0 <= hi else None
+        bounds = {u: pre_resolve([c for c in claims if c.actuator == u])
+                  for u in self.units}
+        return allocator.loop_bound(bounds, live=self.live_units())
+
+    # --- OPT-11 P3: price runs, per battery -------------------------------
+    def _mode_packs(self, maint_results=None) -> list:
+        """Each battery as `modetrade.Pack`, in roster order."""
+        live = set(self.live_units())
+        out = []
+        for i, inv in enumerate(self.inverters):
+            pm = self.pack_mode(inv)
+            idle = (maint_results is None
+                    or maint_results[i].phase == IDLE)
+            refused = (inv.refused if len(self.inverters) > 1
+                       else self.batt_refused) or 0
+            out.append(modetrade.Pack(
+                inv.name, pm.use, pm.mode, pm.sell and pm.can_sell,
+                float(inv.max_w), inv.soc, inv.capacity_kwh,
+                live=inv.name in live, idle=idle, refused=int(refused)))
+        return out
+
+    def _price_runs(self, now, packs, floor_pct, ceiling_pct):
+        """The kept run plan, rebuilt at most once per price slot (15 min) or
+        when the prices or a battery's choice change; a run under way is
+        kept to its end (`priceruns.keep_started()`). None with no fresh
+        firm prices: then no battery holds or trades (design section 5)."""
+        plan = self.fresh_tariff_plan(now)
+        if plan is None or not plan.has_prices:
+            self.mode_runs, self._runs_key = None, None
+            self.day_plan = None
+            return None
+        slot = int(now.timestamp() // 900)
+        key = (id(plan), slot, tuple((p.name, p.use, p.mode, p.sell)
+                                     for p in packs))
+        if self.fc_entity is not None:
+            # P4: a forecast arriving or going rebuilds the plan at once.
+            key += (self.solar_fc is None,)
+        if key != self._runs_key:
+            done_c = self._run_done.get("charge", (None, set()))[1]
+            done_s = self._run_done.get("sell", (None, set()))[1]
+            e = modetrade.energy(packs, floor_pct, ceiling_pct, done_c,
+                                 done_s)
+            required = price_required_spread(
+                arbitrage.threshold_eur_kwh(self.o),
+                price_uncertainty_of(plan.read.product)
+                | {Uncertainty.NO_WEATHER})
+            ref = self._ref_cheap
+            if ref is not None and now - ref.end > REF_CHEAP_KEEP:
+                ref = self._ref_cheap = None
+            new = priceruns.plan(
+                plan.read.points, now, required_eur_kwh=required,
+                charge_kwh=e[0], charge_kw=e[1], sell_kwh=e[2],
+                sell_kw=e[3],
+                ref_eur_kwh=None if ref is None else ref.mean_eur_kwh)
+            if self.fc_entity is not None:
+                new = self._day_plan(now, packs, floor_pct, ceiling_pct,
+                                     new, plan, required, ref, done_c, e)
+            self.mode_runs = priceruns.keep_started(self.mode_runs, new, now)
+            self._runs_key = key
+        runs = self.mode_runs
+        # The cheapest cheap run under way lately is the price the stored
+        # energy was bought at; it stays the reference for REF_CHEAP_KEEP
+        # after it ends, unless a cheaper one comes.
+        ref = self._ref_cheap
+        if runs is not None and runs.cheap is not None \
+                and runs.cheap.holds(now) and (
+                    ref is None or now - ref.end > REF_CHEAP_KEEP
+                    or runs.cheap.mean_eur_kwh <= ref.mean_eur_kwh):
+            self._ref_cheap = runs.cheap
+        return runs
+
+    def _day_plan(self, now, packs, floor_pct, ceiling_pct, runs, plan,
+                  required, ref, done_c, e):
+        """OPT-11 P4: the day plan (`dayplan.plan()`) on the runs just made,
+        its levels held by the hysteresis (`dayplan.hold()`), then the runs
+        made again with each battery's shortfall as the charge, so the cheap
+        run is only as long as the shortfall needs. With no plan (no or stale
+        forecast, no house profile yet) the levels are dropped: P3 option A.
+        Returns the runs to keep."""
+        dp = dayplan.plan(
+            self.solar_fc,
+            None if self.house_profile is None
+            else self.house_profile.estimator(),
+            priceruns.keep_started(self.mode_runs, runs, now), now, packs,
+            trust_pct=self.solar_trust_pct, floor_pct=floor_pct,
+            ceiling_pct=ceiling_pct)
+        self.day_plan = dp
+        if dp is None:
+            self._plan_targets = None
+            return runs
+        self._plan_targets = dayplan.hold(
+            self._plan_targets, dp.targets,
+            {p.name: p.capacity_kwh for p in packs})
+        e2 = modetrade.energy(packs, floor_pct, ceiling_pct, done_c, (),
+                              targets=self._plan_targets)
+        return priceruns.plan(
+            plan.read.points, now, required_eur_kwh=required,
+            charge_kwh=e2[0], charge_kw=e2[1], sell_kwh=e[2], sell_kw=e[3],
+            ref_eur_kwh=None if ref is None else ref.mean_eur_kwh)
+
+    def plan_targets(self):
+        """P4: each battery's planned level, or None (no day plan). Dropped
+        at once when the forecast goes (stale or missing)."""
+        if self.solar_fc is None:
+            return None
+        return self._plan_targets
+
+    def _mode_roles(self, now, maint_results):
+        """OPT-11 P3: each battery's role and range this tick. Grid charging
+        and selling need a fresh plan that `TariffPlan.arbitrage()` allows
+        with the MEASURED peak guard (None refuses: nothing measures the
+        quarter), exactly the gate `arbitrage.decide()` has."""
+        floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
+        packs = self._mode_packs(maint_results)
+        runs = self._price_runs(now, packs, floor_pct, ceiling_pct)
+        guard = arbitrage.guard_state(self.peak_guard)
+        plan = self.fresh_tariff_plan(now)
+        charge_ok = sell_ok = False
+        trade_why = "not_covered"
+
+        def allowed(active):
+            return plan.arbitrage(
+                peak_guard_active=active,
+                min_spread_eur_kwh=arbitrage.threshold_eur_kwh(self.o),
+                uncertainty=frozenset({Uncertainty.NO_WEATHER})).match(
+                    allowed=lambda _v: True, refused=lambda _v: False)
+        if guard is not None and plan is not None and runs is not None:
+            # A charge asks the guard (section 9.1 interlock); a sell only
+            # needs it to have measured the quarter, since discharge is never
+            # capped by it (a big discharge alone engages it on export).
+            sell_ok = allowed(False)
+            charge_ok = sell_ok and allowed(guard)
+            trade_why = (None if charge_ok else "peak" if sell_ok
+                         else "not_worth")
+        price_now = None
+        if plan is not None:
+            try:
+                pt = plan.read.match(series=lambda r: r.at(now),
+                                     no_data=lambda _r: None)
+                price_now = (None if pt is None or pt.provisional
+                             else float(pt.eur_per_kwh))
+            except Absence:
+                price_now = None
+        house = (None if self.grid is None or self.site_batt_w is None
+                 else float(self.grid) + float(self.site_batt_w))
+        if self.house_profile is not None and \
+                self.house_profile.add(now, house):
+            self.store.set(HOUSE_PROFILE_KEY, self.house_profile.dump())
+        targets = self.plan_targets()
+        if targets is None:
+            done_c = self._run_mark("charge", runs and runs.cheap, packs,
+                                    lambda p: p.soc is not None
+                                    and p.soc >= ceiling_pct)
+        else:
+            # P4: out of the run at its planned level. A level the
+            # hysteresis moved opens the run to it again (a new mark key).
+            def full(p):
+                to = modetrade.charge_to(p, ceiling_pct, targets)
+                return p.soc is not None and (to is None or p.soc >= to)
+            done_c = self._run_mark("charge", runs and runs.cheap, packs,
+                                    full, tuple(sorted(targets.items())))
+        done_s = self._run_mark("sell", runs and runs.sell, packs,
+                                lambda p: p.soc is not None
+                                and p.soc <= floor_pct)
+        quarter = int(now.timestamp() // 900)
+        was = self.mode_tick is not None and \
+            self.mode_tick.action == modetrade.CHARGE
+        self.mode_tick = modetrade.decide(
+            runs, now, packs, charge_ok=charge_ok, sell_ok=sell_ok,
+            trade_why=trade_why, price_now=price_now,
+            headroom_w=self.arb_headroom_w, floor_pct=floor_pct,
+            ceiling_pct=ceiling_pct, house_w=house, charging_now=was,
+            blocked=self._charge_blocked_q == quarter,
+            done_charge=done_c, done_sell=done_s, targets=targets,
+            draining=any(r.phase == DRAIN for r in maint_results or ()))
+        # A charge the guard or the headroom stopped stays off this period.
+        if was and self.mode_tick.action != modetrade.CHARGE and \
+                self.mode_tick.why in ("peak", "headroom"):
+            self._charge_blocked_q = quarter
+        return self.mode_tick
+
+    def _run_mark(self, kind, run, packs, out, extra=None) -> set:
+        """The batteries that left run `run` (full, or at the floor); they
+        stay out until it ends, so a level edge does not re-arm them.
+        `extra` (P4: the planned levels) is part of the run's key."""
+        key = None if not run else (run.start, run.end)
+        if key is not None and extra is not None:
+            key += (extra,)
+        was_key, done = self._run_done.get(kind, (None, set()))
+        if key != was_key:
+            done = set()
+        if key is not None:
+            done |= {p.name for p in packs if out(p)}
+        self._run_done[kind] = (key, done)
+        return done
+
+    def _mode_trade(self, claims, now) -> bool:
+        """OPT-11 P3: file the site trade the roles ask for, sized inside the
+        modes and the hard limits (the loop bound) and, for a charge, the
+        billed quarter's headroom (SAFETY-45, aim cap - margin, SAFETY-79).
+        So no battery that its mode or a refusal holds is asked for watts it
+        may not give (P1's unmet share). Returns True when a trade is filed.
+        """
+        tick = self.mode_tick
+        if tick is None:
+            return False
+        size = modetrade.size(tick, self.loop_bound(claims)
+                              if tick.action else None, self.arb_headroom_w)
+        runs = self.mode_runs
+        if tick.action and (size == 0.0 or runs is None):
+            # Nothing the batteries may place (a refusal, a hard limit): no
+            # trade, and the roles say so rather than "charging".
+            back = {modetrade.CHARGE: modetrade.HOLD,
+                    modetrade.REST: modetrade.HOUSE,
+                    modetrade.SELL: modetrade.GIVE}
+            tick = self.mode_tick = modetrade.Tick(
+                tick.ranges, {n: back.get(r, r) for n, r in tick.roles.items()},
+                None, 0.0, "size")
+        if size == 0.0 or runs is None:
+            reason = ("battery modes: no price run now" if tick.why is None
+                      else f"battery modes: no trade ({tick.why})")
+            self.arb = arbitrage.ArbitrageDecision(
+                action=None, power_w=None, reason=reason,
+                spread_eur_kwh=None, required_eur_kwh=None,
+                price_now_eur_kwh=None)
+        else:
+            charge = tick.action == modetrade.CHARGE
+            run = runs.cheap if charge else runs.sell
+            who = ", ".join(n for n, r in sorted(tick.roles.items())
+                            if r == tick.action)
+            act = arbitrage.CHARGE if charge else arbitrage.DISCHARGE
+            self.arb = arbitrage.ArbitrageDecision(
+                action=act, power_w=size,
+                reason=(f"{act}: battery modes, "
+                        f"{'cheap' if charge else 'sell'} run "
+                        f"{run.start.isoformat()} to {run.end.isoformat()} "
+                        f"at {run.mean_eur_kwh:.4f} EUR/kWh; "
+                        f"{abs(size):.0f} W on {who}"),
+                spread_eur_kwh=None, required_eur_kwh=runs.level_eur_kwh,
+                price_now_eur_kwh=None)
+            claims.append(arbitrage.claim(self.arb))
+        if self.arb.action != self._arb_action:
+            self._arb_action = self.arb.action
+            self.log_event(self.arb.explain(), hint=messages.hint(
+                "trade_charge" if self.arb.action == arbitrage.CHARGE else
+                "trade_give" if self.arb.action == arbitrage.DISCHARGE
+                else "trade_off"))
+        return self.arb.action is not None
+
+    def _reseed_run_edge(self, claims) -> None:
+        """OPT-11 P3: a mode trade just ended, so the loop takes over from a
+        command no loop chose. Start it at the house's own point E, the
+        command that brings the grid to its target now (`site battery + grid
+        - target`, inside the loop bound), instead of at the trade's watts
+        (the trade began with the same unslewed step). This tick's error still
+        measures the trade's command (it is exactly E - battery), so the
+        integrator is seeded that much short and lands on E after its step.
+        Measured (tools/opt11p3_replay.py, lagged battery, 2.5 kW charge
+        ending under an 800 W house): no reseed -258 W export then a 2976 W
+        import, settled in 55 s; this -257 W / +615 W, settled in 20 s.
+        """
+        batt = self.site_batt_w
+        if batt is None or self.grid is None:
+            return
+        want = float(batt) + float(self.grid) - self.tuning.target_grid_w
+        bound = self.loop_bound(claims)
+        if bound is not None:
+            want = max(bound[0], min(bound[1], want))
+        want = float(round(max(-self.site_max_w, min(self.site_max_w, want))))
+        self.target = want
+        self.i_w = want - self.tuning.gain * (want - float(batt))
+
+    def _mode_fault_log(self, resolution) -> None:
+        """OPT-11: say once, per battery, that its mode was dropped as a fault.
+
+        A mode range without 0 W would force a direction, which no mode may do,
+        so it is never applied (allocator.unit_interval()). main.py never
+        builds one; this is the line that says so if it ever does.
+        """
+        alloc = resolution.allocation
+        now = {u for u, _ in getattr(alloc, "mode_faults", ())}
+        if resolution.mode_fault is not None and self.inverters:
+            now.add(self.inverters[0].name)
+        for inv in self.inverters:
+            if inv.name in now and inv.name not in self._mode_faults:
+                _LOG.error("Battery mode ignored for %s. Software fault "
+                           "MODE_RANGE.", inv.name)
+                self.log_event(f"battery mode ignored on {inv.name}, a "
+                               f"software fault", hint=messages.hint(
+                                   "mode_fault", unit=inv.name))
+        self._mode_faults = now
+
+    def _pack_action(self, what, unit, value, now) -> dict:
+        """OPT-11: switch one battery on or off, set its mode, or (P3) turn
+        its selling on or off.
+
+        Store state, not an option, so it applies on the next cycle with no
+        restart. Written to the action log. Switching a battery off also stops
+        its maintenance cycle (the owner's 2026-09-27 answer). Refused, with a
+        plain reason, while battery modes are off or for an unknown battery or
+        value.
+        """
+        if not self.modes_on:
+            return {"error": messages.pack_refused("off")}
+        inv = next((i for i in self.inverters if i.name == unit), None)
+        if inv is None:
+            return {"error": messages.pack_refused("unit")}
+        if what == "pack_use":
+            if not isinstance(value, bool):
+                return {"error": messages.pack_refused("value")}
+            inv.store_set(packmode.USE_KEY, value)
+            self.log_event(f"{inv.name} switched {'on' if value else 'off'} "
+                           f"by operator",
+                           hint=messages.hint("pack_on" if value
+                                              else "pack_off", unit=inv.name))
+            if not value:
+                self._maint_stop_off(self.maints[self.inverters.index(inv)],
+                                     now)
+        elif what == "pack_sell":
+            if not packmode.SELLING_ENABLED:
+                return {"error": messages.pack_refused("sell_off")}
+            if not isinstance(value, bool):
+                return {"error": messages.pack_refused("value")}
+            inv.store_set(packmode.SELL_KEY, value)
+            self.log_event(f"{inv.name} selling switched "
+                           f"{'on' if value else 'off'} by operator",
+                           hint=messages.hint("pack_sell", unit=inv.name))
+        else:
+            if value not in packmode.MODES:
+                return {"error": messages.pack_refused("value")}
+            inv.store_set(packmode.MODE_KEY, value)
+            self.log_event(f"{inv.name} mode set to {value.replace('_', ' ')} "
+                           f"by operator",
+                           hint=messages.hint("pack_mode", unit=inv.name))
+        pm = self.pack_mode(inv)
+        out = {"unit": inv.name, "use": pm.use, "mode": pm.mode}
+        if what == "pack_sell":
+            out["sell"] = pm.sell
+        return out
+
+    def mode_values(self) -> dict:
+        """OPT-11 P2: each battery's mode and switch, for their HA state
+        topics. Read from the store, so they are right after a restart. Empty
+        while battery modes are off."""
+        if not self.modes_on:
+            return {}
+        out = {}
+        names = [inv.name for inv in self.inverters]
+        for inv, slug in zip(self.inverters, unit_slugs(names)):
+            pm = self.pack_mode(inv)
+            out[unit_state_key(slug, "mode")] = MODE_LABELS.get(pm.mode,
+                                                               pm.mode)
+            out[unit_state_key(slug, "use")] = USE_ON if pm.use else USE_OFF
+        return out
+
+    async def mqtt_command(self, topic, payload, retained) -> None:
+        """OPT-11 P2: one command from a battery's HA switch or mode list.
+
+        It goes through handle_action(), the page's /action path, so the
+        checks and the store write are the same. A retained command (one the
+        broker replays on subscribe, e.g. after a restart) is never applied:
+        the store already holds the last choice. A refusal is logged once per
+        topic and reason, at most 32, and further refusals are counted in the
+        log at 1, 10, 100 and so on. Never raises: MQTT must not reach control.
+        """
+        try:
+            slug, action, value, why = parse_command(
+                topic, payload, retained, packmode.MODES)
+            if why is None:
+                names = [inv.name for inv in self.inverters]
+                unit = dict(zip(unit_slugs(names), names)).get(slug)
+                result = await self.handle_action(action, unit=unit,
+                                                  value=value)
+                if not (isinstance(result, dict) and "error" in result):
+                    self.mqtt.publish(self.mode_values())
+                    return
+                why = result["error"]
+            else:
+                why = messages.pack_refused(why)
+            # Printable only: a topic is sender-chosen, so no log injection.
+            topic_s = "".join(c if c.isprintable() else "?"
+                              for c in str(topic)[:128])
+            _LOG.debug("Home Assistant command %s %s refused: %s", topic_s,
+                       repr(payload)[:48], why)
+            if (topic_s, why) in self._mqtt_refused \
+                    or len(self._mqtt_refused) >= 32:
+                # Not logged again, but counted: 1, 10, 100... stay visible.
+                self._mqtt_refused_more += 1
+                more = self._mqtt_refused_more
+                if str(more).rstrip("0") == "1":
+                    _LOG.warning("Home Assistant commands still ignored: %d "
+                                 "more so far.", more)
+                return
+            self._mqtt_refused.add((topic_s, why))
+            _LOG.warning("Home Assistant command on %s ignored: %s", topic_s,
+                         why)
+        except Exception:                               # noqa: BLE001
+            _LOG.exception("Home Assistant command could not be handled")
+
+    def _drain_floor(self, claims, maint_results):
+        """SAFETY-78: the site `lo` for a pinned maintenance drain, or None.
+
+        At N>=2 the drain pins its pack and the site target is split around
+        the pin. Below the pin a sibling would have to charge (opposite
+        directions, refused, 0 W, and the drain never moves). So the site
+        target may not go below what the pin places: the drained pack covers
+        the house up to its drain rate and exports the rest, as at N=1, and
+        a sibling only ever adds power in the same direction. At N=1 the
+        drain is the site SET itself, so nothing is filed.
+        A draining pack whose own limits leave it nothing to give (a refusal,
+        a stale link) adds no floor, and that is logged once.
+        """
+        if len(self.inverters) < 2:
+            return None
+        live = set(self.live_units())
+        floor, waits = 0.0, set()
+        for inv, res in zip(self.inverters, maint_results):
+            if res.phase != DRAIN or not res.owns_setpoint \
+                    or not (res.setpoint_w or 0.0) > 0.0:
+                continue
+            u = self.actuator_of("maintenance", inv)
+            b = pre_resolve([c for c in claims if c.actuator == u])
+            p = (None if u not in live or b.contradiction
+                 or b.pinned_by != "maintenance" else allocator.pin_w(b))
+            if p is not None and p > 0.0:
+                floor += p
+            else:
+                waits.add(inv.name)
+        for name in sorted(waits - self._drain_waits):
+            self.log_event(f"maintenance: {name} cannot give power now, so "
+                           f"its monthly cycle waits",
+                           hint=messages.hint("maint_waits", unit=name))
+        self._drain_waits = waits
+        return floor if floor > 0.0 else None
+
+    def _peak_on_able(self, decision, maint_results):
+        """SAFETY-87: at N>=2, `decision` placed on the batteries that can
+        still give: live, not refusing, above their own reserve. `able_w` is
+        their rating plus the drain a held battery gives anyway (its
+        maintenance pin). Unchanged when no battery is held back.
+        DECISIONS/SAFETY-87-guard-uses-able-batteries.md."""
+        if len(self.inverters) < 2:
+            return decision
+        floor = float(self.o.get(
+            "peak_soc_floor", peakguard.PEAK_OPTION_DEFAULTS["peak_soc_floor"]))
+        ok, held = peakguard.reserve_split(self.packs, floor)
+        if not held:
+            return decision
+        live = set(self.live_units())
+        able = [p for p, inv in zip(self.packs, self.inverters)
+                if p in ok and inv.name in live and not (inv.refused or 0) > 0]
+        if not able:
+            return dataclasses.replace(decision, held=held)
+        drain = sum(min(float(r.setpoint_w), i.rating_w())
+                    for i, r in zip(self.inverters, maint_results)
+                    if i.name in held and r.phase == DRAIN
+                    and r.owns_setpoint and (r.setpoint_w or 0.0) > 0.0)
+        names = {p.name for p in able}
+        return peakguard.place_on_able(
+            decision, held,
+            able_w=drain + sum(i.rating_w() for i in self.inverters
+                               if i.name in names),
+            soc=min(float(p.soc) for p in able),
+            soc_floor=peakguard.binding_soc_floor(able, floor))
+
+    def _peak_reserve(self) -> frozenset:
+        """SAFETY-87: the batteries that give nothing for the peak this
+        cycle: under their reserve while the others carry a peak floor."""
+        g = self.peak_guard
+        if g is None or g.able_w is None or not (g.floor_w or 0.0) > 0.0:
+            return frozenset()
+        return frozenset(g.held)
+
+    def _peak_over_drain(self, claims, maint_results) -> None:
+        """SAFETY-83: at N=1 a peak floor above the drain rate outranks it.
+
+        The drain is the site SET at P_MAINTENANCE, above the peak floor
+        (P_PEAK), so the floor did not bind and the house imported what the
+        drain left. Where the floor asks for more than the drain rate, it is
+        refiled at P_MAINTENANCE and wins; nothing else changes. Safety claims
+        (P_SAFETY) still outrank it. At N>=2 the `drain` floor does this, and
+        `_drain_over_reserve()` when a battery is held at its reserve.
+        """
+        if len(self.inverters) != 1:
+            self._drain_over_reserve(claims, maint_results)
+            return
+        res = maint_results[0]
+        if res.phase != DRAIN or not res.owns_setpoint:
+            return
+        rate = float(res.setpoint_w or 0.0)
+        for i, c in enumerate(claims):
+            if c.source == peakguard.SOURCE and c.lo > rate:
+                claims[i] = dataclasses.replace(c, priority=P_MAINTENANCE)
+
+    def _held_pin(self, claims, u):
+        """SAFETY-87: what held unit `u` places anyway (its own pin), or None
+        when that pin charges, so the site is never split both ways."""
+        b = pre_resolve([c for c in claims if c.actuator == u])
+        p = None if b.contradiction else allocator.pin_w(b)
+        return None if p is not None and p < 0.0 else max(p or 0.0, 0.0)
+
+    def _drain_over_reserve(self, claims, maint_results) -> None:
+        """SAFETY-87, N>=2: while a battery is held at its peak reserve, a
+        draining battery that may still give is raised from its drain rate
+        towards its rating for the peak floor, after the others. Otherwise
+        the floor's rest lands on the held battery (its weight 0 only orders
+        the split; the drain pin binds). A site stop still decides alone."""
+        reserve = self._peak_reserve()
+        floor = max((c.lo for c in claims if c.source == peakguard.SOURCE),
+                    default=0.0)
+        if not reserve or not floor > 0.0 or any(
+                c.kind == SET and c.actuator == ACTUATOR_SITE
+                and c.priority > P_PEAK for c in claims):
+            return
+        live = set(self.live_units())
+        drains, others = [], 0.0
+        for inv, res in zip(self.inverters, maint_results):
+            u = self.actuator_of("maintenance", inv)
+            if u not in live:
+                continue
+            if inv.name in reserve:
+                p = self._held_pin(claims, u)
+                if p is None:
+                    return
+                others += p
+                continue
+            b = pre_resolve([c for c in claims if c.actuator == u])
+            if b.contradiction:
+                continue
+            p = allocator.pin_w(b)
+            if p is not None and p < 0.0:
+                return          # a pack pinned to charge: never split both ways
+            if res.phase == DRAIN and b.pinned_by == "maintenance" \
+                    and p is not None and p > 0.0:
+                drains.append((u, p, allocator.hi_w(b)))
+            others += allocator.hi_w(b) if p is None else p
+        give = floor - others
+        for u, p, hi in drains:
+            if give <= 0.0:
+                break
+            up = max(p, min(hi, p + give))
+            give -= up - p
+            for i, c in enumerate(claims):
+                if c.source == "maintenance" and c.kind == SET \
+                        and c.actuator == u:
+                    claims[i] = dataclasses.replace(c, value=up)
+
+    def _peak_over_hold(self, claims, maint_results):
+        """SAFETY-86: a peak floor outranks a maintenance HOLD (0 W).
+
+        At N=1 the floor is refiled at P_MAINTENANCE, as for a drain. At N>=2
+        the holding pack gives only what the others cannot: its pin is raised
+        to the floor minus what they may place, and the floor is returned as
+        the site `hold` ceiling (else None). A site stop still decides alone.
+        DECISIONS/SAFETY-86-peak-over-hold.md.
+        """
+        hold = {self.actuator_of("maintenance", inv)
+                for inv, res in zip(self.inverters, maint_results)
+                if res.phase == HOLD and res.owns_setpoint}
+        peak = [i for i, c in enumerate(claims)
+                if c.source == peakguard.SOURCE and c.lo > 0.0]
+        if not hold or not peak:
+            return
+        if len(self.inverters) == 1:
+            for i in peak:
+                claims[i] = dataclasses.replace(claims[i],
+                                                priority=P_MAINTENANCE)
+            return
+        if any(c.kind == SET and c.actuator == ACTUATOR_SITE
+               and c.priority > P_PEAK for c in claims):
+            return
+        live = set(self.live_units())
+        reserve = self._peak_reserve()          # SAFETY-87: they give nothing
+        others = 0.0
+        for inv in self.inverters:
+            u = self.actuator_of("maintenance", inv)
+            if u in hold or u not in live:
+                continue
+            if inv.name in reserve:     # only its own pin, never both ways
+                p = self._held_pin(claims, u)
+                if p is None:
+                    return
+                others += p
+                continue
+            b = pre_resolve([c for c in claims if c.actuator == u])
+            if b.contradiction:
+                continue
+            p = allocator.pin_w(b)
+            if p is not None and p < 0.0:
+                return          # a pack pinned to charge: never split both ways
+            others += allocator.hi_w(b) if p is None else p
+        floor = max(claims[i].lo for i in peak)
+        give = floor - others
+        if give <= 0.0:
+            return
+        for i, c in enumerate(claims):
+            if c.source == "maintenance" and c.kind == SET \
+                    and c.actuator in hold:
+                claims[i] = dataclasses.replace(c, value=give)
+        return floor
+
+    def _charge_headroom(self, floor: float, claims) -> float:
+        """SAFETY-84: at N>=2 a cheap-window charge pulls no more than the
+        quarter's headroom under the peak aim (`charge_headroom_w()`), so it
+        yields just enough to the peak guard, and nothing under a site stop
+        (its 0 W would need the other pack to give). N=1 is unchanged."""
+        if len(self.inverters) < 2:
+            return floor
+        if any(c.kind == SET and c.actuator == ACTUATOR_SITE
+               and c.priority > P_MAINT_SHAPE for c in claims):
+            return 0.0
+        room = peakguard.charge_headroom_w(self.peak_guard)
+        return floor if room is None else min(floor, room)
+
+    def _charge_ceiling(self, claims):
+        """SAFETY-84: the site `hi` for a cheap-window charge at N>=2, or None.
+
+        The charging pack's own `hi` (P_MAINT_SHAPE) makes it charge; above
+        that the other pack would have to give (opposite directions, refused,
+        0 W). So the site target stays at or below it. Not filed at N=1, nor
+        when the pack's own limits cancel the charge (a refusal, a stale link).
+        DECISIONS/SAFETY-84-charge-at-two.md.
+        """
+        if len(self.inverters) < 2:
+            return None
+        live = set(self.live_units())
+        ceiling = 0.0
+        for inv in self.inverters:
+            u = self.actuator_of("maintenance", inv)
+            b = pre_resolve([c for c in claims if c.actuator == u])
+            if u in live and not b.contradiction and b.hi < 0.0:
+                ceiling += allocator.hi_w(b)
+        return ceiling if ceiling < 0.0 else None
+
+    def _maint_stop_off(self, machine, now) -> None:
+        """OPT-11: stop this battery's maintenance cycle because it is off."""
+        if machine.phase == IDLE:
+            return
+        for msg in machine.abort(now, "battery switched off"):
+            self.log_event(msg, hint=messages.hint("maint_off",
+                                                   unit=machine.name))
+
+    @property
+    def why_words(self) -> str:
+        """The page's "Why" line. While control waits for a missing reading
+        the age is counted when the page asks (UX-10), not frozen at the age
+        the last cycle saw."""
+        if self._why_waiting_since is not None:
+            return messages.why_waiting(max(0.0, (
+                datetime.now(timezone.utc)
+                - self._why_waiting_since).total_seconds()))
+        return self._why_words
+
+    @why_words.setter
+    def why_words(self, text: str) -> None:
+        self._why_words = text
+        self._why_waiting_since = None
 
     @property
     def inputs_ok(self) -> bool:
@@ -1672,6 +2768,18 @@ class Controller:
         return all(inv.soc is not None and inv.batt is not None
                    for inv in self.inverters)
 
+    def missing_reading(self) -> str:
+        """UX-11: the first reading `inputs_ok` finds missing, in words."""
+        if self.grid is None or not self.inverters:
+            return "meter"
+        for inv in self.inverters:
+            of = "" if len(self.inverters) == 1 else f" from {inv.name}"
+            if inv.batt is None:
+                return f"battery power{of}"
+            if inv.soc is None:
+                return f"battery level{of}"
+        return "input"
+
     # -- io ------------------------------------------------------------------
     @property
     def pv_roster(self) -> tuple:
@@ -1722,7 +2830,23 @@ class Controller:
         states = await asyncio.gather(
             *(self.hass.state(entity) for entity in roster))
         self.pv_w, self.pv_why, self.pv_parts = pv_read.total(
-            list(zip(roster, states)))
+            list(zip(roster, states)), pv_read.inverted(self.o))
+
+    async def _read_forecast(self) -> None:
+        """OPT-11 P4: the solar forecast sensors (`solarfc.read()`). A
+        failed or stale read is no forecast, never a zero."""
+        today = await self.hass.state(self.fc_entity)
+        tomorrow = (await self.hass.state(self.fc_tomorrow_entity)
+                    if self.fc_tomorrow_entity else None)
+        now = datetime.now(timezone.utc)
+        fc, why = solarfc.read(today, tomorrow, now)
+        if (fc is None) != (self.solar_fc is None) or why != self.solar_fc_why:
+            self.log_event(
+                "solar forecast: " + ("read" if fc is not None else
+                                      f"none ({why})"),
+                hint=messages.hint("forecast_read" if fc is not None
+                                   else "forecast_none"))
+        self.solar_fc, self.solar_fc_why = fc, why
 
     async def read_inputs(self, now_mono: float | None = None) -> None:
         """Every input this cycle needs, and SAFETY-37's freshness verdict.
@@ -1736,6 +2860,7 @@ class Controller:
         """
         o = self.o
         now_mono = freshness.monotonic() if now_mono is None else float(now_mono)
+        self._now_mono = now_mono
         if self.p1_enabled:
             # ⚠️ P1 is the only authoritative measurement of what the utility
             # sees (§5.1). When it is stale this is None, which falls into the
@@ -1774,6 +2899,14 @@ class Controller:
         _reads = [self._read_unit(inv, now_mono) for inv in self.inverters]
         if self.pv_roster:
             _reads.append(self._read_pv())
+        # OPT-11 P4: the solar forecast, in the same gather (a slow sensor
+        # must not delay control), at most once per FORECAST_READ_S.
+        if self.fc_entity is not None and (
+                self._fc_read_mono is None
+                or now_mono - self._fc_read_mono >= FORECAST_READ_S
+                or now_mono < self._fc_read_mono):
+            self._fc_read_mono = now_mono
+            _reads.append(self._read_forecast())
         await asyncio.gather(*_reads)
         if o.get("peak_forecast_entity"):
             raw = await self.hass.number(o["peak_forecast_entity"])
@@ -1787,7 +2920,7 @@ class Controller:
             now_p = await self.hass.number(now_e)
             avg_p = await self.hass.number(avg_e)
             self.cheap = (now_p is not None and avg_p is not None and now_p <= avg_p)
-            self.tariff_words = "Home Assistant price entities"
+            self.tariff_words = "Prices from Home Assistant entities"
         else:
             # TARIFF-03. §9.2 makes a static day/night tariff a first-class
             # product, and its required EMS handling is TIME-WINDOW SHIFTING.
@@ -1831,9 +2964,38 @@ class Controller:
             horizon_h=float(price_option(o, "price_horizon_h")),
             provider=provider_configured(o), max_age_s=TARIFF_MAX_AGE_S)
 
+        # UX-11: the red meter row says "the add-on log shows why", so a meter
+        # that goes quiet gets one WARNING per episode, not one per cycle. It
+        # is a log line only: no notification, and nothing it decides.
+        # A flapping meter logs at most one WARNING per METER_QUIET_REPEAT_S,
+        # and the episodes in between go to DEBUG.
+        if self.p1_enabled:
+            if (self.p1.stale and not self._meter_quiet_logged
+                    and self.p1.published_age_s > self.p1.max_age_s):
+                self._meter_quiet_logged = True
+                now = _mono()
+                self._meter_quiet_loud = (
+                    self._meter_quiet_warned is None
+                    or now - self._meter_quiet_warned >= METER_QUIET_REPEAT_S)
+                if self._meter_quiet_loud:
+                    self._meter_quiet_warned = now
+                    _LOG.warning("No meter reading for over %s, so control "
+                                 "waits and then sets the battery to 0 W.",
+                                 messages.seconds(self.p1.max_age_s))
+                else:
+                    _LOG.debug("No meter reading for over %s again.",
+                               messages.seconds(self.p1.max_age_s))
+            elif not self.p1.stale and self._meter_quiet_logged:
+                self._meter_quiet_logged = False
+                if self._meter_quiet_loud:
+                    _LOG.info("Meter readings are back.")
+                else:
+                    _LOG.debug("Meter readings are back.")
+
         if self.inputs_ok:
             if self.inputs_bad_since is not None:
-                self.log_event("inputs recovered")
+                self.log_event("inputs recovered",
+                               hint=messages.hint("inputs_back"))
             self.inputs_bad_since = None
         elif self.inputs_bad_since is None:
             self.inputs_bad_since = datetime.now(timezone.utc)
@@ -1868,7 +3030,9 @@ class Controller:
         # §11.1 rule 1 and is already what a missing reading does here.
         inv.batt = inv.batt_fresh.reading()
         if inv.batt_fresh.stale and not was_stale:
-            self.log_event(f"STALE {inv.name}: " + inv.batt_fresh.reason)
+            self.log_event(f"STALE {inv.name}: " + inv.batt_fresh.reason,
+                           hint=messages.hint("battery_stuck", unit=inv.name))
+            self._refusal_from_stale(inv, now_mono)
             # ⚠️ SAFETY-57 REWROTE THE LAST SENTENCE OF THIS LINE AND NOTHING
             # ELSE IN IT. The escape clause used to read "It clears itself the
             # moment the register reports a different value", full stop - and
@@ -1895,16 +3059,22 @@ class Controller:
             # this line already interpolates, is where the pair is spelled out.
             # Saying it in both halves of one sentence is how an operator
             # learns to skim it.
-            _LOG.error("SAFETY-37: %s battery-power reading did not move under "
-                       "a command that did, WHICH IS NOT BY ITSELF A VERDICT "
-                       "ON THE REGISTER - %s. Treating it as MISSING, which "
-                       "commands 0 W. It clears itself the moment the register "
-                       "reports a different value, and failing that %.0f s "
-                       "after the standing command falls below %.0f W "
-                       "(SAFETY-57: a verdict whose own consequence is a 0 W "
-                       "command cannot be tested again from inside it).",
-                       inv.name, inv.batt_fresh.reason,
-                       inv.batt_fresh.bound.release_s,
+            # UX-08 2d: plain, with SAFETY-57's escape clause kept as an
+            # ordered pair (time, then power), and the reason still in `%s`.
+            # UX-11: one sentence and the code. The reason, with SAFETY-56's
+            # two explanations and its figures, and the limits are on the
+            # DEBUG lines below and in the action log.
+            _LOG.error("%s: battery power reading stopped changing, set to "
+                       "0 W until it changes, or %.0f s after the command "
+                       "drops below %.0f W: %s.",
+                       inv.name, inv.batt_fresh.bound.release_s,
+                       inv.batt_fresh.bound.move_w,
+                       messages.reason_code(inv.batt_fresh.reason))
+            _LOG.debug("Evidence for %s: %s.", inv.name, inv.batt_fresh.reason)
+            _LOG.debug("%s: the limits are unchanged over %.0f s, a command "
+                       "over %.0f W and a move by over %.0f W.", inv.name,
+                       inv.batt_fresh.bound.unchanged_s,
+                       inv.batt_fresh.bound.move_w,
                        inv.batt_fresh.bound.move_w)
         elif inv.batt_fresh.releases > was_releases:
             # ⚠️ SAFETY-57. REPORTED, NEVER SILENT. A latch that lets go on a
@@ -1912,9 +3082,18 @@ class Controller:
             # one is withdrawing a SITE STOP. `release_note()` is written to say
             # that nothing has been learned about the register, because nothing
             # has.
-            self.log_event(f"STALE WITHDRAWN {inv.name}")
-            _LOG.warning("SAFETY-57: %s",
-                         inv.batt_fresh.release_note(inv.name))
+            self.log_event(f"STALE WITHDRAWN {inv.name}",
+                           hint=messages.hint("battery_back", unit=inv.name))
+            # Not "recovered": nothing is known about the reading yet, so the
+            # line gives the value it still holds and the window it is
+            # rechecked over (SAFETY-57).
+            _LOG.warning("%s: the command stayed below %.0f W for %.0f s, so "
+                         "battery power reading %+.0f W is used again and "
+                         "rechecked over %.0f s.", inv.name,
+                         inv.batt_fresh.bound.move_w,
+                         inv.batt_fresh.bound.release_s, inv.batt_fresh.held,
+                         inv.batt_fresh.bound.unchanged_s)
+            _LOG.debug("SAFETY-57: %s", inv.batt_fresh.release_note(inv.name))
 
     @property
     def shadow(self) -> bool:
@@ -2048,14 +3227,16 @@ class Controller:
                 self.log_event(
                     f"refusing to broadcast {float(value):+.0f} W to "
                     f"{len(targets)} inverters - that is the ARCH-01 fault; "
-                    f"commanding 0 W")
-                _LOG.error("write_setpoint() was asked to put %+.0f W on every "
-                           "one of %d inverters. A site target handed to each "
-                           "unit is supplied by EACH of them: the gain at the "
-                           "meter becomes N times the per-unit gain. Only 0 W "
-                           "may be written site-wide; shares come from the "
-                           "allocator. Commanding 0 W.", float(value),
-                           len(targets))
+                    f"commanding 0 W", hint=messages.hint("all_blocked"))
+                _LOG.error("Refused to send %+.0f W to all %s at once, so "
+                           "every inverter is set to 0 W. This is a software "
+                           "fault.", float(value),
+                           messages.count(len(targets), "inverter"))
+                _LOG.debug("ARCH-01: a site target handed to each unit is "
+                           "supplied by each of them, so the gain at the meter "
+                           "becomes N times the per-unit gain. Only 0 W may be "
+                           "written site-wide, and shares come from the "
+                           "allocator.")
                 value = 0.0
         else:
             targets = [unit]
@@ -2083,7 +3264,8 @@ class Controller:
         # must not be counted as a clamp engagement, or a transport bug lands in
         # the winding-loop counter.
         if not is_commandable(value):
-            self.log_event(f"non-finite setpoint {value!r} - commanding 0 W")
+            self.log_event(f"non-finite setpoint {value!r} - commanding 0 W",
+                           hint=messages.hint("bad_value"))
             _LOG.error("refusing to write a non-finite setpoint %r - commanding "
                        "0 W and continuing to command. This is a bug upstream, "
                        "not a limit.", value)
@@ -2121,11 +3303,11 @@ class Controller:
         refusal = self.write_refusal(value, inv)
         if refusal is not None:
             self.log_event(
-                f"{inv.name}: WRITE REFUSED {value:+.0f} W - commanding 0 W")
-            _LOG.error("SAFETY-28 REFUSED a write of %+.0f W to %s: %s. "
-                       "Commanding 0 W instead. Every setpoint must be one the "
-                       "allocator placed on THIS tick, for THIS unit - see "
-                       "Controller.write_refusal().", value, inv.name, refusal)
+                f"{inv.name}: WRITE REFUSED {value:+.0f} W - commanding 0 W",
+                hint=messages.hint("write_blocked", unit=inv.name))
+            _LOG.error("Refused to send %+.0f W to %s, so it is set to 0 W "
+                       "instead, which is a software fault. The reason: %s.",
+                       value, inv.name, refusal)
             value = 0.0
 
         # ⚠️ THIS UNIT'S OWN THREE NUMBERS. `inv.max_w` is the supervised cap on
@@ -2140,7 +3322,8 @@ class Controller:
             # (§15), and it is a different surface from the notification, which
             # IS deduplicated. The count is what says how hard the loop pushed;
             # the notification only says that it did.
-            self.log_event(f"{inv.name}: {result.describe()}")
+            self.log_event(f"{inv.name}: {result.describe()}",
+                           hint=messages.hint("write_cut", unit=inv.name))
         value = result.applied_w
 
         # --- SAFETY-10: AND THIS IS THE LAST THING BEFORE THE WIRE -----------
@@ -2171,10 +3354,11 @@ class Controller:
         # one writer, and this is that writer emitting the value it emits for
         # every other refusal.
         if self.shadow and value != shadow.WIRE_W:
-            _LOG.info("SHADOW MODE: not commanding %+.0f W to %s - holding "
-                      "%+.0f W. The decision was reached and recorded; "
-                      "nothing was sent to the inverter.",
-                      value, inv.name, shadow.WIRE_W)
+            # UX-10: DEBUG, because it repeats every cycle in shadow mode. The
+            # INFO line when shadow mode comes on says the same once.
+            _LOG.debug("Shadow mode: would send %+.0f W to %s, and holds "
+                       "%+.0f W. Nothing was sent to the inverter.",
+                       value, inv.name, shadow.WIRE_W)
             value = shadow.WIRE_W
 
         changed = (inv.last_write is None or value != inv.last_write)
@@ -2191,12 +3375,12 @@ class Controller:
                                         timeout=WRITE_BUDGET_S)
         except (asyncio.TimeoutError, TimeoutError):
             ok = False
-            _LOG.error("the write of %+.0f W to %s (%s) did not complete in "
-                       "%.0f s and was abandoned. It will be re-issued on the "
-                       "next tick; no other inverter waited for it.",
+            _LOG.error("Sending %+.0f W to %s (%s) took over %.0f s and was "
+                       "dropped, so it is sent again next cycle.",
                        value, inv.name, entity, WRITE_BUDGET_S)
             self.log_event(f"{inv.name}: write timed out after "
-                           f"{WRITE_BUDGET_S:.0f} s - re-issuing next tick")
+                           f"{WRITE_BUDGET_S:.0f} s - re-issuing next tick",
+                           hint=messages.hint("write_slow", unit=inv.name))
         now = datetime.now(timezone.utc)
         inv.note_write(bool(ok), now)
         if ok:
@@ -2286,7 +3470,8 @@ class Controller:
         now = datetime.now(timezone.utc)
         return [n for n in
                 [x for inv in self.inverters
-                 for x in (inv.link_note(now), inv.stale_note())]
+                 for x in (inv.link_note(now), inv.stale_note(),
+                           inv.refusal_note())]
                 if n]
 
     async def cycle(self) -> None:
@@ -2316,12 +3501,31 @@ class Controller:
         # Calling `tick()` without the answer this produced is the
         # two-packs-draining-at-once defect with the interlock present but not
         # wired, which is why the plan is built here and not inside the loop.
-        maint_plan = maint_arbitrate(self.maints, now)
+        # OPT-11: a battery switched off starts no cycle and is left out of the
+        # slot, so it cannot hold the slot from a battery that is on. One that
+        # is mid-cycle is stopped, with a log line (the owner's 2026-09-27
+        # answer). The switch itself stops it at once (`pack_use`); this is
+        # the same rule for a store that says Off at start-up.
+        _off = ({inv.name for inv in self.inverters
+                 if not self.pack_mode(inv).use} if self.modes_on else set())
+        for inv, machine in zip(self.inverters, self.maints):
+            if inv.name in _off:
+                self._maint_stop_off(machine, now)
+        _on = [m for inv, m in zip(self.inverters, self.maints)
+               if inv.name not in _off]
+        _plan_on = iter(maint_arbitrate(_on, now) if _off
+                        else maint_arbitrate(self.maints, now))
+        maint_plan = [None if inv.name in _off else next(_plan_on)
+                      for inv, _m in zip(self.inverters, self.maints)]
         maint_results = []
         for inv, machine, blocked in zip(self.inverters, self.maints, maint_plan):
+            if blocked is None:
+                maint_results.append(MaintResult(IDLE, False, None, False, []))
+                continue
             res = machine.tick(now, inv.soc, blocked_by=blocked)
             for msg in res.events:
-                self.log_event(msg)
+                self.log_event(msg, hint=messages.hint("maintenance",
+                                                       phase=machine.phase))
             maint_results.append(res)
         # ⚠️ CARRIED TO THE STATUS PAGE, NOT LEFT IN THE 40-LINE ACTION LOG. The
         # deferral is edge-logged (it lasts as long as the other pack's cycle),
@@ -2414,12 +3618,13 @@ class Controller:
                 # operator press that clears the namespaced ones.
                 self.store.set("sign_reason", inv.sign_wd.reason)
                 self.store.set("sign_tripped", True)
-                self.log_event(f"FAILSAFE {inv.name}: " + inv.sign_wd.reason)
-                _LOG.error("SAFETY-02 TRIPPED on %s - %s. Commanding 0 W on "
-                           "that inverter and holding it until control is "
-                           "started again. This survives an add-on restart; "
-                           "restarting will not clear it.",
-                           inv.name, inv.sign_wd.reason)
+                self.log_event(f"FAILSAFE {inv.name}: " + inv.sign_wd.reason,
+                               hint=messages.hint("direction", unit=inv.name))
+                _LOG.error("%s is set to 0 W until control is started, "
+                           "because its power went the wrong way: %s.",
+                           inv.name, messages.reason_code(inv.sign_wd.reason))
+                _LOG.debug("Evidence for %s: %s.", inv.name,
+                           inv.sign_wd.reason)
         # ⚠️ THE SITE'S OWN STANDING COMMAND, WHICH IS THE SUM OF THE UNITS'.
         # SAFETY-07 and SAFETY-18 both grade a SITE quantity - the quarter-hour
         # average at the grid connection, and a meter that has stopped moving
@@ -2463,13 +3668,13 @@ class Controller:
                 # the same reason `circ_*` is.
                 self.store.set("site_sign_reason", self.site_sign_wd.reason)
                 self.store.set("site_sign_tripped", True)
-                self.log_event("FAILSAFE site: " + self.site_sign_wd.reason)
-                _LOG.error("SAFETY-30 TRIPPED at the SITE - %s. That is the "
-                           "SUM of every standing command opposing the meter, "
-                           "which no single inverter is answerable for. "
-                           "Commanding 0 W on every inverter and holding it "
-                           "until control is started again. This survives an "
-                           "add-on restart; restarting will not clear it.",
+                self.log_event("FAILSAFE site: " + self.site_sign_wd.reason,
+                               hint=messages.hint("site_direction"))
+                _LOG.error("Every inverter is set to 0 W until control is "
+                           "started, because the total power went the wrong "
+                           "way: %s.",
+                           messages.reason_code(self.site_sign_wd.reason))
+                _LOG.debug("Evidence for the site: %s.",
                            self.site_sign_wd.reason)
 
         # --- SAFETY-31, AND IT RUNS BESIDE SAFETY-02 FOR THE SAME REASON -----
@@ -2498,12 +3703,13 @@ class Controller:
             self.store.set("circ_reason", self.circ_wd.reason)
             self.store.set("circ_tripped", True)
             self._circ_announced = False
-            self.log_event("CIRCULATING POWER - " + self.circ_wd.reason)
+            self.log_event("CIRCULATING POWER - " + self.circ_wd.reason,
+                           hint=messages.hint("circulating"))
             _LOG.error(
-                "SAFETY-31 TRIPPED - %s. Commanding 0 W on every inverter and "
-                "holding it until control is started again. This survives an "
-                "add-on restart AND a Home Assistant restart; restarting will "
-                "not clear it.", self.circ_wd.reason)
+                "Every inverter is set to 0 W until control is started, "
+                "because the inverters worked against each other: %s.",
+                messages.reason_code(self.circ_wd.reason))
+            _LOG.debug("Evidence for the site: %s.", self.circ_wd.reason)
 
         # --- SAFETY-42, AND IT RUNS HERE FOR SAFETY-02's AND SAFETY-31's REASON
         # Evaluated EVERY cycle, unconditionally, ABOVE the "inputs missing but
@@ -2577,7 +3783,13 @@ class Controller:
                     # what part 6 grades instead is that WIDENING the window
                     # changes the answer.
                     live=inv.is_live(now)[0],
-                    parked=inv.sign_wd.tripped,
+                    # SAFETY-73: a refusing unit is asked 0 W on purpose, and
+                    # one asked under PROBE_W that gives under 100 W is a
+                    # refusal too small to call (its sibling covers the meter).
+                    parked=inv.sign_wd.tripped or bool(inv.refused) or (
+                        n_units > 1 and inv.batt is not None
+                        and abs(float(standing[inv.name])) <= _ctl.PROBE_W
+                        and abs(float(inv.batt)) < _ctl.REFUSED_BELOW_W),
                     # ⚠️ THIS UNIT'S OWN CUT-OUT. Not the shipped 10 %, and not
                     # the site's `peak_soc_floor` either - that one bounds a
                     # money-saving discharge only, and grading a pack against it
@@ -2605,16 +3817,20 @@ class Controller:
                 inv.store_set("delivery_tripped", True)
                 self._delivery_announced.discard(inv.name)
                 self.log_event(f"NOT DELIVERING {inv.name}: "
-                               + inv.delivery_wd.reason)
+                               + inv.delivery_wd.reason,
+                               hint=messages.hint("not_delivering",
+                                                  unit=inv.name))
                 _LOG.error(
-                    "SAFETY-42 TRIPPED on %s - %s. NOTHING IS COMMANDED "
-                    "DIFFERENTLY: this guard reports and does not act, because "
-                    "commanding a unit that is not listening achieves nothing "
-                    "(HW-01) and the only re-allocation this add-on can express "
-                    "would throw away a partially-delivering unit's remaining "
-                    "output. The site is short by that unit's share until "
-                    "somebody looks at it. This survives an add-on AND a Home "
-                    "Assistant restart.", inv.name, inv.delivery_wd.reason)
+                    "%s is not delivering while control keeps running, and "
+                    "only stopping and starting control clears this: %s.",
+                    inv.name, messages.reason_code(inv.delivery_wd.reason))
+                _LOG.debug("Evidence for %s: %s.", inv.name,
+                           inv.delivery_wd.reason)
+                _LOG.debug(
+                    "SAFETY-42 reports and does not act: commanding a unit "
+                    "that is not listening achieves nothing (HW-01), and the "
+                    "only re-allocation the add-on can express would throw "
+                    "away a partly delivering unit's output.")
 
         stale_after = float(self.o.get("stale_input_s", 15))
         # ⚠️ `any`, NOT the sole unit's. The hold exists so a single missed poll
@@ -2635,6 +3851,12 @@ class Controller:
                 # A single missed poll is not a fault. Hold, keep the heartbeat
                 # going, and give it a few seconds to come back.
                 self.reason = f"inputs missing {bad_for:.0f}s"
+                # UX-10: the age is rendered when the page asks, not frozen at
+                # this cycle's. With the meter reading gone the grid value
+                # stops changing, so the next cycle is up to cycle_floor_s
+                # away and the line used to read "0 seconds" all that time.
+                self.why_words = messages.why_waiting(bad_for)
+                self._why_waiting_since = now - timedelta(seconds=bad_for)
                 return
 
         claims = []
@@ -2810,7 +4032,8 @@ class Controller:
                                     actuator=self.actuator_of("safety")))
         elif not self.inputs_ok:
             if self.target != 0.0:
-                self.log_event("inputs missing - commanding 0 W")
+                self.log_event("inputs missing - commanding 0 W",
+                               hint=messages.hint("inputs_missing"))
             claims.append(Claim.set("safety", P_SAFETY, 0.0, "inputs missing",
                                     actuator=self.actuator_of("safety")))
 
@@ -2841,12 +4064,11 @@ class Controller:
         # claim is not sticky. Filed once and skipped next cycle, the floor
         # lapses and the actuator goes silently back to whatever was pushing the
         # peak. Which of the higher-priority claims outranks it is arbiter.py's
-        # business, not this block's - and the answer is already right: a
-        # maintenance DRAIN or HOLD owns the setpoint at P_MAINTENANCE and
-        # commands discharge or zero, neither of which can create offtake, while
-        # a maintenance CHARGE is only ever a P_MAINT_SHAPE limit (40) and is
-        # therefore bound by this floor. That is §9.1's "money outranks the
-        # maintenance schedule", now as a consequence of the priorities.
+        # business, not this block's: a maintenance DRAIN or HOLD owns the
+        # setpoint at P_MAINTENANCE, and a maintenance CHARGE is only ever a
+        # P_MAINT_SHAPE limit (40), bound by this floor. A floor above the drain
+        # rate still wins (SAFETY-78 at N>=2, `_peak_over_drain()` at N=1), and
+        # so does a floor over a HOLD (`_peak_over_hold()`, SAFETY-86).
         #
         # ⚠️ AND IT IS NOT RUN AT ALL WITHOUT P1. `meter_source: off` is the
         # legacy single-entity path: there is no telegram stream, so
@@ -2858,14 +4080,17 @@ class Controller:
         # is not measured on that path, and the honest report is NOT COVERED -
         # the same answer, for the same reason, that the status page already
         # gives for SAFETY-18 on a transport that cannot see `unchanged_s`.
+        self._peak_proj = (None if not self.p1_enabled
+                           else self.peak.project(self.p1.averager, now))
         self.peak_guard = None if not self.p1_enabled else peakguard.decide(
-            self.peak.project(self.p1.averager, now),
+            self._peak_proj,
             # ⚠️ THE SITE SUM. The guard sizes a floor from what the battery is
             # ALREADY removing from the meter, and the meter sees every
             # inverter. One unit's power here would size the floor from a
             # fraction of the discharge already happening.
             batt_w=self.site_batt_w,
             cap_w=float(self.o.get("peak_cap_w", 3500)),
+            margin_w=self.peak_margin_w,
             reading=self.peak.peak(now),
             # ⚠️ SUMMED FROM THE PER-UNIT CONJUNCTION, WHICH IS AC 4. Each
             # unit contributes `min(its max_w, |its own device bounds|)`, so
@@ -2911,6 +4136,11 @@ class Controller:
                                 dev_min=self.site_dev_bound("dev_min"),
                                 dev_max=self.site_dev_bound("dev_max")),
         )
+        # SAFETY-87: at N>=2 a battery at or under its own reserve gives
+        # nothing for the peak, and the others carry the guard's need.
+        if self.peak_guard is not None:
+            self.peak_guard = self._peak_on_able(self.peak_guard,
+                                                 maint_results)
         # SITE, and peakguard.claim() says so on the object it builds. The
         # quantity is the 15-minute average OFFTAKE AT THE GRID CONNECTION,
         # which is what the capacity tariff bills; there is one quarter-hour
@@ -2931,7 +4161,12 @@ class Controller:
         if engaged_now != self._peak_engaged:
             self._peak_engaged = engaged_now
             if self.peak_guard is not None:
-                self.log_event(self.peak_guard.explain())
+                _pg = self.peak_guard
+                self.log_event(_pg.explain(), hint=messages.hint(
+                    "peak_off" if not _pg.engaged else
+                    "peak_blind" if _pg.blind else
+                    "peak_reserve" if _pg.floor_limited else
+                    "peak_saturated" if _pg.saturated else "peak_on"))
 
         # --- OPT-04: price arbitrage (§10.1 priority 3) ----------------------
         # ONE `set` claim at P_ARBITRAGE, and app/arbitrage.py carries the whole
@@ -2977,15 +4212,20 @@ class Controller:
         # decision presented as current.
         self.arb, self.arb_at = None, now
         self.arb_headroom_w = None
-        if arbitrage.enabled(self.o):
-            floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
-            charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
+        # OPT-11 P3: with battery modes on, each battery's mode decides who
+        # trades (`_mode_roles()`, `_mode_trade()`, below, which read the
+        # same headroom), and this site-wide trade is not run.
+        site_trade = arbitrage.enabled(self.o) and not self.modes_on
+        if site_trade or self.modes_on:
             # SAFETY-47. HOISTED OUT OF THE CALL, NOT COPIED. One evaluation of
             # the shipped expression feeds both the sizing below and
             # `arbitrage.sized_from_meter()` in `_shadow_settle()`, so the
             # caveat on the recorded watts can never be answered from a
             # different cycle's guard than the watts were.
             self.arb_headroom_w = peakguard.charge_headroom_w(self.peak_guard)
+        if site_trade:
+            floor_pct, ceiling_pct = arbitrage.soc_bounds(self.o)
+            charge_w, discharge_w = self.trade_power_w(floor_pct, ceiling_pct)
             self.arb = arbitrage.decide(
                 self.fresh_tariff_plan(now), now,
                 peak_guard_active=arbitrage.guard_state(self.peak_guard),
@@ -3043,7 +4283,10 @@ class Controller:
             # operator needs - "it started buying at 03:00", not 240 copies.
             if self.arb.action != self._arb_action:
                 self._arb_action = self.arb.action
-                self.log_event(self.arb.explain())
+                self.log_event(self.arb.explain(), hint=messages.hint(
+                    "trade_charge" if self.arb.action == arbitrage.CHARGE else
+                    "trade_give" if self.arb.action == arbitrage.DISCHARGE
+                    else "trade_off"))
 
         # --- maintenance -----------------------------------------------------
         # ⚠️ ONE PASS PER PACK, AND `arbitrate()` IS WHY THE LIST STAYS SHORT.
@@ -3118,8 +4361,7 @@ class Controller:
                 # charge together, this flag would have to become per-pack - and
                 # so would the reasoning above it.
                 if peakguard.shaping_suspended(
-                        self.peak_guard, self.peak_fc,
-                        float(self.o.get("peak_cap_w", 3500))):
+                        self.peak_guard, self.peak_fc, self.peak_aim_w()):
                     # Edge-logged: level-logging here would write one line per
                     # cycle for as long as the event lasts and flush the 40-line
                     # action log of the very context that explains it.
@@ -3127,7 +4369,8 @@ class Controller:
                         self._maint_shape_suspended = True
                         self.log_event("peak at risk - maintenance charge shaping "
                                        "suspended so the peak claim is not "
-                                       "contradicted")
+                                       "contradicted",
+                                       hint=messages.hint("maint_paused"))
                 else:
                     self._maint_shape_suspended = False
                     hi = 0.0
@@ -3145,7 +4388,8 @@ class Controller:
                         # rate the pack in front of us is charging at.
                         floor = maintenance_charge_floor(
                             self.maint.cfg.charge_w,
-                            self.peak_fc, float(self.o.get("peak_cap_w", 3500)))
+                            self.peak_fc, self.peak_aim_w())
+                        floor = self._charge_headroom(floor, claims)
                         if floor > 0:
                             hi, reason = -floor, "cheap-window charge"
                     # PER-INVERTER, like the SET above and for the same reason -
@@ -3155,6 +4399,28 @@ class Controller:
                                               actuator=self.actuator_of("maintenance",
                                                                         inv)))
 
+        # --- OPT-11: each battery's mode, a soft unit limit at P_MODE ---------
+        # Filed only with battery modes on, and never on a battery in any
+        # maintenance phase: maintenance at 60/40 outranks the mode. The range
+        # always holds 0 W (packmode.mode_range()). pre_resolve() keeps it
+        # apart from the hard limits, and it gives way to the peak guard's
+        # site floor (P_PEAK) only as far as the floor needs, so the two never
+        # meet in a `lo > hi` (arbiter._unit_modes()).
+        # P3: the range is the switch's, narrowed by the battery's role in
+        # the price runs this tick (`modetrade.decide()`); both hold 0 W.
+        if self.modes_on:
+            tick = self._mode_roles(now, maint_results)
+            for inv, result in zip(self.inverters, maint_results):
+                if result.phase != IDLE:
+                    continue
+                pm = self.pack_mode(inv)
+                lo, hi = packmode.mode_range(pm, inv.max_w)
+                rlo, rhi = tick.ranges.get(inv.name, (lo, hi))
+                lo, hi = max(lo, rlo), min(hi, rhi)
+                claims.append(Claim.limit("mode", P_MODE, lo, hi, pm.key,
+                                          actuator=self.actuator_of("mode",
+                                                                    inv)))
+
         # --- the grid-following loop -----------------------------------------
         # ⚠️ SAFETY-10: `or self.shadow`. The loop is the leg a shadow run most
         # needs and the one that is switched off by `auto_start: false`, so
@@ -3163,6 +4429,72 @@ class Controller:
         # loop should be. It is safe because the loop's `prev_w` is
         # `self.target`, which the end of this method re-seeds to what is
         # actually standing on the wire.
+        # SAFETY-52: a refusal learned while control ran does not survive a
+        # stop or a start (shadow mode keeps the loop running when stopped).
+        if bool(self.auto) != self._refusal_auto:
+            self._refusal_auto = bool(self.auto)
+            self._refusal_end("control started" if self.auto
+                              else "control stopped")
+            for inv in (self.inverters if len(self.inverters) > 1 else ()):
+                self._unit_refusal_end(inv, "control started" if self.auto
+                                       else "control stopped")
+        # SAFETY-73: each unit's own refusal, engaged and ended on its own
+        # reading, before the loop reads `self.target` (an end reseeds it).
+        _probing = {}
+        if len(self.inverters) > 1 and self.inputs_ok:
+            self._unit_refusals()
+            _probing = {inv.name: self._unit_probe(inv)
+                        for inv in self.inverters if inv.refused}
+        # --- SAFETY-73: each refusing unit's own P_SAFETY claim ---------------
+        # A hard unit limit that always intersects (OPT-11's P_MODE layer sits
+        # inside it): closed in the refused direction, so the allocator hands
+        # the share to the others within their own limits. During its probe it
+        # is a pin at PROBE_W and the others carry the rest. Filed here, before
+        # the loop, so OPT-11's loop bound sees it. Unit claims only, and still
+        # the last unit claims filed, so every unit's claim order is as before.
+        for inv in self.inverters:
+            if not inv.refused:
+                continue
+            if _probing.get(inv.name):
+                claims.append(Claim.set("refused", P_SAFETY,
+                                        inv.refused * _ctl.PROBE_W,
+                                        _ctl.PROBING,
+                                        actuator=self.actuator_of("refused",
+                                                                  inv)))
+            else:
+                claims.append(Claim.limit("refused", P_SAFETY,
+                                          *_refused_interval(inv.refused),
+                                          _ctl.REFUSED,
+                                          actuator=self.actuator_of("refused",
+                                                                    inv)))
+        # --- SAFETY-78: a pinned drain is a floor under the site target -----
+        # After every unit claim, so the floor is what the pin really places.
+        drain = self._drain_floor(claims, maint_results)
+        if drain is not None:
+            claims.append(Claim.limit("drain", P_MAINTENANCE, lo=drain,
+                                      reason="maintenance drain",
+                                      actuator=self.actuator_of("drain")))
+        self._peak_over_drain(claims, maint_results)
+        # --- SAFETY-86: while a HOLD gives, the site stays at the peak floor --
+        # So the loop never asks for watts the hold keeps back.
+        hold_hi = self._peak_over_hold(claims, maint_results)
+        if hold_hi is not None:
+            claims.append(Claim.limit("hold", P_MAINTENANCE, hi=hold_hi,
+                                      reason="maintenance hold",
+                                      actuator=self.actuator_of("hold")))
+        # --- SAFETY-84: a cheap-window charge is a ceiling over the site ----
+        charge = self._charge_ceiling(claims)
+        if charge is not None:
+            claims.append(Claim.limit("charge", P_MAINT_SHAPE, hi=charge,
+                                      reason="maintenance charge",
+                                      actuator=self.actuator_of("charge")))
+        # --- OPT-11 P3: the site trade, after every unit claim --------------
+        # Sized from what the batteries may place with their modes and hard
+        # limits (the loop bound), so none is asked for watts it may not give.
+        mode_trade, trade_was = False, self._mode_trade_was
+        if self.modes_on:
+            mode_trade = self._mode_trade(claims, now)
+        self._mode_trade_was = mode_trade
         if (self.auto or self.shadow) and self.inputs_ok:
             # ⚠️ prev is the ARBITER's last output, not the loop's own last
             # wish. If something outranked the loop, that is what the hardware
@@ -3180,6 +4512,18 @@ class Controller:
             # stale period as power.
             if self.loop_w is None or self.target != self.loop_w:
                 self.i_w = self.target
+            # OPT-11 P3: a run edge (a mode trade ended) reseeds the loop.
+            if trade_was and not mode_trade:
+                self._reseed_run_edge(claims)
+            # SAFETY-52: another writer overrode the loop, so a refusal learned
+            # against the loop's own ask no longer describes the wire. A gap
+            # (`loop_w` None: blind or stopped) keeps it: the stale-reading stop
+            # is what seeds it, and dropping it there restarts the ~70 s cycle.
+            if self.loop_w is not None and self.target != self.loop_w:
+                self._refusal_end("another writer")
+            probe = self._refusal_probe()
+            if len(self.inverters) > 1:
+                probe = any(_probing.values())
             # ⚠️ `actual_w` IS THE SITE SUM AND THAT IS DEV-02's OTHER HALF.
             # The anti-windup test inside compute() is
             # `abs(prev_w - actual_w) > saturation_w`, and `prev_w` is the SITE
@@ -3208,13 +4552,31 @@ class Controller:
                 tuning=self.tuning,
                 sat_count=self.sat_count,
                 i_w=self.i_w,
+                # SAFETY-52 at one inverter only: with several, OPT-09's pack
+                # limit already closes an empty battery's discharge end.
+                # SAFETY-73: at N>1 the site law holds 0 W only while every
+                # unit refuses the same way. Otherwise None, the old law.
+                refused=self.batt_refused if len(self.inverters) == 1
+                else self._site_refused(),
+                probe=probe,
+                # OPT-11: None unless battery modes are on. SAFETY-85: or while
+                # maintenance holds a battery at N>=2, so the loop does not
+                # wind past what the others can give and jump when it ends.
+                bound=(self.loop_bound(claims) if self.modes_on or (
+                    len(self.inverters) > 1
+                    and any(r.phase != IDLE for r in maint_results))
+                    else None),
             )
             if decision.frozen and self.sat_count < self.tuning.saturation_cycles:
                 self.log_event(f"saturation freeze ({self.target:.0f} W vs "
-                               f"{site_batt:.0f} W)")
+                               f"{site_batt:.0f} W)",
+                               hint=messages.hint("not_keeping_up"))
             self.sat_count = decision.sat_count
             self.i_w = decision.i_w
             self.loop_w = decision.target_w
+            self._loop_decision = decision
+            if len(self.inverters) == 1:
+                self._refusal_update(decision, loop_prev, site_batt, probe)
             # --- TEL-10 ------------------------------------------------------
             # ⚠️ THE INTEGRATOR HAS NEVER LEFT THIS PROCESS, AND THAT IS WHAT
             # THE CARD IS. `self.i_w` is carried between cycles and published
@@ -3258,12 +4620,16 @@ class Controller:
             # it - so a string test is silent on the two cases a winding loop
             # most often presents as. These flags are set where the clamp
             # happens and nothing downstream touches them.
+            # SAFETY-40: every number comes from THIS decision, at clamp time,
+            # never from `self.target` after slew/freeze/arbiter rewrote it.
             self.loop_clamped = (
                 decision.i_clamped or decision.clamped,
-                (f"the loop asked for {decision.i_w:+.0f} W"
-                 + (" (integrator bound)" if decision.i_clamped else "")
-                 + (" (output bound)" if decision.clamped else "")),
+                loop_clamp_note(decision),
+                decision.clamped,
             )
+            self.loop_clamp_facts = (
+                (messages.Clamp(None, decision.requested_w, decision.clamped_w,
+                                "rating"),) if decision.clamped else ())
             # SITE. compute() regulates `grid_w` - the P1 measurement - to
             # zero. Its subject is the meter, and §6.2's architecture is ONE
             # integrator on P1 whose output is then SPLIT. This is the claim the
@@ -3286,7 +4652,9 @@ class Controller:
             # A loop that is not running cannot be winding. Clearing this here
             # rather than letting the last value stand is what makes the alarm
             # de-assert when control is stopped.
-            self.loop_clamped = (False, "")
+            self.loop_clamped = (False, "", False)
+            self.loop_clamp_facts = ()
+            self._loop_decision = None
 
         # SAFETY-28. A new resolution is a new tick, and the previous record is
         # stale from this line onwards. Incremented BEFORE resolve() so that the
@@ -3308,9 +4676,28 @@ class Controller:
         # ability to DELIVER rests on this argument - a weight cannot stop a
         # unit being commanded and cannot move a failing unit's load to its
         # sibling. The `pack` claim filed above is the half that constrains.
-        resolution = resolve(claims, units=self.units, live=self.live_units(),
-                             weights=self.pack_weights, tick=self.alloc_tick)
+        _live = self.live_units()
+        while True:
+            resolution = resolve(claims, units=self.units, live=_live,
+                                 weights=self.pack_weights, tick=self.alloc_tick,
+                                 reserve=self._peak_reserve())
+            # SAFETY-73: a probe pin stands only while the resolved site target
+            # asks at least PROBE_W its way. Below that a sibling would carry
+            # the opposite direction (circulation), so the pin goes back to the
+            # closed limit and the split is resolved once more.
+            _void = [k for k, c in enumerate(claims)
+                     if c.source == "refused" and c.kind == "set"
+                     and c.value * resolution.target_w < _ctl.PROBE_W ** 2]
+            if not _void:
+                break
+            for k in _void:
+                claims[k] = Claim.limit(
+                    "refused", P_SAFETY,
+                    *_refused_interval(1 if claims[k].value > 0 else -1),
+                    _ctl.REFUSED, actuator=claims[k].actuator)
         self.allocation = resolution.allocation
+        if self.modes_on:
+            self._mode_fault_log(resolution)
         # --- THE TWO REFUSALS, AND THEY ARE NOT THE SAME REFUSAL --------------
         # Both do the same thing - REPLACE the resolution with a 0 W failsafe
         # which is then written like any other cycle at
@@ -3335,7 +4722,8 @@ class Controller:
         #    made by commanding one pack to charge while another discharges.
         #    `allocator.plan()` carries the argument for each.
         if not resolution.allocated:
-            self.log_event("ARBITER: " + resolution.allocation.explain())
+            self.log_event("ARBITER: " + resolution.allocation.explain(),
+                           hint=messages.hint("split"))
             resolution = Resolution(0.0, "failsafe", None, False,
                                     resolution.considered,
                                     unit_bounds=resolution.unit_bounds,
@@ -3371,7 +4759,7 @@ class Controller:
                 f"ARBITER: the site target was allocated across "
                 f"{len(resolution.shares)} inverters and this controller has no "
                 f"setpoint entity for {undeliverable} - refusing to command a "
-                f"partial site")
+                f"partial site", hint=messages.hint("no_setpoint"))
             # ⚠️ `shares={}`, NOT THE SHARES IT REFUSED TO DELIVER, AND SINCE
             # DEV-02 THAT IS LOAD-BEARING RATHER THAN TIDY. The write loop below
             # commands each inverter `shares.get(name, 0.0)`, so carrying the
@@ -3399,9 +4787,11 @@ class Controller:
             for _u, _why in (self.allocation.dropped if self.allocation else ()):
                 self.log_event(f"ALLOCATOR: {_u} dropped from the split "
                                f"({_why}) - the remaining inverter(s) now carry "
-                               f"its share of the site target")
+                               f"its share of the site target",
+                               hint=messages.hint("unit_dropped", unit=_u))
             if self._dropped_last and not _dropped:
-                self.log_event("ALLOCATOR: every inverter is back in the split")
+                self.log_event("ALLOCATOR: every inverter is back in the split",
+                               hint=messages.hint("units_back"))
             self._dropped_last = _dropped
         # 3b. OPT-09 / IF-04: WATTS NOBODY COULD TAKE ARE NEVER SILENT EITHER.
         #    `unmet_w` is the site target the envelopes could not absorb. It is
@@ -3418,9 +4808,11 @@ class Controller:
             if _unmet:
                 self.log_event(
                     f"ALLOCATOR: {_unmet:+d} W of the site target could not be "
-                    f"placed on any inverter - {self.allocation.explain()}")
+                    f"placed on any inverter - {self.allocation.explain()}",
+                    hint=messages.hint("unmet", w=_unmet))
             else:
-                self.log_event("ALLOCATOR: the whole site target fits again")
+                self.log_event("ALLOCATOR: the whole site target fits again",
+                               hint=messages.hint("unmet_gone"))
             self._unmet_last = _unmet
         if resolution.scope_errors:
             # A claim reached the arbiter on an actuator its source's scope does
@@ -3429,9 +4821,11 @@ class Controller:
             # card removes, and a site constraint on one unit is a bound the
             # other unit never gets. Loud, every cycle, and it does not change
             # the resolution - the arbiter already routed by `actuator`.
-            _LOG.error("ARBITER SCOPE: %s", "; ".join(resolution.scope_errors))
+            _LOG.error("A limit was filed on the wrong inverter, which is a "
+                       "software fault. %s.", " / ".join(resolution.scope_errors))
         if resolution.contradiction:
-            self.log_event("ARBITER CONTRADICTION - commanding 0 W, see the log")
+            self.log_event("ARBITER CONTRADICTION - commanding 0 W, see the log",
+                           hint=messages.hint("clash"))
         # --- SAFETY-02's arming gate ------------------------------------------
         # Was the number about to go on the wire chosen by the grid-following
         # loop, or by a strategy that commands against the meter on purpose?
@@ -3448,6 +4842,20 @@ class Controller:
         self.following = loop_is_following(resolution, self.loop_w)
         self.target = resolution.target_w
         self.reason = resolution.explain()
+        # UX-08: the same answer in plain words, for the page's "Why" line.
+        # `reason` stays the technical record the log and the checks read.
+        # UX-10: `why_key()` maps a safety winner to its claim's reason, and
+        # every key it can return has words in messages.WHY_WINNER.
+        _why = why_key(resolution.winner, claims)
+        if _why == "inputs missing" and not resolution.contradiction:
+            # UX-11: past the hold, say which reading is missing.
+            self.why_words = messages.why_missing(self.missing_reading(),
+                                                  stale_after)
+        else:
+            self.why_words = messages.why(
+                _why, resolution.target_w, resolution.bound_by,
+                contradiction=resolution.contradiction,
+                raised=why_raised(resolution, claims))
         # --- DEV-02: EACH INVERTER IS TOLD ITS OWN SHARE ---------------------
         # ⚠️ ITS OWN SHARE, NEVER THE SITE TARGET. `resolution.shares` is the
         # allocator's answer and `sum(shares) + unmet_w == round(target_w)` is
@@ -3466,6 +4874,8 @@ class Controller:
         # That is the dropped-link case: the inverter holds its last command
         # FOREVER, so "not in the split" must mean zero on the wire, not
         # silence. The write is the same clamped, budgeted path as every other.
+        # SAFETY-85, before the writes: the wire still holds last cycle's.
+        self._loop_alarm_input(resolution)
         writes = []
         for inv in self.inverters:
             inv.target = float(resolution.shares.get(inv.name, 0.0))
@@ -3624,20 +5034,22 @@ class Controller:
                 self.log_event(
                     "SHADOW MODE ON - " + shadow.why(
                         self.o, control_started=self.auto)
-                    + f"; inverter held at {shadow.WIRE_W:.0f} W")
-                _LOG.warning(
-                    "SAFETY-10 SHADOW MODE IS ON. The full decision path runs "
-                    "and NOTHING is commanded: every inverter is held at "
-                    "%+.0f W on the ordinary heartbeat. %s", shadow.WIRE_W,
+                    + f"; inverter held at {shadow.WIRE_W:.0f} W",
+                    hint=messages.hint("shadow_on"))
+                # UX-10: INFO. It follows a setting or a button press, and
+                # no person has to act on it.
+                _LOG.info(
+                    "Shadow mode is on, so every inverter stays at %.0f W and "
+                    "nothing the add-on decides is sent. %s.", shadow.WIRE_W,
                     shadow.why(self.o, control_started=self.auto))
             elif not first:
                 self.log_event(
-                    "SHADOW MODE OFF - the battery is being controlled again, "
-                    f"resuming from {shadow.WIRE_W:.0f} W")
-                _LOG.warning(
-                    "SAFETY-10 shadow mode is OFF. This controller is "
-                    "commanding the battery again, starting from the "
-                    "%+.0f W that was standing on the wire.", shadow.WIRE_W)
+                    "Shadow mode off: the add-on controls the battery again, "
+                    f"starting from {shadow.WIRE_W:.0f} W",
+                    hint=messages.hint("shadow_off"))
+                _LOG.info(
+                    "Shadow mode is off, so the add-on controls the battery "
+                    "again, starting from %.0f W.", shadow.WIRE_W)
         if not engaged:
             self.shadow_would_w = None
             self.shadow_sized_from_meter = False
@@ -3670,11 +5082,56 @@ class Controller:
             self._shadow_winner = edge
             self.log_event(shadow.log_line(
                 would_w=resolution.target_w, reason=resolution.explain(),
-                sized_from_meter=self.shadow_sized_from_meter))
+                sized_from_meter=self.shadow_sized_from_meter),
+                hint=messages.hint("shadow_decision",
+                                   sw=resolution.target_w))
         self.target = shadow.WIRE_W
         for inv in self.inverters:
             inv.target = shadow.WIRE_W
 
+    def _loop_alarm_input(self, resolution) -> None:
+        """SAFETY-85. The loop's clamp counts only on a cycle the loop decided
+        (a rating may cut it). A battery another owner set to discharge counts
+        when it gave less than it was told for `saturation_cycles` cycles in a
+        row. DECISIONS/SAFETY-85-no-false-not-keeping-up.md."""
+        d = self._loop_decision
+        if d is None:
+            self._short_run = 0
+            self._asked_hist = {}
+            return
+        unmet = self.allocation.unmet_w if self.allocation is not None else 0
+        cut = (resolution.bound_by or "").split("(")[0]
+        owns = (resolution.winner == "loop" and not d.held and not unmet
+                and (resolution.target_w == d.target_w
+                     or cut in ("device", "supervised")))
+        # Graded against the least that stood on the wire (0 W in shadow
+        # mode) over SHORT_CYCLES cycles and SHORT_SPAN_S seconds.
+        now, asked = self._now_mono, {}
+        for inv in self.inverters:
+            h = self._asked_hist.setdefault(inv.name, [])
+            h.append((now, inv.standing_w()))
+            while len(h) > SHORT_CYCLES and (
+                    now is None or h[0][0] is None
+                    or now - h[0][0] > SHORT_SPAN_S):
+                h.pop(0)
+            asked[inv.name] = min(w for _t, w in h)
+        others = [inv for inv in self.inverters if not owns
+                  or allocator.pin_w(resolution.unit_bounds.get(inv.name))
+                  is not None]
+        short = [(inv, asked[inv.name], inv.batt) for inv in others
+                 if inv.batt is not None
+                 and delivery_short(asked[inv.name], inv.batt,
+                                    self.tuning.saturation_w)]
+        self._short_run = self._short_run + 1 if short else 0
+        if owns and self.loop_clamped[0]:
+            return
+        engaged = self._short_run >= self.tuning.saturation_cycles
+        named = len(self.inverters) > 1
+        self.loop_clamped = (engaged, shortfall_note(
+            [(inv.name if named else None, a, g) for inv, a, g in short])
+            if engaged else "", False)
+        self.loop_clamp_facts = ()
+
     async def check_output_clamp(self) -> None:
         """SAFETY-03. Alarm whenever a clamp actually engaged this cycle.
 
@@ -3703,20 +5160,25 @@ class Controller:
         clamped_units = [inv for inv in self.inverters
                          if inv.clamp_last is not None and inv.clamp_last.engaged]
         engaged_write = bool(clamped_units)
-        engaged_loop, loop_note = self.loop_clamped
+        engaged_loop, loop_note, loop_bug = self.loop_clamped
         engaged = engaged_write or engaged_loop
-        if engaged:
-            where = (", ".join(f"{inv.name}: {inv.clamp_last.describe()}"
-                               for inv in clamped_units) if engaged_write
-                     else f"{CLAMP_REASON}: {loop_note}, above the "
-                          f"{self.site_max_w:.0f} W rating, and "
-                          f"was clamped to {self.target:+.0f} W")
-            reason = (f"{where}. This is a BUG SIGNAL, not a limit being used: "
-                      f"something upstream computed a setpoint the actuator "
-                      f"cannot deliver.")
+        # SAFETY-40: only an over-rating is a bug; the integrator bound is not.
+        bug = engaged_write or loop_bug
+        if engaged_write:
+            _named = len(self.inverters) > 1
+            reason = write_clamp_note([(inv.name if _named else None,
+                                        inv.clamp_last)
+                                       for inv in clamped_units])
+            facts = [messages.Clamp(inv.name if _named else None,
+                                    inv.clamp_last.requested_w,
+                                    inv.clamp_last.applied_w,
+                                    inv.clamp_last.bound)
+                     for inv in clamped_units]
         else:
-            reason = ""
-        fired = self.clamp_wd.note(engaged, reason, datetime.now(timezone.utc))
+            reason = loop_note if engaged else ""
+            facts = self.loop_clamp_facts if engaged else ()
+        fired = self.clamp_wd.note(engaged, reason, datetime.now(timezone.utc),
+                                   bug=bug, facts=facts)
 
         # --- THE ACTION LOG, AND IT IS COALESCED PER EPISODE ------------------
         # Every engagement is recorded, but consecutive ones are recorded by
@@ -3738,35 +5200,49 @@ class Controller:
         # write-path engagements and 2 loop-side ones.
         if engaged and not engaged_write:
             tag = f"{CLAMP_REASON} episode {self.clamp_wd.episodes}"
-            row = (f"{tag}: {self.clamp_wd.engagements} engagement(s) - "
-                   f"{reason}")
+            row = (f"{tag}: "
+                   f"{messages.count(self.clamp_wd.engagements, 'engagement')}"
+                   f" - {reason}")
             if self.events and tag in self.events[0]:
                 stamp = self.events[0].split(" ", 1)[0]
                 self.events[0] = f"{stamp} {row}"
             else:
-                self.log_event(row)
+                self.log_event(row, hint=messages.hint(
+                    "power_too_high" if bug else "not_keeping_up"))
         if not fired:
             return
+        if not self.clamp_wd.bug:
+            # SAFETY-40: the integrator bound is anti-windup, not a bug - a
+            # WARNING and a plainly titled notice, same cadence. Its OWN id, so
+            # it can never replace a BUG SIGNAL notice still on screen.
+            _LOG.warning("The battery gives less than asked: %s. Held back %s "
+                         "so far.", messages.reason_code(self.clamp_wd.reason),
+                         messages.times(self.clamp_wd.engagements))
+            _LOG.debug("Evidence: %s.", self.clamp_wd.reason)
+            _LOG.debug("A short hold after a large load or solar step is "
+                       "normal. If it lasts, check that the battery follows "
+                       "its commands.")
+            await self.hass.call("persistent_notification", "create",
+                                 messages.loop_bound().data())
+            return
         _LOG.error(
-            "SAFETY-03 - %s Silently clipping this is how a winding integrator "
-            "reached 14 768 W on this project before: the clamp makes every "
-            "dashboard read a legal number while the thing producing it goes on "
-            "climbing. The command IS clamped and the loop is STILL RUNNING - "
-            "this is an alarm, not a trip. Engagements so far: %d.",
-            self.clamp_wd.reason, self.clamp_wd.engagements)
+            "Power request too high, a software fault: %s. Cut back %s so "
+            "far, control runs on.", messages.reason_code(self.clamp_wd.reason),
+            messages.times(self.clamp_wd.engagements))
+        _LOG.debug("Evidence: %s.", self.clamp_wd.reason)
+        _LOG.debug(
+            "SAFETY-03: silently clipping this is how a winding integrator "
+            "reached 14 768 W on this project before. The clamp makes every "
+            "dashboard read a legal number while the thing producing it goes "
+            "on climbing. This is an alarm, not a trip.")
         # A fixed notification_id, for the reason check_meter_frozen() gives -
         # and a DIFFERENT one from every other alarm this add-on raises, because
         # a clamp is not a frozen meter and neither is a saturation freeze.
-        await self.hass.call("persistent_notification", "create", {
-            "notification_id": "goodwe_output_clamp",
-            "title": "GoodWe: a computed setpoint exceeded the rating",
-            "message": (
-                f"{self.clamp_wd.reason}\n\nThe command has been clamped and "
-                f"the controller is STILL RUNNING. This is NOT the inverter "
-                f"failing to follow a legal command (that is the saturation "
-                f"freeze, which is normal and does not alarm) - the value asked "
-                f"for was itself out of range."),
-        })
+        # UX-08: the words are messages.output_clamp()'s; the numbers are the
+        # ones `reason` was written from (ClampWatchdog.facts), asked first.
+        await self.hass.call("persistent_notification", "create",
+                             messages.output_clamp(self.clamp_wd.facts,
+                                                   shadow=self.shadow).data())
 
     async def check_peak_saturated(self) -> None:
         """SAFETY-07. Alarm ONLY when the guard has run out of inverter.
@@ -3789,37 +5265,62 @@ class Controller:
         available to it. That is the one state where the money is going to be
         spent and a human is the only remaining actuator.
 
+        SAFETY-81: `g.saturated` alone is not enough. It is graded against the
+        aim, and a 1 s meter spike, noise or the last seconds of a quarter set
+        it while the quarter lands on target; `peakguard.load_too_high()` must
+        agree too, for `ALARM_HOLD_S`. The battery reading it gets is the lower
+        of this cycle's and the last one's - see there.
+
         Edge-triggered, and de-asserting arms it again - the same shape as
         FreezeWatchdog's `evaluate()`, and for the same reason: one notification
-        per episode, not one per cycle.
+        per episode, not one per cycle. SAFETY-81: the notification and action
+        log line at most once per quarter; the ERROR line once per episode.
         """
         g = self.peak_guard
-        saturated = bool(g is not None and g.saturated)
+        batt, prev = self.site_batt_w, self._peak_batt_prev
+        if batt is None:
+            # Unknown, not "fine": the hold below neither grows nor restarts.
+            return
+        self._peak_batt_prev = batt
+        if prev is not None:
+            batt = min(float(batt), float(prev))
+        p = self._peak_proj
+        high = bool(
+            g is not None and g.saturated and p is not None
+            and p.block_start is not None
+            and peakguard.load_too_high(
+                p, batt_w=batt, ceiling_w=g.ceiling_w,
+                achievable_w=self.site_rating_w))
+        # SAFETY-81: and for ALARM_HOLD_S, on the projection's clock.
+        saturated = False
+        if high:
+            t = p.block_start + timedelta(seconds=float(p.elapsed_s))
+            if self._peak_high_since is None:
+                self._peak_high_since = t
+            saturated = ((t - self._peak_high_since).total_seconds()
+                         >= peakguard.ALARM_HOLD_S)
+        else:
+            self._peak_high_since = None
         was, self._peak_saturated = self._peak_saturated, saturated
         if not saturated or was:
             return
-        self.log_event("PEAK GUARD SATURATED - " + g.reason)
         _LOG.error(
-            "SAFETY-07 - %s. The guard is asking for everything the inverter "
-            "has and the quarter is still projected over the ceiling: this "
-            "quarter will set or raise the month's billed capacity peak. The "
-            "controller is STILL RUNNING and still shaving; there is nothing "
-            "further it can do. Shed load.", g.reason)
+            "Switch off large loads, the battery alone cannot keep this "
+            "15-minute period under the peak limit: %s.",
+            messages.reason_code(g.reason))
+        _LOG.debug("Evidence: %s.", g.reason)
+        # SAFETY-81: notified once per quarter; a later episode is logged only.
+        if p.block_start == self._peak_alarm_block:
+            return
+        self._peak_alarm_block = p.block_start
+        self.log_event("PEAK_GUARD_SATURATED - " + g.reason,
+                       hint=messages.hint("peak_saturated"))
         # A fixed notification_id, and a DIFFERENT one from every other alarm
         # here - check_meter_frozen() gives the reasoning. A saturated peak guard
         # is not a frozen meter and is not an out-of-range setpoint.
-        await self.hass.call("persistent_notification", "create", {
-            "notification_id": "goodwe_peak_saturated",
-            "title": "GoodWe: the capacity-peak guard has run out of inverter",
-            "message": (
-                f"{g.reason}.\n\nThe battery is being commanded to everything "
-                f"it can give and the quarter is STILL projected over the "
-                f"{g.ceiling_w:.0f} W ceiling, so this quarter will set or raise "
-                f"the month's billed capaciteitstarief peak. This is not a "
-                f"controller fault - the load is simply larger than the "
-                f"inverter. Shedding load in the next few minutes is the only "
-                f"thing that changes the bill."),
-        })
+        await self.hass.call("persistent_notification", "create",
+                             messages.peak_saturated(
+                                 g.ceiling_w, shadow=self.shadow).data())
 
     async def check_peak_floor_limited(self) -> None:
         """SAFETY-24. Alarm when the EMS SoC floor stops the guard shaving.
@@ -3840,6 +5341,8 @@ class Controller:
           floor-limited  the guard asked for NOTHING, because the pack is at or
                          under the EMS floor, or its SoC could not be read.
                          Nothing is being discharged for this quarter at all.
+                         (SAFETY-87, N>=2: or the batteries above their
+                         reserve give all they can and it is not enough.)
 
         They cannot both be true: peakguard.decide()'s floor-limited branch
         returns before the `achievable_w` clamp that sets `saturated`.
@@ -3860,20 +5363,22 @@ class Controller:
         """
         g = self.peak_guard
         limited = bool(g is not None and g.floor_limited)
+        if limited and (g.floor_w or 0.0) > 0.0:
+            limited = self._reserve_short(g)
+        else:
+            self._reserve_batt_prev = self._reserve_high_since = None
         was, self._peak_floor_limited = self._peak_floor_limited, limited
         if not limited or was:
             return
-        # No prefix: `reason` already opens with PEAK GUARD FLOOR-LIMITED, and
+        # No prefix: `reason` already opens with PEAK_GUARD_FLOOR_LIMITED, and
         # a second copy is the kind of stutter that makes a 40-line action log
         # read like boilerplate. The saturated path needs its prefix because its
         # reason carries the word in the middle of a sentence, not at the front.
-        self.log_event(g.reason)
+        self.log_event(g.reason, hint=messages.hint("peak_reserve"))
         _LOG.error(
-            "SAFETY-24 - %s. The controller is STILL RUNNING and charging is "
-            "still blocked, but it is not discharging to hold this quarter, so "
-            "the quarter will set or raise the month's billed capacity peak. "
-            "Shed load, or lower peak_soc_floor if this pack can afford it.",
-            g.reason)
+            "Switch off large loads, the peak guard may not draw the battery "
+            "lower: %s.", messages.reason_code(g.reason))
+        _LOG.debug("Evidence: %s.", g.reason)
         # A fixed notification_id, and a DIFFERENT one from every other alarm
         # here - check_meter_frozen() gives the reasoning. A battery at its
         # energy floor is not a saturated inverter and is not a frozen meter,
@@ -3884,45 +5389,41 @@ class Controller:
         # think the pack is AT it. `decide()` guards its own reason string the
         # same way; a f-string that formats a None here would turn the one
         # notification that matters into a traceback.
-        _at_floor = ("at the floor" if g.soc_floor is None
-                     else f"at {float(g.soc_floor):.0f} %")
-        # ⚠️ SAFETY-32. WHICH PACK STOPPED THE SITE. `g.soc_floor` is the floor
-        # the decision was actually taken with, so this re-grades nothing and
-        # cannot disagree with the alarm it is printed inside. At a roster of one
-        # the sentence is omitted entirely and this notification is byte-for-byte
-        # what SAFETY-25 shipped - there is exactly one pack and naming it would
-        # be noise on every existing install.
-        _blocked = [name for name, why
-                    in peakguard.pack_permissions(self.packs, g.soc_floor)
-                    if why is not None]
-        _which = ("" if len(self.inverters) < 2 else
-                  f"\n\nSAFETY-32 - WHICH PACK: this is graded per pack against "
-                  f"that pack's own BMS cut-out (bms_soc_floor), and the "
-                  f"pack(s) at or below their own floor right now are "
-                  f"{', '.join(_blocked) if _blocked else '(none - see the reason above)'}"
-                  f". The other packs on the roster are not the reason the guard "
-                  f"stopped and raising their cut-out will not change this.")
-        await self.hass.call("persistent_notification", "create", {
-            "notification_id": "goodwe_peak_soc_floor",
-            "title": "GoodWe: the capacity-peak guard has run out of battery",
-            "message": (
-                f"{g.reason}.\n\nTHIS QUARTER WILL GO OVER THE "
-                f"{g.ceiling_w:.0f} W ceiling and will set or raise the "
-                f"month's billed capaciteitstarief peak, because the peak guard "
-                f"is not allowed to discharge any further: {g.soc_floor_reason}."
-                f" This is not a controller fault - it is the EMS-side energy "
-                f"floor (peak_soc_floor) doing what it is set to do, and it sits "
-                f"deliberately above the pack's own BMS cut-out. Charging stays "
-                f"blocked. Shedding load is the only thing that changes the bill "
-                f"now; if this pack can afford a deeper discharge, lower "
-                f"peak_soc_floor.\n\nSAFETY-25 - WHAT THIS FLOOR IS NOT: "
-                f"peak_soc_floor bounds THE PEAK GUARD ONLY. It is not a "
-                f"pack-wide reserve, and the battery is NOT being held "
-                f"{_at_floor} - ordinary self-consumption has no SoC "
-                f"floor at all and will go on discharging past it, down to the "
-                f"pack's own BMS cut-out. What has stopped is the guard buying "
-                f"you a lower bill, not the pack being spent." + _which),
-        })
+        # SAFETY-32/87: which battery is at its reserve, each graded on its own
+        # floor (`g.held`). At a roster of one no battery is named.
+        # ⚠️ SAFETY-25's sentence (the reserve binds the peak guard only) is
+        # part of messages.peak_reserve() on every branch, the unreadable-SoC
+        # one included.
+        await self.hass.call("persistent_notification", "create",
+                             messages.peak_reserve(
+                                 g.ceiling_w, soc_unread=g.soc is None,
+                                 floor_unknown=(g.soc is not None
+                                                and g.soc_floor is None),
+                                 packs=(g.held if len(self.inverters) > 1
+                                        else ()),
+                                 others=(g.floor_w or 0.0) > 0.0).data())
+
+    def _reserve_short(self, g) -> bool:
+        """SAFETY-87: the batteries that can still give, at full power, miss
+        the limit (`load_too_high()` on `g.able_w`), for ALARM_HOLD_S, as
+        SAFETY-81 grades 'Load too high'."""
+        p, batt = self._peak_proj, self.site_batt_w
+        if batt is None:
+            return self._peak_floor_limited
+        prev, self._reserve_batt_prev = self._reserve_batt_prev, batt
+        if prev is not None:
+            batt = min(float(batt), float(prev))
+        if not (p is not None and p.block_start is not None
+                and peakguard.load_too_high(p, batt_w=batt,
+                                            ceiling_w=g.ceiling_w,
+                                            achievable_w=g.able_w)):
+            self._reserve_high_since = None
+            return False
+        t = p.block_start + timedelta(seconds=float(p.elapsed_s))
+        if self._reserve_high_since is None:
+            self._reserve_high_since = t
+        return ((t - self._reserve_high_since).total_seconds()
+                >= peakguard.ALARM_HOLD_S)
 
     async def check_circulating(self) -> None:
         """SAFETY-31 + SAFETY-34. The alarm, and it must survive a restart.
@@ -3939,15 +5440,17 @@ class Controller:
         The latch says "this site is tripped"; the flag says "this process has
         put that in front of a human". A restart clears the flag and keeps the
         latch, so the notification is RE-RAISED on the first cycle after every
-        add-on start - which is also the first cycle after a Home Assistant
-        restart, because the add-on is restarted with it.
+        add-on start. A Core-only restart does NOT restart the add-on, so it is
+        also re-asserted every REANNOUNCE_S (SAFETY-34).
 
         ⚠️ ONE CODE PATH FOR BOTH, ON PURPOSE. A fresh trip and a restart into
         an existing trip raise the alarm through these same lines. Two paths
         would be two chances for the restart one to rot unnoticed, and the
         restart one is the case nobody exercises by hand.
         """
-        if not self.circ_wd.tripped or self._circ_announced:
+        if not self.circ_wd.tripped:
+            return
+        if self._circ_announced and not self._reannounce_due("goodwe_circulating_power"):
             return
         # Set BEFORE the await. `hass.call()` can raise or hang, and a retry
         # every cycle for a broker that is down would be an alarm storm on the
@@ -3955,39 +5458,22 @@ class Controller:
         # already durable and the log line above already fired; this surface is
         # best-effort by design.
         self._circ_announced = True
+        self._announced_mono["goodwe_circulating_power"] = _mono()
         names = self.units
         pos, neg = opposing([inv.batt for inv in self.inverters],
                             min_w=self.circ_wd.cfg.min_w / 2.0)
-        who = ""
-        if pos and neg:
-            who = ("\n\nRight now " + ", ".join(names[i] for i in pos)
-                   + " is discharging while " + ", ".join(names[i] for i in neg)
-                   + " charges.")
         # A fixed notification_id, and a DIFFERENT one from every other alarm
-        # this add-on raises - check_meter_frozen() gives the reasoning. A
-        # circulating loop is not a frozen meter, is not an out-of-range
-        # setpoint and is not a saturated peak guard.
-        await self.hass.call("persistent_notification", "create", {
-            "notification_id": "goodwe_circulating_power",
-            "title": "GoodWe: the inverters are pushing against each other",
-            "message": (
-                f"{self.circ_wd.reason}{who}\n\nTHE METER CANNOT SEE THIS. "
-                f"Circulating power nets to zero at P1, so the site reads idle "
-                f"while the packs are cycled through two conversion stages "
-                f"continuously. Every other guard in this add-on is a consumer "
-                f"of that net figure, which is why none of them fired.\n\n"
-                f"CONTROL HAS BEEN STOPPED - every inverter is commanded 0 W "
-                f"and held there. That removes this controller as one of the "
-                f"two participants, and it makes anything still happening "
-                f"VISIBLE at the meter instead of cancelled at it.\n\n"
-                f"⚠️ IF THE GRID READING DOES NOT MOVE AFTER THIS, one inverter "
-                f"is no longer listening to this add-on and no command will "
-                f"reach it - that has happened twice on this hardware, once for "
-                f"6 h 25 m. The remaining actuator is a human at the isolator.\n"
-                f"\nThis alarm survives a Home Assistant restart. Restarting "
-                f"will not clear it; start control from the add-on UI once you "
-                f"know why two inverters were opposing."),
-        })
+        # this add-on raises - check_meter_frozen() gives the reasoning.
+        await self.hass.call("persistent_notification", "create",
+                             messages.circulating(
+                                 [names[i] for i in pos] if pos and neg else (),
+                                 [names[i] for i in neg] if pos and neg else (),
+                             ).data())
+
+    def _reannounce_due(self, notification_id: str) -> bool:
+        """SAFETY-34: has this latched alarm gone REANNOUNCE_S without being re-asserted?"""
+        t = self._announced_mono.get(notification_id)
+        return t is None or _mono() - t >= REANNOUNCE_S
 
     async def check_not_delivering(self) -> None:
         """SAFETY-42 + SAFETY-34. The alarm, and it must survive a restart.
@@ -4008,8 +5494,8 @@ class Controller:
         not persisted. The latch says "this unit is tripped"; membership says
         "this process has put that in front of a human". A restart empties the
         set and keeps the latch, so the notification is RE-RAISED on the first
-        cycle after every add-on start - which is also the first cycle after a
-        Home Assistant restart, because the add-on is restarted with it.
+        cycle after every add-on start, and re-asserted every REANNOUNCE_S
+        because a Core-only restart does not restart the add-on (SAFETY-34).
 
         ⚠️ ONE CODE PATH FOR BOTH, ON PURPOSE - `check_circulating()`'s
         argument. A fresh trip and a restart into an existing trip raise the
@@ -4027,7 +5513,10 @@ class Controller:
         names = self.units
         slugs = unit_slugs(names)
         for inv, slug in zip(self.inverters, slugs):
-            if not inv.delivery_wd.tripped or inv.name in self._delivery_announced:
+            nid = f"goodwe_not_delivering_{slug}"
+            if not inv.delivery_wd.tripped:
+                continue
+            if inv.name in self._delivery_announced and not self._reannounce_due(nid):
                 continue
             # Added BEFORE the await, for `check_circulating()`'s reason:
             # `hass.call()` can raise or hang, and a retry every cycle for a
@@ -4035,38 +5524,9 @@ class Controller:
             # latch is already durable and the log line already fired; this
             # surface is best-effort by design.
             self._delivery_announced.add(inv.name)
-            peers = ", ".join(n for n in names if n != inv.name) or "no sibling"
-            await self.hass.call("persistent_notification", "create", {
-                "notification_id": f"goodwe_not_delivering_{slug}",
-                "title": f"GoodWe: {inv.name} is not delivering its share",
-                "message": (
-                    f"{inv.delivery_wd.reason}\n\nWHY NOTHING ELSE SAID SO. A "
-                    f"unit sitting at 0 W against a non-zero share is not "
-                    f"pushing the wrong way, it is ABSENT: the per-unit sign "
-                    f"check needs opposition on both sides of "
-                    f"{self.unit_sign_cfg.min_w:.0f} W and never opens, the "
-                    f"site sum still agrees with the meter in "
-                    f"direction, and circulating power is exactly zero when one "
-                    f"unit does nothing. The only other trace is a saturation "
-                    f"freeze, which this add-on's own code calls an alarm "
-                    f"operators learn to ignore.\n\nNOTHING HAS BEEN COMMANDED "
-                    f"DIFFERENTLY. This guard reports and does not act. "
-                    f"Commanding an inverter that has stopped listening "
-                    f"achieves nothing - that has happened on this hardware, "
-                    f"once for 6 h 25 m - and the only re-allocation this "
-                    f"add-on can express is all-or-nothing, which would throw "
-                    f"away the output of a unit that is delivering PART of its "
-                    f"share. So {peers} is still regulating and the site is "
-                    f"short by up to {inv.rating_w():.0f} W until somebody "
-                    f"looks at {inv.name}.\n\nWHAT TO CHECK, in order: is "
-                    f"{inv.name} answering on RS485 at all; is its pack colder "
-                    f"or emptier than its configured bms_soc_floor says (if it "
-                    f"is, that setting does not describe this battery and this "
-                    f"alarm is telling you so); and is anything else writing to "
-                    f"it.\n\nThis alarm survives a Home Assistant restart. "
-                    f"Restarting will not clear it; start control from the "
-                    f"add-on UI once you know why."),
-            })
+            self._announced_mono[nid] = _mono()
+            await self.hass.call("persistent_notification", "create",
+                                 messages.not_delivering(inv.name, slug).data())
 
     async def check_meter_frozen(self) -> None:
         """SAFETY-18. Alarm on a meter that answers forever without changing.
@@ -4092,26 +5552,23 @@ class Controller:
                                         dev_max=self.site_dev_bound("dev_max"))
         if not fired:
             return
-        self.log_event("METER FROZEN? " + self.freeze_wd.reason)
+        self.log_event("METER FROZEN? " + self.freeze_wd.reason,
+                       hint=messages.hint("meter_frozen"))
         _LOG.error(
-            "SAFETY-18 - %s. The grid-following loop is regulating against a "
-            "number that has stopped moving, and nothing in this stack stops "
-            "it: the meter is still answering, so the age is fresh, the "
-            "firmware watchdog is fed and the arbiter only bounds the "
-            "magnitude. CHECK THE METER. Sustained for a quarter of an hour "
-            "this sets the month's billed capacity-tariff peak. This is an "
-            "ALARM ONLY - the loop is still running.", self.freeze_wd.reason)
+            "The meter shows the same value while the battery is asked for "
+            "full power, and control still follows it, so check the meter: "
+            "%s.", messages.reason_code(self.freeze_wd.reason))
+        _LOG.debug("Evidence: %s.", self.freeze_wd.reason)
+        _LOG.debug(
+            "SAFETY-18: nothing else stops this. The meter still answers, so "
+            "its age is fresh, the firmware watchdog is fed and the arbiter "
+            "only bounds the magnitude. Kept up for a quarter of an hour, it "
+            "sets the month's billed capacity peak.")
         # ⚠️ A fixed notification_id, so a second episode REPLACES the first
         # rather than stacking. An operator who has to dismiss eleven identical
         # notifications learns to dismiss the twelfth without reading it.
-        await self.hass.call("persistent_notification", "create", {
-            "notification_id": "goodwe_meter_frozen",
-            "title": "GoodWe: the P1 meter may be frozen",
-            "message": (
-                f"{self.freeze_wd.reason}.\n\nThe controller is STILL RUNNING "
-                f"and still following this reading. Check the meter; if it is "
-                f"stuck, stop control from the add-on UI."),
-        })
+        await self.hass.call("persistent_notification", "create",
+                             messages.meter_frozen(unchanged).data())
 
     # -- tasks ---------------------------------------------------------------
     # -- OPT-04: the background tariff refresh -------------------------------
@@ -4215,14 +5672,10 @@ class Controller:
                         and standing is not None and standing.from_feed)
                 if keep:
                     _LOG.warning(
-                        "tariff refresh degraded (%s); KEEPING the plan "
-                        "resolved at %s, %.0f s ago. tariff_at is NOT moved, "
-                        "so it retires %.0f s after that fetch; arbitrage, "
-                        "where it is armed, stops with it. A kept plan is "
-                        "never presented as a current one.", plan.words,
-                        self.tariff_at,
-                        (now - self.tariff_at).total_seconds(),
-                        TARIFF_MAX_AGE_S)
+                        "The price update was incomplete, so the plan from %s "
+                        "is kept until it is %s old. The update held %s.",
+                        messages.when(brussels(self.tariff_at)),
+                        messages.duration(TARIFF_MAX_AGE_S), plan.words)
                 else:
                     self.tariff_plan, self.tariff_at = plan, now
                     _LOG.info("tariff refreshed: %s", plan.words)
@@ -4232,9 +5685,10 @@ class Controller:
                 # here is something nobody expected, and the plan is kept for
                 # the same reason and on the same terms.
                 _LOG.warning(
-                    "tariff refresh raised (%s); keeping the plan resolved at "
-                    "%s. It retires on its own after %.0f s and arbitrage "
-                    "stops with it.", err, self.tariff_at, TARIFF_MAX_AGE_S)
+                    "The price update failed (%s), so the plan from %s is kept "
+                    "until it is %s old, and trading stops then.",
+                    err, messages.when(brussels(self.tariff_at)),
+                    messages.duration(TARIFF_MAX_AGE_S))
             with contextlib.suppress(asyncio.TimeoutError):
                 await asyncio.wait_for(self.stop_event.wait(),
                                        timeout=TARIFF_REFRESH_S)
@@ -4286,7 +5740,8 @@ class Controller:
         if problems:
             refuse(problems)
             self.refused = problems
-            self.log_event("REFUSED: " + problems[0])
+            self.log_event("REFUSED: " + problems[0],
+                           hint=messages.hint("refused"))
             # Signal, then return WITHOUT entering the loop. amain() wakes
             # on this, runs the normal wind-down (which commands 0 W) and
             # re-raises ConfigRefused afterwards, so the exit code is 78 and
@@ -4397,6 +5852,7 @@ class Controller:
             await self.send_heartbeats(asyncio.get_running_loop().time(),
                                        heartbeat)
             self.publish()
+            self.loop_pass_mono = time.monotonic()
             await asyncio.sleep(1)
 
     async def send_heartbeats(self, loop_now: float, heartbeat_s: float) -> None:
@@ -4546,6 +6002,8 @@ class Controller:
             values[unit_state_key(slug, "soc")] = inv.soc
             values[unit_state_key(slug, "sign_latch")] = (
                 "tripped" if inv.sign_wd.tripped else "clear")
+        # OPT-11 P2: each battery's mode and switch; nothing while modes are off.
+        values.update(self.mode_values())
         self.mqtt.publish(values)
 
     async def shutdown(self) -> None:
@@ -4596,14 +6054,36 @@ class Controller:
         """
         o = self.o
         out = []
+        # SAFETY-61. First, so a stalled loop is the headline: the heartbeat is
+        # sent from this loop, so past layer 1's veto the inverter is at 0 W.
+        if self.loop_pass_mono is None:
+            out.append({"ok": True, "warn": False, "id": "controller",
+                        "text": messages.row_controller_starting()})
+        else:
+            _pass_age = time.monotonic() - self.loop_pass_mono
+            if _pass_age > FIRMWARE_INGEST_VETO_S:
+                out.append({"ok": False, "warn": False, "id": "controller",
+                            "text": messages.row_controller_stalled(
+                                _pass_age, FIRMWARE_INGEST_VETO_S)})
+            else:
+                out.append({"ok": True, "warn": False, "id": "controller",
+                            "text": messages.row_controller_ran(_pass_age)})
         if self.p1_enabled:
             age = self.p1.published_age_s
-            if self.p1.stale:
-                out.append({"ok": False, "warn": False,
-                            "text": f"P1 meter ({o.get('meter_source')}): no reading for "
-                                    f"{age:.0f} s (limit {self.p1.max_age_s:.0f} s)"
-                                    + (f" - last error: {self.p1.last_error}"
-                                       if self.p1.last_error else "")})
+            if (self.p1.stale and self.p1.age_s() is None
+                    and age <= self.p1.max_age_s):
+                # UX-10: no reading yet since the start, still inside the
+                # limit. Amber, not red: it is not a fault yet, but control
+                # waits for it. Red at 0 s contradicted the limit the row
+                # prints. Past the limit it is the red row below, as before.
+                out.append({"ok": False, "warn": True, "id": "meter",
+                            "text": messages.row_meter_waiting(
+                                self.p1.max_age_s)})
+            elif self.p1.stale:
+                # The last error is on the add-on log's WARNING line (p1.py).
+                out.append({"ok": False, "warn": False, "id": "meter",
+                            "text": messages.row_meter_stale(
+                                age, self.p1.max_age_s)})
             else:
                 # ⚠️ unchanged_s is REPORTED, never thresholded and never folded
                 # into the age - see HomeWizardLocalSource.unchanged_s for why
@@ -4615,33 +6095,26 @@ class Controller:
                 # only homewizard_local has one, and p1_source is None until
                 # amain() builds the transport.
                 unchanged = getattr(self.p1_source, "unchanged_s", None)
-                out.append({"ok": True, "warn": False,
-                            "text": f"P1 meter ({o.get('meter_source')}): {self.p1.net_w:g} W, "
-                                    f"{age:.0f} s old, {self.p1.samples} telegrams, "
-                                    f"{self.p1.parse_errors} rejected"
-                                    + (f", measurement unchanged for {unchanged:.0f} s"
-                                       if unchanged is not None else "")})
+                out.append({"ok": True, "warn": False, "id": "meter",
+                            "text": messages.row_meter(
+                                self.p1.net_w, age, self.p1.parse_errors,
+                                unchanged)})
             # SAFETY-18. Reported in both states, for the reason SAFETY-02 is:
             # a detector nobody can see is armed is a detector nobody trusts
             # when it fires. ok=False/warn=False so the banner goes red - this
             # is an alarm, and the banner is the loudest surface we own. It
             # changes NOTHING about control; see check_meter_frozen().
             if self.freeze_wd.active:
-                out.append({"ok": False, "warn": False,
-                            "text": "METER MAY BE FROZEN - " + self.freeze_wd.reason
-                                    + ". The loop is STILL FOLLOWING it and is "
-                                      "still running. Check the meter. Held here "
-                                      "for a quarter of an hour this sets the "
-                                      "month's billed capacity peak."})
+                # The figures are in `freeze_wd.reason`, on the log and the
+                # event list (check_meter_frozen()).
+                out.append({"ok": False, "warn": False, "id": "meter_frozen",
+                            "text": messages.row_meter_frozen()})
             elif getattr(self.p1_source, "unchanged_s", None) is None:
                 # Not "armed". Every transport but homewizard_local is invisible
                 # to this check, and saying "armed" there would be a lie the
                 # status page tells on behalf of a guard that cannot run.
-                out.append({"ok": False, "warn": True,
-                            "text": f"freeze detector: NOT COVERED on "
-                                    f"meter_source {o.get('meter_source')} - only "
-                                    f"homewizard_local sees whether the meter's own "
-                                    f"document changes"})
+                out.append({"ok": False, "warn": True, "id": "freeze_check",
+                            "text": messages.row_freeze_off("source")})
             elif rail_unreachable(self.site_max_w,
                                   dev_min=self.site_dev_bound("dev_min"),
                                   dev_max=self.site_dev_bound("dev_max")):
@@ -4651,12 +6124,11 @@ class Controller:
                 # and an operator does not need to learn two vocabularies for
                 # it. What differs is only which term is missing: there,
                 # `unchanged_s`; here, a rail the command could ever stand at.
-                out.append({"ok": False, "warn": True,
-                            "text": f"freeze detector: NOT COVERED - "
-                                    + rail_unreachable(
-                                        self.site_max_w,
-                                        dev_min=self.site_dev_bound("dev_min"),
-                                        dev_max=self.site_dev_bound("dev_max"))})
+                _no_rating = (not self.site_max_w
+                              or not is_commandable(self.site_max_w))
+                out.append({"ok": False, "warn": True, "id": "freeze_check",
+                            "text": messages.row_freeze_off(
+                                "rating" if _no_rating else "range")})
             else:
                 # ⚠️ SAFETY-20. THE RAIL PRINTED HERE IS THE RAIL THE PREDICATE
                 # USES, device range included. This row used to interpolate
@@ -4675,38 +6147,40 @@ class Controller:
                 # reads `min` and `max` independently and returns None for
                 # whichever attribute is missing or unparseable - so this
                 # renders whatever is there rather than formatting a None.
-                _cap = ("" if _rail >= rail_w(self.site_max_w)
-                        else " - below max_w because "
-                             + "; ".join(
-                                 f"{inv.setpoint_entity or inv.name} accepts "
-                                 f"only {inv.dev_min}...{inv.dev_max} W"
-                                 for inv in self.inverters))
-                out.append({"ok": True, "warn": False,
-                            "text": f"freeze detector: armed (alerts after "
-                                    f"{self.freeze_wd.cfg.hold_s:.0f} s unchanged "
-                                    f"while the command is over "
-                                    f"{_rail:.0f} W{_cap})"})
+                # UX-08: "the inverter's own limit" says the device set it; which
+                # inverter and its range are DOCS and the settings, not entity ids.
+                out.append({"ok": True, "warn": False, "id": "freeze_check",
+                            "text": messages.row_freeze_on(
+                                self.freeze_wd.cfg.hold_s, _rail,
+                                own_limit=_rail < rail_w(self.site_max_w))})
 
             # TARIFF-01. The month's billed peak, and - the load-bearing half -
             # a DIFFERENT row when the store could not answer. "no peak yet" is
             # a normal state on the 1st; "unreadable" is a broken instrument, and
             # a status page that spelled them the same way would let a 0 W read
             # look like a quiet month right up until SAFETY-07 shaved nothing.
+            # UX-08: in plain words. The store's state at start is on the INFO
+            # line `capacity-tariff peak store: ...` and `_pk.explain()` on the
+            # log; the coverage figure (TARIFF-13) is a row of its own.
             _pk = self.peak.peak(when)
             if _pk.is_unreadable:
-                out.append({"ok": False, "warn": True,
-                            "text": "capacity-tariff peak: " + _pk.explain()})
+                out.append({"ok": False, "warn": True, "id": "month_peak",
+                            "text": messages.row_month_peak_unreadable()})
             else:
                 # §9.1's "warning entity at 80 %", as a status row rather than
                 # a second entity - see the constructor on not doubling up.
                 _frac = self.peak.warning_frac(when) or 0.0
                 _ok = _frac < 0.8
-                out.append({"ok": _ok, "warn": not _ok,
-                            "text": _pk.explain()
-                                    + f" - {_frac * 100:.0f} % of the "
-                                      f"{self.peak.cap_w:.0f} W soft limit"
-                                    + f"; {self.peak.recorded} quarter(s) banked"
-                                    + f"; on start: {self.peak.restore_state}"})
+                out.append({"ok": _ok, "warn": not _ok, "id": "month_peak",
+                            "text": (messages.row_month_peak_none()
+                                     if not _pk.is_observed else
+                                     messages.row_month_peak(
+                                         _pk.peak_w,
+                                         brussels(_pk.quarter_start),
+                                         _frac))})
+            out.append({"ok": True, "warn": False, "id": "periods_measured",
+                        "text": messages.row_periods_measured(
+                            self.peak.recorded)})
 
             # SAFETY-07. Three rows, not one, because "idle" and "cannot see"
             # are opposite states and a page that spelled them the same way
@@ -4716,13 +6190,14 @@ class Controller:
             # decision that has not been taken.
             _pg = self.peak_guard
             if _pg is None:
-                out.append({"ok": True, "warn": True,
-                            "text": "peak guard: no decision yet - the first "
-                                    "control cycle has not run"})
+                out.append({"ok": True, "warn": True, "id": "peak_guard",
+                            "text": messages.row_peak_guard_waiting()})
             elif _pg.saturated:
-                out.append({"ok": False, "warn": False,
-                            "text": "PEAK GUARD SATURATED - " + _pg.reason})
-            elif _pg.floor_limited:
+                out.append({"ok": False, "warn": False, "id": "peak_guard",
+                            "runs": True,
+                            "text": messages.row_peak_saturated(_pg.ceiling_w)})
+            elif _pg.floor_limited and (not (_pg.floor_w or 0.0) > 0.0
+                                        or self._peak_floor_limited):
                 # SAFETY-24. NOT ok, like saturation: in both states the money
                 # is going to be spent and a human is the only actuator left. A
                 # separate row from saturation because the two ask for opposite
@@ -4745,21 +6220,31 @@ class Controller:
                 # the whole sentence, because the row is where an operator
                 # reads what the floor does and does not bound. Shortening the
                 # ROW instead would be weakening AC 3.
-                out.append({"ok": False, "warn": False,
-                            "banner": _pg.explain()
-                                      + " - and peak_soc_floor bounds THE PEAK "
-                                        "GUARD ONLY (SAFETY-25, see below)",
-                            "text": _pg.explain()
-                                    + ". NOTE: peak_soc_floor bounds THE PEAK "
-                                      "GUARD ONLY - it is not a pack-wide "
-                                      "reserve, and ordinary self-consumption "
-                                      "has no SoC floor, so the battery may "
-                                      "keep discharging below this level down "
-                                      "to the BMS cut-out (SAFETY-25)"})
+                # UX-08: the same three branches, and the same pack naming, as
+                # check_peak_floor_limited()'s notification. The figures stay in
+                # `_pg.reason`, on the log and the event list.
+                # SAFETY-87: `runs`, control goes on (status_payload()).
+                out.append({"ok": False, "warn": False, "id": "peak_guard",
+                            "runs": True,
+                            "banner": messages.banner_peak_reserve(),
+                            "text": messages.row_peak_reserve(
+                                _pg.ceiling_w, soc_unread=_pg.soc is None,
+                                floor_unknown=(_pg.soc is not None
+                                               and _pg.soc_floor is None),
+                                packs=(_pg.held if len(self.inverters) > 1
+                                       else ()),
+                                others=(_pg.floor_w or 0.0) > 0.0)})
             elif _pg.blind:
-                out.append({"ok": False, "warn": True, "text": _pg.explain()})
+                out.append({"ok": False, "warn": True, "id": "peak_guard",
+                            "text": messages.row_peak_guard_blind(
+                                peakguard.blind_kind(_pg.blind))})
+            elif _pg.engaged:
+                out.append({"ok": False, "warn": True, "id": "peak_guard",
+                            "text": messages.row_peak_guard_on(
+                                _pg.floor_w or 0.0, _pg.ceiling_w,
+                                shadow=self.shadow)})
             else:
-                out.append({"ok": not _pg.engaged, "warn": _pg.engaged,
+                out.append({"ok": True, "warn": False, "id": "peak_guard",
                             "text": _pg.explain()})
         else:
             # ⚠️ OUTSIDE the `p1_enabled` block, and that placement is the point.
@@ -4769,11 +6254,8 @@ class Controller:
             # leave the one install that is unprotected showing nothing at all.
             # Same answer, same reason, as the freeze detector's NOT COVERED row
             # a few lines up.
-            out.append({"ok": False, "warn": True,
-                        "text": f"peak guard: NOT COVERED on meter_source "
-                                f"{o.get('meter_source')} - the quarter-hour "
-                                f"average is measured from P1 telegrams and this "
-                                f"path has none, so a runaway cannot be capped"})
+            out.append({"ok": False, "warn": True, "id": "peak_guard",
+                        "text": messages.row_peak_guard_off()})
 
         # ⚠️ ONE PAIR OF ROWS PER INVERTER, NAMED. A single "battery SoC" row on
         # a site with two packs is a page that shows one pack and calls it the
@@ -4781,17 +6263,21 @@ class Controller:
         # that is what an existing install reads.
         rows = []
         for inv in self.inverters:
-            tag = "" if len(self.inverters) == 1 else f" ({inv.name})"
-            rows.append((f"battery SoC{tag}", inv.soc, inv.soc_entity))
-            rows.append((f"battery power{tag}", inv.batt, inv.batt_entity))
+            unit = None if len(self.inverters) == 1 else inv.name
+            rows.append((messages.LABEL_SOC, unit, inv.soc, inv.soc_entity))
+            rows.append((messages.LABEL_BATTERY, unit, inv.batt,
+                         inv.batt_entity))
         if not self.p1_enabled:
             # In P1 mode the check above replaces this one; leaving both in
             # would report "no entity configured" for a meter_entity that is
             # correctly unused, i.e. a permanent false NOT READY.
-            rows.insert(0, ("grid power", self.grid, o.get("meter_entity")))
-        for label, value, entity in rows:
+            rows.insert(0, (messages.LABEL_GRID, None, self.grid,
+                            o.get("meter_entity")))
+        # UX-08: the rows name the setting, never the entity id (STYLE.md).
+        for label, unit, value, entity in rows:
             if not entity:
-                out.append({"ok": False, "warn": False, "text": f"{label}: no entity configured"})
+                out.append({"ok": False, "warn": False, "id": "sensor",
+                            "text": messages.row_sensor_unset(label, unit)})
             elif value is None:
                 # ⚠️ SAFETY-56. THIS ROW ASSERTED A FALSE FACT ABOUT A NAMED
                 # ENTITY, WHICH IS THE WORST THING A DIAGNOSTIC CAN DO. It read
@@ -4815,65 +6301,83 @@ class Controller:
                 # pre-empting the answer. Same reason the wording is not shared
                 # with `freshness._grade()`: that one is a log line about a
                 # BEHAVIOUR, this one is a banner about an ENTITY.
-                out.append({"ok": False, "warn": False,
-                            "text": f"{label}: no usable value this cycle from "
-                                    f"{entity} - and this row cannot tell which "
-                                    f"of two things that is: the entity is "
-                                    f"missing or not numeric, or it is "
-                                    f"publishing a number that this controller "
-                                    f"is withholding (a freshness gate does "
-                                    f"exactly that, and names itself in a row "
-                                    f"of its own). Confirm the entity in "
-                                    f"Developer Tools before replacing it"})
+                out.append({"ok": False, "warn": False, "id": "sensor",
+                            "text": messages.row_sensor_unusable(label, unit)})
             else:
-                out.append({"ok": True, "warn": False, "text": f"{label}: {entity} = {value:g}"})
+                out.append({"ok": True, "warn": False, "id": "sensor",
+                            "text": messages.row_sensor(label, value, unit)})
 
         for inv in self.inverters:
             sp = inv.setpoint_entity
-            tag = "" if len(self.inverters) == 1 else f" [{inv.name}]"
+            unit = None if len(self.inverters) == 1 else inv.name
             if not sp:
-                out.append({"ok": False, "warn": False,
-                            "text": f"setpoint entity not configured{tag}"})
+                out.append({"ok": False, "warn": False, "id": "control",
+                            "text": messages.row_control_unset(unit)})
             elif inv.dev_max is None:
-                out.append({"ok": False, "warn": False,
-                            "text": f"setpoint entity {sp} not found"})
+                out.append({"ok": False, "warn": False, "id": "control",
+                            "text": messages.row_control_missing(unit)})
             else:
-                out.append({"ok": True, "warn": False,
-                            "text": f"setpoint {sp} (range {inv.dev_min:g}…"
-                                    f"{inv.dev_max:g} W)"})
+                out.append({"ok": True, "warn": False, "id": "control",
+                            "text": messages.row_control(inv.dev_min,
+                                                         inv.dev_max, unit)})
 
         # DEV-02. Whether this controller can still put a number on each
         # inverter, and it is reported in the ONE state that matters: a unit
         # `live_units()` has stopped listing has had its share handed to its
         # siblings, or - at a roster of one - has taken the site to 0 W. A
         # dropped link that shows nothing on the page reads as a healthy site.
-        for note in self.liveness_notes():
-            out.append({"ok": False, "warn": "NOT COMMANDABLE" not in note,
-                        "text": note})
+        # Red only for a unit that is no longer live; the rest are amber.
+        # The same notes, in the same order, as `liveness_notes()`.
+        _now = datetime.now(timezone.utc)
+        for inv in self.inverters:
+            for note, red in ((inv.link_note(_now), not inv.is_live(_now)[0]),
+                              (inv.stale_note(), False),
+                              (inv.refusal_note(), False)):
+                if note:
+                    out.append({"ok": False, "warn": not red, "text": note})
 
-        # SAFETY-03. Red while a clamp is engaged, and the engagement COUNT is
-        # shown even after it clears - a loop that wound once and stopped is
-        # still a bug, and a row that vanishes with the condition takes the
+        # SAFETY-03. Red while an over-rating clamp is engaged (amber for the
+        # integrator bound, SAFETY-40), and the engagement COUNT is shown even
+        # after it clears - a row that vanishes with the condition takes the
         # evidence with it. Reported only when there is something to report:
         # unlike the freeze detector this guard has no "not covered" state, it
         # runs on every write on every transport.
-        if self.clamp_wd.active:
-            out.append({"ok": False, "warn": False,
-                        "text": "OUTPUT CLAMP ENGAGED - " + self.clamp_wd.reason
-                                + f" Engagements: {self.clamp_wd.engagements}."})
-        elif self.clamp_wd.engagements:
-            out.append({"ok": False, "warn": True,
-                        "text": f"output clamp: not engaged now, but it has "
-                                f"engaged {self.clamp_wd.engagements} time(s) in "
-                                f"{self.clamp_wd.episodes} episode(s) since "
-                                f"start - see the event log"})
+        # UX-07 item 1 / UX-08: each count is shown under ITS alarm's name -
+        # over-rating cuts as "Power request too high", integrator-bound cycles
+        # as "Battery is not keeping up" - never the two summed under one.
+        _cw = self.clamp_wd
+        if _cw.active and _cw.bug:
+            out.append({"ok": False, "warn": False, "id": "power_too_high",
+                        "banner": messages.banner_power_too_high(),
+                        "text": messages.row_power_too_high(
+                            _cw.facts, _cw.over_rating, shadow=self.shadow)})
+        elif _cw.active:
+            # SAFETY-40: the integrator bound alone is amber, not red.
+            out.append({"ok": False, "warn": True, "id": "not_keeping_up",
+                        "text": messages.row_not_keeping_up(
+                            _cw.bound_episodes)})
+            # No over-rating in THIS episode (`bug` would be set), so any count
+            # is from an earlier one: keep that software-fault evidence shown.
+            if _cw.over_rating:
+                out.append({"ok": False, "warn": True, "id": "power_too_high",
+                            "text": messages.row_before(
+                                messages.T_OUTPUT_CLAMP, _cw.over_rating)})
+        else:
+            if _cw.over_rating:
+                out.append({"ok": False, "warn": True, "id": "power_too_high",
+                            "text": messages.row_before(
+                                messages.T_OUTPUT_CLAMP, _cw.over_rating)})
+            if _cw.bound_episodes:
+                out.append({"ok": False, "warn": True, "id": "not_keeping_up",
+                            "text": messages.row_before(
+                                messages.T_LOOP_BOUND, _cw.bound_episodes)})
 
         for inv in self.inverters:
             if inv.last_write_ok is False:
-                tag = "" if len(self.inverters) == 1 else f" ({inv.name})"
-                out.append({"ok": False, "warn": False,
-                            "text": f"last write to the inverter{tag} was "
-                                    f"REJECTED - check the log"})
+                out.append({"ok": False, "warn": False, "id": "write",
+                            "text": messages.row_write_refused(
+                                None if len(self.inverters) == 1
+                                else inv.name)})
 
         # SAFETY-02. Reported in both states: a watchdog nobody can see is armed
         # is a watchdog nobody trusts when it fires.
@@ -4888,7 +6392,7 @@ class Controller:
         # inverter's own power sensor. `sign_wd.against` is the same string the
         # trip sentence uses, so the two cannot drift apart.
         for inv in self.inverters:
-            tag = "" if len(self.inverters) == 1 else f" [{inv.name}]"
+            unit = None if len(self.inverters) == 1 else inv.name
             # ⚠️ ADDED ONLY WHEN THERE IS SOMETHING TO DISAMBIGUATE. At the
             # shipped roster of one the two sentences below are the ones that
             # have always been on the page, word for word - AC 8 is about what
@@ -4897,25 +6401,16 @@ class Controller:
             # somebody has learned to recognise. At N>=2 the noun is load-
             # bearing: the row would otherwise send them to look at P1 for a
             # fault that is visible only on one inverter's own power sensor.
-            vs = ("" if len(self.inverters) == 1
-                  else f" against {inv.sign_wd.against}")
+            # UX-08: at N>=2 `unit` is set, and the row says "its own power".
+            # The figures stay in `sign_wd.reason`, on the log and event list.
             if inv.sign_wd.tripped:
-                what = ("the meter" if len(self.inverters) == 1
-                        else inv.sign_wd.against)
-                out.append({"ok": False, "warn": False,
-                            "text": f"SIGN-DISAGREEMENT FAILSAFE{tag} - "
-                                    + inv.sign_wd.reason
-                                    + f". The inverter is held at 0 W. Find out why the "
-                                      f"command opposed {what} before starting control "
-                                      "again; starting clears this. Restarting the "
-                                      "add-on does NOT clear it."})
+                out.append({"ok": False, "warn": False, "id": "direction",
+                            "text": messages.row_direction_trip(unit)})
             else:
                 held = inv.sign_wd.held_s(datetime.now(timezone.utc))
-                out.append({"ok": True, "warn": False,
-                            "text": f"sign watchdog{tag}: armed{vs} (trips after "
-                                    f"{inv.sign_wd.cfg.hold_s:.0f} s opposed, both over "
-                                    f"{inv.sign_wd.cfg.min_w:.0f} W)"
-                                    + (f" - opposed for {held:.0f} s now" if held else "")})
+                out.append({"ok": True, "warn": False, "id": "direction",
+                            "text": messages.row_direction_check(
+                                held, inv.sign_wd.cfg.hold_s, unit)})
 
         # --- SAFETY-30: the SITE row -----------------------------------------
         # ⚠️ ONLY AT N>=2, and the absence at N=1 is the honest report rather
@@ -4925,25 +6420,13 @@ class Controller:
         # operator learns to skim the list.
         if len(self.inverters) > 1:
             if self.site_sign_wd.tripped:
-                out.append({"ok": False, "warn": False,
-                            "text": "SITE SIGN-DISAGREEMENT FAILSAFE - "
-                                    + self.site_sign_wd.reason
-                                    + ". EVERY inverter is held at 0 W. This is the "
-                                      "SUM of the commands against the meter, so it is "
-                                      "not one inverter's fault to find - look at the "
-                                      "loop, the integrator and whatever won the "
-                                      "arbitration. Starting control clears this; "
-                                      "restarting the add-on does NOT."})
+                out.append({"ok": False, "warn": False, "id": "site_direction",
+                            "text": messages.row_site_direction_trip()})
             else:
                 _sheld = self.site_sign_wd.held_s(datetime.now(timezone.utc))
-                out.append({"ok": True, "warn": False,
-                            "text": f"site sign watchdog: armed against the sum of "
-                                    f"the commands (trips after "
-                                    f"{self.site_sign_wd.cfg.hold_s:.0f} s opposed, "
-                                    f"both over "
-                                    f"{self.site_sign_wd.cfg.min_w:.0f} W)"
-                                    + (f" - opposed for {_sheld:.0f} s now"
-                                       if _sheld else "")})
+                out.append({"ok": True, "warn": False, "id": "site_direction",
+                            "text": messages.row_site_direction_check(
+                                _sheld, self.site_sign_wd.cfg.hold_s)})
 
         # --- SAFETY-31 -----------------------------------------------------
         # ⚠️ SITE-LEVEL, WHERE THE ROWS ABOVE ARE PER-INVERTER, and the row says
@@ -4951,28 +6434,20 @@ class Controller:
         # here would invite the operator to clear "the other one".
         _circ = self.site_circulating_w
         if self.circ_wd.tripped:
-            out.append({"ok": False, "warn": False,
-                        "text": "CIRCULATING POWER - " + self.circ_wd.reason
-                                + ". EVERY inverter is held at 0 W. The meter "
-                                  "cannot see this fault, which is why nothing "
-                                  "else reported it. Starting control clears "
-                                  "this; restarting the add-on does NOT, and "
-                                  "neither does restarting Home Assistant."})
+            out.append({"ok": False, "warn": False, "id": "circulating",
+                        "text": messages.row_circulating_trip()})
         elif len(self.inverters) <= 1:
             # AC 5. At the shipped roster the quantity is identically zero for
             # every value of every reading, so "armed" would be a claim to be
             # watching something that cannot happen. Say what is true instead.
-            out.append({"ok": True, "warn": False,
-                        "text": "circulating power: n/a at one inverter - "
-                                "sum(|Bi|) - |sum(Bi)| is identically zero"})
+            out.append({"ok": True, "warn": False, "id": "circulating",
+                        "text": messages.row_one_inverter(
+                            messages.CHECK_CIRCULATING)})
         else:
             held = self.circ_wd.held_s(datetime.now(timezone.utc))
-            out.append({"ok": True, "warn": False,
-                        "text": "circulation watchdog: armed (trips after "
-                                f"{self.circ_wd.cfg.hold_s:.0f} s over "
-                                f"{self.circ_wd.cfg.min_w:.0f} W)"
-                                + (f" - now {_circ:.0f} W" if _circ else "")
-                                + (f", opposed for {held:.0f} s" if held else "")})
+            out.append({"ok": True, "warn": False, "id": "circulating",
+                        "text": messages.row_circulating_check(
+                            _circ, held, self.circ_wd.cfg.hold_s)})
 
         # --- SAFETY-42 -------------------------------------------------------
         # ⚠️ PER INVERTER, AND WARN RATHER THAN BAD, WHICH IS THE ONE PLACE THE
@@ -4985,50 +6460,35 @@ class Controller:
         # caution is what a fault nobody is acting on actually is.
         if len(self.inverters) > 1:
             for inv in self.inverters:
-                tag = f" ({inv.name})"
                 if inv.delivery_wd.tripped:
-                    out.append({"ok": False, "warn": True,
-                                "text": f"NOT DELIVERING{tag} - "
-                                        + inv.delivery_wd.reason
-                                        + ". Nothing has been commanded differently and "
-                                          "the rest of the roster is still regulating, "
-                                          "so the site is short by this unit's share. "
-                                          "Starting control clears this row; restarting "
-                                          "the add-on does NOT, and neither does "
-                                          "restarting Home Assistant."})
+                    out.append({"ok": False, "warn": True, "id": "delivery",
+                                "text": messages.row_not_delivering(inv.name)})
                 else:
                     _dheld = inv.delivery_wd.held_s(datetime.now(timezone.utc))
-                    out.append({"ok": True, "warn": False,
-                                "text": f"delivery watchdog{tag}: armed (reports after "
-                                        f"{inv.delivery_wd.cfg.hold_s:.0f} s short of "
-                                        f"its share by over "
-                                        f"{self.tuning.saturation_w:.0f} W, with a "
-                                        f"sibling that is not)"
-                                        + (f" - short for {_dheld:.0f} s now"
-                                           if _dheld else "")})
+                    out.append({"ok": True, "warn": False, "id": "delivery",
+                                "text": messages.row_delivery_check(
+                                    inv.name, _dheld,
+                                    inv.delivery_wd.cfg.hold_s)})
         else:
             # AC 5, and the same honesty `circulating power: n/a` uses one block
             # up. At one inverter the reduction this check is has no proper
             # subset to find, for EVERY input, so "armed" would be a claim to be
             # watching something that cannot happen.
-            out.append({"ok": True, "warn": False,
-                        "text": "delivery watchdog: n/a at one inverter - a unit "
-                                "short of its share is indistinguishable from a "
-                                "plant that cannot deliver until there is a "
-                                "sibling to compare it with"})
+            out.append({"ok": True, "warn": False, "id": "delivery",
+                        "text": messages.row_one_inverter("Delivery check")})
 
         if not o.get("estop_fitted", False):
-            out.append({"ok": False, "warn": True,
-                        "text": "no e-stop fitted: if this host dies the battery stays "
-                                "latched at its last command"})
+            out.append({"ok": False, "warn": True, "id": "estop",
+                        "text": messages.row_no_estop()})
         else:
-            out.append({"ok": True, "warn": False, "text": "e-stop fitted"})
+            out.append({"ok": True, "warn": False, "id": "estop",
+                        "text": messages.row_estop_fitted()})
 
         if not o.get("peak_forecast_entity"):
             # ok=False + warn=True renders as a caution, not a pass. A check that
             # is both is a check nobody reads.
-            out.append({"ok": False, "warn": True,
-                        "text": "no peak forecast: maintenance charging is not capacity-capped"})
+            out.append({"ok": False, "warn": True, "id": "peak_forecast",
+                        "text": messages.row_no_peak_forecast()})
         # --- TEL-11 ----------------------------------------------------------
         # ⚠️ NO ROW AT ALL WHEN THE ROSTER IS EMPTY, AND THAT IS A DELIBERATE
         # DIFFERENCE FROM THE PEAK-FORECAST CAUTION DIRECTLY ABOVE. That one
@@ -5044,82 +6504,64 @@ class Controller:
         # control path. The reason comes from `pv.watts()` rather than being
         # re-derived here, so the page cannot disagree with the reading.
         #
-        # --- TEL-12: AND AT A ROSTER OF ONE THESE TWO SENTENCES ARE 0.11.0's --
-        # ⚠️ THE `len(...) == 1` BRANCH IS 0.11.0's CODE UNCHANGED, DOWN TO THE
-        # f-string, so an install that set `pv_entity` reads the row it already
-        # reads. That is an ACCEPTANCE CRITERION rather than a courtesy, and it
-        # is graded across trees by `tools/tel11_pv_trace.py` rather than argued
-        # here: `pv.total()` passes a single entity's `why` through verbatim for
-        # exactly this reason. Multi-entity sentences are separate BECAUSE they
-        # have to say something the single-entity ones never could.
+        # TEL-12 kept 0.11.0's single-entity sentences word for word. UX-08
+        # replaced them on purpose (DECISIONS/UX-08-short-notifications.md), so
+        # a `tools/tel11_pv_trace.py` compare against a pre-UX-08 tree shows
+        # these rows as changed telemetry; the control documents stay equal.
         roster = self.pv_roster
         if roster:
-            if len(roster) == 1:
-                if self.pv_w is None:
-                    out.append({"ok": False, "warn": True,
-                                "text": f"PV production: no reading from "
-                                        f"{roster[0]} - {self.pv_why}"})
-                else:
-                    # habit 14: the value sits inside its own literal text, in
-                    # its own slot, beside the entity it was read from and the
-                    # unit it was read in - so a transposition of any two of the
-                    # three is visible in the sentence rather than merely
-                    # present in it.
-                    out.append({"ok": True, "warn": False,
-                                "text": f"PV production: {self.pv_w:.0f} W "
-                                        f"from {roster[0]} (reported "
-                                        f"in {self.pv_why})"})
+            # UX-08: sources are numbered in the order of the settings list,
+            # never named by entity id (STYLE.md). The per-source figures and
+            # units are what `pv.total()` returns; they stay in `pv_parts`.
+            flip = pv_read.inverted(self.o)
+            n_src = len(roster)
+            if self.pv_w is None and n_src == 1:
+                out.append({"ok": False, "warn": True, "id": "pv",
+                            "text": messages.row_pv_none(self.pv_why)})
             elif self.pv_w is None:
                 # ⚠️ THE ROW THAT SAYS THERE IS NO TOTAL, AND IT SAYS IT IN
-                # THOSE WORDS. `pv.total()`'s note is the argument; this is
-                # where the operator meets it. The partial information is NOT
-                # thrown away - every entity that reported is named with its
-                # watts and every one that did not is named with its reason -
-                # because this surface is read LIVE by a human who wants the
-                # diagnostic, whereas the MQTT row is read back COLD a week
-                # later by an attribution that would believe a smaller number.
-                # Different reader, different instant, different rule.
-                out.append({"ok": False, "warn": True,
-                            "text": "PV production: NO SITE TOTAL - "
-                                    + self.pv_why + ". Reporting: "
-                                    + (", ".join(
-                                        f"{ent} {watt:.0f} W"
-                                        for ent, watt, _y in self.pv_parts
-                                        if watt is not None) or "nothing")})
+                # THOSE WORDS - and which sources are missing, by position.
+                out.append({"ok": False, "warn": True, "id": "pv",
+                            "text": messages.row_pv_partial(
+                                [i + 1 for i, (_e, watt, _y)
+                                 in enumerate(self.pv_parts) if watt is None],
+                                n_src)})
             else:
-                # habit 14 at a roster: the total in its own slot, then EVERY
-                # contributor in its own slot with its own watts and its own
-                # unit. A sum that disagrees with the addends it is printed
-                # beside is visible in the sentence.
-                out.append({"ok": True, "warn": False,
-                            "text": f"PV production: {self.pv_w:.0f} W from "
-                                    f"{len(self.pv_parts)} entities ("
-                                    + ", ".join(
-                                        f"{ent} {watt:.0f} W in {why}"
-                                        for ent, watt, why in self.pv_parts)
-                                    + ")"})
+                out.append({"ok": True, "warn": False, "id": "pv",
+                            "text": messages.row_pv(
+                                self.pv_w, n_src,
+                                n_src == 1 and roster[0] in flip)})
             # ⚠️ AND WHEN BOTH KEYS ARE SET, WHICH ONE WON IS STATED. `pv.py`'s
             # `entities()` makes `pv_entities` REPLACE `pv_entity`, which is the
-            # right rule (its docstring says why) and is also the rule an
-            # operator upgrading from 0.11.0 is most likely to trip over: they
-            # add all their inverters to the new field and the old key is left
-            # standing, doing nothing. A replacement nobody is told about is the
-            # "one of which silently wins" `config.yaml` refuses elsewhere - and
-            # refusing to START over a telemetry key would be observability with
-            # a foot in the control path, so this is a CAUTION and never a `bad`
-            # row.
+            # rule an operator upgrading from 0.11.0 is most likely to trip
+            # over. A CAUTION and never a `bad` row: telemetry must not stop
+            # control.
             if pv_read.entity_is_ignored(self.o):
-                out.append({"ok": False, "warn": True,
-                            "text": "PV production: `pv_entities` is set, so "
-                                    "`pv_entity` is IGNORED - the "
-                                    f"{len(roster)} entities in the "
-                                    "list are what is summed. Clear "
-                                    "`pv_entity` to remove this caution"})
+                out.append({"ok": False, "warn": True, "id": "pv",
+                            "text": messages.row_pv_single_ignored()})
+            # TEL-14: a sign that looks reversed, per entity rather than on the
+            # total - see `pv.NEGATIVE_W` and DECISIONS/TEL-14-pv-sign.md §3.
+            for i, (ent, watt, _y) in enumerate(self.pv_parts):
+                if watt is not None and watt < pv_read.NEGATIVE_W:
+                    out.append({"ok": False, "warn": True, "id": "pv",
+                                "text": messages.row_pv_negative(
+                                    i + 1, n_src, watt, ent in flip)})
+            _inv_list = [str(x or "").strip()
+                         for x in (self.o.get("pv_invert_entities") or [])]
+            for ent in pv_read.stray_inverts(self.o):
+                out.append({"ok": False, "warn": True, "id": "pv",
+                            "text": messages.row_pv_stray(
+                                _inv_list.index(ent) + 1)})
         return out
 
-    def status_payload(self) -> dict:
+    def status_payload(self, lang: str = "en") -> dict:
         checks = self.checks()
         bad = [c for c in checks if not c["ok"] and not c["warn"]]
+        # SAFETY-87: a red row with `runs` (the peak alarms) is an alarm while
+        # control goes on, so it neither reads "Not ready" nor holds the page.
+        runs = [c for c in bad if c.get("runs")]
+        bad = [c for c in bad if not c.get("runs")]
+        running_alarm = False
         # --- SAFETY-10, AND IT IS FIRST IN THE CASCADE -----------------------
         # "The battery is NOT being controlled" is the one sentence on this
         # page that may never be displaced by another condition. A banner that
@@ -5144,9 +6586,7 @@ class Controller:
             # is the fault the operator has NO OTHER WAY of learning about: a
             # sign disagreement is visible at the meter and on every dashboard
             # in the house, and circulating power is visible nowhere at all.
-            level, banner = "bad", ("CIRCULATING POWER — the inverters were "
-                                    "pushing against each other. Site held at "
-                                    "0 W.")
+            level, banner = "bad", messages.banner_circulating()
         elif self.site_sign_wd.tripped and len(self.inverters) > 1:
             # SAFETY-30's site half, ABOVE the per-unit rows below and below
             # circulating power above, and the ordering is the same argument
@@ -5155,30 +6595,28 @@ class Controller:
             # inverter is parked and the fault is in what the site was asking
             # for, not in one device - naming a unit here would send an operator
             # to swap the wrong box.
-            level, banner = "bad", ("FAILSAFE — the site's total command "
-                                    "opposed the meter. Every inverter held at "
-                                    "0 W.")
+            level, banner = "bad", messages.banner_site_direction()
         elif any(i.sign_wd.tripped for i in self.inverters):
-            # Outranks "NOT READY": nothing is missing, something went wrong.
-            # ⚠️ THE SENTENCE IS UNCHANGED AT A ROSTER OF ONE, where "the meter"
-            # is what the unit was graded against. At N>=2 it is that unit's own
-            # power, so the banner says so - see checks() on why the noun is
-            # load-bearing rather than cosmetic.
-            level, banner = "bad", (
-                "FAILSAFE — the command opposed the meter. "
-                "Inverter held at 0 W." if len(self.inverters) == 1 else
-                "FAILSAFE — an inverter's command opposed its own measured "
-                "power. That inverter held at 0 W.")
+            # Outranks "Not ready": nothing is missing, something went wrong.
+            # At a roster of one the unit was graded against the meter; at N>=2
+            # against its own power, so the banner says so - see checks() on
+            # why the noun is load-bearing rather than cosmetic.
+            level, banner = "bad", messages.banner_direction(
+                len(self.inverters) > 1)
         elif bad:
             # ⚠️ `banner` IF THE ROW OFFERS ONE, `text` OTHERWISE. A row may
             # need to say more to an operator reading the checks list than fits
             # in the one line at the top of the page - SAFETY-25's floor-limited
             # row is the case that forced this - and a headline that is a full
             # paragraph, repeated verbatim by the row underneath it, is a
-            # headline nobody reads. Rows without the key are unaffected.
-            level, banner = "bad", f"NOT READY — {bad[0].get('banner') or bad[0]['text']}"
+            # headline nobody reads. UX-08: without the key, the banner takes
+            # the row's first sentence, so it stays a headline.
+            level, banner = "bad", messages.banner_not_ready(bad[0])
         elif not self.auto:
-            level, banner = "warn", "Stopped — inverter commanded to 0 W"
+            level, banner = "warn", messages.banner_stopped()
+        elif runs:
+            level, running_alarm = "bad", True
+            banner = runs[0].get("banner") or messages.headline(runs[0]["text"])
         elif any(i.delivery_wd.tripped for i in self.inverters):
             # ⚠️ SAFETY-42, AND IT IS A `warn` BANNER RATHER THAN A `bad` ONE,
             # WHICH IS THE WHOLE "reports, does not act" DECISION IN ONE LINE.
@@ -5193,12 +6631,8 @@ class Controller:
             # precisely the shape this whole card exists to remove. It sits
             # BELOW "Stopped" because a stopped site is the more urgent fact and
             # the banner carries one sentence.
-            _nd = ", ".join(i.name for i in self.inverters
-                            if i.delivery_wd.tripped)
-            level, banner = "warn", (
-                f"NOT DELIVERING — {_nd} is standing at a share it is not "
-                f"producing. The site is still running and short by it; "
-                f"nothing has been commanded differently.")
+            level, banner = "warn", messages.banner_not_delivering(
+                [i.name for i in self.inverters if i.delivery_wd.tripped])
         elif self.maint.phase != IDLE:
             # ⚠️ THE PACK IS NAMED ONLY WHEN THERE IS MORE THAN ONE. At a roster
             # of one this is the string it has always been, character for
@@ -5240,10 +6674,11 @@ class Controller:
             # question it answers is the one those two cannot: at "Grid 0 W,
             # Battery 0 W" the site is either becalmed or throwing away every
             # watt it makes, and only this row separates them.
-            *(() if not self.pv_roster else ((("PV", w(self.pv_w)),))),
-            ("State of charge", "—" if self.pack_floor_soc is None
+            *(() if not self.pv_roster else ((("Solar production",
+                                                w(self.pv_w)),))),
+            ("Battery level", "—" if self.pack_floor_soc is None
              else f"{self.pack_floor_soc:g} %"),
-            ("Commanded", w(self.target)),
+            ("Power request", w(self.target)),
             # SAFETY-10, and it sits BETWEEN the two rows it reconciles.
             # "Commanded 0 W" above and a "Why" below that explains a trade is
             # the exact pair an operator would otherwise have to guess at; this
@@ -5258,8 +6693,8 @@ class Controller:
                 # - the page runs on its own task and `self.peak_guard` has
                 # moved on. See `Controller.__init__`.
                 sized_from_meter=self.shadow_sized_from_meter,
-                reason=self.reason)),
-            ("Why", self.reason),
+                reason=self.why_words)),
+            ("Why", self.why_words),
             ("Maintenance phase", self.maint.phase if len(self.inverters) <= 1
              else f"{self.maint.phase} ({self.maint_unit.name})"),
             # ⚠️ ONLY WHEN A PACK IS ACTUALLY WAITING, so a one-inverter status
@@ -5295,22 +6730,51 @@ class Controller:
             # instead of inferring it, and separates "trading is off" from "no
             # decision was reached this cycle"; `cycle_at` and `arb_at` are what
             # make the second one an observation rather than a guess.
+            # OPT-11 P3: with battery modes on the modes trade, whatever the
+            # switch says, so the row reports their decision.
             ("Arbitrage", arbitrage_row(
-                on=arbitrage.enabled(self.o), decision=self.arb,
+                on=arbitrage.enabled(self.o) or self.modes_on,
+                decision=self.arb,
                 decided_at=self.arb_at, cycle_at=self.cycle_at,
-                now=datetime.now(timezone.utc), why=self.reason)),
+                now=datetime.now(timezone.utc), why=self.why_words)),
         ]
-        return {
+        held = level == "bad" and not running_alarm
+        out = {
             "banner": banner, "level": level, "rows": rows, "checks": checks,
-            "hint": self.events[0] if self.events else "",
+            "hint": self.hint,
+            # The action log itself, newest first. The page does not show it
+            # (UX-08 2d), but an installer can still read it in the `status`
+            # JSON, because several events (a dropped inverter's reason, the
+            # peak guard's projection) are written nowhere else.
+            "events": list(self.events),
         }
+        # UX-13 P1: the Home screen's structured half. Read-only, and it may
+        # never cost the page its rows: a fault here is logged and the old
+        # fields are served alone (the page then shows the installer details).
+        try:
+            out.update(homeview.build(self, level=level, checks=checks,
+                                      lang=lang, held=held))
+        except Exception:                               # noqa: BLE001
+            # Once per process at ERROR: the page polls every 3 s.
+            if not getattr(self, "_home_failed", False):
+                self._home_failed = True
+                _LOG.exception("Home view could not be built, so the page "
+                               "shows the plain status rows only")
+            else:
+                _LOG.debug("Home view failed again", exc_info=True)
+            out["home_error"] = True
+        return out
 
-    async def handle_action(self, what: str):
+    async def handle_action(self, what: str, *, unit=None, value=None):
         now = datetime.now(timezone.utc)
+        if what in ("pack_use", "pack_mode", "pack_sell"):
+            return self._pack_action(what, unit, value, now)
         if what == "auto_toggle":
             self.auto = not self.auto
             self.store.set("auto", self.auto)
-            self.log_event("control started" if self.auto else "control stopped")
+            self.log_event("control started" if self.auto else "control stopped",
+                           hint=messages.hint("control_started" if self.auto
+                                              else "control_stopped"))
             if self.auto:
                 # ⚠️ THE ONLY WAY OUT OF A SIGN-DISAGREEMENT TRIP, on purpose.
                 # It clears on a deliberate human start, not on the condition
@@ -5333,7 +6797,9 @@ class Controller:
                     inv.store_set("sign_tripped", False)
                     inv.store_set("sign_reason", "")
                     self.log_event(f"sign-disagreement failsafe cleared by "
-                                   f"operator on {inv.name}")
+                                   f"operator on {inv.name}",
+                                   hint=messages.hint("stop_cleared",
+                                                      unit=inv.name))
                 # ⚠️ AND THE PRE-DEV-02 FLAT KEYS GO WITH THEM, UNCONDITIONALLY.
                 # This is what makes `flat True + namespaced False` MEAN
                 # something, and it is the reason `_grade_store_migration()` can
@@ -5374,7 +6840,8 @@ class Controller:
                 # moment a second inverter was configured again.
                 if self.site_sign_wd.tripped:
                     self.log_event("site sign-disagreement failsafe cleared "
-                                   "by operator")
+                                   "by operator",
+                                   hint=messages.hint("site_stop_cleared"))
                 self.site_sign_wd.reset()
                 self.store.set("site_sign_tripped", False)
                 self.store.set("site_sign_reason", "")
@@ -5392,7 +6859,8 @@ class Controller:
                     self.circ_wd.reset()
                     self.store.set("circ_tripped", False)
                     self.store.set("circ_reason", "")
-                    self.log_event("circulating-power trip cleared by operator")
+                    self.log_event("circulating-power trip cleared by operator",
+                                   hint=messages.hint("site_stop_cleared"))
                 self._circ_announced = False
                 # SAFETY-42, cleared by the SAME press, and for a reason that is
                 # NOT the one above. The other three latches are cleared here
@@ -5410,7 +6878,10 @@ class Controller:
                 for inv in self.inverters:
                     if inv.delivery_wd.tripped:
                         self.log_event(f"not-delivering report on {inv.name} "
-                                       f"cleared by operator")
+                                       f"cleared by operator",
+                                       hint=messages.hint(
+                                           "not_delivering_cleared",
+                                           unit=inv.name))
                     inv.delivery_wd.reset()
                     inv.store_set("delivery_tripped", False)
                     inv.store_set("delivery_reason", "")
@@ -5436,19 +6907,104 @@ class Controller:
             # bare `maint_start` with no unit, and inventing a unit parameter
             # here would ship half a surface: the page would still have one
             # button and the API would have two meanings.
-            for msg in self._maint_button(now).force_start(now):
-                self.log_event(msg)
+            _m = self._maint_button(now)
+            for msg in _m.force_start(now):
+                self.log_event(msg, hint=messages.hint("maintenance",
+                                                       phase=_m.phase))
             return {"phase": self.maint.phase}
         if what == "maint_abort":
             # Aborts the pack that is actually cycling - `_maint_button()` again
             # - and then zeroes the SITE, which is what it always did.
-            for msg in self._maint_button(now).abort(now, "operator"):
-                self.log_event(msg)
+            _m = self._maint_button(now)
+            for msg in _m.abort(now, "operator"):
+                self.log_event(msg, hint=messages.hint("maintenance",
+                                                       phase=_m.phase))
             await self.command_site_zero()
             return {"phase": self.maint.phase}
         return None
 
 
+# SAFETY-61. Exit status when the control task dies; 70 is sysexits(3)
+# EX_SOFTWARE. See DECISIONS/SAFETY-61-control-task-death.md.
+EXIT_CONTROL_DIED = 70
+
+
+class ControlTaskDied(RuntimeError):
+    """The control task ended while nothing had asked it to stop."""
+
+
+def mode_announcement(opts, store) -> tuple:
+    """OPT-11 P2: `(modes, retract)` for the MQTT publisher at start-up.
+
+    The config topics announced are kept in the store, so turning modes off
+    removes exactly those (`mqtt.mode_configs()`). An install that never
+    turned modes on gets nothing, and its store is not written.
+    """
+    modes = packmode.MODES if packmode.enabled(opts) else ()
+    stored = store.data.get(MODE_CONFIGS_KEY)
+    keep, retract = mode_configs(roster_names(opts), modes, stored)
+    if keep and keep != stored:
+        store.set(MODE_CONFIGS_KEY, keep)
+    return modes, retract
+
+
+def control_task_done(task: asyncio.Task, *, controller, stop: asyncio.Event,
+                      died: list) -> None:
+    """Done-callback on the control task: log its death now and wake amain()
+    to wind down and exit (SAFETY-61, see its DECISIONS record)."""
+    if stop.is_set() or controller.stopping:
+        return          # the normal wind-down, or run_control()'s refusal path
+    exc = None if task.cancelled() else task.exception()
+    _LOG.critical("Control stopped unexpectedly (%s), so every inverter is "
+                  "set to 0 W and the add-on exits with code %d.",
+                  "cancelled" if task.cancelled() else
+                  (repr(exc) if exc else "returned"), EXIT_CONTROL_DIED,
+                  exc_info=exc)
+    died.append(exc)
+    stop.set()
+
+
+DOCS_LINK_TIMEOUT_S = 3
+
+
+async def docs_link_facts(session, token: str) -> dict:
+    """`{slug, ha_version}` from the Supervisor, each None when unreadable.
+
+    `GET /addons/self/info` and `GET /info` are on the Supervisor's bypass
+    list for an add-on's own token, so they need no role (see selfconfig.py).
+    Asked together with a 3 s budget: a link may never hold up control start.
+    """
+    async def ask(url, field):
+        """`(value, why)`: the field, or None and a short reason (UX-09)."""
+        try:
+            async with session.get(url, timeout=DOCS_LINK_TIMEOUT_S, headers={
+                    "Authorization": f"Bearer {token}"}) as r:
+                body = await r.json(content_type=None)
+            data = body.get("data", body) if isinstance(body, dict) else {}
+            value = data.get(field) if isinstance(data, dict) else None
+            return value, (None if value else f"no {field} in its answer")
+        except Exception as err:  # noqa: BLE001 - a link, never a stop
+            # A timeout's own text is empty, so the type is always named.
+            text = str(err).strip()
+            return None, (f"{type(err).__name__}: {text}" if text
+                          else type(err).__name__)
+
+    (slug, why_slug), (ha, why_ha) = await asyncio.gather(
+        ask("http://supervisor/addons/self/info", "slug"),
+        ask("http://supervisor/info", "homeassistant"))
+    out = {"slug": slug, "ha_version": ha}
+    # ONE line, whatever happened: the link is a convenience, not a fault.
+    if slug and ha:
+        _LOG.info("Documentation link: add-on %s, Home Assistant %s", slug, ha)
+    else:
+        missed = [f"{what} ({why})" for what, why in
+                  (("add-on name", why_slug), ("Home Assistant version", why_ha))
+                  if why]
+        _LOG.info("Documentation link: the Supervisor gave no %s, so the "
+                  "link is guessed or left out.", " and no ".join(missed))
+    return out
+
+
 async def amain() -> None:
     opts = load_options()
     logging.basicConfig(
@@ -5480,6 +7036,12 @@ async def amain() -> None:
         except Exception as _e:  # noqa: BLE001
             _LOG.error("core api probe failed: %s", _e)
 
+        # UX-09: the Details link in every notification needs this add-on's
+        # slug and Home Assistant's version (see messages.docs_url()). Both
+        # are best effort: without them the link falls back to the hostname,
+        # or to naming the section only.
+        messages.set_site(**await docs_link_facts(session, _tok))
+
         # ⚠️ THE STARTUP GATE (CFG-01). Nothing below this line may run on a
         # configuration validate.py rejects - specs §1.5: a config the system
         # cannot honour is refused at startup, not survived at runtime.
@@ -5496,6 +7058,15 @@ async def amain() -> None:
             _dev_min, _dev_max, _ = await hass.limits(_sp)
             _LOG.info("setpoint device %s reports range %s…%s W", _sp, _dev_min, _dev_max)
         _problems = validate_startup_config(opts, _dev_min, _dev_max)
+        # UX-15: a new install names no inverter. When that is the ONLY
+        # refusal it serves the setup wizard in setup-only mode, which builds
+        # nothing that commands and returns when stopped. Any other refusal
+        # still exits 78 (DECISIONS/UX-15-setup-only-mode.md).
+        if _problems and setuponly.applies(opts, _problems):
+            await setuponly.serve(
+                opts, HomeAssistant(session, read_only=True), store,
+                port=INGRESS_PORT)
+            return
         if _problems:
             refuse(_problems)
             raise ConfigRefused(_problems)
@@ -5507,6 +7078,9 @@ async def amain() -> None:
         # took the control loop down with it.
         broker = None
         try:
+            # OPT-11 P2: each battery's switch and mode list, only while
+            # battery modes are on (`mode_announcement()`).
+            _modes, _retract = mode_announcement(opts, store)
             broker = await hass.mqtt_service()
             pub = MqttPublisher(
                 broker.get("host") if broker else None,
@@ -5526,6 +7100,8 @@ async def amain() -> None:
                 # is what `build_roster()` itself reads. At a roster of one this
                 # announces nothing new - see `announced_units()`.
                 units=roster_names(opts),
+                modes=_modes,
+                retract=_retract,
             )
         except Exception as err:  # noqa: BLE001
             _LOG.warning("MQTT unavailable (%s) - continuing without status entities", err)
@@ -5539,14 +7115,22 @@ async def amain() -> None:
 
         stop = asyncio.Event()
         controller = Controller(opts, hass, store, pub, stop=stop)
-        runner = await web.start(controller, port=8099)
+        if callable(getattr(pub, "bind", None)):
+            pub.bind(asyncio.get_running_loop(), controller.mqtt_command)
+        runner = await web.start(controller, port=INGRESS_PORT)
 
         loop = asyncio.get_running_loop()
         for sig in (signal.SIGTERM, signal.SIGINT):
             with contextlib.suppress(NotImplementedError):
                 loop.add_signal_handler(sig, stop.set)
 
-        tasks = [asyncio.create_task(controller.run_control())]
+        # SAFETY-61: the control task's death ends the process, after the
+        # wind-down below. See DECISIONS/SAFETY-61-control-task-death.md.
+        died: list = []
+        control = asyncio.create_task(controller.run_control())
+        control.add_done_callback(functools.partial(
+            control_task_done, controller=controller, stop=stop, died=died))
+        tasks = [control]
 
         # OPT-04. The tariff refresh runs as its OWN long-lived task, for the
         # reason P1 ingestion does and then some: `resolve_tariff()` may open an
@@ -5581,10 +7165,14 @@ async def amain() -> None:
         for task in tasks:
             task.cancel()
         for task in tasks:
+            if task is control and died:
+                continue            # already logged by control_task_done()
             with contextlib.suppress(asyncio.CancelledError):
                 await task
         await runner.cleanup()
         _LOG.info("stopped")
+        if died:
+            raise ControlTaskDied(died[0])
         # The late-arriving-device refusal from run_control(). Re-raised only
         # now, so the wind-down above still ran and the inverter is at 0 W.
         if controller.refused:
@@ -5603,6 +7191,9 @@ def main() -> None:
         # EX_CONFIG, so even a script reading the exit status can tell a bad
         # config from a bug.
         raise SystemExit(78)
+    except ControlTaskDied:
+        # No second traceback: control_task_done() logged it at the death.
+        raise SystemExit(EXIT_CONTROL_DIED)
 
 
 if __name__ == "__main__":
diff --git a/goodwe_controller/app/maintenance.py b/goodwe_controller/app/maintenance.py
index 44848e2..32fe91f 100644
--- a/goodwe_controller/app/maintenance.py
+++ b/goodwe_controller/app/maintenance.py
@@ -351,7 +351,7 @@ class Maintenance:
         the action log rather than watching nothing happen.
         """
         if blocked_by:
-            msg = (f"maintenance: forced start REFUSED on {self.name} - "
+            msg = (f"maintenance: {self.name} cannot start now, because "
                    f"{blocked_by}")
             _LOG.warning("%s", msg)
             return [msg]
@@ -378,10 +378,9 @@ class Maintenance:
         """
         if self._deferred != why:
             self._deferred = why
-            msg = (f"maintenance: {self.name} is due and is WAITING its turn - "
-                   f"{why}. It is idle under the control loop and will "
-                   f"recalibrate at the next start hour once the slot is free; "
-                   f"this is not a stalled phase.")
+            msg = (f"maintenance: {self.name} is due and waits its turn, "
+                   f"because {why}. It starts at the next start hour once the "
+                   f"other battery is done. This is not a stalled phase.")
             _LOG.info("%s", msg)
             events.append(msg)
         return events
diff --git a/goodwe_controller/app/messages.py b/goodwe_controller/app/messages.py
new file mode 100644
index 0000000..b40d730
--- /dev/null
+++ b/goodwe_controller/app/messages.py
@@ -0,0 +1,1232 @@
+"""Every Home Assistant notification this add-on raises, in plain words (UX-08).
+
+The rule is `STYLE.md` at the repository root; `test_messages.py` enforces it.
+Titles, bodies and severities live here and nowhere else, so `main.py` only
+decides WHEN to raise a notice and this file decides WHAT it says. The detail
+that used to fill the bodies is in DOCS.md, under "Notifications", one section
+per title; the body ends with a link to it.
+"""
+
+import os
+import re
+from dataclasses import dataclass
+from datetime import datetime
+
+# Severity (STYLE.md section 3). An ALARM may use up to three sentences so
+# that no action a person must take is lost; everything else gets one.
+ALARM, WARNING, INFO, RESOLVED = "alarm", "warning", "info", "resolved"
+
+DOCS_SECTION = "Notifications"
+
+
+def watts(value) -> str:
+    """`7412` -> `7 412 W`: a magnitude, grouped for reading, no sign."""
+    return f"{abs(float(value)):,.0f} W".replace(",", " ")
+
+
+def duration(seconds) -> str:
+    s = float(seconds)
+    if s < 120:
+        return f"{s:.0f} seconds"
+    return f"{s / 60:.0f} minutes"
+
+
+def names(items) -> str:
+    items = list(items)
+    if len(items) <= 1:
+        return "".join(items)
+    return ", ".join(items[:-1]) + " and " + items[-1]
+
+
+# The Details link (UX-09). Home Assistant 2026.2 added the built-in `app`
+# panel (core #157554, frontend #28245), whose add-on pages are
+# /config/app/<slug>/<tab>. 2026.5 dropped the old `hassio` panel, so
+# /hassio/addon/<slug>/<tab> is a 404 there; 2026.1 and older have only that
+# one. No path reaches the Documentation tab on both, so the link follows the
+# Home Assistant version, and an unknown version gets the current path.
+DOCS_PATH = "/config/app/{slug}/documentation"
+DOCS_PATH_OLD = "/hassio/addon/{slug}/documentation"
+APP_PANEL_SINCE = (2026, 2)
+_SLUG = re.compile(r"[a-z0-9]+_goodwe_controller")
+_site = {"slug": None, "ha": None}
+
+
+def set_site(slug=None, ha_version=None) -> None:
+    """What main.py read from the Supervisor at start: our slug, HA's version."""
+    _site["slug"] = slug if isinstance(slug, str) and _SLUG.fullmatch(slug) \
+        else None
+    _site["ha"] = ha_version if isinstance(ha_version, str) else None
+
+
+def ha_release(version) -> tuple | None:
+    """`"2026.9.1"` -> `(2026, 9)`; None when it cannot be read."""
+    m = re.match(r"(\d{4})\.(\d{1,2})\b", str(version or ""))
+    return (int(m.group(1)), int(m.group(2))) if m else None
+
+
+def addon_slug() -> str | None:
+    """This add-on's Supervisor slug, or None outside an add-on.
+
+    The Supervisor's own answer (`GET /addons/self/info`) first. Failing that,
+    the container hostname, which the Supervisor names after the slug with `_`
+    spelled `-` (`local-goodwe-controller`). Anything else gets no link rather
+    than a wrong one.
+    """
+    if _site["slug"]:
+        return _site["slug"]
+    host = os.environ.get("HOSTNAME", "")
+    if re.fullmatch(r"[a-z0-9]+-goodwe-controller", host):
+        return host.replace("-", "_")
+    return None
+
+
+def docs_url(slug: str, ha_version=None) -> str:
+    release = ha_release(ha_version)
+    old = release is not None and release < APP_PANEL_SINCE
+    return (DOCS_PATH_OLD if old else DOCS_PATH).format(slug=slug)
+
+
+def details(title: str) -> str:
+    where = f"section “{title}” under {DOCS_SECTION}"
+    slug = addon_slug()
+    if slug is None:
+        return f"Details: add-on documentation, {where}."
+    return (f"Details: [add-on documentation]({docs_url(slug, _site['ha'])}),"
+            f" {where}.")
+
+
+@dataclass(frozen=True)
+class Notice:
+    id: str
+    severity: str
+    title: str
+    body: str
+    section: str = ""   # the DOCS.md heading, when it is not the title itself
+
+    @property
+    def docs(self) -> str:
+        return self.section or self.title
+
+    def data(self) -> dict:
+        """The `persistent_notification.create` payload."""
+        return {"notification_id": self.id, "title": self.title,
+                "message": f"{self.body}\n\n{details(self.docs)}"}
+
+
+# --- the catalogue ----------------------------------------------------------
+# Each title below is also a DOCS.md heading (test_messages.py checks it).
+
+T_LOOP_BOUND = "Battery is not keeping up"
+T_OUTPUT_CLAMP = "Power request too high"
+T_PEAK_SATURATED = "Load too high for battery"
+T_PEAK_RESERVE = "Battery stopped limiting the peak"
+T_CIRCULATING = "Inverters working against each other"
+T_NOT_DELIVERING = "{unit} is not delivering"
+S_NOT_DELIVERING = "An inverter is not delivering"
+T_METER_FROZEN = "Meter reading may be stuck"
+
+ID_LOOP_BOUND = "goodwe_integrator_bound"
+ID_OUTPUT_CLAMP = "goodwe_output_clamp"
+ID_PEAK_SATURATED = "goodwe_peak_saturated"
+ID_PEAK_RESERVE = "goodwe_peak_soc_floor"
+ID_CIRCULATING = "goodwe_circulating_power"
+ID_NOT_DELIVERING = "goodwe_not_delivering_{slug}"
+ID_METER_FROZEN = "goodwe_meter_frozen"
+
+# Which limit cut a command (clamp.ClampResult.bound, plus the loop's own).
+# The setting is named by its label, "Inverter rating (W)".
+RATING = "the “Inverter rating” setting"
+LIMIT_WORDS = {
+    "max_w": RATING,
+    "device": "the inverter's own limit",
+    "max_w+device": f"{RATING} and the inverter's own limit",
+    "rating": RATING,
+}
+
+
+def loop_bound() -> Notice:
+    """SAFETY-40: the integrator bound. Normal in short bursts; not a fault."""
+    return Notice(ID_LOOP_BOUND, WARNING, T_LOOP_BOUND,
+                  "The battery gives less than asked, which is normal for a "
+                  "moment, but if it lasts, check it is on and not empty "
+                  "or full.")
+
+
+@dataclass(frozen=True)
+class Clamp:
+    """One command that was cut: what was asked, what was sent, and by what."""
+    unit: str | None
+    asked_w: float
+    sent_w: float
+    limit: str          # a key of LIMIT_WORDS
+
+
+def output_clamp(clamps, *, shadow: bool = False) -> Notice:
+    """SAFETY-03: a computed command above the limit. A software fault.
+
+    Asked comes before sent, always - reading them the other way round turns
+    the alarm backwards (test_clamp.py part 6). In shadow mode the cut command
+    never reached the inverter, so the text says "would have" (UX-09).
+    """
+    fault = "This is a software fault, so please report it to your installer."
+    if not clamps:
+        cut = ("would have been cut back" if shadow else "was cut back")
+        state = ("Shadow mode is on, so every inverter stays at 0 W." if shadow
+                 else "Control is still running.")
+        return Notice(ID_OUTPUT_CLAMP, ALARM, T_OUTPUT_CLAMP,
+                      f"The add-on asked for more power than {RATING} allows "
+                      f"and {cut}. {state} {fault}")
+    c = clamps[0]
+    who = f"For {c.unit}, the" if c.unit else "The"
+    others = [x.unit for x in clamps[1:] if x.unit]
+    sent = "would have sent" if shadow else "sent"
+    if others:
+        verb = "was" if len(others) == 1 else "were"
+        state = (f"{names(others)} would have been cut too, and shadow mode "
+                 f"keeps every inverter at 0 W." if shadow else
+                 f"{names(others)} {verb} cut too, and control is still "
+                 f"running.")
+    else:
+        state = ("Shadow mode is on, so the inverter stays at 0 W." if shadow
+                 else "Control is still running.")
+    return Notice(ID_OUTPUT_CLAMP, ALARM, T_OUTPUT_CLAMP,
+                  f"{who} add-on asked for {watts(c.asked_w)}, above "
+                  f"{LIMIT_WORDS.get(c.limit, RATING)}, and {sent} "
+                  f"{watts(c.sent_w)} instead. {state} {fault}")
+
+
+def peak_saturated(ceiling_w, *, shadow: bool = False) -> Notice:
+    """SAFETY-07: the battery gives all it can and the peak still goes up.
+
+    In shadow mode the battery gives nothing, so the text says what the add-on
+    would ask and that the peak may rise (UX-09).
+    """
+    act = "Switch off large loads in the next few minutes."
+    if shadow:
+        return Notice(ID_PEAK_SATURATED, ALARM, T_PEAK_SATURATED,
+                      f"The add-on would ask the battery for all it can give, "
+                      f"and this 15-minute period is heading over your "
+                      f"{watts(ceiling_w)} peak limit. Shadow mode is on, so "
+                      f"the battery gives nothing and this month's peak may "
+                      f"rise. {act}")
+    return Notice(ID_PEAK_SATURATED, ALARM, T_PEAK_SATURATED,
+                  f"The battery is giving all it can, but this 15-minute period "
+                  f"will still go over your {watts(ceiling_w)} peak limit and "
+                  f"raise this month's peak. {act} This is not a fault: the "
+                  f"load is more than the battery can supply.")
+
+
+def peak_reserve(ceiling_w, *, soc_unread: bool, floor_unknown: bool,
+                 packs=(), others: bool = False) -> Notice:
+    """SAFETY-24/25/32: the peak guard may not draw the battery any lower.
+
+    The last sentence is SAFETY-25 and must stay: the reserve binds the peak
+    guard only, and normal home use goes on drawing the battery below it.
+    `packs` names the batteries at their limit, only on a site with several.
+    `floor_unknown`: the floor the guard grades against is None, which at a
+    roster means some inverter's cut-out level is missing (the peak reserve
+    itself always has a value) - so the action names the cut-out level.
+    Both are named by their setting labels, "Peak reserve (%)" and "Battery
+    cut-out level (%)". `others`: the other batteries give all they can and
+    it is not enough (SAFETY-87), so the limit MAY be passed.
+    """
+    if soc_unread:
+        why = "The battery level cannot be read"
+        act = ("Switch off large loads, and check the “Battery level entity” "
+               "setting.")
+    elif floor_unknown:
+        why = "A battery cut-out level is not known"
+        act = ("Switch off large loads, and set “Battery cut-out level” for "
+               "each inverter.")
+    else:
+        why = (f"The battery of {names(packs)} is at its peak reserve" if packs
+               else "The battery is at its peak reserve")
+        act = "Switch off large loads, or lower the peak reserve."
+    if others:
+        return Notice(ID_PEAK_RESERVE, ALARM, T_PEAK_RESERVE,
+                      f"{why}, and the other batteries cannot keep this "
+                      f"15-minute period under your {watts(ceiling_w)} peak "
+                      f"limit alone. {act} Home use can still draw a battery "
+                      f"below its reserve, down to its cut-out level.")
+    return Notice(ID_PEAK_RESERVE, ALARM, T_PEAK_RESERVE,
+                  f"{why}, so this 15-minute period will go over your "
+                  f"{watts(ceiling_w)} peak limit and raise this month's peak. "
+                  f"{act} The reserve only applies to keeping the peak down: "
+                  f"normal home use can still draw the battery below it, down "
+                  f"to the battery cut-out level.")
+
+
+def circulating(discharging=(), charging=()) -> Notice:
+    """SAFETY-31: the inverters push power round each other. Control stopped."""
+    if discharging and charging:
+        what = (f"{names(discharging)} was giving power while "
+                f"{names(charging)} was charging, and your meter cannot see "
+                f"this.")
+    else:
+        what = ("One inverter was charging from another, and your meter "
+                "cannot see this.")
+    return Notice(ID_CIRCULATING, ALARM, T_CIRCULATING,
+                  f"{what} Every inverter is set to 0 W: if the grid power does "
+                  f"not change now, switch the inverters off at the isolator. "
+                  f"Control stays stopped, even after a restart, until you "
+                  f"start it on the add-on page once you know why.")
+
+
+def not_delivering(unit: str, slug: str) -> Notice:
+    """SAFETY-42: one inverter gives less than its share. Reports, never acts."""
+    return Notice(
+        ID_NOT_DELIVERING.format(slug=slug), ALARM,
+        T_NOT_DELIVERING.format(unit=unit),
+        f"{unit} gives less power than it is asked for, but nothing was "
+        f"changed and control keeps running. Check that {unit} is "
+        f"on and connected, that its battery is not empty or cold, and that "
+        f"nothing else controls it. A restart does not clear this: once you "
+        f"know why, stop and start control on the add-on page.",
+        section=S_NOT_DELIVERING)
+
+
+def meter_frozen(unchanged_s) -> Notice:
+    """SAFETY-18: the meter answers but its value does not move."""
+    return Notice(ID_METER_FROZEN, ALARM, T_METER_FROZEN,
+                  f"The meter has shown the same value for "
+                  f"{duration(unchanged_s)} while the add-on asks the "
+                  f"battery for full power. Control is still running and still "
+                  f"follows this reading. Check the meter, and if it is stuck, "
+                  f"stop control on the add-on page.")
+
+
+# --- the status page (UX-08 phase 2b) ----------------------------------------
+# The rows of the Commissioning list and the banner at the top of the add-on
+# page. `main.py` decides WHEN a row shows and its colour (ok / warn / bad);
+# these decide WHAT it says. A row is one sentence of at most 15 words; a red
+# row may use up to 3 sentences and 30 words. A banner is at most 12 words.
+# Rows never name a Home Assistant entity: they name the setting in words.
+# DOCS.md, "Status page", explains every row.
+
+NOT_READY = "Not ready"
+DOCS_STATUS = "Status page"
+
+
+def signed_watts(value) -> str:
+    """`-1200` -> `-1 200 W`: like `watts()`, but the sign is kept."""
+    return f"{float(value):,.0f} W".replace(",", " ")
+
+
+def seconds(value) -> str:
+    """Always in seconds, for a live count set against its limit."""
+    n = f"{float(value):.0f}"
+    return f"{n} second" if n == "1" else f"{n} seconds"
+
+
+# One token each, like a code, so the line keeps its length and stays greppable.
+NO_REASON_SAVED, NO_REASON_CODE = "REASON_NOT_SAVED", "REASON_WITHOUT_CODE"
+_REASON_CODE = re.compile(r"\b[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+\b")
+
+
+def reason_code(reason) -> str:
+    """UX-11: the code in a safety reason (`STALE_READING`), for the one plain
+    WARNING or ERROR line that reports it. The reason with its figures goes on
+    a DEBUG line beside it and into the action log. Saved reasons have always
+    opened with their code, so an old state file reads the same way."""
+    if not reason:
+        return NO_REASON_SAVED
+    m = _REASON_CODE.search(str(reason))
+    return m.group(0) if m else NO_REASON_CODE
+
+
+def times(n) -> str:
+    return "1 time" if int(n) == 1 else f"{int(n)} times"
+
+
+def count(n, noun, plural=None) -> str:
+    """`count(1, "price")` -> `1 price`, `count(3, "price")` -> `3 prices`."""
+    return f"{int(n)} {noun if int(n) == 1 else plural or noun + 's'}"
+
+
+def when(at) -> str:
+    """`27 Sep at 09:15`, as the page writes a moment. `at` is already in the
+    time zone the reader wants (the caller passes `price.brussels(t)`)."""
+    return f"{at.day} {at:%b} at {at:%H:%M}"
+
+
+def for_unit(unit) -> str:
+    """` for inverter-b` on a site with several inverters, else nothing."""
+    return f" for {unit}" if unit else ""
+
+
+def headline(text: str) -> str:
+    """The first sentence of a row, for the banner when the row has no own."""
+    first = re.split(r"(?<=[.!?])\s+(?=[A-Z0-9])", text.strip(), maxsplit=1)[0]
+    return first.rstrip(".")
+
+
+# Banners (the headline at the top of the page).
+def banner_not_ready(row: dict) -> str:
+    return f"{NOT_READY} — {row.get('banner') or headline(row['text'])}"
+
+
+def banner_circulating() -> str:
+    return "Inverters worked against each other. Every inverter is set to 0 W."
+
+
+def banner_site_direction() -> str:
+    return "Total power went the wrong way. All inverters at 0 W."
+
+
+def banner_direction(several: bool) -> str:
+    if several:
+        return "An inverter's own power went the wrong way. Set to 0 W."
+    return "The meter saw power go the wrong way. Inverter at 0 W."
+
+
+def banner_not_delivering(units) -> str:
+    units = list(units)
+    verb = "are" if len(units) > 1 else "is"
+    return f"{names(units)} {verb} not delivering. Control keeps running."
+
+
+def banner_stopped() -> str:
+    return "Stopped — the inverters are set to 0 W"
+
+
+def banner_setup_only() -> str:
+    """UX-15: setup-only mode, where the add-on serves the page and commands
+    nothing (app/setuponly.py)."""
+    return "Setup: nothing is controlled yet"
+
+
+def row_setup_only() -> str:
+    return "No inverter is named yet, so finish Setup and restart the add-on."
+
+
+def banner_shadow(latched: bool) -> str:
+    """SAFETY-10: first in the cascade, never displaced by another banner.
+
+    With a safety stop standing it goes red and says the stop outlasts shadow
+    mode. Each stop has its own red row below, which names it and says how it
+    clears.
+    """
+    if latched:
+        return ("Shadow mode: battery not controlled. A safety stop stays on, "
+                "see below.")
+    return "Shadow mode: the battery is not controlled. Inverters stay at 0 W."
+
+
+# Rows: control and the meter. "Control" is what the add-on does, as in
+# "start control" (STYLE.md section 4).
+def row_controller_starting() -> str:
+    return "Control: starting"
+
+
+def row_controller_ran(age_s) -> str:
+    return f"Control: last ran {seconds(age_s)} ago"
+
+
+def row_controller_stalled(age_s, veto_s) -> str:
+    return (f"Control has not run for {seconds(age_s)}. The control board "
+            f"sets the inverter to 0 W after {seconds(veto_s)}.")
+
+
+def row_meter_waiting(limit_s) -> str:
+    """UX-10: no reading yet since the start, and still inside the limit."""
+    return f"Meter: waiting for the first reading, limit {seconds(limit_s)}"
+
+
+def row_meter_stale(age_s, limit_s) -> str:
+    return (f"Meter: no reading for {seconds(age_s)}, limit "
+            f"{seconds(limit_s)}. The add-on log shows why.")
+
+
+def row_meter(net_w, age_s, rejected=0, unchanged_s=None) -> str:
+    return (f"Meter: {signed_watts(net_w)}, {seconds(age_s)} old"
+            + (f", {rejected} readings refused" if rejected else "")
+            + ("" if unchanged_s is None
+               else f", unchanged for {duration(unchanged_s)}"))
+
+
+def row_meter_frozen() -> str:
+    return (f"{T_METER_FROZEN}. Control still follows it. Check the meter, "
+            f"and stop control if it is stuck.")
+
+
+# Settings are named by their labels in translations/en.yaml.
+METER_SOURCE = "“Where the meter reading comes from”"
+
+FREEZE_OFF = {
+    "source": f"it needs {METER_SOURCE} set to HomeWizard local",
+    "rating": "“Inverter rating” is not set",
+    "range": "the inverter reports no usable power range",
+}
+
+
+def row_freeze_off(why: str) -> str:
+    """`why` is a key of FREEZE_OFF: why the stuck-meter check cannot run."""
+    return f"Stuck-meter check: off, {FREEZE_OFF[why]}"
+
+
+def row_freeze_on(hold_s, rail_w, own_limit: bool) -> str:
+    return (f"Stuck-meter check: alerts after {duration(hold_s)} unchanged "
+            f"above {watts(rail_w)}"
+            + (", the inverter's own limit" if own_limit else ""))
+
+
+# Rows: the peak guard.
+def row_peak_saturated(ceiling_w) -> str:
+    return (f"{T_PEAK_SATURATED}. Switch off large loads to stay under the "
+            f"{watts(ceiling_w)} peak limit.")
+
+
+def row_peak_reserve(ceiling_w, *, soc_unread: bool, floor_unknown: bool,
+                     packs=(), others: bool = False) -> str:
+    """SAFETY-24/25/32. The last sentence is SAFETY-25 and must stay.
+    `others`: as in `peak_reserve()` (SAFETY-87)."""
+    if soc_unread:
+        why = "Battery level cannot be read"
+    elif floor_unknown:
+        why = "A battery cut-out level is not set"
+    else:
+        why = (f"{names(packs)} battery at its peak reserve" if packs
+               else "Battery at its peak reserve")
+    if others:
+        return (f"{why}. The others cannot hold the {watts(ceiling_w)} peak "
+                f"limit alone. Home use still draws it lower, to the cut-out "
+                f"level.")
+    return (f"{why}, so the {watts(ceiling_w)} peak limit will be passed. Home "
+            f"use still draws the battery below it, down to the cut-out level.")
+
+
+def row_peak_guard_off() -> str:
+    """`meter_source` is off: the 15-minute average cannot be measured."""
+    return f"Peak guard: off, set {METER_SOURCE} to anything but off"
+
+
+def banner_peak_reserve() -> str:
+    return T_PEAK_RESERVE
+
+
+# Rows: the sensors and the inverter control.
+LABEL_SOC = "Battery level"
+LABEL_BATTERY = "Battery power"
+LABEL_GRID = "Grid power"
+
+
+def row_sensor(label, value, unit=None) -> str:
+    shown = f"{float(value):g} %" if label.startswith(LABEL_SOC) \
+        else signed_watts(value)
+    return f"{label}{for_unit(unit)}: {shown}"
+
+
+def row_sensor_unset(label, unit=None) -> str:
+    """The setting is "<label> entity" (e.g. "Grid power entity (W)")."""
+    return f"{label}{for_unit(unit)}: “{label} entity” is not set"
+
+
+def row_sensor_unusable(label, unit=None) -> str:
+    """SAFETY-56: it may be missing OR held back as stale; say both."""
+    return (f"{label}{for_unit(unit)}: no usable reading. The entity may be "
+            f"missing, or its reading is held back as too old. Check it in "
+            f"Developer Tools before replacing it.")
+
+
+def setpoint_label(unit=None) -> str:
+    """The label: "Setpoint entity" in the inverter list, else its long form."""
+    return "“Setpoint entity”" if unit else "“Inverter setpoint entity”"
+
+
+def row_control_unset(unit=None) -> str:
+    return f"Inverter control{for_unit(unit)}: {setpoint_label(unit)} is not set"
+
+
+def row_control_missing(unit=None) -> str:
+    return f"Inverter control{for_unit(unit)}: not found in Home Assistant"
+
+
+# Rows: whether each inverter can still be controlled (DEV-02). `name` is
+# always given: these rows came with the inverter list.
+def row_no_setpoint(name) -> str:
+    """Amber. The site refuses to run at part strength, so all stay at 0 W."""
+    return f"{name}: “Setpoint entity” is not set, so every inverter stays at 0 W"
+
+
+def row_not_controllable(name, held_s, limit_s) -> str:
+    """Red. The inverter is dropped and the others carry its share."""
+    return (f"{name} cannot be controlled. It refused every command for "
+            f"{seconds(held_s)}, so control leaves it out.")
+
+
+def row_commands_refused(name, held_s, limit_s) -> str:
+    """Amber. Refused, but not for long enough to be dropped yet."""
+    return (f"{name}: commands refused for {seconds(held_s)}, left out of "
+            f"control after {seconds(limit_s)}")
+
+
+def row_control(lo_w, hi_w, unit=None) -> str:
+    """The inverter's own range: charging below 0 W, giving power above it."""
+    head = f"Inverter control{for_unit(unit)}: ready"
+    if lo_w is None or hi_w is None or lo_w > 0 or hi_w < 0:
+        def w(v):
+            return "?" if v is None else signed_watts(v)
+        return f"{head}, from {w(lo_w)} to {w(hi_w)}"
+    if abs(float(lo_w)) == float(hi_w):
+        return f"{head}, up to {watts(hi_w)} each way"
+    return f"{head}, {watts(lo_w)} charging, {watts(hi_w)} giving"
+
+
+# Rows: the two loop alarms. The names are the notification titles, so the
+# row and the card always call the same thing by the same name (UX-07 item 1).
+def row_power_too_high(clamps, count, *, shadow: bool = False) -> str:
+    """In shadow mode nothing was sent, so it says "would send" (UX-09)."""
+    c = clamps[0] if clamps else None
+    head = f"{T_OUTPUT_CLAMP}{' in shadow mode' if shadow else ''}"
+    what = (f"asked {watts(c.asked_w)}{for_unit(c.unit)}, "
+            f"{'would send' if shadow else 'sent'} {watts(c.sent_w)}. Cut back"
+            if c else "cut back")
+    return (f"{head}: {what} {times(count)} since start. Software fault, "
+            f"please report it.")
+
+
+def banner_power_too_high() -> str:
+    return T_OUTPUT_CLAMP
+
+
+def row_not_keeping_up(count) -> str:
+    return f"{T_LOOP_BOUND}: {times(count)} since start"
+
+
+def row_before(title, count) -> str:
+    """After an episode clears: how often it happened, so the evidence stays."""
+    return f"{title}: {times(count)} since start, fine now"
+
+
+def row_write_refused(unit=None) -> str:
+    return (f"{unit or 'The inverter'} refused the last command. Check the "
+            f"add-on log.")
+
+
+# Rows: the direction checks (SAFETY-02/30).
+def row_direction_trip(unit=None) -> str:
+    """Per inverter. `unit` only at several inverters, graded on its own power."""
+    what = (f"{unit}'s own power went against what the add-on asked, so it is"
+            if unit else
+            "Grid power went against what the add-on asked, so the inverter is")
+    return (f"{what} set to 0 W. Find out why, then start control. A restart "
+            f"does not clear this.")
+
+
+def row_direction_check(held_s, hold_s, unit=None) -> str:
+    who = (f"Direction check for {unit}, against its own power" if unit
+           else "Direction check")
+    if held_s:
+        return f"{who}: opposite for {held_s:.0f} of {seconds(hold_s)}"
+    return f"{who}: on"
+
+
+def row_site_direction_trip() -> str:
+    return ("Grid power went against the add-on's total request, so every "
+            "inverter is set to 0 W. The cause is the total, not one inverter. "
+            "Only starting control clears this.")
+
+
+def row_site_direction_check(held_s, hold_s) -> str:
+    if held_s:
+        return (f"Site direction check: opposite for {held_s:.0f} of "
+                f"{seconds(hold_s)}")
+    return "Site direction check: on, against the meter"
+
+
+# Rows: circulating power (SAFETY-31) and delivery (SAFETY-42).
+def row_circulating_trip() -> str:
+    return ("Inverters worked against each other, so every inverter is set to "
+            "0 W. The meter cannot see this. Only starting control clears this.")
+
+
+CHECK_CIRCULATING = "Check for inverters working against each other"
+
+
+def row_circulating_check(now_w, held_s, hold_s) -> str:
+    if held_s:
+        return (f"{CHECK_CIRCULATING}: {watts(now_w or 0)} for {held_s:.0f} of "
+                f"{seconds(hold_s)}")
+    return (f"{CHECK_CIRCULATING}: on"
+            + (f", now {watts(now_w)}" if now_w else ""))
+
+
+def row_one_inverter(check: str) -> str:
+    return f"{check}: not needed with one inverter"
+
+
+def row_not_delivering(unit) -> str:
+    return (f"{unit} is not delivering, and only stopping and starting control "
+            f"clears this")
+
+
+def row_delivery_check(unit, short_s, hold_s) -> str:
+    if short_s:
+        return (f"Delivery check for {unit}: short for {short_s:.0f} of "
+                f"{seconds(hold_s)}")
+    return f"Delivery check for {unit}: on"
+
+
+def row_estop_fitted() -> str:
+    return "Emergency stop: fitted"
+
+
+def row_no_peak_forecast() -> str:
+    return ("No peak forecast set, so maintenance charging is not kept under "
+            "the peak limit")
+
+
+def row_peak_guard_waiting() -> str:
+    return "Peak guard: no decision yet, control has not run"
+
+
+def row_no_estop() -> str:
+    return ("No emergency stop fitted: if this computer fails, the battery "
+            "keeps its last command")
+
+
+# Rows: solar production (TEL-11/12/14). Sources are numbered in the order of
+# "Solar production entities, per inverter". The settings are named by their
+# labels in translations/en.yaml.
+PV_ONE = "“Solar production entity”"
+PV_REVERSED = "“Reversed-sign solar entities”"
+
+
+def source(n, of) -> str:
+    return "the entity" if of == 1 else f"source {n}"
+
+
+def pv_problem(why: str) -> str:
+    """`pv.watts()`'s reason, in plain words."""
+    w = str(why)
+    if w.startswith("no state"):
+        return "the entity is missing"
+    if w.startswith("entity is"):
+        return "the entity is unavailable"
+    if w.endswith("is not numeric"):
+        return "the reading is not a number"
+    if w.startswith("no unit"):
+        return "the entity has no unit"
+    if w.startswith("unit "):
+        return "the entity's unit is not a power unit"
+    return "the reading is not usable"
+
+
+def row_pv(total_w, count, reversed_=False) -> str:
+    return (f"Solar production: {signed_watts(total_w)}"
+            + (f" from {count} sources" if count > 1 else "")
+            + (", sign reversed" if reversed_ else ""))
+
+
+def row_pv_none(why) -> str:
+    return f"Solar production: no reading, {pv_problem(why)}"
+
+
+def row_pv_partial(missing, count) -> str:
+    """`missing` are the 1-based positions of the sources that did not report."""
+    which = names([str(n) for n in missing])
+    return (f"Solar production: no total, source{'s' if len(missing) > 1 else ''} "
+            f"{which} of {count} {'have' if len(missing) > 1 else 'has'} no "
+            f"reading")
+
+
+def row_pv_single_ignored() -> str:
+    return f"Solar production: clear {PV_ONE}, the per-inverter list replaces it"
+
+
+def row_pv_negative(n, count, value_w, flipped: bool) -> str:
+    fix = ("remove it from" if flipped else "add it to")
+    who = source(n, count)
+    return (f"Solar production: {who} reads {signed_watts(value_w)}, "
+            f"{fix} {PV_REVERSED}")
+
+
+def row_pv_stray(n) -> str:
+    return (f"Solar production: entry {n} of {PV_REVERSED} is not a solar "
+            f"entity in use")
+
+
+# Rows: this month's peak and the peak guard (UX-08 phase 2d). The detail
+# (the projection's reason, the store's state at start) is in the add-on log.
+def row_month_peak(peak_w, at, frac) -> str:
+    """`at` is the local start of the 15-minute period that set the peak."""
+    return (f"Month peak: {watts(peak_w)} on {at.day} {at:%b} at {at:%H:%M}, "
+            f"{frac * 100:.0f} % of the peak limit")
+
+
+def row_month_peak_none() -> str:
+    return "Month peak: none recorded yet this month"
+
+
+def row_month_peak_unreadable() -> str:
+    """The store did not answer. This is not a zero peak (TARIFF-01)."""
+    return "Month peak: cannot be read, so only the peak limit is used"
+
+
+def row_periods_measured(n) -> str:
+    """TARIFF-13's coverage figure. `n` is an int, or a text when unreadable."""
+    shown = n if isinstance(n, int) else "cannot be read"
+    return f"15-minute periods measured this month: {shown}"
+
+
+def row_peak_guard_idle(projected_w, limit_w, month_peak: bool) -> str:
+    """The projection first and the limit second (SAFETY-38's ordered pair)."""
+    limit = (f"this month's {watts(limit_w)} peak" if month_peak
+             else f"the {watts(limit_w)} peak limit")
+    return f"Peak guard: idle, heading for {watts(projected_w)}, under {limit}"
+
+
+def row_peak_guard_quiet() -> str:
+    return "Peak guard: idle"
+
+
+BLIND_WORDS = {
+    "no_block": "waiting for meter readings",
+    "gap": "meter readings have a gap",
+    "frozen": "meter reading is stuck",
+}
+
+
+def row_peak_guard_blind(why: str) -> str:
+    """`why` is a key of BLIND_WORDS. The battery may give power, not charge."""
+    return (f"Peak guard: {BLIND_WORDS[why]}, so the battery does not charge "
+            f"meanwhile")
+
+
+def row_peak_guard_on(floor_w, limit_w, *, shadow: bool = False) -> str:
+    if shadow:
+        return (f"Peak guard: would ask for {watts(floor_w)} to stay under "
+                f"{watts(limit_w)}")
+    return (f"Peak guard: asks the battery for {watts(floor_w)} to stay under "
+            f"{watts(limit_w)}")
+
+
+def row_battery_stuck(unit) -> str:
+    """SAFETY-37/56. A fact, not a verdict: the reading may be stuck, or the
+    battery may be refusing, and the add-on cannot tell which."""
+    return (f"{unit}: battery power reading stopped changing, so it is not used "
+            f"for now")
+
+
+def row_battery_refuses(unit, sign, probing) -> str:
+    """SAFETY-73. One inverter's battery refuses, the others take its share."""
+    way = "give" if sign > 0 else "take"
+    if probing:
+        return f"{unit}: testing if the battery will {way} power again"
+    return f"{unit}: the battery refuses to {way} power, the others take over"
+
+
+# The top of the page: why the battery does what it does (the "Why" line).
+WHY_WINNER = {
+    "loop": "Keeping the grid near zero",
+    "peak": "Keeping under the peak limit",
+    "arbitrage": "Trading on the price",
+    "maintenance": "Battery maintenance",
+    "failsafe": "Safety stop, power went the wrong way",
+    "sign_site": "Safety stop, total power went the wrong way",
+    "circulation": "Safety stop, inverters worked against each other",
+    "stopped": "Control is stopped",
+    "inputs missing": "A reading is missing",
+    "no claim was made": "Nothing asked for power",
+    # UX-10: the claim reasons main.why_key() can return for a safety or
+    # failsafe winner. test_messages.py part 7 finds every one in the code.
+    "sign disagreement": "Safety stop, power went the wrong way",
+    "unsplit": "The power could not be split, all at 0 W",
+    # SAFETY-52: the loop's two words for a battery that gives nothing.
+    "battery refuses": "The battery refuses to give power",
+    "battery probe": "Testing if the battery gives power again",
+    # SAFETY-73: a refusing inverter's own claim, closed or probing.
+    "refused": "A battery refuses power, the others take over",
+}
+WHY_LIMIT = {
+    "peak(quarter peak)": "the peak limit",
+    "peak(blind)": "no charging while the meter is unclear",
+    "peak(SoC floor)": "the peak reserve",
+    "supervised": RATING,
+    "device": "the inverter's own limit",
+    "pack": "the battery level",
+    "reserve": "the battery reserve",
+    "maintenance": "battery maintenance",
+    "charge": "battery maintenance",
+    "hold": "battery maintenance",
+    "refused": "a battery that refuses power",
+}
+
+
+def why(winner, target_w, bound_by=None, *, contradiction=False,
+        raised=False) -> str:
+    """`winner` is the arbiter's winning source, or its reason for the two
+    that share a source ("stopped", "inputs missing", "no claim was made").
+    `bound_by` is `Resolution.bound_by`, e.g. "peak(quarter peak)".
+    `raised` is True when that limit pushed the power UP (the peak limit
+    asking for more): then it did not hold anything back (OPT-11 P1 test F2).
+    """
+    if contradiction:
+        return "Two limits clash, so every inverter is set to 0 W"
+    out = f"{WHY_WINNER.get(winner, 'Other')}: {signed_watts(target_w)}"
+    if bound_by:
+        limit = WHY_LIMIT.get(bound_by) or WHY_LIMIT.get(
+            str(bound_by).split("(")[0], "another limit")
+        out += f", raised for {limit}" if raised else \
+            f", held back by {limit}"
+    return out
+
+
+def why_missing(what, limit_s) -> str:
+    """UX-11: past the hold, which reading is missing and what it does."""
+    return f"No usable {what} reading for over {seconds(limit_s)}: 0 W"
+
+
+def why_waiting(missing_s) -> str:
+    """A reading went missing a moment ago: control holds and waits."""
+    return f"A reading is missing for {seconds(missing_s)}, control waits"
+
+
+# The last thing that happened, shown under the buttons. The add-on keeps its
+# own technical record of each event (`Controller.events`); the page shows
+# these words instead. Every `log_event()` call names one (test_messages.py).
+HINTS = {
+    "control_started": "Control started",
+    "control_stopped": "Control stopped",
+    "settings_saved": "Settings saved, they apply after a restart",
+    "restart_requested": "Restart requested from the settings page",
+    "setup_only": "In setup, nothing is sent to any inverter",
+    "roster": "Inverter list read: {n} inverters",
+    "maint_history": "Maintenance history did not move over cleanly",
+    "stop_restored": "{unit}: an earlier safety stop is back, it stays at 0 W",
+    "battery_stuck": "{unit}: battery power reading stopped changing",
+    "battery_back": "{unit}: battery power reading is used again",
+    "battery_refuses": "The battery refuses to give power, the add-on asks 0 W",
+    "battery_gives": "The battery refusal ended, control asks for power again",
+    "unit_refuses": "{unit}: the battery refuses power, the others take over",
+    "unit_gives": "{unit}: the battery refusal ended, it is asked for power again",
+    "bad_value": "The add-on made an invalid power value, inverters set to 0 W",
+    "write_blocked": "{unit}: a power request was blocked, it is set to 0 W",
+    "all_blocked": "A power request was blocked, inverters set to 0 W",
+    "write_cut": "{unit}: " + T_OUTPUT_CLAMP.lower(),
+    "write_slow": "{unit}: the inverter answered too slowly, trying again",
+    "direction": "{unit}: power went the wrong way, it is set to 0 W",
+    "site_direction": "Total power went the wrong way, inverters set to 0 W",
+    "circulating": T_CIRCULATING + ", all set to 0 W",
+    "not_delivering": T_NOT_DELIVERING,
+    "peak_on": "Peak guard started",
+    "peak_off": "Peak guard idle",
+    "peak_blind": "Peak guard cannot read the meter well",
+    "peak_saturated": T_PEAK_SATURATED,
+    "peak_reserve": T_PEAK_RESERVE,
+    "meter_frozen": T_METER_FROZEN,
+    "power_too_high": T_OUTPUT_CLAMP,
+    "not_keeping_up": T_LOOP_BOUND,
+    "trade_charge": "Trading: charging while the price is low",
+    "trade_give": "Trading: giving power while the price is high",
+    "trade_off": "Trading: waiting for a better price",
+    "forecast_read": "Solar forecast read, the day plan uses it",
+    "forecast_none": "No solar forecast, so Leftover solar takes solar only",
+    "split": "The power split between inverters changed",
+    "clash": "Two limits clash, inverters set to 0 W",
+    "no_setpoint": "An inverter has no “Setpoint entity”, inverters stay at 0 W",
+    "unit_dropped": "{unit} left out of control, the others take its share",
+    "units_back": "Every inverter is back in control",
+    "unmet": "The inverters cannot give {w} of the power asked",
+    "unmet_gone": "The inverters can give all the power asked again",
+    "shadow_on": "Shadow mode on, inverters stay at 0 W",
+    "shadow_off": "Shadow mode off, the add-on controls the battery",
+    "shadow_decision": "Shadow mode: would ask the battery for {sw}",
+    "refused": "Settings refused, the add-on log shows why",
+    "inputs_missing": "A reading is missing, inverters set to 0 W",
+    "inputs_back": "All readings are back",
+    "stop_cleared": "{unit}: safety stop cleared by starting control",
+    "site_stop_cleared": "Safety stop cleared by starting control",
+    "not_delivering_cleared": "{unit}: not-delivering alarm cleared",
+    "maintenance": "Battery maintenance: {phase}",
+    "maint_paused": "Maintenance charging paused to stay under the peak limit",
+    "pack_on": "{unit}: battery switched on",
+    "pack_off": "{unit}: battery switched off, it is asked for 0 W",
+    "pack_mode": "{unit}: battery mode changed",
+    "pack_sell": "{unit}: selling switched",
+    "maint_off": "{unit}: maintenance stopped, the battery is switched off",
+    "maint_waits": "{unit} cannot give power now, so its monthly cycle waits",
+    "mode_fault": "{unit}: battery mode ignored because of a software fault",
+}
+
+
+# OPT-11: why a battery switch or mode change was refused (the page shows it).
+PACK_REFUSED = {
+    "off": "Battery modes are off. Turn on “Battery modes” first.",
+    "unit": "There is no battery with that name.",
+    "value": "That choice is not possible for this battery.",
+    # OPT-11 P3, owner decision 2026-09-29: selling is off for now.
+    "sell_off": "Selling is off for now.",
+    # OPT-11 P2: a Home Assistant command dropped before it reaches a battery.
+    "retained": "An old saved command is not used.",
+    "size": "That command is too long.",
+    "encoding": "That command is not plain text.",
+    "topic": "That is not a battery command.",
+}
+
+
+def pack_refused(why: str) -> str:
+    return PACK_REFUSED[why]
+
+
+def hint(key: str, **kw) -> str:
+    """The plain words for one event. `w` is formatted as watts, `sw` as
+    watts with their sign (positive gives power, negative charges)."""
+    if "w" in kw:
+        kw["w"] = watts(kw["w"])
+    if "sw" in kw:
+        kw["sw"] = signed_watts(kw["sw"])
+    return HINTS[key].format(**kw)
+
+
+def hint_samples() -> list:
+    """`(key, text)` for every hint, rendered, for the test."""
+    kw = {"n": 2, "unit": "inverter-b", "w": 1200, "sw": -1200,
+          "phase": "drain"}
+    return [(k, hint(k, **{f: kw[f] for f in kw if "{" + f + "}" in v}))
+            for k, v in HINTS.items()]
+
+
+RED, AMBER, GREEN = "bad", "warn", "ok"
+
+
+def status_samples() -> list:
+    """`(function name, colour, text)` for every row and banner, for the test.
+
+    The colour is the one main.py gives the row; a red row may use three
+    sentences. Banners are listed with the colour None.
+    """
+    clamp = [Clamp(None, 7412, 5000, "rating")]
+    return [
+        ("banner_not_ready", None, banner_not_ready(
+            {"text": row_meter_frozen()})),
+        ("banner_not_ready", None, banner_not_ready(
+            {"text": "x", "banner": banner_peak_reserve()})),
+        ("banner_circulating", None, banner_circulating()),
+        ("banner_site_direction", None, banner_site_direction()),
+        ("banner_direction", None, banner_direction(False)),
+        ("banner_direction", None, banner_direction(True)),
+        ("banner_not_delivering", None, banner_not_delivering(["inverter-b"])),
+        ("banner_peak_reserve", None, banner_peak_reserve()),
+        ("banner_power_too_high", None, banner_power_too_high()),
+        ("banner_shadow", None, banner_shadow(False)),
+        ("banner_setup_only", None, banner_setup_only()),
+        ("row_setup_only", AMBER, row_setup_only()),
+        ("banner_shadow", None, banner_shadow(True)),
+        ("row_controller_starting", GREEN, row_controller_starting()),
+        ("row_controller_ran", GREEN, row_controller_ran(2)),
+        ("row_controller_stalled", RED, row_controller_stalled(45, 30)),
+        ("row_meter_stale", RED, row_meter_stale(40, 10)),
+        ("row_meter_waiting", AMBER, row_meter_waiting(30)),
+        ("row_meter", GREEN, row_meter(-350, 2, 3, 340)),
+        ("row_meter_frozen", RED, row_meter_frozen()),
+        *(("row_freeze_off", AMBER, row_freeze_off(k)) for k in FREEZE_OFF),
+        ("row_freeze_on", GREEN, row_freeze_on(600, 4465, True)),
+        ("row_peak_saturated", RED, row_peak_saturated(5000)),
+        ("row_peak_guard_off", AMBER, row_peak_guard_off()),
+        ("row_peak_reserve", RED, row_peak_reserve(
+            5000, soc_unread=False, floor_unknown=False, packs=["inverter-b"])),
+        ("row_peak_reserve", RED, row_peak_reserve(
+            5000, soc_unread=False, floor_unknown=False, packs=["inverter-b"],
+            others=True)),
+        ("row_peak_reserve", RED, row_peak_reserve(
+            5000, soc_unread=True, floor_unknown=False)),
+        ("row_peak_reserve", RED, row_peak_reserve(
+            5000, soc_unread=False, floor_unknown=True)),
+        ("row_sensor", GREEN, row_sensor(LABEL_SOC, 54, "inverter-b")),
+        ("row_sensor", GREEN, row_sensor(LABEL_BATTERY, -1200.0, "inverter-b")),
+        ("row_sensor_unset", RED, row_sensor_unset(LABEL_GRID)),
+        ("row_sensor_unusable", RED, row_sensor_unusable(LABEL_BATTERY,
+                                                         "inverter-b")),
+        ("row_control_unset", RED, row_control_unset("inverter-b")),
+        ("row_control_missing", RED, row_control_missing("inverter-b")),
+        ("row_control", GREEN, row_control(-5000, 5000, "inverter-b")),
+        ("row_control_unset", RED, row_control_unset()),
+        ("row_no_setpoint", AMBER, row_no_setpoint("inverter-b")),
+        ("row_not_controllable", RED, row_not_controllable("inverter-b", 45,
+                                                           30)),
+        ("row_commands_refused", AMBER, row_commands_refused("inverter-b", 12,
+                                                             30)),
+        ("row_power_too_high", RED, row_power_too_high(clamp, 3)),
+        ("row_power_too_high", RED, row_power_too_high(
+            [Clamp("inverter-b", 6000, 4600, "max_w+device")], 12)),
+        ("row_power_too_high", RED, row_power_too_high((), 1)),
+        ("row_power_too_high", RED, row_power_too_high(
+            [Clamp("inverter-b", 6000, 4600, "max_w+device")], 12,
+            shadow=True)),
+        ("row_not_keeping_up", AMBER, row_not_keeping_up(48)),
+        ("row_before", AMBER, row_before(T_OUTPUT_CLAMP, 2)),
+        ("row_before", AMBER, row_before(T_LOOP_BOUND, 1)),
+        ("row_write_refused", RED, row_write_refused("inverter-b")),
+        ("row_direction_trip", RED, row_direction_trip()),
+        ("row_direction_trip", RED, row_direction_trip("inverter-b")),
+        ("row_direction_check", GREEN, row_direction_check(0, 60)),
+        ("row_direction_check", GREEN, row_direction_check(12, 60,
+                                                           "inverter-b")),
+        ("row_site_direction_trip", RED, row_site_direction_trip()),
+        ("row_site_direction_check", GREEN, row_site_direction_check(0, 60)),
+        ("row_site_direction_check", GREEN, row_site_direction_check(5, 60)),
+        ("row_circulating_trip", RED, row_circulating_trip()),
+        ("row_circulating_check", GREEN, row_circulating_check(1200, 20, 60)),
+        ("row_one_inverter", GREEN, row_one_inverter("Delivery check")),
+        ("row_not_delivering", AMBER, row_not_delivering("inverter-b")),
+        ("row_delivery_check", GREEN, row_delivery_check("inverter-b", 30, 120)),
+        ("row_delivery_check", GREEN, row_delivery_check("inverter-b", 0, 120)),
+        ("row_no_estop", AMBER, row_no_estop()),
+        ("row_estop_fitted", GREEN, row_estop_fitted()),
+        ("row_no_peak_forecast", AMBER, row_no_peak_forecast()),
+        ("row_peak_guard_waiting", AMBER, row_peak_guard_waiting()),
+        ("row_pv", GREEN, row_pv(3200, 2)),
+        ("row_pv", GREEN, row_pv(1800, 1, True)),
+        ("row_pv_none", AMBER, row_pv_none("no unit_of_measurement on the "
+                                           "entity - it cannot be read in watts")),
+        ("row_pv_partial", AMBER, row_pv_partial([2, 3], 3)),
+        ("row_pv_partial", AMBER, row_pv_partial([2], 2)),
+        ("row_pv_single_ignored", AMBER, row_pv_single_ignored()),
+        ("row_pv_negative", AMBER, row_pv_negative(2, 3, -1500, False)),
+        ("row_pv_negative", AMBER, row_pv_negative(1, 1, -1500, True)),
+        ("row_pv_stray", AMBER, row_pv_stray(2)),
+        ("banner_stopped", None, banner_stopped()),
+        ("row_control", GREEN, row_control(-4000, 5000, "inverter-b")),
+        ("row_month_peak", GREEN, row_month_peak(
+            4998, datetime(2026, 8, 12, 19, 15), 0.83)),
+        ("row_month_peak_none", GREEN, row_month_peak_none()),
+        ("row_month_peak_unreadable", AMBER, row_month_peak_unreadable()),
+        ("row_periods_measured", GREEN, row_periods_measured(120)),
+        ("row_periods_measured", GREEN, row_periods_measured("unreadable")),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, True)),
+        ("row_peak_guard_idle", GREEN, row_peak_guard_idle(1300, 2500, False)),
+        ("row_peak_guard_quiet", GREEN, row_peak_guard_quiet()),
+        *(("row_peak_guard_blind", AMBER, row_peak_guard_blind(k))
+          for k in BLIND_WORDS),
+        ("row_peak_guard_on", AMBER, row_peak_guard_on(1200, 2500)),
+        ("row_peak_guard_on", AMBER, row_peak_guard_on(1200, 2500,
+                                                       shadow=True)),
+        ("row_battery_stuck", AMBER, row_battery_stuck("inverter-b")),
+        ("row_battery_refuses", AMBER, row_battery_refuses("inverter-b", 1,
+                                                           False)),
+        ("row_battery_refuses", AMBER, row_battery_refuses("inverter-b", -1,
+                                                           False)),
+        ("row_battery_refuses", AMBER, row_battery_refuses("inverter-b", 1,
+                                                           True)),
+        ("row_circulating_check", GREEN, row_circulating_check(0, 0, 60)),
+    ]
+
+
+def samples() -> list:
+    """One rendering of every notice, with realistic values, for the test."""
+    return [
+        loop_bound(),
+        output_clamp([Clamp(None, 7412, 5000, "rating")]),
+        output_clamp(()),
+        output_clamp([Clamp("inverter-a", -3000, -2500, "device"),
+                      Clamp("inverter-b", 6000, 4600, "max_w+device")]),
+        output_clamp([Clamp(None, 7412, 5000, "rating")], shadow=True),
+        output_clamp((), shadow=True),
+        output_clamp([Clamp("inverter-a", -3000, -2500, "device"),
+                      Clamp("inverter-b", 6000, 4600, "max_w+device")],
+                     shadow=True),
+        peak_saturated(5000),
+        peak_saturated(5000, shadow=True),
+        peak_reserve(5000, soc_unread=False, floor_unknown=False),
+        peak_reserve(5000, soc_unread=False, floor_unknown=False,
+                     packs=["inverter-b"]),
+        peak_reserve(5000, soc_unread=False, floor_unknown=False,
+                     packs=["inverter-b"], others=True),
+        peak_reserve(5000, soc_unread=True, floor_unknown=False),
+        peak_reserve(5000, soc_unread=False, floor_unknown=True),
+        circulating(["inverter-a"], ["inverter-b"]),
+        circulating(),
+        not_delivering("inverter-b", "inverter_b"),
+        meter_frozen(600),
+        meter_frozen(90),
+    ]
+
+
+# --- refusals (UX-08 phase 2c) --------------------------------------------------
+# A refusal names a setting by its label on the Configuration tab and then by its
+# key, because an installer editing in YAML needs the key. The label is the
+# en.yaml name without its group prefix and unit; test_messages.py checks that.
+LABELS = {
+    "setpoint_entity": "Inverter setpoint entity",
+    "max_w": "Inverter rating",
+    "bms_soc_floor": "Battery cut-out level",
+    "capacity_kwh": "Usable battery capacity",
+    "inverters": "Inverter list",
+    "name": "Name",
+    "meter_source": "Where the meter reading comes from",
+    "meter_phases": "Number of phases",
+    "p1_host": "HomeWizard P1 address",
+    "meter_poll_s": "Time between meter reads",
+    "meter_max_age_s": "Reading too old after",
+    "meter_mqtt_topic": "MQTT topic",
+    "p1_import_entity": "Grid import entity",
+    "p1_export_entity": "Grid export entity",
+    "p1_net_entity": "Signed net power entity",
+    "p1_phase_net_entities": "Net entities per phase",
+    "peak_soc_floor": "Peak reserve",
+    "price_provider": "Dynamic price source",
+    "price_taxes_eur_kwh": "Distribution, levies and VAT",
+    "static_profile": "Fixed or day/night tariff",
+    "price_taxes_profile": "Day/night levies and VAT",
+    "price_formula": "Your own tariff formula",
+    "price_export_formula": "Your own injection formula",
+    "price_csv_path": "Price CSV file",
+    "price_now_entity": "Current price entity",
+    "price_avg_entity": "Average price entity",
+    "arbitrage_enabled": "Trade on the price spread",
+    "cycle_cost_threshold_eur": "Battery cycle cost",
+    "arbitrage_soc_floor": "Trading keeps at least",
+    "arbitrage_soc_ceiling": "Trading charges at most",
+    "maintenance_charge_w": "Recharge rate",
+    "sign_disagree_w": "Wrong-direction threshold",
+    "unit_sign_disagree_w": "Per-inverter wrong-direction threshold",
+    "slew_w": "Largest change per cycle",
+    "shadow_mode": "Shadow mode",
+    # UX-13: named by the settings page's warnings (validate.Note).
+    "integrator_max_w": "Catch-up limit",
+    "maintenance_discharge_w": "Draw-down rate",
+    "peak_cap_w": "Peak limit",
+    "peak_margin_w": "Margin below the peak limit",
+    "peak_forecast_entity": "15-minute demand forecast entity",
+    "meter_entity": "Grid power entity",
+    "soc_entity": "Battery level entity",
+    "batt_entity": "Battery power entity",
+    "pv_entity": "Solar production entity",
+    "pv_entities": "Solar production entities, per inverter",
+    "pv_forecast_entity": "Solar forecast, today",
+    "pv_forecast_tomorrow_entity": "Solar forecast, tomorrow",
+    "solar_trust_pct": "Trust in the forecast",
+    "p1_phase_import_entities": "Import entities per phase",
+    "p1_phase_export_entities": "Export entities per phase",
+}
+
+
+def shown(value) -> str:
+    """A setting's value inside a refusal: `'abc'`, `5`, or `empty` for a value
+    that is missing or blank, never Python's `None` (UX-08 2d)."""
+    if value is None or (isinstance(value, str) and not value.strip()):
+        return "empty"
+    return repr(value)
+
+
+def not_valid(option: str, err) -> str:
+    """A setting whose text does not parse, without the parser's own words:
+    `static_profile is not valid near character 6` (UX-08 2d)."""
+    pos = getattr(err, "pos", None)
+    if isinstance(pos, int):
+        return f"{option} is not valid near character {pos + 1}"
+    return f"{option} is not valid"
+
+
+# The units a formula's "units" field may name, as a reader writes them.
+UNIT_WORDS = {"c_eur_per_kwh": "c/kWh", "eur_per_kwh": "EUR/kWh"}
+
+
+def setting(key: str, unit: str = "") -> str:
+    """`max_w` -> `“Inverter rating” (max_w)`. For one inverter in a list it is
+    `“Inverter rating” for inverter-b (inverters.max_w)`, so the config panel
+    also shows the reason beside `inverters`, where that value is changed."""
+    if unit:
+        return f"“{LABELS[key]}” for {unit} (inverters.{key})"
+    return f"“{LABELS[key]}” ({key})"
diff --git a/goodwe_controller/app/modetrade.py b/goodwe_controller/app/modetrade.py
new file mode 100644
index 0000000..5453d91
--- /dev/null
+++ b/goodwe_controller/app/modetrade.py
@@ -0,0 +1,269 @@
+"""OPT-11 P3: each battery's role this tick, from its mode and the price runs.
+
+Pure: no I/O, no clock. main.py hands in the run plan (`priceruns`), each
+battery's state and the peak guard's answers, files each battery's range as
+its `mode` claim (P_MODE), and files the site trade as the `arbitrage` claim
+(P_ARBITRAGE), sized inside the modes (`size()`), only with battery modes on.
+With them off, `arbitrage.decide()` runs exactly as before.
+
+Roles (the page's Why line names them):
+  off      Off: [0, 0].
+  house    follows the house: charges from spare solar, gives power at any
+           hour (Solar first always; the other modes when there is no plan).
+  hold     Leftover solar / Cheap hours outside a give run: may charge from
+           spare solar, gives nothing, so its energy is kept for the run.
+  give     the same inside a give run: covers the house.
+  sell     inside the sell run, with selling on: gives its rating, to the
+           house first and the rest to the grid.
+  charge   inside the cheap run: charges from the grid.
+  rest     another battery charges from the grid, so this one may not charge
+           (the owner's 2026-09-27 answer 3: while one battery charges from the
+           grid the others cannot give power either; the allocator never
+           splits a target both ways).
+
+Rules that keep this safe (tests: test_modes_p3.py):
+  * every range holds 0 W (a mode may forbid a direction, never force one);
+  * a Solar first battery never charges from the grid;
+  * P4: with a day plan (`targets`), a Leftover solar battery charges from
+    the grid only up to its planned level, never above the ceiling; with
+    none it takes solar only (P3 option A). Cheap hours only fills to the
+    ceiling either way (`charge_to()`);
+  * grid charging needs a measured peak guard that is clear and a measured
+    headroom (SAFETY-45); the trade is sized to that headroom, whose aim is
+    `peak_cap_w - peak_margin_w` (SAFETY-79). It starts only at START_W or
+    more, and once the guard or the headroom stops it, it stays stopped for
+    the rest of that 15-minute period (`blocked`): a charge makes the other
+    batteries stop giving power, so a few watts of charge flipping on and
+    off would swing the house between them and the grid (measured on the
+    2026-09-09 replay: 13 flips in 4 minutes at a 3.5 kW house);
+  * selling needs selling on for that battery, the sell run, a price >= 0
+    now, and the battery above `arbitrage_soc_floor`; it stops there. The
+    peak guard never stops a sell (section 9.1: discharge is never capped);
+    it must only have measured the quarter;
+  * a battery out of a run (full, or at the floor) stays out until the run
+    ends, so the ceiling and the floor do not re-arm within one run;
+  * a battery that refuses a direction (SAFETY-52/73) takes no part in a
+    run in that direction: the refusal wins over the run;
+  * no grid charge while another battery drains for its monthly cycle
+    (`draining`, SAFETY-78): it would charge against the drain.
+"""
+
+from dataclasses import dataclass
+
+from .packmode import (CHEAP_HOURS, GRID_CHARGE_MODES, LEFTOVER_SOLAR,
+                       PLAN_CHARGE_MODES, SOLAR_FIRST)
+
+OFF, HOUSE, HOLD, GIVE, SELL, CHARGE, REST = (
+    "off", "house", "hold", "give", "sell", "charge", "rest")
+PRICE_MODES = (LEFTOVER_SOLAR, CHEAP_HOURS)
+
+# The smallest grid charge worth starting, in W. Under it the other batteries
+# would stop covering the house for less than they give.
+START_W = 500.0
+
+
+@dataclass(frozen=True)
+class Pack:
+    """One battery as this module needs it."""
+    name: str
+    use: bool
+    mode: str
+    sell: bool
+    rating_w: float
+    soc: float | None
+    capacity_kwh: float | None
+    live: bool = True
+    idle: bool = True           # not in a maintenance phase
+    refused: int = 0            # SAFETY-52/73: +1 refuses to give, -1 to charge
+
+
+@dataclass(frozen=True)
+class Tick:
+    ranges: dict                # name -> (lo, hi), only for idle batteries
+    roles: dict                 # name -> role
+    action: str | None          # "charge" | "sell" | None
+    ask_w: float                # signed site ask before sizing (0 if none)
+    why: str | None             # why no trade when a run is on, else None
+
+
+def _room_kwh(p: Pack, pct: float) -> float:
+    """kWh to `pct` (charging) or above it (selling); a battery with no
+    capacity set counts one hour at its rating, so a run is still sized."""
+    if p.capacity_kwh is None or p.soc is None:
+        return abs(p.rating_w) / 1000.0
+    return max(0.0, abs(pct - p.soc)) / 100.0 * float(p.capacity_kwh)
+
+
+def charge_to(p: Pack, ceiling_pct, targets=None):
+    """The level this battery may charge to from the grid, or None.
+
+    `targets` is the day plan (`dayplan.plan()`: name -> level), or None
+    when there is none (no forecast, stale, or not configured). With no plan
+    this is P3 option A exactly: Cheap hours to the ceiling, the others never.
+    With a plan, a Leftover solar battery charges only to its planned level
+    (the sun fills the rest); a battery the plan leaves out, Cheap hours only
+    included, gets the no-plan answer. Solar first never charges."""
+    if p.mode in GRID_CHARGE_MODES:
+        return float(ceiling_pct)
+    if targets is None or p.name not in targets \
+            or p.mode not in PLAN_CHARGE_MODES:
+        return None
+    t = targets[p.name]
+    return None if t is None else min(float(ceiling_pct), float(t))
+
+
+def chargers(packs, ceiling_pct, done=(), targets=None) -> list:
+    """Batteries that may charge from the grid in a cheap run: below the
+    level `charge_to()` allows them (P4: the day plan's)."""
+    out = []
+    for p in packs:
+        to = charge_to(p, ceiling_pct, targets)
+        if (to is not None and p.use and p.idle and p.live
+                and p.soc is not None and p.soc < to
+                and p.refused >= 0 and p.name not in done):
+            out.append(p)
+    return out
+
+
+def sellers(packs, floor_pct, done=()) -> list:
+    """Batteries that may sell in the sell run. Solar first never sells."""
+    return [p for p in packs
+            if p.use and p.idle and p.live and p.sell
+            and p.mode in PRICE_MODES
+            and p.soc is not None and p.soc > floor_pct
+            and p.refused <= 0 and p.name not in done]
+
+
+def energy(packs, floor_pct, ceiling_pct, done_charge=(), done_sell=(),
+           targets=None):
+    """`(charge_kwh, charge_kw, sell_kwh, sell_kw)` for `priceruns.plan()`.
+    With a day plan the charge is each battery's shortfall, so the cheap run
+    is only as long as the shortfall needs."""
+    ch = chargers(packs, ceiling_pct, done_charge, targets)
+    se = sellers(packs, floor_pct, done_sell)
+    return (sum(_room_kwh(p, charge_to(p, ceiling_pct, targets))
+                for p in ch),
+            sum(abs(p.rating_w) for p in ch) / 1000.0,
+            sum(_room_kwh(p, floor_pct) for p in se),
+            sum(abs(p.rating_w) for p in se) / 1000.0)
+
+
+def decide(runs, now, packs, *, charge_ok, sell_ok, trade_why, price_now,
+           headroom_w, floor_pct, ceiling_pct, house_w, charging_now=False,
+           blocked=False, done_charge=(), done_sell=(),
+           targets=None, draining=False) -> Tick:
+    """This tick's ranges, roles and site ask.
+
+    `runs` is the kept `priceruns.RunPlan` or None (no fresh prices).
+    `charge_ok` is True only when `TariffPlan.arbitrage()` allowed a trade
+    this tick with the MEASURED peak guard clear; `sell_ok` when it allowed
+    one with the guard measured (either state); else `trade_why` says why.
+    `headroom_w` is `peakguard.charge_headroom_w()` (None: unmeasured).
+    `house_w` is the measured house (grid + batteries), or None.
+    `charging_now` says last tick charged (then any headroom above 0 keeps
+    it going); `blocked` that the guard or the headroom stopped a charge in
+    this 15-minute period. `targets` is the day plan (`charge_to()`).
+    `draining` says a battery drains for its monthly cycle, so none may
+    charge from the grid (why "cycle").
+    """
+    plan_on = runs is not None and runs.on
+    in_cheap = plan_on and runs.cheap.holds(now) and runs.charge_useful()
+    in_give = plan_on and runs.give_at(now) is not None
+    in_sell = plan_on and runs.sell is not None and runs.sell.holds(now)
+
+    why = None
+    ch = chargers(packs, ceiling_pct, done_charge, targets) if in_cheap \
+        else []
+    if ch and draining:
+        ch, why = [], "cycle"
+    charging = False
+    if ch:
+        need = 0.0 if charging_now else START_W
+        if blocked:
+            why = "headroom"
+        elif not charge_ok:
+            why = trade_why
+        elif headroom_w is None or not headroom_w > need:
+            why = "headroom"
+        else:
+            charging = True
+    se = sellers(packs, floor_pct, done_sell) if in_sell and not charging \
+        else []
+    selling = False
+    if se:
+        if not sell_ok:
+            why = why or trade_why
+        elif price_now is None or price_now < 0.0 or house_w is None:
+            why = why or "negative"
+        else:
+            selling = True
+
+    ranges, roles = {}, {}
+    ch_names = {p.name for p in ch} if charging else set()
+    se_names = {p.name for p in se} if selling else set()
+    for p in packs:
+        r = abs(float(p.rating_w))
+        if not p.use:
+            role, lo, hi = OFF, 0.0, 0.0
+        elif p.name in ch_names:
+            role, lo, hi = CHARGE, -r, 0.0
+        elif charging:
+            # Another battery charges from the grid: this one may not charge
+            # (it would be grid charging too), and cannot give (one sign).
+            role, lo, hi = REST, 0.0, (r if p.mode == SOLAR_FIRST
+                                       or not plan_on or in_give else 0.0)
+        elif p.name in se_names:
+            role, lo, hi = SELL, -r, r
+        elif p.mode == SOLAR_FIRST or not plan_on:
+            role, lo, hi = HOUSE, -r, r
+        elif in_give:
+            role, lo, hi = GIVE, -r, r
+        else:
+            role, lo, hi = HOLD, -r, 0.0
+        roles[p.name] = role
+        if p.idle:
+            ranges[p.name] = (lo, hi)
+
+    if charging:
+        ask = -sum(abs(p.rating_w) for p in ch)
+        return Tick(ranges, roles, CHARGE, ask, None)
+    if selling:
+        ask = sum(abs(p.rating_w) for p in se) + max(0.0, float(house_w))
+        return Tick(ranges, roles, SELL, ask, None)
+    return Tick(ranges, roles, None, 0.0,
+                why if (in_cheap or in_sell) else None)
+
+
+def size(tick: Tick, bound, headroom_w) -> float:
+    """The site trade in W, inside what the batteries may place with their
+    modes (`bound` = main's loop bound) and, for a charge, the billed
+    quarter's headroom. 0.0 means no trade (a 0 W trade is a park order and
+    is never filed)."""
+    if tick.action is None or bound is None:
+        return 0.0
+    lo, hi = bound
+    if tick.action == CHARGE:
+        cap = min(-float(tick.ask_w), -float(lo),
+                  float(headroom_w) if headroom_w is not None else 0.0)
+        return -max(0.0, cap)
+    return max(0.0, min(float(tick.ask_w), float(hi)))
+
+
+def weights(roles: dict, base, target_w: float):
+    """Who carries the site target first (design 3.5). Selling: the sellers.
+    Giving power: batteries in a give run before Solar first. Charging from
+    the grid: only the chargers. Otherwise `base` unchanged. Comfort only;
+    the ranges above are the permission."""
+    names = sorted(roles)
+    first = None
+    if target_w > 0 and any(r == SELL for r in roles.values()):
+        first = {n for n in names if roles[n] == SELL}
+    elif target_w > 0 and any(r == GIVE for r in roles.values()):
+        first = {n for n in names if roles[n] in (GIVE, SELL)}
+    elif target_w < 0 and any(r == CHARGE for r in roles.values()):
+        first = {n for n in names if roles[n] == CHARGE}
+    if not first:
+        return base
+    w = {n: (1.0 if base is None else float(base.get(n, 1.0))) for n in names}
+    out = {n: (w[n] if n in first else 0.0) for n in names}
+    return out if any(v > 0.0 for v in out.values()) else base
diff --git a/goodwe_controller/app/mqtt.py b/goodwe_controller/app/mqtt.py
index 94fc13d..56d54cf 100644
--- a/goodwe_controller/app/mqtt.py
+++ b/goodwe_controller/app/mqtt.py
@@ -7,8 +7,10 @@ That separation is deliberate; observability must never be able to take down
 control.
 """
 
+import asyncio
 import json
 import logging
+import re
 
 try:
     import paho.mqtt.client as mqtt
@@ -375,7 +377,26 @@ def _payload(name, object_id, unique_id, state_topic, device,
     return cfg
 
 
-def discovery_payloads(units=(), omit=(), include=()) -> list:
+def unit_unique_id(slug: str, key: str) -> str:
+    """One unit's entity `unique_id` (also its config topic's middle part)."""
+    return f"{BASE}_unit_{slug}_{key}"
+
+
+def _unit_places(names):
+    """`(slug, device, prefix)` for each roster name, in order."""
+    slugs = unit_slugs(names)
+    for i, (name, slug) in enumerate(zip(names, slugs)):
+        # ⚠️ `i == 0` IS THE ASYMMETRY, IN ONE LINE. The first roster entry
+        # keeps the device it already has and carries its name in the ENTITY
+        # name instead; every later one gets its own device and does not.
+        # Either way HA composes device-name + entity-name into the same
+        # string, which is why `object_id` can be written once for both.
+        device = DEVICE if i == 0 else unit_device(name, slug)
+        prefix = f"{_title(name)} " if i == 0 else ""
+        yield slug, device, prefix
+
+
+def discovery_payloads(units=(), omit=(), include=(), modes=()) -> list:
     """Every `(topic, payload)` this add-on announces, in announcement order.
 
     Split out of `_announce()` so that the acceptance criterion can be graded as
@@ -389,6 +410,8 @@ def discovery_payloads(units=(), omit=(), include=()) -> list:
     the output here (`_payload()`'s note, and test_mqtt.py part 1 asserts an
     ordered LIST precisely because a re-order is a zero-byte edit that
     re-announces every entity on a live install).
+
+    `modes` (OPT-11 P2) is the battery modes offered, empty when they are off.
     """
     omit = set(omit)
     include = [k for k in include if k not in omit]
@@ -400,19 +423,10 @@ def discovery_payloads(units=(), omit=(), include=()) -> list:
             f"homeassistant/sensor/{BASE}_{key}/config",
             _payload(name, object_id, f"{BASE}_{key}", f"{BASE}/{key}",
                      DEVICE, unit, dev_class, state_class, icon)))
-    names = announced_units(units)
-    slugs = unit_slugs(names)
     site_slug = _slug(DEVICE["name"])
-    for i, (name, slug) in enumerate(zip(names, slugs)):
-        # ⚠️ `i == 0` IS THE ASYMMETRY, IN ONE LINE. The first roster entry
-        # keeps the device it already has and carries its name in the ENTITY
-        # name instead; every later one gets its own device and does not.
-        # Either way HA composes device-name + entity-name into the same
-        # string, which is why `object_id` below can be written once for both.
-        device = DEVICE if i == 0 else unit_device(name, slug)
-        prefix = f"{_title(name)} " if i == 0 else ""
+    for slug, device, prefix in _unit_places(announced_units(units)):
         for key, oid, label, unit, dev_class, state_class, icon in UNIT_SENSORS:
-            unique_id = f"{BASE}_unit_{slug}_{key}"
+            unique_id = unit_unique_id(slug, key)
             out.append((
                 f"homeassistant/sensor/{unique_id}/config",
                 _payload(prefix + label,
@@ -427,12 +441,135 @@ def discovery_payloads(units=(), omit=(), include=()) -> list:
             f"homeassistant/sensor/{BASE}_{key}/config",
             _payload(name, object_id, f"{BASE}_{key}", f"{BASE}/{key}",
                      DEVICE, unit, dev_class, state_class, icon)))
+    # OPT-11 P2: last, and only when battery modes are on.
+    out.extend(mode_payloads(units, modes))
     return out
 
 
+# --- OPT-11 P2: each battery's switch and mode, as HA entities ---------------
+# Announced only when battery modes are on, after every other row, so no
+# existing row moves. A command goes through Controller.handle_action(), the
+# page's /action path. DECISIONS/OPT-11-battery-modes.md has the record.
+#
+# The select's options are these labels, in `packmode.MODES` order. A new mode
+# (P3) is a new entry here and a new option at the end; no id changes.
+MODE_LABELS = {"solar_first": "Solar first", "leftover_solar": "Leftover solar",
+               "cheap_hours": "Cheap hours only"}         # OPT-11 P3
+USE_ON, USE_OFF = "ON", "OFF"
+# A longer command payload is refused before it is decoded.
+MAX_COMMAND_BYTES = 64
+# The store key holding the mode config topics last announced, so that turning
+# modes off can remove exactly those (an empty retained config) and an install
+# that never turned them on publishes nothing new.
+MODE_CONFIGS_KEY = "mqtt_mode_configs"
+_MODE_CONFIG_RE = re.compile(
+    rf"homeassistant/(select|switch)/{BASE}_unit_[a-z0-9_]+_(mode|use)/config")
+_COMMAND_RE = re.compile(rf"{BASE}/unit/([a-z0-9_]+)/(mode|use)/set")
+# (entity key, HA component, entity name, icon)
+MODE_ENTITIES = [
+    ("mode", "select", "Mode", "mdi:battery-sync"),
+    ("use", "switch", "Use", "mdi:power"),
+]
+
+
+def mode_payloads(units, modes) -> list:
+    """The `(topic, payload)` for each battery's select and switch.
+
+    Every roster entry gets them, also at a roster of one. The device rule is
+    TEL-07's: the first battery's rows go on the site device with its name in
+    front, each later battery's on its own device. Empty when `modes` is empty.
+    """
+    if not modes:
+        return []
+    site_slug = _slug(DEVICE["name"])
+    options = [MODE_LABELS[m] for m in modes]
+    out = []
+    for slug, device, prefix in _unit_places([str(u) for u in units]):
+        for key, component, label, icon in MODE_ENTITIES:
+            unique_id = unit_unique_id(slug, key)
+            state = f"{BASE}/{unit_state_key(slug, key)}"
+            cfg = {
+                "name": prefix + label,
+                "object_id": f"{site_slug}_{slug}_{key}",
+                "unique_id": unique_id,
+                "state_topic": state,
+                "command_topic": f"{state}/set",
+            }
+            if component == "select":
+                cfg["options"] = options
+            else:
+                cfg["payload_on"] = USE_ON
+                cfg["payload_off"] = USE_OFF
+            # HA sends commands unretained; a retained one is ignored anyway.
+            cfg["retain"] = False
+            cfg["availability_topic"] = AVAILABILITY
+            cfg["device"] = device
+            cfg["icon"] = icon
+            out.append((f"homeassistant/{component}/{unique_id}/config", cfg))
+    return out
+
+
+def mode_retractions(stored, current) -> list:
+    """Config topics announced before and not now: each gets an empty
+    retained config, which removes the entity from HA. Anything in the store
+    that is not one of our mode config topics is ignored."""
+    if not isinstance(stored, list):
+        return []
+    keep = set(current)
+    return list(dict.fromkeys(t for t in stored if isinstance(t, str)
+                              and _MODE_CONFIG_RE.fullmatch(t)
+                              and t not in keep))
+
+
+def mode_configs(units, modes, stored) -> tuple:
+    """`(keep, retract)` at start-up: the mode config topics to store, and the
+    ones to remove now. A removal stays in `keep`, so a start with no broker
+    does not forget it; resending an empty config is harmless."""
+    current = [t for t, _ in mode_payloads(units, modes)]
+    retract = mode_retractions(stored, current)
+    return current + retract, retract
+
+
+def parse_command(topic, payload, retained, modes):
+    """`(slug, action, value, reject)` for one message on a command topic.
+
+    `action` is `pack_use` or `pack_mode`. `value` is what /action would be
+    sent: a bool for the switch, a mode key for the select, or None for a
+    payload that is neither (the store path then refuses it). `reject` is a
+    reason when the message is dropped here: replayed by the broker (retained),
+    too long, not UTF-8, or not a command topic.
+    """
+    m = _COMMAND_RE.fullmatch(topic) if isinstance(topic, str) else None
+    if m is None:
+        return None, None, None, "topic"
+    slug, key = m.group(1), m.group(2)
+    action = "pack_use" if key == "use" else "pack_mode"
+    if retained:
+        return slug, action, None, "retained"
+    if not isinstance(payload, (bytes, bytearray)) \
+            or len(payload) > MAX_COMMAND_BYTES:
+        return slug, action, None, "size"
+    try:
+        text = bytes(payload).decode("utf-8")
+    except UnicodeDecodeError:
+        return slug, action, None, "encoding"
+    if key == "use":
+        value = {USE_ON: True, USE_OFF: False}.get(text)
+    else:
+        value = next((k for k in modes if MODE_LABELS.get(k) == text), None)
+    return slug, action, value, None
+
+
 class MqttPublisher:
+    # OPT-11 P2. Class defaults, so a publisher built without them (and every
+    # test fixture that builds one with __new__) behaves as before.
+    modes = ()
+    retract = ()
+    _loop = None
+    _handler = None
+
     def __init__(self, host, port, username=None, password=None, omit=(),
-                 units=(), include=()):
+                 units=(), include=(), modes=(), retract=()):
         # `omit` drops sensor keys from discovery entirely. ⚠️ Announcing a
         # sensor that nothing will ever publish to is not harmless here:
         # p1_sample_age_s is a watchdog input, and an entity that exists but is
@@ -448,6 +585,10 @@ class MqttPublisher:
         # second reading of the option. Defaults to empty, so a caller that has
         # not been taught about it announces exactly what it announced before.
         self.include = [str(k) for k in include]
+        # OPT-11 P2: the modes offered (empty when battery modes are off), and
+        # the mode config topics to remove (`mode_retractions()`).
+        self.modes = tuple(modes)
+        self.retract = [str(t) for t in retract]
         self.enabled = mqtt is not None and bool(host)
         self.client = None
         if not self.enabled:
@@ -470,7 +611,8 @@ class MqttPublisher:
         # paho DROPS QoS-0 publishes when disconnected, silently. The result is
         # an add-on that logs "MQTT connected" and creates no entities at all.
         # As a bonus, this also re-announces after every reconnect.
-        self.client.on_connect = lambda *_args, **_kw: self._announce()
+        self.client.on_connect = lambda *_args, **_kw: self._on_connect()
+        self.client.on_message = self._on_message
         try:
             self.client.connect(host, int(port), keepalive=60)
             self.client.loop_start()
@@ -485,10 +627,35 @@ class MqttPublisher:
         # diffing what actually goes on the wire - and a payload built here
         # instead would be one this add-on publishes and no check has ever seen.
         for topic, cfg in discovery_payloads(self.units, self.omit,
-                                             self.include):
+                                             self.include, self.modes):
             self.client.publish(topic, json.dumps(cfg), retain=True)
+        for topic in self.retract:
+            self.client.publish(topic, "", retain=True)
         self.client.publish(AVAILABILITY, "online", retain=True)
 
+    def _on_connect(self) -> None:
+        self._announce()
+        if self.modes:
+            for key in ("mode", "use"):
+                self.client.subscribe(f"{BASE}/unit/+/{key}/set")
+
+    def bind(self, loop, handler) -> None:
+        """OPT-11 P2: hand each command to `handler(topic, payload, retained)`,
+        a coroutine function run on `loop` (the controller's)."""
+        self._loop, self._handler = loop, handler
+
+    def _on_message(self, _client, _userdata, msg) -> None:
+        # paho's network thread: nothing is done here but the handoff.
+        loop, handler = self._loop, self._handler
+        if loop is None or handler is None:
+            _LOG.debug("MQTT command before start-up ignored: %s", msg.topic)
+            return
+        try:
+            asyncio.run_coroutine_threadsafe(
+                handler(msg.topic, bytes(msg.payload), bool(msg.retain)), loop)
+        except RuntimeError as err:  # the loop has closed
+            _LOG.debug("MQTT command dropped: %s", err)
+
     def publish(self, values: dict) -> None:
         if not self.enabled or self.client is None:
             return
diff --git a/goodwe_controller/app/p1.py b/goodwe_controller/app/p1.py
index 6d23f34..5632aca 100644
--- a/goodwe_controller/app/p1.py
+++ b/goodwe_controller/app/p1.py
@@ -47,6 +47,11 @@ from datetime import datetime, timezone
 
 import aiohttp
 
+from . import messages
+from .hass import OUTAGE
+
+_S = messages.setting   # a refusal names the setting by its label (UX-08)
+
 try:
     import paho.mqtt.client as mqtt
 except ImportError:  # pragma: no cover - container always has it
@@ -180,7 +185,8 @@ def make_sample(source: str, import_w, export_w, *, phases: int,
     # already applied a sign we are about to apply again - reject it rather
     # than silently double-signing the control loop.
     if imp < 0 or exp < 0:
-        raise P1Error(f"unsigned registers cannot be negative (import={imp:g} export={exp:g})")
+        raise P1Error(f"import and export readings cannot be negative "
+                      f"(import={imp:g} export={exp:g})")
 
     per_phase = per_phase_import = None
     if phase_import_w is not None or phase_export_w is not None:
@@ -188,8 +194,8 @@ def make_sample(source: str, import_w, export_w, *, phases: int,
         pe = list(phase_export_w or [0.0] * len(pi))
         if len(pi) != phases or len(pe) != phases:
             raise P1Error(
-                f"phase count mismatch: telegram has {len(pi)} import / {len(pe)} export "
-                f"phases, meter_phases is {phases}")
+                f"the meter sent {len(pi)} import and {len(pe)} export phases, "
+                f"but {_S('meter_phases')} is {phases}")
         vals = [_watts(a, f"L{i + 1} import") - _watts(b, f"L{i + 1} export")
                 for i, (a, b) in enumerate(zip(pi, pe))]
         per_phase = tuple(vals)
@@ -467,7 +473,7 @@ class P1Ingest:
         """
         self.parse_errors += 1
         self.last_error = str(err)
-        _LOG.warning("P1 telegram rejected: %s", err)
+        _LOG.warning("A meter message could not be read: %s", err)
 
     # -- what consumers read -------------------------------------------------
     def age_s(self) -> float | None:
@@ -519,6 +525,16 @@ WS_URL = "ws://supervisor/core/websocket"
 BAD_STATES = ("unknown", "unavailable", "none", "")
 
 
+async def _receive_json(ws):
+    """The next JSON message. A socket Home Assistant closed (a restart) is a
+    ConnectionResetError, not aiohttp's "Received message 8:1000 is not str"."""
+    msg = await ws.receive()
+    if msg.type is not aiohttp.WSMsgType.TEXT:
+        raise ConnectionResetError(
+            f"Home Assistant closed the connection ({msg.type.name})")
+    return json.loads(msg.data)
+
+
 class HaDsmrSource:
     """Subscribes to state_changed for the configured DSMR entities.
 
@@ -569,8 +585,12 @@ class HaDsmrSource:
                 backoff = 1.0
             except asyncio.CancelledError:
                 raise
+            except (aiohttp.ClientError, ConnectionError) as err:
+                # UX-10: Home Assistant restarting, said once (hass.Outage).
+                OUTAGE.down("websocket", "the meter connection closed", err)
             except Exception as err:  # noqa: BLE001 - any transport fault retries
-                _LOG.warning("P1 HA websocket: %s - reconnecting in %.0fs", err, backoff)
+                _LOG.warning("The meter connection to Home Assistant failed "
+                             "(%s), trying again in %.0f s.", err, backoff)
             finally:
                 self.connected = False
             await asyncio.sleep(backoff)
@@ -578,16 +598,17 @@ class HaDsmrSource:
 
     async def _session_once(self) -> None:
         async with self.session.ws_connect(WS_URL, heartbeat=30) as ws:
-            hello = await ws.receive_json()
+            hello = await _receive_json(ws)
             if hello.get("type") == "auth_required":
                 await ws.send_json({"type": "auth", "access_token": self.token})
-                reply = await ws.receive_json()
+                reply = await _receive_json(ws)
                 if reply.get("type") != "auth_ok":
                     raise RuntimeError(f"auth rejected: {reply.get('message', reply)}")
             await ws.send_json({"id": 1, "type": "subscribe_events",
                                 "event_type": "state_changed"})
             await ws.send_json({"id": 2, "type": "get_states"})
             self.connected = True
+            OUTAGE.up("websocket")
             _LOG.info("P1 ingest: subscribed to %s", ", ".join(sorted(self.ids)))
 
             async for msg in ws:
@@ -613,7 +634,7 @@ class HaDsmrSource:
                     new = data.get("new_state") or {}
                     self._absorb(data.get("entity_id"), new.get("state"))
                     self._schedule()
-            raise RuntimeError("websocket closed")
+            raise ConnectionResetError("Home Assistant closed the connection")
 
     def _absorb(self, entity_id: str | None, state) -> None:
         if not entity_id or entity_id not in self.ids:
@@ -1160,37 +1181,37 @@ def validate_meter_options(opts: dict, phases: int, max_age_s: float) -> list[st
         exp = str(opts.get("p1_export_entity", "") or "").strip()
         if not imp or not exp:
             problems.append(
-                f"meter_source {SOURCE_HA} needs both p1_import_entity and "
-                f"p1_export_entity (got {imp or '<blank>'!r} / {exp or '<blank>'!r})")
+                f"{_S('meter_source')} is {SOURCE_HA!r}, so it needs "
+                f"{_S('p1_import_entity')} and {_S('p1_export_entity')}. They "
+                f"are {messages.shown(imp)} and {messages.shown(exp)}.")
     elif source == SOURCE_HA_SIGNED:
         net = str(opts.get("p1_net_entity", "") or "").strip()
         phase_net = [str(e).strip() for e in
                      (opts.get("p1_phase_net_entities") or []) if str(e).strip()]
         if not net:
             problems.append(
-                f"meter_source {SOURCE_HA_SIGNED} needs p1_net_entity "
-                "(sensor.p1_sample_age_s would otherwise be announced with "
-                "nothing feeding it)")
+                f"{_S('meter_source')} is {SOURCE_HA_SIGNED!r}, so it needs "
+                f"{_S('p1_net_entity')}.")
         if phase_net and len(phase_net) != phases:
             problems.append(
-                f"p1_phase_net_entities has {len(phase_net)} entities but "
-                f"meter_phases is {phases} - every telegram would be rejected "
-                "on the phase-count check")
+                f"{_S('p1_phase_net_entities')} has {len(phase_net)} entities, "
+                f"but {_S('meter_phases')} is {phases}. Make them match.")
     elif source == SOURCE_MQTT:
         if not str(opts.get("meter_mqtt_topic", "") or "").strip():
-            problems.append(f"meter_source {SOURCE_MQTT} needs meter_mqtt_topic")
+            problems.append(f"{_S('meter_source')} is {SOURCE_MQTT!r}, so it "
+                            f"needs {_S('meter_mqtt_topic')}.")
     elif source == SOURCE_HOMEWIZARD:
         host, port_s = homewizard_host_port(opts)
         if not host:
             problems.append(
-                f"meter_source {SOURCE_HOMEWIZARD} needs p1_host (the meter's "
-                "own address, e.g. 192.168.2.250)")
+                f"{_S('meter_source')} is {SOURCE_HOMEWIZARD!r}, so it needs "
+                f"{_S('p1_host')}, the meter's address on your network.")
         if port_s:
             try:
                 int(port_s)
             except ValueError:
-                problems.append(f"p1_host {opts.get('p1_host')!r} has an "
-                                "unparseable port")
+                problems.append(f"{_S('p1_host')} is {messages.shown(opts.get('p1_host'))}, and "
+                                "its port is not a number.")
         try:
             # ⚠️ Not `or 5`: that turns an explicit 0 into the default, and a
             # cadence of 0 is a misconfiguration that must be reported, not
@@ -1198,23 +1219,26 @@ def validate_meter_options(opts: dict, phases: int, max_age_s: float) -> list[st
             raw = opts.get("meter_poll_s", 5)
             poll_s = float(5 if raw is None or raw == "" else raw)
         except (TypeError, ValueError):
-            problems.append(f"meter_poll_s {opts.get('meter_poll_s')!r} is not a number")
+            problems.append(f"{_S('meter_poll_s')} is "
+                            f"{messages.shown(opts.get('meter_poll_s'))}, which is not a "
+                            "number.")
         else:
             if poll_s <= 0:
-                problems.append("meter_poll_s must be positive")
+                problems.append(f"{_S('meter_poll_s')} must be above 0.")
             # ⚠️ The age can never be fresher than the poll interval. At or past
             # max_age_s every reading is stale before its successor arrives, so
             # the controller would sit permanently on missing inputs while the
             # meter is perfectly healthy - refuse it rather than ship that.
             elif poll_s >= max_age_s:
                 problems.append(
-                    f"meter_poll_s {poll_s:.1f} is not under meter_max_age_s "
-                    f"{max_age_s:.1f} - every reading would go stale before the "
-                    "next poll")
+                    f"{_S('meter_poll_s')} is {poll_s:.1f}, not below "
+                    f"{_S('meter_max_age_s')} at {max_age_s:.1f}. Poll more "
+                    "often, or every reading goes stale.")
     else:
         problems.append(
-            f"meter_source {source!r} is not one of "
-            + ", ".join((SOURCE_HA, SOURCE_MQTT, SOURCE_HA_SIGNED, SOURCE_HOMEWIZARD)))
+            f"{_S('meter_source')} is {source!r}. Choose one of: off, "
+            + ", ".join((SOURCE_HA, SOURCE_MQTT, SOURCE_HA_SIGNED, SOURCE_HOMEWIZARD))
+            + ".")
     return problems
 
 
@@ -1261,9 +1285,8 @@ def build_source(opts: dict, ingest: P1Ingest, session, broker: dict | None):
         # 0 W cycle, which is fail-safe. The refusal above is for cadences that
         # can NEVER be fresh.
         if poll_s > ingest.max_age_s / 2:
-            _LOG.warning("meter_poll_s %.1f leaves no room under meter_max_age_s "
-                         "%.1f: one missed poll makes the reading stale. The meter "
-                         "updates every ~5 s; 5 s against 30 s is the tested pair.",
+            _LOG.warning("“Time between meter reads” (%.1f s) is too close to "
+                         "“Reading too old after” (%.1f s). Use 5 s and 30 s.",
                          poll_s, ingest.max_age_s)
         return HomeWizardLocalSource(session, ingest, host, port=port, poll_s=poll_s)
     if source == SOURCE_MQTT:
diff --git a/goodwe_controller/app/packmode.py b/goodwe_controller/app/packmode.py
new file mode 100644
index 0000000..82cac1e
--- /dev/null
+++ b/goodwe_controller/app/packmode.py
@@ -0,0 +1,129 @@
+"""OPT-11: each battery's mode and on/off switch, as limits and weights.
+
+Pure: no I/O, no clock. main.py reads the store, calls these, and files the
+result as a `mode` claim (arbiter.P_MODE) and as the charge weights.
+DECISIONS/OPT-11-battery-modes.md has the record; OPT-11-design section 1 has
+the modes.
+
+Two rules hold for every mode, and they are what keeps modes safe:
+
+1. A mode range always holds 0 W. A mode may forbid a direction, never force
+   one, so batteries never move power in opposite directions because of a mode
+   (allocator.unit_interval() drops a range without 0 as a software fault).
+2. A mode is a limit, not a weight. A weight of 0 does not keep a battery out:
+   allocator._fill()'s last-resort pass still uses it. So "may not" is a range,
+   and weights only set the order among batteries that may.
+
+`mode_range()` is the switch alone (Off is [0, 0]). P3 adds the price runs:
+`modetrade.decide()` narrows each battery's range by its role this tick
+(hold for the expensive hours, charge from the grid, sell), and main.py files
+the intersection. Selling is a per-battery choice (`pack_sell`, the owner's
+2026-09-27 answer), for Leftover solar and Cheap hours only.
+"""
+
+from dataclasses import dataclass
+
+from .store import unit_key
+
+SOLAR_FIRST = "solar_first"
+LEFTOVER_SOLAR = "leftover_solar"
+CHEAP_HOURS = "cheap_hours"         # OPT-11 P3
+
+# The modes a battery may be set to, in the order the page and the HA select
+# list them. The first is the default when the store has no value. A new mode
+# is appended, never inserted: automations send the HA labels (P2).
+MODES = (SOLAR_FIRST, LEFTOVER_SOLAR, CHEAP_HOURS)
+DEFAULT_MODE = SOLAR_FIRST
+
+# Store keys, per battery: `unit/<name>/<key>` (store.unit_key()).
+USE_KEY = "pack_use"
+MODE_KEY = "pack_mode"
+SELL_KEY = "pack_sell"              # OPT-11 P3: sell in the sell run
+
+# Owner decision 2026-09-29 (option A): selling is off until it can be judged
+# on the price the grid pays. While False, `read()` answers `sell=False`
+# whatever the store holds, the page shows no switch and `pack_sell` is
+# refused; the sell code in modetrade/priceruns stays, unreachable.
+SELLING_ENABLED = False
+
+# The modes that may charge from the grid in a cheap run with no day plan.
+# Leftover solar takes solar only then (owner decision 2026-09-29, option A).
+GRID_CHARGE_MODES = (CHEAP_HOURS,)
+# OPT-11 P4: with a fresh solar forecast, the day plan (dayplan.py) lets
+# Leftover solar charge from the grid, by the shortfall only. Cheap hours only
+# ignores the plan (fills to the ceiling); Solar first never grid-charges.
+PLAN_CHARGE_MODES = (LEFTOVER_SOLAR,)
+
+
+def enabled(opts) -> bool:
+    """Battery modes are on only when the option is exactly true. One answer,
+    read by the controller and by the MQTT announcement."""
+    return opts.get("battery_modes_enabled") is True
+
+
+@dataclass(frozen=True)
+class PackMode:
+    """One battery's choice: on or off, its mode, and selling."""
+    use: bool = True
+    mode: str = DEFAULT_MODE
+    sell: bool = False
+
+    @property
+    def can_sell(self) -> bool:
+        """Selling applies to the price modes only; Solar first never sells.
+        False for every battery while SELLING_ENABLED is False."""
+        return SELLING_ENABLED and self.mode in (LEFTOVER_SOLAR, CHEAP_HOURS)
+
+    @property
+    def key(self) -> str:
+        """The page's word for this state: a mode, or `off`."""
+        return self.mode if self.use else "off"
+
+
+def read(data: dict, name: str) -> PackMode:
+    """Battery `name`'s choice from the store's data. A missing or unknown
+    value falls back to the default (on, Solar first), never to Off: a store
+    written by a later version must not switch a battery off here."""
+    use = data.get(unit_key(name, USE_KEY), True)
+    mode = data.get(unit_key(name, MODE_KEY), DEFAULT_MODE)
+    return PackMode(use=use is not False,
+                    mode=mode if mode in MODES else DEFAULT_MODE,
+                    sell=SELLING_ENABLED
+                    and data.get(unit_key(name, SELL_KEY)) is True)
+
+
+def mode_range(pm: PackMode, rating_w: float) -> tuple:
+    """`(lo, hi)` in W for this battery's switch. Always holds 0 W.
+
+    Off asks for 0 W both ways; On allows the rating both ways. main.py files
+    this intersected with the role range from `modetrade.decide()`.
+    """
+    if not pm.use:
+        return 0.0, 0.0
+    r = abs(float(rating_w))
+    return -r, r
+
+
+def charge_weights(base, modes: dict, target_w: float):
+    """The allocator's weights with the solar order applied (design 3.5).
+
+    `base` is packshare.weights()' answer (None for "all 1.0"). While the site
+    charges (`target_w < 0`), a Leftover solar battery weighs 0 and a Solar
+    first battery keeps its weight, so the fill gives the Solar first batteries
+    everything they can take before the last-resort pass reaches the others.
+    Giving power keeps `base`; `modetrade.weights()` adds the run order.
+
+    When no battery that is on would keep a positive weight (all Leftover
+    solar, or every Solar first one at 0), `base` is returned unchanged, so the
+    order among equals stays OPT-09's rather than an equal split.
+    """
+    if float(target_w) >= 0.0 or not modes:
+        return base
+    names = sorted(modes)
+    w = {n: (1.0 if base is None else float(base.get(n, 1.0))) for n in names}
+    out = {n: (0.0 if modes[n].mode in (LEFTOVER_SOLAR, CHEAP_HOURS)
+               else w[n])
+           for n in names}
+    if not any(out[n] > 0.0 for n in names if modes[n].use):
+        return base
+    return out
diff --git a/goodwe_controller/app/peakguard.py b/goodwe_controller/app/peakguard.py
index 2fed3f8..2ecaae8 100644
--- a/goodwe_controller/app/peakguard.py
+++ b/goodwe_controller/app/peakguard.py
@@ -143,6 +143,10 @@ because the money is spent on `max(month's peak so far, this quarter)`:
 
     ceiling_w = max(peak_cap_w, the month's banked peak)
 
+SAFETY-79: the guard AIMS `peak_margin_w` under that ceiling
+(`quarter_target_w()`), so a quarter that lands a little high still stays under
+it. `ceiling_w` stays the real limit for reports and the bill.
+
 Once a month's peak already stands at 5013 W, holding every later quarter to
 3500 W buys nothing - the bill for that month is already 5013 W - while the
 holding itself costs real charging the site wanted. Raising the ceiling to a peak
@@ -393,35 +397,36 @@ function, so whichever way the owner answers, this file does not change and does
 not need re-testing. Nothing here indexes a phase.
 """
 
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 
+from . import messages
 from .arbiter import ACTUATOR_SITE, P_PEAK, Claim
 from .control import peak_at_risk
 from .tariff import QUARTER_S
 
 # Why the projection may not be graded. Reasons, not booleans: the status page
 # and the action log both have to say WHICH, and "blind" alone is unactionable.
-BLIND_NO_BLOCK = "no open quarter - the meter has produced no sample yet"
+BLIND_NO_BLOCK = "no open 15-minute period, the meter has given no reading yet"
 BLIND_COVERAGE = "meter gap"
-BLIND_FROZEN = "SAFETY-18: the meter is answering without changing"
+BLIND_FROZEN = "the meter is answering without changing"
 
 # Where the ceiling came from. Only the second is a relaxation, and only an
 # OBSERVED reading may produce it.
 CEILING_CAP = "peak_cap_w"
-CEILING_MONTH_PEAK = "the month's banked peak"
+CEILING_MONTH_PEAK = "this month's peak"
 
 # SAFETY-24. Why the forced discharge may not be sized. Reasons, not booleans,
 # for BLIND_*'s reason: the status page, the action log and the operator
 # notification all have to say WHICH, and "floor-limited" alone is unactionable.
-FLOOR_SOC_UNREADABLE = ("the battery state of charge was not measured this "
-                        "cycle, and an unreadable SoC is not a full battery")
-# ⚠️ SAFETY-25. "the peak guard's SoC floor", not "the SoC floor", and the
-# possessive is load-bearing: this string is what the status page, the action log
-# and the operator notification all print, and `peak_soc_floor` bounds THIS GUARD
-# ONLY. Widening it to "the SoC floor" would make the one sentence an operator
-# reads at the moment the battery stops shaving into a claim about the pack that
-# the grid-following loop is at that instant disproving.
-FLOOR_AT_SOC_FLOOR = "state of charge is at or below the peak guard's SoC floor"
+FLOOR_SOC_UNREADABLE = ("the battery level was not read this cycle, and "
+                        "unread is not full")
+# ⚠️ SAFETY-25. "the peak reserve", not "the SoC floor", and the name is
+# load-bearing: this string is what the action log and the add-on log print,
+# and `peak_soc_floor` (“Peak reserve”) bounds THIS GUARD ONLY. Widening it to
+# "the SoC floor" would make the one sentence an operator reads at the moment
+# the battery stops shaving into a claim about the pack that the
+# grid-following loop is at that instant disproving.
+FLOOR_AT_SOC_FLOOR = "the battery level is at or below the peak reserve"
 
 SOURCE = "peak"
 
@@ -452,7 +457,13 @@ PEAK_OPTION_DEFAULTS = {
     # and it is consistent with DoD 90 on a full pack. It exists so validate.py
     # rule 8 can refuse a `peak_soc_floor` at or below it - see that rule.
     "bms_soc_floor": 10,
+    # SAFETY-79. Watts the guard aims under `peak_cap_w`, so a quarter that
+    # lands a little high still stays under the cap. Owner decision 2026-09-28.
+    "peak_margin_w": 50,
 }
+# SAFETY-79. config.yaml's schema range for `peak_margin_w`, mirrored so
+# validate.py can refuse it in words; test_peakguard.py pins it to the file.
+PEAK_MARGIN_RANGE_W = (0, 500)
 
 
 @dataclass(frozen=True)
@@ -473,29 +484,49 @@ class PeakDecision:
     projected_w: float | None = None
     excess_w: float = 0.0
     wanted_w: float | None = None    # the floor before `achievable_w` clamped it
+    target_w: float | None = None    # SAFETY-79: what the guard aims at
     saturated: bool = False
     # SAFETY-24. True when a forced discharge WAS wanted and the EMS-side SoC
     # floor refused to size it. Mutually exclusive with `saturated` by
     # construction: this branch asks for nothing, so it cannot have run out of
     # inverter. `soc_floor_reason` says WHICH of the two ways it bound.
+    # SAFETY-87: at N>=2 it may ask the batteries above their reserve for
+    # `able_w`, all they have, when that is not enough (`place_on_able()`).
     floor_limited: bool = False
     soc: float | None = None
     soc_floor: float | None = None
     soc_floor_reason: str | None = None
     reason: str = ""
+    # SAFETY-87, N>=2 only: the batteries at or under their own reserve,
+    # which give nothing for the peak, and what the others can give (None
+    # when they are not asked). See `place_on_able()`.
+    held: tuple = ()
+    able_w: float | None = None
 
     def explain(self) -> str:
+        """Idle: the status row's plain words (UX-08). Engaged: `reason`, the
+        technical record with every figure, for the log and the action log."""
         if self.floor_limited:
             return self.reason
         if not self.engaged:
             if self.projected_w is None:
-                return f"peak guard idle - {self.reason}"
-            return (f"peak guard idle - quarter projects "
-                    f"{self.projected_w:.0f} W under a {self.ceiling_w:.0f} W "
-                    f"ceiling ({self.ceiling_from})")
+                return messages.row_peak_guard_quiet()
+            return messages.row_peak_guard_idle(
+                self.projected_w, self.ceiling_w,
+                month_peak=self.ceiling_from == CEILING_MONTH_PEAK)
         return self.reason
 
 
+def blind_kind(blind: str) -> str:
+    """Which of the three kinds of blindness, as a key of
+    `messages.BLIND_WORDS`, for the status row."""
+    if blind == BLIND_FROZEN:
+        return "frozen"
+    if blind == BLIND_NO_BLOCK:
+        return "no_block"
+    return "gap"
+
+
 def quarter_ceiling_w(cap_w, reading) -> tuple[float, str]:
     """The average this quarter may not exceed, and where the number came from.
 
@@ -511,6 +542,15 @@ def quarter_ceiling_w(cap_w, reading) -> tuple[float, str]:
     return cap, CEILING_CAP
 
 
+def quarter_target_w(cap_w, margin_w, reading) -> float:
+    """SAFETY-79. The average the guard AIMS at: `margin_w` under
+    `quarter_ceiling_w()`, so under a month peak already banked as well as
+    under the cap. Aiming AT a banked peak can bank a few W over it, which
+    raises the bill as surely as going over the cap. Reports and the bill keep
+    the real limit (`ceiling_w`)."""
+    return quarter_ceiling_w(cap_w, reading)[0] - float(margin_w)
+
+
 def excess_w(projection, ceiling_w) -> float:
     """Watts that must come off the meter NOW to land the quarter on the ceiling.
 
@@ -553,8 +593,9 @@ def blindness(projection, max_hold_s, frozen: bool) -> str | None:
         return BLIND_NO_BLOCK
     gap = uncovered_s(projection)
     if max_hold_s is not None and gap > float(max_hold_s):
-        return (f"{BLIND_COVERAGE}: {gap:.0f} s of this quarter uncovered, past "
-                f"the {float(max_hold_s):.0f} s the averager will hold a sample")
+        return (f"{BLIND_COVERAGE}, {gap:.0f} s of this 15-minute period not "
+                f"covered, past the {float(max_hold_s):.0f} s a reading is "
+                f"held")
     return None
 
 
@@ -699,8 +740,45 @@ def binding_soc_floor(packs, soc_floor):
     return max(floors)
 
 
-def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
-           max_hold_s=None, frozen: bool = False) -> PeakDecision:
+def reserve_split(packs, soc_floor) -> tuple[list, tuple]:
+    """SAFETY-87: `(packs the guard may spend, names of those it may not)`,
+    each pack graded on its own floor by `pack_permissions()`."""
+    perms = pack_permissions(packs, soc_floor)
+    return ([p for p, (_n, why) in zip(packs, perms) if why is None],
+            tuple(n for n, why in perms if why is not None))
+
+
+def place_on_able(decision, held, *, able_w, soc, soc_floor) -> PeakDecision:
+    """SAFETY-87: `decision` with the batteries in `held` (at or under their
+    own reserve) giving nothing for the peak. `able_w`, `soc` and `soc_floor`
+    describe the others, as `decide()`'s arguments do for the roster. A
+    floor-limited decision is re-taken on them: they are asked for the need
+    up to `able_w`, and it stays floor-limited only if that is not enough.
+    `soc` and `soc_floor` keep the roster's verdict, as `decide()` echoed it.
+    DECISIONS/SAFETY-87-guard-uses-able-batteries.md."""
+    held = tuple(held)
+    if not decision.floor_limited or decision.wanted_w is None \
+            or discharge_permitted(soc, soc_floor) is not None:
+        return replace(decision, held=held)
+    wanted = float(decision.wanted_w)
+    floor = min(wanted, float(able_w))
+    head = (f"this 15-minute period heads for {decision.projected_w:.0f} W "
+            f"against a {decision.ceiling_w:.0f} W limit "
+            f"({decision.ceiling_from}), aiming at {decision.target_w:.0f} W. "
+            f"At the peak reserve, so giving nothing for the peak: "
+            f"{messages.names(held)}. The others are asked for {floor:+.0f} W")
+    if floor >= wanted:
+        return replace(decision, floor_limited=False, floor_w=floor,
+                       soc_floor_reason=None, held=held, able_w=float(able_w),
+                       reason=f"PEAK_GUARD: {head}")
+    return replace(decision, floor_w=floor, held=held, able_w=float(able_w),
+                   reason=(f"PEAK_GUARD_FLOOR_LIMITED: {head}, all they can "
+                           f"give, but {wanted:+.0f} W was needed, so this "
+                           f"period may go over the limit"))
+
+
+def decide(projection, *, batt_w, cap_w, margin_w, reading, achievable_w, soc,
+           soc_floor, max_hold_s=None, frozen: bool = False) -> PeakDecision:
     """The whole guard. Pure: no clock, no I/O, no state carried between calls.
 
     `batt_w`       MEASURED battery power, positive = discharge. None when the
@@ -718,8 +796,13 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
                    the pack for money. REQUIRED, and deliberately without a
                    default: a default here would be CFG-03's fourth defaults
                    site and TEST-14's quiet fallback in one line.
+    `margin_w`     SAFETY-79. Watts to aim under `cap_w` (`peak_margin_w`).
+                   REQUIRED for the same reason. `ceiling_w` stays the real
+                   limit for every report; only `excess_w` uses the target.
     """
     ceiling, from_where = quarter_ceiling_w(cap_w, reading)
+    target = quarter_target_w(cap_w, margin_w, reading)
+    aim = "" if target == ceiling else f", aiming at {target:.0f} W"
     ceil_top = abs(float(achievable_w))
 
     blind = blindness(projection, max_hold_s, frozen)
@@ -729,10 +812,10 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # see", which is one-directional and cannot cost pack energy.
         return PeakDecision(
             engaged=True, floor_w=0.0, ceiling_w=ceiling, ceiling_from=from_where,
-            blind=blind, projected_w=None,
-            reason=(f"PEAK GUARD BLIND ({blind}) - the battery may not import "
-                    f"while the billed quarter cannot be measured; commanding no "
-                    f"charging (floor 0 W)"))
+            target_w=target, blind=blind, projected_w=None,
+            reason=(f"PEAK_GUARD_BLIND: {blind}. The battery may not charge "
+                    f"while this 15-minute period cannot be measured, so it "
+                    f"is asked for no charging, floor 0 W"))
 
     projected = float(projection.projected_w)
     if batt_w is None:
@@ -741,7 +824,7 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # measurement that is not there is a made-up number.
         return PeakDecision(
             engaged=False, floor_w=None, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
             reason="no battery measurement to size a floor from")
     if QUARTER_S - float(projection.elapsed_s) <= 0.0:
         # A block with no seconds left cannot be influenced. This is degenerate
@@ -749,10 +832,10 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # the battery's own current output would be a claim that says nothing.
         return PeakDecision(
             engaged=False, floor_w=None, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
             reason="the quarter has no seconds left to influence")
 
-    ex = excess_w(projection, ceiling)
+    ex = excess_w(projection, target)
     wanted = float(batt_w) + ex
     if wanted <= 0.0:
         # ⚠️ THE TEST IS ON THE FLOOR, NOT ON `excess > 0`, AND THE REPLAY IS WHY.
@@ -773,7 +856,8 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # the quantity being thresholded is simply the right one.
         return PeakDecision(
             engaged=False, floor_w=None, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected, excess_w=ex,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
+            excess_w=ex,
             wanted_w=wanted,
             reason="the load is under the level this quarter can afford")
 
@@ -791,35 +875,73 @@ def decide(projection, *, batt_w, cap_w, reading, achievable_w, soc, soc_floor,
         # not the grid-following loop, which still has no SoC guard.
         return PeakDecision(
             engaged=True, floor_w=0.0, ceiling_w=ceiling,
-            ceiling_from=from_where, projected_w=projected, excess_w=ex,
+            ceiling_from=from_where, target_w=target, projected_w=projected,
+            excess_w=ex,
             wanted_w=wanted, floor_limited=True, soc=soc, soc_floor=soc_floor,
             soc_floor_reason=denied,
+            # UX-10: plain sentences, every figure kept (test_messages.py
+            # part 6). The code is one token, so it is not read as shouting.
             reason=(
-                f"PEAK GUARD FLOOR-LIMITED: the quarter projects "
-                f"{projected:.0f} W against a {ceiling:.0f} W ceiling "
-                f"({from_where}) and {wanted:+.0f} W of discharge would hold "
-                f"it, but {denied}"
-                + ("" if soc is None else f" ({float(soc):.0f} %")
+                f"PEAK_GUARD_FLOOR_LIMITED: this 15-minute period heads for "
+                f"{projected:.0f} W against a {ceiling:.0f} W limit "
+                f"({from_where}){aim}, and {wanted:+.0f} W from the battery "
+                f"would hold it. But {denied}"
+                + ("" if soc is None else f", at {float(soc):.0f} %")
                 + ("" if soc is None or soc_floor is None
-                   else f" vs {float(soc_floor):.0f} %")
-                + ("" if soc is None else ")")
-                + " - commanding no forced discharge, so THIS QUARTER WILL GO "
-                  "OVER THE CEILING. Charging stays blocked (floor 0 W)"))
+                   else f" against {float(soc_floor):.0f} %")
+                + ", so no forced discharge and no charging, and this period "
+                  "will go over the limit"))
 
     floor = min(wanted, ceil_top)
     saturated = floor < wanted
     return PeakDecision(
         engaged=True, floor_w=floor, ceiling_w=ceiling, ceiling_from=from_where,
-        blind=None, projected_w=projected, excess_w=ex, wanted_w=wanted,
-        saturated=saturated, soc=soc, soc_floor=soc_floor,
+        target_w=target, blind=None, projected_w=projected, excess_w=ex,
+        wanted_w=wanted, saturated=saturated, soc=soc, soc_floor=soc_floor,
         reason=(
-            f"PEAK GUARD: quarter projects {projected:.0f} W against a "
-            f"{ceiling:.0f} W ceiling ({from_where}) with "
+            f"PEAK_GUARD: this 15-minute period heads for {projected:.0f} W "
+            f"against a {ceiling:.0f} W limit ({from_where}){aim}, with "
             f"{QUARTER_S - projection.elapsed_s:.0f} s left, so {ex:.0f} W must "
-            f"come off the meter; battery measured {float(batt_w):+.0f} W, "
-            f"floor {floor:+.0f} W"
-            + (f" - SATURATED, {wanted:+.0f} W was needed and the inverter can "
-               f"only give {ceil_top:.0f} W" if saturated else "")))
+            f"come off the meter. The battery measured {float(batt_w):+.0f} W "
+            f"and is asked for {floor:+.0f} W"
+            # Saturated means floor == ceil_top: the ask IS the most the
+            # inverters give, so one clause says both.
+            + (f", the most the inverters give, but {wanted:+.0f} W was needed"
+               if saturated else "")))
+
+
+# SAFETY-81. A quarter must end this many W over the real limit before
+# "Load too high for battery" fires. Above the guard's own landing error at
+# margin 0 (up to +5.7 W, SAFETY-79 test check 5), which margin 0 accepts.
+ALARM_MISS_W = 10.0
+# ...and for this long without a break, so a load that peaks for a few seconds
+# (a hob or heater cycling) is not read as the rest of the quarter.
+ALARM_HOLD_S = 10.0
+
+
+def load_too_high(projection, *, batt_w, ceiling_w, achievable_w) -> bool:
+    """SAFETY-81. May "Load too high for battery" fire? Only if, with the
+    battery at full power from now on, the quarter still ends more than
+    `ALARM_MISS_W` over the real limit (`ceiling_w`, not the aim).
+
+    This is the miss itself, in W of the quarter average, so it does not have
+    `decide()`'s gain (900 / remaining): near a quarter's end that gain turns
+    a watt over the aim into thousands of W wanted.
+
+    The load is the held meter reading plus `batt_w`. The caller passes the
+    lower of this cycle's and the last cycle's battery reading, so a meter
+    sample taken before the battery's last increase is not counted twice
+    (DECISIONS/SAFETY-81-load-too-high.md). A real overload shows on the meter
+    before the battery moves, so that filter costs it no cycle.
+    """
+    remaining = QUARTER_S - float(projection.elapsed_s)
+    if batt_w is None or remaining <= 0.0:
+        return False
+    rest = float(projection.held_w) + float(batt_w) - float(achievable_w)
+    done_ws = (QUARTER_S * float(projection.projected_w)
+               - max(float(projection.held_w), 0.0) * remaining)
+    ends_w = (done_ws + max(rest, 0.0) * remaining) / QUARTER_S
+    return ends_w - float(ceiling_w) > ALARM_MISS_W
 
 
 def charge_headroom_w(decision) -> float | None:
@@ -1019,5 +1141,6 @@ def claim(decision: PeakDecision) -> Claim | None:
     return Claim.limit(SOURCE, P_PEAK, lo=float(decision.floor_w),
                        reason=("blind" if decision.blind
                                else "SoC floor" if decision.floor_limited
+                               and not decision.floor_w
                                else "quarter peak"),
                        actuator=ACTUATOR_SITE)
diff --git a/goodwe_controller/app/price.py b/goodwe_controller/app/price.py
index f3d0db3..b1c1ca6 100644
--- a/goodwe_controller/app/price.py
+++ b/goodwe_controller/app/price.py
@@ -150,6 +150,7 @@ from enum import Enum
 from textwrap import dedent
 from urllib.parse import urlencode
 
+from . import messages
 from .custom_formula import (
     EXPORT_FORMULA_OPTION, FormulaInvalid, PREVIEW_HOURS, parse_export_formula,
     parse_price_formula, preview_lines, price_eur_kwh, to_resolution)
@@ -1314,8 +1315,8 @@ def code_leaks(cls) -> list:
         src = dedent(inspect.getsource(cls))
         tree = ast.parse(src)
     except (OSError, TypeError, IndentationError, SyntaxError) as e:
-        _LOG.warning("could not read %s's source for the framework-key scan "
-                     "(%s); the double-counting guard is NOT enforced for it",
+        _LOG.warning("Could not read the code of price source %s (%s), so its "
+                     "double-counting check is skipped.",
                      getattr(cls, "id", cls), e)
         return []
     for node in ast.walk(tree):
@@ -1453,9 +1454,8 @@ def _validate_raw(points, caps):
         if abs(p.eur_per_kwh) > MAX_PLAUSIBLE_EUR_KWH:
             raise SourceUnavailable(
                 f"point at {p.start.isoformat()} is {p.eur_per_kwh} EUR/kWh, "
-                f"beyond +-{MAX_PLAUSIBLE_EUR_KWH} - the usual cause is a feed "
-                f"in EUR/MWh being read as EUR/kWh, which is a factor of 1000 "
-                f"and would make every hour look like an emergency")
+                f"beyond +-{MAX_PLAUSIBLE_EUR_KWH}, so the feed is probably in "
+                f"EUR/MWh")
         u = p.start.astimezone(timezone.utc)
         if seen is not None and u <= seen:
             raise SourceUnavailable(
@@ -1708,25 +1708,19 @@ def _points_from_columnar_json(body, expect_unit, scale,
     if len(times) != len(prices):
         raise SourceUnavailable(
             f"{COLUMNAR_TIME_KEY} has {len(times)} entries and "
-            f"{COLUMNAR_PRICE_KEY} has {len(prices)}; refusing to zip them. "
-            f"The short array would truncate the series silently, and a price "
-            f"series missing its last hours is one missing the evening peak - "
-            f"traded on as if complete, where no data at all would have "
-            f"switched arbitrage off (§11.4)")
+            f"{COLUMNAR_PRICE_KEY} has {len(prices)}, so the feed is cut short "
+            f"and none of it is used")
     unit = _columnar_unit(doc.get(COLUMNAR_UNIT_KEY, ""))
     if unit != _columnar_unit(expect_unit):
         raise SourceUnavailable(
             f"the feed reports {doc.get(COLUMNAR_UNIT_KEY)!r}, not "
-            f"{expect_unit!r}. This provider converts with a fixed factor of "
-            f"{scale}, so a changed unit is a factor of 1000 on every price "
-            f"with nothing downstream able to notice it")
+            f"{expect_unit!r}, so its prices cannot be converted")
     if doc.get("deprecated"):
         # Not a refusal: today's prices are still prices. But §11.4 makes a
         # dead feed look exactly like a quiet one, so the warning that the
         # source is going away has to be emitted while it still works.
-        _LOG.warning("the price feed reports deprecated=%r; it still answers, "
-                     "but this endpoint is scheduled to stop",
-                     doc.get("deprecated"))
+        _LOG.warning("The price feed says it will stop (deprecated=%r), "
+                     "though it still answers for now.", doc.get("deprecated"))
     out = []
     dropped = []
     for i, (t, v) in enumerate(zip(times, prices)):
@@ -1745,12 +1739,11 @@ def _points_from_columnar_json(body, expect_unit, scale,
         out.append(RawPoint(start=start, eur_per_kwh=float(v) * scale,
                             provisional=bool(provisional_default)))
     if dropped:
-        _LOG.warning("the feed published no price for %d of %d instants "
-                     "(index %s); those instants are left OUT of the series, "
-                     "never zero-filled - a missing hour is not a free hour",
-                     len(dropped), len(times),
+        _LOG.warning("The price feed gave no price for %d of %s, at index "
+                     "%s. Those are left out, not counted as free.",
+                     len(dropped), messages.count(len(times), "time"),
                      ", ".join(str(i) for i in dropped[:5])
-                     + (", ..." if len(dropped) > 5 else ""))
+                     + (" and more" if len(dropped) > 5 else ""))
     if not out:
         raise SourceUnavailable(
             f"the feed carried {len(times)} instants and a price for none of "
@@ -1796,16 +1789,16 @@ def dayahead_feed_url(plugin_id, opts, since, until, base, bzn) -> str:
     override = str(opts.get("price_feed_url") or "").strip()
     if override:
         _LOG.warning(
-            "price_feed_url is set, so %s is requesting %s exactly as "
-            "given and is adding NO date range to it. The public feed "
-            "answers a single Brussels day to a request that names no "
-            "range, and every hour past that day is then carried forward "
-            "from yesterday's profile and flagged provisional - §8.3 "
-            "drops provisional hours from the trade set, so arbitrage "
-            "would never see tomorrow as firm. Clear price_feed_url to "
-            "let this plugin ask for the %s..%s it was given.",
+            "price_feed_url is set, so %s asks for %s as given, and "
+            "tomorrow's prices may stay provisional. Clear it to ask for %s "
+            "to %s.",
             plugin_id, override, *(d.isoformat()
                                    for d in brussels_date_range(since, until)))
+        _LOG.debug(
+            "The public feed answers one Brussels day to a request that names "
+            "no range. Every later hour is then copied from yesterday and "
+            "marked provisional, and §8.3 leaves provisional hours out of "
+            "trading.")
         return override
     first, last = brussels_date_range(since, until)
     return dated_feed_url(base, bzn=bzn, start=first.isoformat(),
@@ -2011,11 +2004,9 @@ class CustomFormula(PriceProvider):
             raise SourceUnavailable(f"price_formula: {e}")
         if spec is None:
             raise SourceUnavailable(
-                "price_provider is 'custom_formula' but price_formula is "
-                "empty, so there are no coefficients to price anything with. "
-                "validate.py refuses this configuration at startup; reaching "
-                "it here means the options blob changed under a running "
-                "add-on")
+                "“Dynamic price source” (price_provider) is 'custom_formula', "
+                "but “Your own tariff formula” (price_formula) is empty. "
+                "Restart the add-on to check the settings again")
         url = dayahead_feed_url(self.id, opts, since, until,
                                 self.FEED_BASE, self.BZN)
         check_egress(url, self.capabilities())
@@ -2091,8 +2082,8 @@ def _emit_startup_preview(plugin, pid: str, points) -> None:
     try:
         lines = list(plugin.startup_preview(points))
     except Exception as e:                                    # noqa: BLE001
-        _LOG.warning("%s's startup preview raised (%s: %s); prices are "
-                     "unaffected - this is a log line, not a decision",
+        _LOG.warning("%s could not show its start-up preview (%s: %s). Prices "
+                     "are not affected.",
                      pid, type(e).__name__, e)
         return
     for line in lines:
@@ -2116,12 +2107,12 @@ async def load_prices(opts: dict, since: datetime, until: datetime,
     pid = provider_id(opts)
     if not provider_configured(opts):
         return PriceRead.no_data(
-            "no price provider configured (price_provider is 'off'); "
-            "§11.4: static profile, plan provisional, no arbitrage")
+            "no price feed is set (price_provider is 'off'), so the fixed "
+            "tariff is used, the plan is estimated and there is no trading")
     cls = PROVIDERS.get(pid)
     if cls is None:
         return PriceRead.no_data(
-            f"unknown price provider {pid!r}; shipped: "
+            f"unknown price provider {pid!r}. The known ones are "
             f"{', '.join(sorted(PROVIDERS))}")
 
     caps = cls.capabilities()
@@ -2139,12 +2130,12 @@ async def load_prices(opts: dict, since: datetime, until: datetime,
         # Not silent, and not a traceback into the 30 s tick. validate.py
         # should have refused this at startup; if the add-on is running with it
         # anyway, the operator is told which key and what is wrong with it.
-        _LOG.error("price_taxes_profile cannot be used (%s: %s), so this fetch "
-                   "has NO tax component to add - it is not falling back to "
-                   "price_taxes_eur_kwh, because a silently different tax "
-                   "basis is the defect this option exists to remove. Fix the "
-                   "table or clear it; validate.py refuses it at startup",
+        _LOG.error("price_taxes_profile cannot be used (%s: %s), so no taxes "
+                   "are added to this price update. Fix the table or clear it.",
                    type(e).__name__, e)
+        _LOG.debug("price_taxes_eur_kwh is not used instead, because a "
+                   "silently different tax basis is the fault this setting "
+                   "exists to remove.")
         return PriceRead.no_data(
             f"price_taxes_profile cannot be used: {e}")
     if table is not None:
diff --git a/goodwe_controller/app/price_forecast.py b/goodwe_controller/app/price_forecast.py
index 97fc265..916a8fc 100644
--- a/goodwe_controller/app/price_forecast.py
+++ b/goodwe_controller/app/price_forecast.py
@@ -164,6 +164,7 @@ from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from enum import Enum
 
+from . import messages
 from .maintenance import CHARGE_TIMEOUT_MIN, DRAIN_TIMEOUT_MIN
 from .price import PricePoint, PriceRead, _Outcome, brussels
 
@@ -411,13 +412,14 @@ def fill_from_yesterday(read: PriceRead, *, yesterday: PriceRead,
 
     if not out:
         reason = read.match(
-            series=lambda r: (f"the {len(r.points)} published hours all fall "
-                              f"outside {since.isoformat()}..{until.isoformat()}"),
+            series=lambda r: (f"all {messages.count(len(r.points), 'published price')} "
+                              f"fall outside {messages.when(brussels(since))} to "
+                              f"{messages.when(brussels(until))}"),
             no_data=lambda r: r.reason)
         return PriceRead.no_data(
-            f"§8.3 carry-forward produced no hours: {reason}, and yesterday's "
-            f"profile has nothing to fill them with either. §11.4 applies: "
-            f"static profile, plan provisional, no arbitrage")
+            f"no hours could be filled from yesterday's prices: {reason}. So "
+            f"the fixed tariff is used, the plan is estimated and there is no "
+            f"trading")
 
     _audit(out, published)
     carried = sum(1 for p in out if _utc_hour(p.start) not in published)
@@ -431,10 +433,11 @@ def fill_from_yesterday(read: PriceRead, *, yesterday: PriceRead,
         # hours" about a 48-hour horizon. The fill's unit is the HOUR and the
         # feed's is the POINT; nothing derived from one answers for the other.
         total_h = len({_utc_hour(p.start) for p in out})
-        _LOG.info("§8.3: %d of %d hours carried forward from yesterday's "
-                  "profile and flagged provisional; the feed published %d "
-                  "points over the other %d hours",
-                  carried, total_h, len(out) - carried, total_h - carried)
+        _LOG.info("%d of %s use yesterday's prices, marked as estimated. "
+                  "The feed published %s over the other %s.",
+                  carried, messages.count(total_h, "hour"),
+                  messages.count(len(out) - carried, "price"),
+                  messages.count(total_h - carried, "hour"))
 
     product = read.match(series=lambda r: r.product,
                          no_data=lambda _r: yesterday.product)
@@ -525,8 +528,8 @@ class _Permitted(Gate):
                 "one rule this type has.")
         self.action = action
         self.hours = pts
-        self.words = (f"{action.name} permitted on {len(pts)} firm hours "
-                      f"({pts[0].start.isoformat()} ..)")
+        self.words = (f"allowed on {messages.count(len(pts), 'published price')} "
+                      f"from {messages.when(brussels(pts[0].start))}")
 
 
 class _Blocked(Gate):
@@ -570,8 +573,8 @@ def price_permits(read: PriceRead, now: datetime,
     return read.match(
         series=lambda r: _walk(r, hours, action),
         no_data=lambda r: Gate.block(
-            f"{action.name} is gated on a price and there is no price data: "
-            f"{r.reason}. §11.4 - and a missing price is not a cheap one"))
+            f"{action.name} needs a price and there is none: {r.reason}. A "
+            f"missing price is not a cheap one"))
 
 
 def _walk(series, hours, action) -> Gate:
@@ -579,19 +582,18 @@ def _walk(series, hours, action) -> Gate:
     for u in hours:
         if not series.covers(u):
             return Gate.block(
-                f"{action.name} commits {action.commits_h:g} h from "
-                f"{hours[0].isoformat()} and no price covers "
-                f"{u.isoformat()}. An hour outside the series is an hour with "
-                f"no price (§11.4 for that hour), not a free one")
+                f"{action.name} needs prices for {action.commits_h:g} hours "
+                f"from {messages.when(brussels(hours[0]))}, and no price "
+                f"covers {messages.when(brussels(u))}. An hour with no price "
+                f"is not a free one")
         p = series.at(u)
         if p.provisional:
             return Gate.block(
-                f"{action.name} commits {action.commits_h:g} h from "
-                f"{hours[0].isoformat()} and {u.isoformat()} is PROVISIONAL - "
-                f"carried from yesterday's profile or standing in for a dead "
-                f"feed. §8.3: no irreversible action may be taken on a "
-                f"provisional price. It becomes available when the day-ahead "
-                f"print lands (~14-16 h CET, §5.4)")
+                f"{action.name} needs prices for {action.commits_h:g} hours "
+                f"from {messages.when(brussels(hours[0]))}, and the price for "
+                f"{messages.when(brussels(u))} is only estimated. It can start "
+                f"once the day-ahead prices are published, around 14:00 to "
+                f"16:00")
         pts.append(p)
     return Gate.permit(action, pts)
 
@@ -622,5 +624,6 @@ def _go(maint, now, gate) -> Gate:
 
 
 def _no(gate) -> Gate:
-    _LOG.warning("irreversible action refused - %s", gate.reason)
+    _LOG.warning("An action that cannot be undone does not start: %s.",
+                 gate.reason)
     return gate
diff --git a/goodwe_controller/app/price_history.py b/goodwe_controller/app/price_history.py
index 433c803..e6576db 100644
--- a/goodwe_controller/app/price_history.py
+++ b/goodwe_controller/app/price_history.py
@@ -186,8 +186,9 @@ import json
 import logging
 import os
 import tempfile
-from datetime import datetime, timedelta, timezone
+from datetime import date, datetime, timedelta, timezone
 
+from . import messages
 from .price import PricePoint, PriceProduct, PriceRead, brussels
 from .price_forecast import fill_from_yesterday
 
@@ -345,8 +346,19 @@ def _row_of(day: str, points: int, hours: int) -> str:
     whole day to carry, and that is the HOUR figure; the point count says how
     finely it is priced. Neither answers for the other.
     """
-    return (f"{day} ({points} point{'' if points == 1 else 's'} "
-            f"over {hours} h)")
+    # UX-10: the day as the page writes dates ("26 Sep"), not ISO.
+    return (f"{points} price{'' if points == 1 else 's'} over {hours} "
+            f"hour{'' if hours == 1 else 's'} for {day_words(day)}")
+
+
+def day_words(day) -> str:
+    """`'2026-09-26'` -> `'26 Sep'`, as the page writes a date. A key that is
+    not a date is shown as it is, because this feeds a status row."""
+    try:
+        d = date.fromisoformat(str(day))
+    except ValueError:
+        return str(day)
+    return f"{d.day} {d:%b}"
 
 
 def _bad_rows(rec) -> int:
@@ -393,9 +405,8 @@ class PriceHistory:
             self.last_error = f"no durable volume at {parent}"
             # INFO, not ERROR: on a dev host or in a test container there is no
             # /data and nothing is wrong.
-            _LOG.info("no price history: %s - §8.3 carry-forward has nothing "
-                      "to carry and the horizon stays as short as the feed",
-                      self.last_error)
+            _LOG.info("No price history is kept (%s), so missing hours are "
+                      "not filled from yesterday's prices.", self.last_error)
             return
         self.ok = True
         self._load()
@@ -437,9 +448,9 @@ class PriceHistory:
             # exactly what this handler says, and a third `ValueError` subclass
             # nobody has thought of is how this defect arrived the first time.
             self.last_error = f"unreadable ({err})"
-            _LOG.warning("price history at %s is %s - starting from empty. "
-                         "§8.3 carry-forward has nothing to carry until the "
-                         "next refresh has written a full day",
+            _LOG.warning("Price history at %s is %s, so it starts empty. "
+                         "Missing hours cannot be filled in until a full day "
+                         "is saved.",
                          self.path, self.last_error)
             return
         found = blob.get("version") if isinstance(blob, dict) else None
@@ -449,15 +460,15 @@ class PriceHistory:
         # would not notice a writer this build has never met.
         if not isinstance(blob, dict) or isinstance(found, bool) \
                 or not isinstance(found, int) or found != SCHEMA:
-            self.last_error = f"schema {found!r}, not {SCHEMA}"
-            _LOG.warning("price history at %s has %s - discarding it rather "
-                         "than guessing what its points mean",
+            self.last_error = f"version {found!r}, not {SCHEMA}"
+            _LOG.warning("Price history at %s has %s, so it is not used.",
                          self.path, self.last_error)
             return
         days = blob.get("days")
         if not isinstance(days, dict):
-            self.last_error = "no `days` object"
-            _LOG.warning("price history at %s has %s", self.path, self.last_error)
+            self.last_error = "no days in it"
+            _LOG.warning("Price history at %s has %s, so it is not used.",
+                         self.path, self.last_error)
             return
         self._days = self._usable_days(days)
 
@@ -504,20 +515,22 @@ class PriceHistory:
             kept[key] = rec
         notes = []
         if dropped:
-            notes.append(f"{len(dropped)} unusable day record(s) dropped "
-                         f"({', '.join(sorted(dropped))})")
+            notes.append(f"{messages.count(len(dropped), 'unusable day')} "
+                         f"dropped, " + ", ".join(day_words(d)
+                                                  for d in sorted(dropped)))
         if malformed:
             notes.append(
-                f"{sum(malformed.values())} malformed point row(s) in "
-                + ", ".join(f"{d} ({n})" for d, n in sorted(malformed.items())))
+                f"{messages.count(sum(malformed.values()), 'bad price')} in "
+                + ", ".join(f"{day_words(d)} ({n})"
+                            for d, n in sorted(malformed.items())))
         if notes:
             # Recorded, not silent: `yesterday()` and `words` both report
             # `last_error`, and a cache that quietly discards half a file reads
             # to an operator exactly like a normal first day.
-            self.last_error = "; ".join(notes)
-            _LOG.warning("price history at %s: %s - the controller starts "
-                         "anyway and the horizon is as short as the feed makes "
-                         "it", self.path, self.last_error)
+            self.last_error = " and ".join(notes)
+            _LOG.warning("Price history at %s: %s. The add-on starts anyway, "
+                         "and fills in only what the rest holds.",
+                         self.path, self.last_error)
         return kept
 
     def _save(self) -> bool:
@@ -680,10 +693,11 @@ class PriceHistory:
             # undone with the rest of the merge, so those rows are still in the
             # file and the next write that completes drops them again.
             self.last_error = (
-                f"{sum(junked.values())} malformed point row(s) dropped from "
-                + ", ".join(f"{d} ({n})" for d, n in sorted(junked.items())))
-            _LOG.warning("price history at %s: %s - the record is rewritten "
-                         "without them and the refresh continues",
+                f"{messages.count(sum(junked.values()), 'bad price')} dropped "
+                f"from " + ", ".join(f"{day_words(d)} ({n})"
+                                     for d, n in sorted(junked.items())))
+            _LOG.warning("Price history at %s: %s. The file is saved without "
+                         "them and the price update goes on.",
                          self.path, self.last_error)
         self._prune(stamp)
         if not self._save():
@@ -752,21 +766,23 @@ class PriceHistory:
         if self.last_error and not self._days:
             return PriceRead.no_data(
                 f"the price history at {self.path} is {self.last_error}, so "
-                f"§8.3 has no profile to carry forward for {want}; the plan "
-                f"covers only the hours the feed published")
+                f"there are no prices from yesterday to fill in for "
+                f"{day_words(want)}. The plan covers only the hours the feed "
+                f"published")
         rec = self._days.get(want)
         if rec is None:
-            have = ", ".join(sorted(self._days)) or "no days at all"
+            have = (", ".join(day_words(d) for d in sorted(self._days))
+                    or "no days at all")
             return PriceRead.no_data(
-                f"no published prices recorded for {want} (held: {have}), so "
-                f"§8.3 has no profile to carry forward. A record for another "
-                f"day is not a yesterday")
+                f"no published prices are kept for {day_words(want)}, only for "
+                f"{have}, so there are no prices from yesterday to fill in. A "
+                f"record for another day is not a yesterday")
         points, bad = _parse_points(rec.get("points"))
         if not points:
             why = bad or "it is empty"
             return PriceRead.no_data(
-                f"the {want} record holds no usable point ({why}), and an "
-                f"empty series is not a free day")
+                f"the {day_words(want)} record holds no usable price, {why}, "
+                f"and an empty series is not a free day")
         try:
             product = PriceProduct(rec.get("product"))
         except ValueError:
@@ -775,8 +791,9 @@ class PriceHistory:
                 f"which is not a PriceProduct. The optimiser switches on that "
                 f"enum, so a record that cannot name one cannot be a series")
         if bad:
-            _LOG.warning("price history: %s in the %s record were dropped; "
-                         "%d point(s) carried forward", bad, want, len(points))
+            _LOG.warning("Price history: %s dropped from the %s record, and "
+                         "%s kept.", bad, day_words(want),
+                         messages.count(len(points), "price"))
         return PriceRead.series(points, product,
                                 str(rec.get("provider") or "price_history"),
                                 stamp)
@@ -805,7 +822,7 @@ class PriceHistory:
         if not self._days:
             why = f" - {self.last_error}" if self.last_error else ""
             return f"empty{why} - nothing to carry forward yet"
-        held = "; ".join(_row_of(d, *_held(self._days[d]))
+        held = ", ".join(_row_of(d, *_held(self._days[d]))
                          for d in sorted(self._days, key=str))
         # A file that PARTLY loaded says so, or the dropped days read as days
         # that were simply never written.
@@ -833,7 +850,7 @@ def _parse_points(raw) -> tuple:
             continue
         out.append(pt)
     out.sort(key=lambda p: p.start.astimezone(timezone.utc))
-    return tuple(out), (f"{dropped} malformed point(s)" if dropped else "")
+    return tuple(out), (messages.count(dropped, "bad price") if dropped else "")
 
 
 class NoHistory:
@@ -861,5 +878,5 @@ class NoHistory:
 
     def yesterday(self, stamp: datetime) -> PriceRead:
         return PriceRead.no_data(
-            "this caller keeps no price history (NoHistory), so §8.3 has no "
-            "profile to carry forward")
+            "this caller keeps no price history, so there are no prices from "
+            "yesterday to fill in")
diff --git a/goodwe_controller/app/priceruns.py b/goodwe_controller/app/priceruns.py
new file mode 100644
index 0000000..848b78e
--- /dev/null
+++ b/goodwe_controller/app/priceruns.py
@@ -0,0 +1,203 @@
+"""OPT-11 P3: price runs. Which consecutive firm price slots are cheap, which
+are expensive, and which one a battery may sell in.
+
+Pure: prices, the time and a few energy figures in, a `RunPlan` out. No I/O,
+no clock. `modetrade.py` turns the plan into each battery's range and the
+site's trade; main.py rebuilds the plan at most once per 15 minutes and keeps
+a run that has started until its end (`keep_started()`).
+
+The owner's SAFETY-46 answer (2026-09-25): a trade is a run of consecutive
+slots, not one 15-minute interval. OPT-11-design section 2 ("Prices") and
+DECISIONS/OPT-11-battery-modes.md have the record.
+
+* The CHEAP run is the cheapest consecutive firm window long enough to put
+  the planned energy in at the chargers' combined rating.
+* A slot is EXPENSIVE when its price is above the cheap run's mean by at
+  least the required spread (`cycle_cost_threshold_eur`, widened as
+  `TariffPlan.arbitrage()` widens it). Give runs are the maximal consecutive
+  expensive slots. Holding batteries cover the house in them. The mean is
+  the lower of the next cheap run's and `ref_eur_kwh`, the cheap run the
+  batteries last filled in (main.py keeps it for 12 h): energy bought at
+  03:00 is still worth that price at 08:00, when the next cheap run in sight
+  is today's dearer midday (measured: without it a Cheap hours battery spent
+  its night charge on flat morning prices, then had nothing at 19:00).
+* The SELL run is the dearest consecutive window inside one give run long
+  enough to sell the sellers' energy at their rating, with no slot below 0
+  (section 17 of the spec: never export at a negative price).
+* A provisional (carried) price is never part of any run (section 8.3).
+"""
+
+import math
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+
+from .price import _cover_table
+
+# How far ahead runs are looked for. A day: tonight's cheap hours and the next
+# evening's expensive ones, without holding a battery for a peak two days out.
+HORIZON = timedelta(hours=24)
+
+# No plan, and why (the page words are in homeview / ui_text).
+NO_PRICES = "no_prices"           # fewer than two firm slots ahead
+NOT_WORTH = "not_worth"           # no slot clears the required spread
+
+
+@dataclass(frozen=True)
+class Run:
+    start: datetime
+    end: datetime
+    mean_eur_kwh: float
+
+    def holds(self, when: datetime) -> bool:
+        return self.start <= when < self.end
+
+
+@dataclass(frozen=True)
+class RunPlan:
+    """What the prices say for the next day. `reason` is None when there is
+    a plan (a cheap run and at least one give run), else why there is none."""
+    cheap: Run | None
+    give: tuple
+    sell: Run | None
+    level_eur_kwh: float | None
+    reason: str | None
+    # A slot after the cheap run clears the spread over the CHEAP RUN'S OWN
+    # price (not the reference): only then is buying in it worth a cycle.
+    charge_worth: bool = False
+
+    @property
+    def on(self) -> bool:
+        return self.reason is None
+
+    def give_at(self, when):
+        return next((g for g in self.give if g.holds(when)), None)
+
+    def next_give(self, when):
+        """The give run under way at `when`, else the next one, else None."""
+        return next((g for g in self.give if g.end > when), None)
+
+    def charge_useful(self) -> bool:
+        """Charging in the cheap run pays only if, after it, a slot clears
+        the spread over the cheap run's own price."""
+        return self.cheap is not None and self.charge_worth
+
+
+def firm_slots(points, now: datetime, horizon: timedelta = HORIZON) -> list:
+    """`[(start, end, eur_kwh)]`, ascending: the firm slots that have not
+    ended and start within the horizon. A slot's span is TARIFF-14's rule
+    (`price._cover_table()`), so 15-minute and hourly series both work."""
+    out = []
+    for start, end, p in _cover_table(points):
+        if p.provisional or end <= now or start >= now + horizon:
+            continue
+        if end > start:
+            out.append((start, end, float(p.eur_per_kwh)))
+    return out
+
+
+def _segments(slots) -> list:
+    """Split slots into runs of consecutive ones (each starts where the last
+    ended). A gap or a provisional slot breaks a run."""
+    segs, cur = [], []
+    for s in slots:
+        if cur and s[0] != cur[-1][1]:
+            segs.append(cur)
+            cur = []
+        cur.append(s)
+    if cur:
+        segs.append(cur)
+    return segs
+
+
+def _hours(s) -> float:
+    return (s[1] - s[0]).total_seconds() / 3600.0
+
+
+def _mean(win) -> float:
+    h = sum(_hours(s) for s in win)
+    return sum(_hours(s) * s[2] for s in win) / h
+
+
+def _windows(segs, need_h):
+    """Every consecutive window that lasts at least `need_h` hours, shortest
+    such from each start. If no segment is that long, each whole segment."""
+    out = []
+    for seg in segs:
+        for i in range(len(seg)):
+            h, j = 0.0, i
+            while j < len(seg) and h < need_h - 1e-9:
+                h += _hours(seg[j])
+                j += 1
+            if h >= need_h - 1e-9:
+                out.append(seg[i:j])
+    return out or [seg for seg in segs]
+
+
+def need_hours(kwh, kw, slots) -> float:
+    """How long a run must last: `kwh` at `kw`, and at least one slot."""
+    one = min((_hours(s) for s in slots), default=1.0)
+    if not (kwh and kw) or kwh <= 0 or kw <= 0:
+        return one
+    return max(one, float(kwh) / float(kw))
+
+
+def plan(points, now: datetime, *, required_eur_kwh: float, charge_kwh,
+         charge_kw, sell_kwh, sell_kw, horizon: timedelta = HORIZON,
+         ref_eur_kwh=None) -> RunPlan:
+    """The run plan for the next `horizon`. Ties go to the earliest window."""
+    if not (isinstance(required_eur_kwh, (int, float))
+            and math.isfinite(required_eur_kwh) and required_eur_kwh >= 0):
+        raise ValueError("required_eur_kwh must be a finite number >= 0")
+    slots = firm_slots(points, now, horizon)
+    if len(slots) < 2:
+        return RunPlan(None, (), None, None, NO_PRICES)
+    segs = _segments(slots)
+    wins = _windows(segs, need_hours(charge_kwh, charge_kw, slots))
+    best = min(wins, key=lambda w: (round(_mean(w), 9), w[0][0]))
+    cheap = Run(best[0][0], best[-1][1], _mean(best))
+    base = cheap.mean_eur_kwh if ref_eur_kwh is None else min(
+        cheap.mean_eur_kwh, float(ref_eur_kwh))
+    level = base + float(required_eur_kwh)
+    # Expensive: clears the spread, strictly dearer than the cheap mean, and
+    # not part of the cheap run itself (a threshold of 0 must not overlap).
+    dear = [s for s in slots
+            if s[2] >= level and s[2] > cheap.mean_eur_kwh
+            and not (cheap.start <= s[0] < cheap.end)]
+    give_segs = _segments(dear)
+    give = tuple(Run(g[0][0], g[-1][1], _mean(g)) for g in give_segs)
+    worth = any(s[0] >= cheap.end and s[2] >= cheap.mean_eur_kwh
+                + float(required_eur_kwh) for s in dear)
+    if not give:
+        return RunPlan(cheap, (), None, level, NOT_WORTH)
+    # Sell: inside one give run, never over a slot priced below 0.
+    sellable = [part for g in give_segs
+                for part in _segments([s for s in g if s[2] >= 0.0])]
+    sell = None
+    if sellable:
+        sw = _windows(sellable, need_hours(sell_kwh, sell_kw, slots))
+        top = max(sw, key=lambda w: (round(_mean(w), 9),
+                                     -w[0][0].timestamp()))
+        sell = Run(top[0][0], top[-1][1], _mean(top))
+    return RunPlan(cheap, give, sell, level, None, worth)
+
+
+def keep_started(old: RunPlan | None, new: RunPlan, now: datetime) -> RunPlan:
+    """A run under way keeps going to its end (no flapping on a new plan): the
+    cheap run, the give run and the sell run each come from `old` while `old`
+    holds `now` in it. The rest is `new`. A safety or peak rule can still stop
+    a run at any tick; that is not decided here."""
+    if old is None or not old.on:
+        return new
+    cheap = old.cheap if old.cheap and old.cheap.holds(now) else new.cheap
+    sell = old.sell if old.sell and old.sell.holds(now) else new.sell
+    g_old = old.give_at(now)
+    give = new.give
+    if g_old is not None:
+        give = (g_old,) + tuple(g for g in new.give
+                                if g.start >= g_old.end)
+    if cheap is new.cheap and sell is new.sell and g_old is None:
+        return new
+    worth = old.charge_worth if cheap is old.cheap else new.charge_worth
+    return RunPlan(cheap, give, sell, new.level_eur_kwh if new.on
+                   else old.level_eur_kwh, None if give else new.reason,
+                   worth)
diff --git a/goodwe_controller/app/pv.py b/goodwe_controller/app/pv.py
index 2a01f65..71c3691 100644
--- a/goodwe_controller/app/pv.py
+++ b/goodwe_controller/app/pv.py
@@ -50,21 +50,10 @@ SITE figure, and it publishes as an absence. A partial sum is a second way of
 reporting 0-where-there-was-production, one layer up, and it is refused for the
 same reason.
 
-THE SIGN CONVENTION: POSITIVE IS PRODUCTION. Derived from the two conventions
-this add-on already ships rather than assumed:
-
-    `meter_entity`   positive = IMPORTING from the grid   (DOCS.md, Sources)
-    `batt_entity`    positive = DISCHARGING the pack      (DOCS.md, Sources)
-
-Both are "positive = power arriving at the house's AC bus", and production
-arrives there too. There is deliberately NO `pv_invert` to go with
-`meter_invert` and `batt_invert`: those two quantities are BIPOLAR and are READ
-BY THE CONTROL PATH - a reversed `batt_entity` feeds SAFETY-30's per-unit sign
-check and SAFETY-31's circulating-power sensor with a plausible number the site
-then acts on - whereas production is unipolar and is read by nothing. A reversed
-PV sensor announces itself as -4 kW at noon in the very history this card
-creates, and flipping it here would only hide it. See
-`DECISIONS/TEL-11-pv-production.md` §2.
+THE SIGN CONVENTION: POSITIVE IS PRODUCTION, as for `meter_entity` and
+`batt_entity` ("power arriving at the house's AC bus"). TEL-14: a kWh meter or
+power clamp in the PV circuit reads the other way, so `pv_invert_entities`
+flips the sign per entity. See `DECISIONS/TEL-14-pv-sign.md`.
 """
 
 from .hass import BAD_STATES
@@ -193,7 +182,28 @@ def entity_is_ignored(opts: dict) -> bool:
                      if str(x or "").strip()])
 
 
-def total(readings) -> tuple:
+def inverted(opts: dict) -> frozenset:
+    """The entity ids `pv_invert_entities` flips. TEL-14."""
+    return frozenset(e for e in (str(x or "").strip()
+                                 for x in (opts.get("pv_invert_entities") or []))
+                     if e)
+
+
+def stray_inverts(opts: dict) -> list:
+    """`pv_invert_entities` entries naming no entity in the roster - a typo
+    that would otherwise leave a sign unflipped with nothing said. TEL-14."""
+    roster = set(entities(opts))
+    return sorted(e for e in inverted(opts) if e not in roster)
+
+
+# TEL-14: a reading below this is not standby draw. A correctly signed meter in
+# the PV circuit reads a few watts NEGATIVE at night (the owner's: 13 W); -50 W
+# clears that with room for a couple of such devices on one entity, while a
+# reversed sensor in daylight reads hundreds to thousands of watts below zero.
+NEGATIVE_W = -50.0
+
+
+def total(readings, flip=frozenset()) -> tuple:
     """`(watts, why, parts)` - the SITE's production, or an ABSENCE. TEL-12.
 
     `readings` is `[(entity_id, state), ...]` in `entities()` order, one entry
@@ -237,8 +247,13 @@ def total(readings) -> tuple:
     site: shading, a tripped string and nightfall are all real 0s, and a roster
     that went to `unknown` whenever one member read zero would report an absence
     on every clear evening and defeat the channel from the other end.
+
+    ⚠️ TEL-14: `flip` is `inverted(opts)`; each member's sign is applied HERE,
+    before the sum, so every surface reads the corrected figure. `0.0 - w`
+    rather than `-w`, so a flipped 0 W is `0.0` and never `-0.0` on the wire.
     """
-    parts = [(ent, *watts(st)) for ent, st in readings]
+    parts = [(ent, w if w is None or ent not in flip else 0.0 - w, why)
+             for ent, (w, why) in ((e, watts(st)) for e, st in readings)]
     if not parts:
         # No roster. `Controller` does not call this in that state - the gate is
         # `pv_roster` - but a reader of `parts` should never have to wonder.
diff --git a/goodwe_controller/app/selfconfig.py b/goodwe_controller/app/selfconfig.py
index da5ad38..5458253 100644
--- a/goodwe_controller/app/selfconfig.py
+++ b/goodwe_controller/app/selfconfig.py
@@ -82,6 +82,7 @@ import os
 
 import aiohttp
 
+from . import messages
 from .configui import changed_keys
 from .inverter import build_roster
 from .validate import validate_startup_config, validate_unit_ranges
@@ -130,11 +131,16 @@ class SaveRefused(Exception):
     own sentences, byte for byte; `changed` names the keys that moved.
     """
 
-    def __init__(self, kind, problems=(), changed=(), stored=None):
+    def __init__(self, kind, problems=(), changed=(), stored=None,
+                 moved=None):
         self.kind = kind
         self.problems = list(problems)
         self.changed = list(changed)
         self.stored = stored
+        # UX-13 P4: the keys the OTHER surface changed - stored-on-open
+        # against stored-now - when the caller knows what it opened. None
+        # when it does not. `changed` also holds the operator's own edits.
+        self.moved = None if moved is None else list(moved)
         super().__init__(f"save refused ({kind})")
 
 
@@ -287,7 +293,7 @@ async def problems_for(opts: dict, hass=None) -> list:
     return problems
 
 
-async def problems_and_ranges(opts: dict, hass=None):
+async def problems_and_ranges(opts: dict, hass=None, notes=None):
     """`problems_for()`, plus WHICH setpoint entities did not report a range.
 
     ⚠️ THE SECOND HALF EXISTS SO THE PAGE CANNOT LOOK GREEN FOR A REASON THE
@@ -302,6 +308,8 @@ async def problems_and_ranges(opts: dict, hass=None):
     has just typed a new `setpoint_entity` must be told about THAT entity, and
     a route that asked the running controller instead would report on the old
     one. That was the first shape of this and it disagreed with itself.
+
+    UX-13: a list passed as `notes` collects the validator's warnings too.
     """
     flat = str(opts.get("setpoint_entity", "") or "").strip()
 
@@ -328,7 +336,7 @@ async def problems_and_ranges(opts: dict, hass=None):
         # disagreement is itself the finding - so it is reported rather than
         # swallowed. Returning `[]` here would turn a crash into a silent
         # acceptance, which is worse than the 500 this replaced.
-        found = list(validate_startup_config(opts))
+        found = list(validate_startup_config(opts, notes=notes))
         if not found:
             found = [f"the configuration could not be composed ({type(exc).__name__}: "
                      f"{exc}), and the validator did not name a reason. This is a "
@@ -346,7 +354,8 @@ async def problems_and_ranges(opts: dict, hass=None):
         if flat and unit.setpoint_entity.strip().lower() == flat.lower():
             dev_min, dev_max = unit.dev_min, unit.dev_max
             break
-    problems = list(validate_startup_config(opts, dev_min, dev_max))
+    problems = list(validate_startup_config(opts, dev_min, dev_max,
+                                            notes=notes))
     problems += validate_unit_ranges(units, skip_entity=flat)
     unread = [unit.setpoint_entity for unit in units
               if unit.setpoint_entity and unit.dev_min is None
@@ -355,7 +364,7 @@ async def problems_and_ranges(opts: dict, hass=None):
 
 
 async def save(selfcfg: SelfConfig, proposed: dict, expect: str, *,
-               hass=None) -> dict:
+               hass=None, base=None) -> dict:
     """Validate, compare-and-swap, then write. Refuse rather than half-do.
 
     Returns `{"fingerprint": <the new one>}` on success. Raises `SaveRefused`
@@ -378,11 +387,17 @@ async def save(selfcfg: SelfConfig, proposed: dict, expect: str, *,
     genuinely wants what the other surface wrote replaced, the page reloads,
     shows them what changed, and they save again from THAT - which is a
     decision made in front of the difference rather than through it.
+
+    `base`, when given, is the blob the page opened (the one `expect` is the
+    fingerprint of). A stale refusal then also names the keys that moved
+    underneath it, so the page does not list the operator's own edits among
+    the settings "changed elsewhere" (UX-13 P2 test, finding a).
     """
     problems = await problems_for(proposed, hass)
     if problems:
-        _LOG.warning("panel REFUSED to save: %d configuration problem(s); "
-                     "nothing written. First: %s", len(problems), problems[0])
+        _LOG.warning("The settings page did not save, because of %s. The "
+                     "first: %s", messages.count(len(problems), "problem"),
+                     problems[0])
         raise SaveRefused("invalid", problems=problems)
 
     info = await selfcfg.info()
@@ -390,10 +405,15 @@ async def save(selfcfg: SelfConfig, proposed: dict, expect: str, *,
     actual = fingerprint(stored)
     if actual != expect:
         changed = changed_keys(stored, proposed)
-        _LOG.warning("panel REFUSED to save: the stored options changed "
-                     "underneath this page (keys: %s); nothing written",
-                     ", ".join(changed) or "none this page also edited")
-        raise SaveRefused("stale", changed=changed, stored=stored)
+        moved = (changed_keys(base, stored)
+                 if isinstance(base, dict) and fingerprint(base) == expect
+                 else None)
+        keys = changed if moved is None else moved
+        _LOG.warning("The settings page did not save, because the settings "
+                     "changed while it was open (keys: %s).",
+                     ", ".join(keys) or "none this page also edited")
+        raise SaveRefused("stale", changed=changed, stored=stored,
+                          moved=moved)
 
     await selfcfg.write_options(proposed)
     _LOG.info("options saved from the ingress panel; a restart is needed "
diff --git a/goodwe_controller/app/setuponly.py b/goodwe_controller/app/setuponly.py
new file mode 100644
index 0000000..bb4ce3e
--- /dev/null
+++ b/goodwe_controller/app/setuponly.py
@@ -0,0 +1,90 @@
+"""UX-15: setup-only mode. A new install serves the setup wizard and commands
+nothing. The rule and the argument are in DECISIONS/UX-15-setup-only-mode.md.
+
+`applies()` says when: the startup gate's only refusal is that no inverter is
+named. `serve()` then runs the ingress page on a `SetupOnly` stand-in for the
+controller. Nothing that can command is built: no Controller, no inverter, no
+MQTT, no meter task. Its HomeAssistant is read-only, so a service call refuses
+before anything is sent (hass.py), and `/action` refuses too (web.py).
+"""
+
+import asyncio
+import contextlib
+import logging
+import signal
+from datetime import datetime, timezone
+
+from . import messages, web
+from .inverter import roster_entries
+from .validate import actuator_writers, no_power_request_problem
+
+_LOG = logging.getLogger("goodwe.setup")
+
+
+def applies(opts: dict, problems) -> bool:
+    """True when the options name no inverter at all and that is the gate's
+    only refusal. Anything else refused keeps the exit 78 (CFG-01)."""
+    return (not actuator_writers(opts) and not roster_entries(opts)
+            and list(problems) == [no_power_request_problem()])
+
+
+class SetupOnly:
+    """What web.build_app() needs from a controller, and nothing that writes.
+
+    It holds no inverter and no publisher. `hass` must be read-only."""
+
+    setup_only = True
+    auto = False            # control is never started here
+    grid = None             # no meter is read here
+    inverters = ()
+
+    def __init__(self, opts: dict, hass, store):
+        if getattr(hass, "read_only", False) is not True:
+            raise ValueError("setup-only mode needs a read-only HomeAssistant")
+        self.o, self.hass, self.store = opts, hass, store
+        self.events: list[str] = []
+        self.hint = ""
+
+    def log_event(self, msg: str, hint: str | None = None) -> None:
+        stamp = datetime.now(timezone.utc).strftime("%H:%M:%S")
+        self.events.insert(0, f"{stamp} {msg}")
+        del self.events[40:]
+        if hint is not None:
+            self.hint = f"{datetime.now().astimezone():%H:%M} {hint}"
+
+    def status_payload(self, lang: str = "en") -> dict:
+        return {"setup_only": True, "mode": "setup_only",
+                "banner": messages.banner_setup_only(), "level": "warn",
+                "rows": [["Control", "not started, in setup"]],
+                "checks": [{"ok": False, "warn": True,
+                            "text": messages.row_setup_only()}],
+                "hint": self.hint, "events": list(self.events)}
+
+    async def handle_action(self, what):
+        # web.py answers 409 before it gets here. Nothing is done either way.
+        _LOG.warning("The page asked for an action in setup, so nothing "
+                     "was done.")
+        return None
+
+    async def shutdown(self) -> None:
+        """Nothing to wind down: nothing was ever commanded."""
+
+
+async def serve(opts: dict, hass, store, *, port: int) -> None:
+    """Serve the page in setup-only mode until the Supervisor stops us."""
+    controller = SetupOnly(opts, hass, store)
+    _LOG.warning("No inverter is named yet, so the add-on is in setup and "
+                 "controls nothing. Open its page to finish setup.")
+    controller.log_event("setup-only mode: no inverter named, nothing is "
+                         "commanded", hint=messages.hint("setup_only"))
+    runner = await web.start(controller, port=port)
+    stop = asyncio.Event()
+    loop = asyncio.get_running_loop()
+    for sig in (signal.SIGTERM, signal.SIGINT):
+        with contextlib.suppress(NotImplementedError):
+            loop.add_signal_handler(sig, stop.set)
+    try:
+        await stop.wait()
+    finally:
+        await runner.cleanup()
+        _LOG.info("stopped")
diff --git a/goodwe_controller/app/shadow.py b/goodwe_controller/app/shadow.py
index 7cd020f..ada7c30 100644
--- a/goodwe_controller/app/shadow.py
+++ b/goodwe_controller/app/shadow.py
@@ -279,6 +279,8 @@ that write is issued rather than skipped as unchanged.
 """
 from __future__ import annotations
 
+from . import messages
+
 # ⚠️ CFG-03's mirror. `test_defaults_pin.py` part 2 discovers every
 # module-level name ending in OPTION_DEFAULTS and asserts each value
 # reproduces config.yaml EXACTLY, so this table cannot drift from the shipped
@@ -316,11 +318,8 @@ WIRE_W = 0.0
 #: a cap that does not bind - and a number invented for the row would be a
 #: second helping of the defect this constant exists to disclose.
 SIZED_FROM_METER = (
-    "⚠️ AND ITS SIZE CAME FROM THE BILLED-QUARTER METER, WHICH HAS ONLY THE "
-    "HOUSE IN IT WHILE THE BATTERY IS HELD AT 0 W. A live run sizes the same "
-    "trade against a meter the battery is moving, so this is an UPPER BOUND "
-    "and not a prediction; how far under it a live run lands is a closed-loop "
-    "question and a shadow run cannot answer it")
+    "This is an upper limit, not a forecast, because the meter did not see "
+    "the battery move.")
 
 
 def mode(opts: dict) -> str:
@@ -371,18 +370,18 @@ def why(opts: dict, *, control_started: bool) -> str:
     # discount. What is true in every live state is that what this add-on
     # decides reaches the inverter; whether control is RUNNING is the
     # `Stopped` banner's question and it is answered there.
+    # UX-08: the same four rungs, in plain words. The setting is named by its
+    # value, "automatic" for `auto`, so each rung still reads differently.
     m = mode(opts)
+    live = "what the add-on decides reaches the inverters"
+    inert = "the add-on decides but sends nothing"
     if m == "off":
-        return ("off (shadow_mode: off) - NOT in shadow mode: what this "
-                "add-on decides DOES reach the inverter")
+        return f"Off, {live}"
     if m == "on":
-        return ("on (shadow_mode: on) - decisions are recorded and nothing "
-                "is commanded")
+        return f"On, {inert}"
     if control_started:
-        return ("off (shadow_mode: auto, control is started) - NOT in shadow "
-                "mode: what this add-on decides DOES reach the inverter")
-    return ("on (shadow_mode: auto, control is stopped) - decisions are "
-            "recorded and nothing is commanded")
+        return f"Off (automatic, control is started), {live}"
+    return f"On (automatic, control is stopped), {inert}"
 
 
 def words(opts: dict, *, control_started: bool, would_w: float | None,
@@ -409,10 +408,10 @@ def words(opts: dict, *, control_started: bool, would_w: float | None,
     that decided it did not apply, which is the shape of defect this card is
     about. TEST-14's rule with a new name on it.
 
-    ⚠️ AND THE PHRASE IS "ON THIS CYCLE", UNCONDITIONALLY, NOT ONLY WHEN THE
+    ⚠️ AND THE PHRASE IS "THIS CYCLE", UNCONDITIONALLY, NOT ONLY WHEN THE
     CAVEAT FIRES. Every number a shadow run records was reached from a plant
-    that did not respond; "WOULD HAVE COMMANDED -2 000 W" reads as a forecast
-    of a live run and no number here is one. The ⚠️ below is the STRONGER,
+    that did not respond; "would ask for -2 000 W" alone reads as a forecast
+    of a live run and no number here is one. UX-08 2d put it in plain words. The ⚠️ below is the STRONGER,
     conditional statement about the cycles where the answer can be multiples
     out - see this module's header for the measured table.
 
@@ -429,19 +428,19 @@ def words(opts: dict, *, control_started: bool, would_w: float | None,
     if not engaged(opts, control_started=control_started):
         return head
     if would_w is None:
-        return (f"{head}; no decision has been reached yet - the inverter is "
-                f"held at {WIRE_W:.0f} W")
+        return (f"{head}. No decision yet, the inverters stay at "
+                f"{WIRE_W:.0f} W.")
     # ⚠️ THE THOUSANDS SEPARATOR IS SWAPPED ON THE NUMBER ALONE. Applied to
     # the whole sentence it ate the comma out of `head` - and `head` is the
     # half that says WHICH RUNG decided, which is the claim MUTATION.md's
     # masking rule says must survive.
     num = f"{float(would_w):+,.0f}".replace(",", " ")
-    out = (f"{head}; ON THIS CYCLE WOULD HAVE COMMANDED {num} W, inverter "
-           f"held at {WIRE_W:.0f} W")
+    out = (f"{head}. This cycle it would ask for {num} W, the inverters stay "
+           f"at {WIRE_W:.0f} W.")
     if sized_from_meter:
         out += f" {SIZED_FROM_METER}"
     if reason:
-        out += f" - {reason}"
+        out += f" Why: {reason}."
     return out
 
 
@@ -471,25 +470,17 @@ def log_line(*, would_w: float, reason: str, sized_from_meter: bool) -> str:
 def banner(opts: dict, *, control_started: bool, latched: tuple = ()) -> tuple:
     """`(level, text)` for the top of the status page, or `None` when live.
 
-    ⚠️ IT NAMES A STANDING LATCH AND GOES RED FOR ONE. The shadow banner sits
-    ABOVE every other branch of the cascade, because "the battery is not being
-    controlled" is the one sentence that may never be displaced - but a
-    failsafe latch that is up while the controller is inert is up when it
-    stops being inert, and an operator who turns shadow mode off without
-    clearing it gets a battery that will not move and a green page that
-    never mentioned why. So the latch is carried INTO the shadow banner
-    rather than losing its own.
+    ⚠️ IT GOES RED FOR A STANDING LATCH. The shadow banner sits ABOVE every
+    other branch of the cascade, because "the battery is not controlled" is
+    the one sentence that may never be displaced - but a failsafe latch that
+    is up while the controller is inert is up when it stops being inert. So the
+    banner says a safety stop outlasts shadow mode, and each latch keeps its
+    own red row below, which names it and says how it clears. The words are
+    `messages.banner_shadow()`'s (UX-09); `latched` names them for callers.
     """
     if not engaged(opts, control_started=control_started):
         return None
-    text = ("SHADOW MODE - the battery is NOT being controlled. Every "
-            f"inverter is held at {WIRE_W:.0f} W and nothing this add-on "
-            "decides reaches the inverter.")
-    if latched:
-        return ("bad", text + " ⚠️ A FAILSAFE LATCH IS STILL UP ("
-                + ", ".join(latched) + ") and it will still be up when shadow "
-                "mode is turned off.")
-    return ("warn", text)
+    return ("bad" if latched else "warn", messages.banner_shadow(bool(latched)))
 
 
 def problems(opts: dict) -> list:
@@ -510,9 +501,6 @@ def problems(opts: dict) -> list:
     text = str("" if raw is None else raw).strip().lower()
     if text in MODES:
         return []
-    return [f"shadow_mode is {raw!r}, which is not one of "
-            + ", ".join(f"'{m}'" for m in MODES)
-            + ". 'auto' leaves the battery alone while control is stopped and "
-              "commands it once control is started; 'on' records every "
-              "decision and commands nothing at all; 'off' is ordinary "
-              "control."]
+    return [f"{messages.setting('shadow_mode')} is {messages.shown(raw)}. Choose "
+            + ", ".join(f"'{m}'" for m in MODES[:-1])
+            + f" or '{MODES[-1]}'."]
diff --git a/goodwe_controller/app/solarfc.py b/goodwe_controller/app/solarfc.py
new file mode 100644
index 0000000..89977cd
--- /dev/null
+++ b/goodwe_controller/app/solarfc.py
@@ -0,0 +1,254 @@
+"""OPT-11 P4: the solar forecast, read from a Home Assistant sensor.
+
+Pure: HA state dicts and the time in, a `Forecast` (or None and why) out.
+main.py reads the entities; dayplan.py uses the answer. FCST-01 replaces
+this later with the add-on's own forecast (owner answer, 2026-09-27).
+
+Two options name the sensors: `pv_forecast_entity`, the solar energy still
+to come TODAY, and `pv_forecast_tomorrow_entity`, TOMORROW's (optional; it
+is only needed for a cheap run before midnight). Supported, by the entities
+they create (DOCS.md lists them):
+
+* Forecast.Solar (HA core): `sensor.energy_production_today_remaining` and
+  `sensor.energy_production_tomorrow`. The state only; no hourly split.
+* Solcast PV Forecast (HACS `solcast_solar`):
+  `sensor.solcast_pv_forecast_forecast_remaining_today` and
+  `..._forecast_tomorrow`, with `detailedForecast` (or `detailedHourly`):
+  `[{period_start, pv_estimate}]`, kW per period.
+* Open-Meteo Solar Forecast (HACS `open_meteo_solar_forecast`):
+  `sensor.energy_production_today_remaining` / `..._tomorrow`, with
+  `wh_period`: `{period start: Wh}`.
+
+Any other sensor whose state is energy in Wh, kWh or MWh works too, as a
+state only. The unit is read, never guessed (the rule `pv.watts()` has).
+Without an hourly split, the day's energy is spread over a fixed bell from
+06:00 to 20:00 local time (`BELL_FROM_H`, `BELL_TO_H`).
+
+A reading older than `FRESH_S`, or from before local midnight, is stale,
+and a stale or missing forecast is no forecast: the day plan is off and
+every mode acts as in P3 option A.
+"""
+
+import math
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+
+from .hass import BAD_STATES
+from .tariff import BILLING_TZ
+
+KWH_PER = {"Wh": 0.001, "kWh": 1.0, "MWh": 1000.0}
+
+# Stale after 3 h. The integrations above refresh at least hourly, so a
+# 2 h limit would flag a site whose hourly poll was missed once.
+FRESH_S = 3 * 3600.0
+
+# The bell a state-only forecast is spread over, in local hours.
+BELL_FROM_H, BELL_TO_H = 6.0, 20.0
+
+# Why there is no forecast (the page words are in ui_text `home_words`).
+NOT_SET, MISSING, UNIT, STALE, BAD = (
+    "not_set", "missing", "unit", "stale", "bad")
+
+
+@dataclass(frozen=True)
+class Day:
+    """One day's forecast: `kwh` still to come (today) or in all (tomorrow),
+    and the hourly split if the sensor has one: `((start, end, kwh), ...)`."""
+    day0: datetime              # local midnight, as UTC
+    kwh: float
+    periods: tuple = ()
+
+
+@dataclass(frozen=True)
+class Forecast:
+    today: Day
+    tomorrow: Day | None
+    at: datetime                # when the sensor last reported
+
+    def between(self, t0: datetime, t1: datetime) -> float | None:
+        """kWh the sun should give between `t0` (now or later) and `t1`.
+        None when the span reaches the sunny hours of a day with no
+        forecast (tomorrow, when its sensor is not set)."""
+        if t1 <= t0:
+            return 0.0
+        last = self.tomorrow or self.today
+        if t1 > last.day0 + timedelta(days=1, hours=BELL_FROM_H):
+            return None
+        total = 0.0
+        for day in (self.today, self.tomorrow):
+            if day is None:
+                continue
+            a = max(t0, day.day0)
+            b = min(t1, day.day0 + timedelta(days=1))
+            if b > a:
+                total += _day_between(day, a, b, t0)
+        return total
+
+
+def _local_hour(t: datetime) -> float:
+    lt = t.astimezone(BILLING_TZ)
+    return lt.hour + lt.minute / 60.0 + lt.second / 3600.0
+
+
+def _bell(h: float) -> float:
+    """Cumulative share of a day's sun by local hour `h` (0..1)."""
+    if h <= BELL_FROM_H:
+        return 0.0
+    if h >= BELL_TO_H:
+        return 1.0
+    x = (h - BELL_FROM_H) / (BELL_TO_H - BELL_FROM_H)
+    return (1.0 - math.cos(math.pi * x)) / 2.0
+
+
+def _hours_since(day0, t):
+    return (t - day0).total_seconds() / 3600.0
+
+
+def _day_between(day: Day, a: datetime, b: datetime, now: datetime) -> float:
+    if day.periods:
+        out = 0.0
+        for s, e, kwh in day.periods:
+            lo, hi = max(a, s), min(b, e)
+            if hi > lo:
+                out += kwh * (hi - lo).total_seconds() / (e - s).total_seconds()
+        return out
+    # State only: `kwh` is what is left from `max(now, day0)` to the day's
+    # end, spread over the bell.
+    h_from = _hours_since(day.day0, max(now, day.day0))
+    left = 1.0 - _bell(h_from)
+    if left <= 1e-9:
+        return 0.0
+    share = (_bell(_hours_since(day.day0, b))
+             - _bell(_hours_since(day.day0, a))) / left
+    return day.kwh * max(0.0, share)
+
+
+def _parse_time(v):
+    try:
+        t = datetime.fromisoformat(str(v).replace("Z", "+00:00"))
+    except (TypeError, ValueError):
+        return None
+    return t if t.tzinfo else t.replace(tzinfo=timezone.utc)
+
+
+def _periods(attrs: dict, day0: datetime) -> tuple:
+    """The hourly split, if the sensor has one, for the day at `day0`."""
+    d1 = day0 + timedelta(days=1)
+    out = []
+    for key in ("detailedForecast", "detailedHourly"):
+        rows = attrs.get(key)
+        if isinstance(rows, list) and rows:
+            starts = []
+            for r in rows:
+                if not isinstance(r, dict):
+                    continue
+                t = _parse_time(r.get("period_start"))
+                try:
+                    kw = float(r.get("pv_estimate"))
+                except (TypeError, ValueError):
+                    continue
+                if t is not None and math.isfinite(kw) and kw >= 0:
+                    starts.append((t, kw))
+            starts.sort()
+            for i, (t, kw) in enumerate(starts):
+                step = (starts[i + 1][0] - t if i + 1 < len(starts)
+                        else timedelta(minutes=30 if key ==
+                                       "detailedForecast" else 60))
+                if step <= timedelta(0) or step > timedelta(hours=1):
+                    step = timedelta(minutes=30 if key == "detailedForecast"
+                                     else 60)
+                if day0 <= t < d1:
+                    out.append((t, t + step,
+                                kw * step.total_seconds() / 3600.0))
+            if out:
+                return tuple(out)
+    wh = attrs.get("wh_period")
+    if isinstance(wh, dict) and wh:
+        rows = []
+        for k, v in wh.items():
+            t = _parse_time(k)
+            try:
+                e = float(v)
+            except (TypeError, ValueError):
+                continue
+            if t is not None and math.isfinite(e) and e >= 0:
+                rows.append((t, e / 1000.0))
+        rows.sort()
+        for i, (t, kwh) in enumerate(rows):
+            nxt = rows[i + 1][0] if i + 1 < len(rows) else t + timedelta(
+                hours=1)
+            if nxt - t > timedelta(hours=1) or nxt <= t:
+                nxt = t + timedelta(hours=1)
+            if day0 <= t < d1:
+                out.append((t, nxt, kwh))
+    return tuple(out)
+
+
+def _day(state, day0, now, *, today):
+    """`(Day, None)` or `(None, why)` from one sensor's state dict."""
+    if state is None:
+        return None, MISSING
+    raw = str(state.get("state", "")).strip()
+    if raw.lower() in BAD_STATES:
+        return None, MISSING
+    try:
+        v = float(raw)
+    except ValueError:
+        return None, BAD
+    attrs = state.get("attributes") or {}
+    unit = str(attrs.get("unit_of_measurement") or "").strip()
+    if unit not in KWH_PER:
+        return None, UNIT
+    kwh = v * KWH_PER[unit]
+    if not math.isfinite(kwh) or kwh < 0:
+        return None, BAD
+    periods = _periods(attrs, day0)
+    if periods and today:
+        # The split is the whole day; keep what is still to come, scaled so
+        # it adds up to the state (the state is what the integration says
+        # is left).
+        left = sum(k * max(0.0, min(1.0, (e - max(s, now)).total_seconds()
+                                    / (e - s).total_seconds()))
+                   for s, e, k in periods)
+        if left > 1e-6:
+            f = kwh / left
+            periods = tuple((s, e, k * f) for s, e, k in periods)
+    return Day(day0, kwh, periods), None
+
+
+def _reported(state):
+    ts = [_parse_time(state.get(k)) for k in
+          ("last_reported", "last_updated", "last_changed")]
+    ts = [t for t in ts if t is not None]
+    return max(ts) if ts else None
+
+
+def read(today_state, tomorrow_state, now: datetime, *,
+         configured=True):
+    """`(Forecast, None)` or `(None, why)`. `tomorrow_state` may be None
+    (the option is not set, or the sensor is missing): the forecast then
+    covers today only."""
+    if not configured:
+        return None, NOT_SET
+    here = now.astimezone(BILLING_TZ)
+    d0 = datetime(here.year, here.month, here.day, tzinfo=BILLING_TZ)
+    nd = d0.date() + timedelta(days=1)
+    d1 = datetime(nd.year, nd.month, nd.day, tzinfo=BILLING_TZ)
+    day0, day1 = d0.astimezone(timezone.utc), d1.astimezone(timezone.utc)
+    today, why = _day(today_state, day0, now, today=True)
+    if today is None:
+        return None, why
+    at = _reported(today_state)
+    # A reading from before local midnight is yesterday's "left today" (0
+    # after sunset) until the integration refreshes: stale, not a dark day.
+    if at is None or at < day0 or (now - at).total_seconds() > FRESH_S \
+            or (at - now).total_seconds() > 300:
+        return None, STALE
+    tomorrow = None
+    if tomorrow_state is not None:
+        t, _w = _day(tomorrow_state, day1, now, today=False)
+        t_at = _reported(tomorrow_state)
+        if t is not None and t_at is not None and t_at >= day0 \
+                and (now - t_at).total_seconds() <= FRESH_S:
+            tomorrow = t
+    return Forecast(today, tomorrow, at), None
diff --git a/goodwe_controller/app/static/app.css b/goodwe_controller/app/static/app.css
new file mode 100644
index 0000000..db67144
--- /dev/null
+++ b/goodwe_controller/app/static/app.css
@@ -0,0 +1,246 @@
+/* UX-13 page styles. Colours follow the approved mockup (UX-13-mockup.html,
+   version 2) and prefers-color-scheme. No web fonts, no external files. */
+:root{
+  --bg:#f3f4f6;--card:#ffffff;--ink:#1b1d21;--muted:#5b626c;--faint:#8a919b;--line:#e2e5e9;
+  --accent:#1c64d9;--accent-soft:#e6efff;--on-accent:#ffffff;
+  --ok:#17773a;--ok-bg:#e6f4eb;--warn:#955300;--warn-bg:#fcefd9;--bad:#c02626;--bad-bg:#fce8e8;--info:#5b626c;--info-bg:#eceef1;
+  --solar:#c98a00;--house:#6c47c2;--grid:#56657a;--batt:#17773a;
+  --cheap:#8fcca4;--dear:#f0ad72;--mid:#cfd5dc;--track:#dde1e6;--shadow:0 1px 2px rgba(0,0,0,.05);
+}
+@media (prefers-color-scheme:dark){:root:not([data-theme="light"]){
+  --bg:#111317;--card:#1a1d23;--ink:#e7e9ec;--muted:#a2a9b3;--faint:#7c848f;--line:#2b3038;
+  --accent:#6ea2ff;--accent-soft:#1d2a44;--on-accent:#0b1220;
+  --ok:#7ccf98;--ok-bg:#15291d;--warn:#f3c16b;--warn-bg:#2e2412;--bad:#f28b82;--bad-bg:#3a1a19;--info:#a2a9b3;--info-bg:#22262d;
+  --solar:#f0c04a;--house:#b39cf0;--grid:#9fb0c6;--batt:#7ccf98;
+  --cheap:#3f7d56;--dear:#9a5a26;--mid:#3a414b;--track:#343a44;--shadow:none;
+}}
+:root[data-theme="dark"]{
+  --bg:#111317;--card:#1a1d23;--ink:#e7e9ec;--muted:#a2a9b3;--faint:#7c848f;--line:#2b3038;
+  --accent:#6ea2ff;--accent-soft:#1d2a44;--on-accent:#0b1220;
+  --ok:#7ccf98;--ok-bg:#15291d;--warn:#f3c16b;--warn-bg:#2e2412;--bad:#f28b82;--bad-bg:#3a1a19;--info:#a2a9b3;--info-bg:#22262d;
+  --solar:#f0c04a;--house:#b39cf0;--grid:#9fb0c6;--batt:#7ccf98;
+  --cheap:#3f7d56;--dear:#9a5a26;--mid:#3a414b;--track:#343a44;--shadow:none;
+}
+*{box-sizing:border-box}
+[hidden]{display:none!important}
+html{-webkit-text-size-adjust:100%}
+body{margin:0;background:var(--bg);color:var(--ink);font:15px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;overflow-x:hidden}
+button,input,select{font:inherit;color:inherit}
+a{color:var(--accent)}
+:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.top{display:flex;align-items:center;gap:12px;padding:12px 16px 8px;max-width:820px;margin:0 auto}
+.logo{width:36px;height:36px;border-radius:10px;background:var(--accent-soft);display:grid;place-items:center;color:var(--accent);flex:none}
+.app{font-weight:700;font-size:17px;line-height:1.2}
+.pill{display:flex;flex-wrap:wrap;align-items:center;gap:0 6px;font-size:13px;color:var(--muted)}
+.dot{width:8px;height:8px;border-radius:50%;background:var(--ok);flex:none}
+.dot.warn{background:var(--warn)}.dot.bad{background:var(--bad)}
+.tabs{display:flex;gap:4px;max-width:820px;margin:0 auto;padding:0 16px;border-bottom:1px solid var(--line)}
+.tab{border:0;background:none;padding:10px 12px;border-bottom:2px solid transparent;color:var(--muted);cursor:pointer;display:flex;align-items:center;gap:6px;min-height:44px;position:relative}
+.tab[aria-selected="true"]{color:var(--accent);border-bottom-color:var(--accent);font-weight:600}
+.tab svg{width:20px;height:20px}
+.badge{font-size:11px;font-weight:700;background:var(--warn);color:var(--card);border-radius:9px;padding:0 6px;line-height:18px}
+.badge.bad{background:var(--bad)}
+@media (max-width:640px){
+  .tabs{position:fixed;bottom:0;left:0;right:0;z-index:20;background:var(--card);border-top:1px solid var(--line);border-bottom:0;padding:0 4px env(safe-area-inset-bottom);justify-content:space-around;gap:0}
+  .tab{flex-direction:column;gap:0;font-size:11px;padding:6px 4px;border-bottom:0;border-top:2px solid transparent;flex:1;min-width:0}
+  .tab[aria-selected="true"]{border-top-color:var(--accent)}
+  .tab .badge{position:absolute;top:2px;left:calc(50% + 6px)}
+  .wrap{padding-bottom:96px!important}
+}
+.wrap{max-width:820px;margin:0 auto;padding:16px 16px 40px}
+h2{font-size:15px;margin:0 0 10px;font-weight:650}
+.card{background:var(--card);border:1px solid var(--line);border-radius:12px;padding:14px;margin-bottom:12px;box-shadow:var(--shadow)}
+.muted{color:var(--muted)} .small{font-size:13px} .tiny{font-size:12px}
+.row{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+.spread{justify-content:space-between}
+.grow{flex:1 1 auto;min-width:0}
+.banner{border-radius:12px;padding:12px 14px;margin-bottom:12px;display:flex;gap:10px;align-items:flex-start;font-weight:600}
+.banner .ic{flex:none;margin-top:2px}
+.b-ok{background:var(--ok-bg);color:var(--ok)} .b-warn{background:var(--warn-bg);color:var(--warn)} .b-bad{background:var(--bad-bg);color:var(--bad)}
+.banner small{display:block;font-weight:400;color:var(--ink);margin-top:2px}
+.tiles{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:8px}
+@media (max-width:640px){.tiles{grid-template-columns:repeat(2,minmax(0,1fr))}}
+.tile{border:1px solid var(--line);border-radius:10px;padding:10px;min-width:0}
+.tile .lab{font-size:13px;color:var(--muted);display:flex;align-items:center;gap:6px}
+.tile .val{font-size:22px;font-weight:700;font-variant-numeric:tabular-nums;line-height:1.25;margin-top:2px}
+.tile .val small{font-size:13px;font-weight:500;color:var(--muted)}
+.tile .sub{font-size:12px;color:var(--muted)}
+.sw-solar{color:var(--solar)} .sw-house{color:var(--house)} .sw-grid{color:var(--grid)} .sw-batt{color:var(--batt)}
+.brow{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:2px 10px;padding:10px 0;border-top:1px solid var(--line)}
+.brow:first-child{border-top:0}
+.lvl{height:10px;background:var(--track);border-radius:6px;overflow:hidden;grid-column:1/-1;margin:4px 0 2px}
+.lvl>i{display:block;height:100%;background:var(--batt);border-radius:6px}
+.lvl.none>i{background:var(--faint)}
+/* the plan chart */
+.chart{position:relative;margin:18px 0 4px}
+.bars{display:flex;align-items:flex-end;gap:2px;height:72px}
+.bars i{flex:1;border-radius:3px 3px 0 0;background:var(--mid);min-width:0}
+.bars i.cheap{background:var(--cheap)}
+/* not by colour alone: expensive hours are striped, estimates are faded */
+.bars i.dear{background:repeating-linear-gradient(135deg,var(--dear) 0 4px,color-mix(in srgb,var(--dear) 60%,var(--card)) 4px 7px)}
+.bars i.est{opacity:.55}
+.bars i.none{background:none;border-bottom:2px dotted var(--faint);height:2px!important}
+.lane{position:relative;height:18px;margin-top:4px;background:var(--bg);border-radius:4px}
+.lane b{position:absolute;top:2px;bottom:2px;border-radius:3px;min-width:3px}
+.lane .house{background:repeating-linear-gradient(90deg,var(--mid) 0 6px,transparent 6px 9px);top:6px;bottom:6px}
+.lane .grid{background:var(--accent)}
+.lane .give{background:repeating-linear-gradient(135deg,var(--house) 0 4px,color-mix(in srgb,var(--house) 55%,var(--card)) 4px 7px)}
+.lane .cycle{background:repeating-linear-gradient(90deg,var(--warn) 0 3px,var(--warn-bg) 3px 6px)}
+.lane .peak{background:var(--bad)}
+.lanelab{font-size:12px;color:var(--muted);margin-top:6px}
+.nowline{position:absolute;top:-4px;bottom:0;width:2px;background:var(--ink);opacity:.7;pointer-events:none}
+.nowline span{position:absolute;top:-15px;left:-10px;font-size:10px}
+.axis{display:flex;justify-content:space-between;font-size:11px;color:var(--faint);margin-top:4px}
+.legend{display:flex;flex-wrap:wrap;gap:4px 12px;font-size:12px;color:var(--muted);margin-top:8px}
+.legend span{display:inline-flex;align-items:center;gap:5px}
+.legend i{width:14px;height:10px;border-radius:2px;display:inline-block}
+.legend i.house{background:repeating-linear-gradient(90deg,var(--mid) 0 4px,transparent 4px 6px)}
+ul.plain{list-style:none;margin:8px 0 0;padding:0}
+ul.plain li{padding:6px 0;border-top:1px solid var(--line)}
+ul.plain li:first-child{border-top:0}
+.meter{height:12px;background:var(--track);border-radius:6px;overflow:hidden;margin:8px 0 4px}
+.meter i{display:block;height:100%;background:var(--accent)}
+.meter i.warn{background:var(--warn)} .meter i.bad{background:var(--bad)}
+.alert{display:flex;gap:10px;padding:10px 0;border-top:1px solid var(--line)}
+.alert:first-child{border-top:0}
+.sev{flex:none;width:24px;height:24px;border-radius:50%;display:grid;place-items:center;font-size:13px;font-weight:800}
+.sev.warning{background:var(--warn-bg);color:var(--warn)} .sev.alarm{background:var(--bad-bg);color:var(--bad)} .sev.info{background:var(--info-bg);color:var(--info)} .sev.ok{background:var(--ok-bg);color:var(--ok)}
+.alert .t{font-weight:600}
+.btn{border:1px solid var(--line);background:var(--card);padding:9px 14px;border-radius:10px;cursor:pointer;min-height:44px}
+.btn.primary{background:var(--accent);border-color:var(--accent);color:var(--on-accent);font-weight:600}
+.btn.danger{color:var(--bad);border-color:var(--bad)}
+.btn:disabled{opacity:.5;cursor:not-allowed}
+a.btn{display:inline-flex;align-items:center;text-decoration:none;color:var(--ink)}
+details.more{margin-top:12px;border-top:1px solid var(--line)}
+details.more>summary{cursor:pointer;padding:10px 0;color:var(--accent);font-size:14px;min-height:44px;display:flex;align-items:center}
+table.rows{width:100%;border-collapse:collapse;font-size:13px}
+table.rows td{padding:6px 0;border-bottom:1px solid var(--line);vertical-align:top}
+table.rows td:last-child{text-align:right;font-variant-numeric:tabular-nums;font-weight:600;padding-left:12px;overflow-wrap:anywhere}
+table.rows tr:last-child td{border-bottom:0}
+ul.checks{margin:6px 0 0;padding-left:0;list-style:none;font-size:13px}
+ul.checks li{margin:3px 0}
+.c-ok{color:var(--ok)} .c-warn{color:var(--warn)} .c-bad{color:var(--bad)}
+.kv{display:grid;grid-template-columns:auto minmax(0,1fr);gap:4px 12px;font-size:14px;margin-top:10px}
+.kv dt{color:var(--muted)} .kv dd{margin:0}
+#toast{position:fixed;left:50%;transform:translateX(-50%);bottom:24px;z-index:30;background:var(--ink);color:var(--bg);padding:10px 14px;border-radius:10px;font-size:14px;max-width:calc(100% - 32px);opacity:0;pointer-events:none;transition:opacity .2s}
+#toast.show{opacity:1}
+@media (max-width:640px){#toast{bottom:84px}}
+dialog{border:1px solid var(--line);border-radius:14px;background:var(--card);color:var(--ink);max-width:min(420px,calc(100% - 32px));padding:18px}
+dialog::backdrop{background:rgba(0,0,0,.45)}
+@media (prefers-reduced-motion:reduce){*{transition:none!important}}
+.tip{position:fixed;z-index:40;background:var(--ink);color:var(--bg);font-size:12px;line-height:1.35;padding:6px 8px;border-radius:8px;pointer-events:none;max-width:240px;opacity:0;transition:opacity .1s;box-shadow:0 2px 8px rgba(0,0,0,.25);left:0;top:0}
+.tip.show{opacity:1}
+.tip b{display:block;font-weight:700}
+.tip span{display:block}
+.chart [data-tip]{cursor:default}
+.chart [data-tip]:hover,.chart [data-tip]:focus,.chart .hot{outline:2px solid var(--ink);outline-offset:-1px}
+.sr{position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap}
+/* UX-13 P2: Settings, the Installer view (mockup version 2) */
+.btn.link{border:0;background:none;color:var(--accent);padding:6px 0;min-height:0}
+.search{width:100%;border:1px solid var(--line);background:var(--card);border-radius:10px;padding:10px 12px;min-height:44px;margin-bottom:10px}
+.key{font:11px/1.3 ui-monospace,SFMono-Regular,Menlo,monospace;color:var(--faint);overflow-wrap:anywhere}
+.chip{display:inline-flex;align-items:center;gap:4px;font-size:12px;border-radius:999px;padding:1px 8px;background:var(--info-bg);color:var(--muted);white-space:nowrap}
+.chip.now{background:var(--ok-bg);color:var(--ok)} .chip.rs{background:var(--warn-bg);color:var(--warn)}
+.chip.bad{background:var(--bad-bg);color:var(--bad)} .chip.changed{background:var(--accent-soft);color:var(--accent)}
+details.grp{background:var(--card);border:1px solid var(--line);border-radius:12px;margin-bottom:10px;box-shadow:var(--shadow)}
+details.grp>summary{list-style:none;cursor:pointer;padding:14px;display:flex;gap:10px;align-items:center;min-height:56px;flex-wrap:wrap}
+details.grp>summary::-webkit-details-marker{display:none}
+details.grp>summary .grow{flex:1 1 200px}
+details.grp>summary .gdesc{display:block}
+details.grp>summary .chev{transition:transform .15s;flex:none;font-size:22px;line-height:1;width:18px;text-align:center;color:var(--muted)}
+details.grp[open]>summary .chev{transform:rotate(90deg)}
+.gchips,.gbadge{display:inline-flex;flex-wrap:wrap;gap:4px}
+details.grp .body{padding:0 14px 8px}
+details.sub{border-top:1px solid var(--line);margin-top:4px}
+details.sub>summary{cursor:pointer;padding:10px 0;color:var(--accent);font-size:14px;min-height:44px;display:flex;align-items:center}
+.subhead{font-size:12px;text-transform:uppercase;letter-spacing:.04em;color:var(--faint);margin:14px 0 0;font-weight:700}
+.f{padding:12px 0;border-top:1px solid var(--line);min-width:0}
+.part>.f:first-child,.subhead+.f{border-top:0}
+.f .lbl{font-weight:600;font-size:14px}
+.f .help{font-size:13px;color:var(--muted);margin-top:4px}
+.f .ctl{margin-top:8px;min-width:0}
+.f.inline{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:4px 12px;align-items:start}
+.f.inline .ctl{margin-top:0;grid-row:1;grid-column:2}
+.f.inline .help,.f.inline .msgs{grid-column:1/-1}
+.f.changed>.head .lbl::after{content:" •";color:var(--accent)}
+.msg{font-size:13px;margin-top:6px;display:flex;gap:6px;align-items:flex-start;border-radius:8px;padding:6px 8px;overflow-wrap:anywhere}
+.msg .mi{font-weight:800;flex:none}
+.msg.bad{background:var(--bad-bg);color:var(--bad)} .msg.warn{background:var(--warn-bg);color:var(--warn)} .msg.info{background:var(--info-bg);color:var(--info)}
+.f.has-bad .ctl select,.f.has-bad .ctl input,.f.has-bad .ent-btn{border-color:var(--bad)}
+.switch{position:relative;width:52px;height:44px;border:0;background:none;cursor:pointer;flex:none;padding:0}
+.switch::before{content:"";position:absolute;left:2px;top:8px;width:48px;height:28px;border-radius:14px;background:var(--track);transition:background .15s}
+.switch::after{content:"";position:absolute;top:11px;left:5px;width:22px;height:22px;border-radius:50%;background:#fff;box-shadow:0 1px 2px rgba(0,0,0,.3);transition:left .15s}
+.switch[aria-checked="true"]::before{background:var(--accent)}
+.switch[aria-checked="true"]::after{left:25px}
+.swrap{display:inline-flex;align-items:center;gap:8px;min-height:44px}
+.swtext{font-size:13px;color:var(--muted)}
+select.sel,input.txt,input.num{border:1px solid var(--line);background:var(--card);border-radius:10px;padding:9px 10px;min-height:44px;max-width:100%}
+select.sel{width:100%}
+.row>select.sel{width:auto;flex:1 1 200px}
+input.num{width:110px;text-align:right;font-variant-numeric:tabular-nums}
+input.txt{width:100%}
+input:disabled{opacity:.6}
+.seg{display:inline-flex;border:1px solid var(--line);border-radius:10px;overflow:hidden;max-width:100%;flex-wrap:wrap}
+.seg button{border:0;background:var(--card);padding:8px 12px;min-height:44px;cursor:pointer;border-left:1px solid var(--line)}
+.seg button:first-child{border-left:0}
+.seg button[aria-checked="true"]{background:var(--accent-soft);color:var(--accent);font-weight:600}
+.choice{display:flex;gap:10px;align-items:flex-start;border:1px solid var(--line);border-radius:10px;padding:10px 12px;margin-top:8px;cursor:pointer;width:100%;text-align:left;background:var(--card);min-height:44px}
+.choice[aria-checked="true"]{border-color:var(--accent);background:var(--accent-soft)}
+.choice .rad{flex:none;width:18px;height:18px;border-radius:50%;border:2px solid var(--faint);margin-top:2px}
+.choice[aria-checked="true"] .rad{border:5px solid var(--accent)}
+.slider{display:flex;align-items:center;gap:10px;width:100%}
+.slider input[type=range]{flex:1;min-width:0;accent-color:var(--accent);height:28px}
+.unit{color:var(--muted);font-size:13px;white-space:nowrap}
+.ent-btn{width:100%;text-align:left;border:1px solid var(--line);background:var(--card);border-radius:10px;padding:8px 10px;min-height:44px;cursor:pointer;display:flex;gap:8px;align-items:center}
+.ent-btn .grow{min-width:0}
+.ent-btn .grow>div{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.ent-pop{border:1px solid var(--line);border-radius:10px;margin-top:6px;background:var(--card);overflow:hidden}
+.ent-pop input[type=search]{border:0;border-bottom:1px solid var(--line);width:100%;padding:10px;background:var(--card);min-height:44px}
+.ent-note{padding:6px 10px}
+.ent-list{max-height:240px;overflow:auto}
+.ent-opt{display:flex;gap:8px;align-items:center;width:100%;border:0;border-bottom:1px solid var(--line);background:none;text-align:left;padding:8px 10px;cursor:pointer;min-height:44px}
+.ent-opt:hover,.ent-opt:focus{background:var(--accent-soft)}
+.ent-opt .grow{min-width:0}
+.ent-opt .grow>div{overflow-wrap:anywhere}
+.ent-opt .v{font-variant-numeric:tabular-nums;font-size:13px;color:var(--muted);white-space:nowrap}
+.ent-all{display:flex;gap:6px;padding:6px 10px;align-items:center;min-height:44px}
+.elist .erow{padding:6px 0;border-bottom:1px dashed var(--line)}
+.elist>.btn{margin-top:8px}
+.plist .prow{display:grid;gap:6px}
+.plist .pf{display:flex;flex-direction:column;gap:2px}
+.plist .pf>select.sel{width:100%}
+input.txt.time{width:5.5em;text-align:center;font-variant-numeric:tabular-nums}
+.inv{border:1px solid var(--line);border-radius:10px;padding:0 12px;margin:10px 0}
+.inv>.hd{display:flex;align-items:center;gap:8px;padding:10px 0;border-bottom:1px solid var(--line);font-weight:600;flex-wrap:wrap}
+.inv>.f:nth-child(2){border-top:0}
+.invs>.btn{margin:4px 0 8px}
+#savebar{position:fixed;left:0;right:0;bottom:0;z-index:15}
+#savebar .in{max-width:820px;margin:0 auto 10px;padding:10px 12px;background:var(--ink);color:var(--bg);border-radius:12px;display:flex;flex-wrap:wrap;gap:8px;align-items:center;box-shadow:0 4px 16px rgba(0,0,0,.25);width:calc(100% - 32px)}
+#savebar .btn{min-height:44px;padding:6px 12px;background:transparent;color:var(--bg);border-color:rgba(127,127,127,.6)}
+#savebar .btn.primary{background:var(--accent);border-color:var(--accent);color:var(--on-accent)}
+@media (max-width:640px){#savebar{bottom:62px}}
+#s-set{padding-bottom:80px}
+/* UX-13 P4: the setup wizard */
+.steps{display:flex;gap:4px;margin:4px 0 12px}
+.steps i{flex:1;height:6px;border-radius:3px;background:var(--track)}
+.steps i.done{background:var(--accent)} .steps i.cur{background:var(--accent);opacity:.55}
+.msg.ok{background:var(--ok-bg);color:var(--ok)}
+.sev.bad{background:var(--bad-bg);color:var(--bad)} .sev.warn{background:var(--warn-bg);color:var(--warn)}
+.checklist li{display:flex;gap:8px;align-items:flex-start;overflow-wrap:anywhere}
+.kettle .row{margin-top:8px}
+/* UX-13 P3: the Batteries screen and the Simple settings view */
+.bcard .hd{display:flex;align-items:center;gap:10px;margin-bottom:10px}
+.bcard .name{font-weight:700;font-size:16px}
+.bcard .modebox .lbl{display:block;margin-bottom:4px}
+.bcard .modebox .help{font-size:13px;color:var(--muted);margin-top:4px}
+.bcard.off .modebox{opacity:.6}
+.bcard .kv dd{overflow-wrap:anywhere}
+.switch:disabled{opacity:.45;cursor:not-allowed}
+select.sel:disabled{opacity:.6}
+.simple .card>.row{margin-bottom:4px}
+.vhide{display:none!important}
+.simple .card>.f{border-top:0;padding-top:0}
+.simple .f>.head{display:flex;justify-content:space-between;align-items:center;gap:8px;flex-wrap:wrap}
+.simple .card .lbl{font-weight:600;font-size:15px}
+.simple .inv .hd{border-bottom:0}
+.simple .inv .f{border-top:0;padding-top:0}
diff --git a/goodwe_controller/app/static/app.js b/goodwe_controller/app/static/app.js
new file mode 100644
index 0000000..e5354b8
--- /dev/null
+++ b/goodwe_controller/app/static/app.js
@@ -0,0 +1,490 @@
+"use strict";
+/* UX-13 P1: the page shell and the Home screen. Plain JS, no framework, no
+   external files. Every URL is relative, because ingress serves the add-on
+   under a generated path prefix. Every word comes from app/ui_text (fixed
+   labels) or from /status (sentences built by app/homeview.py), so STYLE.md
+   is checked in Python. Data is always set as text, never as HTML. */
+(function () {
+  // P5: English or Dutch, by the browser's language. A word missing in Dutch
+  // falls back to English, key by key (app/uitext.py does the same).
+  const ALL = JSON.parse(document.getElementById("ui-text").textContent);
+  const LANG = /^nl\b/i.test(navigator.language || "") ? "nl" : "en";
+  const merge = (a, b) => {
+    if (!b || typeof a !== "object" || typeof b !== "object" || Array.isArray(a)) return b ?? a;
+    const out = Object.assign({}, a);
+    for (const k in b) out[k] = k in a ? merge(a[k], b[k]) : b[k];
+    return out;
+  };
+  const WORDS = LANG === "en" ? ALL.en : merge(ALL.en, ALL[LANG]);
+  document.documentElement.lang = LANG;
+  const T = WORDS.home;
+  const $ = (s) => document.querySelector(s);
+  const t = (path) => path.split(".").reduce((o, k) => (o == null ? o : o[k]), T);
+  function h(tag, attrs, ...kids) {
+    const e = document.createElement(tag);
+    for (const k in attrs || {}) {
+      const v = attrs[k];
+      if (v === false || v == null) continue;
+      if (k === "class") e.className = v;
+      else if (k === "style") e.style.cssText = v;
+      else if (k.startsWith("on")) e.addEventListener(k.slice(2), v);
+      else e.setAttribute(k, v === true ? "" : v);
+    }
+    for (const c of kids.flat()) {
+      if (c == null || c === false) continue;
+      e.append(c.nodeType ? c : document.createTextNode(String(c)));
+    }
+    return e;
+  }
+  const dec = (x) => (LANG === "nl" ? x.replace(".", ",") : x);
+  const kw = (w) => dec((Math.abs(Number(w)) / 1000).toFixed(1));
+  const eur = (v) => "€" + dec(Number(v).toFixed(2));
+
+  // Fixed labels from ui_text.
+  document.querySelectorAll("[data-t]").forEach((e) => { e.textContent = t(e.dataset.t) || ""; });
+  document.querySelectorAll("[data-t-label]").forEach((e) => { e.setAttribute("aria-label", t(e.dataset.tLabel) || ""); });
+
+  let S = null;              // the last /status
+  let busy = false;
+
+  /* ---------------- toast and confirm dialog ---------------- */
+  function toast(text) {
+    const e = $("#toast"); e.textContent = text; e.classList.add("show");
+    clearTimeout(toast.timer); toast.timer = setTimeout(() => e.classList.remove("show"), 2600);
+  }
+  let onYes = null;
+  // `key` names Home's words in ui_text, or is {name, description, yes}.
+  function ask(key, fn) {
+    const w = typeof key === "string" ? t("dialog." + key) : key;
+    $("#dlg-t").textContent = w.name;
+    $("#dlg-b").textContent = w.description;
+    $("#dlg-yes").textContent = w.yes;
+    onYes = fn;
+    const d = $("#dlg");
+    if (typeof d.showModal === "function") d.showModal(); else if (window.confirm($("#dlg-t").textContent)) fn();
+  }
+  $("#dlg-no").addEventListener("click", () => $("#dlg").close());
+  $("#dlg-yes").addEventListener("click", () => { $("#dlg").close(); if (onYes) onYes(); });
+
+  /* ---------------- data ---------------- */
+  async function getStatus() {
+    const r = await fetch("status?lang=" + LANG, { cache: "no-store" });
+    if (!r.ok) throw new Error("status " + r.status);
+    return r.json();
+  }
+  async function act(what) {
+    const r = await fetch("action", { method: "POST", headers: { "Content-Type": "application/json" },
+                                      body: JSON.stringify({ action: what }) });
+    if (!r.ok) throw new Error("action " + r.status);
+    return r.json();
+  }
+  // `force`: redraw the battery cards even under a focused mode list, after
+  // the person used it (P3).
+  async function refresh(force) {
+    if (busy) return;
+    busy = true;
+    try { S = await getStatus(); render(force === true); }
+    catch (e) { offline(); }
+    finally { busy = false; }
+  }
+
+  /* ---------------- shell ---------------- */
+  function banner(el, level, title, sub, role) {
+    el.replaceChildren(h("div", { class: "banner " + ({ ok: "b-ok", bad: "b-bad" }[level] || "b-warn"), role: role || null },
+      h("span", { class: "ic", "aria-hidden": "true" }, { ok: "✓", bad: "×" }[level] || "!"),
+      h("span", {}, title, sub ? h("small", {}, sub) : null)));
+  }
+  function offline() {
+    banner($("#home-banner"), "bad", t("offline.name"), t("offline.description"), "alert");
+    $("#pill").replaceChildren(h("span", { class: "dot bad" }), h("span", {}, t("offline.name")));
+  }
+  function renderPill() {
+    const st = S.state || null;
+    const dot = st ? ({ running: "", shadow: " warn", stopped: " warn", warning: " warn", alarm: " bad" }[st.kind] ?? " warn")
+                   : (S.level === "ok" ? "" : S.level === "bad" ? " bad" : " warn");
+    const words = st ? [st.pill, st.ran].filter(Boolean).join(". ") : S.setup_only === true ? t("setup_only.name") : S.banner;
+    $("#pill").replaceChildren(h("span", { class: "dot" + dot, "aria-hidden": "true" }), h("span", {}, words));
+  }
+
+  function render(force) {
+    renderPill();
+    const structured = S.now && S.plan && !S.home_error;
+    // UX-15: setup-only mode commands nothing and has no control to offer.
+    const setup = S.setup_only === true;
+    banner($("#home-banner"), S.level, setup ? t("setup_only.name") : S.banner, structured ? S.state.sub : setup ? t("setup_only.description") : "", S.level === "bad" ? "alert" : null);
+    ["#c-now", "#c-plan", "#c-peak", "#c-attn"].forEach((id) => { $(id).hidden = !structured; });
+    if (structured) { renderNow(); renderPlan(); renderPeak(); renderAttention(); }
+    renderControl(structured, setup);
+    renderDetails(!structured && !setup);
+    renderBatteries(force);
+    document.dispatchEvent(new CustomEvent("ux13:status"));
+  }
+
+  /* ---------------- Home: now ---------------- */
+  function val(id, w, show) {
+    const e = $(id);
+    if (w == null || !show) { e.textContent = "–"; return; }
+    e.replaceChildren(kw(w) + " ", h("small", {}, "kW"));
+  }
+  function levelBar(pct, label) {
+    const known = pct != null;
+    return h("div", { class: "lvl" + (known ? "" : " none"), role: "img",
+                      "aria-label": label + " " + (known ? Math.round(pct) + " %" : "–") },
+      h("i", { style: "width:" + (known ? Math.max(0, Math.min(100, pct)) : 0) + "%" }));
+  }
+  function renderNow() {
+    const n = S.now;
+    val("#v-solar", n.solar_w, n.has_solar); $("#sub-solar").textContent = n.lines.solar;
+    val("#v-house", n.house_w, true); $("#sub-house").textContent = n.lines.house;
+    val("#v-grid", n.grid_w, true); $("#sub-grid").textContent = n.lines.grid;
+    val("#v-batt", n.batt_w, true); $("#sub-batt").textContent = n.lines.batt;
+    $("#home-batts").replaceChildren(...S.batteries.map((b) => h("div", { class: "brow" },
+      h("div", {}, h("strong", {}, b.name), h("span", { class: "muted small" }, " · " + b.mode)),
+      h("div", { class: "small", style: "font-variant-numeric:tabular-nums" }, b.level_pct == null ? "–" : Math.round(b.level_pct) + " %"),
+      levelBar(b.level_pct, b.name),
+      h("div", { class: "small muted", style: "grid-column:1/-1" }, b.now))));
+  }
+
+  /* ---------------- Home: today's plan ---------------- */
+  const LEGEND = [["cheap", "background:var(--cheap)"], ["dear", "background:repeating-linear-gradient(135deg,var(--dear) 0 3px,transparent 3px 5px)"],
+                  ["grid", "background:var(--accent)"], ["give", "background:repeating-linear-gradient(135deg,var(--house) 0 3px,transparent 3px 5px)"],
+                  ["cycle", "background:repeating-linear-gradient(90deg,var(--warn) 0 2px,transparent 2px 4px)"],
+                  ["peak", "background:var(--bad)"], ["house", null]];
+  function tipText(lines) { return lines.filter(Boolean).join(" "); }
+  function chartItem(tag, cls, style, title, lines) {
+    return h(tag, { class: cls, style: style, tabindex: "-1", role: "img", "aria-label": tipText([title + "."].concat(lines)),
+                    "data-tip": JSON.stringify([title].concat(lines.filter(Boolean))) });
+  }
+  function roving(group) {
+    const items = [...group.querySelectorAll("[data-tip]")];
+    items.forEach((el, i) => {
+      el.tabIndex = i === 0 ? 0 : -1;
+      el.addEventListener("keydown", (e) => {
+        const d = { ArrowRight: 1, ArrowLeft: -1, Home: -1e9, End: 1e9 }[e.key];
+        if (d === undefined) return;
+        e.preventDefault();
+        const j = Math.max(0, Math.min(items.length - 1, i + d));
+        items[i].tabIndex = -1; items[j].tabIndex = 0; items[j].focus();
+      });
+    });
+  }
+  function renderPlan() {
+    const p = S.plan;
+    $("#verdict").textContent = p.verdict;
+    $("#plan-head").textContent = p.head;
+    const hours = p.hours || 24;
+    const bars = $("#bars");
+    const known = p.prices.filter((b) => b.eur_kwh != null);
+    const mx = Math.max(0.01, ...known.map((b) => Math.abs(b.eur_kwh)));
+    bars.setAttribute("aria-label", t("plan.name"));
+    bars.replaceChildren(...p.prices.map((b) => {
+      const title = b.label + " " + t("plan.time_to") + " " + b.end_label;
+      if (b.eur_kwh == null) return chartItem("i", "none", "", title, [t("plan.none_tip") + "."]);
+      const kind = b.kind === "cheap" ? ", " + t("plan.cheap_tip") : b.kind === "dear" ? ", " + t("plan.dear_tip") : "";
+      const est = (b.points > 1 ? ", " + t("plan.average_tip") : "") + (b.estimate ? ", " + t("plan.estimate_tip") : "");
+      return chartItem("i", (b.kind || "mid") + (b.estimate ? " est" : ""),
+                       "height:" + Math.max(4, Math.round(Math.abs(b.eur_kwh) / mx * 100)) + "%",
+                       title, [eur(b.eur_kwh) + " " + t("plan.per_kwh") + kind + est + "."]);
+    }));
+    roving(bars);
+    $("#no-prices").hidden = known.length > 0;
+    const lanes = $("#lanes");
+    lanes.replaceChildren();
+    S.batteries.forEach((b, i) => {
+      const lane = h("div", { class: "lane", role: "group", "aria-label": b.name });
+      const runs = p.runs.filter((r) => r.battery === i).sort((a, z) => (a.kind === "house" ? -1 : 0) - (z.kind === "house" ? -1 : 0));
+      for (const r of runs) {
+        if (r.end_h <= r.start_h) continue;
+        lane.append(chartItem("b", r.kind, "left:" + (r.start_h / hours * 100) + "%;width:" + ((r.end_h - r.start_h) / hours * 100) + "%",
+                              b.name + ", " + r.from + " " + t("plan.time_to") + " " + r.to, [r.what, r.why, r.amount]));
+      }
+      lanes.append(h("div", { class: "lanelab", "aria-hidden": "true" }, b.name), lane);
+      roving(lane);
+    });
+    const nl = $("#nowline");
+    nl.style.left = Math.max(0, Math.min(100, p.now_h / hours * 100)) + "%";
+    const used = new Set(p.runs.map((r) => r.kind));
+    known.forEach((b) => used.add(b.kind));
+    $("#legend").replaceChildren(...LEGEND.filter(([k]) => used.has(k)).map(([k, css]) =>
+      h("span", {}, h("i", { class: k === "house" ? "house" : null, style: css, "aria-hidden": "true" }), t("plan." + k))));
+    const list = [];
+    S.batteries.forEach((b, i) => {
+      for (const r of p.runs.filter((x) => x.battery === i && x.kind !== "house")) {
+        list.push(h("li", {}, h("strong", {}, b.name + ", " + r.from + " " + t("plan.time_to") + " " + r.to + ": "), tipText([r.what, r.why, r.amount])));
+      }
+      const house = p.runs.find((x) => x.battery === i && x.kind === "house");
+      if (house) list.push(h("li", {}, h("strong", {}, b.name + ": "), tipText([house.what, house.why])));
+    });
+    for (const line of p.lines) list.push(h("li", {}, line));
+    $("#plan-list").replaceChildren(...list);
+    $("#price-line").textContent = [p.price_line, p.tomorrow_line, p.region_line].filter(Boolean).join(" ");
+  }
+
+  /* ---------------- tooltips: hover, tap and keyboard focus ---------------- */
+  (function () {
+    const tip = $("#tip"); let hot = null;
+    const hide = () => { tip.classList.remove("show"); if (hot) hot.classList.remove("hot"); hot = null; };
+    function show(el, x, y) {
+      if (hot && hot !== el) hot.classList.remove("hot");
+      hot = el; el.classList.add("hot");
+      const lines = JSON.parse(el.dataset.tip);
+      tip.replaceChildren(h("b", {}, lines[0]), ...lines.slice(1).map((l) => h("span", {}, l)));
+      tip.classList.add("show");
+      const r = tip.getBoundingClientRect();
+      let L = x + 12, T2 = y - r.height - 12;
+      if (L + r.width > innerWidth - 8) L = x - r.width - 12;
+      if (L < 8) L = 8;
+      if (T2 < 8) T2 = y + 16;
+      tip.style.left = L + "px"; tip.style.top = T2 + "px";
+    }
+    const target = (e) => e.target.closest && e.target.closest(".chart [data-tip]");
+    document.addEventListener("pointermove", (e) => {
+      if (e.pointerType === "touch") return;
+      const el = target(e);
+      if (el) show(el, e.clientX, e.clientY); else if (hot && document.activeElement !== hot) hide();
+    });
+    document.addEventListener("pointerdown", (e) => {
+      const el = target(e);
+      if (el && e.pointerType === "touch") { if (hot === el) hide(); else show(el, e.clientX, e.clientY); }
+      else if (!el) hide();
+    });
+    document.addEventListener("focusin", (e) => {
+      const el = target(e);
+      if (el) { const r = el.getBoundingClientRect(); show(el, r.left + r.width / 2, r.top); }
+    });
+    document.addEventListener("focusout", (e) => { if (target(e)) hide(); });
+    document.addEventListener("keydown", (e) => { if (e.key === "Escape") hide(); });
+    addEventListener("scroll", hide, { passive: true });
+  })();
+
+  /* ---------------- Home: peak, attention, control, details ---------------- */
+  function renderPeak() {
+    const m = S.month_peak;
+    $("#peak-month").textContent = m.month;
+    const covered = m.state !== "not_covered";
+    $("#peak-figures").hidden = !covered; $("#peak-meter").hidden = !covered;
+    $("#peak-now").textContent = m.peak_w != null ? kw(m.peak_w) + " kW"
+                                 : m.state === "unreadable" ? t("peak.unreadable") : t("peak.none");
+    $("#peak-limit").textContent = kw(m.limit_w) + " kW";
+    const pct = m.pct == null ? 0 : Math.max(0, Math.min(100, m.pct));
+    const bar = $("#peak-meter i");
+    bar.style.width = pct + "%";
+    bar.className = pct >= 100 ? "bad" : pct >= 80 ? "warn" : "";
+    $("#peak-meter").setAttribute("aria-label", t("peak.this_month") + " " + (m.pct == null ? "–" : Math.round(m.pct) + " %"));
+    $("#peak-line").textContent = m.line;
+  }
+  function renderAttention() {
+    const list = S.attention;
+    const icon = { alarm: "×", warning: "!", info: "i" };
+    $("#alerts").replaceChildren(...list.map((a) => h("div", { class: "alert" },
+      h("span", { class: "sev " + a.severity, "aria-hidden": "true" }, icon[a.severity] || "i"),
+      h("div", {}, h("div", { class: "t" }, h("span", { class: "sr" }, t("attention." + a.severity) + ": "), a.title),
+        h("div", { class: "small" }, a.body),
+        a.docs && S.control.docs_url ? h("a", { class: "tiny", href: S.control.docs_url, target: "_top", rel: "noopener" }, t("attention.details")) : null))));
+    const n = list.filter((a) => a.severity !== "info").length;
+    $("#attn-count").textContent = n ? n + " " + t("attention.to_look") : t("attention.nothing");
+    if (!list.length) $("#alerts").replaceChildren(h("div", { class: "small muted" }, t("attention.nothing")));
+    const badge = $("#attn-badge");
+    badge.textContent = n; badge.hidden = !n;
+    badge.classList.toggle("bad", list.some((a) => a.severity === "alarm"));
+  }
+  function renderControl(structured, setup) {
+    const running = structured ? S.control.running : null;
+    const btn = $("#btn-ctl");
+    btn.textContent = running === false ? t("control.start") : t("control.stop");
+    btn.className = "btn" + (running === false ? " primary" : "");
+    btn.hidden = !!setup;
+    $("#btn-setup").hidden = !setup;
+    $("#c-ctl .more").hidden = !!setup;
+    $("#ctl-text").textContent = structured ? S.control.text : setup ? t("setup_only.control") : "";
+    $("#hint").textContent = S.hint || "";
+    const docs = $("#docs-link");
+    if (structured && S.control.docs_url) { docs.href = S.control.docs_url; docs.hidden = false; } else docs.hidden = true;
+  }
+  function renderDetails(open) {
+    $("#rows").replaceChildren(...(S.rows || []).map(([k, v]) => h("tr", {}, h("td", { class: "muted" }, k), h("td", {}, v))));
+    $("#checks").replaceChildren(...(S.checks || []).map((c) => {
+      const cls = c.ok ? (c.warn ? "c-warn" : "c-ok") : (c.warn ? "c-warn" : "c-bad");
+      const mark = c.ok ? (c.warn ? "!" : "✓") : (c.warn ? "!" : "✗");
+      return h("li", { class: cls }, mark + " " + c.text);
+    }));
+    if (open) $("#c-details").open = true;
+  }
+
+  /* ---------------- Batteries (UX-13 P3) ---------------- */
+  // One card per battery. With battery modes on (`mode_key` in /status) each
+  // card has an On/Off switch and a mode list, sent as `pack_use` and
+  // `pack_mode` through /action (OPT-11 P1). Selling has no switch while it
+  // is off (owner decision 2026-09-29). The Now, Today and Why lines are
+  // homeview.py's sentences. The Simple settings view draws the same switch
+  // and list into its own card (simpleHost).
+  const MODES = ["solar_first", "leftover_solar", "cheap_hours"];
+  const say = (text, vars) => Object.keys(vars).reduce((x, k) => x.replace("{" + k + "}", vars[k]), text);
+  let packBusy = false;
+  let simpleHost = null;
+  async function packAct(what, b, value) {
+    if (packBusy) return;
+    packBusy = true;
+    try {
+      const r = await fetch("action", { method: "POST", headers: { "Content-Type": "application/json" },
+                                        body: JSON.stringify({ action: what, unit: b.name, value: value }) });
+      const j = await r.json().catch(() => ({}));
+      if (!r.ok) toast(j.error || t("toast.failed"));
+      else if (what === "pack_use") toast(say(value ? t("batteries.toast.on") : t("batteries.toast.off"), { name: b.name }));
+      else toast(say(t("batteries.toast.mode"), { name: b.name, mode: t("batteries.choice." + value + ".name") }));
+    } catch (e) { toast(t("toast.failed")); }
+    finally { packBusy = false; }
+    await refresh(true);
+  }
+  function onSwitch(b, i, where, lid) {
+    const sw = h("button", { type: "button", class: "switch", role: "switch", id: "bsw-" + where + i,
+                             "aria-checked": String(b.use), "aria-labelledby": lid,
+                             onclick: () => packAct("pack_use", b, !b.use) });
+    return h("span", { class: "swrap" }, sw, h("span", { class: "swtext", "aria-hidden": "true" }, b.use ? t("batteries.on") : t("batteries.off")));
+  }
+  function modeSelect(b, i, where, lid) {
+    return h("select", { class: "sel", id: "bsel-" + where + i, "aria-labelledby": lid, disabled: !b.use,
+                         onchange: (e) => packAct("pack_mode", b, e.target.value) },
+      ...MODES.map((k) => h("option", { value: k, selected: b.mode_choice === k }, t("batteries.choice." + k + ".name"))));
+  }
+  function todayLines(b) {
+    if (!b.today || !b.today.length) return b.today_line || "–";
+    return b.today.map((r) => h("div", {}, r.from + " " + t("plan.time_to") + " " + r.to + ": " + r.what));
+  }
+  function batteryCard(b, i) {
+    const modes = b.mode_key != null;
+    const lid = "bname-" + i;
+    const lvl = b.level_pct == null ? "–" : Math.round(b.level_pct) + " %";
+    const stored = b.stored_kwh != null ? " · " + dec(b.stored_kwh.toFixed(1)) + " kWh " + t("batteries.stored").toLowerCase() : "";
+    return h("div", { class: "card bcard" + (modes && !b.use ? " off" : "") },
+      h("div", { class: "hd" },
+        h("div", { class: "grow" }, h("div", { class: "name", id: lid }, b.name),
+          h("div", { class: "tiny muted" }, b.capacity_kwh ? dec(Number(b.capacity_kwh).toFixed(1)) + " kWh" : "")),
+        modes ? onSwitch(b, i, "c", lid) : null),
+      modes ? h("div", { class: "modebox" },
+        h("label", { class: "lbl small", for: "bsel-c" + i }, t("batteries.mode")),
+        modeSelect(b, i, "c", null),
+        h("div", { class: "help" }, t("batteries.choice." + b.mode_key + ".description"))) : null,
+      levelBar(b.level_pct, b.name),
+      h("dl", { class: "kv" },
+        h("dt", {}, t("batteries.level")), h("dd", {}, lvl + stored),
+        h("dt", {}, t("batteries.now")), h("dd", {}, b.now),
+        h("dt", {}, t("batteries.today")), h("dd", {}, todayLines(b)),
+        h("dt", {}, t("batteries.why")), h("dd", { class: "muted" }, b.why || "–")));
+  }
+  function simpleRow(b, i) {
+    const lid = "bsname-" + i;
+    return h("div", { class: "inv" },
+      h("div", { class: "hd" }, h("span", { class: "grow", id: lid }, b.name), onSwitch(b, i, "s", lid)),
+      h("div", { class: "f" }, h("label", { class: "lbl", for: "bsel-s" + i }, t("batteries.mode")),
+        h("div", { class: "ctl" }, modeSelect(b, i, "s", null)),
+        h("div", { class: "help" }, b.now + " " + (b.why || ""))));
+  }
+  // Rebuild without losing the focused control, and never under an open list
+  // or a request in flight.
+  function keepFocus(fn) {
+    const id = document.activeElement && document.activeElement.id;
+    fn();
+    if (id && /^bs(w|el)-/.test(id)) { const e = document.getElementById(id); if (e) e.focus(); }
+  }
+  // The modes-off card's button opens Settings on the Installer view, where
+  // the "Battery modes" switch is (settings.js sets window.UX13.settingsView).
+  $("#batt-off a").addEventListener("click", () => { if (window.UX13.settingsView) window.UX13.settingsView("installer"); });
+  function renderBatteries(force) {
+    if (!S || !S.batteries) { $("#bcards").replaceChildren(); return; }
+    const a = document.activeElement;
+    if (!force && (packBusy || (a && a.tagName === "SELECT" && /^bsel-/.test(a.id)))) return;
+    const modes = S.modes_on === true || S.batteries.some((b) => b.mode_key != null);
+    $("#batt-off").hidden = modes;
+    $("#batt-how").hidden = !modes;
+    const docs = $("#batt-docs");
+    if (S.control && S.control.docs_url) { docs.href = S.control.docs_url; docs.hidden = false; } else docs.hidden = true;
+    if (S.state && ["shadow", "stopped", "alarm"].includes(S.state.kind)) banner($("#batt-banner"), S.level, S.state.pill, S.state.sub, S.level === "bad" ? "alert" : null);
+    else $("#batt-banner").replaceChildren();
+    keepFocus(() => {
+      $("#bcards").replaceChildren(...S.batteries.map(batteryCard));
+      // OPT-11 P4: the solar forecast line under the cards.
+      const sl = $("#batt-solar"), line = modes && S.solar ? S.solar.line : "";
+      if (sl) { sl.textContent = line || ""; sl.hidden = !line; }
+      if (simpleHost && simpleHost.isConnected) {
+        simpleHost.replaceChildren(...(modes ? S.batteries.map(simpleRow)
+          : [h("p", { class: "small muted", style: "margin:4px 0" }, t("batteries.modes_off.name") + ". " + t("batteries.description"))]));
+      }
+    });
+  }
+
+  /* ---------------- control buttons ---------------- */
+  // The action is a toggle, so the page reads the live state first and sends
+  // nothing when control is already where the person asked it to be.
+  // One request at a time: a second confirm while the first is in flight
+  // would read the same state and toggle it back.
+  let toggling = false;
+  async function setControl(want) {
+    if (toggling) return;
+    toggling = true;
+    try {
+      const now = await getStatus();
+      if (!now.control || now.control.running !== want) await act("auto_toggle");
+      toast(want ? t("toast.started") : t("toast.stopped"));
+    } catch (e) { toast(t("toast.failed")); }
+    finally { toggling = false; }
+    refresh();
+  }
+  $("#btn-ctl").addEventListener("click", () => {
+    const running = S && S.control ? S.control.running : true;
+    if (running) ask("stop", () => setControl(false)); else ask("start", () => setControl(true));
+  });
+  async function simple(what) {
+    try { await act(what); toast(t("toast.done")); } catch (e) { toast(t("toast.failed")); }
+    refresh();
+  }
+  $("#btn-maint").addEventListener("click", () => ask("maint_start", () => simple("maint_start")));
+  $("#btn-abort").addEventListener("click", () => ask("maint_abort", () => simple("maint_abort")));
+
+  // Shared with settings.js, which loads after this file.
+  // `first`: the page opened with no route, so settings.js may open the setup
+  // wizard on a new install (UX-13 P4).
+  window.UX13 = { h, ask, toast, t, words: WORDS, lang: LANG, maint: (what) => ask(what, () => simple(what)), first: !location.hash,
+                  // P3: the Simple settings view's battery card, drawn from /status.
+                  batteries: (host) => { simpleHost = host; if (S) renderBatteries(); refresh(); },
+                  status: () => S, kw };
+
+  /* ---------------- tabs: hash routes, arrow keys ---------------- */
+  const TABS = [...document.querySelectorAll(".tab")];
+  function select(tab, focus) {
+    TABS.forEach((x) => {
+      const on = x === tab;
+      x.setAttribute("aria-selected", String(on)); x.tabIndex = on ? 0 : -1;
+      document.getElementById(x.getAttribute("aria-controls")).hidden = !on;
+    });
+    if (focus) tab.focus();
+    if (location.hash !== "#" + tab.dataset.hash) history.replaceState(null, "", "#" + tab.dataset.hash);
+    schedule();
+    document.dispatchEvent(new CustomEvent("ux13:tab", { detail: tab.dataset.hash }));
+  }
+  TABS.forEach((x, i) => {
+    x.addEventListener("click", () => select(x, false));
+    x.addEventListener("keydown", (e) => {
+      const j = { ArrowRight: i + 1, ArrowLeft: i - 1 + TABS.length, Home: 0, End: TABS.length - 1 }[e.key];
+      if (j === undefined) return;
+      e.preventDefault(); select(TABS[j % TABS.length], true);
+    });
+  });
+  function fromHash() {
+    const want = (location.hash || "#home").slice(1);
+    select(TABS.find((x) => x.dataset.hash === want) || TABS[0], false);
+  }
+  addEventListener("hashchange", fromHash);
+
+  /* ---------------- polling: every 3 s while Home or Batteries shows ---------------- */
+  let timer = null;
+  function schedule() {
+    const live = !document.hidden && ($("#t-home").getAttribute("aria-selected") === "true" ||
+                                      $("#t-batt").getAttribute("aria-selected") === "true");
+    if (live && !timer) { refresh(); timer = setInterval(refresh, 3000); }
+    if (!live && timer) { clearInterval(timer); timer = null; }
+  }
+  document.addEventListener("visibilitychange", schedule);
+  fromHash();
+  refresh();
+})();
diff --git a/goodwe_controller/app/static/index.html b/goodwe_controller/app/static/index.html
new file mode 100644
index 0000000..24a34eb
--- /dev/null
+++ b/goodwe_controller/app/static/index.html
@@ -0,0 +1,176 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Battery add-on</title>
+<style>/*APP_CSS*/</style>
+</head>
+<body>
+<header class="top">
+  <div class="logo" aria-hidden="true"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="7" width="16" height="10" rx="2"/><path d="M21 11v2M8 10l-2 3h4l-2 3"/></svg></div>
+  <div class="grow">
+    <div class="app" data-t="app.name"></div>
+    <div class="pill" id="pill" aria-live="polite"><span class="dot warn"></span><span>…</span></div>
+  </div>
+</header>
+
+<nav class="tabs" role="tablist" id="tabs" data-t-label="tabs.label">
+  <button class="tab" role="tab" id="t-home" aria-controls="s-home" aria-selected="true" data-hash="home"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M3 11l9-7 9 7v9a1 1 0 0 1-1 1h-5v-6H9v6H4a1 1 0 0 1-1-1z"/></svg><span data-t="tabs.home"></span><span class="badge" id="attn-badge" hidden></span></button>
+  <button class="tab" role="tab" id="t-batt" aria-controls="s-batt" aria-selected="false" data-hash="batteries" tabindex="-1"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><rect x="3" y="7" width="16" height="10" rx="2"/><path d="M21 11v2"/><rect x="5.5" y="9.5" width="7" height="5" fill="currentColor" stroke="none"/></svg><span data-t="tabs.batteries"></span></button>
+  <button class="tab" role="tab" id="t-set" aria-controls="s-set" aria-selected="false" data-hash="settings" tabindex="-1"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M4 6h10M18 6h2M4 12h4M12 12h8M4 18h12M20 18h0"/><circle cx="16" cy="6" r="2"/><circle cx="10" cy="12" r="2"/><circle cx="18" cy="18" r="2"/></svg><span data-t="tabs.settings"></span></button>
+  <button class="tab" role="tab" id="t-wiz" aria-controls="s-wiz" aria-selected="false" data-hash="setup" tabindex="-1"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M14 7l3 3M5 19l9.5-9.5 3 3L8 22H5z"/><path d="M19 2v4M17 4h4"/></svg><span data-t="tabs.setup"></span></button>
+</nav>
+
+<main class="wrap">
+
+<section class="screen" id="s-home" role="tabpanel" aria-labelledby="t-home">
+  <div id="home-banner"></div>
+
+  <div class="card" id="c-now">
+    <div class="row spread"><h2 data-t="now.name"></h2><span class="tiny muted" data-t="now.description"></span></div>
+    <div class="tiles">
+      <div class="tile"><div class="lab"><span class="sw-solar" aria-hidden="true">&#9728;</span><span data-t="now.solar"></span></div><div class="val" id="v-solar">–</div><div class="sub" id="sub-solar"></div></div>
+      <div class="tile"><div class="lab"><span class="sw-house" aria-hidden="true">&#8962;</span><span data-t="now.house"></span></div><div class="val" id="v-house">–</div><div class="sub" id="sub-house"></div></div>
+      <div class="tile"><div class="lab"><span class="sw-grid" aria-hidden="true">&#8645;</span><span data-t="now.grid"></span></div><div class="val" id="v-grid">–</div><div class="sub" id="sub-grid"></div></div>
+      <div class="tile"><div class="lab"><span class="sw-batt" aria-hidden="true">&#9646;</span><span data-t="now.batteries"></span></div><div class="val" id="v-batt">–</div><div class="sub" id="sub-batt"></div></div>
+    </div>
+    <div id="home-batts" style="margin-top:6px"></div>
+  </div>
+
+  <div class="card" id="c-plan">
+    <div class="row spread"><h2 data-t="plan.name"></h2><span class="chip tiny muted" id="verdict"></span></div>
+    <div class="small" id="plan-head"></div>
+    <div class="chart" id="chart">
+      <div class="bars" id="bars" role="group"></div>
+      <div id="lanes"></div>
+      <div class="nowline" id="nowline" aria-hidden="true"><span data-t="plan.now"></span></div>
+      <div class="axis" aria-hidden="true"><span>00:00</span><span>06:00</span><span>12:00</span><span>18:00</span><span>24:00</span></div>
+    </div>
+    <p class="tiny muted" id="no-prices" hidden data-t="plan.no_prices.description"></p>
+    <div class="legend" id="legend"></div>
+    <p class="tiny muted" style="margin:6px 0 0" data-t="plan.description"></p>
+    <h3 class="sr" data-t="plan.list"></h3>
+    <ul class="plain small" id="plan-list"></ul>
+    <p class="tiny muted" style="margin:8px 0 0" id="price-line"></p>
+  </div>
+
+  <div class="card" id="c-peak">
+    <div class="row spread"><h2 data-t="peak.name"></h2><span class="tiny muted" id="peak-month"></span></div>
+    <div class="row spread small" id="peak-figures"><span><span data-t="peak.this_month"></span>: <strong id="peak-now"></strong></span><span class="muted"><span data-t="peak.limit"></span> <span id="peak-limit"></span></span></div>
+    <div class="meter" id="peak-meter" role="img"><i style="width:0%"></i></div>
+    <div class="tiny muted" id="peak-line"></div>
+  </div>
+
+  <div class="card" id="c-attn">
+    <div class="row spread"><h2 data-t="attention.name"></h2><span class="tiny muted" id="attn-count"></span></div>
+    <div id="alerts"></div>
+  </div>
+
+  <div class="card" id="c-ctl">
+    <h2 data-t="control.name"></h2>
+    <div class="small" id="ctl-text"></div>
+    <div class="row" style="margin-top:10px">
+      <button class="btn" id="btn-ctl" type="button"></button>
+      <a class="btn primary" id="btn-setup" href="#setup" hidden data-t="setup_only.open"></a>
+      <a class="small" id="docs-link" hidden target="_top" rel="noopener" data-t="control.docs"></a>
+    </div>
+    <div class="tiny muted" id="hint" aria-live="polite" style="margin-top:8px"></div>
+    <details class="more">
+      <summary data-t="control.more"></summary>
+      <div class="row" style="padding-bottom:6px">
+        <button class="btn" id="btn-maint" type="button" data-t="control.maint_start"></button>
+        <button class="btn danger" id="btn-abort" type="button" data-t="control.maint_abort"></button>
+      </div>
+    </details>
+  </div>
+
+  <details class="card more" id="c-details">
+    <summary data-t="details.name"></summary>
+    <table class="rows" id="rows"></table>
+    <h2 style="margin-top:12px" data-t="details.checks"></h2>
+    <ul class="checks" id="checks"></ul>
+  </details>
+</section>
+
+<section class="screen" id="s-batt" role="tabpanel" aria-labelledby="t-batt" hidden>
+  <div id="batt-banner"></div>
+  <div class="card" id="batt-off" hidden>
+    <h2 data-t="batteries.modes_off.name"></h2>
+    <p class="small muted" style="margin:0 0 10px" data-t="batteries.description"></p>
+    <a class="btn" href="#settings" data-t="batteries.settings"></a>
+  </div>
+  <div id="bcards"></div>
+  <p class="small muted" id="batt-solar" hidden></p>
+  <details class="grp" id="batt-how" hidden>
+    <summary><span class="grow"><strong data-t="batteries.how.name"></strong><span class="small muted gdesc" data-t="batteries.how.description"></span></span><span class="chev" aria-hidden="true">&#8250;</span></summary>
+    <div class="body small">
+      <p data-t="batteries.how.solar_first.description"></p>
+      <p data-t="batteries.how.leftover_solar.description"></p>
+      <p data-t="batteries.how.off.description"></p>
+      <p class="muted" data-t="batteries.how.rules.description"></p>
+      <p><a id="batt-docs" hidden target="_top" rel="noopener" data-t="control.docs"></a></p>
+    </div>
+  </details>
+</section>
+
+<section class="screen" id="s-set" role="tabpanel" aria-labelledby="t-set" hidden>
+  <div class="row spread" style="margin-bottom:6px">
+    <h2 style="margin:0" data-s="name"></h2>
+    <a class="small" href="config" id="set-classic" data-s="classic"></a>
+  </div>
+  <div class="row" style="margin-bottom:8px">
+    <div class="seg" role="radiogroup" id="set-view" data-s-label="view.name">
+      <button type="button" role="radio" aria-checked="true" data-v="simple" data-s="view.simple"></button>
+      <button type="button" role="radio" aria-checked="false" data-v="installer" tabindex="-1" data-s="view.installer"></button>
+    </div>
+    <span class="tiny muted grow" id="set-desc"></span>
+  </div>
+  <div id="set-banner" aria-live="polite"></div>
+  <div id="simple" class="simple" hidden></div>
+  <div id="set-body">
+    <input class="search" id="set-search" type="search" autocomplete="off" spellcheck="false" data-s-ph="search.description" data-s-label="search.name">
+    <div class="card" id="set-other" hidden><h2 data-s="other"></h2><ul class="plain small" id="set-other-list"></ul></div>
+    <div id="groups"><p class="small muted" data-s="loading"></p></div>
+    <p class="small muted" id="set-nomatch" hidden data-s="no_match.description"></p>
+    <p class="tiny muted" data-s="footer.description"></p>
+  </div>
+</section>
+
+<section class="screen" id="s-wiz" role="tabpanel" aria-labelledby="t-wiz" hidden>
+  <div class="card" id="wz">
+    <div class="row spread"><h2 id="wz-title" style="margin:0" data-s="setup.name"></h2><span class="tiny muted" id="wz-count"></span></div>
+    <div class="steps" id="wz-steps" aria-hidden="true"></div>
+    <p class="small muted" id="wz-desc" style="margin:0 0 6px"></p>
+    <div id="wz-banner" aria-live="polite"></div>
+    <div id="wz-body"><p class="small muted" data-s="loading"></p></div>
+    <div class="row spread" id="wz-nav" style="margin-top:14px">
+      <button class="btn" id="wz-back" type="button" data-s="setup.back"></button>
+      <button class="btn primary" id="wz-next" type="button" data-s="setup.next"></button>
+    </div>
+  </div>
+  <p class="tiny muted" data-s="setup.description"></p>
+</section>
+</main>
+
+<dialog id="dlg" aria-labelledby="dlg-t" aria-describedby="dlg-b">
+  <h2 id="dlg-t"></h2>
+  <p class="small" id="dlg-b"></p>
+  <div class="row" style="justify-content:flex-end">
+    <button class="btn" id="dlg-no" type="button" data-t="dialog.cancel"></button>
+    <button class="btn primary" id="dlg-yes" type="button"></button>
+  </div>
+</dialog>
+<div id="savebar" role="region" hidden><div class="in">
+  <span class="grow" id="sb-text" aria-live="polite"></span>
+  <button class="btn" id="sb-discard" type="button" data-s="savebar.discard"></button>
+  <button class="btn primary" id="sb-save" type="button" data-s="savebar.save"></button>
+</div></div>
+<div id="toast" role="status" aria-live="polite"></div>
+<div id="tip" class="tip" aria-hidden="true"></div>
+
+<script type="application/json" id="ui-text">/*UI_TEXT*/</script>
+<script>/*APP_JS*/</script>
+<script>/*SETTINGS_JS*/</script>
+</body>
+</html>
diff --git a/goodwe_controller/app/static/settings.js b/goodwe_controller/app/static/settings.js
new file mode 100644
index 0000000..8e5cc2e
--- /dev/null
+++ b/goodwe_controller/app/static/settings.js
@@ -0,0 +1,941 @@
+"use strict";
+/* UX-13 P2: Settings, the Installer view. It draws from /config/model's
+   `layout` (app/uilayout.py through app/uipage.py) and `ui` (the page model
+   from app/uimodel.py), so this file names no option key: keys, labels,
+   ranges and choices all arrive as data. It posts the page model back; the
+   add-on turns it into options and runs its own start checks, and nothing
+   they refuse is saved. Every word is from app/ui_text or the add-on, and
+   data is set as text, never as HTML.
+   P4: the Setup tab's wizard is the same page model, drawn one step at a
+   time from each field's `wizard` step, and saved through the same routes. */
+(function () {
+  const ROOT = window.UX13.words;       // English or Dutch (app.js)
+  const W = ROOT.settings;
+  const { h, ask, toast, maint, lang } = window.UX13;
+  const $ = (s) => document.querySelector(s);
+  const ws = (path) => path.split(".").reduce((o, k) => (o == null ? o : o[k]), W);
+  const clone = (x) => (x === undefined ? undefined : JSON.parse(JSON.stringify(x)));
+  const same = (a, b) => JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+
+  document.querySelectorAll("[data-s]").forEach((e) => { e.textContent = ws(e.dataset.s) || ""; });
+  document.querySelectorAll("[data-s-ph]").forEach((e) => { e.placeholder = ws(e.dataset.sPh) || ""; });
+  document.querySelectorAll("[data-s-label]").forEach((e) => { e.setAttribute("aria-label", ws(e.dataset.sLabel) || ""); });
+  $("#savebar").setAttribute("aria-label", W.savebar.label);
+
+  let M = null;              // the last /config/model
+  let V = null;              // the page model being edited
+  let ORIG = null;           // the page model as stored
+  let FP = "";               // the stored blob's fingerprint (compare-and-swap)
+  let MSG = [];              // [{field, card, tier, text}] from the add-on
+  let DEVICE = "";
+  let LIST = null;           // the inverter list field
+  let FILLED = {};           // field key -> the preset field that fills it
+  let view = null;           // "settings" or "setup": the tab drawing V
+  let STEPS = {};            // wizard step -> refusals that block it
+  // P3: "simple" (the default, for home owners) or "installer". Remembered in
+  // this browser only; a blocked storage just means Simple each time.
+  let mode = "simple";
+  try { if (localStorage.getItem("ux13.settings.view") === "installer") mode = "installer"; } catch (e) { /* no storage */ }
+  let uid = 0;
+  const ROWS = [];
+  const OPEN = new Set();
+  const UNLOCKED = new Set();
+
+  /* ---------------- the page model ---------------- */
+  const sub = (f) => f.key.slice(LIST.key.length + 1);
+  function valueIn(model, f, card) {
+    if (card == null) return model[f.key];
+    const c = (model[LIST.key] || [])[card];
+    return c ? c[sub(f)] : undefined;
+  }
+  const get = (f, card) => valueIn(V, f, card);
+  function visible(f) {
+    return (f.show || []).every(([name, op, want]) => {
+      const have = V[name];
+      if (op === "==") return same(have, want);
+      if (op === "!=") return !same(have, want);
+      if (op === "in") return want.some((x) => same(x, have));
+      if (have == null || have === "" || isNaN(+have)) return false;
+      return op === ">" ? +have > want : +have < want;
+    });
+  }
+  function put(f, card, v, redraw) {
+    if (card == null) V[f.key] = v;
+    else V[LIST.key][card][sub(f)] = v;
+    if (f.mirror) {
+      const m = findField(f.mirror);
+      if (m && (m.choices || []).some((c) => same(c[0], v))) V[f.mirror] = v;
+    }
+    if (f.fills && f.presets && f.presets[v]) V[f.fills] = f.presets[v].value;
+    if (redraw || f.fills) redrawView(); else paint();
+    queueValidate();
+  }
+  function findField(key) {
+    for (const g of M.layout.groups) for (const p of g.parts) for (const f of p.fields) {
+      if (f.key === key) return f;
+      for (const s of f.fields || []) if (s.key === key) return s;
+    }
+    return null;
+  }
+
+  /* ---------------- numbers: stored units <-> shown units ---------------- */
+  const decimals = (x) => { const s = String(x); return s.includes(".") ? s.split(".")[1].length : 0; };
+  function shown(f, v) {
+    if (v == null || v === "") return "";
+    return String(+(Number(v) / (f.scale || 1)).toFixed(6));
+  }
+  function stored(f, x) {
+    const st = f.step || (f.type === "integer" ? 1 : 0);
+    let v = x * (f.scale || 1);
+    if (st) v = Math.round(v / st) * st;
+    if (f.min != null) v = Math.max(f.min, v);
+    if (f.max != null) v = Math.min(f.max, v);
+    return f.type === "integer" ? Math.round(v) : +v.toFixed(Math.min(10, decimals(st) + 2));
+  }
+
+  /* ---------------- controls ---------------- */
+  // A choice the page can only keep stays offered while it is the stored value.
+  function choicesOf(f, card) {
+    const cur = get(f, card), was = valueIn(ORIG, f, card);
+    const out = (f.choices || []).filter((c) => !c[2] || same(c[0], cur) || same(c[0], was));
+    if (cur != null && cur !== "" && !out.some((c) => same(c[0], cur))) out.push([cur, String(cur)]);
+    return out;
+  }
+  function toggle(f, card, lid) {
+    const on = !!get(f, card);
+    const b = h("button", { type: "button", class: "switch", role: "switch", "aria-checked": String(on), "aria-labelledby": lid });
+    const txt = h("span", { class: "swtext", "aria-hidden": "true" }, on ? W.on : W.off);
+    b.addEventListener("click", () => {
+      const n = b.getAttribute("aria-checked") !== "true";
+      b.setAttribute("aria-checked", String(n)); txt.textContent = n ? W.on : W.off;
+      put(f, card, n);
+    });
+    return h("span", { class: "swrap" }, b, txt);
+  }
+  function radios(f, card, lid, cards) {
+    const cur = get(f, card);
+    const g = h("div", { class: cards ? "choices" : "seg", role: "radiogroup", "aria-labelledby": lid });
+    const items = choicesOf(f, card);
+    const buttons = items.map(([v, label], i) => {
+      const on = same(v, cur);
+      const hint = cards && f.hints ? f.hints[v] : "";
+      const b = h("button", { type: "button", role: "radio", class: cards ? "choice" : null, "aria-checked": String(on),
+                              tabindex: on || (!items.some((c) => same(c[0], cur)) && i === 0) ? "0" : "-1" },
+        cards ? [h("span", { class: "rad", "aria-hidden": "true" }), h("span", {}, h("div", {}, label), hint ? h("div", { class: "tiny muted" }, hint) : null)] : label);
+      b.addEventListener("click", () => put(f, card, v, true));
+      b.addEventListener("keydown", (e) => {
+        const d = { ArrowRight: 1, ArrowDown: 1, ArrowLeft: -1, ArrowUp: -1 }[e.key];
+        if (!d) return;
+        e.preventDefault();
+        const j = (i + d + items.length) % items.length;
+        put(f, card, items[j][0], true);
+        const again = document.querySelector(`[data-rk="${CSS.escape(g.dataset.rk)}"] [role=radio]:nth-child(${j + 1})`);
+        if (again) again.focus();
+      });
+      return b;
+    });
+    g.dataset.rk = f.key + "|" + card;
+    g.append(...buttons);
+    return g;
+  }
+  function select(f, card, lid) {
+    const cur = get(f, card);
+    const s = h("select", { class: "sel", "aria-labelledby": lid });
+    for (const [v, label] of choicesOf(f, card)) s.append(h("option", { value: JSON.stringify(v), selected: same(v, cur) }, label));
+    for (const [v, label] of f.later || []) s.append(h("option", { value: JSON.stringify(v), disabled: true }, label));
+    s.addEventListener("change", () => put(f, card, JSON.parse(s.value), true));
+    const preset = f.presets && f.presets[cur];
+    return preset ? h("div", { class: "row" }, s, h("span", { class: "chip" }, W.region_year.replace("{year}", preset.year))) : s;
+  }
+  function slider(f, card, lid) {
+    if (f.min == null || f.max == null) return number(f, card, lid);
+    const sc = f.scale || 1;
+    const st = f.step || (f.type === "integer" ? 1 : 0.01);
+    const v = get(f, card);
+    const r = h("input", { type: "range", min: f.min, max: f.max, step: st, value: v == null ? f.min : v, "aria-labelledby": lid });
+    const n = h("input", { class: "num", type: "number", inputmode: "decimal", min: f.min / sc, max: f.max / sc, step: st / sc, value: shown(f, v), "aria-labelledby": lid });
+    r.addEventListener("input", () => { const x = stored(f, +r.value / sc); n.value = shown(f, x); put(f, card, x); });
+    n.addEventListener("change", () => {
+      if (n.value === "" || isNaN(+n.value)) { n.value = shown(f, get(f, card)); return; }
+      const x = stored(f, +n.value); r.value = x; n.value = shown(f, x); put(f, card, x);
+    });
+    return h("div", { class: "slider" }, r, n, f.unit ? h("span", { class: "unit" }, f.unit) : null);
+  }
+  function number(f, card, lid) {
+    const sc = f.scale || 1;
+    const by = FILLED[f.key];
+    const preset = by && by.presets[V[by.key]];
+    const n = h("input", { class: "num", type: "number", inputmode: "decimal", step: f.step ? f.step / sc : "any",
+                           min: f.min == null ? null : f.min / sc, max: f.max == null ? null : f.max / sc,
+                           value: shown(f, get(f, card)), disabled: !!preset, "aria-labelledby": lid });
+    n.addEventListener("input", () => {
+      if (n.value === "") { if (f.optional) put(f, card, null); return; }
+      if (!isNaN(+n.value)) put(f, card, stored(f, +n.value));
+    });
+    n.addEventListener("change", () => { n.value = shown(f, get(f, card)); });
+    return h("div", {}, h("div", { class: "row" }, n, f.unit ? h("span", { class: "unit" }, f.unit) : null),
+             preset ? h("div", { class: "tiny muted" }, W.preset.description) : null);
+  }
+  function text(f, card, lid) {
+    const v = get(f, card);
+    const t = h("input", { class: "txt", type: "text", value: v == null ? "" : v, autocapitalize: "none", spellcheck: "false", "aria-labelledby": lid });
+    t.addEventListener("input", () => put(f, card, t.value));
+    return t;
+  }
+  function locked(f, card, lid) {
+    const box = h("div", {});
+    const id = f.key + "#" + card;
+    const open = () => { UNLOCKED.add(id); box.replaceChildren(slider(f, card, lid)); };
+    if (UNLOCKED.has(id)) { open(); return box; }
+    const v = get(f, card);
+    box.append(h("div", { class: "row" },
+      h("strong", {}, v == null ? W.not_set : shown(f, v) + (f.unit ? " " + f.unit : "")),
+      h("span", { class: "chip" }, W.locked),
+      h("button", { type: "button", class: "btn link", "aria-label": W.change + ": " + f.label, onclick: open }, W.change)));
+    return box;
+  }
+
+  /* entity picker: search, the matching kind first, the live reading */
+  const ENT = {};
+  function entities(kind) {
+    const now = Date.now();
+    const e = ENT[kind];
+    if (e && now - e.at < 30000) return e.p;
+    const p = fetch("ha/entities?kind=" + encodeURIComponent(kind || ""), { cache: "no-store" })
+      .then((r) => (r.ok ? r.json() : { available: false, entities: [] }))
+      .catch(() => ({ available: false, entities: [] }));
+    ENT[kind] = { at: now, p };
+    return p;
+  }
+  const reading = (e) => (e && e.state != null && e.state !== "" ? String(e.state) + (e.unit ? " " + e.unit : "") : "–");
+  function picker(f, lid, value, pick) {
+    let data = null, all = false;
+    const btn = h("button", { type: "button", class: "ent-btn", "aria-expanded": "false", "aria-haspopup": "listbox", "aria-labelledby": lid });
+    const pop = h("div", { class: "ent-pop", hidden: true });
+    const q = h("input", { type: "search", placeholder: W.picker.search.description, "aria-label": W.picker.search.description, autocomplete: "off", spellcheck: "false" });
+    const note = h("div", { class: "tiny muted ent-note" });
+    const list = h("div", { class: "ent-list", role: "listbox", "aria-labelledby": lid });
+    const allBox = h("label", { class: "tiny muted ent-all" },
+      h("input", { type: "checkbox", onchange: (e) => { all = e.target.checked; fill(); } }), W.picker.all);
+    function drawBtn() {
+      const id = value();
+      const e = data && data.entities.find((x) => x.entity_id === id);
+      btn.replaceChildren();
+      if (id) btn.append(h("span", { class: "grow" }, h("div", {}, e ? e.name : id), h("div", { class: "key" }, id)),
+                         data && data.available ? h("span", { class: "chip " + (e ? "now" : "rs") }, e ? reading(e) : W.picker.missing) : null);
+      else btn.append(h("span", { class: "grow muted" }, W.picker.choose));
+      btn.append(h("span", { class: "muted", "aria-hidden": "true" }, "▾"));
+    }
+    function opt(id, name, val) {
+      return h("button", { type: "button", class: "ent-opt", role: "option", "aria-selected": String(id === value()),
+                           onclick: () => { pick(id); close(); drawBtn(); btn.focus(); } },
+        h("span", { class: "grow" }, h("div", {}, name), h("div", { class: "key" }, id)), val ? h("span", { class: "v" }, val) : null);
+    }
+    function fill() {
+      const typed = q.value.trim();
+      const t = typed.toLowerCase();
+      const rows = (data ? data.entities : []).filter((e) => (all || e.match) && (e.entity_id + " " + e.name).toLowerCase().includes(t)).slice(0, 200);
+      list.replaceChildren(...rows.map((e) => opt(e.entity_id, e.name, reading(e))));
+      if (typed.includes(".") && !rows.some((e) => e.entity_id === typed)) list.append(opt(typed, W.picker.use, ""));
+      if (!list.children.length) list.append(h("div", { class: "small muted", style: "padding:10px" }, W.picker.none.description));
+      note.textContent = data && data.text ? data.text : "";
+      note.hidden = !note.textContent;
+    }
+    function close() { pop.hidden = true; btn.setAttribute("aria-expanded", "false"); }
+    btn.addEventListener("click", () => {
+      if (!pop.hidden) { close(); return; }
+      pop.hidden = false; btn.setAttribute("aria-expanded", "true"); q.value = ""; fill();
+      setTimeout(() => q.focus(), 0);
+    });
+    q.addEventListener("input", fill);
+    pop.addEventListener("keydown", (e) => {
+      if (e.key === "Escape") { e.preventDefault(); close(); btn.focus(); return; }
+      if (e.key !== "ArrowDown" && e.key !== "ArrowUp") return;
+      e.preventDefault();
+      const opts = [...list.querySelectorAll(".ent-opt")];
+      const i = opts.indexOf(document.activeElement);
+      const j = e.key === "ArrowDown" ? Math.min(opts.length - 1, i + 1) : i - 1;
+      if (j < 0) q.focus(); else if (opts[j]) opts[j].focus();
+    });
+    pop.append(q, note, list, allBox);
+    drawBtn();
+    entities(f.kind).then((d) => { data = d; drawBtn(); if (!pop.hidden) fill(); });
+    return h("div", { class: "ent" }, btn, pop,
+      f.optional ? h("button", { type: "button", class: "btn link tiny", onclick: () => { pick(""); drawBtn(); } }, W.picker.clear) : null);
+  }
+  function entity(f, card, lid) {
+    return picker(f, lid, () => get(f, card) || "", (v) => put(f, card, v));
+  }
+  function entityList(f, card, lid) {
+    const arr = () => (Array.isArray(get(f, card)) ? get(f, card) : []);
+    const box = h("div", { class: "elist" });
+    arr().forEach((_id, i) => {
+      box.append(h("div", { class: "erow" },
+        h("div", { class: "tiny muted" }, W.phase + " " + (i + 1)),
+        picker(f, lid, () => arr()[i] || "", (v) => { const a = arr().slice(); a[i] = v; put(f, card, a); }),
+        h("button", { type: "button", class: "btn link tiny", onclick: () => { const a = arr().slice(); a.splice(i, 1); put(f, card, a, true); } }, W.remove)));
+    });
+    box.append(h("button", { type: "button", class: "btn", onclick: () => put(f, card, arr().concat([""]), true) }, "+ " + W.add_row));
+    return box;
+  }
+  function solarList(f, card, lid) {
+    const arr = () => (Array.isArray(get(f, card)) ? get(f, card) : []);
+    const box = h("div", { class: "elist" });
+    arr().forEach((row, i) => {
+      const flip = h("button", { type: "button", class: "switch", role: "switch", "aria-checked": String(!!row.reversed), "aria-label": W.reversed });
+      flip.addEventListener("click", () => { const a = clone(arr()); a[i].reversed = !a[i].reversed; put(f, card, a, true); });
+      box.append(h("div", { class: "erow" },
+        picker(f, lid, () => arr()[i].entity || "", (v) => { const a = clone(arr()); a[i].entity = v; put(f, card, a); }),
+        h("div", { class: "row" }, h("span", { class: "swrap" }, flip, h("span", { class: "swtext" }, W.reversed)),
+          h("button", { type: "button", class: "btn link tiny", onclick: () => { const a = clone(arr()); a.splice(i, 1); put(f, card, a, true); } }, W.remove))));
+    });
+    box.append(h("button", { type: "button", class: "btn", onclick: () => put(f, card, arr().concat([{ entity: "", reversed: false }]), true) }, "+ " + W.add_solar));
+    return box;
+  }
+  // P5: time windows, each a start, an end, its days and a price. The add-on
+  // builds the tariff from the rows and names the first overlap or gap.
+  function periodList(f, card) {
+    const P = W.periods;
+    const arr = () => (Array.isArray(get(f, card)) ? get(f, card) : []);
+    const box = h("div", { class: "elist plist" });
+    if (!Array.isArray(get(f, card))) return h("div", { class: "msg info" }, W.derive.custom_profile.description);
+    arr().forEach((row, i) => {
+      const set = (k, v) => { const a = clone(arr()); a[i][k] = v; put(f, card, a); };
+      const say = (what) => P.window + " " + (i + 1) + ", " + what;
+      const time = (k) => {
+        const e = h("input", { class: "txt time", type: "text", inputmode: "numeric", maxlength: "5", placeholder: "00:00",
+                               value: row[k] == null ? "" : row[k], autocomplete: "off", spellcheck: "false", "aria-label": say(P[k]) });
+        e.addEventListener("input", () => set(k, e.value.trim()));
+        return e;
+      };
+      const days = h("select", { class: "sel", "aria-label": say(P.days) });
+      for (const [v, label] of f.days || []) days.append(h("option", { value: v, selected: v === row.days }, label));
+      days.addEventListener("change", () => set("days", days.value));
+      const price = h("input", { class: "num", type: "number", inputmode: "decimal", step: "0.01",
+                                 value: row.price == null ? "" : row.price, "aria-label": say(P.price) });
+      price.addEventListener("input", () => set("price", price.value === "" || isNaN(+price.value) ? null : +price.value));
+      const cell = (label, ...kids) => h("label", { class: "pf" }, h("span", { class: "tiny muted" }, label), ...kids);
+      box.append(h("div", { class: "erow prow" },
+        h("div", { class: "row spread" }, h("strong", { class: "small" }, P.window + " " + (i + 1)),
+          h("button", { type: "button", class: "btn link tiny", onclick: () => { const a = clone(arr()); a.splice(i, 1); put(f, card, a, true); } }, W.remove)),
+        h("div", { class: "row" }, cell(P.from, time("from")), cell(P.to, time("to")),
+          cell(P.price, h("span", { class: "row" }, price, f.unit ? h("span", { class: "unit" }, f.unit) : null))),
+        cell(P.days, days)));
+    });
+    box.append(h("button", { type: "button", class: "btn", onclick: () => {
+      const a = arr(), last = a[a.length - 1];
+      put(f, card, clone(a).concat([{ from: last ? last.to : "00:00", to: "24:00", days: last ? last.days : "mon-sun", price: null }]), true);
+    } }, "+ " + P.add));
+    return box;
+  }
+  const CONTROLS = { toggle, segmented: (f, c, l) => radios(f, c, l, false), choice: (f, c, l) => radios(f, c, l, true),
+                     select, slider, number, text, locked, entity, entity_list: entityList, solar_list: solarList,
+                     period_list: periodList };
+
+  /* ---------------- rows, cards and groups ---------------- */
+  function keyText(f, card) {
+    if (view === "setup") return "";     // the wizard shows no keys
+    if (card != null) return V[LIST.shape] === "flat" && f.flat ? f.flat : LIST.key + "[" + card + "]." + sub(f);
+    return f.key.startsWith("ui.") ? (f.writes || []).join(", ") : f.key;
+  }
+  function fieldRow(f, card, gid) {
+    if (f.control === "inverter_list") return cardList(f, gid);
+    const lid = "sf" + (++uid);
+    const keys = gid === "simple" ? "" : keyText(f, card);     // Simple shows no keys
+    const msg = h("div", { class: "msgs" });
+    const make = CONTROLS[f.control] || text;
+    const row = h("div", { class: "f" + (f.control === "toggle" ? " inline" : ""), "data-key": f.key, "data-card": card },
+      h("div", { class: "head" }, h("div", { class: "lbl", id: lid }, f.label, f.unit && !["slider", "number", "locked", "period_list"].includes(f.control) ? " (" + f.unit + ")" : ""),
+        keys ? h("div", { class: "key" }, keys) : null),
+      h("div", { class: "ctl" }, make(f, card, lid)),
+      f.help ? h("div", { class: "help" }, f.help) : null, msg);
+    ROWS.push({ f, card, el: row, msg, gid, search: (f.label + " " + keys + " " + f.key + " " + (f.help || "")).toLowerCase() });
+    return row;
+  }
+  function blankCard(f, first) {
+    const out = {};
+    for (const s of f.fields) {
+      const k = sub(s);
+      out[k] = s.control === "slider" && first && first[k] != null ? first[k] : s.type === "boolean" ? false : s.control === "number" ? null : "";
+    }
+    return out;
+  }
+  function cardList(f, gid) {
+    const wrap = h("div", { class: "invs", "data-key": f.key });
+    const msg = h("div", { class: "msgs" });
+    const cards = V[f.key];
+    if (!Array.isArray(cards)) {
+      wrap.append(h("div", { class: "msg info" }, W.raw_roster.description), msg);
+    } else {
+      cards.forEach((c, i) => {
+        const box = h("div", { class: "inv" }, h("div", { class: "hd" },
+          h("span", { class: "grow" }, c.name || W.inverter + " " + (i + 1)), view === "setup" ? null : h("span", { class: "key" }, f.key + "[" + i + "]"),
+          cards.length > 1 ? h("button", { type: "button", class: "btn link tiny", onclick: () => {
+            V[f.key].splice(i, 1); V[f.count] = V[f.key].length;
+            // Back to one card, the stored shape returns: a flat inverter stays flat.
+            if (V[f.key].length === 1) for (const k in f.grow) V[k] = clone(ORIG[k]);
+            put(f, null, V[f.key], true);
+          } }, W.remove) : null));
+        for (const s of f.fields) box.append(fieldRow(s, i, gid));
+        wrap.append(box);
+      });
+      wrap.append(msg, h("button", { type: "button", class: "btn", onclick: () => {
+        V[f.key].push(blankCard(f, V[f.key][0])); Object.assign(V, f.grow); V[f.count] = V[f.key].length;
+        put(f, null, V[f.key], true);
+      } }, "+ " + W.add_inverter));
+    }
+    ROWS.push({ f, card: null, el: wrap, msg, gid, list: true, search: (f.label + " " + f.key + " " + (f.help || "")).toLowerCase() });
+    return wrap;
+  }
+  const chev = () => h("span", { class: "chev", "aria-hidden": "true" }, "›");
+  function render() {
+    const host = $("#groups");
+    const y = window.scrollY;
+    host.replaceChildren();
+    ROWS.length = 0;
+    for (const g of M.layout.groups) {
+      const d = h("details", { class: "grp", "data-g": g.id },
+        h("summary", {}, h("span", { class: "grow" }, h("strong", {}, g.name), h("span", { class: "small muted gdesc" }, g.description)),
+          h("span", { class: "gchips" }, h("span", { class: "gbadge" }), ...g.applies.map((a) => h("span", { class: "chip applies" }, a))), chev()));
+      d.open = OPEN.has(g.id);
+      d.addEventListener("toggle", () => { if (!$("#set-search").value) (d.open ? OPEN.add(g.id) : OPEN.delete(g.id)); });
+      const body = h("div", { class: "body" });
+      if (g.support_only) body.append(h("div", { class: "msg warn", role: "note" }, W.support.description));
+      for (const p of g.parts) {
+        const pid = g.id + "." + p.id;
+        let box;
+        if (p.collapsed) {
+          box = h("details", { class: "sub part" }, h("summary", {}, p.name));
+          box.open = OPEN.has(pid);
+          box.addEventListener("toggle", () => { if (!$("#set-search").value) (box.open ? OPEN.add(pid) : OPEN.delete(pid)); });
+        } else {
+          box = h("div", { class: "part" }, p.name ? h("div", { class: "subhead" }, p.name) : null);
+        }
+        if (p.description) box.append(h("p", { class: "small muted", style: "margin:4px 0" }, p.description));
+        for (const f of p.fields) box.append(fieldRow(f, null, g.id));
+        body.append(box);
+      }
+      if (g.id === "maintenance") {
+        body.append(h("div", { class: "part" }, h("div", { class: "subhead" }, W.cycle.name),
+          h("p", { class: "small muted", style: "margin:4px 0" }, W.cycle.description),
+          h("div", { class: "row" },
+            h("button", { type: "button", class: "btn", onclick: () => maint("maint_start") }, ROOT.home.control.maint_start),
+            h("button", { type: "button", class: "btn danger", onclick: () => maint("maint_abort") }, ROOT.home.control.maint_abort))));
+      }
+      d.append(body);
+      host.append(d);
+    }
+    renderSimple();
+    paint();
+    window.scrollTo(0, y);
+  }
+
+  /* ---------------- Settings, Simple (P3) ---------------- */
+  // The fields the layout marks `simple`, each in its own card with when it
+  // applies, and the batteries' switches and modes (runtime state, applied at
+  // once) drawn by app.js from /status. The Installer rows stay built but
+  // hidden, so the save bar counts every unsaved change in either view.
+  const chip = (applies) => h("span", { class: "chip " + (applies === "now" ? "now" : "rs") }, ROOT.applies[applies].name);
+  // A note with {kw} is filled from /status (app.js sends ux13:status).
+  function fillNotes() {
+    const st = window.UX13.status();
+    const mp = st && st.month_peak;
+    document.querySelectorAll("#simple [data-kw-note]").forEach((e) => {
+      const ok = mp && mp.peak_w != null;
+      e.hidden = !ok;
+      e.textContent = ok ? e.dataset.kwNote.replace("{kw}", window.UX13.kw(mp.peak_w) + " kW") : "";
+    });
+  }
+  // OPT-11 P4: the solar forecast card shows the add-on's forecast line.
+  function fillSolar() {
+    const st = window.UX13.status();
+    const line = st && st.solar ? st.solar.line : "";
+    document.querySelectorAll("#simple [data-solar-note]").forEach((e) => {
+      e.textContent = line || "";
+      e.hidden = !line;
+    });
+  }
+  document.addEventListener("ux13:status", fillNotes);
+  document.addEventListener("ux13:status", fillSolar);
+  function simpleField(f) {
+    const row = fieldRow(f, null, "simple");
+    row.querySelector(".head").append(chip(f.applies));
+    const n = f.note && W.simple.note[f.note];
+    if (n && n.description.includes("{kw}")) {
+      row.append(h("div", { class: "small muted", "data-kw-note": n.description, hidden: true }));
+    } else if (n) {
+      // A plain note replaces the option's installer help on this view.
+      const help = row.querySelector(".help");
+      if (help) help.textContent = n.description;
+    }
+    if (f.note === "forecast") row.append(h("div", { class: "small muted", "data-solar-note": "", hidden: true }));
+    return h("div", { class: "card" }, row);
+  }
+  function renderSimple() {
+    const host = $("#simple");
+    host.replaceChildren();
+    if (mode !== "simple") return;
+    const cards = allFields().filter((f) => f.simple).map(simpleField);
+    const batts = h("div", {});
+    cards.splice(Math.min(1, cards.length), 0, h("div", { class: "card" },
+      h("div", { class: "row spread" }, h("div", { class: "lbl" }, W.simple.batteries.name), chip("now")), batts));
+    host.append(...cards, h("p", { class: "small muted", style: "margin:4px 2px" }, W.simple.more.description + " ",
+      h("button", { type: "button", class: "btn link", onclick: () => setMode("installer", true) }, W.simple.installer)));
+    window.UX13.batteries(batts);
+    fillNotes();
+  }
+  // `remember`: only the person's own pick of a view is kept for next time;
+  // a jump to Installer (a link, a setting to fix) is not.
+  function setMode(v, redraw, remember) {
+    mode = v;
+    if (remember) try { localStorage.setItem("ux13.settings.view", v); } catch (e) { /* no storage */ }
+    document.querySelectorAll("#set-view [role=radio]").forEach((b) => {
+      const on = b.dataset.v === v;
+      b.setAttribute("aria-checked", String(on)); b.tabIndex = on ? 0 : -1;
+    });
+    $("#set-desc").textContent = v === "simple" ? W.simple.description : W.description;
+    $("#simple").hidden = v !== "simple";
+    ["#set-search", "#groups", "#set-nomatch"].forEach((id) => { $(id).classList.toggle("vhide", v === "simple"); });
+    if (redraw && M && view === "settings") render();
+  }
+  document.querySelectorAll("#set-view [role=radio]").forEach((b, i, all) => {
+    b.addEventListener("click", () => setMode(b.dataset.v, true, true));
+    b.addEventListener("keydown", (e) => {
+      const d = { ArrowRight: 1, ArrowDown: 1, ArrowLeft: -1, ArrowUp: -1 }[e.key];
+      if (!d) return;
+      e.preventDefault();
+      const j = all[(i + d + all.length) % all.length];
+      setMode(j.dataset.v, true, true); j.focus();
+    });
+  });
+  setMode(mode, false);
+  window.UX13.settingsView = (v) => setMode(v, true);
+
+  /* ---------------- messages, visibility, search, badges ---------------- */
+  const ICON = { bad: "×", warn: "!", info: "i" };
+  const RANK = { bad: 0, warn: 1, info: 2 };
+  function mine(r, m) {
+    if (m.field !== r.f.key) return false;
+    if (r.list || r.card == null) return true;
+    return m.card == null ? r.card === 0 : m.card === r.card;
+  }
+  function paint() {
+    const q = view === "setup" || mode === "simple" ? "" : $("#set-search").value.trim().toLowerCase();
+    // A message counts as shown only beside a row of the view on screen.
+    const onScreen = (r) => view === "setup" || (mode === "simple") === (r.gid === "simple");
+    const placed = new Set();
+    for (const r of ROWS) {
+      r.visible = visible(r.f);
+      const msgs = MSG.filter((m, i) => { const hit = mine(r, m); if (hit && r.visible && onScreen(r)) placed.add(i); return hit; })
+        .sort((a, z) => RANK[a.tier] - RANK[z.tier]);
+      r.tiers = new Set(msgs.map((m) => m.tier));
+      r.msg.replaceChildren(...msgs.map((m) => h("div", { class: "msg " + m.tier },
+        h("span", { class: "mi", "aria-hidden": "true" }, ICON[m.tier] || "i"),
+        h("span", {}, h("span", { class: "sr" }, W.tier[m.tier] + ": "), m.text))));
+      r.el.classList.toggle("has-bad", r.tiers.has("bad"));
+      // A card list counts as one change when cards were added or removed;
+      // an edit inside a card counts on its own row.
+      r.changed = r.list ? !same((get(r.f) || []).length, (valueIn(ORIG, r.f) || []).length)
+                         : !same(get(r.f, r.card), valueIn(ORIG, r.f, r.card));
+      r.el.classList.toggle("changed", r.changed && !r.list);
+    }
+    // Search: a row shows when it is visible and matches. A card list shows
+    // while any of its rows does.
+    for (const r of ROWS) if (!r.list) r.el.hidden = !(r.visible && (!q || r.search.includes(q)));
+    for (const r of ROWS) if (r.list) r.el.hidden = !!q && !r.search.includes(q) && !ROWS.some((s) => !s.list && s.card != null && !s.el.hidden);
+    let any = false;
+    document.querySelectorAll("#groups details.grp").forEach((d) => {
+      const rows = ROWS.filter((r) => r.gid === d.dataset.g);
+      d.querySelectorAll(".part").forEach((p) => {
+        const inside = rows.filter((r) => p.contains(r.el));
+        if (inside.length) p.hidden = inside.every((r) => r.el.hidden);
+      });
+      const hit = rows.some((r) => !r.el.hidden);
+      any = any || hit;
+      d.hidden = !!q && !hit;
+      if (q && hit) { d.open = true; d.querySelectorAll("details.sub").forEach((s) => { s.open = true; }); }
+      const shownRows = rows.filter((r) => r.visible && !r.list);
+      const bad = shownRows.filter((r) => r.tiers.has("bad")).length + rows.filter((r) => r.list && r.tiers.has("bad")).length;
+      const warn = shownRows.filter((r) => !r.tiers.has("bad") && r.tiers.has("warn")).length;
+      const changed = rows.filter((r) => r.changed).length;
+      d.querySelector(".gbadge").replaceChildren(...[
+        bad ? h("span", { class: "chip bad" }, bad + " " + W.to_fix) : null,
+        warn ? h("span", { class: "chip rs" }, warn + " " + W.to_check) : null,
+        changed ? h("span", { class: "chip changed" }, changed + " " + W.changed) : null].filter(Boolean));
+    });
+    $("#set-nomatch").hidden = !q || any;
+    // A sentence shown beside any field is not repeated here.
+    const shownText = new Set(MSG.filter((m, i) => placed.has(i)).map((m) => m.text));
+    const other = MSG.filter((m, i) => !shownText.has(m.text) && MSG.findIndex((x) => x.text === m.text) === i);
+    if (DEVICE) other.push({ tier: "info", text: DEVICE });
+    $("#set-other").hidden = !other.length;
+    $("#set-other-list").replaceChildren(...other.map((m) => h("li", { class: "c-" + ({ bad: "bad", warn: "warn" }[m.tier] || "info") },
+      h("span", { class: "sr" }, W.tier[m.tier] + ": "), (ICON[m.tier] || "i") + " " + m.text)));
+    savebar();
+  }
+  function dirtyCount() {
+    const seen = new Set();
+    for (const r of ROWS) if (r.changed) seen.add(r.f.key + "#" + r.card);
+    return seen.size;
+  }
+  function savebar() {
+    const n = V ? dirtyCount() : 0;
+    $("#savebar").hidden = !(view === "settings" && n);
+    $("#sb-text").textContent = n + " " + (n === 1 ? W.savebar.one : W.savebar.many);
+  }
+  $("#set-search").addEventListener("input", () => { if (V) paint(); });
+
+  /* ---------------- talking to the add-on ---------------- */
+  let vtimer = null, vseq = 0;
+  function queueValidate() { clearTimeout(vtimer); vtimer = setTimeout(validate, 400); }
+  // `extra` asks for more, e.g. the wizard's live checks. Returns the answer,
+  // or null when it failed or a newer check overtook it.
+  async function validate(extra) {
+    const seq = ++vseq;
+    try {
+      const r = await fetch("config/validate", { method: "POST", headers: { "Content-Type": "application/json" },
+                                                 body: JSON.stringify(Object.assign({ model: V, lang }, extra || {})) });
+      const b = await r.json();
+      if (seq !== vseq) return null;
+      MSG = b.messages || [];
+      DEVICE = b.device_note || "";
+      STEPS = b.steps || {};
+      paint();
+      return b;
+    } catch (e) { return null; /* the next change tries again */ }
+  }
+  function banner(level, title, sub, button, onClick) {
+    const host = $("#set-banner");
+    if (!title) { host.replaceChildren(); return; }
+    host.replaceChildren(h("div", { class: "banner " + ({ ok: "b-ok", bad: "b-bad" }[level] || "b-warn") },
+      h("span", { class: "ic", "aria-hidden": "true" }, { ok: "✓", bad: "×" }[level] || "!"),
+      h("span", {}, title, h("small", {}, sub, button ? [" ", h("button", { type: "button", class: "btn link", onclick: onClick }, button)] : null))));
+  }
+  function restart() {
+    ask(W.dialog, async () => {
+      try {
+        await fetch("config/restart", { method: "POST", headers: { "Content-Type": "application/json" },
+                                        body: JSON.stringify({ confirm: "restart" }) });
+      } catch (e) { /* the add-on stops answering while it restarts */ }
+      toast(W.toast.restarting.description);
+    });
+  }
+  async function load(after) {
+    let m;
+    try {
+      const r = await fetch("config/model?lang=" + lang, { cache: "no-store" });
+      if (!r.ok) throw new Error("model " + r.status);
+      m = await r.json();
+      if (!m.layout || !m.ui) throw new Error("no layout");
+    } catch (e) {
+      $("#groups").replaceChildren();
+      $("#set-search").hidden = true;
+      banner("bad", W.load_failed.name, W.load_failed.description);
+      return;
+    }
+    M = m; V = clone(m.ui); ORIG = clone(m.ui); FP = m.fingerprint; MSG = []; DEVICE = "";
+    UNLOCKED.clear();
+    $("#set-search").hidden = false;
+    FILLED = {};
+    LIST = null;
+    for (const g of M.layout.groups) for (const p of g.parts) for (const f of p.fields) {
+      if (f.fills) FILLED[f.fills] = f;
+      if (f.control === "inverter_list") LIST = f;
+    }
+    if (!OPEN.size && M.layout.groups.length) OPEN.add(M.layout.groups[0].id);
+    if (after === "saved") banner("ok", W.saved.name, W.saved.description, W.restart, restart);
+    else if ((m.running_differs || []).length) banner("warn", W.differs.name, W.differs.description, W.restart, restart);
+    else banner();
+    if (view === "setup") drawStep(); else render();
+    validate();
+  }
+  function firstBad() {
+    if (view === "settings" && mode === "simple" && !ROWS.some((x) => x.gid === "simple" && x.tiers && x.tiers.has("bad") && x.visible)
+        && ROWS.some((x) => x.tiers && x.tiers.has("bad") && x.visible)) setMode("installer", true);
+    const r = ROWS.find((x) => x.tiers && x.tiers.has("bad") && x.visible && (view !== "settings" || (mode === "simple") === (x.gid === "simple")));
+    if (!r) { if (!$("#set-other").hidden) $("#set-other").scrollIntoView({ block: "center" }); return; }
+    for (let p = r.el.parentElement; p; p = p.parentElement) if (p.tagName === "DETAILS") p.open = true;
+    r.el.scrollIntoView({ block: "center" });
+    const input = r.el.querySelector("input,select,button");
+    if (input) input.focus({ preventScroll: true });
+  }
+  // The one save path, for the Installer view and the wizard. After a stale
+  // refusal the page holds the new token, so a second press saves. `base` is
+  // the model the page opened: only what changed since then is written, onto
+  // what is stored now (UX-15 F2).
+  async function postSave(extra) {
+    const r = await fetch("config/save", { method: "POST", headers: { "Content-Type": "application/json" },
+                                           body: JSON.stringify(Object.assign({ model: V, base: ORIG, fingerprint: FP, lang }, extra || {})) });
+    const b = await r.json().catch(() => ({}));
+    if (r.status === 409 && b.kind === "stale") FP = b.fingerprint || FP;
+    return { r, b };
+  }
+  // The settings another surface changed (not this page's own edits).
+  function staleText(b) {
+    const names = (b.changed_fields || []).map((k) => { const f = findField(k); return f ? f.label : k; });
+    return W.stale.description + (names.length ? " " + names.join(", ") + "." : "");
+  }
+  async function save() {
+    const btn = $("#sb-save");
+    btn.disabled = true; btn.textContent = W.savebar.saving;
+    try {
+      clearTimeout(vtimer);
+      await validate();
+      if (MSG.some((m) => m.tier === "bad")) { toast(W.toast.blocked.description); firstBad(); return; }
+      const { r, b } = await postSave();
+      if (r.ok) { toast(W.toast.saved); await load("saved"); return; }
+      if (r.status === 409 && b.kind === "stale") {
+        banner("bad", W.stale.name, staleText(b));
+        return;
+      }
+      if (r.status === 422) { MSG = b.messages || []; paint(); toast(W.toast.blocked.description); firstBad(); return; }
+      toast(W.toast.failed);
+    } catch (e) { toast(W.toast.failed); }
+    finally { btn.disabled = false; btn.textContent = W.savebar.save; }
+  }
+  $("#sb-save").addEventListener("click", save);
+  // Discard reloads what is stored: after a stale save ORIG is no longer it.
+  $("#sb-discard").addEventListener("click", async () => {
+    await load(); toast(W.toast.discarded);
+  });
+  addEventListener("beforeunload", (e) => { if (V && dirtyCount()) { e.preventDefault(); e.returnValue = ""; } });
+
+  /* ---------------- the setup wizard (P4) ---------------- */
+  const WS = W.setup;
+  const WZ = { step: 1, kettle: null, shadowOn: true, done: "", checked: null };
+  function redrawView() { if (view === "setup") drawStep(); else render(); }
+  function allFields() {
+    const out = [];
+    for (const g of M.layout.groups) for (const p of g.parts) for (const f of p.fields) out.push(f);
+    return out;
+  }
+  const say = (text, vars) => Object.keys(vars || {}).reduce((t, k) => t.replace("{" + k + "}", vars[k]), text);
+  function watts(w, signed) {
+    const n = String(Math.round(Math.abs(w))).replace(/\B(?=(\d{3})+(?!\d))/g, " ");
+    return (signed && w < 0 ? "-" : "") + n + " W";
+  }
+  function line(tier, text) {
+    const icon = { ok: "✓", bad: "×", warn: "!", info: "i" }[tier] || "i";
+    return h("li", {}, h("span", { class: "sev " + tier, "aria-hidden": "true" }, icon),
+      h("span", {}, h("span", { class: "sr" }, (W.tier[tier] || "") + ": "), text));
+  }
+
+  // Step 1's kettle test. The table is app/uilayout.py's KETTLE; this is
+  // uipage.kettle() (test_setup.py grades that one) on the page.
+  function kettleSource() { const K = M.setup.kettle; return K.sources[V[K.source]] || null; }
+  function kettleSig(src) { return JSON.stringify([V[M.setup.kettle.source], src.read.map(([k]) => V[k] || "")]); }
+  function kettleOutcome(src, before, after) {
+    const d = after - before;
+    if (Math.abs(d) < M.setup.kettle.min_w) return { say: "none", sets: null, d };
+    const o = src[d > 0 ? "up" : "down"];
+    return { say: o.say, sets: o.sets, d };
+  }
+  function kettleOk() {
+    const src = kettleSource();
+    return !src || !!(WZ.kettle && WZ.kettle.sig === kettleSig(src) && WZ.kettle.ok);
+  }
+  async function readMeter(src) {
+    let total = 0;
+    for (const [key, sign] of src.read) {
+      if (!V[key]) return null;
+      const r = await fetch("ha/entities?entity=" + encodeURIComponent(V[key]), { cache: "no-store" })
+        .then((x) => (x.ok ? x.json() : null)).catch(() => null);
+      if (!r || r.watts == null) return null;
+      total += sign * r.watts;
+    }
+    return total;
+  }
+  function kettleBox() {
+    const src = kettleSource();
+    const box = h("div", { class: "f kettle" }, h("div", { class: "lbl" }, WS.kettle.name));
+    if (!src) { box.append(h("div", { class: "help" }, WS.kettle.self.description)); return box; }
+    const sig = kettleSig(src);
+    if (WZ.kettle && WZ.kettle.sig !== sig) WZ.kettle = null;     // another meter: test again
+    const k = WZ.kettle || { sig };
+    box.append(h("div", { class: "help" }, WS.kettle.description));
+    // A skip after the reading went down still says it went down (UX-15).
+    const said = k.say === "skipped" && k.wrong ? "skipped_down" : k.say;
+    const tone = { ok: "ok", flip: "info", none: "warn", unread: "bad", skipped: "warn", skipped_down: "warn" }[said] || "bad";
+    const words = said ? WS.kettle[said] : k.before != null ? WS.kettle.before : null;
+    if (words) box.append(h("div", { class: "msg " + (k.say ? tone : "info"), role: "status" },
+      say(words.description, { w: k.before != null ? watts(k.before, true) : "", d: k.d != null ? watts(k.d) : "" })));
+    const busy = (b) => { b.disabled = true; };
+    const read = h("button", { type: "button", class: "btn" }, k.before != null && !k.ok ? WS.kettle.again : WS.kettle.read);
+    read.addEventListener("click", async () => {
+      busy(read);
+      const sig = kettleSig(src);           // the entity may have changed since drawing
+      if (k.sig !== sig) { k.before = null; k.ok = false; k.sig = sig; }
+      const w = await readMeter(src);
+      if (w == null) WZ.kettle = Object.assign({}, k, { sig, say: "unread" });
+      else if (k.before == null || k.ok) WZ.kettle = { sig, before: w, wrong: !k.ok && !!k.wrong };
+      else {
+        const o = kettleOutcome(src, k.before, w);
+        // `wrong`: the reading went the way no option can fix. A skip after
+        // that keeps saying so on the last step (review R2).
+        const wrong = o.say === "none" ? !!k.wrong : o.sets == null;
+        WZ.kettle = { sig, before: o.say === "none" ? k.before : null, say: o.say, d: o.d, ok: o.sets != null, wrong };
+        if (o.sets) { Object.assign(V, o.sets); queueValidate(); }
+      }
+      drawStep();
+    });
+    const row = h("div", { class: "row" }, read);
+    if (!k.ok) row.append(h("button", { type: "button", class: "btn link", onclick: () => {
+      WZ.kettle = { sig: kettleSig(src), say: "skipped", ok: true, skipped: true, wrong: !!k.wrong }; drawStep();
+    } }, WS.kettle.skip));
+    box.append(row);
+    return box;
+  }
+
+  // Step 6: the shadow switch, the checks, and Save and restart.
+  // The shadow switch goes only on the model the wizard posts, never into V,
+  // which the Installer view saves too (review R3).
+  function shadowValue() {
+    const s = M.setup.shadow;
+    return WZ.shadowOn ? s.on : (ORIG[s.field] !== s.on ? ORIG[s.field] : s.off);
+  }
+  function posted() { return Object.assign({}, V, { [M.setup.shadow.field]: shadowValue() }); }
+  function shadowRow() {
+    const lid = "wzs";
+    const b = h("button", { type: "button", class: "switch", role: "switch", "aria-checked": String(WZ.shadowOn), "aria-labelledby": lid });
+    b.addEventListener("click", () => { WZ.shadowOn = !WZ.shadowOn; drawStep(); });
+    return h("div", { class: "f inline" },
+      h("div", {}, h("div", { class: "lbl", id: lid }, WS.shadow.name), h("div", { class: "help" }, WS.shadow.description)),
+      h("div", { class: "ctl" }, b));
+  }
+  async function runChecks() {
+    const list = $("#wz-checks");
+    if (list) list.replaceChildren(line("info", WS.check.running.description));
+    clearTimeout(vtimer);
+    const b = await validate({ setup: true, model: posted() });
+    WZ.checked = b;
+    if (!list || !list.isConnected) return b;
+    if (!b) { list.replaceChildren(line("bad", WS.check.failed.description)); return b; }
+    const items = [], seen = new Set();
+    const add = (tier, text) => { if (!seen.has(text)) { seen.add(text); items.push([tier, text]); } };
+    const bad = (b.messages || []).filter((m) => m.tier === "bad");
+    if (!bad.length) add("ok", WS.check.pass.description);
+    for (const m of bad) add("bad", m.text);
+    for (const m of b.setup || []) add(m.tier, m.text);
+    if (b.device_note) add("info", b.device_note);
+    const src = kettleSource();
+    if (!src) add("info", WS.kettle.self.description);
+    else if (WZ.kettle && WZ.kettle.skipped) add("warn", (WZ.kettle.wrong ? WS.kettle.skipped_wrong : WS.kettle.skipped).description);
+    else if (kettleOk()) add("ok", WS.kettle.tested.description);
+    const rank = { bad: 0, warn: 1, ok: 2, info: 3 };
+    items.sort((a, z) => rank[a[0]] - rank[z[0]]);
+    list.replaceChildren(...items.map(([t, x]) => line(t, x)));
+    WZ.blocked = items.some(([t]) => t === "bad");
+    return b;
+  }
+  function finalBox() {
+    const again = h("button", { type: "button", class: "btn", onclick: runChecks }, WS.check.again);
+    setTimeout(runChecks, 0);
+    return [h("div", { class: "subhead" }, WS.check.name),
+      h("ul", { class: "plain checklist small", id: "wz-checks", "aria-live": "polite" }), h("div", { class: "row" }, again),
+      shadowRow()];
+  }
+  function wzBanner(level, title, sub, button, onClick) {
+    const host = $("#wz-banner");
+    if (!title) { host.replaceChildren(); return; }
+    host.replaceChildren(h("div", { class: "banner " + ({ ok: "b-ok", bad: "b-bad" }[level] || "b-warn") },
+      h("span", { class: "ic", "aria-hidden": "true" }, { ok: "✓", bad: "×" }[level] || "!"),
+      h("span", {}, title, h("small", {}, sub, button ? [" ", h("button", { type: "button", class: "btn link", onclick: onClick }, button)] : null))));
+  }
+  async function finish() {
+    const b = await runChecks();
+    if (!b) { toast(WS.check.failed.description); return; }
+    if (WZ.blocked) { toast(WS.check.blocked.description); return; }
+    const shadow = shadowValue() === M.setup.shadow.on;
+    // In setup-only mode nothing runs yet, so no inverter is set to 0 W first.
+    const dlg = M.setup_only ? (shadow ? WS.dialog_setup : WS.dialog_setup_live) : (shadow ? WS.dialog : WS.dialog_live);
+    ask(dlg, async () => {
+      wzBanner();
+      let res;
+      try { res = await postSave({ setup: "done", model: posted() }); } catch (e) { toast(W.toast.failed); return; }
+      const { r, b: body } = res;
+      if (r.status === 409 && body.kind === "stale") { wzBanner("bad", W.stale.name, staleText(body)); return; }
+      if (r.status === 422) {
+        MSG = body.messages || []; STEPS = body.steps || {};
+        const first = Object.keys(STEPS).map(Number).sort((a, z) => a - z).find((n) => STEPS[n] > 0);
+        if (first) WZ.step = first;
+        drawStep(); toast(W.toast.blocked.description); firstBad();
+        return;
+      }
+      if (!r.ok) { toast(W.toast.failed); return; }
+      let restarted = true;
+      try {
+        const rr = await fetch("config/restart", { method: "POST", headers: { "Content-Type": "application/json" },
+                                                   body: JSON.stringify({ confirm: "restart" }) });
+        restarted = rr.ok;
+      } catch (e) { /* the add-on stops answering while it restarts */ }
+      WZ.done = restarted ? (shadow ? "done" : "done_live") : "restart_failed";
+      drawStep();
+      if (!restarted) await load("saved");      // still running: read what is stored
+    });
+  }
+  function drawDone() {
+    const w = WS[WZ.done];
+    $("#wz-count").textContent = "";
+    $("#wz-steps").replaceChildren();
+    $("#wz-desc").textContent = "";
+    $("#wz-nav").hidden = true;
+    ROWS.length = 0;
+    if (WZ.done === "restart_failed") wzBanner("warn", w.name, w.description, W.restart, restart);
+    else wzBanner("ok", w.name, w.description);
+    $("#wz-body").replaceChildren(h("a", { class: "btn primary", href: "#home" }, WS.home));
+  }
+  function drawStep() {
+    if (!M) return;
+    if (WZ.done) { drawDone(); return; }
+    const S = M.setup, n = WZ.step, words = WS.steps[n];
+    $("#wz-nav").hidden = false;
+    $("#wz-title").textContent = words.name;
+    $("#wz-count").textContent = say(WS.step, { n, total: S.steps });
+    $("#wz-steps").replaceChildren(...Array.from({ length: S.steps }, (_x, i) =>
+      h("i", { class: i + 1 < n ? "done" : i + 1 === n ? "cur" : null })));
+    $("#wz-desc").textContent = words.description;
+    ROWS.length = 0;
+    const body = [];
+    if (n === 1 && !M.setup_needed) body.push(h("div", { class: "msg info" }, WS.done_before.description));
+    for (const f of allFields()) if (f.wizard === n && f.key !== S.shadow.field) body.push(fieldRow(f, null, "wz"));
+    if (n === 1) body.push(kettleBox());
+    if (n === 5) body.push(h("p", { class: "small muted" }, WS.modes_later.description));
+    if (n === S.final) body.push(...finalBox());
+    $("#wz-body").replaceChildren(...body);
+    $("#wz-back").textContent = n === 1 ? WS.not_now : WS.back;
+    $("#wz-next").textContent = n === S.final ? WS.finish : S.optional.includes(n) ? WS.skip : WS.next;
+    paint();
+  }
+  $("#wz-back").addEventListener("click", () => {
+    if (WZ.step === 1) { location.hash = "#home"; return; }
+    WZ.step -= 1; drawStep(); window.scrollTo(0, 0);
+  });
+  $("#wz-next").addEventListener("click", async () => {
+    if (!M) return;
+    const btn = $("#wz-next");
+    btn.disabled = true;
+    try {
+      const n = WZ.step;
+      if (n === M.setup.final) { await finish(); return; }
+      clearTimeout(vtimer);
+      const b = await validate();
+      if (!b) { toast(W.toast.failed); return; }
+      if (n === 1 && !kettleOk()) { toast(WS.kettle.needed.description); return; }
+      if ((STEPS[n] || 0) > 0) { toast(W.toast.blocked.description); firstBad(); return; }
+      WZ.step = n + 1; drawStep(); window.scrollTo(0, 0);
+    } finally { btn.disabled = false; }
+  });
+
+  document.addEventListener("ux13:tab", (e) => {
+    view = e.detail === "settings" || e.detail === "setup" ? e.detail : null;
+    if (view && !M) load(); else if (view) { redrawView(); validate(); } else savebar();
+  });
+  // app.js chose the first tab before this file ran.
+  const sel = document.querySelector(".tab[aria-selected=true]");
+  if (sel && (sel.dataset.hash === "settings" || sel.dataset.hash === "setup")) { view = sel.dataset.hash; load(); }
+  // First run: opened with no route, on a site the add-on says is new
+  // (uipage.setup_needed), the page goes to Setup by itself.
+  else if (window.UX13.first) {
+    load().then(() => { if (M && M.setup_needed && location.hash === "#home") location.hash = "#setup"; });
+  }
+})();
diff --git a/goodwe_controller/app/static_tariff.py b/goodwe_controller/app/static_tariff.py
index 69e11c9..fc6659b 100644
--- a/goodwe_controller/app/static_tariff.py
+++ b/goodwe_controller/app/static_tariff.py
@@ -204,6 +204,7 @@ import math
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 
+from . import messages
 from .price import (
     MAX_PLAUSIBLE_EUR_KWH, Absence, PricePoint, PriceProduct, PriceRead,
     Uncertainty, _Outcome, brussels, load_prices, price_option,
@@ -262,9 +263,8 @@ def _minutes(value, field: str) -> int:
     parts = text.split(":")
     if len(parts) != 2:
         raise ProfileInvalid(
-            f"{field} is {value!r}; it must be \"HH:MM\" local Belgian time, "
-            f"e.g. \"22:00\". A bare hour or a decimal is refused rather than "
-            f"guessed at - 7.5 could be 07:30 or 07:50.")
+            f"{field} is {value!r}. Write it as \"HH:MM\" in Belgian time, "
+            f"for example \"22:00\".")
     try:
         h, m = int(parts[0]), int(parts[1])
     except ValueError:
@@ -272,9 +272,8 @@ def _minutes(value, field: str) -> int:
                              f"integers, e.g. \"07:00\"")
     if not (0 <= m < 60) or not (0 <= h <= 24) or (h == 24 and m != 0):
         raise ProfileInvalid(
-            f"{field} is {value!r}, which is not a time of day. Hours run 0-23, "
-            f"minutes 0-59; \"24:00\" is accepted only as an END meaning "
-            f"midnight at the end of the day.")
+            f"{field} is {value!r}, which is not a time of day. Use 00:00 to "
+            f"23:59, or \"24:00\" as an end time.")
     return h * 60 + m
 
 
@@ -286,11 +285,8 @@ def _days(value, field: str) -> frozenset:
     """
     if value is None:
         raise ProfileInvalid(
-            f"{field} is missing. Name the days this period applies to - "
-            f"\"mon-fri\", \"sat,sun\" or \"all\". It is required rather than "
-            f"defaulted to every day, because a Belgian night tariff that "
-            f"silently covered the weekend too would misprice 48 h a week with "
-            f"nothing reporting it.")
+            f"{field} is missing. Name the days, for example \"mon-fri\", "
+            f"\"sat,sun\" or \"all\".")
     tokens = []
     if isinstance(value, (list, tuple)):
         for item in value:
@@ -367,10 +363,8 @@ def _price(value, field: str, means: str = None) -> float:
         raise ProfileInvalid(f"{field} is {value!r}, which is not finite")
     if abs(out) > MAX_PLAUSIBLE_EUR_KWH:
         raise ProfileInvalid(
-            f"{field} is {out} EUR/kWh, beyond +-{MAX_PLAUSIBLE_EUR_KWH}. The "
-            f"usual cause is a figure in cents or in EUR/MWh - 34 instead of "
-            f"0.34 - which would make every hour look like an emergency. Same "
-            f"bound the fetched feeds are held to (price.py `_validate_raw`).")
+            f"{field} is {out} EUR/kWh, beyond +-{MAX_PLAUSIBLE_EUR_KWH}. "
+            f"Write the price in EUR/kWh, for example 0.34 and not 34.")
     return out
 
 
@@ -422,9 +416,8 @@ class StaticProfile:
         self.option = option
         if not self.periods:
             raise ProfileInvalid(
-                f"{option} has no periods. A profile with no periods is "
-                f"not a fixed tariff, it is an absent one - leave the option "
-                f"empty to say that on purpose (§11.4 then applies).")
+                f"{option} has no periods. Add at least one, or leave the "
+                f"setting empty.")
         _check_tiling(self.periods, option=option)
 
     # -- what kind of tariff this is, DERIVED --------------------------------
@@ -558,10 +551,7 @@ def _raise_gap(weekday, start, end, option="static_profile"):
     raise ProfileInvalid(
         f"{option} leaves {DAY_NAMES[weekday]} "
         f"{_hhmm(start)}-{_hhmm(end)} with no period, so those hours have no "
-        f"price. Refused rather than defaulted: an invented price is one an "
-        f"optimiser would trade on, and §11.4 already says what a missing price "
-        f"means. Add a period covering it - remember a window written "
-        f"\"22:00-07:00 mon-fri\" does NOT cover Saturday morning.")
+        f"price. Add a period that covers them.")
 
 
 def _raise_overlap(weekday, over, end, periods, option="static_profile"):
@@ -569,9 +559,8 @@ def _raise_overlap(weekday, over, end, periods, option="static_profile"):
     names = [p.name for p in periods if p.covers(weekday, start)]
     raise ProfileInvalid(
         f"{option} gives {DAY_NAMES[weekday]} {_hhmm(start)}-"
-        f"{_hhmm(end)} {n} prices at once ({', '.join(names)}). Two prices for "
-        f"one hour means one of them silently wins on list order. Narrow one of "
-        f"the windows or split the day selector.")
+        f"{_hhmm(end)} {n} prices at once ({', '.join(names)}). Make the "
+        f"periods stop overlapping.")
 
 
 def parse_static_profile(value, *, option: str = "static_profile",
@@ -609,28 +598,21 @@ def parse_static_profile(value, *, option: str = "static_profile",
             value = json.loads(text)
         except ValueError as e:
             raise ProfileInvalid(
-                f"{option} is not valid JSON ({e}). It is a JSON object "
-                f"with a \"periods\" list, on one line, e.g.\n"
-                f'  {{"periods": [{{"name":"day","from":"07:00","to":"22:00",'
-                f'"days":"mon-fri","eur_per_kwh":0.34}}, ...]}}\n'
-                f"Leave it empty for a dynamic-only or price-free site.")
+                f"{messages.not_valid(option, e)}. Copy the example from the "
+                f"documentation, or leave it empty if you have no fixed "
+                f"tariff.")
 
     if isinstance(value, dict):
         tz = str(value.get("timezone", "") or "").strip().lower()
         if tz not in SUPPORTED_TZ:
             raise ProfileInvalid(
                 f"{option}.timezone is {value.get('timezone')!r}. Only "
-                f"Europe/Brussels is supported: the shipped image carries no tz "
-                f"database (see app/price.py), so any other zone could not be "
-                f"honoured and would be silently treated as Brussels - which is "
-                f"wrong by an hour for part of the year.")
+                f"Europe/Brussels is supported.")
         rows = value.get("periods")
         if rows is None:
             raise ProfileInvalid(
-                f"{option} has no \"periods\" list. Even a fully-fixed "
-                f"tariff is written as one period covering 00:00-24:00 all days "
-                f"- one shape for both products, so nothing downstream branches "
-                f"on which kind of site this is.")
+                f"{option} has no \"periods\" list. A fixed price is one "
+                f"period from 00:00 to 24:00 on all days.")
     else:
         rows = value
 
@@ -1137,18 +1119,39 @@ class TariffPlan:
         for 76 % of a 40-hour soak and mixed 900/3600 s for 70 %, and no HTTP
         surface said either.
         """
+        # UX-08: plain words, every figure in its own slot as before.
         if not self.has_prices:
-            return f"no tariff - {self.read.reason}"
-        tag = {"provider": self.read.provider, "static": "static_profile",
-               "fallback": "static_profile (feed down)"}.get(self.origin,
-                                                             self.origin)
+            return f"no prices, {self.read.reason}"
+        tag = {"provider": "the price feed", "static": "your fixed tariff",
+               "fallback": "your fixed tariff, because the feed is down"}.get(
+                   self.origin, self.origin)
+        what = {PriceProduct.DAY_AHEAD: "day-ahead prices",
+                PriceProduct.REALTIME: "real-time prices",
+                PriceProduct.STATIC: "day/night prices",
+                PriceProduct.FIXED: "a fixed price"}.get(self.product,
+                                                         str(self.product))
+        # UX-10: the spacing in words, and no "not final yet": a plan is
+        # provisional exactly when it holds an estimated price, which the
+        # count already says.
         gaps = self.spacings_s
-        return (f"{self.product.value} from {tag}, "
-                f"{self.n_points} points over {self.hours} h, "
-                f"{self.n_firm} firm / {self.n_carried} carried"
-                + (f", {'+'.join(str(g) for g in gaps)} s spacing"
-                   if gaps else "")
-                + (", provisional" if self.provisional else ""))
+        return (f"{what} from {tag}, "
+                f"{self.n_points} prices over {self.hours} hours, "
+                f"{self.n_firm} published and {self.n_carried} estimated"
+                + (f", {spacing_words(gaps)}" if gaps else ""))
+
+
+def spacing_words(gaps) -> str:
+    """`(900, 3600)` -> `one every 15 minutes or every hour`."""
+    def one(s):
+        s = int(s)
+        if s == 3600:
+            return "every hour"
+        if s % 3600 == 0:
+            return f"every {s // 3600} hours"
+        if s % 60 == 0:
+            return f"every {s // 60} minutes"
+        return f"every {s} seconds"
+    return "one " + " or ".join(one(g) for g in gaps)
 
 
 def _whole_hours(points) -> int:
@@ -1218,9 +1221,9 @@ def static_plan(opts: dict, since: datetime, until: datetime, *,
     if profile is None:
         return TariffPlan(
             PriceRead.no_data(
-                "no static_profile configured; §11.4: plan provisional, no "
-                "arbitrage. Self-consumption, peak shaving and reserve "
-                "management are unaffected"),
+                "no fixed tariff is set, so the plan is estimated and there "
+                "is no trading. Self-consumption, peak limiting and the "
+                "reserve are not affected"),
             None, "none")
     points = profile.series(since, until, provisional=provisional)
     return TariffPlan(
@@ -1242,21 +1245,22 @@ def static_status(opts: dict, now: datetime):
         plan = static_plan(opts, now, now + timedelta(days=MEAN_WINDOW_DAYS),
                            now=now)
     except ProfileInvalid as e:
-        _LOG.warning("static_profile is unusable (%s); no cheap window. This "
-                     "should have been refused at startup - see validate.py", e)
-        return False, f"static_profile unusable: {e}"
+        _LOG.warning("static_profile cannot be used (%s), so there is no "
+                     "cheap window. The start-up check should have refused "
+                     "it.", e)
+        return False, f"Fixed tariff cannot be used: {e}"
     if not plan.has_prices:
-        return False, "no static profile"
+        return False, "No fixed tariff set"
     cheap = plan.cheap_now(now)
     window = plan.window_at(now)
     price = plan.price_at(now)
     when = plan.profile.next_change(now)
     until = "" if when is None else f" until {brussels(when):%H:%M}"
-    kind = ("fixed" if plan.product is PriceProduct.FIXED else "day/night")
-    return cheap, (f"{kind}: {window}{until} at {price:.4f} EUR/kWh, "
-                   f"mean {plan.mean_eur_kwh():.4f} over "
-                   f"{MEAN_WINDOW_DAYS} d - "
-                   f"{'CHEAP window' if cheap else 'not a cheap window'}")
+    kind = ("Fixed" if plan.product is PriceProduct.FIXED else "Day/night")
+    return cheap, (f"{kind} tariff, {window}{until}: {price:.4f} EUR/kWh, "
+                   f"{'cheap' if cheap else 'not cheap'} against the "
+                   f"{MEAN_WINDOW_DAYS}-day average of "
+                   f"{plan.mean_eur_kwh():.4f}")
 
 
 async def resolve_tariff(opts: dict, since: datetime, until: datetime,
@@ -1349,17 +1353,18 @@ def _degrade(opts, read, since, until, stamp) -> TariffPlan:
     try:
         profile = parse_static_profile(price_option(opts, "static_profile"))
     except ProfileInvalid as e:
-        _LOG.warning("the price feed is down AND static_profile is unusable "
-                     "(%s), so there is no tariff at all", e)
+        _LOG.warning("The price feed is down and the fixed tariff "
+                     "(static_profile) cannot be used either (%s), so there is "
+                     "no tariff at all.", e)
         profile = None
     if profile is None:
-        _LOG.warning("§11.4: %s, and no static_profile is configured to fall "
-                     "back to. The plan is provisional and arbitrage is off; "
-                     "self-consumption, peak shaving and reserve management "
-                     "continue (§6, §10.1).", read.reason)
+        _LOG.warning("The price feed failed and no fixed tariff is set, so "
+                     "trading is off, while peak limiting and home use go on. "
+                     "%s.", read.reason)
         return TariffPlan(read, None, "none")
-    _LOG.warning("§11.4: %s - falling back to the static profile, plan marked "
-                 "PROVISIONAL, arbitrage off.", read.reason)
+    _LOG.warning("The price feed failed, so the fixed tariff is used "
+                 "instead, marked as estimated, and trading is off. %s.",
+                 read.reason)
     points = profile.series(since, until, provisional=True)
     return TariffPlan(
         PriceRead.series(points, profile.product, "static_profile", stamp),
diff --git a/goodwe_controller/app/store.py b/goodwe_controller/app/store.py
index 90ecbd4..c716fd6 100644
--- a/goodwe_controller/app/store.py
+++ b/goodwe_controller/app/store.py
@@ -222,6 +222,8 @@ class MigrationReport:
         self.misdirected = []
         # Why nothing ran, when nothing ran. Empty means "already at schema".
         self.skipped = ""
+        # The inverter list the moves were graded against, for `explain()`.
+        self.roster = []
 
     @property
     def ok(self) -> bool:
@@ -237,19 +239,27 @@ class MigrationReport:
             # the flat keys ARE its namespace - and an operator reading the
             # startup log needs to be told which, because only one of them
             # changes when a second inverter is declared.
-            return self.skipped or (f"store already at schema "
-                                    f"{self.from_version}; no "
-                                    f"per-inverter migration needed")
-        out = (f"migrated {len(self.moved)} flat key(s) to inverter "
-               f"namespaces: " + ", ".join(sorted(self.moved)))
+            return self.skipped or (f"the saved state is already at version "
+                                    f"{self.from_version}, so nothing moves")
+        # UX-10: plain sentences (test_messages.py part 6). Each problem is
+        # named by its key and what went wrong, and `problems`, `lost` and
+        # `misdirected` keep their full notes for the checks that read them.
+        n = len(self.moved)
+        out = (f"moved {n} saved {'value' if n == 1 else 'values'} to one part "
+               f"per inverter: " + ", ".join(sorted(self.moved)) if n
+               else "moved nothing")
         if self.kept:
-            out += " (left alone, already namespaced: " + ", ".join(sorted(self.kept)) + ")"
-        if self.problems:
-            out += " - PROBLEMS: " + "; ".join(self.problems)
-        if self.lost:
-            out += " - STATE LOST: " + "; ".join(self.lost)
-        if self.misdirected:
-            out += " - WRONG NAMESPACE: " + "; ".join(self.misdirected)
+            out += ". Already in place: " + ", ".join(sorted(self.kept))
+        def keys(notes):
+            return ", ".join(note.split(" ", 1)[0] for note in notes)
+        other = [n for n in self.problems
+                 if n not in self.lost and n not in self.misdirected]
+        parts = ([f"lost {keys(self.lost)}"] if self.lost else []) + (
+            [f"moved under an inverter not in the list {self.roster!r}: "
+             f"{keys(self.misdirected)}"] if self.misdirected else []) + (
+            [f"read back differently {keys(other)}"] if other else [])
+        if parts:
+            out += ". Problems: " + ", and ".join(parts)
         return out
 
 
@@ -328,8 +338,8 @@ def migrate_unit_keys(store, unit: str, roster=None) -> MigrationReport:
         # ⚠️ NOT MARKED DONE. A migration that lost state must run again on the
         # next start rather than be recorded as finished - the one thing worse
         # than a failed migration is a failed migration a later version skips.
-        _LOG.error("per-inverter store migration LOST STATE and has not been "
-                   "marked done: %s", rep.explain())
+        _LOG.error("Moving the saved state to one part per inverter lost "
+                   "data, so it is not marked done: %s", rep.explain())
     return rep
 
 
@@ -436,6 +446,7 @@ def _verify_moves(store, rep: MigrationReport, roster=None) -> None:
     if roster is None:
         return
     names = [str(n) for n in roster]
+    rep.roster = names
     # `unit_key()` builds `unit/<unit>/<key>`, so the unit is field 1. Split
     # through the same spelling the writer used rather than re-deriving it.
     #
@@ -469,8 +480,8 @@ def _verify_moves(store, rep: MigrationReport, roster=None) -> None:
         if unit in names:
             continue
         rep.verified = False
-        note = (f"{target} was migrated into namespace {unit!r}, which is NOT "
-                f"on the roster {names!r} - nothing reads that key")
+        note = (f"{target} was moved under {unit!r}, which is not in the "
+                f"inverter list {names!r}, so nothing reads it")
         rep.problems.append(note)
         rep.misdirected.append(note)
 
@@ -536,14 +547,12 @@ def migrate_maint_keys(store, unit: str, roster) -> MigrationReport:
     names = [str(n) for n in roster]
     rep.from_version = int(data.get(MAINT_SCHEMA_KEY, 0) or 0)
     if len(names) <= 1:
-        rep.skipped = ("one inverter: the flat maintenance keys ARE that pack's "
-                       "history and are read in place, so there is nothing to "
-                       "move and the store layout does not change")
+        rep.skipped = ("one inverter, so it is read where it is and nothing "
+                       "moves")
         return rep
     if rep.from_version >= MAINT_SCHEMA_VERSION:
-        rep.skipped = (f"maintenance history already at schema "
-                       f"{rep.from_version}; written by a multi-inverter "
-                       f"version and not touched")
+        rep.skipped = (f"already at version {rep.from_version}, written for "
+                       f"several inverters, so it is left as it is")
         return rep
 
     rep.ran = True
@@ -567,15 +576,21 @@ def migrate_maint_keys(store, unit: str, roster) -> MigrationReport:
         # the re-run a no-op where the keys did land, so refusing the marker
         # costs one repeated pass and buys the difference between a migration
         # that can still be fixed and one the store says already happened.
-        _LOG.error("per-pack maintenance-history migration did NOT land and "
-                   "has not been marked done: %s", rep.explain())
+        _LOG.error("Moving the maintenance history to one part per inverter "
+                   "did not work, so it is not marked done: %s", rep.explain())
     return rep
 
 
+STATE_PATH = "/data/state.json"
+
+
 class Store:
-    def __init__(self, path: str = "/data/state.json"):
-        self.path = path
+    def __init__(self, path: str | None = None):
+        self.path = path or STATE_PATH
         self.data = dict(DEFAULTS)
+        # UX-13 P4: True when this boot found no state file, i.e. a new /data.
+        # Only the setup wizard's first-run rule reads it (uipage.setup_needed).
+        self.fresh = False
         self.load()
 
     def load(self) -> None:
@@ -589,6 +604,7 @@ class Store:
                           self.data.get("phase"), self.data.get("last_completed"),
                           self.data.get("sign_tripped"))
         except FileNotFoundError:
+            self.fresh = True
             _LOG.info("no saved state, starting fresh")
         except (json.JSONDecodeError, OSError) as err:
             # A corrupt state file must not stop the controller: losing the
diff --git a/goodwe_controller/app/tariff.py b/goodwe_controller/app/tariff.py
index ee7283f..f0463e0 100644
--- a/goodwe_controller/app/tariff.py
+++ b/goodwe_controller/app/tariff.py
@@ -114,6 +114,8 @@ import sqlite3
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone, tzinfo
 
+from . import messages
+
 _LOG = logging.getLogger("goodwe.tariff")
 
 QUARTER_S = 900
@@ -339,8 +341,8 @@ class PeakStore:
             # INFO, not ERROR: on a dev host or in a test container there is no
             # /data and nothing is wrong. A store that OPENED and then broke is
             # the error case, and it is logged as one below.
-            _LOG.info("no peak store: %s - the monthly peak will read "
-                      "NOT_OBSERVED", self.last_error)
+            _LOG.info("No peak store (%s), so the month peak cannot be read "
+                      "and only the peak limit is used.", self.last_error)
             return
         try:
             self._db = sqlite3.connect(self.path, timeout=5.0,
@@ -360,8 +362,9 @@ class PeakStore:
             # fault must not stop a controller that is regulating a battery. The
             # cost of continuing is a peak that reads NOT_OBSERVED, and every
             # reader is built to treat that as "do not use me", not as 0 W.
-            _LOG.error("peak store unusable at %s (%s) - the monthly peak will "
-                       "read NOT_OBSERVED, which is not a zero peak", self.path, err)
+            _LOG.error("The peak store at %s cannot be used (%s), so only the "
+                       "peak limit is used. The month peak is unknown, not "
+                       "zero.", self.path, err)
 
     def close(self) -> None:
         if self._db is not None:
@@ -672,12 +675,12 @@ class PeakTracker:
         now = now or datetime.now(timezone.utc)
         snap = self.store.load_partial()
         if not snap:
-            self.restore_state = ("fresh: no checkpoint" if self.store.ok
-                                  else "fresh: store unreadable")
+            self.restore_state = ("fresh start, nothing saved" if self.store.ok
+                                  else "fresh start, the store cannot be read")
             return self.restore_state
         block = snap.get("block")
         if block is None:
-            self.restore_state = "fresh: checkpoint had no open block"
+            self.restore_state = "fresh start, no open 15-minute period saved"
             return self.restore_state
 
         current = int(now.timestamp() // QUARTER_S) * QUARTER_S
@@ -686,11 +689,13 @@ class PeakTracker:
                 # A reshaped accumulator (meter_phases changed) is a different
                 # measurement, not a resumable one. Say so; do not half-resume.
                 self.store.clear_partial()
-                self.restore_state = "fresh: checkpoint does not fit this averager"
+                self.restore_state = ("fresh start, the saved period does not "
+                                      "fit the number of phases")
                 return self.restore_state
             self.restore_state = (
-                f"resumed the open block at {snap.get('elapsed', 0.0):.0f} s "
-                f"of {QUARTER_S} s ({snap.get('acc', 0.0) / QUARTER_S:.0f} W banked)")
+                f"resumed the open 15-minute period at "
+                f"{snap.get('elapsed', 0.0):.0f} s of {QUARTER_S} s, with "
+                f"{snap.get('acc', 0.0) / QUARTER_S:.0f} W counted so far")
             return self.restore_state
 
         # The block ended while the add-on was down. Its measured part really
@@ -704,10 +709,14 @@ class PeakTracker:
                                      if snap.get("pp_acc") and snap.get("last_pp") else None))
         banked = self.store.record_block(closed, self.policy)
         self.store.clear_partial()
+        # UX-10: plain words and the local time, not ISO and "banked".
         self.restore_state = (
-            f"closed a stale block from {closed.start.isoformat()} at "
-            f"{closed.offtake_avg_w:.0f} W (partial coverage), "
-            + ("banked" if banked else "NOT banked - store unwritable"))
+            f"closed the 15-minute period from "
+            f"{messages.when(closed.start.astimezone(BILLING_TZ))} at "
+            f"{closed.offtake_avg_w:.0f} W, partly measured, "
+            + ("and saved it" if banked
+               else "but could not save it, because the store cannot be "
+                    "written"))
         return self.restore_state
 
     # -- steady state -------------------------------------------------------
diff --git a/goodwe_controller/app/ui_text/en.json b/goodwe_controller/app/ui_text/en.json
new file mode 100644
index 0000000..5dc051e
--- /dev/null
+++ b/goodwe_controller/app/ui_text/en.json
@@ -0,0 +1,455 @@
+{
+  "groups": {
+    "meter": {"name": "Meter", "description": "Where the grid reading comes from."},
+    "inverters": {"name": "Inverters and batteries", "description": "The inverters the add-on controls, and your solar."},
+    "tariff": {"name": "Tariff and prices", "description": "What you pay and are paid per kWh."},
+    "safety": {"name": "Safety limits", "description": "The peak limit, starting and stopping, and the safety stops."},
+    "maintenance": {"name": "Maintenance", "description": "The monthly battery cycle and the log."},
+    "tuning": {"name": "Control tuning", "description": "For support only, because these were measured on real hardware."}
+  },
+  "parts": {
+    "meter.timing": {"name": "Timing"},
+    "inverters.solar": {"name": "Solar"},
+    "inverters.modes": {"name": "Battery modes"},
+    "tariff.selling": {"name": "Charging and selling on price"},
+    "tariff.feed": {"name": "Price feed details"},
+    "safety.peak": {"name": "Peak limit", "description": "The add-on aims a little below your limit, to be safe."},
+    "safety.start": {"name": "Starting and stopping"},
+    "safety.stops": {"name": "Safety stops", "description": "Measured on real hardware, so leave them unchanged."},
+    "maintenance.support": {"name": "Support"}
+  },
+  "fields": {
+    "solar": {"name": "Solar inverters", "description": "Each solar inverter's power sensor, which the add-on records but does not use for control."},
+    "contract": {"name": "Your contract", "description": "How your supplier prices each kWh you take from the grid."},
+    "region": {"name": "Region", "description": "Fills in grid costs, levies and VAT for the year shown, but not yet for Wallonia or Brussels, so check your bill."},
+    "fallback": {"name": "Price when the feed is down", "description": "Used when the price source does not answer."},
+    "fixed_price": {"name": "Price per kWh, all in", "description": "Energy, supplier costs, grid costs, levies and VAT together."},
+    "day_price": {"name": "Day price, weekdays 07:00 to 22:00", "description": "All in, as on your bill."},
+    "night_price": {"name": "Night and weekend price", "description": "All in, as on your bill."},
+    "periods": {"name": "Time windows and prices", "description": "One price per kWh for each time window, all in, as on your bill."}
+  },
+  "choices": {
+    "contract": {"none": "No prices", "fixed": "Fixed price", "daynight": "Day and night", "dynamic": "Dynamic, hourly", "custom": "Other time windows"},
+    "fallback": {"none": "None", "fixed": "One price", "daynight": "Day and night", "custom": "Other time windows"},
+    "region": {"flanders": "Flanders, Fluvius Antwerpen", "own": "I enter my own figure"},
+    "meter_source": {"off": "One grid power entity", "ha_dsmr": "Import and export entities", "mqtt_p1": "Meter over MQTT", "ha_signed": "One net power entity", "homewizard_local": "HomeWizard meter on the network"},
+    "meter_phases": {"1": "1 phase", "3": "3 phases"},
+    "shadow_mode": {"auto": "Automatic", "on": "Always on", "off": "Off"},
+    "price_provider": {"generic_dayahead": "Day-ahead market price", "custom_formula": "Your own price formula", "manual_csv": "A price file"},
+    "log_level": {"trace": "Everything, for support", "debug": "Detailed, to find a problem", "info": "Normal", "warning": "Warnings and errors", "error": "Errors only"},
+    "period_days": {"mon-sun": "Every day", "mon-fri": "Monday to Friday", "sat,sun": "Saturday and Sunday", "mon": "Monday", "tue": "Tuesday", "wed": "Wednesday", "thu": "Thursday", "fri": "Friday", "sat": "Saturday", "sun": "Sunday"}
+  },
+  "applies": {
+    "restart": {"name": "Applies after a restart"},
+    "now": {"name": "Applies right away"}
+  },
+  "home": {
+    "app": {"name": "Battery add-on"},
+    "tabs": {"home": "Home", "batteries": "Batteries", "settings": "Settings", "setup": "Setup", "label": "Screens"},
+    "now": {"name": "Now", "description": "Updated every 3 seconds.", "solar": "Solar", "house": "House", "grid": "Grid", "batteries": "Batteries"},
+    "plan": {
+      "name": "Today's plan",
+      "description": "Point at a bar or a block for details, or tap it on a phone.",
+      "cheap": "Low price",
+      "dear": "High price",
+      "estimate": "Estimate",
+      "grid": "Charges from the grid",
+      "give": "Gives power",
+      "cycle": "Monthly battery cycle",
+      "peak": "Peak limit",
+      "house": "Follows the house",
+      "now": "now",
+      "time_to": "to",
+      "per_kwh": "per kWh",
+      "cheap_tip": "low for today",
+      "dear_tip": "high for today",
+      "estimate_tip": "estimate from yesterday",
+      "none_tip": "No price known",
+      "no_prices": {"description": "No prices for today, so the chart shows only the plan."},
+      "list": "The plan in words",
+      "average_tip": "hour average"
+    },
+    "peak": {"name": "Peak limit", "this_month": "This month's peak", "limit": "Limit", "none": "None recorded yet", "unreadable": "Cannot be read now"},
+    "attention": {"name": "Needs attention", "nothing": "Nothing to look at", "to_look": "to look at", "details": "Details", "alarm": "Alarm", "warning": "Warning", "info": "Info"},
+    "control": {"name": "Control", "stop": "Stop control", "start": "Start control", "maint_start": "Start a battery cycle now", "maint_abort": "Stop the battery cycle", "docs": "Add-on documentation", "more": "More actions"},
+    "details": {"name": "Details for installers", "rows": "Status rows", "checks": "Checks", "event": "Last event"},
+    "dialog": {
+      "cancel": "Cancel",
+      "stop": {"name": "Stop control?", "description": "Every inverter is set to 0 W until you start control again.", "yes": "Stop control"},
+      "start": {"name": "Start control?", "description": "The add-on controls the batteries again and clears any safety stop.", "yes": "Start control"},
+      "maint_start": {"name": "Start a battery cycle?", "description": "The battery empties, refills and holds full, which takes a few hours.", "yes": "Start the cycle"},
+      "maint_abort": {"name": "Stop the battery cycle?", "description": "Every inverter is set to 0 W for a moment, then control carries on.", "yes": "Stop the cycle"}
+    },
+    "toast": {"started": "Control started.", "stopped": "Control stopped.", "done": "Done.", "failed": "That did not work. Try again."},
+    "offline": {"name": "Cannot reach the add-on", "description": "The page tries again every 3 seconds."},
+    "setup_only": {"name": "Setup: nothing is controlled yet", "description": "Nothing is sent to any inverter until setup is saved and the add-on restarts.", "control": "Control starts after setup.", "open": "Open Setup"},
+    "batteries": {"name": "Batteries", "description": "To choose a mode for each battery, turn on battery modes in the settings.", "level": "Level", "now": "Now", "stored": "Stored", "mode": "Mode", "settings": "Change inverter settings",
+      "on": "On", "off": "Off",
+      "choice": {
+        "solar_first": {"name": "Solar first", "description": "Charges from solar before the other batteries and covers the house."},
+        "leftover_solar": {"name": "Leftover solar", "description": "Gets solar the others cannot take, and gives power in expensive hours."},
+        "cheap_hours": {"name": "Cheap hours only", "description": "Charges in the cheapest hours and gives power in the expensive ones."},
+        "off": {"name": "Off", "description": "Rests, and helps only when the peak limit needs it."}
+      },
+      "today": "Today", "why": "Why",
+      "modes_off": {"name": "Battery modes are off"},
+      "how": {"name": "How the modes work", "description": "Which battery gets solar first, and when each gives power.",
+        "solar_first": {"description": "Solar first gets spare solar before the other batteries, and covers the house at any hour."},
+        "leftover_solar": {"description": "Leftover solar gets the solar the Solar first batteries cannot take, and saves its power for expensive hours."},
+        "cheap_hours": {"description": "Cheap hours only charges in the cheapest hours and gives power in the expensive ones."},
+        "off": {"description": "Off rests the battery and starts no monthly cycle, but the peak limit may still use it."},
+        "rules": {"description": "The peak limit and the safety stops come first, and while one battery charges from the grid the others rest."}},
+      "toast": {"on": "{name} is on.", "off": "{name} is off.", "mode": "{name}: {mode}."}},
+    "settings": {"name": "Settings", "description": "The settings are grouped by task below.", "open": "Open the settings page"}
+  },
+  "choices_later": {
+    "region": {"wallonia": "Wallonia, no preset yet", "brussels": "Brussels, no preset yet"}
+  },
+  "choice_help": {
+    "meter_source": {
+      "off": {"description": "A Home Assistant entity that reads grid power in W, positive when you take from the grid."},
+      "ha_dsmr": {"description": "Two Home Assistant entities from the DSMR integration, one for import and one for export."},
+      "mqtt_p1": {"description": "The meter's readings arrive over MQTT on a topic you name."},
+      "ha_signed": {"description": "One Home Assistant entity that reads net grid power, positive for import."},
+      "homewizard_local": {"description": "The add-on reads a HomeWizard meter on your network, and can spot a stuck meter."}
+    }
+  },
+  "settings": {
+    "name": "Settings",
+    "description": "Every setting, grouped by task.",
+    "view": {"name": "Settings view", "simple": "Simple", "installer": "Installer"},
+    "simple": {"description": "The choices a home owner makes.",
+      "note": {"month_peak": {"description": "This month's peak so far: {kw}."}, "shadow": {"description": "Use Always on while you test a new installation."}, "forecast": {"description": "With a forecast, a battery buys only what the sun will not give."}},
+      "batteries": {"name": "Batteries"},
+      "more": {"description": "Looking for the meter, inverters or prices?"},
+      "installer": "Open the installer view"},
+    "classic": "Classic settings",
+    "search": {"name": "Find a setting", "description": "Find a setting, for example peak or meter."},
+    "no_match": {"description": "No setting matches your search."},
+    "loading": "Loading the settings",
+    "load_failed": {"name": "Cannot read the settings", "description": "The add-on could not read its stored settings, so use Classic settings or the Configuration tab."},
+    "footer": {"description": "Every change is checked by the add-on's own start checks before it is saved."},
+    "to_fix": "to fix",
+    "to_check": "to check",
+    "changed": "changed",
+    "on": "On",
+    "off": "Off",
+    "not_set": "Not set",
+    "locked": "Locked",
+    "change": "Change",
+    "support": {"description": "These were measured on real hardware, so change them only when support asks."},
+    "picker": {
+      "choose": "Choose an entity",
+      "search": {"description": "Search by name or entity id."},
+      "all": "Show every entity",
+      "use": "Use this entity id",
+      "clear": "Clear",
+      "missing": "Not in Home Assistant",
+      "none": {"description": "Nothing matches, so check the entity in Developer Tools."}
+    },
+    "add_inverter": "Add an inverter",
+    "inverter": "Inverter",
+    "remove": "Remove",
+    "add_row": "Add a row",
+    "add_solar": "Add a solar inverter",
+    "periods": {"window": "Window", "from": "From", "to": "To", "days": "Days", "price": "Price", "add": "Add a time window"},
+    "reversed": "Reads negative",
+    "phase": "Phase",
+    "raw_roster": {"description": "This inverter list can only be changed in the Configuration tab."},
+    "region_year": "{year} figures",
+    "hour": "{hour}:00 UTC",
+    "preset": {"description": "Filled in by the region above, so choose your own figure to change it."},
+    "cycle": {"name": "Run a cycle by hand", "description": "The same actions as on Home, each asking first."},
+    "savebar": {"label": "Unsaved changes", "one": "change not saved", "many": "changes not saved", "discard": "Discard", "save": "Save", "saving": "Saving"},
+    "saved": {"name": "Saved, not running yet", "description": "The add-on runs the settings it started with until you restart it."},
+    "differs": {"name": "Stored settings are not running", "description": "Some stored settings differ from what runs now, so restart the add-on to apply them."},
+    "stale": {"name": "Changed somewhere else", "description": "These settings changed elsewhere while you edited, so save again to keep yours or discard to load theirs."},
+    "other": "Other messages",
+    "restart": "Restart now",
+    "dialog": {"name": "Restart the add-on?", "description": "Every inverter is set to 0 W while the add-on restarts, and then the new settings apply.", "yes": "Restart now"},
+    "toast": {
+      "saved": "Saved. Restart to apply.",
+      "discarded": "Changes discarded.",
+      "failed": "That did not work. Try again.",
+      "blocked": {"description": "Fix the settings marked in red, then save again."},
+      "restarting": {"description": "Restart requested, so this page stops answering for a moment."}
+    },
+    "tier": {"bad": "Must fix", "warn": "Check this", "info": "Note", "ok": "Passed"},
+    "derive": {
+      "raw_roster": {"description": "This inverter list can only be changed in the Configuration tab."},
+      "no_inverter": {"description": "Add at least one inverter."},
+      "flat_named": {"description": "Add a second inverter before naming this one."},
+      "no_source": {"description": "Choose where the dynamic prices come from."},
+      "custom_profile": {"description": "Other time windows can only be changed in the Configuration tab."},
+      "no_price": {"description": "Enter a price per kWh."},
+      "no_periods": {"description": "Add at least one time window."},
+      "period_time": {"description": "Window {row}: write each time as hours and minutes, like 07:00 or 24:00."},
+      "period_zero": {"description": "Window {row} starts and ends at the same time, so change one of them."},
+      "period_price": {"description": "Window {row}: enter a price per kWh."},
+      "period_price_range": {"description": "Window {row}: enter the price in euro per kWh, like 0.34."},
+      "period_overlap": {"description": "Windows {a} and {b} both cover {day} {from} to {to}, so change one of them."},
+      "period_gap": {"description": "No window covers {day} {from} to {to}, so add one or widen one."},
+      "unknown": {"description": "The page cannot store this choice, so reload the page."}
+    },
+    "setup": {
+      "name": "Setup",
+      "description": "For installers: six steps to a working site, and each can be changed later under Settings.",
+      "done_before": {"description": "This site is set up already, so a change here replaces its stored settings."},
+      "step": "Step {n} of {total}",
+      "back": "Back",
+      "next": "Next",
+      "skip": "Next, or skip",
+      "finish": "Save and restart",
+      "not_now": "Not now",
+      "steps": {
+        "1": {"name": "Your meter", "description": "The add-on steers the grid reading to zero, so it needs your meter first."},
+        "2": {"name": "Inverters and batteries", "description": "One card for each inverter with a battery, with its entities in Home Assistant."},
+        "3": {"name": "Solar", "description": "Optional, so skip this step if the add-on should not record solar production."},
+        "4": {"name": "Prices", "description": "What you pay per kWh, so the batteries can charge when power is cheap."},
+        "5": {"name": "Peak limit", "description": "The grid stays under this limit, averaged over each 15-minute period."},
+        "6": {"name": "Check and start", "description": "The add-on checks everything with its own start checks, then restarts."}
+      },
+      "modes_later": {"description": "After setup, turn on battery modes to choose a mode for each battery on the Batteries screen."},
+      "kettle": {
+        "name": "Check the direction",
+        "description": "Read the meter, switch on a kettle, then read the meter again.",
+        "read": "Read the meter",
+        "again": "Read again",
+        "skip": "Skip this test",
+        "before": {"description": "The meter reads {w} now, so switch on a kettle and press Read again."},
+        "unread": {"description": "The meter cannot be read now, so check the entity and try again."},
+        "none": {"description": "The reading moved only {d}, so switch the kettle on and read again."},
+        "ok": {"description": "Good, the reading went up by {d} when the kettle came on."},
+        "flip": {"description": "The reading went down by {d}, so the add-on flips its sign for you."},
+        "wrong_signed": {"description": "The reading went down by {d}, so choose “One grid power entity” above, which can flip it."},
+        "wrong_dsmr": {"description": "The reading went down by {d}, so check that import and export are not swapped."},
+        "self": {"description": "The add-on reads this meter itself, so Home shows its direction after the restart."},
+        "skipped": {"description": "The meter direction is not tested, so check it on Home after the restart."},
+        "skipped_wrong": {"description": "The kettle test saw the meter reading go down, so check its direction in step 1 before you start control."},
+        "skipped_down": {"description": "The reading went down when the kettle came on, so check the meter's direction before you start control."},
+        "tested": {"description": "The meter direction was tested with a kettle."},
+        "needed": {"description": "Do the kettle test first, or skip it."}
+      },
+      "check": {
+        "name": "What the add-on checked",
+        "running": {"description": "Checking with the add-on's own start checks."},
+        "pass": {"description": "The add-on's start checks pass."},
+        "failed": {"description": "The check did not run, so try again."},
+        "again": "Check again",
+        "blocked": {"description": "Fix the items marked in red, then check again."}
+      },
+      "dialog": {"name": "Save and restart?", "description": "Every inverter is set to 0 W while the add-on restarts, and shadow mode keeps them at 0 W after that.", "yes": "Save and restart"},
+      "dialog_live": {"name": "Save and restart?", "description": "Every inverter is set to 0 W while the add-on restarts, and then the new settings apply.", "yes": "Save and restart"},
+      "dialog_setup": {"name": "Save and restart?", "description": "The add-on restarts with these settings, and shadow mode keeps every inverter at 0 W.", "yes": "Save and restart"},
+      "dialog_setup_live": {"name": "Save and restart?", "description": "The add-on restarts with these settings, and then they apply.", "yes": "Save and restart"},
+      "done": {"name": "Setup is done", "description": "The add-on restarts in shadow mode now, so open Home in a minute to see what it would do."},
+      "done_live": {"name": "Setup is done", "description": "The add-on restarts now, so open Home in a minute to start control."},
+      "restart_failed": {"name": "Saved, not running yet", "description": "The restart did not go through, so press Restart now to apply the settings."},
+      "home": "Open Home"
+    }
+  },
+  "home_words": {
+    "mode_house": "Follows the house",
+    "modes": {"solar_first": "Solar first", "leftover_solar": "Leftover solar", "cheap_hours": "Cheap hours only", "off": "Off"},
+    "attn_shadow": "Shadow mode is on",
+    "attn_shadow_body": "The add-on decides everything, but every inverter stays at 0 W.",
+    "zero_held": "Held at 0 W",
+    "zero_going": "Going to 0 W",
+    "verdict": {
+      "held": "Held at 0 W",
+      "stopped": "Stopped",
+      "cycle": "Monthly cycle today",
+      "trade": "Trading on price",
+      "house": "Follows the house"
+    },
+    "pill": {
+      "running": "Running",
+      "shadow": "Shadow mode",
+      "stopped": "Stopped",
+      "alarm": "Needs you now",
+      "warning": "Running, with a warning"
+    },
+    "banner_sub": {
+      "running": "The batteries follow the plan below.",
+      "shadow": "The plans below say what the add-on would do.",
+      "stopped": "Start control below when you are ready.",
+      "alarm": "See Needs attention below for what to do.",
+      "warning": "See Needs attention below."
+    },
+    "tile": {
+      "not_set_up": "Not set up",
+      "no_reading": "No reading",
+      "producing": "Producing",
+      "not_producing": "Not producing",
+      "needs_solar": "Needs a solar reading",
+      "not_adding_up": "Readings do not add up",
+      "using": "Using",
+      "taking": "Taking from the grid",
+      "feeding": "Feeding in",
+      "balanced": "Balanced",
+      "giving": "Giving power",
+      "charging": "Charging",
+      "resting": "Resting"
+    },
+    "now": {
+      "no_reading": "No reading from this battery.",
+      "would_rest": "{zero}. Would rest now.",
+      "would_give": "{zero}. Would give {kw} now.",
+      "would_charge": "{zero}. Would charge {kw} now.",
+      "held": "{zero} until the alarm clears.",
+      "stopped": "{zero} while control is stopped.",
+      "cycle_drain": "Monthly cycle: emptying.",
+      "cycle_charge": "Monthly cycle: refilling.",
+      "cycle_hold": "Monthly cycle: holding full.",
+      "cycle": "Monthly cycle under way.",
+      "giving": "Giving {kw} now.",
+      "charging": "Charging {kw} now.",
+      "resting": "Resting now.",
+      "off_resting": "Off. Resting now.",
+      "off_peak": "Off, but gives {kw} for the peak limit.",
+      "off_going": "Off. Still at {kw}, going to 0 W."
+    },
+    "why": {
+      "no_reading": "No reading, so the add-on cannot tell.",
+      "held": "An alarm stopped control. See Needs attention.",
+      "stopped": "Control is stopped.",
+      "shadow": "Shadow mode: the add-on only shows what it would do.",
+      "cycle": "The monthly cycle keeps its level reading right.",
+      "cycle_mode": "The monthly cycle comes first. Its mode resumes after.",
+      "off": "You switched it off.",
+      "off_peak": "The peak limit comes before Off. It rests again after.",
+      "refuses_give": "The battery refuses to give power. The add-on tries again every 15 minutes.",
+      "refuses_charge": "The battery refuses to charge. The add-on tries again every 15 minutes.",
+      "peak": "The peak limit needs power from the batteries.",
+      "modes_off": "Battery modes are off, so it follows the house.",
+      "solar_first": "Solar first: it gets spare solar before the others.",
+      "leftover": "It gets the solar that Solar first batteries cannot take.",
+      "leftover_alone": "No Solar first battery is on, so it gets solar first.",
+      "covers_house": "It gives power to cover the house.",
+      "other_refuses": "{name} refuses to give power, so this battery takes over.",
+      "other_cycle": "{name} is emptying for its monthly cycle. This one does not charge.",
+      "grid_charge": "Prices are low, so it charges from the grid.",
+      "rests_charge": "Another battery charges from the grid, so it rests.",
+      "selling": "Prices are high, so it sells to the grid.",
+      "expensive": "Prices are high, so it covers the house.",
+      "saves": "Saves its power for {at}.",
+      "saves_later": "Saves its power for higher prices.",
+      "no_prices": "No prices, so it follows the house.",
+      "no_spread": "Prices differ too little, so it follows the house.",
+      "sun_fills": "Enough sun is forecast, so it does not charge from the grid.",
+      "tops_up": "Too little sun is forecast, so it charges some from the grid.",
+      "no_forecast": "No solar forecast, so it charges from solar only."
+    },
+    "solar": {"line": "Solar still to come today: {kwh}, we count on {count}. Updated {at}.", "no_forecast": "No solar forecast now, so Leftover solar charges from solar only.", "learning": "The add-on is learning your house's use. The plan starts after one full day."},
+    "today": {
+      "not_planned": "Not planned yet.",
+      "no_runs": "No cheap or expensive hours left today.",
+      "off": "Off, so no monthly cycle today.",
+      "house": "Follows the house.",
+      "house_would": "Would follow the house.",
+      "stopped": "Nothing planned while control is stopped.",
+      "held": "Nothing planned until the alarm clears."
+    },
+    "head": {
+      "held": "Every inverter is at 0 W until the alarm clears.",
+      "held_going": "Every inverter goes to 0 W until the alarm clears.",
+      "stopped": "Control is stopped, so nothing is planned.",
+      "cycle": "A battery runs its monthly cycle today.",
+      "trade": "Charges in the cheapest hour, gives power in the dearest.",
+      "house": "Charges from spare solar and covers the house.",
+      "shadow": "Shadow mode: this is what the add-on would do.",
+      "cycle_would": "A battery would run its monthly cycle today.",
+      "trade_would": "Would charge when cheapest and give power when dearest.",
+      "house_would": "Would charge from spare solar and cover the house."
+    },
+    "run": {
+      "grid_what": "Charges up to {kwh} from the grid.",
+      "grid_what_would": "Would charge up to {kwh} from the grid.",
+      "grid_why": "Lowest published price, {eur} per kWh.",
+      "grid_amount": "Costs up to {eur}.",
+      "give_what": "Gives up to {kwh}, to the house first.",
+      "give_what_would": "Would give up to {kwh}, to the house first.",
+      "give_why": "Highest published price, {eur} per kWh.",
+      "sell_what": "Sells up to {kwh}, to the house first.",
+      "sell_what_would": "Would sell up to {kwh}, to the house first.",
+      "cheap_why": "Cheapest hours, about {eur} per kWh.",
+      "dear_why": "Expensive hours, about {eur} per kWh.",
+      "give_amount": "Worth up to {eur} at that price.",
+      "cycle_start": "Starts the monthly battery cycle.",
+      "cycle_start_would": "Would start the monthly battery cycle.",
+      "cycle_now": "Runs the monthly battery cycle now.",
+      "cycle_now_would": "Would run the monthly battery cycle now.",
+      "cycle_why": "Empties, refills and holds full, so the level reads right.",
+      "cycle_why_would": "Would empty, refill and hold full, so the level reads right.",
+      "cycle_amount_unknown": "How long depends on the battery.",
+      "cycle_amount": "Takes about {hours} hours.",
+      "peak_what": "Gives power to stay under {kw}.",
+      "peak_what_would": "Would give power to stay under {kw}.",
+      "peak_why": "The peak limit comes before everything else.",
+      "house_what": "Follows the house.",
+      "house_what_would": "Would follow the house.",
+      "house_why": "Charges from spare solar, gives power when the house needs it.",
+      "house_why_would": "Would charge from spare solar, give power when the house needs it.",
+      "house_amount": "Amounts depend on the sun and the house."
+    },
+    "no_trade": {
+      "not_covered": "No trading on price: nothing measures the 15-minute peak.",
+      "no_prices": "No trading on price yet: no prices have arrived.",
+      "peak": "No trading on price now: the peak limit comes first.",
+      "not_firm": "No trading on price yet: the prices are not published.",
+      "not_worth": "No trading on price today. The price gap is too small.",
+      "no_level": "No trading on price now: a battery level is unknown."
+    },
+    "tomorrow_trade": {
+      "grid": "Tomorrow: charges at {at}, {eur} per kWh.",
+      "grid_would": "Tomorrow: would charge at {at}, {eur} per kWh.",
+      "give": "Tomorrow: gives power at {at}, {eur} per kWh.",
+      "give_would": "Tomorrow: would give power at {at}, {eur} per kWh."
+    },
+    "cycle_waits": "{name} waits its turn for the monthly cycle.",
+    "step_in": "The batteries step in above {kw}.",
+    "step_in_would": "The batteries would step in above {kw}.",
+    "period": "This 15-minute period is heading for {kw}.",
+    "prices": {
+      "now": "Price now {eur} per kWh, all in.",
+      "today": "Today: lowest {lo} at {lo_at}, highest {hi} at {hi_at}.",
+      "none": "No prices for today."
+    },
+    "tomorrow": {
+      "known": "Tomorrow's prices are in.",
+      "unknown": "Tomorrow's prices usually arrive after 13:00."
+    },
+    "region": {
+      "preset": "Levies and VAT: {region}, {year} figures.",
+      "own": "Levies and VAT: your own figure."
+    },
+    "peak_not_covered": "No peak limit: this meter does not measure 15-minute periods.",
+    "control": {
+      "shadow": "Shadow mode: every inverter stays at 0 W.",
+      "running": "Control is running.",
+      "stopped": "Control is stopped. Every inverter is at 0 W."
+    },
+    "attn": {
+      "controller": "Control is not running",
+      "meter": "Meter reading",
+      "meter_frozen": "Meter reading may be stuck",
+      "freeze_check": "Stuck meter check",
+      "month_peak": "This month's peak",
+      "peak_guard": "Peak limit",
+      "peak_forecast": "Peak limit forecast",
+      "sensor": "Battery readings",
+      "control": "Inverter control",
+      "power_too_high": "Power request too high",
+      "not_keeping_up": "Battery is not keeping up",
+      "write": "Power request not accepted",
+      "direction": "Power went the wrong way",
+      "site_direction": "Power went the wrong way",
+      "circulating": "Inverters working against each other",
+      "delivery": "An inverter is not delivering",
+      "estop": "Emergency stop",
+      "pv": "Solar reading",
+      "none": "Inverter connection"
+    },
+    "months": ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"]
+  }
+}
diff --git a/goodwe_controller/app/ui_text/nl.json b/goodwe_controller/app/ui_text/nl.json
new file mode 100644
index 0000000..c5835df
--- /dev/null
+++ b/goodwe_controller/app/ui_text/nl.json
@@ -0,0 +1,378 @@
+{
+  "groups": {
+    "meter": {"name": "Meter", "description": "Waar de meting van het net vandaan komt."},
+    "inverters": {"name": "Omvormers en batterijen", "description": "De omvormers die de add-on regelt, en uw zonnepanelen."},
+    "tariff": {"name": "Tarief en prijzen", "description": "Wat u per kWh betaalt en terugkrijgt."},
+    "safety": {"name": "Veiligheidsgrenzen", "description": "De piekgrens, starten en stoppen, en de veiligheidsstops."},
+    "maintenance": {"name": "Onderhoud", "description": "De maandelijkse batterijcyclus en het logboek."},
+    "tuning": {"name": "Afstelling van de regeling", "description": "Alleen voor support, want deze zijn gemeten op echte hardware."}
+  },
+  "parts": {
+    "meter.timing": {"name": "Timing"},
+    "inverters.solar": {"name": "Zonnepanelen"},
+    "inverters.modes": {"name": "Batterijmodi"},
+    "tariff.selling": {"name": "Laden en verkopen op prijs"},
+    "tariff.feed": {"name": "Details van de prijsfeed"},
+    "safety.peak": {"name": "Piekgrens", "description": "De add-on mikt iets onder uw grens, voor de zekerheid."},
+    "safety.start": {"name": "Starten en stoppen"},
+    "safety.stops": {"name": "Veiligheidsstops", "description": "Gemeten op echte hardware, dus laat ze zoals ze zijn."},
+    "maintenance.support": {"name": "Support"}
+  },
+  "fields": {
+    "solar": {"name": "Omvormers van de zonnepanelen", "description": "De vermogenssensor van elke zonne-omvormer, die de add-on bijhoudt maar niet gebruikt om te regelen."},
+    "contract": {"name": "Uw contract", "description": "Hoe uw leverancier elke kWh prijst die u van het net afneemt."},
+    "region": {"name": "Regio", "description": "Vult nettarieven, heffingen en btw in voor het getoonde jaar, nog niet voor Wallonië of Brussel, dus kijk uw factuur na."},
+    "fallback": {"name": "Prijs als de feed wegvalt", "description": "Gebruikt als de prijsbron niet antwoordt."},
+    "fixed_price": {"name": "Prijs per kWh, alles inbegrepen", "description": "Energie, kosten van de leverancier, nettarieven, heffingen en btw samen."},
+    "day_price": {"name": "Dagprijs, weekdagen 07:00 tot 22:00", "description": "Alles inbegrepen, zoals op uw factuur."},
+    "night_price": {"name": "Nacht- en weekendprijs", "description": "Alles inbegrepen, zoals op uw factuur."},
+    "periods": {"name": "Tijdvakken en prijzen", "description": "Eén prijs per kWh voor elk tijdvak, alles inbegrepen, zoals op uw factuur."}
+  },
+  "choices": {
+    "contract": {"none": "Geen prijzen", "fixed": "Vaste prijs", "daynight": "Dag en nacht", "dynamic": "Dynamisch, per uur", "custom": "Andere tijdvakken"},
+    "fallback": {"none": "Geen", "fixed": "Eén prijs", "daynight": "Dag en nacht", "custom": "Andere tijdvakken"},
+    "region": {"flanders": "Vlaanderen, Fluvius Antwerpen", "own": "Ik vul zelf een bedrag in"},
+    "meter_source": {"off": "Eén entiteit voor netvermogen", "ha_dsmr": "Entiteiten voor afname en injectie", "mqtt_p1": "Meter via MQTT", "ha_signed": "Eén entiteit voor nettovermogen", "homewizard_local": "HomeWizard-meter op het netwerk"},
+    "meter_phases": {"1": "1 fase", "3": "3 fasen"},
+    "shadow_mode": {"auto": "Automatisch", "on": "Altijd aan", "off": "Uit"},
+    "price_provider": {"generic_dayahead": "Day-aheadprijs van de markt", "custom_formula": "Uw eigen prijsformule", "manual_csv": "Een prijsbestand"},
+    "log_level": {"trace": "Alles, voor support", "debug": "Uitgebreid, om een probleem te vinden", "info": "Normaal", "warning": "Waarschuwingen en fouten", "error": "Alleen fouten"},
+    "period_days": {"mon-sun": "Elke dag", "mon-fri": "Maandag tot vrijdag", "sat,sun": "Zaterdag en zondag", "mon": "maandag", "tue": "dinsdag", "wed": "woensdag", "thu": "donderdag", "fri": "vrijdag", "sat": "zaterdag", "sun": "zondag"}
+  },
+  "applies": {"restart": {"name": "Geldt na een herstart"}, "now": {"name": "Geldt meteen"}},
+  "home": {
+    "app": {"name": "Batterij-add-on"},
+    "tabs": {"home": "Start", "batteries": "Batterijen", "settings": "Instellingen", "setup": "Installatie", "label": "Schermen"},
+    "now": {"name": "Nu", "description": "Elke 3 seconden bijgewerkt.", "solar": "Zonnepanelen", "house": "Huis", "grid": "Net", "batteries": "Batterijen"},
+    "plan": {
+      "name": "Plan voor vandaag",
+      "description": "Wijs een staaf of blok aan voor details, of tik erop op een telefoon.",
+      "cheap": "Lage prijs",
+      "dear": "Hoge prijs",
+      "estimate": "Schatting",
+      "grid": "Laadt van het net",
+      "give": "Levert stroom",
+      "cycle": "Maandelijkse batterijcyclus",
+      "peak": "Piekgrens",
+      "house": "Volgt het huis",
+      "now": "nu",
+      "time_to": "tot",
+      "per_kwh": "per kWh",
+      "cheap_tip": "laag voor vandaag",
+      "dear_tip": "hoog voor vandaag",
+      "estimate_tip": "schatting op basis van gisteren",
+      "none_tip": "Geen prijs bekend",
+      "no_prices": {"description": "Geen prijzen voor vandaag, dus de grafiek toont alleen het plan."},
+      "list": "Het plan in woorden",
+      "average_tip": "gemiddelde van het uur"
+    },
+    "peak": {"name": "Piekgrens", "this_month": "Piek van deze maand", "limit": "Grens", "none": "Nog niets gemeten", "unreadable": "Nu niet leesbaar"},
+    "attention": {"name": "Vraagt aandacht", "nothing": "Niets om na te kijken", "to_look": "na te kijken", "details": "Details", "alarm": "Alarm", "warning": "Waarschuwing", "info": "Info"},
+    "control": {"name": "Regeling", "stop": "Regeling stoppen", "start": "Regeling starten", "maint_start": "Nu een batterijcyclus starten", "maint_abort": "Batterijcyclus stoppen", "docs": "Documentatie van de add-on", "more": "Meer acties"},
+    "details": {"name": "Details voor installateurs", "rows": "Statusregels", "checks": "Controles", "event": "Laatste gebeurtenis"},
+    "dialog": {
+      "cancel": "Annuleren",
+      "stop": {"name": "Regeling stoppen?", "description": "Elke omvormer gaat naar 0 W tot u de regeling opnieuw start.", "yes": "Regeling stoppen"},
+      "start": {"name": "Regeling starten?", "description": "De add-on regelt de batterijen weer en heft een veiligheidsstop op.", "yes": "Regeling starten"},
+      "maint_start": {"name": "Batterijcyclus starten?", "description": "De batterij loopt leeg, laadt weer op en blijft vol, wat enkele uren duurt.", "yes": "Cyclus starten"},
+      "maint_abort": {"name": "Batterijcyclus stoppen?", "description": "Elke omvormer gaat even naar 0 W, daarna gaat de regeling verder.", "yes": "Cyclus stoppen"}
+    },
+    "toast": {"started": "Regeling gestart.", "stopped": "Regeling gestopt.", "done": "Klaar.", "failed": "Dat lukte niet. Probeer opnieuw."},
+    "offline": {"name": "Add-on niet bereikbaar", "description": "De pagina probeert het elke 3 seconden opnieuw."},
+    "setup_only": {"name": "Installatie: nog niets wordt geregeld", "description": "Er gaat niets naar een omvormer tot de installatie bewaard is en de add-on herstart.", "control": "De regeling start na de installatie.", "open": "Installatie openen"},
+    "batteries": {"name": "Batterijen", "description": "Zet batterijmodi aan in de instellingen om per batterij een modus te kiezen.", "level": "Laadniveau", "now": "Nu", "stored": "Opgeslagen", "mode": "Modus", "settings": "Instellingen van omvormers wijzigen",
+      "on": "Aan", "off": "Uit",
+      "choice": {
+        "solar_first": {"name": "Eerst zonne-energie", "description": "Laadt met zonne-energie vóór de andere batterijen en dekt het huis."},
+        "leftover_solar": {"name": "Overschot zonne-energie", "description": "Krijgt zonne-energie die de andere niet opnemen, en levert in dure uren."},
+        "cheap_hours": {"name": "Alleen goedkope uren", "description": "Laadt in de goedkoopste uren en levert in de dure uren."},
+        "off": {"name": "Uit", "description": "Rust, en helpt alleen als de piekgrens haar nodig heeft."}
+      },
+      "today": "Vandaag", "why": "Waarom",
+      "modes_off": {"name": "Batterijmodi staan uit"},
+      "how": {"name": "Zo werken de modi", "description": "Welke batterij eerst zonne-energie krijgt, en wanneer elke batterij levert.",
+        "solar_first": {"description": "Eerst zonne-energie krijgt het overschot vóór de andere batterijen, en dekt het huis op elk uur."},
+        "leftover_solar": {"description": "Overschot zonne-energie krijgt wat de batterijen met Eerst zonne-energie niet opnemen, en spaart haar stroom voor dure uren."},
+        "cheap_hours": {"description": "Alleen goedkope uren laadt in de goedkoopste uren en levert in de dure uren."},
+        "off": {"description": "Uit laat de batterij rusten en start geen maandelijkse cyclus, maar de piekgrens mag haar nog gebruiken."},
+        "rules": {"description": "De piekgrens en de veiligheidsstops gaan voor, en terwijl een batterij van het net laadt rusten de andere."}},
+      "toast": {"on": "{name} staat aan.", "off": "{name} staat uit.", "mode": "{name}: {mode}."}},
+    "settings": {"name": "Instellingen", "description": "De instellingen staan hieronder per taak.", "open": "Instellingen openen"}
+  },
+  "choices_later": {"region": {"wallonia": "Wallonië, nog geen standaardwaarde", "brussels": "Brussel, nog geen standaardwaarde"}},
+  "choice_help": {
+    "meter_source": {
+      "off": {"description": "Een Home Assistant-entiteit met het netvermogen in W, positief als u van het net afneemt."},
+      "ha_dsmr": {"description": "Twee Home Assistant-entiteiten van de DSMR-integratie, een voor afname en een voor injectie."},
+      "mqtt_p1": {"description": "De meetwaarden komen via MQTT binnen op een topic dat u opgeeft."},
+      "ha_signed": {"description": "Eén Home Assistant-entiteit met het nettovermogen, positief bij afname."},
+      "homewizard_local": {"description": "De add-on leest een HomeWizard-meter op uw netwerk en merkt een vastgelopen meter op."}
+    }
+  },
+  "settings": {
+    "name": "Instellingen",
+    "description": "Elke instelling, per taak.",
+    "view": {"name": "Weergave van de instellingen", "simple": "Eenvoudig", "installer": "Installateur"},
+    "simple": {"description": "De keuzes die een eigenaar maakt.",
+      "note": {"month_peak": {"description": "De piek van deze maand tot nu: {kw}."}, "shadow": {"description": "Kies Altijd aan terwijl u een nieuwe installatie test."}, "forecast": {"description": "Met een prognose koopt een batterij alleen wat de zon niet geeft."}},
+      "batteries": {"name": "Batterijen"},
+      "more": {"description": "Zoekt u de meter, de omvormers of de prijzen?"},
+      "installer": "De installateursweergave openen"},
+    "classic": "Klassieke instellingen",
+    "search": {"name": "Instelling zoeken", "description": "Zoek een instelling, bijvoorbeeld piek of meter."},
+    "no_match": {"description": "Geen instelling past bij uw zoekopdracht."},
+    "loading": "Instellingen laden",
+    "load_failed": {"name": "Instellingen niet leesbaar", "description": "De add-on kon zijn bewaarde instellingen niet lezen, dus gebruik Klassieke instellingen of het tabblad Configuratie."},
+    "footer": {"description": "Elke wijziging gaat door de startcontroles van de add-on voor ze bewaard wordt."},
+    "to_fix": "op te lossen",
+    "to_check": "na te kijken",
+    "changed": "gewijzigd",
+    "on": "Aan",
+    "off": "Uit",
+    "not_set": "Niet ingesteld",
+    "locked": "Vergrendeld",
+    "change": "Wijzigen",
+    "support": {"description": "Deze zijn gemeten op echte hardware, dus wijzig ze alleen als support erom vraagt."},
+    "picker": {"choose": "Kies een entiteit", "search": {"description": "Zoek op naam of entiteit-id."}, "all": "Alle entiteiten tonen", "use": "Deze entiteit-id gebruiken", "clear": "Wissen", "missing": "Niet in Home Assistant", "none": {"description": "Niets gevonden, dus kijk de entiteit na in Ontwikkelhulpmiddelen."}},
+    "add_inverter": "Omvormer toevoegen",
+    "inverter": "Omvormer",
+    "remove": "Verwijderen",
+    "add_row": "Regel toevoegen",
+    "add_solar": "Zonne-omvormer toevoegen",
+    "periods": {"window": "Tijdvak", "from": "Van", "to": "Tot", "days": "Dagen", "price": "Prijs", "add": "Tijdvak toevoegen"},
+    "reversed": "Meet negatief",
+    "phase": "Fase",
+    "raw_roster": {"description": "Deze lijst met omvormers kan alleen op het tabblad Configuratie gewijzigd worden."},
+    "region_year": "cijfers van {year}",
+    "hour": "{hour}:00 UTC",
+    "preset": {"description": "Ingevuld door de regio hierboven, dus kies een eigen bedrag om het te wijzigen."},
+    "cycle": {"name": "Een cyclus met de hand starten", "description": "Dezelfde acties als op Start, die elk eerst om bevestiging vragen."},
+    "savebar": {"label": "Niet bewaarde wijzigingen", "one": "wijziging niet bewaard", "many": "wijzigingen niet bewaard", "discard": "Verwerpen", "save": "Bewaren", "saving": "Bezig met bewaren"},
+    "saved": {"name": "Bewaard, nog niet actief", "description": "De add-on werkt met de instellingen waarmee hij startte tot u hem herstart."},
+    "differs": {"name": "Bewaarde instellingen zijn niet actief", "description": "Sommige bewaarde instellingen verschillen van wat nu draait, dus herstart de add-on om ze toe te passen."},
+    "stale": {"name": "Elders gewijzigd", "description": "Deze instellingen zijn elders gewijzigd terwijl u bewerkte, dus bewaar opnieuw om de uwe te houden of verwerp om de andere te laden."},
+    "other": "Andere meldingen",
+    "restart": "Nu herstarten",
+    "dialog": {"name": "Add-on herstarten?", "description": "Elke omvormer gaat naar 0 W terwijl de add-on herstart, daarna gelden de nieuwe instellingen.", "yes": "Nu herstarten"},
+    "toast": {"saved": "Bewaard. Herstart om toe te passen.", "discarded": "Wijzigingen verworpen.", "failed": "Dat lukte niet. Probeer opnieuw.", "blocked": {"description": "Los de rood gemarkeerde instellingen op en bewaar opnieuw."}, "restarting": {"description": "Herstart gevraagd, dus deze pagina antwoordt even niet."}},
+    "tier": {"bad": "Oplossen", "warn": "Nakijken", "info": "Opmerking", "ok": "In orde"},
+    "derive": {
+      "raw_roster": {"description": "Deze lijst met omvormers kan alleen op het tabblad Configuratie gewijzigd worden."},
+      "no_inverter": {"description": "Voeg minstens één omvormer toe."},
+      "flat_named": {"description": "Voeg een tweede omvormer toe voor u deze een naam geeft."},
+      "no_source": {"description": "Kies waar de dynamische prijzen vandaan komen."},
+      "custom_profile": {"description": "Deze tijdvakken kunnen alleen op het tabblad Configuratie gewijzigd worden."},
+      "no_price": {"description": "Vul een prijs per kWh in."},
+      "no_periods": {"description": "Voeg minstens één tijdvak toe."},
+      "period_time": {"description": "Tijdvak {row}: schrijf elk tijdstip als uren en minuten, zoals 07:00 of 24:00."},
+      "period_zero": {"description": "Tijdvak {row} begint en eindigt op hetzelfde uur, dus wijzig een van beide."},
+      "period_price": {"description": "Tijdvak {row}: vul een prijs per kWh in."},
+      "period_price_range": {"description": "Tijdvak {row}: vul de prijs in euro per kWh in, zoals 0,34."},
+      "period_overlap": {"description": "Tijdvakken {a} en {b} vallen allebei op {day} {from} tot {to}, dus wijzig er een."},
+      "period_gap": {"description": "Geen tijdvak dekt {day} {from} tot {to}, dus voeg er een toe of maak er een breder."},
+      "unknown": {"description": "De pagina kan deze keuze niet bewaren, dus laad de pagina opnieuw."}
+    },
+    "setup": {
+      "name": "Installatie",
+      "description": "Voor installateurs: zes stappen naar een werkende installatie, en elke stap kan later gewijzigd worden onder Instellingen.",
+      "done_before": {"description": "Deze installatie is al ingesteld, dus een wijziging hier vervangt de bewaarde instellingen."},
+      "step": "Stap {n} van {total}",
+      "back": "Terug",
+      "next": "Volgende",
+      "skip": "Volgende, of overslaan",
+      "finish": "Bewaren en herstarten",
+      "not_now": "Niet nu",
+      "steps": {
+        "1": {"name": "Uw meter", "description": "De add-on stuurt de netmeting naar nul, dus eerst is uw meter nodig."},
+        "2": {"name": "Omvormers en batterijen", "description": "Eén kaart per omvormer met een batterij, met zijn entiteiten in Home Assistant."},
+        "3": {"name": "Zonnepanelen", "description": "Niet verplicht, dus sla deze stap over als de add-on de zonneproductie niet moet bijhouden."},
+        "4": {"name": "Prijzen", "description": "Wat u per kWh betaalt, zodat de batterijen laden als stroom goedkoop is."},
+        "5": {"name": "Piekgrens", "description": "Het net blijft onder deze grens, gemiddeld over elk kwartier."},
+        "6": {"name": "Nakijken en starten", "description": "De add-on kijkt alles na met zijn eigen startcontroles en herstart dan."}
+      },
+      "modes_later": {"description": "Zet na de installatie batterijmodi aan om per batterij een modus te kiezen op het scherm Batterijen."},
+      "kettle": {
+        "name": "Richting nakijken",
+        "description": "Lees de meter af, zet een waterkoker aan en lees de meter opnieuw af.",
+        "read": "Meter aflezen",
+        "again": "Opnieuw aflezen",
+        "skip": "Deze test overslaan",
+        "before": {"description": "De meter geeft nu {w} aan, dus zet een waterkoker aan en druk op Opnieuw aflezen."},
+        "unread": {"description": "De meter is nu niet leesbaar, dus kijk de entiteit na en probeer opnieuw."},
+        "none": {"description": "De meting veranderde maar {d}, dus zet de waterkoker aan en lees opnieuw af."},
+        "ok": {"description": "Goed, de meting steeg met {d} toen de waterkoker aanging."},
+        "flip": {"description": "De meting daalde met {d}, dus de add-on keert het teken voor u om."},
+        "wrong_signed": {"description": "De meting daalde met {d}, dus kies hierboven “Eén entiteit voor netvermogen”, die het kan omkeren."},
+        "wrong_dsmr": {"description": "De meting daalde met {d}, dus kijk na of afname en injectie niet omgewisseld zijn."},
+        "self": {"description": "De add-on leest deze meter zelf, dus Start toont de richting na de herstart."},
+        "skipped": {"description": "De richting van de meter is niet getest, dus kijk ze na op Start na de herstart."},
+        "skipped_wrong": {"description": "Bij de waterkokertest daalde de meting, dus kijk de richting na in stap 1 voor u de regeling start."},
+        "skipped_down": {"description": "De meting daalde toen de waterkoker aanging, dus kijk de richting van de meter na voor u de regeling start."},
+        "tested": {"description": "De richting van de meter is getest met een waterkoker."},
+        "needed": {"description": "Doe eerst de waterkokertest, of sla hem over."}
+      },
+      "check": {"name": "Wat de add-on nakeek", "running": {"description": "Bezig met de startcontroles van de add-on."}, "pass": {"description": "De startcontroles van de add-on zijn in orde."}, "failed": {"description": "De controle liep niet, dus probeer opnieuw."}, "again": "Opnieuw nakijken", "blocked": {"description": "Los de rood gemarkeerde punten op en kijk dan opnieuw na."}},
+      "dialog": {"name": "Bewaren en herstarten?", "description": "Elke omvormer gaat naar 0 W terwijl de add-on herstart, en de schaduwmodus houdt ze daarna op 0 W.", "yes": "Bewaren en herstarten"},
+      "dialog_live": {"name": "Bewaren en herstarten?", "description": "Elke omvormer gaat naar 0 W terwijl de add-on herstart, daarna gelden de nieuwe instellingen.", "yes": "Bewaren en herstarten"},
+      "dialog_setup": {"name": "Bewaren en herstarten?", "description": "De add-on herstart met deze instellingen, en de schaduwmodus houdt elke omvormer op 0 W.", "yes": "Bewaren en herstarten"},
+      "dialog_setup_live": {"name": "Bewaren en herstarten?", "description": "De add-on herstart met deze instellingen, en dan gelden ze.", "yes": "Bewaren en herstarten"},
+      "done": {"name": "Installatie is klaar", "description": "De add-on herstart nu in schaduwmodus, dus open Start over een minuut om te zien wat hij zou doen."},
+      "done_live": {"name": "Installatie is klaar", "description": "De add-on herstart nu, dus open Start over een minuut om de regeling te starten."},
+      "restart_failed": {"name": "Bewaard, nog niet actief", "description": "De herstart lukte niet, dus druk op Nu herstarten om de instellingen toe te passen."},
+      "home": "Start openen"
+    }
+  },
+  "home_words": {
+    "mode_house": "Volgt het huis",
+    "modes": {"solar_first": "Eerst zonne-energie", "leftover_solar": "Overschot zonne-energie", "cheap_hours": "Alleen goedkope uren", "off": "Uit"},
+    "attn_shadow": "Schaduwmodus staat aan",
+    "attn_shadow_body": "De add-on beslist alles, maar elke omvormer blijft op 0 W.",
+    "zero_held": "Op 0 W gehouden",
+    "zero_going": "Gaat naar 0 W",
+    "verdict": {"held": "Op 0 W gehouden", "stopped": "Gestopt", "cycle": "Vandaag maandelijkse cyclus", "trade": "Handelt op prijs", "house": "Volgt het huis"},
+    "pill": {"running": "Actief", "shadow": "Schaduwmodus", "stopped": "Gestopt", "alarm": "Heeft u nu nodig", "warning": "Actief, met een waarschuwing"},
+    "banner_sub": {"running": "De batterijen volgen het plan hieronder.", "shadow": "De plannen hieronder tonen wat de add-on zou doen.", "stopped": "Start de regeling hieronder als u klaar bent.", "alarm": "Zie Vraagt aandacht hieronder voor wat u moet doen.", "warning": "Zie Vraagt aandacht hieronder."},
+    "tile": {"not_set_up": "Niet ingesteld", "no_reading": "Geen meting", "producing": "Produceert", "not_producing": "Produceert niet", "needs_solar": "Zonnemeting nodig", "not_adding_up": "Metingen kloppen niet", "using": "Verbruikt", "taking": "Neemt af van het net", "feeding": "Injecteert", "balanced": "In evenwicht", "giving": "Levert stroom", "charging": "Laadt", "resting": "Rust"},
+    "now": {
+      "no_reading": "Geen meting van deze batterij.",
+      "would_rest": "{zero}. Zou nu rusten.",
+      "would_give": "{zero}. Zou nu {kw} leveren.",
+      "would_charge": "{zero}. Zou nu {kw} laden.",
+      "held": "{zero} tot het alarm weg is.",
+      "stopped": "{zero} zolang de regeling gestopt is.",
+      "cycle_drain": "Maandelijkse cyclus: leegmaken.",
+      "cycle_charge": "Maandelijkse cyclus: opladen.",
+      "cycle_hold": "Maandelijkse cyclus: vol houden.",
+      "cycle": "Maandelijkse cyclus bezig.",
+      "giving": "Levert nu {kw}.",
+      "charging": "Laadt nu {kw}.",
+      "resting": "Rust nu.",
+      "off_resting": "Uit. Rust nu.",
+      "off_peak": "Uit, maar levert {kw} voor de piekgrens.",
+      "off_going": "Uit. Nog {kw}, gaat naar 0 W."
+    },
+    "why": {
+      "no_reading": "Geen meting, dus de add-on weet het niet.",
+      "held": "Een alarm stopte de regeling. Zie Vraagt aandacht.",
+      "stopped": "De regeling is gestopt.",
+      "shadow": "Schaduwmodus: de add-on toont alleen wat hij zou doen.",
+      "cycle": "De maandelijkse cyclus houdt de meting van het laadniveau juist.",
+      "cycle_mode": "De maandelijkse cyclus gaat voor. Daarna volgt ze weer haar modus.",
+      "off": "U hebt haar uitgezet.",
+      "off_peak": "De piekgrens gaat voor op Uit. Daarna rust ze weer.",
+      "refuses_give": "De batterij weigert te leveren. De add-on probeert het elke 15 minuten opnieuw.",
+      "refuses_charge": "De batterij weigert te laden. De add-on probeert het elke 15 minuten opnieuw.",
+      "peak": "De piekgrens vraagt vermogen van de batterijen.",
+      "modes_off": "Batterijmodi staan uit, dus ze volgt het huis.",
+      "solar_first": "Eerst zonne-energie: ze krijgt het overschot vóór de andere.",
+      "leftover": "Ze krijgt de zonne-energie die de batterijen met Eerst zonne-energie niet opnemen.",
+      "leftover_alone": "Geen batterij met Eerst zonne-energie staat aan, dus zij krijgt eerst zonne-energie.",
+      "covers_house": "Ze levert stroom om het huis te dekken.",
+      "other_refuses": "{name} weigert te leveren, dus deze batterij neemt het over.",
+      "other_cycle": "{name} loopt leeg voor haar maandelijkse cyclus. Deze laadt niet.",
+      "grid_charge": "De prijs is laag, dus ze laadt van het net.",
+      "rests_charge": "Een andere batterij laadt van het net, dus deze rust.",
+      "selling": "De prijs is hoog, dus ze verkoopt aan het net.",
+      "expensive": "De prijs is hoog, dus ze dekt het huis.",
+      "saves": "Spaart haar stroom voor {at}.",
+      "saves_later": "Spaart haar stroom voor hogere prijzen.",
+      "no_prices": "Geen prijzen, dus ze volgt het huis.",
+      "no_spread": "De prijzen verschillen te weinig, dus ze volgt het huis.",
+      "sun_fills": "Er is genoeg zon voorspeld, dus ze laadt niet van het net.",
+      "tops_up": "Te weinig zon voorspeld, dus ze laadt wat van het net.",
+      "no_forecast": "Geen zonneprognose, dus ze laadt alleen met zonne-energie."
+    },
+    "solar": {"line": "Nog verwachte zon vandaag: {kwh}, we rekenen op {count}. Bijgewerkt om {at}.", "no_forecast": "Nu geen zonneprognose, dus Overschot zonne-energie laadt alleen met zon.", "learning": "De add-on leert eerst het verbruik van uw huis. Het plan start na één volle dag."},
+    "today": {
+      "not_planned": "Nog niet gepland.",
+      "no_runs": "Vandaag geen goedkope of dure uren meer.",
+      "off": "Uit, dus vandaag geen maandelijkse cyclus.",
+      "house": "Volgt het huis.",
+      "house_would": "Zou het huis volgen.",
+      "stopped": "Niets gepland zolang de regeling gestopt is.",
+      "held": "Niets gepland tot het alarm weg is."
+    },
+    "head": {
+      "held": "Elke omvormer staat op 0 W tot het alarm weg is.",
+      "held_going": "Elke omvormer gaat naar 0 W tot het alarm weg is.",
+      "stopped": "De regeling is gestopt, dus er is niets gepland.",
+      "cycle": "Een batterij doet vandaag zijn maandelijkse cyclus.",
+      "trade": "Laadt in het goedkoopste uur, levert stroom in het duurste.",
+      "house": "Laadt met zonne-overschot en dekt het huis.",
+      "shadow": "Schaduwmodus: dit is wat de add-on zou doen.",
+      "cycle_would": "Een batterij zou vandaag zijn maandelijkse cyclus doen.",
+      "trade_would": "Zou laden als het goedkoopst is en leveren als het duurst is.",
+      "house_would": "Zou laden met zonne-overschot en het huis dekken."
+    },
+    "run": {
+      "grid_what": "Laadt tot {kwh} van het net.",
+      "grid_what_would": "Zou tot {kwh} van het net laden.",
+      "grid_why": "Laagste gepubliceerde prijs, {eur} per kWh.",
+      "grid_amount": "Kost tot {eur}.",
+      "give_what": "Levert tot {kwh}, eerst aan het huis.",
+      "give_what_would": "Zou tot {kwh} leveren, eerst aan het huis.",
+      "give_why": "Hoogste gepubliceerde prijs, {eur} per kWh.",
+      "sell_what": "Verkoopt tot {kwh}, eerst aan het huis.",
+      "sell_what_would": "Zou tot {kwh} verkopen, eerst aan het huis.",
+      "cheap_why": "Goedkoopste uren, ongeveer {eur} per kWh.",
+      "dear_why": "Dure uren, ongeveer {eur} per kWh.",
+      "give_amount": "Tot {eur} waard aan die prijs.",
+      "cycle_start": "Start de maandelijkse batterijcyclus.",
+      "cycle_start_would": "Zou de maandelijkse batterijcyclus starten.",
+      "cycle_now": "Doet nu de maandelijkse batterijcyclus.",
+      "cycle_now_would": "Zou nu de maandelijkse batterijcyclus doen.",
+      "cycle_why": "Maakt leeg, laadt op en houdt vol, zodat het laadniveau klopt.",
+      "cycle_why_would": "Zou leegmaken, opladen en vol houden, zodat het laadniveau klopt.",
+      "cycle_amount_unknown": "Hoe lang hangt af van de batterij.",
+      "cycle_amount": "Duurt ongeveer {hours} uur.",
+      "peak_what": "Levert stroom om onder {kw} te blijven.",
+      "peak_what_would": "Zou stroom leveren om onder {kw} te blijven.",
+      "peak_why": "De piekgrens gaat voor alles.",
+      "house_what": "Volgt het huis.",
+      "house_what_would": "Zou het huis volgen.",
+      "house_why": "Laadt met zonne-overschot, levert als het huis vraagt.",
+      "house_why_would": "Zou laden met zonne-overschot, leveren als het huis vraagt.",
+      "house_amount": "Hoeveel hangt af van de zon en het huis."
+    },
+    "no_trade": {
+      "not_covered": "Geen handel op prijs: niets meet de kwartierpiek.",
+      "no_prices": "Nog geen handel op prijs: er zijn geen prijzen binnen.",
+      "peak": "Nu geen handel op prijs: de piekgrens gaat voor.",
+      "not_firm": "Nog geen handel op prijs: de prijzen zijn niet gepubliceerd.",
+      "not_worth": "Vandaag geen handel op prijs. Het prijsverschil is te klein.",
+      "no_level": "Nu geen handel op prijs: een laadniveau is onbekend."
+    },
+    "tomorrow_trade": {"grid": "Morgen: laadt om {at}, {eur} per kWh.", "grid_would": "Morgen: zou laden om {at}, {eur} per kWh.", "give": "Morgen: levert stroom om {at}, {eur} per kWh.", "give_would": "Morgen: zou stroom leveren om {at}, {eur} per kWh."},
+    "cycle_waits": "{name} wacht zijn beurt af voor de maandelijkse cyclus.",
+    "step_in": "De batterijen springen bij boven {kw}.",
+    "step_in_would": "De batterijen zouden bijspringen boven {kw}.",
+    "period": "Dit kwartier gaat richting {kw}.",
+    "prices": {"now": "Prijs nu {eur} per kWh, alles inbegrepen.", "today": "Vandaag: laagste {lo} om {lo_at}, hoogste {hi} om {hi_at}.", "none": "Geen prijzen voor vandaag."},
+    "tomorrow": {"known": "De prijzen van morgen zijn binnen.", "unknown": "De prijzen van morgen komen meestal na 13:00."},
+    "region": {"preset": "Heffingen en btw: {region}, cijfers van {year}.", "own": "Heffingen en btw: uw eigen bedrag."},
+    "peak_not_covered": "Geen piekgrens: deze meter meet geen kwartieren.",
+    "control": {"shadow": "Schaduwmodus: elke omvormer blijft op 0 W.", "running": "De regeling is actief.", "stopped": "De regeling is gestopt. Elke omvormer staat op 0 W."},
+    "attn": {
+      "controller": "Regeling is niet actief",
+      "meter": "Meting van de meter",
+      "meter_frozen": "Meter staat mogelijk vast",
+      "freeze_check": "Controle op vastgelopen meter",
+      "month_peak": "Piek van deze maand",
+      "peak_guard": "Piekgrens",
+      "peak_forecast": "Prognose voor de piekgrens",
+      "sensor": "Metingen van de batterij",
+      "control": "Regeling van de omvormer",
+      "power_too_high": "Vermogensvraag te hoog",
+      "not_keeping_up": "Batterij kan niet volgen",
+      "write": "Vermogensvraag niet aanvaard",
+      "direction": "Vermogen de verkeerde kant op",
+      "site_direction": "Vermogen de verkeerde kant op",
+      "circulating": "Omvormers werken elkaar tegen",
+      "delivery": "Een omvormer levert niet",
+      "estop": "Noodstop",
+      "pv": "Meting van de zonnepanelen",
+      "none": "Verbinding met de omvormer"
+    },
+    "months": ["januari", "februari", "maart", "april", "mei", "juni", "juli", "augustus", "september", "oktober", "november", "december"]
+  }
+}
diff --git a/goodwe_controller/app/uilayout.py b/goodwe_controller/app/uilayout.py
new file mode 100644
index 0000000..04a8e80
--- /dev/null
+++ b/goodwe_controller/app/uilayout.py
@@ -0,0 +1,347 @@
+"""UX-13: the new page's layout, written once - screen, group, field.
+
+UI code names option keys only here and in uimodel.py, which holds the
+derivations this table lists (DECISIONS/UX-13-one-layout-table.md, amending
+UX-02 §3). Everything else stays where UX-02 put it: ranges in config.yaml's
+schema, rules in validate.py. test_uilayout.py fails CI when an option in
+config.yaml has no place here.
+
+A field's `key` is an option key, `inverters.<field>` for one inverter in the
+list, or `ui.<name>` for a page-only control that uimodel.py turns into options.
+The key is also its text key: label and help are translations/*.yaml's entry
+for an option, and app/ui_text's `fields.<name>` for a `ui.` field.
+"""
+
+from dataclasses import dataclass
+
+RESTART = "restart"         # stored options apply after a restart (UX-02 §5)
+NOW = "now"                 # runtime state (OPT-11's battery switches), none yet
+
+# Controls are names, not string literals, so a key is never followed by a
+# constant (test_defaults_pin.py reads `f("key", <constant>)` as a fallback).
+CHOICE, ENTITY, ENTITY_LIST, TOGGLE, SEGMENTED, SLIDER = (
+    "choice", "entity", "entity_list", "toggle", "segmented", "slider")
+NUMBER, TEXT, SELECT, LOCKED, INVERTER_LIST, SOLAR_LIST = (
+    "number", "text", "select", "locked", "inverter_list", "solar_list")
+PERIOD_LIST = "period_list"     # P5: time windows, each with its own price
+CONTROLS = (CHOICE, ENTITY, ENTITY_LIST, TOGGLE, SEGMENTED, SLIDER, NUMBER,
+            TEXT, SELECT, LOCKED, INVERTER_LIST, SOLAR_LIST, PERIOD_LIST)
+# What an entity picker offers first. `power_w` is a power sensor the add-on
+# reads as watts with no unit conversion, so validate.py warns on a kW sensor.
+ENTITY_KINDS = ("power_w", "power", "energy", "pct", "number", "any")
+SHOW_OPS = ("==", "!=", "in", ">", "<")
+
+
+@dataclass(frozen=True)
+class Field:
+    key: str
+    control: str
+    unit: str = ""
+    scale: int = 1              # shown = stored / scale (the peak limit in kW)
+    step: float = 0             # slider or number step, stored units; 0 = 1
+    kind: str = ""              # entity picker filter, one of ENTITY_KINDS
+    show: tuple = ()            # ((name, op, value), ...), all must hold
+    applies: str = RESTART
+    simple: bool = False        # also on Settings, Simple
+    wizard: int = 0             # setup wizard step 1-6, 0 = not in the wizard
+    mirror: str = ""            # a choice also copied to this field, if offered
+    fills: str = ""             # a preset choice fills this field (uimodel)
+    note: str = ""              # P3: a line under it on Settings, Simple
+
+    @property
+    def text(self) -> str:
+        """Where the label and help live: `translations` or `ui_text`."""
+        return "ui_text" if self.key.startswith("ui.") else "translations"
+
+
+@dataclass(frozen=True)
+class Part:
+    id: str                     # "" is the group's main part
+    fields: tuple
+    collapsed: bool = False
+
+
+@dataclass(frozen=True)
+class Group:
+    id: str
+    parts: tuple
+    support_only: bool = False  # collapsed, with a "for support" warning
+
+
+def _src(*values):
+    return (("meter_source", "in", values),)
+
+
+_DYNAMIC = (("ui.contract", "==", "dynamic"),)
+_MAINT = (("maintenance_enabled", "==", True),)
+_ONE = (("inverter_count", "==", 1),)
+_SEVERAL = (("inverter_count", ">", 1),)
+_PHASES = (("meter_phases", ">", 1),)
+# One inverter stored flat has no name or capacity (uimodel._roster_encode).
+_LISTED = (("inverter_shape", "!=", "flat"),)
+
+# The per-inverter card. Its keys are `inverters.<field>` in config.yaml.
+ROSTER_FIELDS = (
+    Field("inverters.name", TEXT, show=_LISTED, wizard=2),
+    Field("inverters.setpoint_entity", ENTITY, kind="number", wizard=2),
+    Field("inverters.max_w", SLIDER, "W", step=100, wizard=2),
+    Field("inverters.bms_soc_floor", SLIDER, "%", wizard=2),
+    Field("inverters.soc_entity", ENTITY, kind="pct", wizard=2),
+    Field("inverters.batt_entity", ENTITY, kind="power_w", wizard=2),
+    Field("inverters.batt_invert", TOGGLE, wizard=2),
+    Field("inverters.capacity_kwh", NUMBER, "kWh", step=0.1, show=_LISTED,
+          wizard=2),
+)
+
+GROUPS = (
+    Group("meter", (
+        Part("", (
+            Field("meter_source", CHOICE, wizard=1),
+            Field("meter_entity", ENTITY, kind="power_w", show=_src("off"),
+                  wizard=1),
+            Field("meter_invert", TOGGLE, show=_src("off"), wizard=1),
+            Field("p1_net_entity", ENTITY, kind="power_w",
+                  show=_src("ha_signed"), wizard=1),
+            Field("p1_import_entity", ENTITY, kind="power_w",
+                  show=_src("ha_dsmr"), wizard=1),
+            Field("p1_export_entity", ENTITY, kind="power_w",
+                  show=_src("ha_dsmr"), wizard=1),
+            Field("p1_host", TEXT, show=_src("homewizard_local"), wizard=1),
+            Field("meter_mqtt_topic", TEXT, show=_src("mqtt_p1"), wizard=1),
+            Field("meter_phases", SEGMENTED, wizard=1),
+            Field("p1_phase_net_entities", ENTITY_LIST, kind="power_w",
+                  show=_src("ha_signed") + _PHASES, wizard=1),
+            Field("p1_phase_import_entities", ENTITY_LIST, kind="power_w",
+                  show=_src("ha_dsmr") + _PHASES, wizard=1),
+            Field("p1_phase_export_entities", ENTITY_LIST, kind="power_w",
+                  show=_src("ha_dsmr") + _PHASES, wizard=1),
+        )),
+        Part("timing", (
+            Field("meter_max_age_s", SLIDER, "s", step=5),
+            Field("meter_poll_s", SLIDER, "s",
+                  show=_src("homewizard_local")),
+        ), collapsed=True),
+    )),
+    Group("inverters", (
+        Part("", (Field("inverters", INVERTER_LIST, wizard=2),)),
+        # pv.py reads each entity's own unit, so a kW sensor is fine here.
+        Part("solar", (Field("ui.solar", SOLAR_LIST, kind="power",
+                             wizard=3),)),
+        # OPT-11: the switch that turns battery modes on. Each battery's mode
+        # and on/off switch are runtime state on the Batteries screen.
+        Part("modes", (
+            Field("battery_modes_enabled", TOGGLE),
+            # OPT-11 P4: the solar forecast; today's also on Settings, Simple.
+            Field("pv_forecast_entity", ENTITY, kind="energy", simple=True,
+                  note="forecast"),
+            Field("pv_forecast_tomorrow_entity", ENTITY, kind="energy"),
+            Field("solar_trust_pct", SLIDER, "%", step=5),
+        )),
+    )),
+    Group("tariff", (
+        Part("", (
+            # A contract without a feed is also the price used when a feed
+            # is down, so the fallback follows it (uimodel._tariff_encode).
+            Field("ui.contract", SEGMENTED, wizard=4, mirror="ui.fallback"),
+            Field("price_provider", SELECT, show=_DYNAMIC, wizard=4),
+            Field("price_formula", TEXT,
+                  show=_DYNAMIC + (("price_provider", "==", "custom_formula"),),
+                  wizard=4),
+            Field("price_csv_path", TEXT,
+                  show=_DYNAMIC + (("price_provider", "==", "manual_csv"),),
+                  wizard=4),
+            Field("ui.region", SELECT, wizard=4,
+                  fills="price_taxes_eur_kwh"),
+            Field("price_taxes_eur_kwh", NUMBER, "€/kWh", step=0.00001,
+                  wizard=4),
+            Field("price_markup_eur_kwh", NUMBER, "€/kWh", step=0.001,
+                  show=_DYNAMIC, wizard=4),
+            Field("export_price_eur_kwh", NUMBER, "€/kWh", step=0.001,
+                  wizard=4),
+            Field("price_export_formula", TEXT),
+            Field("ui.fallback", SEGMENTED, show=_DYNAMIC, wizard=4),
+            Field("ui.fixed_price", NUMBER, "€/kWh", step=0.01,
+                  show=(("ui.fallback", "==", "fixed"),), wizard=4),
+            Field("ui.day_price", NUMBER, "€/kWh", step=0.01,
+                  show=(("ui.fallback", "==", "daynight"),), wizard=4),
+            Field("ui.night_price", NUMBER, "€/kWh", step=0.01,
+                  show=(("ui.fallback", "==", "daynight"),), wizard=4),
+            Field("ui.periods", PERIOD_LIST, "€/kWh", step=0.01,
+                  show=(("ui.fallback", "==", "custom"),), wizard=4),
+        )),
+        Part("selling", (
+            # OPT-11: derived from the batteries' selling switches once battery
+            # modes exist (uimodel.arbitrage_from_batteries). A toggle until then.
+            Field("arbitrage_enabled", TOGGLE),
+            Field("cycle_cost_threshold_eur", NUMBER, "€/kWh", step=0.01),
+            Field("arbitrage_soc_floor", SLIDER, "%"),
+            Field("arbitrage_soc_ceiling", SLIDER, "%"),
+        )),
+        Part("feed", (
+            Field("price_feed_url", TEXT, show=_DYNAMIC),
+            Field("price_horizon_h", SLIDER, "h", show=_DYNAMIC),
+            Field("price_timeout_s", SLIDER, "s", show=_DYNAMIC),
+            Field("price_now_entity", ENTITY, kind="any"),
+            Field("price_avg_entity", ENTITY, kind="any"),
+        ), collapsed=True),
+    )),
+    Group("safety", (
+        Part("peak", (
+            Field("peak_cap_w", SLIDER, "kW", scale=1000, step=100,
+                  simple=True, wizard=5, note="month_peak"),
+            Field("peak_margin_w", SLIDER, "W", step=10),   # SAFETY-79
+            Field("peak_forecast_entity", ENTITY, kind="power_w", wizard=5),
+            Field("peak_soc_floor", LOCKED, "%"),
+        )),
+        Part("start", (
+            Field("shadow_mode", SEGMENTED, simple=True, wizard=6,
+                  note="shadow"),
+            Field("auto_start", TOGGLE),
+            Field("estop_fitted", TOGGLE),
+            Field("stale_input_s", SLIDER, "s"),
+            Field("meter_freeze_s", SLIDER, "s", step=30,
+                  show=_src("homewizard_local")),
+        )),
+        Part("stops", (
+            Field("sign_disagree_w", LOCKED, "W", step=10, show=_ONE),
+            Field("sign_disagree_s", LOCKED, "s", step=5, show=_ONE),
+            Field("unit_sign_disagree_w", LOCKED, "W", step=10,
+                  show=_SEVERAL),
+            Field("unit_sign_disagree_s", LOCKED, "s", step=5,
+                  show=_SEVERAL),
+            Field("site_sign_disagree_w", LOCKED, "W", step=10,
+                  show=_SEVERAL),
+            Field("site_sign_disagree_s", LOCKED, "s", step=5,
+                  show=_SEVERAL),
+            Field("circulation_w", LOCKED, "W", step=10, show=_SEVERAL),
+            Field("circulation_hold_s", LOCKED, "s", step=5, show=_SEVERAL),
+            Field("delivery_hold_s", LOCKED, "s", step=5, show=_SEVERAL),
+        ), collapsed=True),
+    )),
+    Group("maintenance", (
+        Part("", (
+            Field("maintenance_enabled", TOGGLE),
+            Field("maintenance_interval_days", SLIDER, "days", show=_MAINT),
+            Field("maintenance_start_hour", SELECT, show=_MAINT),
+            Field("maintenance_discharge_w", SLIDER, "W", step=100,
+                  show=_MAINT),
+            Field("maintenance_charge_w", SLIDER, "W", step=100,
+                  show=_MAINT),
+            Field("maintenance_soc_floor", SLIDER, "%", show=_MAINT),
+            Field("maintenance_soc_target", SLIDER, "%", show=_MAINT),
+            Field("maintenance_hold_min", SLIDER, "min", step=5,
+                  show=_MAINT),
+        )),
+        Part("support", (Field("log_level", SELECT),)),
+    )),
+    Group("tuning", (
+        Part("", (
+            Field("gain", LOCKED, step=0.05),
+            Field("slew_w", LOCKED, "W", step=50),
+            Field("deadband_w", LOCKED, "W"),
+            Field("target_grid_w", LOCKED, "W"),
+            Field("step_w", LOCKED, "W"),
+            Field("saturation_w", LOCKED, "W", step=10),
+            Field("saturation_cycles", LOCKED),
+            Field("integrator_max_w", LOCKED, "W", step=100),
+            Field("heartbeat_s", LOCKED, "s"),
+            Field("cycle_floor_s", LOCKED, "s"),
+        )),
+    ), support_only=True),
+)
+
+# --------------------------------------------------------------------------- #
+# UX-13 P4: the setup wizard. Its fields are the ones with `wizard=` above; this
+# is what the table cannot say per field (DECISIONS/UX-13-setup-wizard.md).
+# --------------------------------------------------------------------------- #
+WIZARD_STEPS = 6
+FINAL_STEP = WIZARD_STEPS       # a refusal on no wizard field is shown here
+OPTIONAL_STEPS = (3,)           # solar: "Next, or skip"
+
+# Step 1's kettle test. Per meter source Home Assistant reads: the page fields
+# read before and after a kettle is switched on, each with the sign it adds to
+# the grid reading, and what each direction means as (outcome, fields it
+# sets). Sets None: the options cannot fix it, so the step is not passed. A
+# source not listed is read by the add-on itself, so the page cannot test it.
+KETTLE_SOURCE = "meter_source"
+KETTLE_MIN_W = 500.0            # a kettle is 2 000 W, a house wobbles less
+KETTLE = {
+    "off": ((("meter_entity", 1),),
+            {"up": ("ok", {"meter_invert": False}),
+             "down": ("flip", {"meter_invert": True})}),
+    "ha_signed": ((("p1_net_entity", 1),),
+                  {"up": ("ok", {}), "down": ("wrong_signed", None)}),
+    "ha_dsmr": ((("p1_import_entity", 1), ("p1_export_entity", -1)),
+                {"up": ("ok", {}), "down": ("wrong_dsmr", None)}),
+}
+# Step 6 starts the site in shadow mode unless the installer switches it off:
+# (field, value when on, value when off).
+SHADOW = ("shadow_mode", "on", "auto")
+
+# Option keys the page never shows. uimodel.py writes each from page fields.
+DERIVED = {
+    "setpoint_entity": "inverters",       # one inverter, stored flat
+    "soc_entity": "inverters",
+    "batt_entity": "inverters",
+    "batt_invert": "inverters",
+    "max_w": "inverters",
+    "bms_soc_floor": "inverters",
+    "pv_entity": "ui.solar",              # one solar row, stored flat
+    "pv_entities": "ui.solar",
+    "pv_invert_entities": "ui.solar",     # the rows' "reads negative" toggles
+    "static_profile": "ui.fallback",      # built from the price fields
+    "price_taxes_profile": "ui.region",   # a preset writes it, "own" keeps it
+}
+# Option keys the page never shows and never writes: passed through as stored.
+HIDDEN: dict = {}
+
+
+def fields():
+    """Every field once, in page order, roster fields after `inverters`."""
+    for group in GROUPS:
+        for part in group.parts:
+            for field in part.fields:
+                yield group, part, field
+                if field.control == INVERTER_LIST:
+                    for sub in ROSTER_FIELDS:
+                        yield group, part, sub
+
+
+def field(key: str) -> Field | None:
+    return next((f for _g, _p, f in fields() if f.key == key), None)
+
+
+def visible(fld: Field, model: dict) -> bool:
+    """Whether `fld` is shown for this page model (uimodel.options_to_ui)."""
+    for name, op, value in fld.show:
+        have = model.get(name)
+        if op == "==" and have != value:
+            return False
+        if op == "!=" and have == value:
+            return False
+        if op == "in" and have not in value:
+            return False
+        try:
+            if op == ">" and not float(have) > value:
+                return False
+            if op == "<" and not float(have) < value:
+                return False
+        except (TypeError, ValueError):
+            return False
+    return True
+
+
+def range_of(key: str, schema_ui: list):
+    """(min, max) from the Supervisor's schema (`info["schema"]`), or None.
+
+    Never typed here: config.yaml is the one place a range is written. A range
+    arrives as lengthMin/lengthMax (tools/supervisor_selfapi_probe.py)."""
+    path = key.split(".")
+    nodes = schema_ui or []
+    for step in path[:-1]:
+        parent = next((n for n in nodes if n.get("name") == step), None)
+        nodes = (parent or {}).get("schema") or []
+    node = next((n for n in nodes if n.get("name") == path[-1]), None)
+    if not node or "lengthMin" not in node or "lengthMax" not in node:
+        return None
+    return node["lengthMin"], node["lengthMax"]
diff --git a/goodwe_controller/app/uimodel.py b/goodwe_controller/app/uimodel.py
new file mode 100644
index 0000000..332a864
--- /dev/null
+++ b/goodwe_controller/app/uimodel.py
@@ -0,0 +1,488 @@
+"""UX-13: stored options <-> the page model, for the keys the page derives.
+
+`options_to_ui()` turns the stored blob into what the page edits: always a list
+of inverter cards, solar rows with a "reads negative" toggle, a contract and
+simple prices or time windows (P5) instead of `static_profile` JSON, and a
+region preset instead of the levies figure. `ui_to_options()` turns it back, so the validator and the
+Supervisor always see the real blob.
+
+The rule that makes the round trip exact: the model carries the stored values
+of the derived keys (`keep`). A derivation whose page fields still read what
+`keep` decodes to writes `keep` back untouched, and only an edited one is
+re-encoded. So a blob the page cannot express (a `static_profile` with odd
+windows, a malformed roster) survives a save of some other field unchanged.
+See DECISIONS/UX-13-one-layout-table.md.
+"""
+
+import copy
+import json
+import re
+
+from .price import FLEMISH_TAXES_COMPONENTS_EUR_KWH, MAX_PLAUSIBLE_EUR_KWH
+from .static_tariff import (DAY_NAMES, MINUTES_PER_DAY, Period, ProfileInvalid,
+                            parse_static_profile)
+
+__all__ = ["options_to_ui", "ui_to_options", "ui_to_options_partial",
+           "REGION_PRESETS", "PERIOD_DAYS",
+           "arbitrage_from_batteries", "DeriveError", "COUNT", "GROWN"]
+
+
+class DeriveError(ValueError):
+    """The page model asks for something no options blob can say. `code` names
+    the sentence the page shows (app/ui_text `derive.<code>`), and `field` the
+    page field it is shown beside."""
+
+    def __init__(self, text, code="", field="", **values):
+        super().__init__(text)
+        self.code, self.field = code, field
+        self.values = values    # the sentence's {placeholders} (P5)
+        self.keys = ()          # the option keys the failed derivation writes
+
+
+# The page model's inverter count, which show conditions read, and what adding
+# a card sets: a second inverter turns the one flat inverter into a list.
+COUNT = "inverter_count"
+GROWN = {"inverter_shape": "list"}
+
+
+# --------------------------------------------------------------------------- #
+# Region presets for "Grid costs, levies and VAT". Year-stamped, updated each
+# January (owner, 2026-09-27). Only presets with a sourced figure are listed:
+# Flanders is app/price.py's Fluvius Antwerpen sum (TARIFF-18: Eneco
+# residential card, Flanders, September 2026, VAT included). Wallonia and
+# Brussels have a day and a night band (config.yaml) and join with sourced
+# figures; until then those sites choose "own".
+# --------------------------------------------------------------------------- #
+REGION_PRESETS = {
+    "flanders": {
+        "year": 2026,
+        "taxes_eur_kwh": round(sum(v for _n, v in
+                                   FLEMISH_TAXES_COMPONENTS_EUR_KWH), 5),
+        "taxes_profile": "",
+    },
+}
+OWN = "own"
+
+_ROSTER_FLAT = ("setpoint_entity", "soc_entity", "batt_entity", "batt_invert",
+                "max_w", "bms_soc_floor")
+_TOL = 1e-9
+
+
+def _blank(v) -> bool:
+    return v is None or (isinstance(v, str) and not v.strip())
+
+
+def _num(v):
+    try:
+        return None if _blank(v) or isinstance(v, bool) else float(v)
+    except (TypeError, ValueError):
+        return None
+
+
+# --- 1. one inverter (flat keys) or the `inverters` list -------------------- #
+def _roster_decode(o):
+    entries = o.get("inverters")
+    if entries is None or entries == "" or entries == []:
+        card = {k: o.get(k) for k in _ROSTER_FLAT}
+        card.update(name="", capacity_kwh=None)
+        return {"inverter_shape": "flat", "inverters": [card]}
+    if isinstance(entries, list) and all(isinstance(e, dict) for e in entries):
+        return {"inverter_shape": "list",
+                "inverters": [dict(e) for e in entries]}
+    # Not something a card can show: edited in the Configuration tab only.
+    return {"inverter_shape": "raw", "inverters": None}
+
+
+def _roster_encode(m, keep):
+    out = {}
+    shape, cards = m.get("inverter_shape"), m.get("inverters")
+    if shape == "raw":
+        raise DeriveError("the inverter list is edited in the Configuration tab",
+                          "raw_roster", "inverters")
+    if not cards:
+        raise DeriveError("at least one inverter is needed", "no_inverter",
+                          "inverters")
+    if shape == "flat" and len(cards) == 1:
+        card = cards[0]
+        if not _blank(card.get("name")) or not _blank(card.get("capacity_kwh")):
+            raise DeriveError("one inverter stored flat has no name or "
+                              "capacity", "flat_named", "inverters")
+        for k in _ROSTER_FLAT:
+            if card.get(k) is not None or k in keep:
+                out[k] = card.get(k)
+        out["inverters"] = []
+        return out
+    out["inverters"] = [{k: v for k, v in c.items() if v is not None}
+                        for c in cards]
+    # The flat keys beside a list are not read: they stay as stored.
+    out.update({k: copy.deepcopy(keep[k]) for k in _ROSTER_FLAT if k in keep})
+    if shape == "flat" or _roster_decode(keep)["inverter_shape"] == "flat":
+        # CFG-04 rule 9e: a flat power request entity beside a list is refused,
+        # so a list that replaces the flat inverter clears it.
+        out["setpoint_entity"] = ""
+    return out
+
+
+# --- 2. solar rows: pv_entity / pv_entities / pv_invert_entities ------------ #
+def _strs(v):
+    return [str(x).strip() for x in (v if isinstance(v, list) else [])
+            if not _blank(x)]
+
+
+def _solar_rows(o):
+    listed = _strs(o.get("pv_entities"))
+    if listed:
+        return listed, True
+    one = "" if _blank(o.get("pv_entity")) else str(o.get("pv_entity")).strip()
+    return ([one] if one else []), False
+
+
+def _solar_decode(o):
+    rows, _listed = _solar_rows(o)
+    flipped = set(_strs(o.get("pv_invert_entities")))
+    return {"ui.solar": [{"entity": e, "reversed": e in flipped}
+                         for e in rows]}
+
+
+def _solar_encode(m, keep):
+    out = {}
+    rows = [r for r in (m.get("ui.solar") or [])
+            if not _blank(r.get("entity"))]
+    entities = [str(r["entity"]).strip() for r in rows]
+    old_rows, was_list = _solar_rows(keep)
+    if len(entities) <= 1 and not was_list:
+        out["pv_entity"] = entities[0] if entities else ""
+        if "pv_entities" in keep:
+            out["pv_entities"] = []
+    else:
+        out["pv_entities"] = entities
+        if "pv_entity" in keep:
+            out["pv_entity"] = ""       # TEL-12: the list replaces it
+    # Flips of entities that were never a row stay as stored (pv.stray_inverts
+    # reports them). Flips of removed rows go with the row.
+    extras = [x for x in _strs(keep.get("pv_invert_entities"))
+              if x not in old_rows and x not in entities]
+    flips = [e for e, r in zip(entities, rows) if r.get("reversed")] + extras
+    if flips or "pv_invert_entities" in keep:
+        out["pv_invert_entities"] = flips
+    return out
+
+
+# --- 3. contract and static_profile ----------------------------------------- #
+def _fixed_json(price) -> str:
+    return json.dumps({"periods": [
+        {"name": "all", "from": "00:00", "to": "24:00", "days": "mon-sun",
+         "eur_per_kwh": price}]})
+
+
+def _daynight_json(day, night) -> str:
+    return json.dumps({"periods": [
+        {"name": "day", "from": "07:00", "to": "22:00", "days": "mon-fri",
+         "eur_per_kwh": day},
+        {"name": "night", "from": "22:00", "to": "07:00", "days": "mon-fri",
+         "eur_per_kwh": night},
+        {"name": "night", "from": "00:00", "to": "24:00", "days": "sat,sun",
+         "eur_per_kwh": night}]})
+
+
+def _shape(text):
+    """The periods of a profile without their names, for comparing, or None."""
+    try:
+        prof = parse_static_profile(text)
+    except ProfileInvalid:
+        return None
+    if prof is None:
+        return ()
+    return tuple(sorted((p.start_min, p.end_min, tuple(sorted(p.days)),
+                         p.eur_per_kwh) for p in prof.periods))
+
+
+def _profile_decode(raw):
+    """("none"|"fixed"|"daynight"|"custom", fixed, day, night)."""
+    if isinstance(raw, str) and _blank(raw):
+        return "none", None, None, None
+    if not isinstance(raw, str):
+        return "custom", None, None, None
+    got = _shape(raw)
+    if not got:
+        return ("none" if got == () else "custom"), None, None, None
+    if len(got) == 1 and got == _shape(_fixed_json(got[0][3])):
+        return "fixed", got[0][3], None, None
+    day = next((p[3] for p in got if p[:2] == (420, 1320)), None)
+    night = next((p[3] for p in got if p[:2] == (1320, 420)), None)
+    if (day is not None and night is not None
+            and got == _shape(_daynight_json(day, night))):
+        return "daynight", None, day, night
+    return "custom", None, None, None
+
+
+# --- 3b. the time-window editor (UX-13 P5) ---------------------------------- #
+# Each row is {"from", "to", "days", "price"} and, when read from a stored
+# profile, its "name". `days` is one of these; a profile with any other day set
+# is edited in the Configuration tab only (`ui.periods` is None).
+PERIOD_DAYS = ("mon-sun", "mon-fri", "sat,sun") + DAY_NAMES
+_DAYSETS = {d: frozenset(range(7)) if d == "mon-sun" else
+            frozenset(range(5)) if d == "mon-fri" else
+            frozenset((5, 6)) if d == "sat,sun" else
+            frozenset((DAY_NAMES.index(d),)) for d in PERIOD_DAYS}
+_TIME = re.compile(r"^\s*(\d{1,2}):(\d{2})\s*$")
+
+
+def _hhmm(minute) -> str:
+    return f"{minute // 60:02d}:{minute % 60:02d}"
+
+
+def _periods_decode(raw):
+    """The rows for a stored profile: [] when unset, None when it cannot be
+    shown as rows (unparsable, or days the editor has no choice for)."""
+    try:
+        prof = parse_static_profile(raw) if isinstance(raw, str) else None
+    except ProfileInvalid:
+        return None
+    if prof is None:
+        return [] if isinstance(raw, str) else None
+    rows = []
+    for p in prof.periods:
+        days = next((d for d, s in _DAYSETS.items() if s == p.days), None)
+        if days is None:
+            return None
+        rows.append({"from": _hhmm(p.start_min), "to": _hhmm(p.end_min),
+                     "days": days, "price": p.eur_per_kwh, "name": p.name})
+    return rows
+
+
+def _minute(text, *, end):
+    """"07:00" -> 420, "24:00" -> 1440 as an end, else None."""
+    m = _TIME.match(str(text or ""))
+    if not m:
+        return None
+    h, mi = int(m.group(1)), int(m.group(2))
+    if mi > 59 or h > 24 or (h == 24 and (mi or not end)):
+        return None
+    return h * 60 + mi
+
+
+def _periods_json(rows) -> str:
+    """The static_profile for the editor's rows, or DeriveError naming the
+    first problem: a bad time, an empty price, an overlap or a gap."""
+    if not rows:
+        raise DeriveError("add at least one time window", "no_periods",
+                          "ui.periods")
+    periods = []
+    for i, row in enumerate(rows, start=1):
+        row = row if isinstance(row, dict) else {}
+        start = _minute(row.get("from"), end=False)
+        end = _minute(row.get("to"), end=True)
+        if start is None or end is None:
+            raise DeriveError(f"window {i} has a bad time", "period_time",
+                              "ui.periods", row=i)
+        end = end or MINUTES_PER_DAY            # "00:00" as an end
+        if start == end:
+            raise DeriveError(f"window {i} is empty", "period_zero",
+                              "ui.periods", row=i)
+        price = _num(row.get("price"))
+        if price is None:
+            raise DeriveError(f"window {i} needs a price", "period_price",
+                              "ui.periods", row=i)
+        if abs(price) > MAX_PLAUSIBLE_EUR_KWH:
+            raise DeriveError(f"window {i}'s price is out of range",
+                              "period_price_range", "ui.periods", row=i)
+        if row.get("days") not in _DAYSETS:
+            raise DeriveError(f"window {i} has no days", "unknown",
+                              "ui.periods")
+        name = str(row.get("name") or "").strip() or f"window{i}"
+        periods.append(Period(name=name, start_min=start, end_min=end,
+                              days=_DAYSETS[row["days"]],
+                              eur_per_kwh=price))
+    _tiling(periods)
+    return json.dumps({"periods": [
+        {"name": p.name, "from": _hhmm(p.start_min),
+         "to": _hhmm(p.end_min), "days": row["days"],
+         "eur_per_kwh": p.eur_per_kwh}
+        for p, row in zip(periods, rows)]})
+
+
+def _tiling(periods):
+    """Each minute of the week in exactly one window, as static_tariff.py
+    requires. The first overlap or gap, by day and time, is the error."""
+    for day in range(7):
+        start, kind, rows = None, None, None
+        for minute in range(MINUTES_PER_DAY + 1):
+            here = [i for i, p in enumerate(periods, start=1)
+                    if minute < MINUTES_PER_DAY and p.covers(day, minute)]
+            now = ("gap" if not here else "overlap" if len(here) > 1
+                   else None) if minute < MINUTES_PER_DAY else "end"
+            if kind is not None and (now != kind or (kind == "overlap"
+                                                     and here != rows)):
+                values = {"day": DAY_NAMES[day], "from": _hhmm(start),
+                          "to": _hhmm(minute)}
+                if kind == "gap":
+                    raise DeriveError("a time has no window", "period_gap",
+                                      "ui.periods", **values)
+                raise DeriveError("two windows cover one time",
+                                  "period_overlap", "ui.periods",
+                                  a=rows[0], b=rows[1], **values)
+            if now in ("gap", "overlap") and kind is None:
+                start, kind, rows = minute, now, here
+
+
+def _tariff_decode(o):
+    raw = o.get("static_profile", "")
+    kind, fixed, day, night = _profile_decode(raw)
+    provider = o.get("price_provider")
+    dynamic = not _blank(provider) and provider != "off"
+    return {"ui.contract": "dynamic" if dynamic else kind,
+            "price_provider": provider, "ui.fallback": kind,
+            "ui.fixed_price": fixed, "ui.day_price": day,
+            "ui.night_price": night, "ui.periods": _periods_decode(raw)}
+
+
+def _tariff_encode(m, keep):
+    out = {}
+    contract = m.get("ui.contract")
+    if contract == "dynamic":
+        if _blank(m.get("price_provider")) or m.get("price_provider") == "off":
+            raise DeriveError("a dynamic contract needs a price source",
+                              "no_source", "price_provider")
+        out["price_provider"] = m["price_provider"]
+        kind = m.get("ui.fallback")
+    else:
+        out["price_provider"] = "off"
+        kind = contract
+    if kind == "none":
+        out["static_profile"] = ""
+    elif kind == "fixed":
+        out["static_profile"] = _fixed_json(_price_of(m, "ui.fixed_price"))
+    elif kind == "daynight":
+        out["static_profile"] = _daynight_json(_price_of(m, "ui.day_price"),
+                                               _price_of(m, "ui.night_price"))
+    elif kind == "custom":
+        rows = m.get("ui.periods")
+        if rows is not None:
+            out["static_profile"] = _periods_json(rows)
+        elif "static_profile" not in keep:
+            raise DeriveError("odd tariff windows are edited in the "
+                              "Configuration tab", "custom_profile",
+                              "ui.contract")
+        else:
+            # Days the editor cannot show: kept as stored.
+            out["static_profile"] = keep["static_profile"]
+    else:
+        raise DeriveError(f"unknown contract {kind!r}", "unknown",
+                          "ui.contract")
+    return out
+
+
+def _price_of(m, name):
+    value = _num(m.get(name))
+    if value is None:
+        raise DeriveError(f"{name} needs a price", "no_price", name)
+    return value
+
+
+# --- 4. region preset -> price_taxes_eur_kwh / price_taxes_profile ---------- #
+def _region_decode(o):
+    taxes, profile = o.get("price_taxes_eur_kwh"), o.get("price_taxes_profile", "")
+    region = OWN
+    for rid, p in REGION_PRESETS.items():
+        same = _num(taxes) is not None and abs(_num(taxes) - p["taxes_eur_kwh"]) < _TOL
+        if same and str(profile or "").strip() == p["taxes_profile"]:
+            region = rid
+    return {"ui.region": region, "price_taxes_eur_kwh": taxes}
+
+
+def _region_encode(m, keep):
+    region = m.get("ui.region")
+    if region == OWN:
+        out = {"price_taxes_eur_kwh": m.get("price_taxes_eur_kwh")}
+        if "price_taxes_profile" in keep:       # "own" keeps the stored table
+            out["price_taxes_profile"] = keep["price_taxes_profile"]
+        return out
+    if region not in REGION_PRESETS:
+        raise DeriveError(f"unknown region {region!r}", "unknown", "ui.region")
+    p = REGION_PRESETS[region]
+    out = {"price_taxes_eur_kwh": p["taxes_eur_kwh"]}
+    if p["taxes_profile"] or "price_taxes_profile" in keep:
+        out["price_taxes_profile"] = p["taxes_profile"]
+    return out
+
+
+# --- 5. arbitrage_enabled: the OPT-11 hook ---------------------------------- #
+def arbitrage_from_batteries(m):
+    """OPT-11 hook. With battery modes on, `arbitrage_enabled` is true when any
+    battery may sell. Battery modes are not built yet, so this returns None and
+    the toggle is stored as the page has it: no behaviour change."""
+    return None
+
+
+def _arbitrage_decode(o):
+    return {"arbitrage_enabled": o.get("arbitrage_enabled")}
+
+
+def _arbitrage_encode(m, keep):
+    derived = arbitrage_from_batteries(m)
+    value = m.get("arbitrage_enabled") if derived is None else derived
+    return {} if value is None and "arbitrage_enabled" not in keep \
+        else {"arbitrage_enabled": value}
+
+
+# (option keys it writes, decode, encode). Each is independent of the others.
+DERIVATIONS = (
+    (("inverters",) + _ROSTER_FLAT, _roster_decode, _roster_encode),
+    (("pv_entity", "pv_entities", "pv_invert_entities"), _solar_decode,
+     _solar_encode),
+    (("price_provider", "static_profile"), _tariff_decode, _tariff_encode),
+    (("price_taxes_eur_kwh", "price_taxes_profile"), _region_decode,
+     _region_encode),
+    (("arbitrage_enabled",), _arbitrage_decode, _arbitrage_encode),
+)
+_OWNED = {k for keys, _d, _e in DERIVATIONS for k in keys}
+_MODEL_ONLY = ("keep", "inverter_shape", "inverter_count", "region_year")
+
+
+def options_to_ui(options: dict) -> dict:
+    """The page model for a stored blob. Pure: reads nothing else."""
+    model = {k: copy.deepcopy(v) for k, v in options.items()
+             if k not in _OWNED}
+    for _keys, decode, _encode in DERIVATIONS:
+        model.update(decode(options))
+    model["keep"] = {k: copy.deepcopy(options[k]) for k in _OWNED
+                     if k in options}
+    cards = model.get("inverters")
+    model["inverter_count"] = len(cards) if isinstance(cards, list) else None
+    preset = REGION_PRESETS.get(model["ui.region"])
+    model["region_year"] = preset["year"] if preset else None
+    return model
+
+
+def ui_to_options(model: dict) -> dict:
+    """The options blob for a page model. Raises DeriveError on a model no blob
+    can express, so the page says so instead of saving something else."""
+    out, errors = ui_to_options_partial(model)
+    if errors:
+        raise errors[0]
+    return out
+
+
+def ui_to_options_partial(model: dict):
+    """(blob, [DeriveError]): every derivation that can be made, and the
+    stored values (`keep`) for each one that cannot. For the checks only, so a
+    step can be blocked by its own field and the rest still checked (UX-15
+    F1). Never saved: `ui_to_options()` raises instead."""
+    keep = model.get("keep") or {}
+    out = {k: copy.deepcopy(v) for k, v in model.items()
+           if k not in _MODEL_ONLY and k not in _OWNED
+           and not k.startswith("ui.")}
+    errors = []
+    for keys, decode, encode in DERIVATIONS:
+        was = decode(keep)
+        if all(model.get(name) == value for name, value in was.items()):
+            out.update({k: copy.deepcopy(keep[k]) for k in keys if k in keep})
+            continue
+        try:
+            out.update(encode(model, keep))
+        except DeriveError as err:
+            err.keys = keys
+            errors.append(err)
+            out.update({k: copy.deepcopy(keep[k]) for k in keys if k in keep})
+    return out, errors
diff --git a/goodwe_controller/app/uipage.py b/goodwe_controller/app/uipage.py
new file mode 100644
index 0000000..f6ecf1a
--- /dev/null
+++ b/goodwe_controller/app/uipage.py
@@ -0,0 +1,403 @@
+"""UX-13 P2: the settings view's server half. It names no option key.
+
+It turns app/uilayout.py's table into the JSON the page draws from (labels
+from the Supervisor's translations, ranges and choices from its schema, page
+words from app/ui_text), turns a posted page model into options through
+app/uimodel.py, and says beside which page field each validator sentence
+goes. The rules stay in validate.py and the sentences are passed on as they
+are (DECISIONS/UX-13-one-layout-table.md).
+"""
+
+import copy
+import os
+import re
+
+from . import uilayout as L
+from . import uitext
+from . import uimodel as U
+from .configui import help_of, label_of, problems_by_field, split_group
+from .validate import power_request_entities
+
+# A choice the page cannot make, only keep. None since P5's period editor.
+ONLY_IF_HELD = ()
+_TIERS = ("bad", "warn", "info")
+
+
+def ui_text(lang="en") -> dict:
+    """The page words in `lang`, English where Dutch has no key (P5)."""
+    return copy.deepcopy(uitext.words(lang))
+
+
+def _roster():
+    """The inverter list field's key, read off the table."""
+    return next(f.key for _g, _p, f in L.fields()
+                if f.control == L.INVERTER_LIST)
+
+
+def _node(schema_ui, key):
+    """The Supervisor's schema entry for `key` (`list.sub` too), or {}."""
+    nodes, path = schema_ui or [], key.split(".")
+    for step in path[:-1]:
+        parent = next((n for n in nodes if n.get("name") == step), None)
+        nodes = (parent or {}).get("schema") or []
+    return next((n for n in nodes if n.get("name") == path[-1]), None) or {}
+
+
+def _words(translations, lang, key, T):
+    """(label, help) for a field: ui_text for `ui.` fields, else the
+    translation without its `Group · ` prefix, and the raw key last."""
+    if key.startswith("ui."):
+        entry = T["fields"].get(key[3:], {})
+        return entry.get("name", key), entry.get("description", "")
+    path = tuple(key.split(".")[:-1])
+    name = key.split(".")[-1]
+    label, _lang = label_of(translations, lang, name, path)
+    text, _lang = help_of(translations, lang, name, path)
+    return split_group(label)[1], text
+
+
+def _choices(fld, node, T, value_type):
+    """[[value, label, only_if_held], ...] for a choice control, or None."""
+    if fld.control not in (L.SEGMENTED, L.SELECT, L.CHOICE):
+        return None
+    name = fld.key[3:] if fld.key.startswith("ui.") else fld.key
+    words = T["choices"].get(name) or {}
+    if fld.key.startswith("ui."):
+        values = list(words)
+    elif node.get("options"):
+        values = [v for v in node["options"] if not words or v in words]
+    elif value_type == "integer" and node.get("lengthMax") is not None:
+        values = list(range(int(node["lengthMin"]), int(node["lengthMax"]) + 1))
+        if words:
+            values = [v for v in values if str(v) in words]
+    else:
+        return []
+    out = []
+    for v in values:
+        label = words.get(str(v))
+        if label is None:
+            label = (T["settings"]["hour"].replace("{hour}", f"{v:02d}")
+                     if isinstance(v, int) else str(v))
+        preset = U.REGION_PRESETS.get(v) if fld.fills else None
+        if preset:
+            label = f"{label}, " + T["settings"]["region_year"].replace(
+                "{year}", str(preset["year"]))
+        out.append([v, label, v in ONLY_IF_HELD])
+    return out
+
+
+def _field(fld, schema_ui, translations, lang, T):
+    node = _node(schema_ui, fld.key)
+    label, text = _words(translations, lang, fld.key, T)
+    if fld.unit:
+        # The page shows the unit beside the control, in its own scale (kW),
+        # so the translation's "(W)" goes; "(optional)" stays.
+        label = re.sub(r"\s*\([^()\s]{1,6}\)", "", label)
+    value_type = ("float" if fld.control == L.NUMBER and fld.key.startswith("ui.")
+                  else node.get("type") or "")
+    out = {"key": fld.key, "control": fld.control, "label": label,
+           "help": text, "unit": fld.unit, "scale": fld.scale,
+           "step": fld.step, "kind": fld.kind,
+           "show": [list(c) for c in fld.show], "applies": fld.applies,
+           "wizard": fld.wizard, "simple": fld.simple, "note": fld.note,
+           "type": value_type, "optional": not node.get("required", False),
+           # A choice mirrored into a field also shows (and finds) its keys.
+           "writes": sorted(k for k, how in L.DERIVED.items()
+                            if how in (fld.key, fld.mirror))}
+    if node.get("lengthMin") is not None:
+        out["min"] = node["lengthMin"]
+    if node.get("lengthMax") is not None:
+        out["max"] = node["lengthMax"]
+    choices = _choices(fld, node, T, value_type)
+    if choices is not None:
+        out["choices"] = choices
+        name = fld.key[3:] if fld.key.startswith("ui.") else fld.key
+        later = T.get("choices_later", {}).get(name)
+        if later:
+            out["later"] = [[v, words] for v, words in later.items()]
+        hints = T.get("choice_help", {}).get(name)
+        if hints:
+            out["hints"] = {v: e.get("description", "")
+                            for v, e in hints.items()}
+    if fld.control == L.PERIOD_LIST:
+        # P5: the day choices of one time window, in the editor's order.
+        names = T["choices"]["period_days"]
+        out["days"] = [[d, names.get(d, d)] for d in U.PERIOD_DAYS]
+    if fld.mirror:
+        out["mirror"] = fld.mirror
+    if fld.fills:
+        out["fills"] = fld.fills
+        out["presets"] = {rid: {"year": p["year"], "value": p["taxes_eur_kwh"]}
+                          for rid, p in U.REGION_PRESETS.items()}
+    roster = _roster()
+    if fld.key.startswith(roster + "."):
+        sub = fld.key[len(roster) + 1:]
+        if L.DERIVED.get(sub) == roster:
+            out["flat"] = sub           # how the one flat inverter stores it
+    if fld.control == L.INVERTER_LIST:
+        out["fields"] = [_field(sub, schema_ui, translations, lang, T)
+                         for sub in L.ROSTER_FIELDS]
+        out["count"] = U.COUNT
+        out["grow"] = dict(U.GROWN)
+        out["shape"] = next(iter(U.GROWN))
+    return out
+
+
+def layout(schema_ui, translations, lang="en") -> dict:
+    """Every group, part and field of the Installer view, as the page draws
+    it. Built from the table only: a field the table places is on the page."""
+    T = ui_text(lang)
+    groups = []
+    for g in L.GROUPS:
+        parts = []
+        for p in g.parts:
+            words = T["parts"].get(f"{g.id}.{p.id}", {}) if p.id else {}
+            parts.append({"id": p.id, "name": words.get("name", ""),
+                          "description": words.get("description", ""),
+                          "collapsed": p.collapsed,
+                          "fields": [_field(f, schema_ui, translations, lang, T)
+                                     for f in p.fields]})
+        words = T["groups"].get(g.id, {})
+        applies = sorted({f.applies for p in g.parts for f in p.fields})
+        groups.append({"id": g.id, "name": words.get("name", g.id),
+                       "description": words.get("description", ""),
+                       "support_only": g.support_only,
+                       "applies": [T["applies"][a]["name"] for a in applies],
+                       "parts": parts})
+    return {"groups": groups}
+
+
+# --------------------------------------------------------------------------- #
+# The page model -> options, for the validator and the save
+# --------------------------------------------------------------------------- #
+def _same(a, b) -> bool:
+    """Equal as the Supervisor stores it: 3 and 3.0 alike, True and 1 not."""
+    if isinstance(a, bool) or isinstance(b, bool):
+        return type(a) is type(b) and a == b
+    if isinstance(a, (int, float)) and isinstance(b, (int, float)):
+        return a == b
+    if isinstance(a, list) and isinstance(b, list):
+        return len(a) == len(b) and all(_same(x, y) for x, y in zip(a, b))
+    if isinstance(a, dict) and isinstance(b, dict):
+        return a.keys() == b.keys() and all(_same(a[k], b[k]) for k in a)
+    return type(a) is type(b) and a == b
+
+
+def to_options(model: dict, stored: dict | None = None) -> dict:
+    """The options blob for a posted page model. A value equal to the stored
+    one is written as stored, in the stored key order, so a save that changed
+    nothing writes an identical blob (the browser reads 3.0 as 3)."""
+    return _settle(U.ui_to_options(model), stored)
+
+
+def to_options_partial(model: dict, stored: dict | None = None):
+    """(blob, [DeriveError]) for the checks: `uimodel.ui_to_options_partial`,
+    settled like `to_options`. Never saved (UX-15 F1)."""
+    out, errors = U.ui_to_options_partial(model)
+    return _settle(out, stored), errors
+
+
+def only_edits(mine: dict, base: dict, stored: dict) -> dict:
+    """The blob to save: `stored`, with the keys whose value in `mine` (this
+    page's model) differs from `base` (the model it opened) set to `mine`'s.
+    A key this page never edited keeps what is stored now, even when another
+    surface changed it meanwhile (UX-13 P4 test, F2)."""
+    edits = {k: v for k, v in mine.items()
+             if k not in base or not _same(v, base[k])}
+    gone = {k for k in base if k not in mine}
+    out = {k: copy.deepcopy(edits.get(k, v)) for k, v in stored.items()
+           if k not in gone}
+    out.update({k: copy.deepcopy(v) for k, v in edits.items()
+                if k not in out})
+    return out
+
+
+def _settle(out: dict, stored: dict | None) -> dict:
+    stored = stored or {}
+    for k, v in out.items():
+        if k in stored and _same(v, stored[k]):
+            out[k] = copy.deepcopy(stored[k])
+    return ({k: out[k] for k in stored if k in out}
+            | {k: v for k, v in out.items() if k not in stored})
+
+
+def derive_message(err: U.DeriveError, lang="en") -> dict:
+    T = uitext.words(lang)
+    words = T["settings"]["derive"]
+    text = words.get(err.code, words["unknown"])["description"]
+    args = dict(getattr(err, "values", None) or {})
+    # A time window's day is shown by name (P5 period editor).
+    if "day" in args:
+        args["day"] = T["choices"]["period_days"].get(args["day"], args["day"])
+    return {"field": err.field or None, "card": None, "tier": "bad",
+            "text": uitext.say(text, **args)}
+
+
+def derive_messages(errors, problems, notes, model, keys, lang="en"):
+    """The page's messages when part of the model could not become options:
+    each conversion's own sentence beside its field, then the checks of the
+    rest. A refusal or note about a key the failed conversion writes is left
+    out, because it judges the stored value, not what the page shows."""
+    failed = {k for err in errors for k in err.keys}
+    by_key, unanchored = problems_by_field(problems, keys)
+    kept = [t for k, texts in by_key.items() if k not in failed
+            for t in texts] + list(unanchored)
+    kept = [p for p in problems if p in kept]
+    notes = [n for n in notes if not set(n.keys or ()) & failed]
+    return ([derive_message(err, lang) for err in errors]
+            + anchors(kept, notes, model, keys))
+
+
+# --------------------------------------------------------------------------- #
+# Where a sentence goes on the page
+# --------------------------------------------------------------------------- #
+# `inverters.max_w`, or `inverters[1].setpoint_entity` for one card.
+_SUB = re.compile(r"(?<![A-Za-z0-9_])([a-z_0-9]+)(?:\[(\d+)\])?\.([a-z_0-9]+)")
+
+
+def _mirror_of(key):
+    return next((f.key for _g, _p, f in L.fields() if f.mirror == key), None)
+
+
+def targets(key: str, text: str, model: dict) -> list:
+    """[(page field, card)] for a sentence that names option `key`. `card` is
+    the inverter card's index, or None."""
+    roster = _roster()
+    cards = model.get(roster) if isinstance(model.get(roster), list) else []
+    names = [c.get("name") for c in cards if isinstance(c, dict)]
+    # messages.setting(): “Inverter rating” for inverter-b (inverters.max_w),
+    # or a roster rule's own `inverters[1] (inverter-b)`.
+    card = next((i for i, n in enumerate(names)
+                 if n and f"for {n} ({roster}." in text), None)
+    index = re.search(re.escape(roster) + r"\[(\d+)\]", text)
+    if card is None and index and int(index.group(1)) < len(cards):
+        card = int(index.group(1))
+    if key == roster:
+        subs = [(f"{roster}.{s}", int(i) if i and int(i) < len(cards) else card)
+                for r, i, s in _SUB.findall(text) if r == roster]
+        subs = [x for x in dict.fromkeys(subs) if L.field(x[0])]
+        return subs or [(roster, card)]
+    if key in L.DERIVED:
+        how = L.DERIVED[key]
+        if how == roster:
+            return [(f"{roster}.{key}", 0 if card is None else card)]
+        fld = L.field(how)
+        if fld is not None and not L.visible(fld, model) and _mirror_of(how):
+            return [(_mirror_of(how), None)]
+        return [(how, None)]
+    if L.field(key) is not None:
+        return [(key, None)]
+    return [(None, None)]
+
+
+def anchors(problems, notes, model, keys) -> list:
+    """[{field, card, tier, text}] for the refusals and notes. `field` is
+    None for a sentence that names no setting on the page."""
+    out, seen = [], set()
+
+    def add(field, card, tier, text):
+        if (field, card, text) not in seen:
+            seen.add((field, card, text))
+            out.append({"field": field, "card": card, "tier": tier,
+                        "text": text})
+
+    by_key, unanchored = problems_by_field(problems, keys)
+    for key, texts in by_key.items():
+        for text in texts:
+            for field, card in targets(key, text, model):
+                add(field, card, "bad", text)
+    for text in unanchored:
+        add(None, None, "bad", text)
+    for note in notes:
+        tier = note.tier if note.tier in _TIERS else "info"
+        for key in note.keys or (None,):
+            for field, card in (targets(key, note.text, model) if key
+                                else [(None, None)]):
+                add(field, card, tier, note.text)
+    # A sentence placed on one inverter's field is not also put on the list.
+    roster = _roster()
+    placed = {m["text"] for m in out
+              if (m["field"] or "").startswith(roster + ".")}
+    return [m for m in out if not (m["field"] == roster
+                                   and m["text"] in placed)]
+
+
+def fields_of(keys, model) -> list:
+    """The page fields that show these option keys (a stale save's list)."""
+    return list(dict.fromkeys(f for k in keys for f, _c in targets(k, "", model)
+                              if f))
+
+
+# --------------------------------------------------------------------------- #
+# UX-13 P4: the setup wizard (DECISIONS/UX-13-setup-wizard.md)
+# --------------------------------------------------------------------------- #
+# Store keys (app/store.py), not options. SETUP_DONE is written when the
+# wizard saves. STARTED is the one control's Start and Stop write.
+SETUP_DONE = "setup_done"
+STARTED = "auto"
+
+
+def setup_needed(stored: dict, store_data, started, fresh=False) -> str | None:
+    """Why the page opens the wizard by itself, or None.
+
+    "no_power_request": the stored options name no inverter to control, so
+    the add-on cannot start on them. "first_start": a new install. This boot
+    found no Store file (`fresh`), the wizard never saved and control was never
+    started or stopped. `fresh` is what tells a new install from an old site
+    that was never started, e.g. one left in shadow for weeks (TEST-23).
+    `store_data` is the Store's dict (None: unknown, so no), `started` is
+    whether control is started now."""
+    if not power_request_entities(stored or {}):
+        return "no_power_request"
+    if store_data is None or not fresh:
+        return None
+    if store_data.get(SETUP_DONE) or STARTED in store_data or started:
+        return None
+    return "first_start"
+
+
+def setup_spec() -> dict:
+    """What the wizard needs beyond each field's step: read off the table."""
+    kettle = {}
+    for source, (read, outcomes) in L.KETTLE.items():
+        kettle[source] = {"read": [[f, sign] for f, sign in read]}
+        for way, (say, sets) in outcomes.items():
+            kettle[source][way] = {"say": say, "sets": sets}
+    field, on, off = L.SHADOW
+    return {"steps": L.WIZARD_STEPS, "final": L.FINAL_STEP,
+            "optional": list(L.OPTIONAL_STEPS),
+            "kettle": {"source": L.KETTLE_SOURCE, "min_w": L.KETTLE_MIN_W,
+                       "sources": kettle},
+            "shadow": {"field": field, "on": on, "off": off}}
+
+
+def kettle(source, before_w, after_w):
+    """The kettle test's verdict, as the page reaches it (settings.js
+    `kettleOutcome`): (outcome, fields it sets or None, change in W), or None
+    for a source the page cannot read."""
+    spec = L.KETTLE.get(source)
+    if spec is None:
+        return None
+    change = float(after_w) - float(before_w)
+    if abs(change) < L.KETTLE_MIN_W:
+        return "none", None, change
+    say, sets = spec[1]["up" if change > 0 else "down"]
+    return say, (dict(sets) if sets is not None else None), change
+
+
+def step_of(field_key, model) -> int:
+    """The wizard step a sentence on this page field blocks: the field's own
+    step while it is shown, else the last step, which lists everything."""
+    fld = L.field(field_key) if field_key else None
+    if fld is None or not fld.wizard or not L.visible(fld, model):
+        return L.FINAL_STEP
+    return fld.wizard
+
+
+def step_problems(messages, model) -> dict:
+    """{"1": n, ...}: how many refusals block each wizard step."""
+    out = {str(n): 0 for n in range(1, L.WIZARD_STEPS + 1)}
+    for m in messages:
+        if m.get("tier") == "bad":
+            out[str(step_of(m.get("field"), model))] += 1
+    return out
diff --git a/goodwe_controller/app/uitext.py b/goodwe_controller/app/uitext.py
new file mode 100644
index 0000000..d6caf53
--- /dev/null
+++ b/goodwe_controller/app/uitext.py
@@ -0,0 +1,51 @@
+"""UX-13 P5: the page's words, app/ui_text/<lang>.json, in English or Dutch.
+
+One file per language with the same keys. A key missing from a language falls
+back to English, key by key, the way the Supervisor's translations do.
+test_ui_text.py holds both files to STYLE.md and to each other.
+"""
+
+import copy
+import io
+import json
+import os
+
+DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ui_text")
+LANGS = ("en", "nl")
+_CACHE: dict = {}
+
+
+def lang_of(value) -> str:
+    """"nl", "nl-BE" or "nl_NL" -> "nl"; anything else -> "en"."""
+    head = str(value or "").strip().lower().replace("_", "-").split("-")[0]
+    return head if head in LANGS else "en"
+
+
+def raw(lang: str) -> dict:
+    """One language file as written, without the English fallback."""
+    if lang not in _CACHE:
+        with io.open(os.path.join(DIR, f"{lang}.json"), encoding="utf-8") as f:
+            _CACHE[lang] = json.load(f)
+    return _CACHE[lang]
+
+
+def _merge(base, over):
+    if not (isinstance(base, dict) and isinstance(over, dict)):
+        return copy.deepcopy(over)
+    out = copy.deepcopy(base)
+    for k, v in over.items():
+        out[k] = _merge(base.get(k), v) if k in base else copy.deepcopy(v)
+    return out
+
+
+def words(lang="en") -> dict:
+    """Every word in `lang`, English where a key is missing."""
+    lang = lang_of(lang)
+    return raw("en") if lang == "en" else _merge(raw("en"), raw(lang))
+
+
+def say(template: str, **values) -> str:
+    """Fill `{name}` placeholders, as settings.js `say()` does."""
+    for k, v in values.items():
+        template = template.replace("{" + k + "}", str(v))
+    return template
diff --git a/goodwe_controller/app/validate.py b/goodwe_controller/app/validate.py
index e0627fd..e49e0ca 100644
--- a/goodwe_controller/app/validate.py
+++ b/goodwe_controller/app/validate.py
@@ -243,6 +243,13 @@ NOT READY banner already names the problem, (b) does not apply.
      note below on `gain`, which is the term that owns that and which SAFETY-39
      measured and did not change.
 
+ 12. `peak_margin_w` outside 0-500 W, not whole, or not below `peak_cap_w`.
+     SAFETY-79; the Supervisor checks the range too, but not for sim/inject.py.
+
+ 13. OPT-11 P4: `solar_trust_pct` outside 30-100 or not whole, or a solar
+     forecast entity that is not a `sensor.` id. A trust of 0 or 500 % would
+     make the day plan buy everything or nothing, which no one means.
+
 WHAT IS DELIBERATELY *NOT* REFUSED, because it is untidy rather than unsafe:
 
   - `integrator_max_w` above `max_w`. DOCS.md is right that the only thing the
@@ -321,7 +328,10 @@ WHAT IS DELIBERATELY *NOT* REFUSED, because it is untidy rather than unsafe:
 """
 
 import logging
+import re
+from typing import NamedTuple
 
+from . import dayplan, messages, pv, solarfc
 from .arbitrage import enabled as arbitrage_on
 from .control import SLEW_RAIL_FRAC, LOOP_TICK_S, PLANT_SETTLE_S
 from .custom_formula import (
@@ -329,8 +339,9 @@ from .custom_formula import (
     parse_export_formula, parse_price_formula, stale_card)
 from .inverter import roster_entries
 from .maintenance import MAINT_OPTION_DEFAULTS
-from .p1 import is_enabled, validate_meter_options
-from .peakguard import PEAK_OPTION_DEFAULTS
+from .p1 import (
+    SOURCE_HA, SOURCE_HA_SIGNED, is_enabled, validate_meter_options)
+from .peakguard import PEAK_MARGIN_RANGE_W, PEAK_OPTION_DEFAULTS
 from .price import (
     PRICE_OPTION_DEFAULTS, PROVIDERS, RETIRED_PROVIDERS,
     SUPERSEDED_TAXES_DEFAULTS_EUR_KWH)
@@ -342,6 +353,47 @@ from .watchdog import SIGN_OPTION_DEFAULTS
 
 _LOG = logging.getLogger("goodwe.config")
 
+
+class _WarnOnce(logging.Filter):
+    """UX-10: a settings warning is said once per start. The validator runs
+    twice at start (before the first cycle and again once the inverter's range
+    is known), and a warning about options that have not changed is the same
+    news both times. Refusals are ERROR and pass untouched."""
+
+    def __init__(self):
+        super().__init__()
+        self.seen = set()
+
+    def filter(self, record):
+        if record.levelno != logging.WARNING:
+            return True
+        text = record.getMessage()
+        if text in self.seen:
+            return False
+        self.seen.add(text)
+        return True
+
+
+WARN_ONCE = _WarnOnce()
+_LOG.addFilter(WARN_ONCE)
+
+
+class Note(NamedTuple):
+    """UX-13: a warning or info for the settings page. Never a refusal: the
+    add-on starts. `keys` are the options it is about, so the page can show it
+    beside them."""
+    tier: str                   # "warn" or "info"; the wizard's checks
+                                # also "ok" and "bad" (setup_checks)
+    keys: tuple
+    text: str
+
+
+def _advise(notes, tier: str, keys, text: str) -> None:
+    """Add a Note when the caller collects them (the settings page)."""
+    if notes is not None:
+        notes.append(Note(tier, tuple(keys), text))
+
+
 # ⚠️ A MIRROR OF A FIRMWARE CONSTANT, AND IT CANNOT BE IMPORTED. The firmware
 # threshold is a compile-time YAML substitution baked into the ESP32 image
 # (`max_age_s: "30"`, master/goodwe-master-stage4-failsafe.yaml), so nothing at
@@ -571,6 +623,17 @@ def _unit_label(opts: dict, index: int) -> str:
     return f" ({name or f'inverters[{index}]'})"
 
 
+def S(key: str, where: str = "") -> str:
+    """A setting as a refusal names it; `where` is `_unit_label()`'s " (name)"."""
+    return messages.setting(key, where.strip().strip("()"))
+
+
+def _labels(keys, joiner: str = "and") -> str:
+    """Several settings, each with its key: the config panel files a refusal
+    under every key it names (`configui.problems_by_field()`)."""
+    return f" {joiner} ".join(S(k) for k in keys)
+
+
 def _roster_problems(opts: dict) -> list[str]:
     """Rule 9 (CFG-04): the `inverters:` roster, refused where it cannot mean
     what it says.
@@ -625,11 +688,9 @@ def _roster_problems(opts: dict) -> list[str]:
     if raw is None or raw == "" or raw == []:
         return problems
     if not isinstance(raw, (list, tuple)):
-        return [f"inverters is {type(raw).__name__} {raw!r}, and it must be a "
-                "LIST of inverter objects - one per inverter, each naming its "
-                "own name, setpoint_entity and max_w. A single inverter needs "
-                "no list at all: leave `inverters` empty and the flat "
-                "setpoint_entity/soc_entity/batt_entity/max_w keys describe it."]
+        return [f"{S('inverters')} is {type(raw).__name__} {raw!r}, not a list. "
+                "Add one entry per inverter, or leave it empty for a single "
+                "inverter."]
 
     entries = roster_entries(opts)
     seen: dict = {}
@@ -637,45 +698,31 @@ def _roster_problems(opts: dict) -> list[str]:
         where = f"inverters[{i}]"
         if not isinstance(entry, dict):
             problems.append(
-                f"{where} is {type(entry).__name__} {entry!r}, and every entry "
-                "must be an object with at least name, setpoint_entity and "
-                "max_w.")
+                f"{where} in the “Inverter list” is {messages.shown(entry)}. Each entry needs "
+                "a name, a setpoint entity and an inverter rating.")
             continue
         name = str(entry.get("name") or "").strip()
         if not name:
             problems.append(
-                f"{where} has no name. Every inverter needs one: the Store "
-                "namespaces this unit's SAFETY-02 latch, its heartbeat and its "
-                "write bookkeeping under it, so two unnamed units would share "
-                "one namespace and a trip caused by one would latch the other. "
-                "Any short identifier works - inverter-a, inverter-b, garage.")
+                f"{where} in the “Inverter list” has no name. Give every "
+                "inverter a short name, for example inverter-a.")
         elif name in seen:
             problems.append(
-                f"{where} and {seen[name]} are both called {name!r}. The Store "
-                "keys every per-unit latch under the unit's name, so two units "
-                "with one name share one SAFETY-02 latch and one heartbeat "
-                "deadline - a trip caused by either would stop both, and an "
-                "operator clearing it would clear both. Give them different "
-                "names.")
+                f"{where} and {seen[name]} are both called {name!r}. Give every "
+                "inverter its own name.")
         else:
             seen[name] = where
         who = f"{where} ({name})" if name else where
         if not str(entry.get("setpoint_entity") or "").strip():
             problems.append(
-                f"{who} has no setpoint_entity, so this add-on cannot command "
-                "it. It would sit in the roster, take a share of the site "
-                "target every cycle and deliver none of it, while the status "
-                "page showed a site running at full strength. Give it the "
-                "ESPHome number entity that carries ITS setpoint, or remove "
-                "the entry.")
+                f"{who} has no {S('setpoint_entity')}, so the add-on cannot "
+                "control it. Set its ESPHome number entity, or remove the "
+                "entry.")
         if _number(entry, "max_w", None) is None or (_number(entry, "max_w", None) or 0) <= 0:
             problems.append(
-                f"{who} has no usable max_w (got {entry.get('max_w')!r}). It is "
-                "the supervised cap on what may be written to THIS inverter, it "
-                "is not shared with any other unit and it is deliberately not "
-                "inherited from the flat max_w - a rating borrowed from a "
-                "sibling is exactly what DEV-02 removed. State this unit's own "
-                "rating in watts.")
+                f"{who} has no usable {S('max_w')}: it is "
+                f"{messages.shown(entry.get('max_w'))}. Set this inverter's own rating in "
+                "watts.")
 
     # --- (f) and (g): OPT-09's capacity, which is optional but not partial ---
     stated, blank = [], []
@@ -694,35 +741,21 @@ def _roster_problems(opts: dict) -> list[str]:
             val = None
         if val is None or not (val > 0.0):
             problems.append(
-                f"{who} has capacity_kwh {raw!r}, which is not a usable number "
-                "of kilowatt-hours. It is THIS pack's usable capacity and it is "
-                "read to weight the split of the site target by ENERGY headroom "
-                "rather than by power rating; a zero or an unparseable value is "
-                "a pack the split would quietly stop preferring while the box "
-                "still shows a value. State it in kWh, or leave it empty on "
-                "every entry.")
+                f"{who} has {S('capacity_kwh')} {messages.shown(raw)}, which is not a usable "
+                "number. Set it in kWh, or leave it empty on every inverter.")
         else:
             stated.append(who)
     if stated and blank:
         problems.append(
-            f"capacity_kwh is stated on {', '.join(stated)} and left empty on "
-            f"{', '.join(blank)}. It is OPTIONAL but it is not PARTIAL: the "
-            "split weights one pack's energy headroom against another's, so a "
-            "pack measured in kWh beside a sibling that weighs a dimensionless "
-            "1.0 is not a comparison - the add-on answers 'no opinion' for the "
-            "whole roster and the value you filled in changes nothing. State a "
-            "capacity for every inverter, or for none of them.")
+            f"{S('capacity_kwh')} is set on {', '.join(stated)} but empty on "
+            f"{', '.join(blank)}. Set it on every inverter, or on none.")
 
     flat_sp = str(opts.get("setpoint_entity") or "").strip()
     if entries and flat_sp:
         problems.append(
-            f"setpoint_entity is set to {flat_sp} AND an inverters list of "
-            f"{len(entries)} is declared. The flat setpoint_entity/soc_entity/"
-            "batt_entity/max_w keys are the SINGLE-inverter shape and are not "
-            "read at all once a roster exists, so this config declares an "
-            "actuator that nothing will ever write - a site running quietly "
-            "smaller than its own configuration. Move that inverter into the "
-            "list as its own entry and clear setpoint_entity.")
+            f"{S('setpoint_entity')} is set to {flat_sp}, but the "
+            f"{S('inverters')} is also filled in. Move that inverter into the "
+            "list and clear this setting.")
     return problems
 
 
@@ -760,17 +793,14 @@ def validate_unit_ranges(units, *, skip_entity: str = "") -> list[str]:
         name = getattr(unit, "name", entity)
         if dev_max is not None and cap > float(dev_max):
             problems.append(
-                f"{name}: max_w is {cap:.0f} W but {entity} accepts at most "
-                f"{float(dev_max):.0f} W - THE DEVICE WINS, so the {cap:.0f} W "
-                f"configured for this inverter would silently never happen. "
-                f"Lower this entry's max_w to {float(dev_max):.0f} W or less.")
+                f"{name}: {S('max_w')} is {cap:.0f} W, but {entity} accepts at "
+                f"most {float(dev_max):.0f} W. Lower this inverter's rating to "
+                f"{float(dev_max):.0f} W or less.")
         elif dev_min is not None and -cap < float(dev_min):
             problems.append(
-                f"{name}: max_w is {cap:.0f} W, so this controller may command "
-                f"{-cap:.0f} W, but {entity} accepts no less than "
-                f"{float(dev_min):.0f} W - THE DEVICE WINS on the charge side. "
-                f"Lower this entry's max_w to {abs(float(dev_min)):.0f} W or "
-                "less.")
+                f"{name}: {S('max_w')} is {cap:.0f} W, but {entity} accepts no "
+                f"less than {float(dev_min):.0f} W when charging. Lower this "
+                f"inverter's rating to {abs(float(dev_min)):.0f} W or less.")
     return problems
 
 
@@ -786,7 +816,16 @@ class ConfigRefused(Exception):
         super().__init__(problems[0] if problems else "configuration refused")
 
 
-def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]:
+def no_power_request_problem() -> str:
+    """Rule 1's refusal: no inverter to control. UX-15's setup-only mode
+    starts when this is the only refusal (app/setuponly.py)."""
+    return (f"{S('setpoint_entity')} is empty, so the add-on cannot control "
+            "the inverter. Set it to the ESPHome number entity for the "
+            "setpoint.")
+
+
+def validate_startup_config(opts: dict, dev_min=None, dev_max=None,
+                            notes: list | None = None) -> list[str]:
     """Return the list of reasons this configuration must not be started.
 
     Empty list means go. `dev_min`/`dev_max` are the setpoint device's own
@@ -796,18 +835,16 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
 
     Pure and side-effect free apart from two warnings, so it can be called from
     a test or from sim/inject.py without a Home Assistant anywhere near it.
+
+    UX-13: pass a list as `notes` to also get each logged warning as a `Note`
+    for the settings page. The refusals returned do not depend on it.
     """
     problems: list[str] = []
 
     # --- 1. an actuator to write to, and AT MOST ONE WRITER PER ACTUATOR -----
     writers = actuator_writers(opts)
     if not writers:
-        problems.append(
-            "setpoint_entity is not set, so this add-on has no actuator: every "
-            "write is a no-op, the device's own rating is never read, and the "
-            "ESP32 heartbeat that holds off the layer-1 failsafe never happens. "
-            "It would run, look healthy, and move no energy at all. Set it to "
-            "the ESPHome number entity that carries the setpoint.")
+        problems.append(no_power_request_problem())
     # SAFETY-28. The §1.5 non-goal, graded on the writers rather than on the
     # count of option keys. Read `actuator_writers()` for why the old check went
     # green on the very config this one is here to refuse.
@@ -822,15 +859,9 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     for actuator, who in sorted(writers.items()):
         if len(who) > 1:
             problems.append(
-                f"{len(who)} configured writers can reach the one actuator "
-                f"{actuator}: {', '.join(who)}. specs §1.5 makes any "
-                "configuration in which two writers can reach one actuator a "
-                "non-goal - two independent setpoints on one inverter is the "
-                "arbitration problem this add-on refuses to have, and at "
-                "runtime it is a meter-emulation target being written twice a "
-                "second by two strategies that cannot see each other. Give "
-                "each actuator exactly one writer, or point the second one at "
-                "its own entity.")
+                f"{len(who)} settings point at the same inverter entity "
+                f"{actuator}: {', '.join(who)}. Give each inverter its own "
+                "setpoint entity.")
 
     # --- 9. CFG-04's roster, graded BEFORE anything reads a per-unit number --
     # ⚠️ FIRST, THOUGH IT IS THE NEWEST RULE. Rules 5 and 6 below now ask the
@@ -861,7 +892,8 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     # has answered; it is not called from here because at startup no device has.
     max_w = _number(opts, "max_w", 2000.0)
     if max_w is None:
-        problems.append(f"max_w {opts.get('max_w')!r} is not a number")
+        problems.append(f"{S('max_w')} is {messages.shown(opts.get('max_w'))}, which is not "
+                        "a number. Set it in watts.")
     # ⚠️ config.yaml's int(100,5000) already blocks this on a real install, so
     # the check is not for the Supervisor path - it is because
     # validate_startup_config() is now also sim/inject.py's entry point and can
@@ -872,24 +904,19 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     # nonsense config it is.
     elif max_w <= 0:
         problems.append(
-            f"max_w is {max_w:.0f} W and must be positive - it is a magnitude, "
-            "not a signed setpoint. At or below zero the arbiter's supervised "
-            f"limit becomes lo={-max_w:.0f} / hi={max_w:.0f}, which is a "
-            "contradiction it resolves to 0 W, so the controller would look "
-            "like it was tripping rather than misconfigured.")
+            f"{S('max_w')} is {max_w:.0f} W. Set it above 0 W.")
     elif dev_max is not None and max_w > dev_max:
         problems.append(
-            f"max_w is {max_w:.0f} W but {opts.get('setpoint_entity') or 'the setpoint device'} accepts at "
-            f"most {dev_max:.0f} W - THE DEVICE WINS, so the {max_w:.0f} W you "
-            f"configured would silently never happen. Lower max_w to "
-            f"{dev_max:.0f} W or less, or point setpoint_entity at a device that "
-            f"can take {max_w:.0f} W.")
+            f"{S('max_w')} is {max_w:.0f} W, but "
+            f"{opts.get('setpoint_entity') or 'the setpoint entity'} accepts at "
+            f"most {dev_max:.0f} W. Lower the rating to {dev_max:.0f} W or "
+            "less.")
     elif dev_min is not None and -max_w < dev_min:
         problems.append(
-            f"max_w is {max_w:.0f} W, so this controller may command "
-            f"{-max_w:.0f} W, but {opts.get('setpoint_entity') or 'the setpoint device'} accepts no less "
-            f"than {dev_min:.0f} W - THE DEVICE WINS on the charge side. Lower "
-            f"max_w to {abs(dev_min):.0f} W or less.")
+            f"{S('max_w')} is {max_w:.0f} W, but "
+            f"{opts.get('setpoint_entity') or 'the setpoint entity'} accepts no "
+            f"less than {dev_min:.0f} W when charging. Lower the rating to "
+            f"{abs(dev_min):.0f} W or less.")
 
     # --- 3. a meter that can actually read -----------------------------------
     # ⚠️ Not a second copy of these rules - p1.py owns them, because
@@ -898,9 +925,10 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     phases = _number(opts, "meter_phases", 1.0)
     max_age_s = _number(opts, "meter_max_age_s", 30.0)
     if phases is None or max_age_s is None:
-        problems.append("meter_phases and meter_max_age_s must both be numbers "
-                        f"(got {opts.get('meter_phases')!r} / "
-                        f"{opts.get('meter_max_age_s')!r})")
+        problems.append(f"{S('meter_phases')} and {S('meter_max_age_s')} must "
+                        f"both be numbers. They are "
+                        f"{messages.shown(opts.get('meter_phases'))} and "
+                        f"{messages.shown(opts.get('meter_max_age_s'))}.")
     else:
         problems.extend(validate_meter_options(opts, int(phases), max_age_s))
 
@@ -921,15 +949,9 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     if (is_enabled(opts) and max_age_s is not None
             and max_age_s > FIRMWARE_INGEST_VETO_S):
         problems.append(
-            f"meter_max_age_s is {max_age_s:.0f} s but the ESP32 firmware vetoes "
-            f"any P1 sample at {FIRMWARE_INGEST_VETO_S:.0f} s and forces the "
-            "layer-1 failsafe - THE FIRMWARE WINS, and it wins silently. This "
-            f"add-on would treat a {max_age_s - 1:.0f} s reading as fresh and "
-            "keep commanding, while the inverter sat at 0 W with a healthy-"
-            "looking meter on the status page. Lower meter_max_age_s to "
-            f"{FIRMWARE_INGEST_VETO_S:.0f} s or less (30 s is the tested value), "
-            "or rebuild the firmware with a matching max_age_s and update "
-            "validate.FIRMWARE_INGEST_VETO_S.")
+            f"{S('meter_max_age_s')} is {max_age_s:.0f} s, but the control "
+            f"board stops the inverter after {FIRMWARE_INGEST_VETO_S:.0f} s. "
+            f"Set it to {FIRMWARE_INGEST_VETO_S:.0f} s or less.")
 
     # --- 5. a sign watchdog that can actually fire ---------------------------
     # ⚠️ Strictly `>=`, matching the predicate exactly: watchdog.py tests
@@ -956,19 +978,15 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     caps = [cap for _, cap in caps_ix]
     weakest = min(caps) if caps else None
     if sign_w is None:
-        problems.append(f"sign_disagree_w {opts.get('sign_disagree_w')!r} is not a number")
+        problems.append(f"{S('sign_disagree_w')} is "
+                        f"{messages.shown(opts.get('sign_disagree_w'))}, which is not a "
+                        "number. Set it back to 300 W.")
     elif weakest is not None and weakest > 0 and sign_w >= weakest:
         where = _unit_label(opts, min(caps_ix, key=lambda p: p[1])[0])
         problems.append(
-            f"sign_disagree_w is {sign_w:.0f} W but max_w{where} is "
-            f"{weakest:.0f} W, so "
-            "the SAFETY-02 sign-disagreement watchdog can never fire: the "
-            "arbiter never lets a command exceed max_w, and the watchdog needs "
-            f"a command over {sign_w:.0f} W. It would sit there reporting "
-            "'armed' on the status page while being incapable of tripping - the "
-            f"one runaway failure mode this system has actually observed. Lower "
-            f"sign_disagree_w below {weakest:.0f} W (300 W is the measured "
-            "default), or raise max_w.")
+            f"{S('sign_disagree_w')} is {sign_w:.0f} W, not below "
+            f"{S('max_w', where)} at {weakest:.0f} W, so this safety stop can "
+            f"never trip. Lower it or raise the rating.")
 
     # ⚠️ AND THE SAME RULE FOR SAFETY-30's PER-UNIT THRESHOLD, WHICH IS A
     # SEPARATE COMPARISON AND THEREFORE A SEPARATE WAY TO DISARM. It grades a
@@ -1014,20 +1032,15 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     unit_where = (_unit_label(opts, min(caps_ix, key=lambda p: p[1])[0])
                   if caps_ix else "")
     if unit_sign_w is None:
-        problems.append(f"unit_sign_disagree_w "
-                        f"{opts.get('unit_sign_disagree_w')!r} is not a number")
+        problems.append(f"{S('unit_sign_disagree_w')} is "
+                        f"{messages.shown(opts.get('unit_sign_disagree_w'))}, which is not a "
+                        "number. Set it back to "
+                        f"{SIGN_OPTION_DEFAULTS['unit_sign_disagree_w']:.0f} W.")
     elif weakest is not None and weakest > 0 and unit_sign_w >= weakest:
         problems.append(
-            f"unit_sign_disagree_w is {unit_sign_w:.0f} W but max_w{unit_where}"
-            f" is {weakest:.0f} W, so the SAFETY-30 per-inverter sign-disagreement "
-            "watchdog can never fire: no inverter is ever commanded past max_w, "
-            f"and the watchdog needs a command over {unit_sign_w:.0f} W. At two "
-            "inverters that is the guard which catches a unit doing the "
-            "OPPOSITE of what it was told while its sibling covers for it at "
-            "the meter - the case the site-level watchdog is structurally "
-            f"blind to. Lower unit_sign_disagree_w below {weakest:.0f} W "
-            f"({SIGN_OPTION_DEFAULTS['unit_sign_disagree_w']:.0f} W is the "
-            "measured default), or raise max_w.")
+            f"{S('unit_sign_disagree_w')} is {unit_sign_w:.0f} W, not below "
+            f"{S('max_w', unit_where)} at {weakest:.0f} W, so this safety stop "
+            f"can never trip. Lower it or raise the rating.")
 
     # --- 6. a maintenance charge the ceiling can actually accommodate --------
     # ⚠️ Strictly `>`, matching the arbiter exactly. The shaping is
@@ -1100,18 +1113,14 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     maint_where = _unit_label(opts, maint_index)
     if charge_w is None:
         problems.append(
-            f"maintenance_charge_w {opts.get('maintenance_charge_w')!r} is not a number")
+            f"{S('maintenance_charge_w')} is "
+            f"{messages.shown(opts.get('maintenance_charge_w'))}, which is not a number. Set "
+            "it in watts.")
     elif maint_cap is not None and maint_cap > 0 and charge_w > maint_cap:
         problems.append(
-            f"maintenance_charge_w is {charge_w:.0f} W but max_w{maint_where} is "
-            f"{maint_cap:.0f} W, so a maintenance charge in a cheap window can "
-            "never happen: the shaping asks the arbiter for at most "
-            f"{-charge_w:.0f} W while the supervised limit allows no less than "
-            f"{-maint_cap:.0f} W, which is a contradiction it resolves to 0 W - "
-            "THE CEILING WINS, and what you would see is an ARBITER "
-            "CONTRADICTION line that reads like a bug rather than like these "
-            f"two numbers. Lower maintenance_charge_w to {maint_cap:.0f} W or "
-            f"less, or raise max_w to at least {charge_w:.0f} W.")
+            f"{S('maintenance_charge_w')} is {charge_w:.0f} W, but the "
+            f"{S('max_w', maint_where)} is {maint_cap:.0f} W, so the monthly "
+            f"recharge cannot run. Lower it to {maint_cap:.0f} W or less.")
 
     # --- 10. a slew rate the plant can actually follow -----------------------
     # ⚠️ SAFETY-39. The one rule here that grades a RATIO rather than a
@@ -1140,37 +1149,22 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     slew_w = _number(opts, "slew_w", 0.0)
     rail = site_rail_w(opts)
     if slew_w is None:
-        problems.append(f"slew_w {opts.get('slew_w')!r} is not a number")
+        problems.append(f"{S('slew_w')} is {messages.shown(opts.get('slew_w'))}, which is "
+                        "not a number. Set it to 0 to follow the inverter "
+                        "rating.")
     elif slew_w < 0:
         problems.append(
-            f"slew_w is {slew_w:.0f} W and must not be negative - it is a "
-            "magnitude, and 0 means 'follow max_w' (the recommended setting).")
+            f"{S('slew_w')} is {slew_w:.0f} W and cannot be negative. Set it to "
+            "0 to follow the inverter rating.")
     elif slew_w and rail is not None and rail > 0:
         bound = SLEW_RAIL_FRAC * rail
         if slew_w > bound + 1.0:
-            ticks = rail / slew_w
             problems.append(
-                f"slew_w is {slew_w:.0f} W against a site rail of {rail:.0f} W, "
-                f"so the loop crosses its whole output range in {ticks:.1f} "
-                f"cycles - {ticks * LOOP_TICK_S:.0f} s at the {LOOP_TICK_S:.0f} s "
-                f"tick this site was measured running - while the plant takes "
-                f"{PLANT_SETTLE_S:.0f} s to settle (goodwe/NOTES.md §5.10, a "
-                "1.78 kW step). The controller would command its entire range "
-                "before it could observe its answer to the first step, which is "
-                "not a slow loop, it is a loop that MANUFACTURES the error it "
-                "then chases: measured on this system 2026-09-05, a 3.4 kW "
-                "export drove the setpoint 380 -> 5000 W in five ticks, the "
-                "battery to -5154 W past a 5000 VA rating, and the grid from "
-                "3.4 kW of export to 2.8 kW of import. The stated limit - the "
-                "command moves at most slew_w per cycle, so it cannot jump "
-                "ahead of the inverter - is untrue at this rail; THE PLANT "
-                f"WINS, and it has no status row. Set slew_w to 0, which means "
-                f"'follow the rail' and resolves to {bound:.0f} W here and "
-                "moves on its own if the rail does, or write a value at or "
-                f"below {bound:.0f} W. Lower is always accepted.")
+                f"{S('slew_w')} is {slew_w:.0f} W, too fast for a {rail:.0f} W "
+                f"site. Set it to 0 or to at most {bound:.0f} W.")
 
     # --- 7. two price sources on one site ------------------------------------
-    problems.extend(_price_problems(opts))
+    problems.extend(_price_problems(opts, notes))
 
     # --- 8. an EMS energy floor the BMS does not already enforce -------------
     # ⚠️ THE FALLBACKS ARE peakguard.PEAK_OPTION_DEFAULTS, NOT LITERALS, and
@@ -1198,33 +1192,31 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
         where = _unit_label(opts, _ix)
         if soc_floor is None or bms_floor is None:
             problems.append(
-                f"peak_soc_floor and bms_soc_floor{where} must both be numbers "
-                f"(got {opts.get('peak_soc_floor')!r} / {_raw!r})")
+                f"{S('peak_soc_floor')} and {S('bms_soc_floor', where)} must "
+                f"both be numbers. They are {messages.shown(opts.get('peak_soc_floor'))} and "
+                f"{messages.shown(_raw)}.")
         elif soc_floor <= bms_floor:
             problems.append(
-                f"peak_soc_floor is {soc_floor:.0f} % but the pack's own cut-out "
-                f"(bms_soc_floor{where}) is {bms_floor:.0f} %, so SAFETY-07's forced "
-                "discharge has no EMS-side bound at all - THE BMS WINS, and it is "
-                "the pack's protection rather than yours. The guard would report a "
-                "SoC floor on its status page while being incapable of ever being "
-                "the thing that stops the discharge, and the symptom of that is a "
-                "battery repeatedly sitting at the BMS limit with no record of why "
-                f"- which looks exactly like the SoC drift the maintenance cycle "
-                f"exists to correct. Raise peak_soc_floor above {bms_floor:.0f} % "
-                f"(the shipped default is "
-                f"{PEAK_OPTION_DEFAULTS['peak_soc_floor']:.0f} %), or correct "
-                f"bms_soc_floor{where} if it does not match this pack.")
+                f"{S('peak_soc_floor')} is {soc_floor:.0f} %, not above the "
+                f"{S('bms_soc_floor', where)} of {bms_floor:.0f} %. Raise the "
+                f"reserve above {bms_floor:.0f} %, or correct the cut-out "
+                "level.")
+
+    # --- 12. SAFETY-79: the margin the peak guard keeps under the limit -----
+    problems += _margin_problems(opts)
+    problems += _forecast_problems(opts)
 
     # --- warnings: real, but not worth refusing over -------------------------
     integ = opts.get("integrator_max_w")
     integ_w = None if not integ else _number(opts, "integrator_max_w", None)
     if integ_w is not None and max_w is not None and integ_w > max_w:
         _LOG.warning(
-            "integrator_max_w %.0f W is above max_w %.0f W. Not refused - the "
-            "arbiter still bounds the wire to +-max_w - but the only thing the "
-            "extra headroom buys is more wrong-direction power to unwind after "
-            "saturation. 0 (follow max_w) is the recommended value.",
+            "integrator_max_w %.0f W is above max_w %.0f W. This is allowed, "
+            "but it only adds overshoot, so 0 is recommended.",
             integ_w, max_w)
+        _advise(notes, "warn", ("integrator_max_w",),
+                f"{S('integrator_max_w')} is above {S('max_w')}, which only "
+                "adds overshoot, so set it to 0.")
 
     # ⚠️ THE SIBLING OF RULE 6, AND NOT THE SAME CASE - see the docstring. The
     # drain phase OWNS the actuator (`Claim.set` at P_MAINTENANCE), and a SET is
@@ -1246,20 +1238,22 @@ def validate_startup_config(opts: dict, dev_min=None, dev_max=None) -> list[str]
     if (disch_w is not None and maint_cap is not None and maint_cap > 0
             and disch_w > maint_cap):
         _LOG.warning(
-            "maintenance_discharge_w %.0f W is above max_w%s %.0f W. Not "
-            "refused - the drain phase SETS the setpoint and the arbiter clamps "
-            "it to %.0f W and names the clamp ('limited by supervised(max_w)'), "
-            "so nothing is silent and the cycle still completes. But it drains "
-            "at %.0f W, not the %.0f W you configured, and the drain phase has "
-            "a 720 min timeout. Lower it to %.0f W or raise max_w to remove the "
-            "surprise.",
-            disch_w, maint_where, maint_cap, maint_cap, maint_cap, disch_w,
-            maint_cap)
+            "maintenance_discharge_w %.0f W is above max_w%s %.0f W, so "
+            "draining runs at %.0f W. Lower it to %.0f W or raise max_w.",
+            disch_w, maint_where, maint_cap, maint_cap, maint_cap)
+        _advise(notes, "warn", ("maintenance_discharge_w",),
+                f"{S('maintenance_discharge_w')} is above "
+                f"{S('max_w', maint_where)}, so the battery empties at "
+                f"{messages.watts(maint_cap)} and the cycle takes longer.")
+        _LOG.debug(
+            "Not refused: the drain phase sets the setpoint, the arbiter "
+            "clamps it to %.0f W and names the clamp, and the drain phase has "
+            "a 720 min timeout.", maint_cap)
 
     return problems
 
 
-def _price_problems(opts: dict) -> list[str]:
+def _price_problems(opts: dict, notes: list | None = None) -> list[str]:
     """Rule 7 (TARIFF-02): the price configuration, refused where it is untrue.
 
     ⚠️ NOTE WHAT IS *NOT* HERE. `price_provider: "off"` is not refused and never
@@ -1306,43 +1300,19 @@ def _price_problems(opts: dict) -> list[str]:
         # fall back to, the site has had no tariff at all - a worse state, and
         # one this message must not paper over.
         been_running = (
-            f"the static day/night tariff in static_profile"
+            f"the {S('static_profile')}"
             if str(opts.get("static_profile", "") or "").strip()
-            else "NOTHING AT ALL - static_profile is empty too, so there was "
-                 "no tariff to fall back to either")
+            else "no tariff at all")
         problems.append(
-            f"price_provider is {pid!r}, which WAS a shipped plugin and has "
-            f"been WITHDRAWN (TARIFF-07). This is not a typo and you did not "
-            f"mistype it - the add-on offered this id, accepted it, and has "
-            f"said nothing at every startup since. "
-            f"⚠️ IT HAS NEVER FETCHED A PRICE, HERE OR ANYWHERE: "
-            f"{RETIRED_PROVIDERS[pid]}. Every fetch it ever made ended in "
-            f"SourceUnavailable, and §11.4 turns that into a SILENT fall back "
-            f"- so what this site has actually been running since the day the "
-            f"id was set is {been_running}. Nothing you could see would have "
-            f"differed from a working provider that simply never found a cheap "
-            f"hour, which is why you are being told now rather than left on "
-            f"it. WHAT TO DO: set price_provider to 'generic_dayahead' for the "
-            f"wholesale EPEX BE day-ahead curve, to which the add-on adds your "
-            f"price_markup_eur_kwh and price_taxes_eur_kwh - that APPROXIMATES "
-            f"a Belgian dynamic tariff and cannot reproduce your supplier's "
-            f"B x spot + A formula, so the level will be off even when the "
-            f"shape is right; or 'manual_csv' to enter all-in prices you "
-            f"compute yourself; or 'off' to run on static_profile "
-            f"deliberately. There is deliberately NO alias to your old "
-            f"supplier: aliasing would need your contract's own two "
-            f"coefficients, which live behind your klantenzone login and are "
-            f"in no public index, so the add-on would have to invent the "
-            f"numbers it prices your battery against.")
+            f"{S('price_provider')} is {pid!r}, which was withdrawn and never "
+            f"fetched a price. This site ran on {been_running}. Choose "
+            "'generic_dayahead', 'manual_csv' or 'off'.")
         return problems      # nothing below can be judged against a dead id
 
     if pid != "off" and pid not in PROVIDERS:
         problems.append(
-            f"price_provider is {pid!r}, which is not a shipped plugin. The "
-            f"ids that exist are: off, {', '.join(sorted(PROVIDERS))}. "
-            "Refused rather than defaulted, per the §14 warning box - a "
-            "silent fall back to 'off' would look exactly like a working "
-            "provider that happens never to find a cheap hour.")
+            f"{S('price_provider')} is {pid!r}, which does not exist. Choose "
+            f"one of: off, {', '.join(sorted(PROVIDERS))}.")
         return problems          # nothing below can be judged against an unknown id
 
     # ⚠️ THE HA-SIDE OVERLAP THE PM TOLD US TO DECIDE ABOUT, DECIDED HERE.
@@ -1386,19 +1356,9 @@ def _price_problems(opts: dict) -> list[str]:
                 if str(opts.get(k, "") or "").strip()]
     if pid != "off" and ha_price:
         problems.append(
-            f"price_provider is {pid!r} AND {' and '.join(ha_price)} "
-            f"{'is' if len(ha_price) == 1 else 'are'} set, which is two price "
-            "sources on one site. THE HOME ASSISTANT ENTITIES WIN: they are "
-            "what main.py reduces to the `cheap` flag the maintenance cycle "
-            "reads, and read_inputs() never looks at the other source once "
-            "they are set. The provider series is consumed - "
-            "app/static_tariff.py builds a tariff plan and an arbitrage "
-            "verdict, and app/arbitrage.py trades on it off a background "
-            "refresh - but the `cheap` flag those entities own is a separate "
-            "decision they would silently keep. Clear "
-            "price_now_entity and price_avg_entity to use the "
-            f"{pid!r} plugin, or set price_provider to 'off' to keep the "
-            "Home Assistant sensors.")
+            f"{S('price_provider')} is {pid!r}, but {_labels(ha_price)} would "
+            f"win over it. Clear {'it' if len(ha_price) == 1 else 'them'}, or "
+            "set the source to 'off'.")
 
     # ⚠️ THE SAME RULE FOR THE SOURCE TARIFF-03 ADDED, AND THIS ONE IS A LIVE
     # CONFLICT RATHER THAN A LATENT ONE. main.py's read_inputs() takes `cheap`
@@ -1407,14 +1367,9 @@ def _price_problems(opts: dict) -> list[str]:
     # day/night tariff has no way to see that it lost.
     if ha_price and str(opts.get("static_profile", "") or "").strip():
         problems.append(
-            f"static_profile is set AND {' and '.join(ha_price)} "
-            f"{'is' if len(ha_price) == 1 else 'are'} set, which is two "
-            "tariff sources feeding one cheap-window flag. THE HOME ASSISTANT "
-            "ENTITIES WIN: main.py reads them first and never looks at the "
-            "static profile, so the day/night tariff you typed would decide "
-            "nothing and nothing would say so. Clear price_now_entity and "
-            "price_avg_entity to use static_profile, or clear static_profile "
-            "to keep the Home Assistant sensors.")
+            f"{S('static_profile')} is set, but {_labels(ha_price)} would win "
+            f"over it. Clear the fixed tariff or "
+            f"{'the entity' if len(ha_price) == 1 else 'the two entities'}.")
 
     # ⚠️ THE PROFILE ITSELF, PARSED AT STARTUP RATHER THAN AT 02:00. A profile
     # that does not tile the day has hours with no price, and the only ways to
@@ -1427,16 +1382,15 @@ def _price_problems(opts: dict) -> list[str]:
             profile = parse_static_profile(raw_profile)
         except ProfileInvalid as e:
             profile = None
-            problems.append(f"static_profile cannot be used: {e}")
+            problems.append(f"“{messages.LABELS['static_profile']}” cannot be used. {e}")
         if profile is not None and profile.product is not None \
                 and len(set(profile.prices)) == 1:
             _LOG.info(
-                "static_profile carries one distinct price (%.4f EUR/kWh "
-                "all-in), so this site is priced as FULLY FIXED. Arbitrage is "
-                "off by arithmetic - a flat series has no spread - and the "
-                "add-on runs self-consumption only, which is §9.2's handling "
-                "for this product. Peak shaving, reserve management and the "
-                "maintenance cycle are unaffected.", profile.prices[0])
+                "static_profile has one price (%.4f EUR/kWh all-in), so this "
+                "site has a fully fixed price. A flat price has no spread to "
+                "trade on, so the add-on uses the battery for self-consumption "
+                "only. Peak limiting, the reserve and battery maintenance are "
+                "not affected.", profile.prices[0])
 
     # ⚠️ TARIFF-17: THE TAXES PERIOD TABLE, PARSED AT STARTUP RATHER THAN AT
     # 03:00, FOR `static_profile`'s REASON ONE OPTION OVER. This table is read
@@ -1452,7 +1406,7 @@ def _price_problems(opts: dict) -> list[str]:
         try:
             taxes_table = parse_taxes_profile(raw_taxes_profile)
         except ProfileInvalid as e:
-            problems.append(f"{TAXES_PROFILE_OPTION} cannot be used: {e}")
+            problems.append(f"“{messages.LABELS[TAXES_PROFILE_OPTION]}” cannot be used. {e}")
 
     if taxes_table is not None:
         # ⚠️ TWO WRITERS OF ONE QUANTITY, ONE OF WHICH SILENTLY LOSES - the
@@ -1482,21 +1436,12 @@ def _price_problems(opts: dict) -> list[str]:
                          PRICE_OPTION_DEFAULTS["price_taxes_eur_kwh"])
         shipped = PRICE_OPTION_DEFAULTS["price_taxes_eur_kwh"]
         untouched = (shipped,) + tuple(SUPERSEDED_TAXES_DEFAULTS_EUR_KWH)
-        superseded = ", ".join(
-            str(u) for u in SUPERSEDED_TAXES_DEFAULTS_EUR_KWH)
         if scalar is not None \
                 and not any(abs(scalar - u) <= 1e-12 for u in untouched):
             problems.append(
-                f"{TAXES_PROFILE_OPTION} is set AND price_taxes_eur_kwh is "
-                f"{scalar} rather than its shipped {shipped}. THE TABLE WINS: "
-                f"the add-on reads the per-period figures and never looks at "
-                f"the scalar, so the number you typed there would decide "
-                f"nothing and nothing would say so. Set price_taxes_eur_kwh "
-                f"back to {shipped}, or clear {TAXES_PROFILE_OPTION} to keep "
-                f"the flat figure. (A scalar still sitting on a SUPERSEDED "
-                f"default - {superseded} - is accepted and NOT refused: "
-                f"that is a number this add-on wrote into your options "
-                f"blob, not one you typed.)")
+                f"{S(TAXES_PROFILE_OPTION)} is set, so "
+                f"{S('price_taxes_eur_kwh')} is not used. Set it back to "
+                f"{shipped} from {scalar}, or clear the table.")
 
         # ⚠️ THE UNITS RUNG, AND IT IS A SECOND QUANTITY RATHER THAN A
         # RESTATEMENT. Every Belgian DSO prints these bands in c EUR/kWh
@@ -1511,13 +1456,8 @@ def _price_problems(opts: dict) -> list[str]:
                         if abs(p.eur_per_kwh) >= 1.0})
         if steep:
             problems.append(
-                f"{TAXES_PROFILE_OPTION} carries {steep} EUR/kWh. Belgian "
-                f"levies and distribution run about 0.05-0.25 EUR/kWh, so "
-                f"these are almost certainly the CENT figures off the tariff "
-                f"card (ORES prints `13,27`, which is 0.1327 EUR/kWh) typed "
-                f"without the conversion - a factor of 100 that would make "
-                f"every hour look like an emergency. Divide by 100, or clear "
-                f"the option.")
+                f"{S(TAXES_PROFILE_OPTION)} has {steep} EUR/kWh, which looks "
+                "like cents. Divide the figures by 100, or clear this setting.")
         negative = sorted({p.eur_per_kwh for p in taxes_table.periods
                            if p.eur_per_kwh < 0})
         if negative:
@@ -1528,10 +1468,12 @@ def _price_problems(opts: dict) -> list[str]:
             # observe. §14's warning box governs CONTRADICTIONS, and this is
             # not one.
             _LOG.warning(
-                "%s carries negative levies %s EUR/kWh. That is accepted, but "
-                "a tax component below zero is usually a sign error: the "
-                "add-on will SUBTRACT it from the published price in those "
-                "hours.", TAXES_PROFILE_OPTION, negative)
+                "%s has negative levies %s EUR/kWh, which are subtracted from "
+                "the price. This is allowed, but it is usually a sign error.",
+                TAXES_PROFILE_OPTION, negative)
+            _advise(notes, "warn", (TAXES_PROFILE_OPTION,),
+                    f"{S(TAXES_PROFILE_OPTION)} has negative figures, which "
+                    "lower the price, and that is usually a sign error.")
 
     # ⚠️ TARIFF-15: THE FORMULA, GRADED AGAINST THE OPERATOR'S OWN CARD, AT
     # STARTUP RATHER THAN AT 03:00.
@@ -1567,25 +1509,15 @@ def _price_problems(opts: dict) -> list[str]:
         or isinstance(raw_formula, dict)
     if pid == "custom_formula" and not has_formula:
         problems.append(
-            "price_provider is 'custom_formula' but price_formula is empty, "
-            "so the add-on has no coefficients to price anything with. Every "
-            "fetch would return no-price-data and §11.4 would fall back "
-            "silently - which is the shape of defect this provider exists to "
-            "remove, arrived at by leaving one field blank. Copy the "
-            "Tariefformule line off your supplier's tariff card, e.g. "
-            "{\"index\":\"epex_be\",\"resolution\":\"hourly\","
-            "\"factor\":0.102,\"offset\":1.00,"
-            "\"units\":\"c_eur_per_kwh\",\"vat_pct\":6,"
-            "\"card\":{\"month\":\"2026-09\","
-            "\"index_eur_per_mwh\":133.9905,\"expect_incl_vat\":15.55}} "
-            "- see DOCS.md. Or set price_provider to 'generic_dayahead' for "
-            "the wholesale curve with a flat markup.")
+            f"{S('price_provider')} is 'custom_formula', but "
+            f"{S('price_formula')} is empty. Copy the formula from your "
+            "supplier's tariff card, or choose 'generic_dayahead'.")
     elif has_formula:
         try:
             spec = parse_price_formula(raw_formula)
         except FormulaInvalid as e:
             spec = None
-            problems.append(f"price_formula cannot be used: {e}")
+            problems.append(f"“{messages.LABELS['price_formula']}” cannot be used. {e}")
         if spec is not None and pid != "custom_formula":
             # ⚠️ A WARNING AND NOT A REFUSAL. This is not two price sources
             # fighting over one flag - it is one that is simply not wired to
@@ -1594,11 +1526,13 @@ def _price_problems(opts: dict) -> list[str]:
             # silent loser this module's case (a) is about, so it is said out
             # loud rather than left to be discovered from a bill.
             _LOG.warning(
-                "price_formula is filled in but price_provider is %r, so the "
-                "coefficients decide NOTHING - only 'custom_formula' reads "
-                "them. Set price_provider to 'custom_formula' to use them, or "
-                "clear price_formula so the configuration says what the "
-                "add-on is doing.", pid)
+                "price_formula is filled in, but price_provider is %r, so the "
+                "formula is not used. Set price_provider to 'custom_formula' "
+                "or clear price_formula.", pid)
+            _advise(notes, "warn", ("price_formula", "price_provider"),
+                    f"{S('price_formula')} is not used, because "
+                    f"{S('price_provider')} is not 'custom_formula', so clear "
+                    "it or choose that source.")
         if spec is not None and pid == "custom_formula":
             taxes = _number(opts, "price_taxes_eur_kwh",
                             PRICE_OPTION_DEFAULTS["price_taxes_eur_kwh"])
@@ -1612,6 +1546,8 @@ def _price_problems(opts: dict) -> list[str]:
                 # exactly right and a site refused over one is a site that
                 # cannot start.
                 _LOG.warning("%s", aged)
+                _advise(notes, "warn", ("price_formula",),
+                        _card_note("price_formula", spec))
 
     # ⚠️ TARIFF-16: THE INJECTION LEG, REFUSED AT STARTUP ON THE SAME RULE.
     #
@@ -1639,7 +1575,7 @@ def _price_problems(opts: dict) -> list[str]:
             xspec = parse_export_formula(raw_export)
         except FormulaInvalid as e:
             xspec = None
-            problems.append(f"{EXPORT_FORMULA_OPTION} cannot be used: {e}")
+            problems.append(f"“{messages.LABELS[EXPORT_FORMULA_OPTION]}” cannot be used. {e}")
         if xspec is not None:
             # ⚠️ THE 6% ASYMMETRY, PRINTED RATHER THAN ASSUMED. The two legs
             # carry INDEPENDENT `vat_pct` values and a Belgian site's are 6 and
@@ -1649,9 +1585,9 @@ def _price_problems(opts: dict) -> list[str]:
             _LOG.info(
                 "%s is set: injection priced as (%g x index %+g) x "
                 "(1 + %g/100) %s, i.e. %.4g x the wholesale price with a "
-                "%+.5f EUR/kWh offset. ⚠️ NO STRATEGY IN THIS ADD-ON READS "
-                "IT: arbitrage.py prices the sell side as displaced IMPORT "
-                "and compares two all-in CONSUMPTION prices, so this option "
+                "%+.5f EUR/kWh offset. No part of the add-on reads it yet: "
+                "trading prices the sell side as displaced import and "
+                "compares two all-in consumption prices, so this setting "
                 "changes no decision the add-on takes today. It is what you "
                 "are shown, and the shape a future export-aware strategy "
                 "would read.",
@@ -1687,24 +1623,27 @@ def _price_problems(opts: dict) -> list[str]:
                 # bounds in `implausible_injection()` are applied, and the
                 # operator is told which of the two checks did NOT run.
                 _LOG.warning(
-                    "%s has no \"card\" block, so its coefficients are "
-                    "UNGRADED: nothing recomputed a printed price from them. "
-                    "That is accepted because it is the real market - Eneco "
-                    "prints its injection formula with no price beside it, so "
-                    "there is nothing to grade against on that card - and "
-                    "refusing would make the published line inexpressible. "
-                    "What IS checked is the shape of the coefficients: the "
-                    "pass-through (%.4g x the wholesale price) and the offset "
-                    "(%+.5f EUR/kWh). If YOUR card prints an injection "
-                    "estimate, add {\"month\": ..., \"index_eur_per_mwh\": "
-                    "..., \"expect_incl_vat\": ...} and the add-on will "
-                    "refuse to start unless your numbers reproduce it.",
+                    "%s has no \"card\" block, so its numbers are not checked "
+                    "against a printed price, only their shape (pass-through "
+                    "%.4g, offset %+.5f EUR/kWh).",
                     EXPORT_FORMULA_OPTION, xspec.passthrough,
                     xspec.offset_eur_kwh)
+                _advise(notes, "info", (EXPORT_FORMULA_OPTION,),
+                        f"{S(EXPORT_FORMULA_OPTION)} has no card block, so "
+                        "only the shape of its numbers is checked.")
+                _LOG.debug(
+                    "Accepted because some suppliers (Eneco) print the "
+                    "injection formula with no price beside it. If your card "
+                    "prints an injection estimate, add {\"month\": ..., "
+                    "\"index_eur_per_mwh\": ..., \"expect_incl_vat\": ...} "
+                    "and the add-on refuses to start unless your numbers "
+                    "reproduce it.")
             else:
                 xaged = stale_card(xspec)
                 if xaged:
                     _LOG.warning("%s", xaged)
+                    _advise(notes, "warn", (EXPORT_FORMULA_OPTION,),
+                            _card_note(EXPORT_FORMULA_OPTION, xspec))
 
     # ⚠️ A WARNING, NOT A REFUSAL, AND THE ASYMMETRY IS DELIBERATE. §11.4 says a
     # site with no price data falls back to the static profile; a dynamic site
@@ -1713,11 +1652,12 @@ def _price_problems(opts: dict) -> list[str]:
     # every install TARIFF-02 shipped, none of which could have had one.
     if pid != "off" and not str(opts.get("static_profile", "") or "").strip():
         _LOG.warning(
-            "price_provider is %r but static_profile is empty. §11.4's "
-            "degradation row is 'no price data -> fall back to the static "
-            "profile'; with none configured, a feed outage leaves this site "
-            "with no tariff at all rather than with a coarse one. Not refused, "
-            "but filling it in is what makes that row work.", pid)
+            "price_provider is %r but static_profile is empty, so a price "
+            "feed outage leaves no tariff at all. Fill in static_profile as a "
+            "fallback.", pid)
+        _advise(notes, "warn", ("static_profile",),
+                f"{S('static_profile')} is empty, so the site has no tariff "
+                "at all while the price feed is down.")
 
     # ⚠️ OPT-04. THE THREE WAYS `arbitrage_enabled: true` CAN BE A LIE, refused
     # rather than logged, because a strategy that is armed in the UI and cannot
@@ -1732,66 +1672,427 @@ def _price_problems(opts: dict) -> list[str]:
                      PRICE_OPTION_DEFAULTS["cycle_cost_threshold_eur"])
     if thresh is None or thresh < 0:
         problems.append(
-            f"cycle_cost_threshold_eur is "
-            f"{opts.get('cycle_cost_threshold_eur')!r} and must be a "
-            f"non-negative number of EUR/kWh - it is what one round trip COSTS "
-            f"(§10.1). A negative threshold is one that every spread clears, "
-            f"including a spread of nothing, which is arbitrage with the brake "
-            f"removed rather than arbitrage tuned aggressively.")
+            f"{S('cycle_cost_threshold_eur')} is "
+            f"{messages.shown(opts.get('cycle_cost_threshold_eur'))}. Set it to 0 or more, "
+            "in EUR/kWh.")
 
     if arbitrage_on(opts):
         if pid == "off" and not str(opts.get("static_profile", "") or "").strip():
             problems.append(
-                "arbitrage_enabled is on but price_provider is 'off' and "
-                "static_profile is empty, so this site has NO PRICES AT ALL. "
-                "§10.1's priority 3 is 'charge cheap, discharge expensive' and "
-                "there is nothing here to tell cheap from expensive, so the "
-                "strategy would refuse on every cycle forever while the "
-                "configuration said it was running. Configure a price_provider "
-                "or a static_profile, or turn arbitrage_enabled off.")
+                f"{S('arbitrage_enabled')} is on, but the site has no prices. "
+                f"Set {_labels(['price_provider', 'static_profile'], 'or')}, "
+                "or turn trading off.")
         if not is_enabled(opts):
             problems.append(
-                "arbitrage_enabled is on but meter_source is 'off', so there "
-                "is no P1 telegram stream, the capacity-tariff peak guard "
-                "never runs, and nothing measures the 15-minute average this "
-                "strategy's charging would land in. §9.1 gives peak shaving "
-                "priority over arbitrage; an unmeasured peak cannot be shaved, "
-                "so arbitrage would be deliberately creating the billed "
-                "quantity with the one guard that limits it switched off. "
-                "app/arbitrage.py refuses to trade in that state anyway - this "
-                "refuses the configuration that asks it to. Set meter_source, "
-                "or turn arbitrage_enabled off.")
+                f"{S('arbitrage_enabled')} is on, but no meter is set in "
+                f"{S('meter_source')}. Choose a meter, or turn trading off.")
         floor = _number(opts, "arbitrage_soc_floor",
                         PRICE_OPTION_DEFAULTS["arbitrage_soc_floor"])
         ceiling = _number(opts, "arbitrage_soc_ceiling",
                           PRICE_OPTION_DEFAULTS["arbitrage_soc_ceiling"])
         if floor is None or ceiling is None:
             problems.append(
-                f"arbitrage_soc_floor {opts.get('arbitrage_soc_floor')!r} and "
-                f"arbitrage_soc_ceiling {opts.get('arbitrage_soc_ceiling')!r} "
-                f"must both be numbers - they are percentages of pack charge.")
+                f"{S('arbitrage_soc_floor')} and {S('arbitrage_soc_ceiling')} "
+                "must both be numbers, in %.")
         elif floor >= ceiling:
             problems.append(
-                f"arbitrage_soc_floor is {floor:g} % and arbitrage_soc_ceiling "
-                f"is {ceiling:g} %, so there is no band left between them: "
-                f"every state of charge is either at or under the floor (no "
-                f"discharge) or at or over the ceiling (no charge), and the "
-                f"strategy can never act. The floor is the reserve it may not "
-                f"spend and the ceiling is the headroom it may not overfill, "
-                f"so the floor must be the SMALLER number.")
+                f"{S('arbitrage_soc_floor')} is {floor:g} %, not below "
+                f"{S('arbitrage_soc_ceiling')} at {ceiling:g} %. Make the lower "
+                "limit the smaller number.")
 
     if pid == "manual_csv" and not str(opts.get("price_csv_path", "") or "").strip():
         problems.append(
-            "price_provider is 'manual_csv' but price_csv_path is empty, so "
-            "the offline fallback has no file to read. Every fetch would "
-            "return no-price-data with a filesystem error as its reason - "
-            "which is §11.4 behaviour arrived at by accident rather than by "
-            "configuration. Point it at the CSV, or set price_provider to "
-            "'off', which says the same thing on purpose.")
+            f"{S('price_provider')} is 'manual_csv', but "
+            f"{S('price_csv_path')} is empty. Set the path to the CSV file, or "
+            "choose 'off'.")
 
     return problems
 
 
+def _card_note(option: str, spec) -> str:
+    return (f"{S(option)} uses a tariff card dated {spec.card_month}, so copy "
+            "the new figures if your contract changed.")
+
+
+# UX-13: entity options whose number the add-on takes as watts, with no unit
+# conversion. pv.py converts each solar entity's own unit, so those are not here.
+WATT_ENTITY_KEYS = (
+    "meter_entity", "p1_net_entity", "p1_import_entity", "p1_export_entity",
+    "p1_phase_net_entities", "p1_phase_import_entities",
+    "p1_phase_export_entities", "batt_entity", "peak_forecast_entity")
+
+
+# The meter entities each `meter_source` reads through Home Assistant.
+METER_ENTITY_KEYS = {
+    "off": ("meter_entity",),
+    SOURCE_HA_SIGNED: ("p1_net_entity", "p1_phase_net_entities"),
+    SOURCE_HA: ("p1_import_entity", "p1_export_entity",
+                "p1_phase_import_entities", "p1_phase_export_entities")}
+
+
+def _entities_read(opts: dict) -> list[tuple[str, str, str]]:
+    """(key, inverter name or "", entity id) for each entity the add-on reads
+    with these options. Keys the chosen meter source or roster shape ignores
+    are left out, so a stale default is not reported."""
+    out = []
+
+    def add(key, value, where=""):
+        for e in (value if isinstance(value, list) else [value]):
+            if isinstance(e, str) and e.strip():
+                out.append((key, where, e.strip()))
+
+    source = str(opts.get("meter_source") or "off").strip()
+    for key in METER_ENTITY_KEYS.get(source, ()):
+        add(key, opts.get(key))
+    entries = roster_entries(opts)
+    if not entries:
+        for key in ("setpoint_entity", "soc_entity", "batt_entity"):
+            add(key, opts.get(key))
+    for i, entry in enumerate(entries):
+        if isinstance(entry, dict):
+            where = _unit_label(opts, i).strip().strip("()")
+            for key in ("setpoint_entity", "soc_entity", "batt_entity"):
+                add(key, entry.get(key), where)
+    solar = [e for e in (opts.get("pv_entities") or []) if str(e or "").strip()]
+    add("pv_entities" if solar else "pv_entity", list(pv.entities(opts)))
+    for key in ("peak_forecast_entity", "price_now_entity", "price_avg_entity"):
+        add(key, opts.get(key))
+    for key in FORECAST_KEYS:
+        add(key, opts.get(key))
+    return out
+
+
+def config_notes(opts: dict, *, entities: dict | None = None,
+                 month_peak_w=None) -> list[Note]:
+    """UX-13: warnings that need live data, for the settings page. Never a
+    refusal, and nothing here changes what `validate_startup_config()` says.
+
+    `entities` is Home Assistant's entity list by id (app/haentities.py), or
+    None when it could not be read, in which case those checks are skipped.
+    `month_peak_w` is this month's peak so far, or None.
+    """
+    notes: list[Note] = []
+    if entities is not None:
+        _entity_notes(notes, opts, entities)
+    cap = _number(opts, "peak_cap_w", None)
+    if month_peak_w is not None and cap is not None and cap < month_peak_w:
+        _advise(notes, "warn", ("peak_cap_w",),
+                f"This month's peak is already {messages.watts(month_peak_w)}, "
+                f"so a lower {S('peak_cap_w')} saves nothing until next month.")
+    return notes
+
+
+def _entity_notes(notes, opts: dict, entities: dict, bad=()) -> None:
+    """A note for each entity these options read that Home Assistant does not
+    have, or that reads in kW where watts are taken. A missing entity whose
+    key is in `bad` is a "bad" note, which blocks the setup wizard."""
+    for key, where, entity in _entities_read(opts):
+        row = entities.get(entity)
+        if row is None:
+            _advise(notes, "bad" if key in bad else "warn", (key,),
+                    f"Home Assistant has no entity {entity}, which "
+                    f"{S(key, where)} names.")
+            continue
+        unit = str(row.get("unit") or "")
+        if key in WATT_ENTITY_KEYS and unit in pv.WATTS_PER and unit != "W":
+            _advise(notes, "warn", (key,),
+                    f"{entity} reads in {unit}, but {S(key, where)} is "
+                    "taken as watts, so pick a sensor in W.")
+        if key in FORECAST_KEYS and unit not in solarfc.KWH_PER:
+            _advise(notes, "warn", (key,),
+                    f"{entity} does not read in kWh, so pick a solar "
+                    "forecast sensor in kWh.")
+    if any(opts.get(k) for k in FORECAST_KEYS) and \
+            opts.get("battery_modes_enabled") is not True:
+        _advise(notes, "info", ("pv_forecast_entity",),
+                "The solar forecast is used only with battery modes on.")
+    if opts.get("pv_forecast_tomorrow_entity") and \
+            not opts.get("pv_forecast_entity"):
+        _advise(notes, "warn", ("pv_forecast_tomorrow_entity",),
+                "Tomorrow's forecast is used only with today's, so set "
+                f"{S('pv_forecast_entity')} too.")
+
+
+# --------------------------------------------------------------------------- #
+# UX-13 P4: the setup wizard's last step
+# --------------------------------------------------------------------------- #
+# Below this a battery or solar reading counts as idle for a sign check.
+IDLE_W = 50.0
+# Meter + solar + battery is the house's use, never below zero. Below minus
+# this, read seconds apart, a direction is reversed (a battery giving power).
+BALANCE_W = 300.0
+# The keys that pick the meter. A meter the add-on reads itself (HomeWizard,
+# MQTT) is only known live when the running options read the same one.
+_METER_KEYS = ("meter_source", "p1_host", "meter_mqtt_topic")
+
+
+def power_request_entities(opts: dict) -> list:
+    """The power request entity of each inverter these options name: the flat
+    one, or each entry's. Blank ones are left out."""
+    entries = roster_entries(opts)
+    if not entries:
+        values = [opts.get("setpoint_entity")]
+    else:
+        values = [e.get("setpoint_entity") for e in entries
+                  if isinstance(e, dict)]
+    return [str(v).strip() for v in values
+            if isinstance(v, str) and v.strip()]
+
+
+def _reading(entities, entity, convert=False):
+    """(number, unit) of an entity's state, or (None, state text). The number
+    is as the add-on reads it: raw for the meter and battery power, which it
+    takes as watts, and in W for solar (`convert`), which pv.py converts."""
+    row = (entities or {}).get(entity) or {}
+    unit = str(row.get("unit") or "")
+    try:
+        value = float(row.get("state"))
+    except (TypeError, ValueError):
+        return None, str(row.get("state") or "nothing")
+    if value != value or value in (float("inf"), float("-inf")):
+        return None, str(row.get("state"))
+    return value * (pv.WATTS_PER.get(unit, 1.0) if convert else 1.0), unit
+
+
+def _signed(w) -> str:
+    return ("-" if w < 0 else "") + messages.watts(w)
+
+
+def _cards(opts: dict) -> list:
+    """(who, entry) per inverter: who is " for <name>" in a list, else ""."""
+    entries = roster_entries(opts)
+    if not entries:
+        return [("", {k: opts.get(k) for k in (
+            "setpoint_entity", "soc_entity", "batt_entity", "batt_invert")})]
+    out = []
+    for i, entry in enumerate(entries):
+        if isinstance(entry, dict):
+            name = _unit_label(opts, i).strip().strip("()")
+            out.append((f" for {name}" if name else "", entry))
+    return out
+
+
+def setup_checks(opts: dict, *, entities: dict | None, running=None,
+                 meter_now_w=None, prices_known=None) -> list[Note]:
+    """UX-13 P4: what the setup wizard's last step shows, beside the refusals.
+
+    Live checks on the proposed options: the meter reads, each power request
+    entity exists in Home Assistant (a write to a missing one is answered 200,
+    SAFETY-77, so only the entity list can tell), the battery levels read, and
+    prices are known. Tier "ok", "info", "warn", or "bad" for a missing power
+    request or meter entity, which the wizard will not save. Reads nothing itself:
+    `entities` is Home Assistant's list by id (None when it did not answer),
+    `running` the options this process started with, `meter_now_w` its meter
+    reading and `prices_known` how many of today's hours have a price.
+    """
+    notes: list[Note] = []
+    if entities is None:
+        # Red: only the list can tell a missing power request entity (SAFETY-77).
+        _advise(notes, "bad", ("setpoint_entity",), "Home Assistant is not "
+                "answering, so press Check again once it is back.")
+    else:
+        # A missing meter entity is red too (UX-15): with the kettle test
+        # skipped, nothing else on the way to the save would catch it.
+        meter_keys = {k for keys in METER_ENTITY_KEYS.values() for k in keys}
+        _entity_notes(notes, opts, entities,
+                      bad=("setpoint_entity",) + tuple(sorted(meter_keys)))
+    meter = _meter_check(notes, opts, entities, running, meter_now_w)
+    batts = [_card_checks(notes, who, entry, entities)
+             for who, entry in _cards(opts)]
+    solar = []
+    if entities is not None:
+        flipped = pv.inverted(opts)
+        for entity in pv.entities(opts):
+            w, _unit = _reading(entities, entity, convert=True)
+            if entity not in entities or w is None:
+                solar.append(None)
+                continue
+            if w < -IDLE_W and entity not in flipped:
+                solar.append(None)
+                _advise(notes, "warn", ("pv_invert_entities",),
+                        f"{entity} reads below zero now, so turn on its "
+                        "“Reads negative” switch in the Solar step.")
+            else:
+                w = -w if entity in flipped else w
+                solar.append(w)
+                _advise(notes, "ok", ("pv_entity",),
+                        f"{entity} reads {_signed(w)} of solar production "
+                        "now.")
+    # A battery sensor that reads the wrong way while giving power makes the
+    # house use less than nothing. Only with every term known: a missing
+    # solar reading could be the difference.
+    known = [meter] + batts + solar
+    if solar and batts and all(w is not None for w in known) \
+            and sum(known) < -BALANCE_W:
+        _advise(notes, "warn", ("batt_invert",),
+                f"The readings add up to {_signed(sum(known))} of house "
+                "use, so check each "
+                "battery's “Battery power sign is reversed” switch in step 2.")
+    _price_check(notes, opts, running, prices_known)
+    return notes
+
+
+def _meter_check(notes, opts, entities, running, meter_now_w):
+    """The meter line. Returns the grid reading in W (positive: taken from
+    the grid) as the add-on will read it, or None when it is not known."""
+    source = str(opts.get("meter_source") or "off").strip()
+    if source == "off":
+        parts = [(opts.get("meter_entity"), 1.0)]
+    elif source == SOURCE_HA_SIGNED:
+        parts = [(opts.get("p1_net_entity"), 1.0)]
+    elif source == SOURCE_HA:
+        parts = [(opts.get("p1_import_entity"), 1.0),
+                 (opts.get("p1_export_entity"), -1.0)]
+    else:
+        same = isinstance(running, dict) and all(
+            running.get(k) == opts.get(k) for k in _METER_KEYS)
+        if same and meter_now_w is not None:
+            _meter_line(notes, float(meter_now_w))
+            return float(meter_now_w)
+        _advise(notes, "info", ("meter_source",), "The add-on reads "
+                "this meter itself, so Home shows its reading after "
+                "the restart.")
+        return None
+    if entities is None:
+        return None
+    total = 0.0
+    for entity, sign in parts:
+        entity = str(entity or "").strip()
+        if not entity or entity not in entities:
+            return None         # a refusal or a missing-entity note says so
+        w, text = _reading(entities, entity)
+        if w is None:
+            _advise(notes, "warn", ("meter_source",),
+                    f"{entity} reads {text} now, so check it in Home "
+                    "Assistant before you start.")
+            return None
+        total += sign * w
+    if source == "off" and opts.get("meter_invert"):
+        total = -total
+    _meter_line(notes, total)
+    return total
+
+
+def _meter_line(notes, w) -> None:
+    if abs(w) < 1.0:
+        text = "The meter reads 0 W now."
+    elif w > 0:
+        text = f"The meter reads {messages.watts(w)} taken from the grid now."
+    else:
+        text = f"The meter reads {messages.watts(w)} fed into the grid now."
+    _advise(notes, "ok", ("meter_source",), text)
+
+
+def _card_checks(notes, who, entry, entities):
+    """The checks for one inverter's card. Returns its battery power in W,
+    positive while giving power, or None when it is not known."""
+    if entities is None:
+        return None
+    setpoint = str(entry.get("setpoint_entity") or "").strip()
+    if setpoint and setpoint in entities:
+        _advise(notes, "ok", ("setpoint_entity",),
+                f"Home Assistant has {setpoint}, the power request "
+                f"entity{who}.")
+    soc = str(entry.get("soc_entity") or "").strip()
+    if not soc:
+        _advise(notes, "warn", ("soc_entity",), f"There is no battery "
+                f"level entity{who}, so pick one in step 2 or the add-on "
+                "holds 0 W.")
+    elif soc in entities:
+        level, _unit = _reading(entities, soc)
+        if level is None or not 0.0 <= level <= 100.0:
+            _advise(notes, "warn", ("soc_entity",), f"The battery "
+                    f"level{who} reads nothing now, so check {soc}.")
+        else:
+            _advise(notes, "ok", ("soc_entity",),
+                    f"The battery level{who} reads {level:.0f} %.")
+    batt = str(entry.get("batt_entity") or "").strip()
+    if batt and batt in entities:
+        w, _unit = _reading(entities, batt)
+        if w is None:
+            _advise(notes, "warn", ("batt_entity",), f"The battery "
+                    f"power{who} reads nothing now, so check {batt}.")
+            return None
+        w = -w if entry.get("batt_invert") else w
+        if abs(w) < IDLE_W:
+            _advise(notes, "info", ("batt_entity",), f"The battery{who} is "
+                    "idle now, so check its direction on Home later.")
+        else:
+            doing = "giving power" if w > 0 else "charging"
+            _advise(notes, "info", ("batt_invert",),
+                    f"The battery{who} reads {messages.watts(w)} {doing} "
+                    "now, so check the inverter shows the same.")
+        return w
+    return None
+
+
+def _price_check(notes, opts, running, prices_known) -> None:
+    provider = str(opts.get("price_provider") or "off").strip()
+    profile = str(opts.get("static_profile") or "").strip()
+    if provider in ("", "off"):
+        if profile:
+            _advise(notes, "ok", ("static_profile",),
+                    "Your prices come from your contract, so they are "
+                    "always known.")
+        else:
+            _advise(notes, "info", ("price_provider",),
+                    "No prices are set, so the batteries do not charge "
+                    "on price.")
+        return
+    same = (isinstance(running, dict)
+            and str(running.get("price_provider") or "") == provider)
+    if same and prices_known:
+        _advise(notes, "ok", ("price_provider",),
+                f"Prices for today are in, for {prices_known} of 24 hours.")
+    else:
+        _advise(notes, "info", ("price_provider",),
+                "Prices are fetched after the restart, and Home shows them.")
+
+
+def _margin_problems(opts: dict) -> list[str]:
+    """Rule 12: `peak_margin_w` is a whole number in the schema's range, and
+    below the peak limit, which would leave nothing to aim at."""
+    raw = opts.get("peak_margin_w")
+    margin = _number(opts, "peak_margin_w",
+                     PEAK_OPTION_DEFAULTS["peak_margin_w"])
+    lo, hi = PEAK_MARGIN_RANGE_W
+    if margin is None or margin != int(margin) or not lo <= margin <= hi:
+        return [f"{S('peak_margin_w')} must be a whole number from {lo} to "
+                f"{hi} W. It is {messages.shown(raw)}."]
+    cap = _number(opts, "peak_cap_w", None)
+    if cap is not None and margin >= cap:
+        return [f"{S('peak_margin_w')} is {margin:.0f} W, not below the "
+                f"{S('peak_cap_w')} of {cap:.0f} W. Lower the margin."]
+    return []
+
+
+TRUST_RANGE_PCT = (30, 100)
+# A Home Assistant sensor id; it goes into the /api/states/<id> path.
+_SENSOR_ID = re.compile(r"sensor\.[a-z0-9_]+")
+FORECAST_KEYS = ("pv_forecast_entity", "pv_forecast_tomorrow_entity")
+
+
+def _forecast_problems(opts: dict) -> list[str]:
+    """Rule 13 (OPT-11 P4): the trust is a whole percentage in range, and
+    each forecast entity set is a sensor."""
+    out = []
+    raw = opts.get("solar_trust_pct")
+    trust = _number(opts, "solar_trust_pct", dayplan.DEFAULT_TRUST_PCT)
+    lo, hi = TRUST_RANGE_PCT
+    if trust is None or trust != int(trust) or not lo <= trust <= hi:
+        out.append(f"{S('solar_trust_pct')} must be a whole number from {lo} "
+                   f"to {hi} %. It is {messages.shown(raw)}.")
+    for key in FORECAST_KEYS:
+        e = opts.get(key)
+        if e is None or e == "":
+            continue
+        if not isinstance(e, str) or not _SENSOR_ID.fullmatch(e):
+            out.append(f"{S(key)} must be a sensor, like "
+                       f"sensor.energy_production_today_remaining. It is "
+                       f"{messages.shown(e)}.")
+    return out
+
+
 def _number(opts: dict, key, default):
     raw = opts.get(key, default)
     if raw is None or raw == "":
@@ -1813,11 +2114,9 @@ def refuse(problems: list[str]) -> None:
     at all and even the exit status distinguishes the two.
     """
     _LOG.error("=" * 72)
-    _LOG.error("REFUSING TO START: the add-on configuration is not usable.")
-    _LOG.error("This is a CONFIGURATION problem, not a crash. Nothing is broken;")
-    _LOG.error("the add-on will start as soon as the settings below are fixed.")
-    _LOG.error("Fix them in Settings > Add-ons > GoodWe RS485 Controller >")
-    _LOG.error("Configuration, then start the add-on again.")
+    _LOG.error("The add-on did not start, because its settings have problems.")
+    _LOG.error("Nothing is broken. Fix the settings below, then start it again.")
+    _LOG.error("They are on the add-on's Configuration tab.")
     _LOG.error("-" * 72)
     for i, problem in enumerate(problems, 1):
         _LOG.error("  %d. %s", i, problem)
diff --git a/goodwe_controller/app/watchdog.py b/goodwe_controller/app/watchdog.py
index bbe857b..8bb97b6 100644
--- a/goodwe_controller/app/watchdog.py
+++ b/goodwe_controller/app/watchdog.py
@@ -670,11 +670,10 @@ class SignWatchdog:
         # ⚠️ `self.against` IS THE ONLY THING SAFETY-30 CHANGED IN THIS STRING,
         # and it defaults to the wording that shipped - "a meter reading" - so a
         # one-inverter install's `reason` is byte-identical to what an operator
-        # (and test_watchdog.py) has always read. A per-unit instance names what
-        # it actually compared instead, because "commanded +1500 W against a
-        # meter reading -1500 W" would be a false statement about which
-        # instrument produced the evidence, on the one line somebody woken by
-        # this alarm reads first.
+        # has always read (test_watchdog.py pins its meaning). A per-unit
+        # instance names what it actually compared instead, because "commanded
+        # +1500 W against a meter reading -1500 W" would be a false statement
+        # about which instrument produced the evidence.
         self.reason = (
             f"SIGN_DISAGREEMENT: commanded {commanded_w:+.0f} W against "
             f"{self.against} {against_w:+.0f} W for {held:.0f} s continuously "
diff --git a/goodwe_controller/app/web.py b/goodwe_controller/app/web.py
index a21b736..ea953fa 100644
--- a/goodwe_controller/app/web.py
+++ b/goodwe_controller/app/web.py
@@ -10,7 +10,9 @@ a cellar, by someone who did not write it. Numbers alone are not enough - it
 says what is wrong in words.
 
 ⚠️ SINCE UX-02 THERE ARE TWO PAGES HERE, AND ONLY ONE OF THEM IS THIS FILE'S.
-`/` is the status and control surface and is unchanged. `/config` is the
+`/` is the status and control surface; since UX-13 P1 its files are in
+app/static/ and its Home screen reads the structured half of `/status`
+(app/homeview.py). `/config` is the
 configuration surface: its markup lives in app/config_page.py, its field model
 in app/configui.py and its Supervisor conversation in app/selfconfig.py. What
 stays HERE is the routing, so that the question a reviewer has to answer - does
@@ -24,97 +26,70 @@ routes below read `GET /addons/self/info`, run the SHIPPED validator, write
 mode or reaches `controller.handle_action()`. The set of things an operator can
 do to the inverter through this panel is exactly what `/action` offered before
 this card - test_selfconfig.py part 7 asserts that by listing the routes and the
-actions and comparing them with the shipped set.
+actions and comparing them with the shipped set. UX-13's `ha/entities` is a GET
+of Home Assistant's entity list (app/haentities.py) and writes nothing.
+UX-13 P4's setup wizard uses the same routes. The one thing it adds that is
+not options is a Store key, `setup_done`, written when the wizard's save
+succeeds, so the page stops opening the wizard by itself (uipage.setup_needed).
+UX-15's setup-only mode serves these routes from `setuponly.SetupOnly`, which
+commands nothing; there `/action` answers 409.
+OPT-11 P1 adds two `/action` values, `pack_use` and `pack_mode`, which set one
+battery's on/off switch or mode in the store (Controller._pack_action); P3 adds
+`pack_sell`, that battery's selling switch. They
+are the only actions that name a battery; the configuration routes still reach
+none of them.
 """
 
+import io
+import json
 import logging
+import os
+from datetime import datetime, timezone
 
 from aiohttp import web
 
-from . import selfconfig
+from . import messages, selfconfig, uipage, uitext
+from .haentities import EntityCache
+from .homeview import region_of
+from .validate import config_notes, setup_checks
 from .config_page import CONFIG_PAGE
 from .configui import changed_keys, field_model, problems_by_field
+from .uimodel import DeriveError, options_to_ui
 
 _LOG = logging.getLogger("goodwe.web")
 
-PAGE = """<!doctype html>
-<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>GoodWe RS485 Controller</title>
-<style>
- :root{--bg:#f5f6f8;--card:#fff;--ink:#1c1e21;--muted:#6b7280;--line:#e5e7eb;
-       --ok:#137333;--warn:#b25e02;--bad:#c5221f}
- @media(prefers-color-scheme:dark){:root{--bg:#111317;--card:#1b1e24;--ink:#e8eaed;
-       --muted:#9aa0a6;--line:#2c3038;--ok:#81c995;--warn:#fdd663;--bad:#f28b82}}
- *{box-sizing:border-box}
- body{margin:0;padding:16px;background:var(--bg);color:var(--ink);
-      font:15px/1.5 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
- h1{font-size:18px;margin:0 0 12px}
- .card{background:var(--card);border:1px solid var(--line);border-radius:10px;
-       padding:14px;margin-bottom:12px}
- .banner{font-weight:600;padding:12px 14px;border-radius:10px;margin-bottom:12px}
- .b-ok{background:rgba(19,115,51,.12);color:var(--ok)}
- .b-warn{background:rgba(178,94,2,.12);color:var(--warn)}
- .b-bad{background:rgba(197,34,31,.12);color:var(--bad)}
- table{width:100%;border-collapse:collapse}
- td{padding:6px 0;border-bottom:1px solid var(--line);vertical-align:top}
- td:last-child{text-align:right;font-variant-numeric:tabular-nums;font-weight:600}
- tr:last-child td{border-bottom:0}
- .k{color:var(--muted);font-weight:400}
- ul{margin:6px 0 0;padding-left:18px}
- li{margin:3px 0}
- .ok{color:var(--ok)} .bad{color:var(--bad)} .warn{color:var(--warn)}
- button{font:inherit;padding:9px 14px;border-radius:8px;border:1px solid var(--line);
-        background:var(--card);color:var(--ink);cursor:pointer;margin:0 6px 6px 0}
- button.primary{background:#1a73e8;border-color:#1a73e8;color:#fff}
- button.danger{background:var(--bad);border-color:var(--bad);color:#fff}
- .muted{color:var(--muted);font-size:13px}
-</style></head><body>
-<h1>GoodWe RS485 Controller</h1>
-<p class="muted"><a href="config">Configuration &rarr;</a></p>
-<div id="banner" class="banner b-warn">loading…</div>
+# OPT-11: the per-battery actions, which name a battery and a value.
+PACK_ACTIONS = ("pack_use", "pack_mode", "pack_sell")
 
-<div class="card">
-  <table id="live"></table>
-</div>
+# UX-13 P1: the page lives in app/static/ as three files - index.html,
+# app.css, app.js - plus the page words from app/ui_text/<lang>.json (English
+# and, since P5, Dutch; the page picks by the browser's language). They are
+# joined into ONE response here, once, so the page needs no second request
+# and no route of its own: the route list below is unchanged, and every URL
+# the page uses stays relative (ingress). No build step, no external file.
+STATIC = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static")
 
-<div class="card">
-  <div class="k">Commissioning</div>
-  <ul id="checks"></ul>
-</div>
 
-<div class="card">
-  <button class="primary" onclick="act('auto_toggle')">Start / stop control</button>
-  <button onclick="act('maint_start')">Force maintenance cycle</button>
-  <button class="danger" onclick="act('maint_abort')">Abort maintenance</button>
-  <div class="muted" id="hint"></div>
-</div>
+def _read(path):
+    with io.open(path, encoding="utf-8") as f:
+        return f.read()
 
-<script>
-async function refresh(){
-  try{
-    const r = await fetch('status', {cache:'no-store'});
-    const s = await r.json();
-    const b = document.getElementById('banner');
-    b.textContent = s.banner;
-    b.className = 'banner ' + (s.level==='ok'?'b-ok':s.level==='bad'?'b-bad':'b-warn');
-    document.getElementById('live').innerHTML = s.rows
-      .map(([k,v]) => `<tr><td class="k">${k}</td><td>${v}</td></tr>`).join('');
-    document.getElementById('checks').innerHTML = s.checks
-      .map(c => `<li class="${c.ok?'ok':(c.warn?'warn':'bad')}">${c.ok?'✓':(c.warn?'!':'✗')} ${c.text}</li>`)
-      .join('');
-    document.getElementById('hint').textContent = s.hint || '';
-  }catch(e){
-    document.getElementById('banner').textContent = 'cannot reach the add-on';
-  }
-}
-async function act(what){
-  await fetch('action', {method:'POST', headers:{'Content-Type':'application/json'},
-                         body: JSON.stringify({action: what})});
-  refresh();
-}
-refresh(); setInterval(refresh, 3000);
-</script></body></html>
-"""
+
+def page() -> str:
+    """The assembled index page. `</` is escaped inside the two inline
+    scripts, so no text in them can close the tag early."""
+    ui_text = json.dumps({lang: uitext.raw(lang) for lang in uitext.LANGS},
+                         ensure_ascii=False)
+    scripts = {}
+    for name in ("app.js", "settings.js"):
+        scripts[name] = _read(os.path.join(STATIC, name))
+        if "</script" in scripts[name].lower():
+            raise ValueError(f"{name} may not contain a closing script tag")
+    return (_read(os.path.join(STATIC, "index.html"))
+            .replace("/*APP_CSS*/", _read(os.path.join(STATIC, "app.css")))
+            .replace("/*UI_TEXT*/", ui_text.replace("</", "<\\/"))
+            .replace("/*APP_JS*/", scripts["app.js"])
+            .replace("/*SETTINGS_JS*/", scripts["settings.js"]))
 
 
 # ⚠️ WHAT THE PANEL SAYS WHEN IT COULD NOT READ A DEVICE RANGE. Two of
@@ -125,11 +100,8 @@ refresh(); setInterval(refresh, 3000);
 # them too, and says so, because a green page that is green for a reason the
 # operator cannot see is the exact failure this add-on keeps refusing to ship.
 DEVICE_NOTE = (
-    "%s did not report a range, so the two checks that compare a configured "
-    "ceiling against what the device itself accepts were skipped - here and at "
-    "startup, identically. Everything else was checked. If the device answers "
-    "later and disagrees, the add-on refuses to start then, with the same "
-    "message you would have seen here.")
+    "%s did not report its power range, so two checks were skipped, here and "
+    "at start. If they fail later, the add-on will not start then.")
 
 
 def build_app(controller, selfcfg=None) -> web.Application:
@@ -143,12 +115,34 @@ def build_app(controller, selfcfg=None) -> web.Application:
     if selfcfg is None:
         selfcfg = selfconfig.SelfConfig(controller.hass.session,
                                         controller.hass.token)
+    entities = EntityCache(controller.hass)
+    index_page = page()
+    # UX-13 P4: the blobs /config/model handed out, by fingerprint, so a stale
+    # save can name only the keys that moved underneath the page (finding a).
+    handed: dict = {}
+
+    def hand_out(options):
+        fp = selfconfig.fingerprint(options)
+        handed.pop(fp, None)
+        handed[fp] = options
+        while len(handed) > 16:
+            handed.pop(next(iter(handed)))
+        return fp
+
+    def store_data():
+        store = getattr(controller, "store", None)
+        data = getattr(store, "data", None)
+        return data if isinstance(data, dict) else None
 
     async def index(_request):
-        return web.Response(text=PAGE, content_type="text/html")
+        return web.Response(text=index_page, content_type="text/html")
 
-    async def status(_request):
-        return web.json_response(controller.status_payload())
+    async def status(request):
+        # UX-13 P5: Home's sentences in the page's language, English or Dutch.
+        lang = uitext.lang_of(request.query.get("lang"))
+        if lang == "en":
+            return web.json_response(controller.status_payload())
+        return web.json_response(controller.status_payload(lang=lang))
 
     async def action(request):
         try:
@@ -156,7 +150,21 @@ def build_app(controller, selfcfg=None) -> web.Application:
         except ValueError:
             raise web.HTTPBadRequest(text="expected JSON")
         what = body.get("action")
-        result = await controller.handle_action(what)
+        if getattr(controller, "setup_only", False):
+            # UX-15: nothing to start or stop until setup is saved.
+            return web.json_response(
+                {"ok": False, "error": messages.row_setup_only()}, status=409)
+        if what in PACK_ACTIONS:
+            # OPT-11: one battery's switch or mode. Store state for the named
+            # battery, applied on the next cycle; nothing is written here.
+            result = await controller.handle_action(
+                what, unit=body.get("unit"), value=body.get("value"))
+            if isinstance(result, dict) and "error" in result:
+                return web.json_response({"ok": False,
+                                          "error": result["error"]},
+                                         status=400)
+        else:
+            result = await controller.handle_action(what)
         if result is None:
             raise web.HTTPBadRequest(text=f"unknown action {what!r}")
         return web.json_response({"ok": True, "result": result})
@@ -165,15 +173,31 @@ def build_app(controller, selfcfg=None) -> web.Application:
     async def config_index(_request):
         return web.Response(text=CONFIG_PAGE, content_type="text/html")
 
-    async def _proposed(request):
+    async def _proposed(request, stored=None):
+        """(body, options, model). UX-13's settings view posts its page
+        `model`, which app/uimodel.py turns into the options blob here, so the
+        validator and the Supervisor only ever see a real blob. The classic
+        page posts `options`. Raises DeriveError for a model no blob can say.
+
+        With `stored` (a save) and the `base` model the page opened, only the
+        keys this page changed are written onto what is stored now, so a save
+        after a stale refusal keeps the other surface's changes (UX-15 F2)."""
         try:
             body = await request.json()
         except ValueError:
             raise web.HTTPBadRequest(text="expected JSON")
+        model = body.get("model")
+        if isinstance(model, dict):
+            mine = uipage.to_options(model, stored)
+            base = body.get("base")
+            if stored is not None and isinstance(base, dict):
+                was, _errors = uipage.to_options_partial(base, stored)
+                mine = uipage.only_edits(mine, was, stored)
+            return body, mine, model
         options = body.get("options")
         if not isinstance(options, dict):
             raise web.HTTPBadRequest(text="expected an options object")
-        return body, options
+        return body, options, None
 
     async def config_model(request):
         """Everything the page needs to draw itself, from ONE Supervisor call.
@@ -198,10 +222,25 @@ def build_app(controller, selfcfg=None) -> web.Application:
                             info.get("translations") or {}, lang)
         model.update({
             "options": options,
-            "fingerprint": selfconfig.fingerprint(options),
+            "fingerprint": hand_out(options),
             "running": controller.o,
             "running_differs": changed_keys(controller.o, options),
             "lang": lang,
+            # UX-13 P1: the levies preset and its year, for the P2 Settings
+            # screens, which show the year beside the region choice.
+            "region": region_of(options),
+            # UX-13 P2: the Installer view draws from these two.
+            "layout": uipage.layout(info.get("schema") or [],
+                                    info.get("translations") or {}, lang),
+            "ui": options_to_ui(options),
+            # UX-13 P4: the setup wizard, and why it opens by itself.
+            "setup": uipage.setup_spec(),
+            "setup_needed": uipage.setup_needed(
+                options, store_data(), bool(getattr(controller, "auto", False)),
+                fresh=getattr(getattr(controller, "store", None), "fresh",
+                              False) is True),
+            # UX-15: this process serves setup only and commands nothing.
+            "setup_only": getattr(controller, "setup_only", False) is True,
         })
         return web.json_response(model)
 
@@ -218,16 +257,60 @@ def build_app(controller, selfcfg=None) -> web.Application:
         product this card is delivering; anything this layer did to them would
         be a second opinion about a rule it does not own.
         """
-        _body, options = await _proposed(request)
+        try:
+            _body = await request.json()
+        except ValueError:
+            raise web.HTTPBadRequest(text="expected JSON")
+        model = _body.get("model")
+        errors = []
+        if isinstance(model, dict):
+            # UX-15 F1: a part the page cannot turn into options blocks its
+            # own step, and everything else is still checked.
+            options, errors = uipage.to_options_partial(model)
+        else:
+            model, options = None, _body.get("options")
+            if not isinstance(options, dict):
+                raise web.HTTPBadRequest(text="expected an options object")
+        notes = []
         problems, unread = await selfconfig.problems_and_ranges(
-            options, controller.hass)
+            options, controller.hass, notes=notes)
         by_key, unanchored = problems_by_field(problems, _keys_of(options))
+        # UX-13: warnings and info beside the refusals. Never block a save.
+        # The entity checks use the picker's cached list and never wait on HA.
+        notes += config_notes(options, entities=entities.peek())
         payload = {"problems": problems, "by_key": by_key,
-                   "unanchored": unanchored}
+                   "unanchored": unanchored,
+                   "notes": [n._asdict() for n in notes]}
         if unread:
             payload["device_note"] = DEVICE_NOTE % ", ".join(sorted(set(unread)))
+        if model is not None:
+            payload["messages"] = (
+                uipage.derive_messages(errors, problems, notes, model,
+                                       _keys_of(options),
+                                       uitext.lang_of(_body.get("lang")))
+                if errors
+                else uipage.anchors(problems, notes, model, _keys_of(options)))
+            payload["steps"] = uipage.step_problems(payload["messages"], model)
+        if _body.get("setup"):
+            payload["setup"] = [n._asdict() for n in await _setup_checks(options)]
         return web.json_response(payload)
 
+    async def _setup_checks(options):
+        """The wizard's live checks: a list at most a few seconds old, and
+        what the running add-on already knows (its meter, today's prices)."""
+        rows, age = await entities.get(max_age=5.0)
+        if age is not None and age >= 30.0:
+            rows = None             # Home Assistant is not answering
+        try:
+            prices = (controller.status_payload().get("plan") or {}).get(
+                "prices") or []
+            known = sum(1 for p in prices if p.get("eur_kwh") is not None)
+        except Exception:  # noqa: BLE001 - a display figure, never a failure
+            known = None
+        return setup_checks(options, entities=rows, running=controller.o,
+                            meter_now_w=getattr(controller, "grid", None),
+                            prices_known=known)
+
     def _keys_of(options):
         # ⚠️ THE ANCHOR LIST IS THE KEYS OF THE BLOB UNDER TEST, and that is
         # sound only because the page posts the WHOLE blob it read - which is
@@ -238,33 +321,78 @@ def build_app(controller, selfcfg=None) -> web.Application:
 
     async def config_save(request):
         """Validate, compare-and-swap, write. Or refuse and write NOTHING."""
-        body, options = await _proposed(request)
+        # The page model carries no stored values of the keys it shows, so the
+        # blob is settled against what is stored: an unchanged value is written
+        # exactly as stored (uipage.to_options).
+        try:
+            posted = await request.json()
+        except ValueError:
+            raise web.HTTPBadRequest(text="expected JSON")
+        stored_now = None
+        if isinstance(posted, dict) and isinstance(posted.get("model"), dict):
+            try:
+                stored_now = (await selfcfg.info()).get("options") or {}
+            except selfconfig.SupervisorUnavailable as err:
+                _LOG.error("saving options failed: %s", err)
+                return web.json_response({"error": str(err)}, status=502)
+        try:
+            body, options, model = await _proposed(request, stored_now)
+        except DeriveError:
+            model = posted["model"]
+            _opts, errors = uipage.to_options_partial(model, stored_now)
+            lang = uitext.lang_of(posted.get("lang"))
+            messages_ = [uipage.derive_message(e, lang) for e in errors]
+            return web.json_response(
+                {"kind": "invalid", "problems": [], "by_key": {},
+                 "unanchored": [], "messages": messages_,
+                 "steps": uipage.step_problems(messages_, model)},
+                status=422)
         expect = str(body.get("fingerprint") or "")
         try:
             result = await selfconfig.save(selfcfg, options, expect,
-                                           hass=controller.hass)
+                                           hass=controller.hass,
+                                           base=handed.get(expect))
         except selfconfig.SaveRefused as refused:
             if refused.kind == "stale":
                 stored = refused.stored or {}
+                # The fields to look at are the ones the OTHER surface moved,
+                # not this page's own edits (UX-13 P2 test, finding a).
+                moved = (refused.changed if refused.moved is None
+                         else refused.moved)
                 return web.json_response(
                     {"kind": "stale", "changed": refused.changed,
+                     "moved": refused.moved,
+                     "changed_fields": (uipage.fields_of(moved, model)
+                                        if model is not None else []),
                      "stored": stored,
                      # The page needs the CURRENT token to be able to save
                      # again after the operator has read the difference. That
                      # is not a force door: it takes a second, deliberate press
                      # made in front of what changed.
-                     "fingerprint": selfconfig.fingerprint(stored)},
+                     "fingerprint": hand_out(stored)},
                     status=409)
             by_key, unanchored = problems_by_field(refused.problems,
                                                    _keys_of(options))
-            return web.json_response(
-                {"kind": "invalid", "problems": refused.problems,
-                 "by_key": by_key, "unanchored": unanchored}, status=422)
+            payload = {"kind": "invalid", "problems": refused.problems,
+                       "by_key": by_key, "unanchored": unanchored}
+            if model is not None:
+                payload["messages"] = uipage.anchors(refused.problems, [],
+                                                     model, _keys_of(options))
+                payload["steps"] = uipage.step_problems(payload["messages"],
+                                                        model)
+            return web.json_response(payload, status=422)
         except selfconfig.SupervisorUnavailable as err:
             _LOG.error("saving options failed: %s", err)
             return web.json_response({"error": str(err)}, status=502)
         controller.log_event("configuration saved from the panel - "
-                             "not applied until the add-on restarts")
+                             "not applied until the add-on restarts",
+                             hint=messages.hint("settings_saved"))
+        # `handed` keeps `expect`: another page may have opened the same blob.
+        store = getattr(controller, "store", None)
+        if (model is not None and body.get("setup") == "done"
+                and store is not None):
+            store.set(uipage.SETUP_DONE,
+                      datetime.now(timezone.utc).isoformat(timespec="seconds"))
         return web.json_response({"ok": True, **result})
 
     async def config_restart(request):
@@ -288,9 +416,20 @@ def build_app(controller, selfcfg=None) -> web.Application:
         except selfconfig.SupervisorUnavailable as err:
             _LOG.error("restart request failed: %s", err)
             return web.json_response({"error": str(err)}, status=502)
-        controller.log_event("restart requested from the configuration panel")
+        controller.log_event("restart requested from the configuration panel",
+                             hint=messages.hint("restart_requested"))
         return web.json_response({"ok": True})
 
+    async def ha_entities(request):
+        """UX-13: Home Assistant's entities for the picker. A read only, and
+        never an error: when Home Assistant is down the list says so."""
+        kind = str(request.query.get("kind", "") or "")[:16]
+        one = str(request.query.get("entity", "") or "")[:255]
+        if one:
+            # UX-13 P4's kettle test: one entity, read now.
+            return web.json_response(await entities.reading(one))
+        return web.json_response(await entities.payload(kind))
+
     app = web.Application()
     app.add_routes([
         web.get("/", index),
@@ -301,12 +440,21 @@ def build_app(controller, selfcfg=None) -> web.Application:
         web.post("/config/validate", config_validate),
         web.post("/config/save", config_save),
         web.post("/config/restart", config_restart),
+        web.get("/ha/entities", ha_entities),
     ])
     return app
 
 
+def access_log():
+    """UX-10: the page polls /status every few seconds, and aiohttp logs each
+    request at INFO. That access log is kept for a DEBUG log level only."""
+    return (logging.getLogger("aiohttp.access")
+            if _LOG.isEnabledFor(logging.DEBUG) else None)
+
+
 async def start(controller, port: int = 8099, selfcfg=None):
-    runner = web.AppRunner(build_app(controller, selfcfg))
+    runner = web.AppRunner(build_app(controller, selfcfg),
+                           access_log=access_log())
     await runner.setup()
     site = web.TCPSite(runner, "0.0.0.0", port)
     await site.start()
diff --git a/goodwe_controller/config.yaml b/goodwe_controller/config.yaml
index 2e301b3..973f5a3 100644
--- a/goodwe_controller/config.yaml
+++ b/goodwe_controller/config.yaml
@@ -1,5 +1,5 @@
 name: GoodWe RS485 Controller
-version: "0.12.0"
+version: "0.13.0"
 slug: goodwe_controller
 description: >-
   Drives a GoodWe ES/BP battery inverter over RS485 by emulating its smart
@@ -93,7 +93,7 @@ options:
   # against a sibling's numbers; an entry silently inheriting `soc_entity` would
   # rebuild that defect in YAML. `name`, `setpoint_entity`, `max_w` and
   # `bms_soc_floor` are therefore REQUIRED of every entry (the schema below enforces it, and
-  # validate.py rule 9 enforces it again for the callers the Supervisor never
+  # validate.py rules 8 and 9 enforce it again for the callers the Supervisor never
   # sees). An omitted `soc_entity`/`batt_entity` means THIS UNIT HAS NO SUCH
   # SENSOR - `inputs_ok` already stops the site for that - and never means
   # "use the other one's".
@@ -146,6 +146,18 @@ options:
   # options blob, and the upgrade leaves an add-on that cannot start.
   inverters: []
   estop_fitted: false
+  # OPT-11: battery modes. Off by default, so an install that has not turned
+  # them on behaves exactly as before. When on, each battery gets an on/off
+  # switch and a mode on the Batteries screen, kept in the add-on's store.
+  # DECISIONS/OPT-11-battery-modes.md.
+  battery_modes_enabled: false
+  # OPT-11 P4: a Home Assistant solar forecast (kWh left today; tomorrow's is
+  # optional) and how much of it to count on. Read only with battery modes
+  # on; empty means no day plan (P3 option A). app/solarfc.py lists the
+  # integrations whose sensors fit.
+  pv_forecast_entity: ""
+  pv_forecast_tomorrow_entity: ""
+  solar_trust_pct: 70
 
   # TEL-11 - THE SITE'S PV PRODUCTION, IN WATTS, AND IT IS READ BY NOTHING THAT
   # DECIDES ANYTHING. Optional, empty on every install that does not set it, and
@@ -159,12 +171,8 @@ options:
   # So this takes whatever `sensor.*` the site's PV integration provides, any
   # brand Home Assistant can read.
   #
-  # ⚠️ POSITIVE IS PRODUCTION, and there is deliberately no `pv_invert` beside
-  # `meter_invert` and `batt_invert`. Those two quantities are bipolar AND are
-  # read by the control path, so a reversed sensor there is a plausible number
-  # the site acts on; production is unipolar and is read by nothing, so a
-  # reversed sensor announces itself as -4 kW at noon in the history this key
-  # exists to create. See DECISIONS/TEL-11-pv-production.md.
+  # POSITIVE IS PRODUCTION. An entity that reads the other way round goes in
+  # `pv_invert_entities` below - see DECISIONS/TEL-14-pv-sign.md.
   #
   # ⚠️ THE ENTITY'S OWN `unit_of_measurement` IS WHAT IS BELIEVED - W, kW, MW
   # and the rest of Home Assistant's power units. A sensor with no unit, or with
@@ -215,6 +223,12 @@ options:
   # which is also empty" - i.e. no PV channel at all, which is every install.
   pv_entities: []
 
+  # TEL-14. Every PV entity listed here (in `pv_entity` or `pv_entities`) has
+  # its sign flipped, for a kWh meter or power clamp that reads production as
+  # negative. Per entity, because one roster can mix both conventions. `[]` is
+  # load-bearing like `pv_entities: []`; see DECISIONS/TEL-14-pv-sign.md.
+  pv_invert_entities: []
+
   # ==========================================================================
   # METER - where the grid reading comes from
   # ==========================================================================
@@ -224,7 +238,7 @@ options:
   # ha_signed reads ONE signed HA entity (+ import / - export), which is what a
   # HomeWizard P1 publishes and what ha_dsmr cannot consume.
   # homewizard_local skips Home Assistant entirely and polls the meter's own
-  # local API. ⚠️ It is the ONLY mode whose sensor.p1_sample_age_s measures when
+  # local API. ⚠️ It is the ONLY mode whose sensor.goodwe_p1_sample_age measures when
   # the meter REPORTED rather than when the value last CHANGED - HA emits
   # nothing at all for a repeated reading - so it is the only mode a firmware
   # watchdog may threshold. See DOCS.md.
@@ -283,6 +297,8 @@ options:
   # protects the shallower pack with the deeper pack's number.
   bms_soc_floor: 10
   peak_cap_w: 3500
+  # SAFETY-79: the peak guard aims this many watts under peak_cap_w.
+  peak_margin_w: 50
   peak_forecast_entity: ""
 
   # The peak guard can COMMAND a discharge to hold a billed quarter under
@@ -916,12 +932,13 @@ schema:
   # batteries, whereas an absent capacity has an honest answer - no opinion
   # about the split, every unit weighs 1.0, which is what shipped.
   #
-  # ⚠️ THREE KEYS ARE REQUIRED PER ENTRY AND THAT IS DELIBERATE. An entry with
+  # ⚠️ FOUR KEYS ARE REQUIRED PER ENTRY AND THAT IS DELIBERATE. An entry with
   # no `name` has no Store namespace and would share another unit's SAFETY-02
   # latch; one with no `setpoint_entity` is a unit nothing can command; one with
   # no `max_w` would have to borrow a rating, which is the sibling-grading
-  # defect DEV-02 removed. The optional pair is the sensors, whose absence
-  # honestly means "this unit reports none".
+  # defect DEV-02 removed; `bms_soc_floor` is SAFETY-32's (options block above).
+  # The optional keys are the sensors, whose absence honestly means "this unit
+  # reports none", and `capacity_kwh`.
   #
   # ⚠️ THIS BLOCK IS DECLARED BEFORE `max_w:` ON PURPOSE. `max_w` now appears
   # TWICE under `schema:` - once nested here, once flat below - and a reader
@@ -940,6 +957,10 @@ schema:
       capacity_kwh: float(0.1,200)?
 
   estop_fitted: bool
+  battery_modes_enabled: bool
+  pv_forecast_entity: str?
+  pv_forecast_tomorrow_entity: str?
+  solar_trust_pct: int(30,100)
   # TEL-11. Optional, and OPTIONAL WITHOUT A COMPANION RULE - unlike
   # `price_now_entity`/`price_avg_entity`, which are legal only while
   # `price_provider` is `off` and make the add-on REFUSE TO START otherwise.
@@ -971,6 +992,10 @@ schema:
   # `p1_phase_import_entities` is the shipped precedent for the pair.
   pv_entities:
     - str
+  # TEL-14. A parallel list, not a prefix or a dict: measured by
+  # tools/supervisor_shape_probe.py section H, DECISIONS/TEL-14-pv-sign.md.
+  pv_invert_entities:
+    - str
 
   # ==========================================================================
   # METER - where the grid reading comes from
@@ -1006,6 +1031,7 @@ schema:
   max_w: int(100,5000)
   bms_soc_floor: int(0,50)
   peak_cap_w: int(500,15000)
+  peak_margin_w: int(0,500)
   peak_forecast_entity: str?
 
   # SAFETY-24. No "off" value: a guard that can command a discharge does not get
diff --git a/goodwe_controller/named_absence.py b/goodwe_controller/named_absence.py
new file mode 100644
index 0000000..eb78d36
--- /dev/null
+++ b/goodwe_controller/named_absence.py
@@ -0,0 +1,99 @@
+"""Read a value a check prints or grades without raising (TEST-26).
+
+Each test file is one script, so an IndexError in a print or a check name
+kills every check after it (MUTATION.md, FCST-06). Read through these instead,
+and conjoin `present(x)` in the check so the absence grades as a named FAIL.
+
+`ABSENT` values never raise: they format as `<ABSENT ...>` under any spec,
+index and attribute to themselves, compare unequal AND not-unequal, and are
+falsy. `not x`, `"a" not in x` and `all(... for _ in x)` are therefore TRUE of
+one, which is why the check needs the `present()` term. `int()`, `range()` and
+use as a list index still raise: guard those with `present()`.
+"""
+
+_NAN = float("nan")
+
+
+class Absent:
+    __slots__ = ("what",)
+
+    def __init__(self, what):
+        object.__setattr__(self, "what", what)
+
+    def __repr__(self):
+        return f"<ABSENT {self.what}>"
+
+    __str__ = __repr__
+
+    def __format__(self, spec):
+        return repr(self)
+
+    def __bool__(self):
+        return False
+
+    def __eq__(self, other):
+        return False
+
+    __ne__ = __lt__ = __le__ = __gt__ = __ge__ = __eq__
+
+    def __hash__(self):
+        return id(self)
+
+    def __getitem__(self, _):
+        return self
+
+    def __getattr__(self, _):
+        return self
+
+    def __call__(self, *_a, **_k):
+        return self
+
+    def __len__(self):
+        return 0
+
+    def __iter__(self):
+        return iter(())
+
+    def __contains__(self, _):
+        return False
+
+    def __float__(self):
+        return _NAN
+
+    def _same(self, *_):
+        return self
+
+    __add__ = __radd__ = __sub__ = __rsub__ = __mul__ = __rmul__ = _same
+    __truediv__ = __rtruediv__ = __floordiv__ = __rfloordiv__ = _same
+    __mod__ = __rmod__ = __neg__ = __pos__ = __abs__ = __round__ = _same
+
+
+def present(*xs):
+    """True when none of `xs` is an ABSENT stand-in."""
+    return not any(isinstance(x, Absent) for x in xs)
+
+
+def nth(seq, i=0, what=None):
+    """`seq[i]`, or an ABSENT saying how many items there were."""
+    n = 0 if seq is None else len(seq)
+    if -n <= i < n:
+        return seq[i]
+    return Absent(what or f"[{i}] of {n} item(s)")
+
+
+def first(it, what="no match"):
+    """`next(it)`, or ABSENT when it is exhausted."""
+    return next(iter(it), Absent(what))
+
+
+def field(mapping, key, what=None):
+    """`mapping[key]`, or ABSENT when the key (or the mapping) is missing."""
+    try:
+        return mapping[key]
+    except (KeyError, IndexError, TypeError):
+        return Absent(what or f"key {key!r}")
+
+
+def given(x, what="None"):
+    """`x`, or ABSENT when it is None - so `:.2f` and arithmetic cannot raise."""
+    return Absent(what) if x is None else x
diff --git a/goodwe_controller/scenarios/energy-charts-be-solar-price-2026-09-01_2026-09-17.json b/goodwe_controller/scenarios/energy-charts-be-solar-price-2026-09-01_2026-09-17.json
new file mode 100644
index 0000000..9fdbf21
--- /dev/null
+++ b/goodwe_controller/scenarios/energy-charts-be-solar-price-2026-09-01_2026-09-17.json
@@ -0,0 +1 @@
+{"source":"api.energy-charts.info (Fraunhofer ISE), fetched 2026-09-29 by the OPT-11 P4 dev agent","queries":{"solar_actual":"/public_power?country=be&start=2026-09-01&end=2026-09-18 (production type 'Solar')","solar_dayahead":"/public_power_forecast?country=be&production_type=solar&forecast_type=day-ahead&start=2026-09-01&end=2026-09-18","price":"/price?bzn=BE&start=2026-09-01&end=2026-09-18"},"units":{"solar":"MW, Belgium, hourly (value at the hour's start)","price":"EUR/MWh, day-ahead, 15-minute"},"solar":{"unix_seconds":[1788213600,1788217200,1788220800,1788224400,1788228000,1788231600,1788235200,1788238800,1788242400,1788246000,1788249600,1788253200,1788256800,1788260400,1788264000,1788267600,1788271200,1788274800,1788278400,1788282000,1788285600,1788289200,1788292800,1788296400,1788300000,1788303600,1788307200,1788310800,1788314400,1788318000,1788321600,1788325200,1788328800,1788332400,1788336000,1788339600,1788343200,1788346800,1788350400,1788354000,1788357600,1788361200,1788364800,1788368400,1788372000,1788375600,1788379200,1788382800,1788386400,1788390000,1788393600,1788397200,1788400800,1788404400,1788408000,1788411600,1788415200,1788418800,1788422400,1788426000,1788429600,1788433200,1788436800,1788440400,1788444000,1788447600,1788451200,1788454800,1788458400,1788462000,1788465600,1788469200,1788472800,1788476400,1788480000,1788483600,1788487200,1788490800,1788494400,1788498000,1788501600,1788505200,1788508800,1788512400,1788516000,1788519600,1788523200,1788526800,1788530400,1788534000,1788537600,1788541200,1788544800,1788548400,1788552000,1788555600,1788559200,1788562800,1788566400,1788570000,1788573600,1788577200,1788580800,1788584400,1788588000,1788591600,1788595200,1788598800,1788602400,1788606000,1788609600,1788613200,1788616800,1788620400,1788624000,1788627600,1788631200,1788634800,1788638400,1788642000,1788645600,1788649200,1788652800,1788656400,1788660000,1788663600,1788667200,1788670800,1788674400,1788678000,1788681600,1788685200,1788688800,1788692400,1788696000,1788699600,1788703200,1788706800,1788710400,1788714000,1788717600,1788721200,1788724800,1788728400,1788732000,1788735600,1788739200,1788742800,1788746400,1788750000,1788753600,1788757200,1788760800,1788764400,1788768000,1788771600,1788775200,1788778800,1788782400,1788786000,1788789600,1788793200,1788796800,1788800400,1788804000,1788807600,1788811200,1788814800,1788818400,1788822000,1788825600,1788829200,1788832800,1788836400,1788840000,1788843600,1788847200,1788850800,1788854400,1788858000,1788861600,1788865200,1788868800,1788872400,1788876000,1788879600,1788883200,1788886800,1788890400,1788894000,1788897600,1788901200,1788904800,1788908400,1788912000,1788915600,1788919200,1788922800,1788926400,1788930000,1788933600,1788937200,1788940800,1788944400,1788948000,1788951600,1788955200,1788958800,1788962400,1788966000,1788969600,1788973200,1788976800,1788980400,1788984000,1788987600,1788991200,1788994800,1788998400,1789002000,1789005600,1789009200,1789012800,1789016400,1789020000,1789023600,1789027200,1789030800,1789034400,1789038000,1789041600,1789045200,1789048800,1789052400,1789056000,1789059600,1789063200,1789066800,1789070400,1789074000,1789077600,1789081200,1789084800,1789088400,1789092000,1789095600,1789099200,1789102800,1789106400,1789110000,1789113600,1789117200,1789120800,1789124400,1789128000,1789131600,1789135200,1789138800,1789142400,1789146000,1789149600,1789153200,1789156800,1789160400,1789164000,1789167600,1789171200,1789174800,1789178400,1789182000,1789185600,1789189200,1789192800,1789196400,1789200000,1789203600,1789207200,1789210800,1789214400,1789218000,1789221600,1789225200,1789228800,1789232400,1789236000,1789239600,1789243200,1789246800,1789250400,1789254000,1789257600,1789261200,1789264800,1789268400,1789272000,1789275600,1789279200,1789282800,1789286400,1789290000,1789293600,1789297200,1789300800,1789304400,1789308000,1789311600,1789315200,1789318800,1789322400,1789326000,1789329600,1789333200,1789336800,1789340400,1789344000,1789347600,1789351200,1789354800,1789358400,1789362000,1789365600,1789369200,1789372800,1789376400,1789380000,1789383600,1789387200,1789390800,1789394400,1789398000,1789401600,1789405200,1789408800,1789412400,1789416000,1789419600,1789423200,1789426800,1789430400,1789434000,1789437600,1789441200,1789444800,1789448400,1789452000,1789455600,1789459200,1789462800,1789466400,1789470000,1789473600,1789477200,1789480800,1789484400,1789488000,1789491600,1789495200,1789498800,1789502400,1789506000,1789509600,1789513200,1789516800,1789520400,1789524000,1789527600,1789531200,1789534800,1789538400,1789542000,1789545600,1789549200,1789552800,1789556400,1789560000,1789563600,1789567200,1789570800,1789574400,1789578000,1789581600,1789585200,1789588800,1789592400,1789596000,1789599600,1789603200,1789606800,1789610400,1789614000,1789617600,1789621200,1789624800,1789628400,1789632000,1789635600,1789639200,1789642800,1789646400,1789650000,1789653600,1789657200,1789660800,1789664400,1789668000,1789671600,1789675200,1789678800,1789682400,1789686000,1789689600,1789693200,1789696800,1789700400,1789704000,1789707600,1789711200,1789714800,1789718400,1789722000,1789725600,1789729200,1789732800,1789736400,1789740000,1789743600,1789747200,1789750800,1789754400,1789758000,1789761600,1789765200],"actual_mw":[0.0,0.0,0.0,0.0,0.0,0.0,0.0,114.2,727.9,1795.6,2975.4,4152.6,4776.3,5060.0,5008.0,4769.2,4214.3,3123.2,1785.2,562.2,10.9,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,239.0,1152.6,2390.5,4109.2,5007.6,4605.0,4081.8,4021.1,3269.8,2573.1,1817.2,1013.0,347.4,9.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,82.3,409.7,617.9,926.0,1321.1,2109.5,2820.2,2437.3,1991.8,2042.2,1634.3,789.5,188.4,1.9,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,89.4,523.5,1018.8,1829.1,2278.5,2171.7,1935.4,1826.6,1602.5,1399.9,1364.0,649.9,90.3,0.1,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,231.2,1101.9,2818.2,4429.7,5025.5,5602.2,5867.7,6134.0,5736.9,4874.9,3547.5,2040.9,612.7,14.8,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,273.5,1651.3,3127.0,4962.8,6487.6,7290.2,7738.9,7678.3,6752.6,4974.2,2970.4,1176.5,208.6,3.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,186.4,1269.8,2663.0,4342.6,5950.7,6952.1,7100.3,6669.3,5082.1,3329.3,2176.2,1026.7,253.7,1.7,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,105.9,699.2,1474.3,2499.7,3709.1,4432.7,4692.1,4138.1,2714.1,1336.2,530.6,468.6,249.4,1.9,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,229.0,1363.2,2907.2,4156.2,4636.4,4739.1,4359.9,3858.8,3924.7,3439.0,2506.1,1451.3,385.2,3.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,166.4,1302.4,2891.5,4667.7,6100.6,6561.2,6345.8,5839.1,5238.4,4359.7,3104.7,1523.4,286.4,0.1,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,42.4,522.1,1210.9,1860.8,2570.2,2983.2,3386.0,3243.2,3053.6,2819.0,2209.5,1296.1,317.4,0.1,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,74.3,809.8,2135.0,3659.9,4665.3,5282.2,5795.2,5377.6,4478.5,3348.8,2103.9,922.4,160.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,9.7,146.9,445.4,716.1,826.9,800.3,1071.0,1563.0,1688.9,1187.6,837.5,509.4,101.4,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,15.6,194.1,574.0,1015.5,1604.0,2296.5,2906.4,3495.3,3890.8,3586.0,2424.4,1352.6,285.7,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,117.8,1325.2,2984.4,4799.4,6173.9,6854.3,6621.2,5843.8,4587.6,3345.7,2034.7,899.5,151.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,64.7,921.0,2446.8,3716.5,4561.2,5240.0,5652.1,5521.4,5072.2,4196.4,2557.7,1124.3,174.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,30.5,552.4,1685.5,2813.2,3861.4,3806.6,3110.2,2338.1,1741.2,1280.2,806.7,423.5,86.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,75.5,1116.1,2859.4,4623.4,5413.3,5489.7,5656.1,5533.0,5292.3,4425.7,2814.5,1287.5,98.8,0.0,0.0,0.0,0.0],"dayahead_unix_seconds":[1788213600,1788217200,1788220800,1788224400,1788228000,1788231600,1788235200,1788238800,1788242400,1788246000,1788249600,1788253200,1788256800,1788260400,1788264000,1788267600,1788271200,1788274800,1788278400,1788282000,1788285600,1788289200,1788292800,1788296400,1788300000,1788303600,1788307200,1788310800,1788314400,1788318000,1788321600,1788325200,1788328800,1788332400,1788336000,1788339600,1788343200,1788346800,1788350400,1788354000,1788357600,1788361200,1788364800,1788368400,1788372000,1788375600,1788379200,1788382800,1788386400,1788390000,1788393600,1788397200,1788400800,1788404400,1788408000,1788411600,1788415200,1788418800,1788422400,1788426000,1788429600,1788433200,1788436800,1788440400,1788444000,1788447600,1788451200,1788454800,1788458400,1788462000,1788465600,1788469200,1788472800,1788476400,1788480000,1788483600,1788487200,1788490800,1788494400,1788498000,1788501600,1788505200,1788508800,1788512400,1788516000,1788519600,1788523200,1788526800,1788530400,1788534000,1788537600,1788541200,1788544800,1788548400,1788552000,1788555600,1788559200,1788562800,1788566400,1788570000,1788573600,1788577200,1788580800,1788584400,1788588000,1788591600,1788595200,1788598800,1788602400,1788606000,1788609600,1788613200,1788616800,1788620400,1788624000,1788627600,1788631200,1788634800,1788638400,1788642000,1788645600,1788649200,1788652800,1788656400,1788660000,1788663600,1788667200,1788670800,1788674400,1788678000,1788681600,1788685200,1788688800,1788692400,1788696000,1788699600,1788703200,1788706800,1788710400,1788714000,1788717600,1788721200,1788724800,1788728400,1788732000,1788735600,1788739200,1788742800,1788746400,1788750000,1788753600,1788757200,1788760800,1788764400,1788768000,1788771600,1788775200,1788778800,1788782400,1788786000,1788789600,1788793200,1788796800,1788800400,1788804000,1788807600,1788811200,1788814800,1788818400,1788822000,1788825600,1788829200,1788832800,1788836400,1788840000,1788843600,1788847200,1788850800,1788854400,1788858000,1788861600,1788865200,1788868800,1788872400,1788876000,1788879600,1788883200,1788886800,1788890400,1788894000,1788897600,1788901200,1788904800,1788908400,1788912000,1788915600,1788919200,1788922800,1788926400,1788930000,1788933600,1788937200,1788940800,1788944400,1788948000,1788951600,1788955200,1788958800,1788962400,1788966000,1788969600,1788973200,1788976800,1788980400,1788984000,1788987600,1788991200,1788994800,1788998400,1789002000,1789005600,1789009200,1789012800,1789016400,1789020000,1789023600,1789027200,1789030800,1789034400,1789038000,1789041600,1789045200,1789048800,1789052400,1789056000,1789059600,1789063200,1789066800,1789070400,1789074000,1789077600,1789081200,1789084800,1789088400,1789092000,1789095600,1789099200,1789102800,1789106400,1789110000,1789113600,1789117200,1789120800,1789124400,1789128000,1789131600,1789135200,1789138800,1789142400,1789146000,1789149600,1789153200,1789156800,1789160400,1789164000,1789167600,1789171200,1789174800,1789178400,1789182000,1789185600,1789189200,1789192800,1789196400,1789200000,1789203600,1789207200,1789210800,1789214400,1789218000,1789221600,1789225200,1789228800,1789232400,1789236000,1789239600,1789243200,1789246800,1789250400,1789254000,1789257600,1789261200,1789264800,1789268400,1789272000,1789275600,1789279200,1789282800,1789286400,1789290000,1789293600,1789297200,1789300800,1789304400,1789308000,1789311600,1789315200,1789318800,1789322400,1789326000,1789329600,1789333200,1789336800,1789340400,1789344000,1789347600,1789351200,1789354800,1789358400,1789362000,1789365600,1789369200,1789372800,1789376400,1789380000,1789383600,1789387200,1789390800,1789394400,1789398000,1789401600,1789405200,1789408800,1789412400,1789416000,1789419600,1789423200,1789426800,1789430400,1789434000,1789437600,1789441200,1789444800,1789448400,1789452000,1789455600,1789459200,1789462800,1789466400,1789470000,1789473600,1789477200,1789480800,1789484400,1789488000,1789491600,1789495200,1789498800,1789502400,1789506000,1789509600,1789513200,1789516800,1789520400,1789524000,1789527600,1789531200,1789534800,1789538400,1789542000,1789545600,1789549200,1789552800,1789556400,1789560000,1789563600,1789567200,1789570800,1789574400,1789578000,1789581600,1789585200,1789588800,1789592400,1789596000,1789599600,1789603200,1789606800,1789610400,1789614000,1789617600,1789621200,1789624800,1789628400,1789632000,1789635600,1789639200,1789642800,1789646400,1789650000,1789653600,1789657200,1789660800,1789664400,1789668000,1789671600,1789675200,1789678800,1789682400,1789686000,1789689600,1789693200,1789696800,1789700400,1789704000,1789707600,1789711200,1789714800,1789718400,1789722000,1789725600,1789729200,1789732800,1789736400,1789740000,1789743600,1789747200,1789750800,1789754400,1789758000,1789761600,1789765200],"dayahead_mw":[0.0,0.0,0.0,0.0,0.0,0.0,0.4,216.8,970.2,1764.6,2632.7,3541.0,4193.7,4455.6,4397.4,4093.4,3438.9,2603.6,1544.1,532.9,33.1,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.2,229.5,1139.6,2380.4,3495.0,4040.3,4075.9,3816.1,3349.8,2825.6,2266.2,1671.4,1024.5,378.5,19.9,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,96.5,453.4,828.2,1198.3,1711.3,2324.8,2792.9,3042.9,3026.8,2635.1,1879.1,1095.4,395.5,17.8,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,99.7,495.9,1021.1,1557.0,2058.4,2387.2,2364.9,2093.4,1729.9,1386.8,998.8,586.9,202.7,7.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,201.6,1236.4,2781.8,4162.3,5028.8,5460.7,5777.0,5827.4,5469.8,4722.4,3461.3,1787.2,469.6,15.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,201.8,1350.0,3063.8,4509.0,5599.3,6385.8,6741.5,6595.2,5984.5,4926.2,3361.5,1638.5,451.2,11.8,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,186.9,1206.6,2818.4,4465.9,5667.5,6276.1,6168.8,5559.8,4724.5,3723.5,2535.8,1311.3,379.6,7.7,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,107.9,632.7,1274.3,1990.8,2671.8,3026.4,3066.6,2829.2,2260.1,1531.2,887.6,416.4,118.2,1.7,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,166.6,1277.6,2941.7,4171.6,4781.4,5014.0,4967.6,4637.6,3959.4,3200.6,2224.8,1240.6,322.5,4.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,153.6,1267.9,3169.3,4881.5,5991.8,6225.3,5928.2,5330.3,4600.3,3718.3,2569.7,1355.4,324.5,2.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,60.7,394.8,904.1,1551.7,2229.4,2766.4,3180.6,3329.4,3176.2,2793.1,2131.7,1211.2,282.7,1.4,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,113.0,885.8,2077.2,3360.1,4519.9,5344.4,5608.2,5436.0,4890.1,4055.2,2806.9,1398.3,293.1,0.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,29.3,202.3,417.5,601.6,747.3,883.8,973.5,1142.9,1322.1,1310.2,1079.3,640.1,148.2,0.1,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,46.4,358.3,780.1,1257.9,1778.8,2303.7,2715.1,2953.3,2894.0,2528.8,1914.0,1051.9,210.3,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,114.2,1209.6,3154.6,4922.3,6232.4,6986.1,7017.0,6445.2,5349.5,3941.9,2367.9,1093.5,202.2,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,93.0,1002.2,2592.9,3944.7,4621.7,4890.2,4988.8,4918.6,4583.5,3928.1,2748.8,1284.6,205.4,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,54.5,515.3,1190.5,1774.4,2228.6,2377.4,2132.7,1682.6,1311.8,1044.7,735.4,376.4,68.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,84.0,1077.3,2940.8,4618.6,5669.8,6127.5,6085.3,5699.0,5050.0,4026.0,2593.9,1120.8,158.6,0.0,0.0,0.0,0.0]},"price":{"unix_seconds":[1788213600,1788214500,1788215400,1788216300,1788217200,1788218100,1788219000,1788219900,1788220800,1788221700,1788222600,1788223500,1788224400,1788225300,1788226200,1788227100,1788228000,1788228900,1788229800,1788230700,1788231600,1788232500,1788233400,1788234300,1788235200,1788236100,1788237000,1788237900,1788238800,1788239700,1788240600,1788241500,1788242400,1788243300,1788244200,1788245100,1788246000,1788246900,1788247800,1788248700,1788249600,1788250500,1788251400,1788252300,1788253200,1788254100,1788255000,1788255900,1788256800,1788257700,1788258600,1788259500,1788260400,1788261300,1788262200,1788263100,1788264000,1788264900,1788265800,1788266700,1788267600,1788268500,1788269400,1788270300,1788271200,1788272100,1788273000,1788273900,1788274800,1788275700,1788276600,1788277500,1788278400,1788279300,1788280200,1788281100,1788282000,1788282900,1788283800,1788284700,1788285600,1788286500,1788287400,1788288300,1788289200,1788290100,1788291000,1788291900,1788292800,1788293700,1788294600,1788295500,1788296400,1788297300,1788298200,1788299100,1788300000,1788300900,1788301800,1788302700,1788303600,1788304500,1788305400,1788306300,1788307200,1788308100,1788309000,1788309900,1788310800,1788311700,1788312600,1788313500,1788314400,1788315300,1788316200,1788317100,1788318000,1788318900,1788319800,1788320700,1788321600,1788322500,1788323400,1788324300,1788325200,1788326100,1788327000,1788327900,1788328800,1788329700,1788330600,1788331500,1788332400,1788333300,1788334200,1788335100,1788336000,1788336900,1788337800,1788338700,1788339600,1788340500,1788341400,1788342300,1788343200,1788344100,1788345000,1788345900,1788346800,1788347700,1788348600,1788349500,1788350400,1788351300,1788352200,1788353100,1788354000,1788354900,1788355800,1788356700,1788357600,1788358500,1788359400,1788360300,1788361200,1788362100,1788363000,1788363900,1788364800,1788365700,1788366600,1788367500,1788368400,1788369300,1788370200,1788371100,1788372000,1788372900,1788373800,1788374700,1788375600,1788376500,1788377400,1788378300,1788379200,1788380100,1788381000,1788381900,1788382800,1788383700,1788384600,1788385500,1788386400,1788387300,1788388200,1788389100,1788390000,1788390900,1788391800,1788392700,1788393600,1788394500,1788395400,1788396300,1788397200,1788398100,1788399000,1788399900,1788400800,1788401700,1788402600,1788403500,1788404400,1788405300,1788406200,1788407100,1788408000,1788408900,1788409800,1788410700,1788411600,1788412500,1788413400,1788414300,1788415200,1788416100,1788417000,1788417900,1788418800,1788419700,1788420600,1788421500,1788422400,1788423300,1788424200,1788425100,1788426000,1788426900,1788427800,1788428700,1788429600,1788430500,1788431400,1788432300,1788433200,1788434100,1788435000,1788435900,1788436800,1788437700,1788438600,1788439500,1788440400,1788441300,1788442200,1788443100,1788444000,1788444900,1788445800,1788446700,1788447600,1788448500,1788449400,1788450300,1788451200,1788452100,1788453000,1788453900,1788454800,1788455700,1788456600,1788457500,1788458400,1788459300,1788460200,1788461100,1788462000,1788462900,1788463800,1788464700,1788465600,1788466500,1788467400,1788468300,1788469200,1788470100,1788471000,1788471900,1788472800,1788473700,1788474600,1788475500,1788476400,1788477300,1788478200,1788479100,1788480000,1788480900,1788481800,1788482700,1788483600,1788484500,1788485400,1788486300,1788487200,1788488100,1788489000,1788489900,1788490800,1788491700,1788492600,1788493500,1788494400,1788495300,1788496200,1788497100,1788498000,1788498900,1788499800,1788500700,1788501600,1788502500,1788503400,1788504300,1788505200,1788506100,1788507000,1788507900,1788508800,1788509700,1788510600,1788511500,1788512400,1788513300,1788514200,1788515100,1788516000,1788516900,1788517800,1788518700,1788519600,1788520500,1788521400,1788522300,1788523200,1788524100,1788525000,1788525900,1788526800,1788527700,1788528600,1788529500,1788530400,1788531300,1788532200,1788533100,1788534000,1788534900,1788535800,1788536700,1788537600,1788538500,1788539400,1788540300,1788541200,1788542100,1788543000,1788543900,1788544800,1788545700,1788546600,1788547500,1788548400,1788549300,1788550200,1788551100,1788552000,1788552900,1788553800,1788554700,1788555600,1788556500,1788557400,1788558300,1788559200,1788560100,1788561000,1788561900,1788562800,1788563700,1788564600,1788565500,1788566400,1788567300,1788568200,1788569100,1788570000,1788570900,1788571800,1788572700,1788573600,1788574500,1788575400,1788576300,1788577200,1788578100,1788579000,1788579900,1788580800,1788581700,1788582600,1788583500,1788584400,1788585300,1788586200,1788587100,1788588000,1788588900,1788589800,1788590700,1788591600,1788592500,1788593400,1788594300,1788595200,1788596100,1788597000,1788597900,1788598800,1788599700,1788600600,1788601500,1788602400,1788603300,1788604200,1788605100,1788606000,1788606900,1788607800,1788608700,1788609600,1788610500,1788611400,1788612300,1788613200,1788614100,1788615000,1788615900,1788616800,1788617700,1788618600,1788619500,1788620400,1788621300,1788622200,1788623100,1788624000,1788624900,1788625800,1788626700,1788627600,1788628500,1788629400,1788630300,1788631200,1788632100,1788633000,1788633900,1788634800,1788635700,1788636600,1788637500,1788638400,1788639300,1788640200,1788641100,1788642000,1788642900,1788643800,1788644700,1788645600,1788646500,1788647400,1788648300,1788649200,1788650100,1788651000,1788651900,1788652800,1788653700,1788654600,1788655500,1788656400,1788657300,1788658200,1788659100,1788660000,1788660900,1788661800,1788662700,1788663600,1788664500,1788665400,1788666300,1788667200,1788668100,1788669000,1788669900,1788670800,1788671700,1788672600,1788673500,1788674400,1788675300,1788676200,1788677100,1788678000,1788678900,1788679800,1788680700,1788681600,1788682500,1788683400,1788684300,1788685200,1788686100,1788687000,1788687900,1788688800,1788689700,1788690600,1788691500,1788692400,1788693300,1788694200,1788695100,1788696000,1788696900,1788697800,1788698700,1788699600,1788700500,1788701400,1788702300,1788703200,1788704100,1788705000,1788705900,1788706800,1788707700,1788708600,1788709500,1788710400,1788711300,1788712200,1788713100,1788714000,1788714900,1788715800,1788716700,1788717600,1788718500,1788719400,1788720300,1788721200,1788722100,1788723000,1788723900,1788724800,1788725700,1788726600,1788727500,1788728400,1788729300,1788730200,1788731100,1788732000,1788732900,1788733800,1788734700,1788735600,1788736500,1788737400,1788738300,1788739200,1788740100,1788741000,1788741900,1788742800,1788743700,1788744600,1788745500,1788746400,1788747300,1788748200,1788749100,1788750000,1788750900,1788751800,1788752700,1788753600,1788754500,1788755400,1788756300,1788757200,1788758100,1788759000,1788759900,1788760800,1788761700,1788762600,1788763500,1788764400,1788765300,1788766200,1788767100,1788768000,1788768900,1788769800,1788770700,1788771600,1788772500,1788773400,1788774300,1788775200,1788776100,1788777000,1788777900,1788778800,1788779700,1788780600,1788781500,1788782400,1788783300,1788784200,1788785100,1788786000,1788786900,1788787800,1788788700,1788789600,1788790500,1788791400,1788792300,1788793200,1788794100,1788795000,1788795900,1788796800,1788797700,1788798600,1788799500,1788800400,1788801300,1788802200,1788803100,1788804000,1788804900,1788805800,1788806700,1788807600,1788808500,1788809400,1788810300,1788811200,1788812100,1788813000,1788813900,1788814800,1788815700,1788816600,1788817500,1788818400,1788819300,1788820200,1788821100,1788822000,1788822900,1788823800,1788824700,1788825600,1788826500,1788827400,1788828300,1788829200,1788830100,1788831000,1788831900,1788832800,1788833700,1788834600,1788835500,1788836400,1788837300,1788838200,1788839100,1788840000,1788840900,1788841800,1788842700,1788843600,1788844500,1788845400,1788846300,1788847200,1788848100,1788849000,1788849900,1788850800,1788851700,1788852600,1788853500,1788854400,1788855300,1788856200,1788857100,1788858000,1788858900,1788859800,1788860700,1788861600,1788862500,1788863400,1788864300,1788865200,1788866100,1788867000,1788867900,1788868800,1788869700,1788870600,1788871500,1788872400,1788873300,1788874200,1788875100,1788876000,1788876900,1788877800,1788878700,1788879600,1788880500,1788881400,1788882300,1788883200,1788884100,1788885000,1788885900,1788886800,1788887700,1788888600,1788889500,1788890400,1788891300,1788892200,1788893100,1788894000,1788894900,1788895800,1788896700,1788897600,1788898500,1788899400,1788900300,1788901200,1788902100,1788903000,1788903900,1788904800,1788905700,1788906600,1788907500,1788908400,1788909300,1788910200,1788911100,1788912000,1788912900,1788913800,1788914700,1788915600,1788916500,1788917400,1788918300,1788919200,1788920100,1788921000,1788921900,1788922800,1788923700,1788924600,1788925500,1788926400,1788927300,1788928200,1788929100,1788930000,1788930900,1788931800,1788932700,1788933600,1788934500,1788935400,1788936300,1788937200,1788938100,1788939000,1788939900,1788940800,1788941700,1788942600,1788943500,1788944400,1788945300,1788946200,1788947100,1788948000,1788948900,1788949800,1788950700,1788951600,1788952500,1788953400,1788954300,1788955200,1788956100,1788957000,1788957900,1788958800,1788959700,1788960600,1788961500,1788962400,1788963300,1788964200,1788965100,1788966000,1788966900,1788967800,1788968700,1788969600,1788970500,1788971400,1788972300,1788973200,1788974100,1788975000,1788975900,1788976800,1788977700,1788978600,1788979500,1788980400,1788981300,1788982200,1788983100,1788984000,1788984900,1788985800,1788986700,1788987600,1788988500,1788989400,1788990300,1788991200,1788992100,1788993000,1788993900,1788994800,1788995700,1788996600,1788997500,1788998400,1788999300,1789000200,1789001100,1789002000,1789002900,1789003800,1789004700,1789005600,1789006500,1789007400,1789008300,1789009200,1789010100,1789011000,1789011900,1789012800,1789013700,1789014600,1789015500,1789016400,1789017300,1789018200,1789019100,1789020000,1789020900,1789021800,1789022700,1789023600,1789024500,1789025400,1789026300,1789027200,1789028100,1789029000,1789029900,1789030800,1789031700,1789032600,1789033500,1789034400,1789035300,1789036200,1789037100,1789038000,1789038900,1789039800,1789040700,1789041600,1789042500,1789043400,1789044300,1789045200,1789046100,1789047000,1789047900,1789048800,1789049700,1789050600,1789051500,1789052400,1789053300,1789054200,1789055100,1789056000,1789056900,1789057800,1789058700,1789059600,1789060500,1789061400,1789062300,1789063200,1789064100,1789065000,1789065900,1789066800,1789067700,1789068600,1789069500,1789070400,1789071300,1789072200,1789073100,1789074000,1789074900,1789075800,1789076700,1789077600,1789078500,1789079400,1789080300,1789081200,1789082100,1789083000,1789083900,1789084800,1789085700,1789086600,1789087500,1789088400,1789089300,1789090200,1789091100,1789092000,1789092900,1789093800,1789094700,1789095600,1789096500,1789097400,1789098300,1789099200,1789100100,1789101000,1789101900,1789102800,1789103700,1789104600,1789105500,1789106400,1789107300,1789108200,1789109100,1789110000,1789110900,1789111800,1789112700,1789113600,1789114500,1789115400,1789116300,1789117200,1789118100,1789119000,1789119900,1789120800,1789121700,1789122600,1789123500,1789124400,1789125300,1789126200,1789127100,1789128000,1789128900,1789129800,1789130700,1789131600,1789132500,1789133400,1789134300,1789135200,1789136100,1789137000,1789137900,1789138800,1789139700,1789140600,1789141500,1789142400,1789143300,1789144200,1789145100,1789146000,1789146900,1789147800,1789148700,1789149600,1789150500,1789151400,1789152300,1789153200,1789154100,1789155000,1789155900,1789156800,1789157700,1789158600,1789159500,1789160400,1789161300,1789162200,1789163100,1789164000,1789164900,1789165800,1789166700,1789167600,1789168500,1789169400,1789170300,1789171200,1789172100,1789173000,1789173900,1789174800,1789175700,1789176600,1789177500,1789178400,1789179300,1789180200,1789181100,1789182000,1789182900,1789183800,1789184700,1789185600,1789186500,1789187400,1789188300,1789189200,1789190100,1789191000,1789191900,1789192800,1789193700,1789194600,1789195500,1789196400,1789197300,1789198200,1789199100,1789200000,1789200900,1789201800,1789202700,1789203600,1789204500,1789205400,1789206300,1789207200,1789208100,1789209000,1789209900,1789210800,1789211700,1789212600,1789213500,1789214400,1789215300,1789216200,1789217100,1789218000,1789218900,1789219800,1789220700,1789221600,1789222500,1789223400,1789224300,1789225200,1789226100,1789227000,1789227900,1789228800,1789229700,1789230600,1789231500,1789232400,1789233300,1789234200,1789235100,1789236000,1789236900,1789237800,1789238700,1789239600,1789240500,1789241400,1789242300,1789243200,1789244100,1789245000,1789245900,1789246800,1789247700,1789248600,1789249500,1789250400,1789251300,1789252200,1789253100,1789254000,1789254900,1789255800,1789256700,1789257600,1789258500,1789259400,1789260300,1789261200,1789262100,1789263000,1789263900,1789264800,1789265700,1789266600,1789267500,1789268400,1789269300,1789270200,1789271100,1789272000,1789272900,1789273800,1789274700,1789275600,1789276500,1789277400,1789278300,1789279200,1789280100,1789281000,1789281900,1789282800,1789283700,1789284600,1789285500,1789286400,1789287300,1789288200,1789289100,1789290000,1789290900,1789291800,1789292700,1789293600,1789294500,1789295400,1789296300,1789297200,1789298100,1789299000,1789299900,1789300800,1789301700,1789302600,1789303500,1789304400,1789305300,1789306200,1789307100,1789308000,1789308900,1789309800,1789310700,1789311600,1789312500,1789313400,1789314300,1789315200,1789316100,1789317000,1789317900,1789318800,1789319700,1789320600,1789321500,1789322400,1789323300,1789324200,1789325100,1789326000,1789326900,1789327800,1789328700,1789329600,1789330500,1789331400,1789332300,1789333200,1789334100,1789335000,1789335900,1789336800,1789337700,1789338600,1789339500,1789340400,1789341300,1789342200,1789343100,1789344000,1789344900,1789345800,1789346700,1789347600,1789348500,1789349400,1789350300,1789351200,1789352100,1789353000,1789353900,1789354800,1789355700,1789356600,1789357500,1789358400,1789359300,1789360200,1789361100,1789362000,1789362900,1789363800,1789364700,1789365600,1789366500,1789367400,1789368300,1789369200,1789370100,1789371000,1789371900,1789372800,1789373700,1789374600,1789375500,1789376400,1789377300,1789378200,1789379100,1789380000,1789380900,1789381800,1789382700,1789383600,1789384500,1789385400,1789386300,1789387200,1789388100,1789389000,1789389900,1789390800,1789391700,1789392600,1789393500,1789394400,1789395300,1789396200,1789397100,1789398000,1789398900,1789399800,1789400700,1789401600,1789402500,1789403400,1789404300,1789405200,1789406100,1789407000,1789407900,1789408800,1789409700,1789410600,1789411500,1789412400,1789413300,1789414200,1789415100,1789416000,1789416900,1789417800,1789418700,1789419600,1789420500,1789421400,1789422300,1789423200,1789424100,1789425000,1789425900,1789426800,1789427700,1789428600,1789429500,1789430400,1789431300,1789432200,1789433100,1789434000,1789434900,1789435800,1789436700,1789437600,1789438500,1789439400,1789440300,1789441200,1789442100,1789443000,1789443900,1789444800,1789445700,1789446600,1789447500,1789448400,1789449300,1789450200,1789451100,1789452000,1789452900,1789453800,1789454700,1789455600,1789456500,1789457400,1789458300,1789459200,1789460100,1789461000,1789461900,1789462800,1789463700,1789464600,1789465500,1789466400,1789467300,1789468200,1789469100,1789470000,1789470900,1789471800,1789472700,1789473600,1789474500,1789475400,1789476300,1789477200,1789478100,1789479000,1789479900,1789480800,1789481700,1789482600,1789483500,1789484400,1789485300,1789486200,1789487100,1789488000,1789488900,1789489800,1789490700,1789491600,1789492500,1789493400,1789494300,1789495200,1789496100,1789497000,1789497900,1789498800,1789499700,1789500600,1789501500,1789502400,1789503300,1789504200,1789505100,1789506000,1789506900,1789507800,1789508700,1789509600,1789510500,1789511400,1789512300,1789513200,1789514100,1789515000,1789515900,1789516800,1789517700,1789518600,1789519500,1789520400,1789521300,1789522200,1789523100,1789524000,1789524900,1789525800,1789526700,1789527600,1789528500,1789529400,1789530300,1789531200,1789532100,1789533000,1789533900,1789534800,1789535700,1789536600,1789537500,1789538400,1789539300,1789540200,1789541100,1789542000,1789542900,1789543800,1789544700,1789545600,1789546500,1789547400,1789548300,1789549200,1789550100,1789551000,1789551900,1789552800,1789553700,1789554600,1789555500,1789556400,1789557300,1789558200,1789559100,1789560000,1789560900,1789561800,1789562700,1789563600,1789564500,1789565400,1789566300,1789567200,1789568100,1789569000,1789569900,1789570800,1789571700,1789572600,1789573500,1789574400,1789575300,1789576200,1789577100,1789578000,1789578900,1789579800,1789580700,1789581600,1789582500,1789583400,1789584300,1789585200,1789586100,1789587000,1789587900,1789588800,1789589700,1789590600,1789591500,1789592400,1789593300,1789594200,1789595100,1789596000,1789596900,1789597800,1789598700,1789599600,1789600500,1789601400,1789602300,1789603200,1789604100,1789605000,1789605900,1789606800,1789607700,1789608600,1789609500,1789610400,1789611300,1789612200,1789613100,1789614000,1789614900,1789615800,1789616700,1789617600,1789618500,1789619400,1789620300,1789621200,1789622100,1789623000,1789623900,1789624800,1789625700,1789626600,1789627500,1789628400,1789629300,1789630200,1789631100,1789632000,1789632900,1789633800,1789634700,1789635600,1789636500,1789637400,1789638300,1789639200,1789640100,1789641000,1789641900,1789642800,1789643700,1789644600,1789645500,1789646400,1789647300,1789648200,1789649100,1789650000,1789650900,1789651800,1789652700,1789653600,1789654500,1789655400,1789656300,1789657200,1789658100,1789659000,1789659900,1789660800,1789661700,1789662600,1789663500,1789664400,1789665300,1789666200,1789667100,1789668000,1789668900,1789669800,1789670700,1789671600,1789672500,1789673400,1789674300,1789675200,1789676100,1789677000,1789677900,1789678800,1789679700,1789680600,1789681500,1789682400,1789683300,1789684200,1789685100,1789686000,1789686900,1789687800,1789688700,1789689600,1789690500,1789691400,1789692300,1789693200,1789694100,1789695000,1789695900,1789696800,1789697700,1789698600,1789699500,1789700400,1789701300,1789702200,1789703100,1789704000,1789704900,1789705800,1789706700,1789707600,1789708500,1789709400,1789710300,1789711200,1789712100,1789713000,1789713900,1789714800,1789715700,1789716600,1789717500,1789718400,1789719300,1789720200,1789721100,1789722000,1789722900,1789723800,1789724700,1789725600,1789726500,1789727400,1789728300,1789729200,1789730100,1789731000,1789731900,1789732800,1789733700,1789734600,1789735500,1789736400,1789737300,1789738200,1789739100,1789740000,1789740900,1789741800,1789742700,1789743600,1789744500,1789745400,1789746300,1789747200,1789748100,1789749000,1789749900,1789750800,1789751700,1789752600,1789753500,1789754400,1789755300,1789756200,1789757100,1789758000,1789758900,1789759800,1789760700,1789761600,1789762500,1789763400,1789764300,1789765200,1789766100,1789767000,1789767900],"eur_mwh":[182.03,182.08,163.28,155.31,168.81,160.82,164.97,167.69,156.01,155.57,146.35,145.44,146.69,146.37,149.45,147.28,149.26,148.72,145.56,147.7,147.33,151.33,162.33,168.84,180.54,191.08,194.58,196.65,207.79,211.97,207.84,197.55,216.93,204.28,187.62,166.56,187.7,188.26,168.07,150.0,178.94,122.2,116.91,105.77,111.31,96.33,81.06,71.29,73.51,68.0,64.33,56.68,76.2,63.4,57.4,47.0,58.47,46.18,55.09,80.26,53.66,65.32,94.89,86.13,66.74,88.82,115.99,126.09,115.31,130.11,156.77,174.04,142.64,175.72,194.13,204.72,199.91,205.53,221.75,233.83,224.78,233.27,239.0,236.56,228.69,220.16,217.27,206.27,213.25,201.21,196.88,191.48,190.34,181.2,178.66,174.58,194.46,182.01,169.2,152.41,170.2,167.55,166.76,161.96,163.12,155.28,153.5,152.62,151.59,152.03,151.97,150.27,152.45,151.74,150.43,152.81,157.85,166.29,170.37,184.22,187.2,195.15,200.27,209.0,214.55,212.65,209.49,204.25,221.56,209.82,197.34,177.79,194.36,184.14,169.27,144.53,188.01,156.4,140.72,122.83,154.42,133.16,116.15,104.4,113.32,109.08,108.56,150.43,130.52,137.9,138.82,135.7,137.82,141.22,143.67,147.38,232.43,130.0,115.37,114.01,160.0,125.72,140.79,158.02,142.75,163.99,177.84,190.19,167.76,194.57,198.0,218.7,199.84,214.08,246.85,248.38,238.02,237.86,243.6,245.93,236.03,217.07,210.98,197.7,199.81,194.09,198.45,187.02,177.64,167.0,163.41,152.38,200.92,178.86,170.0,163.9,181.24,169.22,170.84,163.97,172.61,156.62,148.96,145.82,146.87,147.96,143.97,139.58,137.69,140.49,140.43,135.4,142.24,140.1,144.26,155.01,155.0,171.78,180.22,180.24,194.9,194.04,187.76,180.92,206.59,188.03,176.99,150.0,185.21,156.62,135.0,121.5,132.84,128.3,119.46,116.55,110.16,100.16,84.2,82.16,88.59,75.48,55.09,57.63,93.86,84.82,61.83,35.85,79.14,61.36,51.42,53.09,45.58,49.19,84.78,84.44,100.03,66.93,74.01,99.08,92.39,116.94,148.0,162.91,140.35,161.34,178.54,212.27,172.95,185.5,212.77,244.9,207.46,227.72,227.31,214.6,220.58,198.97,191.38,179.26,189.35,171.38,178.98,178.93,169.58,165.8,177.92,156.76,167.45,154.22,141.41,130.92,151.79,137.23,133.12,120.63,125.63,120.91,122.4,117.43,120.54,120.22,117.84,119.91,116.54,117.1,117.74,121.36,121.34,127.07,123.19,137.17,140.9,162.5,167.46,164.68,182.76,173.25,170.49,163.06,194.34,174.96,162.69,147.0,170.53,146.27,123.23,107.71,119.96,101.22,83.68,70.9,62.47,60.14,43.82,39.16,42.03,36.8,32.28,26.64,20.93,25.21,23.4,19.94,30.32,25.63,25.11,25.38,23.04,22.96,30.29,35.71,33.63,33.41,28.76,41.57,28.7,40.29,83.0,121.26,97.79,132.6,152.52,156.73,168.48,160.96,167.99,190.0,170.9,180.0,189.53,183.88,185.12,170.64,166.54,147.65,158.36,153.79,175.48,167.6,183.34,158.64,160.93,159.51,120.85,113.18,79.9,81.15,114.0,129.21,113.85,95.0,93.19,82.47,71.88,71.07,67.89,64.66,57.43,63.17,59.85,62.68,58.69,55.37,60.7,60.5,62.88,61.17,75.0,81.0,74.3,69.7,91.75,82.63,88.41,53.14,139.17,80.81,40.46,38.62,90.33,62.91,26.65,12.61,10.84,8.01,2.45,0.7,6.38,2.86,2.36,-0.25,10.1,11.11,7.67,1.94,0.0,2.11,4.5,5.14,5.21,3.6,3.72,5.37,3.75,3.13,1.95,4.02,2.33,6.54,21.4,47.18,41.44,80.65,121.78,162.9,151.95,184.59,228.13,230.8,195.0,210.0,227.74,254.99,216.55,209.24,213.41,206.43,242.72,212.97,207.75,191.2,204.27,200.0,215.09,215.05,216.85,194.24,195.39,161.31,200.0,181.4,164.0,190.0,190.44,180.0,185.0,164.5,176.14,171.11,166.5,155.38,160.07,154.27,151.56,153.85,142.89,142.44,146.03,149.27,142.45,143.52,148.8,147.16,145.82,148.24,148.01,144.3,147.14,140.58,130.41,119.91,137.86,125.05,101.35,82.62,81.44,59.6,11.17,6.46,1.86,0.38,0.01,0.0,0.0,0.0,-0.01,0.08,0.21,0.52,0.56,0.61,0.67,0.7,0.62,0.45,0.44,0.26,-0.1,-0.06,-0.02,-0.01,0.0,0.01,0.01,1.94,20.0,57.83,57.23,92.4,149.52,187.76,154.38,181.12,203.57,231.26,200.15,222.35,225.67,240.47,224.99,228.57,235.06,222.0,230.95,207.44,200.0,186.23,203.97,191.26,185.8,176.51,182.72,172.25,170.83,154.9,170.64,157.34,149.89,145.97,157.58,150.45,149.74,146.89,149.6,149.3,148.62,147.58,151.0,147.89,148.01,148.14,147.81,149.63,150.89,159.77,154.85,165.11,178.69,193.19,195.97,206.62,212.62,218.5,221.23,224.63,223.89,216.37,230.04,219.95,206.24,193.0,210.91,208.46,175.75,163.68,186.35,167.47,154.05,128.12,163.95,149.14,119.1,113.04,111.9,108.75,89.94,85.54,84.2,81.24,76.54,71.22,88.66,93.99,94.0,91.11,84.95,79.8,108.5,122.0,76.72,98.29,152.66,175.0,120.3,151.06,176.44,212.78,174.56,192.43,207.21,253.27,223.41,238.42,256.31,251.52,231.09,236.2,240.78,227.76,234.26,208.47,199.27,182.15,196.74,190.39,189.67,181.83,184.32,176.62,178.67,167.72,206.48,177.9,169.38,165.08,177.17,170.08,168.0,162.55,159.7,157.7,158.04,157.37,153.22,155.0,154.56,154.92,152.87,153.88,154.58,152.48,155.13,160.05,169.53,188.53,188.04,204.34,213.46,215.19,228.76,224.12,217.31,213.47,230.01,215.61,199.98,157.34,199.88,174.17,152.17,126.24,167.32,155.91,130.94,136.67,148.69,106.43,94.0,125.0,143.12,102.46,84.77,74.62,76.0,77.0,95.42,113.5,100.0,107.4,122.47,143.41,105.96,143.02,148.2,162.25,167.9,186.28,235.1,210.72,200.0,182.0,210.19,209.85,200.49,199.34,207.1,237.47,207.72,230.83,252.1,264.0,240.95,248.69,242.39,226.87,238.95,220.97,211.83,197.31,207.15,196.89,194.8,186.29,190.45,180.93,177.47,161.86,150.93,151.41,150.99,147.59,153.25,147.26,144.04,141.53,147.79,146.53,143.55,139.93,145.58,139.56,139.11,138.06,138.92,138.52,138.04,138.65,137.29,139.03,144.59,150.34,154.12,174.5,178.43,186.62,199.35,200.21,200.11,197.43,220.07,202.0,196.01,174.03,198.32,167.49,152.54,142.05,161.5,145.45,128.61,100.85,139.18,115.83,94.41,80.39,111.25,89.61,84.99,74.38,80.53,70.58,62.27,57.1,62.24,64.95,68.99,71.19,66.9,87.32,109.0,123.12,68.48,125.53,155.99,161.9,138.77,160.57,167.35,173.0,142.2,172.83,196.19,211.26,205.85,218.77,217.08,222.0,210.98,208.46,208.88,210.02,209.77,202.61,200.27,191.49,194.39,195.04,197.26,190.92,188.39,198.05,203.05,191.84,216.08,216.08,214.92,200.0,223.37,201.43,196.32,190.0,199.53,194.83,180.53,172.23,179.88,175.77,167.1,173.89,163.29,165.99,171.41,178.73,170.27,177.37,187.71,201.07,193.62,207.61,218.27,226.77,227.17,234.05,236.99,229.94,248.93,227.5,216.08,195.67,215.99,195.01,177.1,155.09,174.91,152.71,139.59,123.83,140.77,123.19,114.96,94.5,102.77,96.63,94.57,116.34,114.63,126.82,129.89,123.95,105.0,119.11,121.0,136.79,123.41,135.01,135.0,156.68,146.88,152.16,162.02,181.78,154.76,184.28,194.3,215.76,197.23,234.15,253.03,296.58,345.32,389.16,482.99,559.0,551.11,446.41,358.97,295.9,271.39,268.06,241.43,238.01,239.7,226.41,223.05,211.56,218.21,210.61,197.78,171.79,184.6,186.52,186.74,180.73,196.82,178.05,175.47,172.53,175.32,172.46,169.94,168.45,166.32,163.94,165.68,164.16,166.06,167.17,167.35,168.62,170.54,174.27,176.92,183.52,192.19,202.17,206.23,214.04,221.47,223.98,224.54,223.09,233.86,225.04,214.23,187.32,213.95,202.65,192.88,180.75,204.6,175.08,169.13,169.97,163.06,185.0,198.43,198.91,182.87,179.23,177.77,162.73,172.1,166.28,155.17,143.51,163.3,152.98,152.18,152.57,186.6,181.0,177.17,172.6,162.46,166.67,180.7,192.1,175.84,198.95,206.97,221.91,217.12,238.1,260.78,278.05,275.22,286.93,301.36,307.06,298.22,284.97,273.08,267.9,266.11,244.68,236.0,228.79,234.01,225.01,222.31,218.53,217.02,207.13,202.55,192.08,212.37,206.92,204.04,198.97,205.88,199.05,197.21,194.0,197.97,198.57,195.0,194.0,190.18,189.82,188.6,188.6,184.5,182.43,185.0,185.0,184.5,185.2,186.37,190.1,190.15,192.46,196.26,192.84,199.21,196.7,191.12,186.8,200.75,188.62,161.01,158.44,182.81,150.39,145.6,153.79,118.45,97.3,73.99,35.77,52.68,34.2,13.46,4.74,3.21,0.04,0.03,0.01,0.01,-0.02,-0.02,-0.04,-0.23,-0.03,0.11,0.31,0.16,0.46,0.71,2.85,0.09,5.21,33.89,66.56,70.11,101.9,121.52,152.39,147.85,180.52,192.56,195.82,194.44,204.81,206.31,212.48,210.99,211.17,210.92,207.69,210.75,204.94,202.7,201.72,199.85,202.7,206.1,201.8,198.01,194.39,194.96,190.65,191.99,180.01,173.3,166.01,176.4,165.98,164.26,163.74,168.52,163.79,160.6,159.2,163.59,162.26,161.37,159.7,164.44,163.8,163.6,164.38,165.12,166.31,168.69,172.0,171.24,176.28,181.79,180.65,185.77,184.13,181.4,170.89,190.1,173.56,159.78,158.28,156.27,160.0,206.87,216.22,204.03,210.0,210.15,208.74,201.09,200.0,198.91,200.0,190.0,197.52,192.03,190.17,190.0,187.41,183.56,179.49,176.61,183.24,189.84,189.26,184.13,189.99,190.0,173.41,192.5,170.63,162.67,159.67,181.0,181.46,195.22,208.01,196.33,203.18,210.52,228.64,217.28,228.31,234.49,239.96,228.8,235.0,237.53,233.99,235.33,235.0,231.65,227.5,232.43,227.5,227.5,222.41,220.53,208.58,207.24,206.0,218.18,205.79,196.0,186.85,192.1,187.5,189.38,182.59,185.42,185.05,183.47,182.75,183.46,184.16,183.8,184.05,180.24,181.2,183.46,190.12,184.46,194.47,208.57,219.61,217.24,233.14,248.07,253.46,271.31,290.75,295.11,297.14,322.65,289.62,274.69,252.89,279.63,264.53,239.64,214.12,240.16,219.56,201.43,183.63,211.71,193.52,196.52,184.4,195.27,181.38,176.86,168.87,175.0,161.89,155.25,154.82,159.82,161.77,155.63,166.0,152.91,155.59,169.1,182.0,152.0,170.08,190.0,201.52,175.17,205.53,233.51,270.47,229.77,270.89,333.46,415.67,404.29,435.53,453.89,473.23,459.76,414.74,364.86,331.14,321.33,292.9,266.69,248.81,267.01,248.59,241.74,224.4,235.05,222.94,217.32,205.7,220.0,217.99,206.05,192.24,211.24,198.43,194.29,188.1,189.9,187.33,188.68,188.05,185.3,185.99,187.33,184.0,184.06,184.3,184.53,181.31,184.37,187.02,199.91,215.55,221.26,234.39,236.48,246.4,255.55,251.15,248.71,243.93,268.06,241.51,225.01,197.87,227.5,212.6,189.51,158.02,181.16,162.59,128.03,112.06,146.77,133.17,101.37,109.96,76.07,63.14,58.9,57.88,40.35,38.99,38.55,35.67,55.47,50.01,57.1,85.42,64.43,90.0,111.1,140.0,136.6,129.01,156.17,190.22,162.47,197.9,215.77,230.55,205.94,223.22,243.09,278.93,255.4,280.48,282.39,280.88,262.25,251.19,245.93,238.7,231.3,226.54,223.45,208.0,212.98,202.8,199.21,187.03,194.58,187.06,180.29,171.04,182.54,179.17,174.97,171.33,173.51,170.97,170.88,170.12,167.75,167.9,170.37,169.89,169.85,168.72,167.11,168.69,170.17,167.23,169.14,170.0,167.9,177.37,187.37,220.0,197.69,217.11,230.8,237.77,243.9,239.69,235.5,231.64,247.01,237.79,223.17,192.0,219.85,202.29,185.57,182.2,200.69,193.13,182.29,171.96,162.72,155.32,141.29,135.83,138.48,116.46,114.76,102.69,105.87,97.8,95.13,90.54,100.42,102.58,103.54,105.57,106.16,114.22,126.39,126.41,126.98,137.06,158.59,177.36,173.45,189.85,198.98,216.92,204.26,222.42,235.62,263.72,238.62,248.91,263.27,269.75,264.58,248.79,240.28,234.85,237.58,229.52,215.47,199.19,216.13,202.96,198.3,191.83,200.09,190.81,184.75,168.7,197.58,185.08,176.47,169.98,174.1,168.39,165.03,162.09,162.3,158.05,155.7,154.95,160.56,161.19,155.07,155.33,154.59,155.12,157.61,158.65,154.1,153.69,161.44,169.37,170.77,191.92,204.03,212.71,226.18,219.37,212.21,205.04,215.92,205.03,195.31,176.24,200.0,179.57,153.31,124.7,150.69,127.84,99.53,71.89,65.19,42.21,37.72,35.01,53.75,39.37,33.61,29.35,31.66,33.1,33.84,33.14,36.32,40.0,49.88,73.6,51.78,80.0,102.17,117.18,67.26,110.88,158.88,171.2,135.28,183.35,195.15,196.4,175.59,197.09,210.32,215.1,208.86,214.85,220.55,242.65,222.4,220.21,221.71,219.19,222.96,214.97,207.21,191.66,201.88,193.56,197.36,190.04,189.25,187.6,181.63,168.09,154.93,147.78,139.31,135.34,140.08,134.35,132.41,132.98,131.48,130.65,137.82,137.95,132.5,133.98,135.29,143.31,132.55,137.72,134.35,138.47,143.38,142.42,153.72,166.12,178.99,187.39,194.1,208.47,214.08,224.71,227.72,216.8,229.11,212.83,208.23,190.36,210.3,182.39,150.0,114.83,166.0,110.0,83.5,55.06,70.83,66.52,36.32,36.23,20.47,9.17,5.7,1.8,6.13,4.83,5.32,5.13,16.92,18.22,18.6,26.34,0.38,2.33,4.15,6.38,16.45,9.75,63.59,61.63,32.01,64.31,116.25,154.15,135.57,166.57,198.45,218.22,183.16,189.31,197.36,215.28,206.78,205.44,198.66,195.15,193.79,190.4,180.77,171.21,179.84,176.32,171.21,150.91,164.19,146.47,137.36,118.64]},"license":"CC BY 4.0 (creativecommons.org/licenses/by/4.0) from Bundesnetzagentur | SMARD.de"}
\ No newline at end of file
diff --git a/goodwe_controller/scenarios/ux13/test23/options.arb.json b/goodwe_controller/scenarios/ux13/test23/options.arb.json
new file mode 100644
index 0000000..e0a3ec6
--- /dev/null
+++ b/goodwe_controller/scenarios/ux13/test23/options.arb.json
@@ -0,0 +1,73 @@
+{
+ "arbitrage_enabled": true,
+ "arbitrage_soc_ceiling": 95,
+ "arbitrage_soc_floor": 20,
+ "auto_start": false,
+ "batt_entity": "sensor.test23_battery_power",
+ "batt_invert": false,
+ "bms_soc_floor": 10,
+ "circulation_hold_s": 75,
+ "circulation_w": 700,
+ "cycle_cost_threshold_eur": 0.1,
+ "cycle_floor_s": 15,
+ "deadband_w": 15,
+ "delivery_hold_s": 185,
+ "estop_fitted": false,
+ "export_price_eur_kwh": 0.04,
+ "gain": 0.6,
+ "heartbeat_s": 10,
+ "integrator_max_w": 0,
+ "inverters": [],
+ "log_level": "info",
+ "maintenance_charge_w": 2000,
+ "maintenance_discharge_w": 2000,
+ "maintenance_enabled": false,
+ "maintenance_hold_min": 120,
+ "maintenance_interval_days": 28,
+ "maintenance_soc_floor": 11,
+ "maintenance_soc_target": 99,
+ "maintenance_start_hour": 10,
+ "max_w": 2000,
+ "meter_entity": "sensor.p1_meter_active_power",
+ "meter_freeze_s": 300,
+ "meter_invert": false,
+ "meter_max_age_s": 30,
+ "meter_mqtt_topic": "",
+ "meter_phases": 1,
+ "meter_poll_s": 5,
+ "meter_source": "ha_signed",
+ "p1_export_entity": "",
+ "p1_host": "",
+ "p1_import_entity": "",
+ "p1_net_entity": "sensor.test23_p1_meter_active_power",
+ "p1_phase_export_entities": [],
+ "p1_phase_import_entities": [],
+ "p1_phase_net_entities": [],
+ "peak_cap_w": 3500,
+ "peak_forecast_entity": "",
+ "peak_soc_floor": 20,
+ "price_avg_entity": "",
+ "price_csv_path": "/share/goodwe_prices.csv",
+ "price_feed_url": "https://api.energy-charts.info/price?bzn=BE",
+ "price_horizon_h": 48,
+ "price_markup_eur_kwh": 0.03,
+ "price_now_entity": "",
+ "price_provider": "generic_dayahead",
+ "price_taxes_eur_kwh": 0.06,
+ "price_timeout_s": 10,
+ "saturation_cycles": 3,
+ "saturation_w": 500,
+ "setpoint_entity": "number.test23_setpoint_w",
+ "sign_disagree_s": 180,
+ "sign_disagree_w": 300,
+ "site_sign_disagree_s": 325,
+ "site_sign_disagree_w": 300,
+ "slew_w": 0,
+ "soc_entity": "sensor.test23_soc",
+ "stale_input_s": 15,
+ "static_profile": "",
+ "step_w": 10,
+ "target_grid_w": -10,
+ "unit_sign_disagree_s": 85,
+ "unit_sign_disagree_w": 250
+}
\ No newline at end of file
diff --git a/goodwe_controller/scenarios/ux13/test23/options.baseline.json b/goodwe_controller/scenarios/ux13/test23/options.baseline.json
new file mode 100644
index 0000000..768a884
--- /dev/null
+++ b/goodwe_controller/scenarios/ux13/test23/options.baseline.json
@@ -0,0 +1,73 @@
+{
+ "arbitrage_enabled": false,
+ "arbitrage_soc_ceiling": 95,
+ "arbitrage_soc_floor": 20,
+ "auto_start": false,
+ "batt_entity": "",
+ "batt_invert": false,
+ "bms_soc_floor": 10,
+ "circulation_hold_s": 75,
+ "circulation_w": 700,
+ "cycle_cost_threshold_eur": 0.1,
+ "cycle_floor_s": 15,
+ "deadband_w": 15,
+ "delivery_hold_s": 185,
+ "estop_fitted": false,
+ "export_price_eur_kwh": 0.04,
+ "gain": 0.6,
+ "heartbeat_s": 10,
+ "integrator_max_w": 0,
+ "inverters": [],
+ "log_level": "info",
+ "maintenance_charge_w": 2000,
+ "maintenance_discharge_w": 2000,
+ "maintenance_enabled": false,
+ "maintenance_hold_min": 120,
+ "maintenance_interval_days": 28,
+ "maintenance_soc_floor": 11,
+ "maintenance_soc_target": 99,
+ "maintenance_start_hour": 10,
+ "max_w": 2000,
+ "meter_entity": "sensor.p1_meter_active_power",
+ "meter_freeze_s": 300,
+ "meter_invert": false,
+ "meter_max_age_s": 30,
+ "meter_mqtt_topic": "",
+ "meter_phases": 1,
+ "meter_poll_s": 5,
+ "meter_source": "off",
+ "p1_export_entity": "",
+ "p1_host": "",
+ "p1_import_entity": "",
+ "p1_net_entity": "",
+ "p1_phase_export_entities": [],
+ "p1_phase_import_entities": [],
+ "p1_phase_net_entities": [],
+ "peak_cap_w": 3500,
+ "peak_forecast_entity": "",
+ "peak_soc_floor": 20,
+ "price_avg_entity": "",
+ "price_csv_path": "/share/goodwe_prices.csv",
+ "price_feed_url": "",
+ "price_horizon_h": 48,
+ "price_markup_eur_kwh": 0.03,
+ "price_now_entity": "",
+ "price_provider": "off",
+ "price_taxes_eur_kwh": 0.06,
+ "price_timeout_s": 10,
+ "saturation_cycles": 3,
+ "saturation_w": 500,
+ "setpoint_entity": "",
+ "sign_disagree_s": 180,
+ "sign_disagree_w": 300,
+ "site_sign_disagree_s": 325,
+ "site_sign_disagree_w": 300,
+ "slew_w": 0,
+ "soc_entity": "",
+ "stale_input_s": 15,
+ "static_profile": "",
+ "step_w": 10,
+ "target_grid_w": -10,
+ "unit_sign_disagree_s": 85,
+ "unit_sign_disagree_w": 250
+}
\ No newline at end of file
diff --git a/goodwe_controller/scenarios/ux13/test23/options.doc1-roster.json b/goodwe_controller/scenarios/ux13/test23/options.doc1-roster.json
new file mode 100644
index 0000000..551b715
--- /dev/null
+++ b/goodwe_controller/scenarios/ux13/test23/options.doc1-roster.json
@@ -0,0 +1,98 @@
+{
+ "arbitrage_enabled": false,
+ "arbitrage_soc_ceiling": 95,
+ "arbitrage_soc_floor": 20,
+ "auto_start": false,
+ "batt_entity": "sensor.test23_battery_power",
+ "batt_invert": false,
+ "bms_soc_floor": 10,
+ "circulation_hold_s": 75,
+ "circulation_w": 700,
+ "cycle_cost_threshold_eur": 0.1,
+ "cycle_floor_s": 15,
+ "deadband_w": 15,
+ "delivery_hold_s": 185,
+ "estop_fitted": false,
+ "export_price_eur_kwh": 0.04,
+ "gain": 0.6,
+ "heartbeat_s": 10,
+ "integrator_max_w": 0,
+ "inverters": [
+  {
+   "batt_entity": "sensor.goodwe_a_battery_power",
+   "bms_soc_floor": 10,
+   "capacity_kwh": 15.36,
+   "max_w": 5000,
+   "name": "inverter-a",
+   "setpoint_entity": "number.goodwe_a_setpoint_w",
+   "soc_entity": "sensor.goodwe_a_soc"
+  },
+  {
+   "batt_entity": "sensor.goodwe_b_battery_power",
+   "bms_soc_floor": 10,
+   "capacity_kwh": 20.48,
+   "max_w": 4600,
+   "name": "inverter-b",
+   "setpoint_entity": "number.goodwe_b_setpoint_w",
+   "soc_entity": "sensor.goodwe_b_soc"
+  }
+ ],
+ "log_level": "info",
+ "maintenance_charge_w": 2000,
+ "maintenance_discharge_w": 2000,
+ "maintenance_enabled": false,
+ "maintenance_hold_min": 120,
+ "maintenance_interval_days": 28,
+ "maintenance_soc_floor": 11,
+ "maintenance_soc_target": 99,
+ "maintenance_start_hour": 10,
+ "max_w": 2000,
+ "meter_entity": "sensor.p1_meter_active_power",
+ "meter_freeze_s": 300,
+ "meter_invert": false,
+ "meter_max_age_s": 30,
+ "meter_mqtt_topic": "",
+ "meter_phases": 1,
+ "meter_poll_s": 5,
+ "meter_source": "ha_signed",
+ "p1_export_entity": "",
+ "p1_host": "",
+ "p1_import_entity": "",
+ "p1_net_entity": "sensor.test23_p1_meter_active_power",
+ "p1_phase_export_entities": [],
+ "p1_phase_import_entities": [],
+ "p1_phase_net_entities": [],
+ "peak_cap_w": 3500,
+ "peak_forecast_entity": "",
+ "peak_soc_floor": 20,
+ "price_avg_entity": "",
+ "price_csv_path": "/share/goodwe_prices.csv",
+ "price_export_formula": "",
+ "price_feed_url": "https://api.energy-charts.info/price?bzn=BE",
+ "price_formula": "",
+ "price_horizon_h": 48,
+ "price_markup_eur_kwh": 0.03,
+ "price_now_entity": "",
+ "price_provider": "generic_dayahead",
+ "price_taxes_eur_kwh": 0.06,
+ "price_taxes_profile": "",
+ "price_timeout_s": 10,
+ "pv_entities": [],
+ "pv_entity": "",
+ "saturation_cycles": 3,
+ "saturation_w": 500,
+ "setpoint_entity": "",
+ "shadow_mode": "auto",
+ "sign_disagree_s": 180,
+ "sign_disagree_w": 300,
+ "site_sign_disagree_s": 325,
+ "site_sign_disagree_w": 300,
+ "slew_w": 0,
+ "soc_entity": "sensor.test23_soc",
+ "stale_input_s": 15,
+ "static_profile": "",
+ "step_w": 10,
+ "target_grid_w": -10,
+ "unit_sign_disagree_s": 85,
+ "unit_sign_disagree_w": 250
+}
\ No newline at end of file
diff --git a/goodwe_controller/scenarios/ux13/test23/options.json b/goodwe_controller/scenarios/ux13/test23/options.json
new file mode 100644
index 0000000..5a388aa
--- /dev/null
+++ b/goodwe_controller/scenarios/ux13/test23/options.json
@@ -0,0 +1,73 @@
+{
+ "arbitrage_enabled": false,
+ "arbitrage_soc_ceiling": 95,
+ "arbitrage_soc_floor": 20,
+ "auto_start": false,
+ "batt_entity": "sensor.test23_battery_power",
+ "batt_invert": false,
+ "bms_soc_floor": 10,
+ "circulation_hold_s": 75,
+ "circulation_w": 700,
+ "cycle_cost_threshold_eur": 0.1,
+ "cycle_floor_s": 15,
+ "deadband_w": 15,
+ "delivery_hold_s": 185,
+ "estop_fitted": false,
+ "export_price_eur_kwh": 0.04,
+ "gain": 0.6,
+ "heartbeat_s": 10,
+ "integrator_max_w": 0,
+ "inverters": [],
+ "log_level": "info",
+ "maintenance_charge_w": 2000,
+ "maintenance_discharge_w": 2000,
+ "maintenance_enabled": false,
+ "maintenance_hold_min": 120,
+ "maintenance_interval_days": 28,
+ "maintenance_soc_floor": 11,
+ "maintenance_soc_target": 99,
+ "maintenance_start_hour": 10,
+ "max_w": 2000,
+ "meter_entity": "sensor.p1_meter_active_power",
+ "meter_freeze_s": 300,
+ "meter_invert": false,
+ "meter_max_age_s": 30,
+ "meter_mqtt_topic": "",
+ "meter_phases": 1,
+ "meter_poll_s": 5,
+ "meter_source": "ha_signed",
+ "p1_export_entity": "",
+ "p1_host": "",
+ "p1_import_entity": "",
+ "p1_net_entity": "sensor.test23_p1_meter_active_power",
+ "p1_phase_export_entities": [],
+ "p1_phase_import_entities": [],
+ "p1_phase_net_entities": [],
+ "peak_cap_w": 3500,
+ "peak_forecast_entity": "",
+ "peak_soc_floor": 20,
+ "price_avg_entity": "",
+ "price_csv_path": "/share/goodwe_prices.csv",
+ "price_feed_url": "https://api.energy-charts.info/price?bzn=BE",
+ "price_horizon_h": 48,
+ "price_markup_eur_kwh": 0.03,
+ "price_now_entity": "",
+ "price_provider": "generic_dayahead",
+ "price_taxes_eur_kwh": 0.06,
+ "price_timeout_s": 10,
+ "saturation_cycles": 3,
+ "saturation_w": 500,
+ "setpoint_entity": "number.test23_setpoint_w",
+ "sign_disagree_s": 180,
+ "sign_disagree_w": 300,
+ "site_sign_disagree_s": 325,
+ "site_sign_disagree_w": 300,
+ "slew_w": 0,
+ "soc_entity": "sensor.test23_soc",
+ "stale_input_s": 15,
+ "static_profile": "",
+ "step_w": 10,
+ "target_grid_w": -10,
+ "unit_sign_disagree_s": 85,
+ "unit_sign_disagree_w": 250
+}
\ No newline at end of file
diff --git a/goodwe_controller/scenarios/ux13/test23/options.s3.json b/goodwe_controller/scenarios/ux13/test23/options.s3.json
new file mode 100644
index 0000000..18354a9
--- /dev/null
+++ b/goodwe_controller/scenarios/ux13/test23/options.s3.json
@@ -0,0 +1,73 @@
+{
+ "arbitrage_enabled": true,
+ "arbitrage_soc_ceiling": 95,
+ "arbitrage_soc_floor": 20,
+ "auto_start": true,
+ "batt_entity": "sensor.test23_battery_power",
+ "batt_invert": false,
+ "bms_soc_floor": 10,
+ "circulation_hold_s": 75,
+ "circulation_w": 700,
+ "cycle_cost_threshold_eur": 0.1,
+ "cycle_floor_s": 15,
+ "deadband_w": 15,
+ "delivery_hold_s": 185,
+ "estop_fitted": false,
+ "export_price_eur_kwh": 0.04,
+ "gain": 0.6,
+ "heartbeat_s": 10,
+ "integrator_max_w": 0,
+ "inverters": [],
+ "log_level": "info",
+ "maintenance_charge_w": 2000,
+ "maintenance_discharge_w": 2000,
+ "maintenance_enabled": false,
+ "maintenance_hold_min": 120,
+ "maintenance_interval_days": 28,
+ "maintenance_soc_floor": 11,
+ "maintenance_soc_target": 99,
+ "maintenance_start_hour": 10,
+ "max_w": 2000,
+ "meter_entity": "sensor.p1_meter_active_power",
+ "meter_freeze_s": 300,
+ "meter_invert": false,
+ "meter_max_age_s": 30,
+ "meter_mqtt_topic": "",
+ "meter_phases": 1,
+ "meter_poll_s": 5,
+ "meter_source": "ha_signed",
+ "p1_export_entity": "",
+ "p1_host": "",
+ "p1_import_entity": "",
+ "p1_net_entity": "sensor.test23_p1_meter_active_power",
+ "p1_phase_export_entities": [],
+ "p1_phase_import_entities": [],
+ "p1_phase_net_entities": [],
+ "peak_cap_w": 15000,
+ "peak_forecast_entity": "",
+ "peak_soc_floor": 20,
+ "price_avg_entity": "",
+ "price_csv_path": "/share/goodwe_prices.csv",
+ "price_feed_url": "",
+ "price_horizon_h": 48,
+ "price_markup_eur_kwh": 0.03,
+ "price_now_entity": "",
+ "price_provider": "manual_csv",
+ "price_taxes_eur_kwh": 0.06,
+ "price_timeout_s": 10,
+ "saturation_cycles": 3,
+ "saturation_w": 500,
+ "setpoint_entity": "number.test23_setpoint_w",
+ "sign_disagree_s": 180,
+ "sign_disagree_w": 300,
+ "site_sign_disagree_s": 325,
+ "site_sign_disagree_w": 300,
+ "slew_w": 0,
+ "soc_entity": "sensor.test23_soc",
+ "stale_input_s": 15,
+ "static_profile": "",
+ "step_w": 10,
+ "target_grid_w": -10,
+ "unit_sign_disagree_s": 85,
+ "unit_sign_disagree_w": 250
+}
\ No newline at end of file
diff --git a/goodwe_controller/scenarios/ux13/validator-calls-652097a.jsonl.gz b/goodwe_controller/scenarios/ux13/validator-calls-652097a.jsonl.gz
new file mode 100644
index 0000000..a019bc5
Binary files /dev/null and b/goodwe_controller/scenarios/ux13/validator-calls-652097a.jsonl.gz differ
diff --git a/goodwe_controller/test_alloc.py b/goodwe_controller/test_alloc.py
index 517d826..a04c55a 100644
--- a/goodwe_controller/test_alloc.py
+++ b/goodwe_controller/test_alloc.py
@@ -10,12 +10,10 @@ IN FULL.
 ⚠️ WHAT THIS FILE CAN AND CANNOT CLAIM, SAID BEFORE THE FIRST CHECK.
 The two-master rig lives in admin/goodwe (TEST-19, `sim/sitesim.py`), where
 `compute()` closes the loop against `plantsim.Plant` with the firmware's own
-encoder on the wire. That repository is PRIVATE and this repository's CI token
-is minted for this one, so the rig is not reachable from the gate - and a test
-file that needed it would either fail the gate or, like test_freeze.py's hwsim
-section, pass SILENTLY having checked nothing.
+encoder on the wire. CI checks admin/goodwe out at `.gitea/infra-pin` (CI-12),
+but this file does not import the rig.
 
-So the split is deliberate:
+The split:
 
   * `tools/alloc_sim.py` drives the REAL rig, and its output is quoted in the
     pull request. It is where "no limit cycle" is a claim about the shipped
@@ -1043,6 +1041,133 @@ check("...and the three that are NOT caught are reported as such, with the "
       all(b is False for _n, b, _w in MUT[-3:]))
 
 
+
+print()
+print("13. OPT-11: the mode layer - applied at or below 35, released above it")
+# A mode is a SOFT unit limit beside the hard ones (UnitBounds.mode_*). The
+# allocator applies it only when the site target was decided at or below the
+# mode's own priority (P_MODE, 35), drops it when its range leaves out 0 W,
+# and never lets it narrow a hard limit into nothing.
+from app.allocator import (MODE_FAULT, MODE_OUTRANKED, MODE_RELEASED,  # noqa: E402
+                           loop_bound, unit_interval)
+from app.arbiter import P_MODE                                     # noqa: E402
+
+
+def M(lo=-RATING, hi=RATING, mlo=-inf, mhi=inf, prio=P_MODE, **kw):
+    """A unit's bounds with a mode range beside its hard limits."""
+    b = B(lo, hi, **kw)
+    return UnitBounds(lo=b.lo, hi=b.hi, gate=b.gate, pinned_w=b.pinned_w,
+                      pinned_by=b.pinned_by, contradiction=b.contradiction,
+                      mode_lo=mlo, mode_hi=mhi, mode_priority=prio)
+
+
+_off = {A: M(), Bee: M(mlo=0.0, mhi=0.0)}
+_at35 = plan(3000, _off, deciding_priority=P_MODE)
+_at50 = plan(3000, _off, deciding_priority=P_PEAK)
+_at10 = plan(3000, _off, deciding_priority=P_LOOP)
+print(f"    B off, 3000 W: decided at 10 {_at10.explain()} | at 35 "
+      f"{_at35.explain()} | at 50 {_at50.explain()}")
+check("⭐ RELEASE AT 35: a target decided at P_MODE itself keeps the mode - "
+      "B (Off) is held at 0 W and A carries all 3000 W",
+      _at35.shares == {A: 3000, Bee: 0} and _at35.unmet_w == 0)
+check("...and below it too (the loop, 10): the same split",
+      _at10.shares == _at35.shares)
+check("⭐ RELEASE AT 50: a target decided by the peak floor releases the mode "
+      "and B takes its weighted half",
+      _at50.shares == {A: 1500, Bee: 1500} and _at50.unmet_w == 0)
+check("...and the boundary is exactly 35: at 36 the mode is released",
+      plan(3000, _off, deciding_priority=P_MODE + 1).shares
+      == {A: 1500, Bee: 1500})
+check("...and no deciding priority named means the mode applies (the safe "
+      "reading for a direct caller)",
+      plan(3000, _off).shares == {A: 3000, Bee: 0})
+check("unit_interval() reports why: None when applied, MODE_RELEASED above "
+      "35, and the hard limits always",
+      unit_interval(_off[Bee], P_MODE) == (0.0, 0.0, None)
+      and unit_interval(_off[Bee], P_PEAK) == (-RATING, RATING, MODE_RELEASED))
+
+# CONTAINS 0: a mode that would FORCE a direction is a software fault.
+_force = {A: M(mlo=500.0, mhi=RATING), Bee: M()}
+_f = plan(-1000, _force, deciding_priority=P_LOOP)
+print(f"    A's mode is [500, 5000] (leaves out 0 W), site charges 1000 W: "
+      f"{_f.explain()}, faults {_f.mode_faults}")
+check("⭐ CONTAINS 0: a mode range that leaves out 0 W is dropped and named "
+      "as a fault, so REFUSE_SIGN stays unreachable: both units charge and "
+      "the split is allowed",
+      _f.ok and _f.mode_faults == ((A, MODE_FAULT),)
+      and all(v <= 0 for v in _f.shares.values())
+      and sum(_f.shares.values()) == -1000)
+_f_obeyed = plan(-1000, {A: B(500.0, RATING), Bee: B(-RATING, RATING)})
+check("...and that is not a hypothetical: the same range obeyed as a hard "
+      "limit forces A to give 500 W while B charges 1500 W, which the "
+      "allocator REFUSES as circulating power",
+      not _f_obeyed.ok and REFUSE_SIGN in _f_obeyed.refused)
+check("...and a mode whose own lo is above its own hi is the same fault",
+      unit_interval(M(mlo=300.0, mhi=-300.0))[2] == MODE_FAULT)
+_out = unit_interval(M(lo=-2000.0, hi=-500.0, mlo=0.0, mhi=0.0))
+check("a hard limit that leaves the mode no room wins outright "
+      "(MODE_OUTRANKED): the unit keeps its hard interval",
+      _out == (-2000.0, -500.0, MODE_OUTRANKED))
+check("a unit with no mode (every unit with battery modes off) gets exactly "
+      "its hard limits, and plan() is the same record as before the mode "
+      "fields existed",
+      unit_interval(B(-700.0, 900.0)) == (-700.0, 900.0, None)
+      and plan(1234, TWO, deciding_priority=P_PEAK) == plan(1234, TWO))
+
+# The sweep: sum and sign kept whatever the modes, the target and the
+# deciding priority; every share inside its effective interval.
+_rng = random.Random(1135)
+_bad, _nm = [], 0
+for _ in range(20000):
+    _units = {}
+    for u in (A, Bee, "inverter-c")[:_rng.choice((2, 3))]:
+        r = _rng.choice((2000.0, 3600.0, 5000.0))
+        mlo = _rng.choice((-r, -700.0, 0.0))
+        mhi = _rng.choice((0.0, 450.0, r))
+        _units[u] = M(-r, r, mlo, mhi)
+    _d = _rng.choice((P_LOOP, P_ARBITRAGE, P_MODE, P_MODE + 1, P_PEAK, None))
+    _t = _rng.randint(-15000, 15000)
+    _p = plan(_t, _units, deciding_priority=_d)
+    _nm += 1
+    _eff = {u: unit_interval(b, _d)[:2] for u, b in _units.items()}
+    _sh = _p.shares
+    if (not _p.ok or sum(_sh.values()) + _p.unmet_w != _p.sum_w
+            or (any(v > 0 for v in _sh.values())
+                and any(v < 0 for v in _sh.values()))
+            or any(not (_eff[u][0] <= _sh[u] <= _eff[u][1]) for u in _sh)
+            or (_d is not None and _d > P_MODE
+                and any(_eff[u] != (b.lo, b.hi) for u, b in _units.items()))):
+        _bad.append((_t, _d, _p.explain()))
+for x in _bad[:5]:
+    print(f"       BAD {x}")
+check(f"over {_nm} random ticks (2-3 units, mode ranges holding 0 W, targets "
+      f"+-15 kW, deciding at 10/30/35/36/50/None) the shares sum to S with "
+      f"`unmet`, never split the sign, and each stays inside its interval - "
+      f"the mode's above 35 released, applied at or below",
+      not _bad and _nm == 20000)
+
+# loop_bound(): what the loop may ask when it decides.
+_lb = loop_bound({A: M(mlo=-3000.0, mhi=0.0), Bee: M(mlo=0.0, mhi=0.0)})
+check("loop_bound() sums each unit's interval with its mode applied: A may "
+      "only charge 3000 W, B is off, so the loop may ask [-3000, 0]",
+      _lb == (-3000.0, 0.0))
+check("...a unit that is not live adds nothing",
+      loop_bound({A: M(), Bee: M()}, live=(A,)) == (-RATING, RATING))
+check("...a PINNED unit adds the span from 0 to its pin, so a 200 W probe "
+      "(SAFETY-73: the closed limit becomes a pin) stays reachable",
+      loop_bound({A: M(gate=P_SAFETY, pin=200.0),
+                  Bee: M(mlo=0.0, mhi=0.0)}) == (0.0, 200.0))
+check("...and the pin is clamped into the hard limits first, as plan() "
+      "clamps it",
+      loop_bound({A: M(lo=-RATING, hi=0.0, gate=P_SAFETY, pin=200.0),
+                  Bee: M(mlo=0.0, mhi=0.0)}) == (0.0, 0.0))
+check("...a mode that leaves out 0 W adds the hard interval (dropped, as in "
+      "plan()), so every term holds 0 and so does the sum",
+      loop_bound({A: M(mlo=500.0, mhi=900.0), Bee: M(mlo=0.0, mhi=0.0)})
+      == (-RATING, RATING))
+check("...and a unit contradicting itself adds nothing",
+      loop_bound({A: M(contra=True), Bee: M(mlo=0.0, mhi=0.0)}) == (0.0, 0.0))
+
 print()
 if fails:
     print(f"{len(fails)} FAILED: {', '.join(fails)}")
diff --git a/goodwe_controller/test_arbiter.py b/goodwe_controller/test_arbiter.py
index 76327d2..8fe90d4 100644
--- a/goodwe_controller/test_arbiter.py
+++ b/goodwe_controller/test_arbiter.py
@@ -149,7 +149,7 @@ check("...and `source` is still the first positional argument, which is what "
       Claim.limit("device", P_SAFETY, -1, 1).source == "device")
 
 print()
-print("ARB-03 2. the split: eleven sources, each classified where it is BUILT")
+print("ARB-03 2. the split: sixteen sources, each classified where it is BUILT")
 # The classification is graded against what each claim is ABOUT, restated here
 # so that the table in arbiter.py and the expectation in a test are not the same
 # sentence read twice. test_peakguard.py part 10f pins this set against main.py's
@@ -171,6 +171,17 @@ SITE_SOURCES = {
                  "offending number is the SITE target, which no single "
                  "inverter owns - parking one of them would leave the rest "
                  "pushing the same way with the guard satisfied",
+    # SAFETY-78.
+    "drain":     "the site target may not go below a pinned maintenance "
+                 "drain, or a sibling would charge against it. Filed at N>1 "
+                 "only",
+    # SAFETY-84.
+    "charge":    "the site target may not go above a cheap-window maintenance "
+                 "charge, or a sibling would give against it. Filed at N>1 "
+                 "only",
+    # SAFETY-86.
+    "hold":      "the site target stays at the peak floor while a holding pack "
+                 "gives the shortfall. Filed at N>1 only",
 }
 UNIT_SOURCES = {
     "device":     "one inverter's own reported min/max rating",
@@ -189,16 +200,24 @@ UNIT_SOURCES = {
                   "is added, `peak_soc_floor` is not consulted, the SITE target "
                   "is untouched, and main.py does not file it at all at a "
                   "roster of one",
+    # SAFETY-73.
+    "refused":    "THIS battery's own reading gave nothing against THIS unit's "
+                  "own standing command, so that direction is closed on THIS "
+                  "unit and its share goes to the others. Filed at N>1 only",
+    # OPT-11, added on purpose (test_peakguard.py part 10f says why).
+    "mode":       "THIS battery's mode, chosen by its owner. A soft unit limit "
+                  "that stage 1 keeps apart from the hard ones and stage 3 "
+                  "releases when a claim above P_MODE decides the site target",
 }
 for _src, _why in sorted(SITE_SOURCES.items()):
     print(f"    site  {_src:<11} {_why}")
 for _src, _why in sorted(UNIT_SOURCES.items()):
     print(f"    unit  {_src:<11} {_why}")
-check("all ELEVEN claim sources are classified, and only those eleven",
+check("all SIXTEEN claim sources are classified, and only those sixteen",
       set(CLAIM_SCOPE) == set(SITE_SOURCES) | set(UNIT_SOURCES))
-check("the six that are about the GRID CONNECTION are site claims",
+check("the nine that are about the GRID CONNECTION are site claims",
       {s for s, v in CLAIM_SCOPE.items() if v == SCOPE_SITE} == set(SITE_SOURCES))
-check("the five that are about a PACK, a DEVICE or one write are per-inverter",
+check("the seven that are about a PACK, a DEVICE or one write are per-inverter",
       {s for s, v in CLAIM_SCOPE.items() if v == SCOPE_UNIT} == set(UNIT_SOURCES))
 check("a source nobody classified cannot be routed at all - actuator_for() "
       "raises rather than defaulting to the site, because defaulting to the "
@@ -216,9 +235,9 @@ check("with one inverter every source routes to the site, per-inverter ones "
       all(actuator_for(s, "inverter-a", ONE) == ACTUATOR_SITE for s in CLAIM_SCOPE))
 check("...and with none configured at all, likewise",
       all(actuator_for(s, "inverter-a", ()) == ACTUATOR_SITE for s in CLAIM_SCOPE))
-check("with TWO the identity breaks and the split becomes real: the five "
-      "per-inverter sources route to the unit this controller drives, the six "
-      "site sources stay on the grid connection",
+check("with TWO the identity breaks and the split becomes real: the seven "
+      "per-inverter sources route to the unit this controller drives, the "
+      "nine site sources stay on the grid connection",
       {s: actuator_for(s, "inverter-a", TWO) for s in CLAIM_SCOPE}
       == {**{s: "inverter-a" for s in UNIT_SOURCES},
           **{s: ACTUATOR_SITE for s in SITE_SOURCES}})
@@ -499,7 +518,7 @@ check("...and at N=1, where every source legitimately routes to the site, the "
           Claim.limit("maintenance", P_MAINT_SHAPE, hi=0.0)]) == [])
 check("an unclassified ninth source is a violation wherever it is filed",
       scope_violations([Claim.limit("reserve", P_LOOP, hi=0.0)]) != [])
-check("and the eight, routed by actuator_for() at a two-inverter site, are "
+check("and the sixteen, routed by actuator_for() at a two-inverter site, are "
       "clean - which is what says the router and the checker agree",
       scope_violations(
           [Claim.limit(s, P_SAFETY, -1, 1,
@@ -536,6 +555,252 @@ check("...and a correctly routed cycle is unaffected, which is what says this "
       resolve(SITE_SIDE, units=TWO).allocated is True)
 
 
+
+print()
+print("OPT-11 9. the mode layer: a unit `hi` never meets the site `lo`")
+# A battery's mode is a SOFT unit limit at P_MODE (35). Stage 1 keeps it apart
+# from the hard limits; stage 3 applies it only while the site target was
+# decided at or below P_MODE. So the peak guard's site floor (P_PEAK) releases
+# every mode and SAFETY-25 section 0a's cross-inverter contradiction - 0 W in a
+# billed period - still cannot be written down.
+from app.arbiter import MODE_SOURCE, P_MODE                     # noqa: E402
+from app.allocator import MODE_FAULT, MODE_RELEASED             # noqa: E402
+
+
+def _two(loop_w, *, peak_lo=None, modes=None, rating=2000.0, arb=None):
+    """A two-inverter cycle's claims: ratings, each unit's mode, the loop,
+    optionally the peak floor and an arbitrage set."""
+    cl = []
+    for u in TWO:
+        cl.append(Claim.limit("supervised", P_SAFETY, -rating, rating,
+                              "max_w", actuator=u))
+    for u, (lo, hi) in (modes or {}).items():
+        cl.append(Claim.limit(MODE_SOURCE, P_MODE, lo, hi, "mode", actuator=u))
+    cl.append(Claim.set("loop", P_LOOP, loop_w))
+    if arb is not None:
+        cl.append(Claim.set("arbitrage", P_ARBITRAGE, arb))
+    if peak_lo is not None:
+        cl.append(Claim.limit("peak", P_PEAK, lo=peak_lo))
+    return cl
+
+
+check("P_MODE sits between arbitrage and the peak guard, so a trade stays "
+      "inside each mode and the peak floor releases them all",
+      P_ARBITRAGE < P_MODE < P_PEAK and P_MODE < P_MAINT_SHAPE)
+_off_b = {"inverter-b": (0.0, 0.0)}
+r = resolve(_two(-500.0, peak_lo=3000.0, modes=_off_b), units=TWO)
+print(f"    peak floor 3000 W, loop asks -500 W, B off: {r.explain()}, "
+      f"deciding {r.deciding_priority}, shares {r.shares}")
+check("⭐ at N=2 a mode `hi` of 0 W on B and the peak guard's site `lo` of "
+      "3000 W do NOT contradict: no 0 W stop, the floor decides S (priority "
+      "50), the mode is released, and the shares still sum to S",
+      not r.contradiction and r.allocated and r.target_w == 3000.0
+      and r.deciding_priority == P_PEAK
+      and sum(r.shares.values()) == 3000 and r.allocation.unmet_w == 0)
+_forbidden = [c if c.source != MODE_SOURCE
+              else Claim.limit(MODE_SOURCE, P_MODE, c.lo, c.hi,
+                               actuator=ACTUATOR_SITE)
+              for c in _two(-500.0, peak_lo=3000.0, modes=_off_b)]
+_rf = site_resolve([c for c in _forbidden if c.actuator == ACTUATOR_SITE])
+check("...and the SAME mode filed as a SITE limit is exactly the fault the "
+      "layer exists to keep out: stage 2 then reads `lo` 3000 > `hi` 0 and "
+      "stops the site at 0 W (so the check above sees the difference)",
+      _rf.contradiction and _rf.target_w == 0.0)
+check("...and resolve() refuses that mis-filed mode at N=2 (a UNIT claim on "
+      "the site), rather than dividing a number that may be wrong",
+      resolve(_forbidden, units=TWO).allocated is False)
+
+# The sweep: every mode range that holds 0 W, every loop ask, every floor.
+_bad = []
+_n = 0
+_spans = [(0.0, 0.0), (-2000.0, 0.0), (0.0, 2000.0), (-2000.0, 2000.0),
+          (-700.0, 300.0)]
+for _ma in _spans:
+    for _mb in _spans:
+        for _loop in (-5000.0, -1200.0, 0.0, 800.0, 3900.0):
+            for _peak in (None, 0.0, 1500.0, 3000.0, 4000.0):
+                _n += 1
+                _r = resolve(_two(_loop, peak_lo=_peak,
+                                  modes={"inverter-a": _ma,
+                                         "inverter-b": _mb}), units=TWO)
+                _al = _r.allocation
+                _sh = list(_r.shares.values())
+                if (_r.contradiction or not _r.allocated
+                        or sum(_sh) + _al.unmet_w != _al.sum_w
+                        or (any(x > 0 for x in _sh) and any(x < 0 for x in _sh))
+                        or (_peak is not None and _r.target_w < _peak)):
+                    _bad.append((_ma, _mb, _loop, _peak, _r.explain(),
+                                 _al.explain()))
+for x in _bad[:5]:
+    print(f"       BAD {x}")
+check(f"over {_n} two-inverter cycles (5x5 mode ranges holding 0 W, 5 loop "
+      f"asks, 5 peak floors) no cycle contradicts, refuses, loses a watt of "
+      f"the sum, splits the sign, or goes under the peak floor",
+      not _bad and _n == 625)
+
+check("deciding_priority: the loop alone decides at 10",
+      resolve(_two(800.0), units=TWO).deciding_priority == P_LOOP)
+check("...a trade decides at 30, so the modes still apply to it",
+      resolve(_two(800.0, arb=-1500.0), units=TWO).deciding_priority
+      == P_ARBITRAGE)
+check("...a peak floor that does not bind leaves the loop deciding at 10",
+      resolve(_two(3500.0, peak_lo=1000.0), units=TWO).deciding_priority
+      == P_LOOP)
+check("...and a peak floor that binds decides at 50",
+      resolve(_two(500.0, peak_lo=1000.0), units=TWO).deciding_priority
+      == P_PEAK)
+_r35 = resolve(_two(3000.0, modes=_off_b), units=TWO)
+check("with the loop deciding, B's Off mode holds: B gets 0 W and A carries "
+      "what it can, the rest reported as unmet",
+      _r35.shares == {"inverter-a": 2000, "inverter-b": 0}
+      and _r35.allocation.unmet_w == 1000)
+
+_ub = pre_resolve([Claim.limit("supervised", P_SAFETY, -2000, 2000),
+                   Claim.limit(MODE_SOURCE, P_MODE, 0.0, 0.0)])
+check("stage 1 keeps the mode APART from the hard limits: the unit's own "
+      "interval is still its rating and the mode travels beside it",
+      (_ub.lo, _ub.hi, _ub.mode_lo, _ub.mode_hi, _ub.mode_priority)
+      == (-2000, 2000, 0.0, 0.0, P_MODE) and not _ub.contradiction)
+_ub2 = pre_resolve([Claim.limit("supervised", P_SAFETY, -2000, 2000),
+                    Claim.limit(MODE_SOURCE, P_MODE, 500.0, 2000.0)])
+check("...so a mode that does not hold 0 W cannot make the unit contradict "
+      "itself at stage 1; stage 3 drops it as a software fault instead",
+      not _ub2.contradiction
+      and allocate(1000.0, {"inverter-a": _ub2, "inverter-b": UnitBounds()})[1]
+      and resolve(_two(1000.0, modes={"inverter-a": (500.0, 2000.0)}),
+                  units=TWO).allocation.mode_faults
+      == (("inverter-a", MODE_FAULT),))
+_ubm = pre_resolve([Claim.limit("supervised", P_SAFETY, -2000, 2000),
+                    Claim.set("maintenance", P_MAINTENANCE, 2500.0, "drain"),
+                    Claim.limit(MODE_SOURCE, P_MODE, 0.0, 0.0)])
+check("...and a unit's own maintenance SET (60) gates the mode out, as it "
+      "gates every lower limit: maintenance outranks the mode",
+      _ubm.mode_priority is None and _ubm.pinned_by == "maintenance")
+
+print()
+print("OPT-11 10. at N=1 the mode bounds the site target, by the same rule")
+_one = [Claim.limit("supervised", P_SAFETY, -5000, 5000, "max_w"),
+        Claim.limit(MODE_SOURCE, P_MODE, 0.0, 0.0, "off")]
+_r1 = resolve(_one + [Claim.set("loop", P_LOOP, 1200.0)], units=ONE)
+check("the loop deciding: an Off battery's site target is 0 W, named as the "
+      "mode's doing, with no contradiction",
+      _r1.target_w == 0.0 and not _r1.contradiction
+      and _r1.bound_by == "mode(off)" and _r1.allocated)
+_r1p = resolve(_one + [Claim.set("loop", P_LOOP, 1200.0),
+                       Claim.limit("peak", P_PEAK, lo=2000.0)], units=ONE)
+check("...a binding peak floor releases it (2000 W, no contradiction), "
+      "which at N=1 would otherwise be `lo` 2000 > `hi` 0 and a 0 W stop",
+      _r1p.target_w == 2000.0 and not _r1p.contradiction
+      and _r1p.deciding_priority == P_PEAK)
+_r1a = resolve(_one + [Claim.set("arbitrage", P_ARBITRAGE, -3000.0)],
+               units=ONE)
+check("...a trade (30) stays inside it", _r1a.target_w == 0.0)
+_r1f = resolve([Claim.limit(MODE_SOURCE, P_MODE, 100.0, 900.0),
+                Claim.set("loop", P_LOOP, -1200.0)], units=ONE)
+check("...and a mode range without 0 W is dropped and reported, never "
+      "obeyed: the target stays the loop's -1200 W",
+      _r1f.target_w == -1200.0 and _r1f.mode_fault is not None)
+check("...and with no mode claim at all, stage 2's answer is untouched "
+      "(the N=1 path with battery modes off)",
+      resolve([Claim.set("loop", P_LOOP, 1200.0)], units=ONE).target_w
+      == 1200.0)
+
+print()
+print("OPT-11 11. a mode gives way only as far as the peak limit needs")
+# Review of PR #149. The first cut released the modes only when a limit above
+# P_MODE bound S. A trade (30) that won above the peak floor then kept the
+# modes, and the units placed less than the floor: the mode beat the peak
+# guard (a billed peak). And a peak limit that merely capped a charge released
+# the modes, so an Off battery was charged from the grid. The rule now: clamp
+# into what the modes can place, then back into the limits above the mode.
+_offb = {"inverter-b": (0.0, 0.0)}
+
+
+def _placed(r):
+    return sum(r.shares.values())
+
+
+_ra = resolve(_two(0.0, arb=3000.0, peak_lo=2000.0, rating=1500.0,
+                   modes=_offb)[:-1] + [
+    Claim.set("arbitrage", P_ARBITRAGE, 3000.0),
+    Claim.limit("peak", P_PEAK, lo=2000.0)], units=TWO)
+print(f"    trade 3000 W over a 2000 W floor, A 1500 W, B off: {_ra.shares}")
+check("⭐ a trade above the peak floor with B Off: the units still place the "
+      "floor (2000 W), A to its rating and B only the 500 W A cannot give",
+      _placed(_ra) == 2000 and _ra.shares == {"inverter-a": 1500,
+                                               "inverter-b": 500})
+_r1t = resolve(_one + [Claim.set("arbitrage", P_ARBITRAGE, 3000.0),
+                       Claim.limit("peak", P_PEAK, lo=2000.0)], units=ONE)
+check("⭐ ...and at N=1 an Off battery under a trade gives the peak floor "
+      "(2000 W), not 0 W", _r1t.target_w == 2000.0
+      and _r1t.bound_by == "peak")
+_rc = resolve(_two(0.0, arb=-3000.0, peak_lo=-1000.0, modes=_offb),
+              units=TWO)
+check("⭐ a grid charge the peak limit caps at 1000 W does not release B's "
+      "Off: A takes it all and B stays at 0 W",
+      _rc.shares == {"inverter-a": -1000, "inverter-b": 0})
+_r1c = resolve(_one + [Claim.set("arbitrage", P_ARBITRAGE, -3000.0),
+                       Claim.limit("peak", P_PEAK, lo=-1000.0)], units=ONE)
+check("...and at N=1 an Off battery is not charged from the grid under a "
+      "capped trade", _r1c.target_w == 0.0)
+_rp = resolve(_two(500.0, peak_lo=1500.0, modes=_offb), units=TWO)
+check("a peak floor A can carry alone leaves B Off at 0 W",
+      _rp.shares == {"inverter-a": 1500, "inverter-b": 0}
+      and _rp.target_w == 1500.0)
+_rall = resolve(_two(0.0, peak_lo=3000.0,
+                     modes={"inverter-a": (0.0, 0.0),
+                            "inverter-b": (0.0, 0.0)}), units=TWO)
+check("every battery Off and a 3000 W peak floor: the floor is placed, "
+      "split between them, and nothing contradicts",
+      _placed(_rall) == 3000 and not _rall.contradiction
+      and _rall.allocation.refused is None)
+
+import random as _rnd                                           # noqa: E402
+_g = _rnd.Random(149)
+_worse, _needless, _sign, _nn = [], [], [], 0
+for _ in range(20000):
+    _units = ("inverter-a", "inverter-b", "inverter-c")[:_g.choice((2, 3))]
+    _cl = []
+    for _u in _units:
+        _rt = _g.choice((1000.0, 2500.0))
+        _cl.append(Claim.limit("supervised", P_SAFETY, -_rt, _rt,
+                               actuator=_u))
+        if _g.random() < 0.2:
+            _cl.append(Claim.limit("pack", P_SAFETY,
+                                   *_g.choice(((0.0, inf), (-inf, 0.0))),
+                                   actuator=_u))
+        _cl.append(Claim.limit(MODE_SOURCE, P_MODE,
+                               _g.choice((0.0, -_rt)), _g.choice((0.0, _rt)),
+                               actuator=_u))
+    _src = _g.choice(("loop", "arbitrage"))
+    _cl.append(Claim.set(_src, P_LOOP if _src == "loop" else P_ARBITRAGE,
+                         _g.uniform(-7000.0, 7000.0)))
+    _pk = _g.uniform(-4000.0, 6000.0)
+    _cl.append(Claim.limit("peak", P_PEAK, lo=_pk))
+    _r = resolve(_cl, units=_units)
+    _r0 = resolve([c for c in _cl if c.source != MODE_SOURCE], units=_units)
+    _nn += 1
+    if _r.allocation.refused is not None:
+        _sign.append(_cl)
+        continue
+    if _placed(_r) < _pk - 1 and _placed(_r0) >= _pk - 1:
+        _worse.append(_cl)
+    # An Off unit gives power only when the peak floor is short without it.
+    _off = [c.actuator for c in _cl if c.source == MODE_SOURCE
+            and c.lo == 0.0 and c.hi == 0.0]
+    # What the units whose mode lets them give power can give, within it.
+    _on_cap = sum(max(0.0, min(_r.unit_bounds[u].hi, _r.unit_bounds[u].mode_hi))
+                  for u in _units if _r.unit_bounds[u].mode_hi > 0.0
+                  and _r.unit_bounds[u].lo <= 0.0)
+    if any(_r.shares.get(u, 0) > 0 for u in _off) and _pk <= _on_cap - 1:
+        _needless.append(_cl)
+check(f"over {_nn} random N=2/3 cycles (modes, packs, a trade or the loop, a "
+      f"peak floor): no split is refused, the placed power never falls under "
+      f"the floor where the same cycle without modes met it, and an Off "
+      f"battery gives power only when the others cannot carry the floor "
+      f"({len(_sign)}, {len(_worse)}, {len(_needless)})",
+      not _sign and not _worse and not _needless)
+
 print()
 if fails:
     print(f"{len(fails)} FAILED: {', '.join(fails)}")
diff --git a/goodwe_controller/test_arbitrage.py b/goodwe_controller/test_arbitrage.py
index 737ef3d..5faf5c6 100644
--- a/goodwe_controller/test_arbitrage.py
+++ b/goodwe_controller/test_arbitrage.py
@@ -79,6 +79,7 @@ import sys
 from datetime import datetime, timedelta, timezone
 
 from app import arbitrage as _arb
+from named_absence import first
 from app import main as _main
 from app import peakguard as _pg
 from app.arbiter import (
@@ -933,12 +934,12 @@ check("main.py passes the guard's OWN measured headroom at its one "
 # once in `__init__` and never refreshed would satisfy the pin above and would
 # size every trade from the guard decision of whatever cycle happened to run
 # last - which is the defect the hoist's own comment warns about, one level up.
-_s45_cycle = next(n for n in ast.walk(_S45_MAIN_TREE)
-                  if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
-                  and n.name == "cycle"
-                  and any(isinstance(c, ast.Call)
-                          and ast.unparse(c.func).endswith("arbitrage.decide")
-                          for c in ast.walk(n)))
+_s45_cycle = first((n for n in ast.walk(_S45_MAIN_TREE)
+                    if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
+                    and n.name == "cycle"
+                    and any(isinstance(c, ast.Call)
+                            and ast.unparse(c.func).endswith("arbitrage.decide")
+                            for c in ast.walk(n))), "no cycle() calling arbitrage.decide")
 check("...and the assignment is INSIDE the same `cycle()` that makes the call, "
       "so the headroom the trade is sized from is this cycle's guard decision "
       "and not one carried from an arbitrary earlier one",
@@ -1038,7 +1039,7 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
             now = t0 + timedelta(seconds=t)
             claims = []
             pk = _pg.decide(PeakTracker.project(avg, now), batt_w=batt,
-                            cap_w=cap_w, reading=None, achievable_w=MAX_W,
+                            cap_w=cap_w, margin_w=0.0, reading=None, achievable_w=MAX_W,
                             soc=50.0, soc_floor=20.0, max_hold_s=900.0,
                             frozen=False)
             pc = _pg.claim(pk)
@@ -1069,22 +1070,23 @@ def s45_loop(*, sized: bool, cap_w=S45_CAP_W, load_w=S45_LOAD_W,
             res = resolve(claims)
             target = res.target_w
             head_w = _pg.charge_headroom_w(pk) if sized else HEADROOM_CLEAR
-            rec.append(dict(
+            row = dict(
                 t_s=t, action=arb.action, power_w=arb.power_w,
                 reason=arb.reason, price=arb.price_now_eur_kwh,
                 spread=arb.spread_eur_kwh, winner=res.winner,
                 target_w=float(res.target_w), headroom_w=head_w,
                 engaged=bool(pk.engaged),
                 sized_from_meter=_arb.sized_from_meter(
-                    arb, head_w, winner=res.winner)))
+                    arb, head_w, winner=res.winner))
+            rec.append(row)
             if shadow:
                 # --- TRANSCRIBED 1/3: `_shadow_settle()`'s record, taken
                 #     BEFORE the re-seed destroys its evidence.
-                rec[-1]["would_w"] = float(res.target_w)
-                rec[-1]["row"] = _shadow.words(
+                row["would_w"] = float(res.target_w)
+                row["row"] = _shadow.words(
                     {"shadow_mode": "on"}, control_started=False,
                     would_w=float(res.target_w),
-                    sized_from_meter=rec[-1]["sized_from_meter"],
+                    sized_from_meter=row["sized_from_meter"],
                     reason=res.explain())
                 # --- TRANSCRIBED 2/3: `_write_unit()`'s substitution - the
                 #     plant below is driven from WIRE_W, not from the decision.
@@ -1378,7 +1380,7 @@ def _s47_headroom(*, meter_w, batt_w, elapsed_s=450.0):
         t += 5.0
     pk = _pg.decide(
         PeakTracker.project(avg, S45_T0 + timedelta(seconds=elapsed_s)),
-        batt_w=batt_w, cap_w=S45_CAP_W, reading=None, achievable_w=MAX_W,
+        batt_w=batt_w, cap_w=S45_CAP_W, margin_w=0.0, reading=None, achievable_w=MAX_W,
         soc=50.0, soc_floor=20.0, max_hold_s=900.0, frozen=False)
     return _pg.charge_headroom_w(pk)
 
@@ -1485,13 +1487,14 @@ s47check("the shipped row carries the caveat at the worst cycle: the operator is
 s47check("...and it still carries the watts, in their own slot, and the standing "
       "0 W beside them - the caveat NARROWS the claim rather than deleting "
       "the record a shadow run exists to produce",
-      "WOULD HAVE COMMANDED" in _s47_row and "inverter held at 0 W" in _s47_row
+      "it would ask for" in _s47_row
+      and "the inverters stay at 0 W" in _s47_row
       and f"{round(_s47_chg['would_w']):+d}".replace("+", "") != "")
-s47check("...and the watts are introduced as what it would have commanded ON "
-      "THIS CYCLE, in every shadow state and not only the caveated ones - no "
-      "number a shadow run records is a forecast of a live run",
-      "ON THIS CYCLE WOULD HAVE COMMANDED" in _s47_row
-      and "ON THIS CYCLE WOULD HAVE COMMANDED" in _s47_first_row)
+s47check("...and the watts are introduced as what it would ask for THIS CYCLE, "
+      "in every shadow state and not only the caveated ones - no number a "
+      "shadow run records is a forecast of a live run (UX-08: in plain words)",
+      "This cycle it would ask for" in _s47_row
+      and "This cycle it would ask for" in _s47_first_row)
 
 # --- 3d-7b. THE ACTION LOG, WHICH IS THE RECORD READ AFTERWARDS -----------
 # ⚠️ THE TWO SURFACES ARE GRADED SEPARATELY BECAUSE THEY FAILED SEPARATELY.
@@ -2607,7 +2610,7 @@ check("arbitrage on with NO price source at all is refused - a strategy that "
       "must refuse on every cycle forever looks exactly like one that is "
       "running and finding nothing",
       why(validate_startup_config(vbase(arbitrage_enabled=True, **P1_ON),
-                                  -5000, 5000), "NO PRICES AT ALL"))
+                                  -5000, 5000), "the site has no prices"))
 check("arbitrage on with meter_source off is refused - §9.1 puts peak shaving "
       "above arbitrage and an unmeasured peak cannot be shaved",
       why(validate_startup_config(
@@ -2618,7 +2621,7 @@ check("a floor at or above the ceiling is refused - there is no band left "
       why(validate_startup_config(
           vbase(arbitrage_enabled=True, price_provider="generic_dayahead",
                 arbitrage_soc_floor=90, arbitrage_soc_ceiling=90, **P1_ON),
-          -5000, 5000), "no band left"))
+          -5000, 5000), "Make the lower limit the smaller number"))
 check("...and the same numbers the right way round start",
       validate_startup_config(
           vbase(arbitrage_enabled=True, price_provider="generic_dayahead",
@@ -2627,7 +2630,7 @@ check("...and the same numbers the right way round start",
 check("a NEGATIVE cycle_cost_threshold_eur is refused even with arbitrage OFF "
       "- it is a cost, and a negative one is a threshold every spread clears",
       why(validate_startup_config(vbase(cycle_cost_threshold_eur=-0.01),
-                                  -5000, 5000), "non-negative")
+                                  -5000, 5000), "Set it to 0 or more")
       and raises(lambda: threshold_eur_kwh({"cycle_cost_threshold_eur": -1}),
                  ValueError))
 # Rule 7's wording, which OPT-04 had to update because it named what main.py
diff --git a/goodwe_controller/test_batteries_screen.py b/goodwe_controller/test_batteries_screen.py
new file mode 100644
index 0000000..85cd197
--- /dev/null
+++ b/goodwe_controller/test_batteries_screen.py
@@ -0,0 +1,499 @@
+"""UX-13 P3: the Batteries screen and Settings, Simple.  `python3 test_batteries_screen.py`
+
+1. Each battery's Now, Today and Why lines, in English and Dutch, for the six
+   states the brief names: modes off, modes on, a battery Off, an Off battery
+   giving way to the peak limit, a refusal hold, and the monthly cycle.
+2. The OPT-11 P1 test's F2 contradictions stay gone: a battery that moves
+   power never reads "0 W" beside it, the Off help names no watts, and no
+   battery line says the peak limit "holds back" a battery it asks for power.
+3. The plan leaves an Off battery out, except for the peak limit.
+4. `battery_why()` is pure and picks the most urgent reason first.
+5. The screen's `/action` round trips over the real web app: the switch and
+   the mode list post `pack_use` and `pack_mode`, `/status` shows the result
+   in both languages, and a refused value comes back as a plain 400.
+6. The page: the cards, the Simple view and its fields come from the layout
+   table and ui_text, and the scripts post only the existing actions.
+7. The screen changes no control path: homeview.py reads the controller and
+   calls nothing that writes, and the page adds no /action value.
+The headless-browser check is in the PR, not in CI (the CI image has no
+browser). Mutating a module this file grades? Read MUTATION.md first.
+"""
+
+import ast
+import asyncio
+import io
+import json
+import os
+import re
+import socket
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import aiohttp                                                  # noqa: E402
+from aiohttp import web as aioweb                               # noqa: E402
+
+import ux13_demo as D                                           # noqa: E402
+from app import homeview, messages, packmode, uilayout as L, uipage, web  # noqa
+from app.maintenance import IDLE, DRAIN                         # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def words(lang):
+    with io.open(os.path.join(HERE, "app", "ui_text", f"{lang}.json"),
+                 encoding="utf-8") as f:
+        return json.load(f)
+
+
+EN, NL = words("en"), words("nl")
+B_NAME = D.OPTS["inverters"][1]["name"]
+LANGS = {"en": EN, "nl": NL}
+
+
+# The fixture's prices are for the day it is built, so the plan depends on
+# the hour. Pin the clock (review of #150: unpinned, this file failed every
+# morning): the fixture is built at 00:15 on 2026-09-28, Brussels time. Part 1
+# looks at 23:30, when the day's trades and cycle start are past, and part 3
+# at 00:30, with all of them ahead.
+_BUILT = datetime(2026, 9, 27, 22, 15, tzinfo=timezone.utc)
+
+
+class _Clock(datetime):
+    @classmethod
+    def now(cls, tz=None):
+        return _BUILT.astimezone(tz) if tz else _BUILT.replace(tzinfo=None)
+
+
+D.datetime = _Clock
+_DAY0 = homeview.local_day(_BUILT)[0]
+EVENING = _DAY0 + timedelta(hours=23, minutes=30)
+MORNING = _DAY0 + timedelta(minutes=30)
+
+
+def build(state, lang="en", c=None, now=None):
+    c = c or D.controller(state)
+    s = c.status_payload()
+    return homeview.build(c, level=s["level"], checks=s["checks"], lang=lang,
+                          now=now or EVENING)
+
+
+# The six states and what each battery's Why line must be.
+WANT = {
+    "running": ("modes_off", "modes_off"),
+    "modes": ("solar_first", "leftover"),
+    "off": ("solar_first", "off"),
+    "off_peak": ("peak", "off_peak"),
+    "refusal": ("refuses_give", "other_refuses"),
+    # SAFETY-78: the other battery says why it does not charge.
+    "maint": ("cycle_mode", "other_cycle"),
+}
+
+# ============================================================================ #
+print("1. Now, Today and Why per battery, English and Dutch")
+ROWS = {(st, lang): build(st, lang) for st in WANT for lang in LANGS}
+for st, want in WANT.items():
+    got = tuple(b["why_key"] for b in ROWS[(st, "en")]["batteries"])
+    en = ROWS[(st, "en")]["batteries"]
+    nl = ROWS[(st, "nl")]["batteries"]
+    print(f"    {st}: " + " / ".join(f"{b['now']} | {b['why']} | "
+                                     f"{b['today_line'] or b['today']}"
+                                     for b in en))
+    check(f"{st}: the Why lines are {want}, in each language's own words",
+          got == want
+          and all(b["why"] == homeview.uitext.say(
+              W["home_words"]["why"][b["why_key"]],
+              name=D.OPTS["inverters"][0]["name"])
+              for W, rows in ((EN, en), (NL, nl)) for b in rows))
+    check(f"{st}: every battery has a Now, a Why and a Today, and the Dutch "
+          f"lines differ from the English",
+          all(b["now"] and b["why"] and (b["today"] or b["today_line"])
+              for b in en + nl)
+          and all(e["why"] != n["why"] and e["now"] != n["now"]
+                  for e, n in zip(en, nl)))
+
+_modes = ROWS[("modes", "en")]
+check("modes on: each row carries its switch and mode; Today says Solar "
+      "first follows the house and, before any cycle has made the price "
+      "runs (OPT-11 P3), that Leftover solar is not planned yet",
+      _modes["modes_on"] is True
+      and [(b["use"], b["mode_key"]) for b in _modes["batteries"]]
+      == [(True, "solar_first"), (True, "leftover_solar")]
+      and [b["today_line"] for b in _modes["batteries"]]
+      == [EN["home_words"]["today"]["house"],
+          EN["home_words"]["today"]["not_planned"]])
+_off = ROWS[("running", "en")]
+check("modes off: no switch, no mode, and Today and Why say it follows the "
+      "house", _off["modes_on"] is False
+      and all("mode_key" not in b and "use" not in b
+              and b["today_line"] == EN["home_words"]["today"]["house"]
+              for b in _off["batteries"]))
+_b = ROWS[("off", "en")]["batteries"][1]
+check("a battery Off: 'Off. Resting now.', 'You switched it off.', and no "
+      "monthly cycle today", (_b["mode_key"], _b["now"], _b["why"],
+                              _b["today_line"])
+      == ("off", EN["home_words"]["now"]["off_resting"],
+          EN["home_words"]["why"]["off"], EN["home_words"]["today"]["off"]))
+_b = ROWS[("off_peak", "en")]["batteries"][1]
+_bn = ROWS[("off_peak", "nl")]["batteries"][1]
+check("Off giving way to the peak limit says so plainly, with the figure: "
+      "'Off, but gives 0.5 kW for the peak limit.'",
+      _b["now"] == "Off, but gives 0.5 kW for the peak limit."
+      and _bn["now"] == "Uit, maar levert 0,5 kW voor de piekgrens."
+      and _b["why"] == EN["home_words"]["why"]["off_peak"])
+_a, _b = ROWS[("refusal", "en")]["batteries"]
+check("a refusal hold: the refusing battery says it refuses and when it "
+      "tries again, the other says it takes over",
+      _a["why"] == EN["home_words"]["why"]["refuses_give"]
+      and _b["why"] == "Battery A refuses to give power, so this battery "
+                       "takes over.")
+_a = ROWS[("maint", "en")]["batteries"][0]
+check("maintenance: the cycle comes first, the mode resumes after, and Today "
+      "shows the cycle block", _a["maintenance"] == DRAIN
+      and _a["why"] == EN["home_words"]["why"]["cycle_mode"]
+      and [r["kind"] for r in _a["today"]] == ["cycle"])
+_sh = build("shadow")["batteries"]
+_al = build("alarm")["batteries"]
+check("shadow mode and an alarm: Why says which, and Today plans nothing "
+      "the add-on does not do",
+      all(b["why_key"] == "shadow" and b["today_line"]
+          == EN["home_words"]["today"]["house_would"] for b in _sh)
+      and all(b["why_key"] == "held" and b["today_line"]
+              == EN["home_words"]["today"]["held"] for b in _al))
+
+# ============================================================================ #
+print("\n2. the OPT-11 P1 test's F2: no line contradicts the power shown")
+ZERO = re.compile(r"\b0 W\b")
+GOING = (EN["home_words"]["zero_going"], NL["home_words"]["zero_going"],
+         "going to 0 W", "gaat naar 0 W")
+_bad = []
+for (st, lang), payload in sorted(ROWS.items()):
+    for b in payload["batteries"]:
+        moving = b["power_w"] is not None and abs(b["power_w"]) > homeview.IDLE_W
+        if moving and b.get("maintenance", IDLE) == IDLE:
+            kw = homeview._dec(f"{abs(b['power_w']) / 1000:.1f}")
+            kw = kw.replace(".", ",") if lang == "nl" else kw
+            if kw not in b["now"]:
+                _bad.append(f"{st}/{lang}/{b['name']}: no figure in {b['now']!r}")
+            for line in (b["now"], b["why"]):
+                if ZERO.search(line) and not any(g in line for g in GOING):
+                    _bad.append(f"{st}/{lang}/{b['name']}: 0 W beside power: "
+                                f"{line!r}")
+        if "held back" in b["why"] or "tegengehouden" in b["why"]:
+            _bad.append(f"{st}/{lang}/{b['name']}: {b['why']!r}")
+print(f"    {_bad}")
+check("a battery that moves power shows the figure, and no line beside it "
+      "says 0 W", not _bad)
+check("the Off help names no watts, in either language, and says the peak "
+      "limit may use the battery",
+      all(not ZERO.search(W["home"]["batteries"]["choice"]["off"]
+                          ["description"]) for W in LANGS.values())
+      and "peak limit" in EN["home"]["batteries"]["choice"]["off"]
+      ["description"])
+_going = homeview.battery_now(62, 900, phase=IDLE, shadow=False, running=True,
+                              off=True, peak=False)
+check("an Off battery still moving without the peak limit reads 'going to "
+      "0 W' with its figure, never a bare 0 W",
+      _going == "Off. Still at 0.9 kW, going to 0 W.")
+
+# ============================================================================ #
+print("\n3. the plan leaves an Off battery out, except for the peak limit")
+_c = D.controller("off")
+_c.maints[1].cfg = _c.maints[0].cfg      # both due, so both would be drawn
+_p = build("off", c=_c)
+_kinds = {i: {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == i}
+          for i in (0, 1)}
+print(f"    {_kinds}")
+check("Off: no 'follows the house', no trade, no monthly cycle for B",
+      not _kinds[1] and "house" in _kinds[0])
+_p = build("off", now=MORNING)
+# OPT-11 P3: with modes on the plan shows each battery's price runs, which a
+# control cycle makes; make them as the cycle does (`_mode_roles()`).
+_mc = D.controller("modes")
+_mc._mode_roles(MORNING, None)
+_m = build("modes", c=_mc, now=MORNING)
+_kinds = {i: {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == i}
+          for i in (0, 1)}
+print(f"    morning: {_kinds}, lines {_p['plan']['lines']}")
+check("in the morning, with trades and a cycle ahead: Solar first A follows "
+      "the house and has its cycle but no price block (OPT-11 P3: Solar first "
+      "never trades), Off B has no block and waits for no cycle; with B on "
+      "(Leftover solar) B has its expensive run but no grid block (it takes "
+      "solar only until the forecast, owner decision 2026-09-29) and waits",
+      {"house", "cycle"} == _kinds[0] and not _kinds[1]
+      and not any(B_NAME in x for x in _p["plan"]["lines"])
+      and "give" in {r["kind"] for r in _m["plan"]["runs"]
+                     if r["battery"] == 1}
+      and "grid" not in {r["kind"] for r in _m["plan"]["runs"]
+                         if r["battery"] == 1}
+      and any(B_NAME in x for x in _m["plan"]["lines"]))
+_p = build("off_peak")
+check("...but the peak block stays on it while the peak limit needs it",
+      {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == 1}
+      == {"peak"})
+# Review: an Off battery that A covers alone rests, so it gets no peak block,
+# and a card never says "every battery gives" beside it.
+_c = D.controller("off_peak")
+_c.inverters[1].batt = 0.0
+_p = build("off_peak", c=_c)
+_a, _b = _p["batteries"]
+check("peak limit covered by A alone: Off B rests, has no peak block, and "
+      "A's Why does not claim every battery gives",
+      _b["why_key"] == "off" and _b["now"] == EN["home_words"]["now"]
+      ["off_resting"] and not _b["today"]
+      and {r["kind"] for r in _p["plan"]["runs"] if r["battery"] == 0}
+      >= {"peak"} and _a["why_key"] == "peak"
+      and "every" not in _a["why"] and "elke" not in
+      build("off_peak", "nl", c=_c)["batteries"][0]["why"])
+# Review: a blind or floor-limited guard is engaged with a 0 W floor. It
+# forbids charging only, so no battery gives power for it.
+_bad = []
+for _kw in (dict(blind="meter gap"), dict(floor_limited=True)):
+    _c = D.controller("off_peak")
+    _c.peak_guard = homeview.peakguard.PeakDecision(
+        engaged=True, floor_w=0.0, ceiling_w=3500.0, ceiling_from="cap",
+        projected_w=None, **_kw)
+    _c.inverters[1].batt = 300.0          # B still going to 0 W
+    _p = build("off_peak", c=_c)
+    _a, _b = _p["batteries"]
+    if (_a["why_key"] == "peak" or _b["why_key"] == "off_peak"
+            or "peak limit" in _b["now"]
+            or any(r["kind"] == "peak" for r in _p["plan"]["runs"])):
+        _bad.append((_kw, _a["why_key"], _b["why_key"], _b["now"]))
+print(f"    {_bad}")
+check("a blind or floor-limited peak guard (floor 0 W) draws no peak block "
+      "and no line says the peak limit takes power", not _bad)
+
+# ============================================================================ #
+print("\n4. battery_why(): pure, most urgent first")
+BASE = dict(modes_on=True, mode=packmode.SOLAR_FIRST, off=False, reading=True,
+            phase=IDLE, shadow=False, running=True, held=False, refused=0,
+            peak=False, giving=False, sf_ahead=False)
+
+
+def why(**kw):
+    return homeview.battery_why(**dict(BASE, **kw))
+
+
+_cases = [
+    (dict(reading=False, held=True), "no_reading"),
+    (dict(held=True, shadow=True), "held"),
+    (dict(running=False, off=True), "stopped"),
+    (dict(shadow=True, phase=DRAIN), "shadow"),
+    (dict(phase=DRAIN, off=True), "cycle_mode"),
+    (dict(phase=DRAIN, modes_on=False), "cycle"),
+    (dict(off=True, peak=True, giving=True), "off_peak"),
+    (dict(off=True, peak=True, giving=False), "off"),   # charging or resting
+    (dict(off=True, giving=True), "off"),
+    (dict(refused=1, peak=True), "refuses_give"),
+    (dict(refused=-1), "refuses_charge"),
+    (dict(peak=True, giving=True, other_refuses="B"), "peak"),
+    (dict(giving=True, other_refuses="B", modes_on=False), "other_refuses"),
+    (dict(modes_on=False, giving=True), "modes_off"),
+    (dict(giving=True, mode=packmode.LEFTOVER_SOLAR), "covers_house"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, sf_ahead=True), "leftover"),
+    (dict(mode=packmode.LEFTOVER_SOLAR), "leftover_alone"),
+    ({}, "solar_first"),
+    # OPT-11 P3: the battery's role in the price runs, and no plan.
+    (dict(mode=packmode.CHEAP_HOURS, role="charge"), "grid_charge"),
+    (dict(role="rest"), "rests_charge"),
+    (dict(mode=packmode.CHEAP_HOURS, role="sell", giving=True), "selling"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="give", giving=True),
+     "expensive"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="hold", has_at=True), "saves"),
+    (dict(mode=packmode.CHEAP_HOURS, role="hold"), "saves_later"),
+    (dict(mode=packmode.CHEAP_HOURS, role="house", plan="no_prices"),
+     "no_prices"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="house", plan="no_spread",
+          giving=True), "no_spread"),
+    # ...and the urgent reasons still come first.
+    (dict(role="charge", refused=-1), "refuses_charge"),
+    (dict(role="sell", peak=True), "peak"),
+    (dict(role="hold", off=True), "off"),
+    # OPT-11 P4: the day plan's word, while holding only.
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="hold", has_at=True,
+          day="sun_fills"), "sun_fills"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="hold", day="tops_up"),
+     "tops_up"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="hold", day="no_forecast"),
+     "no_forecast"),
+    (dict(mode=packmode.LEFTOVER_SOLAR, role="charge", day="tops_up"),
+     "grid_charge"),
+    # SAFETY-78: another battery drains for its monthly cycle.
+    (dict(other_cycle="A"), "other_cycle"),
+    (dict(other_cycle="A", modes_on=False, giving=True), "other_cycle"),
+    (dict(other_cycle="A", mode=packmode.CHEAP_HOURS, role="charge"),
+     "other_cycle"),
+    (dict(other_cycle="A", peak=True), "peak"),
+    (dict(other_cycle="A", refused=-1), "refuses_charge"),
+    (dict(other_cycle="A", off=True), "off"),
+    (dict(other_cycle="A", mode=packmode.LEFTOVER_SOLAR, role="hold",
+          day="tops_up"), "other_cycle"),
+]
+_wrong = [(kw, want, why(**kw)) for kw, want in _cases if why(**kw) != want]
+print(f"    {_wrong}")
+check(f"{len(_cases)} cases, each the expected reason", not _wrong)
+check("every reason it can return has words in both languages",
+      {w for _k, w in _cases} == set(EN["home_words"]["why"])
+      == set(NL["home_words"]["why"]))
+
+# ============================================================================ #
+print("\n5. /action round trips from the screen, over the real web app")
+
+
+async def _serve(state, calls):
+    c = D.controller(state)
+    stored = dict(D.defaults(D.CONFIG), **D.OPTS)
+    runner = aioweb.AppRunner(web.build_app(c, D.Supervisor(stored)))
+    await runner.setup()
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    await aioweb.TCPSite(runner, "127.0.0.1", port).start()
+    out = []
+    try:
+        async with aiohttp.ClientSession() as s:
+            root = f"http://127.0.0.1:{port}/"
+            for body, lang in calls:
+                if body is not None:
+                    async with s.post(root + "action", json=body) as r:
+                        out.append((r.status,
+                                    await r.json(content_type=None)))
+                async with s.get(root + "status?lang=" + lang) as r:
+                    out.append((r.status, await r.json(content_type=None)))
+    finally:
+        await runner.cleanup()
+    return out
+
+
+A, B = (i["name"] for i in D.OPTS["inverters"])
+# Exactly what app.js posts: {action, unit, value}.
+_r = asyncio.run(_serve("modes", [
+    ({"action": "pack_use", "unit": B, "value": False}, "en"),
+    ({"action": "pack_mode", "unit": A, "value": packmode.LEFTOVER_SOLAR},
+     "nl"),
+    ({"action": "pack_use", "unit": B, "value": True}, "en"),
+    ({"action": "pack_mode", "unit": A, "value": "cheap_hours"}, "en"),
+    ({"action": "pack_sell", "unit": A, "value": True}, "en"),
+    ({"action": "pack_sell", "unit": A, "value": "yes"}, "en"),
+    ({"action": "pack_mode", "unit": A, "value": "sell_only"}, "en"),
+]))
+(_s1, _j1), (_, _st1), (_s2, _j2), (_, _st2), (_s3, _), (_, _st3), \
+    (_s4, _j4), (_, _st4), (_s5, _j5), (_, _st5), (_s6, _j6), (_, _st6), \
+    (_s7, _j7), (_, _st7) = _r
+check("switch B off: 200, and /status shows B Off with 'You switched it off.'",
+      _s1 == 200 and _j1["result"]["use"] is False
+      and _st1["batteries"][1]["mode_key"] == "off"
+      and _st1["batteries"][1]["why"] == EN["home_words"]["why"]["off"])
+check("set A to Leftover solar: 200, and /status?lang=nl shows it in Dutch",
+      _s2 == 200 and _st2["batteries"][0]["mode_choice"]
+      == packmode.LEFTOVER_SOLAR
+      and _st2["batteries"][0]["mode"]
+      == NL["home_words"]["modes"]["leftover_solar"])
+check("switch B back on: its stored mode returns",
+      _s3 == 200 and _st3["batteries"][1]["mode_key"]
+      == packmode.LEFTOVER_SOLAR)
+check("OPT-11 P3: Cheap hours only is a mode now: 200, and /status shows it",
+      _s4 == 200 and _st4["batteries"][0]["mode_choice"]
+      == packmode.CHEAP_HOURS)
+check("owner decision 2026-09-29 (option A): selling is off, so a posted "
+      "pack_sell is refused with the plain reason 'Selling is off for now.', "
+      "and /status says no battery sells or can",
+      _s5 == 400 and _j5["error"] == messages.pack_refused("sell_off")
+      and _s6 == 400 and all(b["sell"] is False and b["can_sell"] is False
+                             for b in _st5["batteries"] + _st6["batteries"]))
+check("...a mode that does not exist is refused with a plain 400, and "
+      "nothing changes", _s7 == 400 and _j7["error"]
+      and _st7["batteries"][0]["mode_choice"] == packmode.CHEAP_HOURS)
+_r = asyncio.run(_serve("running", [
+    ({"action": "pack_use", "unit": B, "value": False}, "en")]))
+check("with battery modes off the switch is refused with the plain reason, "
+      "and the batteries stay on", _r[0][0] == 400 and _r[0][1]["error"]
+      and "mode_key" not in _r[1][1]["batteries"][1])
+
+# ============================================================================ #
+print("\n6. the page")
+PAGE = web.page()
+JS = io.open(os.path.join(HERE, "app", "static", "app.js"),
+             encoding="utf-8").read()
+SJS = io.open(os.path.join(HERE, "app", "static", "settings.js"),
+              encoding="utf-8").read()
+check("the Batteries screen has its cards, the modes-off card and 'How the "
+      "modes work'", all(f'id="{i}"' in PAGE for i in
+                         ("bcards", "batt-off", "batt-how", "batt-banner")))
+check("Settings has a Simple / Installer choice as a radio group, and Simple "
+      "comes first", re.search(r'id="set-view"[^>]*>\s*<button[^>]*'
+                               r'data-v="simple"', PAGE) is not None
+      and PAGE.count('role="radio"') >= 2 and 'id="simple"' in PAGE)
+_acts = set(re.findall(r'packAct\("(\w+)"', JS))
+check(f"the cards post only the existing actions ({sorted(_acts)}), as "
+      f"{{action, unit, value}}; selling has no control while it is off",
+      _acts == set(web.PACK_ACTIONS) - {"pack_sell"}
+      and packmode.SELLING_ENABLED is False
+      and "action: what, unit: b.name, value: value" in JS)
+check("the switch is a real switch and the list offers the three modes, "
+      "cheap hours included, with nothing greyed out",
+      'role: "switch"' in JS and '"aria-checked"' in JS
+      and 'const MODES = ["solar_first", "leftover_solar", "cheap_hours"];'
+      in JS and "batteries.later" not in JS)
+check("no selling switch anywhere on the page or in Settings, and no words "
+      "for one", "pack_sell" not in JS and "sell" not in SJS
+      and "batteries.sell" not in JS
+      and all("sell" not in W["home"]["batteries"] for W in LANGS.values()))
+_T = uipage.ui_text("en")
+_lay = uipage.layout(D.schema_ui(D.CONFIG), {"en": {}})
+_simple = [f for g in _lay["groups"] for p in g["parts"] for f in p["fields"]
+           if f.get("simple")]
+check("Settings, Simple draws the fields the layout marks, and each note "
+      "has words in both languages",
+      sorted(f["key"] for f in _simple)
+      == sorted(f.key for g in L.GROUPS for p in g.parts for f in p.fields
+                if f.simple)
+      and all(f["note"] in EN["settings"]["simple"]["note"]
+              and f["note"] in NL["settings"]["simple"]["note"]
+              for f in _simple if f["note"]))
+check("settings.js picks them by the `simple` flag and names no option key",
+      "f.simple" in SJS and not any(f'"{f.key}"' in SJS for g in L.GROUPS
+                                    for p in g.parts for f in p.fields))
+
+# ============================================================================ #
+print("\n7. no control path changes: the screen reads, it does not write")
+SRC = io.open(os.path.join(HERE, "app", "homeview.py"), encoding="utf-8").read()
+WRITES = {"set_number", "store_set", "set", "set_time", "handle_action",
+          "log_event", "abort", "tick", "publish", "call", "write",
+          "_pack_action", "_maint_stop_off"}
+_calls = sorted({n.func.attr for n in ast.walk(ast.parse(SRC))
+                 if isinstance(n, ast.Call)
+                 and isinstance(n.func, ast.Attribute)
+                 and n.func.attr in WRITES})
+check(f"homeview.py calls nothing that writes state or commands an inverter "
+      f"({_calls})", not _calls)
+_imports = sorted({(n.module or "") for n in ast.walk(ast.parse(SRC))
+                   if isinstance(n, ast.ImportFrom)})
+check(f"...and imports no module that sends power requests ({_imports})",
+      not {"main", "inverter", "hass", "control", "allocator",
+           "arbiter"} & {m.lstrip(".") for m in _imports})
+_c = D.controller("off_peak")
+_before = (json.dumps(_c.store.data, sort_keys=True, default=str),
+           [(i.last_write, i.target) for i in _c.inverters])
+for lang in LANGS:
+    build("off_peak", lang, c=_c)
+check("building the screen twice leaves the store and every power request "
+      "as it was", _before
+      == (json.dumps(_c.store.data, sort_keys=True, default=str),
+          [(i.last_write, i.target) for i in _c.inverters]))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_ci_gate.py b/goodwe_controller/test_ci_gate.py
index 03c9d1a..1d88981 100644
--- a/goodwe_controller/test_ci_gate.py
+++ b/goodwe_controller/test_ci_gate.py
@@ -62,10 +62,9 @@ the step it wants: if checks.yml is restructured so that the step cannot be
 found, this file goes RED rather than quietly grading nothing.
 
 ⚠️ NEEDS `git`, which is why .gitea/ci/Dockerfile installs it. No network: the
-fixtures are local repositories built in a temp directory, and the workflow's
-`git remote add origin "$(echo "$URL" | sed "s#://#://x-access-token:...@#")"`
-is a no-op substitution on a path with no `://` in it, which is what lets the
-shipped line be used verbatim.
+fixtures are local repositories built in a temp directory; the workflow's
+token header (TOOL-9) is ignored for a local path, which is what lets the
+shipped lines be used verbatim.
 
 ⚠️ This file writes only under a temporary directory. It must stay that way:
 CI mounts the checkout READ-ONLY.
diff --git a/goodwe_controller/test_clamp.py b/goodwe_controller/test_clamp.py
index 8659611..b3cc1b2 100644
--- a/goodwe_controller/test_clamp.py
+++ b/goodwe_controller/test_clamp.py
@@ -38,6 +38,9 @@ acceptance criteria; part 6 is TEST-11's and part 7 is SAFETY-28's:
      the check that replaced a config-shape proxy: `ACTUATOR_WRITE_KEYS` graded
      how many option KEYS exist, which stays 1 while a per-inverter config adds
      a second real writer.
+  9. SAFETY-40. The integrator bound (normal anti-windup) is reported in its
+     own words and never as a BUG SIGNAL; the over-rating keeps it; and every
+     number in either message is the clamp tick's own Decision.
 
 ------------------------------------------------------------------------------
 WHY PART 4 ALSO ASSERTS ON `Decision`'s BOOLEANS AND NOT ON `reason`
@@ -74,12 +77,17 @@ Read MUTATION.md before you report a survivor.
 import asyncio
 import io
 import math
+import os
 import re
 import sys
 from datetime import datetime, timedelta, timezone
 
+from named_absence import given, nth, present
+
+from app import messages
 from app.clamp import (
-    CLEAR_CYCLES, REASON_CODE, REASSERT_S, SUSTAINED_CYCLES, ClampWatchdog,
+    CLEAR_CYCLES, REASON_CODE, REASSERT_S, SUSTAINED_CYCLES, ClampResult,
+    ClampWatchdog,
     clamp_to_rating,
     is_commandable,
 )
@@ -97,6 +105,9 @@ T0 = datetime(2026, 8, 30, 9, 0, 0, tzinfo=timezone.utc)
 # which is also the device rating, so this is the bound the alarm is written at.
 LIVE_MAX_W = 5000.0
 CLAMP_ID = "goodwe_output_clamp"
+# SAFETY-40: the integrator-bound WARNING has its own id, so it can never
+# replace a BUG SIGNAL notice still on screen.
+BOUND_ID = "goodwe_integrator_bound"
 
 
 def check(name, cond):
@@ -322,15 +333,15 @@ _esc_fires = [5.0 * (CLEAR_CYCLES + 2 + _j)
                            T0 + timedelta(seconds=5.0 * (CLEAR_CYCLES + 2 + _j)))]
 _esc_delay = _esc_fires[0] - _RUNAWAY_AT if _esc_fires else None
 print(f"    budget spent by a benign episode, then a continuous runaway from "
-      f"t={_RUNAWAY_AT:.0f}s: first alarm at t={_esc_fires[0]:.0f}s "
-      f"(delay {_esc_delay:.0f}s)")
+      f"t={_RUNAWAY_AT:.0f}s: first alarm at t={nth(_esc_fires, 0):.0f}s "
+      f"(delay {given(_esc_delay):.0f}s)")
 check(f"⚠️ a SUSTAINED runaway speaks even when an earlier, unrelated episode "
-      f"spent the budget - it is not held for REASSERT_S ({_esc_delay:.0f}s "
+      f"spent the budget - it is not held for REASSERT_S ({given(_esc_delay):.0f}s "
       f"delay, escalation is {SUSTAINED_CYCLES} cycles)",
       _esc_delay is not None and _esc_delay < REASSERT_S / 2)
 check("...and it speaks at the escalation boundary rather than immediately, "
       "which is what keeps the scattered flood suppressed",
-      _esc_delay >= 5.0 * (SUSTAINED_CYCLES - 1))
+      _esc_delay is not None and _esc_delay >= 5.0 * (SUSTAINED_CYCLES - 1))
 
 # ⚠️ `last_alarm` SURVIVING THE DE-ASSERT IS NOW LOAD-BEARING, AND NOTHING
 # PINNED IT. Review built the mutation: if the de-assert path ALSO refreshed
@@ -456,7 +467,7 @@ def wired(grid, cycles=40, batt=0.0, track=True, **over):
 def clamp_notes(hass):
     return [d for dom, svc, d in hass.calls
             if (dom, svc) == ("persistent_notification", "create")
-            and d.get("notification_id") == CLAMP_ID]
+            and d.get("notification_id") in (CLAMP_ID, BOUND_ID)]
 
 
 # THE 10.3 RUNAWAY, replayed. "With the inverter switched off entirely, an
@@ -486,8 +497,13 @@ check(f"AC 1: NOT ONE of the {len(emitted)} values that reached the device "
 # largest emitted value is what it is and not 5000 W. The clamp is what makes it
 # bounded; the freeze is what makes it small. A check that read
 # `max(emitted) == max_w` would have been asserting the freeze, not the clamp.
+# SAFETY-52 re-baseline: an inverter reporting 0 W for SETTLE_CYCLES is a
+# battery that refuses, so the command then drops to 0 W. The freeze still
+# engaged first, and the event log says so.
 check(f"...and the saturation freeze is what pins it at {max(emitted):,.0f} W "
-      f"rather than the rail", ctl_r.sat_count >= ctl_r.tuning.saturation_cycles)
+      f"rather than the rail",
+      any("saturation freeze" in e for e in ctl_r.events)
+      and max(emitted) < LIVE_MAX_W)
 
 notes_r = clamp_notes(hass_r)
 print(f"    the loop clamped on {ctl_r.clamp_wd.engagements} of {60} cycles, "
@@ -495,18 +511,23 @@ print(f"    the loop clamped on {ctl_r.clamp_wd.engagements} of {60} cycles, "
       f"notification(s)")
 check("AC 3: and it ALARMED - silently clipping this is the defect",
       ctl_r.clamp_wd.engagements > 0 and len(notes_r) >= 1)
-check("...with its own notification_id, not shared with any other guard",
-      all(d["notification_id"] == CLAMP_ID for d in notes_r))
+check("...with its own notification_id, not shared with any other guard - "
+      "on a default install the integrator bound's (SAFETY-40)",
+      all(d["notification_id"] == BOUND_ID for d in notes_r))
 check("...one episode, re-asserted rather than one per cycle",
       ctl_r.clamp_wd.episodes == 1 and len(notes_r) < ctl_r.clamp_wd.engagements)
-check("...and it names itself a bug signal, not a limit in use",
-      bool(notes_r) and "out of range" in notes_r[0]["message"])
+# SAFETY-40: on a default install this runaway is the INTEGRATOR bound, so it
+# says so, and does not call anti-windup a bug (part 8 grades the wording).
+check("...and it is the integrator-bound notice, which calls nothing a fault",
+      bool(notes_r) and notes_r[0]["title"] == messages.T_LOOP_BOUND
+      and "fault" not in notes_r[0]["message"])
 rows_r = [e for e in ctl_r.events if REASON_CODE in e]
 check(f"the action log records every engagement, coalesced into one row per "
       f"episode ({len(rows_r)} row(s), {ctl_r.clamp_wd.engagements} "
       f"engagement(s))",
       len(rows_r) == ctl_r.clamp_wd.episodes
-      and f"{ctl_r.clamp_wd.engagements} engagement(s)" in rows_r[0])
+      and messages.count(ctl_r.clamp_wd.engagements, "engagement")
+      in rows_r[0])
 
 # ⚠️ REGRESSION, AND IT WAS A REAL BUG BEFORE IT WAS A CHECK. `log_event()` keeps
 # 40 rows. A row per engagement flushes that ring inside 40 cycles of a winding
@@ -523,20 +544,55 @@ check(f"a long winding episode does NOT flood the 40-row event log "
       f"({len(rows_l)} rows for {ctl_l.clamp_wd.engagements} engagements)",
       ctl_l.clamp_wd.engagements > 40 and len(rows_l) <= ctl_l.clamp_wd.episodes)
 check("...and the count in the row is the counter's, so nothing is lost",
-      f"{ctl_l.clamp_wd.engagements} engagement(s)" in rows_l[-1])
+      messages.count(ctl_l.clamp_wd.engagements, "engagement")
+      in nth(rows_l, -1))
 # The RED row exists only while engaged, and the episode above is short, so it
 # is captured mid-run rather than asserted after the hysteresis has cleared it.
-check("the status page goes red WHILE it is engaged",
-      any(not c["ok"] and not c["warn"] and "OUTPUT CLAMP ENGAGED" in c["text"]
+check("the status page flags it WHILE it is engaged - amber, since it is the "
+      "integrator bound (SAFETY-40; red is part 9's over-rating case)",
+      any(not c["ok"] and c["warn"] and c.get("id") == "not_keeping_up"
+          and c["text"].startswith(messages.T_LOOP_BOUND)
           for c in ctl_r.red_snapshot))
-check("...and once clear, a warn row still says how many times it engaged",
-      any(c["warn"] and f"{ctl_r.clamp_wd.engagements} time(s)" in c["text"]
-          for c in ctl_r.checks()))
+# SAFETY-85: the row counts episodes, not cycles.
+check("...and once clear, a warn row still says how many times it happened "
+      "(episodes, not cycles), under the integrator bound's own title",
+      any(c["warn"] and c.get("id") == "not_keeping_up"
+          and c["text"] == messages.row_before(
+              messages.T_LOOP_BOUND, ctl_r.clamp_wd.bound_episodes)
+          for c in ctl_r.checks())
+      and 0 < ctl_r.clamp_wd.bound_episodes < ctl_r.clamp_wd.bound)
+# UX-07 item 1: the after-episode row used to say "output clamp ... engaged N
+# time(s)" for integrator-bound cycles. Each count now sits under its own name.
+check("UX-07 item 1: bound-only engagements are counted as the bound, and no "
+      "row calls them 'Power request too high'",
+      ctl_r.clamp_wd.bound == ctl_r.clamp_wd.engagements > 0
+      and ctl_r.clamp_wd.over_rating == 0
+      and not any(c.get("id") == "power_too_high"
+                  or messages.T_OUTPUT_CLAMP in c["text"]
+                  for c in ctl_r.checks()))
+# ...and an earlier over-rating count stays on the page while a LATER bound
+# episode runs: it is the software-fault evidence, and that episode (bug False)
+# cannot have added to it, so "fine now" is true of it.
+_w = ctl_r.clamp_wd
+_saved = (_w.active, _w.bug, _w.over_rating)
+_w.active, _w.bug, _w.over_rating = True, False, 2
+_rows = ctl_r.checks()
+_w.active, _w.bug, _w.over_rating = _saved
+check("UX-07 item 1: during a bound episode an earlier over-rating count is "
+      "still shown, amber, under its own title",
+      any(c.get("id") == "not_keeping_up" for c in _rows)
+      and any(c.get("id") == "power_too_high" and c["warn"] and not c["ok"]
+              and c["text"] == messages.row_before(messages.T_OUTPUT_CLAMP, 2)
+              for c in _rows))
 
 # ⚠️ NOT A TRIP. 11.2's action is "clamp and alarm"; the loop keeps running and
 # keeps writing the clamped value. If a later cut changes that it must come here.
-check(f"it is NOT a trip - the command stands at {ctl_r.target:+.0f} W, not 0 W",
-      ctl_r.target != 0.0 and ctl_r.target == hass_r.writes[-1])
+# SAFETY-52: the loop itself now asks 0 W of an inverter that gives nothing,
+# with its own reason. That is the loop's decision, not a stop.
+check(f"it is NOT a trip - the command stands at {ctl_r.target:+.0f} W because "
+      f"the loop says '{ctl_r.loop_reason}', not because of a stop",
+      ctl_r.loop_reason == "battery refuses"
+      and ctl_r.target == hass_r.writes[-1])
 check("...and the controller still reports itself running, not failsafe",
       ctl_r.auto and not ctl_r.sign_wd.tripped)
 
@@ -578,7 +634,8 @@ check("AC 2: the clamp counted ZERO engagements", ctl_s.clamp_wd.engagements ==
 check("AC 2: no OUTPUT_CLAMP row in the action log",
       not [e for e in ctl_s.events if REASON_CODE in e])
 check("AC 2: and no clamp row on the status page",
-      not [c for c in ctl_s.checks() if "output clamp" in c["text"].lower()])
+      not [c for c in ctl_s.checks()
+           if c.get("id") in ("power_too_high", "not_keeping_up")])
 
 print("   ...and the two alarms do not share a notification_id")
 ids_clamp = {d["notification_id"] for d in clamp_notes(hass_r)}
@@ -804,11 +861,11 @@ class _SpyWatchdog(ClampWatchdog):
         self.seen = []          # clamp_last.requested_w at each consultation
         self.seen_write = []    # was the WRITE-path half engaged, per cycle
 
-    def note(self, engaged, reason, now):
+    def note(self, engaged, reason, now, **kw):
         cl = self.owner.clamp_last
         self.seen.append(None if cl is None else cl.requested_w)
         self.seen_write.append(bool(cl and cl.engaged))
-        return super().note(engaged, reason, now)
+        return super().note(engaged, reason, now, **kw)
 
 
 def probed(cls=Controller, grid=9000.0, cycles=5, **over):
@@ -984,14 +1041,17 @@ check("PRECONDITION: the write really did clamp, on the DEVICE bound",
       and hass_w.writes[-1] == 2500.0)
 check("...and the loop-side half is SILENT here, so self.clamp_last is the "
       "only evidence that this happened at all",
-      ctl_w.loop_clamped == (False, ""))
+      ctl_w.loop_clamped == (False, "", False))
 check("AC 3: the guard alarmed on write-path evidence alone",
       ctl_w.clamp_wd.engagements == 1 and len(notes_w) == 1)
 check("...and the operator is told WHICH bound bit, so a device-rating clamp "
       "is not reported as a max_w one",
-      bool(notes_w) and "device bound" in notes_w[0]["message"])
+      bool(notes_w)
+      and messages.LIMIT_WORDS["device"] in notes_w[0]["message"]
+      and messages.LIMIT_WORDS["max_w"] not in notes_w[0]["message"])
 check("...and the action log carries the row, written by write_setpoint()",
-      any(REASON_CODE in e and "device bound" in e for e in ctl_w.events))
+      any(REASON_CODE in e and messages.LIMIT_WORDS["device"] in e
+          for e in ctl_w.events))
 
 # The same stimulus, the same clamp, the two calls swapped. This is the ticket
 # in one pair of runs.
@@ -1079,21 +1139,27 @@ check("⚠️ THE ORDERED PAIR IN THE §15 ACTION-LOG ROW (main.py:1366). The "
       "the loop asked for +2000 W and the guard clamped it UP to +9999 W - "
       "past the 2000 W rating printed four words later - which is the alarm "
       "reading backwards on the one line an operator is woken by",
-      any(f"the computed setpoint {_asked_x:+.0f} W was clamped to "
-          f"{_sent_x:+.0f} W" in e for e in _rows_x))
-check("⚠️ ...AND IN THE ClampWatchdog NOTIFICATION REASON (main.py:2452), "
-      "which is a SECOND surface off the same sentence and has to be pinned "
-      "separately - SAFETY-38 round 3's whole lesson was that pinning one call "
-      "site leaves the other shipping",
-      bool(notes_x)
-      and f"the computed setpoint {_asked_x:+.0f} W was clamped to "
-          f"{_sent_x:+.0f} W" in notes_x[0]["message"])
+      any(f"asked {_asked_x:+.0f} W and sent {_sent_x:+.0f} W" in e
+          for e in _rows_x))
+# UX-08: the notification is a SECOND surface off the same numbers, in its own
+# words (messages.output_clamp): asked first, sent second.
+def _asked_then_sent(msg, asked, sent):
+    return (f"asked for {messages.watts(asked)}," in msg
+            and f"and sent {messages.watts(sent)} instead" in msg
+            and msg.index(messages.watts(asked)) < msg.index("and sent"))
+
+
+check("⚠️ ...AND IN THE ClampWatchdog NOTIFICATION, which is a SECOND surface "
+      "off the same numbers and has to be pinned separately - SAFETY-38 round "
+      "3's whole lesson was that pinning one call site leaves the other "
+      "shipping",
+      bool(notes_x) and _asked_then_sent(notes_x[0]["message"], _asked_x, _sent_x))
 check("...and the TRANSPOSED sentence appears on NEITHER surface, so the two "
       "checks above discriminate rather than decorate",
-      not any(f"the computed setpoint {_sent_x:+.0f} W was clamped to "
-              f"{_asked_x:+.0f} W" in e for e in _rows_x)
-      and f"the computed setpoint {_sent_x:+.0f} W was clamped to "
-          f"{_asked_x:+.0f} W" not in notes_x[0]["message"])
+      not any(f"asked {_sent_x:+.0f} W and sent {_asked_x:+.0f} W" in e
+              for e in _rows_x)
+      and not _asked_then_sent(nth(notes_x, 0)["message"], _sent_x, _asked_x)
+      and present(nth(notes_x, 0)))
 # The DEVICE bound, off part 6c's controller: same sentence, other stage. The
 # unit of coverage is the call site, and `bound` is the only thing that differs
 # between the two rows an operator can receive.
@@ -1102,10 +1168,9 @@ check("...and the same ordered pair holds on the DEVICE-bound row, where the "
       "loop asked for +3000 W and the device took +2500 W. PRECONDITION: those "
       "two also render differently",
       f"{_asked_w:+.0f}" != f"{_sent_w:+.0f}"
-      and any(f"the computed setpoint {_asked_w:+.0f} W was clamped to "
-              f"{_sent_w:+.0f} W" in e for e in ctl_w.events)
-      and f"the computed setpoint {_asked_w:+.0f} W was clamped to "
-          f"{_sent_w:+.0f} W" in notes_w[0]["message"])
+      and any(f"asked {_asked_w:+.0f} W and sent {_sent_w:+.0f} W" in e
+              for e in ctl_w.events)
+      and _asked_then_sent(nth(notes_w, 0)["message"], _asked_w, _sent_w))
 
 
 # ==============================================================================
@@ -1702,6 +1767,35 @@ check("SAFETY-28's gate still OBSERVES too - it refused nothing on this run, "
       "implemented by making every write unauthorised",
       not [e for e in _cl_c.events if "WRITE REFUSED" in e])
 
+# UX-09: what the over-rating alarm and its row SAY in each mode. The loop
+# bounds the command before the write clamp here, so an over-rating is injected
+# as the write path records one, and check_output_clamp() is run on it. Nothing
+# reaches the wire in shadow mode, so neither text may claim a command was sent.
+def _said(mode):
+    h, c = _s10(mode, cycles=2)
+    c.inverters[0].clamp_last = ClampResult(7412.0, 5000.0, 5000.0, True,
+                                            "max_w")
+    asyncio.run(c.check_output_clamp())
+    notes = [d["message"] for d in clamp_notes(h)
+             if d["notification_id"] == CLAMP_ID]
+    rows = [r["text"] for r in c.checks() if r.get("id") == "power_too_high"]
+    return notes, rows
+
+
+_ux_live, _ux_shad = _said("off"), _said("on")
+print(f"    over-rating, live: {_ux_live}\n    over-rating, shadow: {_ux_shad}")
+check("UX-09: live, the over-rating alarm and row say what was SENT",
+      _ux_live[0] and all(" and sent 5 000 W" in m for m in _ux_live[0])
+      and _ux_live[1] and all("sent 5 000 W" in t and "would" not in t
+                              for t in _ux_live[1]))
+check("...in shadow mode they say what WOULD have been sent and that the "
+      "inverter stays at 0 W, never that it was sent",
+      _ux_shad[0] and all("would have sent 5 000 W" in m
+                          and " and sent " not in m and "stays at 0 W" in m
+                          for m in _ux_shad[0])
+      and _ux_shad[1] and all("would send 5 000 W" in t and " sent " not in t
+                              for t in _ux_shad[1]))
+
 # ⚠️ AND SAFETY-18 IS GRADED ON WHAT IT WAS HANDED, WHICH IS AN ORDERING
 # CLAIM. `check_meter_frozen()` takes `self.target` - the arbiter's RESOLVED
 # INTENT - and `_shadow_settle()` re-seeds that to 0 W at the very end of the
@@ -1786,17 +1880,17 @@ check("the status page has a Shadow mode row in BOTH states, so its ABSENCE is "
       _ROW in _shad_rows and _ROW in _live_rows)
 check("AC 3: the banner states plainly that the battery is not being "
       "controlled",
-      "SHADOW MODE" in _shad_pay["banner"]
-      and "NOT being controlled" in _shad_pay["banner"])
+      "Shadow mode" in _shad_pay["banner"]
+      and "not controlled" in _shad_pay["banner"])
 check("...and it is not green. A page that reads `ok` while nothing is being "
       "commanded is the 'looks healthy but is inert' failure itself",
       _shad_pay["level"] == "warn")
 check("...and it is FIRST in the cascade: the same controller has other "
       "conditions to report and none of them displaces this sentence",
       _live_pay["banner"] != _shad_pay["banner"]
-      and "SHADOW MODE" not in _live_pay["banner"])
-_slot = re.search(r"WOULD HAVE COMMANDED ([-+][\d ]+) W, inverter held at "
-                  r"([-\d]+) W", _shad_rows[_ROW])
+      and "Shadow mode" not in _live_pay["banner"])
+_slot = re.search(r"This cycle it would ask for ([-+][\d ]+) W, the inverters "
+                  r"stay at ([-\d]+) W", _shad_rows[_ROW])
 check("the row answers 'what would it have done' with a NUMBER in its own "
       "named slot, and says where the inverter actually is in a second one - "
       "two slots in one sentence, so a transposition moves them",
@@ -1810,32 +1904,37 @@ if _slot is not None:
     check("...and the second slot is the STANDING command, so the two cannot "
           "be read as one number",
           float(_slot.group(2)) == 0.0)
-check("the row answers 'and why' by carrying the arbiter's own sentence, "
-      "rather than a re-derivation of it",
-      _shad_c.reason in _shad_rows[_ROW])
+check("the row answers 'and why' by carrying the page's own Why line, the "
+      "arbiter's answer in plain words (UX-08), rather than a re-derivation",
+      _shad_c.why_words in _shad_rows[_ROW]
+      and dict(_shad_pay["rows"])["Why"] == _shad_c.why_words)
 check("with shadow mode off the row says so, and says what follows from it - "
       "which is the arrangement that makes the one above a claim about this "
       "controller and not about the string",
-      "NOT in shadow mode" in _live_rows[_ROW]
-      and "DOES reach the inverter" in _live_rows[_ROW]
-      and "WOULD HAVE COMMANDED" not in _live_rows[_ROW])
+      _live_rows[_ROW].startswith("Off")
+      and "reaches the inverters" in _live_rows[_ROW]
+      and "would ask for" not in _live_rows[_ROW])
 
-# ⚠️ A STANDING LATCH IS NAMED RATHER THAN HIDDEN. The shadow banner sits above
-# the three `bad` branches, so it has to carry what they would have said - a
+# ⚠️ A STANDING LATCH IS SHOWN RATHER THAN HIDDEN. The shadow banner sits above
+# the three `bad` branches, so it has to say what they would have said - a
 # latch that is up while the controller is inert is up the moment it stops
-# being inert.
+# being inert. UX-09: the banner (12 words) says a safety stop outlasts shadow
+# mode, and the latch's own red row, still on the list, names it.
 _shad_c.inverters[0].sign_wd.tripped = True
 _latched = _shad_c.status_payload()
 print(f"    banner with a latch up: {_latched['banner']!r}")
-check("a failsafe latch that is standing is NAMED in the shadow banner and "
-      "turns it red, so nobody turns shadow mode off into a battery that will "
-      "not move and a page that never mentioned why",
+check("a failsafe latch that is standing turns the shadow banner red and the "
+      "banner says a safety stop stays on, so nobody turns shadow mode off "
+      "into a battery that will not move and a page that never mentioned why",
       _latched["level"] == "bad"
-      and "LATCH IS STILL UP" in _latched["banner"]
-      and _shad_c.inverters[0].name in _latched["banner"])
+      and "safety stop stays on" in _latched["banner"])
+check("...and the latch is NAMED on its own red row, which says how it clears",
+      any(not r["ok"] and not r["warn"] and r.get("id") == "direction"
+          and "A restart does not clear this" in r["text"]
+          for r in _shad_c.checks()))
 check("...and it still says the battery is not being controlled, so the latch "
       "has not displaced the sentence that may never be displaced",
-      "NOT being controlled" in _latched["banner"])
+      "not controlled" in _latched["banner"])
 _shad_c.inverters[0].sign_wd.tripped = False
 
 # --- 8i. THE RECORD A LATER ANALYSIS READS ----------------------------------
@@ -1855,6 +1954,201 @@ check("...EDGE-logged, not level-logged: 25 cycles did not flush the 40-row "
       len(_shadow_lines) < 25 and len(_shad_c.events) <= 40)
 
 
+# ==============================================================================
+print()
+print("9. SAFETY-40: the integrator bound is not a BUG SIGNAL, and the numbers "
+      "are the clamp tick's own")
+# Three defects, each graded on the wired Controller.cycle() with compute()
+# spied, so every number is compared with the Decision of the SAME tick:
+#   1. `i_clamped` (normal anti-windup) used the over-rating BUG SIGNAL text;
+#   2. "the loop asked for" printed `Decision.i_w`, the integrator, as a request;
+#   3. "was clamped to" printed `self.target`, read after slew/freeze rewrote it.
+# The fixtures are chosen so the numbers the old text used DIFFER from the true
+# ones (MUTATION.md habit 4); the PRECONDITION checks pin that.
+import logging
+import app.main as _main_mod
+
+_real_compute = _main_mod.compute
+
+
+class _LogCap(logging.Handler):
+    def __init__(self):
+        super().__init__()
+        self.records = []
+
+    def emit(self, record):
+        self.records.append(record)
+
+
+def s40_run(grid, cycles, track, **over):
+    """Per tick: (Decision, self.target, clamp_wd.reason, engaged) + hass + log."""
+    ticks, decisions = [], []
+
+    def spy(*a, **k):
+        d = _real_compute(*a, **k)
+        decisions.append(d)
+        return d
+
+    cap = _LogCap()
+    lg = logging.getLogger("goodwe")
+    lg.addHandler(cap)
+    _main_mod.compute = spy
+
+    async def go():
+        hass = _Hass(grid, track=track)
+        c = Controller(dict(
+            {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+             "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+             "meter_source": "off", "max_w": LIVE_MAX_W, "gain": 0.6,
+             "slew_w": 1000, "deadband_w": 15, "target_grid_w": 0,
+             "step_w": 10, "heartbeat_s": 10, "stale_input_s": 15},
+            **over), hass, _Store(), _Pub(), stop=asyncio.Event())
+        c.auto = True
+        c.dev_min, c.dev_max = -LIVE_MAX_W, LIVE_MAX_W
+        red = []
+        for _ in range(cycles):
+            n = len(decisions)
+            before = c.clamp_wd.engagements
+            await c.read_inputs()
+            await c.cycle()
+            d = decisions[-1] if len(decisions) > n else None
+            ticks.append((d, c.target, c.clamp_wd.reason,
+                          c.clamp_wd.engagements > before))
+            if c.clamp_wd.active and not red:
+                red = c.checks()
+        return hass, c, red
+
+    try:
+        hass, c, red = asyncio.run(go())
+    finally:
+        _main_mod.compute = _real_compute
+        lg.removeHandler(cap)
+    return ticks, hass, c, red, cap.records
+
+
+def _f(d, name):
+    """A Decision field, NaN when absent - so an old tree goes red, not crashes."""
+    return getattr(d, name, float("nan"))
+
+
+# --- 9a. default install: only the INTEGRATOR bound can engage ---------------
+ticks_i, hass_i, ctl_i, red_i, log_i = s40_run(6000.0, 20, track=False)
+wind = [(d, t, r) for d, t, r, e in ticks_i
+        if e and d is not None and d.i_clamped and not d.clamped]
+for d, t, r in wind:
+    print(f"    tick: bound {_f(d, 'i_bound_w'):+.0f}  i_w {d.i_w:+.0f}  command "
+          f"{d.target_w:+.0f}  self.target {t:+.0f}\n      -> {r}")
+check("PRECONDITION: the integrator bound engaged, and on a tick where the "
+      "carried integrator AND the emitted command both differ from the bound",
+      any(d.i_w != _f(d, 'i_bound_w') and d.target_w != _f(d, 'i_bound_w')
+          for d, t, r in wind))
+check("defect 1: the integrator bound is NOT reported as an over-rating",
+      wind and all(" rating" not in r and "fault" not in r
+                   for d, t, r in wind))
+check("defect 1: ...it names the integrator's bound, from the same tick",
+      wind and all(f"reached its {_f(d, 'i_bound_w'):+.0f} W limit" in r
+                   for d, t, r in wind))
+check("defect 2: the integrator accumulator is not printed as a request",
+      wind and all(f"{d.i_w:+.0f} W" not in r and "asked for" not in r
+                   for d, t, r in wind))
+check("the command quoted is that tick's Decision, not a later read",
+      wind and all(f"command now {d.target_w:+.0f} W" in r
+                   for d, t, r in wind))
+check("at the bound nothing is described as 'above' or 'over' the rating",
+      wind and all(" above " not in r and " over " not in r
+                   for d, t, r in wind))
+notes_i = clamp_notes(hass_i)
+check("it still NOTIFIES (not suppressed), under a title that claims no bug",
+      notes_i and all(n["title"] == messages.T_LOOP_BOUND
+                      and "fault" not in n["message"] for n in notes_i))
+check("...under its OWN notification_id, so it cannot replace a BUG SIGNAL "
+      "notice still on screen",
+      notes_i and all(n["notification_id"] == BOUND_ID for n in notes_i))
+# UX-11: the WARNING quotes the code. The reason is on the DEBUG line beside
+# it (test_messages.py part 6).
+check("...logged as a WARNING, not an ERROR",
+      any(x.levelno == logging.WARNING
+          and x.getMessage().startswith("The battery gives less than asked: "
+                                        "OUTPUT_CLAMP.") for x in log_i)
+      and not any(x.levelno >= logging.ERROR and "OUTPUT_CLAMP" in x.getMessage()
+                  for x in log_i))
+check("...and the status row is amber, not red",
+      any(c["warn"] and c.get("id") == "not_keeping_up" for c in red_i)
+      and not any(not c["warn"] and c.get("id") == "power_too_high"
+                  for c in red_i))
+
+# --- 9b. the genuine over-rating: integrator_max_w above max_w ----------------
+ticks_o, hass_o, ctl_o, red_o, log_o = s40_run(9000.0, 12, track=True,
+                                               integrator_max_w=9000)
+over = [(d, t, r) for d, t, r, e in ticks_o
+        if e and d is not None and d.clamped]
+for d, t, r in over[:2]:
+    print(f"    tick: requested {_f(d, 'requested_w'):+.0f}  clamped {_f(d, 'clamped_w'):+.0f}"
+          f"  i_w {d.i_w:+.0f}  self.target {t:+.0f}\n      -> {r}")
+check("PRECONDITION: the output clamp engaged on a tick where the slew limit "
+      "rewrote the command AND the integrator differs from the request",
+      any(t != _f(d, 'clamped_w') and d.i_w != _f(d, 'requested_w') for d, t, r in over))
+check("the over-rating says it was cut to the rating",
+      over and all(" W rating, command now " in r for d, t, r in over))
+check("defect 2: it quotes the requested COMMAND of that tick, not i_w",
+      over and all(f"computed {_f(d, 'requested_w'):+.0f} W" in r for d, t, r in over))
+check("defect 3: 'cut to' is the clamp's own result, not self.target",
+      over and all(f"cut to the {_f(d, 'clamped_w'):+.0f} W rating" in r
+                   for d, t, r in over))
+check("...and its ERROR says it is a software fault and that control keeps "
+      "running (UX-08 2d moved the 14 768 W rationale to a DEBUG line beside "
+      "it, which is still in main.py)",
+      any(x.levelno == logging.ERROR and "software fault" in x.getMessage()
+          and "control runs on" in x.getMessage() for x in log_o)
+      and "reached 14 768 W on this project" in
+      open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "app",
+                        "main.py"), encoding="utf-8").read())
+check("...under the over-rating title, quoting a tick's own asked and sent "
+      "numbers in that order, with a red status row",
+      clamp_notes(hass_o)
+      and all(n["title"] == messages.T_OUTPUT_CLAMP
+              and n["notification_id"] == CLAMP_ID
+              and any(_asked_then_sent(n["message"], _f(d, 'requested_w'),
+                                       _f(d, 'clamped_w')) for d, t, r in over)
+              for n in clamp_notes(hass_o))
+      and any(not c["warn"] and c.get("id") == "power_too_high"
+              and c["text"].startswith(messages.T_OUTPUT_CLAMP)
+              for c in red_o))
+# The red row quotes the same tick's numbers as the card, asked before sent.
+_row_o = [c["text"] for c in red_o if c.get("id") == "power_too_high"]
+check("...and the red row quotes asked before sent, from one of those ticks",
+      _row_o and any(
+          f"asked {messages.watts(_f(d, 'requested_w'))}" in _row_o[0]
+          and f"sent {messages.watts(_f(d, 'clamped_w'))}" in _row_o[0]
+          and _row_o[0].index("asked") < _row_o[0].index("sent")
+          for d, t, r in over))
+
+# --- 9c. the text, directly, and the two budgets -------------------------------
+from app.clamp import loop_clamp_note  # noqa: E402
+
+d_at = compute(prev_w=1000.0, grid_w=9000.0, actual_w=1000.0,
+               tuning=Tuning(max_w=5000.0, slew_w=1000.0, gain=0.6), i_w=4500.0)
+check(f"exactly at the rating ({d_at.i_bound_w:+.0f} W) is 'reached', never "
+      f"'above' - {loop_clamp_note(d_at)!r}",
+      d_at.i_clamped and not d_at.clamped and abs(d_at.i_bound_w) == 5000.0
+      and "above" not in loop_clamp_note(d_at))
+check("a healthy decision produces no text",
+      loop_clamp_note(compute(0.0, 100.0, 0.0, Tuning(max_w=5000.0))) == "")
+
+# Anti-windup notices must never spend the budget a BUG SIGNAL needs.
+wd = ClampWatchdog()
+fired_w = wd.note(True, "wind", T0, bug=False)
+fired_b = wd.note(True, "bug", T0 + timedelta(seconds=5), bug=True)
+wd.note(True, "wind again", T0 + timedelta(seconds=10), bug=False)
+check("an anti-windup notice does not delay a bug in the same episode, and "
+      "does not overwrite its text",
+      fired_w and fired_b and wd.bug and wd.reason == "bug")
+wd2 = ClampWatchdog()
+seq = [wd2.note(True, "b", T0 + timedelta(seconds=5 * i)) for i in range(40)]
+check("bug-only cadence is unchanged: rising edge, then every REASSERT_S",
+      seq[0] and sum(seq) == 1 + int(5 * 39 // REASSERT_S))
+
+
 print()
 if fails:
     print(f"{len(fails)} FAILED: {', '.join(fails)}")
diff --git a/goodwe_controller/test_control.py b/goodwe_controller/test_control.py
index 08c79ac..9db66c2 100644
--- a/goodwe_controller/test_control.py
+++ b/goodwe_controller/test_control.py
@@ -17,6 +17,7 @@ Read MUTATION.md before you report a survivor.
 
 import sys
 
+from named_absence import nth
 from app.control import (LOOP_TICK_S, PLANT_SETTLE_DOWN_S, PLANT_SETTLE_S,
                          SETTLE_CYCLES, SLEW_RAIL_FRAC, Tuning, compute,
                          slew_limit_w, unasked_power,
@@ -59,68 +60,34 @@ def check(name, cond):
 # stopped testing anything is precisely the failure this ticket exists to fix.
 # A comment cannot go stale-green, because it never claims to be running.
 #
-# Measured at 389d9ec. Numbers are the lead's independent reproduction.
-# ⚠️ THE SAFETY-13 ROWS WERE RE-MEASURED IN ROUND 2 AND THREE OF THEM WERE
-# WRONG AS FIRST WRITTEN. Every figure below marked (S13) was taken by deleting
-# the mechanism, purging __pycache__, running this file in the CI image and
-# counting `FAIL` lines, on THIS tree; the release/1.0 comparison figures were
-# taken the same way on a pristine c8dcb38 worktree.
+# Measured at TEST-26 on a purged tree in the CI image, each run graded to the
+# end of the file (98/99 where the `if _bad:` check is skipped). Before TEST-26
+# the rows marked * killed the file with an IndexError or ZeroDivisionError in
+# a check, so their earlier figures were short; those checks now fail by name.
 #
-#   - `output freeze` was written as 11. The mutation form its own note
-#     describes - the whole `target = min(...)/max(...)` line removed, `reason`
-#     left alone - gives 6 on this tree AND 6 on the first SAFETY-13 commit,
-#     against 2 on release/1.0. 11 is not reproducible by that form, or by
-#     removing the line and its `reason` (4), or by swapping min/max (12). The
-#     row is 6.
-#   - `saturation detector, saturated_now = False` was left at 11 while the
-#     SAFETY-13 section added checks that grade it. It is 15.
-#   - the footnote's `frozen = False` figure was left at 10 for the same
-#     reason. It is 13.
-#
-# The rows below `output freeze` are this ticket's own mechanisms: removing the
-# EXIT restores release/1.0's unbounded freeze; making `unasked_power()` return
-# True gives an exit to the limit case as well, which is the half of the
-# decision that has to stay unbounded; deriving SETTLE_CYCLES from
-# PLANT_SETTLE_S (18 s, the UP ramp) instead of PLANT_SETTLE_DOWN_S (23 s) is
-# the round-1 defect itself; and pinning `_SAT_COUNT_CAP` back at release/1.0's
-# literal 10 caps the counter below the bound and deletes the exit silently.
-#
-# ⚠️ ONLY THE ROWS THIS BRANCH MOVES WERE RE-MEASURED. Everything not marked
-# (S13) still carries 389d9ec's figures and was not re-run here.
-#
-# ⚠️ THE SLEW ROWS WERE RE-MEASURED AT SAFETY-39 AND ONE OF THEM MOVED: the
-# slew limit was 4 and is now 5, because the SAFETY-39 section grades it too.
-# The new row is the RAIL DEFAULT specifically - `slew_limit_w()` reduced to
-# `return abs(float(tuning.slew_w))`, which leaves the limit intact and only
-# removes the 0-means-the-rail resolution. Three checks notice, which is over
-# the invariant's floor of two. Both figures were reproduced by deleting the
-# mechanism, running this file and counting, on a tree with __pycache__ purged.
-#
-#   mechanism in compute()                     checks that fail when deleted
-#   ------------------------------------------ -----------------------------
-#   integrator freeze (AC 3)                                               2
-#   integrator clamp (AC 1)                                                6
-#   integrator bound follows max_w                                         4
-#   output clamp                                                           3
-#   slew limit                                                             5
-#   slew follows the rail (SAFETY-39), `slew_w` read raw                   3
-#   output freeze                                        (S13)             6
-#   the output freeze's EXIT (S13), freeze made unconditional again        4
-#   `unasked_power()` discriminates, replaced by `return True`  (S13)      6
-#   SETTLE_CYCLES from PLANT_SETTLE_S, not _DOWN_S        (S13)            9
-#   `_SAT_COUNT_CAP` pinned back at release/1.0's 10      (S13)            6
-#   deadband                                                               5
-#   quantisation                                                           2
-#   saturation detector, `saturated_now = False`         (S13)            15
-#   saturation duration (AC 2), fires instantly                            2
-#   sat counter reset on a good cycle                                      6
-#   target_grid_w bias                                                     3
-#   i_w=None seeding from prev_w                                           6
-#
-# The detector figure is for the `saturated_now = False` form specifically;
-# disabling it further down as `frozen = False` is a weaker mutation and gives
-# 13 on this tree (10 on release/1.0). Reproduce the same form or the number
-# will not match.
+#   mechanism in compute(), and the exact form deleted        checks that fail
+#   --------------------------------------------------------- ----------------
+#   integrator freeze: `if not frozen or i_w == 0.0` -> `if True`            6
+#   integrator clamp: `bounded = i_w`                                       6
+#   integrator bound follows max_w: default `limit = 5000.0`                3
+#   output clamp: `target = want`                                           3
+#   slew limit: `slewed = target`                                          17
+#   slew follows the rail (SAFETY-39): `slew_limit_w()` returns
+#     `abs(float(tuning.slew_w))` *                                          9
+#   output freeze: the `target = min(...)/max(...)` line removed            7
+#   output freeze: `if frozen:` -> `if False:` *                            14
+#   the output freeze's EXIT (S13): its `if` -> `if False` *                11
+#   `unasked_power()` returns True (S13)                                    6
+#   SETTLE_CYCLES from PLANT_SETTLE_S, not _DOWN_S (S13)                    9
+#   `_SAT_COUNT_CAP = 10`, release/1.0's literal (S13) *                   11
+#   deadband: its `if` -> `if False`                                        7
+#   quantisation: `target = target`                                         4
+#   saturation detector: `saturated_now = False` *                         27
+#   saturation detector: `frozen = False` *                                25
+#   saturation duration fires instantly: `sat_count >= 1`                   5
+#   sat counter not reset on a good cycle: `else sat_count`                 5
+#   target_grid_w bias: `error = grid_w`                                    5
+#   i_w=None seeding from prev_w: `i_w = 0.0`                              11
 #
 # ⚠️ IT HAS FOUND A DEAD MECHANISM TWICE, BOTH THE SAME WAY: a clamp standing in
 # for the mechanism under test. Deleting the integrator freeze once failed
@@ -142,10 +109,9 @@ def check(name, cond):
 # mutation run always has one, because the previous run wrote it. -B is still
 # worth passing, for the NEXT edit rather than this one.
 #
-# The error is one-directional - stale bytecode can only under-report - so
-# every figure above is a lower bound at worst, and the two zeros ever recorded
-# were both confirmed by fixing them and watching the count rise, which a
-# caching artefact cannot do.
+# Two things under-report a figure here, both in the same direction: stale
+# bytecode, and a check that raises and stops the file before the rest are
+# graded (MUTATION.md, FCST-06). The second is what the * rows above had.
 # ---------------------------------------------------------------------------
 
 print("control law")
@@ -520,7 +486,7 @@ for _ in range(20):
     rows.append((prev, d.target_w, d.i_w, d.reason))
     prev, i_w, sat = d.target_w, d.i_w, d.sat_count
 pinned = [r for r in rows if r[3] == "saturated-freeze"]
-check(f"non-zero prev_w, another writer: pinned at {pinned[0][1]:.0f} W...",
+check(f"non-zero prev_w, another writer: pinned at {nth(pinned, 0)[1]:.0f} W...",
       pinned and all(r[1] == -800.0 for r in pinned))
 # ⚠️ SAFETY-48 MOVED THIS NUMBER FROM -2390 W TO -1200 W, DELIBERATELY, AND
 # THE PROPERTY IT IS HERE FOR IS UNCHANGED. The release lets the command walk
@@ -550,9 +516,9 @@ for c in range(24):
     cmds.append(d.target_w)
     prev, i_w, sat = d.target_w, d.i_w, d.sat_count
 check("the card's case: the block does hold at first, at 0 W",
-      cmds[6] == 0.0 and cmds[7] == 0.0)
+      nth(cmds, 6) == 0.0 and nth(cmds, 7) == 0.0)
 started = [i for i, c in enumerate(cmds) if c != 0.0]
-check(f"the card's case: the charge starts at cycle {started[0]}"
+check(f"the card's case: the charge starts at cycle {nth(started, 0)}"
       f" instead of never", bool(started))
 # ⚠️ AND IT STOPS AT THE FROZEN INTEGRATOR, NOT AT THE RAIL. This is AC 4: the
 # integrator moved while the output was blocked, and the release must not turn
@@ -991,7 +957,8 @@ check("the shipped Tuning default is 0, i.e. the rail, so the law carries no "
 # serial, per goodwe/NOTES.md §1.1b. It is here because the ARITHMETIC is what
 # is being graded, and the arithmetic does not care.
 _rails = [100.0, 500.0, 1500.0, 2000.0, 5000.0, 9600.0, 10000.0]
-_ticks = {r: r / slew_limit_w(Tuning(max_w=r)) for r in _rails}
+# A zero limit grades as nan ticks (a named FAIL), not a ZeroDivisionError.
+_ticks = {r: r / (slew_limit_w(Tuning(max_w=r)) or float("nan")) for r in _rails}
 print("    ticks to cross the rail at the default, by rail: "
       + ", ".join(f"{r:.0f}W={t:.1f}" for r, t in _ticks.items()))
 check("⭐ AT EVERY RAIL THE DEFAULT TAKES THE SAME NUMBER OF TICKS TO CROSS IT - "
@@ -1010,7 +977,7 @@ check("...and that is the same as saying the crossing takes the plant's own "
 # refuses on, and it is asserted HERE too so that the law and the gate cannot
 # drift apart - the rule can only ever refuse what this ratio says is too fast.
 _broken = Tuning(max_w=5000.0, slew_w=1000.0)
-_broken_s = 5000.0 / slew_limit_w(_broken) * LOOP_TICK_S
+_broken_s = 5000.0 / (slew_limit_w(_broken) or float("nan")) * LOOP_TICK_S
 print(f"    the 2026-09-05 configuration (max_w 5000, slew_w 1000) crosses its "
       f"rail in {_broken_s:.0f} s against a plant measured at {PLANT_SETTLE_S:.0f} s")
 check("⭐ RESTORING slew_w 1000 AT max_w 5000 IS FASTER THAN THE PLANT, and by "
@@ -1023,13 +990,11 @@ check("⭐ RESTORING slew_w 1000 AT max_w 5000 IS FASTER THAN THE PLANT, and by
 #
 # ⚠️ THE PLANT BELOW IS MODELLED HERE AND IS NOT THE RIG. admin/goodwe's
 # `plantsim.Plant` is the battery model this project grades control changes
-# against, and this repository's CI cannot reach it - that repository is private
-# and this job's token is minted for this one (see .gitea/workflows/checks.yml).
-# So the rig evidence lives in `tools/slew_sim.py`, is quoted in the pull
-# request and in DECISIONS/SAFETY-39-slew-against-the-rail.md, and what runs
-# HERE is a first-order lag with the time constant that reproduces §5.10's
-# measured ~18 s to the deadband. test_alloc.py makes the same split for the
-# same reason and says so in the same words.
+# against. CI checks admin/goodwe out at `.gitea/infra-pin` (CI-12), but this
+# file does not import `plantsim`. The rig evidence lives in `tools/slew_sim.py`,
+# is quoted in the pull request and in DECISIONS/SAFETY-39-slew-against-the-rail.md,
+# and what runs HERE is a first-order lag with the time constant that reproduces
+# §5.10's measured ~18 s to the deadband. test_alloc.py makes the same split.
 #
 # ⚠️ AND IT CANNOT SHOW A BATTERY ABOVE ITS RATING, WHICH IS SAID BEFORE THE
 # RESULT RATHER THAN AFTER IT. Neither this model nor `plantsim.Plant` lets the
@@ -1191,6 +1156,142 @@ check("...while the GAIN does own it: 0.6 -> 0.3 -> 0.2 falls monotonically, at
       _R["gain03"]["over"] < _R["rail"]["over"]
       and _R["gain02"]["over"] < _R["gain03"]["over"])
 
+print()
+print("OPT-11: the loop is told what the battery modes allow")
+# compute(bound=(lo, hi)) is the site output bound: the sum over live units of
+# (hard limits with the mode applied), allocator.loop_bound(). Without it the
+# loop asks for watts no battery may give, the allocator reports them unmet,
+# and the saturation freeze parks the target on them (SAFETY-73 section 1).
+import random as _random                     # noqa: E402
+from app.control import MODE_BOUND           # noqa: E402
+from named_absence import present            # noqa: E402
+
+TB = Tuning(gain=0.6, max_w=5000.0, slew_w=400.0, deadband_w=15.0,
+            step_w=10, target_grid_w=-10.0)
+
+
+def closed_loop(cycles, load, *, bound=None, deliver=None, change=None):
+    """A plant that follows 94 % of the command each cycle, capped at
+    `deliver` (what the allocator can place). `change(i)` may return a new
+    bound. Rows: (command, actual, sat_count, frozen, reason, i_w)."""
+    prev, actual, sat, i_w, rows = 0.0, 0.0, 0, None, []
+    for i in range(cycles):
+        if change is not None:
+            bound = change(i, bound)
+        d = compute(prev, load - actual, actual, TB, sat, i_w, bound=bound)
+        prev, sat, i_w = d.target_w, d.sat_count, d.i_w
+        cmd = prev if deliver is None else max(deliver[0],
+                                                min(deliver[1], prev))
+        actual = actual + 0.94 * (cmd - actual)
+        rows.append((prev, actual, sat, d.frozen, d.reason, d.i_w))
+    return rows
+
+
+# (a) One battery may give 800 W (the other is Off), the house takes 3000 W.
+_with = closed_loop(40, 3000.0, bound=(-800.0, 800.0))
+_without = closed_loop(40, 3000.0, deliver=(-800.0, 800.0))
+print(f"    house 3000 W, modes allow 800 W: with the bound the command ends "
+      f"at {nth(_with, -1)[0]:.0f} W (sat {max(r[2] for r in _with)}, reason "
+      f"{nth(_with, -1)[4]}); without it {nth(_without, -1)[0]:.0f} W with "
+      f"{sum(r[3] for r in _without)} frozen cycles")
+check("⭐ THE LOOP BOUND HOLDS: every command and every integrator value "
+      "stays inside [-800, 800], and the command settles at the bound",
+      all(-800.0 <= r[0] <= 800.0 and -800.0 <= r[5] <= 800.0 for r in _with)
+      and present(nth(_with, -1)) and nth(_with, -1)[0] == 800.0
+      and nth(_with, -1)[4] == MODE_BOUND)
+_big = []
+_pv, _iw, _sat = 0.0, None, 0
+for _i in range(30):
+    _d = compute(_pv, 12000.0, _pv, TB, _sat, _iw, bound=(-800.0, 800.0))
+    _pv, _iw, _sat = _d.target_w, _d.i_w, _d.sat_count
+    _big.append(_d)
+check("...and a house far beyond what the modes allow (12 kW against 800 W) "
+      "does not read as the loop winding into its rail: SAFETY-03's flags "
+      "stay false on every cycle",
+      _big and not any(d.i_clamped or d.clamped for d in _big)
+      and all(d.target_w <= 800.0 for d in _big))
+check("⭐ NO SATURATION FREEZE from unmet watts: sat_count never reaches the "
+      "freeze and no cycle is frozen",
+      not any(r[3] for r in _with)
+      and max(r[2] for r in _with) < TB.saturation_cycles)
+check("...and the same site WITHOUT the bound is the failure it removes: the "
+      "loop asks past 800 W, the plant cannot follow and the freeze engages",
+      any(r[3] for r in _without) and max(r[0] for r in _without) > 800.0)
+
+# (b) Every battery switched off: the bound is [0, 0].
+_off = closed_loop(20, 2500.0, bound=(0.0, 0.0))
+check("all batteries off: the loop asks 0 W on every cycle, with the "
+      "integrator at 0, and never freezes",
+      all(r[0] == 0.0 and r[5] == 0.0 and not r[3] for r in _off))
+
+# (c) A mode closes while the battery gives 2000 W: the ask drops at once.
+_close = closed_loop(30, 2000.0, bound=(-5000.0, 5000.0),
+                     change=lambda i, b: (0.0, 0.0) if i >= 20 else b)
+check("a mode that closes mid-run drops the ask to 0 W on the same cycle "
+      "(no slew steps of unmet watts) and carries no integrator past it",
+      present(nth(_close, 20)) and nth(_close, 19)[0] > 1500.0
+      and nth(_close, 20)[0] == 0.0
+      and nth(_close, 20)[5] == 0.0 and not any(r[3] for r in _close[20:]))
+
+# (d) Rounding never steps outside the bound.
+_q = compute(1000.0, 3000.0, 1000.0, TB, 0, 1236.0, bound=(-5000.0, 1236.0))
+check("quantising to 10 W does not step outside the bound: 1236 W becomes "
+      "1230 W, not 1240 W", _q.target_w == 1230.0)
+_qn = compute(-1000.0, -3000.0, -1000.0, TB, 0, -1236.0,
+              bound=(-1236.0, 5000.0))
+check("...on the charge side too: -1236 W becomes -1230 W",
+      _qn.target_w == -1230.0)
+
+# (e) A bound that leaves out 0 W is a fault and is not obeyed.
+_rngc = _random.Random(1131)
+_same, _nb = True, 0
+for _ in range(4000):
+    args = (_rngc.uniform(-5000, 5000), _rngc.uniform(-4000, 4000),
+            _rngc.uniform(-5000, 5000), TB, _rngc.randint(0, 5),
+            _rngc.choice((None, _rngc.uniform(-6000, 6000))))
+    _nb += 1
+    if (compute(*args, bound=(200.0, 900.0)) != compute(*args)
+            or compute(*args, bound=None) != compute(*args)):
+        _same = False
+check(f"a bound that leaves out 0 W is ignored, and bound=None is the law as "
+      f"it was: {_nb} random cycles give the identical Decision",
+      _same and _nb == 4000)
+
+# (f) Inside the bound nothing changes: a bound wider than every command.
+_wide = True
+for _ in range(4000):
+    args = (_rngc.uniform(-4000, 4000), _rngc.uniform(-3000, 3000),
+            _rngc.uniform(-4000, 4000), TB, _rngc.randint(0, 5),
+            _rngc.choice((None, _rngc.uniform(-4000, 4000))))
+    if compute(*args, bound=(-9000.0, 9000.0)) != compute(*args):
+        _wide = False
+check("a bound wider than the rail changes no Decision (4000 random cycles)",
+      _wide)
+
+# (g) Review of PR #149: a bound EQUAL to the rail - every battery on, the
+# default once modes are on - must leave SAFETY-03 exactly as it was. Before
+# the fix the mode clamp ran first and took `i_clamped` away from the rail.
+_rail_same, _rail_hits = True, 0
+for _tb in (TB, Tuning(gain=0.6, max_w=5000.0, slew_w=400.0, deadband_w=15.0,
+                       step_w=10, target_grid_w=-10.0,
+                       integrator_max_w=7000.0)):
+    _lim = _tb.max_w
+    for _ in range(4000):
+        args = (_rngc.uniform(-5000, 5000), _rngc.uniform(-12000, 12000),
+                _rngc.uniform(-5000, 5000), _tb, _rngc.randint(0, 5),
+                _rngc.choice((None, _rngc.uniform(-8000, 8000))))
+        _d0 = compute(*args)
+        _rail_hits += _d0.i_clamped
+        if compute(*args, bound=(-_lim, _lim)) != _d0:
+            _rail_same = False
+check(f"a bound equal to the rail changes no Decision, SAFETY-03's i_clamped "
+      f"included ({_rail_hits} of 8000 random cycles wind into the rail), and "
+      f"with integrator_max_w above max_w too", _rail_same and _rail_hits > 100)
+_one_side = compute(4000.0, 12000.0, 4000.0, TB, 0, 4990.0,
+                    bound=(0.0, 5000.0))
+check("...and a bound that closes only the other side still lets the rail "
+      "flag a loop winding into it", _one_side.i_clamped)
+
 print()
 if fails:
     print(f"{len(fails)} FAILED: {', '.join(fails)}")
diff --git a/goodwe_controller/test_control_task.py b/goodwe_controller/test_control_task.py
new file mode 100644
index 0000000..b37afa2
--- /dev/null
+++ b/goodwe_controller/test_control_task.py
@@ -0,0 +1,377 @@
+"""Runnable check for SAFETY-61: the control task's death.  `python3 test_control_task.py`
+
+If `run_control()` raised, nothing noticed: the task ended, `stop` was never
+set, the web UI kept serving and the Supervisor saw a healthy container. The
+card's fix and its reasons are in DECISIONS/SAFETY-61-control-task-death.md.
+
+Parts 1-3 drive the REAL `app.main.main()` - the process entry point - in a
+child process (this file re-invoked with `--driver`), with only the outside
+world faked: options, Home Assistant, the store, the web server and the core
+API probe. The child's exit status is the real one. Each child runs under a
+deadline, because the defect this card closes is a HANG (MUTATION.md habit 5).
+
+Takes ~15 s. Purge `__pycache__` before a mutation run (MUTATION.md).
+"""
+
+import asyncio
+import json
+import os
+import signal
+import subprocess
+import sys
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+FAULT = "injected SAFETY-61 fault"
+DEADLINE_S = 40
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+# --------------------------------------------------------------------------- #
+# The child: the real main() with the outside world faked.
+# --------------------------------------------------------------------------- #
+BASE = {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+        "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+        "meter_source": "off", "max_w": 2000, "gain": 0.6, "slew_w": 0,
+        "deadband_w": 15, "target_grid_w": -10, "step_w": 10,
+        "heartbeat_s": 10, "stale_input_s": 15, "cycle_floor_s": 1,
+        "auto_start": True}
+
+
+def driver(scenario):
+    import aiohttp
+    import app.main as M
+    import app.store
+    import app.web
+
+    def event(*e):
+        """Streamed as it happens, so a child killed at the deadline or by
+        os._exit() still reports what it did."""
+        print("EV " + json.dumps(list(e)), flush=True)
+    t0 = time.monotonic()
+
+    class FakeHass:
+        def __init__(self):
+            self.batt = 0.0
+            self.limit_calls = 0
+
+        async def limits(self, entity):
+            self.limit_calls += 1
+            # "refuse": ESPHome not up at the startup gate, then a rating
+            # below max_w once run_control() re-reads it -> its refusal path.
+            if scenario == "refuse":
+                return (None, None, None) if self.limit_calls == 1 else (-1000.0, 1000.0, 1.0)
+            return (-5000.0, 5000.0, 1.0)
+
+        async def number(self, entity, invert=False):
+            if entity == "sensor.grid":
+                # a steady 600 W import, alternating by 1 W so every pass cycles
+                return 600.0 + (int(time.monotonic() - t0) % 2)
+            if entity == "sensor.batt":
+                return self.batt
+            if entity == "sensor.soc":
+                return 50.0
+            return None
+
+        async def state(self, entity):
+            return None
+
+        async def set_number(self, entity, value):
+            event("w", float(value))
+            self.batt = float(value)
+            return True
+
+        async def call(self, *a, **k):
+            return True
+
+        async def mqtt_service(self):
+            raise RuntimeError("no broker in this test")
+
+    class _Store:
+        data = {}
+
+        def get(self, key, default=None):
+            return default
+
+        def set(self, *a, **k):
+            pass
+
+    class _Runner:
+        async def cleanup(self):
+            event("cleanup")
+
+    async def _web_start(controller, port=8099, selfcfg=None):
+        return _Runner()
+
+    class _NoProbeSession:
+        """The core API probe in amain() must not touch a network."""
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *a):
+            return False
+
+        def get(self, *a, **k):
+            raise OSError("no network in this test")
+
+    M.load_options = lambda: dict(BASE)
+    M.HomeAssistant = lambda session: FakeHass()
+    app.store.Store = _Store
+    app.web.start = _web_start
+    aiohttp.ClientSession = _NoProbeSession
+
+    real_cycle = M.Controller.cycle
+    n = {"cycles": 0}
+
+    async def cycle(self):
+        n["cycles"] += 1
+        if scenario == "fault" and n["cycles"] == 4:
+            event("fault")
+            raise RuntimeError(FAULT)
+        await real_cycle(self)
+        if scenario == "clean" and n["cycles"] == 4:
+            os.kill(os.getpid(), signal.SIGTERM)     # the Supervisor's stop
+
+    M.Controller.cycle = cycle
+    M.main()
+
+
+def run_child(scenario):
+    env = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
+    try:
+        p = subprocess.run([sys.executable, "-B", __file__, "--driver", scenario],
+                           cwd=HERE, env=env, capture_output=True, text=True,
+                           timeout=DEADLINE_S)
+    except subprocess.TimeoutExpired as e:
+        rc, out, err = None, e.stdout or "", e.stderr or ""
+    else:
+        rc, out, err = p.returncode, p.stdout, p.stderr
+    out = out.decode() if isinstance(out, bytes) else out
+    err = err.decode() if isinstance(err, bytes) else err
+    events = [json.loads(ln[3:]) for ln in out.splitlines() if ln.startswith("EV ")]
+    return rc, out, err, events
+
+
+def tail(text, n=15):
+    return "\n".join("      | " + ln for ln in text.splitlines()[-n:])
+
+
+if len(sys.argv) == 3 and sys.argv[1] == "--driver":
+    driver(sys.argv[2])
+    sys.exit(0)            # unreachable in every scenario: main() exits itself
+
+
+# --------------------------------------------------------------------------- #
+print("1. an exception inside cycle() - the real main(), in a child process")
+rc, out, err, ev = run_child("fault")
+print(f"    exit status {rc}; events {ev}")
+check(f"the process ENDS inside {DEADLINE_S} s rather than sitting there "
+      "healthy (the defect is a hang)", rc is not None)
+check("exit status is 70 (EX_SOFTWARE), not 0 and not an unhandled crash's 1",
+      rc == 70)
+fault_at = ev.index(["fault"]) if ["fault"] in ev else None
+before = [e[1] for e in ev[:fault_at] if e[0] == "w"] if fault_at is not None else []
+after = [e[1] for e in ev[fault_at + 1:] if e[0] == "w"] if fault_at is not None else []
+# Precondition (habit 23): the inverter was holding a NON-ZERO command when the
+# fault hit, so a 0 W write afterwards is evidence of the wind-down, not rest.
+check("precondition: the fault hit while the last command was non-zero "
+      f"(last before fault = {before[-1] if before else None})",
+      fault_at is not None and bool(before) and before[-1] != 0.0)
+check(f"the wind-down ran: 0 W written AFTER the fault (writes after = {after})",
+      after == [0.0])
+check("the web runner was cleaned up, i.e. the ordinary shutdown path ran",
+      ["cleanup"] in ev[(fault_at or 0):])
+died_line = next((i for i, ln in enumerate(err.splitlines())
+                  if "Control stopped unexpectedly (RuntimeError('" + FAULT + "'))" in ln), None)
+wind_line = next((i for i, ln in enumerate(err.splitlines())
+                  if "shutting down - commanding 0 W" in ln), None)
+check("a CRITICAL line names the exception and the exit status",
+      died_line is not None
+      and "CRITICAL" in err.splitlines()[died_line]
+      and "set to 0 W and the add-on exits with code 70" in err.splitlines()[died_line])
+check("the traceback is logged, down to the frame that raised",
+      "Traceback (most recent call last)" in err
+      and f"RuntimeError: {FAULT}" in err and "in cycle" in err)
+check("it is logged AT THE DEATH, before the wind-down - not only at exit",
+      died_line is not None and wind_line is not None and died_line < wind_line)
+check("exactly one traceback: main() does not print a second one",
+      err.count("Traceback (most recent call last)") == 1)
+if fails:
+    print(tail(err, 30))
+
+# --------------------------------------------------------------------------- #
+print("2. the same entry point stopped by SIGTERM - the callback must stay quiet")
+rc2, out2, err2, ev2 = run_child("clean")
+print(f"    exit status {rc2}; events {ev2}")
+check("an ordinary stop still exits 0", rc2 == 0)
+check("an ordinary stop logs no unexpected stop", "Control stopped unexpectedly" not in err2)
+check("an ordinary stop still winds down to 0 W, from a non-zero command",
+      any(e[0] == "w" and e[1] != 0.0 for e in ev2)
+      and [e for e in ev2 if e[0] == "w"][-1:] == [["w", 0.0]])
+
+# --------------------------------------------------------------------------- #
+print("3. run_control()'s own refusal path returns on purpose - still exit 78")
+rc3, out3, err3, ev3 = run_child("refuse")
+print(f"    exit status {rc3}")
+check("a late-arriving device rating refusal exits 78 (EX_CONFIG), not 70",
+      rc3 == 78)
+check("and is not reported as a death", "Control stopped unexpectedly" not in err3)
+if rc3 != 78:
+    print(tail(err3))
+
+# --------------------------------------------------------------------------- #
+print("4. hass.py: a body that is not a state object is an ABSENCE")
+import aiohttp                                      # noqa: E402
+from aiohttp import web as aioweb                   # noqa: E402
+
+import app.hass as H                                # noqa: E402
+
+
+async def hass_cases():
+    async def handler(req):
+        k = req.match_info["k"]
+        if k == "sensor.good":
+            return aioweb.json_response({"entity_id": k, "state": "42"})
+        if k == "sensor.badjson":
+            return aioweb.Response(text="{not json", content_type="application/json")
+        if k == "sensor.list":
+            return aioweb.Response(text="[1, 2]", content_type="application/json")
+        if k == "sensor.html":
+            return aioweb.Response(text="<html>", content_type="text/html")
+        return aioweb.Response(status=404)
+
+    async def svc(req):
+        return aioweb.Response(body=b"\xff\xfe\xfa", status=400,
+                               headers={"Content-Type": "text/plain; charset=utf-8"})
+
+    app_ = aioweb.Application()
+    app_.router.add_get("/states/{k}", handler)
+    app_.router.add_post("/services/{d}/{s}", svc)
+    runner = aioweb.AppRunner(app_)
+    await runner.setup()
+    site = aioweb.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    port = site._server.sockets[0].getsockname()[1]
+    H.CORE_API = f"http://127.0.0.1:{port}"
+    got = {}
+    try:
+        async with aiohttp.ClientSession() as session:
+            h = H.HomeAssistant(session, token="t")
+            for e in ("sensor.good", "sensor.badjson", "sensor.list", "sensor.html"):
+                try:
+                    got[e] = ("ok", await h.number(e))
+                except Exception as err:                    # noqa: BLE001
+                    got[e] = ("raised", type(err).__name__)
+            try:
+                got["call"] = ("ok", await h.set_number("number.sp", 0))
+            except Exception as err:                        # noqa: BLE001
+                got["call"] = ("raised", type(err).__name__)
+    finally:
+        await runner.cleanup()
+    return got
+
+got = asyncio.run(hass_cases())
+print(f"    {got}")
+check("baseline: a well-formed state reads as its value (42.0)",
+      got["sensor.good"] == ("ok", 42.0))
+check("a malformed JSON body labelled application/json reads as None, not a raise",
+      got["sensor.badjson"] == ("ok", None))
+check("a JSON body that is not an object reads as None, not a raise",
+      got["sensor.list"] == ("ok", None))
+check("a text/html 200 reads as None (already true before SAFETY-61)",
+      got["sensor.html"] == ("ok", None))
+check("a rejected write with an undecodable body is a failed write (False)",
+      got["call"] == ("ok", False))
+
+# --------------------------------------------------------------------------- #
+print("5. the control-loop status row")
+from app.main import Controller                     # noqa: E402
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, *a, **k):
+        pass
+
+    def close(self):
+        pass
+
+
+class _Store:
+    data = {}
+
+    def set(self, *a, **k):
+        pass
+
+
+class _RowHass:
+    async def limits(self, entity):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def number(self, entity, invert=False):
+        return {"sensor.grid": 600.0, "sensor.soc": 50.0}.get(entity, 0.0)
+
+    async def state(self, entity):
+        return None
+
+    async def set_number(self, entity, value):
+        return True
+
+    async def call(self, *a, **k):
+        return True
+
+
+def rows_for(pass_age):
+    c = Controller(dict(BASE), _RowHass(), _Store(), _Pub(), stop=asyncio.Event())
+    c.loop_pass_mono = None if pass_age is None else time.monotonic() - pass_age
+    return c.checks()
+
+
+r_new, r_29, r_31 = rows_for(None), rows_for(29), rows_for(31)
+print(f"    {r_new[0]} | {r_29[0]} | {r_31[0]}")
+# UX-08: the wording is app/messages.py's; these pin the meaning - which row,
+# its colour, and the two numbers (age, veto) an operator acts on.
+check("before the first pass the row is ok and says 'starting'",
+      r_new[0]["id"] == "controller" and r_new[0]["ok"] and not r_new[0]["warn"]
+      and "starting" in r_new[0]["text"])
+check("29 s after a pass it is ok",
+      r_29[0]["id"] == "controller" and r_29[0]["ok"] and not r_29[0]["warn"]
+      and "29 seconds ago" in r_29[0]["text"])
+check("31 s after a pass it is RED and first, naming the age and the veto",
+      r_31[0]["id"] == "controller" and not r_31[0]["ok"]
+      and not r_31[0]["warn"]
+      and "not run for 31 seconds" in r_31[0]["text"]
+      and "0 W after 30 seconds" in r_31[0]["text"])
+
+
+async def one_pass():
+    c = Controller(dict(BASE), _RowHass(), _Store(), _Pub(), stop=asyncio.Event())
+    c.auto = True
+    before = getattr(c, "loop_pass_mono", "absent")
+    t = asyncio.create_task(c.run_control())
+    await asyncio.sleep(2.5)
+    c.stopping = True
+    await asyncio.wait_for(t, timeout=10)
+    return before, getattr(c, "loop_pass_mono", None)
+
+_before, _after = asyncio.run(one_pass())
+print(f"    stamp before run: {_before}; age after 2.5 s: "
+      f"{None if _after is None else round(time.monotonic() - _after, 2)} s")
+check("the real run_control() stamps each pass",
+      _before is None and _after is not None and time.monotonic() - _after < 3)
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)}")
+    for f in fails:
+        print(f"  - {f}")
+    sys.exit(1)
+print("all SAFETY-61 checks passed")
diff --git a/goodwe_controller/test_delivery.py b/goodwe_controller/test_delivery.py
index f7cf11e..2688c84 100644
--- a/goodwe_controller/test_delivery.py
+++ b/goodwe_controller/test_delivery.py
@@ -31,6 +31,9 @@ import re
 import sys
 from datetime import datetime, timedelta, timezone
 
+from named_absence import given, present
+
+from app import control, messages
 from app.control import Tuning
 from app.delivery import (
     DELIVERY_OPTION_DEFAULTS, DELIVERY_SHARE_FRACTION, REASON_CODE,
@@ -590,6 +593,15 @@ check("...and the SHARES now differ, which is OPT-09 and not a weakening of the
       "grades the ALARM, and neither can do the other's half",
       _pw != _pf
       and _sf[-1]["shares"][1] == 0.0 and _sw[-1]["shares"][1] == 2000.0)
+# SAFETY-73. A unit that gives < 100 W while asked > 200 W is refused after
+# SETTLE_CYCLES cycles that also span REFUSED_SPAN_S (22 s). This fixture's 14
+# cycles are 0.2 s apart, so the wedged B meets the count and not the span, and
+# SAFETY-42's report stands alone here. test_refusal_units.py grades the
+# refusal. On a site the 185 s hold puts the refusal first.
+check("SAFETY-73: the wedged arm's B is not refused in this fixture: 12 cycles "
+      "of evidence in under 3 s are not the 22 s a refusal needs",
+      _cw.inverters[1].refused == 0
+      and _cw.inverters[1].ref_count >= control.SETTLE_CYCLES)
 check("...and the state of charge is still what tells them apart",
       [r["soc"] for r in _sw] != [r["soc"] for r in _sf])
 print(f"       both arms, last cycle: grid {_sw[-1]['grid']:.0f} W, shares "
@@ -738,8 +750,8 @@ async def _at_saturation_w(sat, b_frac=_SAT_B_FRAC):
 _c_ship, _r_ship = asyncio.run(_at_saturation_w(_SAT_SHIPPED))
 _c_up, _r_up = asyncio.run(_at_saturation_w(_SAT_RAISED))
 _b_ship, _b_up = _c_ship.inverters[1], _c_up.inverters[1]
-_gap_ship = short_by(_b_ship.standing_w(), _b_ship.batt)
-_gap_up = short_by(_b_up.standing_w(), _b_up.batt)
+_gap_ship = given(short_by(_b_ship.standing_w(), _b_ship.batt), "B not short")
+_gap_up = given(short_by(_b_up.standing_w(), _b_up.batt), "B not short")
 
 check(f"the raised threshold is a config an operator can actually enter: "
       f"{_SAT_RAISED} W is inside the shipped schema "
@@ -762,7 +774,7 @@ check("the raised arm REACHED the comparison: B was asked for a discharge "
       "share, is short of it, is live, is not parked, and NOTHING accounts for "
       "it - the only thing standing between this unit and an alarm is the "
       "configured watts",
-      float(_b_up.standing_w()) > 0 and _gap_up is not None
+      float(_b_up.standing_w()) > 0 and present(_gap_up)
       and not _b_up.sign_wd.tripped
       and account(live=True, parked=False, soc=_b_up.soc,
                   bms_floor=_b_up.bms_soc_floor) is None)
@@ -780,7 +792,7 @@ check("...and SAFETY-43's RELATIVE arm is silent on both arms of this fixture, "
 check("...and its shortfall lands STRICTLY BETWEEN the two configured "
       "thresholds, which is the one place the two answers can differ. Part 4's "
       "fixtures are all above both, which is exactly why they cannot see this",
-      _gap_up is not None and float(_SAT_SHIPPED) < _gap_up < float(_SAT_RAISED))
+      present(_gap_up) and float(_SAT_SHIPPED) < _gap_up < float(_SAT_RAISED))
 
 check("AT THE SHIPPED THRESHOLD THE UNIT IS NAMED",
       _r_ship[-1]["named"] == ("inverter-b",))
@@ -927,14 +939,18 @@ check("...but the banner does NOT go on saying 'Running - holding grid at "
       "zero'. That sentence is a claim the site cannot make while a unit is "
       "absent, and 'the page reads healthy while the fault runs' is the shape "
       "this whole card exists to remove. It names the unit and stays a WARNING",
-      _pay["level"] == "warn" and "NOT DELIVERING" in _pay["banner"]
+      _pay["level"] == "warn" and "is not delivering" in _pay["banner"]
       and "inverter-b" in _pay["banner"]
       and "holding grid at zero" not in _pay["banner"])
 print(f"       banner: {_pay['level']!r} / {_pay['banner']!r}")
-_row = [r for r in _cw.checks() if "NOT DELIVERING" in r["text"]]
+_row = [r for r in _cw.checks()
+        if r.get("id") == "delivery" and "not delivering" in r["text"]]
 check("the status page carries it as a CAUTION, not a failure: the site is "
       "still running and short, which a red cross would misdescribe",
-      len(_row) == 1 and _row[0]["ok"] is False and _row[0]["warn"] is True)
+      len(_row) == 1 and _row[0]["ok"] is False and _row[0]["warn"] is True
+      and "inverter-b" in _row[0]["text"])
+check("...and the row says how it clears: a stop and start of control",
+      bool(_row) and "stopping and starting control" in _row[0]["text"])
 
 
 # ===========================================================================
@@ -1140,8 +1156,10 @@ async def _one():
             "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
             "meter_source": "off", "max_w": 2000, "gain": 0.6,
             # ⚠️ THE SAME 1 s AS THE TWO-INVERTER FIXTURE, AND THAT IS WHAT
-            # MAKES THIS SECTION NON-VACUOUS. The run below is 2 s of wall clock
-            # against a 1 s window, so a hold is not what stops this firing -
+            # MAKES THIS SECTION NON-VACUOUS. The run below is 1.1 s of wall
+            # clock against a 1 s window (SAFETY-52 shortened it from 2 s, and
+            # "the window was never even opened" below is what still makes it
+            # non-vacuous), so a hold is not what stops this firing -
             # the reduction is. With a shipped-length hold "nothing was
             # reported" would be true of a fixture that simply ran out of time.
             "bms_soc_floor": _FLOOR_PCT, "delivery_hold_s": 1,
@@ -1151,7 +1169,10 @@ async def _one():
     c.inverters[0].dev_min, c.inverters[0].dev_max = -2000.0, 2000.0
     c.auto = True
     hass.ctrl = c
-    await _drive(c, n=20, dt=0.1)
+    # SAFETY-52: from SETTLE_CYCLES of delivering nothing the loop asks 0 W
+    # (the battery refuses), so the run stops just before that. 11 cycles is
+    # still 1.1 s against the 1 s hold.
+    await _drive(c, n=11, dt=0.1)
     return c, hass, store
 
 
@@ -1170,10 +1191,11 @@ check("...and no store key was written, so a one-inverter install's state file "
       "is byte-identical to what it was before this card",
       unit_key(_only.name, "delivery_tripped") not in _st1.data
       and unit_key(_only.name, "delivery_reason") not in _st1.data)
-_n1row = [r for r in _c1.checks() if "delivery watchdog" in r["text"]]
+_n1row = [r for r in _c1.checks() if r.get("id") == "delivery"]
 check("...and the status page says n/a rather than 'armed', which would be a "
       "claim to be watching something that cannot happen",
-      len(_n1row) == 1 and _n1row[0]["ok"] and "n/a at one inverter" in _n1row[0]["text"])
+      len(_n1row) == 1 and _n1row[0]["ok"]
+      and "not needed with one inverter" in _n1row[0]["text"])
 check("...no persistent notification of this kind was raised either",
       not [c for c in _h1.calls
            if "not_delivering" in str(c[2].get("notification_id", ""))])
@@ -1193,8 +1215,8 @@ async def _restart():
     c1 = _ctrl(h1, store=shared)
     await _drive(c1)
     # A NEW process, a NEW HomeAssistant object (so the in-memory notification
-    # is gone with it), the SAME durable file. That is what a Home Assistant
-    # restart is from this add-on's point of view: the add-on goes with it.
+    # is gone with it), the SAME durable file: an ADD-ON restart. A Core-only
+    # restart keeps the process; graded in part 8b (SAFETY-34).
     h2 = _DeliveryHass(b_soc=50.0)
     c2 = _ctrl(h2, store=shared)
     await c2.check_not_delivering()
@@ -1230,7 +1252,7 @@ check("the notification NAMES THE UNIT - in its id, its title and its body - "
 check("...and it says, in the operator's own sentence, that nothing has been "
       "commanded differently. An alarm that let somebody believe the add-on "
       "had handled it would be worse than no alarm",
-      "NOTHING HAS BEEN COMMANDED DIFFERENTLY" in _note[2]["message"])
+      "nothing was changed and control keeps running" in _note[2]["message"])
 print(f"       id={_note[2]['notification_id']!r} title={_note[2]['title']!r}")
 _before_calls = len(_rh2.calls)
 await_again = asyncio.run(_r2.check_not_delivering())
@@ -1248,6 +1270,40 @@ check("the operator's START press is the only way out, and it clears the "
       and _rs.data.get(unit_key("inverter-b", "delivery_reason")) == ""
       and _r2._delivery_announced == set())
 
+print()
+print("8b. SAFETY-34: a Core-only restart - same add-on process, HA's memory wiped")
+import app.main as _main_mod  # noqa: E402
+
+
+async def _core_restart():
+    shared = _MemStore()
+    c = _ctrl(_DeliveryHass(b_soc=50.0), store=shared)
+    await _drive(c)
+    return c
+
+
+_c = asyncio.run(_core_restart())
+_real_mono, _clock = _main_mod._mono, [_main_mod._mono()]
+_main_mod._mono = lambda: _clock[0]
+try:
+    _c.hass = _DeliveryHass(b_soc=50.0)
+    asyncio.run(_c.check_not_delivering())
+    _early = [x for x in _c.hass.calls
+              if "not_delivering" in str(x[2].get("notification_id", ""))]
+    _clock[0] += _main_mod.REANNOUNCE_S
+    asyncio.run(_c.check_not_delivering())
+    _late = [x for x in _c.hass.calls
+             if "not_delivering" in str(x[2].get("notification_id", ""))]
+finally:
+    _main_mod._mono = _real_mono
+check("SAFETY-34: the latch tripped in this process",
+      _c.inverters[1].delivery_wd.tripped)
+check("SAFETY-34: inside REANNOUNCE_S the same process does not re-raise",
+      len(_early) == 0)
+check("SAFETY-34: after REANNOUNCE_S the SAME process re-asserts the card, "
+      "because a Core-only restart wiped it and did not restart the add-on",
+      len(_late) == 1 and "inverter_b" in _late[0][2]["notification_id"])
+
 
 print()
 if fails:
diff --git a/goodwe_controller/test_docs.py b/goodwe_controller/test_docs.py
new file mode 100644
index 0000000..43fe729
--- /dev/null
+++ b/goodwe_controller/test_docs.py
@@ -0,0 +1,210 @@
+"""Runnable check that the operator docs say what the code does.  `python3 test_docs.py`
+
+DOC-1. Two things the docs got wrong and an installer would have copied:
+
+1. The `inverters:` example in DOCS.md must be ACCEPTED by the shipped
+   validator (`app/validate.py`) and carry every key config.yaml's schema
+   requires per entry. It omitted `bms_soc_floor` and would not start.
+2. The P1 age entity the ESP32 watchdog subscribes to must be documented under
+   the id Home Assistant composes from what `app/mqtt.py` announces, and the
+   old wrong id must appear in no shipped doc.
+
+Each part also runs its own mutation (habit 1 of MUTATION.md): the spoilt input
+must turn it red, or the green above it means nothing.
+"""
+
+import os
+import re
+import sys
+
+from app import mqtt
+from app.validate import validate_startup_config
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+REPO = os.path.dirname(HERE)
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def read(*parts):
+    with open(os.path.join(*parts), encoding="utf-8") as fh:
+        return fh.read()
+
+
+DOCS = read(HERE, "DOCS.md")
+CFG = read(HERE, "config.yaml")
+
+
+# --------------------------------------------------------------------------- #
+# A reader for the two YAML shapes used here. No PyYAML in the checks image
+# (test_defaults_pin.py says why), so this is by hand, and part 1a checks it
+# actually found something.
+def scalar(raw):
+    raw = raw.split("#", 1)[0].strip()
+    if raw[:1] in "\"'" and raw[-1:] == raw[:1] and len(raw) >= 2:
+        return raw[1:-1]
+    if raw in ("true", "false"):
+        return raw == "true"
+    if raw == "[]":
+        return []
+    for cast in (int, float):
+        try:
+            return cast(raw)
+        except ValueError:
+            pass
+    return raw
+
+
+def parse_example(text):
+    """Top-level `key: value` lines plus one list of flat mappings."""
+    out, cur_list, cur = {}, None, None
+    for line in text.splitlines():
+        if not line.split("#", 1)[0].strip():
+            continue
+        m = re.match(r"^([a-z0-9_]+):\s*(.*)$", line)
+        if m:
+            if m.group(2).split("#", 1)[0].strip():
+                out[m.group(1)] = scalar(m.group(2))
+                cur_list = None
+            else:
+                cur_list = out[m.group(1)] = []
+            continue
+        m = re.match(r"^\s+-\s+([a-z0-9_]+):\s*(.*)$", line)
+        if m and cur_list is not None:
+            cur = {m.group(1): scalar(m.group(2))}
+            cur_list.append(cur)
+            continue
+        m = re.match(r"^\s+([a-z0-9_]+):\s*(.*)$", line)
+        if m and cur is not None:
+            cur[m.group(1)] = scalar(m.group(2))
+            continue
+        raise ValueError(f"unparsed line in the DOCS.md example: {line!r}")
+    return out
+
+
+# --------------------------------------------------------------------------- #
+print("DOC-1 - the docs say what the code does\n")
+print("1. the `inverters:` example in DOCS.md starts")
+
+section = DOCS[DOCS.index("### More than one inverter (`inverters`)"):]
+section = section[:section.index("\n### ", 1)]
+block = re.search(r"```yaml\n(.*?)```", section, re.S).group(1)
+example = parse_example(block)
+entries = example.get("inverters") or []
+
+# The options a fresh install is given, from config.yaml itself: the example is
+# pasted on top of these, exactly as an installer does.
+opts_block = CFG[CFG.index("\noptions:"):CFG.index("\nschema:")]
+shipped = {m.group(1): scalar(m.group(2))
+           for m in re.finditer(r"^  ([a-z0-9_]+): *(.*)$", opts_block, re.M)}
+
+# config.yaml's per-entry schema: required keys are the ones without `?`.
+schema_block = CFG[CFG.index("\nschema:"):]
+inv_schema = re.search(r"^  inverters:\n((?:    .*\n)+)", schema_block, re.M).group(1)
+schema_keys = dict(re.findall(r"^    -? ?\s*([a-z0-9_]+): *(\S+)", inv_schema, re.M))
+required = sorted(k for k, t in schema_keys.items() if not t.endswith("?"))
+
+check(f"1a. the reader found the example: {len(entries)} entries, "
+      f"{len(shipped)} shipped options, schema keys {sorted(schema_keys)}",
+      len(entries) == 2 and all(len(e) >= 4 for e in entries)
+      and len(shipped) > 50 and "bms_soc_floor" in required)
+
+missing = [(e.get("name"), k) for e in entries for k in required if k not in e]
+check(f"1b. every entry carries every key the schema requires {required} "
+      f"(missing: {missing})", not missing)
+
+unknown = [(e.get("name"), k) for e in entries for k in e if k not in schema_keys]
+check(f"1c. no entry uses a key the schema does not declare (found: {unknown})",
+      not unknown)
+
+
+def with_example(ex):
+    opts = dict(shipped)
+    opts.update(ex)
+    return opts
+
+
+problems = validate_startup_config(with_example(example))
+for p in problems:
+    print(f"      refused: {p[:160]}")
+check("1d. the shipped validator accepts the example as documented", problems == [])
+
+# Precondition: the example clears the flat setpoint_entity, so without its
+# roster there is no actuator. If this passed, 1d graded the flat keys, not the
+# roster.
+flat_only = {k: v for k, v in example.items() if k != "inverters"}
+check("1e. ...and it is the ROSTER that 1d graded (the example without it is "
+      "refused)", validate_startup_config(with_example(flat_only)) != [])
+
+# The mutation this card is about: the key the docs used to leave out.
+spoilt = dict(example, inverters=[
+    {k: v for k, v in e.items() if k != "bms_soc_floor"} for e in entries])
+sp = validate_startup_config(with_example(spoilt))
+check("1f. MUTATION: the example with `bms_soc_floor` removed is refused, "
+      "and the refusal names it",
+      sp != [] and any("bms_soc_floor" in p for p in sp))
+
+# --------------------------------------------------------------------------- #
+print("\n2. the P1 age entity is documented under its real id")
+
+
+def compose(device_name, entity_name):
+    """HA's entity_id from device name + entity name (mqtt.py's note on
+    DEVICE). Written here, not borrowed from mqtt._slug, so a change to that
+    helper cannot move both sides of the comparison."""
+    s = re.sub(r"[^a-z0-9]+", "_", f"{device_name} {entity_name}".lower())
+    return "sensor." + s.strip("_")
+
+
+p1_rows = [r for r in mqtt.SENSORS if r[0] == "p1_age"]
+check("2a. mqtt.py announces exactly one `p1_age` sensor", len(p1_rows) == 1)
+real_id = compose(mqtt.DEVICE["name"], p1_rows[0][2]) if p1_rows else ""
+print(f"      composed from mqtt.py: {real_id}")
+
+# Anchor outside mqtt.py: the id recorded from the live install.
+recorded = read(HERE, "tools", "rehearsal", "announced-reference.txt")
+check("2b. ...and that composes to the id recorded from the live install "
+      "(tools/rehearsal/announced-reference.txt)",
+      re.search(rf"^{re.escape(real_id)}\s+goodwe_ctl_p1_age\b", recorded, re.M)
+      is not None)
+
+m = re.search(r"^#### `(sensor\.[a-z0-9_]+)`\n\n(?:.*\n){0,6}?.*stale-input watchdog",
+              DOCS, re.M)
+documented = m.group(1) if m else None
+check(f"2c. DOCS.md's watchdog-entity section is headed with that id "
+      f"(found {documented!r})", documented == real_id)
+
+# The wrong id, anywhere an installer reads. CHANGELOG.md and DECISIONS/ are
+# history and keep what was said at the time.
+SHIPPED_DOCS = [
+    os.path.join(HERE, "DOCS.md"), os.path.join(HERE, "config.yaml"),
+    os.path.join(REPO, "README.md"), os.path.join(REPO, "FIELD-GUIDE.md"),
+    os.path.join(REPO, "docs", "build_guide.py"),
+    os.path.join(REPO, "docs", "field-guide.html"),
+]
+WRONG = "p1_sample_age_s"
+hits = []
+for path in SHIPPED_DOCS:
+    for n, line in enumerate(read(path).splitlines(), 1):
+        if WRONG in line:
+            hits.append(f"{os.path.relpath(path, REPO)}:{n}")
+check(f"2d. `{WRONG}` appears in no shipped doc (hits: {hits})", not hits)
+
+# MUTATION: the old heading must fail 2c's comparison.
+bad = DOCS.replace(f"#### `{real_id}`", f"#### `sensor.{WRONG}`")
+mb = re.search(r"^#### `(sensor\.[a-z0-9_]+)`\n\n(?:.*\n){0,6}?.*stale-input watchdog",
+               bad, re.M)
+check("2e. MUTATION: the old heading is found and does not match",
+      mb is not None and mb.group(1) != real_id)
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)}")
+    sys.exit(1)
+print("all ok")
diff --git a/goodwe_controller/test_freeze.py b/goodwe_controller/test_freeze.py
index cdd6cd7..e182920 100644
--- a/goodwe_controller/test_freeze.py
+++ b/goodwe_controller/test_freeze.py
@@ -19,7 +19,8 @@ shipped `meter_freeze_s` itself:
      a check that calls the predicate directly would not be testing the thing
      that ships. Uses the rig's own `sim/hwsim.py --fault freeze` when the infra
      repo is next to this one (or `$GOODWE_SIM`), and an equivalent local stub
-     otherwise. Both are exercised; the run says which one it used.
+     otherwise. Both are exercised; the run says which one it used. CI sets
+     `GOODWE_REQUIRE_HWSIM=1`, which refuses the stub (CI-12).
 
   4. THE WIRING: the real `Controller.cycle()`, asserted on the service call
      that leaves the process;
@@ -84,6 +85,7 @@ from pathlib import Path
 
 import aiohttp
 
+from app import messages
 from app.control import Tuning, compute
 from app.freeze import (
     RAIL_FRAC, FreezeWatchdog, FreezeWatchdogConfig, looks_frozen,
@@ -600,6 +602,15 @@ hw = find_hwsim()
 # that cannot fail, from the other end.
 PART3_TRANSPORT = f"the rig hwsim at {hw}" if hw else "the local stub"
 print(f"frozen meter over HTTP - using {PART3_TRANSPORT}")
+# CI-12: CI sets GOODWE_REQUIRE_HWSIM=1, so a missing infra checkout fails here
+# instead of passing on the stub. Local runs may still use the stub, and say so.
+if not hw:
+    if os.environ.get("GOODWE_REQUIRE_HWSIM"):
+        print("FAIL: GOODWE_REQUIRE_HWSIM is set but sim/hwsim.py was not found "
+              "(sibling ../goodwe or $GOODWE_SIM) - refusing to fall back to the stub")
+        sys.exit(1)
+    print("STUB USED: part 3 ran against the local stub, NOT the infra repo's "
+          "sim/hwsim.py - not a CI-grade result")
 if hw:
     def argv_for(mode):
         return [HWSIM_DRIVER, "8791" if mode == "freeze" else "8792", mode,
@@ -763,7 +774,7 @@ def _is_freeze_note(d):
     calls itself frozen, which would be a confusable alarm on its own account.
     """
     return (d.get("notification_id") == FREEZE_NOTE_ID
-            or "frozen" in str(d.get("title", "")).lower())
+            or d.get("title") == messages.T_METER_FROZEN)
 
 
 def notes_of(hass):
@@ -778,7 +789,7 @@ def notes_by_text_of(hass):
     both would be true by construction.
     """
     return [d for d in all_notes_of(hass)
-            if "frozen" in str(d.get("title", "")).lower()]
+            if d.get("title") == messages.T_METER_FROZEN]
 
 
 def wired(unchanged_s, grid, cycles=60, dev=(-5000.0, 5000.0), **over):
@@ -821,11 +832,12 @@ all_notes = all_notes_of(hass_f)              # the whole surface
 # install has. Flipped here rather than plumbing a whole P1 transport in - the
 # row's own content is what is under test.
 ctl_f.p1_enabled = True
-rows = [c for c in ctl_f.checks() if "METER MAY BE FROZEN" in c["text"]]
+frozen_rows = [c for c in ctl_f.checks() if c.get("id") == "meter_frozen"]
 print(f"    frozen at +4000 W: command ran to {ctl_f.target:.0f} W, "
-      f"{len(notes)} notification(s), {len(rows)} red status row(s)")
+      f"{len(notes)} notification(s), {len(frozen_rows)} red status row(s)")
 # SURFACE-WIDE, deliberately, and the second guard has now landed. SAFETY-03
-# ships `goodwe_output_clamp`, and this scenario - a runaway loop winding into
+# ships `goodwe_output_clamp` (and, for the integrator bound on a default
+# install, `goodwe_integrator_bound` - SAFETY-40), and this scenario - a runaway loop winding into
 # the rail - raises it legitimately: the loop asks for more than the rating and
 # is clamped. So the answer to "is this scenario still meant to raise exactly
 # one alarm" is NO, it raises exactly two, and BOTH ARE NAMED here rather than
@@ -836,7 +848,7 @@ _ids = sorted(d.get("notification_id") for d in all_notes)
 print(f"    the whole notification surface this run: {_ids}")
 check("the whole notification surface carried exactly two alarms this run - "
       "SAFETY-18's and SAFETY-03's, both named",
-      _ids == ["goodwe_meter_frozen", "goodwe_output_clamp"])
+      _ids == ["goodwe_integrator_bound", "goodwe_meter_frozen"])
 # THIS GUARD'S, keyed on the id.
 check("...and the freeze detector is the one that raised it", len(notes) == 1)
 # ⚠️ Selected by TEXT, not by id - see notes_by_text_of(). One of the two
@@ -847,9 +859,12 @@ check("...with a fixed notification_id so repeats replace, not stack",
       [d.get("notification_id") for d in notes_by_text_of(hass_f)]
       == [FREEZE_NOTE_ID])
 check("...and it says the controller is still running",
-      bool(notes) and "STILL RUNNING" in notes[0]["message"])
+      bool(notes) and "Control is still running" in notes[0]["message"])
 check("the status page carries a failed row saying so",
-      len(rows) == 1 and not rows[0]["ok"] and not rows[0]["warn"])
+      len(frozen_rows) == 1 and not frozen_rows[0]["ok"] and not frozen_rows[0]["warn"])
+check("...and the row says control still follows the reading and what to do",
+      bool(frozen_rows) and "still follows it" in frozen_rows[0]["text"]
+      and "Check the meter" in frozen_rows[0]["text"])
 check("the event log names it", any("METER FROZEN" in e for e in ctl_f.events))
 # ⚠️ NOTIFY, NOT TRIP. If a later cut turns this into a trip it must come here
 # and change this expectation deliberately, not discover it in the field.
@@ -1094,8 +1109,7 @@ def freeze_rows(unchanged_s, grid, **over):
     # p1_enabled is what a homewizard_local install has; the row's own content
     # is what is under test, not the transport that feeds it.
     ctl.p1_enabled = True
-    return ctl, [r for r in ctl.checks()
-                 if r["text"].startswith("freeze detector")]
+    return ctl, [r for r in ctl.checks() if r.get("id") == "freeze_check"]
 
 
 _ctl_u, _rows_u = freeze_rows(None, 4000.0, meter_source="ha_dsmr")
@@ -1104,30 +1118,31 @@ print(f"    uncovered: {_rows_u[0]['text'] if _rows_u else '(no row at all)'}")
 print(f"    covered:   {_rows_c[0]['text'] if _rows_c else '(no row at all)'}")
 check("an uncovered transport gets exactly one freeze-detector row",
       len(_rows_u) == 1)
-check("...and it says NOT COVERED",
-      bool(_rows_u) and "NOT COVERED" in _rows_u[0]["text"])
+# UX-08: the row says the check is off and which source it needs, in words
+# (STYLE.md: no option values). DOCS.md "Status page" maps them to the keys.
+check("...and it says the check is off",
+      bool(_rows_u) and ": off" in _rows_u[0]["text"])
 check("...and it does NOT claim the guard is armed - that would be the status "
       "page lying on behalf of a guard that cannot run",
-      bool(_rows_u) and "armed" not in _rows_u[0]["text"])
-check("...and it names the meter_source it is not covering, so the operator "
-      "knows which install this is",
-      bool(_rows_u) and "ha_dsmr" in _rows_u[0]["text"])
-check("...and it names homewizard_local as the transport that would be covered",
-      bool(_rows_u) and "homewizard_local" in _rows_u[0]["text"])
+      bool(_rows_u) and "alerts after" not in _rows_u[0]["text"])
+check("...and it names HomeWizard local as the source that would be covered",
+      bool(_rows_u) and "HomeWizard local" in _rows_u[0]["text"])
 check("...flagged as a warning rather than a silent ok",
       bool(_rows_u) and not _rows_u[0]["ok"] and _rows_u[0]["warn"])
 
 check("a COVERED transport gets exactly one freeze-detector row",
       len(_rows_c) == 1)
-check("...and that one DOES say armed - without this, 'the uncovered row does "
-      "not say armed' is satisfied by deleting the armed branch",
-      bool(_rows_c) and "armed" in _rows_c[0]["text"]
-      and "NOT COVERED" not in _rows_c[0]["text"])
+check("...and that one DOES say it is on - without this, 'the uncovered row "
+      "does not say armed' is satisfied by deleting the armed branch",
+      bool(_rows_c) and "alerts after" in _rows_c[0]["text"]
+      and ": off" not in _rows_c[0]["text"])
 check("...and it quotes the hold and the rail it is armed at, derived from the "
       "config the controller was actually built with",
       bool(_rows_c)
-      and f"{_ctl_c.freeze_wd.cfg.hold_s:.0f} s unchanged" in _rows_c[0]["text"]
-      and f"{rail_w(LIVE_INSTALL_MAX_W):.0f} W" in _rows_c[0]["text"])
+      and f"{messages.duration(_ctl_c.freeze_wd.cfg.hold_s)} unchanged"
+      in _rows_c[0]["text"]
+      and f"above {messages.watts(rail_w(LIVE_INSTALL_MAX_W))}"
+      in _rows_c[0]["text"])
 check("...as an ok row, since a covered armed guard is not a warning",
       bool(_rows_c) and _rows_c[0]["ok"] and not _rows_c[0]["warn"])
 
@@ -1169,17 +1184,23 @@ check("...and at or above the device rail, which is why it must",
 check("THE ALARM FIRES through the real cycle() - the rating reaches the "
       "predicate from the controller, not just from a unit call",
       len(_n20) == 1 and _c20.freeze_wd.active)
-check("...and the notification the operator gets quotes the capped rail, "
-      "not the max_w one",
+# UX-08: the notification no longer quotes a rail at all (the reader's action
+# is "check the meter"), so it cannot quote the wrong one; the capped rail is
+# still what the reason - the log line and the status row - carries.
+check("...and the notification the operator gets names no max_w rail, and the "
+      "reason behind it quotes the capped rail",
       bool(_n20)
+      and f"{rail_w(LIVE_INSTALL_MAX_W):.0f} W"
+      not in str(_n20[0].get("message", ""))
       and f"{rail_w(LIVE_INSTALL_MAX_W, dev_min=-4700.0, dev_max=4700.0):.0f} W"
-      in str(_n20[0].get("message", "")))
+      in _c20.freeze_wd.reason)
 # p1_enabled is what a homewizard_local install has - set by hand here for the
 # same reason part 4 sets it, see freeze_rows().
 _c20.p1_enabled = True
 check("...and the red status row is up too, so the page and the notification "
       "agree",
-      any("METER MAY BE FROZEN" in r["text"] for r in _c20.checks()))
+      any(r.get("id") == "meter_frozen" and not r["ok"] and not r["warn"]
+          for r in _c20.checks()))
 
 
 # --------------------------------------------------------------------------- #
@@ -1205,23 +1226,25 @@ check("a device smaller than max_w still gets exactly one freeze-detector row",
 check("...and the page does NOT print the max_w rail the command can never "
       "reach - THE DEFECT, in one assertion",
       bool(_rows_s)
-      and f"{rail_w(LIVE_INSTALL_MAX_W):.0f} W" not in _rows_s[0]["text"])
+      and messages.watts(rail_w(LIVE_INSTALL_MAX_W)) not in _rows_s[0]["text"])
 check("...it prints the rail the predicate actually uses",
       bool(_rows_s)
-      and f"{rail_w(LIVE_INSTALL_MAX_W, dev_min=-4700.0, dev_max=4700.0):.0f} W"
-      in _rows_s[0]["text"])
-check("...and it names the device range as the reason, since the operator "
-      "configured max_w and is owed the reason the guard is armed elsewhere",
-      bool(_rows_s) and "4700" in _rows_s[0]["text"]
-      and "max_w" in _rows_s[0]["text"])
+      and messages.watts(rail_w(LIVE_INSTALL_MAX_W, dev_min=-4700.0,
+                                dev_max=4700.0)) in _rows_s[0]["text"])
+check("...and it names the inverter's own limit as the reason, since the "
+      "operator configured max_w and is owed the reason the guard is armed "
+      "elsewhere",
+      bool(_rows_s) and "the inverter's own limit" in _rows_s[0]["text"])
+check("...and it does not say so when max_w itself sets the rail",
+      bool(_rows_c) and "own limit" not in _rows_c[0]["text"])
 
 # ⚠️ THE NUMBER IS TAKEN OFF THE ROW AND FED BACK INTO THE SHIPPED PREDICATE.
 # Asserting the page against `rail_w(...)` alone proves the two agree, which a
 # revert of BOTH to bare max_w also satisfies. What a revert cannot satisfy is
 # this: the rail the page advertises has to be a magnitude the wire can carry,
 # and the wire stops at the device rating.
-_m = re.search(r"command is over (\d+(?:\.\d+)?) W", _rows_s[0]["text"]) if _rows_s else None
-_page_rail = float(_m.group(1)) if _m else None
+_m = re.search(r"above (\d[\d ]*) W", _rows_s[0]["text"]) if _rows_s else None
+_page_rail = float(_m.group(1).replace(" ", "")) if _m else None
 print(f"    the page advertises a rail of {_page_rail} W against a device that "
       f"stops at {_ctl_s.dev_max:.0f} W")
 check("...the row states a rail in watts at all, so the parse below means "
@@ -1239,11 +1262,13 @@ check("...as an ok row - a guard armed at a lower rail is still armed, not a "
       "warning", bool(_rows_s) and _rows_s[0]["ok"] and not _rows_s[0]["warn"])
 
 check("a device with no commandable range gets exactly one row", len(_rows_z) == 1)
-check("...and it says NOT COVERED - the rail is not merely low there, it is "
-      "0 W, which would be TRUE of every command including a parked one",
-      bool(_rows_z) and "NOT COVERED" in _rows_z[0]["text"])
-check("...and it NEVER says armed", 
-      bool(_rows_z) and "armed" not in _rows_z[0]["text"])
+check("...and it says the check is off for the power range - the rail is not "
+      "merely low there, it is 0 W, which would be TRUE of every command "
+      "including a parked one",
+      bool(_rows_z) and ": off" in _rows_z[0]["text"]
+      and "power range" in _rows_z[0]["text"])
+check("...and it NEVER says armed",
+      bool(_rows_z) and "alerts after" not in _rows_z[0]["text"])
 check("...flagged as a warning rather than a silent ok, like the uncovered "
       "transport row it shares",
       bool(_rows_z) and not _rows_z[0]["ok"] and _rows_z[0]["warn"])
@@ -1263,7 +1288,8 @@ check("a Controller built with the key absent lands on the SHIPPED hold, so "
       _ctl_c.freeze_wd.cfg.hold_s == SHIPPED_HOLD_S)
 
 print()
-print(f"part 3 (the live HTTP transport) ran against: {PART3_TRANSPORT}")
+# `CI: ` lines are echoed into the CI log even on a pass (checks.yml).
+print(f"CI: test_freeze part 3 (the live HTTP transport) ran against: {PART3_TRANSPORT}")
 if fails:
     print(f"{len(fails)} FAILED: {', '.join(fails)}")
     sys.exit(1)
diff --git a/goodwe_controller/test_freshness.py b/goodwe_controller/test_freshness.py
index e04f6ab..80a8e3c 100644
--- a/goodwe_controller/test_freshness.py
+++ b/goodwe_controller/test_freshness.py
@@ -69,6 +69,8 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 from app import freshness as F
+from app import messages
+from named_absence import first, given, nth, present
 from app.circulation import circulating_w
 from app.freshness import BOUNDS, BATT_OBLIGED_S, BATT_UNCHANGED_S, MOVE_W, Freshness
 from app.inverter import Inverter
@@ -253,11 +255,12 @@ check("FRESH AND UNCHANGED is not stale. Forty identical readings over 39 s "
 check("⚠️ STALE IS. The same forty readings, the same instants, the same "
       "numbers - and the command moved 2500 W underneath them. The reading "
       "becomes None to its consumers, which is the whole card",
-      _stale.stale and _stale_read[-1] is None)
+      _stale.stale and bool(_stale_read) and _stale_read[-1] is None)
 check("...and it becomes None at the BOUND, not before: 35.0 s of unchanged "
       "arrivals, so the last fresh verdict is at t=34 and the first None at "
       "t=35",
-      _stale_read[34] == A_FROZEN_W and _stale_read[35] is None
+      len(_stale_read) > 35
+      and _stale_read[34] == A_FROZEN_W and _stale_read[35] is None
       and BATT_UNCHANGED_S == 35.0)
 check("...and NEVER a held number and never a zero - `reading()` has exactly "
       "two shapes, the arrived value or None",
@@ -357,7 +360,7 @@ check("...and `inputs_ok` goes False, so the site stops rather than regulating "
       _cs.inputs_ok is False and _cf.inputs_ok is True)
 check("...and the operator gets a line saying which unit and why, on the same "
       "status list the liveness notes use",
-      any("STALE_READING" in n and "inverter-a" in n
+      any("stopped changing" in n and "inverter-a" in n
           for n in _cs.liveness_notes())
       and _cf.liveness_notes() == [])
 check("...and the raw number is still recorded for diagnostics, so the "
@@ -449,14 +452,14 @@ _cu, _circu, _tripu, _standu, _ = run(_cycles(False))
 _WD_S = 2.0     # `unit_sign_disagree_s` as this fixture sets it, above
 print(f"    standing on A (gated): {[round(v) for v in _standg]}")
 print(f"    gated      : sign trip tick={_tripg}  circ={_circg[:6]}...")
-print(f"    gate closed after {_tgate:.2f} s of WALL clock, against the "
-      f"{_WD_S:.0f} s watchdog window ({_WD_S / _tgate:.1f}x margin)")
+print(f"    gate closed after {given(_tgate):.2f} s of WALL clock, against the "
+      f"{_WD_S:.0f} s watchdog window ({_WD_S / given(_tgate):.1f}x margin)")
 print(f"    counterfact: sign trip tick={_tripu}  circ={_circu[:6]}...")
 
 check("⚠️ PRECONDITION ON THE WALL CLOCK, AND IT IS A CHECK RATHER THAN AN "
       "ASSUMPTION (CI-06). The gate closes on the INJECTED clock, the watchdog "
       "on the real one, so this fixture only means something while the gate "
-      f"closes well inside the window: it closed at {_tgate:.2f} s against "
+      f"closes well inside the window: it closed at {given(_tgate):.2f} s against "
       f"{_WD_S:.0f} s. If this fails the machine was slow, not the code - and "
       "saying so here is what stops that being read as a defect",
       _tgate is not None and _tgate < 0.5 * _WD_S)
@@ -667,13 +670,13 @@ print("6. THE BOUNDS, graded against the SHIPPED config.yaml at BOTH ends")
 
 
 def option_default(key):
-    """`key`'s default out of config.yaml's `options:` block, at two spaces."""
+    """`key`'s default out of config.yaml's `options:` block, at two spaces - or ABSENT."""
     body = io.open(HERE / "config.yaml", encoding="utf-8").read()
     body = body[body.index("\noptions:"):body.index("\nschema:")]
     for line in body.splitlines():
         if line.startswith(f"  {key}:") and not line[2:3].isspace():
             return float(line.split(":", 1)[1].strip())
-    return None
+    return given(None, f"{key} not in config.yaml options")
 
 
 _circ_hold = option_default("circulation_hold_s")
@@ -922,11 +925,11 @@ for _day in _loop_days:
         _prev8b = _f8b.stale
         _t += 1.0
 _waits.sort()
-_p50 = _waits[len(_waits) // 2]
+_p50 = nth(_waits, len(_waits) // 2)
 print(f"    {len(_loop_days)} days replayed at 1 Hz in "
       f"{time.monotonic() - _t8b:.1f}s: {_trips8b} trips")
 print(f"    wait for the register's next change after a trip: "
-      f"min {_waits[0]:.1f} s  median {_p50:.1f} s  max {_waits[-1]:.1f} s; "
+      f"min {nth(_waits, 0):.1f} s  median {_p50:.1f} s  max {nth(_waits, -1):.1f} s; "
       f"{sum(1 for w in _waits if w >= 710.0)} at or over the live episode's "
       f"710 s")
 
@@ -940,7 +943,7 @@ check("⚠️ THE OLD EXIT WAS NOT RARE AND IT WAS NOT SHORT. Ninety-three trips
       "143.4 s and as long as 21440.1 s. Seventeen of the ninety-three are at "
       "or beyond the 710 s the live site was parked for on 2026-09-21",
       _trips8b == 93 and abs(_p50 - 143.4) < 0.1
-      and abs(_waits[-1] - 21440.1) < 0.1
+      and abs(nth(_waits, -1) - 21440.1) < 0.1
       and sum(1 for w in _waits if w >= 710.0) == 17)
 check("⚠️ AND THAT DISTRIBUTION IS A PROPERTY OF THIS BMS, NOT OF THIS CODE - "
       "which is the whole reason the exit could not stay as it was. The short "
@@ -1072,6 +1075,8 @@ def _decoder():
 
 
 def hms(t):
+    if not present(t):
+        return repr(t)
     return f"{int(t // 3600):02d}:{int(t % 3600 // 60):02d}:{int(t % 60):02d}"
 
 
@@ -1241,9 +1246,9 @@ _holds = [(_bt_moves[i + 1][0] - _bt_moves[i][0], _bt_moves[i][0],
            _bt_moves[i + 1][0], _bt_moves[i][1])
           for i in range(len(_bt_moves) - 1)]
 _HOLD_S, _HOLD_FROM, _REG_MOVES, _HOLD_W = max(_holds)
-_TRIP = next(t for t, s, _h, _sw, _r in _rows_after if s and t > _HOLD_FROM)
-_PARK = next(t for t, v in _sp if t > _TRIP and v == 0.0)
-_HUMAN = next(t for t, v in _sp if t > _PARK and v != 0.0)
+_TRIP = first((t for t, s, _h, _sw, _r in _rows_after if s and t > _HOLD_FROM), "no trip")
+_PARK = first((t for t, v in _sp if t > _TRIP and v == 0.0), "no 0 W after the trip")
+_HUMAN = first((t for t, v in _sp if t > _PARK and v != 0.0), "no command after the park")
 _blips = [t for t, s, _h, _sw, _r in _edges(_rows_after)
           if s and t < _HOLD_FROM]
 print(f"    longest register hold {_HOLD_S:.1f} s at {_HOLD_W:+.0f} W, "
@@ -1259,8 +1264,8 @@ def _first_clear_after(rows, t_from):
     return next((t for t, s, _h, _sw, _r in rows if t > t_from and not s), None)
 
 
-_clear_before = _first_clear_after(_rows_before, _TRIP)
-_clear_after = _first_clear_after(_rows_after, _TRIP)
+_clear_before = given(_first_clear_after(_rows_before, _TRIP), "no clear")
+_clear_after = given(_first_clear_after(_rows_after, _TRIP), "no clear")
 print(f"    BEFORE (release_s=inf): stale {hms(_TRIP)} -> clear "
       f"{hms(_clear_before)}   {_clear_before - _TRIP:.0f} s")
 print(f"    AFTER  (release_s={BOUNDS['batt'].release_s:.0f}): stale "
@@ -1279,7 +1284,8 @@ check("PRECONDITION: the episode is in the capture where the manifest says it "
       "several. 0x0518 answers -3 W for 850.0 s from 10:51:24, the gate arms "
       "at 10:52:00, the site's own 0 W reaches the wire at 10:52:21, and "
       "nothing else moves until a human does at 11:05:31",
-      abs(_HOLD_S - 850.0) < 0.1 and _HOLD_W == -3.0
+      present(_TRIP, _PARK, _HUMAN)
+      and abs(_HOLD_S - 850.0) < 0.1 and _HOLD_W == -3.0
       and hms(_HOLD_FROM) == "10:51:24" and hms(_TRIP) == "10:52:00"
       and hms(_PARK) == "10:52:21" and hms(_HUMAN) == "11:05:31"
       and hms(_REG_MOVES) == "11:05:34"
@@ -1310,7 +1316,7 @@ check("⚠️ GREEN AFTER, AND THE REGISTER NEVER MOVES - THIS IS THE CARD. The
       < _PARK + BOUNDS["batt"].release_s + 1.0
       and hms(_clear_after) == "10:52:39" and _f_after.releases >= 1
       and _D.held_at(_bt, _clear_after) == _D.held_at(_bt, _TRIP) == -3.0
-      and next(r for r in _rows_after if r[0] == _clear_after)[2] == -3.0)
+      and first(r for r in _rows_after if r[0] == _clear_after)[2] == -3.0)
 check("...and the recovery is worth 776 s of this one episode: the site is "
       "handed its telemetry back at 10:52:39 instead of at 11:05:35, and 772 "
       "of those seconds are BEFORE the human touched anything. That is the "
@@ -1555,8 +1561,9 @@ async def _wired_release():
 
 
 _c57, _seen57 = run(_wired_release())
-_trip57 = next(t for t, b, _ok in _seen57 if b is None)
-_back57 = next(t for t, b, _ok in _seen57 if t > _trip57 and b is not None)
+_trip57 = first((t for t, b, _ok in _seen57 if b is None), "batt never None")
+_back57 = first((t for t, b, _ok in _seen57 if t > _trip57 and b is not None),
+                "batt never back")
 print(f"    real read path: batt None from t={_trip57}, a number again at "
       f"t={_back57}, register held {A_FROZEN_W:+.0f} throughout")
 check("⚠️ THROUGH THE SHIPPED READ PATH, NOT THE POLICY OBJECT. "
@@ -1574,19 +1581,20 @@ check("...and the site stops holding inputs bad, which is what ends the "
       _c57.inputs_bad_since is None and _c57.inputs_ok is True)
 _ev57 = [e for e in _c57.events if "STALE" in e]
 _msgs57 = [r.getMessage() for r in _LOGREC]
-_rel57 = [m for m in _msgs57 if "STALE_WITHDRAWN" in m]
+_rel57 = [m for m in _msgs57 if "is used again and rechecked" in m]
 print(f"    events: {[e.split(' ', 1)[1][:44] for e in _ev57]}")
 check("⚠️ A LATCH THAT LETS GO ON A TIMER AND SAYS NOTHING IS ONE NO OPERATOR "
       "CAN AUDIT - and this one is withdrawing a SITE STOP. Both edges reach "
       "the event log and the logger, in order, naming the unit",
       len(_ev57) == 2 and "STALE inverter-a" in _ev57[1]
       and "STALE WITHDRAWN inverter-a" in _ev57[0]
-      and len(_rel57) == 1 and "inverter-a" in _rel57[0])
+      and len(_rel57) == 1 and "inverter-a" in nth(_rel57, 0))
 check("⚠️ AND THE RELEASE LINE REFUSES TO CLAIM A RECOVERY, because none has "
       "happened: it says in its own words that nothing has been learned about "
       "the register, and it prints the value the register is STILL holding",
-      "NOTHING HAS BEEN LEARNED ABOUT THE REGISTER" in _rel57[0]
-      and f"still holding {A_FROZEN_W:+.0f}" in _rel57[0])
+      "used again" in nth(_rel57, 0) and "recovered" not in nth(_rel57, 0)
+      and f"reading {A_FROZEN_W:+.0f} W is used again and rechecked"
+      in nth(_rel57, 0))
 
 
 # --- 10h. the two sentences, as ORDERED PAIRS (habit 14) ---------------------
@@ -1595,25 +1603,25 @@ check("⚠️ AND THE RELEASE LINE REFUSES TO CLAIM A RECOVERY, because none has
 # could be transposed at zero bytes - 17.0 s and 250 W in the stale line's new
 # escape clause, and 250 W and 17.0 s again in the release note - so each is
 # asserted with its value embedded in its own literal position.
-_stale57 = [m for m in _msgs57 if "SAFETY-37" in m]
-print(f"    escape clause: ...{_stale57[0][-150:]}")
+_stale57 = [m for m in _msgs57
+            if "battery power reading stopped changing" in m]
+print(f"    escape clause: ...{nth(_stale57, 0)[-150:]}")
 check("⚠️ THE STALE LINE'S PROMISE IS NOW TRUE, AND IT IS PINNED AS AN ORDERED "
       "PAIR. It used to end 'It clears itself the moment the register reports "
       "a different value.' - which was FALSE, because the 0 W in the sentence "
       "before it is what stops the register being asked. The new clause names "
       "17 s in the TIME slot and 250 W in the POWER slot; swapped, this goes "
       "red",
-      f"failing that {BOUNDS['batt'].release_s:.0f} s after the standing "
-      f"command falls below {BOUNDS['batt'].move_w:.0f} W" in _stale57[0])
+      f"or {BOUNDS['batt'].release_s:.0f} s after the command drops below "
+      f"{BOUNDS['batt'].move_w:.0f} W" in nth(_stale57, 0))
 check("...and the release note names 250 W in the POWER slot and 17 s in the "
       "TIME slot, in that order, which is the reverse arrangement of the same "
       "two numbers",
-      f"sat below {BOUNDS['batt'].move_w:.0f} W for "
-      f"{BOUNDS['batt'].release_s:.0f} s" in _rel57[0])
+      f"stayed below {BOUNDS['batt'].move_w:.0f} W for "
+      f"{BOUNDS['batt'].release_s:.0f} s" in nth(_rel57, 0))
 check("...and the 35.0 s the register is re-graded over is named in the note "
       "too, because it is what the operator is being told to wait out",
-      f"re-graded over a fresh {BOUNDS['batt'].unchanged_s:.0f} s window"
-      in _rel57[0])
+      f"rechecked over {BOUNDS['batt'].unchanged_s:.0f} s" in nth(_rel57, 0))
 check("⚠️ AND THE DIAGNOSIS HALF IS SAFETY-56'S AND HAS NOW BEEN REWRITTEN, "
       "WHICH IS WHAT THIS CHECK WAS FOR. It used to require 'battery-power "
       "register is not following its own command' to still be present, so "
@@ -1622,9 +1630,10 @@ check("⚠️ AND THE DIAGNOSIS HALF IS SAFETY-56'S AND HAS NOW BEEN REWRITTEN,
       "requirement is now the inverse: the accusation is GONE from this line "
       "and part 11 grades what replaced it. The escape clause above is "
       "SAFETY-57's and is untouched by it",
-      "battery-power register is not following its own command"
+      present(nth(_stale57, 0))
+      and "battery-power register is not following its own command"
       not in _stale57[0]
-      and "did not move under a command that did" in _stale57[0])
+      and "stopped changing" in _stale57[0])
 check("...and a re-trip's reason names the TWO durations separately, each "
       "beside its own value, because after a release the verdict's window and "
       "the register's own unchanged time are different facts",
@@ -1635,9 +1644,8 @@ check("...and a re-trip's reason names the TWO durations separately, each "
           [f.submit(A_FROZEN_W, 1300.0, float(t)) for t in range(80, 130)],
           f.stale and f.releases == 1
           and "unchanged for 92 s" in f.reason
-          and "the 35 s window this verdict rests on opened when the previous "
-              "one was withdrawn" in f.reason
-          and "graded 2 times" in f.reason)[-1])(
+          and "checked 2 times over a 35 s window since the last stop was "
+              "withdrawn" in f.reason)[-1])(
               Freshness(BOUNDS["batt"])))
 
 
@@ -1678,11 +1686,11 @@ print("11. SAFETY-56: the sentence this gate can honestly say")
 # story. Every boundary is derived in part 10b from the register's own longest
 # hold; nothing here is typed.
 _S56_CMDS_HELD = sorted({_D.held_at(_sp, t)
-                         for t in range(int(_HOLD_FROM), int(_PARK))})
+                         for t in range(int(_HOLD_FROM), int(_PARK) if present(_PARK) else 0)})
 _S56_SOC_HELD = sorted({_D.held_at(_soc, t)
-                        for t in range(int(_HOLD_FROM), int(_HUMAN))})
-_S56_CHARGE_T, _S56_CHARGE_W = next((t, v) for t, v in _sp
-                                    if t > _PARK and v < 0.0)
+                        for t in range(int(_HOLD_FROM), int(_HUMAN) if present(_HUMAN) else 0)})
+_S56_CHARGE = first(((t, v) for t, v in _sp if t > _PARK and v < 0.0), "no charge command")
+_S56_CHARGE_T, _S56_CHARGE_W = _S56_CHARGE[0], _S56_CHARGE[1]
 _S56_AFTER = _D.held_at(_bt, _REG_MOVES + 5.0)
 print(f"    during the 850 s hold: commands {_S56_CMDS_HELD} W, "
       f"SoC {_S56_SOC_HELD} %, register {_HOLD_W:+.0f} W")
@@ -1695,7 +1703,7 @@ check("11a. ⚠️ THE OLD DIAGNOSIS WAS FALSE ON THE ONE SITE IT WAS EVER "
       "-3 W. Then the first CHARGE command arrives and it moves within ONE "
       "17.0 s obligation window. A register that answers a reversed command in "
       "one window had not stopped reporting; what would not move was the PACK",
-      all(v > 0.0 for v in _S56_CMDS_HELD)
+      bool(_S56_CMDS_HELD) and all(v > 0.0 for v in _S56_CMDS_HELD)
       and min(_S56_CMDS_HELD) == 260.0 and max(_S56_CMDS_HELD) == 1060.0
       and _S56_SOC_HELD == [11.0] and _HOLD_W == -3.0
       and _S56_CHARGE_W < 0.0
@@ -1711,7 +1719,7 @@ check("...and the gate was RIGHT to fire anyway, which is why this card touches
       and BOUNDS["batt"].move_w == MOVE_W
       and BOUNDS["batt"].release_s == F.BATT_OBLIGED_S
       and hms(_TRIP) == "10:52:00" and _f_after.releases == 1
-      and next(r for r in _rows_after if r[0] == _TRIP)[1] is True)
+      and first(r for r in _rows_after if r[0] == _TRIP)[1] is True)
 
 # --- 11b. two worlds, one published stream, one verdict ----------------------
 # ⚠️ GROUND TRUTH IS WRITTEN DOWN, NOT DERIVED FROM THE PUBLISHED STREAM
@@ -1790,8 +1798,8 @@ check("...and the two runs were driven at 50 % and 11 % SoC and the sentence "
 # bytes, and "the register may be unable to comply / the source may have
 # stopped reporting reality" is a different and wrong claim.
 _S56_EXPLANATIONS = [
-    ("DEAD", "the register may have stopped reporting reality"),
-    ("REFUSED", "the source may be unable to comply with the command"),
+    ("DEAD", "reading may have stopped"),
+    ("REFUSED", "battery may be unable to follow the command"),
 ]
 # ⚠️ WHAT THE THREE SENTENCES USED TO ASSERT. Each is a claim about the
 # REGISTER or about the ENTITY, and 11a measured the register to be alive on
@@ -1803,7 +1811,13 @@ _S56_ACCUSATIONS = [
     ("app/main.py _read_unit()", "register is not following its own command"),
     ("app/main.py checks()", f"{_BATT_ENT} is missing or not numeric"),
 ]
-_log56 = [r.getMessage() for r in _LOGREC[_S56_LOG0:] if "SAFETY-37" in r.getMessage()]
+_log56 = [r.getMessage() for r in _LOGREC[_S56_LOG0:]
+          if "battery power reading stopped changing" in r.getMessage()]
+# UX-11: the ERROR line quotes the code, and the reason itself is on the DEBUG
+# line logged beside it.
+_dbg56 = [r.getMessage() for r in _LOGREC[_S56_LOG0:]
+          if r.levelno == logging.DEBUG
+          and r.getMessage().startswith("Evidence for ")] or [""]
 
 
 def _s56_row(c):
@@ -1816,11 +1830,12 @@ def _s56_row(c):
     a red with no name attached, which reads like broken infrastructure and gets
     retried rather than read. Measured: 0 named reds before, 2 after.
     """
-    hits = [r for r in c.checks() if r["text"].startswith("battery power")]
-    if len(hits) != 1:
-        return {"ok": None, "warn": None,
-                "text": f"<NO SINGLE `battery power` ROW: {len(hits)} found>"}
-    return hits[0]
+    hits = [r for r in c.checks() if r.get("id") == "sensor"
+            and r["text"].startswith(messages.LABEL_BATTERY)]
+    if len(hits) == 1:
+        return hits[0]
+    return {"ok": None, "warn": None,
+            "text": f"<NO SINGLE `battery power` ROW: {len(hits)} found>"}
 
 
 _row56_ref = _s56_row(_c56_ref)
@@ -1845,7 +1860,7 @@ check("PRECONDITION: all four operator-facing surfaces were really produced by "
       "two are the same string, which is 11b again on the log surface",
       len(_log56) == 2 and _log56[0] == _log56[1]
       and all(len(s) > 30 for s in _S56_SURFACES.values())
-      and _r56_ref in _log56[-1])
+      and _log56[-1].endswith(": STALE_READING.") and _r56_ref in _dbg56[-1])
 _idx56 = [_r56_ref.find(t) for _w, t in _S56_EXPLANATIONS]
 check(f"11c. BOTH EXPLANATIONS ARE NAMED, AND IN THAT ORDER: "
       f"{_S56_EXPLANATIONS[0][1]!r} at {_idx56[0]} then "
@@ -1857,7 +1872,7 @@ check(f"11c. BOTH EXPLANATIONS ARE NAMED, AND IN THAT ORDER: "
 check("...and the sentence says in its own words that it CANNOT choose, rather "
       "than leaving two explanations side by side for a reader to rank - an "
       "operator who reads a list picks the first item",
-      "CANNOT TELL THEM APART" in _r56_ref)
+      "this check cannot tell which" in _r56_ref)
 # ⚠️ THE POSITIVE CONTROL FOR THE `not any(...)` BELOW, AND IT IS NOT OPTIONAL:
 # a quantifier over an empty list is True, and so is one over three literals
 # with a typo in each. These are the three sentences as 0.10.1 SHIPPED them,
@@ -1926,22 +1941,25 @@ check("⚠️ AND THE VERDICT IS UNCHANGED BY THIS CARD - both rows are still "
       _row56_ref["ok"] is False and _row56_ref["warn"] is False
       and _row56_abs["ok"] is False and _row56_abs["warn"] is False
       and _row56_ref["text"] == _row56_abs["text"])
-check("...and what it says instead is the observation plus BOTH causes, with "
-      f"{_BATT_ENT} in its own slot - `label` and `entity` are two "
-      f"interpolations in one sentence and swapping them costs zero bytes, so "
-      f"the literal around each is pinned (habit 14)",
-      f"battery power: no usable value this cycle from {_BATT_ENT} - and this "
-      f"row cannot tell which of two things that is" in _row56_ref["text"]
-      and "the entity is missing or not numeric" in _row56_ref["text"]
-      and "a number that this controller is withholding" in _row56_ref["text"])
+# UX-08: the row names the setting by its label, never the entity id
+# (STYLE.md), so there is no second interpolation left to transpose.
+check("...and what it says instead is the observation plus BOTH causes, under "
+      "its own label, and the check to make before replacing the sensor - with "
+      f"no entity id ({_BATT_ENT}) on the page row",
+      _row56_ref["text"].startswith(f"{messages.LABEL_BATTERY}: no usable "
+                                    f"reading")
+      and "may be missing" in _row56_ref["text"]
+      and "held back as too old" in _row56_ref["text"]
+      and "Developer Tools before replacing it" in _row56_ref["text"]
+      and _BATT_ENT not in _row56_ref["text"])
 check("⚠️ AND THE DISCRIMINATOR IT POINTS AT EXISTS AND IS SELECTIVE, which is "
       "why the row does not need to ask `batt_fresh.stale` itself: `checks()` "
       "carries a STALE_READING row in REFUSED and NONE in ABSENT, so 'is that "
       "row below?' answers the question this one declines to answer. A row "
       "that pointed at a surface present in both states would be worse than "
       "the accusation it replaced",
-      any("STALE_READING" in r["text"] for r in _c56_ref.checks())
-      and not any("STALE_READING" in r["text"] for r in _c56_abs.checks()))
+      any("stopped changing" in r["text"] for r in _c56_ref.checks())
+      and not any("stopped changing" in r["text"] for r in _c56_abs.checks()))
 check("...and the row's wording is NOT shared with the log line's, which is a "
       "design choice rather than an omission: the two sentences have no clause "
       "in common longer than the word 'entity', because one explains a "
@@ -1950,7 +1968,7 @@ check("...and the row's wording is NOT shared with the log line's, which is a "
       "other caller does not need",
       _S56_EXPLANATIONS[0][1] not in _row56_ref["text"]
       and _S56_EXPLANATIONS[1][1] not in _row56_ref["text"]
-      and "no usable value this cycle" not in _r56_ref)
+      and "no usable reading" not in _r56_ref)
 
 # --- 11e. what part 11 does NOT grade, with its shape (habit 13) -------------
 # * It does not show the live episode was a BMS refusal beyond doubt. 11a
diff --git a/goodwe_controller/test_haentities.py b/goodwe_controller/test_haentities.py
new file mode 100644
index 0000000..6db27e8
--- /dev/null
+++ b/goodwe_controller/test_haentities.py
@@ -0,0 +1,248 @@
+"""UX-13 P0: the entity list for the picker.  `python3 test_haentities.py`
+
+`GET ha/entities` reads Home Assistant's states through the add-on's own
+session (hass.states()) and must never fail the page: part 1 drives the real
+HomeAssistant client against a local server that answers 502, garbage, the
+wrong shape, nothing at all, or too slowly. Part 2 checks the 30 s cache and
+what is served while Home Assistant is down. Part 3 serves the real route.
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import asyncio
+import json
+import logging
+import sys
+import time
+
+from aiohttp import ClientSession, web as aioweb
+
+from app import hass as H, haentities as E, web
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+STATES = [
+    {"entity_id": "sensor.grid", "state": "812",
+     "attributes": {"friendly_name": "Grid power", "unit_of_measurement": "W",
+                    "device_class": "power"}},
+    {"entity_id": "sensor.soc", "state": "54",
+     "attributes": {"friendly_name": "Battery level", "unit_of_measurement": "%",
+                    "device_class": "battery"}},
+    {"entity_id": "number.setpoint", "state": "0", "attributes": {}},
+    {"entity_id": "sensor.pv_kw", "state": "1.2",
+     "attributes": {"unit_of_measurement": "kW"}},
+    {"no_entity_id": True},
+]
+
+
+async def serve(handler):
+    app = aioweb.Application()
+    app.router.add_get("/api/states", handler)
+    runner = aioweb.AppRunner(app)
+    await runner.setup()
+    site = aioweb.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    return runner, site._server.sockets[0].getsockname()[1]
+
+
+async def read_with(handler, timeout_s=10):
+    runner, port = await serve(handler)
+    H.CORE_API, H.STATES_TIMEOUT_S = f"http://127.0.0.1:{port}/api", timeout_s
+    try:
+        async with ClientSession() as session:
+            t0 = time.monotonic()
+            got = await H.HomeAssistant(session, "token").states()
+            read_with.took = time.monotonic() - t0
+            return got
+    finally:
+        await runner.cleanup()
+
+
+async def ok(_r):
+    return aioweb.json_response(STATES)
+
+
+async def bad_gateway(_r):
+    return aioweb.Response(status=502)
+
+
+async def garbage(_r):
+    return aioweb.Response(text="<html>", content_type="application/json")
+
+
+async def not_a_list(_r):
+    return aioweb.json_response({"message": "hi"})
+
+
+async def slow(_r):
+    await asyncio.sleep(2)
+    return aioweb.json_response(STATES)
+
+
+async def closed_port():
+    H.CORE_API = "http://127.0.0.1:9/api"
+    async with ClientSession() as session:
+        return await H.HomeAssistant(session, "token").states()
+
+
+print("1. hass.states() answers None, never an exception")
+check("a normal answer is the state list", asyncio.run(read_with(ok)) == STATES)
+for name, handler in (("502 while HA restarts", bad_gateway),
+                      ("a body that is not JSON", garbage),
+                      ("JSON that is not a list", not_a_list)):
+    check(f"{name} -> None", asyncio.run(read_with(handler)) is None)
+class _Lines(logging.Handler):
+    def __init__(self):
+        super().__init__()
+        self.lines = []
+
+    def emit(self, record):
+        if record.levelno >= logging.WARNING:
+            self.lines.append(record.getMessage())
+
+
+_lines = _Lines()
+logging.getLogger().addHandler(_lines)
+check("an answer slower than the timeout -> None, at the timeout",
+      asyncio.run(read_with(slow, timeout_s=0.3)) is None
+      and read_with.took < 1.0)
+# UX-13 P1 test finding (c): a timeout's own text is empty, which left
+# "Reading the entity list failed: " with no reason.
+check("...and its WARNING line gives the reason, not an empty one "
+      f"({_lines.lines})", any(
+          x == "Reading the entity list failed: no answer within 0.3 seconds."
+          for x in _lines.lines)
+      and not any(x.rstrip().endswith("failed:") for x in _lines.lines))
+logging.getLogger().removeHandler(_lines)
+check("no server at all -> None", asyncio.run(closed_port()) is None)
+check("the timeout for the list is the same 10 s as every other read",
+      "STATES_TIMEOUT_S = 10 " in open(H.__file__, encoding="utf-8").read())
+
+
+class FakeHass:
+    def __init__(self):
+        self.answer, self.reads = STATES, 0
+
+    async def states(self):
+        self.reads += 1
+        await asyncio.sleep(0.01)
+        return self.answer
+
+
+class Clock:
+    def __init__(self):
+        self.t = 1000.0
+
+    def __call__(self):
+        return self.t
+
+
+print("\n2. the cache, and Home Assistant being down")
+_h, _c = FakeHass(), Clock()
+_cache = E.EntityCache(_h, clock=_c)
+
+
+async def burst():
+    return await asyncio.gather(*(_cache.payload("power") for _ in range(5)))
+
+
+_p = asyncio.run(burst())
+check("five pickers opening at once cost one read of Home Assistant",
+      _h.reads == 1 and all(x == _p[0] for x in _p))
+_ids = [r["entity_id"] for r in _p[0]["entities"]]
+check("power entities come first, then the rest, and a broken state is left "
+      f"out ({_ids})", _ids == ["sensor.grid", "sensor.pv_kw",
+                                "number.setpoint", "sensor.soc"]
+      and [r["match"] for r in _p[0]["entities"]] == [True, True, False, False])
+check("each row carries id, name, state, unit and device class",
+      _p[0]["entities"][0] == {"entity_id": "sensor.grid", "name": "Grid power",
+                               "state": "812", "unit": "W",
+                               "device_class": "power", "match": True})
+check("the kinds filter as the pickers need",
+      [r["entity_id"] for r in _p[0]["entities"]
+       if E.matches(r, "pct")] == ["sensor.soc"]
+      and [r["entity_id"] for r in _p[0]["entities"]
+           if E.matches(r, "number")] == ["number.setpoint"])
+_c.t += 10
+asyncio.run(_cache.payload())
+check("within 30 s the cached list is served", _h.reads == 1)
+check("peek() hands the validator the fresh list without a read",
+      set(_cache.peek()) == set(_ids) and _h.reads == 1)
+_h.answer = None
+_c.t += 30
+_down = asyncio.run(_cache.payload())
+check("Home Assistant down after a good read: the old list, marked old",
+      _h.reads == 2 and _down["available"] and _down["text"] == E.STALE_TEXT
+      and len(_down["entities"]) == 4 and _down["age_s"] >= 30)
+check("...and peek() then gives nothing, so no warning rests on an old list",
+      _cache.peek() is None)
+
+
+async def down_windows():
+    """One loop throughout: a contended asyncio.Lock binds to its loop."""
+    hass, clock = FakeHass(), Clock()
+    hass.answer = None
+    cache = E.EntityCache(hass, clock=clock)
+    counts = []
+    for step in (0, 1, 30):
+        clock.t += step
+        await asyncio.gather(*(cache.payload() for _ in range(5)))
+        counts.append(hass.reads)
+    return counts
+
+
+check("five polls while Home Assistant is down cost one read, the polls just "
+      "after wait for the next window, and that window tries once",
+      asyncio.run(down_windows()) == [1, 1, 2])
+_h2 = FakeHass()
+_h2.answer = None
+_empty = asyncio.run(E.EntityCache(_h2).payload("power"))
+check("Home Assistant down from the start: an empty list that says why",
+      _empty == {"available": False, "text": E.DOWN_TEXT, "entities": []})
+
+
+print("\n3. the route")
+
+
+class FakeController:
+    def __init__(self, hass):
+        self.hass, self.o = hass, {}
+
+
+async def route(hass, query=""):
+    app = web.build_app(FakeController(hass), selfcfg=object())
+    runner = aioweb.AppRunner(app)
+    await runner.setup()
+    site = aioweb.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    port = site._server.sockets[0].getsockname()[1]
+    try:
+        async with ClientSession() as s:
+            async with s.get(f"http://127.0.0.1:{port}/ha/entities{query}") as r:
+                return r.status, await r.json()
+    finally:
+        await runner.cleanup()
+
+
+_st, _body = asyncio.run(route(FakeHass(), "?kind=pct"))
+check("GET ha/entities?kind=pct answers 200 with the matching entity first",
+      _st == 200 and _body["entities"][0]["entity_id"] == "sensor.soc")
+_st, _body = asyncio.run(route(_h2))
+check("with Home Assistant down it still answers 200, with the reason",
+      _st == 200 and _body["available"] is False and _body["entities"] == [])
+check("the words shown are short and plain (STYLE: one sentence)",
+      all(len(t.split()) <= 12 and t.count(".") == 1
+          for t in (E.DOWN_TEXT, E.STALE_TEXT)))
+print(json.dumps(_body))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_home.py b/goodwe_controller/test_home.py
new file mode 100644
index 0000000..adfe652
--- /dev/null
+++ b/goodwe_controller/test_home.py
@@ -0,0 +1,654 @@
+"""UX-13 P1: the Home screen's `/status` and the page shell.  `python3 -B test_home.py`
+
+1. `/status` keeps every old field (`banner`, `level`, `rows`, `checks`,
+   `hint`, `events`) AND carries the structured half the Home screen reads:
+   `state`, `now`, `batteries`, `plan`, `attention`, `month_peak`, `control`.
+   Both are pinned here, by name and shape.
+2. The plan shows only what the add-on does today. Trading on price is the
+   verdict the control cycle would reach (the same `plan.arbitrage()` call),
+   drawn where the cheapest and dearest prices are, with kWh and € per block.
+   The monthly cycle, the peak limit and "follows the house" are the rest.
+3. Shadow mode says "would", a stopped site plans nothing, and a red row is an
+   alarm under "Needs attention".
+4. A fault in the Home view never costs the page its old rows.
+5. The page: served at `/` from app/static, no external file, relative URLs
+   only, every label resolves in app/ui_text, and the region year reaches
+   `config/model` for the P2 Settings screens.
+
+The STYLE scan of every Home sentence is test_messages.py part 8.
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import asyncio
+import io
+import json
+import os
+import re
+import sys
+from datetime import datetime, timedelta, timezone
+
+from aiohttp import ClientSession, web as aioweb
+
+from app import homeview, web
+from app.main import Controller
+from app.peakguard import PeakDecision
+from app.price import PricePoint, PriceProduct, PriceRead
+from app.static_tariff import TariffPlan
+from app.uimodel import REGION_PRESETS
+from named_absence import field, nth, present
+
+FLANDERS = REGION_PRESETS["flanders"]["taxes_eur_kwh"]
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+# --------------------------------------------------------------------------- #
+# Fixtures: a real Controller, with its readings set directly.
+# --------------------------------------------------------------------------- #
+class _Store:
+    def __init__(self):
+        self.data = {}
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def get(self, k, d=None):
+        return self.data.get(k, d)
+
+    def set_time(self, k, v):
+        self.data[k] = v.isoformat()
+
+    def get_time(self, k):
+        v = self.data.get(k)
+        return None if v is None else datetime.fromisoformat(v)
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, _v):
+        pass
+
+    def close(self):
+        pass
+
+
+class _Hass:
+    session = None
+    token = ""
+
+    async def limits(self, _e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def number(self, _e, invert=False):
+        return None
+
+    async def state(self, _e):
+        return None
+
+    async def set_number(self, _e, _v):
+        return True
+
+    async def call(self, *_a):
+        return True
+
+    async def states(self):
+        return []
+
+
+ONE = {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+       "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+       "meter_source": "off", "max_w": 5000, "shadow_mode": "off",
+       "maintenance_enabled": False}
+TWO = dict(ONE, inverters=[
+    {"name": "Battery A", "setpoint_entity": "number.a", "soc_entity":
+     "sensor.soc_a", "batt_entity": "sensor.batt_a", "max_w": 2500,
+     "capacity_kwh": 9.6},
+    {"name": "Battery B", "setpoint_entity": "number.b", "soc_entity":
+     "sensor.soc_b", "batt_entity": "sensor.batt_b", "max_w": 2500,
+     "capacity_kwh": 5.4}])
+
+# Sunday 27 September 2026, 11:40 in Brussels (09:40 UTC): the mockup's day.
+NOW = datetime(2026, 9, 27, 9, 40, tzinfo=timezone.utc)
+DAY0 = datetime(2026, 9, 26, 22, 0, tzinfo=timezone.utc)
+MOCK = [.24, .22, .21, .20, .21, .22, .24, .27, .26, .22, .18, .16, .15, .14,
+        .16, .19, .23, .28, .33, .36, .34, .29, .26, .24]
+
+
+def make(opts, *, soc=(62.0, 35.0), batt=(-2500.0, -300.0), grid=10.0,
+         auto=True, wrote=0.0):
+    """`wrote` is each inverter's last accepted power request (None: none yet)."""
+    c = Controller(dict(opts), _Hass(), _Store(), _Pub(), stop=asyncio.Event())
+    c.auto = auto
+    for i, inv in enumerate(c.inverters):
+        inv.soc, inv.batt = soc[i], batt[i]
+        inv.last_write = wrote
+        inv.dev_min, inv.dev_max = -5000.0, 5000.0
+    c.grid = grid
+    return c
+
+
+def provider_plan(prices=MOCK, day0=DAY0, days=2, provisional_from=None):
+    pts = []
+    for d in range(days):
+        for k, p in enumerate(prices):
+            start = day0 + timedelta(days=d, hours=k)
+            pts.append(PricePoint(start, p, provisional_from is not None
+                                  and start >= provisional_from))
+    return TariffPlan(PriceRead.series(tuple(pts), PriceProduct.DAY_AHEAD,
+                                       "generic_dayahead", NOW), None,
+                      "provider")
+
+
+def quiet_guard(projected_w=1240.0):
+    return PeakDecision(engaged=False, floor_w=None, ceiling_w=3500.0,
+                        ceiling_from="cap", projected_w=projected_w)
+
+
+def status(c, now=NOW):
+    s = c.status_payload()
+    # The status route builds at wall-clock time; rebuild the structured half
+    # at the fixture's instant so the day and the hours are the mockup's.
+    s.update(homeview.build(c, level=s["level"], checks=s["checks"], now=now))
+    return s
+
+
+# --------------------------------------------------------------------------- #
+print("1. /status: the old fields stay, the structured half is added")
+# --------------------------------------------------------------------------- #
+c1 = make(ONE, soc=(62.0,), batt=(960.0,), grid=800.0)
+s1 = c1.status_payload()
+OLD = {"banner", "level", "rows", "checks", "hint", "events"}
+NEW = {"state", "now", "batteries", "plan", "attention", "month_peak",
+       "control"}
+check(f"every old field is still there, with its old type ({sorted(OLD)})",
+      OLD <= set(s1) and isinstance(s1["rows"], list)
+      and all(len(r) == 2 for r in s1["rows"])
+      and all({"ok", "warn", "text"} <= set(r) for r in s1["checks"])
+      and isinstance(s1["banner"], str) and s1["level"] in ("ok", "warn", "bad")
+      and isinstance(s1["events"], list))
+check(f"...and the structured half is added beside them ({sorted(NEW)})",
+      NEW <= set(s1) and "home_error" not in s1)
+check("...and it is JSON, as the route serves it", json.loads(json.dumps(s1))
+      == json.loads(json.dumps(s1)))
+check("`state` names the kind, the pill word, the control row and a sub-line",
+      set(s1["state"]) == {"kind", "pill", "ran", "sub"}
+      and s1["state"]["kind"] == "running")
+check("`now` carries the four tiles in W and a plain line for each",
+      {"solar_w", "house_w", "grid_w", "batt_w", "has_solar", "lines"}
+      <= set(s1["now"])
+      and set(s1["now"]["lines"]) == {"solar", "house", "grid", "batt"}
+      and s1["now"]["grid_w"] == 800.0 and s1["now"]["batt_w"] == 960.0)
+_nh = homeview.now_block(grid_w=-3000.0, pv_w=1000.0, batt_w=1500.0,
+                         has_solar=True, shadow=False)
+_nz = homeview.now_block(grid_w=-1030.0, pv_w=1000.0, batt_w=0.0,
+                         has_solar=True, shadow=False)
+_np = homeview.now_block(grid_w=800.0, pv_w=1000.0, batt_w=-300.0,
+                         has_solar=True, shadow=False)
+check("House = grid (+ import) + solar + battery (+ giving): 800 + 1000 - 300 "
+      "= 1500 W",
+      _np["house_w"] == 1500.0 and _np["lines"]["house"] == "Using")
+check("...a sum below zero is not shown as a positive figure: 0 W inside "
+      "the idle band, and no figure beyond it",
+      _nz["house_w"] == 0.0 and _nh["house_w"] is None
+      and _nh["lines"]["house"] == homeview.tile_house(None, True, True))
+check("...and with no solar reading the house figure is NOT invented: it is "
+      "None and the tile says why",
+      s1["now"]["house_w"] is None and s1["now"]["has_solar"] is False
+      and s1["now"]["lines"]["house"] == homeview.tile_house(None, False))
+_b = s1["batteries"][0]
+check("`batteries[]` has level, power, state, mode, the now line and why",
+      {"name", "level_pct", "power_w", "state", "mode", "now", "why",
+       "capacity_kwh", "stored_kwh", "maintenance"} <= set(_b)
+      and _b["level_pct"] == 62.0 and _b["state"] == "giving"
+      and _b["now"] == "Giving 1.0 kW now.")
+_p = s1["plan"]
+check("`plan` carries the verdict, the prices, the runs, the lines and "
+      "the region",
+      {"verdict", "head", "prices", "runs", "lines", "now_h", "hours",
+       "price_line", "tomorrow_line", "region", "region_line"} <= set(_p)
+      and len(_p["prices"]) in (23, 24, 25))
+check("`attention[]` has severity, title, body and docs; `month_peak` and "
+      "`control` are there",
+      all({"severity", "title", "body", "docs"} <= set(a)
+          for a in s1["attention"])
+      and {"month", "limit_w", "peak_w", "pct", "period_w", "state", "line"}
+      <= set(s1["month_peak"])
+      and {"running", "shadow", "text", "maintenance", "docs_url"}
+      <= set(s1["control"]))
+
+# --------------------------------------------------------------------------- #
+print("\n2. the plan is what the add-on actually does")
+# --------------------------------------------------------------------------- #
+s_house = status(make(TWO))
+check("with trading off and no cycle due, each battery follows the house "
+      "from now to the end of the day, and nothing else is drawn",
+      [r["kind"] for r in s_house["plan"]["runs"]] == ["house", "house"]
+      and s_house["plan"]["verdict_key"] == "house"
+      and all(r["end_h"] == 24.0 and abs(r["start_h"] - 11 - 40 / 60) < 0.01
+              for r in s_house["plan"]["runs"])
+      and s_house["plan"]["runs"][0]["to"] == "24:00")
+
+ARB = dict(TWO, arbitrage_enabled=True, cycle_cost_threshold_eur=0.05)
+c_arb = make(ARB)
+c_arb.tariff_plan, c_arb.tariff_at = provider_plan(), NOW
+c_arb.peak_guard = quiet_guard()
+s_arb = status(c_arb)
+_runs = s_arb["plan"]["runs"]
+_grid = [r for r in _runs if r["kind"] == "grid"]
+_give = [r for r in _runs if r["kind"] == "give"]
+check("trading on price: a charge block at the cheapest hour (13:00) and a "
+      "give block at the dearest (19:00), on each battery",
+      [(r["battery"], r["from"], r["to"]) for r in _grid]
+      == [(0, "13:00", "14:00"), (1, "13:00", "14:00")]
+      and [(r["battery"], r["from"], r["to"]) for r in _give]
+      == [(0, "19:00", "20:00"), (1, "19:00", "20:00")]
+      and s_arb["plan"]["verdict_key"] == "trade")
+check("...placed where the control cycle's own verdict puts them: the same "
+      "plan.arbitrage() call on the same plan",
+      c_arb.fresh_tariff_plan(NOW).arbitrage(
+          peak_guard_active=False, min_spread_eur_kwh=0.05,
+          uncertainty=frozenset({__import__("app.price", fromlist=["x"])
+                                 .Uncertainty.NO_WEATHER}))
+      .match(allowed=lambda v: (v.cheapest.start, v.dearest.start),
+             refused=lambda v: None)
+      == (DAY0 + timedelta(hours=13), DAY0 + timedelta(hours=19)))
+# Battery A: 2.5 kW for 1 h = 2.5 kWh; room to the 95 % ceiling is 33 % of
+# 9.6 kWh = 3.17 kWh, so 2.5. Battery B: 60 % of 5.4 = 3.24, so 2.5.
+check("each block carries kWh and €: charging is capped by the battery's own "
+      "rating and the room its level leaves, € = kWh x that hour's price",
+      [r["kwh"] for r in _grid] == [2.5, 2.5]
+      and [r["eur"] for r in _grid] == [0.35, 0.35]
+      and [r["eur_kwh"] for r in _grid] == [0.14, 0.14]
+      and "2.5 kWh" in _grid[0]["what"] and "€0.14" in _grid[0]["why"]
+      and "€0.35" in _grid[0]["amount"])
+# Giving at 19:00 comes after the 13:00 charge, so each battery may give what
+# it will hold then: B is at 35 % + 2.5 kWh of 5.4 = 81 %, and 81 - 20 = 61 %
+# of 5.4 = 3.3 kWh, so 2.5 (an upper bound, like every amount here).
+check("...and giving is capped by what each battery holds above arbitrage's "
+      "floor after the charge before it",
+      [r["kwh"] for r in _give] == [2.5, 2.5]
+      and [r["eur"] for r in _give] == [0.9, 0.9])
+
+
+def trade(soc, prices=MOCK, provisional_from=None, now=NOW, opts=ARB):
+    c = make(opts, soc=soc)
+    c.tariff_plan = provider_plan(prices, provisional_from=provisional_from)
+    c.tariff_at, c.peak_guard = now, quiet_guard()
+    s = status(c, now=now)
+    return ([(r["kind"], r["battery"], r["kwh"]) for r in s["plan"]["runs"]
+             if r["kind"] in ("grid", "give")], s["plan"]["lines"])
+
+
+# Review of #144: only what arbitrage.decide() would still do is drawn.
+_t, _l = trade((96.0, 35.0))
+check("a battery at arbitrage's ceiling gets no charge block, not "
+      "'Charges up to 0.0 kWh'", ("grid", 0, 0.0) not in _t
+      and [k for k in _t if k[0] == "grid"] == [("grid", 1, 2.5)])
+# 20:00 local: the dearest (19:00) is over; tomorrow's charge is a line. Put
+# the dearest later today instead, with the emptiest pack at the floor.
+_late = MOCK[:22] + [.40, .24]
+_t, _l = trade((62.0, 20.0), prices=_late, now=NOW + timedelta(hours=8))
+_t2, _l2 = trade((62.0, 35.0), prices=_late, now=NOW + timedelta(hours=8))
+check("no give block while the emptiest battery is at arbitrage's floor: "
+      "the cycle's sale is graded on the emptiest pack (at 35 % both give)",
+      not [k for k in _t if k[0] == "give"]
+      and [k[:2] for k in _t2] == [("give", 0), ("give", 1)])
+_t, _l = trade((62.0, 35.0), prices=[x - 0.5 for x in MOCK])
+check("no give block at a negative price (the cycle refuses that sale)",
+      not [k for k in _t if k[0] == "give"]
+      and [k for k in _t if k[0] == "grid"])
+# Running, a missing level is a red row and the site is held. In shadow mode
+# the plan is still drawn, so this is where the level gate shows.
+_t, _l = trade((None, 35.0), opts=dict(ARB, shadow_mode="on"))
+check("with a battery level unknown the cycle does not trade, so nothing is "
+      "drawn and a line says why (shadow mode, which still plans)",
+      _t == [] and homeview.line_no_trade("no_level") in _l)
+_t, _l = trade((62.0, 35.0), provisional_from=DAY0)
+check("a plan with no published prices yet says so, not 'the price gap is "
+      "too small'",
+      _t == [] and homeview.line_no_trade("not_firm") in _l
+      and homeview.line_no_trade("not_worth") not in _l)
+check("the price bars are today's 24 hours, from the real series, with the "
+      "cheap and expensive thirds marked",
+      [b["eur_kwh"] for b in s_arb["plan"]["prices"]] == MOCK
+      and s_arb["plan"]["prices"][13]["kind"] == "cheap"
+      and s_arb["plan"]["prices"][19]["kind"] == "dear"
+      and s_arb["plan"]["prices"][0]["kind"] == "mid"
+      and s_arb["plan"]["prices"][13]["label"] == "13:00")
+check("the price line names the price now, today's lowest and highest, and "
+      "that tomorrow's prices are in",
+      s_arb["plan"]["price_line"] == ("Price now €0.16 per kWh, all in. "
+                                      "Today: lowest €0.14 at 13:00, "
+                                      "highest €0.36 at 19:00.")
+      and s_arb["plan"]["tomorrow_line"] == "Tomorrow's prices are in.")
+
+c_late = make(ARB)
+c_late.tariff_plan, c_late.tariff_at = provider_plan(), NOW
+c_late.peak_guard = quiet_guard()
+s_late = status(c_late, now=NOW + timedelta(hours=9))    # 20:40 local
+check("a block whose hour is over is not drawn: at 20:40 no trade is left "
+      "today",
+      not [r for r in s_late["plan"]["runs"] if r["kind"] in ("grid", "give")])
+
+c_peak = make(ARB)
+c_peak.tariff_plan, c_peak.tariff_at = provider_plan(), NOW
+c_peak.peak_guard = PeakDecision(engaged=True, floor_w=800.0,
+                                 ceiling_w=3500.0, ceiling_from="cap",
+                                 projected_w=3900.0)
+s_peak = status(c_peak)
+check("while the peak limit holds, the verdict refuses as the cycle does: no "
+      "trade block, a plain line, and a peak block for this 15-minute period",
+      not [r for r in s_peak["plan"]["runs"] if r["kind"] in ("grid", "give")]
+      and homeview.line_no_trade("peak") in s_peak["plan"]["lines"]
+      and [(r["from"], r["to"]) for r in s_peak["plan"]["runs"]
+           if r["kind"] == "peak"] == [("11:30", "11:45"), ("11:30", "11:45")])
+
+c_pk = make(ARB)
+c_pk.p1_enabled = True        # the peak line is shown where P1 runs
+c_pk.tariff_plan, c_pk.tariff_at = provider_plan(), NOW
+c_pk.peak_guard = PeakDecision(engaged=False, floor_w=None, ceiling_w=4200.0,
+                               ceiling_from="month_peak", projected_w=1240.0)
+s_pk = status(c_pk)
+check("the plan's peak line names the guard's ceiling, which is this month's "
+      "peak once it is above the limit",
+      homeview.line_peak_limit(4200.0, False) in s_pk["plan"]["lines"]
+      and s_pk["month_peak"]["line"].endswith("above 4.2 kW."))
+
+c_blind = make(ARB)
+c_blind.tariff_plan, c_blind.tariff_at = provider_plan(), NOW
+s_blind = status(c_blind)          # meter_source off: the guard never runs
+check("with nothing measuring the 15-minute peak, trading is NOT drawn, as "
+      "the cycle refuses it (guard state None)",
+      not [r for r in s_blind["plan"]["runs"] if r["kind"] in ("grid", "give")]
+      and homeview.line_no_trade("not_covered") in s_blind["plan"]["lines"])
+
+c_flat = make(ARB)
+c_flat.tariff_plan, c_flat.tariff_at = provider_plan(prices=[.2] * 24), NOW
+c_flat.peak_guard = quiet_guard()
+s_flat = status(c_flat)
+check("a flat day: no trade, no cheap or expensive hour marked",
+      not [r for r in s_flat["plan"]["runs"] if r["kind"] in ("grid", "give")]
+      and {b["kind"] for b in s_flat["plan"]["prices"]} == {"mid"}
+      and homeview.line_no_trade("not_worth") in s_flat["plan"]["lines"])
+
+c_old = make(ARB)
+c_old.tariff_plan = provider_plan()
+c_old.tariff_at = NOW - timedelta(hours=3)                # past its max age
+c_old.peak_guard = quiet_guard()
+s_old = status(c_old)
+check("a stale plan is not traded on by the cycle, so it is not drawn",
+      not [r for r in s_old["plan"]["runs"] if r["kind"] in ("grid", "give")])
+
+MAINT = dict(TWO, maintenance_enabled=True, maintenance_start_hour=12)
+c_m = make(MAINT)
+s_m = status(c_m)
+_cyc = [r for r in s_m["plan"]["runs"] if r["kind"] == "cycle"]
+check("a monthly cycle due today is drawn on ONE battery, at the start hour "
+      "the cycle uses (12 UTC is 14:00 here), and the other one waits",
+      len(_cyc) == 1 and field(nth(_cyc), "from") == "14:00"
+      and s_m["plan"]["verdict_key"] == "cycle"
+      and any("waits its turn" in x for x in s_m["plan"]["lines"]))
+check("...with its duration from the battery's capacity and the cycle's rates "
+      "and hold time",
+      present(nth(_cyc)) and _cyc[0]["amount"].startswith("Takes about ")
+      and _cyc[0]["end_h"] > _cyc[0]["start_h"] + 2)
+c_m.maints[0].store.set("phase", "drain")
+s_md = status(c_m)
+check("a cycle under way is drawn from now, and the battery's now line says "
+      "so",
+      [r["from"] for r in s_md["plan"]["runs"] if r["kind"] == "cycle"]
+      == ["11:40"]
+      and s_md["batteries"][0]["now"] == "Monthly cycle: emptying."
+      and any("Battery B waits its turn" in x for x in s_md["plan"]["lines"]))
+
+# --------------------------------------------------------------------------- #
+print("\n3. shadow mode, a stopped site, an alarm")
+# --------------------------------------------------------------------------- #
+c_sh = make(dict(ARB, shadow_mode="on"))
+c_sh.tariff_plan, c_sh.tariff_at = provider_plan(), NOW
+c_sh.peak_guard = quiet_guard()
+s_sh = status(c_sh)
+_texts = [r["what"] for r in s_sh["plan"]["runs"]] + [s_sh["plan"]["head"]]
+check("shadow: the state is shadow, the battery tile is held at 0 W, and "
+      "every block and the head say 'would'",
+      s_sh["state"]["kind"] == "shadow"
+      and s_sh["now"]["lines"]["batt"] == "Held at 0 W"
+      and all("ould" in x for x in _texts)
+      and s_sh["plan"]["head"].startswith("Shadow mode:"))
+check("...and 'Shadow mode is on' is the first item under Needs attention",
+      s_sh["attention"][0]["title"] == homeview.ATTN_SHADOW
+      and s_sh["attention"][0]["severity"] == "info")
+check("...and each battery's now line says it is held at 0 W",
+      all(b["now"].startswith("Held at 0 W.") for b in s_sh["batteries"]))
+
+s_stop = status(make(TWO, auto=False))
+check("stopped: nothing is planned and the head says so",
+      s_stop["plan"]["runs"] == [] and s_stop["state"]["kind"] == "stopped"
+      and s_stop["plan"]["verdict_key"] == "stopped"
+      and s_stop["control"]["running"] is False
+      and all(b["now"] == "Held at 0 W while control is stopped."
+              for b in s_stop["batteries"]))
+
+c_al = make(ONE, soc=(62.0,), batt=(0.0,))
+c_al.inverters[0].sign_wd.tripped = True
+s_al = c_al.status_payload()
+_red = [a for a in s_al["attention"] if a["severity"] == "alarm"]
+check("an alarm: level bad, state alarm, and the red row is the first item "
+      "under Needs attention",
+      s_al["level"] == "bad" and s_al["state"]["kind"] == "alarm"
+      and _red and s_al["attention"][0] is _red[0]
+      and _red[0]["title"] == homeview.ATTN_TITLES["direction"])
+check("...and nothing is planned while every inverter is held at 0 W",
+      s_al["plan"]["runs"] == [] and s_al["plan"]["verdict_key"] == "held")
+_rows = [r for r in s_al["checks"] if not r["ok"] and not r["warn"]]
+check("...and every red, amber and settling row reaches Needs attention with "
+      "its own sentence as the body, and no green row does",
+      [a["body"] for a in homeview.attention(s_al["checks"])]
+      == [r["text"] for r in s_al["checks"] if not r["ok"] and not r["warn"]]
+      + [r["text"] for r in s_al["checks"] if not r["ok"] and r["warn"]]
+      + [r["text"] for r in s_al["checks"] if r["ok"] and r["warn"]])
+
+# UX-13 P1 test finding (a): the page said "Held at 0 W" about 15 s before
+# the inverter's power request reached 0 W. Until the last accepted request
+# is 0 W it says "Going to 0 W".
+c_al.inverters[0].last_write = 20.0
+s_go = homeview.build(c_al, level="bad", checks=s_al["checks"], now=NOW)
+c_al.inverters[0].last_write = 0.0
+s_at = homeview.build(c_al, level="bad", checks=s_al["checks"], now=NOW)
+check("an alarm while the last power request is still 20 W says 'Going to "
+      "0 W', and 'Held at 0 W' once 0 W was accepted",
+      s_go["plan"]["verdict"] == "Going to 0 W"
+      and s_go["batteries"][0]["now"] == "Going to 0 W until the alarm clears."
+      and s_go["plan"]["head"].startswith("Every inverter goes to 0 W")
+      and s_at["plan"]["verdict"] == "Held at 0 W"
+      and s_at["batteries"][0]["now"] == "Held at 0 W until the alarm clears.")
+c_sp = make(TWO, auto=False)
+c_sp.inverters[1].last_write = -1500.0
+s_sp = status(c_sp)
+s_new = status(make(TWO, auto=False, wrote=None))
+check("...and before any power request was accepted (just started, or every "
+      "write refused) it says 'Going to 0 W', not 'Held'",
+      [b["now"] for b in s_new["batteries"]]
+      == ["Going to 0 W while control is stopped."] * 2)
+check("...and a stop does the same, per battery",
+      [b["now"] for b in s_sp["batteries"]]
+      == ["Held at 0 W while control is stopped.",
+          "Going to 0 W while control is stopped."])
+
+# Finding (b): a quarter-hourly feed. The block's price and the price line
+# name the same 15-minute point, and nothing says "the list".
+_q = []
+for _k, _p in enumerate(MOCK):
+    for _m in range(4):
+        _q.append(PricePoint(DAY0 + timedelta(hours=_k, minutes=15 * _m),
+                             round(_p + (0.0 if _m != 3 else -0.01), 4), False))
+_q += [PricePoint(p.start + timedelta(days=1), p.eur_per_kwh, False)
+       for p in list(_q)]
+c_q = make(ARB)
+c_q.tariff_plan = TariffPlan(PriceRead.series(tuple(_q), PriceProduct.DAY_AHEAD,
+                                              "generic_dayahead", NOW), None,
+                             "provider")
+c_q.tariff_at = NOW
+c_q.peak_guard = quiet_guard()
+s_q = status(c_q)
+_grid = [r for r in s_q["plan"]["runs"] if r["kind"] == "grid"]
+_lo = min(_q[:96], key=lambda p: p.eur_per_kwh)
+check("quarter-hour prices: the charge block, its price and the price line's "
+      "lowest are the same 15-minute period",
+      _grid and _grid[0]["from"] == homeview.hhmm(_lo.start)
+      and _grid[0]["why"] == f"Lowest published price, €{_lo.eur_per_kwh:.2f} "
+                             "per kWh."
+      and f"Today: lowest €{_lo.eur_per_kwh:.2f} at "
+          f"{homeview.hhmm(_lo.start)}," in s_q["plan"]["price_line"]
+      and "the list" not in json.dumps(s_q["plan"]))
+check("...and the hour bar says it is an hour average",
+      s_q["plan"]["prices"][13]["points"] == 4
+      and '"plan.average_tip"' in io.open(os.path.join(
+          HERE, "app", "static", "app.js"), encoding="utf-8").read())
+
+# --------------------------------------------------------------------------- #
+print("\n4. a fault in the Home view never costs the page its rows")
+# --------------------------------------------------------------------------- #
+_real = homeview.build
+try:
+    homeview.build = lambda *a, **k: 1 / 0
+    s_err = make(ONE, soc=(50.0,), batt=(0.0,)).status_payload()
+finally:
+    homeview.build = _real
+check("the old fields are served and `home_error` says the rest is missing",
+      OLD <= set(s_err) and s_err.get("home_error") is True
+      and not (NEW & set(s_err)))
+
+# --------------------------------------------------------------------------- #
+print("\n5. the page")
+# --------------------------------------------------------------------------- #
+PAGE = web.page()
+JS = io.open(os.path.join(HERE, "app", "static", "app.js"),
+             encoding="utf-8").read()
+UI = json.load(io.open(os.path.join(HERE, "app", "ui_text", "en.json"),
+                       encoding="utf-8"))["home"]
+
+
+def resolve(path):
+    node = UI
+    for k in path.split("."):
+        if not isinstance(node, dict) or k not in node:
+            return None
+        node = node[k]
+    return node
+
+
+_WORDS = json.loads(PAGE.split('id="ui-text">', 1)[1]
+                    .split("</script>", 1)[0].replace("<\\/", "</"))
+check("the page is assembled: no placeholder is left and the words parse, "
+      "English and Dutch (UX-13 P5)",
+      "/*APP_CSS*/" not in PAGE and "/*APP_JS*/" not in PAGE
+      and "/*UI_TEXT*/" not in PAGE
+      and _WORDS["en"]["home"] == UI and set(_WORDS) == {"en", "nl"})
+check("four tabs with the four hash routes, in a keyboard tablist",
+      re.findall(r'data-hash="(\w+)"', PAGE) == ["home", "batteries",
+                                                 "settings", "setup"]
+      and 'role="tablist"' in PAGE and PAGE.count('role="tabpanel"') == 4
+      and "ArrowRight" in JS and "ArrowLeft" in JS)
+_ext = re.findall(r"""(?:https?:)?//[A-Za-z0-9.-]+\.[a-z]{2,}""", PAGE)
+check(f"no external file and no web font: no URL leaves the add-on "
+      f"({_ext})", not _ext and "@import" not in PAGE
+      and "<link" not in PAGE and "src=" not in PAGE)
+_abs = re.findall(r"""(?:fetch\(|href=)["'](/[^"']*)["']""", PAGE)
+check(f"every fetch and link is relative, for ingress ({_abs})",
+      not _abs and 'fetch("status?lang=' in JS and 'fetch("action"' in JS)
+_keys = set(re.findall(r'data-t(?:-label)?="([\w.]+)"', PAGE)) | set(
+    re.findall(r'''\bt\("([\w.]+)"\)''', JS))
+_missing = sorted(k for k in _keys if not isinstance(resolve(k), str))
+check(f"every label the page asks for is in app/ui_text ({len(_keys)} "
+      f"keys; missing: {_missing})", len(_keys) > 30 and not _missing)
+check("data is set as text, never as HTML, so no status sentence can inject "
+      "markup", "innerHTML" not in JS and "insertAdjacentHTML" not in JS)
+check("every function of the old page is still on it: start/stop, the "
+      "maintenance start and abort, the status rows, the checks and the "
+      "event line",
+      "auto_toggle" in JS and '"maint_start"' in JS and '"maint_abort"' in JS
+      and 'id="rows"' in PAGE and 'id="checks"' in PAGE
+      and 'id="hint"' in PAGE and 'href="config"' in PAGE)
+check("stopping, starting and both maintenance actions ask first",
+      all(f'ask("{k}"' in JS for k in ("stop", "start", "maint_start",
+                                       "maint_abort")))
+check("tooltips open on hover, on a tap and on keyboard focus",
+      "pointermove" in JS and "pointerdown" in JS and "focusin" in JS)
+check("the chart is not colour alone: expensive hours and blocks are "
+      "patterned, and every item has a text label",
+      "repeating-linear-gradient" in PAGE and '"aria-label": tipText' in JS)
+check("the phone layout puts the tabs at the bottom under 640 px, and dark "
+      "mode follows the system",
+      "@media (max-width:640px)" in PAGE and "position:fixed;bottom:0" in PAGE
+      and "prefers-color-scheme:dark" in PAGE)
+
+
+async def _serve():
+    class _Sup:
+        async def info(self):
+            return {"options": {"price_taxes_eur_kwh": FLANDERS,
+                                "price_taxes_profile": ""},
+                    "schema": [], "translations": {}}
+    c = make(ONE, soc=(50.0,), batt=(0.0,))
+    runner = aioweb.AppRunner(web.build_app(c, _Sup()))
+    await runner.setup()
+    site = aioweb.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    port = site._server.sockets[0].getsockname()[1]
+    out = {}
+    try:
+        async with ClientSession() as s:
+            async with s.get(f"http://127.0.0.1:{port}/") as r:
+                out["page"] = (r.status, r.content_type, await r.text())
+            async with s.get(f"http://127.0.0.1:{port}/status") as r:
+                out["status"] = await r.json()
+            async with s.get(f"http://127.0.0.1:{port}/status?lang=nl-BE") as r:
+                out["status_nl"] = await r.json()
+            async with s.get(f"http://127.0.0.1:{port}/config/model") as r:
+                out["model"] = await r.json()
+    finally:
+        await runner.cleanup()
+    return out
+
+
+E = asyncio.run(_serve())
+_nl_words = json.load(io.open(os.path.join(HERE, "app", "ui_text", "nl.json"),
+                              encoding="utf-8"))["home_words"]
+check("UX-13 P5: /status?lang=nl-BE builds Home in Dutch, and plain /status "
+      "stays English",
+      E["status_nl"]["state"]["pill"] in _nl_words["pill"].values()
+      and E["status_nl"]["control"]["text"] in _nl_words["control"].values()
+      and E["status"]["state"]["pill"] not in _nl_words["pill"].values()
+      and set(E["status_nl"]) == set(E["status"]))
+check("GET / serves the assembled page as HTML", E["page"][0] == 200
+      and E["page"][1] == "text/html" and E["page"][2] == PAGE)
+check("GET status over HTTP carries both halves",
+      OLD <= set(E["status"]) and NEW <= set(E["status"]))
+check("the levies preset and its year reach config/model for the P2 "
+      "Settings screens (P0 review follow-up)",
+      E["model"].get("region") == {"id": "flanders", "year": 2026})
+c_reg = make(dict(ARB, price_taxes_eur_kwh=FLANDERS))
+c_reg.tariff_plan, c_reg.tariff_at = provider_plan(), NOW
+s_reg = status(c_reg)
+check("...and Home names the preset with its year wherever prices come from "
+      "a feed, and says 'your own figure' otherwise",
+      s_reg["plan"]["region"] == {"id": "flanders", "year": 2026}
+      and s_reg["plan"]["region_line"]
+      == "Levies and VAT: Flanders, Fluvius Antwerpen, 2026 figures."
+      and s_arb["plan"]["region_line"] == "Levies and VAT: your own figure."
+      and s_house["plan"]["region_line"] == "")
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_inverter.py b/goodwe_controller/test_inverter.py
index 066051c..4b7281e 100644
--- a/goodwe_controller/test_inverter.py
+++ b/goodwe_controller/test_inverter.py
@@ -73,6 +73,8 @@ import time
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+from named_absence import first, given, nth, present
+
 from app import main as app_main
 from app.inverter import LINK_STALE_S, UNIT_A, Inverter, build_roster
 from app.main import WRITE_BUDGET_S, Controller
@@ -809,9 +811,11 @@ check("...and the status page shows BOTH per-inverter rows - one latched, one "
       "'the sign watchdog is armed' printed over a latched sibling is the page "
       "lying",
       len([r for r in _c3r.checks()
-           if r["text"].startswith("sign watchdog [")]) == 1
+           if r.get("id") == "direction" and r["ok"]
+           and "inverter-a" in r["text"]]) == 1
       and len([r for r in _c3r.checks()
-               if "SIGN-DISAGREEMENT FAILSAFE [" in r["text"]]) == 1)
+               if r.get("id") == "direction" and not r["ok"]
+               and not r["warn"] and "inverter-b" in r["text"]]) == 1)
 check("⚠️ AND SAFETY-30's SITE ROW IS THERE BESIDE THEM, EXACTLY ONCE. At two "
       "inverters there are three sign questions on this page and they are three "
       "rows: is A doing what it was told, is B, and is the SITE'S TOTAL "
@@ -821,15 +825,15 @@ check("⚠️ AND SAFETY-30's SITE ROW IS THERE BESIDE THEM, EXACTLY ONCE. At tw
       "per-unit rows would be advertising two guards where the install has "
       "three",
       len([r for r in _c3r.checks()
-           if r["text"].startswith("site sign watchdog:")]) == 1)
+           if r.get("id") == "site_direction"]) == 1)
 check("...and the per-inverter rows now say WHAT the unit was compared "
       "against, because at a roster of two it is no longer the meter. A row "
       "still reading 'the command opposed the meter' would send an operator to "
       "look at P1 for a fault that is visible only on one inverter's own power "
       "sensor",
-      all("its own measured power" in r["text"] for r in _c3r.checks()
-          if r["text"].startswith(("sign watchdog [",
-                                   "SIGN-DISAGREEMENT FAILSAFE ["))))
+      len([r for r in _c3r.checks() if r.get("id") == "direction"]) == 2
+      and all("own power" in r["text"] for r in _c3r.checks()
+              if r.get("id") == "direction"))
 
 # The operator's clear, which is one button and has to reach every latch.
 run(_c3r.handle_action("auto_toggle"))          # -> stopped
@@ -993,8 +997,9 @@ _compute_calls = [n for n in ast.walk(MAIN_AST)
                   and n.func.id == "compute"]
 check("main.py has exactly ONE `compute(` call site, so the argument graded "
       "below is unambiguously the shipped one", len(_compute_calls) == 1)
-_actual_src = ast.unparse(
-    next(k.value for k in _compute_calls[0].keywords if k.arg == "actual_w"))
+_actual_kw = first((k.value for k in nth(_compute_calls, 0).keywords if k.arg == "actual_w"),
+                   "no actual_w= keyword")
+_actual_src = ast.unparse(_actual_kw) if present(_actual_kw) else repr(_actual_kw)
 _site_batt_assign = [ast.unparse(n.value) for n in ast.walk(CTRL)
                      if isinstance(n, ast.Assign) and len(n.targets) == 1
                      and isinstance(n.targets[0], ast.Name)
@@ -1073,7 +1078,7 @@ print("6. AC 6: independent heartbeats, with the hang INJECTED")
 #
 # Two things fix it and both are graded: the writes go out CONCURRENTLY, and
 # each one is bounded by `WRITE_BUDGET_S`.
-_HB_MAX = read_schema_max("heartbeat_s")
+_HB_MAX = given(read_schema_max("heartbeat_s"), "heartbeat_s bound")
 print(f"    WRITE_BUDGET_S {WRITE_BUDGET_S:.0f} s + the schema's largest "
       f"heartbeat_s {_HB_MAX:.0f} s = {WRITE_BUDGET_S + _HB_MAX:.0f} s, against "
       f"layer 1's {FIRMWARE_INGEST_VETO_S:.0f} s veto")
@@ -1351,7 +1356,7 @@ check("⚠️ AND A UNIT WITH NO `setpoint_entity` IS DELIBERATELY STILL LIVE HE
       inverter_b(setpoint="").is_live(_now)[0] is True)
 check("...and the status page says so in its own row, which is the surface an "
       "operator actually reads",
-      any("NO SETPOINT ENTITY" in n for n in
+      any("“Setpoint entity” is not set" in n for n in
           built(store=MemStore(), second=inverter_b(setpoint=""))[0]
           .liveness_notes()))
 check("...and a healthy site adds NO liveness rows at all, so the page is not "
@@ -1624,7 +1629,7 @@ check("⚠️ AC 5: two inverters naming the SAME setpoint_entity are REFUSED. "
       "life of this add-on because the schema had exactly one such key; this "
       "is the first configuration in which it is expressible, and it is the "
       "first time that guarantee has had to be a check",
-      _why(_p_same, "one actuator") and _why(_p_same, "number.sp_a"))
+      _why(_p_same, "point at the same inverter entity") and _why(_p_same, "number.sp_a"))
 check("...and case-folded, so the hazard cannot be smuggled past on "
       "NUMBER.SP_A versus number.sp_a - which is exactly how it would be "
       "written by someone copying an entity id out of the HA UI",
@@ -1648,7 +1653,7 @@ check("a flat setpoint_entity left set BESIDE a declared roster is refused. It "
       "names an actuator the roster does not, so nothing would ever write it - "
       "a site running quietly smaller than its own configuration, which is the "
       "'silently a different config' outcome this card ranks below a refusal",
-      _why(_p_flat, "AND an inverters list"))
+      _why(_p_flat, "but the “Inverter list” (inverters) is also filled in"))
 _p_dup = validate_startup_config(_opts(setpoint_entity="", inverters=[
     dict(name="twin", setpoint_entity="number.sp_a", max_w=A_RATING),
     dict(name="twin", setpoint_entity="number.sp_b",
@@ -1661,13 +1666,14 @@ for _what, _bad, _needle in (
         ("with no name at all",
          dict(setpoint_entity="number.sp_b", max_w=3000), "has no name"),
         ("this controller cannot command",
-         dict(name="inverter-b", max_w=3000), "has no setpoint_entity"),
+         dict(name="inverter-b", max_w=3000),
+         "has no “Inverter setpoint entity” (setpoint_entity)"),
         ("with no rating",
          dict(name="inverter-b", setpoint_entity="number.sp_b"),
-         "no usable max_w"),
+         "no usable “Inverter rating” (max_w)"),
         ("whose rating is not a number",
          dict(name="inverter-b", setpoint_entity="number.sp_b", max_w="lots"),
-         "no usable max_w")):
+         "no usable “Inverter rating” (max_w)")):
     check(f"an entry {_what} is refused, and the refusal says which entry and "
           f"which key ({_needle!r}) rather than that something is wrong",
           _why(validate_startup_config(_opts(setpoint_entity="",
@@ -1675,7 +1681,7 @@ for _what, _bad, _needle in (
 check("`inverters` that is not a list at all is refused with the shape it "
       "should have been, rather than crashing inside build_roster()",
       _why(validate_startup_config(_opts(inverters="number.sp_b")),
-           "must be a\nLIST".replace("\n", " ")))
+           "(inverters) is str 'number.sp_b', not a list"))
 
 # --- the permissive readers INSIDE validate.py --------------------------------
 # ⚠️ RUN BOTH WAYS, WHICH IS MUTATION.md's RULE. A check that only asserts the
@@ -1733,8 +1739,8 @@ check("the fixture actually desynchronises the two lists, or the two checks "
 check("⚠️ RULE 5 NAMES THE UNIT THE NUMBER CAME OFF. The weakest cap is "
       "inverter-c's 1000 W; it sits at caps index 1, and `_unit_label(opts, 1)` "
       "is inverter-B. The refusal says inverter-c",
-      _why(_p_skew, "max_w (inverter-c) is 1000 W")
-      and not _why(_p_skew, "max_w (inverter-b) is 1000 W"))
+      _why(_p_skew, "for inverter-c (inverters.max_w) is 1000 W")
+      and not _why(_p_skew, "for inverter-b (inverters.max_w) is 1000 W"))
 # ⚠️ MAINT-05 MOVED RULE 6's SUBJECT, AND THIS CHECK MOVED WITH IT. It used to
 # assert the refusal named inverter-b, because rule 6 graded the FIRST entry
 # with a usable cap - `Controller.maint_unit` was `inverters[0]` and the shaping
@@ -1748,15 +1754,15 @@ check("⚠️ RULE 6 TOO, AND SINCE MAINT-05 IT IS THE WEAKEST PACK IT NAMES. "
       "inverter-c's 1000 W sits at caps index 1, and `_unit_label(opts, 1)` is "
       "inverter-B - so a caps index leaking into a roster index would say "
       "inverter-b here. The refusal says inverter-c, with inverter-c's number",
-      _why(_p_skew, "maintenance_charge_w is 3000 W but max_w (inverter-c) is "
-                    "1000 W")
-      and not _why(_p_skew, "maintenance_charge_w is 3000 W but max_w "
-                            "(inverter-b)"))
+      _why(_p_skew, "(maintenance_charge_w) is 3000 W, but the “Inverter rating” for "
+                    "inverter-c (inverters.max_w) is 1000 W")
+      and not _why(_p_skew, "(maintenance_charge_w) is 3000 W, but the “Inverter rating” for "
+                            "inverter-b"))
 check("...and it is no longer graded against the FIRST usable cap at all, which "
       "is the behaviour change MAINT-05 makes here: inverter-b's 2000 W was the "
       "pre-card answer and appears nowhere in the maintenance refusal now",
-      not _why(_p_skew, "maintenance_charge_w is 3000 W but max_w "
-                        "(inverter-b) is 2000 W"))
+      not _why(_p_skew, "(maintenance_charge_w) is 3000 W, but the “Inverter rating” for "
+                        "inverter-b (inverters.max_w) is 2000 W"))
 check("...and the counterfactual, so this is not a check that would pass on a "
       "validator that named nothing: the OLD expressions still evaluate, on "
       "this same config, to the wrong names",
@@ -1779,7 +1785,7 @@ check("⚠️ A READER THAT SILENTLY PINNED INVERTER #1, IN main.py. run_control
       "unit's max_w was graded against the device it is written to, and the "
       "skip was silent. The per-unit form catches B against B's own ESPHome",
       len(_p_rng) == 1 and _why(_p_rng, "inverter-b")
-      and _why(_p_rng, "THE DEVICE WINS"))
+      and _why(_p_rng, "Lower this inverter's rating to"))
 check("...and it says INVERTER-B, not 'the setpoint device' - a site with "
       "three inverters and one bad rating needs to be told which one",
       _why(_p_rng, "number.sp_b") and not _why(_p_rng, "inverter-a"))
diff --git a/goodwe_controller/test_maintenance.py b/goodwe_controller/test_maintenance.py
index 8b513aa..b090c36 100644
--- a/goodwe_controller/test_maintenance.py
+++ b/goodwe_controller/test_maintenance.py
@@ -497,7 +497,7 @@ check("a FORCED start is refused while another pack holds the slot, and the "
       "phase machine does not move. The calendar is a preference an operator "
       "may overrule; one pack at a time is a property of the grid connection "
       "and a button does not add a second one",
-      _b8.phase == IDLE and len(_ev) == 1 and "REFUSED" in _ev[0]
+      _b8.phase == IDLE and len(_ev) == 1 and "cannot start now" in _ev[0]
       and "inverter-a" in _ev[0])
 check("...and an unblocked forced start still works, so the refusal is a "
       "condition and not a disabled feature",
@@ -534,7 +534,7 @@ check("...and the deferred pack's PHASE does not move either, so "
       _b9.phase == IDLE and _b9.store.get_time("phase_started") is None)
 check("...and the words say WAITING, name the pack it waits for, and say it "
       "will run next - none of which any failure path in this module says",
-      "WAITING" in _r9[1].events[0]
+      "waits its turn" in _r9[1].events[0]
       and "inverter-a" in _r9[1].events[0]
       and "not a stalled phase" in _r9[1].events[0]
       and "ABORT" not in _r9[1].events[0] and "stuck" not in _r9[1].events[0])
@@ -687,7 +687,7 @@ print(f"    a store already written by a multi-inverter version: {_rep3.explain(
 check("a store already at the per-pack schema is NOT TOUCHED - not one key "
       "written - and says so",
       not _rep3.ran and _m3.data == _before3 and _m3.writes == []
-      and "not touched" in _rep3.explain())
+      and "left as it is" in _rep3.explain())
 
 # ⚠️ AND BREAK IT. The read-back postcondition is the whole difference between
 # this and a two-line copy, and it is inherited from `migrate_unit_keys()`
@@ -766,7 +766,7 @@ check("...and the refusal NAMES the namespace it used AND the roster it was "
       "graded against, rather than merely saying something went wrong - the "
       "operator's next question is 'which name, and which one should it have "
       "been', and a bare `not ok` answers neither",
-      "WRONG NAMESPACE" in _rep5.explain()
+      "moved under an inverter not in the list" in _rep5.explain()
       and unit_key(UNIT_A, "last_completed") in _rep5.explain()
       and repr(ROSTER) in _rep5.explain())
 check("⚠️ AND THE MARKER IS NOT STAMPED, WHICH IS THE WHOLE REMEDY. A stamped "
@@ -893,7 +893,7 @@ check("...and the counterfactual: the SAME two calls with the roster's own "
       "`already at schema` early return, not a refusal. So 9c is about the "
       "NAME surviving into the second start, not about second calls",
       _rep7ok_a.ok and _m7ok.data[MAINT_SCHEMA_KEY] == MAINT_SCHEMA_VERSION
-      and _rep7ok_b.ran is False and "already at schema" in _rep7ok_b.explain())
+      and _rep7ok_b.ran is False and "already at version" in _rep7ok_b.explain())
 
 
 # --------------------------------------------------------------------------- #
@@ -1363,50 +1363,24 @@ check("...while the second pack's write reaches only its own namespace",
 
 # --------------------------------------------------------------------------- #
 print()
-print("12. RECORDED, NOT FIXED: the site loop still contradicts a drain at N>=2")
+print("12. FIXED (SAFETY-78): a drain at N>=2 no longer parks the site")
 
-# ⚠️ THIS IS A DEFECT THIS CARD FOUND AND DELIBERATELY DID NOT FIX, AND IT IS
-# WRITTEN DOWN AS A RUNNING CHECK RATHER THAN AS A COMMENT SO IT CANNOT BE
-# FORGOTTEN OR QUIETLY "FIXED" BY A TUNING CHANGE.
-#
-# WHAT IT IS. The maintenance SET is a per-unit claim and PINS its pack. The
-# loop's target is a SITE claim. When the site target is BELOW the pin - a
-# drain of 2000 W while the house is importing less than that, which is most of
-# a night - the only split that sums to the site target asks the sibling to
-# CHARGE while the maintained pack DISCHARGES, and `allocator.plan()` refuses it
-# by name as circulating power. The refusal is correct and fails safe: the whole
-# site goes to 0 W with an ARBITER line in the action log.
-#
-# WHY IT IS NOT THIS CARD'S. It is PRE-EXISTING - measured on release/1.0 at
-# 2d025ee, where the same drain filed on `inverters[0]` produces the identical
-# refusal with the two unit names swapped - and fixing it means changing what
-# the site loop's target MEANS while a unit is pinned (regulate the meter using
-# only the unpinned packs), which is loop and allocator territory, not
-# maintenance's. MAINT-05 moves which pack is pinned and nothing else about it.
-#
-# ⚠️ AND THE CONSEQUENCE AN OPERATOR WOULD SEE IS A MISDIAGNOSIS, WHICH IS WHY
-# IT MATTERS ENOUGH TO PIN. The pack is held at 0 W while its FSM believes it is
-# draining, so after 12 h the DRAIN timeout fires and reports "drain stuck" -
-# §12's words for "the battery is not following commands, a fault". The battery
-# is fine; the site refused to allocate. That is the same class of wrong story
-# this card's own notes warn about for the deferral.
+# This section used to pin the defect: with the house below the drain, the
+# only split summing to the site target asked the sibling to CHARGE, the
+# allocator refused it and the site sat at 0 W while the FSM believed it was
+# draining. SAFETY-78 files a site `drain` floor at the pin, so the sibling
+# only ever adds power the same way. test_safety78.py grades it in full.
 _cX, _ = controller(TWO_OPTS, grid=0.0)
 _cX.maints[1].force_start(_now)
 one_cycle(_cX)
 print(f"    house at 0 W, B draining 2000 W -> reason {_cX.reason!r}; "
       f"{_cX.allocation.explain()}")
-check("a maintenance drain BELOW the site target is refused by the allocator "
-      "and the site parks at 0 W - recorded here so the next card can find it, "
-      "not asserted as desirable",
-      _cX.target == 0.0 and _cX.allocation.refused
-      and "circulating power" in _cX.allocation.explain())
-check("...and the pack that is supposedly draining is commanded 0 W, so its "
-      "12 h DRAIN timeout would eventually report 'drain stuck' - a fault "
-      "message about a healthy battery",
-      _cX.maints[1].phase == DRAIN and _cX.inverters[1].target == 0.0)
-check("...while the SAME site with the house importing more than the drain "
-      "allocates cleanly, which is what makes this a CONDITION rather than "
-      "'maintenance does not work at two inverters'",
+check("a maintenance drain above the loop's site target is allocated, not "
+      "refused: B drains at its rate and A is held at 0 W",
+      _cX.allocation.refused is None and _cX.target == 2000.0
+      and _cX.inverters[1].target == 2000.0 and _cX.inverters[0].target == 0.0)
+check("...and the SAME site with the house importing more than the drain "
+      "still allocates cleanly",
       _cB.allocation.refused is None and _cB.inverters[1].target == 2000.0)
 
 
@@ -1581,9 +1555,11 @@ try:
     _logged, _ = controller(NAMED_OPTS, store=_log_store)
 finally:
     logging.getLogger("goodwe").removeHandler(_h)
-_s44_lines = [m for m in _records if "SAFETY-44" in m]
+# UX-08 2d: the line is plain now, so it is found by its words, not a card id.
+_s44_lines = [m for m in _records
+              if "which is not in the inverter list" in m]
 print(f"    SAFETY-44 operator lines logged: {len(_s44_lines)}")
-check("⭐ the repair SAYS SO, at ERROR, naming SAFETY-44 - deleting this line "
+check("⭐ the repair SAYS SO, at ERROR, in one plain line - deleting this line "
       "left the whole suite green, and it is how an operator learns their "
       "latch was re-armed rather than never lost",
       len(_s44_lines) == 1)
diff --git a/goodwe_controller/test_messages.py b/goodwe_controller/test_messages.py
new file mode 100644
index 0000000..f6cd1c2
--- /dev/null
+++ b/goodwe_controller/test_messages.py
@@ -0,0 +1,1851 @@
+"""UX-08: user-facing text follows STYLE.md.   RUN: python3 -B test_messages.py
+
+1. Every notification in `app/messages.py` obeys the rule. The test renders
+   each one with realistic values and checks the title length, the number of
+   sentences and words for its severity, the banned terms, the entity ids and
+   the Details line.
+2. No notification is worded anywhere else. An AST scan of `app/` fails any
+   `persistent_notification` call whose payload is not built by
+   `app/messages.py`.
+3. The status page. Every row and banner in `app/messages.py` obeys the rule
+   for its colour: a row one sentence of at most 15 words, a red row up to 3
+   sentences and 30 words, a banner at most 12 words.
+   THE RATCHET for the kinds not rewritten yet. Every status-row and banner
+   literal left in `app/`, every validator refusal, every WARNING+ log line and every option
+   name and description in `translations/en.yaml` must either obey its limit
+   or appear in `ux08_allowlist.txt`. A new string that breaks the rule and is
+   not listed goes red. So does a listed entry that no longer matches a
+   failing string, so the list can only shrink: remove the line when you
+   rewrite the string.
+4. DOCS.md has a section for every notification, under "## Notifications".
+5. Mutations: each rule is shown to catch a spoiled input (habit 1 of
+   MUTATION.md).
+
+Run `python3 -B test_messages.py --violations` to print what part 3 sees.
+"""
+
+import ast
+import hashlib
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE / "tools"))
+
+from app import messages                                          # noqa: E402
+import translations_lint as TL                                    # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+# --- the rule (STYLE.md sections 1 and 4): tools/style_rules.py, shared with
+# test_ui_text.py since UX-13 P5.
+from style_rules import (BANNED, ENTITY, PLACEHOLDER, SHOUT, SNAKE,  # noqa: E402,F401
+                         sentences, text_problems, title_problems, words)
+
+
+def body_problems(body, severity):
+    out = []
+    n_s, n_w = sentences(body), len(words(body))
+    if severity == messages.ALARM:
+        if n_s > 3:
+            out.append(f"alarm body over 3 sentences ({n_s})")
+        if n_w > 70:
+            out.append(f"alarm body over 70 words ({n_w})")
+        long = [s for s in re.split(r"(?<=[.!?])\s+", body) if len(words(s)) > 30]
+        if long:
+            out.append(f"sentence over 30 words ({len(words(long[0]))})")
+    else:
+        if n_s > 1:
+            out.append(f"{severity} body over 1 sentence ({n_s})")
+        if n_w > 25:
+            out.append(f"{severity} body over 25 words ({n_w})")
+    if ";" in body:
+        out.append("semicolon: split it into sentences or drop a clause")
+    return out + text_problems(body, keys=False, entities=False)
+
+
+def notice_problems(n):
+    out = []
+    if n.severity not in (messages.ALARM, messages.WARNING, messages.INFO,
+                          messages.RESOLVED):
+        out.append(f"unknown severity {n.severity!r}")
+    out += title_problems(n.title) + body_problems(n.body, n.severity)
+    if not ends_in_details(n.data()["message"], n.docs):
+        out.append("message does not end in its Details line")
+    return out
+
+
+def ends_in_details(message, docs):
+    return message.endswith("\n\n" + messages.details(docs))
+
+
+# ============================================================================== #
+print("1. every notification obeys the rule")
+SAMPLES = messages.samples()
+for n in SAMPLES:
+    p = notice_problems(n)
+    check(f"{n.severity:8} {n.title!r}: {len(words(n.body))} words, "
+          f"{sentences(n.body)} sentence(s){' - ' + '; '.join(p) if p else ''}",
+          not p)
+ids = {v for k, v in vars(messages).items() if k.startswith("ID_")}
+seen = {re.sub(r"inverter_b$", "{slug}", n.id) for n in SAMPLES}
+check(f"the samples cover every notification id in the catalogue "
+      f"(missing: {sorted(ids - seen)})", ids <= seen)
+check("the payload carries exactly the three keys Home Assistant accepts",
+      all(set(n.data()) == {"notification_id", "title", "message"}
+          for n in SAMPLES))
+# The Details link (UX-09). Home Assistant 2026.2+ serves add-on pages at
+# /config/app/<slug>/<tab> and 2026.5 dropped /hassio/addon/<slug>/<tab>, so
+# the path follows the version the Supervisor reports; unknown means current.
+_LINE = ("Details: [add-on documentation](/config/app/local_goodwe_controller/"
+         "documentation), section “Battery is not keeping up” under "
+         "Notifications.")
+os.environ["HOSTNAME"] = "3f2a9c1b7d4e"          # a container id, as on TEST-23
+messages.set_site("local_goodwe_controller", "2026.9.1")
+check("with the Supervisor's slug the Details line is exactly the current-HA "
+      "link plus the section by name, even when the hostname is a container id",
+      SAMPLES[0].data()["message"].endswith("\n\n" + _LINE))
+_link = {v: messages.docs_url("local_goodwe_controller", v)
+         for v in ("2026.1.3", "2026.2.0", "2026.4.2", "2026.10.0b1",
+                   "2025.12.5", None, "rubbish")}
+check(f"Home Assistant 2026.1 and older get the old /hassio path, 2026.2 and "
+      f"newer and an unknown version the /config/app path ({_link})",
+      _link == {
+          "2026.1.3": "/hassio/addon/local_goodwe_controller/documentation",
+          "2025.12.5": "/hassio/addon/local_goodwe_controller/documentation",
+          "2026.2.0": "/config/app/local_goodwe_controller/documentation",
+          "2026.4.2": "/config/app/local_goodwe_controller/documentation",
+          "2026.10.0b1": "/config/app/local_goodwe_controller/documentation",
+          None: "/config/app/local_goodwe_controller/documentation",
+          "rubbish": "/config/app/local_goodwe_controller/documentation"})
+messages.set_site("../../etc", "2026.9.1")
+check("a slug that is not this add-on's shape is not put in a link",
+      "](" not in SAMPLES[0].data()["message"])
+messages.set_site(None, None)
+os.environ["HOSTNAME"] = "abcd1234-goodwe-controller"
+check("without the Supervisor's answer the slug comes from a Supervisor-style "
+      "hostname",
+      "(/config/app/abcd1234_goodwe_controller/documentation)"
+      in SAMPLES[0].data()["message"])
+os.environ["HOSTNAME"] = "some-laptop"
+check("...and anywhere else it names the section without a guessed link",
+      SAMPLES[0].data()["message"].endswith(
+          "\n\nDetails: add-on documentation, section “Battery is not keeping "
+          "up” under Notifications."))
+del os.environ["HOSTNAME"]
+
+# Where the slug and the version come from: the Supervisor, read once at start.
+import asyncio                                                    # noqa: E402
+from app.main import docs_link_facts                              # noqa: E402
+
+
+class _Resp:
+    def __init__(self, body):
+        self.body = body
+
+    async def __aenter__(self):
+        if isinstance(self.body, Exception):
+            raise self.body
+        return self
+
+    async def __aexit__(self, *a):
+        return False
+
+    async def json(self, content_type=None):
+        return self.body
+
+
+class _Session:
+    def __init__(self, answers):
+        self.answers, self.asked, self.timeouts = answers, [], []
+
+    def get(self, url, **kw):
+        self.asked.append((url, kw.get("headers", {}).get("Authorization")))
+        self.timeouts.append(kw.get("timeout"))
+        return _Resp(self.answers[url])
+
+
+_ok = _Session({
+    "http://supervisor/addons/self/info": {"result": "ok", "data": {
+        "slug": "local_goodwe_controller", "version": "0.12.0"}},
+    "http://supervisor/info": {"result": "ok", "data": {
+        "homeassistant": "2026.9.1", "supervisor": "2026.08.0"}}})
+_down = _Session({"http://supervisor/addons/self/info": OSError("refused"),
+                  "http://supervisor/info": ValueError("not json")})
+check("at start the add-on asks the Supervisor for its slug and HA's version, "
+      "with its own token",
+      asyncio.run(docs_link_facts(_ok, "tok")) == {
+          "slug": "local_goodwe_controller", "ha_version": "2026.9.1"}
+      and all(a == "Bearer tok" for _u, a in _ok.asked))
+check("...and a Supervisor that does not answer costs the link, never the "
+      "start",
+      asyncio.run(docs_link_facts(_down, "tok")) == {
+          "slug": None, "ha_version": None})
+check("...and each question has a short timeout, so a Supervisor that hangs "
+      f"delays control start by seconds, not minutes ({_ok.timeouts})",
+      len(_ok.timeouts) == 2
+      and all(isinstance(t, (int, float)) and 0 < t <= 3 for t in _ok.timeouts))
+
+# Shadow mode (UX-09): nothing the add-on decides reaches the inverter, so no
+# text may say a command was sent or that the battery is giving power.
+_c1 = [messages.Clamp(None, 7412, 5000, "rating")]
+_c2 = [messages.Clamp("inverter-a", -3000, -2500, "device"),
+       messages.Clamp("inverter-b", 6000, 4600, "max_w+device")]
+_live = [messages.output_clamp(c).body for c in (_c1, _c2, ())]
+_shad = [messages.output_clamp(c, shadow=True).body for c in (_c1, _c2, ())]
+check("live, the over-rating alarm says what was sent and that control runs",
+      " and sent 5 000 W" in _live[0] and " and sent 2 500 W" in _live[1]
+      and all("Control is still running" in b or "control is still running"
+              in b for b in _live))
+check("in shadow mode it says what would have been sent, and that the "
+      "inverters stay at 0 W",
+      "would have sent 5 000 W" in _shad[0]
+      and "would have sent 2 500 W" in _shad[1]
+      and "would have been cut back" in _shad[2]
+      and all(" sent" not in b.replace("would have sent", "") for b in _shad)
+      and all("0 W" in b and "hadow mode" in b for b in _shad))
+_row_live = messages.row_power_too_high(_c1, 3)
+_row_shad = messages.row_power_too_high(_c1, 3, shadow=True)
+check("the over-rating row says 'sent' live and 'would send' in shadow mode",
+      "sent 5 000 W" in _row_live and "would" not in _row_live
+      and "would send 5 000 W" in _row_shad and " sent" not in _row_shad
+      and "shadow mode" in _row_shad)
+_sat = messages.peak_saturated(5000, shadow=True).body
+check("in shadow mode the peak alarm does not claim the battery is giving "
+      "power, and keeps its action",
+      "giving all it can" not in _sat and "gives nothing" in _sat
+      and "Switch off large loads" in _sat
+      and "giving all it can" in messages.peak_saturated(5000).body)
+check("shadow mode changes no notification's id or severity",
+      all(messages.output_clamp(c, shadow=True).id == messages.ID_OUTPUT_CLAMP
+          and messages.output_clamp(c, shadow=True).severity == messages.ALARM
+          for c in (_c1, _c2, ()))
+      and messages.peak_saturated(1, shadow=True).id == messages.ID_PEAK_SATURATED
+      and messages.peak_saturated(1, shadow=True).severity == messages.ALARM)
+check("the output-clamp alarm quotes asked before sent",
+      messages.output_clamp([messages.Clamp(None, 7412, 5000, "rating")]).body
+      .index("7 412 W") < messages.output_clamp(
+          [messages.Clamp(None, 7412, 5000, "rating")]).body.index("5 000 W"))
+
+
+# ============================================================================== #
+print("\n2. no notification is worded outside app/messages.py")
+APP = HERE / "app"
+
+
+# UX-08 2d: a refusal is counted as it is SHOWN. A placeholder that names a
+# setting is expanded to the label and key `messages.setting()` prints, so
+# `{S('max_w')}` counts as “Inverter rating” (max_w), three words, not one.
+SETTING_CALLS = ("S", "_S", "setting", "messages.setting")
+CONSTANTS = {}          # module-level NAME = "text", per file, for keys
+
+
+def _key(node):
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    if isinstance(node, ast.Name):
+        return CONSTANTS.get(node.id)
+    return None
+
+
+def expand_setting(node):
+    """The shown text of a placeholder that names a setting, else None."""
+    if isinstance(node, ast.Call) and node.args:
+        name = ast.unparse(node.func)
+        if name in SETTING_CALLS:
+            key = _key(node.args[0])
+            if key not in messages.LABELS:
+                return None
+            unit = node.args[1] if len(node.args) > 1 else None
+            plain = unit is None or (isinstance(unit, ast.Constant)
+                                     and not unit.value)
+            return messages.setting(key, "" if plain else "inverter-b")
+        if name == "_labels" and isinstance(node.args[0], (ast.List, ast.Tuple)):
+            keys = [_key(e) for e in node.args[0].elts]
+            if all(k in messages.LABELS for k in keys):
+                return " and ".join(messages.setting(k) for k in keys)
+    if (isinstance(node, ast.Subscript)
+            and ast.unparse(node.value) == "messages.LABELS"):
+        key = _key(node.slice)
+        return messages.LABELS.get(key) if key else None
+    return None
+
+
+def render(node, expand=False):
+    """A string expression as text, placeholders as {expr}; None otherwise.
+    `expand` shows setting placeholders as the page shows them."""
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    if isinstance(node, ast.JoinedStr):
+        out = []
+        for v in node.values:
+            if isinstance(v, ast.Constant):
+                out.append(v.value)
+                continue
+            shown = expand_setting(v.value) if expand else None
+            out.append(shown if shown is not None
+                       else "{" + ast.unparse(v.value) + "}")
+        return "".join(out)
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+        a, b = render(node.left, expand), render(node.right, expand)
+        if a is None and b is None:
+            return None
+        return (a if a is not None else "{…}") + (b if b is not None else "{…}")
+    if isinstance(node, ast.IfExp):
+        a, b = render(node.body, expand), render(node.orelse, expand)
+        if a is None and b is None:
+            return None
+        return (a or "") + " / " + (b or "")
+    return None
+
+
+def notification_calls(tree):
+    for node in ast.walk(tree):
+        if (isinstance(node, ast.Call) and node.args
+                and ast.unparse(node.func).endswith("call")
+                and render(node.args[0]) == "persistent_notification"):
+            yield node
+
+
+bad_calls, n_calls = [], 0
+for f in sorted(APP.glob("*.py")):
+    for call in notification_calls(ast.parse(f.read_text(encoding="utf-8"))):
+        n_calls += 1
+        payload = call.args[2] if len(call.args) > 2 else None
+        ok = (isinstance(payload, ast.Call)
+              and isinstance(payload.func, ast.Attribute)
+              and payload.func.attr == "data"
+              and "messages." in ast.unparse(payload.func.value))
+        if not ok:
+            bad_calls.append(f"{f.name}:{call.lineno}")
+check(f"the scan found the add-on's notification calls ({n_calls})", n_calls >= 7)
+check(f"every one is built by app/messages.py (not: {bad_calls})", not bad_calls)
+
+
+# ============================================================================== #
+print("\n3. the ratchet: other user-facing text obeys its limit or is listed")
+
+LIMITS = {                      # kind: (words, keys ok, entity ids ok)
+    "row": (15, False, False),
+    "banner": (12, False, False),
+    "refusal": (30, True, True),
+    "log": (25, True, True),
+    "option-name": (6, False, False),
+    "option-desc": (30, True, True),
+    "note": (25, True, True),           # UX-13: a settings-page warning
+    "ui-name": (6, False, False),       # UX-13: app/ui_text, a name or choice
+    "ui-desc": (25, False, False),      # UX-13: app/ui_text, one-line help
+}
+LOG_CALL = re.compile(r"(?:^|\.)(?:_LOG|log|logger|LOG)\.(warning|error|critical|exception)$")
+
+
+def strings_in(node, expand=False):
+    """Top-level string expressions inside `node` (not their parts)."""
+    t = render(node, expand)
+    if t is not None:
+        yield node, t
+        return
+    for child in ast.iter_child_nodes(node):
+        yield from strings_in(child, expand)
+
+
+def _module_constants(tree):
+    """Module-level `NAME = "text"` assignments."""
+    return {t.id: n.value.value for n in tree.body
+            if isinstance(n, ast.Assign) and isinstance(n.value, ast.Constant)
+            and isinstance(n.value.value, str)
+            for t in n.targets if isinstance(t, ast.Name)}
+
+
+_MODCONST = {f.stem: _module_constants(ast.parse(f.read_text(encoding="utf-8")))
+             for f in sorted(APP.glob("*.py"))}
+
+
+def collect():
+    """(kind, where, text) for every user-facing literal of a ratcheted kind."""
+    out = []
+    for f in sorted(APP.glob("*.py")):
+        if f.name == "messages.py":
+            continue
+        tree = ast.parse(f.read_text(encoding="utf-8"))
+        # The file's own constants, and those it imports from another app
+        # module (`from .validate import TAXES_PROFILE_OPTION`), so a key
+        # named by a constant from elsewhere is expanded too.
+        CONSTANTS.clear()
+        CONSTANTS.update(_module_constants(tree))
+        for n in tree.body:
+            if isinstance(n, ast.ImportFrom) and n.level == 1 and n.module:
+                theirs = _MODCONST.get(n.module, {})
+                CONSTANTS.update({a.asname or a.name: theirs[a.name]
+                                  for a in n.names if a.name in theirs})
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Dict):
+                for k, v in zip(node.keys, node.values):
+                    key = render(k) if k is not None else None
+                    if key in ("text", "banner"):
+                        for n, t in strings_in(v):
+                            out.append(("row" if key == "text" else "banner",
+                                        f"{f.name}:{n.lineno}", t))
+            elif isinstance(node, ast.Assign) and f.name == "main.py":
+                tgt = ast.unparse(node.targets[0]).replace(" ", "").strip("()")
+                if tgt in ("level,banner", "banner"):
+                    for n, t in strings_in(node.value):
+                        if len(words(t)) > 1:
+                            out.append(("banner", f"{f.name}:{n.lineno}", t))
+            elif isinstance(node, ast.Call):
+                name = ast.unparse(node.func)
+                if LOG_CALL.search(name) or name.endswith("._moan"):
+                    arg = node.args[1 if name.endswith("._moan") else 0] \
+                        if node.args else None
+                    if arg is not None:
+                        for n, t in strings_in(arg):
+                            out.append(("log", f"{f.name}:{n.lineno}", t))
+                elif name.endswith("_advise") and node.args:
+                    for n, t in strings_in(node.args[-1], expand=True):
+                        if len(words(t)) > 1:
+                            out.append(("note", f"{f.name}:{n.lineno}", t))
+                elif re.search(r"problems\.(append|extend)$", name):
+                    for a in node.args:
+                        for n, t in strings_in(a, expand=True):
+                            if len(words(t)) > 1:
+                                out.append(("refusal", f"{f.name}:{n.lineno}", t))
+    # UX-08 2d: the Dutch option texts are held to the same length.
+    for lang in ("en", "nl"):
+        tr = TL.parse_translation_file(HERE / "translations" / f"{lang}.yaml")
+
+        def walk(conf, path):
+            for key, v in (conf or {}).items():
+                if not isinstance(v, dict):
+                    continue
+                if isinstance(v.get("name"), str):
+                    out.append(("option-name", f"{lang}.yaml:{path}{key}",
+                                v["name"].split("·")[-1].strip()))
+                if isinstance(v.get("description"), str):
+                    out.append(("option-desc", f"{lang}.yaml:{path}{key}",
+                                v["description"]))
+                if isinstance(v.get("fields"), dict):
+                    walk(v["fields"], f"{path}{key}.")
+        walk(tr.get("configuration"), "")
+    # UX-13: the new page's own words, held to the option texts' rule. Home's
+    # sentences (`home_words`) are templates, checked rendered in part 8.
+    for f in sorted((APP / "ui_text").glob("*.json")):
+        def walk_ui(node, path):
+            for key, v in node.items():
+                if not path and key == "home_words":
+                    continue
+                if isinstance(v, dict):
+                    walk_ui(v, f"{path}{key}.")
+                elif isinstance(v, str):
+                    out.append(("ui-desc" if key == "description" else
+                                "ui-name", f"{f.name}:{path}{key}", v))
+        walk_ui(json.loads(f.read_text(encoding="utf-8")), "")
+    return out
+
+
+def problems_of(kind, text):
+    lim, keys, ents = LIMITS[kind]
+    p = []
+    if len(words(text)) > lim:
+        p.append(f"over {lim} words ({len(words(text))})")
+    if ";" in text:
+        p.append("semicolon")
+    if kind in ("note", "ui-desc") and sentences(text) > 1:
+        p.append(f"over 1 sentence ({sentences(text)})")
+    return p + text_problems(text, keys=keys, entities=ents)
+
+
+def key_of(kind, text):
+    return f"{kind} {hashlib.sha1(text.encode('utf-8')).hexdigest()[:12]}"
+
+
+ALLOW_FILE = HERE / "ux08_allowlist.txt"
+# The allowlist may never grow. The test demands the list be exactly this long,
+# so deleting lines means lowering this number in the same change, and adding
+# one means raising it where a reviewer sees it.
+ALLOWLIST_MAX = 0
+
+
+def read_allowlist(path):
+    keys = set()
+    for line in path.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if line:
+            keys.add(" ".join(line.split()[:2]))
+    return keys
+
+
+found = collect()
+violating = {}
+for kind, where, text in found:
+    p = problems_of(kind, text)
+    if p:
+        violating.setdefault(key_of(kind, text), (kind, where, text, p))
+if "--violations" in sys.argv:
+    for k, (kind, where, text, p) in sorted(violating.items(),
+                                             key=lambda kv: kv[1][:2]):
+        print(f"{k}  # {where} {'; '.join(p)} :: {text[:70]!r}")
+    sys.exit(0)
+
+STATUS = messages.status_samples()
+
+
+def row_problems(colour, text):
+    """STYLE.md section 1 for a status row (by colour) or a banner (None)."""
+    n_s, n_w = sentences(text), len(words(text))
+    out = []
+    if colour is None:
+        if n_w > 12:
+            out.append(f"banner over 12 words ({n_w})")
+    elif colour == messages.RED:
+        if n_s > 3:
+            out.append(f"red row over 3 sentences ({n_s})")
+        if n_w > 30:
+            out.append(f"red row over 30 words ({n_w})")
+    else:
+        if n_s > 1:
+            out.append(f"{colour} row over 1 sentence ({n_s})")
+        if n_w > 15:
+            out.append(f"{colour} row over 15 words ({n_w})")
+    if ";" in text:
+        out.append("semicolon: split it into sentences or drop a clause")
+    return out + text_problems(text, keys=False, entities=False)
+
+
+for fn, colour, text in STATUS:
+    p = row_problems(colour, text)
+    check(f"{colour or 'banner':6} {text!r}{' - ' + '; '.join(p) if p else ''}",
+          not p)
+_catalogue = {k for k, v in vars(messages).items()
+              if callable(v) and k.startswith(("row_", "banner_"))}
+_missing = sorted(_catalogue - {fn for fn, _c, _t in STATUS})
+check(f"the samples cover every row and banner in the catalogue "
+      f"(missing: {_missing})", not _missing)
+# A red row with no banner of its own heads the page as "Not ready - <its first
+# sentence>". The three trips have their own branch in status_payload(), and
+# main.py gives the other two a "banner" key (both are sampled above).
+_own_banner = {"row_direction_trip", "row_site_direction_trip",
+               "row_circulating_trip", "row_peak_reserve", "row_power_too_high"}
+_long = [t for fn, c, t in STATUS if c == messages.RED and fn not in _own_banner
+         and len(words(messages.banner_not_ready({"text": t}))) > 12]
+# The hint under the buttons (UX-08 2d): the last event in plain words, one
+# per key of messages.HINTS, held to the rule for a green row.
+for key, text in messages.hint_samples():
+    p = row_problems(messages.GREEN, text)
+    check(f"hint   {text!r}{' - ' + '; '.join(p) if p else ''}", not p)
+_calls, _bare = 0, []
+for f in sorted(APP.glob("*.py")):
+    for node in ast.walk(ast.parse(f.read_text(encoding="utf-8"))):
+        if (isinstance(node, ast.Call)
+                and ast.unparse(node.func).endswith("log_event")):
+            _calls += 1
+            h = next((k.value for k in node.keywords if k.arg == "hint"), None)
+            if not (isinstance(h, ast.Call)
+                    and ast.unparse(h.func) in ("messages.hint", "hint")):
+                _bare.append(f"{f.name}:{node.lineno}")
+check(f"every event the add-on records gives the page its plain words, from "
+      f"messages.hint() ({_calls} calls, without: {_bare})",
+      _calls >= 40 and not _bare)
+_raw = ("OUTPUT_CLAMP", "BUG SIGNAL", "FAILSAFE", "SIGN_DISAGREEMENT",
+        "ALLOCATOR", "UNMET", "ARBITER", "PEAK GUARD", "PEAK_GUARD")
+check("no hint carries the raw event codes the page used to show",
+      not [t for _k, t in messages.hint_samples()
+           if any(r in t for r in _raw)])
+
+check(f"every other red row makes a 'Not ready' banner of at most 12 words "
+      f"(too long: {_long})", not _long)
+
+# A latch row must say how it clears: that is the one action it exists for.
+_clears = {
+    "row_direction_trip": "A restart does not clear this",
+    "row_site_direction_trip": "Only starting control clears this",
+    "row_circulating_trip": "Only starting control clears this",
+    "row_not_delivering": "only stopping and starting control clears this",
+}
+_unclear = [fn for fn, _c, t in STATUS if fn in _clears and _clears[fn] not in t]
+check(f"every latch row says how it clears (missing: {_unclear})",
+      not _unclear and {fn for fn, _c, _t in STATUS} >= set(_clears))
+
+allow = read_allowlist(ALLOW_FILE)
+by_kind = {}
+for kind, *_ in found:
+    by_kind[kind] = by_kind.get(kind, 0) + 1
+for _fn, colour, _t in STATUS:
+    kind = "row" if colour else "banner"
+    by_kind[kind] = by_kind.get(kind, 0) + 1
+check(f"the scan found every ratcheted kind ({by_kind})",
+      all(by_kind.get(k, 0) >= 5 for k in LIMITS))
+new = sorted(k for k in violating if k not in allow)
+for k in new:
+    kind, where, text, p = violating[k]
+    print(f"       NEW  {where}: {'; '.join(p)} :: {text[:90]!r}\n"
+          f"            (rewrite it to STYLE.md; listing it needs a reason)")
+check(f"no new string breaks the rule ({len(new)} new)", not new)
+stale = sorted(k for k in allow if k not in violating)
+for k in stale:
+    print(f"       STALE {k} - that string now obeys the rule or is gone: "
+          f"delete its line from ux08_allowlist.txt")
+check(f"no allowlist entry is stale, so the list only shrinks "
+      f"({len(stale)} stale)", not stale)
+check(f"the allowlist is exactly its cap ({len(allow)} entries, cap "
+      f"{ALLOWLIST_MAX}): lower the cap when you delete lines",
+      len(allow) == ALLOWLIST_MAX)
+
+# A refusal names a setting by its Configuration-tab label (UX-08 2c). The
+# catalogue's labels must be the en.yaml names without group prefix and unit.
+_TR = TL.parse_translation_file(HERE / "translations" / "en.yaml")["configuration"]
+
+
+def _label_stems(key):
+    names = [c[key]["name"] for c in (_TR, _TR["inverters"]["fields"])
+             if isinstance(c.get(key), dict)]
+    out = set()
+    for n in names:
+        n = n.split("·")[-1].strip()
+        while re.search(r"\s*\([^()]*\)$", n):
+            n = re.sub(r"\s*\([^()]*\)$", "", n)
+        out.add(n)
+    return out
+
+
+_drift = sorted(f"{k}: {v!r}" for k, v in messages.LABELS.items()
+                if v not in _label_stems(k))
+check(f"every label a refusal quotes is the setting's name in en.yaml "
+      f"(drifted: {_drift})", not _drift)
+check("...and a refusal quotes the label and then the key, so the config "
+      "panel still files it under that setting",
+      messages.setting("max_w", "inverter-b")
+      == "“Inverter rating” for inverter-b (inverters.max_w)")
+# UX-08 2d: the refusals as the validator SHOWS them. The scan above expands
+# setting labels in a template, but a reason that carries a parser's error
+# (`{e}`) is only as long as that error, so the long ones found by the 2c test
+# are driven for real here and held to the same 30 words.
+from app import custom_formula as _cf                             # noqa: E402
+from app.validate import validate_startup_config                 # noqa: E402
+
+_BASE = {"setpoint_entity": "number.goodwe_setpoint", "max_w": 2000,
+         "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+         "meter_source": "off", "maintenance_charge_w": 2000,
+         "maintenance_discharge_w": 2000}
+_CARD = _cf._LEGS["price_formula"].example.replace("15.55", "15.05")
+_TABLE = ('{"periods":[{"name":"day","from":"07:00","to":"22:00","days":'
+          '"mon-fri","eur_per_kwh":0.1},{"name":"night","from":"22:00","to":'
+          '"07:00","days":"mon-fri","eur_per_kwh":0.08},{"name":"night",'
+          '"from":"00:00","to":"24:00","days":"sat,sun","eur_per_kwh":0.08}]}')
+_ROSTER = {k: v for k, v in _BASE.items()
+           if k not in ("setpoint_entity", "soc_entity", "batt_entity",
+                        "max_w")}
+_ROSTER["inverters"] = [
+    dict(name=n, setpoint_entity=f"number.sp_{n[-1]}", max_w=w,
+         soc_entity=f"sensor.soc_{n[-1]}", batt_entity=f"sensor.batt_{n[-1]}",
+         bms_soc_floor=10)
+    for n, w in (("inverter-a", 2000), ("inverter-b", 200))]
+_DRIVEN = {
+    "formula card": dict(_BASE, price_provider="custom_formula",
+                         price_formula=_CARD),
+    "formula not valid": dict(_BASE, price_provider="custom_formula",
+                              price_formula='{"index": "epex_be"} x'),
+    "injection card": dict(_BASE, price_export_formula=_CARD),
+    "roster thresholds": dict(_ROSTER, maintenance_charge_w=100,
+                              maintenance_discharge_w=100),
+    "levies table and flat": dict(_BASE, price_taxes_profile=_TABLE,
+                                  price_taxes_eur_kwh=0.1198),
+    "feed and entities": dict(_BASE, price_provider="generic_dayahead",
+                              price_now_entity="sensor.now",
+                              price_avg_entity="sensor.avg"),
+    "fixed tariff and entities": dict(_BASE, static_profile=_TABLE,
+                                      price_now_entity="sensor.now",
+                                      price_avg_entity="sensor.avg"),
+    "fixed tariff not valid": dict(_BASE, static_profile='{"periods": []} x'),
+}
+_LEAKS = ("c_eur_per_kwh", "vat_pct", "its own card", "line 1 column",
+          "None", "JSON", "one you do not use")
+_shown, _long, _leaky = [], [], []
+for _name, _o in _DRIVEN.items():
+    _ps = validate_startup_config(_o, -5000, 5000)
+    _shown.append((_name, len(_ps)))
+    _long += [f"{_name}: {len(words(t))} words: {t}" for t in _ps
+              if len(words(t)) > 30]
+    _leaky += [f"{_name}: {t}" for t in _ps if any(x in t for x in _LEAKS)]
+check(f"every driven case is refused ({_shown})",
+      all(n >= 1 for _n, n in _shown)
+      and dict(_shown)["roster thresholds"] >= 2)
+check(f"...and every refusal, as SHOWN, is at most 30 words (too long: "
+      f"{_long})", not _long)
+check(f"...and shows no parser text, file units or Python's None (found: "
+      f"{_leaky})", not _leaky)
+
+# The config panel files a reason beside every setting whose key it names, but
+# `inverters.max_w` names a setting of one inverter in the list, not the flat
+# `max_w` (UX-08 2d, from the 2c test).
+from app.configui import problems_by_field                        # noqa: E402
+_by, _un = problems_by_field(
+    ["“Inverter rating” for inverter-b (inverters.max_w) is 200 W.",
+     "“Inverter rating” (max_w) is 0."], ["max_w", "inverters"])
+check("a roster refusal shows beside `inverters` only, and a flat one beside "
+      f"`max_w` ({ {k: len(v) for k, v in _by.items()} })",
+      _by.get("inverters") == [
+          "“Inverter rating” for inverter-b (inverters.max_w) is 200 W."]
+      and _by.get("max_w") == ["“Inverter rating” (max_w) is 0."]
+      and not _un)
+
+print(f"CI: UX-08 allowlist {len(allow)} entries "
+      + ", ".join(f"{k} {sum(1 for x in allow if x.startswith(k + ' '))}"
+                  for k in LIMITS))
+
+
+# ============================================================================== #
+print("\n4. DOCS.md holds the detail of every notification")
+DOCS = (HERE / "DOCS.md").read_text(encoding="utf-8")
+part = DOCS.split("\n## Notifications\n", 1)
+check("DOCS.md has a '## Notifications' section", len(part) == 2)
+section = part[-1].split("\n## ", 1)[0] if len(part) == 2 else ""
+heads = set(re.findall(r"^### (.+)$", section, re.M))
+missing = sorted({n.docs for n in SAMPLES} - heads)
+check(f"...with a heading for every Details line (missing: {missing})", not missing)
+check("DOCS.md explains the status page rows under "
+      f"'## {messages.DOCS_STATUS}'", f"\n## {messages.DOCS_STATUS}\n" in DOCS)
+
+
+# ============================================================================== #
+print("\n5. mutations: each rule catches a spoiled input")
+N = messages.Notice
+check("a six-word title is refused",
+      bool(title_problems("The meter reading may be stuck")))
+check("a GoodWe prefix is refused", bool(title_problems("GoodWe: meter stuck")))
+check("a second sentence in a warning is refused",
+      bool(body_problems("The battery lags. Check it.", messages.WARNING)))
+check("a semicolon run-on is refused, in an alarm too",
+      bool(body_problems("It stopped; check it.", messages.ALARM)))
+check("a fourth sentence in an alarm is refused",
+      bool(body_problems("One. Two. Three. Four.", messages.ALARM)))
+check("an internal name is refused", bool(body_problems(
+    "The integrator reached its bound.", messages.WARNING)))
+check("a card id is refused", bool(body_problems(
+    "See SAFETY-25.", messages.WARNING)))
+check("shouting is refused", bool(body_problems(
+    "Control is STILL RUNNING.", messages.WARNING)))
+check("an entity id in an alarm is refused", bool(body_problems(
+    "Check sensor.battery_power now.", messages.ALARM)))
+check("...but allowed in a refusal", not problems_of(
+    "refusal", "Check sensor.battery_power in Developer Tools."))
+check("a semicolon in a refusal or an option text is refused",
+      bool(problems_of("refusal", "It is wrong; fix it."))
+      and bool(problems_of("option-desc", "It is wrong; fix it.")))
+check("a label that drifted from en.yaml is caught",
+      "Inverter power" not in _label_stems("max_w"))
+check("an option key in an alarm is refused", bool(body_problems(
+    "Lower peak_soc_floor.", messages.ALARM)))
+check("a message that lost its Details line is refused",
+      ends_in_details(N("x", messages.WARNING, "Meter stuck", "It is.")
+                      .data()["message"], "Meter stuck")
+      and not ends_in_details("It is.", "Meter stuck"))
+_fake = "  x = {'text': 'THE METER IS FROZEN AND NOTHING WORKS AT ALL'}\n"
+_n = [t for node in ast.walk(ast.parse(_fake.strip()))
+      if isinstance(node, ast.Dict) for _, t in strings_in(node.values[0])]
+check("a second sentence in an amber row is refused",
+      bool(row_problems(messages.AMBER, "Meter stuck. Check it.")))
+check("a fourth sentence in a red row is refused",
+      bool(row_problems(messages.RED, "One. Two. Three. Four.")))
+check("a 16-word green row is refused",
+      bool(row_problems(messages.GREEN, " ".join(["word"] * 16))))
+check("a 13-word banner is refused",
+      bool(row_problems(None, " ".join(["word"] * 13))))
+check("an entity id in a status row is refused",
+      bool(row_problems(messages.GREEN, "Battery level: sensor.soc = 54")))
+check("a semicolon in a status row is refused",
+      bool(row_problems(messages.RED, "It stopped; check it.")))
+check("a new shouting status row is seen by the scan and is not listed",
+      _n and problems_of("row", _n[0])
+      and key_of("row", _n[0]) not in allow)
+_bad = ast.parse("await self.hass.call('persistent_notification', 'create', "
+                 "{'title': 'x', 'message': 'y'})", mode="exec")
+check("a hand-written notification payload is seen by part 2",
+      any(not (isinstance(c.args[2], ast.Call)) for c in notification_calls(_bad)))
+
+
+# ============================================================================== #
+print("\n6. log lines as they are built at run time (UX-10)")
+# Part 3 reads a WARNING+ line's own literal and counts each placeholder as one
+# word. So a reason text built elsewhere and passed in as `%s` was never seen:
+# the 2d test found "…clamped to +2000 W; … This is a BUG SIGNAL … Cut back 1
+# times" in the log while part 3 was green, because `loop_clamp_note()` built
+# it. This part closes that gap in two steps.
+#  a. Every dynamic part of every WARNING+ line in `app/` is classified here,
+#     as data (a number, a name, a path, an exception's own text) or as a text
+#     the add-on builds. A new dynamic part that is in neither list fails, so a
+#     new builder cannot slip past.
+#  b. Every built text is produced by the real code and checked. It is the
+#     evidence behind an alarm, so it gets the red-alarm shape: at most 3
+#     sentences of at most 30 words, 70 in all. It keeps its reason code. The
+#     whole line, as logged, may carry no semicolon, banned term, capitals,
+#     "1 times", "(s)" or a doubled full stop.
+from datetime import datetime as _dt, timedelta as _td, timezone as _tz  # noqa: E402
+
+from app import clamp as _clamp, freshness as _fresh, peakguard as _pg   # noqa: E402
+from app import store as _store                                         # noqa: E402
+from app.circulation import CirculationConfig, CirculationWatchdog      # noqa: E402
+from app.control import Tuning, compute                                 # noqa: E402
+from app.delivery import (DeliveryConfig, DeliveryWatchdog, UnitDelivery,  # noqa: E402
+                          delinquent)
+from app.freeze import FreezeWatchdog, FreezeWatchdogConfig             # noqa: E402
+from app.price import PricePoint, PriceProduct, PriceRead               # noqa: E402
+from app.static_tariff import TariffPlan                                # noqa: E402
+from app.tariff import Projection                                       # noqa: E402
+from app.watchdog import (AGAINST_METER, AGAINST_OWN_POWER, SignWatchdog,  # noqa: E402
+                          SignWatchdogConfig)
+
+_T0 = _dt(2026, 9, 27, 9, 0, tzinfo=_tz.utc)
+PLURAL = re.compile(r"\b1 [a-z]{2,}s\b(?<!\b1 [a-z]ss)|\w\(s\)")
+COUNT_PLURAL = re.compile(r"%d [a-z]{2,}s\b")
+
+
+def dynamic_parts(tree, fname):
+    """(key, call) for every dynamic part of a WARNING+ log call in `tree`."""
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        name = ast.unparse(node.func)
+        moan = name.endswith("._moan")
+        if not (LOG_CALL.search(name) or moan):
+            continue
+        i = 1 if moan else 0
+        if len(node.args) <= i:
+            continue
+        fmt = node.args[i]
+        parts = [ast.unparse(a) for a in node.args[i + 1:]]
+        if isinstance(fmt, ast.JoinedStr):
+            parts += [ast.unparse(v.value) for v in fmt.values
+                      if isinstance(v, ast.FormattedValue)]
+        elif not (isinstance(fmt, ast.Constant) and isinstance(fmt.value, str)):
+            parts.append(ast.unparse(fmt))
+        for part in parts:
+            yield f"{fname}:{part}", node
+
+
+# a. DATA: shown as it is, never worded by the add-on. An exception's text is
+# the library's (hass.py words the Home Assistant ones, UX-10 item 3).
+DATA = {
+    # hass.py: the _moan() wrapper and what its callers pass
+    "hass.py:msg", "hass.py:*args", "hass.py:entity_id", "hass.py:err",
+    "hass.py:obj", "hass.py:raw", "hass.py:domain", "hass.py:service",
+    "hass.py:resp.status", "hass.py:said", "hass.py:entity", "hass.py:what",
+    # UX-13 P2: the entity list's wait, and an error's text or else its name
+    "hass.py:STATES_TIMEOUT_S", "hass.py:str(err) or type(err).__name__",
+    # main.py
+    "main.py:'cancelled' if task.cancelled() else repr(exc) if exc else 'returned'",
+    "main.py:EXIT_CONTROL_DIED", "main.py:first.name", "main.py:OPTIONS_PATH",
+    "main.py:err", "main.py:', '.join(sorted(stranded))",
+    "main.py:sorted(on_roster)", "main.py:inv.name", "main.py:topic_s",
+    "main.py:more",
+    "main.py:inv.batt_fresh.bound.release_s", "main.py:inv.batt_fresh.bound.move_w",
+    "main.py:inv.batt_fresh.bound.unchanged_s", "main.py:inv.batt_fresh.held",
+    "main.py:value", "main.py:float(value)",
+    "main.py:entity", "main.py:WRITE_BUDGET_S",
+    "main.py:_e",
+    "main.py:messages.times(self.clamp_wd.engagements)",
+    "main.py:messages.when(brussels(self.tariff_at))",
+    "main.py:messages.duration(TARIFF_MAX_AGE_S)",
+    "main.py:messages.count(len(targets), 'inverter')",
+    "main.py:messages.seconds(self.p1.max_age_s)",
+    # maintenance.py, mqtt.py, p1.py
+    "maintenance.py:phase", "mqtt.py:err", "p1.py:err", "p1.py:self.host",
+    "p1.py:self.topic", "p1.py:poll_s", "p1.py:ingest.max_age_s",
+    "p1.py:backoff", "p1.py:self.url", "p1.py:str(err) or type(err).__name__",
+    "p1.py:self.poll_s",
+    # price.py
+    "price.py:doc.get('deprecated')", "price.py:len(dropped)",
+    "price.py:messages.count(len(times), 'time')", "price.py:plugin_id",
+    "price.py:override",
+    "price.py:', '.join((str(i) for i in dropped[:5])) + (' and more' if len(dropped) > 5 else '')",
+    "price.py:*(d.isoformat() for d in brussels_date_range(since, until))",
+    "price.py:pid",
+    "price.py:'/'.join(sorted((c.value for c in caps.sources - {Component.ENERGY})))",
+    "price.py:' and '.join(ignored) + (' is' if len(ignored) == 1 else ' are')",
+    "price.py:getattr(cls, 'id', cls)", "price.py:e", "price.py:type(e).__name__",
+    # price_history.py, selfconfig.py, static_tariff.py, store.py, tariff.py
+    "price_history.py:self.path", "price_history.py:day_words(want)",
+    "price_history.py:messages.count(len(points), 'price')",
+    "price_history.py:err",
+    "selfconfig.py:messages.count(len(problems), 'problem')",
+    "selfconfig.py:', '.join(keys) or 'none this page also edited'",
+    "static_tariff.py:e", "store.py:err", "store.py:key", "store.py:raw",
+    "tariff.py:self.path", "tariff.py:err", "tariff.py:start", "tariff.py:month",
+    # validate.py: option values and keys (the refusals are part 3's)
+    "validate.py:integ_w", "validate.py:max_w", "validate.py:disch_w",
+    "validate.py:maint_where", "validate.py:maint_cap", "validate.py:pid",
+    "validate.py:i", "validate.py:TAXES_PROFILE_OPTION", "validate.py:negative",
+    "validate.py:EXPORT_FORMULA_OPTION", "validate.py:xspec.passthrough",
+    "validate.py:xspec.offset_eur_kwh", "validate.py:'=' * 72",
+    "validate.py:'-' * 72",
+    "web.py:err",
+}
+
+
+# b. BUILT TEXT: each producer, run for real. A reason that is only ever
+# stored and restored (a saved safety stop) is produced by the same builder.
+def _sign(against, cmd=1500.0, got=-1400.0):
+    wd = SignWatchdog(SignWatchdogConfig(min_w=250.0, hold_s=60.0),
+                      against=against)
+    for s in (0, 61):
+        wd.evaluate(cmd, got, True, _T0 + _td(seconds=s))
+    return wd.reason
+
+
+def _sign_texts():
+    return [_sign(AGAINST_METER), _sign(AGAINST_OWN_POWER, -1100.0, 2000.0)]
+
+
+def _circ_texts():
+    wd = CirculationWatchdog(CirculationConfig(min_w=250.0, hold_s=60.0))
+    for s, w in ((0, 5200.0), (30, 6000.0), (61, 5800.0)):
+        wd.evaluate(w, _T0 + _td(seconds=s))
+    return [wd.reason]
+
+
+def _delivery_texts():
+    units = [UnitDelivery("inverter-a", 1000.0, 990.0),
+             UnitDelivery("inverter-b", 2000.0, 0.0)]
+    sentence = delinquent(units, 200.0)["inverter-b"]
+    wd = DeliveryWatchdog(DeliveryConfig(hold_s=120.0))
+    for s in (0, 121):
+        wd.evaluate(sentence, _T0 + _td(seconds=s))
+    return [wd.reason]
+
+
+def _freeze_texts():
+    out = []
+    for dev in (None, 4700.0):
+        wd = FreezeWatchdog(FreezeWatchdogConfig(hold_s=600.0))
+        wd.evaluate(3600.0, 4480.0 if dev else 5000.0, 5000.0, _T0,
+                    dev_min=-dev if dev else None, dev_max=dev)
+        out.append(wd.reason)
+    return out
+
+
+def _stale_texts():
+    one = _fresh.Freshness(_fresh.BOUNDS["batt"])
+    for t in range(0, 40):
+        one.submit(-1200.0, -1200.0 if t < 1 else 1300.0, float(t))
+    two = _fresh.Freshness(_fresh.BOUNDS["batt"])
+    for t in range(0, 40):
+        two.submit(-1200.0, -1200.0 if t < 1 else 1300.0, float(t))
+    for t in range(40, 80):
+        two.submit(-1200.0, 0.0, float(t))
+    for t in range(80, 130):
+        two.submit(-1200.0, 1300.0, float(t))
+    return [one.reason, two.reason]
+
+
+def _clamp_texts():
+    over = compute(prev_w=1000.0, grid_w=9000.0, actual_w=1000.0,
+                   tuning=Tuning(max_w=5000.0, slew_w=1000.0, gain=0.6,
+                                 integrator_max_w=9000.0), i_w=8000.0)
+    at = compute(prev_w=1000.0, grid_w=9000.0, actual_w=1000.0,
+                 tuning=Tuning(max_w=5000.0, slew_w=1000.0, gain=0.6),
+                 i_w=4500.0)
+    write = [(n, _clamp.clamp_to_rating(w, 5000.0, -2500.0, 2500.0))
+             for n, w in (("inverter-a", 3000.0), ("inverter-b", -7412.0))]
+    # One inverter is not named (main.py passes None), several are.
+    return [_clamp.loop_clamp_note(over), _clamp.loop_clamp_note(at),
+            _clamp.write_clamp_note([(None, write[0][1])]),
+            _clamp.write_clamp_note(write[:1]), _clamp.write_clamp_note(write)]
+
+
+def _peak_texts():
+    proj = Projection(projected_w=4338.0, elapsed_w=4338.0, elapsed_s=799.0,
+                      covered_frac=1.0, complete=False, block_start=_T0,
+                      held_w=0.0)
+    kw = dict(cap_w=3500.0, margin_w=0.0, reading=None, soc_floor=30.0, max_hold_s=30.0)
+    sat = _pg.decide(proj, batt_w=1500.0, achievable_w=5000.0, soc=80.0, **kw)
+    low = _pg.decide(proj, batt_w=1500.0, achievable_w=5000.0, soc=20.0, **kw)
+    unread = _pg.decide(proj, batt_w=1500.0, achievable_w=5000.0, soc=None, **kw)
+    return [sat.reason, low.reason, unread.reason]
+
+
+def _migration_texts():
+    out = []
+    for moved, kept, lost, wrong in (
+            (2, 0, 0, 0), (2, 1, 1, 0), (2, 0, 0, 1), (0, 2, 0, 0),
+            (0, 2, 1, 0)):
+        rep = _store.MigrationReport()
+        rep.ran = moved > 0 or lost > 0
+        rep.from_version = 1
+        rep.roster = ["inverter-a"]
+        rep.moved = {f"unit/inverter-a/k{i}": True for i in range(moved)}
+        rep.kept = [f"unit/inverter-a/old{i}" for i in range(kept)]
+        for i in range(lost):
+            note = f"unit/inverter-a/k{i} was written as True and reads back as None"
+            rep.problems.append(note)
+            rep.lost.append(note)
+        for i in range(wrong):
+            note = (f"unit/garage/k{i} was migrated into namespace 'garage', "
+                    f"which is not in the inverter list")
+            rep.problems.append(note)
+            rep.misdirected.append(note)
+        out.append(rep.explain())
+    return out
+
+
+def _tariff_texts():
+    hours = [_T0 + _td(minutes=15 * i) for i in range(8)]
+    pts = [PricePoint(h, 0.2, i >= 4) for i, h in enumerate(hours)]
+    read = PriceRead.series(pts, PriceProduct.DAY_AHEAD, "x", _T0)
+    return [TariffPlan(read, None, "provider").words,
+            TariffPlan(PriceRead.no_data("the price feed timed out"), None,
+                       "none").words]
+
+
+def _static(spec):
+    """Templates for a family of builders that is not one function: the first
+    argument of every call to `spec`, or every value assigned to `spec`, in
+    the named file (placeholders count as one word, as in part 3)."""
+    fname, kind, name = spec
+    out = []
+    for f in ([APP / fname] if fname != "*" else sorted(APP.glob("*.py"))):
+        tree = ast.parse(f.read_text(encoding="utf-8"))
+        for node in ast.walk(tree):
+            if kind == "call" and isinstance(node, ast.Call) and node.args \
+                    and ast.unparse(node.func).split(".")[-1] == name:
+                out += [t for _n, t in strings_in(node.args[0])]
+            elif kind == "assign" and isinstance(node, ast.Assign) \
+                    and ast.unparse(node.targets[0]) == name:
+                out += [t for _n, t in strings_in(node.value)]
+            elif kind == "return" and isinstance(node, ast.FunctionDef) \
+                    and node.name == name:
+                out += [t for r in ast.walk(node) if isinstance(r, ast.Return)
+                        and r.value is not None for _n, t in strings_in(r.value)]
+    return [t for t in out if len(words(t)) > 1]
+
+
+# UX-11: a WARNING+ line quotes a safety reason by its code only. The reason,
+# with its figures, is on a DEBUG line beside it and in the action log.
+SAFETY_REASONS = {
+    "sign": _sign_texts, "circulation": _circ_texts,
+    "delivery": _delivery_texts, "clamp": _clamp_texts, "peak": _peak_texts,
+    "freeze": _freeze_texts, "stale": _stale_texts,
+}
+
+
+def _coded(maker):
+    """The codes a WARNING+ line shows for the reasons `maker` builds, plus
+    the fallback for a restored stop with no reason saved."""
+    return lambda: ([messages.reason_code(t) for t in maker()]
+                    + [messages.reason_code("")])
+
+
+TEXT = {
+    "main.py:messages.reason_code(first.sign_wd.reason)": _coded(_sign_texts),
+    "main.py:messages.reason_code(inv.sign_wd.reason)": _coded(_sign_texts),
+    "main.py:messages.reason_code(self.site_sign_wd.reason)":
+        _coded(_sign_texts),
+    "main.py:messages.reason_code(self.circ_wd.reason)": _coded(_circ_texts),
+    "main.py:messages.reason_code(inv.delivery_wd.reason)":
+        _coded(_delivery_texts),
+    "main.py:messages.reason_code(self.clamp_wd.reason)": _coded(_clamp_texts),
+    "main.py:messages.reason_code(g.reason)": _coded(_peak_texts),
+    "main.py:messages.reason_code(self.freeze_wd.reason)":
+        _coded(_freeze_texts),
+    "main.py:messages.reason_code(inv.batt_fresh.reason)": _coded(_stale_texts),
+    "main.py:rep.explain()": _migration_texts,
+    "store.py:rep.explain()": _migration_texts,
+    "main.py:plan.words": _tariff_texts,
+    # OPT-11 P2: why an MQTT command was ignored.
+    "main.py:why": lambda: list(messages.PACK_REFUSED.values()),
+    # Families: every builder of the text, as a template.
+    "main.py:refusal": lambda: (_static(("main.py", "return", "write_refusal"))
+                                + _static(("allocator.py", "return", "authorises"))),
+    "main.py:' / '.join(resolution.scope_errors)":
+        lambda: _static(("arbiter.py", "return", "scope_violations"))
+        + _static(("arbiter.py", "call", "append")),
+    "price_forecast.py:gate.reason": lambda: _static(("*", "call", "block")),
+    "static_tariff.py:read.reason": lambda: _static(("*", "call", "no_data")),
+    "price_history.py:self.last_error":
+        lambda: _static(("price_history.py", "assign", "self.last_error")),
+    "price_history.py:bad": lambda: _static(("price_history.py", "return",
+                                             "_parse_points")),
+    "maintenance.py:msg": lambda: _static(("maintenance.py", "assign", "msg")),
+    "validate.py:aged": lambda: _static(("*", "return", "stale_card")),
+    "validate.py:xaged": lambda: _static(("*", "return", "stale_card")),
+    # Refusals: part 3 holds them to the refusal rule already.
+    "selfconfig.py:problems[0]": None,
+    "validate.py:problem": None,
+    "p1.py:problem": None,
+}
+
+
+# UX-11: a WARNING+ line, as logged with its built text filled in, is at most
+# 25 words (STYLE.md). These families are not safety reasons and were not
+# rewritten by UX-11. Each is listed with why, the list may only shrink
+# (LONG_LINE_CAP), and a listed key that no longer runs long fails.
+LONG_LINE_OK = {
+    "main.py:plan.words": "tariff plan words, TARIFF-11 pins them, follow-up",
+    "static_tariff.py:read.reason": "price feed reasons, follow-up",
+    "main.py:rep.explain()": "state migration report, names saved keys",
+    "store.py:rep.explain()": "state migration report, names saved keys",
+    "main.py:refusal": "write refusals, a software fault only",
+    "main.py:' / '.join(resolution.scope_errors)":
+        "claim scope errors, a software fault only",
+    "maintenance.py:msg": "maintenance gate reasons, follow-up",
+    "price_forecast.py:gate.reason": "trading gate reasons, follow-up",
+    "price_history.py:self.last_error": "price history errors, follow-up",
+}
+LONG_LINE_CAP = 9
+LINE_WORDS = 25
+
+
+def reason_problems(text):
+    """STYLE.md's red-alarm shape, for a text a log line quotes."""
+    out = []
+    n_s, n_w = sentences(text), len(words(text))
+    if n_s > 3:
+        out.append(f"over 3 sentences ({n_s})")
+    if n_w > 70:
+        out.append(f"over 70 words ({n_w})")
+    long = [x for x in re.split(r"(?<=[.!?])\s+", text) if len(words(x)) > 30]
+    if long:
+        out.append(f"a sentence over 30 words ({len(words(long[0]))})")
+    return out + line_problems(text)
+
+
+def logged_shape(line):
+    """UX-10 review: the line as logged, wrapper and reason together, has the
+    red-alarm shape too. The reason alone passing is not enough: the 2d-style
+    "title: reason. tail. tail." line read as 4 sentences with a 3-sentence
+    reason inside it."""
+    out = []
+    if sentences(line) > 3:
+        out.append(f"over 3 sentences ({sentences(line)})")
+    long = [x for x in re.split(r"(?<=[.!?])\s+", line) if len(words(x)) > 30]
+    if long:
+        out.append(f"a sentence over 30 words ({len(words(long[0]))})")
+    return out
+
+
+def line_problems(text):
+    """What no WARNING+ line may carry, whatever its length."""
+    out = []
+    if ";" in text:
+        out.append("semicolon")
+    if re.search(r"(?<!\.)\.\.(?!\.)|\.{4,}|\.:|:\s*\.", text):
+        out.append("a doubled full stop")
+    if PLURAL.search(text):
+        out.append("plural: " + PLURAL.search(text).group(0))
+    return out + text_problems(text, keys=True, entities=True)
+
+
+def _fill(template, fmt_node, key_part, sample):
+    """The line as logged: `sample` in the text slot, `X` in the others."""
+    if isinstance(fmt_node, ast.JoinedStr):
+        return template.replace("{" + key_part + "}", sample)
+    return template  # %-style: filled by the caller
+
+
+def scan_log_lines(files, text=None, data=None, long_ok=None, long_seen=None):
+    """-> (unclassified keys, stale keys, [(key, sample, problems)])."""
+    text = TEXT if text is None else text
+    data = DATA if data is None else data
+    long_ok = LONG_LINE_OK if long_ok is None else long_ok
+    long_seen = set() if long_seen is None else long_seen
+    seen, bad = set(), []
+    for fname, tree in files:
+        for key, call in dynamic_parts(tree, fname):
+            seen.add(key)
+            if key in data or key not in text:
+                continue
+            maker = text[key]
+            if maker is None:
+                continue
+            i = 1 if ast.unparse(call.func).endswith("._moan") else 0
+            fmt = call.args[i]
+            template = render(fmt) or ""
+            args = [ast.unparse(a) for a in call.args[i + 1:]]
+            part = key.split(":", 1)[1]
+            for sample in maker():
+                p = reason_problems(sample)
+                if isinstance(fmt, ast.JoinedStr):
+                    line = template.replace("{" + part + "}", sample)
+                else:
+                    slots = iter(["%s" if a != part else "\0" for a in args])
+                    line = re.sub(r"%[-+ #0-9.]*[sdrfgx]",
+                                  lambda m: next(slots, m.group(0)), template)
+                    line = PLACEHOLDER.sub("X", line).replace("\0", sample)
+                p += [f"as logged: {x}" for x in line_problems(line)
+                      + logged_shape(line) if x not in p]
+                if len(words(line)) > LINE_WORDS:
+                    long_seen.add(key)
+                    if key not in long_ok:
+                        p.append(f"as logged: over {LINE_WORDS} words "
+                                 f"({len(words(line))})")
+                if p:
+                    bad.append((key, sample, p))
+    unknown = sorted(seen - set(data) - set(text))
+    stale = sorted((set(data) | set(text)) - seen)
+    return unknown, stale, bad
+
+
+_FILES = [(f.name, ast.parse(f.read_text(encoding="utf-8")))
+          for f in sorted(APP.glob("*.py"))]
+_long_seen = set()
+_unknown, _stale, _bad = scan_log_lines(_FILES, long_seen=_long_seen)
+for k, sample, p in _bad:
+    print(f"       BAD  {k}: {'; '.join(p)} :: {sample!r}")
+check(f"every dynamic part of a WARNING+ line is classified as data or as a "
+      f"built text (unclassified: {_unknown})", not _unknown)
+check(f"...and no classification is left over from a line that is gone "
+      f"(stale: {_stale})", not _stale)
+_n_texts = sum(len(m()) for m in TEXT.values() if m is not None)
+check(f"UX-11: no WARNING+ line runs over {LINE_WORDS} words as logged, except "
+      f"the {len(LONG_LINE_OK)} listed families, and none of them is a safety "
+      f"reason (cap {LONG_LINE_CAP})",
+      len(LONG_LINE_OK) <= LONG_LINE_CAP
+      and not any("reason_code" in k
+                  or TEXT.get(k) in SAFETY_REASONS.values()
+                  for k in LONG_LINE_OK))
+check(f"...and every listed family still runs long, so the list only shrinks "
+      f"(no longer long: {sorted(set(LONG_LINE_OK) - _long_seen)})",
+      set(LONG_LINE_OK) <= _long_seen)
+
+
+def _code_lines_without_evidence(files):
+    """WARNING+ calls quoting `messages.reason_code(X)` whose next statement
+    is not a DEBUG call that logs X itself (UX-11: nothing is lost)."""
+    out, n = [], 0
+    for fname, tree in files:
+        for node in ast.walk(tree):
+            for body in (getattr(node, f, None) for f in ("body", "orelse")):
+                if not isinstance(body, list):
+                    continue
+                for i, st in enumerate(body):
+                    call = st.value if isinstance(st, ast.Expr) else None
+                    if not (isinstance(call, ast.Call)
+                            and LOG_CALL.search(ast.unparse(call.func))):
+                        continue
+                    coded = [a.args[0] for a in call.args
+                             if isinstance(a, ast.Call) and a.args
+                             and ast.unparse(a.func) == "messages.reason_code"]
+                    if not coded:
+                        continue
+                    n += 1
+                    nxt = body[i + 1] if i + 1 < len(body) else None
+                    dbg = (nxt.value if isinstance(nxt, ast.Expr)
+                           and isinstance(nxt.value, ast.Call)
+                           and ast.unparse(nxt.value.func).endswith(".debug")
+                           else None)
+                    want = ast.unparse(coded[0])
+                    if dbg is None or not any(
+                            ast.unparse(a) == want
+                            or ast.unparse(a).startswith(want + " or ")
+                            for a in dbg.args):
+                        out.append(f"{fname}:{call.lineno}")
+    return n, out
+
+
+_n_coded, _no_evidence = _code_lines_without_evidence(_FILES)
+check(f"every WARNING+ line that quotes a reason code ({_n_coded}) has the "
+      f"reason itself on a DEBUG line right after it (missing: {_no_evidence})",
+      _n_coded >= 14 and not _no_evidence)
+_n_m, _m_bad = _code_lines_without_evidence([("x.py", ast.parse(
+    "_LOG.error('Stop: %s.', messages.reason_code(wd.reason))\n"
+    "_LOG.debug('Something else.')\n"))])
+check("...and a line whose DEBUG evidence was dropped is caught",
+      _n_m == 1 and _m_bad == ["x.py:1"])
+_evidence_bad = [(n, t, reason_problems(t)) for n, m in SAFETY_REASONS.items()
+                 for t in m() if reason_problems(t)]
+check(f"the safety reasons behind those lines, on the DEBUG line and in the "
+      f"action log, keep the red-alarm shape ({_evidence_bad})",
+      not _evidence_bad)
+_codes = {n: [messages.reason_code(t) for t in m()]
+          for n, m in SAFETY_REASONS.items()}
+check(f"...and every one carries a code the line can quote ({_codes})",
+      all(re.fullmatch(r"[A-Z]+(?:_[A-Z]+)+", c)
+          and c not in (messages.NO_REASON_SAVED, messages.NO_REASON_CODE)
+          for cs in _codes.values() for c in cs))
+check(f"every built text, run for real, obeys the rule, and so does the line "
+      f"that quotes it ({_n_texts} texts, {len(_bad)} bad)", not _bad)
+_counts = [f"{f}:{n.lineno}" for f, t in _FILES for n in ast.walk(t)
+           if isinstance(n, ast.Call) and (LOG_CALL.search(ast.unparse(n.func))
+                                           or ast.unparse(n.func).endswith("._moan"))
+           for a in n.args[:2] if isinstance(a, ast.Constant)
+           and isinstance(a.value, str) and COUNT_PLURAL.search(a.value)]
+check(f"no WARNING+ line puts a plural noun after a bare count, which reads "
+      f"'1 times' (use messages.times() and friends; found: {_counts})",
+      not _counts)
+
+# UX-10 review: the two clamp lines the owner quoted, as logged for one
+# inverter, fit the red shape the tight way: at most 3 sentences and 30 words
+# in all, code and numbers kept. The real literals from main.py, filled with
+# the real notes.
+def _clamp_line(opening):
+    for n in ast.walk(dict(_FILES)["main.py"]):
+        if isinstance(n, ast.Call) and LOG_CALL.search(ast.unparse(n.func)) \
+                and n.args and (render(n.args[0]) or "").startswith(opening):
+            return n.args[0].value
+    return None
+
+
+_over, _at, _w1, _w1n, _w2 = _clamp_texts()
+_clamp_lines = {
+    "error, loop": (_clamp_line("Power request too high"), _over),
+    "error, write": (_clamp_line("Power request too high"), _w1),
+    "warning, loop": (_clamp_line("The battery gives less than asked"), _at),
+}
+_clamp_shown = {k: (f % (messages.reason_code(r), messages.times(1))
+                    if f else None)
+                for k, (f, r) in _clamp_lines.items()}
+for k, v in _clamp_shown.items():
+    print(f"       {k}: {v!r} ({len(words(v or ''))} words)")
+check("UX-11: the clamp lines are at most 25 words and keep OUTPUT_CLAMP and "
+      "the count, and the numbers are in the reason the DEBUG line beside "
+      "them logs",
+      all(v and len(words(v)) <= LINE_WORDS
+          and "OUTPUT_CLAMP" in v and "1 time so far" in v
+          and "+9000" not in v for v in _clamp_shown.values())
+      and "software fault" in _clamp_shown["error, loop"]
+      and all(x in _over for x in ("+9000 W", "+5000 W", "+2000 W")))
+
+# Mutations: the scan catches what the 2d scan missed.
+_OLD_CLAMP = ("OUTPUT_CLAMP: the loop computed +2148 W, over the 2000 W rating, "
+              "and it was clamped to +2000 W; the loop's command this cycle was "
+              "+440 W. This is a BUG SIGNAL, not a limit being used: something "
+              "upstream computed a setpoint the actuator cannot deliver.")
+_mut_text = dict(TEXT, **{"main.py:messages.reason_code(self.clamp_wd.reason)":
+                          lambda: [_OLD_CLAMP]})
+_u, _s, _b = scan_log_lines([f for f in _FILES if f[0] == "main.py"],
+                            text=_mut_text)
+check("an injected bad reason (the 2d clamp text) is caught, on both clamp "
+      f"lines ({sorted({k for k, _t, _p in _b if 'clamp' in k})})",
+      [k for k, _t, _p in _b].count(
+          "main.py:messages.reason_code(self.clamp_wd.reason)") == 2)
+# UX-11: the line that quoted the whole STALE_READING reason (60 words on
+# TEST-23) is caught by the length rule alone.
+_old_stale = dict(TEXT, **{"main.py:messages.reason_code(inv.batt_fresh.reason)":
+                           _stale_texts})
+_u, _s, _b = scan_log_lines([f for f in _FILES if f[0] == "main.py"],
+                            text=_old_stale)
+check("...and the UX-10 stale line, which quoted the whole reason, is caught "
+      f"for its length ({[p for k, _t, p in _b if 'batt_fresh' in k][:1]})",
+      any("batt_fresh" in k and any(f"over {LINE_WORDS} words" in x for x in p)
+          for k, _t, p in _b))
+_new_site = ast.parse("_LOG.warning('Something broke: %s', self.new_wd.reason)")
+_u, _s, _b = scan_log_lines([("main.py", _new_site)])
+check(f"...and a new line quoting a text nobody classified is caught ({_u})",
+      _u == ["main.py:self.new_wd.reason"])
+check("...and '1 times', '(s)', a semicolon and a doubled full stop in a "
+      "logged line are caught",
+      all(line_problems(t) for t in ("Cut back 1 times so far.",
+                                     "2 malformed point row(s) dropped.",
+                                     "It failed; retrying.",
+                                     "Cut back to +2000 W.. Only this.",
+                                     "index 0, 1, .... Those are left out.",
+                                     "moved to one part: . Problems")))
+check("...and so is the 2d-style line, a 2-sentence reason inside a title and "
+      "two tails, which reads as 4 sentences although the reason passes",
+      logged_shape("Power request too high: OUTPUT_CLAMP: cut to +5000 W. The "
+                   "command was +1000 W. Control is still running. Cut back "
+                   "1 time so far.")
+      and not reason_problems("OUTPUT_CLAMP: cut to +5000 W. The command was "
+                              "+1000 W"))
+check("...while '1 s' and '1 time' are fine",
+      not line_problems("Held for 1 s, cut back 1 time so far."))
+# INFO lines are not held to the length rule, but the 2d test found "§8.3",
+# ISO timestamps and "keys ARE" in them. Their literals may carry none.
+INFO_JARGON = re.compile(r"§\s?\d|isoformat|\b(?:ARE|NOT|AND)\b")
+_info_bad = [f"{f}:{n.lineno}" for f, t in _FILES for n in ast.walk(t)
+             if isinstance(n, ast.Call) and n.args
+             and re.search(r"(?:^|\.)(?:_LOG|log|logger|LOG)\.info$",
+                           ast.unparse(n.func))
+             for _n, s in strings_in(n.args[0])
+             if INFO_JARGON.search(ast.unparse(n.args[0])) or SHOUT.search(s)]
+check(f"no INFO line carries a section number, an ISO timestamp or capitals "
+      f"(found: {_info_bad})", not _info_bad)
+check("...and one that did is caught",
+      bool(INFO_JARGON.search('"§8.3 price history: %s"'))
+      and bool(SHOUT.search("the flat keys ARE NOT that pack's history")))
+
+
+# ============================================================================== #
+print("\n7. log levels, log noise and the display bugs (UX-10)")
+import logging                                                    # noqa: E402
+
+from app import hass as _hass, p1 as _p1, validate as _validate, web as _web  # noqa: E402
+from app.arbiter import Claim                                     # noqa: E402
+from app.main import Controller, why_key                          # noqa: E402
+from app import control as _control                              # noqa: E402
+from app import main as _main                                    # noqa: E402
+
+
+class _Rec(logging.Handler):
+    def __init__(self):
+        super().__init__(logging.DEBUG)
+        self.records = []
+
+    def emit(self, record):
+        self.records.append(record)
+
+
+def _captured(logger_name, fn):
+    rec, lg = _Rec(), logging.getLogger(logger_name)
+    old = lg.level
+    lg.addHandler(rec)
+    lg.setLevel(logging.DEBUG)
+    try:
+        fn()
+    finally:
+        lg.removeHandler(rec)
+        lg.setLevel(old)
+    return rec.records
+
+
+def _level_of(fname, words_in_line):
+    """The level of the log call in `fname` whose literal holds the words."""
+    tree = ast.parse((APP / fname).read_text(encoding="utf-8"))
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Call) and node.args \
+                and re.search(r"_LOG\.\w+$", ast.unparse(node.func)):
+            text = render(node.args[0]) or ""
+            if words_in_line in text:
+                return ast.unparse(node.func).rsplit(".", 1)[-1]
+    return None
+
+
+check("the shadow line of every cycle is DEBUG, not INFO in capitals "
+      f"({_level_of('main.py', 'Shadow mode: would send')})",
+      _level_of("main.py", "Shadow mode: would send") == "debug"
+      and _level_of("main.py", "SHADOW MODE: not commanding") is None)
+check("'Shadow mode is on' and 'is off', which follow a setting or a button, "
+      f"are INFO ({_level_of('main.py', 'Shadow mode is on')}, "
+      f"{_level_of('main.py', 'Shadow mode is off')})",
+      _level_of("main.py", "Shadow mode is on") == "info"
+      and _level_of("main.py", "Shadow mode is off") == "info")
+_access = {}
+for _lvl in (logging.INFO, logging.DEBUG):
+    logging.getLogger("goodwe.web").setLevel(_lvl)
+    _access[logging.getLevelName(_lvl)] = _web.access_log()
+logging.getLogger("goodwe.web").setLevel(logging.NOTSET)
+_start_src = " ".join(
+    ast.unparse(n) for n in ast.walk(ast.parse(
+        (APP / "web.py").read_text(encoding="utf-8")))
+    if isinstance(n, ast.AsyncFunctionDef) and n.name == "start")
+check(f"the page's own polls are not logged at INFO: aiohttp's access log is "
+      f"off unless the log level is debug ({_access})",
+      _access["INFO"] is None
+      and isinstance(_access["DEBUG"], logging.Logger)
+      and "access_log=access_log()" in _start_src)
+_validate.WARN_ONCE.seen.clear()        # part 3 ran the validator already
+_twice = _captured("goodwe.config", lambda: [
+    _validate.validate_startup_config(
+        dict(_BASE, price_provider="generic_dayahead", static_profile=""),
+        -5000, 5000) for _ in range(2)])
+_sp = [r for r in _twice if "static_profile is empty" in r.getMessage()]
+check(f"a settings warning is logged once per start, though the check runs "
+      f"twice ({len(_sp)} line(s))", len(_sp) == 1
+      and _sp[0].levelno == logging.WARNING)
+
+
+def _outage():
+    o = _hass.Outage()
+    o.down("api", "error 502", "read sensor.x: 502, message='Bad Gateway'")
+    o.down("api", "error 502", "read sensor.y: 502")
+    o.down("websocket", "the meter connection closed",
+           "Received message 8:1000 is not str")
+    o.up("api")
+    o.up("websocket")
+    o.down("api", "no connection", "Cannot connect to host supervisor:80")
+
+
+_out = _captured("goodwe.hass", _outage)
+_warn = [r.getMessage() for r in _out if r.levelno == logging.WARNING]
+_info = [r.getMessage() for r in _out if r.levelno == logging.INFO]
+check(f"a Home Assistant restart is one plain WARNING line, and one INFO line "
+      f"when both connections are back ({_warn}, {_info})",
+      _warn[:1] == ["Home Assistant is not answering (error 502), perhaps it "
+                    "is restarting. The add-on keeps trying."]
+      and _info == ["Home Assistant answers again."] and len(_warn) == 2)
+check("...and the library's own text is kept, at DEBUG",
+      any("Received message 8:1000" in r.getMessage() for r in _out
+          if r.levelno == logging.DEBUG)
+      and not any("8:1000" in m or "Bad Gateway" in m for m in _warn + _info))
+
+
+class _Resp400:
+    def __init__(self, body):
+        self.status, self.reason, self._body = 400, "Bad Request", body
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *a):
+        return False
+
+    async def text(self):
+        return self._body
+
+
+class _Session400:
+    def __init__(self, body):
+        self.body = body
+
+    def post(self, *a, **k):
+        return _Resp400(self.body)
+
+
+def _refused(body):
+    ha = _hass.HomeAssistant(_Session400(body), token="t")
+    ok = []
+    recs = _captured("goodwe.hass", lambda: ok.append(asyncio.run(
+        ha.call("number", "set_value", {"entity_id": "number.sp", "value": 1}))))
+    return (ok[0] if ok else None), [r.getMessage() for r in recs
+                                     if r.levelno == logging.WARNING]
+
+
+def _one(res):
+    """(write result, the one WARNING line) or a named absence that fails."""
+    ok, lines = res
+    return ok, (lines[0] if len(lines) == 1 else f"<{len(lines)} lines>")
+
+
+_bare_ok, _bare = _one(_refused("400: Bad Request"))
+_full_ok, _full = _one(_refused(
+    '{"message": "Value 6000 for number.sp is outside valid range"}'))
+check(f"a write Home Assistant refuses while it loads is one plain WARNING, "
+      f"still a failed write, without the empty '400: Bad Request' ({_bare!r})",
+      _bare_ok is False
+      and _bare.startswith("Home Assistant refused number.set_value for "
+                           "number.sp (error 400, no details).")
+      and "Bad Request" not in _bare)
+check(f"...while a body that says more is still quoted ({_full!r})",
+      _full_ok is False and "outside valid range" in _full)
+
+
+class _WS:
+    def __init__(self, kind):
+        self.kind = kind
+
+    async def receive(self):
+        return type("M", (), {"type": self.kind, "data": "{}"})()
+
+
+def _closed_ws():
+    try:
+        asyncio.run(_p1._receive_json(_WS(_p1.aiohttp.WSMsgType.CLOSE)))
+    except ConnectionResetError as e:
+        return str(e)
+    return None
+
+
+check(f"a socket Home Assistant closed is a plain ConnectionResetError, which "
+      f"the reconnect loop reports through that one line ({_closed_ws()!r})",
+      (_closed_ws() or "").startswith("Home Assistant closed the connection"))
+
+# "Why: Other". Every winner and every safety reason the code can produce has
+# words. The keys are found in the code: each `Claim.set(source, ..., reason)`
+# through main.why_key(), plus main.py's own refusal to split ("unsplit").
+_SOURCES = {}
+for _f in sorted(APP.glob("*.py")):
+    _tree = ast.parse(_f.read_text(encoding="utf-8"))
+    _consts = _module_constants(_tree)
+    for _n in ast.walk(_tree):
+        if isinstance(_n, ast.Call) and ast.unparse(_n.func) == "Claim.set" \
+                and _n.args:
+            _src = _n.args[0]
+            _src = (_src.value if isinstance(_src, ast.Constant)
+                    else _consts.get(getattr(_src, "id", ""), None))
+            _rsn = next((k.value for k in _n.keywords if k.arg == "reason"),
+                        _n.args[3] if len(_n.args) > 3 else None)
+            _rsn = _rsn.value if isinstance(_rsn, ast.Constant) else ""
+            _SOURCES.setdefault((_src, _rsn), f"{_f.name}:{_n.lineno}")
+_keys = {why_key(s, [Claim.set(s, 0, 0.0, r)]) for s, r in _SOURCES}
+_keys |= {why_key("failsafe", []),
+          why_key("failsafe", [Claim.set("loop", 0, 1.0, "tracking")])}
+# SAFETY-52: the loop's claim reason is computed, so the scan cannot see it.
+_keys |= {why_key("loop", [Claim.set("loop", 0, 0.0, _r)])
+          for _r in (_control.REFUSED, _control.PROBING)}
+check("...including the loop's two battery-refuses reasons, which get words of "
+      "their own", {_control.REFUSED, _control.PROBING} <= _keys)
+check(f"the scan found the claims ({len(_SOURCES)}), including the latched "
+      f"per-inverter stop the 2d test saw as 'Other'",
+      ("failsafe", "sign disagreement") in _SOURCES and len(_SOURCES) >= 8)
+_missing_why = sorted(k for k in _keys if k not in messages.WHY_WINNER)
+check(f"every winner and safety reason has words in messages.WHY_WINNER "
+      f"(missing: {_missing_why}, keys: {sorted(_keys)})", not _missing_why)
+check("...so the latched stop reads as a safety stop, not 'Other' "
+      f"({messages.why(why_key('failsafe', [Claim.set('failsafe', 0, 0.0, 'sign disagreement')]), 0)!r})",
+      messages.why(why_key("failsafe", [Claim.set("failsafe", 0, 0.0,
+                                                  "sign disagreement")]), 0)
+      == "Safety stop, power went the wrong way: 0 W")
+_without = {k: v for k, v in messages.WHY_WINNER.items()
+            if k != "sign disagreement"}
+check("...and a table that lost that entry is caught",
+      any(k not in _without for k in _keys))
+
+
+class _H:
+    async def number(self, *a, **k):
+        return None
+
+    async def limits(self, *a):
+        return (-2000.0, 2000.0, 1.0)
+
+    async def call(self, *a, **k):
+        return True
+
+    async def set_number(self, *a, **k):
+        return True
+
+
+class _S:
+    data = {}
+
+    def set(self, *a):
+        pass
+
+    def get_time(self, *a):
+        return None
+
+
+class _P:
+    enabled = False
+
+    def publish(self, *a, **k):
+        pass
+
+
+_c = Controller({"setpoint_entity": "number.sp", "meter_source": "off",
+                 "max_w": 2000, "stale_input_s": 15}, _H(), _S(), _P(),
+                stop=asyncio.Event())
+_c.p1_enabled = True
+_c.p1 = _p1.P1Ingest(max_age_s=30.0)
+
+
+def _meter_row():
+    """The meter row, or a named absence that fails every check below."""
+    rows = [r for r in _c.checks() if r.get("id") == "meter"]
+    return rows[0] if len(rows) == 1 else {
+        "ok": None, "warn": None, "text": f"<{len(rows)} meter rows>"}
+
+
+_r0 = _meter_row()
+_c.p1.started_mono -= 31.0
+_r1 = _meter_row()
+_c.p1.submit(_p1.make_sample(_p1.SOURCE_HA, 500.0, 0.0, phases=1))
+_r2 = _meter_row()
+check(f"right after a start, before the first meter reading and inside its "
+      f"limit, the meter row is amber and waits, not red at 0 s ({_r0})",
+      _r0["warn"] and not _r0["ok"]
+      and _r0["text"] == "Meter: waiting for the first reading, limit 30 "
+                         "seconds")
+check(f"...past the limit with still no reading it is red, as before ({_r1})",
+      not _r1["ok"] and not _r1["warn"]
+      and _r1["text"].startswith("Meter: no reading for 31 seconds"))
+check(f"...and a reading makes it green ({_r2['text']!r})",
+      _r2["ok"] and _r2["text"].startswith("Meter: 500 W"))
+
+_c.auto = True
+_c.p1_enabled = False
+asyncio.run(_c.cycle())
+_w0 = _c.why_words
+_c._why_waiting_since -= _td(seconds=7)
+_w7 = _c.why_words
+check(f"'A reading is missing for N seconds' counts while control waits, "
+      f"instead of the age the last cycle saw ({_w0!r} -> {_w7!r})",
+      _w0 == "A reading is missing for 0 seconds, control waits"
+      and _w7 == "A reading is missing for 7 seconds, control waits")
+_c.why_words = "Keeping the grid near zero: 0 W"
+check("...and once a cycle decides again, the line is that decision",
+      _c.why_words == "Keeping the grid near zero: 0 W")
+
+# UX-11 item 3: past the hold, the Why line says which reading is missing,
+# not "A reading is missing: 0 W". Driven through cycle() for real.
+_c.inputs_bad_since = _dt.now(_tz.utc) - _td(seconds=20)
+asyncio.run(_c.cycle())
+check(f"past the hold, the Why line names the missing reading "
+      f"({_c.why_words!r})",
+      _c.why_words == "No usable meter reading for over 15 seconds: 0 W")
+
+# UX-11 item 2: the red meter row says the log shows why. A meter that goes
+# quiet logs one WARNING per episode, not one per cycle, and INFO when back.
+_c.p1_enabled = True
+_c.p1 = _p1.P1Ingest(max_age_s=30.0)
+
+
+def _meter_at(age_s):
+    import time as _time
+    _c.p1.submit(_p1.make_sample(_p1.SOURCE_HA, 500.0, 0.0, phases=1,
+                                 ingest_mono=_time.monotonic() - age_s))
+
+
+def _quiet_episodes():
+    # Two quiet episodes close together, then a third 10 minutes on.
+    for age in (1, 40, 45, 50, 1, 2, 60, 65, 1):
+        _meter_at(age)
+        asyncio.run(_c.read_inputs())
+    _c._meter_quiet_warned -= _main.METER_QUIET_REPEAT_S
+    for age in (40, 45, 1):
+        _meter_at(age)
+        asyncio.run(_c.read_inputs())
+
+
+_mq = [r for r in _captured("goodwe", _quiet_episodes)
+       if "meter" in r.getMessage().lower()]
+_mq_warn = [r.getMessage() for r in _mq if r.levelno == logging.WARNING]
+_mq_info = [r.getMessage() for r in _mq if r.levelno == logging.INFO]
+_mq_dbg = [r.getMessage() for r in _mq if r.levelno == logging.DEBUG]
+check(f"a meter that goes quiet logs one WARNING per episode, not per cycle, "
+      f"and one INFO when readings return, and a flapping meter at most one "
+      f"pair per {_main.METER_QUIET_REPEAT_S:.0f} s ({_mq_warn}, {_mq_info}, "
+      f"{_mq_dbg})",
+      len(_mq_warn) == 2 and _mq_info == ["Meter readings are back."] * 2
+      and len(_mq_dbg) == 2
+      and _mq_warn[0] == "No meter reading for over 30 seconds, so control "
+                         "waits and then sets the battery to 0 W."
+      and len(words(_mq_warn[0])) <= LINE_WORDS)
+
+# UX-11 item 1: a state file saved before UX-11 holds the long reasons, and
+# they load unchanged. The ERROR line at start shows the code, and the saved
+# text goes on the DEBUG line beside it. Old and new files look the same,
+# because the saved reason's format did not change and it opens with its code.
+_OLD = {
+    "sign": "SIGN_DISAGREEMENT: commanded -1000 W against a meter reading "
+            "+1500 W for 180 s continuously (limits: both over 300 W, held "
+            "over 180 s)",
+    "delivery": "UNIT_NOT_DELIVERING: inverter-a is standing at +2000 W and "
+                "delivering +0 W - 2000 W of its share (100 % of it) is not "
+                "arriving - while inverter-b is not in that state. Nothing "
+                "this add-on reads explains it - held for 121 s continuously "
+                "(limit: over 120 s)",
+    "circ": "CIRCULATING_POWER: 5800 W measured going round between the "
+            "inverters for 61 s, peaking at 6000 W, over the limits of 250 W "
+            "and 60 s. The meter cannot see it, because it nets to zero there",
+}
+
+
+class _OldStore(_S):
+    data = {"unit/inverter-a/sign_tripped": True,
+            "unit/inverter-a/sign_reason": _OLD["sign"],
+            "unit/inverter-a/delivery_tripped": True,
+            "unit/inverter-a/delivery_reason": _OLD["delivery"],
+            "circ_tripped": True, "circ_reason": _OLD["circ"],
+            "site_sign_tripped": True, "site_sign_reason": ""}
+
+
+_restart = []
+_rs = _captured("goodwe", lambda: _restart.append(Controller(
+    {"setpoint_entity": "number.sp", "meter_source": "off", "max_w": 2000},
+    _H(), _OldStore(), _P(), stop=asyncio.Event())))
+_rs_err = [r.getMessage() for r in _rs if r.levelno == logging.ERROR]
+_rs_dbg = [r.getMessage() for r in _rs if r.levelno == logging.DEBUG]
+for _m in _rs_err:
+    print(f"       {_m!r} ({len(words(_m))} words)")
+check("an old state file's long reasons load unchanged, so the stops stay on",
+      _restart and _restart[0].inverters[0].sign_wd.tripped
+      and _restart[0].inverters[0].sign_wd.reason == _OLD["sign"]
+      and _restart[0].inverters[0].delivery_wd.reason == _OLD["delivery"]
+      and _restart[0].circ_wd.reason == _OLD["circ"])
+check("...each ERROR line at start is one plain sentence with the code, at "
+      f"most {LINE_WORDS} words, and a stop saved without a reason says so",
+      len(_rs_err) == 4
+      and all(len(words(m)) <= LINE_WORDS and "(limits" not in m
+              for m in _rs_err)
+      and any(m.endswith(": SIGN_DISAGREEMENT.") for m in _rs_err)
+      and any(m.endswith(": UNIT_NOT_DELIVERING.") for m in _rs_err)
+      and any(m.endswith(": CIRCULATING_POWER.") for m in _rs_err)
+      and any(m.endswith(f": {messages.NO_REASON_SAVED}.") for m in _rs_err))
+check("...and the saved text, figures and all, is on a DEBUG line beside it",
+      all(any(t in m for m in _rs_dbg) for t in _OLD.values()))
+# UX-11 review: `log_level` defaults to info and `events` starts empty, so the
+# saved figures also go on the action log, where `status` shows them.
+_rs_ev = _restart[0].events if _restart else []
+check(f"...and in the action log, which an installer reads at the default "
+      f"log level ({len(_rs_ev)} events)",
+      all(any(t in e for e in _rs_ev) for t in _OLD.values())
+      and any(e.endswith(messages.NO_REASON_SAVED) for e in _rs_ev))
+
+# UX-11 item 4: the action log's clamp count and the shadow-off entry.
+_main_src = (APP / "main.py").read_text(encoding="utf-8")
+check("the action log counts 'engagements' with a real plural and the "
+      "shadow-off entry is plain, not 'engagement(s)' or 'SHADOW MODE OFF -'",
+      "engagement(s)" not in _main_src and "SHADOW MODE OFF" not in _main_src
+      and messages.count(25, "engagement") == "25 engagements"
+      and messages.count(1, "engagement") == "1 engagement")
+
+# ============================================================================== #
+print("\n8. the Home screen's sentences (UX-13 P1)")
+# app/homeview.py builds every sentence the Home screen shows. Each is rendered
+# with real values by `text_samples()` and held to STYLE.md: a title at most 5
+# words, a plan line at most 2 sentences of at most 12 words each (the design
+# note's new row type), any other line 1 sentence of at most 25 words.
+from app import homeview                                          # noqa: E402
+
+PLAN_SENTENCE_WORDS, PLAN_SENTENCES = 12, 2
+
+
+def home_problems(kind, text):
+    if kind == "title":
+        return title_problems(text)
+    out = text_problems(text, keys=False, entities=False)
+    if ";" in text:
+        out.append("semicolon")
+    if kind == "line":
+        if sentences(text) > 1:
+            out.append(f"over 1 sentence ({sentences(text)})")
+        if len(words(text)) > 25:
+            out.append(f"over 25 words ({len(words(text))})")
+        return out
+    if sentences(text) > PLAN_SENTENCES:
+        out.append(f"plan line over {PLAN_SENTENCES} sentences")
+    long = [x for x in re.split(r"(?<=[.!?])\s+", text)
+            if len(words(x)) > PLAN_SENTENCE_WORDS]
+    if long:
+        out.append(f"plan sentence over {PLAN_SENTENCE_WORDS} words "
+                   f"({len(words(long[0]))}): {long[0]!r}")
+    return out
+
+
+for _lang in ("en", "nl"):         # UX-13 P5: Home in English and Dutch
+    _home = homeview.text_samples(_lang)
+    _home_bad = [(k, t, p) for k, t in _home for p in [home_problems(k, t)]
+                 if p]
+    for k, t, p in _home_bad:
+        print(f"    {_lang} {k}: {t!r}: {p}")
+    check(f"every Home sentence in {_lang} obeys its STYLE limit "
+          f"({len(_home)} rendered, {len(_home_bad)} over)",
+          len(_home) > 80 and not _home_bad)
+_shadowed = [t for k, t in homeview.text_samples() if "ould" in t]
+check("in shadow mode the Home plan says what the add-on WOULD do: every "
+      "shadow variant of a plan text carries 'would'",
+      all("ould" in f(True) for f in (
+          lambda sh: homeview.run_grid_what(2.5, sh),
+          lambda sh: homeview.run_give_what(2.5, sh),
+          lambda sh: homeview.run_cycle_what("idle", sh),
+          lambda sh: homeview.run_cycle_why(sh),
+          lambda sh: homeview.run_peak_what(3500, sh),
+          lambda sh: homeview.run_house_what(sh),
+          lambda sh: homeview.run_house_why(sh),
+          lambda sh: homeview.plan_head("house", sh),
+          lambda sh: homeview.plan_head("trade", sh),
+          lambda sh: homeview.line_peak_limit(3500, sh)))
+      and not any("ould" in f(False) for f in (
+          lambda sh: homeview.run_grid_what(2.5, sh),
+          lambda sh: homeview.run_house_what(sh),
+          lambda sh: homeview.plan_head("house", sh)))
+      and len(_shadowed) > 10)
+check("mutation: a 13-word plan sentence and a 6-word title are caught",
+      home_problems("plan", "One two three four five six seven eight nine "
+                            "ten eleven twelve thirteen.")
+      and home_problems("title", "One two three four five six"))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_modes.py b/goodwe_controller/test_modes.py
new file mode 100644
index 0000000..6e38ed3
--- /dev/null
+++ b/goodwe_controller/test_modes.py
@@ -0,0 +1,512 @@
+"""Runnable check for OPT-11 P1, battery modes.  `python3 test_modes.py`
+
+Each battery gets an on/off switch and a mode (Solar first, Leftover solar),
+kept in the store and filed as a SOFT unit limit at P_MODE (35). Drives the
+REAL `Controller` (read_inputs + cycle) through tools/opt11_identity.py's
+harness, in simulated time. DECISIONS/OPT-11-battery-modes.md has the record.
+
+1. With battery modes off, every command is byte-identical to release/1.0
+   a5dddad, at one inverter and at two (digests measured on that tree).
+2. Solar order: surplus solar fills the Solar first battery, then spills to the
+   Leftover solar one; a full Solar first battery hands all of it on.
+3. Off: the battery is asked for 0 W, the others carry the site, the loop is
+   bounded and never freezes on watts no battery may give; all off at N=1 and
+   N=2 asks 0 W.
+4. Off stops and skips maintenance, with a log line; a battery in maintenance
+   gets no mode claim.
+5. The actions: `pack_use` and `pack_mode`, what they store, log and refuse.
+6. A mode range without 0 W is dropped as a software fault, logged once.
+7. The Batteries screen's data.
+
+Mutations (MUTATION.md, purged copies, graded over this file and the named
+tests) are listed in the pull request and DECISIONS/OPT-11-battery-modes.md.
+"""
+
+import asyncio
+import logging
+import os
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import opt11_identity as rig                                   # noqa: E402
+from named_absence import nth, present                         # noqa: E402
+import app.main as app_main                                    # noqa: E402
+from app import homeview, messages, packmode                   # noqa: E402
+from app.control import MODE_BOUND                             # noqa: E402
+from app.maintenance import DRAIN, IDLE                        # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+ON = {"battery_modes_enabled": True}
+A, B = "inverter-a", "inverter-b"
+
+
+def store_with(**modes):
+    """A store where each named battery has (use, mode)."""
+    s = rig._Store()
+    for name, (use, mode) in modes.items():
+        s.data[unit_key(name, packmode.USE_KEY)] = use
+        s.data[unit_key(name, packmode.MODE_KEY)] = mode
+    return s
+
+
+def spy_claims():
+    """Record every claim list main.py's own `resolve` is handed."""
+    seen, real = [], app_main.resolve
+
+    def _spy(claims, **kw):
+        seen.append(list(claims))
+        return real(claims, **kw)
+    app_main.resolve = _spy
+    return seen, lambda: setattr(app_main, "resolve", real)
+
+
+def spy_bounds():
+    """Record the `bound` main.py hands `compute()` on every cycle."""
+    seen, real = [], app_main.compute
+
+    def _spy(*a, **kw):
+        seen.append(kw.get("bound", "absent"))
+        return real(*a, **kw)
+    app_main.compute = _spy
+    return seen, lambda: setattr(app_main, "compute", real)
+
+
+def flat(t):
+    return 0.0
+
+
+# ============================================================================ #
+print("1. battery modes off: byte-identical to release/1.0 a5dddad")
+# The digests below were printed by `python3 tools/opt11_identity.py` run on
+# the a5dddad tree (the same file copied in, nothing else changed), in the CI
+# image, on 2026-09-28. Each hashes 540 cycles: site target, every inverter's
+# written value, the loop's reason, integrator and saturation count, the
+# arbiter's sentence and the allocation record.
+A5DDDAD = {
+    "n1": "fc3bca170c46920f08d86baee62ea883954a89ea6222d6bbf7d6652877226262",
+    "n2": "a60003b1930fa3cba21f3220670d9172b9ff438347d77ba9bc3383fca1ceb15a",
+    "n1_off": "fc3bca170c46920f08d86baee62ea883954a89ea6222d6bbf7d6652877226262",
+    "n2_off": "a60003b1930fa3cba21f3220670d9172b9ff438347d77ba9bc3383fca1ceb15a",
+    # Added in review (PR #149), printed on a5dddad the same way: both
+    # batteries due for maintenance, and the arbiter alone on 6000 seeded
+    # claim lists with the peak floor, trades, maintenance and refusals.
+    "n1_maint": "5a21d43ec7cbf95a224bbb9bca13a8e62a00161101b586ae9fa68ab565992977",
+    "n2_maint": "48a1ad96121592e207a4664fb2da9f5208a49b88e5802a358873a5d30cb8c18e",
+    "resolve": "43a874216711936e14b9185bcc8d26c58fe4f3cfc3c1c8eaf89bffd95d6e81ef",
+}
+_claims, _undo_c = spy_claims()
+_bounds, _undo_b = spy_bounds()
+try:
+    _now = {k: rig.digest(rig.run(**v)[0])
+            for k, v in rig.SCENARIOS.items() if k != "n2_maint"}
+    _now["resolve"] = rig.digest(rig.resolve_rows())
+finally:
+    _undo_b()
+# SAFETY-85: n2_maint (maintenance at N=2) is the one run with a bound.
+_bounds_m, _undo_b = spy_bounds()
+try:
+    _now["n2_maint"] = rig.digest(rig.run(**rig.SCENARIOS["n2_maint"])[0])
+finally:
+    _undo_c()
+    _undo_b()
+# SAFETY-78 changes n2_maint ON PURPOSE: on a5dddad and 5a4cdc2 its N=2 drain
+# was refused on 392 of 540 cycles (site at 0 W); now none is. Printed on the
+# SAFETY-78 tree the same way. Every other digest is unchanged.
+# SAFETY-85 changes it again ON PURPOSE: while A's drain pin stands the loop
+# is bounded by what the batteries can place, so when A drops out at t=1655 B
+# follows the house down at once instead of unwinding 920 W too high. Was
+# cd4d9cb5b7e29ff4ab4fe65dab5106683d8a599f09323fbdee4018ad9b28fcd1.
+SAFETY78_N2_MAINT = \
+    "1afcd46b1b987868b110d2b0f4a7555848c9aa4728a836d4a2ce2a2107268497"
+for k in A5DDDAD:
+    print(f"    {k:7} {'same' if _now[k] == A5DDDAD[k] else 'DIFFERS'} "
+          f"{_now[k][:16]}")
+check("⭐ at N=1 and N=2, with the option absent and with it false, every "
+      "command, reason and allocation record over 540 cycles each is "
+      "byte-identical to a5dddad (house steps, a solar surplus, a battery "
+      "at its cut-out level, at N=2 a refusal with probes, both batteries "
+      "due for maintenance; n2_maint apart, below), and so is the arbiter "
+      "on 6000 claim lists",
+      {k: v for k, v in _now.items() if k != "n2_maint"}
+      == {k: v for k, v in A5DDDAD.items() if k != "n2_maint"})
+check("...and n2_maint is the SAFETY-78 digest: the N=2 drain that a5dddad "
+      "refused on 392 of 540 cycles now runs (test_safety78.py), bounded by "
+      "SAFETY-85",
+      _now["n2_maint"] == SAFETY78_N2_MAINT != A5DDDAD["n2_maint"])
+check("...and no cycle in those runs filed a `mode` claim, and only "
+      "n2_maint's (SAFETY-85: maintenance at N=2) handed `compute()` a bound",
+      _claims and not any(c.source == "mode" for cl in _claims for c in cl)
+      and _bounds and set(_bounds) == {None}
+      and any(b is not None for b in _bounds_m))
+
+
+# ============================================================================ #
+print("\n2. the solar order: Solar first fills, the rest spills to Leftover")
+_surplus = (lambda t: -3200.0)          # 3200 W more solar than the house uses
+_full_a = (lambda u, t: 100.0 if (u == "a" and t >= 300) else 50.0)
+_rows, _c = rig.run(2, extra=ON, dur=600.0, load=_surplus, soc=_full_a,
+                    cut=lambda u, t: False,
+                    store=store_with(**{A: (True, packmode.SOLAR_FIRST),
+                                        B: (True, packmode.LEFTOVER_SOLAR)}))
+_room = [r for r in _rows if 200 <= r[0] < 300]
+_full = [r for r in _rows if r[0] >= 500]
+
+
+def _cmd(r):
+    """One row's written values, by battery; ABSENTs if the row is missing."""
+    return (dict(r[2]) if present(r)
+            else {"a": nth((), 0, "a"), "b": nth((), 0, "b")})
+
+
+print(f"    A has room: A {_cmd(nth(_room, -1))['a']:+.0f} W, B "
+      f"{_cmd(nth(_room, -1))['b']:+.0f} W | A full: A {_cmd(nth(_full, -1))['a']:+.0f} "
+      f"W, B {_cmd(nth(_full, -1))['b']:+.0f} W")
+check("⭐ while A (Solar first) has room it takes all it can, 2500 W, and B "
+      "(Leftover solar) gets only the spill, about 700 W",
+      present(nth(_room, -1))
+      and all(_cmd(r)["a"] == -2500.0 and -800.0 <= _cmd(r)["b"] <= -600.0
+              for r in _room))
+check("⭐ once A is full, the surplus spills to B, up to B's rating",
+      present(nth(_full, -1))
+      and all(_cmd(r)["a"] == 0.0 and _cmd(r)["b"] == -2500.0 for r in _full))
+_rows_off, _ = rig.run(2, dur=300.0, load=_surplus,
+                       soc=lambda u, t: 50.0, cut=lambda u, t: False)
+check("...and the same site with battery modes off splits 50/50, which is "
+      "what says the order above comes from the modes",
+      _cmd(_rows_off[-1])["a"] == _cmd(_rows_off[-1])["b"] < -1500.0)
+_give = rig.run(2, extra=ON, dur=300.0, load=lambda t: 3000.0,
+                soc=lambda u, t: 50.0, cut=lambda u, t: False,
+                store=store_with(**{A: (True, packmode.SOLAR_FIRST),
+                                    B: (True, packmode.LEFTOVER_SOLAR)}))[0]
+check("while giving power the modes keep OPT-09's weights: A Solar first and "
+      "B Leftover solar, both half full, share a 3000 W house equally",
+      _cmd(_give[-1])["a"] == _cmd(_give[-1])["b"] > 1400.0)
+
+
+# ============================================================================ #
+print("\n3. Off: 0 W on that battery, the loop bounded, no freeze")
+_rows, _c = rig.run(2, extra=ON, dur=600.0, load=lambda t: 4000.0,
+                    soc=lambda u, t: 50.0, cut=lambda u, t: False,
+                    store=store_with(**{B: (False, packmode.SOLAR_FIRST)}))
+_tail = _rows[40:]
+print(f"    house 4000 W, B off: A {_cmd(_tail[-1])['a']:+.0f} W, B "
+      f"{_cmd(_tail[-1])['b']:+.0f} W, site {_tail[-1][1]:+.0f} W, reason "
+      f"{_tail[-1][3]}, {_tail[-1][7]}")
+check("⭐ B (Off) is asked for 0 W on every cycle and A carries the house up "
+      "to its rating",
+      all(_cmd(r)["b"] == 0.0 for r in _rows)
+      and all(_cmd(r)["a"] == 2500.0 for r in _tail))
+check("⭐ the loop stays inside what the modes allow (2500 W) and never "
+      "freezes: no saturated-freeze reason, and the saturation count stays "
+      "below the freeze",
+      all(r[1] <= 2500.0 for r in _rows)
+      and not any(r[3] == "saturated-freeze" for r in _rows)
+      and max(r[5] for r in _rows) < _c.tuning.saturation_cycles
+      and _tail[-1][3] == MODE_BOUND)
+check("...and nothing is left unmet: the allocation places the whole target",
+      all("UNMET" not in (r[7] or "") for r in _tail))
+_bounds, _undo_b = spy_bounds()
+try:
+    rig.run(2, extra=ON, dur=100.0, load=lambda t: 4000.0,
+            soc=lambda u, t: 50.0, cut=lambda u, t: False,
+            store=store_with(**{B: (False, packmode.SOLAR_FIRST)}))
+finally:
+    _undo_b()
+check("...because main.py hands compute() the loop bound, B's 0 W included: "
+      "[-2500, 2500]", _bounds and set(_bounds) == {(-2500.0, 2500.0)})
+# Review (PR #149): a unit the allocator drops (stale link) must not count in
+# the loop bound either, or the loop asks for watts nobody live can place.
+_rows, _c = rig.run(2, extra=ON, dur=10.0, load=flat, soc=lambda u, t: 50.0,
+                    cut=lambda u, t: False)
+_both = _c.loop_bound([app_main.Claim.limit(
+    "supervised", app_main.P_SAFETY, -2500.0, 2500.0,
+    actuator=_c.actuator_of("supervised", i)) for i in _c.inverters])
+_c.live_units = lambda: (A,)
+_one_live = _c.loop_bound([app_main.Claim.limit(
+    "supervised", app_main.P_SAFETY, -2500.0, 2500.0,
+    actuator=_c.actuator_of("supervised", i)) for i in _c.inverters])
+check("the loop bound counts only live units: both live [-5000, 5000], B's "
+      "link stale [-2500, 2500]",
+      _both == (-5000.0, 5000.0) and _one_live == (-2500.0, 2500.0))
+
+for _n in (1, 2):
+    _st = store_with(**{A: (False, packmode.SOLAR_FIRST),
+                        B: (False, packmode.LEFTOVER_SOLAR)})
+    if _n == 1:
+        _st = rig._Store()
+        _st.data[unit_key(app_main.UNIT_A, packmode.USE_KEY)] = False
+    _rows, _c = rig.run(_n, extra=ON, dur=300.0, load=lambda t: 3000.0,
+                        soc=lambda u, t: 50.0, cut=lambda u, t: False,
+                        store=_st)
+    check(f"every battery off at N={_n}: every command is 0 W, the site "
+          f"target is 0 W, the integrator stays at 0 and nothing freezes",
+          all(all(v == 0.0 for _u, v in r[2]) and r[1] == 0.0 and r[4] == 0.0
+              and r[3] != "saturated-freeze" for r in _rows))
+_rows1, _ = rig.run(1, extra=ON, dur=300.0, load=lambda t: 1800.0,
+                    soc=lambda u, t: 50.0)
+_rows1o, _ = rig.run(1, dur=300.0, load=lambda t: 1800.0,
+                     soc=lambda u, t: 50.0)
+check("at N=1 a battery that is on (Solar first by default) follows the "
+      "house exactly as with battery modes off",
+      [r[:6] for r in _rows1] == [r[:6] for r in _rows1o]
+      and _cmd(_rows1[-1])["a"] > 1700.0)
+
+
+# ============================================================================ #
+print("\n4. Off stops and skips maintenance; maintenance outranks the mode")
+MAINT = {"maintenance_enabled": True, "maintenance_start_hour": 11}
+_st = store_with(**{A: (False, packmode.SOLAR_FIRST)})
+_rows, _c = rig.run(2, extra={**ON, **MAINT}, dur=60.0,
+                    load=lambda t: 500.0, soc=lambda u, t: 60.0,
+                    cut=lambda u, t: False, store=_st)
+print(f"    both due at 11:00, A off: A {_c.maints[0].phase}, "
+      f"B {_c.maints[1].phase}")
+check("⭐ a battery that is off starts no cycle, and does not hold the slot: "
+      "both are due, A (first in the roster) is off, so B starts",
+      _c.maints[0].phase == IDLE and _c.maints[1].phase == DRAIN)
+_st2 = store_with()
+_seen, _undo_c = spy_claims()
+_msgs = []
+
+
+async def _switch_b_off(c, t):
+    if t == 30.0:
+        _msgs.append(await c.handle_action("pack_use", unit=B, value=False))
+
+
+try:
+    _rows, _c = rig.run(2, extra={**ON, **MAINT}, dur=60.0,
+                        load=lambda t: 500.0, soc=lambda u, t: 60.0,
+                        cut=lambda u, t: False, store=_st2,
+                        before=_switch_b_off)
+finally:
+    _undo_c()
+_during = [cl for cl in _seen[:6]]
+print(f"    B off at 30 s while A drains: A {_c.maints[0].phase}, "
+      f"B {_c.maints[1].phase}; events: "
+      f"{[e for e in _c.events if 'switched' in str(e) or 'ABORT' in str(e)]}")
+check("while A runs its cycle it gets no mode claim (maintenance at 60/40 "
+      "outranks the mode) and B, idle, gets one",
+      all({c.actuator for c in cl if c.source == "mode"} == {B}
+          for cl in _during))
+_st3 = store_with()
+_st3.data[unit_key(B, "phase")] = DRAIN
+_st3.data["maint_schema_version"] = 1
+
+
+async def _b_off_now(c, t):
+    if t == 10.0:
+        _msgs.append(await c.handle_action("pack_use", unit=B, value=False))
+
+
+_rows, _c = rig.run(2, extra=ON, dur=30.0, load=lambda t: 500.0,
+                    soc=lambda u, t: 60.0, cut=lambda u, t: False,
+                    store=_st3, before=_b_off_now)
+_ev = [str(e) for e in _c.events]
+print(f"    B mid-drain, switched off at 10 s: B {_c.maints[1].phase}; "
+      f"{[e for e in _ev if 'switched off' in e or 'ABORT' in e]}")
+check("⭐ switching off a battery that is mid-cycle stops its cycle at once, "
+      "with a log line saying why",
+      _c.maints[1].phase == IDLE
+      and any("battery switched off" in e for e in _ev)
+      and _cmd(_rows[-1])["b"] == 0.0)
+_st4 = store_with(**{B: (False, packmode.SOLAR_FIRST)})
+_st4.data[unit_key(B, "phase")] = DRAIN
+_st4.data["maint_schema_version"] = 1
+_rows, _c = rig.run(2, extra=ON, dur=20.0, load=lambda t: 500.0,
+                    soc=lambda u, t: 60.0, cut=lambda u, t: False, store=_st4)
+check("...and a store that says Off for a battery mid-cycle (a restart) stops "
+      "it on the first cycle, and it is never asked to drain",
+      _c.maints[1].phase == IDLE
+      and all(_cmd(r)["b"] == 0.0 for r in _rows))
+
+
+# ============================================================================ #
+print("\n5. the actions: pack_use and pack_mode")
+_rows, _c = rig.run(2, extra=ON, dur=10.0, load=flat,
+                    soc=lambda u, t: 50.0, cut=lambda u, t: False)
+_r1 = asyncio.run(_c.handle_action("pack_mode", unit=B,
+                                   value=packmode.LEFTOVER_SOLAR))
+_r2 = asyncio.run(_c.handle_action("pack_use", unit=A, value=False))
+print(f"    {_r1} {_r2}")
+check("pack_mode stores the mode under the battery's own key and says what "
+      "it now is",
+      _r1 == {"unit": B, "use": True, "mode": packmode.LEFTOVER_SOLAR}
+      and _c.store.data[unit_key(B, packmode.MODE_KEY)]
+      == packmode.LEFTOVER_SOLAR)
+check("pack_use stores the switch, and both are written to the action log",
+      _r2 == {"unit": A, "use": False, "mode": packmode.SOLAR_FIRST}
+      and _c.store.data[unit_key(A, packmode.USE_KEY)] is False
+      and any("inverter-a switched off by operator" in str(e)
+              for e in _c.events)
+      and any("inverter-b mode set to leftover solar" in str(e)
+              for e in _c.events))
+_bad = [asyncio.run(_c.handle_action("pack_use", unit="inverter-z",
+                                     value=True)),
+        asyncio.run(_c.handle_action("pack_use", unit=A, value="yes")),
+        # 0 == False in Python: a stored 0 would read back as ON.
+        asyncio.run(_c.handle_action("pack_use", unit=A, value=0)),
+        asyncio.run(_c.handle_action("pack_use", unit=A, value=1)),
+        asyncio.run(_c.handle_action("pack_mode", unit=A,
+                                     value="sell_only")),
+        asyncio.run(_c.handle_action("pack_mode", unit=A, value=None))]
+check("an unknown battery, a switch that is not true or false (0 and 1 "
+      "included), and a mode "
+      "that does not exist are refused, "
+      "with a plain reason, and store nothing",
+      all(isinstance(x, dict) and set(x) == {"error"} for x in _bad)
+      and unit_key(A, packmode.MODE_KEY) not in _c.store.data
+      and _c.store.data[unit_key(A, packmode.USE_KEY)] is False)
+_rows, _c0 = rig.run(2, dur=10.0, load=flat, soc=lambda u, t: 50.0,
+                     cut=lambda u, t: False)
+_r0 = asyncio.run(_c0.handle_action("pack_use", unit=A, value=False))
+check("with battery modes off the actions are refused and store nothing",
+      set(_r0) == {"error"}
+      and unit_key(A, packmode.USE_KEY) not in _c0.store.data)
+check("the old actions still take no battery and answer as before",
+      asyncio.run(_c0.handle_action("nonsense")) is None)
+check("a store value from a later version (an unknown mode) reads as the "
+      "default, Solar first and on, never as Off",
+      packmode.read({unit_key(A, packmode.MODE_KEY): "grid_only",
+                     unit_key(A, packmode.USE_KEY): "maybe"}, A)
+      == packmode.PackMode(True, packmode.SOLAR_FIRST))
+
+
+# ============================================================================ #
+print("\n6. a mode range without 0 W is a software fault, never obeyed")
+_real_range = packmode.mode_range
+packmode.mode_range = lambda pm, r: (100.0, 900.0)
+_log = []
+
+
+class _H(logging.Handler):
+    def emit(self, rec):
+        _log.append((rec.levelno, rec.getMessage()))
+
+
+_h = _H()
+logging.getLogger("goodwe").addHandler(_h)
+try:
+    _rows, _c = rig.run(2, extra=ON, dur=60.0, load=lambda t: -2000.0,
+                        soc=lambda u, t: 50.0, cut=lambda u, t: False)
+finally:
+    packmode.mode_range = _real_range
+    logging.getLogger("goodwe").removeHandler(_h)
+_errs = [msg for lv, msg in _log if lv >= logging.ERROR and "MODE_RANGE" in msg]
+print(f"    {_errs}")
+check("⭐ both batteries still charge from the surplus (the forced range is "
+      "dropped, so no battery is made to give power) and no split is refused",
+      all(v <= 0.0 for _u, v in _rows[-1][2])
+      and _cmd(_rows[-1])["a"] < 0.0
+      and not any("REFUSED" in (r[7] or "") for r in _rows))
+check("...and it is logged once per battery, as an ERROR naming the fault "
+      "code, not once per cycle",
+      len(_errs) == 2 and any(A in e for e in _errs) and any(B in e for e in _errs))
+
+
+# ============================================================================ #
+print("\n7. the Batteries screen's data")
+_rows, _c = rig.run(2, extra=ON, dur=10.0, load=flat, soc=lambda u, t: 50.0,
+                    cut=lambda u, t: False,
+                    store=store_with(**{B: (False, packmode.LEFTOVER_SOLAR)}))
+_bat = homeview.battery_rows(_c, False, True)
+_bat_nl = homeview.build(_c, level="ok", checks=[], lang="nl")["batteries"]
+print(f"    {[(b['name'], b['use'], b['mode_key'], b['mode']) for b in _bat]}")
+check("with battery modes on each row carries its switch, its state and its "
+      "stored mode, in the page's words",
+      [(b["use"], b["mode_key"], b["mode_choice"], b["mode"]) for b in _bat]
+      == [(True, "solar_first", "solar_first", "Solar first"),
+          (False, "off", "leftover_solar", "Off")]
+      and _bat_nl[1]["mode"] == "Uit")
+_rows, _c0 = rig.run(2, dur=10.0, load=flat, soc=lambda u, t: 50.0,
+                     cut=lambda u, t: False)
+check("...and with them off the rows are what they were: no new keys, the "
+      "mode reads as before",
+      all("mode_key" not in b and b["mode"] == homeview.mode_house()
+          for b in homeview.battery_rows(_c0, False, True)))
+
+
+# ============================================================================ #
+print("\n8. the page's route: /action and /status over the real web app")
+import socket                                                  # noqa: E402
+
+import aiohttp                                                 # noqa: E402
+from aiohttp import web as aioweb                              # noqa: E402
+
+from app import web as app_web                                 # noqa: E402
+
+_rows, _c = rig.run(2, extra=ON, dur=10.0, load=flat, soc=lambda u, t: 50.0,
+                    cut=lambda u, t: False)
+
+
+async def _page():
+    # The configuration routes are not used here; a stand-in keeps the app
+    # from building a Supervisor client.
+    app = app_web.build_app(_c, selfcfg=object())
+    runner = aioweb.AppRunner(app)
+    await runner.setup()
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    await aioweb.TCPSite(runner, "127.0.0.1", port).start()
+    out = {}
+    try:
+        async with aiohttp.ClientSession() as s:
+            root = f"http://127.0.0.1:{port}/"
+            for key, body in (
+                    ("mode", {"action": "pack_mode", "unit": B,
+                              "value": packmode.LEFTOVER_SOLAR}),
+                    ("off", {"action": "pack_use", "unit": A,
+                             "value": False}),
+                    ("bad", {"action": "pack_mode", "unit": A,
+                             "value": "grid_only"})):
+                async with s.post(root + "action", json=body) as r:
+                    out[key] = (r.status, await r.json(content_type=None))
+            async with s.get(root + "status") as r:
+                out["status"] = (r.status, await r.json(content_type=None))
+            async with s.get(root) as r:
+                out["page"] = (r.status, await r.text())
+    finally:
+        await runner.cleanup()
+    return out
+
+
+_web = asyncio.run(_page())
+print(f"    {_web['mode']} {_web['off']} {_web['bad']}")
+check("POST /action with pack_mode and pack_use names a battery and a value, "
+      "and answers what it stored",
+      _web["mode"] == (200, {"ok": True, "result": {
+          "unit": B, "use": True, "mode": packmode.LEFTOVER_SOLAR}})
+      and _web["off"][0] == 200 and _web["off"][1]["result"]["use"] is False)
+check("...a value this release does not offer is a 400 with the plain reason "
+      "the page shows",
+      _web["bad"][0] == 400 and _web["bad"][1]["ok"] is False
+      and _web["bad"][1]["error"] == messages.pack_refused("value"))
+_sb = {b["name"]: b for b in _web["status"][1].get("batteries", [])}
+check("...and /status then shows both batteries' switch and mode for the "
+      "Batteries screen",
+      _web["status"][0] == 200
+      and (_sb.get(A, {}).get("mode_key"), _sb.get(B, {}).get("mode_key"))
+      == ("off", packmode.LEFTOVER_SOLAR))
+check("the page carries the mode names from app/ui_text for its cards",
+      _web["page"][0] == 200 and "Leftover solar" in _web["page"][1]
+      and "Overschot zonne-energie" in _web["page"][1])
+
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: {', '.join(fails)}")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_modes_p3.py b/goodwe_controller/test_modes_p3.py
new file mode 100644
index 0000000..5dc2fa2
--- /dev/null
+++ b/goodwe_controller/test_modes_p3.py
@@ -0,0 +1,722 @@
+"""Runnable check for OPT-11 P3, price runs per battery.  `python3 test_modes_p3.py`
+
+Drives the pure modules (priceruns, modetrade) and the REAL Controller
+(tools/opt11p3_replay.py: read_inputs + cycle on a P1 meter, the arbiter, the
+allocator and the peak guard, with two lagged model batteries), in simulated
+time. DECISIONS/OPT-11-battery-modes.md has the record.
+
+1. With battery modes off, every command and trade is byte-identical to
+   release/1.0 7a00f12 on the trade path P3 changed (digests measured there),
+   and the harness would see a change there.
+2. Price runs: consecutive, firm, sized by energy; give runs clear the spread;
+   the sell run sits in a give run with no slot below 0; a started run is kept.
+3. Roles: a fuzz of modetrade.decide() and size() against the invariants.
+4. The real controller over a day: no opposite-direction split, no grid
+   charge on Solar first, the quarter never above the aim while charging, no
+   sell below the floor or the spread, holding outside the expensive hours.
+5. A refusal wins over a run.
+6. No prices or too small a gap: the price modes follow the house; Solar first
+   alone never trades.
+7. A run edge reseeds the loop (handover measured with and without).
+8. The site Why row: a limit that pushes power up does not "hold it back" (F2).
+9. Selling is off (owner, 2026-09-29): `pack_sell` refused, read as false.
+10. The Batteries screen: Why and Today lines from the roles and runs.
+11. Review additions: modes on ignore the site trade switch, a battery in
+    maintenance takes no part, the headroom stop latches for the period.
+
+12. Option A: no sale in a day; Leftover solar never grid-charges (P4).
+
+Mutations (MUTATION.md, purged copies, graded over this file and the named
+tests) are listed in the pull request.
+"""
+
+import asyncio
+import logging
+import os
+import random
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+from named_absence import nth, present                         # noqa: E402
+import opt11p3_identity as ident                               # noqa: E402
+import opt11p3_replay as rp                                    # noqa: E402
+from app import homeview, messages, modetrade, packmode, priceruns  # noqa
+from app import arbitrage                                      # noqa: E402
+from app.arbiter import Claim, P_ARBITRAGE, P_LOOP, P_PEAK, Resolution  # noqa
+from app.main import Controller, why_raised                    # noqa: E402
+from app.price import PricePoint, brussels                     # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+L = timezone(timedelta(hours=2))
+A, B = "inverter-a", "inverter-b"
+
+# ============================================================================ #
+print("1. modes off: byte-identical to 7a00f12 on the trade path")
+# Printed by tools/opt11p3_identity.py on release/1.0 7a00f12 (2026-09-29),
+# goodwe-addon-checks:1. 1080 cycles each; the trade CHARGEs and DISCHARGEs.
+AT_7A00F12 = {
+    "n1": "71245b227ca40bada4f71f57ea6154475f4b0bd60239c9ad4f80bffb0094514c",
+    "n2": "56cf28010b06765c29e5479abb815d7503d570b39240d82dfc818efa90c93722",
+    "n1_off": "71245b227ca40bada4f71f57ea6154475f4b0bd60239c9ad4f80bffb0094514c",
+    "n2_off": "56cf28010b06765c29e5479abb815d7503d570b39240d82dfc818efa90c93722",
+}
+_rows = {k: ident.run(**v)[0] for k, v in ident.SCENARIOS.items()}
+_got = {k: ident.digest(v) for k, v in _rows.items()}
+for k in AT_7A00F12:
+    print(f"    {k} {'same' if _got[k] == AT_7A00F12[k] else 'DIFFERS'} "
+          f"{_got[k][:16]}")
+check("with battery modes off (option absent or false), every command, "
+      "integrator, allocation and trade sentence equals 7a00f12's, at one "
+      "inverter and at two", _got == AT_7A00F12)
+_acts = {r[-1][0] for r in _rows["n2"] if r[-1]}
+check("...and the runs reach the trade P3 now skips with modes on: a charge "
+      "and a sale", {arbitrage.CHARGE, arbitrage.DISCHARGE} <= _acts)
+
+
+def _moved(scn, patch):
+    """Does `patch` (applied before each cycle) move scenario `scn`?"""
+    real = ident._feed
+
+    def feed(c, t):
+        patch(c)
+        real(c, t)
+    ident._feed = feed
+    try:
+        return ident.digest(ident.run(**ident.SCENARIOS[scn])[0]) \
+            != AT_7A00F12[scn]
+    finally:
+        ident._feed = real
+
+
+def _as_if_trade_ended(c):
+    c._mode_trade_was = True        # the run-edge reseed, leaking to modes off
+
+
+def _moved_headroom(scn):
+    """Does an unmeasured headroom (the expression P3 hoisted) move it?"""
+    from app import peakguard
+    real = peakguard.charge_headroom_w
+    peakguard.charge_headroom_w = lambda g: None
+    try:
+        return ident.digest(ident.run(**ident.SCENARIOS[scn])[0]) \
+            != AT_7A00F12[scn]
+    finally:
+        peakguard.charge_headroom_w = real
+
+
+check("non-vacuous: a run-edge reseed leaking into modes off moves n2, and so "
+      "does the headroom P3 hoisted, if it went unmeasured",
+      _moved("n2", _as_if_trade_ended) and _moved_headroom("n1"))
+
+# ============================================================================ #
+print("\n2. price runs")
+D0 = datetime(2026, 9, 9, 0, 0, tzinfo=L)
+
+
+def pts(prices, start=D0, minutes=15, provisional=()):
+    return [PricePoint(start=brussels(start + timedelta(minutes=minutes * i)),
+                       eur_per_kwh=p, provisional=i in provisional)
+            for i, p in enumerate(prices)]
+
+
+# 24 h of quarters: cheap 02:00-04:00 (and one cheaper single quarter at
+# 05:00), dear 18:00-20:00 with a peak quarter at 19:00, flat otherwise.
+DAY = [0.30] * 96
+for i in range(8, 16):
+    DAY[i] = 0.10
+DAY[20] = 0.05
+for i in range(72, 80):
+    DAY[i] = 0.50
+DAY[76] = 0.70
+P = pts(DAY)
+NOW = D0 + timedelta(minutes=5)
+r1 = priceruns.plan(P, NOW, required_eur_kwh=0.25, charge_kwh=5.0,
+                    charge_kw=2.5, sell_kwh=0.0, sell_kw=0.0)
+r2 = priceruns.plan(P, NOW, required_eur_kwh=0.25, charge_kwh=0.0,
+                    charge_kw=0.0, sell_kwh=2.5, sell_kw=2.5)
+print(f"    2 h need: {r1.cheap}; give {r1.give}")
+check("the cheap run lasts what the energy needs at the rating (5 kWh at "
+      "2.5 kW = 2 h) and is the cheapest such consecutive window, not the "
+      "cheapest single quarter",
+      r1.cheap.start == D0 + timedelta(hours=2)
+      and r1.cheap.end == D0 + timedelta(hours=4)
+      and abs(r1.cheap.mean_eur_kwh - 0.10) < 1e-9)
+check("...with nothing to charge, one quarter: the cheapest one",
+      r2.cheap.start == D0 + timedelta(hours=5)
+      and r2.cheap.end == D0 + timedelta(hours=5, minutes=15))
+check("give runs are the consecutive quarters at least the required spread "
+      "above the cheap run (0.10 + 0.25): 18:00-20:00, one run",
+      r1.on and len(r1.give) == 1
+      and r1.give[0].start == D0 + timedelta(hours=18)
+      and r1.give[0].end == D0 + timedelta(hours=20))
+check("the sell run is the dearest window inside a give run, sized by the "
+      "sellers' energy (2.5 kWh at 2.5 kW = 1 h)",
+      r2.sell.end - r2.sell.start == timedelta(hours=1)
+      and r1.give[0].start <= r2.sell.start < r2.sell.end <= r1.give[0].end
+      and r2.sell.start <= D0 + timedelta(hours=19) < r2.sell.end)
+_flat = priceruns.plan(pts([0.3] * 96), NOW, required_eur_kwh=0.1,
+                       charge_kwh=5, charge_kw=2.5, sell_kwh=0, sell_kw=0)
+_thr0 = priceruns.plan(pts([0.3] * 96), NOW, required_eur_kwh=0.0,
+                       charge_kwh=5, charge_kw=2.5, sell_kwh=0, sell_kw=0)
+check("a flat day has no plan (`not_worth`), even with a threshold of 0: the "
+      "cheap run never counts as its own expensive run",
+      _flat.reason == priceruns.NOT_WORTH and not _flat.give
+      and _thr0.reason == priceruns.NOT_WORTH)
+_prov = priceruns.plan(pts(DAY, provisional=set(range(74, 96))), NOW,
+                       required_eur_kwh=0.25, charge_kwh=5, charge_kw=2.5,
+                       sell_kwh=2.5, sell_kw=2.5)
+check("a provisional (carried) price is never part of a run (section 8.3)",
+      all(g.end <= D0 + timedelta(hours=18, minutes=30) for g in _prov.give)
+      and (_prov.sell is None
+           or _prov.sell.end <= D0 + timedelta(hours=18, minutes=30)))
+_neg = list(DAY)
+_neg[76] = -0.05
+_rn = priceruns.plan(pts(_neg), NOW, required_eur_kwh=0.25, charge_kwh=0,
+                     charge_kw=0, sell_kwh=10.0, sell_kw=2.5)
+check("the sell run never spans a quarter priced below 0 (section 17)",
+      _rn.sell is not None and not (_rn.sell.start <= D0 + timedelta(
+          hours=19) < _rn.sell.end))
+# All prices below 0 but one: the give run holds negative quarters (they
+# clear the spread over an even lower cheap run), and the sale must skip them.
+_allneg = [-0.30] * 96
+for i in range(8, 16):
+    _allneg[i] = -0.40
+for i in range(72, 80):
+    _allneg[i] = -0.05
+_allneg[76] = 0.10
+_rneg = priceruns.plan(pts(_allneg), NOW, required_eur_kwh=0.15,
+                       charge_kwh=0, charge_kw=0, sell_kwh=2.5, sell_kw=2.5)
+check("...even when the whole give run is below 0 but one quarter: the sale "
+      "is that quarter only",
+      _rneg.on and _rneg.sell is not None
+      and _rneg.sell.start == D0 + timedelta(hours=19)
+      and _rneg.sell.end == D0 + timedelta(hours=19, minutes=15))
+# A spike inside the cheap run clears the spread over the run's own mean:
+# it must not also be a give run (charge and give would overlap).
+_sp = [0.50] * 96
+for i in range(8, 16):
+    _sp[i] = 0.02
+_sp[15] = 0.20
+_rsp = priceruns.plan(pts(_sp), NOW, required_eur_kwh=0.05, charge_kwh=5.0,
+                      charge_kw=2.5, sell_kwh=0, sell_kw=0)
+check("no give run overlaps the cheap run, even a quarter inside it that "
+      "clears the spread over the run's mean",
+      _rsp.cheap.start == D0 + timedelta(hours=2)
+      and all(g.end <= _rsp.cheap.start or g.start >= _rsp.cheap.end
+              for g in _rsp.give))
+_few = priceruns.plan(pts([0.1]), NOW, required_eur_kwh=0.1, charge_kwh=1,
+                      charge_kw=1, sell_kwh=0, sell_kw=0)
+check("fewer than two firm slots: no plan (`no_prices`)",
+      _few.reason == priceruns.NO_PRICES)
+_mid = D0 + timedelta(hours=3)
+_new = priceruns.plan(P, _mid, required_eur_kwh=0.25, charge_kwh=0.0,
+                      charge_kw=0.0, sell_kwh=0.0, sell_kw=0.0)
+_kept = priceruns.keep_started(r1, _new, _mid)
+check("a run under way is kept to its end when a new plan would move it "
+      "(no flapping), and a run not yet started is not",
+      _new.cheap != r1.cheap and _kept.cheap == r1.cheap
+      and priceruns.keep_started(r1, _new, NOW).cheap == _new.cheap)
+_late = priceruns.plan(P, D0 + timedelta(hours=20, minutes=5),
+                       required_eur_kwh=0.25, charge_kwh=5, charge_kw=2.5,
+                       sell_kwh=0, sell_kw=0)
+check("a run that has ended is not planned again, and nothing beyond the "
+      "firm prices is invented",
+      all(g.start >= D0 + timedelta(hours=20) for g in _late.give)
+      and not _late.on)
+
+# ============================================================================ #
+print("\n3. roles: modetrade.decide() fuzz")
+rnd = random.Random(311)
+_bad = []
+_seen = set()
+for _ in range(20000):
+    n = rnd.choice((1, 2, 3))
+    packs = []
+    for k in range(n):
+        packs.append(modetrade.Pack(
+            f"inv-{k}", rnd.random() > 0.15,
+            rnd.choice(packmode.MODES), rnd.random() > 0.5,
+            rnd.choice((1000.0, 2500.0, 5000.0)),
+            rnd.choice((None, 5.0, 19.0, 20.0, 21.0, 60.0, 95.0, 99.0)),
+            rnd.choice((None, 5.0, 10.0)), live=rnd.random() > 0.1,
+            idle=rnd.random() > 0.1, refused=rnd.choice((0, 0, 0, 1, -1))))
+    t = D0 + timedelta(minutes=rnd.randrange(0, 24 * 60))
+    runs = rnd.choice((None, r1, r2, _flat))
+    ok_s = rnd.random() > 0.3
+    ok_c = ok_s and rnd.random() > 0.3
+    hr = rnd.choice((None, 0.0, 100.0, 499.0, 501.0, 3000.0))
+    price = rnd.choice((None, -0.1, 0.0, 0.5))
+    house = rnd.choice((None, -500.0, 800.0))
+    was = rnd.random() > 0.7
+    blocked = rnd.random() > 0.8
+    tk = modetrade.decide(runs, t, packs, charge_ok=ok_c, sell_ok=ok_s,
+                          trade_why="x", price_now=price, headroom_w=hr,
+                          floor_pct=20.0, ceiling_pct=95.0, house_w=house,
+                          charging_now=was, blocked=blocked)
+    _seen.add(tk.action)
+    by = {p.name: p for p in packs}
+    for name, (lo, hi) in tk.ranges.items():
+        if not lo <= 0.0 <= hi:
+            _bad.append(("range without 0", name, lo, hi))
+    for name, role in tk.roles.items():
+        p = by[name]
+        if role == modetrade.CHARGE and (p.mode != packmode.CHEAP_HOURS
+                                         or p.refused < 0 or not p.use
+                                         or p.soc is None or p.soc >= 95.0):
+            _bad.append(("bad charger", p))
+        if role == modetrade.SELL and (not p.sell or p.refused > 0
+                                       or p.mode == packmode.SOLAR_FIRST
+                                       or p.soc is None or p.soc <= 20.0):
+            _bad.append(("bad seller", p))
+        if not p.use and tk.ranges.get(name, (0.0, 0.0)) != (0.0, 0.0):
+            _bad.append(("off not 0", p))
+    if tk.action == modetrade.CHARGE:
+        need = 0.0 if was else modetrade.START_W
+        if not (ok_c and hr is not None and hr > need and not blocked
+                and runs is not None and runs.cheap.holds(t)):
+            _bad.append(("charge without leave", ok_c, hr, blocked))
+        for name, (lo, hi) in tk.ranges.items():
+            if tk.roles[name] != modetrade.CHARGE and lo < 0.0:
+                _bad.append(("grid charge on a non-charger", by[name]))
+        s = modetrade.size(tk, (-7000.0, 7000.0), hr)
+        if not (s < 0 and -s <= min(-tk.ask_w, hr) + 1e-9):
+            _bad.append(("charge size", s, tk.ask_w, hr))
+        if modetrade.size(tk, (-300.0, 300.0), hr) < -300.0:
+            _bad.append(("charge over the bound",))
+    if tk.action == modetrade.SELL:
+        if not (ok_s and price is not None and price >= 0.0 and runs
+                is not None and runs.sell.holds(t) and house is not None):
+            _bad.append(("sell without leave", ok_s, price))
+        s = modetrade.size(tk, (-7000.0, 2000.0), hr)
+        if not 0.0 < s <= 2000.0:
+            _bad.append(("sell size", s))
+    if tk.action is None and modetrade.size(tk, (-1e4, 1e4), hr) != 0.0:
+        _bad.append(("no action but a size",))
+print(f"    actions seen {sorted(map(str, _seen))}; {len(_bad)} bad: {_bad[:3]}")
+check("20000 random ticks: every range holds 0 W; Off is [0, 0]; no Solar "
+      "first, refusing, full or unknown battery charges; no Solar first, "
+      "refusing or at-floor battery sells; while one charges no other may "
+      "charge; a charge needs the guard, the headroom (500 W to start) and "
+      "no stop this period, and is sized under the headroom; a sale needs a "
+      "price >= 0 in the sell run", not _bad
+      and {modetrade.CHARGE, modetrade.SELL, None} <= _seen)
+
+# ============================================================================ #
+print("\n4. the real controller over a day (A Solar first, B Cheap hours + sell)")
+# Wholesale; all-in (x + 0.12) x 1.06: cheap 0.148, flat 0.339, dear 0.551.
+# With a cycle cost of 0.20 (0.30 widened) only 19:00-20:00 clears it.
+DAYW = [0.20] * 96 * 2
+for i in list(range(4, 12)) + list(range(100, 108)):
+    DAYW[i] = 0.02                           # 01:00-03:00 wholesale
+for i in list(range(76, 80)) + list(range(172, 176)):
+    DAYW[i] = 0.40                           # 19:00-20:00
+UTC0 = D0.astimezone(timezone.utc)
+WPTS = [(UTC0 + timedelta(minutes=15 * i), 900, p) for i, p in enumerate(DAYW)]
+
+
+def house_flat(w):
+    return [(UTC0.timestamp() - 10, float(w))]
+
+
+AIM = rp.PEAK_CAP - 50
+
+
+def run_day(variant, *, house_w=2600.0, start_h=0.75, hours=21.0,
+            soc0=None, choice=None, refuse=(), n=2, check_cb=None,
+            patch=None, house=None, limits=None):
+    rows = []
+
+    def cb(c, h, now, pr):
+        sh = dict(c.allocation.shares) if c.allocation is not None and \
+            c.allocation.shares else {}
+        rows.append(dict(
+            now=now, grid=h.grid(), shares=sh,
+            action=getattr(c.arb, "action", None),
+            winner=c.reason.split(" ->")[0],
+            roles=dict(c.mode_tick.roles) if c.mode_tick else {},
+            soc={u: p.soc for u, p in h.plants.items()},
+            p={u: p.p for u, p in h.plants.items()},
+            runs=c.mode_runs, price=pr, why=c.why_words,
+            unmet=getattr(c.allocation, "unmet_w", 0) or 0))
+        if check_cb:
+            check_cb(c, h, now, pr)
+    st, c = rp.run(variant, house or house_flat(house_w), WPTS,
+                   UTC0 + timedelta(hours=start_h), 3600 * hours, check=cb,
+                   soc0=soc0, choice=choice, refuse=refuse, n=n, patch=patch,
+                   extra={"cycle_cost_threshold_eur": 0.20}, limits=limits)
+    return rows, st, c
+
+
+# Selling is off (owner, 2026-09-29, option A). Its code is kept behind
+# packmode.SELLING_ENABLED, and these checks turn it on to hold that code to
+# its invariants; part 12 checks it is unreachable with the flag as shipped.
+_SELL_SHIPPED = packmode.SELLING_ENABLED
+packmode.SELLING_ENABLED = True
+ROWS, ST, _c4 = run_day("p3_ch_sell", soc0={"a": 60.0, "b": 30.0})
+charge = [r for r in ROWS if r["action"] == arbitrage.CHARGE]
+sell = [r for r in ROWS if r["action"] == arbitrage.DISCHARGE]
+print(f"    {len(ROWS)} cycles, {len(charge)} charging, {len(sell)} selling; "
+      f"{rp.summary(ST)}")
+check("B charged from the grid in the cheap run and sold in the dear one, "
+      "and A never took part in either",
+      charge and sell
+      and all(r["roles"][A] in (modetrade.REST, modetrade.HOUSE)
+              for r in charge + sell)
+      and all(r["now"].astimezone(L).hour in (0, 1, 2, 3) for r in charge)
+      and all(r["runs"].cheap.holds(r["now"]) for r in charge)
+      and all(r["now"].astimezone(L).hour == 19 for r in sell))
+_mixed = [r for r in ROWS if any(v > 0 for v in r["shares"].values())
+          and any(v < 0 for v in r["shares"].values())]
+check("no opposite-direction split on any cycle (every share one sign)",
+      not _mixed)
+check("no grid charge on Solar first: while the site charges from the grid, "
+      "A's share is never below 0 W",
+      all(r["shares"].get(A, 0) >= 0 for r in charge))
+# The quarters the add-on itself banked (the P1 blocks, as the bill reads).
+_chq = {int(r["now"].timestamp() // 900) for r in charge}
+_qc = [b.offtake_avg_w for b in _c4.p1.blocks
+       if int(b.start.timestamp() // 900) in _chq]
+print(f"    banked quarters with a grid charge: {len(_qc)}, highest "
+      f"{max(_qc):.2f} W, aim {AIM} W")
+check("never above the SAFETY-79 aim while grid charging: every banked "
+      "15-minute period with a grid charge is at most cap - margin",
+      _qc and max(_qc) <= AIM + 0.5)
+check("...and the charge is sized to the headroom, not the rating: under a "
+      "2.6 kW house B charges well under its 2.5 kW",
+      max(-r["shares"].get(B, 0) for r in charge) < 1200)
+_sold = [r for r in sell]
+check("no sale below the floor or the spread: every sale cycle has B above "
+      "arbitrage_soc_floor (20 %) and a price at least cheap + required",
+      all(r["soc"]["b"] > 19.9 for r in _sold)
+      and all(r["price"] is not None and rp.all_in(r["price"])
+              >= r["runs"].cheap.mean_eur_kwh + 0.30 - 1e-9 for r in _sold))
+_hold = [r for r in ROWS if r["roles"].get(B) == modetrade.HOLD]
+check("outside the expensive hours B holds its power: never gives while "
+      "holding", _hold and all(r["shares"].get(B, 0) <= 0 for r in _hold))
+_give = [r for r in ROWS if r["roles"].get(B) in (modetrade.GIVE,
+                                                  modetrade.SELL)]
+check("...and gives only in the expensive hours (19:00-20:00)",
+      all(r["now"].astimezone(L).hour == 19 for r in _give))
+
+
+def starts(rows, kind):
+    return sum(1 for a, b in zip(rows, rows[1:])
+               if a["action"] != kind and b["action"] == kind)
+
+
+check("the sale starts once and runs to its end: no on-off while the two "
+      "batteries' 5 kW discharge makes the peak guard read 'engaged'",
+      starts(ROWS, arbitrage.DISCHARGE) == 1)
+
+# B's inverter can only take 1000 W: the trade asks for that, not its rating.
+ROWS_U, _, _ = run_day("p3_ch_sell", hours=1.0, house_w=800.0,
+                       soc0={"a": 60.0, "b": 30.0},
+                       limits={"b": (-1000.0, 1000.0)})
+_cu = [r for r in ROWS_U if r["action"] == arbitrage.CHARGE]
+print(f"    B limited to 1 kW: charge {min(r['shares'].get(B, 0) for r in _cu)}"
+      f" W, unmet {max(abs(r['unmet']) for r in _cu)} W")
+check("SAFETY-45 sizing inside the modes: the charge is sized to what the "
+      "batteries may place, so none of it is left unmet (P1's gap)",
+      _cu and all(abs(r["unmet"]) < 1 for r in _cu)
+      and min(r["shares"].get(B, 0) for r in _cu) >= -1000)
+
+# A house that swings over the limit every minute during the cheap run.
+_sw = [(UTC0.timestamp() + 60 * k, 2000.0 if k % 2 else 3900.0)
+       for k in range(0, 200)]
+ROWS_W, _, _ = run_day("p3_ch_sell", hours=1.5, house=_sw,
+                       soc0={"a": 60.0, "b": 30.0})
+_per_q = {}
+for a_, b_ in zip(ROWS_W, ROWS_W[1:]):
+    if a_["action"] != arbitrage.CHARGE and b_["action"] == arbitrage.CHARGE:
+        q = int(b_["now"].timestamp() // 900)
+        _per_q[q] = _per_q.get(q, 0) + 1
+print(f"    house swinging 2.0/3.9 kW each minute: charge starts per period "
+      f"{sorted(_per_q.values())}")
+check("a charge the peak guard or the headroom stopped stays off for the "
+      "rest of that 15-minute period (at most one start per period)",
+      _per_q and max(_per_q.values()) == 1)
+
+# At the floor: B starts the sale just above it.
+ROWS_F, _, _ = run_day("p3_ch_sell", start_h=18.75, hours=1.5,
+                       soc0={"a": 60.0, "b": 24.0})
+_sf = [r for r in ROWS_F if r["action"] == arbitrage.DISCHARGE]
+_after = [r for r in ROWS_F if r["now"].astimezone(L).hour == 19
+          and r["soc"]["b"] <= 20.0]
+_lastf = nth(ROWS_F, -1, "the last cycle")
+print(f"    from 24 %: sold {len(_sf)} cycles, B ends at "
+      f"{_lastf['soc']['b'] if present(_lastf) else _lastf} %")
+check("the sale stops at arbitrage_soc_floor and does not re-arm in the run",
+      _sf and _after and all(r["action"] != arbitrage.DISCHARGE
+                             for r in _after))
+packmode.SELLING_ENABLED = _SELL_SHIPPED
+
+# N=1: one Cheap hours battery.
+ROWS1, _, _ = run_day("p3_ch_sell", n=1, soc0={"a": 30.0},
+                      choice={"a": (True, "cheap_hours", False)},
+                      hours=3.0)
+_c1 = [r for r in ROWS1 if r["action"] == arbitrage.CHARGE]
+check("at one inverter the same rules: it charges in the cheap run, sized "
+      "under the aim", _c1 and max(r["grid"] for r in _c1) < AIM + 400)
+
+# ============================================================================ #
+print("\n5. a refusal wins over a run")
+ROWS_R, _, _ = run_day("p3_ch_sell", hours=1.0, soc0={"a": 60.0, "b": 30.0},
+                       refuse=("b",))
+_first = nth(ROWS_R, 0, "the first cycle")
+_ref = [r for r in ROWS_R if present(_first)
+        and r["now"] > _first["now"] + timedelta(minutes=3)]
+print(f"    B refuses to charge; after 3 min: trades "
+      f"{sorted({str(r['action']) for r in _ref})}, B roles "
+      f"{sorted({r['roles'].get(B) for r in _ref})}")
+check("B refusing to charge: no grid trade is filed after the refusal is "
+      "learned, B's role is no longer 'charge', and A covers the house",
+      _ref and all(r["action"] is None for r in _ref)
+      and all(r["roles"].get(B) != modetrade.CHARGE for r in _ref)
+      and sum(r["shares"].get(A, 0) > 0 for r in _ref) > len(_ref) / 2)
+
+# ============================================================================ #
+print("\n6. no prices, no gap, Solar first alone")
+
+
+def _no_plan(c):
+    c.tariff_plan = None
+    c.fresh_tariff_plan = lambda now: None
+
+
+ROWS_N, _, _ = run_day("p3_ch_sell", hours=1.0, patch=_no_plan,
+                       soc0={"a": 60.0, "b": 60.0}, house_w=1500.0)
+check("no prices: no trade, and Leftover solar / Cheap hours follow the "
+      "house (they give power, not held forever)",
+      all(r["action"] is None for r in ROWS_N)
+      and all(r["roles"].get(B) == modetrade.HOUSE for r in ROWS_N)
+      and any(r["shares"].get(B, 0) > 0 for r in ROWS_N))
+ROWS_S, _, _ = run_day("p3_ch_sell", hours=21.0,
+                       choice={"a": (True, "solar_first", False),
+                               "b": (True, "solar_first", True)})
+check("both batteries Solar first: never a grid charge or a sale all day, "
+      "even with selling switched on",
+      all(r["action"] is None for r in ROWS_S))
+
+# ============================================================================ #
+print("\n7. a run edge reseeds the loop")
+
+
+def _no_reseed(c):
+    c._reseed_run_edge = lambda claims: None
+
+
+def edge(rows, kind):
+    for i in range(1, len(rows)):
+        if rows[i - 1]["action"] == kind and rows[i]["action"] != kind:
+            w = [r["grid"] for r in rows[i:i + 36]]
+            return min(w), max(w)
+    return None
+
+
+_e_on = edge(run_day("p3_ch_sell", hours=3.0, house_w=800.0,
+                     soc0={"a": 60.0, "b": 70.0})[0], arbitrage.CHARGE)
+_e_off = edge(run_day("p3_ch_sell", hours=3.0, house_w=800.0,
+                      soc0={"a": 60.0, "b": 70.0}, patch=_no_reseed)[0],
+              arbitrage.CHARGE)
+print(f"    grid in the 3 min after a 2.5 kW charge ends, 800 W house: "
+      f"reseeded {_e_on}, not reseeded {_e_off}")
+check("reseeded, the loop takes over without the import spike the trade's "
+      "watts leave behind (and exports no more than without)",
+      _e_on and _e_off and _e_on[1] < 1000 and _e_off[1] > 2000
+      and _e_on[0] > _e_off[0] - 100)
+
+# ============================================================================ #
+print("\n8. the site Why row (OPT-11 P1 test, F2)")
+_cl = [Claim.set("loop", P_LOOP, 1200.0), Claim.limit("peak", P_PEAK,
+                                                      lo=2500.0)]
+_up = Resolution(2500.0, "loop", bound_by="peak(quarter peak)")
+_dn = Resolution(800.0, "loop", bound_by="peak(quarter peak)")
+check("a peak floor that raised the power reads 'raised for the peak limit', "
+      "never 'held back'",
+      why_raised(_up, _cl) is True and "held back" not in messages.why(
+          "loop", 2500.0, "peak(quarter peak)", raised=True)
+      and "raised for the peak limit" in messages.why(
+          "loop", 2500.0, "peak(quarter peak)", raised=True))
+check("...a limit that lowered it still reads 'held back'",
+      why_raised(_dn, _cl) is False
+      and "held back by" in messages.why("loop", 800.0, "pack"))
+check("...and a trade the peak floor raised reads the same way",
+      why_raised(Resolution(2000.0, "arbitrage", bound_by="peak"),
+                 [Claim.set("arbitrage", P_ARBITRAGE, -1000.0)]) is True)
+
+# ============================================================================ #
+print("\n9. the selling switch is off (owner decision 2026-09-29, option A)")
+_st = rp._Store()
+_st.data[unit_key(B, packmode.SELL_KEY)] = True     # an old stored "on"
+_st.data[unit_key(B, packmode.MODE_KEY)] = packmode.CHEAP_HOURS
+_ctl = Controller(dict(rp.options(True, False)), rp.Hass(("a", "b"),
+                  lambda t: 0.0), _st, rp._Pub(), stop=asyncio.Event())
+_r9 = [asyncio.run(_ctl.handle_action("pack_sell", unit=B, value=v))
+       for v in (True, False, "yes")]
+check("pack_sell is refused with the plain reason 'Selling is off for now.' "
+      "and stores nothing",
+      all(x == {"error": messages.pack_refused("sell_off")} for x in _r9)
+      and _st.data[unit_key(B, packmode.SELL_KEY)] is True
+      and not any("selling switched" in str(e) for e in _ctl.events))
+check("...a stored 'on' reads as false: no battery sells or can, whatever "
+      "the store holds", packmode.SELLING_ENABLED is False
+      and packmode.read(_st.data, B).sell is False
+      and packmode.read(_st.data, B).can_sell is False
+      and all(p.sell is False for p in _ctl._mode_packs()))
+
+# ============================================================================ #
+print("\n10. the Batteries screen")
+_keys = set(homeview.ROLE_WHY.values()) | {"saves_later", "no_prices",
+                                             "no_spread"}
+_en, _nl = homeview.uitext.words("en"), homeview.uitext.words("nl")
+check("every role's Why line has words in English and Dutch, and they differ",
+      all(k in _en["home_words"]["why"] and k in _nl["home_words"]["why"]
+          and _en["home_words"]["why"][k] != _nl["home_words"]["why"][k]
+          for k in _keys))
+packmode.SELLING_ENABLED = True      # the kept sell code, as in part 4
+_c10 = run_day("p3_ch_sell", start_h=18.0, hours=0.5,
+               soc0={"a": 60.0, "b": 80.0})[2]
+_now10 = D0 + timedelta(hours=18, minutes=30)
+_plan = homeview.mode_runs(_c10, *homeview.local_day(_now10.astimezone(
+    timezone.utc)), _now10.astimezone(timezone.utc), False)
+packmode.SELLING_ENABLED = _SELL_SHIPPED
+print(f"    plan blocks for B at 18:30: "
+      f"{[(r['from'], r['to'], r['kind'], r['what']) for r in _plan[0]]}")
+check("the plan draws B's expensive run, the sale inside it, and nothing "
+      "for Solar first A", _plan[0]
+      and {r["battery"] for r in _plan[0]} == {1}
+      and any(r["kind"] == "give" for r in _plan[0]))
+_sale = [r for r in _plan[0] if r["what"].startswith("Sells")]
+check("a sale block shows no money: the price shown is what the house pays, "
+      "and a sale earns the lower injection price",
+      _sale and all(r["amount"] is None and r["eur"] is None for r in _sale))
+_why = homeview.battery_why(
+    modes_on=True, mode=packmode.CHEAP_HOURS, off=False, reading=True,
+    phase="idle", shadow=False, running=True, held=False, refused=0,
+    peak=False, sf_ahead=True, role="hold", has_at=True)
+check("a holding battery's Why names when it gives power",
+      _why == "saves" and "18:00 - 19:00" in homeview.why_words(
+          _why, at="18:00 - 19:00"))
+
+# ============================================================================ #
+print("\n11. review additions (PR #153): gaps four mutants survived")
+import types                                                   # noqa: E402
+import app.main as _main                                       # noqa: E402
+
+# Modes on with the site switch on: only the modes trade (R13).
+ROWS_X, _, _ = run_day("p2_arb", hours=3.0, soc0={"a": 30.0, "b": 30.0},
+                       choice={"a": (True, "solar_first", False),
+                               "b": (True, "solar_first", False)})
+check("modes on, 'Trade on the price spread' on, both batteries Solar first: "
+      "no trade all through the cheap hours (the site trade is not run)",
+      ROWS_X and all(r["action"] is None for r in ROWS_X)
+      and all(v >= 0 for r in ROWS_X for v in r["shares"].values())
+      and not any(r["winner"].startswith("arbitrage") for r in ROWS_X))
+
+# A battery in a maintenance phase takes no part in a run (R10).
+ROWS_M, _, _cm = run_day("p3_ch_sell", hours=0.6, house_w=800.0,
+                         soc0={"a": 60.0, "b": 30.0})
+_lm = nth(ROWS_M, -1, "the last cycle")
+_nm = _lm["now"] if present(_lm) else None
+_tm = _cm._mode_roles(_nm, [types.SimpleNamespace(phase=_main.IDLE),
+                            types.SimpleNamespace(phase="CHARGE")]) \
+    if _nm is not None else None
+check("a battery in its monthly cycle is not a charger: no range, no charge "
+      "role, and no grid charge when it is the only price battery",
+      _tm is not None and B not in _tm.ranges
+      and _tm.roles.get(B) != modetrade.CHARGE and _tm.action is None)
+
+# The headroom stopping a charge latches it off for the period (R8).
+_cm2 = run_day("p3_ch_sell", hours=0.6, house_w=800.0,
+               soc0={"a": 60.0, "b": 30.0})[2]
+_ok8 = False
+if _nm is not None and _cm2.mode_tick is not None \
+        and _cm2.mode_tick.action == modetrade.CHARGE:
+    _q = int(_nm.timestamp() // 900)
+    _cm2.arb_headroom_w = 0.0
+    _t1 = _cm2._mode_roles(_nm, None)
+    _cm2.arb_headroom_w = 3000.0
+    _t2 = _cm2._mode_roles(_nm + timedelta(seconds=5), None)
+    _nq = datetime.fromtimestamp((_q + 1) * 900 + 5, timezone.utc)
+    _cm2.tariff_at = _nq
+    _t3 = _cm2._mode_roles(_nq, None)
+    _ok8 = (_t1.why == "headroom" and _cm2._charge_blocked_q in (_q, _q + 1)
+            and _t2.action is None and _t3.action == modetrade.CHARGE)
+check("a charge the headroom stopped stays off for the rest of the period, "
+      "even when the headroom comes back, and may start in the next one", _ok8)
+
+# ============================================================================ #
+print("\n12. option A: no sale, and Leftover solar takes solar only (P4)")
+ROWS_A, _, _ = run_day("p3_ch_sell", soc0={"a": 60.0, "b": 30.0},
+                       choice={"a": (True, "solar_first", False),
+                               "b": (True, "cheap_hours", True)})
+print(f"    Cheap hours B with a stored sell 'on': "
+      f"{sum(r['action'] == arbitrage.CHARGE for r in ROWS_A)} charging, "
+      f"{sum(r['action'] == arbitrage.DISCHARGE for r in ROWS_A)} selling")
+check("with selling on in the store, a whole day has no sale and no sell "
+      "role, while Cheap hours only still charges from the grid",
+      all(r["action"] != arbitrage.DISCHARGE for r in ROWS_A)
+      and all(modetrade.SELL not in r["roles"].values() for r in ROWS_A)
+      and any(r["action"] == arbitrage.CHARGE for r in ROWS_A))
+ROWS_L, _, _c12 = run_day("p3_ch_sell", soc0={"a": 60.0, "b": 30.0},
+                          choice={"a": (True, "solar_first", False),
+                                  "b": (True, "leftover_solar", True)})
+_lh = [r for r in ROWS_L if r["roles"].get(B) == modetrade.HOLD]
+_lg = [r for r in ROWS_L if r["roles"].get(B) == modetrade.GIVE]
+print(f"    Leftover solar B: {len(_lh)} holding, {len(_lg)} giving, "
+      f"grid trades {sorted({str(r['action']) for r in ROWS_L})}")
+check("Leftover solar never charges from the grid before the forecast: no "
+      "grid trade and no charge role all day, in the same cheap run",
+      all(r["action"] is None for r in ROWS_L)
+      and all(r["roles"].get(B) != modetrade.CHARGE for r in ROWS_L))
+check("...it still saves its power and gives it in the expensive hours",
+      _lh and _lg and all(r["now"].astimezone(L).hour == 19 for r in _lg))
+_pk = [modetrade.Pack("x", True, m, False, 2500.0, 30.0, 10.0)
+       for m in packmode.MODES]
+check("...only Cheap hours only is a grid charger (packmode.GRID_CHARGE_MODES)",
+      [p.mode for p in modetrade.chargers(_pk, 95.0)]
+      == [packmode.CHEAP_HOURS])
+_c12b = run_day("p3_ch_sell", start_h=0.75, hours=0.25,
+                soc0={"a": 60.0, "b": 30.0},
+                choice={"a": (True, "solar_first", False),
+                        "b": (True, "leftover_solar", True)})[2]
+_n12 = UTC0 + timedelta(hours=1)
+_plan12 = homeview.mode_runs(_c12b, *homeview.local_day(_n12), _n12,
+                             False)[0]
+print(f"    Leftover solar plan at 01:00: "
+      f"{[(r['from'], r['to'], r['kind']) for r in _plan12]}")
+check("...and the plan draws no grid block for it, only its expensive run",
+      _plan12 and all(r["kind"] != "grid" for r in _plan12))
+_enw, _nlw = homeview.uitext.words("en"), homeview.uitext.words("nl")
+check("...and its help text promises no grid charging (EN and NL)",
+      all("cheap" not in t.lower() and "goedkop" not in t.lower()
+          for t in (_enw["home"]["batteries"]["choice"]["leftover_solar"]
+                    ["description"],
+                    _nlw["home"]["batteries"]["choice"]["leftover_solar"]
+                    ["description"],
+                    _enw["home"]["batteries"]["how"]["leftover_solar"]
+                    ["description"],
+                    _nlw["home"]["batteries"]["how"]["leftover_solar"]
+                    ["description"])))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED:")
+    for f in fails:
+        print(f"  - {f}")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_modes_p4.py b/goodwe_controller/test_modes_p4.py
new file mode 100644
index 0000000..b0f1234
--- /dev/null
+++ b/goodwe_controller/test_modes_p4.py
@@ -0,0 +1,800 @@
+"""Runnable check for OPT-11 P4, the solar forecast and the day plan.
+`python3 test_modes_p4.py`
+
+Drives the pure modules (solarfc, dayplan, modetrade) and the REAL Controller
+(tools/opt11p3_replay.py's engine, with a forecast sensor in the fake Home
+Assistant), in simulated time. DECISIONS/OPT-11-battery-modes.md has the
+record.
+
+1. No usable forecast (none set, or set and unavailable): every command,
+   trade and role is byte-identical to release/1.0 5a4cdc2 (digests measured
+   there), and the harness sees a change there.
+2. The forecast sensors: the three supported shapes, units, stale, missing.
+3. The house profile: hours, days kept, the night floor, ready.
+4. The day plan: sunny, partly, dark; Solar first never gets a level; a
+   Leftover solar level is the shortfall; hysteresis.
+5. modetrade with a plan: a fuzz against the invariants, and no plan = P3.
+6. The real controller over a night and a day: sunny (no grid charge),
+   dark (Leftover solar buys the shortfall only, and stops there), Cheap
+   hours skips the part the sun covers, a forecast that goes away mid-run,
+   and every P1-P3 and SAFETY-79 invariant on every cycle.
+7. The Batteries screen and the Simple view: the forecast line and Why.
+8. Options: validation of the trust and the entities.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import asyncio
+import logging
+import os
+import random
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+from named_absence import nth, present                         # noqa: E402
+import opt11p3_replay as rp                                    # noqa: E402
+from app import arbitrage, dayplan, homeview, modetrade, packmode  # noqa
+from app import priceruns, solarfc, validate                    # noqa: E402
+from app.tariff import BILLING_TZ                               # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+L = timezone(timedelta(hours=2))
+A, B = "inverter-a", "inverter-b"
+D0 = datetime(2026, 9, 21, tzinfo=L)
+UTC0 = D0.astimezone(timezone.utc)
+
+# ============================================================================ #
+print("1. no usable forecast: byte-identical to 5a4cdc2 (P3 option A)")
+# Printed by tools/opt11p4_identity.py on release/1.0 5a4cdc2 (2026-09-29),
+# goodwe-addon-checks:1. 1080 cycles each, battery modes on.
+BASE_DIGESTS = {
+    "n1_ls":
+        "13f11c330263c91625acde7628426ff16dae3a9af99aebeef3051dc5b5a884ea",
+    "n1_ch":
+        "ff3fb2cdf849bc74185864e0fd87c04c70a947b2f2b08d3f5c9b35ee8b75f490",
+    "n2_sf_ls":
+        "9424e1837b805a6a31293a28b8fbad6ba611ea0bfe3240d636d68d62dc5e9f22",
+    "n2_ch_ls":
+        "63e09c4323148ec4e1e6766a3c50ab270b6575ec13c35aaa1115d2c5cabc342b",
+    "n2_ls_ls":
+        "98e180d43fa2aeecbe693838d2097dd4cb698c60aba8213c198d80d4e7166265",
+    "n2_sf_ch":
+        "95908916505bc5fa460db7b9829d5b56ec216038caa47be4bbf7be775241c7a2",
+    "n1_ls_fc_down":
+        "13f11c330263c91625acde7628426ff16dae3a9af99aebeef3051dc5b5a884ea",
+    "n1_ch_fc_down":
+        "ff3fb2cdf849bc74185864e0fd87c04c70a947b2f2b08d3f5c9b35ee8b75f490",
+    "n2_sf_ls_fc_down":
+        "9424e1837b805a6a31293a28b8fbad6ba611ea0bfe3240d636d68d62dc5e9f22",
+    "n2_ch_ls_fc_down":
+        "63e09c4323148ec4e1e6766a3c50ab270b6575ec13c35aaa1115d2c5cabc342b",
+    "n2_ls_ls_fc_down":
+        "98e180d43fa2aeecbe693838d2097dd4cb698c60aba8213c198d80d4e7166265",
+    "n2_sf_ch_fc_down":
+        "95908916505bc5fa460db7b9829d5b56ec216038caa47be4bbf7be775241c7a2",
+}
+import opt11p4_identity as ident                                # noqa: E402
+
+got = ident.digests()
+for k, v in BASE_DIGESTS.items():
+    check(f"{k}: same digest as 5a4cdc2", got.get(k) == v)
+check("every scenario is pinned", set(got) == set(BASE_DIGESTS))
+for k in [k for k in got if k.endswith("_fc_down")]:
+    check(f"{k}: a set but unavailable forecast equals no forecast",
+          got[k] == got[k[:-len('_fc_down')]])
+
+
+def _moved(scn, patch, undo):
+    patch()
+    try:
+        return ident.p3.digest(ident.run(**ident.SCENARIOS[scn])[0]) \
+            != BASE_DIGESTS[scn]
+    finally:
+        undo()
+
+
+_gcm = modetrade.GRID_CHARGE_MODES
+check("the harness bites: Leftover solar grid-charging with no plan moves "
+      "n2_sf_ls",
+      _moved("n2_sf_ls",
+             lambda: setattr(modetrade, "GRID_CHARGE_MODES",
+                             (packmode.LEFTOVER_SOLAR, packmode.CHEAP_HOURS)),
+             lambda: setattr(modetrade, "GRID_CHARGE_MODES", _gcm)))
+_read = solarfc.read
+
+
+def _as_dark(today, tomorrow, now, **kw):
+    return _read({"state": "0", "attributes": {"unit_of_measurement":
+                                               "kWh"},
+                  "last_updated": now.isoformat()}, None, now)
+
+
+check("...and an unavailable forecast read as a dark one moves "
+      "n2_sf_ls_fc_down (Leftover solar would buy its shortfall)",
+      _moved("n2_sf_ls_fc_down", lambda: setattr(solarfc, "read", _as_dark),
+             lambda: setattr(solarfc, "read", _read)))
+
+# ============================================================================ #
+print("2. the forecast sensors")
+NOW = datetime(2026, 9, 21, 9, 0, tzinfo=L).astimezone(timezone.utc)
+
+
+def st(state, unit="kWh", at=NOW, **attrs):
+    a = dict(attrs)
+    if unit is not None:
+        a["unit_of_measurement"] = unit
+    return {"state": state, "attributes": a,
+            "last_updated": at.isoformat(), "last_reported": at.isoformat()}
+
+
+fc, why = solarfc.read(st("12.5"), None, NOW)
+check("Forecast.Solar shape (state only, kWh): read", fc is not None
+      and abs(fc.today.kwh - 12.5) < 1e-9 and fc.today.periods == ())
+check("...the rest of the day adds up to the state",
+      abs(fc.between(NOW, UTC0 + timedelta(days=1)) - 12.5) < 1e-6)
+check("...and nothing comes after sunset (20:00 local)",
+      fc.between(datetime(2026, 9, 21, 20, tzinfo=L), UTC0
+                 + timedelta(days=1)) < 1e-9)
+fc2, _ = solarfc.read(st("12500", unit="Wh"), None, NOW)
+fc3, _ = solarfc.read(st("0.0125", unit="MWh"), None, NOW)
+check("Wh and MWh are converted, never guessed",
+      abs(fc2.today.kwh - 12.5) < 1e-9 and abs(fc3.today.kwh - 12.5) < 1e-9)
+check("a sensor with no unit, or in W, is refused (unit)",
+      solarfc.read(st("12.5", unit=None), None, NOW) == (None, solarfc.UNIT)
+      and solarfc.read(st("12.5", unit="W"), None, NOW)[1] == solarfc.UNIT)
+check("unavailable, unknown and a missing entity are no forecast",
+      solarfc.read(st("unavailable"), None, NOW)[1] == solarfc.MISSING
+      and solarfc.read(st("unknown"), None, NOW)[1] == solarfc.MISSING
+      and solarfc.read(None, None, NOW)[1] == solarfc.MISSING)
+check("a negative or non-numeric state is no forecast",
+      solarfc.read(st("-1"), None, NOW)[1] == solarfc.BAD
+      and solarfc.read(st("lots"), None, NOW)[1] == solarfc.BAD)
+old = NOW - timedelta(seconds=solarfc.FRESH_S + 1)
+check("older than 3 h is stale, and stale is no forecast",
+      solarfc.read(st("12.5", at=old), None, NOW) == (None, solarfc.STALE)
+      and solarfc.read(st("12.5", at=NOW - timedelta(hours=2, minutes=59)),
+                       None, NOW)[0] is not None)
+check("a report from the future is stale too",
+      solarfc.read(st("12.5", at=NOW + timedelta(hours=1)), None,
+                   NOW)[1] == solarfc.STALE)
+check("not configured says so", solarfc.read(None, None, NOW,
+                                              configured=False)[1]
+      == solarfc.NOT_SET)
+# Solcast: detailedForecast, kW per 30 min, the whole day.
+sol = [{"period_start": (UTC0 + timedelta(minutes=30 * i)).isoformat(),
+        "pv_estimate": 2.0 if 20 <= i < 36 else 0.0} for i in range(48)]
+fc4, _ = solarfc.read(st("8.0", detailedForecast=sol), None, NOW)
+# 10:00-18:00 local at 2 kW = 16 kWh in all; from 09:00 all 16 is to come,
+# scaled to the state's 8.
+check("Solcast shape: periods read and scaled to the state (kWh left)",
+      fc4.today.periods and abs(fc4.between(NOW, UTC0 + timedelta(days=1))
+                                - 8.0) < 1e-6)
+check("...the split is used: 10:00-12:00 is a quarter of the day's sun",
+      abs(fc4.between(datetime(2026, 9, 21, 10, tzinfo=L),
+                      datetime(2026, 9, 21, 12, tzinfo=L)) - 2.0) < 1e-6)
+# Open-Meteo: wh_period, Wh per hour.
+wh = {(UTC0 + timedelta(hours=h)).isoformat(): (1000.0 if 8 <= h < 16
+                                                 else 0.0)
+      for h in range(24)}
+fc5, _ = solarfc.read(st("7.0", wh_period=wh), None, NOW)
+check("Open-Meteo shape: wh_period read (8 x 1 kWh, 7 left at 09:00)",
+      abs(fc5.between(NOW, UTC0 + timedelta(days=1)) - 7.0) < 1e-6
+      and abs(fc5.between(datetime(2026, 9, 21, 14, tzinfo=L),
+                          datetime(2026, 9, 21, 16, tzinfo=L)) - 2.0) < 1e-6)
+TOM = UTC0 + timedelta(days=1)
+check("without tomorrow's sensor, a span into tomorrow's sun is unknown",
+      fc.between(NOW, TOM + timedelta(hours=9)) is None
+      and fc.between(NOW, TOM + timedelta(hours=5)) is not None)
+fct, _ = solarfc.read(st("12.5"), st("20.0"), NOW)
+check("with it, tomorrow's sun is counted",
+      abs(fct.between(TOM, TOM + timedelta(days=1)) - 20.0) < 1e-6)
+fcs, _ = solarfc.read(st("12.5"), st("20.0", at=old), NOW)
+check("a stale tomorrow is dropped, today is kept",
+      fcs is not None and fcs.tomorrow is None)
+# Review (PR #156): just after local midnight the integration may not have
+# refreshed yet, so "left today" is still yesterday's 0 and "tomorrow" is
+# really today. That is stale, not a dark day.
+MID = datetime(2026, 9, 22, 0, 10, tzinfo=L).astimezone(timezone.utc)
+EVE = datetime(2026, 9, 21, 21, 30, tzinfo=L).astimezone(timezone.utc)
+check("a today reading from before local midnight is stale (not 0 kWh)",
+      solarfc.read(st("0.0", at=EVE), st("15", at=EVE), MID)
+      == (None, solarfc.STALE))
+fcm, _ = solarfc.read(st("15", at=MID - timedelta(minutes=2)),
+                      st("18", at=EVE), MID)
+check("...and a tomorrow reading from before midnight is dropped",
+      fcm is not None and fcm.tomorrow is None)
+
+# ============================================================================ #
+print("3. the house profile")
+
+
+def profile(day_w=None, days=1, evening=None, start=UTC0 - timedelta(days=1)):
+    hp = dayplan.HouseProfile()
+    t = start
+    end = start + timedelta(days=days)
+    while t < end:
+        h = t.astimezone(L).hour
+        w = (evening if evening is not None and 17 <= h < 22 else
+             day_w if day_w is not None else 600.0)
+        hp.add(t, w)
+        t += timedelta(seconds=5)
+    hp.add(t, None)
+    return hp
+
+
+hp = profile(day_w=600.0, evening=3000.0)
+check("a full day recorded is ready, with 24 hours",
+      hp.ready() and sum(len(r) for r in hp.days.values()) == 24)
+check("an hour's figure is its mean", abs(hp.hour_w(18) - 3000.0) < 1e-6
+      and abs(hp.hour_w(3) - 600.0) < 1e-6)
+hp_half = dayplan.HouseProfile()
+for i in range(12 * 60 * 10):
+    hp_half.add(UTC0 + timedelta(seconds=5 * i), 500.0)
+check("ten hours are not ready (MIN_HOURS)", not hp_half.ready())
+neg = profile(day_w=-2000.0)
+f, base = neg.estimator()
+check("a sunny net use (negative) is lifted to the night floor for the "
+      "solar sum", f(12) == -2000.0 and base == -2000.0 or base >= 0.0)
+hp9 = profile(days=9)
+check("only the last 7 days are kept", len(hp9.days) <= 8)
+hp_rt = dayplan.HouseProfile(hp.dump())
+check("dump and load give the same figures", hp_rt.hour_w(18) == round(
+    hp.hour_w(18), 1) and hp_rt.ready())
+bogus = dayplan.HouseProfile({"2099-01-01": {str(h): 9e5 for h in range(24)},
+                              "zz": {str(h): 9e5 for h in range(24)}})
+check("a stored day that is not a date is dropped on load",
+      "zz" not in bogus.days)
+bogus.add(UTC0, 500.0)
+bogus.add(UTC0 + timedelta(hours=1), 500.0)
+check("a stored day after today (a wrong clock) is pruned, not kept forever",
+      "2099-01-01" not in bogus.days)
+check("a bad stored profile is ignored, not fatal",
+      not dayplan.HouseProfile({"x": "y", "2026-09-20": {"99": 1,
+                                                          "a": "b"}}).ready())
+
+# ============================================================================ #
+print("4. the day plan")
+P = modetrade.Pack
+
+
+def pk(name, mode, soc, cap=10.0, **kw):
+    return P(name, True, mode, False, 2500.0, soc, cap, **kw)
+
+
+# Prices: cheap 01:00-03:00, dear 19:00-20:00 local (as in test_modes_p3).
+DAYW = [0.20] * 96 * 2
+for i in list(range(4, 12)) + list(range(100, 108)):
+    DAYW[i] = 0.02
+for i in list(range(76, 80)) + list(range(172, 176)):
+    DAYW[i] = 0.40
+WPTS = [(UTC0 + timedelta(minutes=15 * i), 900, p) for i, p in enumerate(DAYW)]
+from app.price import PricePoint                                # noqa: E402
+
+
+def runs_at(now):
+    pts = [PricePoint(start=s, eur_per_kwh=rp.all_in(p), provisional=False)
+           for s, _n, p in WPTS]
+    return priceruns.plan(pts, now, required_eur_kwh=0.30, charge_kwh=6.0,
+                          charge_kw=2.5, sell_kwh=0.0, sell_kw=0.0)
+
+
+T0 = datetime(2026, 9, 21, 0, 30, tzinfo=L).astimezone(timezone.utc)
+R0 = runs_at(T0)
+check("the price plan has a cheap run at night and a dear one at 19:00",
+      R0.on and R0.cheap.holds(datetime(2026, 9, 21, 1, 30, tzinfo=L))
+      and any(g.start.astimezone(L).hour == 19 for g in R0.give))
+
+
+def fc_of(kwh, now=T0):
+    wh = {(UTC0 + timedelta(hours=h)).isoformat():
+          (kwh * 1000.0 / 10 if 8 <= h < 18 else 0.0) for h in range(24)}
+    return solarfc.read(st(f"{kwh}", wh_period=wh, at=now), None, now)[0]
+
+
+EST = profile(day_w=600.0, evening=3000.0).estimator()
+PACKS = [pk(A, packmode.SOLAR_FIRST, 60.0), pk(B, packmode.LEFTOVER_SOLAR,
+                                                 30.0)]
+
+
+def dplan(kwh, packs=PACKS, trust=70, est=EST):
+    return dayplan.plan(fc_of(kwh), est, R0, T0, packs, trust_pct=trust,
+                        floor_pct=20.0, ceiling_pct=95.0)
+
+
+sunny, partly, dark = dplan(40.0), dplan(12.0), dplan(1.0)
+print(f"    sunny {sunny.verdict} {sunny.targets}; partly {partly.verdict} "
+      f"{partly.targets}; dark {dark.verdict} {dark.targets}")
+check("40 kWh forecast: sunny, and B needs nothing from the grid",
+      sunny.verdict == dayplan.SUNNY and sunny.need_kwh[B] == 0.0)
+check("1 kWh forecast: dark (not even A fills from the sun)",
+      dark.verdict == dayplan.DARK)
+check("Solar first never gets a level (never charges from the grid)",
+      all(A not in p.targets for p in (sunny, partly, dark)))
+_use = 3000.0 / 1000.0          # the 19:00-20:00 run at 3 kW
+_want = 20.0 + _use / dayplan.EFF / 10.0 * 100.0
+check("dark: B's level is what the house draws in the dear run (floor + "
+      f"use / eff = {_want:.1f} %), not the 95 % ceiling",
+      abs(dark.targets[B] - _want) < 0.1 and dark.targets[B] < 95.0)
+check("...so it buys only the shortfall", abs(dark.need_kwh[B] - (
+    _want - 30.0) / 10.0) < 0.01)
+check("the level falls as the forecast rises (partly between dark and "
+      "sunny)", sunny.targets[B] <= partly.targets[B] <= dark.targets[B])
+ch = dplan(12.0, packs=[pk(A, packmode.SOLAR_FIRST, 60.0),
+                        pk(B, packmode.CHEAP_HOURS, 30.0)])
+ch_dark = dplan(1.0, packs=[pk(A, packmode.SOLAR_FIRST, 60.0),
+                            pk(B, packmode.CHEAP_HOURS, 30.0)])
+check("...and on a partly sunny day too: Cheap hours ignores the plan "
+      "(design section 1; review of PR #156)", B not in ch.targets
+      and B not in ch_dark.targets
+      and modetrade.charge_to(pk(B, packmode.CHEAP_HOURS, 30.0), 95.0,
+                              {B: 40.0}) == 95.0)
+# Review of PR #156: four mutants that survived.
+_hi = {h: (3000.0 if 17 <= h < 22 else 2000.0 if 8 <= h < 17 else 600.0)
+       for h in range(24)}
+check("a house that uses more by day leaves less sun: a higher level",
+      dplan(20.0, est=(lambda h: _hi[h], 600.0)).targets[B]
+      > dplan(20.0).targets[B] + 1.0)
+_two = dplan(40.0, packs=[pk(A, packmode.SOLAR_FIRST, 60.0),
+                          pk(B, packmode.LEFTOVER_SOLAR, 30.0),
+                          pk("inverter-c", packmode.LEFTOVER_SOLAR, 80.0)])
+check("two Leftover solar batteries share the sun by their room (65:15)",
+      abs(_two.share_kwh[B] / _two.share_kwh["inverter-c"] - 6.5 / 1.5)
+      < 0.01)
+_h = lambda hh: datetime(2026, 9, 21, hh, tzinfo=L).astimezone(timezone.utc)
+_rp = priceruns.RunPlan(priceruns.Run(_h(13), _h(14), 0.02),
+                        (priceruns.Run(_h(8), _h(9), 0.4),
+                         priceruns.Run(_h(19), _h(20), 0.4)),
+                        None, 0.3, None, True)
+_pl = dayplan.plan(fc_of(12.0), EST, _rp, T0, PACKS, trust_pct=70,
+                   floor_pct=20.0, ceiling_pct=95.0)
+check("the plan is for the dear run after the cheap run, not an earlier one",
+      _pl is not None and _pl.until == _h(19))
+_hp = dayplan.HouseProfile()
+for i in range(30):
+    _hp.add(_h(10) + timedelta(seconds=5 * i), 500.0)
+_hp.add(_h(11), 500.0)
+check("an hour with under 5 minutes of readings is not kept",
+      not any(10 in r for r in _hp.days.values()))
+check("trust 100 % counts more sun than 70 %: a lower level",
+      dplan(12.0, trust=100).targets[B] < partly.targets[B])
+check("...and the sun counted scales with the trust exactly",
+      abs(dplan(12.0, trust=100).sun_kwh * 0.7 - partly.sun_kwh) < 0.01)
+_room_a = (95.0 - 60.0) / 10.0 * 10.0 / 10.0     # A: 60 % -> 95 % of 10 kWh
+check("Solar first takes the sun first: B's share is what is left after "
+      f"A's {_room_a:.1f} kWh of room",
+      abs(partly.share_kwh[B] - max(0.0, partly.sun_kwh - _room_a)) < 0.01
+      and partly.share_kwh[B] < partly.sun_kwh)
+_flat = (lambda h: 600.0, 600.0)
+_sunny_net = (lambda h: -2000.0 if 9 <= h < 17 else 600.0, 600.0)
+check("the house's net use in sunny hours (negative) is lifted to the night "
+      "floor: the same sun as a flat 600 W house",
+      abs(dplan(12.0, est=_flat).sun_kwh - dplan(12.0, est=_sunny_net)
+          .sun_kwh) < 1e-6)
+check("no forecast, no house profile or no price plan: no plan",
+      dayplan.plan(None, EST, R0, T0, PACKS, trust_pct=70, floor_pct=20,
+                   ceiling_pct=95) is None
+      and dplan(12.0, est=None) is None
+      and dayplan.plan(fc_of(12.0), EST, None, T0, PACKS, trust_pct=70,
+                       floor_pct=20, ceiling_pct=95) is None)
+# A plan for a run beyond today's forecast (after 20:00, cheap run tomorrow
+# night, give run tomorrow evening) with no tomorrow sensor: no plan.
+T_EVE = datetime(2026, 9, 21, 21, 0, tzinfo=L).astimezone(timezone.utc)
+check("the sun before the dear run is unknown (no tomorrow sensor): no plan",
+      dayplan.plan(fc_of(12.0, T_EVE), EST, runs_at(T_EVE), T_EVE, PACKS,
+                   trust_pct=70, floor_pct=20, ceiling_pct=95) is None)
+off = [pk(A, packmode.SOLAR_FIRST, 60.0),
+       P(B, False, packmode.LEFTOVER_SOLAR, False, 2500.0, 30.0, 10.0)]
+check("an Off battery gets no level", B not in dplan(1.0, packs=off).targets)
+maint = [pk(A, packmode.SOLAR_FIRST, 60.0),
+         pk(B, packmode.LEFTOVER_SOLAR, 30.0, idle=False)]
+check("a battery in maintenance gets no level",
+      B not in dplan(1.0, packs=maint).targets)
+# Hysteresis.
+cap = {B: 10.0}
+check("hysteresis: a 0.3 kWh move on a 40 % level is ignored",
+      dayplan.hold({B: 40.0}, {B: 43.0}, cap) == {B: 40.0})
+check("...a 1 kWh move is taken", dayplan.hold({B: 40.0}, {B: 50.0}, cap)
+      == {B: 50.0})
+check("...10 % of a small level is enough (0.3 kWh on a 25 % level)",
+      dayplan.hold({B: 25.0}, {B: 28.0}, cap) == {B: 28.0})
+check("...a battery new to the plan takes its level, one gone is dropped",
+      dayplan.hold({A: 50.0}, {B: 33.0}, cap) == {B: 33.0})
+_flips = 0
+_kept = None
+rnd = random.Random(4)
+for i in range(400):
+    lvl = 40.0 + rnd.uniform(-2.0, 2.0)       # a noisy forecast
+    new = dayplan.hold(_kept, {B: lvl}, cap)
+    if _kept is not None and new != _kept:
+        _flips += 1
+    _kept = new
+check(f"a forecast wobbling by +-0.2 kWh moves the level rarely "
+      f"({_flips} of 400)", _flips <= 8)
+
+# ============================================================================ #
+print("5. modetrade with a plan")
+
+
+def p3_chargers(packs, ceiling, done=()):
+    """P3 option A's rule, as 5a4cdc2 wrote it."""
+    return [p for p in packs if p.use and p.idle and p.live
+            and p.mode in packmode.GRID_CHARGE_MODES and p.soc is not None
+            and p.soc < ceiling and p.refused >= 0 and p.name not in done]
+
+
+rnd = random.Random(11)
+bad = []
+same = 0
+for i in range(20000):
+    packs = [P(n, rnd.random() > 0.1, rnd.choice(packmode.MODES), False,
+               2500.0, rnd.choice([None, rnd.uniform(0, 100)]),
+               rnd.choice([None, 10.0, 5.0]), live=rnd.random() > 0.05,
+               idle=rnd.random() > 0.1, refused=rnd.choice([0, 0, 0, 1, -1]))
+             for n in (A, B, "c")]
+    ceiling = rnd.choice([90.0, 95.0, 100.0])
+    if [p.name for p in modetrade.chargers(packs, ceiling)] == \
+            [p.name for p in p3_chargers(packs, ceiling)]:
+        same += 1
+    targets = {p.name: rnd.uniform(0, 120) for p in packs
+               if rnd.random() > 0.3}
+    ch = modetrade.chargers(packs, ceiling, targets=targets)
+    for p in ch:
+        to = modetrade.charge_to(p, ceiling, targets)
+        if p.mode == packmode.SOLAR_FIRST or to is None or to > ceiling \
+                or p.soc >= to or p.refused < 0 or not (p.use and p.idle
+                                                        and p.live):
+            bad.append((p, targets, ceiling))
+        if p.mode == packmode.LEFTOVER_SOLAR and p.name not in targets:
+            bad.append(("LS without a level", p))
+check("no plan: chargers() is P3 option A's rule on 20 000 random rosters",
+      same == 20000)
+check("with a plan: never Solar first, never above the ceiling or the "
+      "level, never refusing, Off, not live or in maintenance, and Leftover "
+      f"solar only with a level ({len(bad)} bad)", not bad)
+# decide() with a plan, in the cheap run: every range holds 0, only chargers
+# charge, SF never charges.
+now_c = R0.cheap.start + timedelta(minutes=5)
+bad = []
+for i in range(5000):
+    packs = [P(n, rnd.random() > 0.1, rnd.choice(packmode.MODES), False,
+               2500.0, rnd.uniform(0, 100), 10.0, live=rnd.random() > 0.05,
+               idle=rnd.random() > 0.1, refused=rnd.choice([0, 0, 1, -1]))
+             for n in (A, B)]
+    targets = {p.name: rnd.uniform(0, 100) for p in packs}
+    t = modetrade.decide(R0, now_c, packs, charge_ok=True, sell_ok=True,
+                         trade_why=None, price_now=0.1, headroom_w=3000.0,
+                         floor_pct=20.0, ceiling_pct=95.0, house_w=500.0,
+                         targets=targets)
+    for p in packs:
+        lo, hi = t.ranges.get(p.name, (0.0, 0.0))
+        if not lo <= 0.0 <= hi:
+            bad.append(("range without 0", p, lo, hi))
+        if t.roles[p.name] == modetrade.CHARGE and (
+                p.mode == packmode.SOLAR_FIRST
+                or p.soc >= (95.0 if p.mode == packmode.CHEAP_HOURS
+                             else min(95.0, targets[p.name]))):
+            bad.append(("charges past its level", p, targets))
+check(f"decide() with a plan on 5000 random cases: ranges hold 0, nothing "
+      f"charges at or past its level, Solar first never ({len(bad)} bad)",
+      not bad)
+t_ls = modetrade.decide(R0, now_c, [pk(A, packmode.SOLAR_FIRST, 50.0),
+                                    pk(B, packmode.LEFTOVER_SOLAR, 30.0)],
+                        charge_ok=True, sell_ok=True, trade_why=None,
+                        price_now=0.1, headroom_w=3000.0, floor_pct=20.0,
+                        ceiling_pct=95.0, house_w=500.0,
+                        targets={B: 50.0})
+check("a Leftover solar battery below its level charges in the cheap run, "
+      "Solar first rests", t_ls.roles == {A: modetrade.REST,
+                                          B: modetrade.CHARGE})
+e = modetrade.energy([pk(B, packmode.LEFTOVER_SOLAR, 30.0)], 20.0, 95.0,
+                     targets={B: 45.0})
+check("the cheap run is sized by the shortfall (1.5 kWh), not the room to "
+      "95 % (6.5 kWh)", abs(e[0] - 1.5) < 1e-9)
+
+# ============================================================================ #
+print("6. the real controller over a night and a day")
+AIM = rp.PEAK_CAP - 50
+FC_KWH = [None]             # today's forecast in the fake sensor (None: down)
+
+
+async def _sensor(self, e):
+    now = rp_start[0] + timedelta(seconds=self.t)
+    kwh = FC_KWH[0](now) if callable(FC_KWH[0]) else FC_KWH[0]
+    if kwh is None:
+        return {"state": "unavailable", "attributes": {},
+                "last_updated": now.isoformat()}
+    if e.endswith("tomorrow"):
+        return None
+    loc = now.astimezone(L)
+    d0 = loc.replace(hour=0, minute=0, second=0, microsecond=0)
+    wh = {(d0 + timedelta(hours=h)).astimezone(timezone.utc).isoformat():
+          (kwh * 100.0 if 8 <= h < 18 else 0.0) for h in range(24)}
+    left = sum(v for k, v in wh.items()
+               if datetime.fromisoformat(k) >= now) / 1000.0
+    return {"state": f"{left:.3f}",
+            "attributes": {"unit_of_measurement": "kWh", "wh_period": wh},
+            "last_updated": now.isoformat(), "last_reported": now.isoformat()}
+
+
+rp.Hass.state = _sensor
+rp_start = [UTC0]
+FC_OPTS = {"pv_forecast_entity": "sensor.energy_production_today_remaining",
+           "cycle_cost_threshold_eur": 0.20}
+
+
+def seed_profile(c):
+    if c.house_profile is not None:
+        c.house_profile = profile(day_w=600.0, evening=3000.0)
+
+
+def house_flat(w):
+    return [(UTC0.timestamp() - 10, float(w))]
+
+
+def run_day(choice, *, fc, soc0, hours=21.0, start_h=0.75, house_w=800.0,
+            refuse=(), extra=None, patch=seed_profile):
+    FC_KWH[0] = fc
+    start = UTC0 + timedelta(hours=start_h)
+    rp_start[0] = start
+    rows = []
+
+    def cb(c, h, now, pr):
+        sh = dict(c.allocation.shares) if c.allocation is not None and \
+            c.allocation.shares else {}
+        rows.append(dict(
+            now=now, grid=h.grid(), shares=sh,
+            action=getattr(c.arb, "action", None),
+            roles=dict(c.mode_tick.roles) if c.mode_tick else {},
+            soc={u: p.soc for u, p in h.plants.items()},
+            targets=c.plan_targets(), plan=c.day_plan, runs=c.mode_runs))
+    st_, c = rp.run("p3_ls", house_flat(house_w), WPTS, start, 3600 * hours,
+                    check=cb, soc0=soc0, choice=choice, refuse=refuse,
+                    extra=dict(FC_OPTS, **(extra or {})), patch=patch)
+    return rows, st_, c
+
+
+SF_LS = {"a": (True, "solar_first", False), "b": (True, "leftover_solar",
+                                                  False)}
+SF_CH = {"a": (True, "solar_first", False), "b": (True, "cheap_hours",
+                                                  False)}
+
+
+def invariants(tag, rows, c):
+    charge = [r for r in rows if r["action"] == arbitrage.CHARGE]
+    mixed = [r for r in rows if any(v > 0 for v in r["shares"].values())
+             and any(v < 0 for v in r["shares"].values())]
+    check(f"{tag}: no opposite-direction split on any cycle", not mixed)
+    check(f"{tag}: Solar first never charges from the grid (A's share >= 0 "
+          "while the site charges)",
+          all(r["shares"].get(A, 0) >= 0 for r in charge))
+    q = {int(r["now"].timestamp() // 900) for r in charge}
+    banked = [b.offtake_avg_w for b in c.p1.blocks
+              if int(b.start.timestamp() // 900) in q]
+    check(f"{tag}: every banked quarter with a grid charge <= cap - margin "
+          f"(max {max(banked, default=0):.1f} W, aim {AIM})",
+          not banked or max(banked) <= AIM + 0.5)
+    return charge
+
+
+# Sunny: 40 kWh forecast. B (Leftover solar) at 30 % needs nothing.
+rows, st_, c = run_day(SF_LS, fc=40.0, soc0={"a": 60.0, "b": 30.0})
+charge = invariants("sunny", rows, c)
+_last = nth(rows, -1, "a cycle")
+print(f"    sunny: verdict {present(_last) and _last['plan'] and _last['plan'].verdict}, "
+      f"{len(charge)} charge cycles")
+check("sunny: a day plan is made, and says sunny",
+      any(r["plan"] is not None and r["plan"].verdict == dayplan.SUNNY
+          for r in rows))
+check("sunny: no grid charge at all", not charge)
+
+# Dark: 1 kWh. B buys the evening's shortfall only, in the cheap run.
+rows, st_, c = run_day(SF_LS, fc=1.0, soc0={"a": 60.0, "b": 30.0})
+charge = invariants("dark", rows, c)
+tgt = nth([r["targets"][B] for r in rows if r["targets"]], 0, "a level")
+top = max(r["soc"]["b"] for r in rows)
+print(f"    dark: B level {tgt:.1f} %, B reached {top:.1f} %, "
+      f"{len(charge)} charge cycles")
+check("dark: Leftover solar charges from the grid in the cheap run",
+      charge and all(r["runs"].cheap.holds(r["now"]) for r in charge)
+      and all(r["roles"][B] == modetrade.CHARGE for r in charge))
+check("dark: ...only up to its level (the shortfall), not 95 %",
+      present(tgt) and tgt < 60.0 and top <= tgt + 2.0)
+check("dark: A rests while B charges", all(r["roles"][A] == modetrade.REST
+                                           for r in charge))
+
+# Cheap hours on a partly sunny day: ignores the plan, fills as in P3.
+rows, st_, c = run_day(SF_CH, fc=14.0, soc0={"a": 60.0, "b": 30.0})
+charge = invariants("cheap hours, partly", rows, c)
+top = max(r["soc"]["b"] for r in rows)
+print(f"    cheap hours partly: B reached {top:.1f} %")
+check("Cheap hours gets no planned level",
+      not any(r["targets"] and B in r["targets"] for r in rows))
+rows_nf, _s, c_nf = run_day(SF_CH, fc=None, soc0={"a": 60.0, "b": 30.0})
+check("Cheap hours with a sun forecast charges as with none (P3)",
+      charge and abs(max(r["soc"]["b"] for r in rows_nf) - top) < 1.0
+      and top > 80.0)
+
+# The forecast goes away mid-run: Leftover solar stops at once (P3 option A).
+DROP = UTC0 + timedelta(hours=1, minutes=30)
+rows, st_, c = run_day(SF_LS, fc=lambda now: 1.0 if now < DROP else None,
+                       soc0={"a": 60.0, "b": 10.0})
+invariants("forecast lost mid-run", rows, c)
+before = [r for r in rows if r["now"] < DROP and r["action"]
+          == arbitrage.CHARGE]
+late = [r for r in rows if r["now"] > DROP + timedelta(
+    seconds=2 * 60 + 10) and r["action"] == arbitrage.CHARGE]
+check("forecast lost mid-run: Leftover solar was charging, and stops within "
+      "a forecast read (60 s) and a cycle", before and not late)
+
+# The forecast is far too high (40 kWh, and there is no sun at all): no grid
+# charge, so B covers less of the evening - a money risk, never a safety one.
+rows, st_, c = run_day(SF_LS, fc=40.0, soc0={"a": 30.0, "b": 30.0})
+invariants("forecast too high", rows, c)
+check("forecast too high: no grid charge, and B still keeps its power for "
+      "the dear run", not [r for r in rows if r["action"]
+                           == arbitrage.CHARGE]
+      and all(r["roles"].get(B) != modetrade.GIVE for r in rows
+              if r["now"].astimezone(L).hour not in (19,)))
+
+# A refusal wins over the plan.
+rows, st_, c = run_day(SF_LS, fc=1.0, soc0={"a": 60.0, "b": 30.0},
+                       refuse=("b",))
+invariants("refusal", rows, c)
+check("refusal: B refuses to charge, so the plan's charge ends and B is "
+      "never a charger after it", rows and not [
+          r for r in rows[len(rows) // 3:]
+          if r["roles"].get(B) == modetrade.CHARGE])
+
+# Off wins over the plan.
+rows, st_, c = run_day({"a": (True, "solar_first", False),
+                        "b": (False, "leftover_solar", False)},
+                       fc=1.0, soc0={"a": 60.0, "b": 30.0})
+check("Off: an Off battery never charges from the grid, whatever the plan",
+      not [r for r in rows if r["action"] == arbitrage.CHARGE]
+      and all(abs(r["shares"].get(B, 0)) < 1e-6 for r in rows))
+
+# No house profile yet (first day): no plan, P3 option A.
+rows, st_, c = run_day(SF_LS, fc=1.0, soc0={"a": 60.0, "b": 30.0},
+                       patch=None)
+check("no house profile yet: no plan, and Leftover solar takes solar only",
+      all(r["plan"] is None for r in rows)
+      and not [r for r in rows if r["action"] == arbitrage.CHARGE])
+check("...while the profile learns and the store keeps each closed hour",
+      c.house_profile is not None and len(
+          c.store.data.get("house_profile") or {}) >= 1)
+check("selling stays off (option A)", packmode.SELLING_ENABLED is False)
+
+# A forecast arriving mid-period makes the plan at once, not at the next
+# 15-minute period.
+COME = datetime(2026, 9, 21, 1, 3, tzinfo=L).astimezone(timezone.utc)
+rows, st_, c = run_day(SF_LS, fc=lambda now: None if now < COME else 1.0,
+                       soc0={"a": 60.0, "b": 30.0}, hours=0.5)
+first = next((r["now"] for r in rows if r["targets"]), None)
+check("a forecast that arrives at 01:03 makes the plan before 01:15",
+      first is not None and first < COME + timedelta(minutes=3))
+
+# Battery modes off: the forecast is never read.
+READS = [0]
+_real_sensor = rp.Hass.state
+
+
+async def _counted(self, e):
+    READS[0] += 1
+    return await _real_sensor(self, e)
+rp.Hass.state = _counted
+FC_KWH[0] = 1.0
+rp.run("modes_off", house_flat(800.0), WPTS, UTC0 + timedelta(hours=1),
+       600.0, extra=dict(FC_OPTS))
+rp.Hass.state = _real_sensor
+check("battery modes off: the forecast sensor is never read", READS[0] == 0)
+
+# ============================================================================ #
+print("7. the Batteries screen and the Simple view")
+rows, st_, c = run_day(SF_LS, fc=1.0, soc0={"a": 60.0, "b": 30.0},
+                       hours=0.6)
+rp.m.datetime = datetime
+sb = homeview.solar_block(c, c.solar_fc.at)
+check("the forecast line names the forecast, what is counted and when",
+      sb["line"].startswith("Solar still to come today:")
+      and "we count on" in sb["line"] and sb["state"] == "plan")
+why = homeview.day_key(c, B)
+check("B's Why key (plan, dark) is tops_up", why == "tops_up")
+check("...and says so in plain words", homeview.why_words(why)
+      == "Too little sun is forecast, so it charges some from the grid.")
+_d0, _d1 = homeview.local_day(c.solar_fc.at)
+_blocks, _ = homeview.mode_runs(c, _d0, _d1, c.solar_fc.at, False)
+_grid = [b for b in _blocks if b["kind"] == "grid" and b["battery"] == 1]
+_need = homeview.plan_need(c, B)
+check(f"Today: B's grid block is the planned shortfall ({_need:.2f} kWh), "
+      "not its room to 95 %", _grid and abs(_grid[0]["kwh"] - _need) < 0.01
+      and _need < 3.0)
+_run = c.mode_runs.cheap
+_packs = c._mode_packs()
+_m1 = c._run_mark("charge", _run, _packs, lambda p: True, ((B, 40.0),))
+_m2 = c._run_mark("charge", _run, _packs, lambda p: False, ((B, 50.0),))
+check("a level the hysteresis moved opens the run to that battery again",
+      _m1 and not _m2)
+c.solar_fc = None
+check("the levels are dropped as soon as the forecast goes, even before "
+      "the plan is rebuilt", c._plan_targets and c.plan_targets() is None)
+check("a lost forecast says so: no forecast, Leftover solar solar only",
+      homeview.solar_block(c, datetime.now(timezone.utc))["state"]
+      == "no_forecast" and homeview.day_key(c, B) == "no_forecast")
+check("the Why line wins over 'saves its power' only while holding",
+      homeview.battery_why(modes_on=True, mode="leftover_solar", off=False,
+                           reading=True, phase="idle", shadow=False,
+                           running=True, held=False, refused=0, peak=False,
+                           sf_ahead=True, role="hold", has_at=True,
+                           day="sun_fills") == "sun_fills"
+      and homeview.battery_why(modes_on=True, mode="leftover_solar",
+                               off=False, reading=True, phase="idle",
+                               shadow=False, running=True, held=False,
+                               refused=0, peak=False, sf_ahead=True,
+                               role="charge", has_at=True, day="tops_up")
+      == "grid_charge")
+for lang in ("en", "nl"):
+    homeview._LANG[0] = lang
+    t = [homeview.why_words(k) for k in ("sun_fills", "tops_up",
+                                         "no_forecast")]
+    t += [homeview._t("solar.no_forecast"), homeview._t("solar.learning"),
+          homeview.line_solar(9.2, 6.4, "10:15")]
+    check(f"{lang}: every P4 sentence is there and short (<= 2 x 12 words)",
+          all(t) and all(len(s.split()) <= 24 for s in t))
+homeview._LANG[0] = "en"
+from app import uilayout                                        # noqa: E402
+simple = [f.key for _g, _p, f in uilayout.fields() if f.simple]
+check("the Simple view has the solar forecast card",
+      "pv_forecast_entity" in simple)
+
+# ============================================================================ #
+print("8. options")
+BASE_OPTS = {"setpoint_entity": "number.x", "max_w": 2500}
+for v, ok in ((70, True), (30, True), (100, True), (29, False), (101, False),
+              (70.5, False), ("x", False)):
+    probs = validate._forecast_problems(dict(solar_trust_pct=v))
+    check(f"solar_trust_pct {v!r}: {'accepted' if ok else 'refused'}",
+          (not probs) == ok)
+check("a forecast entity that is not a sensor is refused, in plain words",
+      validate._forecast_problems({"pv_forecast_entity": "number.x"})
+      and "must be a sensor" in validate._forecast_problems(
+          {"pv_forecast_entity": "number.x"})[0])
+check("an entity id with a path or odd characters is refused",
+      all(validate._forecast_problems({"pv_forecast_entity": e}) for e in
+          ("sensor.x/../config", "sensor.x?y=1", "sensor.X", "sensor.",
+           " sensor.x", "sensor.a b"))
+      and not validate._forecast_problems(
+          {"pv_forecast_entity": "sensor.energy_production_today_remaining"}))
+check("empty entities are fine", not validate._forecast_problems(
+    {"pv_forecast_entity": "", "pv_forecast_tomorrow_entity": ""}))
+notes = []
+validate._entity_notes(notes, {"pv_forecast_entity": "sensor.f",
+                               "battery_modes_enabled": True},
+                       {"sensor.f": {"unit": "W"}})
+check("a forecast sensor not in kWh gets a warning",
+      any("kWh" in n.text for n in notes))
+notes = []
+validate._entity_notes(notes, {"pv_forecast_entity": "sensor.f"},
+                       {"sensor.f": {"unit": "kWh"}})
+check("a forecast with battery modes off gets a note that it is unused",
+      any("battery modes on" in n.text for n in notes))
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)}")
+    for f in fails:
+        print("  -", f)
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_mqtt.py b/goodwe_controller/test_mqtt.py
index 75da0d1..5e4a5b7 100644
--- a/goodwe_controller/test_mqtt.py
+++ b/goodwe_controller/test_mqtt.py
@@ -42,6 +42,7 @@ part is a diff against it, reported as `N topics, M missing, C changed, A added`
           re-executed from mutated source, each one named with the property it
           breaks. A property nothing breaks is a property nothing is watching.
   Part 9  What these checks CANNOT see, enumerated and sized.
+  Part 10 OPT-11 P2: each battery's select and switch, commands, removal.
 
 ⚠️ THE FIXTURE GIVES A AND B DIFFERENT NAMES, DIFFERENT RATINGS, DIFFERENT SoC,
 DIFFERENT BATTERY POWER AND DIFFERENT LATCH STATES, ON PURPOSE. A fixture whose
@@ -821,8 +822,8 @@ MUTATIONS = [
     ("per-unit entities announced at a roster of ONE",
      [("PER_UNIT_MIN_ROSTER = 2", "PER_UNIT_MIN_ROSTER = 1")]),
     ("the unit is dropped from the unique_id",
-     [('unique_id = f"{BASE}_unit_{slug}_{key}"',
-       'unique_id = f"{BASE}_unit_{key}"')]),
+     [('return f"{BASE}_unit_{slug}_{key}"',
+       'return f"{BASE}_unit_{key}"')]),
     ("the unit is dropped from the state topic",
      [('return f"unit/{slug}/{key}"', 'return f"unit/{key}"')]),
     ("the slug de-collision is removed (rule 9(c) does not cover this)",
@@ -944,6 +945,540 @@ for line in [
 ]:
     print("    " + line)
 
+# ---------------------------------------------------------------------------
+print("\n10. OPT-11 P2: each battery's switch and mode as HA entities")
+# ---------------------------------------------------------------------------
+import logging     # noqa: E402
+import os          # noqa: E402
+import tempfile    # noqa: E402
+
+from app import messages, packmode    # noqa: E402
+from app.store import Store, unit_key  # noqa: E402
+
+
+def announce_p2(units=(), omit=(), include=(), modes=(), retract=(),
+                module=mqtt):
+    """What `_on_connect()` sends: the announcement, then any subscriptions."""
+    pub = module.MqttPublisher.__new__(module.MqttPublisher)
+    pub.omit, pub.units, pub.include = set(omit), [str(u) for u in units], \
+        [str(k) for k in include]
+    pub.modes, pub.retract = tuple(modes), list(retract)
+    pub.enabled, pub.client = True, FakeClient()
+    subs = []
+    pub.client.subscribe = lambda topic, *a: subs.append(topic)
+    pub._on_connect()
+    return pub.client.msgs, subs
+
+
+# --- 10a. modes off: byte-identical to ed739d4 --------------------------------
+# The digest below is GENERATED from release/1.0 at ed739d4 (the base of this
+# PR): the same matrix run through that commit's `_announce()`. Reproduce with
+# `git show ed739d4:goodwe_controller/app/mqtt.py` and this loop.
+ROSTERS = [[], ["inverter-a"], ["inverter-a", "inverter-b"], ["a", "b", "c"],
+           ["inverter-b", "Inverter B", "x", "y"], ["café"]]
+ED739D4_OFF = "501a7d93782a260b"
+_h, _n, _subs_off = hashlib.sha256(), 0, []
+for _r in ROSTERS:
+    for _om in [(), ("p1_age",), ("p1_age", "grid")]:
+        for _inc in [(), ("pv",)]:
+            _m, _s = announce_p2(_r, _om, _inc)
+            _h.update(repr(_m).encode())
+            _subs_off += _s
+            _n += 1
+print(f"    modes off, {_n} configurations: digest {_h.hexdigest()[:16]} "
+      f"(ed739d4: {ED739D4_OFF})")
+check("modes off: every configuration announces byte-for-byte what ed739d4 "
+      "announces, in the same order, and subscribes to nothing",
+      _h.hexdigest()[:16] == ED739D4_OFF and not _subs_off)
+
+
+# --- 10b. modes on: the ordered payload diff ----------------------------------
+MODES = packmode.MODES
+ON1, SUB1 = announce_p2(["inverter-a"], modes=MODES)
+m, c, a = report("roster of one, modes on", ON1)
+# P2 announced the first two; OPT-11 P3 appended "Cheap hours only".
+_opt = '["Solar first", "Leftover solar", "Cheap hours only"]'
+MODE_N1 = [
+    ("homeassistant/select/goodwe_ctl_unit_inverter_a_mode/config",
+     '{"name": "Inverter A Mode", "object_id": "goodwe_inverter_a_mode", '
+     '"unique_id": "goodwe_ctl_unit_inverter_a_mode", '
+     '"state_topic": "goodwe_ctl/unit/inverter_a/mode", '
+     '"command_topic": "goodwe_ctl/unit/inverter_a/mode/set", '
+     '"options": ' + _opt + ', "retain": false, '
+     '"availability_topic": "goodwe_ctl/availability", "device": ' + _DEV + ', '
+     '"icon": "mdi:battery-sync"}', True),
+    ("homeassistant/switch/goodwe_ctl_unit_inverter_a_use/config",
+     '{"name": "Inverter A Use", "object_id": "goodwe_inverter_a_use", '
+     '"unique_id": "goodwe_ctl_unit_inverter_a_use", '
+     '"state_topic": "goodwe_ctl/unit/inverter_a/use", '
+     '"command_topic": "goodwe_ctl/unit/inverter_a/use/set", '
+     '"payload_on": "ON", "payload_off": "OFF", "retain": false, '
+     '"availability_topic": "goodwe_ctl/availability", "device": ' + _DEV + ', '
+     '"icon": "mdi:power"}', True),
+]
+check("modes on at a roster of one: every existing message byte-identical and "
+      "in place, then exactly the select and the switch, then availability",
+      ON1 == SITE_NOW[:-1] + MODE_N1 + SITE_NOW[-1:])
+check("...and it subscribes to the two command topics, and nothing else",
+      SUB1 == ["goodwe_ctl/unit/+/mode/set", "goodwe_ctl/unit/+/use/set"])
+
+ON2, _ = announce_p2(NAMES2, modes=MODES)
+m, c, a = report("roster of two, modes on", ON2, TWO)
+check("modes on at a roster of two: nothing missing or changed, four added, "
+      "and the modes-off list is an unchanged prefix",
+      (m, c) == ([], []) and len(a) == 4 and ON2[:len(TWO) - 1] == TWO[:-1]
+      and ON2[-1] == TWO[-1])
+_mc = cfgs(ON2)[-4:]
+check("...A's two stay on the site device with its name in front; B's two are "
+      "on B's own device, as TEL-07's rule has it",
+      [c_["name"] for c_ in _mc] == ["Inverter A Mode", "Inverter A Use",
+                                      "Mode", "Use"]
+      and _mc[0]["device"] == mqtt.DEVICE == _mc[1]["device"]
+      and _mc[2]["device"] == _mc[3]["device"]
+      == mqtt.unit_device("inverter-b", "inverter_b"))
+check("...unique_ids are stable per battery and distinct from every other id",
+      [c_["unique_id"] for c_ in _mc]
+      == ["goodwe_ctl_unit_inverter_a_mode", "goodwe_ctl_unit_inverter_a_use",
+          "goodwe_ctl_unit_inverter_b_mode", "goodwe_ctl_unit_inverter_b_use"]
+      and len({c_["unique_id"] for c_ in cfgs(ON2)}) == len(cfgs(ON2)))
+_ids = [compose(c_["device"]["name"], c_["name"]).split(".", 1)[1]
+        for c_ in _mc]
+print(f"    composed ids: {_ids}")
+check("...and HA composes the ids the design names: "
+      "goodwe_inverter_<x>_mode and goodwe_inverter_<x>_use",
+      _ids == ["goodwe_inverter_a_mode", "goodwe_inverter_a_use",
+               "goodwe_inverter_b_mode", "goodwe_inverter_b_use"])
+check("every mode has a plain label, in MODES order, and a later mode only "
+      "appends an option: no existing option or id changes",
+      all(k in mqtt.MODE_LABELS for k in MODES)
+      and len(set(mqtt.MODE_LABELS.values())) == len(mqtt.MODE_LABELS)
+      and json.loads(MODE_N1[0][1])["options"]
+      == [mqtt.MODE_LABELS[k] for k in MODES])
+# Review of #152: the HA options are what automations send, so they are kept
+# apart from the page's words on purpose. They start equal; if the page's
+# English changes, this goes red and the author decides: keep the HA option
+# (and change this pin) or rename it (a breaking change, in DECISIONS).
+_en = json.loads((HERE / "app" / "ui_text" / "en.json").read_text())
+check("each HA mode option is the page's English name for that mode, in "
+      "both places the page names it",
+      all(mqtt.MODE_LABELS[k] == _en["home_words"]["modes"][k]
+          == _en["home"]["batteries"]["choice"][k]["name"] for k in MODES))
+# OPT-11 P3 added `cheap_hours`: against P2's two modes (7a00f12), only the
+# options list changes, by one entry at its end; no topic, id or label moves.
+_p3 = mqtt.mode_payloads(NAMES2, MODES)
+_orig = mqtt.MODE_LABELS
+mqtt.MODE_LABELS = {k: v for k, v in _orig.items() if k != "cheap_hours"}
+try:
+    _p2 = mqtt.mode_payloads(NAMES2, MODES[:2])
+finally:
+    mqtt.MODE_LABELS = _orig
+check("...P3 appended `cheap_hours`: against P2's list only the options "
+      "change, by one entry at the end, and P2's two labels are unchanged",
+      MODES[:2] == ("solar_first", "leftover_solar")
+      and _p2[0][1]["options"] == ["Solar first", "Leftover solar"] and
+      [t for t, _ in _p3] == [t for t, _ in _p2]
+      and all({k: v for k, v in x.items() if k != "options"}
+              == {k: v for k, v in y.items() if k != "options"}
+              for (_, x), (_, y) in zip(_p3, _p2))
+      and _p3[0][1]["options"] == _p2[0][1]["options"] + ["Cheap hours only"])
+
+
+# --- 10c. modes turned off: removal ------------------------------------------
+_cur2 = [t for t, _ in mqtt.mode_payloads(NAMES2, MODES)]
+_ret = mqtt.mode_retractions(_cur2, [])
+OFF2, _subs = announce_p2(NAMES2, retract=_ret)
+check("modes turned off: the modes-off list, then an EMPTY retained config "
+      "for each of the four, then availability, and no subscription",
+      OFF2 == TWO[:-1] + [(t, "", True) for t in _cur2] + TWO[-1:]
+      and not _subs)
+check("...the store keeps what was announced, so a roster that shrinks removes "
+      "only the battery that left",
+      mqtt.mode_retractions(_cur2, [t for t, _ in
+                                    mqtt.mode_payloads(["inverter-a"], MODES)])
+      == _cur2[2:])
+check("...and nothing from the store is removed that is not one of our mode "
+      "configs: a non-list, a number, a site sensor, another add-on's select",
+      mqtt.mode_retractions("homeassistant/select/x/config", []) == []
+      and mqtt.mode_retractions(
+          [3, None, "homeassistant/sensor/goodwe_ctl_grid/config",
+           "homeassistant/select/other_mode/config",
+           "homeassistant/select/goodwe_ctl_unit_a_mode/config/x",
+           "homeassistant/select/goodwe_ctl_unit_a_mode/config"], [])
+      == ["homeassistant/select/goodwe_ctl_unit_a_mode/config"])
+
+
+_on1 = [t for t, _ in mqtt.mode_payloads(["inverter-a"], MODES)]
+_k, _r = mqtt.mode_configs(["inverter-a"], MODES, _cur2)
+check("start-up (`mode_configs`): a battery that left is removed, and stays "
+      "in the store, so a start with no broker does not forget it",
+      _r == _cur2[2:] and _k == _on1 + _cur2[2:])
+_k, _r = mqtt.mode_configs(NAMES2, (), _cur2 + _cur2[:1])
+check("...modes turned off: all four are removed, once each, and kept",
+      _r == _cur2 and _k == _cur2)
+check("...never turned on: nothing to store and nothing to remove, so the "
+      "store is not written",
+      mqtt.mode_configs(NAMES2, (), None) == ([], []))
+_k, _r = mqtt.mode_configs(NAMES2, MODES, _cur2)
+check("...turned on again: nothing removed, and the list does not grow",
+      _r == [] and _k == _cur2)
+
+
+from app.main import mode_announcement  # noqa: E402
+_st = Store(os.path.join(tempfile.mkdtemp(), "ann.json"))
+_OPTS1M = dict(OPTS2, battery_modes_enabled=True,
+               inverters=OPTS2["inverters"][:1])
+_seen = [mode_announcement(dict(OPTS2), _st),
+         dict(_st.data)]
+_seen += [mode_announcement(dict(OPTS2, battery_modes_enabled=True), _st),
+          list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])]
+_seen += [mode_announcement(_OPTS1M, _st),
+          list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])]
+_seen += [mode_announcement(dict(OPTS2, battery_modes_enabled=False), _st),
+          list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])]
+check("main's start-up, through a real Store: never on announces and stores "
+      "nothing; on stores the four; a roster of one removes B's two and keeps "
+      "them; off removes all four and the store keeps them",
+      _seen[0] == ((), []) and mqtt.MODE_CONFIGS_KEY not in _seen[1]
+      and _seen[2] == (MODES, []) and _seen[3] == _cur2
+      and _seen[4] == (MODES, _cur2[2:]) and sorted(_seen[5]) == sorted(_cur2)
+      and _seen[6] == ((), _seen[5])
+      and sorted(_seen[7]) == sorted(_cur2))
+_st = Store(os.path.join(tempfile.mkdtemp(), "ren.json"))
+mode_announcement(dict(OPTS2, battery_modes_enabled=True), _st)
+_ren = dict(OPTS2, battery_modes_enabled=True, inverters=[
+    OPTS2["inverters"][0], dict(OPTS2["inverters"][1], name="inverter-c")])
+_r = mode_announcement(_ren, _st)[1]
+_kept = list(_st.data.get(mqtt.MODE_CONFIGS_KEY) or [])
+check("...B renamed C while on: B's two are removed and stay stored beside "
+      "A's and C's, so a start with no broker does not forget them",
+      _r == _cur2[2:] and _kept[-2:] == _cur2[2:] and len(_kept) == 6
+      and mode_announcement(_ren, _st)[1] == _cur2[2:])
+check("battery modes are on only for exactly `true`: not \"true\", 1 or "
+      "\"false\"",
+      [packmode.enabled({"battery_modes_enabled": v})
+       for v in (True, "true", 1, "false", None)]
+      == [True, False, False, False, False])
+
+
+# --- 10d. state topics, from the store ----------------------------------------
+_tmp = tempfile.mkdtemp()
+OPTS2M = dict(OPTS2, battery_modes_enabled=True)
+
+
+def ctl_for(opts, path):
+    pub = _Pub()
+    pub.sent = []
+    pub.publish = lambda values, _p=pub: (_p.sent.append(dict(values)),
+                                          setattr(_p, "last", dict(values)))
+    return Controller(dict(opts), None, Store(path), pub,
+                      stop=asyncio.Event()), pub
+
+
+_path = os.path.join(_tmp, "state.json")
+ctlm, pubm = ctl_for(OPTS2M, _path)
+ctlm.publish()
+_fed = {f"{mqtt.BASE}/{k}" for k in pubm.last
+        if k.endswith("/mode") or k.endswith("/use")}
+check("every announced mode entity is fed, and nothing else is: the state "
+      "topics published are exactly the ones announced",
+      _fed == {c_["state_topic"] for c_ in _mc})
+check("...defaults with nothing in the store: both On, both Solar first",
+      [pubm.last[k] for k in ("unit/inverter_a/mode", "unit/inverter_a/use",
+                              "unit/inverter_b/mode", "unit/inverter_b/use")]
+      == ["Solar first", "ON", "Solar first", "ON"])
+_c_off, _p_off = ctl_for(dict(OPTS2, battery_modes_enabled=False),
+                         os.path.join(_tmp, "off2.json"))
+_c_off.publish()
+_c_abs, _p_abs = ctl_for(OPTS2, os.path.join(_tmp, "off3.json"))
+_c_abs.publish()
+check("modes off (false or absent): the controller publishes the same keys as "
+      "before, with no mode or switch topic",
+      set(_p_off.last) == set(_p_abs.last) == set(vals2)
+      and not [k for k in _p_off.last if k.endswith(("/mode", "/use"))])
+
+
+# --- 10e. commands: the /action path, validated -------------------------------
+class _Logs(logging.Handler):
+    def __init__(self):
+        super().__init__(logging.DEBUG)
+        self.rows = []
+
+    def emit(self, record):
+        self.rows.append((record.levelno, record.getMessage()))
+
+
+_logs = _Logs()
+logging.getLogger("goodwe").addHandler(_logs)
+logging.getLogger("goodwe").setLevel(logging.DEBUG)
+_calls = []
+_real_handle = ctlm.handle_action
+
+
+async def _spy(what, **kw):
+    _calls.append((what, kw))
+    return await _real_handle(what, **kw)
+
+
+ctlm.handle_action = _spy
+
+
+def cmd(topic, payload, retained=False, ctl=None):
+    ctl = ctl or ctlm
+    asyncio.run(ctl.mqtt_command(topic, payload, retained))
+
+
+def stored(ctl=None):
+    d = (ctl or ctlm).store.data
+    return {k: d.get(k) for k in (unit_key("inverter-a", "pack_use"),
+                                  unit_key("inverter-a", "pack_mode"),
+                                  unit_key("inverter-b", "pack_use"),
+                                  unit_key("inverter-b", "pack_mode"))}
+
+
+T_A = "goodwe_ctl/unit/inverter_a"
+T_B = "goodwe_ctl/unit/inverter_b"
+pubm.sent.clear()
+cmd(f"{T_B}/use/set", b"OFF")
+cmd(f"{T_A}/mode/set", b"Leftover solar")
+check("good commands go through handle_action() with the /action arguments",
+      _calls == [("pack_use", {"unit": "inverter-b", "value": False}),
+                 ("pack_mode", {"unit": "inverter-a",
+                                "value": "leftover_solar"})])
+check("...and reach the store under P1's keys, and nowhere else",
+      stored() == {unit_key("inverter-a", "pack_use"): None,
+                   unit_key("inverter-a", "pack_mode"): "leftover_solar",
+                   unit_key("inverter-b", "pack_use"): False,
+                   unit_key("inverter-b", "pack_mode"): None})
+check("...and the state topics say so at once, from the store",
+      pubm.sent and pubm.sent[-1] == {
+          "unit/inverter_a/mode": "Leftover solar", "unit/inverter_a/use": "ON",
+          "unit/inverter_b/mode": "Solar first", "unit/inverter_b/use": "OFF"})
+check("...and the action log records each change",
+      any("inverter-b switched off" in e for e in ctlm.events)
+      and any("inverter-a mode set to leftover solar" in e
+              for e in ctlm.events))
+
+_before = stored()
+_n_calls = len(_calls)
+BAD = [
+    (f"{T_A}/use/set", b"on"), (f"{T_A}/use/set", b"ON\n"),
+    (f"{T_A}/use/set", b"true"), (f"{T_A}/use/set", b"1"),
+    (f"{T_A}/use/set", b""),
+    (f"{T_A}/mode/set", b"solar_first"),          # a key, not the option
+    (f"{T_A}/mode/set", b"Sell only"),            # not an offered mode
+    (f"{T_A}/mode/set", b"solar first"),
+    (f"{T_A}/mode/set", "Sοlar first".encode()),  # Greek omicron
+    (f"{T_A}/mode/set", b"Solar first\x00"),
+    (f"{T_A}/mode/set", b'{"action": "pack_use", "value": false}'),
+    (f"{T_A}/mode/set", b"Solar first; rm -rf /"),
+    (f"{T_A}/mode/set", b"' OR 1=1 --"),
+    (f"{T_A}/use/set", b"\xff\xfe"),              # not UTF-8
+    (f"{T_A}/mode/set", b"Solar first" * 10),     # too long
+    ("goodwe_ctl/unit/inverter_z/use/set", b"OFF"),   # no such battery
+    ("goodwe_ctl/unit/../use/set", b"OFF"),
+    ("goodwe_ctl/unit/inverter_a/soc/set", b"OFF"),
+    ("goodwe_ctl/unit/inverter_a/use/set/x", b"OFF"),
+    ("goodwe_ctl/unit/Inverter_A/use/set", b"OFF"),
+    (f"{T_A}/use/set", None),
+]
+for _t, _p in BAD:
+    cmd(_t, _p)
+check(f"all {len(BAD)} bad commands are refused: the store is unchanged",
+      stored() == _before)
+_passed = [c_ for c_ in _calls[_n_calls:]]
+check("...those that reach handle_action() carry a value /action also refuses "
+      "(None) or no known battery; nothing is coerced into a valid choice",
+      all(kw["value"] is None or kw["unit"] is None for _, kw in _passed))
+
+# Log once per topic and reason.
+_logs.rows.clear()
+for _ in range(5):
+    cmd(f"{T_B}/use/set", b"maybe")
+_warn = [r for r in _logs.rows if r[0] >= logging.WARNING]
+check("a refused command repeated 5 times is logged once at WARNING, in plain "
+      "words, and at DEBUG the other times",
+      len(_warn) == 1 and messages.pack_refused("value") in _warn[0][1]
+      and len([r for r in _logs.rows if r[0] == logging.DEBUG]) == 5)
+_logs.rows.clear()
+_flood, _ = ctl_for(OPTS2M, os.path.join(_tmp, "flood.json"))
+for _i in range(100):
+    cmd(f"goodwe_ctl/unit/x{_i}/use/set", b"OFF", ctl=_flood)
+_w = [r[1] for r in _logs.rows if r[0] >= logging.WARNING]
+_per = [w for w in _w if "still ignored" not in w]
+_more = [w for w in _w if "still ignored" in w]
+print(f"    flood: {len(_per)} per-topic WARNINGs, then {_more}")
+check("...and a flood of 100 different bad topics logs 32 WARNINGs, then the "
+      "rest only as a count, at 1 and 10 more (review of #152)",
+      len(_per) == 32 and len(_more) == 2
+      and "1 more so far" in _more[0] and "10 more so far" in _more[1])
+_logs.rows.clear()
+for _ in range(100):
+    cmd(f"{T_B}/use/set", b"maybe", ctl=_flood)
+_more = [r[1] for r in _logs.rows
+         if r[0] >= logging.WARNING and "still ignored" in r[1]]
+check("...so a repeated attack on ONE topic still shows it goes on: the count "
+      "reaches 100 in 3 lines, not 100",
+      len(_more) == 1 and "100 more so far" in _more[0])
+_logs.rows.clear()
+_inj, _ = ctl_for(OPTS2M, os.path.join(_tmp, "inj.json"))
+cmd("goodwe_ctl/unit/a\nERROR forged line\x1b[31m/use/set", b"OFF", ctl=_inj)
+_w = [r[1] for r in _logs.rows if r[0] >= logging.WARNING]
+check("...and a topic with a newline or an escape code cannot forge a log "
+      "line: it is logged printable only",
+      len(_w) == 1 and "\n" not in _w[0] and "\x1b" not in _w[0]
+      and "a?ERROR forged line?[31m" in _w[0])
+
+# Modes off: refused on the same path, even if a message arrives.
+cmd(f"{T_A}/use/set", b"OFF", ctl=_c_off)
+check("with modes off a command is refused by the same check /action makes",
+      stored(_c_off)[unit_key("inverter-a", "pack_use")] is None)
+
+
+# --- 10f. a retained command after a restart ----------------------------------
+_logs.rows.clear()
+_before = stored()
+_n_calls = len(_calls)
+cmd(f"{T_A}/use/set", b"OFF", retained=True)
+cmd(f"{T_B}/use/set", b"ON", retained=True)
+check("a RETAINED command (the broker replays it on subscribe, e.g. after a "
+      "restart) is never applied, and never reaches handle_action()",
+      stored() == _before and len(_calls) == _n_calls)
+check("...and it is logged once, in plain words",
+      any(messages.pack_refused("retained") in r[1]
+          for r in _logs.rows if r[0] >= logging.WARNING))
+ctl_r, pub_r = ctl_for(OPTS2M, _path)      # a restart: same state file
+ctl_r.publish()
+check("after a restart the state topics come from the store: A Leftover solar "
+      "and on, B off",
+      [pub_r.last[k] for k in ("unit/inverter_a/mode", "unit/inverter_a/use",
+                               "unit/inverter_b/use")]
+      == ["Leftover solar", "ON", "OFF"])
+logging.getLogger("goodwe").removeHandler(_logs)
+
+
+# --- 10g. the paho side ----------------------------------------------------------
+class _Msg:
+    def __init__(self, topic, payload, retain):
+        self.topic, self.payload, self.retain = topic, payload, retain
+
+
+_got = []
+
+
+async def _handler(*args):
+    _got.append(args)
+
+
+async def _drive():
+    pub = mqtt.MqttPublisher.__new__(mqtt.MqttPublisher)
+    pub._on_message(None, None, _Msg("t", b"x", 0))      # not bound: dropped
+    pub.bind(asyncio.get_running_loop(), _handler)
+    pub._on_message(None, None, _Msg(f"{T_A}/use/set", b"OFF", 1))
+    await asyncio.sleep(0.05)
+
+asyncio.run(_drive())
+check("paho's thread hands (topic, bytes, retained) to the controller's loop, "
+      "and drops a message that arrives before the controller exists",
+      _got == [(f"{T_A}/use/set", b"OFF", True)])
+
+_kws = {k.arg: ast.unparse(k.value) for c_ in _call for k in c_.keywords}
+_main_src = (HERE / "app" / "main.py").read_text()
+check("(source read) main() passes modes and retractions to the publisher, "
+      "and binds its commands to the controller",
+      _kws.get("modes") == "_modes" and _kws.get("retract") == "_retract"
+      and "pub.bind(asyncio.get_running_loop(), controller.mqtt_command)"
+      in _main_src
+      and "_modes, _retract = mode_announcement(opts, store)" in _main_src)
+
+
+# --- 10h. the guards, broken one at a time --------------------------------------
+def p2_properties(mod):
+    out = {}
+    try:
+        off, s_off = announce_p2(NAMES2, module=mod)
+        on1, s_on = announce_p2(["inverter-a"], modes=MODES, module=mod)
+        on2, _ = announce_p2(NAMES2, modes=MODES, module=mod)
+        out["off identical"] = off == TWO and not s_off
+        out["on payloads"] = on1 == ON1 and on2 == ON2
+        out["subscribes when on"] = s_on == SUB1
+        cur = [t for t, _ in mod.mode_payloads(NAMES2, MODES)]
+        out["retract filters store"] = mod.mode_retractions(
+            [3, "homeassistant/sensor/goodwe_ctl_grid/config",
+             "homeassistant/select/other/config"] + cur, cur) == []
+        out["retract keeps current"] = mod.mode_retractions(cur, cur) == []
+        out["retract published"] = announce_p2(
+            NAMES2, retract=cur[:1], module=mod)[0] == \
+            TWO[:-1] + [(cur[0], "", True)] + TWO[-1:]
+        pc = mod.parse_command
+        out["retained dropped"] = pc(f"{T_A}/use/set", b"OFF", True,
+                                     MODES)[3] == "retained"
+        out["size capped"] = pc(f"{T_A}/mode/set", b"Solar first" * 10,
+                                False, MODES)[3] == "size"
+        out["utf-8 only"] = pc(f"{T_A}/use/set", b"\xff", False,
+                               MODES)[3] == "encoding"
+        out["switch exact"] = (
+            pc(f"{T_A}/use/set", b"on", False, MODES)[2] is None
+            and pc(f"{T_A}/use/set", b"OFF", False, MODES)[2] is False)
+        out["select labels only"] = (
+            pc(f"{T_A}/mode/set", b"solar_first", False, MODES)[2] is None
+            and pc(f"{T_A}/mode/set", b"Leftover solar", False,
+                   MODES)[2] == "leftover_solar")
+        out["select offered only"] = pc(
+            f"{T_A}/mode/set", b"Solar first", False, ("leftover_solar",))[2] \
+            is None
+        out["topic exact"] = all(
+            pc(t, b"OFF", False, MODES)[3] == "topic"
+            for t in ("goodwe_ctl/unit/../use/set", "goodwe_ctl/unit/a/b/use/set",
+                      "goodwe_ctl/unit/a/use/set/x", "x/goodwe_ctl/unit/a/use/set"))
+    except Exception as err:  # noqa: BLE001
+        out["did not raise"] = False
+        out["__error__"] = repr(err)[:70]
+    return out
+
+
+P2_SHIPPED = p2_properties(mqtt)
+check("the shipped module has every P2 property (so a red below is the "
+      "mutation)", all(v is True for v in P2_SHIPPED.values()))
+P2_MUTATIONS = [
+    ("mode entities announced with modes off",
+     [("    if not modes:\n        return []\n", "    modes = modes or ('solar_first', 'leftover_solar')\n")]),
+    ("subscribed with modes off", [("        if self.modes:\n", "        if True:\n")]),
+    ("retained commands applied", [("    if retained:\n", "    if False:\n")]),
+    ("no payload size cap", [("or len(payload) > MAX_COMMAND_BYTES", "or False")]),
+    ("bad UTF-8 replaced, not refused",
+     [('.decode("utf-8")', '.decode("utf-8", "replace")')]),
+    ("switch payload case-folded",
+     [("{USE_ON: True, USE_OFF: False}.get(text)",
+       "{USE_ON: True, USE_OFF: False}.get(text.upper())")]),
+    ("select accepts mode keys too",
+     [("if MODE_LABELS.get(k) == text", "if text in (k, MODE_LABELS.get(k))")]),
+    ("select accepts any labelled mode, offered or not",
+     [("(k for k in modes if MODE_LABELS.get(k) == text)",
+       "(k for k in MODE_LABELS if MODE_LABELS.get(k) == text)")]),
+    ("command topic loosened", [('/([a-z0-9_]+)/(mode|use)/set")', '/(.+)/(mode|use)/set")')]),
+    ("command topic matched as a prefix",
+     [("_COMMAND_RE.fullmatch(topic)", "_COMMAND_RE.search(topic)")]),
+    ("store list not filtered",
+     [("and _MODE_CONFIG_RE.fullmatch(t)\n", "and True\n")]),
+    ("current configs also removed", [("and t not in keep))", "))")]),
+    ("commands published retained by HA", [('cfg["retain"] = False', 'cfg["retain"] = True')]),
+    ("retractions not published",
+     [('            self.client.publish(topic, "", retain=True)\n', "            pass\n")]),
+]
+_p2_surv = []
+for label, pairs in P2_MUTATIONS:
+    got = properties(load(pairs))
+    got.update(p2_properties(load(pairs)))
+    broke = sorted(k for k, v in {**SHIPPED, **P2_SHIPPED}.items()
+                   if v is True and got.get(k) is not True)
+    print(f"    {'RED ' if broke else 'GREEN'} {label}"
+          + (f"  (breaks: {', '.join(broke)})" if broke else ""))
+    if not broke:
+        _p2_surv.append(label)
+check(f"all {len(P2_MUTATIONS)} P2 mutations of app/mqtt.py are red",
+      not _p2_surv)
+
+
 # ---------------------------------------------------------------------------
 print()
 if fails:
diff --git a/goodwe_controller/test_named_absence.py b/goodwe_controller/test_named_absence.py
new file mode 100644
index 0000000..416fee8
--- /dev/null
+++ b/goodwe_controller/test_named_absence.py
@@ -0,0 +1,426 @@
+"""Runnable check for TEST-26 - a missing value must be a NAMED red. `python3 test_named_absence.py`
+
+Every test file here is one script. A check or print that RAISES on a missing
+value (an empty list indexed, `next()` exhausted, `:.0f` on None) kills every
+check after it: the mutation it should name shows up as one unnamed traceback,
+and the checks below it are never graded (MUTATION.md, FCST-06).
+
+1. `named_absence.py`, the shared non-raising accessors.
+2. A scan of every `test_*.py` for the shapes that raise, which must find none.
+3. What the scan cannot see, counted on every run.
+"""
+import ast
+import sys
+from collections import Counter
+from pathlib import Path
+
+from named_absence import field, first, given, nth, present
+
+HERE = Path(__file__).resolve().parent
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+# ==============================================================================
+print("1. the accessors never raise, and an absence is never a pass")
+# ==============================================================================
+_a = nth([], 0)
+_b = first(x for x in (1, 2) if x > 5)
+_c = field({"a": 1}, "pv")
+_d = given(None)
+print(f"    {_a!r} {_b!r} {_c!r} {_d!r}")
+check("each accessor hands back the value when it is there",
+      nth([7, 8], -1) == 8 and first(iter([3])) == 3
+      and field({"pv": 0.0}, "pv") == 0.0 and given(0.0) == 0.0
+      and present(0.0, None, "", []))
+check("...and a stand-in that says what was missing when it is not",
+      repr(_a) == "<ABSENT [0] of 0 item(s)>" and repr(_c) == "<ABSENT key 'pv'>"
+      and not present(_a) and not present(1, _b) and not present(_c, _d))
+check("formatting, indexing, attributes and arithmetic do not raise",
+      f"{_a:.2f}|{_a[2]['x']:+.0f}|{_d.attr.get('k'):,}|{_d / 2 - 1:.1f}"
+      == "|".join(["<ABSENT [0] of 0 item(s)>"] * 2 + ["<ABSENT None>"] * 2))
+check("an absence is never equal, unequal, ordered or truthy - so `==`, `!=` "
+      "and `<` grade it FAIL",
+      not (_a == 0) and not (_a != 0) and not (_a < 1) and not (_a >= 1)
+      and not bool(_a) and not (_a == _a))
+
+
+# ==============================================================================
+print()
+print("2. no test file reads a possibly-missing value in a way that raises")
+# ==============================================================================
+# The scan flags, anywhere in a file:
+#   index   `name[k]` (constant k) where `name` holds a FILTERED list - a
+#           comprehension with an `if`, `filter()`, or an accumulator started
+#           as `[]` - directly or as returned by a function in the same file;
+#   next    `next(it)` without a default;
+#   format  a numeric format spec on a name that may be None - assigned None,
+#           an `... else None`, a one-argument `.get()`, or tested `is None`.
+# A site is guarded when an earlier operand of the same `and`/`or`, or the
+# test of an enclosing `if`/`while`/conditional expression, names the value,
+# or it sits in a `try`. A check's NAME is evaluated before its condition, so
+# a guard in the condition does not guard the name.
+_NUMFMT = set("fdeEgGn%xXbo")
+_FUNCS = (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)
+_COMPS = (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)
+
+
+def _filtered(rhs, returns):
+    if isinstance(rhs, (ast.ListComp, ast.GeneratorExp)):
+        return any(g.ifs for g in rhs.generators)
+    if isinstance(rhs, ast.List):
+        return not rhs.elts
+    if isinstance(rhs, ast.Call) and isinstance(rhs.func, ast.Name):
+        f = rhs.func.id
+        if f == "filter":
+            return True
+        if f in ("list", "sorted", "tuple") and rhs.args:
+            return _filtered(rhs.args[0], returns)
+        return "listy" in returns.get((f, None), ())
+    return False
+
+
+def _maybe_none(rhs, returns):
+    if isinstance(rhs, ast.Constant):
+        return rhs.value is None
+    if isinstance(rhs, ast.IfExp):
+        return _maybe_none(rhs.body, returns) or _maybe_none(rhs.orelse, returns)
+    if isinstance(rhs, ast.Call):
+        if isinstance(rhs.func, ast.Attribute) and rhs.func.attr == "get":
+            return len(rhs.args) == 1 or (len(rhs.args) == 2 and _maybe_none(rhs.args[1], returns))
+        if isinstance(rhs.func, ast.Name):
+            return "noney" in returns.get((rhs.func.id, None), ())
+    return False
+
+
+class _Scope:
+    def __init__(self, node, parent):
+        self.node, self.parent = node, parent
+        self.bound, self.listy, self.noney = set(), set(), set()
+
+
+def _dump(n):
+    return ast.dump(n)
+
+
+def _mentions(expr, base):
+    """`base` appears in `expr` other than as the thing being indexed, so
+    `x[0] == 1 and x[1]` does not count as guarding `x[1]`."""
+    b = _dump(base)
+    inner = {id(n.value) for n in ast.walk(expr) if isinstance(n, ast.Subscript)}
+    return any(_dump(x) == b and id(x) not in inner for x in ast.walk(expr))
+
+
+def _exits_on(st, base):
+    """`if not x: return` (or continue/break/raise) - x is guarded below it."""
+    return (isinstance(st, ast.If) and _mentions(st.test, base) and st.body
+            and isinstance(st.body[-1], (ast.Return, ast.Continue, ast.Break, ast.Raise)))
+
+
+def scan(src, census=None):
+    """[(line, kind, text)] for every unguarded raising read in `src`."""
+    tree = ast.parse(src)
+    parent = {c: p for p in ast.walk(tree) for c in ast.iter_child_nodes(p)}
+
+    def scope_node(n):
+        p = parent.get(n)
+        while p is not None and not isinstance(p, _FUNCS + _COMPS + (ast.Module,)):
+            p = parent.get(p)
+        return p
+
+    scopes = {tree: _Scope(tree, None)}
+    for n in ast.walk(tree):
+        if isinstance(n, _FUNCS + _COMPS):
+            scopes[n] = None
+    for n in list(scopes):
+        if n is not tree:
+            scopes[n] = _Scope(n, None)
+    for n, s in scopes.items():
+        if n is not tree:
+            s.parent = scopes[scope_node(n)]
+
+    def targets(t):
+        if isinstance(t, ast.Name):
+            yield t
+        elif isinstance(t, (ast.Tuple, ast.List)):
+            for e in t.elts:
+                yield from targets(e)
+        elif isinstance(t, ast.Starred):
+            yield from targets(t.value)
+
+    for n in ast.walk(tree):
+        if isinstance(n, _FUNCS):
+            a = n.args
+            for arg in a.posonlyargs + a.args + a.kwonlyargs + [a.vararg, a.kwarg]:
+                if arg is not None:
+                    scopes[n].bound.add(arg.arg)
+        elif isinstance(n, ast.comprehension):
+            for t in targets(n.target):
+                scopes[scope_node(n)].bound.add(t.id)
+        elif isinstance(n, (ast.For, ast.AsyncFor, ast.With, ast.AugAssign, ast.NamedExpr)):
+            ts = ([n.target] if not isinstance(n, ast.With)
+                  else [i.optional_vars for i in n.items if i.optional_vars])
+            for t0 in ts:
+                for t in targets(t0):
+                    scopes[scope_node(n)].bound.add(t.id)
+
+    # `x = <default> if x is None else x` makes x not-None: a scope that
+    # normalises x this way does not get x marked by its `is None` tests.
+    normalised = set()
+    for n in ast.walk(tree):
+        if (isinstance(n, ast.Assign) and isinstance(n.value, ast.IfExp)
+                and isinstance(n.value.test, ast.Compare)):
+            for t in n.targets:
+                if isinstance(t, ast.Name) and any(isinstance(x, ast.Name) and x.id == t.id
+                                                  for x in ast.walk(n.value.test)):
+                    normalised.add((scope_node(n), t.id))
+
+    # Two passes, so a function's return shape is known before its callers.
+    returns = {}
+    for _ in range(2):
+        for n in ast.walk(tree):
+            if isinstance(n, (ast.Assign, ast.AnnAssign)) and n.value is not None:
+                s = scopes[scope_node(n)]
+                for t0 in (n.targets if isinstance(n, ast.Assign) else [n.target]):
+                    if isinstance(t0, ast.Name):
+                        s.bound.add(t0.id)
+                        if _filtered(n.value, returns):
+                            s.listy.add(t0.id)
+                        if _maybe_none(n.value, returns):
+                            s.noney.add(t0.id)
+                    elif (isinstance(t0, ast.Tuple) and isinstance(n.value, ast.Tuple)
+                          and len(t0.elts) == len(n.value.elts)):
+                        for e, v in zip(t0.elts, n.value.elts):
+                            for t in targets(e):
+                                s.bound.add(t.id)
+                                if _filtered(v, returns):
+                                    s.listy.add(t.id)
+                                if _maybe_none(v, returns):
+                                    s.noney.add(t.id)
+                    elif (isinstance(t0, ast.Tuple) and isinstance(n.value, ast.Call)
+                          and isinstance(n.value.func, ast.Name)):
+                        for i, e in enumerate(t0.elts):
+                            for t in targets(e):
+                                s.bound.add(t.id)
+                                got = returns.get((n.value.func.id, i), ())
+                                if "listy" in got:
+                                    s.listy.add(t.id)
+                                if "noney" in got:
+                                    s.noney.add(t.id)
+                    else:
+                        for t in targets(t0):
+                            s.bound.add(t.id)
+            elif (isinstance(n, ast.Compare)
+                  and any(isinstance(o, (ast.Is, ast.IsNot)) for o in n.ops)
+                  and any(isinstance(c, ast.Constant) and c.value is None
+                          for c in [n.left] + n.comparators)):
+                for x in [n.left] + n.comparators:
+                    if isinstance(x, ast.Name) and (scope_node(n), x.id) not in normalised:
+                        s = scopes[scope_node(n)]
+                        while s.parent is not None and x.id not in s.bound:
+                            s = s.parent
+                        s.noney.add(x.id)
+        for fn in tree.body:
+            if not isinstance(fn, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                continue
+            s = scopes[fn]
+            for r in ast.walk(fn):
+                if not isinstance(r, ast.Return) or r.value is None or scope_node(r) is not fn:
+                    continue
+                vals = r.value.elts if isinstance(r.value, ast.Tuple) else [r.value]
+                for i, v in enumerate(vals):
+                    key = (fn.name, i if isinstance(r.value, ast.Tuple) else None)
+                    tags = returns.setdefault(key, set())
+                    if isinstance(v, ast.Name) and v.id in s.listy or _filtered(v, returns):
+                        tags.add("listy")
+                    if isinstance(v, ast.Name) and v.id in s.noney or _maybe_none(v, returns):
+                        tags.add("noney")
+
+    def resolve(name_node, attr):
+        s = scopes[scope_node(name_node)]
+        while s is not None:
+            if name_node.id in s.bound or name_node.id in getattr(s, attr):
+                return name_node.id in getattr(s, attr)
+            s = s.parent
+        return False
+
+    def guarded(node, base):
+        ch, p = node, parent.get(node)
+        while p is not None:
+            if isinstance(p, ast.BoolOp) and ch in p.values:
+                if any(_mentions(v, base) for v in p.values[:p.values.index(ch)]):
+                    return True
+            elif isinstance(p, (ast.IfExp, ast.If, ast.While)):
+                if ch is not p.test and _mentions(p.test, base):
+                    return True
+            elif isinstance(p, (ast.ListComp, ast.GeneratorExp, ast.SetComp)):
+                if ch is p.elt and any(_mentions(i, base) for g in p.generators for i in g.ifs):
+                    return True
+            elif isinstance(p, ast.Try) and ch in p.body:
+                return True
+            for field_ in ("body", "orelse"):
+                block = getattr(p, field_, None)
+                if (isinstance(block, list) and ch in block
+                        and any(_exits_on(st, base) for st in block[:block.index(ch)])):
+                    return True
+            if isinstance(p, _FUNCS):
+                return False
+            ch, p = p, parent.get(p)
+        return False
+
+    out = []
+    for n in ast.walk(tree):
+        if (isinstance(n, ast.Subscript) and isinstance(n.ctx, ast.Load)
+                and isinstance(n.value, ast.Name)):
+            k = n.slice
+            if isinstance(k, ast.UnaryOp) and isinstance(k.op, ast.USub):
+                k = k.operand
+            if (isinstance(k, ast.Constant) and type(k.value) is int
+                    and resolve(n.value, "listy") and not guarded(n, n.value)):
+                out.append((n.lineno, "index", ast.unparse(n)))
+        elif (isinstance(n, ast.Call) and isinstance(n.func, ast.Name)
+              and n.func.id == "next" and len(n.args) == 1 and not n.keywords):
+            if not guarded(n, n.args[0]):
+                out.append((n.lineno, "next", ast.unparse(n)[:60]))
+        elif (isinstance(n, ast.FormattedValue) and n.format_spec is not None
+              and isinstance(n.value, ast.Name)):
+            spec = "".join(v.value for v in n.format_spec.values
+                           if isinstance(v, ast.Constant))
+            if (spec and (spec[-1] in _NUMFMT or "," in spec)
+                    and resolve(n.value, "noney") and not guarded(n, n.value)):
+                out.append((n.lineno, "format", f"{{{n.value.id}:{spec}}}"))
+    if census is not None:
+        _count_blind(tree, resolve, census)
+    return sorted(set(out))
+
+
+def _count_blind(tree, resolve, census):
+    """Count, inside check() and print() arguments, the forms part 2 skips."""
+    for call in ast.walk(tree):
+        if not (isinstance(call, ast.Call) and isinstance(call.func, ast.Name)
+                and call.func.id in ("check", "print")):
+            continue
+        for n in (x for a in call.args for x in ast.walk(a)):
+            if isinstance(n, ast.Subscript) and isinstance(n.ctx, ast.Load):
+                k = n.slice.operand if isinstance(n.slice, ast.UnaryOp) else n.slice
+                if not isinstance(k, ast.Constant):
+                    continue
+                if isinstance(k.value, str):
+                    census["key"] += 1
+                elif isinstance(n.value, ast.Name):
+                    if not resolve(n.value, "listy"):
+                        census["name-list"] += 1
+                elif isinstance(n.value, ast.Attribute):
+                    census["attr-list"] += 1
+                else:
+                    census["other-index"] += 1
+            elif isinstance(n, ast.FormattedValue) and n.format_spec is not None:
+                if not isinstance(n.value, ast.Name):
+                    census["format-expr"] += 1
+                elif not resolve(n.value, "noney"):
+                    census["format-name"] += 1
+            elif isinstance(n, ast.BinOp) and isinstance(n.op, (ast.Div, ast.FloorDiv)):
+                census["division"] += 1
+
+
+# The scan must bite before its silence means anything: one planted site of
+# each kind, and the guarded spelling of each, which must NOT be flagged.
+_PLANTED = '''
+def run():
+    seen = []
+    t_gate = None
+    return seen, t_gate
+rows = [r for r in range(3) if r > 9]
+seen, t_gate = run()
+waits, n = [], 0
+check(f"first {rows[0]}", bool(rows))
+print(waits[0])
+check("pair", rows[0] == 1 and rows[1] == 2)
+print(seen[-1])
+print(f"{t_gate:.2f}")
+print(next(r for r in rows))
+'''
+_GUARDED = '''
+def run():
+    seen = []
+    t_gate = None
+    return seen, t_gate
+rows = [r for r in range(3) if r > 9]
+seen, t_gate = run()
+check("first", bool(rows) and rows[0] == 1)
+print(seen[-1] if seen else "-")
+check("pair", len(rows) == 2 and rows[0] < rows[1])
+print(f"{t_gate:.2f}" if t_gate is not None else "-")
+print(next((r for r in rows), None))
+def show(rows):
+    print(rows[0])
+def head():
+    if not rows:
+        return None
+    return rows[0]
+'''
+_hit = scan(_PLANTED)
+print(f"    planted: {_hit}")
+check("the scan flags a planted site of each kind - a filtered list indexed in "
+      "a check NAME whose condition guards it, an accumulator bound in a tuple "
+      "and one returned from a function, a maybe-None formatted, and next() "
+      "without a default",
+      [(k, t) for _l, k, t in _hit] == [
+          ("index", "rows[0]"), ("index", "waits[0]"), ("index", "rows[0]"),
+          ("index", "rows[1]"), ("index", "seen[-1]"),
+          ("format", "{t_gate:.2f}"),
+          ("next", "next((r for r in rows))")])
+check("...and flags none of the guarded spellings - `and`, a conditional, "
+      "an early return, a default - nor a parameter that shadows a filtered "
+      "name", scan(_GUARDED) == [])
+
+_SUITES = sorted(HERE.glob("test_*.py"))
+_found = {p.name: scan(p.read_text(encoding="utf-8")) for p in _SUITES}
+_all = [(f, *h) for f, hs in _found.items() for h in hs]
+for f, line, kind, text in _all:
+    print(f"    {f}:{line}  {kind:6}  {text}")
+check(f"no unguarded raising read in any of the {len(_SUITES)} test files "
+      f"({len(_all)} found) - read it through named_absence.py and conjoin "
+      f"present() in the check", _all == [] and len(_SUITES) >= 30)
+
+
+# ==============================================================================
+print()
+print("3. what part 2 cannot see, counted - these can still raise")
+# ==============================================================================
+# The scan knows a list is filtered, or a name may be None, only from its own
+# file's syntax. Each form below can still raise and is NOT graded; the counts
+# are of every such site in check() and print() arguments, largest first.
+_BLIND = {
+    "key": "`x['k']` - a dict key the code under test may omit",
+    "name-list": "`x[k]` on a list the scan cannot see is filtered - returned "
+                 "by another module or a method, or of a fixed length",
+    "format-name": "a numeric format on a name the scan has no reason to think "
+                   "is None - e.g. set from another module's function",
+    "format-expr": "a numeric format on an attribute, subscript or call",
+    "attr-list": "`obj.items[k]` - an attribute list",
+    "other-index": "`x[k]` on a call, a slice or a nested subscript",
+    "division": "`/` or `//` by a value that can be 0",
+}
+_census = Counter()
+for p in _SUITES:
+    scan(p.read_text(encoding="utf-8"), _census)
+for k, why in sorted(_BLIND.items(), key=lambda kv: -_census[kv[0]]):
+    print(f"    {_census[k]:5d}  {why}")
+print("    never counted: these forms outside check()/print() arguments; "
+      "attribute access, iteration, int() or range() on a None or an ABSENT; "
+      "a raise inside a fixture function or inside app/.")
+check("every counted form is in the printed table", set(_census) <= set(_BLIND))
+
+
+print()
+if fails:
+    print(f"{len(fails)} CHECK(S) FAILED")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_p1.py b/goodwe_controller/test_p1.py
index 4983200..99fe896 100644
--- a/goodwe_controller/test_p1.py
+++ b/goodwe_controller/test_p1.py
@@ -1320,8 +1320,8 @@ check("homewizard_local is enabled here too",
 row = [s for s in SENSORS if s[0] == "p1_age"]
 check("the age sensor is declared exactly once", len(row) == 1)
 check("its object_id pins entity_id to sensor.p1_sample_age_s",
-      row[0][1] == "p1_sample_age_s")
-check("it is published in seconds", row[0][3] == "s")
+      len(row) == 1 and row[0][1] == "p1_sample_age_s")
+check("it is published in seconds", len(row) == 1 and row[0][3] == "s")
 
 
 class _RecordingClient:
@@ -1432,7 +1432,7 @@ def p1_rows(ctl):
     a traceback instead of reddening the check that names the rule.
     """
     try:
-        return [c["text"] for c in ctl.checks() if c["text"].startswith("P1 meter")]
+        return [c["text"] for c in ctl.checks() if c.get("id") == "meter"]
     except Exception as err:  # noqa: BLE001 - a raise here is itself the failure
         print(f"       checks() raised {type(err).__name__}: {err}")
         return err
diff --git a/goodwe_controller/test_packshare.py b/goodwe_controller/test_packshare.py
index 19dfcc3..561e9ad 100644
--- a/goodwe_controller/test_packshare.py
+++ b/goodwe_controller/test_packshare.py
@@ -36,6 +36,7 @@ from math import inf
 from pathlib import Path
 
 from app import arbitrage, packshare
+from named_absence import first, nth, present
 from app.allocator import plan
 from app.arbiter import (
     ACTUATOR_SITE, CLAIM_SCOPE, P_LOOP, P_SAFETY, SCOPE_UNIT, Claim, resolve,
@@ -347,12 +348,12 @@ check("...and the shipped behaviour really was the other one, so the line "
       "above is not vacuous: an equal split of 1500 W is 750/750, and 750 W is "
       "what a pack at its cut-out was being told to produce",
       _r_now.shares == {A: 750, Bee: 750})
-_plan_a = next(p for p in _r_opt.allocation.plans if p.unit == A)
+_plan_a = first((p for p in _r_opt.allocation.plans if p.unit == A), "no plan for A")
 print(f"    {_plan_a.explain()}")
 check("...and the RECORD says why, in the line an operator is already reading. "
       "`UnitPlan.within_envelope` is asked rather than assumed, and SAFETY-28's "
       "write gate refuses a record that contradicts itself",
-      _plan_a.within_envelope and _plan_a.share_w == 0
+      present(_plan_a) and _plan_a.within_envelope and _plan_a.share_w == 0
       and _plan_a.hi == 0.0 and _r_opt.allocated)
 check("a pack at 100 % is not allocated a CHARGE either, and the sibling takes "
       "the whole of it - the same sentence in the other direction",
@@ -477,12 +478,12 @@ check("...and the two halves are separated from EACH OTHER as well: on a pack "
       "grades the ENVELOPE. Case three - both packs with room, nothing closed - "
       "is the one that can only be the WEIGHTS",
       _env_only.shares == {A: 0, Bee: 1500}
-      and _broken[2][1] != _broken[2][2])
+      and len(_broken) > 2 and _broken[2][1] != _broken[2][2])
 check("...and the third case is the one that isolates the WEIGHTS from the "
       "ENVELOPE: both packs have room, no interval is closed, nothing is "
       "refused - and the split still moves from 500/500 to 97/903 because the "
       "energy headroom says so",
-      _broken[2][1] == {A: 97, Bee: 903} and _broken[2][2] == {A: 500, Bee: 500})
+      nth(_broken, 2)[1] == {A: 97, Bee: 903} and nth(_broken, 2)[2] == {A: 500, Bee: 500})
 
 
 # ==============================================================================
@@ -1156,7 +1157,7 @@ check("⚠️ MAIN.PY ACTUALLY PASSES `weights=`, AND IT PASSES THE METHOD RATHE
 # reads the allocation's own `unmet_w`, is EDGE-TRIGGERED against the previous
 # cycle's value, and logs. What it does NOT grade is the sentence it logs or
 # that a real cycle reaches it; that is stated here rather than implied.
-_cycle_src = next(
+_cycle_src = first(
     f for cls in ast.walk(ast.parse(
         (Path(__file__).resolve().parent / "app" / "main.py")
         .read_text(encoding="utf-8")))
diff --git a/goodwe_controller/test_peak_margin.py b/goodwe_controller/test_peak_margin.py
new file mode 100644
index 0000000..19f09d9
--- /dev/null
+++ b/goodwe_controller/test_peak_margin.py
@@ -0,0 +1,311 @@
+"""Runnable check for SAFETY-79, the margin under the peak limit.
+`python3 test_peak_margin.py`
+
+The peak guard aims at `peak_cap_w - peak_margin_w` (default 50 W); the bill
+and every report keep the real `peak_cap_w`. DECISIONS/SAFETY-79-peak-margin.md
+has the record. Drives the REAL Controller through tools/safety79_identity.py.
+
+1. `peak_margin_w: 0` is byte-identical to release/1.0 ed739d4.
+2. The guard aims at cap - margin at N=1 and N=2, and with OPT-11 modes on an
+   Off battery covers the shortfall to cap - margin.
+3. The bill and the reports still use the real cap.
+4. Each call site in main.py passes the value its side needs.
+5. The setting: default, range, refusals in plain words.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import ast
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import safety79_identity as rig                               # noqa: E402
+from named_absence import nth, present                        # noqa: E402
+from style_rules import text_problems                         # noqa: E402
+from app import messages, peakguard                 # noqa: E402
+from app.control import maintenance_charge_floor              # noqa: E402
+from app.peakguard import (PEAK_MARGIN_RANGE_W,               # noqa: E402
+                           PEAK_OPTION_DEFAULTS, quarter_target_w)
+from app.validate import config_notes, validate_startup_config  # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+CAP = float(rig.CAP_W)
+
+# ============================================================================ #
+print("1. peak_margin_w 0: byte-identical to release/1.0 ed739d4")
+# Printed by `python3 tools/safety79_identity.py 0` on the ed739d4 tree (the
+# tool copied in, nothing else changed; that tree ignores the key), in the CI
+# image; re-printed 2026-09-29 (review) after adding the charge headroom, the
+# shaping suspension and the two maintenance scenarios. 540 cycles each.
+ED739D4 = {
+    "n1": "82316f7d4362fae4c035a1bed5e7907cf362faba994c634d0b1c356c501f53e5",
+    "n2": "0dc24e16a8390ec42edacf735eaf20273847b33b9c67d7cdc536df0ca739e421",
+    "n1_off": "eed44f058f3fcc6e7651c5c84c6fa6313e7520035ad7cac282012cf6909668a0",
+    "n2_off": "69796c107b9f78892e04d282b754f889590acf9fe1b96f09525f5ea2005e9c0a",
+    "n1_maint":
+        "bd4a88a10aa840a360ac781ac04e30b040a5aac5426fabba1fb259d71dfeba67",
+    "n2_maint":
+        "0656bc5a4a2fa3a7455822fdd7da5f68f57fd9593f374e869a0d30ba7e429275",
+}
+_zero = rig.digests(0)
+_default = rig.digests()
+for k in ED739D4:
+    print(f"    {k:7} margin 0 {'same' if _zero[k] == ED739D4[k] else 'DIFFERS'}"
+          f" {_zero[k][:16]}, default {_default[k][:16]}")
+# SAFETY-84 changes n2_maint ON PURPOSE: on 9d5b7d1 its N=2 cheap-window
+# charge was refused on 214 of 540 cycles (site at 0 W); now none is.
+# Printed on the SAFETY-84 tree the same way (margin 0).
+# SAFETY-85: the loop is bounded while A charges (reasons change, commands
+# do not). Was 95722b262f1bcf504493d7b5babc3895799ac56cc15f5d2ccdbe7c9f04adfcbb.
+SAFETY84_N2_MAINT = \
+    "ef97ae2e13668b3e0b2d22f3f5f37835ea46cd306c2cc475c97e284f9dcc6545"
+check("⭐ at N=1 and N=2, with and without battery modes and with a "
+      "maintenance charge, margin 0 is "
+      "byte-identical to ed739d4 (n2_maint apart, below)",
+      {k: v for k, v in _zero.items() if k != "n2_maint"}
+      == {k: v for k, v in ED739D4.items() if k != "n2_maint"})
+check("...and n2_maint at margin 0 is the SAFETY-84 digest: the N=2 charge "
+      "that 9d5b7d1 refused on 214 of 540 cycles now runs (test_safety84.py)",
+      _zero["n2_maint"] == SAFETY84_N2_MAINT != ED739D4["n2_maint"])
+check("...and the default (key absent) changes every scenario, so the "
+      "scenarios do reach the margin", all(_default[k] != ED739D4[k]
+                                          for k in ED739D4))
+
+# ============================================================================ #
+print("\n2. the guard aims at cap - margin")
+_runs = {}
+for name, spec in rig.SCENARIOS.items():
+    for m in (None, 0, 120):
+        _runs[name, m] = rig.run(**spec, margin=m, dur=3600.0)
+for name in rig.SCENARIOS:
+    g = _runs[name, None][1].peak_guard
+    print(f"    {name}: margin {_runs[name, None][1].peak_margin_w:.0f} W, "
+          f"aims at {g.target_w:.0f} W, limit {g.ceiling_w:.0f} W")
+check("test_target_is_cap_minus_margin: with the key absent every scenario "
+      "(N=1, N=2, modes on and off) aims at cap - 50 and reports the cap",
+      all(_runs[n, None][1].peak_margin_w == 50.0
+          and _runs[n, None][1].peak_guard.target_w == CAP - 50
+          and _runs[n, None][1].peak_guard.ceiling_w == CAP
+          for n in rig.SCENARIOS))
+check("...and a margin of 120 moves the aim to cap - 120, a margin of 0 to "
+      "the cap", all(_runs[n, 120][1].peak_guard.target_w == CAP - 120
+                     and _runs[n, 0][1].peak_guard.target_w == CAP
+                     for n in rig.SCENARIOS))
+
+
+def banked(ctl):
+    return {b.start.strftime("%H:%M"): round(b.offtake_avg_w, 2)
+            for b in ctl.p1.blocks}
+
+
+_b = {m: banked(_runs["n1_off", m][1]) for m in (0, None, 120)}
+print(f"    N=1, the battery Off: quarters banked {_b}")
+check("test_off_battery_n1: at N=1 with the battery Off, the guard makes it "
+      "give just enough to bank the 11:30 quarter at cap - margin (2500, "
+      "2450, 2380 W for margins 0, 50, 120)",
+      [_b[m]["11:30"] for m in (0, None, 120)]
+      == [CAP, CAP - 50, CAP - 120])
+
+
+def meter_at(rows, t):
+    row = next((r for r in rows if r[0] == t), None)
+    if row is None:
+        return None, {}
+    return rig.load(t) - sum(w for _u, w in row[2]), dict(row[2])
+
+
+_g0, _c0 = meter_at(_runs["n2_off", 0][0], 1800.0)
+_g50, _c50 = meter_at(_runs["n2_off", None][0], 1800.0)
+print(f"    N=2, B Off, 6000 W house: margin 0 -> {_c0}, meter {_g0} W; "
+      f"margin 50 -> {_c50}, meter {_g50} W")
+check("test_off_battery_n2: at N=2 with B Off and A at its rating, B covers "
+      "the shortfall to cap - margin, not to the cap",
+      _c0["b"] == 1000.0 and _g0 == CAP
+      and _c50["b"] == 1050.0 and _g50 == CAP - 50)
+
+def _peak(w, observed=True):
+    return type("R", (), {"is_observed": observed, "peak_w": w})()
+
+
+# Review (SAFETY-79 point 2): the margin applies under a month peak already
+# banked, too. Aiming AT it can bank a few W over it, which raises the bill;
+# and a banked peak between cap - margin and the cap (a quarter the old guard
+# held at the cap, say) was aimed at exactly, so one overshoot crossed the cap.
+check("test_margin_under_banked_peak: the aim is the margin under the limit "
+      "that holds - the cap, or a month peak already banked above it",
+      quarter_target_w(CAP, 50, _peak(2499.0)) == CAP - 50
+      and quarter_target_w(CAP, 50, _peak(3000.0)) == 2950.0
+      and quarter_target_w(CAP, 50, _peak(3000.0, observed=False)) == CAP - 50
+      and quarter_target_w(CAP, 50, None) == CAP - 50
+      and quarter_target_w(CAP, 0, _peak(3000.0)) == 3000.0)
+
+
+def _decide(banked_w, projected_w):
+    """Half a quarter at `projected_w`, battery idle, a month peak banked."""
+    from datetime import datetime, timezone
+    from app.tariff import Projection
+    pr = Projection(projected_w, projected_w, 450.0, 1.0, False,
+                    datetime(2026, 9, 1, 12, 0, tzinfo=timezone.utc),
+                    projected_w)
+    return peakguard.decide(pr, batt_w=0.0, cap_w=CAP, margin_w=50,
+                            reading=_peak(banked_w), achievable_w=5000.0,
+                            soc=60.0, soc_floor=20.0)
+
+
+_d1, _d2 = _decide(2499.0, 2600.0), _decide(3000.0, 3100.0)
+print(f"    banked 2499 W: floor {_d1.floor_w}, limit {_d1.ceiling_w}; "
+      f"banked 3000 W: floor {_d2.floor_w}, limit {_d2.ceiling_w}")
+check("...and decide() sizes the floor to land the quarter 50 W under it "
+      "(2449 and 2950 W), while the reported limit stays the cap or the peak",
+      _d1.floor_w == 2 * (2600.0 - 2450.0) and _d1.ceiling_w == CAP
+      and _d2.floor_w == 2 * (3100.0 - 2950.0) and _d2.ceiling_w == 3000.0)
+
+# ============================================================================ #
+print("\n3. the bill and the reports keep the real cap")
+_c = _runs["n1_off", None][1]
+_t = rig.rig.BASE       # the runs' clock, not the wall clock (a new month)
+_pk = _c.peak.peak(_t).peak_w
+print(f"    month peak {_pk:.0f} W, tracker cap {_c.peak.cap_w:.0f} W, "
+      f"warning {_c.peak.warning_frac(_t):.3f}, headroom "
+      f"{_c.peak.headroom_w(_t):.0f} W")
+check("test_billing_uses_cap: the month-peak tracker (bill, headroom, 80 % "
+      "warning) is built on the real cap, not cap - margin",
+      _c.peak.cap_w == CAP and _c.peak.warning_frac(_t) == _pk / CAP
+      and _c.peak.headroom_w(_t) == CAP - _pk)
+_eng = [g for r in _runs["n1_off", None][0] for g in (r[-1][1],)
+        if g and g[0] and g[1]]
+print(f"    {len(_eng)} engaged cycles; one: {_eng[0][4] if _eng else None}")
+check("test_reports_use_cap: every engaged sentence names the real limit and "
+      "the aim beside it", _eng and all(
+          g[2] == CAP and "against a 2500 W limit (peak_cap_w), aiming at "
+          "2450 W" in g[4] for g in _eng))
+check("...and the settings note compares the month peak with the real cap: "
+      "a 2480 W peak under a 2500 W cap is no warning, 2520 W is",
+      config_notes({"peak_cap_w": 2500, "peak_margin_w": 50},
+                   month_peak_w=2480) == []
+      and [n.keys for n in config_notes({"peak_cap_w": 2500,
+                                         "peak_margin_w": 50},
+                                        month_peak_w=2520)]
+      == [("peak_cap_w",)])
+_lim = _eng[0][2] if _eng else 0.0
+_notice = messages.peak_saturated(_lim)
+check("...and the user-facing peak notice built from the decision's limit "
+      "says the cap", messages.watts(CAP) in _notice.body
+      and messages.watts(CAP - 50) not in _notice.body)
+
+# ============================================================================ #
+print("\n4. each call site in main.py")
+with open(os.path.join(HERE, "app", "main.py"), encoding="utf-8") as f:
+    _src = f.read()
+_tree = ast.parse(_src)
+
+
+def calls(name):
+    return [n for n in ast.walk(_tree) if isinstance(n, ast.Call)
+            and isinstance(n.func, (ast.Attribute, ast.Name))
+            and getattr(n.func, "attr", getattr(n.func, "id", "")) == name]
+
+
+def kw(call, key):
+    if not present(call):
+        return "absent"
+    return next((ast.get_source_segment(_src, k.value) for k in call.keywords
+                 if k.arg == key), "absent")
+
+
+def arg(call, i):
+    if not present(call) or len(call.args) <= i:
+        return "absent"
+    return ast.get_source_segment(_src, call.args[i])
+
+
+_dec = [c for c in calls("decide")
+        if getattr(c.func, "value", None) is not None
+        and getattr(c.func.value, "id", "") == "peakguard"]
+_shape = calls("shaping_suspended")
+_maint = calls("maintenance_charge_floor")
+_tracker = calls("PeakTracker")
+_d, _s, _m, _t = (nth(_dec, 0, "peakguard.decide()"),
+                  nth(_shape, 0, "shaping_suspended()"),
+                  nth(_maint, 0, "maintenance_charge_floor()"),
+                  nth(_tracker, 0, "PeakTracker()"))
+print(f"    decide(cap_w={kw(_d, 'cap_w')}, margin_w={kw(_d, 'margin_w')})")
+print(f"    shaping_suspended(..., {arg(_s, 2)})")
+print(f"    maintenance_charge_floor(..., {arg(_m, 2)})")
+print(f"    PeakTracker(cap_w={kw(_t, 'cap_w')})")
+check("test_call_sites: the guard gets the real cap AND the margin; the "
+      "forecast checks get cap - margin; the month-peak tracker gets the "
+      "real cap",
+      len(_dec) == 1 and "peak_cap_w" in kw(_d, "cap_w")
+      and kw(_d, "margin_w") == "self.peak_margin_w"
+      and len(_shape) == 1 and len(_maint) == 1
+      and arg(_s, 2) == "self.peak_aim_w()"
+      and arg(_m, 2) == "self.peak_aim_w()"
+      and len(_tracker) == 1
+      and kw(_t, "cap_w") == 'float(opts.get("peak_cap_w", 3500))')
+check("test_aim_w: `peak_aim_w()` is cap - margin, and the forecast sizing "
+      "gives a maintenance charge only what is left under it",
+      _c.peak_aim_w() == CAP - 50
+      and maintenance_charge_floor(2000.0, 2400.0, _c.peak_aim_w()) == 50.0
+      and peakguard.shaping_suspended(None, 2470.0, _c.peak_aim_w())
+      and not peakguard.shaping_suspended(None, 2470.0, CAP))
+
+# ============================================================================ #
+print("\n5. the setting")
+
+
+with open(os.path.join(HERE, "config.yaml"), encoding="utf-8") as f:
+    _hits = re.findall(r"^  peak_margin_w:\s*(\S+)", f.read(), re.M)
+print(f"    config.yaml: {_hits}")
+check("config.yaml ships 50, int(0,500), and the in-code mirror matches",
+      _hits == ["50", "int(0,500)"]
+      and PEAK_OPTION_DEFAULTS["peak_margin_w"] == 50
+      and PEAK_MARGIN_RANGE_W == (0, 500))
+
+BASE = {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+        "max_w": 2000, "peak_cap_w": 3500}
+_base_problems = validate_startup_config(BASE)
+
+
+def refused(value, **more):
+    opts = dict(BASE, peak_margin_w=value, **more)
+    return [p for p in validate_startup_config(opts)
+            if p not in _base_problems]
+
+
+_ok = {v: refused(v) for v in (0, 50, 500)}
+_bad = {v: refused(v) for v in (-1, 501, 12.5, "abc")}
+for v, p in _bad.items():
+    print(f"    {v!r}: {p}")
+check("test_margin_range: 0, 50 and 500 are accepted, and so is the key "
+      "absent", not any(_ok.values()) and _base_problems == [])
+check("...and below 0, above 500, not whole, or not a number is refused, "
+      "once, naming the setting and the range",
+      all(len(p) == 1 and "“Margin below the peak limit” (peak_margin_w)"
+          in p[0] and "from 0 to 500 W" in p[0] for p in _bad.values()))
+_high = refused(500, peak_cap_w=500)
+print(f"    500 under a 500 W limit: {_high}")
+check("...and a margin that leaves nothing under the limit is refused",
+      len(_high) == 1 and "not below" in _high[0])
+_style = [text_problems(p[0], keys=("peak_margin_w", "peak_cap_w"),
+                        entities=False) for p in list(_bad.values()) + [_high]]
+check(f"...in plain words (STYLE.md): {_style}", not any(_style))
+
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: {', '.join(fails)}")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_peakguard.py b/goodwe_controller/test_peakguard.py
index a90b20d..ac02b5f 100644
--- a/goodwe_controller/test_peakguard.py
+++ b/goodwe_controller/test_peakguard.py
@@ -109,12 +109,20 @@ import re
 import shutil
 import sys
 import tempfile
+import types
 import time
 from datetime import datetime, timedelta, timezone
 from math import inf, isinf
 from pathlib import Path
 
+from app import messages
 from app import peakguard
+from named_absence import first, given, nth, present
+
+
+def _src(node):
+    """`ast.unparse(node)`, or what was there instead - never a raise."""
+    return ast.unparse(node) if isinstance(node, ast.AST) else repr(node)
 # ⚠️ THE DROP AND REFUSAL REASONS ARE IMPORTED, NOT TRANSCRIBED. A check that
 # matched the English would stay green against an allocator that renamed the
 # case out from under it, which is this repository's own named failure mode.
@@ -265,18 +273,18 @@ def _schema_bound(key: str, which: int):
 
 
 # Everything numeric below is read out of the shipped file, not typed here.
-CAP_W = read_option("peak_cap_w")
-MAX_HOLD_S = read_option("meter_max_age_s")
-FREEZE_S = read_option("meter_freeze_s")
-CYCLE_S = read_option("cycle_floor_s")
+CAP_W = given(read_option("peak_cap_w"), "peak_cap_w not in config.yaml")
+MAX_HOLD_S = given(read_option("meter_max_age_s"), "meter_max_age_s not in config.yaml")
+FREEZE_S = given(read_option("meter_freeze_s"), "meter_freeze_s not in config.yaml")
+CYCLE_S = given(read_option("cycle_floor_s"), "cycle_floor_s not in config.yaml")
 # The live install runs max_w 5000 (NOTES.md, freeze.py). That is also the schema
 # ceiling and the GW5000S-BP's rating, which is why the two agree - so the
 # device figure is taken from the schema rather than typed.
-LIVE_MAX_W = read_schema_max("max_w")
+LIVE_MAX_W = given(read_schema_max("max_w"), "max_w not in config.yaml")
 # SAFETY-24's two options, out of the shipped file for the same reason.
-SOC_FLOOR = read_option("peak_soc_floor")
-BMS_FLOOR = read_option("bms_soc_floor")
-MAINT_FLOOR = read_option("maintenance_soc_floor")
+SOC_FLOOR = given(read_option("peak_soc_floor"), "peak_soc_floor not in config.yaml")
+BMS_FLOOR = given(read_option("bms_soc_floor"), "bms_soc_floor not in config.yaml")
+MAINT_FLOOR = given(read_option("maintenance_soc_floor"), "maintenance_soc_floor not in config.yaml")
 # A state of charge that comfortably permits a forced discharge, DERIVED from
 # the floor rather than typed: every part of this file that is not about
 # SAFETY-24 has to grade SAFETY-07's behaviour at a SoC where the new floor is
@@ -291,8 +299,8 @@ print(f"    read from config.yaml: peak_cap_w {CAP_W:.0f} W, "
 print(f"    ...and peak_soc_floor {SOC_FLOOR:.0f} %, bms_soc_floor "
       f"{BMS_FLOOR:.0f} %, maintenance_soc_floor {MAINT_FLOOR:.0f} %")
 check("every threshold this check grades against came out of config.yaml",
-      None not in (CAP_W, MAX_HOLD_S, FREEZE_S, CYCLE_S, LIVE_MAX_W,
-                   SOC_FLOOR, BMS_FLOOR, MAINT_FLOOR))
+      present(CAP_W, MAX_HOLD_S, FREEZE_S, CYCLE_S, LIVE_MAX_W,
+              SOC_FLOOR, BMS_FLOOR, MAINT_FLOOR))
 check("...and the SoC these checks use as 'plenty of battery' is comfortably "
       "clear of the floor, so nothing outside part 9 is silently grading "
       "SAFETY-24 instead of SAFETY-07", SOC_OK > SOC_FLOOR + 10.0)
@@ -361,7 +369,7 @@ check("...and it grows monotonically through the quarter, so the guard is at "
 BATT_NOW = 400.0
 a_edge = averager_at(CEIL, 450.0)
 p_edge = PeakTracker.project(a_edge, B + timedelta(seconds=450))
-d_edge = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_edge = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 e_edge = excess_w(p_edge, CEIL)
 print(f"    held exactly AT the ceiling for 450 s: projected "
@@ -376,7 +384,7 @@ check("at the engagement boundary the excess is zero, so the floor is exactly "
 # than on the excess. Re-derived here rather than described: a guard that
 # released as soon as `excess <= 0` hands the actuator back at the exact instant
 # it is working, and the load springs straight back.
-released = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+released = decide(p_edge, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 would_release_on_excess = excess_w(p_edge, CEIL) <= 0.0
 # ⚠️ `floor_w` IS FORMATTED DEFENSIVELY, AND MUTATION.md's OWN LEDGER IS WHY.
@@ -397,7 +405,7 @@ check("...and the claim is held there, not released. `excess` falls to zero as "
       "arithmetic read as a level", would_release_on_excess and released.engaged)
 d_gone = decide(PeakTracker.project(averager_at(500.0, 450.0),
                                     B + timedelta(seconds=450)),
-                batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+                batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 check("...and it DOES release once the load falls under what the quarter can "
       "afford, so 'threshold the floor' is not 'never let go'",
@@ -406,7 +414,7 @@ check("...and it DOES release once the load falls under what the quarter can "
 # A hair over, and the floor is the battery plus the excess. Not a constant.
 a_over = averager_at(CEIL + 200.0, 450.0)
 p_over = PeakTracker.project(a_over, B + timedelta(seconds=450))
-d_over = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_over = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    200 W over for 450 s: {d_over.explain()}")
 check("a quarter projected over the ceiling engages, and the floor is the "
@@ -415,7 +423,7 @@ check("a quarter projected over the ceiling engages, and the floor is the "
       and near(d_over.floor_w, BATT_NOW + excess_w(p_over, CEIL), 1e-6))
 check("...and the floor moves with the battery measurement, so it is a claim "
       "about delivered power rather than a fixed setpoint",
-      not near(decide(p_over, batt_w=BATT_NOW + 250.0, cap_w=CAP_W, reading=None,
+      not near(decide(p_over, batt_w=BATT_NOW + 250.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                       achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR).floor_w,
                d_over.floor_w, 1.0))
 
@@ -426,7 +434,7 @@ intent = 0.0
 delivered_floor = []
 intent_floor = []
 for _ in range(5):
-    d_del = decide(p_over, batt_w=stuck_batt, cap_w=CAP_W, reading=None,
+    d_del = decide(p_over, batt_w=stuck_batt, cap_w=CAP_W, margin_w=0.0, reading=None,
                    achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
     delivered_floor.append(d_del.floor_w)
     intent = intent + excess_w(p_over, CEIL)     # what the intent form would do
@@ -437,7 +445,7 @@ print(f"    five cycles with the inverter not following: delivered-power floor "
 check("a floor sized from DELIVERED battery power is stationary while the "
       "inverter fails to follow; one sized from the standing command winds up",
       len(set(f"{v:.3f}" for v in delivered_floor)) == 1
-      and intent_floor[-1] > intent_floor[0] * 4)
+      and nth(intent_floor, -1) > nth(intent_floor, 0) * 4)
 
 
 # ==============================================================================
@@ -509,7 +517,7 @@ check(f"a loop already discharging harder ({BIG:.0f} W) than the floor is not "
 absurd = averager_at(LIVE_MAX_W * 4, 870.0)
 p_absurd = PeakTracker.project(absurd, B + timedelta(seconds=870))
 DEV_MAX = LIVE_MAX_W - 500.0        # a device rating tighter than max_w
-d_absurd = decide(p_absurd, batt_w=1000.0, cap_w=CAP_W, reading=None,
+d_absurd = decide(p_absurd, batt_w=1000.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=min(LIVE_MAX_W, DEV_MAX), max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 r6 = resolve([Claim.limit("device", P_SAFETY, -DEV_MAX, DEV_MAX, "rating"),
               Claim.limit("supervised", P_SAFETY, -LIVE_MAX_W, LIVE_MAX_W, "max_w"),
@@ -592,7 +600,7 @@ print(f"    a real PeakStore on a missing volume: state={rd_broken.state}, "
       f"headroom_w()={tr_broken.headroom_w(B)}")
 check("the real store answers NOT_OBSERVED rather than a peak of 0 W",
       rd_broken.state == NOT_OBSERVED and rd_broken.peak_w is None)
-d_broken = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, reading=rd_broken,
+d_broken = decide(p_over, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=rd_broken,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    {d_broken.explain()}")
 check("AND THE GUARD STILL ENGAGES ON IT. An unreadable peak must not disarm "
@@ -620,7 +628,7 @@ print("4. blindness: three ways a projection is not evidence")
 # (a) NO OPEN BLOCK. A fresh averager projects 0 W - under every ceiling.
 fresh = QuarterAverager(phases=1, max_hold_s=MAX_HOLD_S)
 p_fresh = PeakTracker.project(fresh, B)
-d_fresh = decide(p_fresh, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_fresh = decide(p_fresh, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    fresh averager: projected {p_fresh.projected_w:.0f} W, "
       f"block_start={p_fresh.block_start}; {d_fresh.explain()}")
@@ -648,7 +656,7 @@ p_frozen = PeakTracker.project(frozen_av, B + timedelta(seconds=600))
 RAILED = LIVE_MAX_W                          # the loop has wound to the rail
 is_frozen = looks_frozen(FREEZE_S + 1.0, -RAILED, LIVE_MAX_W,
                          FreezeWatchdogConfig(hold_s=FREEZE_S))
-d_frozen = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, reading=None,
+d_frozen = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR,
                   frozen=is_frozen)
 print(f"    meter stuck at -4000 W with the command at {-RAILED:+.0f} W: "
@@ -673,7 +681,7 @@ check("...and the same command NOT frozen is left alone, so the blind branch is
       "not simply always on",
       near(resolve(SAFE + [Claim.set("loop", P_LOOP, -RAILED, "grid"),
                            peakguard.claim(decide(
-                               p_frozen, batt_w=-RAILED, cap_w=CAP_W,
+                               p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0,
                                reading=None, achievable_w=LIVE_MAX_W,
                                max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR, frozen=False))
                            or Claim.limit("noop", P_PEAK)]).target_w,
@@ -685,7 +693,7 @@ gapped = averager_at(4200.0, 600.0, gap_at=200.0, gap_s=GAP)
 p_gap = PeakTracker.project(gapped, B + timedelta(seconds=600))
 clean = averager_at(4200.0, 600.0)
 p_clean = PeakTracker.project(clean, B + timedelta(seconds=600))
-d_gap = decide(p_gap, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_gap = decide(p_gap, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    a {GAP:.0f} s hole at 4200 W: uncovered {uncovered_s(p_gap):.0f} s, "
       f"projected {p_gap.projected_w:.0f} W vs {p_clean.projected_w:.0f} W with "
@@ -749,7 +757,7 @@ check("a renamed held value now raises AttributeError on the first cycle. The "
 OLD = (p_held.partial_ws if hasattr(p_held, "partial_ws")
        else HELD * 300.0)   # acc, which the old form would still have had
 old_projected = (HELD * 300.0 + 0.0 * (QUARTER_S - 300.0)) / QUARTER_S
-d_true = decide(p_held, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_true = decide(p_held, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                 achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR)
 print(f"    same fixture: shipped projection {p_held.projected_w:.0f} W "
       f"(engaged={d_true.engaged}), the defaulted form's "
@@ -796,7 +804,7 @@ def replay(path, *, guarded: bool, cap_w=CAP_W, max_w=LIVE_MAX_W, pack=None,
     """
     ing = P1Ingest(phases=1, max_age_s=MAX_HOLD_S)
     store = fresh_store(f"{path.stem}-{'g' if guarded else 'u'}"
-                        f"{'' if pack is None else f'-p{soc_floor:.0f}'}")
+                        f"{'' if pack is None else f'-p{given(soc_floor):.0f}'}")
     tracker = PeakTracker(store, cap_w=cap_w)
     batt = 0.0                      # delivered discharge, W (positive)
     next_cycle = None
@@ -825,7 +833,7 @@ def replay(path, *, guarded: bool, cap_w=CAP_W, max_w=LIVE_MAX_W, pack=None,
         next_cycle = t + timedelta(seconds=CYCLE_S)
         cycles += 1
         d = decide(PeakTracker.project(ing.averager, t),
-                   batt_w=batt, cap_w=cap_w, reading=tracker.peak(t),
+                   batt_w=batt, cap_w=cap_w, margin_w=0.0, reading=tracker.peak(t),
                    achievable_w=max_w, max_hold_s=MAX_HOLD_S, soc=soc,
                    soc_floor=floor_pct, frozen=False)
         if d.floor_w is not None and d.floor_w < 0.0:
@@ -1031,7 +1039,7 @@ check(f"a Controller built with peak_cap_w ABSENT takes the shipped "
       c.peak.cap_w == CAP_W)
 check("...and before the first cycle the guard has NO decision, which the "
       "status page must not spell as 'idle'", c.peak_guard is None)
-pre = [r for r in c.checks() if "peak guard" in r["text"]]
+pre = [r for r in c.checks() if r.get("id") == "peak_guard"]
 print("    status row before the first cycle: "
       + (pre[0]["text"] if pre else "(none)"))
 check("the status page says so in its own row",
@@ -1047,17 +1055,20 @@ c_off, hass_off = built(TMP / "legacy.db",
                         {"meter_source": "off", "meter_entity": "sensor.grid"})
 c_off.auto, c_off.soc, c_off.batt, c_off.grid = True, 55.0, 0.0, -6000.0
 asyncio.get_event_loop_policy().new_event_loop().run_until_complete(c_off.cycle())
-off_rows = [r for r in c_off.checks() if "peak guard" in r["text"]]
+off_rows = [r for r in c_off.checks() if r.get("id") == "peak_guard"]
 print(f"    meter_source off: guard={c_off.peak_guard}, wrote "
-      f"{hass_off.writes[-1]:+.0f} W")
+      f"{nth(hass_off.writes, -1):+.0f} W")
 print("    status row: " + (off_rows[0]["text"] if off_rows else "(none)"))
 check("with no P1 the guard does not run at all - it files nothing, and the "
       "legacy path can still charge", c_off.peak_guard is None
       and hass_off.writes and hass_off.writes[-1] < 0)
-check("...and the status page says NOT COVERED rather than 'idle' or a green "
-      "row, which is the same answer SAFETY-18 already gives on a transport "
-      "that cannot see it", len(off_rows) == 1
-      and "NOT COVERED" in off_rows[0]["text"] and off_rows[0]["warn"])
+check("...and the status page says the guard is off, and why, rather than "
+      "'idle' or a green row - the same answer SAFETY-18 already gives on a "
+      "transport that cannot see it", len(off_rows) == 1
+      and ": off" in off_rows[0]["text"]
+      and "Where the meter reading comes from" in off_rows[0]["text"]
+      and "idle" not in off_rows[0]["text"]
+      and not off_rows[0]["ok"] and off_rows[0]["warn"])
 
 # ⚠️ THE FIXTURE MUST LAND IN THE CURRENT QUARTER, AND THAT IS NOT PEDANTRY.
 # `cycle()` reads the real clock, and `project()` measures the open block against
@@ -1165,7 +1176,9 @@ def wired_over_limit(db, want_floor_w, opts=None, store=None, batt_w=0.0,
             int(now.timestamp() // QUARTER_S) * QUARTER_S, timezone.utc)
         span = int((now - blk).total_seconds())
         remaining = max(1.0, QUARTER_S - (now - blk).total_seconds())
-        net_w = CAP_W + want_floor_w * remaining / QUARTER_S
+        # SAFETY-79: sized against what the guard aims at, cap - margin.
+        net_w = (CAP_W - ctl.peak_margin_w
+                 + want_floor_w * remaining / QUARTER_S)
         for i in range(0, span + 1, 5):
             ctl.p1.submit(sample(blk + timedelta(seconds=i), net_w))
         # ⚠️ AND ONE TELEGRAM AT `now` ITSELF. The averager credits a sample's
@@ -1207,23 +1220,36 @@ check("the real cycle files the peak claim and the real arbiter binds the real "
       and not c.peak_guard.saturated and "peak" in (c.reason or ""))
 check("...and the number written to the inverter is the guard's floor",
       hass.writes and near(hass.writes[-1], c.peak_guard.floor_w, 1.5))
-rows = [r for r in c.checks() if "peak guard" in r["text"].lower()]
+rows = [r for r in c.checks() if r.get("id") == "peak_guard"]
 print("    status row: " + (rows[0]["text"] if rows else "(none)"))
 check("the status page carries exactly one peak-guard row, flagged",
       len(rows) == 1 and rows[0]["warn"])
+# UX-08 2d: the engaged row names what the battery is asked for FIRST and the
+# limit SECOND. Both are watts, so only the ordered pair tells them apart.
+from app import messages as _msg_on                               # noqa: E402
+_on = (f"asks the battery for {_msg_on.watts(c.peak_guard.floor_w)} to stay "
+       f"under {_msg_on.watts(c.peak_guard.ceiling_w)}")
+_on_swapped = (f"asks the battery for {_msg_on.watts(c.peak_guard.ceiling_w)} "
+               f"to stay under {_msg_on.watts(c.peak_guard.floor_w)}")
+check("...and it names the battery's share first and the limit second, and "
+      "the two render differently so the swap is visible",
+      len(rows) == 1 and _on in rows[0]["text"]
+      and _on_swapped not in rows[0]["text"]
+      and _msg_on.watts(c.peak_guard.floor_w)
+      != _msg_on.watts(c.peak_guard.ceiling_w))
 check("an engagement that is not saturated raises NO notification - §10.3's "
       "'clamp AND alarm' is SAFETY-03's rule about a BUG SIGNAL, and a house "
       "load bigger than the inverter is not a bug",
       "goodwe_peak_saturated" not in hass.notifications)
 check("...but it does reach the action log, which is where a control action "
       "that moves energy belongs",
-      any("PEAK GUARD" in e for e in c.events))
-n_events = sum(1 for e in c.events if "PEAK GUARD" in e)
+      any("PEAK_GUARD" in e for e in c.events))
+n_events = sum(1 for e in c.events if "PEAK_GUARD" in e)
 asyncio.get_event_loop_policy().new_event_loop().run_until_complete(c.cycle())
 check("...and it is edge-logged, not level-logged: a second engaged cycle adds "
       "no second line, so a quarter of engagement cannot push the cause of the "
       "event off a 40-line log",
-      sum(1 for e in c.events if "PEAK GUARD" in e) == n_events)
+      sum(1 for e in c.events if "PEAK_GUARD" in e) == n_events)
 
 # The saturated case, through the same real cycle.
 # A floor of 1.5x what the inverter can give: it saturates wherever in the
@@ -1234,6 +1260,13 @@ check(f"the saturating fixture ({NET2:.0f} W) is a load the real ingest "
       f"accepts, not one it rejects as implausible", NET2 < PLAUSIBLE_MAX_W)
 print(f"    saturated case: {c2.peak_guard.explain()}")
 check("a load larger than the inverter saturates the guard", c2.peak_guard.saturated)
+# SAFETY-81 review: the alarm must hold ALARM_HOLD_S first. The fixture runs on
+# the wall clock, so the start of the hold is moved back instead of waited out.
+check("...but not on its first cycle: it must hold peakguard.ALARM_HOLD_S "
+      "(SAFETY-81)", hass2.notifications.count("goodwe_peak_saturated") == 0
+      and c2._peak_high_since is not None)
+c2._peak_high_since -= timedelta(seconds=peakguard.ALARM_HOLD_S)
+asyncio.get_event_loop_policy().new_event_loop().run_until_complete(c2.cycle())
 check("...and THAT raises exactly one notification, with its own id - the one "
       "state where the money will be spent and a human is the only remaining "
       "actuator", hass2.notifications.count("goodwe_peak_saturated") == 1)
@@ -1242,7 +1275,7 @@ check("...once per episode, not once per cycle",
       hass2.notifications.count("goodwe_peak_saturated") == 1)
 check("...and the command is still bounded by the rating, so a saturated guard "
       "never asks the hardware for more than it has",
-      abs(hass2.writes[-1]) <= LIVE_MAX_W + 1e-6)
+      bool(hass2.writes) and abs(hass2.writes[-1]) <= LIVE_MAX_W + 1e-6)
 
 # ==============================================================================
 # THE WIRING'S OWN MUTATIONS. Everything above this line grades `peakguard.py`,
@@ -1394,7 +1427,8 @@ check("B3: main.py sizes the floor from the MEASURED battery power, not from "
 # `datetime.now()`. Every number below therefore comes from ONE instant, and the
 # tolerances that used to absorb the wall clock are gone.
 _proj3 = _seen["projection"]
-_kw = dict(cap_w=CAP_W, reading=b3.peak.peak(), achievable_w=LIVE_MAX_W,
+_kw = dict(cap_w=CAP_W, margin_w=b3.peak_margin_w, reading=b3.peak.peak(),
+           achievable_w=LIVE_MAX_W,
            max_hold_s=b3.p1.averager.max_hold_s, soc=SOC_OK,
            soc_floor=SOC_FLOOR)
 _intent = _shipped_decide(_proj3, batt_w=STANDING, **_kw)
@@ -1439,7 +1473,7 @@ check("...and the consequence is the wind-up part 1 demonstrates, now on the "
       "REAL controller's own projection: the intent-sized floor re-adds its own "
       "unmet ask every cycle and reaches the rail SATURATED, while the "
       "delivered-power floor does not move at all",
-      _i_sat_at is not None and _i_track[-1] > _i_track[0]
+      _i_sat_at is not None and len(_i_track) > 1 and _i_track[-1] > _i_track[0]
       and len({f"{v:.3f}" for v in _d_track}) == 1
       and not b3.peak_guard.saturated)
 # Graded on the parsed call syntax too, so a rename cannot quietly reintroduce
@@ -1456,9 +1490,9 @@ _peak_calls = [n for n in ast.walk(ast.parse(_mainsrc))
                and n.func.attr == "decide"
                and isinstance(n.func.value, ast.Name)
                and n.func.value.id == "peakguard"]
-_call = _peak_calls[0]
-_batt_src = ast.unparse(next(k.value for k in _call.keywords if k.arg == "batt_w"))
-_soc_src = ast.unparse(next(k.value for k in _call.keywords if k.arg == "soc"))
+_call = nth(_peak_calls, 0, "peakguard.decide() call in main.py")
+_batt_src = _src(first(k.value for k in _call.keywords if k.arg == "batt_w"))
+_soc_src = _src(first(k.value for k in _call.keywords if k.arg == "soc"))
 print(f"    main.py's decide(batt_w=...) is `{_batt_src}`, decide(soc=...) is "
       f"`{_soc_src}`")
 check("...and the call site says so in the source: the argument is the measured "
@@ -1497,8 +1531,8 @@ check(f"...and main.py has exactly ONE `peakguard.decide(` call site (it has "
 # no fixture separated them - which is exactly the coupling the card forbids and
 # exactly the kind of survivor a value-based check cannot see. This grades the
 # NAME, and part 9 below now also separates them behaviourally.
-_floor_src = ast.unparse(next(k.value for k in _call.keywords
-                              if k.arg == "soc_floor")).replace("'", '"')
+_floor_src = _src(first(k.value for k in _call.keywords
+                         if k.arg == "soc_floor")).replace("'", '"')
 print(f"    main.py's decide(soc_floor=...) is `{_floor_src}`")
 check("...and the floor comes from `peak_soc_floor`, defaulted from the ONE "
       "mirror - not from `maintenance_soc_floor` (a drain target, not a spend "
@@ -1531,12 +1565,14 @@ check("SAFETY-24 adds exactly the two keys it names and no more: §14's kW/W "
       "trap `capacity_peak_limit_kw` stays declined, and no speculative "
       "`peak_guard`/`peak_shave` block appeared beside it",
       _peak_keys == []
-      and sorted(PEAK_OPTION_DEFAULTS) == ["bms_soc_floor", "peak_soc_floor"])
+      and sorted(PEAK_OPTION_DEFAULTS) == ["bms_soc_floor", "peak_margin_w",
+                                           "peak_soc_floor"])   # + SAFETY-79
 # Graded on the parsed call syntax, not on the text: the module docstring names
 # `peak_cap_w` while arguing that it does not read it, so a grep would be
 # satisfied by deleting the explanation and would fail on writing one.
-_decide = next(n for n in ast.walk(ast.parse(src))
-               if isinstance(n, ast.FunctionDef) and n.name == "decide")
+_decide = first((n for n in ast.walk(ast.parse(src))
+                 if isinstance(n, ast.FunctionDef) and n.name == "decide"),
+                "def decide in peakguard.py")
 _DECIDE_ARGS = [a.arg for a in _decide.args.args + _decide.args.kwonlyargs]
 _getters = [n for n in ast.walk(ast.parse(src))
             if isinstance(n, ast.Call) and isinstance(n.func, ast.Attribute)
@@ -1610,13 +1646,13 @@ check("...and the defaulting form that was ACTUALLY shipped once in this "
       discharge_permitted(float(None or 100), SOC_FLOOR) is None)
 
 # --- the decision -----------------------------------------------------------
-d_ok = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_ok = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
               achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK,
               soc_floor=SOC_FLOOR)
-d_lim = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_lim = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                soc=SOC_FLOOR, soc_floor=SOC_FLOOR)
-d_unread = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+d_unread = decide(p_hungry, batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                   achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=None,
                   soc_floor=SOC_FLOOR)
 print(f"    with battery:  {d_ok.explain()}")
@@ -1637,8 +1673,8 @@ check("...and it still says what it WOULD have taken, so the under-shave is a "
       near(d_lim.wanted_w, WANTED, 1e-6) and d_lim.wanted_w > d_lim.floor_w)
 check("...and its one-line explanation tells the operator the consequence in "
       "the words that matter - the quarter is going over the ceiling",
-      "FLOOR-LIMITED" in d_lim.explain()
-      and "WILL GO OVER THE CEILING" in d_lim.explain()
+      "FLOOR_LIMITED" in d_lim.explain()
+      and "will go over the limit" in d_lim.explain()
       and f"{CEIL:.0f} W" in d_lim.explain())
 check("an unreadable SoC lands in the same branch, with the OTHER reason - so "
       "an operator reading one line can tell a flat battery from a dead sensor",
@@ -1658,7 +1694,7 @@ check("floor-limited and saturated are MUTUALLY EXCLUSIVE, by construction: the
 # notification that matters.
 d_quiet = decide(PeakTracker.project(averager_at(500.0, 450.0),
                                      B + timedelta(seconds=450)),
-                 batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+                 batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                  soc=SOC_FLOOR - 5.0, soc_floor=SOC_FLOOR)
 print(f"    an EMPTY pack on a quiet quarter: {d_quiet.explain()}")
@@ -1670,7 +1706,7 @@ check("an empty pack on a quarter that does not need shaving is IDLE, not "
       and d_quiet.floor_w is None)
 # And the BLIND branch is untouched: it never forces a discharge, so there is
 # nothing for an energy floor to bound there.
-d_blind_low = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, reading=None,
+d_blind_low = decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0, reading=None,
                      achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                      soc=SOC_FLOOR - 5.0, soc_floor=SOC_FLOOR, frozen=True)
 check("...and an empty pack does not disturb the BLIND branch either: SAFETY-"
@@ -1727,7 +1763,7 @@ for load in (0.0, CEIL - 500.0, CEIL, CEIL + 300.0, CEIL + 3000.0,
         for bw in (-2000.0, 0.0, 400.0, 4000.0):
             for sc in (None, 0.0, BMS_FLOOR, SOC_FLOOR, SOC_FLOOR + 0.5, 100.0):
                 for fl in (SOC_FLOOR, BMS_FLOOR + 1.0, 55.0):
-                    _d = decide(_pr, batt_w=bw, cap_w=CAP_W, reading=None,
+                    _d = decide(_pr, batt_w=bw, cap_w=CAP_W, margin_w=0.0, reading=None,
                                 achievable_w=LIVE_MAX_W,
                                 max_hold_s=MAX_HOLD_S, soc=sc, soc_floor=fl)
                     SWEEP_N += 1
@@ -1774,8 +1810,8 @@ check("`soc` and `soc_floor` are REQUIRED keyword-only arguments of decide() "
       "with no default. A default on either is TEST-14's exact shape and would "
       "be the quiet fallback this card exists to remove - and a default on "
       "`soc_floor` would additionally be CFG-03's fourth defaults site",
-      _required_kw == {"batt_w", "cap_w", "reading", "achievable_w", "soc",
-                       "soc_floor"})
+      _required_kw == {"batt_w", "cap_w", "margin_w", "reading",
+                       "achievable_w", "soc", "soc_floor"})
 _req_fields = tuple(f.name for f in dataclasses.fields(PeakDecision)
                     if f.default is dataclasses.MISSING
                     and f.default_factory is dataclasses.MISSING)
@@ -1914,17 +1950,17 @@ asyncio.get_event_loop_policy().new_event_loop().run_until_complete(c24.cycle())
 check("...once per episode, not once per cycle - a quarter of an hour of "
       "identical cards is how an operator learns to dismiss the one that "
       "mattered", hass24.notifications.count("goodwe_peak_soc_floor") == 1)
-rows24 = [r for r in c24.checks() if "peak guard" in r["text"].lower()]
+rows24 = [r for r in c24.checks() if r.get("id") == "peak_guard"]
 print("    status row: " + (rows24[0]["text"] if rows24 else "(none)"))
 check("the status page carries exactly one peak-guard row and it is NOT ok - "
       "the money is going to be spent and a human is the only actuator left",
-      len(rows24) == 1 and not rows24[0]["ok"]
-      and "FLOOR-LIMITED" in rows24[0]["text"])
-check("...and it reaches the action log too", any("FLOOR-LIMITED" in e
+      len(rows24) == 1 and not rows24[0]["ok"] and not rows24[0]["warn"]
+      and "peak limit will be passed" in rows24[0]["text"])
+check("...and it reaches the action log too", any("FLOOR_LIMITED" in e
                                                   for e in c24.events))
 # A missing SoC sensor, through the same real cycle. `inputs_ok` stops the loop
 # at 0 W in that state, so the guard's own answer is what is graded here.
-d_nosoc = decide(p_hungry, batt_w=0.0, cap_w=CAP_W, reading=None,
+d_nosoc = decide(p_hungry, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                  soc=None, soc_floor=SOC_FLOOR)
 check("decide() handed soc=None answers floor-limited rather than a full "
@@ -2008,11 +2044,13 @@ check("...and so is a floor EXACTLY AT it, which is the interesting case: equal
       "it leaves none", len(equal) == 1)
 check("...while one point above is accepted, so this refuses the disarmed case "
       "only and not 'close to the limit'", above == [])
-check("...and the refusal NAMES BOTH NUMBERS and the shipped default, so the "
-      "operator can act on it without reading the source",
-      f"{BMS_FLOOR:.0f} %" in below[0]
-      and f"{BMS_FLOOR - 5:.0f} %" in below[0]
-      and f"{PEAK_OPTION_DEFAULTS['peak_soc_floor']:.0f} %" in below[0])
+# UX-08 2c: the shipped default left the sentence (it is on the option's
+# description). The two numbers the operator acts on stay.
+check("...and the refusal NAMES BOTH NUMBERS, so the operator can act on it "
+      "without reading the source",
+      len(below) == 1
+      and f"{BMS_FLOOR:.0f} %" in below[0]
+      and f"{BMS_FLOOR - 5:.0f} %" in below[0])
 check("...and a non-numeric floor is refused rather than defaulted, for the "
       "reason every read in this file is: a value that cannot be parsed is not "
       "an observation of anything",
@@ -2200,7 +2238,7 @@ def replay_loop(window, *, start_soc, soc_floor, usable_wh=REF_PACK_WH):
         next_cycle = t + timedelta(seconds=CYCLE_S)
         cycles += 1
         d = decide(PeakTracker.project(ing.averager, t), batt_w=batt,
-                   cap_w=CAP_W, reading=tracker.peak(t),
+                   cap_w=CAP_W, margin_w=0.0, reading=tracker.peak(t),
                    achievable_w=LOOP_MAX_W, max_hold_s=MAX_HOLD_S, soc=soc,
                    soc_floor=soc_floor, frozen=False)
         dec = compute(prev_w, w - batt, batt, LOOP_TUNING, sat_count=sat,
@@ -2245,7 +2283,7 @@ def replay_loop(window, *, start_soc, soc_floor, usable_wh=REF_PACK_WH):
 # measuring something else.
 EVE = evening(19, 24)
 EVE_W = [w for _, w in EVE]
-print(f"    the evening of 2026-08-20, {EVE[0][0]:%H:%M}-{EVE[-1][0]:%H:%M} UTC: "
+print(f"    the evening of 2026-08-20, {nth(EVE, 0)[0]:%H:%M}-{nth(EVE, -1)[0]:%H:%M} UTC: "
       f"{len(EVE)} telegrams, mean {sum(EVE_W) / len(EVE_W):.0f} W, "
       f"min {min(EVE_W):.0f} W, max {max(EVE_W):.0f} W")
 check("the window really is a SUSTAINED-LOAD evening and not a quiet one - "
@@ -2324,7 +2362,7 @@ check("...and the sweep spans the whole schema range, rule 8's refused low end "
 HOT = evening(15, 17)
 HOT_R = replay_loop(HOT, start_soc=SOC_FLOOR - 1.0, soc_floor=SOC_FLOOR)
 print(f"    the same day's high-load block "
-      f"{HOT[0][0]:%H:%M}-{HOT[-1][0]:%H:%M} UTC, pack started one point BELOW "
+      f"{nth(HOT, 0)[0]:%H:%M}-{nth(HOT, -1)[0]:%H:%M} UTC, pack started one point BELOW "
       f"the floor:")
 print(f"      {HOT_R['limited']} cycles reporting PEAK GUARD FLOOR-LIMITED, "
       f"{HOT_R['limited_discharging']} of them with the loop simultaneously "
@@ -2470,17 +2508,23 @@ check("...and DOCS.md sends the reader to it rather than leaving the open "
 # comment is a scope sentence the operator never sees.
 c25, hass25, NET25, _ = wired_over_limit(
     TMP / "soc25.db", LIVE_MAX_W * 0.3, soc=SOC_FLOOR - 1.0)
-rows25 = [r for r in c25.checks() if "peak guard" in r["text"].lower()]
+rows25 = [r for r in c25.checks() if r.get("id") == "peak_guard"]
+
+
+def _row_scope(text):
+    """SAFETY-25 in messages.row_peak_reserve()'s words."""
+    return ("Home use still draws the battery below it" in text
+            and "down to the cut-out level" in text)
+
+
 print("    status row: " + (rows25[0]["text"] if rows25 else "(none)"))
 check("the STATUS PAGE row for a floor-limited guard says the floor bounds the "
       "guard only and that self-consumption may keep discharging below it. "
       "Without that sentence the page implies a pack-wide reserve at the exact "
       "moment the replay above says the loop is still emptying the pack",
       len(rows25) == 1
-      and "PEAK GUARD FLOOR-LIMITED" in rows25[0]["text"]
-      and "BOUNDS THE PEAK GUARD ONLY" in rows25[0]["text"].upper()
-      and "not a pack-wide reserve" in rows25[0]["text"]
-      and "BMS cut-out" in rows25[0]["text"])
+      and "at its peak reserve" in rows25[0]["text"]
+      and _row_scope(rows25[0]["text"]))
 # ⚠️ THE ROW KEEPS THE WHOLE SENTENCE; THE BANNER DOES NOT. status_payload()
 # renders the first not-ok/not-warn row as the page headline, so before this the
 # loudest element on the page was the same 550-character paragraph the row three
@@ -2492,33 +2536,42 @@ print(f"    banner ({len(_pay25['banner'])} chars): {_pay25['banner']}")
 # The guard's own line, which the banner has always carried and which is not
 # this card's to shorten: `explain()` is SAFETY-24's sentence about a quarter
 # that is going over the ceiling.
-_expl25 = rows25[0]["text"].split(". NOTE:")[0]
-check("the NOT READY banner is the guard's own line plus a SHORT scope tag - "
-      "under 90 characters of it - and NOT the row's whole paragraph repeated "
-      "at the top of the page. A headline that is a paragraph is a headline "
-      "nobody reads, and this one is followed three lines later by the same "
-      "text verbatim",
+# UX-08: the banner is the notification's own title, and the row below keeps
+# the SAFETY-25 sentence.
+# SAFETY-87: control goes on while the guard is floor-limited, so the banner
+# does not say "Not ready". This fixture also has a row that does stop control
+# (no SoC entity), which outranks it; the peak row alone is graded below.
+c25.checks = lambda: rows25
+_pay25 = c25.status_payload()
+del c25.checks
+print(f"    banner, peak row alone: {_pay25['banner']}")
+check("the banner is a short headline - the notification's title, without "
+      "'Not ready' (control goes on) - and NOT the row repeated at the top of "
+      "the page. A headline that is a paragraph is a headline nobody reads",
       _pay25["level"] == "bad"
-      and _pay25["banner"].startswith("NOT READY")
-      and _expl25 in _pay25["banner"]
-      and "BOUNDS THE PEAK GUARD ONLY" in _pay25["banner"].upper()
-      and "not a pack-wide reserve" not in _pay25["banner"]
-      and len(_pay25["banner"]) - len(_expl25) < 90)
-check("...and shortening the banner did NOT shorten the row: the full AC 3 "
+      and _pay25["banner"] == messages.T_PEAK_RESERVE
+      and not _row_scope(_pay25["banner"]))
+check("...and shortening the banner did NOT shorten the row: the SAFETY-25 "
       "sentence is still what the checks list carries, which is the surface the "
-      "operator reads to find out what the floor does not bound",
-      len(rows25[0]["text"]) > 300
-      and "not a pack-wide reserve" in rows25[0]["text"]
-      and "BMS cut-out" in rows25[0]["text"])
+      "operator reads to find out what the reserve does not bound",
+      len(rows25) == 1 and _row_scope(rows25[0]["text"]))
 
 _body25 = hass25.last_message("goodwe_peak_soc_floor")
+
+
+def _says_scope(body):
+    """SAFETY-25 in messages.peak_reserve()'s words: the reserve binds the peak
+    guard only, and home use goes on discharging below it to the cut-out."""
+    return ("The reserve only applies to keeping the peak down" in body
+            and "normal home use can still draw the battery below it" in body
+            and "down to the battery cut-out level" in body)
+
+
 print(f"    notification body tail: ...{_body25[-180:]}")
 check("...and so does the persistent notification, which outlives the page and "
       "is the thing an operator reads on a phone at 19:00. It names what has "
       "stopped - the guard buying a lower bill - and what has not",
-      "peak_soc_floor bounds THE PEAK GUARD ONLY" in _body25
-      and "not a" in _body25 and "pack-wide reserve" in _body25
-      and "BMS cut-out" in _body25)
+      _says_scope(_body25))
 
 
 # --- 10f. THE CLAIM-SOURCE SET, PINNED --------------------------------------
@@ -2618,21 +2671,52 @@ check("...and so does the persistent notification, which outlives the page and "
 #
 # If you are here because you added a TWELFTH, that argument is what this line
 # wants from you, not an edit.
+# ⚠️ SAFETY-73 ADDED `refused` (a P_SAFETY unit limit on a measured refusal).
+# ⚠️ OPT-11 ADDED `mode`, ON PURPOSE, AND IT IS NOT THE DEFERRED RESERVE EITHER.
+# `mode` is `Claim.limit("mode", P_MODE, lo, hi)` on ONE inverter's actuator:
+# the owner's per-battery choice (on/off, Solar first, Leftover solar), filed
+# only with `battery_modes_enabled` on (default off). It is not conditioned on
+# a state of charge, and it cannot bound the site against the peak floor:
+#   1. stage 1 keeps it APART from the hard limits (UnitBounds.mode_*), so it
+#      never enters a `lo > hi` test, not even the unit's own;
+#   2. stage 3 applies it only while the site target was decided at or below
+#      P_MODE (35), so the guard's floor (P_PEAK, 50) RELEASES it, and at N=1
+#      `resolve()` applies it to the site by the same rule, after stage 2;
+#   3. its range always holds 0 W, so it can forbid a direction and never
+#      force one (a range without 0 is dropped as a software fault).
+# test_arbiter.py part 9 grades the no-contradiction claim at N=2, over 625
+# cycles with the floor, and part 10 at N=1. The sweeps below never reach it:
+# their fixtures leave battery modes off, so they still see {device,
+# supervised, loop}. DECISIONS/OPT-11-battery-modes.md.
+# ⚠️ SAFETY-78 ADDED `drain`, AND IT IS NOT THE DEFERRED RESERVE. It is a
+# site `lo` at P_MAINTENANCE, filed only at N>=2 while a pack's maintenance
+# drain is pinned, equal to what that pin places. It is not conditioned on a
+# state of charge, it never closes discharge (a `lo`, not a `hi`), and it is
+# never filed at N=1, so the sweeps below still see {device, supervised,
+# loop}. DECISIONS/SAFETY-78-drain-at-two.md.
+# ⚠️ SAFETY-84 ADDED `charge`, ITS MIRROR, AND IT IS NOT THE RESERVE EITHER. A
+# site `hi` at P_MAINT_SHAPE, filed only at N>=2 while a pack's cheap-window
+# maintenance charge makes it charge, equal to that pack's own `hi`. Never at
+# N=1. DECISIONS/SAFETY-84-charge-at-two.md.
+# SAFETY-86 added `hold`: a site `hi` at the peak floor while a holding pack
+# gives at N>=2. Not a reserve either. DECISIONS/SAFETY-86-peak-over-hold.md.
 CLAIM_SOURCES = {"device", "supervised", "failsafe", "safety", "peak",
                  "arbitrage", "maintenance", "loop", "circulation",
-                 "sign_site", "pack"}
+                 "sign_site", "pack", "refused", "mode", "drain", "charge",
+                 "hold"}
 # The two appends that file a claim BUILT ELSEWHERE in the method. Named here so
 # that a THIRD such indirection reads as an unrecognised append rather than as a
 # silent gap in the scan.
 CLAIM_BUILDERS = {"peak_claim": "peak", "arb_claim": "arbitrage"}
 
 _main_tree = ast.parse((HERE / "app" / "main.py").read_text(encoding="utf-8"))
-_cycle_def = next(
+_cycle_def = first((
     f
     for cls in ast.walk(_main_tree)
     if isinstance(cls, ast.ClassDef) and cls.name == "Controller"
     for f in cls.body
-    if isinstance(f, (ast.FunctionDef, ast.AsyncFunctionDef)) and f.name == "cycle")
+    if isinstance(f, (ast.FunctionDef, ast.AsyncFunctionDef)) and f.name == "cycle"),
+    "Controller.cycle in main.py")
 
 
 def claim_source(node):
@@ -2661,7 +2745,7 @@ check("every `claims.append(...)` in main.py's cycle is one this scan can READ "
       "- a claim filed through a shape it cannot parse has to fail here rather "
       "than be counted as nothing, which is how a scan like this goes quietly "
       "vacuous", len(_appends) >= 10 and None not in _filed)
-check("...and the sources that cycle can file are EXACTLY these ELEVEN. THIS "
+check("...and the sources that cycle can file are EXACTLY these SIXTEEN. THIS "
       "is what makes part 10 a tripwire: replay_loop() hand-builds the claim "
       "list, so it cannot see a claim main.py adds - and a loop-side SoC "
       "reserve is a new source. Filing one takes this line red on the line it "
@@ -2801,7 +2885,7 @@ print("    site: " + ", ".join(sorted(s for s, v in CLAIM_SCOPE.items()
       + "  |  per-inverter: "
       + ", ".join(sorted(s for s, v in CLAIM_SCOPE.items() if v == SCOPE_UNIT)))
 check("...and the split is the one ARB-03 argued, with SAFETY-31's and "
-      "SAFETY-30's and OPT-09's additions: the six about the GRID CONNECTION "
+      "SAFETY-30's, OPT-09's, SAFETY-78's, SAFETY-84's and SAFETY-86's additions: the nine about the GRID CONNECTION "
       "are site claims and the five about a pack, a device or one write are "
       "per-inverter. `circulation` is a site claim because its quantity is "
       "defined over the roster and is identically zero for any one unit; "
@@ -2810,9 +2894,11 @@ check("...and the split is the one ARB-03 argued, with SAFETY-31's and "
       "per-inverter because since SAFETY-30 it grades one unit's command "
       "against that unit's OWN measured power",
       {s for s, v in CLAIM_SCOPE.items() if v == SCOPE_SITE}
-      == {"loop", "peak", "arbitrage", "safety", "circulation", "sign_site"}
+      == {"loop", "peak", "arbitrage", "safety", "circulation", "sign_site",
+          "drain", "charge", "hold"}
       and {s for s, v in CLAIM_SCOPE.items() if v == SCOPE_UNIT}
-      == {"device", "supervised", "failsafe", "maintenance", "pack"})
+      == {"device", "supervised", "failsafe", "maintenance", "pack",
+          "refused", "mode"})
 
 # The shipped roster is ONE inverter, so §6.2's identity holds and every claim a
 # real cycle files is a site claim. Observed on the claims main.py's own resolve
@@ -2909,10 +2995,13 @@ check("⚠️ AND THIS IS THE BREAKING HALF. Give the same Controller a second "
       "rest of the roster goes on pushing the same way - and this line goes red",
       _routed == {"device": "inverter-a", "supervised": "inverter-a",
                   "failsafe": "inverter-a", "maintenance": "inverter-a",
-                  "pack": "inverter-a",
+                  "pack": "inverter-a", "refused": "inverter-a",
+                  "mode": "inverter-a",
                   "loop": ACTUATOR_SITE, "peak": ACTUATOR_SITE,
                   "arbitrage": ACTUATOR_SITE, "safety": ACTUATOR_SITE,
-                  "circulation": ACTUATOR_SITE, "sign_site": ACTUATOR_SITE})
+                  "circulation": ACTUATOR_SITE, "sign_site": ACTUATOR_SITE,
+                  "drain": ACTUATOR_SITE, "charge": ACTUATOR_SITE,
+                  "hold": ACTUATOR_SITE})
 check("...and the roster it was restored to is the shipped one, so nothing "
       "below inherits a two-inverter Controller",
       c_src.units == (app_main.UNIT_A,) and len(c_src.inverters) == 1)
@@ -2957,9 +3046,7 @@ def append_actuator(node):
     dynamic check in this file is blind to the swap at N=1.
     """
     kw = [k for k in node.keywords if k.arg == "actuator"]
-    if len(kw) != 1:
-        return None
-    return ast.unparse(kw[0].value)
+    return ast.unparse(kw[0].value) if len(kw) == 1 else None
 
 
 # The appends that BUILD their claim in place - the nine whose routing is
@@ -2993,13 +3080,13 @@ _unit_sources_unrouted = [
     if CLAIM_SCOPE.get(r[0]) == SCOPE_UNIT and "," not in r[1]]
 print(f"    {len(_direct)} direct appends, each read at its own line: "
       + ", ".join(f"main.py:{ln} {s} -> {a}" for s, a, ln in _routing))
-check("all ELEVEN of `Controller.cycle()`'s DIRECT appends route through "
+check("all SEVENTEEN of `Controller.cycle()`'s DIRECT appends route through "
       "`self.actuator_of(<string literal>)`, so this scan can read the routing "
       "of EVERY one of them. An append that computed its actuator, or omitted "
       "the argument, or hand-wrote a string, fails HERE rather than being "
       "silently skipped - which is how a scan like this goes quietly vacuous, "
       "and 10f is in this file because that already happened once",
-      len(_direct) == 11
+      len(_direct) == 17
       and all(a is not None and a.startswith("self.actuator_of('")
               for _s, a, _ln in _routing))
 check("⚠️ AND AT EVERY ONE OF THE ELEVEN THE LITERAL IT ROUTES THROUGH IS THE "
@@ -3016,15 +3103,15 @@ check("⚠️ AND EVERY PER-INVERTER APPEND NAMES THE INVERTER IT IS ABOUT. "
       "site-scoped sources and is the whole defect for a per-inverter one: a "
       "`device` limit built inside the roster loop and routed without `inv` "
       "files inverter B's rating on inverter A, where it binds the wrong "
-      "share. Six of the eleven appends are SCOPE_UNIT - `device`, "
-      "`supervised`, `failsafe`, maintenance's two and OPT-09's `pack` - and "
-      "all six pass one. "
+      "share. Nine of the sixteen appends are SCOPE_UNIT - `device`, "
+      "`supervised`, `failsafe`, maintenance's two, OPT-09's `pack`, "
+      "SAFETY-73's two `refused` and OPT-11's `mode` - and all nine pass one. "
       "SAFETY-30's `sign_site` is deliberately NOT one of them: it is filed on "
       "the site, beside `circulation`, because the number that tripped it is "
       "the site target",
       _unit_sources_unrouted == []
       and len([r for r in _routing
-               if CLAIM_SCOPE.get(r[0]) == SCOPE_UNIT]) == 6)
+               if CLAIM_SCOPE.get(r[0]) == SCOPE_UNIT]) == 9)
 check("...and the only appends this pin does NOT reach are the two that file a "
       "claim BUILT ELSEWHERE - `peak_claim` and `arb_claim` - which have no "
       "`actuator=` at the call site to mis-type. Their routing is pinned where "
@@ -3033,7 +3120,8 @@ check("...and the only appends this pin does NOT reach are the two that file a "
       "arbitrage.claim() by test_arbitrage.py",
       sorted(_indirect) == sorted(CLAIM_BUILDERS)
       and len(_direct) + len(_indirect) == len(_appends))
-check("...and between them the twelve appends account for exactly the eleven "
+check("...and between them the nineteen appends account for exactly the "
+      "sixteen "
       "sources 10f pins, so the routing pin and the source set are one scan "
       "and neither can drift from the other",
       {s for s, _a, _ln in _routing} | set(CLAIM_BUILDERS.values())
@@ -3085,7 +3173,7 @@ check("⚠️ AND THE RATING LIMITS ARE FILED ONCE PER INVERTER, ON ITS OWN "
           ("supervised", "inverter-a"),
           ("supervised", "inverter-b")])
 check("...and naming those three is not an accident of this fixture but the "
-      "reason the static pin exists - SEVEN of the eleven sources need a state "
+      "reason the static pin exists - EIGHT of the twelve sources need a state "
       "no check in this file reaches. SAFETY-31's `circulation` is one of the "
       "seven: it is filed only while the site is MEASURED to be circulating, "
       "which no fixture here is. SAFETY-30's `sign_site` is another, and it "
@@ -3093,7 +3181,8 @@ check("...and naming those three is not an accident of this fixture but the "
       "standing opposed to the meter for its whole window",
       {c.source for c in _cl2}
       == CLAIM_SOURCES - {"failsafe", "safety", "maintenance", "peak",
-                          "arbitrage", "circulation", "sign_site"})
+                          "arbitrage", "circulation", "sign_site",
+                          "refused", "mode", "drain", "charge", "hold"})
 # ⚠️ AND NOW THE HALF THAT WAS EVIDENCE-SHAPED AND OBSERVED NOTHING. The three
 # checks above grade WHICH ACTUATOR each claim lands on. They say nothing about
 # WHOSE NUMBERS the bound is built from - and those are two different defects
@@ -3874,13 +3963,12 @@ check("⚠️ AC 3. Rule 8 grades EVERY unit: a roster whose SECOND pack has a "
       "inverter-b. Under the flat key this config STARTED, and the guard would "
       "then have commanded a forced discharge that pack B's BMS - not the "
       "operator's floor - is the thing that stops",
-      len(_r_second) == 1 and "(inverter-b)" in _msg(_r_second)
-      and "(inverter-a)" not in _msg(_r_second))
-check("...and it names BOTH numbers and the shipped default, so the operator "
-      "can act on it without reading the source",
+      len(_r_second) == 1 and " for inverter-b" in _msg(_r_second)
+      and " for inverter-a" not in _msg(_r_second))
+check("...and it names BOTH numbers, so the operator can act on it without "
+      "reading the source",
       f"{B_PACK_FLOOR_DEEP_SIM:.0f} %" in _msg(_r_second)
-      and f"{SOC_FLOOR:.0f} %" in _msg(_r_second)
-      and f"{PEAK_OPTION_DEFAULTS['peak_soc_floor']:.0f} %" in _msg(_r_second))
+      and f"{SOC_FLOOR:.0f} %" in _msg(_r_second))
 # The mirror. A grader hardwired to index 1 - or one that reports the LAST
 # offender - passes the check above and fails this one.
 _r_first = rule8(validate_startup_config(
@@ -3888,8 +3976,8 @@ _r_first = rule8(validate_startup_config(
 check("...and with the SAME two numbers in the OTHER ORDER it names "
       "inverter-a instead. The pair of checks is what makes this an index "
       "check: one of them goes red for any hardwired position",
-      len(_r_first) == 1 and "(inverter-a)" in _msg(_r_first)
-      and "(inverter-b)" not in _msg(_r_first))
+      len(_r_first) == 1 and " for inverter-a" in _msg(_r_first)
+      and " for inverter-b" not in _msg(_r_first))
 # And both at once, because a loop that `break`s on the first offender reports
 # one refusal for a config with two.
 _r_both = rule8(validate_startup_config(
@@ -3897,8 +3985,8 @@ _r_both = rule8(validate_startup_config(
 check("...and a roster where BOTH packs offend is refused TWICE, once per unit "
       "and each naming its own - so an operator with two wrong packs is not "
       "told about one of them and left to discover the other on the next boot",
-      len(_r_both) == 2 and "(inverter-a)" in _msg(_r_both, 0)
-      and "(inverter-b)" in _msg(_r_both, 1))
+      len(_r_both) == 2 and " for inverter-a" in _msg(_r_both, 0)
+      and " for inverter-b" in _msg(_r_both, 1))
 # A missing per-entry cut-out is refused BY NAME rather than defaulted.
 _r_missing = rule8(validate_startup_config(_roster32(A_PACK_FLOOR, None)))
 print(f"    entry with no bms_soc_floor -> {_msg(_r_missing)[:120] or '(none)'}...")
@@ -3907,7 +3995,7 @@ check("...and an entry that states NO `bms_soc_floor` is refused by name rather
       "cut-out this add-on invented for a battery it has not been told about, "
       "which is the same wrong number the flat key produced. See "
       "DECISIONS/SAFETY-32-per-pack-bms-floor.md",
-      len(_r_missing) == 1 and "(inverter-b)" in _msg(_r_missing)
+      len(_r_missing) == 1 and " for inverter-b" in _msg(_r_missing)
       and "must both be numbers" in _msg(_r_missing))
 
 # --- 12f. nothing is inherited, with the flat key SET AND DIFFERENT ----------
@@ -3959,8 +4047,8 @@ check("...and with the key absent entirely the one pack takes the SHIPPED "
 # the floor comes from is a claim genuinely about the code's shape and is pinned
 # on the source in part 4, where it already lives; what is graded here is the
 # VALUE that reaches `decide()`.
-_floor_call = ast.unparse(next(k.value for k in _call.keywords
-                               if k.arg == "soc_floor"))
+_floor_call = _src(first(k.value for k in _call.keywords
+                          if k.arg == "soc_floor"))
 print(f"    main.py's decide(soc_floor=...) is `{_floor_call}`")
 
 
@@ -4058,18 +4146,22 @@ check("⚠️ ...AND THE SAME PAIR SWAPPED GIVES THE SAME SITE FLOOR, so no "
       and _g_deepa.soc_floor != _g_shallow.soc_floor
       and [pk.bms_floor for pk in _g_ctl_deepa.packs]
       == [B_PACK_FLOOR_DEEP_SIM, B_PACK_FLOOR_SIM])
-check("...and it is not just a number in a report - THE SITE'S VERDICT FLIPS. "
-      "With both packs at 25 % the shallow site is permitted and the guard "
-      "sizes a positive forced discharge; BOTH deep sites are FLOOR-LIMITED, "
-      "because 25 % is at or below the 35 % cut-out wherever on the roster it "
-      "sits. Grading the roster against one position would spend a pack its "
-      "BMS stops - through `sim/inject.py`, which does not run rule 8 - and "
-      "this line is what goes red when it does",
+# SAFETY-87 changed what the verdict is at N>=2: the pack at or under its own
+# floor is HELD (named, gives nothing for the peak) and the others still shave.
+check("...and it is not just a number in a report - THE HELD PACK FOLLOWS IT. "
+      "With both packs at 25 % the shallow site holds nobody back; on BOTH deep "
+      "sites the pack whose 35 % cut-out is at or above 25 % is held, wherever "
+      "it sits, gives nothing for the peak (weight 0), and the other pack "
+      "carries a positive floor (SAFETY-87). Holding a position instead of "
+      "the pack would spend a pack its BMS stops",
       _g_shallow.floor_limited is False and _g_shallow.floor_w > 0.0
-      and _g_deep.floor_limited is True and _g_deep.floor_w == 0.0
-      and _g_deep.soc_floor_reason == FLOOR_AT_SOC_FLOOR
-      and _g_deepa.floor_limited is True and _g_deepa.floor_w == 0.0
-      and _g_deepa.soc_floor_reason == FLOOR_AT_SOC_FLOOR)
+      and _g_shallow.held == ()
+      and _g_deep.floor_limited is False and _g_deep.floor_w > 0.0
+      and _g_deep.held == ("inverter-b",)
+      and _g_ctl_deep._peak_reserve() == {"inverter-b"}
+      and _g_deepa.floor_limited is False and _g_deepa.floor_w > 0.0
+      and _g_deepa.held == ("inverter-a",)
+      and _g_ctl_deepa._peak_reserve() == {"inverter-a"})
 check("...and the precondition that makes the three runs comparable (habit 1): "
       "the two deep runs carry THE SAME PAIR of cut-outs in opposite orders, "
       "those two numbers really are different, and all six packs are at the "
@@ -4140,14 +4232,14 @@ check("⚠️ THE POSITIONAL PIN, AND IT NEEDS THREE PACKS TO EXIST. On a roster
               for r in _g3_runs)
       and [[pk.bms_floor for pk in r[2].packs] for r in _g3_runs]
       == [r[1] for r in _g3_runs])
-check("...and the VERDICT flips with it, on all three: 25 % is at or below the "
-      "35 % cut-out wherever it sits, so every one of these sites is "
-      "FLOOR-LIMITED and sizes no forced discharge at all - where the "
-      "all-shallow two-pack baseline above was permitted and sized a positive "
-      "one. A slice that dropped the deep position would spend, through "
-      "`sim/inject.py`, a pack its BMS stops",
-      all(r[3].floor_limited is True and r[3].floor_w == 0.0
-          and r[3].soc_floor_reason == FLOOR_AT_SOC_FLOOR for r in _g3_runs)
+check("...and the HELD pack follows it, on all three (SAFETY-87): 25 % is at "
+      "or below the 35 % cut-out wherever it sits, so that pack and only that "
+      "pack is held and gives nothing for the peak, while the two others carry "
+      "a positive floor. A slice that dropped the deep position would spend, "
+      "through `sim/inject.py`, a pack its BMS stops",
+      all(r[3].floor_limited is False and r[3].floor_w > 0.0
+          and r[3].held == (r[2].inverters[r[1].index(_G3_DEEP_SIM)].name,)
+          and r[2]._peak_reserve() == set(r[3].held) for r in _g3_runs)
       and _g_shallow.floor_limited is False and _g_shallow.floor_w > 0.0)
 check("...and the precondition that makes the three comparable (habit 1): every "
       "pack in all three rosters is at the SAME state of charge, so neither the "
@@ -4243,12 +4335,12 @@ check("...and the baseline the table is measured against is the shipped call "
 # rewritten as `self.inverters[:2]` leaves this expression identical, and it is
 # the three-pack runs' `len(ctl.packs) == 3` that goes red on it. And it cannot
 # see the reduction INSIDE `binding_soc_floor()` at all; that is 12c2's.
-_floor_node = next(k.value for k in _call.keywords if k.arg == "soc_floor")
+_floor_node = first(k.value for k in _call.keywords if k.arg == "soc_floor")
 _floor_roster_arg = (_floor_node.args[0]
                      if isinstance(_floor_node, ast.Call) and _floor_node.args
                      else None)
 print(f"    the ROSTER argument main.py reduces is "
-      f"`{ast.unparse(_floor_roster_arg)}`, an AST "
+      f"`{_src(_floor_roster_arg)}`, an AST "
       f"{type(_floor_roster_arg).__name__}")
 check("⚠️ THE STRUCTURAL HALF, AND IT IS EXACT RATHER THAN A SUBSTRING. The "
       "roster handed to `binding_soc_floor()` is the WHOLE property "
@@ -4305,12 +4397,18 @@ async def _notify32(packs_socs, floors):
     inv_b, _ = second_inverter(ctl)
     for inv, so, fl in zip(ctl.inverters, packs_socs, floors):
         inv.soc, inv.bms_soc_floor = so, fl
-    ctl.peak_guard = PeakDecision(
+        # SAFETY-87: the full pack refuses to give (SAFETY-73), so no battery
+        # can carry the peak and the alarm still fires; it names the held one.
+        inv.refused = 1 if so > SOC_FLOOR else 0
+    _idle = [types.SimpleNamespace(phase="idle", owns_setpoint=False,
+                                   setpoint_w=None)] * 2
+    ctl.peak_guard = ctl._peak_on_able(PeakDecision(
         engaged=True, floor_w=0.0, ceiling_w=CAP_W, ceiling_from=CEILING_CAP,
         projected_w=CAP_W + 500.0, excess_w=500.0, wanted_w=500.0,
         floor_limited=True, soc=min(packs_socs),
         soc_floor=binding_soc_floor(ctl.packs, SOC_FLOOR),
-        soc_floor_reason=FLOOR_AT_SOC_FLOOR, reason="PEAK GUARD FLOOR-LIMITED: x")
+        soc_floor_reason=FLOOR_AT_SOC_FLOOR, reason="PEAK GUARD FLOOR-LIMITED: x"),
+        _idle)
     ctl._peak_floor_limited = False
     await ctl.check_peak_floor_limited()
     return hs.last_message("goodwe_peak_soc_floor")
@@ -4323,8 +4421,8 @@ check("the notification an operator reads at 19:00 NAMES THE PACK that stopped "
       "the site, and names only that one. 'the battery is at its floor' on a "
       "site with two batteries is an instruction to go and look at both, and "
       "the wrong one is the one that is fine",
-      "SAFETY-32" in _body32 and "inverter-b" in _body32
-      and "inverter-a" not in _body32.split("WHICH PACK")[-1])
+      "The battery of inverter-b is at its peak reserve" in _body32
+      and "inverter-a" not in _body32)
 # The mirror again, on the SoC axis: swap which pack is empty and the name
 # swaps. A hardwired `self.inverters[1].name` passes the line above.
 _body32b = asyncio.get_event_loop_policy().new_event_loop().run_until_complete(
@@ -4332,8 +4430,8 @@ _body32b = asyncio.get_event_loop_policy().new_event_loop().run_until_complete(
 check("...and with the SAME two readings swapped between the packs it names "
       "inverter-a instead - so the sentence follows the measurement rather "
       "than a position in the roster",
-      "inverter-a" in _body32b
-      and "inverter-b" not in _body32b.split("WHICH PACK")[-1])
+      "The battery of inverter-a is at its peak reserve" in _body32b
+      and "inverter-b" not in _body32b)
 
 
 # ⚠️ AC 5, THE OTHER HALF: THE SAME METHOD ON A ROSTER OF ONE MUST PRINT WHAT IT
@@ -4357,13 +4455,14 @@ async def _notify32_one():
 
 _body32one = asyncio.get_event_loop_policy().new_event_loop().run_until_complete(
     _notify32_one())
-check("⚠️ AC 5. At a roster of ONE the same notification carries NO per-pack "
-      "sentence at all - byte for byte the message SAFETY-25 shipped. There is "
+check("⚠️ AC 5. At a roster of ONE the same notification names NO pack - "
+      "byte for byte the two-pack message minus the name (UX-08). There is "
       "one battery, naming it is noise, and this alarm reaches every existing "
       "install",
-      "SAFETY-32" not in _body32one and "WHICH PACK" not in _body32one
-      and _body32one == _body32.split("\n\nSAFETY-32")[0]
-      and "peak_soc_floor bounds THE PEAK GUARD ONLY" in _body32one)
+      "inverter-" not in _body32one
+      and _body32one == _body32.replace("The battery of inverter-b is",
+                                        "The battery is")
+      and _says_scope(_body32one))
 
 
 # --- 12i. THE SIBLING ARGUMENT: `pack_floor_soc`, THE OTHER HALF OF THE PAIR --
@@ -4499,18 +4598,19 @@ check("...and the TWO-pack mirror, which is what production reaches the moment "
       [r[3].soc for r in _s2_runs] == [_S_EMPTY_SIM] * 2
       and [[inv.soc for inv in r[2].inverters] for r in _s2_runs]
       == [[_S_EMPTY_SIM, _S_FULL_SIM], [_S_FULL_SIM, _S_EMPTY_SIM]])
-check("⚠️ ...AND THE SITE'S VERDICT FLIPS WITH IT, which is what makes this a "
-      "defect rather than a reporting difference. With the emptiest pack at "
-      "11 % - below the 20 % EMS floor - every one of those five sites is "
-      "FLOOR-LIMITED and sizes NO forced discharge at all, where the baseline "
-      "with its emptiest pack at 25 % is permitted and sizes a positive one. A "
-      "reduction that dropped the empty pack's position would grade this site "
-      "for PERMISSION against a pack 39 points fuller and spend, through "
-      "`sim/inject.py`, a pack its own BMS stops",
-      all(r[3].floor_limited is True and r[3].floor_w == 0.0
+# SAFETY-87: at N>=2 the emptiest pack is HELD and the others still shave.
+check("⚠️ ...AND THE HELD PACK FOLLOWS IT, which is what makes this a defect "
+      "rather than a reporting difference. With the emptiest pack at 11 % - "
+      "below the 20 % EMS floor - that pack and only that pack is held on "
+      "every one of those five sites and gives nothing for the peak, while "
+      "the fuller ones carry a positive floor (SAFETY-87); the baseline holds "
+      "nobody back. A reduction that dropped the empty pack's position would "
+      "spend, through `sim/inject.py`, a pack its own BMS stops",
+      all(r[3].floor_limited is False and r[3].floor_w > 0.0
+          and r[3].held == (r[2].inverters[r[1].index(_S_EMPTY_SIM)].name,)
           for r in _s3_runs + _s2_runs)
       and _s_ok.floor_limited is False and _s_ok.floor_w > 0.0
-      and _s_ok.soc == SOC_BETWEEN)
+      and _s_ok.held == () and _s_ok.soc == SOC_BETWEEN)
 check("...and the precondition that makes the six runs comparable (habit 1): "
       "every pack in every roster carries the SAME cut-out, so "
       "`binding_soc_floor()` answers the SAME site floor on all of them and the "
@@ -4744,28 +4844,31 @@ check("⚠️ THE NONE GUARD IS THE SAME FAMILY. One silent pack at ANY position
 # killed by the roster set), it cannot see `inv.soc` become `inv.bms_soc_floor`
 # (killed by the runs' held-flat cut-outs), and it cannot see a change inside
 # `Inverter.soc` at all.
-_pfs_fn = next(n for n in ast.walk(ast.parse(_mainsrc))
-               if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
-               and n.name == "pack_floor_soc")
-_pfs_vals = next(n.value for n in _pfs_fn.body
-                 if isinstance(n, ast.Assign)
-                 and [ast.unparse(t) for t in n.targets] == ["vals"])
+_pfs_fn = first((n for n in ast.walk(ast.parse(_mainsrc))
+                 if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef))
+                 and n.name == "pack_floor_soc"), "def pack_floor_soc in main.py")
+_pfs_vals = first((n.value for n in _pfs_fn.body
+                   if isinstance(n, ast.Assign)
+                   and [ast.unparse(t) for t in n.targets] == ["vals"]),
+                  "`vals = ...` in pack_floor_soc")
 
 
 def _gen_iter_of(fn_node, name):
     """The iterable of the comprehension inside the single `name(...)` call."""
-    call = next(n for n in ast.walk(fn_node)
-                if isinstance(n, ast.Call) and isinstance(n.func, ast.Name)
-                and n.func.id == name)
-    comp = call.args[0]
-    return comp.generators[0].iter if len(comp.generators) == 1 else None
+    call = first((n for n in ast.walk(fn_node)
+                  if isinstance(n, ast.Call) and isinstance(n.func, ast.Name)
+                  and n.func.id == name), f"{name}() call")
+    comp = nth(call.args, 0)
+    gens = getattr(comp, "generators", [])
+    return gens[0].iter if len(gens) == 1 else None
 
 
 _pfs_min_iter = _gen_iter_of(_pfs_fn, "min")
+_pfs_vals_iter = nth(getattr(_pfs_vals, "generators", []), 0).iter
 _pfs_any_iter = _gen_iter_of(_pfs_fn, "any")
-print(f"    pack_floor_soc reduces: list over `{ast.unparse(_pfs_vals.generators[0].iter)}`"
-      f", any() over `{ast.unparse(_pfs_any_iter)}`, min() over "
-      f"`{ast.unparse(_pfs_min_iter)}`")
+print(f"    pack_floor_soc reduces: list over `{_src(_pfs_vals_iter)}`"
+      f", any() over `{_src(_pfs_any_iter)}`, min() over "
+      f"`{_src(_pfs_min_iter)}`")
 check("⚠️ THE STRUCTURAL HALF, EXACT RATHER THAN A SUBSTRING. `min()` reduces "
       "the WHOLE list `vals` - a bare Name, not a Subscript, not a call, not a "
       "second comprehension - and `vals` is built by ONE comprehension over the "
@@ -4777,7 +4880,7 @@ check("⚠️ THE STRUCTURAL HALF, EXACT RATHER THAN A SUBSTRING. `min()` reduce
       "to length 12. This grades the code's SHAPE and nothing about the values; "
       "what the expression MEANS is graded by the runs",
       isinstance(_pfs_min_iter, ast.Name) and _pfs_min_iter.id == "vals"
-      and ast.unparse(_pfs_min_iter) == "vals"
+      and _src(_pfs_min_iter) == "vals"
       and isinstance(_pfs_vals, ast.ListComp)
       and len(_pfs_vals.generators) == 1
       and not _pfs_vals.generators[0].ifs
@@ -4785,13 +4888,13 @@ check("⚠️ THE STRUCTURAL HALF, EXACT RATHER THAN A SUBSTRING. `min()` reduce
       and isinstance(_pfs_vals.generators[0].iter.value, ast.Name)
       and _pfs_vals.generators[0].iter.value.id == "self"
       and _pfs_vals.generators[0].iter.attr == "inverters"
-      and ast.unparse(_pfs_vals.generators[0].iter) == "self.inverters")
+      and _src(_pfs_vals_iter) == "self.inverters")
 check("...and the NONE GUARD reduces that same whole list, pinned the same way. "
       "`any(v is None for v in vals[:1])` is +4 bytes and leaves every other "
       "line in this file identical; the sweep above reaches it up to length 12 "
       "and this reaches it at every length",
       isinstance(_pfs_any_iter, ast.Name) and _pfs_any_iter.id == "vals"
-      and ast.unparse(_pfs_any_iter) == "vals")
+      and _src(_pfs_any_iter) == "vals")
 check("...and the counterfactual that shows these pins are not vacuous (habit "
       "7): the very slices they exist for really do unparse to something else, "
       "so the equalities above are doing work rather than being trivially true "
@@ -4813,8 +4916,8 @@ _arb_calls = [n for n in ast.walk(ast.parse(_mainsrc))
               and n.func.attr == "decide"
               and isinstance(n.func.value, ast.Name)
               and n.func.value.id == "arbitrage"]
-_arb_soc = ast.unparse(next(k.value for k in _arb_calls[0].keywords
-                            if k.arg == "soc"))
+_arb_soc = _src(first(k.value for k in nth(_arb_calls, 0).keywords
+                       if k.arg == "soc"))
 print(f"    main.py's arbitrage.decide(soc=...) is `{_arb_soc}` "
       f"({len(_arb_calls)} call site)")
 check("⚠️ AND THE SECOND CONSUMER OF THE SAME REDUCTION. `arbitrage.decide()` "
@@ -5404,7 +5507,7 @@ MUT.append(("blindness() returns None - the degenerate 0 W projection is graded"
 
 # 2. the frozen term dropped from the guard's inputs.
 MUT.append(("frozen=False - SAFETY-18's term dropped",
-            not decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, reading=None,
+            not decide(p_frozen, batt_w=-RAILED, cap_w=CAP_W, margin_w=0.0, reading=None,
                        achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S, soc=SOC_OK, soc_floor=SOC_FLOOR,
                        frozen=False).engaged and d_frozen.engaged,
             "part 4: 'THE BACKSTOP: SAFETY-18's runaway ... cut to 0 W'"))
@@ -5475,7 +5578,7 @@ _early = sum(1 for _t in (500.0, 1000.0, 2000.0)
              if discharge_permitted(SOC_FLOOR - 1.0, SOC_FLOOR) is not None
              and not decide(PeakTracker.project(
                  averager_at(_t, 450.0), B + timedelta(seconds=450)),
-                 batt_w=BATT_NOW, cap_w=CAP_W, reading=None,
+                 batt_w=BATT_NOW, cap_w=CAP_W, margin_w=0.0, reading=None,
                  achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                  soc=SOC_FLOOR - 1.0, soc_floor=SOC_FLOOR).engaged)
 MUT.append((f"the SoC gate moved above the `wanted > 0` test ({_early} quiet "
@@ -5577,7 +5680,7 @@ MUT.append(("an unstated per-entry cut-out defaulted to 0 %",
 
 # 19. rule 8 grading only the first unit, i.e. the flat rule left in place.
 MUT.append(("rule 8 grading only the FIRST unit",
-            _r_second != [] and "(inverter-b)" in _msg(_r_second),
+            _r_second != [] and " for inverter-b" in _msg(_r_second),
             "part 12e: 'a roster whose SECOND pack has a cut-out above "
             "peak_soc_floor is refused'. ⚠️ The offender is the SECOND entry "
             "for exactly this row"))
@@ -5585,15 +5688,14 @@ MUT.append(("rule 8 grading only the FIRST unit",
 # 20. rule 8 naming a hardwired unit - CFG-04's rule 5/6 bug, which is why
 #     `unit_bms_floors_indexed()` carries the roster index.
 MUT.append(("rule 8's refusal naming a hardwired inverter",
-            "(inverter-b)" in _msg(_r_second) and "(inverter-a)" in _msg(_r_first),
+            " for inverter-b" in _msg(_r_second) and " for inverter-a" in _msg(_r_first),
             "part 12e: the two orders. Either hardwired index passes one of "
             "them and fails the other"))
 
 # 21. the notification naming a fixed roster position rather than the pack that
 #     is actually at its floor.
 MUT.append(("the per-pack notification naming a fixed roster position",
-            "inverter-a" in _body32b
-            and "inverter-b" not in _body32b.split("WHICH PACK")[-1],
+            "inverter-a" in _body32b and "inverter-b" not in _body32b,
             "part 12h: the same two readings swapped between the packs"))
 
 # ---- the two PR #48 SURVIVORS, and why they survived -------------------------
@@ -5643,8 +5745,8 @@ MUT.append(("main.py grading the site against ONE roster position - "
             _g_deep.soc_floor == float(B_PACK_FLOOR_DEEP_SIM)
             and _g_deepa.soc_floor == float(B_PACK_FLOOR_DEEP_SIM)
             and _g_shallow.soc_floor == float(SOC_FLOOR)
-            and _g_deep.floor_limited and _g_deepa.floor_limited
-            and not _g_shallow.floor_limited,
+            and _g_deep.held == ("inverter-b",)
+            and _g_deepa.held == ("inverter-a",) and _g_shallow.held == (),
             "part 12g, REWRITTEN as behaviour: real two-pack cycles, the SAME "
             "pair of cut-outs carried in both orders, and both the floor "
             "reaching decide() and the site's verdict follow the ROSTER rather "
@@ -5688,8 +5790,8 @@ MUT.append(("`binding_soc_floor()` reduced over a WINDOW - `max(floors[-2:])` -
 #     cut-out at index 0, 1 and 2 reach it.
 MUT.append(("main.py grading the site against a WINDOW of roster positions - "
             "`self.packs[:2]` - ROUND 3 SURVIVOR 2, +4 bytes",
-            _g3_runs[2][3].soc_floor == float(_G3_DEEP_SIM)
-            and binding_soc_floor(_g3_runs[2][2].packs[:2], SOC_FLOOR)
+            nth(_g3_runs, 2)[3].soc_floor == float(_G3_DEEP_SIM)
+            and binding_soc_floor(nth(_g3_runs, 2)[2].packs[:2], SOC_FLOOR)
             == float(SOC_FLOOR)
             and all(r[3].soc_floor == float(_G3_DEEP_SIM) for r in _g3_runs)
             and all(_slice_kills.values()),
@@ -5711,7 +5813,7 @@ MUT.append(("main.py grading the site against a WINDOW of roster positions - "
 MUT.append(("main.py grading the site against a THREE-wide window - "
             "`self.packs[:3]` / `self.packs[-3:]`, found by THIS round's "
             "battery, invisible to every behavioural run in this file",
-            ast.unparse(_floor_roster_arg) == "self.packs"
+            _src(_floor_roster_arg) == "self.packs"
             and isinstance(_floor_roster_arg, ast.Attribute)
             and all(binding_soc_floor(ctl.packs[:3], SOC_FLOOR) == dec.soc_floor
                     and binding_soc_floor(ctl.packs[-3:], SOC_FLOOR)
@@ -5758,7 +5860,7 @@ MUT.append(("`pack_floor_soc` reduced over a WINDOW - `vals[:2]` (+4 bytes) or "
 MUT.append(("`pack_floor_soc` reduced over a THREE-wide window - `vals[:3]` / "
             "`vals[-3:]` - invisible to every cycle in this file",
             _s_head_kill[3] and _s_tail_kill[3]
-            and ast.unparse(_pfs_min_iter) == "vals",
+            and _src(_pfs_min_iter) == "vals",
             "part 12i's LENGTH SWEEP (widths 1-11, on the REAL property over "
             "rosters of 1 to 12 real inverters) and its STRUCTURAL PIN. The "
             "six real cycles cannot see it - three packs is the longest roster "
@@ -5777,7 +5879,7 @@ MUT.append(("`pack_floor_soc` reduced with `max()` - the FULLEST pack, which is
 MUT.append(("`pack_floor_soc`'s NONE GUARD narrowed to a slice - "
             "`any(v is None for v in vals[:1])`, +4 bytes",
             all(g is None for _n, _p, g in _s_none_rows)
-            and ast.unparse(_pfs_any_iter) == "vals",
+            and _src(_pfs_any_iter) == "vals",
             "part 12i's NONE-GUARD SWEEP - one silent pack at every position of "
             "every length 1..12 - and the same structural pin. ⚠️ 12d's "
             "two-pack fixture silences the SECOND pack only, so a guard "
@@ -5786,7 +5888,7 @@ MUT.append(("`pack_floor_soc`'s NONE GUARD narrowed to a slice - "
 # 32. and the roster the list itself is built from.
 MUT.append(("`pack_floor_soc` building `vals` from a SLICE of the roster - "
             "`[inv.soc for inv in self.inverters[:2]]`, +4 bytes",
-            ast.unparse(_pfs_vals.generators[0].iter) == "self.inverters"
+            _src(_pfs_vals_iter) == "self.inverters"
             and _s_head_kill[2] and not _SLICED,
             "part 12i's sweep reads the REAL property on real rosters so it "
             "sees this too, its pin is on the comprehension's own iterable, "
@@ -5818,7 +5920,7 @@ check("...and the seventh is honestly reported as not caught, because it cannot
       "the expression rather than by a check. THAT is why the ceiling is a max "
       "and not a subtraction - `headroom = cap - peak` would have turned the "
       "same zero into FULL freedom, which part 3 shows is why headroom_w() is "
-      "not consumed here", not MUT[6][1]
+      "not consumed here", present(nth(MUT, 6)) and not MUT[6][1]
       and quarter_ceiling_w(CAP_W, _zero_peak)[0] == CAP_W)
 check("...and SAFETY-32's own eight defeats are each caught too - the flat "
       "cut-out inherited, the site floor graded in place of the pack's, the "
@@ -5851,7 +5953,7 @@ check("...⚠️ AND ONE IS RECORDED AS NOT CAUGHT, which is the only honest row
       "pin would refuse honest refactors, so the hole is reported with its size "
       "instead of hidden. THIS is the row that a fifth review should argue "
       "with, and it exists to be argued with",
-      not MUT[27][1]
+      present(nth(MUT, 27)) and not MUT[27][1]
       and all(_head_kill[w] and _tail_kill[w] for w in range(1, _SWEEP_N)))
 check("...⚠️ AND ROUND 4's SIX, WHICH ARE THE SAME FAMILY AT THE SIBLING "
       "ARGUMENT OF THE SAME CALL. `pack_floor_soc` is the MINIMUM over the "
@@ -5873,7 +5975,7 @@ check("...and so is the last one, which is not a defeat at all but the EDGE OF "
       "and a `lo` limit cannot cap a discharge. Saying so here is worth more "
       "than a green line that would be untrue - and part 10 now says it with a "
       "number instead of a sentence, which is worth more again",
-      not MUT[12][1] and EV["min_soc"] <= BMS_FLOOR + 0.05)
+      present(nth(MUT, 12)) and not MUT[12][1] and EV["min_soc"] <= BMS_FLOOR + 0.05)
 
 
 # ==============================================================================
@@ -5906,13 +6008,15 @@ print("13. SAFETY-38 round 4: the ORDERED PAIR inside PeakDecision.explain()")
 _S38_PROJ = PeakTracker.project(averager_at(CAP_W - 1200.0, 450.0),
                                 B + timedelta(seconds=450))
 _S38_CEIL_W, _S38_CEIL_FROM = quarter_ceiling_w(CAP_W, obs_hi)
-_S38_IDLE = decide(_S38_PROJ, batt_w=0.0, cap_w=CAP_W, reading=obs_hi,
+_S38_IDLE = decide(_S38_PROJ, batt_w=0.0, cap_w=CAP_W, margin_w=0.0, reading=obs_hi,
                    achievable_w=LIVE_MAX_W, max_hold_s=MAX_HOLD_S,
                    soc=SOC_OK, soc_floor=SOC_FLOOR)
-_S38_LITERAL = (f"quarter projects {_S38_PROJ.projected_w:.0f} W under a "
-                f"{_S38_CEIL_W:.0f} W ceiling")
-_S38_SWAPPED = (f"quarter projects {_S38_CEIL_W:.0f} W under a "
-                f"{_S38_PROJ.projected_w:.0f} W ceiling")
+# UX-08 2d: the row is in plain words now, and the pair is still ordered.
+from app import messages as _msg38                                # noqa: E402
+_S38_LITERAL = (f"heading for {_msg38.watts(_S38_PROJ.projected_w)}, under "
+                f"this month's {_msg38.watts(_S38_CEIL_W)} peak")
+_S38_SWAPPED = (f"heading for {_msg38.watts(_S38_CEIL_W)}, under "
+                f"this month's {_msg38.watts(_S38_PROJ.projected_w)} peak")
 print(f"    projection {_S38_PROJ.projected_w:.0f} W against a "
       f"{_S38_CEIL_W:.0f} W ceiling ({_S38_CEIL_FROM})")
 print(f"    {_S38_IDLE.explain()!r}")
@@ -5935,7 +6039,8 @@ check("...and the TRANSPOSED sentence is NOT what it says, so the check above "
       _S38_SWAPPED not in _S38_IDLE.explain())
 check("...and the row still names WHERE the ceiling came from, which is the "
       "difference between a cap an operator set and a peak the month already "
-      "banked", f"ceiling ({CEILING_MONTH_PEAK})" in _S38_IDLE.explain())
+      "banked", "under this month's" in _S38_IDLE.explain()
+      and "peak limit" not in _S38_IDLE.explain())
 
 # THE SHIPPED CONSUMER. `explain()` is not read by anybody until main.py prints
 # it, and round 3's lesson is that the pin belongs on the CALL SITE: the status
@@ -5943,7 +6048,7 @@ check("...and the row still names WHERE the ceiling came from, which is the "
 # main.py:1951 is what the release edge writes.
 _c38, _h38 = built(TMP / "s38pin.db")
 _c38.peak_guard = _S38_IDLE
-_rows38 = [r for r in _c38.checks() if "peak guard" in r["text"]]
+_rows38 = [r for r in _c38.checks() if r.get("id") == "peak_guard"]
 print("    status row: " + (_rows38[0]["text"] if _rows38 else "(none)"))
 check("⚠️ ...AND THE SAME ORDERED PAIR ON THE STATUS PAGE (main.py:3313), read "
       "off the shipped `checks()` rather than off `explain()` a second time. "
@@ -5953,7 +6058,8 @@ check("⚠️ ...AND THE SAME ORDERED PAIR ON THE STATUS PAGE (main.py:3313), re
 check("...and the row is green and un-warned, which is what makes the "
       "transposed version dangerous rather than merely untidy: an OK row "
       "carrying a projection 2713 W OVER its own ceiling is the one an "
-      "operator scrolls past", _rows38[0]["ok"] and not _rows38[0]["warn"]
+      "operator scrolls past", len(_rows38) == 1
+      and _rows38[0]["ok"] and not _rows38[0]["warn"]
       and _S38_CEIL_W - _S38_PROJ.projected_w == 2713.0)
 
 # ==============================================================================
@@ -5981,7 +6087,7 @@ def _proj_at(net_w, elapsed):
 
 def _decide_on(projection, *, batt_w, soc=SOC_OK, cap_w=CAP_W,
                achievable_w=LIVE_MAX_W, reading=None, frozen=False):
-    return decide(projection, batt_w=batt_w, cap_w=cap_w, reading=reading,
+    return decide(projection, batt_w=batt_w, cap_w=cap_w, margin_w=0.0, reading=reading,
                   achievable_w=achievable_w, soc=soc, soc_floor=SOC_FLOOR,
                   max_hold_s=MAX_HOLD_S, frozen=frozen)
 
@@ -6211,8 +6317,9 @@ check("a FLOOR-LIMITED decision - the guard wanted a discharge and SoC refused "
 # been inverted.
 _H45_SRC = (HERE / "app" / "peakguard.py").read_text(encoding="utf-8")
 _H45_TREE = ast.parse(_H45_SRC)
-_h45_fn = next(n for n in ast.walk(_H45_TREE)
-               if isinstance(n, ast.FunctionDef) and n.name == "decide")
+_h45_fn = first((n for n in ast.walk(_H45_TREE)
+                 if isinstance(n, ast.FunctionDef) and n.name == "decide"),
+                "def decide in peakguard.py")
 _H45_RUNG = [n for n in ast.walk(_h45_fn) if isinstance(n, ast.If)
              and ast.unparse(n.test) == "wanted <= 0.0"]
 check("the `wanted <= 0.0` rung is still in decide(), spelled exactly that "
@@ -6223,8 +6330,9 @@ check("...and it still DISENGAGES rather than merely reporting: the fixture "
       "13a is built on reaches it and files no claim, so the pin above is not "
       "grading a rung that has been inverted under it",
       peakguard.claim(_h45_idle) is None)
-_h45_head_fn = next(n for n in _H45_TREE.body if isinstance(n, ast.FunctionDef)
-                    and n.name == "charge_headroom_w")
+_h45_head_fn = first((n for n in _H45_TREE.body if isinstance(n, ast.FunctionDef)
+                      and n.name == "charge_headroom_w"),
+                     "def charge_headroom_w in peakguard.py")
 check("...and charge_headroom_w() is a PURE READ of the decision - one "
       "positional parameter, no projection, no clock and no options - so it "
       "cannot become a second answer to the question decide() already answers",
diff --git a/goodwe_controller/test_price.py b/goodwe_controller/test_price.py
index b544281..7a53af1 100644
--- a/goodwe_controller/test_price.py
+++ b/goodwe_controller/test_price.py
@@ -60,6 +60,8 @@ import os
 import re
 import shutil
 import sys
+
+from named_absence import first, nth
 import tempfile
 from datetime import date, datetime, timedelta, timezone
 from textwrap import dedent
@@ -310,8 +312,10 @@ check("...and every one of them is in the schema block too", _unschemad == [])
 # it. So the schema is deliberately WIDER than the registry, by exactly
 # RETIRED_PROVIDERS and by nothing else. Both halves are graded: an id that is
 # in neither set, and a retired id that has gone missing.
-_line = next(ln for ln in _schema_block if ln.startswith("  price_provider:"))
-_schema_ids = set(_line.split("list(", 1)[1].rstrip(")").split("|"))
+_line = first((ln for ln in _schema_block if ln.startswith("  price_provider:")),
+              "price_provider in the schema")
+_schema_ids = (set(_line.split("list(", 1)[1].rstrip(")").split("|"))
+               if "list(" in _line else set())
 _wanted = set(PROVIDERS) | set(RETIRED_PROVIDERS) | {"off"}
 check(f"the schema offers exactly the registered plugins, the retired ids and "
       f"'off' {sorted(_schema_ids)}",
@@ -954,7 +958,7 @@ def asked_url(since, until, extra=None):
     t = canned(_REAL[_TD])
     o = opts(price_provider="generic_dayahead", **(extra or {}))
     run(load_prices(o, since, until, transport=t))
-    return t.calls[0][0]
+    return nth(t.calls, 0)[0]
 
 
 # The expectation is built HERE, from the window, by different arithmetic than
@@ -2069,7 +2073,7 @@ check(f"every networked plugin declares at least one host, and manual_csv "
 check("the timeout the plugin passes to the transport is the configured one, "
       "not a hardcoded default",
       (lambda t: (load("generic_dayahead", {"price_timeout_s": 7},
-                       transport=t), t.calls[0][1] == 7.0)[1])(
+                       transport=t), nth(t.calls, 0)[1] == 7.0)[1])(
           canned(columnar_feed(EPEX_EUR_MWH))))
 
 
@@ -2119,7 +2123,7 @@ check("...and so does a configured provider on its own",
                               -5000, 5000) == [])
 check("an unknown provider id is refused rather than defaulted to 'off'",
       why(validate_startup_config(vbase(price_provider="nordpool"), -5000, 5000),
-          "not a shipped plugin"))
+          "which does not exist"))
 
 # ⚠️ TARIFF-07: A RETIRED ID IS REFUSED BY A DIFFERENT MESSAGE, AND EVERY CHECK
 # HERE GRADES THE REASON RATHER THAN THE VERDICT. The failure this section
@@ -2140,26 +2144,21 @@ check(f"every retired id is refused at startup {sorted(_retired)}",
       len(_retired) == 3 and all(len(v) == 1 for v in _retired.values()))
 check("...and NOT by the unknown-id message, which would tell an operator they "
       "mistyped an id this add-on offered them and accepted for months",
-      all("not a shipped plugin" not in v[0] for v in _retired.values())
-      and "WITHDRAWN" not in _unknown[0])
+      all("which does not exist" not in v[0] for v in _retired.values())
+      and "was withdrawn" not in _unknown[0])
 check("...and each message NAMES ITS OWN ID, so the operator can tell it is "
       "about their configuration and not a generic notice",
       all(repr(pid) in v[0] for pid, v in _retired.items()))
-check("...and (a) says the plugin never fetched a price, naming the endpoint "
-      "that does not exist",
-      all("NEVER FETCHED A PRICE" in v[0] for v in _retired.values())
-      and "api.engie.be/dynamic/be" in _retired["engie_dynamic"][0]
-      and "api.totalenergies.be/prices/dynamic"
-          in _retired["totalenergies_dynamic"][0]
-      and "api.eneco.be/eddy/prices" in _retired["eneco_eddy"][0])
+# UX-08 2c: the endpoints that never existed are in DOCS.md under "Energy price
+# providers"; the refusal keeps what the operator acts on.
+check("...and (a) says the plugin never fetched a price",
+      all("never fetched a price" in v[0] for v in _retired.values()))
 check("...and (b) says what the site has ACTUALLY been running instead - the "
       "half §11.4 made invisible",
-      all("SILENT" in v[0] and "static_profile" in v[0]
-          for v in _retired.values()))
-check("...and (c) says what to do, naming a live plugin and refusing to "
-      "pretend an alias could exist",
+      all("This site ran on" in v[0] for v in _retired.values()))
+check("...and (c) says what to do, naming a live plugin",
       all("generic_dayahead" in v[0] and "manual_csv" in v[0]
-          and "NO alias" in v[0] for v in _retired.values()))
+          for v in _retired.values()))
 
 # ⚠️ AND THE SENTENCE CHANGES WITH THE SITE. "You have been on the static
 # profile" is FALSE where no profile was ever set, and that site is in a WORSE
@@ -2173,11 +2172,12 @@ _with_profile = validate_startup_config(
 _without = _retired["eneco_eddy"][0]
 check("a retired id on a site WITH a static profile is told it has been "
       "running that profile",
-      "the static day/night tariff in static_profile" in _with_profile)
+      "ran on the “Fixed or day/night tariff” (static_profile)"
+      in _with_profile)
 check("...and a site WITHOUT one is told it has been running nothing at all, "
       "which is a different and worse state",
-      "NOTHING AT ALL" in _without
-      and "the static day/night tariff in static_profile" not in _without)
+      "ran on no tariff at all" in _without
+      and "(static_profile)" not in _without)
 check("...so the two renderings are not the same sentence",
       _with_profile != _without)
 
@@ -2189,7 +2189,7 @@ _p = validate_startup_config(
 check("a provider AND the Home Assistant price entities is refused - two price "
       "sources on one site", len(_p) == 1)
 check("...and the message says which one actually wins",
-      why(_p, "HOME ASSISTANT ENTITIES WIN"))
+      why(_p, "would win over it"))
 # TARIFF-03 added a second source with the same silent-loser shape.
 _ps = validate_startup_config(
     vbase(static_profile='{"periods": [{"from":"00:00","to":"24:00",'
@@ -2198,7 +2198,7 @@ _ps = validate_startup_config(
     -5000, 5000)
 check("a static_profile AND the Home Assistant price entities is refused too - "
       "main.py reads one of them for `cheap` and the loser is silent",
-      len(_ps) == 1 and why(_ps, "HOME ASSISTANT"))
+      len(_ps) == 1 and why(_ps, "(price_now_entity) and “Average price entity” (price_avg_entity) would win"))
 check("the Home Assistant entities alone still start, so nothing is taken away "
       "from a live install",
       validate_startup_config(vbase(price_now_entity="sensor.now",
@@ -2477,9 +2477,9 @@ def _started(sites, opts):
 
 _MAIN_TREE = derived(lambda: ast.parse(open(os.path.join(_APP, "main.py"),
                                             encoding="utf-8").read()))
-_AMAIN = derived(lambda: next(n for n in ast.walk(_MAIN_TREE)
-                              if isinstance(n, ast.AsyncFunctionDef)
-                              and n.name == "amain"))
+_AMAIN = derived(lambda: next((n for n in ast.walk(_MAIN_TREE)
+                               if isinstance(n, ast.AsyncFunctionDef)
+                               and n.name == "amain"), None))
 _SITES = derived(lambda: _task_sites(_AMAIN))
 _GRAPH = derived(lambda: _call_graph(_APP))
 _FETCH_ENTRY = "resolve_tariff"
@@ -2941,10 +2941,10 @@ check("...and BOTH translations tell an operator which switch does which - "
       "the provider option says it is what starts the fetch, and the trading "
       "option says turning it off does not turn the feed off. One language "
       "updated and not the other is how this surface rots",
-      "STARTS THE PRICE FETCH" in _T10_TR["en"]
-      and "DOES NOT TURN THE PRICE FEED OFF" in _T10_TR["en"]
-      and "HET OPHALEN VAN PRIJZEN START" in _T10_TR["nl"]
-      and "ZET DE PRIJSFEED NIET UIT" in _T10_TR["nl"])
+      "starts the price fetch" in _T10_TR["en"]
+      and "does not turn the price feed off" in _T10_TR["en"]
+      and "start het ophalen van prijzen" in _T10_TR["nl"]
+      and "zet de prijsfeed niet uit" in _T10_TR["nl"])
 
 
 # --------------------------------------------------------------------------- #
@@ -3427,8 +3427,8 @@ check(f"network charges folded into `offset` move the card's own price to "
       isinstance(_double_price, float) and abs(_double_price - 15.55) > 10)
 check(f"...and it is refused, by the CARD rule, naming the discrepancy and "
       f"the network-charge cause ({_double[:60]!r})",
-      "does not reproduce its own card" in _double and "OUT BY" in _double
-      and "folded into `offset`" in _double)
+      "the card says" in _double
+      and "network charges are not in the offset" in _double)
 
 _CORRUPTIONS = {
     "VAT left out (vat_pct 0)": spoilt(vat_pct=0),
@@ -3447,7 +3447,7 @@ for _name, _blob in sorted(_CORRUPTIONS.items()):
     _why = refusal(_blob)
     check(f"{_name}: refused, and by the CARD rule rather than by another one "
           f"({_why[:48]!r})",
-          "does not reproduce its own card" in _why and "OUT BY" in _why)
+          "the card says" in _why)
 
 # ⚠️ THE TOLERANCE IS A REAL EDGE AND IT IS GRADED FROM BOTH SIDES, or
 # "within 0.01" and "within anything" would be the same check.
@@ -3459,7 +3459,7 @@ _outside = refusal(spoilt(card_expect_incl_vat=round(
     + CARD_TOLERANCE * 2.0, 6)))
 check(f"half a tolerance out passes and twice a tolerance out does not, so "
       f"{CARD_TOLERANCE} is the number being enforced rather than a shape",
-      _inside == "" and "does not reproduce its own card" in _outside)
+      _inside == "" and "the card says" in _outside)
 
 # A card that is absent is refused, and NOT by the generic unknown-field rule.
 check(f"a formula with NO card block is refused, and the message says why the "
@@ -3491,8 +3491,8 @@ _cf_t = canned(_REAL[_TD])
 run(load_prices(opts(price_provider="custom_formula", **_CF_OPTS),
                 _w0, _w0 + timedelta(hours=48), transport=_cf_t))
 check(f"...and asks for the same Brussels range generic_dayahead asks for "
-      f"{_cf_t.calls[0][0]!r}",
-      _cf_t.calls[0][0] == asked_url(_w0, _w0 + timedelta(hours=48)))
+      f"{nth(_cf_t.calls, 0)[0]!r}",
+      nth(_cf_t.calls, 0)[0] == asked_url(_w0, _w0 + timedelta(hours=48)))
 
 # The price at each instant is the document's own index through the card's
 # arithmetic - computed HERE from the captured bytes, by different arithmetic.
@@ -3565,32 +3565,31 @@ check("...and the hourly series' coverage is still DERIVED from the "
 print()
 print("15e. every refusal in the table, and the two that are WARNINGS")
 _TABLE = {
-    "units absent": (spoilt(units=""), "units", "is REQUIRED"),
+    "units absent": (spoilt(units=""), "units", "Choose one of"),
     "units not one of the enumerated ones":
-        (spoilt(units="cents"), "units", "must be one of"),
+        (spoilt(units="cents"), "units", "Choose one of"),
     "factor == 0 (every spread becomes 0, arbitrage never fires)":
         (spoilt(factor=0), "factor", "static_profile"),
     "factor < 0 (the dearest hour becomes the cheapest)":
-        (spoilt(factor=-0.102), "factor", "inverts the market"),
+        (spoilt(factor=-0.102), "factor", "turns the market upside down"),
     "vat_pct above 30 (the 6 / 1.06 / 106 confusion)":
         (spoilt(vat_pct=106), "vat_pct", "between 0 and 30"),
     "vat_pct below 0": (spoilt(vat_pct=-6), "vat_pct", "between 0 and 30"),
     "a non-numeric coefficient": (spoilt(factor="0.102"), "factor",
                                   "not a number"),
     "a coefficient that is an EXPRESSION rather than a number":
-        (spoilt(factor="0.1*x"), "factor", "evaluates nothing"),
+        (spoilt(factor="0.1*x"), "factor", "Write a plain number"),
     "a non-finite coefficient": (spoilt(offset=float("inf")), "offset",
                                  "not finite"),
-    "an unknown index": (spoilt(index="belpex_h"), "index", "cannot get it"),
+    "an unknown index": (spoilt(index="belpex_h"), "index", "can only fetch"),
     "an unknown resolution": (spoilt(resolution="daily"), "resolution",
-                              "must be one of"),
+                              "Choose one of"),
     "an unknown top-level field (which is how 'expr' is answered)":
-        (spoilt(expr="0.102*spot+1"), "expr", "NO field that takes an "
-                                              "expression"),
+        (spoilt(expr="0.102*spot+1"), "expr", "It takes only"),
     "an unknown field inside the card": ({**ENECO_CARD,
                                           "card": dict(ENECO_CARD["card"],
                                                        vat="6")},
-                                         "vat", "no field(s)"),
+                                         "vat", "unknown field(s)"),
 }
 for _name, (_blob, _names, _needle) in sorted(_TABLE.items()):
     _why = refusal(_blob)
@@ -3645,7 +3644,7 @@ check("...and it is warned about, naming the month and saying why it is not "
       "refused",
       "2019-01" in (stale_card(parse_price_formula(json.dumps(_old_card)))
                     or "")
-      and "Not refused" in (stale_card(
+      and "still starts" in (stale_card(
           parse_price_formula(json.dumps(_old_card))) or ""))
 check("...while a card from this month draws no warning, so the rule is the "
       "AGE and not the presence of the field",
@@ -3846,18 +3845,18 @@ check("custom_formula with NO formula is refused, naming the option and "
       "showing the shape",
       why(validate_startup_config(vbase(price_provider="custom_formula"),
                                   -5000, 5000),
-          "price_formula is empty"))
+          "(price_formula) is empty"))
 check("a formula that does not reproduce its card is refused AT STARTUP, "
       "with the discrepancy named",
       why(validate_startup_config(
           vbase(price_provider="custom_formula",
                 price_formula=json.dumps(spoilt(offset=13.0))),
-          -5000, 5000), "does not reproduce its own card"))
+          -5000, 5000), "the card says"))
 check("...and a formula that is not JSON at all is refused with the shape it "
       "wanted, rather than with a traceback",
       why(validate_startup_config(
           vbase(price_provider="custom_formula", price_formula="0.102*spot+1"),
-          -5000, 5000), "not valid JSON"))
+          -5000, 5000), "price_formula is not valid near character"))
 check(f"...and a card outside the plausible band is refused too, WITH THE "
       f"SHIPPED taxes in place - the flat "
       f"{PRICE_OPTION_DEFAULTS['price_taxes_eur_kwh']} must not be able to "
@@ -4101,13 +4100,15 @@ def _t11_render(over=None, *, plan=None, plan_age_s=0.0, soc=55.0, cycles=1,
 # row that is WRONG IN EXACTLY THE WAY THE DEFECT WAS, and both answers are
 # asserted.
 _T11_SLOTS = {
-    "points": r"(\d+) points over \d+ h",
-    "hours": r"\d+ points over (\d+) h",
-    "firm": r"(\d+) firm / \d+ carried",
-    "carried": r"\d+ firm / (\d+) carried",
-    "horizon": r"for a (\d+) h horizon",
-    "age_s": r"fetched (\d+) s ago",
-    "spacings": r"([\d+]+) s spacing",
+    # UX-08 2d: the row is in plain words; every figure keeps its own slot.
+    "points": r"(\d+) prices over \d+ hours",
+    "hours": r"\d+ prices over (\d+) hours",
+    "firm": r"(\d+) published and \d+ estimated",
+    "carried": r"\d+ published and (\d+) estimated",
+    "horizon": r"for (\d+) hours ahead",
+    "age_s": r"Price plan from (\d+) s ago",
+    # UX-10: the spacing is in words ("one every 15 minutes or every hour").
+    "spacings": r"one (every [a-z0-9 ]+?)(?:,|\.|$)",
     # ⚠️ THE *Arbitrage* ROW'S OWN AGE SLOT, and it is deliberately the same
     # pattern for "decided N s ago" and "the last one was taken N s ago" -
     # WHICH of the two sentences was rendered is graded by inequality below,
@@ -4125,6 +4126,18 @@ _T11_SLOTS = {
 }
 
 
+def _spacing_s(raw):
+    """`every 15 minutes or every hour` -> `[900, 3600]`; raises otherwise."""
+    unit = {"second": 1, "minute": 60, "hour": 3600}
+    out = []
+    for part in raw.split(" or "):
+        m = re.fullmatch(r"every (?:(\d+) )?(second|minute|hour)s?", part.strip())
+        if m is None:
+            raise ValueError(f"no spacing in {part!r}")
+        out.append(int(m.group(1) or 1) * unit[m.group(2)])
+    return out
+
+
 def _slot(row, name):
     """The number in ONE NAMED SLOT of a rendered row, or `_Raised`.
 
@@ -4140,18 +4153,18 @@ def _slot(row, name):
         if m is None:
             raise ValueError(f"no {name!r} slot in {row[:90]!r}")
         raw = m.group(1)
-        return ([int(x) for x in raw.split("+")] if name == "spacings"
-                else int(raw))
+        return (_spacing_s(raw) if name == "spacings" else int(raw))
     return derived(_get)
 
 
-_T11_GOOD = ("x (recomputed this tick); provider plan fetched 7 s ago for a "
-             "48 h horizon: dynamic_dayahead from generic_dayahead, "
-             "132 points over 33 h, 36 firm / 96 carried, 900+3600 s spacing")
-_T11_SHIPPED_DEFECT = ("x (recomputed this tick); provider plan fetched 7 s "
-                       "ago for a 48 h horizon: dynamic_dayahead from "
-                       "generic_dayahead, 132 points over 132 h, "
-                       "96 firm / 36 carried, 900+3600 s spacing")
+_T11_GOOD = ("x. Price plan from 7 s ago, for 48 hours ahead: day-ahead "
+             "prices from the price feed, 132 prices over 33 hours, "
+             "36 published and 96 estimated, one every 15 minutes or every "
+             "hour")
+_T11_SHIPPED_DEFECT = ("x. Price plan from 7 s ago, for 48 hours ahead: "
+                       "day-ahead prices from the price feed, 132 prices over "
+                       "132 hours, 96 published and 36 estimated, one every "
+                       "15 minutes or every hour")
 # The slots divide into the ones a *Tariff*/​*Arbitrage* ROW carries and the
 # ones a REFUSAL sentence carries; each group is calibrated against its own
 # well-formed example, because a slot asked of the wrong kind of sentence is
@@ -4399,12 +4412,16 @@ check(f"AC, AND THE WHOLE OF DEFECT 4: 'trading is off' and 'trading is on "
       f"`off (arbitrage_enabled)` for both - naming an option that is `true` "
       f"in the options blob",
       _T11_OFF[0]["Arbitrage"] != _T11_ON_HELD[0]["Arbitrage"])
+# ⚠️ THE "Why" ROW OF THE SAME RENDER, NOT A SECOND READ OF `why_words`. Since
+# UX-10 the waiting sentence counts its seconds when it is read, so reading the
+# property again here, after the other renders above, could cross a second
+# ("1 second" in the row, "2 seconds" now) - CI run 953 on PR #141 did.
 check(f"...and the armed-but-held row carries the CONTROL LOOP'S OWN REASON "
-      f"({_T11_ON_HELD[1].reason!r}), so the operator is told which input is "
+      f"({_T11_ON_HELD[0]['Why']!r}), so the operator is told which input is "
       f"missing rather than being sent to look at a switch that is already on. "
       f"The reason comes from main.py, not from this file",
-      _T11_ON_HELD[1].reason
-      and _T11_ON_HELD[1].reason in _T11_ON_HELD[0]["Arbitrage"])
+      _T11_ON_HELD[0]["Why"].startswith("A reading is missing")
+      and _T11_ON_HELD[0]["Why"] in _T11_ON_HELD[0]["Arbitrage"])
 check(f"...and a cycle that DID reach the step renders the strategy's own "
       f"sentence - {_T11_ON_OK[1].arb.explain()[:50]!r} - rather than a "
       f"re-derivation of it, which is the guarantee OPT-04 put on this row and "
@@ -4450,10 +4467,10 @@ check(f"DRIVEN, no clock touched: a decision stands "
       and _T11_DROP_STALE is True
       and _T11_ON_DROPPED[0]["Arbitrage"] != _T11_ON_OK[0]["Arbitrage"])
 check(f"...and it names the reason the cycle stopped "
-      f"({_T11_ON_DROPPED[1].reason!r}) beside the age of the decision it is "
+      f"({_T11_ON_DROPPED[1].why_words!r}) beside the age of the decision it is "
       f"still showing, so 'the strategy decided this' and 'the strategy last "
       f"decided this' are not one sentence",
-      _T11_ON_DROPPED[1].reason in _T11_ON_DROPPED[0]["Arbitrage"]
+      _T11_ON_DROPPED[1].why_words in _T11_ON_DROPPED[0]["Arbitrage"]
       and isinstance(_slot(_T11_ON_DROPPED[0]["Arbitrage"], "arb_age_s"), int))
 
 check("...and `main.py`'s 'if and only if' is graded as BEHAVIOUR rather than "
@@ -4586,8 +4603,8 @@ check(f"...and the row an operator reads names the SPACING that makes those "
 check("...and this is the same wording FCST-04's *Price history* row already "
       "used, so the two rows describing the same feed can be compared rather "
       "than being two conventions on one page",
-      "points over" in _T11_E2E_ROW
-      and "points over" in ("" if isinstance(_T11_E2E, _Raised)
+      "prices over" in _T11_E2E_ROW
+      and "prices over" in ("" if isinstance(_T11_E2E, _Raised)
                             else _T11_E2E["Price history"]))
 
 
@@ -4684,9 +4701,25 @@ _T17_TAB_OUT = derived(lambda: assemble(_T17_CAPS, _T17_RAW, MARKUP,
                                         _T17_TABLE))
 check("the table parses, through static_tariff's OWN grammar",
       not isinstance(_T17_TABLE, _Raised))
+# Graded on this file's own two calls: the arms may differ only in `taxes`.
+_T17_ARMS = {t.id: [ast.unparse(a) for a in n.value.args[0].body.args]
+             for n in ast.parse(open(__file__, encoding="utf-8").read()).body
+             if isinstance(n, ast.Assign) and isinstance(n.value, ast.Call)
+             and isinstance(n.value.func, ast.Name)
+             and n.value.func.id == "derived" and n.value.args
+             and isinstance(n.value.args[0], ast.Lambda)
+             and isinstance(n.value.args[0].body, ast.Call)
+             for t in n.targets if isinstance(t, ast.Name)
+             and t.id in ("_T17_FLAT_OUT", "_T17_TAB_OUT")}
+print(f"    arms: {_T17_ARMS}")
 check(f"the two arms are the same feed: same caps, same {len(_T17_RAW)} "
-      f"RawPoints and the same markup {MARKUP}, by IDENTITY and not by value",
-      _T17_CAPS is _T17_CAPS and _T17_RAW is _T17_RAW)
+      f"RawPoints and the same markup {MARKUP} - the two `assemble()` calls "
+      f"share their first three arguments by NAME and differ only in the fourth",
+      sorted(_T17_ARMS) == ["_T17_FLAT_OUT", "_T17_TAB_OUT"]
+      and [len(v) for v in _T17_ARMS.values()] == [4, 4]
+      and _T17_ARMS["_T17_FLAT_OUT"][:3] == _T17_ARMS["_T17_TAB_OUT"][:3]
+      == ["_T17_CAPS", "_T17_RAW", "MARKUP"]
+      and _T17_ARMS["_T17_FLAT_OUT"][3] != _T17_ARMS["_T17_TAB_OUT"][3])
 _T17_BANDS = derived(lambda: sorted({p.eur_per_kwh
                                      for p in _T17_TABLE.periods}))
 check(f"...and the table is genuinely hour-varying: {_T17_BANDS} EUR/kWh, two "
@@ -5342,18 +5375,17 @@ check("...and none of those rows is vacuous: every one really did refuse on "
 _T16_DIFFER = [
     ("factor 0 -> where a FLAT price of THIS leg lives",
      spoilt(factor=0.0), "static_profile", "export_price_eur_kwh"),
-    ("a negative factor -> which market it inverts",
-     spoilt(factor=-0.102), "No consumption tariff",
-     "No Belgian injection tariff"),
-    ("a card miss -> what a wrong `offset` costs on THIS leg",
-     spoilt(factor=0.120), "bills you for it twice",
-     "nothing is added to this leg"),
+    # UX-08 2c: a negative factor gets one sentence on both legs now ("put the
+    # minus sign on the offset"), so it left this table.
+    ("a card miss -> what else to check on THIS leg",
+     spoilt(factor=0.120), "network charges are not in the offset",
+     "the VAT is 0 for injection"),
     ("invalid JSON -> WHEN this option is read at all, which is not the "
      "same answer on the two legs: `price_formula` decides nothing unless "
      "price_provider is 'custom_formula', and the injection leg is read "
      "whatever the consumption provider is",
-     "{not json", "unless price_provider is 'custom_formula'",
-     "read whatever price_provider is set to"),
+     "{not json", "unless “Dynamic price source” is 'custom_formula'",
+     "only if your injection price follows the market"),
 ]
 for _what, _blob, _cons_mark, _inj_mark in _T16_DIFFER:
     _a, _b = ((_reason(lambda b=_blob: parse_price_formula(b)),
@@ -5470,10 +5502,10 @@ check(f"a factor 100x out is refused BY THE PASS-THROUGH RUNG, naming the "
       f"share of the wholesale price it would pay ({_T16_PT_WHY[:60]!r})",
       "passes through" in _T16_PT_WHY
       and f"{PASSTHROUGH_LO}-{PASSTHROUGH_HI}x" in _T16_PT_WHY
-      and "|offset| above" not in _T16_PT_WHY)
+      and "larger than" not in _T16_PT_WHY)
 check(f"an offset 100x out is refused BY THE OFFSET RUNG, naming the EUR/kWh "
       f"it works out at ({_T16_OFF_WHY[:60]!r})",
-      "|offset| above" in _T16_OFF_WHY
+      "larger than" in _T16_OFF_WHY
       and "passes through" not in _T16_OFF_WHY)
 check(f"...and the WHOLE card 100x out - which trips both - is refused, with "
       f"the pass-through rung answering first ({_T16_BOTH_WHY[:44]!r})",
@@ -5535,9 +5567,8 @@ check(f"a card block ON THIS LEG is graded by the same rung at the same "
       f"15.55) is refused, naming the option the operator typed "
       f"({_T16_SPOILT_CARD[:64]!r})",
       _T16_WITH_CARD == ""
-      and "does not reproduce its own card" in _T16_SPOILT_CARD
-      and _T16_SPOILT_CARD.startswith(EXPORT_FORMULA_OPTION)
-      and f"the tolerance is {CARD_TOLERANCE}" in _T16_SPOILT_CARD)
+      and "the card says" in _T16_SPOILT_CARD
+      and _T16_SPOILT_CARD.startswith(EXPORT_FORMULA_OPTION))
 check(f"...and half a tolerance out still passes, so {CARD_TOLERANCE} is "
       f"enforced on this leg too rather than 'something'",
       _reason(lambda: parse_export_formula(json.dumps(spoilt(
@@ -5562,10 +5593,11 @@ print("17f. the SCALAR path is unchanged - arithmetically, not merely in "
 # ⚠️ THE ACCEPTANCE CRITERION TARIFF-17 GRADED THE SAME WAY (16f). A site with
 # a flat injection price is every site that exists today, and "we did not mean
 # to change it" is not a measurement.
-_T16_OLD_SCALAR = [ast.unparse(n) for n in ast.walk(next(
-    n for n in ast.parse(open(os.path.join(HERE, "app", "price.py"),
-                              encoding="utf-8").read()).body
-    if isinstance(n, ast.FunctionDef) and n.name == "export_price_eur_kwh"))
+_T16_OLD_SCALAR = [ast.unparse(n) for n in ast.walk(first(
+    (n for n in ast.parse(open(os.path.join(HERE, "app", "price.py"),
+                               encoding="utf-8").read()).body
+     if isinstance(n, ast.FunctionDef) and n.name == "export_price_eur_kwh"),
+    "def export_price_eur_kwh in price.py"))
     if isinstance(n, ast.Return)]
 check(f"`export_price_eur_kwh()`'s BODY is still the single expression it has "
       f"always been, pinned on the AST rather than on the source text: "
diff --git a/goodwe_controller/test_price_forecast.py b/goodwe_controller/test_price_forecast.py
index 77f9617..59761eb 100644
--- a/goodwe_controller/test_price_forecast.py
+++ b/goodwe_controller/test_price_forecast.py
@@ -62,8 +62,11 @@ import inspect
 import itertools
 import os
 import sys
+
+from named_absence import first, nth
 from datetime import datetime, timedelta, timezone
 
+from app import messages as _msg_fc
 from app import price as _price
 from app import price_forecast as _fc
 from app import static_tariff as _st
@@ -638,7 +641,7 @@ _late = fill_from_yesterday(
     series_of(DAY, lambda u: t_price(brussels(u).hour),
               PriceProduct.DAY_AHEAD, "generic_dayahead", provisional=False),
     yesterday=YESTERDAY, since=D0, until=D1, stamp=D1)
-_h20 = DAY[20]
+_h20 = nth(DAY, 20)
 _before = derived(lambda: FILLED.at(_h20))
 _after = derived(lambda: _late.at(_h20))
 check("before the print, hour 20 is provisional and carries YESTERDAY's number",
@@ -666,8 +669,10 @@ check("with neither a published hour nor a yesterday, the result is no_data - "
 check("...so it has no .points to iterate and no .get() to default out of",
       raises(lambda: _nothing.points, Absence)
       and raises(lambda: _nothing.get("points", []), Absence))
-check("...and its reason names §11.4 for an operator",
-      "§11.4" in _nothing.reason)
+check("...and its reason says the fixed tariff is used and there is no "
+      "trading (§11.4), in words an operator reads",
+      "fixed tariff is used" in _nothing.reason
+      and "no trading" in _nothing.reason)
 check("a naive `since` is refused rather than silently interpreted as UTC",
       raises(lambda: fill_from_yesterday(TODAY_PART, yesterday=YESTERDAY,
                                          since=datetime(2026, 1, 15),
@@ -728,7 +733,8 @@ check("an action that commits nothing is not an irreversible one and cannot be "
 # prices that were published for the morning and guessed for the evening.
 _m = maint()
 _gate_bad = derived(lambda: begin_phase(_m, START, FILLED, MAINTENANCE_DRAIN))
-_first_prov = derived(lambda: next(u for u in _hours if FILLED.at(u).provisional))
+_first_prov = derived(lambda: first((u for u in _hours if FILLED.at(u).provisional),
+                                     "a carried hour in the window"))
 check("the drain's window really does reach past the published hours while "
       "staying INSIDE the series, so the refusal below is about provenance and "
       "not about a short series",
@@ -742,9 +748,10 @@ check("...and the phase machine did not move: it is still idle, so the "
       _m.phase == IDLE)
 check("...and the reason names §8.3, the offending hour, and when the real "
       "price is expected",
-      "§8.3" in _gate_bad.reason
-      and _first_prov.isoformat() in _gate_bad.reason
-      and "14-16" in _gate_bad.reason)
+      "is only estimated" in _gate_bad.reason
+      and bool(_first_prov)
+      and _msg_fc.when(brussels(_first_prov)) in _gate_bad.reason
+      and "14:00 to 16:00" in _gate_bad.reason)
 
 # The positive arm, so the block above is discriminating rather than universal.
 _firm_long = series_of(hours_between(START,
@@ -769,7 +776,8 @@ _gate_none = begin_phase(_m3, START, PriceRead.no_data("the feed timed out"),
                          MAINTENANCE_DRAIN)
 check("no price data at all BLOCKS an irreversible action too - a missing "
       "price is not a cheap one (§11.4)",
-      _gate_none.kind == "blocked" and "§11.4" in _gate_none.reason
+      _gate_none.kind == "blocked"
+      and "missing price is not a cheap one" in _gate_none.reason
       and _m3.phase == IDLE)
 _short = series_of(DAY[:4], lambda u: t_price(brussels(u).hour),
                    PriceProduct.DAY_AHEAD, "generic_dayahead",
diff --git a/goodwe_controller/test_price_history.py b/goodwe_controller/test_price_history.py
index 9a3c733..8e4a743 100644
--- a/goodwe_controller/test_price_history.py
+++ b/goodwe_controller/test_price_history.py
@@ -104,6 +104,8 @@ import json
 import os
 import shutil
 import sys
+
+from named_absence import first, nth
 import tempfile
 from datetime import datetime, timedelta, timezone
 
@@ -239,7 +241,8 @@ YDAY_H = bday_hours(YDAY_D)
 
 def at_local(bdate: str, hh: int) -> datetime:
     """The UTC instant whose Brussels wall clock reads hh:00 on `bdate`."""
-    return next(u for u in bday_hours(bdate) if brussels(u).hour == hh)
+    return first((u for u in bday_hours(bdate) if brussels(u).hour == hh),
+                 f"{bdate} {hh:02d}:00 Brussels")
 
 
 # ⚠️ AND IT IS NOT ON THE HOUR. A controller's `now` is
@@ -791,7 +794,7 @@ print("2b. a QUARTER-HOURLY feed keeps every print, and its spread with them")
 _QSTEP_MIN = 15
 _qrows = []
 for _n in range(len(TODAY_H) * (60 // _QSTEP_MIN)):
-    _qu = TODAY_H[0] + timedelta(minutes=_QSTEP_MIN * _n)
+    _qu = nth(TODAY_H, 0) + timedelta(minutes=_QSTEP_MIN * _n)
     # A spiky within-the-hour profile, so decimation is visible in the SPREAD
     # and not only in a count.
     _qrows.append((_qu,
@@ -1017,7 +1020,7 @@ check("a store holding only the day before LAST answers no_data, not those "
       _y3.kind == "no_data")
 check(f"...and the reason names BOTH the date wanted and the dates held, so an "
       f"operator can see which it is: {why(_y3)!r}",
-      "2026-01-14" in why(_y3) and "2026-01-12" in why(_y3))
+      "14 Jan" in why(_y3) and "12 Jan" in why(_y3))
 
 _h4 = store()
 _ph.PriceHistory._remember(
@@ -1214,7 +1217,7 @@ json.dump({"version": SCHEMA + 99, "days": {}}, open(_p7, "w", encoding="utf-8")
 _h7 = PriceHistory(_p7)
 check("a file from a schema this build does not know is discarded rather than "
       "guessed at - its points might mean something else",
-      "schema" in (_h7.last_error or "")
+      "version" in (_h7.last_error or "")
       and _h7.yesterday(NOW).kind == "no_data")
 
 # A record whose points are malformed. THE DEFECT IS A DEFAULTED PRICE.
@@ -1267,7 +1270,7 @@ json.dump({"version": SCHEMA, "days": {
 _h14 = PriceHistory(_p14)
 check("a day record that is not a dict is DROPPED and REPORTED, and the rest "
       "of the file still loads - one bad record is not a bad file",
-      _h14.ok and "unusable day record" in (_h14.last_error or "")
+      _h14.ok and "unusable day" in (_h14.last_error or "")
       and sorted(_h14._days) == ["2026-01-13"])
 _w14 = derived(lambda: _h14.words)
 _y14 = derived(lambda: _h14.yesterday(NOW).kind)
@@ -1288,7 +1291,7 @@ for _shape in ("oops", [1, 2, 3], 7, None, {"points": "not a list"}):
     check(f"...and the same holds for a day record of {type(_shape).__name__} "
           f"{_shape!r}: dropped, reported, and every accessor answers "
           f"({_wX!r}, {_yX!r})",
-          _hX._days == {} and "unusable day record" in (_hX.last_error or "")
+          _hX._days == {} and "unusable day" in (_hX.last_error or "")
           and isinstance(_wX, str) and _yX == "no_data")
 
 _pF = os.path.join(tmpdir(), "price_history.json")
@@ -1297,7 +1300,7 @@ json.dump({"version": float(SCHEMA), "days": {}},
 check(f"a `version` of {float(SCHEMA)!r} is refused although it EQUALS "
       f"{SCHEMA} - a schema check that cannot tell 1 from 1.0 is one that "
       f"would not notice a writer this build has never met",
-      "schema" in (PriceHistory(_pF).last_error or ""))
+      "version" in (PriceHistory(_pF).last_error or ""))
 
 
 # --------------------------------------------------------------------------- #
@@ -1325,7 +1328,7 @@ check(f"...and a store holding a day names the DATE, the POINT COUNT and the "
       f"HOUR COUNT {words_of(_h_words)!r} - 'a cache exists' and 'the cache "
       f"holds yesterday, all 24 hours of it' are different facts, and only "
       f"the second says the horizon will be full tomorrow morning",
-      words_of(_h_words) == f"{YDAY_D} (24 points over 24 h)")
+      words_of(_h_words) == "24 prices over 24 hours for 14 Jan")
 
 # ⚠️ AND THE TWO NUMBERS ARE NOT THE SAME NUMBER - FCST-05's LOW. The row
 # shipped as `f"{d} ({_n_points(rec)} h)"`, which counts POINTS and prints them
@@ -1359,15 +1362,15 @@ check(f"...and the row reports BOTH, each under its own unit: {_qw!r}. "
       f"A day of 96 quarter-hourly prints is 96 points over 24 h, and the "
       f"figure that says whether tomorrow's fill has a whole day to carry is "
       f"the HOUR one",
-      _qw == f"{YDAY_D} (96 points over 24 h)")
+      _qw == "96 prices over 24 hours for 14 Jan")
 check(f"...and specifically the row does NOT say '96 h' {_qw!r} - a point "
       f"count wearing the hour's name is H1's defect, and this row is where "
       f"an operator would have read it",
-      isinstance(_qw, str) and "(96 h)" not in _qw and " (96 points " in _qw)
+      isinstance(_qw, str) and "(96 h)" not in _qw and _qw.startswith("96 prices "))
 check(f"a file that only PARTLY loaded says so in the row {_w14!r}, or the "
       f"days it dropped read as days that were simply never written",
       isinstance(_w14, str) and (_h14.last_error or "") in _w14
-      and "2026-01-13" in _w14)
+      and "13 Jan" in _w14)
 check("NoHistory() has a sentence of its own rather than an empty cell",
       NoHistory().words == "not kept")
 check("...and `words` never raises, whatever the file holds. It is read once "
@@ -1543,8 +1546,8 @@ for _shape, _bad in _BAD_STARTS:
           f"{_wload!r}: ONE point held, and the row that is not a point named "
           f"rather than counted",
           isinstance(_wload, str)
-          and _wload.startswith(f"{TODAY_D} (1 point over 1 h) [")
-          and "1 malformed point row(s) in" in _wload)
+          and _wload.startswith("1 price over 1 hour for 15 Jan [")
+          and "1 bad price in" in _wload)
     # ⚠️ AND THE TWO NOTES ARE GRADED APART, BECAUSE THEY MASK EACH OTHER
     # OTHERWISE (MUTATION.md TEST-16). `_usable_days()` records what it FOUND
     # at open and `_remember()` records what it DROPPED on the refresh; both
@@ -1559,22 +1562,22 @@ for _shape, _bad in _BAD_STARTS:
           f"'{TODAY_D} (1 h)' - the status row reporting a full cache while "
           f"every tariff refresh was dying on it",
           isinstance(_wafter, str)
-          and "malformed point row(s) dropped from" in _wafter
-          and TODAY_D in _wafter)
+          and "bad price dropped from" in _wafter
+          and "15 Jan" in _wafter)
     check(f"...and the row MOVED from what was found to what was dropped "
           f"{_wload.split('[')[-1]!r} -> {_wafter.split('[')[-1]!r}, so the "
           f"two notes are not one note read twice",
           isinstance(_wload, str) and isinstance(_wafter, str)
-          and "malformed point row(s) in" in _wload
-          and "malformed point row(s) in" not in _wafter
-          and "malformed point row(s) dropped from" not in _wload)
+          and "bad price in" in _wload
+          and "bad price in" not in _wafter
+          and "bad price dropped from" not in _wload)
     # ...and a SECOND refresh over the same store is clean, which is the state
     # a restarted add-on comes up in.
     _hM2 = PriceHistory(_pM)
     check(f"...and the store reopened from that file is CLEAN: the whole day "
           f"held and nothing to report {words_of(_hM2)!r}, so the note clears "
           f"itself rather than becoming permanent furniture",
-          words_of(_hM2) == f"{TODAY_D} ({_want} points over {_want} h)"
+          words_of(_hM2) == f"{_want} prices over {_want} hours for 15 Jan"
           and _hM2.last_error is None)
 
 # ...and the shipped path, end to end, through the caller that catches
@@ -1698,7 +1701,7 @@ check(f"...and `words` and `yesterday()` AGREE about that store "
       f"{_h16.words[:44]!r}: neither names a day the file does not hold, and "
       f"both name the write failure. They disagreed - `words` printed two "
       f"full days BESIDE the error while `yesterday()` answered 24 points",
-      YDAY_D not in _h16.words and TODAY_D not in _h16.words
+      "14 Jan" not in _h16.words and "15 Jan" not in _h16.words
       and "could not write" in _h16.words
       and _y16.kind == "no_data" and "could not write" in why(_y16))
 check(f"...and it DEGRADES rather than raising: the carry still returned a "
@@ -2009,9 +2012,9 @@ check("...so calling it without one is a TypeError, not a quiet regression",
 
 _MAIN = open(os.path.join(_APP, "main.py"), encoding="utf-8").read()
 _main_tree = ast.parse(_MAIN)
-_refresh = next(n for n in ast.walk(_main_tree)
-                if isinstance(n, ast.AsyncFunctionDef)
-                and n.name == "run_tariff_refresh")
+_refresh = first((n for n in ast.walk(_main_tree)
+                  if isinstance(n, ast.AsyncFunctionDef)
+                  and n.name == "run_tariff_refresh"), "run_tariff_refresh in main.py")
 _kw = [k.arg for n in ast.walk(_refresh) if isinstance(n, ast.Call)
        for k in n.keywords]
 check(f"the shipped refresh task passes a history {_kw} - the wiring is what "
@@ -2033,9 +2036,9 @@ check("...and `words` reaches the STATUS PAGE as its own row, so what the fill "
       "has to carry from is a fact an operator can read rather than one that "
       "only exists in a log line",
       '("Price history", self.price_history.words)' in _MAIN)
-_rows_fn = next(n for n in ast.walk(_main_tree)
-                if isinstance(n, ast.FunctionDef)
-                and n.name == "status_payload")
+_rows_fn = first((n for n in ast.walk(_main_tree)
+                  if isinstance(n, ast.FunctionDef)
+                  and n.name == "status_payload"), "status_payload in main.py")
 _row_labels = [e.elts[0].value for e in ast.walk(_rows_fn)
                if isinstance(e, ast.Tuple) and len(e.elts) == 2
                and isinstance(e.elts[0], ast.Constant)
diff --git a/goodwe_controller/test_pv.py b/goodwe_controller/test_pv.py
index 2d83c83..ad71ba7 100644
--- a/goodwe_controller/test_pv.py
+++ b/goodwe_controller/test_pv.py
@@ -56,7 +56,8 @@ absence every clear evening.
   Part 8  ⭐⭐ THE SUM, AND WHAT ONE ABSENT MEMBER DOES TO IT.
   Part 9  ⭐ publication at a roster of three, as payload bytes.
   Part 10 the operator surfaces at three - and 0.11.0's, unchanged, at one.
-  Part 11 what this file cannot see, with sizes, and both mutation tables.
+  Part 11 what this file cannot see, with sizes, and the mutation tables.
+  Part 12 TEL-14: the sign, declared per entity (runs before part 11).
 
 ⚠️ MUTATING A MODULE THIS FILE GRADES? PURGE `__pycache__` FIRST - or run
 `tools/mutation_run.sh`, which does. `python3 -B` alone does NOT save you: it
@@ -68,7 +69,8 @@ import asyncio
 import sys
 from pathlib import Path
 
-from app import mqtt, pv
+from app import messages, mqtt, pv
+from named_absence import field, nth, present
 from app.main import Controller
 
 HERE = Path(__file__).resolve().parent
@@ -348,12 +350,12 @@ check("...and a kW sensor is read in kW: 3.21 kW is 3210 W, not 3.21 W. There "
 
 # ⚠️ THE ONE THAT SEPARATES "ABSENT" FROM "STALE", AND IT NEEDS TWO CYCLES.
 c_drop, _, p_drop = run(cycles=2, states=[state("4100", "W"), None], **PV_ON)
-print(f"    published pv by cycle: {[f['pv'] for f in p_drop.frames]}")
+print(f"    published pv by cycle: {[field(f, 'pv') for f in p_drop.frames]}")
 check("⭐ A FAILED READ CLEARS THE PREVIOUS GOOD ONE. The cycle after a 4100 W "
       "reading disappears publishes an ABSENCE, not 4100 W again - a value "
       "that survives its own sensor is indistinguishable from a real one at "
       "the moment somebody is working out whether the sun was shining",
-      [f["pv"] for f in p_drop.frames] == [4100.0, None]
+      [field(f, "pv") for f in p_drop.frames] == [4100.0, None]
       and c_drop.pv_w is None and "no state" in c_drop.pv_why)
 
 
@@ -378,9 +380,9 @@ def wire(values, include=("pv",)):
     return pub.client.msgs
 
 
-_zero = run(cycles=1, states=[state("0", "W")], **PV_ON)[2].frames[-1]
-_absent = run(cycles=1, states=[None], **PV_ON)[2].frames[-1]
-_nosrc = p_off.frames[-1]
+_zero = nth(run(cycles=1, states=[state("0", "W")], **PV_ON)[2].frames, -1)
+_absent = nth(run(cycles=1, states=[None], **PV_ON)[2].frames, -1)
+_nosrc = nth(p_off.frames, -1)
 print(f"    no source : 'pv' in frame = {'pv' in _nosrc}")
 def pv_msg(values):
     """The `goodwe_ctl/pv` message the shipped publisher emits, or None."""
@@ -388,17 +390,17 @@ def pv_msg(values):
     return got[0] if got else None
 
 
-print(f"    no reading: {_absent['pv']!r}  -> wire {pv_msg(_absent)}")
-print(f"    zero watts: {_zero['pv']!r}  -> wire {pv_msg(_zero)}")
+print(f"    no reading: {field(_absent, 'pv')!r}  -> wire {pv_msg(_absent)}")
+print(f"    zero watts: {field(_zero, 'pv')!r}  -> wire {pv_msg(_zero)}")
 check("NO SOURCE: an install that never set `pv_entity` publishes no `pv` key "
       "at all - there is no entity to feed, so feeding one would be a topic "
       "nothing announced",
-      "pv" not in _nosrc)
+      present(_nosrc) and "pv" not in _nosrc)
 check("NO READING: the key is PRESENT and its value is None, which is a "
       "different frame from the one above. 'the option is off' and 'the sensor "
       "did not answer' are two facts and one field cannot carry both",
       "pv" in _absent and _absent["pv"] is None)
-check("ZERO WATTS: 0.0, published as a number", _zero["pv"] == 0.0)
+check("ZERO WATTS: 0.0, published as a number", field(_zero, "pv") == 0.0)
 check("⭐ AND ON THE WIRE THE LAST TWO ARE DIFFERENT BYTES ON THE SAME TOPIC: "
       "`None` - which is Home Assistant's own payload for 'this sensor has no "
       "value', so the entity goes to `unknown` and the recorder records a GAP "
@@ -441,7 +443,7 @@ def announced(opts):
 check("with a source: `pv` is announced AND published",
       "pv" in announced(PV_ON) and "pv" in _absent)
 check("without one: announced by nothing and published by nothing",
-      "pv" not in announced({}) and "pv" not in _nosrc)
+      "pv" not in announced({}) and present(_nosrc) and "pv" not in _nosrc)
 check("...and the predicate is ONE expression, `mqtt.optional_keys()`, read by "
       "the announcement and by `Controller.publish()` alike - two spellings is "
       "how an entity gets announced that nothing feeds",
@@ -473,7 +475,7 @@ _a1 = mqtt.discovery_payloads(include=mqtt.optional_keys(PV_ON))
 _a2 = mqtt.discovery_payloads(include=mqtt.optional_keys(PV_ON))
 _pv_cfg = [c for _t, c in _a1 if c["unique_id"] == "goodwe_ctl_pv"]
 print(f"    composed entity_id: "
-      f"{compose(mqtt.DEVICE['name'], _pv_cfg[0]['name'])}")
+      f"{compose(mqtt.DEVICE['name'], nth(_pv_cfg, 0)['name'])}")
 check("a restart re-announces the SAME bytes, so Home Assistant sees the entity "
       "it already has rather than a new one beside a dead one - the history is "
       "continuous across a restart of the add-on",
@@ -483,7 +485,8 @@ check("a restart re-announces the SAME bytes, so Home Assistant sees the entity
 check("...and the id Home Assistant composes for it is "
       "`sensor.goodwe_pv_power`, which is what DOCS.md tells an operator to put "
       "on a dashboard - device name plus entity name, NOT the object_id",
-      compose(mqtt.DEVICE["name"], _pv_cfg[0]["name"])
+      len(_pv_cfg) == 1
+      and compose(mqtt.DEVICE["name"], _pv_cfg[0]["name"])
       == "sensor.goodwe_pv_power"
       and _pv_cfg[0]["state_topic"] == "goodwe_ctl/pv")
 
@@ -496,6 +499,11 @@ def rows_of(c):
     return [r["text"] for r in c.checks()]
 
 
+def pv_rows(c):
+    """The solar rows of the status page (UX-08: selected by id, not wording)."""
+    return [r for r in c.checks() if r.get("id") == "pv"]
+
+
 def page_rows(c):
     return c.status_payload()["rows"]
 
@@ -507,42 +515,44 @@ check("⚠️ AN UNSET OPTION ADDS NO STATUS ROW AND NO PAGE ROW - not a caution
       "is unset, because an unset forecast leaves a money guard without an "
       "input; this is instrumentation and a permanent caution on every install "
       "that never asked for it is the warning spam the card forbids",
-      not [t for t in _off_rows if "PV" in t]
-      and not [r for r in page_rows(c_off) if r[0] == "PV"])
+      not pv_rows(c_off)
+      and not [r for r in page_rows(c_off) if r[0] == "Solar production"])
 check("...and the whole row list is otherwise the same length, so nothing else "
       "moved either", len(_on_rows) == len(_off_rows) + 1)
-_pv_row = [t for t in _on_rows if t.startswith("PV production")]
+_pv_row = [r["text"] for r in pv_rows(c_on)]
 print(f"    {_pv_row}")
-# habit 14: the ordered pair - value, entity and unit each in its OWN slot in
-# the literal sentence, so a transposition is visible rather than merely
-# present.
-check("a good read says the watts, the entity it came from and the unit it was "
-      "reported in, each in its own slot",
-      _pv_row == ["PV production: 3210 W from sensor.pv_power "
-                  "(reported in W)"]
-      and ("PV", "3 210 W") in page_rows(c_on))
+# UX-08: the row says the watts, and no entity id (STYLE.md). The unit it was
+# read in is DEBUG detail; a refused unit still gets its own caution below.
+check("a good read says the watts, as a green row, and names no entity id",
+      _pv_row == [f"Solar production: {messages.signed_watts(3210)}"]
+      and "sensor." not in _pv_row[0]
+      and pv_rows(c_on)[0]["ok"] is True
+      and ("Solar production", "3 210 W") in page_rows(c_on))
 
 c_bad, _, _ = run(cycles=1, states=[state("1234", "%")], **PV_ON)
-_bad_row = [r for r in c_bad.checks() if r["text"].startswith("PV production")]
+_bad_row = pv_rows(c_bad)
 print(f"    {[r['text'] for r in _bad_row]}")
-check("a refused read says WHICH refusal, and names the entity - 'no reading' "
-      "on its own sends an operator to look at a working sensor",
+check("a refused read says WHICH refusal - 'no reading' on its own sends an "
+      "operator to look at a working sensor",
       len(_bad_row) == 1
-      and _bad_row[0]["text"] == ("PV production: no reading from "
-                                  "sensor.pv_power - unit '%' is not one of "
-                                  "mW, W, kW, MW, GW, TW - it cannot be read "
-                                  "in watts"))
+      and _bad_row[0]["text"] == ("Solar production: no reading, the entity's "
+                                  "unit is not a power unit"))
+check("...and every refusal pv.watts() can give has its own plain words",
+      len({messages.pv_problem(pv.watts(st)[1]) for st in (
+          None, state("unavailable", "W"), state("abc", "W"),
+          state("12", ""), state("12", "%"))}) == 5)
 check("⭐ ...and it is a CAUTION, never a `bad` row: `status_payload()` builds "
       "NOT READY out of rows that are neither ok nor warn, and a telemetry "
       "channel that could put a battery site into NOT READY would be "
       "observability with a foot in the control path",
-      _bad_row[0] == {"ok": False, "warn": True, "text": _bad_row[0]["text"]}
-      and not c_bad.status_payload()["banner"].startswith("NOT READY")
+      len(_bad_row) == 1
+      and _bad_row[0]["ok"] is False and _bad_row[0]["warn"] is True
+      and not c_bad.status_payload()["banner"].startswith(messages.NOT_READY)
       and c_bad.status_payload()["level"] != "bad"
       and c_bad.status_payload()["banner"]
       == c_off.status_payload()["banner"])
 check("...and the page row renders an absence as an em dash, not as 0 W",
-      ("PV", "—") in page_rows(c_bad))
+      ("Solar production", "—") in page_rows(c_bad))
 
 
 # ==============================================================================
@@ -663,7 +673,9 @@ NEEDLES = ("pv_entity", "pv_w", "pv_why", "optional_keys", "ABSENT_AS_UNKNOWN",
            # TEL-12's own names. `pv_entities` and `pv_entity` share a prefix so
            # the first would have caught it anyway; spelled out because a scope
            # that only works by accident stops working when a name is renamed.
-           "pv_entities", "pv_parts", "pv_roster", "entity_is_ignored")
+           "pv_entities", "pv_parts", "pv_roster", "entity_is_ignored",
+           # TEL-14's.
+           "pv_invert_entities", "stray_inverts", "NEGATIVE_W")
 
 
 def touches(src: str) -> bool:
@@ -685,13 +697,24 @@ print(f"    {len(APP)} modules under app/; TEL-11 material is in: {_touch}")
 check(f"PRECONDITION: the scan found the whole package, not a subset - "
       f"{len(APP)} modules", len(APP) >= 25 and "control.py" in
       [f.name for f in APP])
-check("⭐ EXACTLY THREE MODULES CAN SEE THE MATERIAL: `pv.py` (the reader), "
-      "`main.py` (the read and the two operator surfaces) and `mqtt.py` (the "
-      "publication). `control.py`, `arbiter.py`, `allocator.py`, `peakguard.py`, "
-      "`arbitrage.py`, `maintenance.py`, `clamp.py`, `freeze.py`, "
-      "`watchdog.py`, `delivery.py` and `circulation.py` do not mention it in "
-      "any spelling, comments included",
-      _touch == ["main.py", "mqtt.py", "pv.py"])
+# UX-13 adds the settings surface: labels (messages.py), a settings warning
+# (validate.py) and the page's layout and derivation (uilayout.py, uimodel.py).
+# None of them decides anything, so the decision modules stay excluded.
+# UX-13 P1 adds homeview.py, the Home screen's read-only view: its House tile
+# is grid + solar + battery, and it shows nothing without a solar reading.
+_DECIDERS = ("control.py", "arbiter.py", "allocator.py", "peakguard.py",
+             "arbitrage.py", "maintenance.py", "clamp.py", "freeze.py",
+             "watchdog.py", "delivery.py", "circulation.py")
+check("⭐ ONLY THE READER, THE PUBLISHER AND THE SETTINGS SURFACE SEE THE "
+      "MATERIAL: `pv.py` (the reader), `main.py` (the read and the two operator "
+      "surfaces), `homeview.py` (the Home screen's view), `mqtt.py` (the "
+      "publication), and `messages.py`, `validate.py`, `uilayout.py` and "
+      "`uimodel.py` (settings). "
+      f"{', '.join(_DECIDERS)} do not mention it in any spelling, comments "
+      "included",
+      _touch == ["homeview.py", "main.py", "messages.py", "mqtt.py", "pv.py",
+                 "uilayout.py", "uimodel.py", "validate.py"]
+      and not set(_DECIDERS) & set(_touch))
 # habit 4 in the instrument: a scanner that cannot go red is not a scanner.
 check("...and the scan CAN go red - a module body with the material in it is "
       "caught, so the green above is the tree speaking and not the scanner "
@@ -867,8 +890,8 @@ print("9. ⭐ publication at a roster of three, as PAYLOAD BYTES")
 # Part 3 did this for one entity. The new state is "several configured, one of
 # them gone", and the number that must NOT appear on the topic is a specific
 # plausible number rather than a wrong shape.
-_m_full = run(cycles=1, by_entity=FULL, **PV_MANY)[2].frames[-1]
-print(f"    3 healthy   : {_m_full['pv']!r}  -> wire {pv_msg(_m_full)}")
+_m_full = nth(run(cycles=1, by_entity=FULL, **PV_MANY)[2].frames, -1)
+print(f"    3 healthy   : {field(_m_full, 'pv')!r}  -> wire {pv_msg(_m_full)}")
 check("⭐ THREE HEALTHY: one topic, one number, the SITE total - 3750.0. There "
       "is deliberately no per-entity topic: the recorder statistic OPT-10 reads "
       "back is the site figure, and a per-inverter breakdown is a dashboard "
@@ -878,7 +901,7 @@ check("⭐ THREE HEALTHY: one topic, one number, the SITE total - 3750.0. There
       == [pv_msg(_m_full)])
 _holed = []
 for _miss, (_script, _partial) in HOLES.items():
-    _fr = run(cycles=1, by_entity=_script, **PV_MANY)[2].frames[-1]
+    _fr = nth(run(cycles=1, by_entity=_script, **PV_MANY)[2].frames, -1)
     _msg = pv_msg(_fr)
     print(f"    {_miss} dead -> wire {_msg}   (partial would have been "
           f"{_partial:.0f} W -> {str(_partial)!r})")
@@ -917,47 +940,39 @@ print()
 print("10. the operator surfaces at a roster of three - and 0.11.0 at one")
 # ==============================================================================
 _c_many, _, _ = run(cycles=1, by_entity=FULL, **PV_MANY)
-_many_row = [t for t in rows_of(_c_many) if t.startswith("PV production")]
+_many_row = [r["text"] for r in pv_rows(_c_many)]
 print(f"    {_many_row}")
-# habit 14 at a roster: the total in its own slot and EVERY contributor in its
-# own slot with its own watts and its own unit, so a sum that disagrees with the
-# addends printed beside it is visible in the sentence.
-check("a healthy roster says the SITE total, how many entities it came from, "
-      "and then every entity with its own watts and its own unit - so a total "
-      "that disagrees with the numbers printed beside it is visible rather than "
-      "merely present",
-      _many_row == ["PV production: 3750 W from 3 entities "
-                    f"({E1} 1200 W in W, {E2} 2100 W in kW, "
-                    f"{E3} 450 W in W)"]
-      and ("PV", "3 750 W") in page_rows(_c_many))
+# UX-08: the row carries the site total and the number of sources; the
+# per-source figures are DOCS/DEBUG detail (DECISIONS/UX-08-short-notifications).
+check("a healthy roster says the SITE total and how many sources it came from",
+      _many_row == [f"Solar production: {messages.signed_watts(3750)} from 3 "
+                    f"sources"]
+      and ("Solar production", "3 750 W") in page_rows(_c_many))
 
 _c_gap, _, _ = run(cycles=1, by_entity=HOLES[E2][0], **PV_MANY)
-_gap_row = [r for r in _c_gap.checks() if r["text"].startswith("PV production")]
+_gap_row = pv_rows(_c_gap)
 print(f"    {[r['text'] for r in _gap_row]}")
-check("⭐ A HOLED ROSTER SAYS THERE IS NO SITE TOTAL, IN THOSE WORDS, names the "
-      "entity that is missing and why - AND names what the others reported. The "
-      "partial information is not thrown away, it is put where a HUMAN reading "
+check("⭐ A HOLED ROSTER SAYS THERE IS NO SITE TOTAL, IN THOSE WORDS, and names "
+      "the missing source by its place in the list - put where a HUMAN reading "
       "the page live will see it, and kept out of the number a recorder hands "
       "back cold a week later",
       len(_gap_row) == 1
-      and _gap_row[0]["text"] == (
-          "PV production: NO SITE TOTAL - only 2 of 3 entities are reporting "
-          "and a partial sum would understate production: "
-          f"{E2} - no state (entity missing, or the read failed). "
-          f"Reporting: {E1} 1200 W, {E3} 450 W"))
+      and _gap_row[0]["text"] == ("Solar production: no total, source 2 of 3 "
+                                  "has no reading"))
 check("⭐ ...and it is a CAUTION, never a `bad` row, at a roster exactly as at "
       "one entity: `status_payload()` builds NOT READY out of rows that are "
       "neither ok nor warn, and a telemetry channel that could put a battery "
       "site into NOT READY would be observability with a foot in the control "
       "path",
-      _gap_row[0] == {"ok": False, "warn": True, "text": _gap_row[0]["text"]}
+      len(_gap_row) == 1
+      and _gap_row[0]["ok"] is False and _gap_row[0]["warn"] is True
       and _c_gap.status_payload()["level"] != "bad"
       and _c_gap.status_payload()["banner"]
       == c_off.status_payload()["banner"])
 check("...and the page row is an em dash, not a smaller number: the one row an "
       "operator glances at cannot show a partial total either",
-      ("PV", "—") in page_rows(_c_gap)
-      and ("PV", "3 300 W") not in page_rows(_c_gap))
+      ("Solar production", "—") in page_rows(_c_gap)
+      and ("Solar production", "3 300 W") not in page_rows(_c_gap))
 
 # ⚠️ THE ACCEPTANCE CRITERION THE REST OF THIS FILE CANNOT STATE: at a roster of
 # ONE the surfaces are 0.11.0's, character for character. `c_on` above is the
@@ -967,27 +982,24 @@ _c_one_new, _, _ = run(cycles=3, by_entity={E1: [state("3210", "W")]},
                        pv_entities=[E1])
 print(f"    one entity via pv_entities : "
       f"{[t for t in rows_of(_c_one_new) if 'PV' in t]}")
-check("⭐ ONE ENTITY IS 0.11.0's PATH, however it was declared: the status "
-      "sentence, the page row and the published value are the same shape "
-      "through `pv_entity` and through a one-member `pv_entities`, and the "
-      "sentence is 0.11.0's own - `(reported in W)`, not `from 1 entities`",
-      [t.replace(E1, "sensor.pv_power")
-       for t in rows_of(_c_one_new) if "PV" in t]
-      == [t for t in rows_of(c_on) if "PV" in t]
-      == ["PV production: 3210 W from sensor.pv_power (reported in W)"]
+check("⭐ ONE ENTITY IS ONE PATH, however it was declared: the status "
+      "sentence, the page row and the published value are the same through "
+      "`pv_entity` and through a one-member `pv_entities` - no `from 1 sources`",
+      [r["text"] for r in pv_rows(_c_one_new)]
+      == [r["text"] for r in pv_rows(c_on)]
+      == [f"Solar production: {messages.signed_watts(3210)}"]
       and page_rows(_c_one_new)[[r[0] for r in page_rows(_c_one_new)]
-                                .index("PV")] == ("PV", "3 210 W"))
-check("...and a refused read at a roster of one is 0.11.0's refusal sentence "
-      "too, not the roster one - `no reading from <entity> - <reason>`",
-      [r["text"] for r in run(cycles=1, pv_entities=[E1],
-                              by_entity={E1: [state("1234", "%")]})[0].checks()
-       if r["text"].startswith("PV production")]
-      == [f"PV production: no reading from {E1} - unit '%' is not one of "
-          "mW, W, kW, MW, GW, TW - it cannot be read in watts"])
+                                .index("Solar production")] == ("Solar production", "3 210 W"))
+check("...and a refused read at a roster of one is the one-sensor refusal "
+      "too, not the roster one - `no reading, <reason>`",
+      [r["text"] for r in pv_rows(run(cycles=1, pv_entities=[E1],
+                                      by_entity={E1: [state("1234", "%")]})[0])]
+      == [r["text"] for r in _bad_row])
 
 # ⚠️ AND THE REPLACEMENT IS STATED RATHER THAN SILENT.
 _c_both, _, _ = run(cycles=1, by_entity=FULL, **dict(PV_ON, **PV_MANY))
-_ign = [r for r in _c_both.checks() if "IGNORED" in r["text"]]
+_IGN = messages.row_pv_single_ignored()
+_ign = [r for r in _c_both.checks() if r["text"] == _IGN]
 print(f"    {[r['text'] for r in _ign]}")
 check("⭐ BOTH KEYS SET: the page SAYS `pv_entity` is ignored and how many "
       "entities are summed instead. `entities()` REPLACES rather than unions - "
@@ -995,27 +1007,221 @@ check("⭐ BOTH KEYS SET: the page SAYS `pv_entity` is ignored and how many "
       "key still names - but a replacement nobody is told about is the 'one of "
       "which silently wins' this config refuses elsewhere",
       len(_ign) == 1 and _ign[0]["ok"] is False and _ign[0]["warn"] is True
-      and _ign[0]["text"] == ("PV production: `pv_entities` is set, so "
-                              "`pv_entity` is IGNORED - the 3 entities in the "
-                              "list are what is summed. Clear `pv_entity` to "
-                              "remove this caution")
+      and "clear “Solar production entity”" in _ign[0]["text"]
       and _c_both.pv_w == 3750.0)
 check("...and that caution appears ONLY when both are set - not on the 0.11.0 "
       "configuration, not on a list-only one, and not on an install with "
       "neither",
-      not [r for r in c_on.checks() if "IGNORED" in r["text"]]
-      and not [r for r in _c_many.checks() if "IGNORED" in r["text"]]
-      and not [r for r in c_off.checks() if "IGNORED" in r["text"]])
+      not [r for r in c_on.checks() if r["text"] == _IGN]
+      and not [r for r in _c_many.checks() if r["text"] == _IGN]
+      and not [r for r in c_off.checks() if r["text"] == _IGN])
 check("...and an install with NO PV roster still adds no row of any kind - the "
       "whole of TEL-12 is invisible at the shipped default",
-      not [t for t in rows_of(c_off) if "PV" in t]
-      and not [r for r in page_rows(c_off) if r[0] == "PV"]
+      not pv_rows(c_off)
+      and not [r for r in page_rows(c_off) if r[0] == "Solar production"]
       and len(rows_of(_c_many)) == len(rows_of(c_off)) + 1
       and run(cycles=1)[1].state_calls == []
       and run(cycles=1, pv_entities=[])[1].state_calls == []
       and run(cycles=1, pv_entities=["  "])[1].state_calls == [])
 
 
+# ==============================================================================
+print()
+print("12. TEL-14: the sign, declared PER ENTITY")
+# ==============================================================================
+# Some installs' PV entities read POSITIVE for consumption and NEGATIVE for
+# production (a kWh meter or an ESPHome clamp in the PV circuit). The fixture is
+# a MIXED roster, because that is the case a global flag gets wrong:
+#   E1  an inverter, positive = producing       1200 W  -> 1200
+#   E2  a meter, NEGATIVE = producing, flipped  -2.1 kW -> 2100
+#   E3  a meter at night, correctly signed, NOT flipped: -30 W standby -> -30
+# and the values keep every wrong reduction apart:
+#   right 3270; no flip -930; flip all 930; abs() of every member 3330;
+#   flip E3 instead of E2 -870.
+# ⚠️ EVERY CHECK BELOW READS THROUGH `_at`/`_row` AND NEVER INDEXES BLIND, so a
+# missing value is a NAMED FAIL rather than a traceback that hides the rest.
+
+
+def _at(seq, i):
+    """`seq[i]`, or None when there is no such element."""
+    try:
+        return seq[i]
+    except (IndexError, KeyError, TypeError):
+        return None
+
+
+def _row(c, needle):
+    """Every status-row dict whose text contains `needle` (a list, maybe [])."""
+    try:
+        return [r for r in c.checks() if needle in r.get("text", "")]
+    except Exception as e:                      # noqa: BLE001 - named, below
+        return [{"text": f"checks() raised {e!r}", "ok": None, "warn": None}]
+
+
+MIX = {E1: [state("1200", "W")], E2: [state("-2.1", "kW")],
+       E3: [state("-30", "W")]}
+MIX_TOTAL = 3270.0
+_MIX_WRONG = {"no flip": -930.0, "flip all": 930.0, "abs": 3330.0,
+              "flip E3 not E2": -870.0}
+PV_FLIP = dict(PV_MANY, pv_invert_entities=[E2])
+check(f"PRECONDITION: the mixed fixture's right answer {MIX_TOTAL:g} W is apart "
+      f"from every wrong reduction {_MIX_WRONG}",
+      MIX_TOTAL not in _MIX_WRONG.values()
+      and len(set(_MIX_WRONG.values())) == len(_MIX_WRONG))
+
+# --- the option ---------------------------------------------------------------
+check("inverted() is the stripped, non-empty entries of `pv_invert_entities`, "
+      "and a 0.12.0 blob (no key at all) flips nothing",
+      pv.inverted({"pv_invert_entities": [" sensor.a ", "", None, "sensor.b"]})
+      == frozenset({"sensor.a", "sensor.b"})
+      and pv.inverted({}) == frozenset()
+      and pv.inverted({"pv_invert_entities": None}) == frozenset())
+
+# --- the arithmetic -----------------------------------------------------------
+_t_mix = pv.total([(e, _at(MIX[e], 0)) for e in (E1, E2, E3)],
+                  pv.inverted(PV_FLIP))
+_t_raw = pv.total([(e, _at(MIX[e], 0)) for e in (E1, E2, E3)])
+print(f"    mixed, E2 flipped: {_t_mix[0]}   no flip: {_t_raw[0]}")
+check(f"⭐ A MIXED ROSTER: only the listed entity is flipped, before the sum - "
+      f"{MIX_TOTAL:g} W, not any of {_MIX_WRONG}",
+      _t_mix[0] == MIX_TOTAL
+      and [w for _e, w, _y in _t_mix[2]] == [1200.0, 2100.0, -30.0])
+check("⭐ DEFAULT IS 0.12.0: with no flip `total()` answers exactly what it "
+      "always did - the raw sum, the same `why`, the same parts",
+      _t_raw == (-930.0, "3 entities",
+                 [(E1, 1200.0, "W"), (E2, -2100.0, "kW"), (E3, -30.0, "W")]))
+_t_zero = pv.total([(E2, state("0", "W"))], frozenset({E2}))
+check("a flipped 0 W is +0.0, never -0.0 - so the wire says `0.0` and the page "
+      "says `0 W`, not `-0`",
+      _t_zero[0] == 0.0 and str(_t_zero[0]) == "0.0"
+      and f"{_t_zero[0]:.0f}" == "0")
+_t_gone = pv.total([(E1, state("1200")), (E2, None)], frozenset({E2}))
+check("a flipped member that is ABSENT is still an absence of the total - the "
+      "flip never turns None into a number",
+      _t_gone[0] is None and _at(_at(_t_gone[2], 1), 1) is None)
+check("a single flipped entity keeps 0.11.0's pass-through `why` (the unit)",
+      pv.total([(E2, state("-13", "W"))], frozenset({E2}))
+      == (13.0, "W", [(E2, 13.0, "W")]))
+
+# --- the read path, the wire and the page -------------------------------------
+_c_mix, _, _p_mix = run(cycles=1, by_entity=MIX, **PV_FLIP)
+_f_mix = _at(_p_mix.frames, -1) or {}
+print(f"    controller pv_w {_c_mix.pv_w}   wire {pv_msg(_f_mix)}")
+check("⭐ END TO END: the controller reads the option, and the MQTT `pv` row "
+      "carries the corrected site total",
+      _c_mix.pv_w == MIX_TOTAL
+      and pv_msg(_f_mix) == ("goodwe_ctl/pv", "3270.0", False))
+_mix_row = [r["text"] for r in _row(_c_mix, "from 3 sources")]
+print(f"    {_mix_row}")
+check("the status row prints the total AFTER the sign",
+      _mix_row == [f"Solar production: {messages.signed_watts(MIX_TOTAL)} "
+                   f"from 3 sources"])
+check("...and the page's PV row is the corrected total",
+      ("Solar production", "3 270 W") in page_rows(_c_mix))
+_c_hole_f, _, _ = run(cycles=1, by_entity=dict(MIX, **{E1: [None]}), **PV_FLIP)
+check("a holed roster with a flipped member names the missing source, not "
+      "the flipped one",
+      [r["text"] for r in _row(_c_hole_f, "no total")]
+      == ["Solar production: no total, source 1 of 3 has no reading"])
+
+# The owner's report, at a roster of one: a meter reading +13 W at night.
+_OWN = "sensor.pv_meter_power"
+_c_own, _, _ = run(cycles=1, by_entity={_OWN: [state("13", "W")]},
+                   pv_entity=_OWN, pv_invert_entities=[_OWN])
+_c_own0, _, _ = run(cycles=1, by_entity={_OWN: [state("13", "W")]},
+                    pv_entity=_OWN)
+check("⭐ THE REPORTED CASE: 13 W of night-time standby on a reversed meter is "
+      "-13 W once flipped, the row says so and marks it - and it raises NO "
+      "negative caution, because -13 W is standby and not a reversed sign - "
+      "and NO stray caution, because a lone `pv_entity` is in the roster",
+      _c_own.pv_w == -13.0
+      and [r["text"] for r in pv_rows(_c_own)]
+      == ["Solar production: -13 W, sign reversed"]
+      and _row(_c_own, "Reversed-sign solar entities") == [])
+check("...and WITHOUT the option it is the plain row",
+      [r["text"] for r in pv_rows(_c_own0)] == ["Solar production: 13 W"])
+
+# Whitespace: the roster entry and the invert entry differ only by padding. Both
+# sides must normalise the same way, or the read path leaves the sign unflipped
+# while the page marks it, or the page calls a flipped entity a stray.
+_c_pad, _, _ = run(cycles=1, by_entity=MIX,
+                   pv_entities=[E1, f" {E2}", E3],
+                   pv_invert_entities=[f"{E2} "])
+check("⭐ PADDING: ` sensor.x` in the roster and `sensor.x ` in "
+      "`pv_invert_entities` are the same entity - flipped on the read path, "
+      "marked on the page, and no stray caution",
+      _c_pad.pv_w == MIX_TOTAL
+      and _row(_c_pad, "Reversed-sign solar entities") == [])
+
+# --- the negative caution -------------------------------------------------------
+def _neg(watts_by_entity, flip=()):
+    opts = dict(PV_MANY, pv_invert_entities=list(flip))
+    c, _, _ = run(cycles=1, by_entity={e: [state(str(w), "W")]
+                                       for e, w in watts_by_entity.items()},
+                  **opts)
+    return _row(c, "reads ")
+
+
+_n_add = _neg({E1: 1200, E2: -1500, E3: 450})
+_n_rm = _neg({E1: 1200, E2: 1500, E3: 450}, flip=[E2])
+print(f"    {[r['text'] for r in _n_add + _n_rm]}")
+check("⭐ AN UNFLIPPED ENTITY FAR BELOW ZERO gets a caution that names it by "
+      "its place in the list, its watts, and says to ADD it to the "
+      "setting 'Reversed-sign solar entities' (`pv_invert_entities`)",
+      [r["text"] for r in _n_add]
+      == ["Solar production: source 2 reads -1 500 W, add it to "
+          "“Reversed-sign solar entities”"])
+check("...and a FLIPPED one far below zero is told to REMOVE it instead",
+      len(_n_rm) == 1 and "remove it from “Reversed-sign solar entities”"
+      in (_at(_n_rm, 0) or {}).get("text", ""))
+check("⭐ ...and it is a CAUTION, never a `bad` row - a telemetry sign cannot "
+      "put a battery site into NOT READY",
+      bool(_n_add) and all(r.get("ok") is False and r.get("warn") is True
+                           for r in _n_add + _n_rm))
+check(f"the threshold is {pv.NEGATIVE_W:g} W per ENTITY: -50 W is standby and "
+      "stays quiet, -51 W cautions",
+      pv.NEGATIVE_W == -50.0
+      and _neg({E1: -50, E2: 0, E3: 0}) == []
+      and len(_neg({E1: -51, E2: 0, E3: 0})) == 1)
+check("⭐ ...PER ENTITY, NOT ON THE TOTAL: three correctly signed meters at "
+      "-20 W standby each (total -60 W) raise nothing, and a reversed -1500 W "
+      "hidden in a positive total (+1650 W) is still caught",
+      _neg({E1: -20, E2: -20, E3: -20}) == []
+      and len(_neg({E1: 2700, E2: -1500, E3: 450})) == 1)
+
+# --- the stray entry ------------------------------------------------------------
+_c_typo, _, _ = run(cycles=1, by_entity=FULL,
+                    **dict(PV_MANY, pv_invert_entities=["sensor.pv_wset"]))
+check("a `pv_invert_entities` entry naming no PV entity in use is a named "
+      "caution (a typo would otherwise leave the sign silently unflipped)",
+      [(r["text"], r.get("ok"), r.get("warn"))
+       for r in _row(_c_typo, "not a solar entity in use")]
+      == [("Solar production: entry 1 of “Reversed-sign solar entities” is "
+           "not a solar entity in use", False, True)]
+      and _row(_c_mix, "not a solar entity in use") == [])
+
+# --- default: byte-identical to 0.12.0 ------------------------------------------
+_c_d0, _, _p_d0 = run(cycles=1, by_entity=MIX, **PV_MANY)
+_c_d1, _, _p_d1 = run(cycles=1, by_entity=MIX,
+                      **dict(PV_MANY, pv_invert_entities=[]))
+check("⭐ DEFAULT: `pv_invert_entities: []` and a 0.12.0 blob with no such key "
+      "give the same rows, the same frame and the raw sum",
+      [r["text"] for r in _c_d0.checks()] == [r["text"] for r in _c_d1.checks()]
+      and _at(_p_d0.frames, -1) == _at(_p_d1.frames, -1)
+      and _c_d0.pv_w == -930.0)
+
+# --- still not a control input --------------------------------------------------
+_BIG_FLIP = {E1: [state("1500", "W")], E2: [state("-4.5", "kW")],
+             E3: [state("2000", "W")]}
+_c_bf, _h_bf, _ = run(**_stim, by_entity=_BIG_FLIP,
+                      **dict(PV_MANY, pv_invert_entities=[E2]))
+check("⭐ NOT A CONTROL INPUT, WITH A FLIP: 40 cycles against the settled 600 W "
+      "import write exactly what `unset` writes, and the flip really did move "
+      "the reading (8000 W, part 6's shift precondition)",
+      _h_bf.writes == _w_none and _c_bf.target == _c_none.target
+      and _c_bf.pv_w == BIG_TOTAL)
+
+
 # ==============================================================================
 print()
 print("11. what this file CANNOT see, with sizes - and the mutation table")
@@ -1028,10 +1234,9 @@ for line in [
     "  (mqtt/const.py PAYLOAD_NONE, mqtt/sensor.py's `_message_received`,",
     "  retrieved 2026-09-24) and quoted in app/mqtt.py. No HA runs in this",
     "  suite, so what is graded here is the BYTES this add-on publishes.",
-    "Whether the operator's PV sensor is telling the truth. A sensor wired",
-    "  backwards reads -4 kW at noon; this file asserts that the sign is",
-    "  published unchanged, never that it is right. That is what the history",
-    "  the card creates is FOR - see DECISIONS/TEL-11-pv-production.md §2.",
+    "Whether the operator's PV sensor is telling the truth. TEL-14 lets the",
+    "  installer declare a reversed one; this file grades the flip and the",
+    "  -50 W caution, never that the declaration is right.",
     "The control-path claim OUTSIDE app/. `tools/`, the ESPHome firmware and",
     "  the ingress page are not scanned by part 6's census.",
     "A roster of more than one INVERTER (CFG-04's battery kind). Every",
@@ -1138,6 +1343,10 @@ print("    time - see DECISIONS/TEL-11-pv-production.md §5 for the transcript."
 print("    ⚠️ A RED COUNT IS A PROPERTY OF THE SUITE AS MUCH AS OF THE MUTATION:")
 print("    these name THIS tree. Re-measure rather than inherit.")
 
+print()
+print("    TEL-14: 14 mutations, all red, no survivors - bytes and named reds in")
+print("    DECISIONS/TEL-14-pv-sign.md §4.")
+
 print()
 if fails:
     print(f"{len(fails)} FAILED:")
diff --git a/goodwe_controller/test_refusal.py b/goodwe_controller/test_refusal.py
new file mode 100644
index 0000000..a396727
--- /dev/null
+++ b/goodwe_controller/test_refusal.py
@@ -0,0 +1,475 @@
+"""Runnable check for SAFETY-52.  `python3 test_refusal.py`
+
+A battery that refuses to give power (the BMS cut-out) used to leave the
+command standing at its last ask for hours: +5000 W for 11.87 h on 2026-09-06,
++1940 W for 3 h 55 m on the bus on 2026-09-19. Now a refused direction is held
+at 0 W, a 200 W probe asks every 15 minutes, and the refusal ends on charge, on
+an answered probe, on stop/start and when another writer takes the wire.
+DECISIONS/SAFETY-52 has the record and the replay figures.
+
+Mutating the modules this file grades? Purge `__pycache__` first, or run
+`tools/mutation_run.sh`, which does - see MUTATION.md.
+
+Parts 1-5 drive the REAL `Controller` (read_inputs + cycle, the real
+SAFETY-37/57 gate) against a scripted battery whose reading stands at exactly
+-4 W for any request >= -4 W at the cut-out, and follows otherwise. Time is the
+`now_mono` handed to `read_inputs()`, so 12 hours run in seconds. `OLD` runs the
+same fixture with `refused=None` forced into `compute()` - release/1.0's law -
+so every "new" figure is shown beside the one it replaces. Part 4 also runs
+`compute()` alone, as the bus saw 09-19 before the gate existed.
+
+Mutations, each on a copy of this tree purged of `__pycache__`, graded with
+`python3 -B` over test_refusal, test_control, test_clamp, test_telemetry and
+test_messages (MUTATION.md). Reds are failing checks, on this tree:
+
+  #   mutation                                                 reds
+  --  -------------------------------------------------------  ---------------
+  R1  control.py: the engage `if` -> `if False and ...`          8 here + 1 clamp
+      (release/1.0's behaviour)
+  R2  control.py: the exit on the other direction removed        1
+  R3  control.py: the exit on an answered probe removed          2
+  R4  control.py: `PROBE_W = 300.0`, above the gate's 250 W       4
+  R5  control.py: the hold keeps the old target, not 0 W          4
+  R6  main.py: `_refusal_from_stale()` returns at once           1
+  R7  main.py: another writer no longer ends the refusal         1
+  R8  main.py: stop/start no longer ends the refusal             1
+  R9  main.py: the probe window never opens                      4
+  R10 main.py: seed from a stale stop below `saturation_w` again,  1
+      not below REFUSED_BELOW_W (review of #141). The same mutation
+      in control.py's engage clause SURVIVES, and that is expected:
+      the delivery exit (R11) ends such a refusal in the same cycle.
+  R11 control.py: only an answered PROBE ends the refusal          2
+      (`and probe` back in the delivery exit; review of #141)
+"""
+
+import asyncio
+import sys
+from datetime import datetime, timedelta, timezone
+
+from app import control, freshness
+from app.control import PROBE_EVERY_S, PROBE_S, PROBE_W, REFUSED, PROBING
+from app.main import Controller, why_key
+from app.arbiter import Claim
+from app import messages
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+LIVE = {"max_w": 5000.0, "gain": 0.6, "slew_w": 400.0, "target_grid_w": -10.0,
+        "deadband_w": 15, "step_w": 10}
+TICK = 5.0            # the meter's measured median tick (replay_recorded_loop)
+CUT_W = -4.0          # what the register reads at the cut-out, 2026-09-06
+H = 3600.0
+BASE = datetime(2026, 9, 6, 19, 30, tzinfo=timezone.utc)
+
+
+class _Store:
+    def __init__(self):
+        self.data = {}
+
+    def set(self, *a):
+        pass
+
+    def get_time(self, *a):
+        return None
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, values):
+        pass
+
+    def close(self):
+        pass
+
+
+class _Hass:
+    """House load, and a battery that follows unless `cut(t)` says it refuses.
+
+    At the cut-out the reading is exactly CUT_W for any request >= CUT_W (a flat
+    register, which is what arms or does not arm the stale-reading gate). A
+    charge request is followed: the pack accepts charge at the floor.
+    `cap(t)` limits discharge while not cut (the 09-06 pack gave 4570 W at 10 %).
+    """
+
+    def __init__(self, load, cut, cap=lambda t: 1e9):
+        self.load, self.cut, self.cap = load, cut, cap
+        self.t = 0.0
+        self.cmd = 0.0
+        self.writes = []
+
+    def batt(self):
+        if self.cut(self.t) and self.cmd >= CUT_W:
+            return CUT_W
+        return float(round(min(self.cmd, self.cap(self.t))))
+
+    async def limits(self, entity):
+        return (-LIVE["max_w"], LIVE["max_w"], 1.0)
+
+    async def number(self, entity, invert=False):
+        b = self.batt()
+        return {"sensor.grid": self.load(self.t) - b, "sensor.soc": 9.0,
+                "sensor.batt": b}.get(entity)
+
+    async def set_number(self, entity, value):
+        self.writes.append((self.t, float(value)))
+        self.cmd = float(value)
+        return True
+
+    async def call(self, *a):
+        return True
+
+
+def run(load, cut, dur, cap=lambda t: 1e9, old=False, events=None):
+    """Real cycles every TICK seconds of `now_mono`. `events[t] = fn(c)` pokes
+    the controller (stop, start, another writer) at that instant.
+
+    Returns [(t, grid, batt, setpoint, i_w, loop_reason, batt_refused)], the
+    number of gate trips, and the controller."""
+    async def go():
+        hass = _Hass(load, cut, cap)
+        c = Controller(dict(
+            {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+             "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+             "meter_source": "off", "heartbeat_s": 10, "stale_input_s": 15},
+            **LIVE), hass, _Store(), _Pub(), stop=asyncio.Event())
+        c.auto = True
+        c.dev_min, c.dev_max = -LIVE["max_w"], LIVE["max_w"]
+        import app.main as m
+        real, real_dt = m.compute, m.datetime
+        clock = [0.0]
+
+        class _DT(real_dt):
+            """`cycle()`'s wall clock follows `now_mono`, so the 15 s input hold
+            and the gate's release run in simulated seconds too."""
+            @classmethod
+            def now(cls, tz=None):
+                return BASE + timedelta(seconds=clock[0])
+
+        m.datetime = _DT
+        if old:
+            m.compute = lambda *a, **k: real(*a, **dict(k, refused=None))
+        rows, trips, was = [], 0, False
+        try:
+            t = 0.0
+            while t < dur:
+                hass.t = clock[0] = t
+                for et, fn in list((events or {}).items()):
+                    if et <= t:
+                        fn(c)
+                        del events[et]
+                await c.read_inputs(now_mono=t)
+                stale = c.inverters[0].batt_fresh.stale
+                trips += stale and not was
+                was = stale
+                await c.cycle()
+                rows.append((t, hass.load(t) - hass.batt(), hass.batt(),
+                             hass.cmd, c.i_w, c.loop_reason, c.batt_refused))
+                t += TICK
+        finally:
+            m.compute, m.datetime = real, real_dt
+        return rows, trips, c
+    return asyncio.run(go())
+
+
+def at(rows, t):
+    return min(rows, key=lambda r: abs(r[0] - t))
+
+
+def longest_hold_h(rows, floor_w=250.0, until=None):
+    """Longest run of one identical request at or above `floor_w`, in hours."""
+    best = cur = 0.0
+    last = None
+    for r in rows:
+        if until is not None and r[0] >= until:
+            break
+        cur = cur + TICK if (r[3] == last and abs(r[3]) >= floor_w) else 0.0
+        last = r[3]
+        best = max(best, cur)
+    return best / H
+
+
+# ==============================================================================
+print("1. the 09-06 shape: a load step takes the request to 5000 W, the battery "
+      "cuts out, the load ends")
+# ==============================================================================
+def load906(t):
+    return 1020 if t < 60 else 4800 if t < 162 else 940 if t < 11.9 * H else -600
+
+
+def cut906(t):
+    return t >= 132
+
+
+def cap906(t):
+    return 4570.0
+
+
+old906, otrips906, _ = run(load906, cut906, 12.2 * H, cap906, old=True)
+new906, ntrips906, c906 = run(load906, cut906, 12.2 * H, cap906)
+for name, rows, tr in (("old", old906, otrips906), ("new", new906, ntrips906)):
+    print(f"    {name}: request at 2 min {at(rows, 120)[3]:+.0f} W, at 6 h "
+          f"{at(rows, 6 * H)[3]:+.0f} W (i_w {at(rows, 6 * H)[4]:+.0f}), longest "
+          f"hold {longest_hold_h(rows):.2f} h, gate trips {tr}")
+check("PRECONDITION: the old law holds +5000 W for the whole night on this "
+      "fixture, as it did on 2026-09-06 - the fixture reproduces the card",
+      at(old906, 6 * H)[3] == 5000.0 and longest_hold_h(old906) > 11.5)
+check("the request reaches the rail before the cut, so the new law starts from "
+      "the same place", at(new906, 120)[3] == 5000.0)
+t0 = next((r[0] for r in new906 if r[5] == REFUSED), None)
+check(f"after the cut the battery-refuses hold takes the request to 0 W within "
+      f"about a minute (at t={t0})", t0 is not None and 132 < t0 <= 132 + 90
+      and at(new906, t0)[3] == 0.0)
+check("...and it stays refused overnight, with the integrator at 0, and no "
+      "request of 250 W or more stands for longer than one probe interval",
+      at(new906, 6 * H)[6] == 1 and at(new906, 6 * H)[4] == 0.0
+      and longest_hold_h(new906, until=11.9 * H) < PROBE_EVERY_S / H)
+check(f"...and the stale-reading gate does not cycle: {ntrips906} trips in "
+      f"12 hours (the old law's latch also kept it quiet: {otrips906})",
+      ntrips906 == 0)
+morning = [r for r in new906 if r[0] >= 11.9 * H + 60]
+check("when solar makes the grid export, the refusal ends and the battery "
+      "charges - the exit on the other direction",
+      morning and morning[-1][6] == 0 and morning[-1][3] < -400)
+
+# ==============================================================================
+print("2. the probe: 200 W every 15 minutes, below the gate's 250 W")
+# ==============================================================================
+probes = []
+for r in new906:
+    if r[3] == PROBE_W and (not probes or r[0] - probes[-1][1] > TICK):
+        probes.append([r[0], r[0]])
+    elif r[3] == PROBE_W:
+        probes[-1][1] = r[0]
+starts = [p[0] for p in probes]
+gaps = [b - a for a, b in zip(starts, starts[1:])]
+print(f"    {len(probes)} probes, first at {starts[0] / 60 if starts else 0:.1f} "
+      f"min, gaps {sorted(set(round(g) for g in gaps))} s, lengths "
+      f"{sorted(set(round(p[1] - p[0] + TICK) for p in probes))} s")
+check("the probe asks exactly PROBE_W, which is below the stale-reading gate's "
+      "threshold, so a probe can never arm it",
+      PROBE_W < freshness.MOVE_W and all(r[3] in (0.0, PROBE_W)
+                                         for r in new906 if r[6] == 1))
+check("there is a probe every 15 minutes through the night (at least 40 in "
+      "11.8 hours), each about 34 s long",
+      len(probes) >= 40 and all(PROBE_EVERY_S <= g <= PROBE_EVERY_S + PROBE_S
+                                + 2 * TICK for g in gaps)
+      and all(PROBE_S - TICK <= p[1] - p[0] + TICK <= PROBE_S + TICK
+              for p in probes))
+check("...and a probe reads as a probe on the loop's own reason row",
+      any(r[5] == PROBING for r in new906))
+
+# ==============================================================================
+print("3. recovery with no sign change: the battery gives power again at 2 h")
+# ==============================================================================
+def cut_rec(t):
+    return 132 <= t < 2 * H
+
+
+oldr, _, _ = run(load906, cut_rec, 2.6 * H, cap906, old=True)
+newr, _, crec = run(load906, cut_rec, 2.6 * H, cap906)
+after_o = [r for r in oldr if 2 * H <= r[0] < 2 * H + 600]
+after_n = [r for r in newr if 2 * H <= r[0] < 2.6 * H]
+exp_o = sum(max(0.0, -r[1]) * TICK for r in after_o) / 3600
+exp_n = sum(max(0.0, -r[1]) * TICK for r in after_n) / 3600
+print(f"    old: worst grid {min(r[1] for r in after_o):+.0f} W, export "
+      f"{exp_o:.0f} Wh; new: worst grid {min(r[1] for r in after_n):+.0f} W, "
+      f"export {exp_n:.0f} Wh")
+check("PRECONDITION: the old law answers a recovering battery with its "
+      "standing +5000 W and exports kilowatts into a 940 W house",
+      min(r[1] for r in after_o) < -3000)
+check("the new law never exports more than the probe while it waits, and the "
+      "answered probe ends the refusal so control resumes",
+      min(r[1] for r in after_n) > -PROBE_W - 50
+      and after_n[-1][6] == 0 and abs(after_n[-1][1] - (-10)) < 100)
+check("...and the event log says the probe was answered",
+      any("BATTERY REFUSES ENDED: the probe was answered" in e
+          for e in crec.events))
+
+# ==============================================================================
+print("4. the 09-19 shape: a stale-reading stop on a frozen ~0 W reading "
+      "is a refusal")
+# ==============================================================================
+# The request steps +1540 -> +1940 and more as the battery cuts out mid-ramp:
+# the request moves after the reading went flat, so the gate trips before the
+# hold's 12 cycles - the ~70 s cycle SAFETY-59 measured. The trip seeds the hold.
+def load919(t):
+    return 1530 if t < 60 else 2400 if t < 1800 else 900 if t < 4 * H else -600
+
+
+def cut919(t):
+    return t >= 65
+
+
+def run919(old):
+    return run(load919, cut919, 4.2 * H, old=old)
+
+
+old919, otr919, _ = run919(True)
+new919, ntr919, c919 = run919(False)
+print(f"    old: gate trips {otr919}, longest hold {longest_hold_h(old919):.2f} h;"
+      f" new: gate trips {ntr919}, longest hold {longest_hold_h(new919):.2f} h")
+check("PRECONDITION: on the old law the gate trips over and over all night "
+      "(the SAFETY-59 cycle) or the request stands for hours",
+      otr919 > 20 or longest_hold_h(old919) > 1.0)
+check("the new law stops after at most two trips and holds 0 W, and the event "
+      "log says the battery refuses",
+      ntr919 <= 2 and at(new919, 2 * H)[3] in (0.0, PROBE_W)
+      and any("BATTERY REFUSES" in e for e in c919.events))
+
+# The same shape through `compute()` alone, as the bus saw it on 2026-09-19
+# before the gate existed: +1540 -> +1940, then a battery giving nothing.
+T = control.Tuning(**LIVE)
+res = {}
+for name, carry in (("old", None), ("new", 0)):
+    # sat_count 2: the +1540 and +1940 cycles were already short (the plan)
+    prev, i_w, sat, ref, cmds = 1940.0, 2340.0, 2, carry, []
+    for _ in range(2000):              # ~2.8 h at 5 s
+        d = control.compute(prev, 1950.0, CUT_W, T, sat, i_w, refused=ref)
+        prev, i_w, sat, ref = d.target_w, d.i_w, d.sat_count, d.refused
+        cmds.append(prev)
+    res[name] = cmds
+print(f"    compute() alone: old stands at {res['old'][-1]:+.0f} W "
+      f"({sum(v == 1940.0 for v in res['old'])} of 2000 cycles at +1940 W), "
+      f"new at {res['new'][-1]:+.0f} W from cycle "
+      f"{res['new'].index(0.0) if 0.0 in res['new'] else None}")
+check("PRECONDITION: without the gate the old law parks at +1940 W, the 7 065 "
+      "identical writes the bus recorded", set(res["old"]) == {1940.0})
+check("...and the new law holds 0 W within SETTLE_CYCLES cycles",
+      res["new"].index(0.0) < control.SETTLE_CYCLES
+      and set(res["new"][control.SETTLE_CYCLES:]) == {0.0})
+
+# ==============================================================================
+print("5. the other exits: stop, start, another writer")
+# ==============================================================================
+def stop(c):
+    c.auto = False
+
+
+def start(c):
+    c.auto = True
+
+
+rows, _, c = run(load906, cut906, 1200, cap906, events={600.0: stop,
+                                                         700.0: start})
+check("stopping control ends the refusal, and starting again begins from "
+      "nothing refused", at(rows, 590)[6] == 1 and at(rows, 650)[6] == 0
+      and at(rows, 705)[6] == 0)
+
+
+def other_writer(c):
+    c.loop_w = 1234.0      # the arbiter gave the wire something the loop did not ask
+
+
+rows, _, c = run(load906, cut906, 900, cap906, events={600.0: other_writer})
+check("another writer on the wire ends the refusal (the arbiter reseed)",
+      at(rows, 590)[6] == 1 and at(rows, 605)[6] == 0)
+
+# ==============================================================================
+print("5b. review of #141: a pack that gives SOME power, and a reading that is "
+      "only late, are not a refusal")
+# ==============================================================================
+# A pack derated to 100-499 W (cold, BMS taper) gives what it can against a
+# larger ask. Engaging below `saturation_w` (500 W) held it at 0 W for ~93 % of
+# the time; "gives nothing" is below the probe's own answer.
+# `compute()` alone: through the Controller the stale-reading gate trips on the
+# flat 300 W first, and that fixture then passes whatever this threshold is.
+def derated(carry, cap_w=300.0, n=1800):
+    prev, i_w, sat, ref, gave, held = 0.0, 0.0, 0, carry, 0.0, 0
+    b = 0.0
+    for _ in range(n):                                   # 2.5 h at 5 s
+        d = control.compute(prev, 2000.0 - b, b, T, sat, i_w, refused=ref)
+        prev, i_w, sat, ref = d.target_w, d.i_w, d.sat_count, d.refused
+        held += bool(ref)
+        b = max(0.0, min(prev, cap_w))                   # one tick late
+        gave += b
+    return gave / n, held
+
+
+T = control.Tuning(**LIVE)
+gave_old, _ = derated(None)
+gave_new, held_new = derated(0)
+print(f"    pack derated to 300 W: old law {gave_old:.0f} W average, new "
+      f"{gave_new:.0f} W, held as refusing on {held_new} cycles")
+check("a pack that gives a steady 300 W against a 2000 W ask is never held at "
+      "0 W as refusing, and keeps giving what the old law got from it",
+      held_new == 0 and gave_new == gave_old and gave_old > 290.0)
+
+
+def lagging(tick, dead_s=6.0, publish_s=10.0, phase_s=5.0, dur=600.0):
+    """`compute()` on a HEALTHY pack whose reading lags: it follows the command
+    of `dead_s` ago, published every `publish_s`. A 1 s meter (`meter_poll_s`
+    1) makes SETTLE_CYCLES only 12 s, shorter than that lag."""
+    prev, i_w, sat, ref, hist, reg, pub = 0.0, 0.0, 0, 0, [], 0.0, -phase_s
+    held = engaged = 0
+    t = 0.0
+    while t < dur:
+        then = [c for tc, c in hist if tc <= t - dead_s]
+        b = then[-1] if then else 0.0
+        if t - pub >= publish_s:
+            reg, pub = b, t
+        d = control.compute(prev, (3000.0 if t >= 10 else 0.0) - b, reg, T,
+                            sat, i_w, refused=ref)
+        engaged += bool(d.refused) and not ref
+        prev, i_w, sat, ref = d.target_w, d.i_w, d.sat_count, d.refused
+        hist.append((t, prev))
+        held += tick * bool(ref)
+        t += tick
+    return engaged, held
+
+
+lag1 = lagging(1.0)
+print(f"    1 s meter, healthy pack with a late reading: engaged {lag1[0]} "
+      f"time(s), held {lag1[1]:.0f} s")
+check("a healthy pack whose reading is merely late is let go as soon as the "
+      "reading shows it delivering - not held until the next probe",
+      lag1[1] <= 10.0)
+
+
+async def _seed(held_w):
+    """`_refusal_from_stale()` on a unit standing at +2000 W, frozen."""
+    c = Controller(dict(
+        {"setpoint_entity": "number.sp", "meter_entity": "sensor.grid",
+         "soc_entity": "sensor.soc", "batt_entity": "sensor.batt",
+         "meter_source": "off"}, **LIVE),
+        _Hass(lambda t: 0.0, lambda t: False), _Store(), _Pub(),
+        stop=asyncio.Event())
+    c.auto, c.sat_count = True, c.tuning.saturation_cycles
+    inv = c.inverters[0]
+    inv.last_write, inv.batt_fresh.held = 2000.0, held_w
+    c._refusal_from_stale(inv, 100.0)
+    return c.batt_refused
+
+
+check("a stale-reading stop on a register standing at 300 W is not a refusal "
+      "(it gives something), and one at -4 W is",
+      asyncio.run(_seed(300.0)) == 0 and asyncio.run(_seed(CUT_W)) == 1)
+d = control.compute(0.0, 1500.0, 1400.0, T, 0, 0.0, refused=1, probe=False)
+check("...i.e. a held direction that reads 100 W or more ends the refusal "
+      "without waiting for a probe", d.refused == 0)
+
+# ==============================================================================
+print("6. words")
+# ==============================================================================
+w = messages.why(why_key("loop", [Claim.set("loop", 0, 0.0, REFUSED)]), 0.0)
+wp = messages.why(why_key("loop", [Claim.set("loop", 0, PROBE_W, PROBING)]),
+                  PROBE_W)
+print(f"    {w!r} / {wp!r}")
+check("the page's Why line says the battery refuses, not 'Keeping the grid "
+      "near zero: 0 W'", w == "The battery refuses to give power: 0 W")
+check("...and a probe says what it is", wp.startswith("Testing if the battery"))
+check("...and an ordinary loop cycle still reads as the loop",
+      why_key("loop", [Claim.set("loop", 0, 10.0, "tracking")]) == "loop")
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_refusal_units.py b/goodwe_controller/test_refusal_units.py
new file mode 100644
index 0000000..4366a7a
--- /dev/null
+++ b/goodwe_controller/test_refusal_units.py
@@ -0,0 +1,537 @@
+"""Runnable check for SAFETY-73.  `python3 test_refusal_units.py`
+
+SAFETY-52 per inverter. With two or more inverters, a battery that refuses
+(gives < 100 W for 12 cycles and 22 s while asked > 200 W, or trips the stale-reading
+gate on a ~0 W reading) is closed in that direction by its own P_SAFETY limit,
+so the allocator hands its share to the others. It is probed at 200 W every
+15 minutes, one inverter at a time. When every inverter refuses the same way
+the site holds 0 W. When a refusal ends the site target restarts from the watts
+on the wire. DECISIONS/SAFETY-73 has the record.
+
+Drives the REAL `Controller` (read_inputs + cycle, the real freshness gate,
+allocator, OPT-09 pack claim and SAFETY-42 detector) with two inverters in
+simulated time. At the cut-out a battery reads -4 W for any request >= -4 W
+and accepts charge. Two register shapes: FLAT at -4 W (the 09-06 capture) and
+JITTER +-3 W (the gate cannot arm). `OLD` runs the same fixture with the
+per-unit refusal switched off, which is 652097a's behaviour at N>1.
+
+Mutations (MUTATION.md, `python3 -B`, copies purged of `__pycache__`), graded
+over this file / test_delivery / test_refusal. Every one is red here:
+
+  #    mutation                                                   reds
+  ---  ---------------------------------------------------------  -------
+  U1   main.py: the per-unit engage clause never fires              7/2/0
+  U2   main.py: the N>1 stale-reading seed returns at once          14/0/0
+  U3   main.py: no `refused` claim is filed                         13/2/0
+  U4   main.py: a probe never pins (always the closed limit)        7/0/0
+  U5   main.py: a probe pin stands whatever the site target         1/0/0
+  U6   main.py: no reseed of the site target when a refusal ends    1/0/0
+  U7   main.py: no site hold when every inverter refuses            2/0/0
+  U8   main.py: the other-direction exit removed (charge counter)   1/0/0
+  U9   main.py: the delivery exit removed                           3/0/0
+  U10  main.py: probes are no longer one at a time                  1/0/0
+  U11  main.py: the above-cut-out WARNING condition inverted        1/0/0
+  U12  main.py: SAFETY-42's account no longer sees a small ask      1/0/0
+  U13  main.py: a unit engages above `saturation_w`, not PROBE_W    1/0/0
+  U14  main.py: the evidence need not span REFUSED_SPAN_S (review)  1/0/0
+  U15  main.py: the WARNING also for a refusal to take (review)     1/0/0
+
+On 652097a itself this file stops at the first sample (`Inverter` has no
+`refused`); its OLD arms reproduce that tree's N>1 behaviour instead, and
+every PRECONDITION line is graded against them.
+"""
+
+import asyncio
+import logging
+import sys
+from datetime import datetime, timedelta, timezone
+
+from app import control
+from app.control import PROBE_EVERY_S, PROBE_S, PROBE_W
+from app.main import Controller
+from app.arbiter import P_LOOP, P_PEAK, P_SAFETY, Claim, resolve
+import app.main as m
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+TICK = 5.0
+CUT_W = -4.0
+FULL_W = 40.0
+H = 3600.0
+BASE = datetime(2026, 9, 6, 19, 30, tzinfo=timezone.utc)
+UNITS = ("a", "b")
+
+
+class _Store:
+    def __init__(self):
+        from app.store import DEFAULTS
+        self.data = dict(DEFAULTS)
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def get_time(self, *a):
+        return None
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, *a, **k):
+        pass
+
+    def close(self):
+        pass
+
+
+class _Hass:
+    """A house, one meter, and two batteries that follow unless cut out.
+
+    `lag` (review): (dead s, publish s). Each battery reading then shows the
+    power of `dead` s before its last publish; the power itself and the meter
+    follow at once. `full[u](t)`: that battery takes at most FULL_W of charge.
+    """
+
+    def __init__(self, load, cut, soc, jitter, lag=None, full=None):
+        self.load, self.cut, self.soc, self.jitter = load, cut, soc, jitter
+        self.lag, self.full = lag, full or {}
+        self.cmd = {u: 0.0 for u in UNITS}
+        self.hist = {u: [(-1e18, 0.0)] for u in UNITS}
+        self.t = 0.0
+
+    def power(self, u, t=None):
+        t = self.t if t is None else t
+        c = next((v for tt, v in reversed(self.hist[u]) if tt <= t), 0.0)
+        if self.cut[u](t) and c >= CUT_W:
+            if self.jitter:
+                return CUT_W + ((int(t / TICK) % 3) - 1) * 3.0
+            return CUT_W
+        if u in self.full and self.full[u](t) and c < -FULL_W:
+            return -FULL_W
+        return float(round(c))
+
+    def batt(self, u):
+        if self.lag is None:
+            return self.power(u)
+        dead, pub = self.lag
+        return self.power(u, (self.t // pub) * pub - dead)
+
+    def grid(self):
+        return self.load(self.t) - sum(self.power(u) for u in UNITS)
+
+    async def limits(self, e):
+        return (-2000.0, 2000.0, 1.0)
+
+    async def call(self, *a):
+        return True
+
+    async def number(self, e, invert=False):
+        if e == "sensor.grid":
+            return self.grid()
+        u = e[-1]
+        if e.startswith("sensor.soc"):
+            v = self.soc[u]
+            return v(self.t) if callable(v) else v
+        if e.startswith("sensor.batt"):
+            return self.batt(u)
+        return None
+
+    async def set_number(self, e, v):
+        self.cmd[e[-1]] = float(v)
+        self.hist[e[-1]].append((self.t, float(v)))
+        return True
+
+
+def _off(c):
+    """652097a's N>1 behaviour: nothing refuses per unit."""
+    c._unit_refusals = lambda: None
+    c._unit_refusal_start = lambda *a, **k: None
+
+
+def run(load, cut, dur, *, soc=None, jitter=False, old=False, events=None,
+        extra=None, tick=None, lag=None, full=None):
+    """Real cycles every TICK of simulated time. Rows are dicts per cycle."""
+    async def go():
+        hass = _Hass(load, cut, soc or {"a": 50.0, "b": 50.0}, jitter, lag,
+                     full)
+        dt = tick or TICK
+        inv = [{"name": f"inverter-{u}", "setpoint_entity": f"number.sp_{u}",
+                "soc_entity": f"sensor.soc_{u}",
+                "batt_entity": f"sensor.batt_{u}",
+                "max_w": 2000, "bms_soc_floor": 10} for u in UNITS]
+        o = {"meter_entity": "sensor.grid", "meter_source": "off",
+             "inverters": inv, "gain": 0.6, "slew_w": 400,
+             "target_grid_w": -10, "deadband_w": 15, "step_w": 10,
+             "heartbeat_s": 10, "stale_input_s": 15, "auto_start": True}
+        o.update(extra or {})
+        c = Controller(o, hass, _Store(), _Pub(), stop=asyncio.Event())
+        for i in c.inverters:
+            i.dev_min, i.dev_max = -2000.0, 2000.0
+        c.auto = True
+        if old:
+            _off(c)
+        real_dt = m.datetime
+        clock = [0.0]
+
+        class _DT(real_dt):
+            @classmethod
+            def now(cls, tz=None):
+                return BASE + timedelta(seconds=clock[0])
+
+        m.datetime = _DT
+        rows = []
+        trips = {u: 0 for u in UNITS}
+        was = {u: False for u in UNITS}
+        pending = dict(events or {})
+        try:
+            t = 0.0
+            while t < dur:
+                hass.t = clock[0] = t
+                for et in sorted(pending):
+                    if et <= t:
+                        pending.pop(et)(c)
+                await c.read_inputs(now_mono=t)
+                for u, i in zip(UNITS, c.inverters):
+                    s = i.batt_fresh.stale
+                    trips[u] += s and not was[u]
+                    was[u] = s
+                await c.cycle()
+                rows.append(dict(
+                    t=t, grid=hass.grid(), site=c.target, reason=c.loop_reason,
+                    a=hass.cmd["a"], b=hass.cmd["b"],
+                    ra=c.inverters[0].refused, rb=c.inverters[1].refused,
+                    da=c.inverters[0].delivery_wd.tripped,
+                    db=c.inverters[1].delivery_wd.tripped))
+                t += dt
+        finally:
+            m.datetime = real_dt
+        return rows, trips, c
+    return asyncio.run(go())
+
+
+def after(rows, t0, t1=None):
+    return [r for r in rows if r["t"] >= t0 and (t1 is None or r["t"] < t1)]
+
+
+def mean(rows, k):
+    return sum(r[k] for r in rows) / len(rows) if rows else float("nan")
+
+
+def never(t):
+    return False
+
+
+def cut_at(t0, t1=None):
+    return lambda t: t >= t0 and (t1 is None or t < t1)
+
+
+def probes(rows, k):
+    """Start times of runs where refused unit `k` is asked exactly PROBE_W."""
+    out, prev = [], False
+    for r in rows:
+        on = abs(r[k]) == PROBE_W and r["r" + k] != 0
+        if on and not prev:
+            out.append(r["t"])
+        prev = on
+    return out
+
+
+SHAPES = (("flat", False), ("jitter", True))
+
+# ==============================================================================
+print("1. case a: house 3000 W, both give power, A cuts out at 120 s")
+# ==============================================================================
+for shape, jit in SHAPES:
+    new, ntr, cn = run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, H,
+                       jitter=jit)
+    old, otr, _ = run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, H,
+                      jitter=jit, old=True)
+    tail_n, tail_o = after(new, 300), after(old, 300)
+    held = [r for r in tail_n if abs(r["a"]) != PROBE_W]
+    print(f"    {shape}: old B {mean(tail_o, 'b'):.0f} W grid "
+          f"{mean(tail_o, 'grid'):+.0f} W trips A {otr['a']}; new B "
+          f"{mean(tail_n, 'b'):.0f} W grid {mean(tail_n, 'grid'):+.0f} W "
+          f"trips A {ntr['a']}")
+    check(f"{shape}: PRECONDITION: on the old law B never takes over (mean "
+          f"under 1950 W) while A gives nothing",
+          mean(tail_o, "b") < 1950 and mean(tail_o, "grid") > 1050)
+    check(f"{shape}: A is refused and asked 0 W outside its probes, B carries "
+          f"its rating, and the grid imports only what B cannot give",
+          cn.inverters[0].refused == 1 and all(r["a"] == 0.0 for r in held)
+          and min(r["b"] for r in tail_n) == 2000.0
+          and abs(mean(tail_n, "grid") - 1004) < 20)
+    check(f"{shape}: A's stale-reading gate trips at most once, the site is "
+          f"never stopped after the first 5 minutes, and SAFETY-42 does not "
+          f"report A as not delivering",
+          ntr["a"] <= 1
+          and all(r["reason"] != "not-running" for r in tail_n)
+          and not any(r["da"] for r in new))
+
+# ==============================================================================
+print("2. case b: house 1200 W, which B alone can carry, A cuts out")
+# ==============================================================================
+for shape, jit in SHAPES:
+    new, ntr, cn = run(lambda t: 1200.0, {"a": cut_at(120), "b": never}, H,
+                       jitter=jit)
+    old, _, _ = run(lambda t: 1200.0, {"a": cut_at(120), "b": never}, H,
+                    jitter=jit, old=True)
+    tail_n, tail_o = after(new, 300), after(old, 300)
+    imp = sum(max(0.0, r["grid"]) for r in tail_n) * TICK / H
+    print(f"    {shape}: old grid {mean(tail_o, 'grid'):+.0f} W, new grid "
+          f"{mean(tail_n, 'grid'):+.0f} W, new import {imp:.0f} Wh")
+    check(f"{shape}: PRECONDITION: the old law leaves a standing import",
+          mean(tail_o, "grid") > 250)
+    check(f"{shape}: B takes over the whole house and the grid sits near its "
+          f"target", abs(mean(tail_n, "grid") + 10) < 25 and imp < 10)
+    pa = probes(new, "a")
+    in_probe = [r for r in new
+                if any(p <= r["t"] < p + PROBE_S for p in pa)]
+    check(f"{shape}: A is probed at 200 W every 15 minutes while B carries "
+          f"the rest, and the two never pull opposite ways",
+          len(pa) >= 3
+          and all(abs(q - p - PROBE_EVERY_S - PROBE_S) <= 2 * TICK
+                  for p, q in zip(pa, pa[1:]))
+          and all(r["b"] > 0 for r in in_probe)
+          and all(r["a"] * r["b"] >= 0 for r in new))
+
+# ==============================================================================
+print("3. case c: both cut out; the site holds 0 W, probes one at a time")
+# ==============================================================================
+for shape, jit in SHAPES:
+    new, ntr, cn = run(lambda t: 3000.0, {"a": cut_at(120), "b": cut_at(150)},
+                       1.5 * H, jitter=jit)
+    old, _, _ = run(lambda t: 3000.0, {"a": cut_at(120), "b": cut_at(150)},
+                    1.5 * H, jitter=jit, old=True)
+    tail_n, tail_o = after(new, 600), after(old, 600)
+    pa, pb = probes(new, "a"), probes(new, "b")
+    print(f"    {shape}: old mean asks A/B {mean(tail_o, 'a'):.0f}/"
+          f"{mean(tail_o, 'b'):.0f} W; new {mean(tail_n, 'a'):.0f}/"
+          f"{mean(tail_n, 'b'):.0f} W, probes A {len(pa)} B {len(pb)}")
+    check(f"{shape}: PRECONDITION: the old law keeps asking two empty "
+          f"batteries", mean(tail_o, "a") > 150 and mean(tail_o, "b") > 150)
+    check(f"{shape}: the site holds 0 W: the loop says `battery refuses` or "
+          f"`battery probe` and each battery is asked 0 W or its probe",
+          all(r["reason"] in (control.REFUSED, control.PROBING)
+              for r in tail_n)
+          and all(r["a"] in (0.0, PROBE_W) and r["b"] in (0.0, PROBE_W)
+                  for r in tail_n))
+    check(f"{shape}: both batteries are probed, never at the same time",
+          len(pa) >= 3 and len(pb) >= 3
+          and not any(r["a"] and r["b"] for r in new if r["t"] > 300))
+
+# ==============================================================================
+print("4. recovery: the reseed stops the parked site target reaching the grid")
+# ==============================================================================
+# Both cut, the house drops to 940 W at 1 h, A recovers at 1.5 h with no sign
+# change. Phase A, with the envelope but no reseed and no site hold: -1059 W.
+ld = (lambda t: 3000.0 if t < H else 940.0)
+for shape, jit in SHAPES:
+    rows, _, c = run(ld, {"a": cut_at(120, 1.5 * H), "b": cut_at(150)},
+                     2 * H, jitter=jit)
+    win = after(rows, 1.5 * H, 1.5 * H + 900)
+    worst = min(r["grid"] for r in win)
+    print(f"    {shape}: worst grid after A recovers {worst:+.0f} W; A "
+          f"refused {c.inverters[0].refused}")
+    check(f"{shape}: A's recovery is found (at its next probe at the latest) "
+          f"and never exports more than 250 W",
+          c.inverters[0].refused == 0 and worst > -250
+          and any("BATTERY REFUSES ENDED inverter-a" in e for e in c.events))
+
+# Case a: B at its rating, the site target parked at 3600 W while the house
+# still imports; the house falls to 2500 W and A recovers. Without the reseed A
+# is handed the parked 1600 W at once, 1100 W more than the house needs.
+ld2 = (lambda t: 3000.0 if t < 0.5 * H else 2500.0)
+rows, _, c = run(ld2, {"a": cut_at(120, 0.75 * H), "b": never}, 1.5 * H)
+win = after(rows, 0.75 * H, 0.75 * H + 900)
+print(f"    a: worst grid when A recovers {min(r['grid'] for r in win):+.0f} W")
+check("case a: a recovery hands A no parked site target (worst export under "
+      "250 W)", min(r["grid"] for r in win) > -250
+      and any("BATTERY REFUSES ENDED inverter-a" in e for e in c.events))
+
+# ==============================================================================
+print("5. exits, words and the circulation guard")
+# ==============================================================================
+# Solar: the house exports from 30 min, so the loop wants to charge.
+rows, _, c = run(lambda t: 3000.0 if t < 0.5 * H else -2500.0,
+                 {"a": cut_at(120), "b": never}, H)
+check("the grid asking the other direction lets A charge at once (its limit "
+      "closes only the refused direction) and a minute of charge ends the "
+      "refusal",
+      c.inverters[0].refused == 0 and min(r["a"] for r in after(rows, 0.6 * H))
+      < -500 and any("the other way" in e for e in c.events))
+
+
+def _stop(c):
+    c.auto = False
+
+
+rows, _, c = run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, 0.5 * H,
+                 events={1200.0: _stop})
+check("stopping control ends the refusal",
+      c.inverters[0].refused == 0
+      and any("control stopped" in e for e in c.events))
+
+# A small house: the site asks under 200 W, so a probe may not pin A (B would
+# have to charge while A gives power). The probe waits instead.
+rows, _, c = run(lambda t: 3000.0 if t < 600 else 120.0,
+                 {"a": cut_at(120), "b": never}, 1.2 * H)
+check("with the site asking under 200 W no probe is sent and no inverter is "
+      "ever asked the opposite way to the other",
+      c.inverters[0].refused == 1
+      and probes(after(rows, 700), "a") == []
+      and all(r["a"] * r["b"] >= 0 for r in rows)
+      and not any("ARBITER" in e for e in c.events))
+
+# The hold binds every strategy's ask: a peak-guard SET at P_PEAK on the site
+# is still placed around a refusing unit's closed limit.
+_res = resolve([Claim.set("peak", P_PEAK, 3000.0, "quarter peak"),
+                Claim.set("loop", P_LOOP, 500.0, "tracking"),
+                Claim.limit("supervised", P_SAFETY, -2000.0, 2000.0,
+                            actuator="inverter-a"),
+                Claim.limit("supervised", P_SAFETY, -2000.0, 2000.0,
+                            actuator="inverter-b"),
+                Claim.limit("refused", P_SAFETY, hi=0.0,
+                            reason=control.REFUSED, actuator="inverter-a")],
+               units=("inverter-a", "inverter-b"),
+               live=("inverter-a", "inverter-b"))
+check("a P_SAFETY refusal limit binds a higher-priority strategy too: the "
+      "peak guard's 3000 W goes to B, A gets 0 W",
+      _res.shares.get("inverter-a") == 0 and _res.shares.get("inverter-b")
+      == 2000)
+
+
+class _Grab(logging.Handler):
+    def __init__(self):
+        super().__init__()
+        self.lines = []
+
+    def emit(self, record):
+        self.lines.append((record.levelno, record.getMessage()))
+
+
+_g = _Grab()
+_lg = logging.getLogger("goodwe")
+_lv = _lg.level
+_lg.setLevel(logging.INFO)
+_lg.addHandler(_g)
+run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, 600)
+run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, 600,
+    soc={"a": 10.0, "b": 50.0})
+_lg.removeHandler(_g)
+_lg.setLevel(_lv)
+warns = [x for lv, x in _g.lines if lv == logging.WARNING
+         and "REFUSES_ABOVE_CUT_OUT" in x]
+infos = [x for lv, x in _g.lines if lv == logging.INFO
+         and "BATTERY_REFUSES" in x]
+print(f"    {warns} / {infos}")
+check("a refusal above the configured cut-out level logs INFO and one WARNING "
+      "naming the inverter, and a battery at its cut-out logs neither "
+      "(OPT-09's limit closes it first)",
+      len(warns) == 1 and warns[0].startswith("inverter-a ")
+      and len(infos) == 1 and infos[0].startswith("inverter-a:")
+      and len(warns[0].split()) <= 25)
+
+# A night load of 400 W: each unit is asked about 400 W once the loop has
+# made up A's missing half, under `saturation_w`. Engaging at PROBE_W is what
+# refuses A here; at 500 W it would keep a phantom share that SAFETY-43 names.
+rows, _, c = run(lambda t: 400.0, {"a": cut_at(0), "b": never}, 1200)
+check("a 400 W night load: A is refused at a share under 500 W, B carries the "
+      "house and nothing reports A as not delivering",
+      c.inverters[0].refused == 1 and not any(r["da"] for r in rows)
+      and abs(mean(after(rows, 300), "grid") + 10) < 25
+      and mean(after(rows, 300), "b") > 380)
+
+# A night load of 150 W: A's share never passes PROBE_W, so it is never
+# refused, and SAFETY-43 must not name it as not delivering either: a battery
+# asked under 200 W that gives under 100 W is a refusal too small to call.
+rows, _, c = run(lambda t: 150.0, {"a": cut_at(0), "b": never}, 1200)
+check("a small share on an empty battery is neither refused nor reported as "
+      "not delivering, and the grid stays near its target",
+      c.inverters[0].refused == 0 and not any(r["da"] for r in rows)
+      and abs(mean(after(rows, 300), "grid") + 10) < 25)
+
+rows, _, c = run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, 600)
+notes = c.liveness_notes()
+check("the status page names the refusing inverter",
+      any(n.startswith("inverter-a: the battery refuses to give power")
+          for n in notes))
+
+# Shadow mode writes nothing, so nothing is asked and nothing can refuse.
+rows, _, c = run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, 1200,
+                 extra={"shadow_mode": True})
+check("shadow mode: no inverter is refused and both stay at 0 W",
+      c.inverters[0].refused == 0 and c.inverters[1].refused == 0
+      and all(r["a"] == 0.0 and r["b"] == 0.0 for r in rows))
+
+# Review. A 1 s meter makes 12 cycles 11 s, shorter than a healthy battery
+# reading's lag (6 s dead time plus a 13 s publish). Ordinary load steps then
+# refused both inverters and dropped the site to 0 W (16 times an hour). The
+# evidence must also span REFUSED_SPAN_S.
+_steps = (lambda t: 300.0 if int(t // 120) % 2 == 0 else 3000.0)
+rows, _, c = run(_steps, {"a": never, "b": never}, H, tick=1.0,
+                 lag=(6.0, 13.0))
+check("a 1 s meter and slow battery readings: load steps for an hour refuse "
+      "neither healthy inverter",
+      not any(r["ra"] or r["rb"] for r in rows))
+rows, _, c = run(lambda t: 3000.0, {"a": cut_at(120), "b": never}, 600,
+                 tick=1.0, lag=(6.0, 13.0))
+_eng = next((r["t"] for r in rows if r["ra"]), None)
+check("...and the same slow readings still refuse a battery that is cut "
+      "out, after the span and well inside the 185 s report",
+      _eng is not None and 120 + m.REFUSED_SPAN_S <= _eng < 185
+      and not any(r["da"] for r in rows))
+
+# Review. A full battery that stops taking charge is refused (charge), and
+# it is always above its cut-out level: that says nothing about the setting,
+# so it gets the INFO line and no REFUSES_ABOVE_CUT_OUT warning.
+_g2 = _Grab()
+_lg.setLevel(logging.INFO)
+_lg.addHandler(_g2)
+rows, _, c = run(lambda t: -3000.0, {"a": never, "b": never}, 600,
+                 soc={"a": 99.0, "b": 60.0}, full={"a": lambda t: t >= 120})
+_lg.removeHandler(_g2)
+_lg.setLevel(_lv)
+check("a full battery that stops taking charge is refused that way only, "
+      "with the INFO line and no warning about its cut-out level",
+      c.inverters[0].refused == -1
+      and any(lv == logging.INFO and "BATTERY_REFUSES" in x
+              for lv, x in _g2.lines)
+      and not any("REFUSES_ABOVE_CUT_OUT" in x for _lv2, x in _g2.lines))
+
+# ==============================================================================
+print("6. one inverter is untouched")
+# ==============================================================================
+
+
+def _boom(*a, **k):
+    raise AssertionError("SAFETY-73 code ran at N=1")
+
+
+_saved = {k: getattr(Controller, k) for k in (
+    "_unit_refusals", "_unit_refusal_start", "_unit_refusal_end",
+    "_unit_probe", "_site_refused")}
+for k in _saved:
+    setattr(Controller, k, _boom)
+try:
+    import test_refusal as _t1
+    _one_ok = not _t1.fails
+except (AssertionError, SystemExit) as e:
+    _one_ok = isinstance(e, SystemExit) and not e.code
+finally:
+    for k, v in _saved.items():
+        setattr(Controller, k, v)
+check("SAFETY-52's whole single-inverter suite passes with every SAFETY-73 "
+      "method made to raise, so none of it runs at N=1", _one_ok)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_rehearse.py b/goodwe_controller/test_rehearse.py
index fa924e1..ded905a 100644
--- a/goodwe_controller/test_rehearse.py
+++ b/goodwe_controller/test_rehearse.py
@@ -75,9 +75,10 @@ print("1. the harness's own preconditions")
 sys.path.insert(0, str(HERE / "tools"))
 import rehearse_roster as RR  # noqa: E402
 
-check("the tool refuses rather than passing when it cannot run: its three exit "
-      "codes are distinct and 2 is not 0",
-      (RR.EXIT_OK, RR.EXIT_FINDING, RR.EXIT_COULD_NOT_RUN) == (0, 1, 2))
+check("the tool refuses rather than passing when it cannot run: its four exit "
+      "codes are distinct and only 0 is a pass",
+      (RR.EXIT_OK, RR.EXIT_FINDING, RR.EXIT_COULD_NOT_RUN,
+       RR.EXIT_DEGRADED) == (0, 1, 2, 3))
 
 # ⚠️ THE ANCHOR. `app/mqtt.py` records `sensor.goodwe_p1_sample_age` as VERIFIED
 # against the live system on 2026-08-26, and the ESP32's ingest guard subscribes
@@ -204,6 +205,10 @@ def mutant_tree(edits) -> str:
     shutil.copytree(FIX, dest / "tools" / "rehearsal", ignore=ignore)
     shutil.copyfile(HERE / "tools" / "rehearse_roster.py",
                     dest / "tools" / "rehearse_roster.py")
+    # The input-shape gate (SAFETY-62) and the option names it checks against.
+    shutil.copyfile(HERE / "tools" / "predeploy_check.py",
+                    dest / "tools" / "predeploy_check.py")
+    shutil.copyfile(HERE / "config.yaml", dest / "config.yaml")
     for rel, old, new in edits:
         path = dest / rel
         text = path.read_text(encoding="utf-8")
@@ -356,8 +361,9 @@ check("omitting --live-entities REFUSES with exit 2 rather than reporting a "
       _no_code == RR.EXIT_COULD_NOT_RUN and "REFUSED" in _no_out + _no_err)
 
 _deg_code, _deg_out, _ = raw("--no-live-entities")
-check("...and the explicit opt-out RUNS, so the escape hatch exists",
-      _deg_code in (RR.EXIT_OK, RR.EXIT_FINDING))
+check("...and the explicit opt-out RUNS, so the escape hatch exists - but a "
+      "clean degraded run is exit 3, never 0 (SAFETY-62)",
+      _deg_code == RR.EXIT_DEGRADED and "NO FINDINGS" in _deg_out)
 check("⚠️ ...carrying a standing banner in the report HEADER and again in "
       "the closing block, because a report is skimmed from the bottom",
       _deg_out.count("DEGRADED RUN") >= 2
diff --git a/goodwe_controller/test_safety78.py b/goodwe_controller/test_safety78.py
new file mode 100644
index 0000000..9b3907f
--- /dev/null
+++ b/goodwe_controller/test_safety78.py
@@ -0,0 +1,433 @@
+"""Runnable check for SAFETY-78: a maintenance drain at N=2 no longer stalls.
+`python3 test_safety78.py`
+
+At two inverters the drain pins its battery at the drain rate and the site
+target is split around the pin. Below the pin the other battery had to charge,
+the allocator refused the opposite directions, the site sat at 0 W and the
+drain never moved (OPT-11 P1 F1, UX-13 P3 check 5, OPT-11 P3 F4). Now a site
+`lo` (`drain`, P_MAINTENANCE) keeps the site target at or above what the pin
+places. Drives the REAL Controller (tools/opt11_identity.py's harness).
+DECISIONS/SAFETY-78-drain-at-two.md has the record.
+
+1. N=2, house below, at and above the drain rate, a solar surplus: the drain
+   runs at its rate, no opposite split, no refusal, no log spam, and it ends.
+2. A drain that cannot give power waits with ONE log line.
+3. Battery modes on, a Cheap hours battery in a cheap run during the drain:
+   no grid charge, and its card says why.
+4. The peak guard binds during a drain, and the arbiter's order holds.
+5. The N=1 and N=2 digests hold, and the harness bites.
+6. A seeded sweep of the floor against the loop, trades, the peak floor, a
+   safety stop, refusals and an Off battery.
+
+Mutations (MUTATION.md, purged copies, graded over this file and the named
+tests) are listed in the pull request.
+"""
+
+import functools
+import logging
+import os
+import random
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import opt11p3_identity as p3                                  # noqa: E402
+import safety78_identity as s78                                # noqa: E402
+import safety79_identity as s79                                # noqa: E402
+from app import allocator, arbitrage, homeview, packmode       # noqa: E402
+from app.arbiter import (Claim, P_ARBITRAGE, P_LOOP, P_MAINTENANCE,  # noqa
+                         P_MODE, P_PEAK, P_SAFETY, pre_resolve, resolve)
+from app.main import Controller                                # noqa: E402
+from app.maintenance import CHARGE, DRAIN                      # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+M = {"maintenance_enabled": True, "maintenance_start_hour": 11}
+A, B = "inverter-a", "inverter-b"
+
+
+def cmd(r):
+    return dict(r[2])
+
+
+def refused(rows):
+    return sum(1 for r in rows if r[7] and "REFUSED" in r[7])
+
+
+def opposite(rows):
+    return sum(1 for r in rows if cmd(r)["a"] * cmd(r)["b"] < 0)
+
+
+def drain_run(house, dur=600.0, soc=lambda u, t: 50.0, cut=None, **kw):
+    return rig.run(2, extra=dict(M, **kw.pop("extra", {})), dur=dur,
+                   load=lambda t: house(t) if callable(house) else house,
+                   soc=soc, cut=cut or (lambda u, t: False), **kw)
+
+
+def with_peak_db(fn):
+    """Run `fn()` with the Controller's peak store in a temporary file."""
+    db = os.path.join(tempfile.mkdtemp(prefix="s78t-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        return fn()
+    finally:
+        rig.Controller = real
+
+
+# ============================================================================ #
+print("1. N=2: the drain runs whatever the house uses")
+RUNS = {h: drain_run(h) for h in (1200.0, 2000.0, 3000.0, -1500.0)}
+for h, (rows, c) in RUNS.items():
+    print(f"    house {h:+.0f} W: last A {cmd(rows[-1])['a']:+.0f} W, B "
+          f"{cmd(rows[-1])['b']:+.0f} W, grid {h - sum(cmd(rows[-1]).values()):+.0f}"
+          f" W; {rows[-1][6]}; refusals {refused(rows)}")
+check("⭐ below, at and above the drain rate and under a solar surplus, "
+      "battery A is commanded its 2000 W drain on EVERY cycle, so the drain "
+      "moves (it used to sit at 0 W from the first cycle)",
+      all(cmd(r)["a"] == 2000.0 for rows, _c in RUNS.values() for r in rows)
+      and all(c.maints[0].phase == DRAIN for _r, c in RUNS.values()))
+check("⭐ no cycle splits the site both ways and the allocator refuses "
+      "nothing: battery B never charges while A drains",
+      all(opposite(rows) == 0 and refused(rows) == 0
+          and all(cmd(r)["b"] >= 0.0 for r in rows)
+          for rows, _c in RUNS.values()))
+check("...and nothing is logged per cycle: no ARBITER line in the action log",
+      not any("ARBITER" in e for _r, c in RUNS.values() for e in c.events))
+_r3 = RUNS[3000.0][0]
+check("above the drain rate, B covers the rest of the house in the SAME "
+      "direction and the grid settles at the loop's aim",
+      990.0 <= cmd(_r3[-1])["b"] <= 1030.0
+      and abs(3000.0 - sum(cmd(_r3[-1]).values()) + 10.0) <= 30.0)
+check("at or below the drain rate, B is held at 0 W and A exports the rest, "
+      "as the drain does at one inverter ('exports the surplus')",
+      all(cmd(RUNS[h][0][-1])["b"] == 0.0 for h in (1200.0, 2000.0, -1500.0))
+      and all(RUNS[h][0][-1][6].startswith("loop -> 2000 W")
+              for h in (1200.0, 2000.0, -1500.0)))
+check("...and where the loop alone would ask less, the Why names the drain",
+      "limited by drain" in RUNS[1200.0][0][-1][6])
+
+# The drain ends: A's level falls to the floor, and the cycle moves on.
+_end_rows, _end = drain_run(1200.0, dur=500.0,
+                            soc=lambda u, t: max(5.0, 50.0 - t / 10.0)
+                            if u == "a" else 50.0)
+check("⭐ and the drain ENDS: A reaches the 11 % floor and the cycle moves "
+      "to its charge phase, with no refusal on the way",
+      _end.maints[0].phase == CHARGE and refused(_end_rows) == 0)
+
+# The check bites: without the floor, the same site stalls as it did.
+_real = Controller._drain_floor
+Controller._drain_floor = lambda self, claims, results: None
+try:
+    _bite, _bc = drain_run(1200.0, dur=120.0)
+finally:
+    Controller._drain_floor = _real
+print(f"    without the drain floor: refusals {refused(_bite)}/{len(_bite)}, "
+      f"last A {cmd(_bite[-1])['a']:+.0f} W")
+check("non-vacuous: with the floor taken out, the same fixture refuses every "
+      "cycle and parks A at 0 W (the reported defect)",
+      refused(_bite) == len(_bite) and cmd(_bite[-1])["a"] == 0.0
+      and any("ARBITER" in e for e in _bc.events))
+
+# ============================================================================ #
+print("\n2. a drain that cannot give power waits, with one log line")
+_w_rows, _w = drain_run(1500.0, cut=lambda u, t: u == "a")
+_waits = [e for e in _w.events if "cannot give power now" in e]
+print(f"    A refuses to give: {_waits}; last {_w_rows[-1][2]}")
+check("⭐ A refuses to give power (SAFETY-73): the cycle waits, the line is "
+      "logged ONCE over 120 cycles, and nothing is refused",
+      len(_waits) == 1 and _w.inverters[0].refused == 1
+      and refused(_w_rows) == 0 and _w.maints[0].phase == DRAIN)
+check("...and B covers the house on its own meanwhile",
+      1400.0 <= cmd(_w_rows[-1])["b"] <= 1600.0)
+
+# PR #154 review: one line per episode, across a probe and a second episode.
+_pr_rows, _pr = drain_run(1500.0, dur=1300.0, cut=lambda u, t: u == "a")
+check("the SAFETY-73 probe (A pinned at 200 W, not by maintenance) does not "
+      "end the wait: still ONE line over 1300 s with a probe in it",
+      any(cmd(r)["a"] == 200.0 for r in _pr_rows)
+      and sum("cannot give power now" in e for e in _pr.events) == 1)
+_e2_rows, _e2 = drain_run(1500.0, dur=2600.0, cut=lambda u, t: u == "a" and (
+    t < 600.0 or t >= 1400.0))
+check("...and a second episode, after the probe ends the first, logs again",
+      sum("cannot give power now" in e for e in _e2.events) == 2)
+_cw_rows, _cw = drain_run(-1500.0, dur=300.0, cut=lambda u, t: u == "a")
+_cw_cards = homeview.battery_rows(_cw, False, True)
+check("while A waits, B may take the solar surplus, so its card does not "
+      "say 'This one does not charge'",
+      cmd(_cw_rows[-1])["b"] < 0.0 and _cw_cards[1]["why_key"] != "other_cycle")
+
+
+def reject_a(c, t):
+    """Every write to A is rejected, so A's link goes stale (not live)."""
+    if not getattr(c.hass, "_rej", False):
+        real = c.hass.set_number
+
+        async def set_number(e, v):
+            return False if e == "number.sp_a" else await real(e, v)
+        c.hass.set_number, c.hass._rej = set_number, True
+
+
+_l_rows, _l = drain_run(1500.0, dur=400.0, before=reject_a)
+print(f"    A's writes rejected: {_l_rows[-1][2]}, {_l_rows[-1][7][-40:]}")
+check("⭐ a draining battery that is dropped (stale link) adds no floor: B "
+      "covers the 1500 W house, not the 2000 W drain rate, and the wait is "
+      "logged once",
+      "dropped inverter-a" in _l_rows[-1][7]
+      and cmd(_l_rows[-1])["b"] == 1500.0
+      and sum("cannot give power now" in e for e in _l.events) == 1)
+
+# ============================================================================ #
+print("\n3. battery modes on: no grid charge during the drain")
+
+
+def cheap_b():
+    s = rig._Store()
+    s.data[unit_key(A, packmode.MODE_KEY)] = packmode.SOLAR_FIRST
+    s.data[unit_key(B, packmode.MODE_KEY)] = packmode.CHEAP_HOURS
+    return s
+
+
+def modes_run(maint):
+    extra = dict(s79.P1, **p3.ARB, battery_modes_enabled=True,
+                 **(M if maint else {}))
+    ticks = []
+
+    def on_cycle(c, t):
+        ticks.append(c.mode_tick)
+    rows, c = with_peak_db(lambda: rig.run(
+        2, extra=extra, dur=1800.0, load=lambda t: 800.0,
+        soc=lambda u, t: 50.0, cut=lambda u, t: False, before=p3._feed,
+        on_cycle=on_cycle, store=cheap_b()))
+    cheap = [(r, k) for r, k in zip(rows, ticks) if 900.0 <= r[0] < 1800.0]
+    return rows, c, cheap
+
+
+_base_rows, _base_c, _base_cheap = modes_run(False)
+_m_rows, _m_c, _m_cheap = modes_run(True)
+check("baseline: with no drain, B (Cheap hours only) charges from the grid "
+      "in the cheap run, so the fixture reaches the charge",
+      any(cmd(r)["b"] < 0.0 for r, _k in _base_cheap)
+      and all(k.roles[B] == "charge" for _r, k in _base_cheap))
+check("⭐ with A draining, B never charges in that run: its role is not "
+      "'charge', no trade is filed, and the modes say why ('cycle')",
+      all(cmd(r)["b"] >= 0.0 and k.roles[B] != "charge" and k.action is None
+          and k.why == "cycle" for r, k in _m_cheap)
+      and _m_c.maints[0].phase == DRAIN)
+check("...and the drain runs through the run: A at 2000 W, nothing refused",
+      all(cmd(r)["a"] == 2000.0 for r in _m_rows) and refused(_m_rows) == 0)
+
+# Battery modes off: the site trade (`arbitrage.decide()`) buys in the cheap
+# period. It is a site SET at P_ARBITRAGE, below the drain floor.
+_t_trades = []
+_t_rows, _t_c = with_peak_db(lambda: rig.run(
+    2, extra=dict(s79.P1, **p3.ARB, **M), dur=1800.0, load=lambda t: 800.0,
+    soc=lambda u, t: 50.0, cut=lambda u, t: False, before=p3._feed,
+    on_cycle=lambda c, t: _t_trades.append(c.arb and c.arb.action)))
+print(f"    modes off, trades seen: {sorted({str(a) for a in _t_trades})}")
+check("⭐ battery modes off: the site trade still asks to buy in the cheap "
+      "period, and the drain floor keeps it from charging B against the drain: "
+      "A drains at 2000 W, B never charges, nothing is refused",
+      arbitrage.CHARGE in _t_trades
+      and all(cmd(r)["a"] == 2000.0 and cmd(r)["b"] >= 0.0 for r in _t_rows)
+      and refused(_t_rows) == 0)
+_cards = homeview.battery_rows(_m_c, False, True)
+print(f"    cards: {[(b['name'], b['now'], b['why']) for b in _cards]}")
+check("⭐ B's card tells the truth: it names the draining battery and says "
+      "it does not charge (it said 'charges from the grid' while resting)",
+      _cards[1]["why_key"] == "other_cycle" and A in _cards[1]["why"]
+      and _cards[0]["why_key"] == "cycle_mode")
+
+# ============================================================================ #
+print("\n4. the peak guard during a drain, and the order of the claims")
+
+
+def off_b():
+    s = rig._Store()
+    s.data[unit_key(B, packmode.USE_KEY)] = False
+    return s
+
+
+_p_rows, _p = with_peak_db(lambda: rig.run(
+    2, extra=dict(s79.P1, battery_modes_enabled=True, **M), dur=600.0,
+    load=lambda t: 6000.0, soc=lambda u, t: 60.0, cut=lambda u, t: False,
+    before=s79._feed, store=off_b()))
+print(f"    house 6000 W, limit {s79.CAP_W} W, B Off: {_p_rows[-1][2]}, "
+      f"{_p_rows[-1][6]}")
+check("⭐ the peak guard binds during the drain: the site goes above the "
+      "drain to the guard's floor, A keeps draining at 2000 W and B (Off) "
+      "gives only the shortfall, in the same direction",
+      _p.peak_guard.engaged and _p_rows[-1][1] >= _p.peak_guard.floor_w > 2000.0
+      and all(cmd(r)["a"] == 2000.0 and cmd(r)["b"] >= 0.0 for r in _p_rows)
+      and "limited by peak" in _p_rows[-1][6] and refused(_p_rows) == 0)
+
+
+
+def blind_at(t0):
+    """The site meter stops answering at `t0`: a safety SET at P_SAFETY."""
+    def before(c, t):
+        if t >= t0 and not getattr(c.hass, "_blind", False):
+            real = c.hass.number
+
+            async def number(e, invert=False):
+                return None if e == "sensor.grid" else await real(e, invert)
+            c.hass.number, c.hass._blind = number, True
+    return before
+
+
+_s_rows, _s = drain_run(3000.0, dur=300.0, before=blind_at(150.0))
+print(f"    meter lost at 150 s: {_s_rows[-1][2]}, {_s_rows[-1][6]}")
+check("⭐ a safety stop outranks the drain at N=2: with the meter gone the "
+      "safety SET parks both batteries at 0 W, and the drain ran before",
+      cmd(_s_rows[20])["a"] == 2000.0
+      and all(cmd(r) == {"a": 0.0, "b": 0.0} for r in _s_rows if r[0] >= 175.0)
+      and _s_rows[-1][6].startswith("safety -> 0 W"))
+
+UNITS = (A, B)
+_drain = [Claim.set("maintenance", P_MAINTENANCE, 2000.0, "drain", actuator=A),
+          Claim.limit("drain", P_MAINTENANCE, lo=2000.0, reason="drain")]
+_order = {
+    "loop under the drain": ([Claim.set("loop", P_LOOP, 500.0)], 2000.0),
+    "a grid charge (trade)": ([Claim.set("arbitrage", P_ARBITRAGE, -2500.0)],
+                              2000.0),
+    "a sale bigger than the drain": ([Claim.set("arbitrage", P_ARBITRAGE,
+                                                3000.0)], 3000.0),
+    "a peak floor above the drain": ([Claim.set("loop", P_LOOP, 500.0),
+                                      Claim.limit("peak", P_PEAK, lo=3500.0)],
+                                     3500.0),
+    "a safety stop": ([Claim.set("loop", P_LOOP, 500.0),
+                       Claim.set("safety", P_SAFETY, 0.0, "stopped")], 0.0),
+}
+_got = {}
+for k, (extra, want) in _order.items():
+    r = resolve(_drain + extra, units=UNITS)
+    _got[k] = (r.target_w, dict(r.shares), r.allocated)
+    print(f"    {k}: target {r.target_w:+.0f} W, shares {dict(r.shares)}")
+check("⭐ the order holds: a safety stop parks everything; the peak floor "
+      "above the drain wins; a sale above it runs; a grid charge and the "
+      "loop below it are lifted to it; never an opposite split",
+      all(_got[k][0] == want and _got[k][2]
+          and not (min(_got[k][1].values()) < 0 < max(_got[k][1].values()))
+          for k, (_e, want) in _order.items())
+      and _got["a safety stop"][1] == {A: 0, B: 0}
+      and _got["a grid charge (trade)"][1] == {A: 2000, B: 0})
+
+# ============================================================================ #
+print("\n5. the N=1 and N=2 digests")
+# Printed by `python3 tools/safety78_identity.py`, goodwe-addon-checks:1,
+# 2026-09-29. 480 cycles each, draining throughout, every claim and the
+# newest action-log line hashed. N=2: the same on release/1.0 35cdffe. N=1:
+# re-pinned by SAFETY-83, whose `--diff` against 35cdffe changes only cycles
+# where the peak guard asked for more than the drain (test_safety83.py).
+# SAFETY-85 re-pinned two: n1_drain_owner loses its false 'not keeping up'
+# rows (commands unchanged); n2_drain's loop is bounded while A drains
+# (reasons and the loop claim change, commands unchanged).
+PINNED = {
+    "n1_drain":
+        "b0f9ef44149163bc0acece537fe047871c00f0d9ea213e7a7fc8efc4ad3aa500",
+    "n1_drain_modes":
+        "95ab82426e23bce308db3edebe18b1ab37d956952e9f521adce37150ce87ee8a",
+    "n1_drain_owner":
+        "607c2583c7ae4bdafb90d780b3414c62d76c430ca67798cd117d1a46f3bb40ae",
+    "n2_drain":
+        "5806a6f457b7baf8dfb44daddced502f1939c114e15b84029dbb2659be8c8b0f",
+    "n2_drain_owner":
+        "05750347f1829c249f99154613f068f442a59ef59f409093907f6d0add78dd4c",
+}
+_now = s78.digests()
+for k in PINNED:
+    print(f"    {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'} "
+          f"{_now[k][:16]}")
+check("⭐ a drain under a house below, at and above its rate, a surplus and a "
+      "load over the peak limit, at N=1 (modes off and on) and N=2, matches "
+      "the pinned digests: commands, reasons, roles, trades and every claim",
+      _now == PINNED)
+Controller._drain_floor = lambda self, claims, results: (
+    2000.0 if any(r.phase == DRAIN for r in results) else None)
+try:
+    _leak = s78.digest(s78.run(**s78.SCENARIOS["n1_drain"], dur=60.0)[0])
+    _same = s78.digest(s78.run(**s78.SCENARIOS["n1_drain"], dur=60.0)[0])
+finally:
+    Controller._drain_floor = _real
+_ref = s78.digest(s78.run(**s78.SCENARIOS["n1_drain"], dur=60.0)[0])
+check("non-vacuous: filing the drain floor at N=1 (which moves no watt "
+      "there) moves the digest, because the harness hashes the claims",
+      _leak != _ref and _leak == _same)
+
+# ============================================================================ #
+print("\n6. the floor against every other claim (PR #154 review, seeded sweep)")
+_rnd = random.Random(78)
+_bad, _peak_above, _off_gave = [], 0, 0
+for _i in range(20000):
+    ma, mb = _rnd.choice((2500., 3000., 5000.)), _rnd.choice((1500., 2500.))
+    ua = [Claim.limit("supervised", P_SAFETY, -ma, ma, actuator=A),
+          Claim.set("maintenance", P_MAINTENANCE,
+                    _rnd.choice((500., 2000., 6000.)), "drain", actuator=A)]
+    if _rnd.random() < .2:
+        ua.append(Claim.limit("pack", P_SAFETY, -ma,
+                              _rnd.choice((0., 800.)), actuator=A))
+    ub = [Claim.limit("supervised", P_SAFETY, -mb, mb, actuator=B)]
+    _offb = _rnd.random() < .4
+    if _offb:
+        ub.append(Claim.limit("mode", P_MODE, 0., 0., "off", actuator=B))
+    if _rnd.random() < .15:
+        ub.append(Claim.limit("refused", P_SAFETY, -mb, 0., actuator=B))
+    pin = allocator.pin_w(pre_resolve(ua))
+    site = [Claim.set("loop", P_LOOP, _rnd.uniform(-6000., 8000.))]
+    if pin is not None and pin > 0.0:
+        site.append(Claim.limit("drain", P_MAINTENANCE, lo=pin))
+    if _rnd.random() < .3:
+        site.append(Claim.set("arbitrage", P_ARBITRAGE,
+                              _rnd.choice((-3000., 1000., 4000.))))
+    pk = _rnd.uniform(0., 8000.) if _rnd.random() < .4 else None
+    if pk is not None:
+        site.append(Claim.limit("peak", P_PEAK, lo=pk))
+    stop = _rnd.random() < .05
+    if stop:
+        site.append(Claim.set("safety", P_SAFETY, 0.0, "stopped"))
+    r = resolve(ua + ub + site, units=UNITS)
+    s = dict(r.shares)
+    why = []
+    if min(s.values()) < 0 < max(s.values()) or r.contradiction:
+        why.append("opposite or contradiction")
+    if stop and (r.target_w != 0.0 or any(s.values())):
+        why.append("stop not parked")
+    if not stop and pin is not None and pin > 0.0:
+        if r.target_w < pin or s[B] < 0:
+            why.append("below the floor, or B charges")
+        if pk is not None and pk > pin:
+            _peak_above += 1
+            if r.allocated and r.target_w < min(pk, pin + mb):
+                why.append("peak floor not honoured")
+        if _offb and s[B] > 0:
+            _off_gave += 1
+            if not (pk is not None and pk > pin):
+                why.append("Off B used for the drain")
+    if why:
+        _bad.append((_i, why, r.target_w, s, pin, pk))
+print(f"    {_bad[:3]}; peak above the drain {_peak_above}, Off B gave for "
+      f"the peak {_off_gave}")
+check("⭐ over 20000 seeded claim lists: never an opposite split or a "
+      "contradiction; a safety stop parks both; the site never goes below "
+      "the pin and B never charges; a peak floor above the drain is met; an "
+      "Off battery gives only for the peak floor, never for the drain",
+      not _bad and _peak_above > 1000 and _off_gave > 100)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: {', '.join(fails)}")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_safety81.py b/goodwe_controller/test_safety81.py
new file mode 100644
index 0000000..5721f69
--- /dev/null
+++ b/goodwe_controller/test_safety81.py
@@ -0,0 +1,171 @@
+"""Runnable check for SAFETY-81, no false "Load too high for battery" alarms.
+`python3 test_safety81.py`
+
+Drives the REAL Controller through tools/safety81_sim.py (a 1 s cycle on a
+plant shaped like the SAFETY-79 rig, one sample in ten late).
+DECISIONS/SAFETY-81-load-too-high.md has the record.
+
+1. Every command is byte-identical to release/1.0 5a4cdc2.
+2. No alarm on the quarter-edge spike, the last seconds, noise (margin 50
+   and 0) or a burst the quarter absorbs.
+3. Real overloads still alarm, ALARM_HOLD_S after 5a4cdc2.
+4. peakguard.load_too_high() on its own.
+5. The hold across a cycle with no battery reading (review).
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import asyncio
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import safety81_sim as sim                                    # noqa: E402
+from app.main import Controller                               # noqa: E402
+from app.peakguard import load_too_high                       # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+# Printed by `python3 tools/safety81_sim.py` on release/1.0 5a4cdc2 (the tool
+# copied in, nothing else changed), in the CI image: (alarm times, digest).
+BASE = {
+    "const4500": ([2699.0], "6ba6b8634f0df9526adc04f03c82db7d083973268deda0d1f07c5519bc2e5e9d"),
+    "const4500_m0": ([2699.0], "2bede28f3ea6ba9294be134c9b9733e43d22a7c24deac3bf8210bbbbe09b2039"),
+    "sine4500": ([2699.0], "bf70c2c23a0eede40c34478d1354b7daa1858e0a0f920693e2dd15fb5046120f"),
+    "edge4600": ([2.0, 902.0, 1802.0, 2699.0], "3cc0c6fec0c70f138530955babc2b416fe7307373037c1b2e927b6ccdaad3a4d"),
+    "edge4600_m0": ([2.0, 902.0, 1802.0, 2699.0], "ba9ba2c042ee42b043315b996ece38b3478dc9866aaf833256c9c29c02f0fe9f"),
+    "burst_end": ([881.0, 1781.0, 2681.0], "5f70e1eb4244820f1d44b494cb80e51f1a4486dee03357c9a8e8f7d371c5d9af"),
+    "noise5000_m50": ([292.0, 2551.0, 2698.0], "48b446e1a78e6d6032b31cb68a4eadb0f74e3aec4cc1e184162e9c65449bfdc5"),
+    "noise5000_m0": ([292.0, 2552.0, 2698.0], "1a0527dee6c2b03dc95a90b4682858c7bf5edf7205c2aced249112f04328c960"),
+    "step6500": ([1201.0, 1801.0], "95e5c90e4a6814526cb4f3bea76286063b449d86a420f888c014531fb6e913a3"),
+    "miss5560": ([1201.0, 1801.0], "cd991cfe1685750598236701a5a2f2f0342d66645609c536d42ab7ba07216e6c"),
+    "ramp6500": ([1296.0, 1801.0], "8db7675535f1a01abf38bd6bfb996a6fe57711d3ecca53541bb1c0870748c46b"),
+    "step7500_reserve": ([], "21eb9c07a4582f47f347084d1c75a28a5d767bc068bc3f74f32433d3239e9ccb"),
+    # Added in review, printed the same way.
+    "sine4500_fast": (["112, about one per 30 s"], "710008fd8f2d33a0e2cbb9a626bedafd6d87bc23712bbc5b74a4af9b3ec21897"),
+    "twice7000": ([1001.0, 1502.0, 2699.0], "1cddda8cf35859efb2ad503f1683f744cb812a6325a390c4fa3df19d717af043"),
+    "step6500_gap": ([1201.0, 1801.0], "95e5c90e4a6814526cb4f3bea76286063b449d86a420f888c014531fb6e913a3"),
+}
+OUT = {k: sim.run(**v) for k, v in sim.SCENARIOS.items()}
+RUN = {k: v[:2] for k, v in OUT.items()}
+ERR = {k: v[4] for k, v in OUT.items()}
+
+# ============================================================================ #
+print("1. every command byte-identical to release/1.0 5a4cdc2")
+check("the same scenarios as 5a4cdc2", set(RUN) == set(BASE))
+for k, (alarms, digest) in RUN.items():
+    check(f"{k}: digest {digest[:12]}", digest == BASE[k][1])
+
+# ============================================================================ #
+print("2. no false alarm (5a4cdc2's are listed)")
+for k in ("edge4600", "edge4600_m0", "const4500", "const4500_m0", "sine4500",
+          "noise5000_m50", "noise5000_m0", "burst_end", "sine4500_fast"):
+    check(f"{k}: none (5a4cdc2: {BASE[k][0]})", RUN[k][0] == [])
+
+# ============================================================================ #
+print("3. real overloads still alarm, ALARM_HOLD_S after 5a4cdc2")
+# ALARM_HOLD_S (10 s) plus up to 2 s of late meter samples; at 1800 s the
+# quarter-edge tick restarts the hold.
+for k, want in (("step6500", [1211.0, 1813.0]),
+                ("miss5560", [1213.0, 1813.0])):
+    print(f"    {k}: load steps up at 1200 s; alarms at {RUN[k][0]}, "
+          f"5a4cdc2 {BASE[k][0]}")
+    check(f"{k}: after the hold, and again only at the next quarter",
+          RUN[k][0] == want)
+check("step6500_gap: cycles stopped by a lost battery reading do not "
+      "restart the hold",
+      RUN["step6500_gap"][0] == [1215.0, 1813.0])
+check("twice7000: notified once in the quarter (5a4cdc2: "
+      f"{BASE['twice7000'][0]})", RUN["twice7000"][0] == [1011.0])
+check("twice7000: the ERROR line for both overloads",
+      ERR["twice7000"] == [1011.0, 1512.0])
+# By design: until 1306 s (then the hold) this quarter would end at most
+# ALARM_MISS_W over the real 3500 W cap; 5a4cdc2 alarmed at the aim (cap - 50).
+print(f"    ramp6500: alarms at {RUN['ramp6500'][0]}, "
+      f"5a4cdc2 {BASE['ramp6500'][0]}")
+check("ramp6500: alarms once the quarter will end over the real cap by "
+      "more than ALARM_MISS_W",
+      RUN["ramp6500"][0] == [1316.0, 1813.0])
+check("step7500 under the peak reserve: not this alarm (the guard is not "
+      "allowed to discharge)", RUN["step7500_reserve"][0] == [])
+
+# ============================================================================ #
+print("4. load_too_high()")
+
+
+def proj(elapsed, done_avg, held):
+    """A projection `elapsed` s in, averaging `done_avg` so far."""
+    r = 900.0 - elapsed
+    return SimpleNamespace(elapsed_s=elapsed, held_w=held,
+                           projected_w=(done_avg * elapsed + max(held, 0) * r)
+                           / 900.0)
+
+
+def ltl(p, batt, cap=3500.0, rail=2000.0):
+    return load_too_high(p, batt_w=batt, ceiling_w=cap, achievable_w=rail)
+
+
+check("load 6000 W vs 3500 + 2000: yes", ltl(proj(300, 3450, 4000), 2000))
+check("already over, the battery can carry the load but not catch up: yes",
+      ltl(proj(450, 7200, 7200), 0, rail=5000))
+check("the last second, a 7 W miss (under ALARM_MISS_W): no",
+      not ltl(proj(899, 3509, 2500), 1000))
+check("a miss of exactly ALARM_MISS_W: no",
+      not ltl(proj(450, 3520, 3500), 2000))
+check("...and 1 W more: yes", ltl(proj(450, 3522, 3500), 2000))
+check("over cap + battery, but the quarter lands under the cap: no",
+      not ltl(proj(880, 3450, 4000), 2000))
+check("...and when it does not: yes", ltl(proj(700, 3450, 4000), 2000))
+check("no battery reading: no", not ltl(proj(300, 3450, 5000), None))
+check("no seconds left: no", not ltl(proj(900, 4000, 5000), 2000))
+check("a quarter already over is not won back by export: yes",
+      ltl(proj(800, 3950, 1000), 0))
+
+# ============================================================================ #
+print("5. the hold across a cycle with no battery reading")
+# A reading the stale detector drops (STALE_READING) reaches the alarm as None
+# while the cycle still runs. Unknown is not "fine": it must not restart the
+# hold. Driven on Controller.check_peak_saturated() itself, with stubs.
+Q0 = datetime(2026, 9, 20, 11, 0, tzinfo=timezone.utc)
+notes = []
+
+
+async def _call(domain, service, data):
+    notes.append(data.get("notification_id"))
+
+
+stub = SimpleNamespace(
+    peak_guard=SimpleNamespace(saturated=True, ceiling_w=3500.0,
+                               reason="PEAK_GUARD: fixture"),
+    site_rating_w=2000.0, shadow=False, events=[],
+    _peak_batt_prev=None, _peak_alarm_block=None, _peak_high_since=None,
+    _peak_saturated=False, hass=SimpleNamespace(call=_call),
+    log_event=lambda msg, hint=None: None)
+first = None
+for sec in range(0, 30):
+    stub.site_batt_w = None if 4 <= sec < 8 else 2000.0
+    p = proj(300 + sec, 3450, 6000)
+    p.block_start = Q0
+    stub._peak_proj = p
+    asyncio.run(Controller.check_peak_saturated(stub))
+    if notes and first is None:
+        first = sec
+check(f"a 4 s gap in the battery reading: alarm at {first} s, not 18 s",
+      first == 10)
+
+print()
+if fails:
+    print(f"FAILED: {len(fails)} check(s)")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_safety83.py b/goodwe_controller/test_safety83.py
new file mode 100644
index 0000000..00567ea
--- /dev/null
+++ b/goodwe_controller/test_safety83.py
@@ -0,0 +1,307 @@
+"""Runnable check for SAFETY-83: the peak guard outranks the drain at N=1.
+`python3 test_safety83.py`
+
+At one inverter the monthly drain is the site SET at P_MAINTENANCE, above the
+peak floor, so the house imported what the drain left and quarters went over
+the peak limit. Now a peak floor above the drain rate is refiled at
+P_MAINTENANCE and wins. Drives the REAL Controller (tools/opt11_identity.py's
+harness on a P1 meter). DECISIONS/SAFETY-83-peak-over-drain.md has the record.
+
+1. A house of 5000, 6000 and 7000 W during a drain, limits 2500 and 3500,
+   margins 0 and 50: every quarter banks at or under the aim, the drain keeps
+   running, no 'Load too high' alarm, and without the fix the same runs go over.
+   Under a month peak banked above the limit the aim is that peak - margin.
+2. The drain never makes the banked quarter worse than no drain, below and
+   above the drain rate; below it the rest is still exported.
+3. The drain still ends, and the order holds: a lost reading parks the
+   battery, the rating caps the floor without a clash.
+4. Only cycles where the guard wanted more than the drain change, and N=2 is
+   untouched.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import functools
+import logging
+import os
+import sys
+import tempfile
+import types
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import safety78_identity as s78                                # noqa: E402
+import safety79_identity as s79                                # noqa: E402
+from app import tariff                                         # noqa: E402
+from app.arbiter import (Claim, P_MAINTENANCE, P_PEAK, P_SAFETY,  # noqa
+                         resolve)
+from app.main import Controller                                # noqa: E402
+from app.maintenance import CHARGE, DRAIN, MaintResult         # noqa: E402
+
+fails = []
+TOL = 1.0       # watts over the aim a banked quarter may show
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def run(house, cap, margin, drain_w, *, maint=True, dur=2700.0, soc=None,
+        before=None, store=None, month_peak=None, **extra):
+    """N=1 on a P1 meter; returns (rows, controller, banked quarters).
+    `month_peak` banks that quarter earlier in the month."""
+    opts = dict(s79.P1, peak_cap_w=cap, peak_margin_w=margin, **extra)
+    if maint:
+        opts.update(maintenance_enabled=True, maintenance_start_hour=11,
+                    maintenance_discharge_w=drain_w)
+    db = os.path.join(tempfile.mkdtemp(prefix="s83-"), "tariff.db")
+    if month_peak is not None:
+        tariff.PeakStore(db)._db.execute(
+            "INSERT INTO monthly_peak VALUES (?, ?, ?, NULL)",
+            (tariff.month_key(rig.BASE), month_peak,
+             "2026-09-02T10:00:00+00:00")).connection.commit()
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        rows, c = rig.run(1, extra=opts, dur=dur,
+                          load=house if callable(house) else lambda t: house,
+                          soc=soc or (lambda u, t: 60.0),
+                          cut=lambda u, t: False, before=before or s79._feed,
+                          store=store)
+    finally:
+        rig.Controller = real
+    return rows, c, {b.start.strftime("%H:%M"): b.offtake_avg_w
+                     for b in c.p1.blocks}
+
+
+def without_fix(fn):
+    real = Controller._peak_over_drain
+    Controller._peak_over_drain = lambda self, claims, results: None
+    try:
+        return fn()
+    finally:
+        Controller._peak_over_drain = real
+
+
+def cmd(r):
+    return dict(r[2])["a"]
+
+
+def alarmed(c):
+    """Did SAFETY-81's 'Load too high' alarm fire on this run?"""
+    return any("PEAK_GUARD_SATURATED" in e for e in c.events)
+
+
+# ============================================================================ #
+print("1. banked quarters during a drain, N=1")
+CASES = [(cap, drain, m, h) for cap, drain in ((2500, 2000), (3500, 2500))
+         for m in (0, 50) for h in (5000.0, 6000.0, 7000.0)]
+RES, OLD = {}, {}
+for k in CASES:
+    cap, drain, m, h = k
+    RES[k] = run(h, cap, m, drain)
+    OLD[k] = without_fix(lambda: run(h, cap, m, drain))
+    print(f"    limit {cap} drain {drain} margin {m:>2} house {h:.0f}: "
+          f"banked {[round(v) for v in RES[k][2].values()]} W "
+          f"(before the fix {[round(v) for v in OLD[k][2].values()]} W)")
+check("⭐ every quarter banks at or under the aim (limit - margin) plus 1 W, "
+      "for a 5000, 6000 and 7000 W house, limits 2500 and 3500, margins 0 "
+      "and 50",
+      all(len(b) >= 2 and max(b.values()) <= k[0] - k[2] + TOL
+          for k, (_r, _c, b) in RES.items()))
+check("⭐ the drain keeps running: the phase is drain on every run and the "
+      "battery gives at least the drain rate on every cycle",
+      all(c.maints[0].phase == DRAIN and all(cmd(r) >= k[1] for r in rows)
+          for k, (rows, c, _b) in RES.items()))
+check("...and where the house is over drain + aim, the battery gives more "
+      "than the drain rate, bound by the peak floor",
+      all(any(cmd(r) > k[1] and "limited by peak" in r[6] for r in rows)
+          for k, (rows, _c, _b) in RES.items() if k[3] - k[1] > k[0] - k[2]))
+check("non-vacuous: without the fix the same runs bank over the limit "
+      "wherever the house is above drain + aim (the reported defect: 3000 W "
+      "at a 5000 W house against 2500 W)",
+      all(max(b.values()) > k[0] + 100.0 for k, (_r, _c, b) in OLD.items()
+          if k[3] - k[1] > k[0])
+      and round(OLD[(2500, 2000, 50, 5000.0)][2]["11:15"]) == 3000)
+# A hob cycling: one 5 s spike to 11000 W every 150 s on a 6000 W house. Each
+# spike saturates the guard for one cycle, shorter than ALARM_HOLD_S.
+_sat = []
+
+
+def _spiky_feed(c, t):
+    s79._feed(c, t)
+    _sat.append(bool(c.peak_guard is not None and c.peak_guard.saturated))
+
+
+_k_rows, _k, _kb = run(lambda t: 11000.0 if t % 150 < 5 else 6000.0,
+                       3500, 50, 2500, before=_spiky_feed)
+check("⭐ a drain the guard raises gives no 'Load too high' alarm (SAFETY-81), "
+      "steady or with 5 s spikes that saturate the guard",
+      not any(alarmed(c) for _r, c, _b in RES.values())
+      and any(_sat) and not alarmed(_k))
+
+# Owner (SAFETY-79): under a month peak banked above the limit, the aim is that
+# peak - margin, during a drain too. Owner's settings, peak banked at 4500 W.
+BANK = {h: (run(h, 3500, 50, 2500, month_peak=4500.0),
+            without_fix(lambda: run(h, 3500, 50, 2500, month_peak=4500.0)))
+        for h in (6500.0, 7500.0)}
+for h, (new, old) in BANK.items():
+    print(f"    month peak 4500, house {h:.0f}: banked "
+          f"{[round(v) for v in new[2].values()]} W (before the fix "
+          f"{[round(v) for v in old[2].values()]} W)")
+check("⭐ under a month peak of 4500 W: a 7500 W house banks at 4450 W "
+      "(peak - margin, not the 3450 W cap aim), was 5000 W; a 6500 W house "
+      "stays under the drain alone at 4000 W",
+      all(4430.0 <= v <= 4450.0 + TOL for v in BANK[7500.0][0][2].values())
+      and max(BANK[7500.0][1][2].values()) > 4900.0
+      and all(round(v) in (4000, 4014)
+              for v in BANK[6500.0][0][2].values()))
+
+# ============================================================================ #
+print("\n2. the drain never makes the banked quarter worse, N=1")
+CAP, DRAIN_W, MARGIN = 3500, 2500, 50          # the owner's settings
+AIM = CAP - MARGIN
+WORSE = {}
+for h in (1200.0, 3000.0, 5000.0, 6500.0, 7000.0):
+    _rows, _c, b = run(h, CAP, MARGIN, DRAIN_W)
+    _r0, _c0, b0 = run(h, CAP, MARGIN, DRAIN_W, maint=False)
+    WORSE[h] = (b, b0, _rows)
+    print(f"    house {h:.0f}: with the drain {[round(v) for v in b.values()]}"
+          f" W, without {[round(v) for v in b0.values()]} W")
+check("⭐ below and above the drain rate, every quarter with the drain banks "
+      "no more than the larger of the aim and the same quarter without it",
+      all(b[q] <= max(AIM, b0[q]) + TOL for b, b0, _r in WORSE.values()
+          for q in b))
+_r12 = WORSE[1200.0][2]
+check("below the drain rate the battery gives the drain rate and exports the "
+      "rest (owner, 2026-09-29): 2500 W against a 1200 W house",
+      all(cmd(r) == DRAIN_W for r in _r12[1:]))
+
+# ============================================================================ #
+print("\n3. the drain ends, and the order holds")
+_e_rows, _e, _eb = run(6500.0, CAP, MARGIN, DRAIN_W, dur=1200.0,
+                       soc=lambda u, t: max(5.0, 60.0 - t / 20.0))
+check("⭐ with the guard binding, the drain still reaches its floor and moves "
+      "to the charge phase, with no abort",
+      _e.maints[0].phase == CHARGE
+      and not any("abort" in e.lower() for e in _e.events))
+
+
+def blind_at(t0):
+    """The battery power reading goes missing at `t0`: a safety SET."""
+    def before(c, t):
+        s79._feed(c, t)
+        if t >= t0 and not getattr(c.hass, "_blind", False):
+            real = c.hass.number
+
+            async def number(e, invert=False):
+                return None if e == "sensor.batt_a" else await real(e, invert)
+            c.hass.number, c.hass._blind = number, True
+    return before
+
+
+_s_rows, _s, _sb = run(6500.0, CAP, MARGIN, DRAIN_W, dur=600.0,
+                       before=blind_at(300.0))
+print(f"    reading lost at 300 s: last {cmd(_s_rows[-1]):+.0f} W, "
+      f"{_s_rows[-1][6]}")
+check("⭐ a safety SET outranks the refiled peak floor: before the reading "
+      "goes the battery gives above the drain rate, after it it is at 0 W",
+      any(cmd(r) > DRAIN_W for r in _s_rows if r[0] < 300.0)
+      and all(cmd(r) == 0.0 for r in _s_rows if r[0] >= 400.0)
+      and _s_rows[-1][6].startswith("safety -> 0 W"))
+_m_rows, _m, _mb = run(7000.0, 2500, 50, 2000, dur=900.0, max_w=3000)
+print(f"    max_w 3000, house 7000: last {cmd(_m_rows[-1]):+.0f} W, "
+      f"{_m_rows[-1][6]}")
+check("⭐ the rating caps the floor without a clash: at max_w 3000 the "
+      "battery gives 3000 W, never 0 W, and nothing contradicts",
+      all(cmd(r) >= 2000.0 for r in _m_rows)
+      and cmd(_m_rows[-1]) == 3000.0
+      and not any("CONTRADICTION" in (r[6] or "") for r in _m_rows))
+check("...and there, with the battery at its rating and the house still over, "
+      "the 'Load too high' alarm does fire", alarmed(_m))
+
+# ============================================================================ #
+print("\n4. only the cycles where the guard wanted more change")
+
+
+def promoted(row):
+    return [c for c in row[-1][0] if c[0] == "peak"]
+
+
+_id = {k: s78.run(**v)[0] for k, v in s78.SCENARIOS.items()}
+_bad = []
+for k, rows in _id.items():
+    for r in rows:
+        claims, guard = r[-1][0], r[-1][1]
+        rate = [c[3] for c in claims if c[0] == "maintenance" and c[2] == "set"]
+        pk = promoted(r)
+        if k.startswith("n2"):
+            ok = all(c[1] == P_PEAK for c in pk)
+        elif s78.wanted_more(r):
+            ok = ([c[1] for c in pk] == [P_MAINTENANCE]
+                  and r[1] == guard[1] and "limited by peak" in r[6])
+        else:
+            ok = (all(c[1] == P_PEAK for c in pk)
+                  and (not rate or r[1] == rate[0]))
+        if not ok:
+            _bad.append((k, r[0], r[1], r[6], pk))
+_bad1 = [b for b in _bad if b[0].startswith("n1")]
+_bad2 = [b for b in _bad if b[0].startswith("n2")]
+_more = {k: sum(map(s78.wanted_more, rows)) for k, rows in _id.items()}
+print(f"    cycles with the guard above the drain: {_more}; bad {_bad[:3]}")
+check("⭐ at N=1, on every cycle where the guard asks for more than the drain "
+      "the peak claim is refiled at P_MAINTENANCE and the target is its floor; "
+      "on every other cycle the peak claim stays at P_PEAK and the target is "
+      "the drain rate",
+      not _bad1 and all(_more[k] > 50 for k in _id if k.startswith("n1")))
+check("⭐ at N=2 the peak claim is never refiled (the SAFETY-78 floor does "
+      "that job), and test_safety78.py part 5 holds N=2 to the digests of "
+      "release/1.0 35cdffe", not _bad2)
+
+
+# The rule itself, at the boundary: a floor AT the drain rate changes nothing.
+_one = types.SimpleNamespace(inverters=[None])
+_edge = {}
+for lo in (1999.5, 2000.0, 2000.5):
+    cl = [Claim.set("maintenance", P_MAINTENANCE, 2000.0, DRAIN),
+          Claim.limit("peak", P_PEAK, lo=lo, reason="quarter peak")]
+    Controller._peak_over_drain(_one, cl, [MaintResult(DRAIN, True, 2000.0,
+                                                       False, [])])
+    _edge[lo] = cl[1].priority
+check("at the boundary: a floor at or below the 2000 W drain stays at P_PEAK, "
+      "a floor 0.5 W above it is refiled at P_MAINTENANCE",
+      _edge == {1999.5: P_PEAK, 2000.0: P_PEAK, 2000.5: P_MAINTENANCE})
+
+_stop = [Claim.set("maintenance", P_MAINTENANCE, 2000.0, DRAIN),
+         Claim.limit("peak", P_PEAK, lo=4000.0, reason="quarter peak"),
+         Claim.set("safety", P_SAFETY, 0.0, "inputs missing")]
+Controller._peak_over_drain(_one, _stop, [MaintResult(DRAIN, True, 2000.0,
+                                                      False, [])])
+check("⭐ and a refiled floor stays under a safety SET: the site resolves "
+      "to 0 W", _stop[1].priority == P_MAINTENANCE
+      and resolve(_stop).target_w == 0.0)
+
+
+def store_hold():
+    st = rig._Store()
+    st.data["phase"], st.data["phase_started"] = "hold", rig.BASE.isoformat()
+    return st
+
+
+_h_rows, _h, _hb = run(6000.0, 2500, 50, 2000, dur=600.0, store=store_hold())
+check("a maintenance HOLD at N=1 now gives way to the guard too (SAFETY-86, "
+      "test_safety86.py): the battery gives with the house over the limit",
+      _h.maints[0].phase == "hold" and _h.peak_guard.engaged
+      and cmd(_h_rows[-1]) > 0.0 and "limited by peak" in _h_rows[-1][6])
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: {', '.join(fails)}")
+    sys.exit(1)
+print("all checks passed")
diff --git a/goodwe_controller/test_safety84.py b/goodwe_controller/test_safety84.py
new file mode 100644
index 0000000..9fc4502
--- /dev/null
+++ b/goodwe_controller/test_safety84.py
@@ -0,0 +1,510 @@
+"""Runnable check for SAFETY-84: a maintenance charge at N=2 no longer stalls.
+`python3 test_safety84.py`
+
+In a cheap window the charging battery's own `hi` makes it charge. At two
+inverters the loop's site target sat above it, the other battery had to give,
+the allocator refused the opposite directions and the site sat at 0 W. Now a
+site `hi` (`charge`, P_MAINT_SHAPE) keeps the site target at or below the
+charge, and the charge is sized to the quarter's headroom so it yields to the
+peak guard. Drives the REAL Controller (tools/safety84_identity.py's harness).
+DECISIONS/SAFETY-84-charge-at-two.md has the record.
+
+1. N=2 in a cheap window, house below, at and above the charge rate and a
+   solar surplus: the charge runs, no opposite split, no refusal, and it ends.
+2. The peak guard: the charge yields just enough to hold the aim (cap -
+   margin, and a banked month peak - margin); over the aim the guard wins,
+   the charging battery gives too, and nothing parks; no false 'Load too
+   high'. Without P1 the charge is not sized, as at N=1.
+3. Outside a cheap window nothing changes.
+4. A safety stop parks both batteries without a refusal, and the charge
+   resumes after it.
+5. One battery refusing, or dropped, and B Off with battery modes on.
+6. A trade outranked by the charge (P_ARBITRAGE < P_MAINT_SHAPE).
+7. A seeded sweep of the ceiling against the loop, trades, refusals, packs
+   and modes.
+8. The N=1 digests equal release/1.0 9d5b7d1, and the N=2 ones are pinned.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import logging
+import os
+import random
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import opt11p3_identity as p3                                  # noqa: E402
+import safety84_identity as s84                                # noqa: E402
+from app import arbitrage, packmode                            # noqa: E402
+from app.arbiter import (Claim, P_ARBITRAGE, P_LOOP, P_MAINT_SHAPE,  # noqa
+                         P_MODE, P_SAFETY, resolve)
+from app.main import Controller                                # noqa: E402
+from app.maintenance import CHARGE, HOLD                       # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+A, B = "inverter-a", "inverter-b"
+AIM = 3450.0            # peak_cap_w 3500 - peak_margin_w 50
+TOL = 10.0              # W over the aim a banked quarter may show (SAFETY-81)
+
+
+def cmd(r):
+    return dict(r[2])
+
+
+def refused(rows):
+    return sum(1 for r in rows if r[7] and "REFUSED" in r[7])
+
+
+def opposite(rows):
+    return sum(1 for r in rows if cmd(r)["a"] * cmd(r)["b"] < 0)
+
+
+def charge_claims(r):
+    """The site `charge` claims main.py handed resolve() on row `r`."""
+    return [c for c in r[-1][0] if c[0] == "charge"]
+
+
+def banked(c):
+    return [b.offtake_avg_w for b in c.p1.blocks]
+
+
+def alarmed(c):
+    """Did SAFETY-81's 'Load too high' alarm fire on this run? Its quarter
+    stamp too, since ALLOCATOR rows can push its row out of the 40-row log
+    (SAFETY-85)."""
+    return c._peak_alarm_block is not None or any(
+        "PEAK_GUARD_SATURATED" in e for e in c.events)
+
+
+def run(house, n=2, **kw):
+    return s84.run(n, load=house if callable(house) else lambda t: house,
+                   **kw)
+
+
+def rise(u, t):
+    """A fills from 60 % (1 % a cycle); B stays at 50 %."""
+    return min(100.0, 60.0 + t / 5.0) if u == "a" else 50.0
+
+
+# ============================================================================ #
+print("1. N=2 in a cheap window: the charge runs whatever the house uses")
+RUNS = {h: run(h, dur=900.0) for h in (800.0, 2000.0, 3000.0, -1500.0)}
+for h, (rows, c) in RUNS.items():
+    print(f"    house {h:+.0f} W: last A {cmd(rows[-1])['a']:+.0f} W, B "
+          f"{cmd(rows[-1])['b']:+.0f} W; {rows[-1][6]}; refusals "
+          f"{refused(rows)}")
+check("⭐ below, at and above the charge rate and under a solar surplus, "
+      "battery A charges on EVERY cycle (it used to sit at 0 W from the "
+      "first cycle)",
+      all(cmd(r)["a"] < 0.0 for rows, _c in RUNS.values() for r in rows)
+      and all(c.maints[0].phase == CHARGE for _r, c in RUNS.values()))
+check("⭐ no cycle splits the site both ways and the allocator refuses "
+      "nothing: battery B never gives while A charges",
+      all(opposite(rows) == 0 and refused(rows) == 0
+          and all(cmd(r)["b"] <= 0.0 for r in rows)
+          for rows, _c in RUNS.values()))
+check("...and nothing is logged per cycle: no ARBITER line in the action log",
+      not any("ARBITER" in e for _r, c in RUNS.values() for e in c.events))
+check("with the quarter's headroom above the charge rate, A charges at the "
+      "full 2000 W and the Why names the charge",
+      all(cmd(r)["a"] == -2000.0 for h in (800.0, -1500.0)
+          for r in RUNS[h][0])
+      and "limited by charge" in RUNS[800.0][0][-1][6])
+print(f"    Why: {RUNS[800.0][1].why_words}")
+check("...and the page's Why reads as at one battery: 'held back by battery "
+      "maintenance'",
+      RUNS[800.0][1].why_words.endswith("held back by battery maintenance"))
+
+_end_rows, _end = run(800.0, dur=600.0, soc=rise)
+check("⭐ and the charge ENDS: A reaches its 99 % target and the cycle moves "
+      "on to its hold, with no refusal on the way",
+      _end.maints[0].phase == HOLD and refused(_end_rows) == 0
+      and any("charge complete" in e for e in _end.events))
+
+_real = Controller._charge_ceiling
+Controller._charge_ceiling = lambda self, claims: None
+try:
+    _bite, _bc = run(800.0, dur=120.0)
+finally:
+    Controller._charge_ceiling = _real
+print(f"    without the ceiling: refusals {refused(_bite)}/{len(_bite)}, "
+      f"last A {cmd(_bite[-1])['a']:+.0f} W")
+check("non-vacuous: with the ceiling taken out, the same fixture refuses "
+      "every cycle and parks A at 0 W (the reported defect)",
+      refused(_bite) == len(_bite) and cmd(_bite[-1])["a"] == 0.0)
+
+# ============================================================================ #
+print("\n2. the peak guard outranks the charge")
+_q_rows, _q = run(3000.0, dur=2700.0)
+print(f"    house 3000: banked {[round(v) for v in banked(_q)]} W, last A "
+      f"{cmd(_q_rows[-1])['a']:+.0f} W")
+check("⭐ house 3000 W, aim 3450 W: the charge yields just enough - every "
+      "banked quarter lands on the aim, not on house + 2000 W",
+      len(banked(_q)) >= 2
+      and all(AIM - TOL <= v <= AIM + TOL for v in banked(_q)))
+check("...and it yields by charging less, not by stopping: A charges and B "
+      "is 0 W on every cycle, nothing is refused, no 'Load too high'",
+      all(cmd(r)["a"] < 0.0 and cmd(r)["b"] == 0.0 for r in _q_rows)
+      and refused(_q_rows) == 0 and not alarmed(_q))
+check("...and the peak guard never has to step in (the charge stays under "
+      "what the quarter can afford)",
+      not any(r[-1][1] and r[-1][1][0] for r in _q_rows))
+
+_o_rows, _o = run(5000.0, dur=2700.0)
+_both = [r for r in _o_rows
+         if charge_claims(r) and any(c[0] == "peak" for c in r[-1][0])]
+print(f"    house 5000: banked {[round(v) for v in banked(_o)]} W, last "
+      f"{cmd(_o_rows[-1])}, {_o_rows[-1][6]}")
+check("⭐ house 5000 W, over the aim alone: the peak guard wins - every "
+      "banked quarter is at or under the aim, both batteries give in the "
+      "same direction, nothing is refused and nothing parks at 0 W",
+      all(v <= AIM + TOL for v in banked(_o)) and opposite(_o_rows) == 0
+      and refused(_o_rows) == 0
+      and sum(cmd(r)["a"] + cmd(r)["b"] > 0.0 for r in _o_rows) > 100)
+check("...and the guard's `lo` never meets the charge's `hi` in one cycle "
+      "(the charge is suspended while the guard holds)", not _both)
+check("...with no false 'Load too high' alarm", not alarmed(_o))
+
+_k_rows, _k = run(3000.0, dur=2700.0, month_peak=4000.0)
+print(f"    month peak 4000 banked, house 3000: banked "
+      f"{[round(v) for v in banked(_k)]} W")
+check("⭐ under a month peak banked at 4000 W the aim is 3950 W: the charge "
+      "takes the extra headroom and every banked quarter lands on 3950 W",
+      len(banked(_k)) >= 2
+      and all(3950.0 - TOL <= v <= 3950.0 + TOL for v in banked(_k))
+      and refused(_k_rows) == 0 and not alarmed(_k))
+
+_real = Controller._charge_headroom
+Controller._charge_headroom = lambda self, floor, claims: floor
+try:
+    _nh_rows, _nh = run(3000.0, dur=2700.0)
+finally:
+    Controller._charge_headroom = _real
+_gave = sum(1 for r in _nh_rows if cmd(r)["a"] > 0.0 or cmd(r)["b"] > 0.0)
+print(f"    without the headroom: cycles a battery gives {_gave}, banked "
+      f"{[round(v) for v in banked(_nh)]} W")
+check("non-vacuous: charging at the full rate instead, the guard has to "
+      "step in and the batteries give back on many cycles",
+      _gave > 50)
+
+
+def peak_run(house):
+    rows, c = run(house, dur=1800.0)
+    return rows, c, [r for r in rows if r[-1][1] and r[-1][1][0]]
+
+
+# A 6500 W house needs 3050 W off the meter: more than B's 2500 W alone.
+_p_rows, _p, _p_eng = peak_run(6500.0)
+print(f"    house 6500: banked {[round(v) for v in banked(_p)]} W, A gives "
+      f"on {sum(cmd(r)['a'] > 0.0 for r in _p_eng)} of {len(_p_eng)} "
+      f"engaged cycles")
+check("⭐ house 6500 W, more than B alone can cover: the charge is suspended "
+      "and A, the battery being filled, gives too; the quarter lands on the "
+      "aim, nothing is refused, no 'Load too high'",
+      len(_p_eng) > 100 and all(cmd(r)["a"] > 0.0 for r in _p_eng)
+      and all(v <= AIM + TOL for v in banked(_p))
+      and refused(_p_rows) == 0 and not alarmed(_p))
+_real = s84.m.peakguard.shaping_suspended
+s84.m.peakguard.shaping_suspended = lambda *a: False
+try:
+    _ns_rows, _ns, _ns_eng = peak_run(6500.0)
+finally:
+    s84.m.peakguard.shaping_suspended = _real
+check("non-vacuous: with the suspension taken out, A is held at 0 W, the "
+      "quarter goes over the cap and 'Load too high' fires",
+      not any(cmd(r)["a"] > 0.0 for r in _ns_eng)
+      and max(banked(_ns)) > 3500.0 and alarmed(_ns))
+
+
+def prices_only(c, t):
+    """A cheap price and no P1 telegram (`meter_source: off`)."""
+    if not getattr(c.hass, "_px", False):
+        read, px = c.hass.number, {"sensor.pnow": 0.05, "sensor.pavg": 0.20}
+
+        async def number(e, invert=False):
+            return px[e] if e in px else await read(e, invert)
+        c.hass.number, c.hass._px = number, True
+
+
+_p1 = s84.s79.P1
+s84.s79.P1 = {"meter_source": "off", "peak_cap_w": 3500}
+try:
+    _off_rows, _off = run(800.0, dur=600.0, before=prices_only)
+finally:
+    s84.s79.P1 = _p1
+check("⭐ with no P1 meter nothing measures the quarter and the charge is not "
+      "sized, as at N=1: A charges at 2000 W on every cycle, nothing refused",
+      _off.peak_guard is None and all(cmd(r)["a"] == -2000.0 for r in _off_rows)
+      and refused(_off_rows) == 0)
+
+# ============================================================================ #
+print("\n3. outside a cheap window nothing changes")
+_d = {h: run(h, cheap=False, dur=600.0) for h in (800.0, -1500.0)}
+check("⭐ no `charge` claim is filed outside a cheap window: B covers the "
+      "house, the charge takes solar only, nothing is refused",
+      not any(charge_claims(r) for rows, _c in _d.values() for r in rows)
+      and cmd(_d[800.0][0][-1]) == {"a": 0.0, "b": 800.0}
+      and cmd(_d[-1500.0][0][-1])["a"] < 0.0
+      and all(refused(rows) == 0 for rows, _c in _d.values()))
+
+
+# ============================================================================ #
+print("\n4. a safety stop outranks the charge")
+
+
+def blind_at(t0, t1):
+    """A's power reading is missing from `t0` to `t1`: a safety SET."""
+    def before(c, t):
+        s84.feed(True)(c, t)
+        if not getattr(c.hass, "_blind", False):
+            real = c.hass.number
+
+            async def number(e, invert=False):
+                if e == "sensor.batt_a" and t0 <= c.hass.t < t1:
+                    return None
+                return await real(e, invert)
+            c.hass.number, c.hass._blind = number, True
+    return before
+
+
+_s_rows, _s = run(800.0, dur=600.0, before=blind_at(150.0, 400.0))
+_stop = [r for r in _s_rows if 175.0 <= r[0] < 400.0]
+_last = _s_rows[79]                     # t = 395 s, still without the reading
+print(f"    A's reading lost 150-400 s: {_last[2]}, {_last[6]}; after: "
+      f"{_s_rows[-1][2]}")
+check("⭐ with a reading gone the safety SET parks both batteries at 0 W "
+      "with no refusal and no ARBITER line (it used to refuse every cycle)",
+      all(cmd(r) == {"a": 0.0, "b": 0.0} for r in _stop)
+      and _last[0] == 395.0 and _last[6].startswith("safety -> 0 W")
+      and refused(_s_rows) == 0 and not any("ARBITER" in e for e in _s.events))
+check("...and the charge ran before and runs again after",
+      cmd(_s_rows[20])["a"] == -2000.0 and cmd(_s_rows[-1])["a"] == -2000.0)
+
+
+_full = _s._charge_headroom(2000.0, [])
+check("the stop test reads only SITE SETs: a unit's own safety SET (on B) "
+      "or a site limit does not cut A's charge, a site safety SET does",
+      _s._charge_headroom(2000.0, [Claim.set("failsafe", P_SAFETY, 0.0,
+                                             actuator=B)]) == _full > 0.0
+      and _s._charge_headroom(2000.0, [Claim.limit("peak", P_SAFETY,
+                                                   lo=0.0)]) == _full
+      and _s._charge_headroom(2000.0, [Claim.set("safety", P_SAFETY,
+                                                 0.0)]) == 0.0)
+
+
+def stop_at(t0):
+    def before(c, t):
+        s84.feed(True)(c, t)
+        if t >= t0:
+            c.auto = False
+    return before
+
+
+_st_rows, _st = run(800.0, dur=400.0, before=stop_at(200.0))
+check("control switched off mid-charge: both batteries at 0 W, no refusal",
+      cmd(_st_rows[-1]) == {"a": 0.0, "b": 0.0} and refused(_st_rows) == 0)
+
+# ============================================================================ #
+print("\n5. one battery refusing, dropped, or Off")
+
+
+def a_takes_nothing(c, t):
+    """A reads 0 W whenever it is asked to charge (a battery that refuses)."""
+    s84.feed(True)(c, t)
+    if not getattr(c.hass, "_rt", False):
+        real = c.hass.power
+        c.hass.power = lambda u: (0.0 if u == "a" and c.hass.cmd["a"] < 0.0
+                                  else real(u))
+        c.hass._rt = True
+
+
+_r_rows, _r = run(800.0, dur=900.0, before=a_takes_nothing)
+print(f"    A refuses to charge: {_r_rows[-1][2]}, {_r_rows[-1][6]}")
+check("⭐ A refuses to charge (SAFETY-73): no ceiling is filed for it, B "
+      "covers the 800 W house, and no cycle is split both ways or refused",
+      _r.inverters[0].refused == -1 and cmd(_r_rows[-1]) == {"a": 0.0,
+                                                           "b": 800.0}
+      and not charge_claims(_r_rows[-1])
+      and opposite(_r_rows) == 0 and refused(_r_rows) == 0)
+
+_g_rows, _g = run(3000.0, dur=600.0, cut=lambda u, t: u == "b")
+check("B refuses to give: A still charges and nothing is refused",
+      all(cmd(r)["a"] < 0.0 for r in _g_rows) and refused(_g_rows) == 0)
+
+
+def reject_a(c, t):
+    """Every write to A is rejected, so A's link goes stale (not live)."""
+    s84.feed(True)(c, t)
+    if not getattr(c.hass, "_rej", False):
+        real = c.hass.set_number
+
+        async def set_number(e, v):
+            return False if e == "number.sp_a" else await real(e, v)
+        c.hass.set_number, c.hass._rej = set_number, True
+
+
+_l_rows, _l = run(1500.0, dur=400.0, before=reject_a)
+print(f"    A's writes rejected: {_l_rows[-1][2]}, {_l_rows[-1][7][-40:]}")
+check("⭐ a charging battery that is dropped (stale link) adds no ceiling: "
+      "B covers the 1500 W house instead of charging for A",
+      "dropped inverter-a" in _l_rows[-1][7]
+      and 1490.0 <= cmd(_l_rows[-1])["b"] <= 1530.0
+      and not charge_claims(_l_rows[-1]))
+
+
+def modes_store(b_mode=None, b_off=False):
+    s = rig._Store()
+    for k in ("phase", "phase_started"):
+        s.data[unit_key(A, k)] = ("charge" if k == "phase"
+                                  else rig.BASE.isoformat())
+    if b_mode:
+        s.data[unit_key(B, packmode.MODE_KEY)] = b_mode
+    if b_off:
+        s.data[unit_key(B, packmode.USE_KEY)] = False
+    return s
+
+
+_m = {h: run(h, dur=600.0, extra={"battery_modes_enabled": True},
+             store=modes_store(b_off=True)) for h in (800.0, -3000.0)}
+print(f"    B Off: {[(h, cmd(rows[-1])) for h, (rows, _c) in _m.items()]}")
+check("⭐ battery modes on, B Off: A charges at 2000 W over an 800 W house "
+      "and takes 2500 W of a 3000 W surplus, B stays at 0 W, nothing is "
+      "refused",
+      cmd(_m[800.0][0][-1]) == {"a": -2000.0, "b": 0.0}
+      and cmd(_m[-3000.0][0][-1]) == {"a": -2500.0, "b": 0.0}
+      and all(refused(rows) == 0 and opposite(rows) == 0
+              for rows, _c in _m.values()))
+
+# ============================================================================ #
+print("\n6. a trade does not outrank the charge")
+
+
+def sell_feed(c, t):
+    p3._feed(c, t)
+    s84.feed(True)(c, t)
+
+
+_trades = []
+_t_rows, _t = run(800.0, dur=5400.0, before=sell_feed,
+                  extra=dict(p3.ARB),
+                  soc=lambda u, t: 60.0)
+print(f"    modes off, a sell at 75-90 min: last {_t_rows[-1][2]}")
+_sells = [r for r in _t_rows if any(c[0] == "arbitrage" and c[3] > 0.0
+                                    for c in r[-1][0])]
+check("⭐ battery modes off: the site trade asks to SELL while A charges; "
+      "the charge (P_MAINT_SHAPE) outranks it, so A keeps charging and "
+      "nothing is refused",
+      len(_sells) > 50
+      and all(cmd(r)["a"] < 0.0 and cmd(r)["b"] <= 0.0 for r in _sells)
+      and refused(_t_rows) == 0)
+
+# ============================================================================ #
+print("\n7. a seeded sweep of the ceiling")
+_c = run(800.0, dur=30.0)[1]
+_rnd = random.Random(84)
+_bad = []
+for _i in range(20000):
+    ra, rb = _rnd.choice((2000.0, 2500.0)), _rnd.choice((1000.0, 2500.0))
+    f = _rnd.uniform(1.0, ra)
+    cl = [Claim.limit("supervised", P_SAFETY, -ra, ra, actuator=A),
+          Claim.limit("supervised", P_SAFETY, -rb, rb, actuator=B),
+          Claim.limit("maintenance", P_MAINT_SHAPE, hi=-f, actuator=A)]
+    x = _rnd.random()
+    if x < 0.1:
+        cl.append(Claim.limit("refused", P_SAFETY, 0.0, actuator=A))
+    elif x < 0.2:
+        cl.append(Claim.limit("pack", P_SAFETY, 0.0, actuator=A))
+    y = _rnd.random()
+    if y < 0.15:
+        cl.append(Claim.limit("refused", P_SAFETY, *_rnd.choice(
+            ((0.0, float("inf")), (float("-inf"), 0.0))), actuator=B))
+    elif y < 0.3:
+        cl.append(Claim.limit("mode", P_MODE, *_rnd.choice(
+            ((0.0, 0.0), (0.0, rb), (-rb, 0.0))), actuator=B))
+    cl.append(Claim.set("loop", P_LOOP, _rnd.uniform(-6000, 6000)))
+    if _rnd.random() < 0.4:
+        cl.append(Claim.set("arbitrage", P_ARBITRAGE,
+                            _rnd.uniform(-5000, 5000)))
+    ceil = _c._charge_ceiling(cl)
+    if ceil is not None:
+        cl.append(Claim.limit("charge", P_MAINT_SHAPE, hi=ceil))
+    res = resolve(cl, units=(A, B), live={A, B})
+    sh = res.shares or {}
+    why = []
+    if not res.allocated or res.contradiction:
+        why.append("refused or contradicted")
+    if sh.get(A, 0.0) * sh.get(B, 0.0) < 0.0:
+        why.append("opposite")
+    a_free = x >= 0.2
+    if a_free and (ceil is None or sh.get(A, 0.0) > -f + 1.0):
+        why.append("A does not charge")
+    if not a_free and ceil is not None:
+        why.append("ceiling filed for a pack that cannot charge")
+    if why:
+        _bad.append((_i, why))
+print(f"    20000 claim lists, bad {len(_bad)}: {_bad[:3]}")
+check("⭐ 20000 random N=2 claim lists (a charge on A, refusals, a full "
+      "pack, B's mode, the loop and trades in both directions): never "
+      "refused, never both ways, A always charges at least its rate, and "
+      "no ceiling for a pack that cannot charge", not _bad)
+
+# ============================================================================ #
+print("\n8. the N=1 and N=2 digests")
+# Printed by `python3 tools/safety84_identity.py` in goodwe-addon-checks:1,
+# 2026-09-30, 480 cycles each, every claim hashed. N=1 and n2_charge_dear:
+# the same on release/1.0 9d5b7d1 (the tool copied in). N=2 in a cheap
+# window: new, the charge that 9d5b7d1 refused on every cycle.
+# SAFETY-85 re-pinned the three N=2 ones: the loop is bounded while A's
+# charge pin stands. n2_charge and _banked change only the loop's reason and
+# claim on 2 cycles; n2_charge_dear changes commands on 98 cycles, where A's
+# pin lifts (t=1800) and B no longer jumps 1390 W, and after the surplus step.
+PINNED = {
+    "n1_charge":
+        "0ed25c856456b97acb07a39299a8cb7b1a762c4d0005b88a0823c03057a80be5",
+    "n1_charge_dear":
+        "c25340b56060d4581f7204e200b07e7c8618711be2baca3b1667b7ebeb600dc3",
+    "n1_charge_banked":
+        "2619acdd06b04e56c000b168d64e1d044346c6ba3f929c94258d6ad8189ec609",
+    "n2_charge":
+        "b16d692128f14bcce3d87b142d290e0d6b13724289680e44a05215c9eaa24a7c",
+    "n2_charge_dear":
+        "00a197d89a5dd1e8b3ae6a5d1af66329a4dc4850476569c5931c125fa4d9eaee",
+    "n2_charge_banked":
+        "a6973faea916e4c88ca1770047f94478346eeb1efa4889b154fad0747f91267f",
+}
+_now = s84.digests()
+for k in PINNED:
+    print(f"    {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'} "
+          f"{_now[k][:16]}")
+check("⭐ at N=1 a charge in and out of a cheap window and under a banked "
+      "month peak is byte-identical to 9d5b7d1 (commands, reasons and every "
+      "claim), and N=2 outside a cheap window matches its SAFETY-85 pin",
+      all(_now[k] == PINNED[k] for k in ("n1_charge", "n1_charge_dear",
+                                         "n1_charge_banked",
+                                         "n2_charge_dear")))
+check("...and the N=2 cheap-window digests match the pins",
+      _now["n2_charge"] == PINNED["n2_charge"]
+      and _now["n2_charge_banked"] == PINNED["n2_charge_banked"])
+_n1 = s84.run(1, dur=600.0)[0]
+check("...and no N=1 cycle files a `charge` claim",
+      not any(charge_claims(r) for r in _n1))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all SAFETY-84 checks passed")
diff --git a/goodwe_controller/test_safety85.py b/goodwe_controller/test_safety85.py
new file mode 100644
index 0000000..ed70653
--- /dev/null
+++ b/goodwe_controller/test_safety85.py
@@ -0,0 +1,450 @@
+"""Runnable check for SAFETY-85: no false 'not keeping up' while another owner
+sets the battery. `python3 test_safety85.py`
+
+The loop's integrator bound fired every ~2.5 min during maintenance and under
+the peak guard, though the battery gave what it was told: the loop's own ask,
+re-seeded and pushed by a grid error it did not own, crossed its rail. Now the
+loop's clamp counts only on a cycle the loop decided, a battery another owner
+set alarms only when it gives less than told, and at N>=2 the loop is bounded
+while maintenance holds a battery. Drives the REAL Controller
+(tools/safety84_identity.py's harness). DECISIONS/SAFETY-85-no-false-not-keeping-up.md.
+
+1. N=1 and N=2: a drain, a charge and a HOLD with the house above what the
+   battery is set to, an hour each: no warning; without the fix they warn.
+2. A battery that gives less than told during a drain does alarm (N=1, N=2);
+   a two-cycle dip does not.
+3. Control coming back from maintenance does not jump (N=2 hold end, N=2
+   charge pin lifting, N=1 hold end).
+4. The loop's own alarm stays (house over the rating); a safety limit at N=2
+   (a battery at its cut-out) does not warn.
+5. The status row counts episodes, not cycles.
+6. The rules at their boundaries.
+7. Review: a battery the peak guard sets that gives nothing warns; a battery
+   that lags (10 s) and a charge that tapers do not.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import logging
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import safety79_identity as s79                                # noqa: E402
+import safety84_identity as s84                                # noqa: E402
+import app.main as app_main                                    # noqa: E402
+from app import clamp, messages                                # noqa: E402
+from app.main import Controller                                # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+A = "inverter-a"
+HOUR = 3600.0
+SLEW = 400.0            # the rig's slew_w
+OPT0 = dict(s84.OPT)
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+async def _call(self, *a):
+    """The rig's Home Assistant, recording each notification id it is sent."""
+    if len(a) >= 3 and a[1] == "create" and isinstance(a[2], dict):
+        self.__dict__.setdefault("notes", []).append(
+            a[2].get("notification_id"))
+    return True
+
+
+rig._Hass.call = _call
+
+
+def store(n, phase):
+    """Battery A in `phase` from the first cycle ('drain': due at 11:00;
+    'idle': only with `maint=False`)."""
+    if phase == "drain":
+        return rig._Store()
+    if phase == "charge":
+        return s79.store_charging(n)
+    s = rig._Store()
+    if phase == "hold":
+        for k, v in (("phase", "hold"), ("phase_started",
+                                         rig.BASE.isoformat())):
+            s.data[k if n == 1 else unit_key(A, k)] = v
+    return s
+
+
+def run(n, phase, house, cap, *, dur=HOUR, soc=None, cut=None, extra=None,
+        maint=True):
+    """Rows and controller; `cap` is the peak limit (20000: never binds);
+    `house` is watts or a function of time."""
+    s84.OPT = dict(OPT0, peak_cap_w=cap, maintenance_enabled=maint)
+    if soc is None:
+        def soc(u, t):
+            return 99.0 if phase == "hold" and u == "a" else 60.0
+    try:
+        load = house if callable(house) else (lambda t: house)
+        return s84.run(n, load=load, cheap=(phase == "charge"),
+                       store=store(n, phase), soc=soc, dur=dur, cut=cut,
+                       extra=dict({"maintenance_hold_min": 600,
+                                   "maintenance_discharge_w": 2000},
+                                  **(extra or {})))
+    finally:
+        s84.OPT = OPT0
+
+
+def warned(c):
+    """'Battery is not keeping up': notifications, cycles, episodes."""
+    return (getattr(c.hass, "notes", []).count(messages.ID_LOOP_BOUND),
+            c.clamp_wd.bound, c.clamp_wd.bound_episodes)
+
+
+def patched(obj, name, value):
+    """Run `fn` with `obj.name` replaced (the 'without the fix' runs)."""
+    def wrap(fn):
+        real = getattr(obj, name)
+        setattr(obj, name, value)
+        try:
+            return fn()
+        finally:
+            setattr(obj, name, real)
+    return wrap
+
+
+no_gate = patched(Controller, "_loop_alarm_input", lambda self, r: None)
+no_bound = patched(Controller, "loop_bound", lambda self, claims: None)
+
+
+def cmd(r):
+    return dict(r[2])
+
+
+def steps(rows, lo, hi):
+    """The largest change in the total command between cycles in [lo, hi]."""
+    tot = [(r[0], sum(cmd(r).values())) for r in rows]
+    return max(abs(b - a) for (t0, a), (t1, b) in zip(tot, tot[1:])
+               if lo <= t1 <= hi)
+
+
+# ============================================================================ #
+print("1. the house above what the battery is set to, an hour each")
+CASES = [
+    # (n, phase, house, cap): the peak guard raises the drain / the HOLD at a
+    # 3500 W limit; the rest are the phase alone under a house that pushes the
+    # loop's re-seeded ask past its rail.
+    (1, "drain", 6500.0, 3500), (1, "drain", 7500.0, 20000),
+    (1, "charge", 10000.0, 20000),
+    (1, "hold", 6500.0, 3500), (1, "hold", 9000.0, 20000),
+    (2, "drain", 6500.0, 3500), (2, "charge", 10000.0, 20000),
+    (2, "hold", 4500.0, 20000), (2, "hold", 6500.0, 3500),
+]
+NEW, OLD = {}, {}
+for k in CASES:
+    NEW[k] = run(*k)
+    OLD[k] = no_gate(lambda: no_bound(lambda: run(*k)))
+    print(f"    N={k[0]} {k[1]:6} house {k[2]:5.0f} limit {k[3]:5}: phases "
+          f"{sorted({p for r in NEW[k][0] for p in r[-1][3]})}, warnings "
+          f"(notes, cycles, episodes) {warned(NEW[k][1])}, without the fix "
+          f"{warned(OLD[k][1])}")
+check("⭐ no 'Battery is not keeping up' notification, cycle or episode in any "
+      "of the nine hours, at N=1 and N=2",
+      all(warned(c) == (0, 0, 0) for _r, c in NEW.values()))
+check("...the phase held all hour (the battery was set by maintenance, or by "
+      "the guard over it, throughout)",
+      all(all(r[-1][3][0] == k[1] for r in NEW[k][0]) for k in CASES))
+check("non-vacuous: without the fix every one of the nine warns, the "
+      "notification re-created on the re-assert cadence",
+      all(warned(c)[0] >= 1 and warned(c)[1] > 0 for _r, c in OLD.values())
+      and sum(warned(c)[0] for _r, c in OLD.values()) >= 9 * 5)
+
+# ============================================================================ #
+print("\n2. a battery that really gives less than told still alarms")
+
+
+def gone(t0, t1):
+    """Battery A gives nothing from t0 to t1."""
+    return lambda u, t: u == "a" and t0 <= t < t1
+
+
+SHORT = {n: run(n, "drain", 1000.0, 20000, dur=1200.0, cut=gone(600, 1200))
+         for n in (1, 2)}
+for n, (rows, c) in SHORT.items():
+    print(f"    N={n}: {warned(c)}, log "
+          f"{[e for e in c.events if 'OUTPUT_CLAMP' in e][:1]}")
+_r1, _c1 = SHORT[1]
+check("⭐ N=1, a drain of 2000 W that gives nothing: it warns, and the log "
+      "says what was asked and what came",
+      warned(_c1)[0] >= 1 and any(
+          "the battery gives -4 W of the +2000 W asked" in e
+          for e in _c1.events))
+_r2, _c2 = SHORT[2]
+check("⭐ N=2, the same on battery A while B follows the house: it warns and "
+      "names inverter-a",
+      warned(_c2)[0] >= 1 and any(
+          "inverter-a gives -4 W of the +2000 W asked" in e
+          for e in _c2.events))
+_hb = run(2, "hold", 4500.0, 20000, dur=1200.0,
+          cut=lambda u, t: u == "b" and t >= 600)
+print(f"    N=2 HOLD on A, B gives nothing: {warned(_hb[1])}")
+check("⭐ N=2, A in its HOLD and B, which the loop drives, gives nothing: the "
+      "loop stands at what B may give, and it warns naming inverter-b",
+      warned(_hb[1])[0] >= 1 and any(
+          "inverter-b gives -4 W of the +2500 W asked" in e
+          for e in _hb[1].events))
+check("...it starts no earlier than the saturation cycles allow (3 x 5 s)",
+      all(e.split(" ", 1)[0] >= "11:10:10" for c in (_c1, _c2)
+          for e in c.events if "OUTPUT_CLAMP" in e))
+_quiet = patched(app_main, "delivery_short", lambda *a: False)(
+    lambda: run(1, "drain", 1000.0, 20000, dur=1200.0, cut=gone(600, 1200)))
+check("non-vacuous: without the delivery rule the N=1 drain that gives "
+      "nothing is silent (the loop's clamp never reaches its rail here)",
+      warned(_quiet[1]) == (0, 0, 0))
+_dip = run(1, "drain", 1000.0, 20000, dur=900.0, cut=gone(600, 610))
+check("a dip of two cycles is not an alarm", warned(_dip[1]) == (0, 0, 0))
+
+# ============================================================================ #
+print("\n3. control coming back from maintenance does not jump")
+END = {"maintenance_hold_min": 10}
+_bounds = []
+_real_compute = app_main.compute
+
+
+def _spy_compute(*a, **kw):
+    _bounds.append(kw.get("bound"))
+    return _real_compute(*a, **kw)
+
+
+app_main.compute = _spy_compute
+try:
+    _h2 = run(2, "hold", 4500.0, 20000, dur=900.0, extra=END)
+finally:
+    app_main.compute = _real_compute
+_h2_old = no_bound(lambda: run(2, "hold", 4500.0, 20000, dur=900.0,
+                               extra=END))
+_h1 = run(1, "hold", 4500.0, 20000, dur=900.0, extra=END)
+s84.OPT = dict(OPT0)
+_cd = s84.run(2, cheap=False)
+_cd_old = no_bound(lambda: s84.run(2, cheap=False))
+print(f"    N=2 hold end: largest step {steps(_h2[0], 560, 700):.0f} W "
+      f"(without the bound {steps(_h2_old[0], 560, 700):.0f} W); N=1 "
+      f"{steps(_h1[0], 560, 700):.0f} W; N=2 charge pin lifts at 1800 s: "
+      f"{steps(_cd[0], 1780, 1840):.0f} W (without "
+      f"{steps(_cd_old[0], 1780, 1840):.0f} W)")
+check("⭐ N=2, the HOLD ends under a 4500 W house: the batteries move at most "
+      "one slew step a cycle",
+      _h2[1].maints[0].phase != "hold" and steps(_h2[0], 560, 700) <= SLEW)
+_held = [any(p != "idle" for p in r[-1][3]) for r in _h2[0]]
+print(f"    bound per cycle: {len(_bounds)} calls, {len(_held)} rows, "
+      f"{sum(_held)} in maintenance, "
+      f"{sum(b is not None for b in _bounds)} bounded")
+check("...and the bound is on while A holds and off from the cycle the HOLD "
+      "ends (review)",
+      len(_bounds) == len(_held) and any(not h for h in _held)
+      and all((b is not None) == h for b, h in zip(_bounds, _held)))
+check("⭐ N=2, A's charge pin lifts at a quarter's start: at most one slew "
+      "step a cycle", steps(_cd[0], 1780, 1840) <= SLEW)
+check("...and N=1 already moved one slew step at a time (re-seeded each "
+      "cycle), unchanged", steps(_h1[0], 560, 700) <= SLEW)
+check("non-vacuous: without the bound the N=2 loop stands wound at its rail "
+      "and both jump (2500 W at the hold's end)",
+      steps(_h2_old[0], 560, 700) >= 2000.0
+      and steps(_cd_old[0], 1780, 1840) >= 1000.0)
+
+# ============================================================================ #
+print("\n4. what still warns, and what a safety limit does")
+_rail = run(1, "drain", 6500.0, 20000, dur=600.0, maint=False)
+print(f"    N=1 no maintenance, house 6500 over a 5000 W rating: "
+      f"{warned(_rail[1])}")
+check("⭐ the loop in charge at its rail (house over the rating) still warns, "
+      "as SAFETY-40 decided", warned(_rail[1])[0] >= 1)
+
+
+def at_cutout(u, t):
+    return 9.0 if u == "a" else 60.0
+
+
+_cut = run(2, "idle", 6000.0, 20000, dur=900.0, soc=at_cutout, maint=False)
+_cut_old = no_gate(lambda: run(2, "idle", 6000.0, 20000, dur=900.0,
+                               soc=at_cutout, maint=False))
+print(f"    N=2, A at its cut-out, house 6000: {warned(_cut[1])}, without "
+      f"the fix {warned(_cut_old[1])}")
+check("⭐ N=2, A at its cut-out level (a safety limit sets it to 0 W) and B "
+      "at its rating: no warning, each battery gives what it is told",
+      warned(_cut[1]) == (0, 0, 0) and cmd(_cut[0][-1]) == {"a": 0.0,
+                                                          "b": 2500.0})
+check("non-vacuous: without the fix it warns",
+      warned(_cut_old[1])[0] >= 1)
+
+# ============================================================================ #
+print("\n5. the status row counts episodes")
+_wd = clamp.ClampWatchdog()
+_t = datetime(2026, 9, 20, 11, 0, tzinfo=timezone.utc)
+for ep in range(3):
+    for i in range(10):
+        _wd.note(True, "x", _t, bug=False)
+        _t += timedelta(seconds=5)
+    for i in range(clamp.CLEAR_CYCLES):
+        _wd.note(False, "", _t)
+        _t += timedelta(seconds=5)
+_wd.note(True, "y", _t, bug=True)
+check("three bound episodes of ten cycles and one over-rating: 3 episodes, "
+      "30 cycles", (_wd.bound_episodes, _wd.bound, _wd.episodes) == (3, 30, 4))
+_rows = [x for x in _c1.checks() if x.get("id") == "not_keeping_up"]
+check("⭐ the page row reads the episodes, not the cycles "
+      f"({_c1.clamp_wd.bound_episodes} vs {_c1.clamp_wd.bound})",
+      _rows and _c1.clamp_wd.bound > _c1.clamp_wd.bound_episodes >= 1
+      and _rows[0]["text"].startswith(messages.T_LOOP_BOUND + ": "
+                                      + messages.times(
+                                          _c1.clamp_wd.bound_episodes)))
+
+# ============================================================================ #
+print("\n6. the rules at their boundaries")
+DS = [((2000, 1499, 500), True), ((2000, 1500, 500), False),
+      ((2000, 2600, 500), False), ((2000, -4, 500), True),
+      ((0, -900, 500), False), ((0, 900, 500), False),
+      ((-2000, -1499, 500), False), ((-2000, 600, 500), False)]
+check("delivery_short: a discharge more than the margin short; more than "
+      "asked, 0 W asked, or a charge (a full pack tapers) is never short",
+      all(clamp.delivery_short(*a) is want for a, want in DS))
+check("the note names each battery, asked before given",
+      clamp.shortfall_note([("inverter-a", 2000.0, -4.0)])
+      == "OUTPUT_CLAMP: inverter-a gives -4 W of the +2000 W asked"
+      and clamp.shortfall_note([(None, -2000.0, 0.0)])
+      == "OUTPUT_CLAMP: the battery gives +0 W of the -2000 W asked")
+
+# ============================================================================ #
+print("\n7. review: the peak guard, a battery that lags, a charge that tapers")
+import math                                                     # noqa: E402
+
+
+def under_guard(n, cut):
+    """A HOLD the peak guard raises (house 6500, limit 3500), 20 min."""
+    return run(n, "hold", 6500.0, 3500, dur=1200.0, cut=cut)
+
+
+_g1 = under_guard(1, lambda u, t: t >= 600)
+_g2 = under_guard(2, lambda u, t: u == "a" and t >= 600)
+print(f"    under the guard, the battery gives nothing: N=1 {warned(_g1[1])}, "
+      f"N=2 {warned(_g2[1])}")
+check("⭐ the peak guard sets the battery and it gives nothing: it warns at "
+      "N=1, and at N=2 (A, raised for the peak, gives nothing; B gives all "
+      "it is told)",
+      warned(_g1[1])[0] >= 1 and warned(_g2[1])[0] >= 1
+      and all("peak" in r[6] for rows, _c in (_g1, _g2) for r in rows
+              if 600 <= r[0] <= 620))
+check("...and it gives what it is told until then (no warning before 600 s)",
+      all(e.split(" ", 1)[0] >= "11:10:00" for c in (_g1[1], _g2[1])
+          for e in c.events if "OUTPUT_CLAMP" in e))
+
+
+def lagging(fn, lag=10.0):
+    """Run `fn` on plantsim's battery (800 W/s ramp, `lag` s first-order lag)
+    at the live 2 s meter tick."""
+    real_p, real_t = rig._Hass.power, rig.TICK
+
+    def power(self, u):
+        st = self.__dict__.setdefault("_plant", {})
+        a, tgt, tl = st.get(u, (0.0, 0.0, self.t))
+        for _ in range(int(round((self.t - tl) / 0.1))):
+            d = self.cmd[u] - tgt
+            tgt += math.copysign(min(abs(d), 80.0), d)
+            a += (tgt - a) * (1 - math.exp(-0.1 / lag))
+        st[u] = (a, tgt, self.t)
+        if self.cut(u, self.t) and self.cmd[u] >= -4.0:
+            return -4.0
+        return float(round(a))
+    rig._Hass.power, rig.TICK = power, 2.0
+    try:
+        return fn()
+    finally:
+        rig._Hass.power, rig.TICK = real_p, real_t
+
+
+def kettle(t):
+    """800 W, plus 2 kW 3 min in 10, plus 3 kW 1 min in 4."""
+    return (800.0 + (2000.0 if t % 600 < 180 else 0.0)
+            + (3000.0 if t % 240 < 60 else 0.0))
+
+
+def lag_runs():
+    return [run(n, ph, kettle, 3500, dur=1800.0)
+            for n, ph in ((1, "drain"), (2, "drain"), (2, "hold"))]
+
+
+_lag = lagging(lag_runs)
+_lag_old = patched(app_main, "SHORT_CYCLES", 1)(
+    lambda: patched(app_main, "SHORT_SPAN_S", 0.0)(
+        lambda: lagging(lag_runs)))
+_lag_dead = lagging(lambda: run(1, "drain", 1000.0, 20000, dur=900.0,
+                                cut=gone(600, 900)))
+print(f"    lagging battery, house steps under the guard: "
+      f"{[warned(c) for _r, c in _lag]}, graded on last cycle's command "
+      f"{[warned(c) for _r, c in _lag_old]}; gives nothing "
+      f"{warned(_lag_dead[1])}")
+check("⭐ a battery that lags (10 s) behind maintenance and peak-guard steps "
+      "at a 2 s meter does not warn (N=1 drain, N=2 drain and HOLD, 30 min)",
+      all(warned(c) == (0, 0, 0) for _r, c in _lag))
+check("non-vacuous: graded on last cycle's command alone, it warns",
+      sum(warned(c)[0] for _r, c in _lag_old) >= 3)
+check("...and a lagging battery that gives nothing still warns",
+      warned(_lag_dead[1])[0] >= 1)
+
+
+def taper(fn):
+    """Battery A takes the full charge until 600 s, then its acceptance falls
+    to 150 W over 30 min (constant-voltage taper)."""
+    real_p = rig._Hass.power
+
+    def power(self, u):
+        c = self.cmd[u]
+        if c < 0 and u == "a":
+            c = max(c, -max(150.0, 2500.0 - max(0.0, self.t - 600) / 1800
+                            * 2350.0))
+        return float(round(c))
+    rig._Hass.power = power
+    try:
+        return fn()
+    finally:
+        rig._Hass.power = real_p
+
+
+def charge_runs():
+    s84.OPT = dict(OPT0, peak_cap_w=20000)
+    try:
+        return [s84.run(n, load=lambda t: 800.0, cheap=True,
+                        store=s79.store_charging(n), soc=lambda u, t: 60.0,
+                        dur=2400.0) for n in (1, 2)]
+    finally:
+        s84.OPT = OPT0
+
+
+def both_ways(asked, given, margin):
+    asked, given = float(asked), float(given)
+    return asked != 0.0 and (asked - given) * math.copysign(1.0, asked) > margin
+
+
+_tp = taper(charge_runs)
+_tp_old = patched(app_main, "delivery_short", both_ways)(
+    lambda: taper(charge_runs))
+print(f"    a charge that tapers: {[warned(c) for _r, c in _tp]}, grading "
+      f"charges too {[warned(c) for _r, c in _tp_old]}")
+check("⭐ a maintenance charge that tapers near full does not warn (N=1, N=2)",
+      all(warned(c) == (0, 0, 0) for _r, c in _tp)
+      and all("charge" in {p for r in rows for p in r[-1][3]}
+              for rows, _c in _tp))
+check("non-vacuous: grading charges too, the taper warns",
+      all(warned(c)[0] >= 3 for _r, c in _tp_old))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all SAFETY-85 checks passed")
diff --git a/goodwe_controller/test_safety86.py b/goodwe_controller/test_safety86.py
new file mode 100644
index 0000000..253d6b1
--- /dev/null
+++ b/goodwe_controller/test_safety86.py
@@ -0,0 +1,442 @@
+"""Runnable check for SAFETY-86: the peak guard outranks the maintenance HOLD.
+`python3 test_safety86.py`
+
+During the HOLD the battery rests full at 0 W (P_MAINTENANCE, above the peak
+floor), so the house imported everything and quarters went over the peak
+limit. Now the holding battery gives what keeps the quarter at the aim: at N=1
+the peak floor is refiled at P_MAINTENANCE, at N>=2 the hold's pin is raised
+to what the other batteries cannot give. Drives the REAL Controller
+(tools/safety84_identity.py's harness). DECISIONS/SAFETY-86-peak-over-hold.md.
+
+1. N=1, house over the aim: every quarter lands on the aim, the hold goes on,
+   no 'Load too high'; without the fix the quarter goes over and it fires.
+2. Under the aim nothing changes, at N=1 and N=2 (rows identical).
+3. N=2, house over the aim: the other battery gives first, the holding one
+   only the shortfall; with battery modes on and B Off too.
+4. A month peak banked above the limit: the aim is that peak - margin.
+5. A safety stop still parks everything, and the hold gives again after.
+6. The level dips below the target: the hold still ends on its clock.
+7. The rule at its boundaries, on claim lists.
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import logging
+import os
+import sys
+import types
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import safety84_identity as s84                                # noqa: E402
+from app import control as _ctl                                # noqa: E402
+from app import packmode                                       # noqa: E402
+from app.arbiter import (Claim, P_MAINTENANCE, P_PEAK, P_SAFETY,  # noqa
+                         resolve)
+from app.main import Controller                                # noqa: E402
+from app.maintenance import (CHARGE, DRAIN, HOLD, IDLE,          # noqa: E402
+                             MaintResult)
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+A, B = "inverter-a", "inverter-b"
+AIM = 3450.0            # peak_cap_w 3500 - peak_margin_w 50
+TOL = 10.0              # W over the aim a banked quarter may show (SAFETY-81)
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def store_hold(n, b_off=False):
+    """A store with battery A in its HOLD from the first cycle."""
+    s = rig._Store()
+    for k in ("phase", "phase_started"):
+        s.data[k if n == 1 else unit_key(A, k)] = (
+            "hold" if k == "phase" else rig.BASE.isoformat())
+    if b_off:
+        s.data[unit_key(B, packmode.USE_KEY)] = False
+    return s
+
+
+def full(u, t):
+    """A rests full; B is half full."""
+    return 99.0 if u == "a" else 60.0
+
+
+def run(house, n, *, hold_min=600, b_off=False, extra=None, **kw):
+    kw.setdefault("soc", full)
+    kw.setdefault("dur", 2700.0)
+    return s84.run(n, load=house if callable(house) else lambda t: house,
+                   cheap=False, store=store_hold(n, b_off),
+                   extra=dict({"maintenance_hold_min": hold_min},
+                              **(extra or {})), **kw)
+
+
+def without_fix(fn):
+    real = Controller._peak_over_hold
+    Controller._peak_over_hold = lambda self, claims, results: None
+    try:
+        return fn()
+    finally:
+        Controller._peak_over_hold = real
+
+
+def cmd(r):
+    return dict(r[2])
+
+
+def banked(c):
+    return [b.offtake_avg_w for b in c.p1.blocks]
+
+
+def on_aim(c, aim=AIM):
+    b = banked(c)
+    return len(b) >= 2 and all(aim - TOL <= v <= aim + TOL for v in b)
+
+
+def alarmed(c):
+    """Did SAFETY-81's 'Load too high' alarm fire on this run? Its quarter
+    stamp too, since ALLOCATOR rows can push its row out of the 40-row log
+    (SAFETY-85)."""
+    return c._peak_alarm_block is not None or any(
+        "PEAK_GUARD_SATURATED" in e for e in c.events)
+
+
+def refused(rows):
+    return sum(1 for r in rows if r[7] and "REFUSED" in r[7])
+
+
+def peak_prio(r):
+    return [c[1] for c in r[-1][0] if c[0] == "peak"]
+
+
+def hold_pin(r):
+    return [c[3] for c in r[-1][0] if c[0] == "maintenance" and c[2] == "set"]
+
+
+# ============================================================================ #
+print("1. N=1: a house over the aim during the HOLD")
+N1 = {h: run(h, 1) for h in (5000.0, 6500.0, 7000.0)}
+N1_OLD = {h: without_fix(lambda: run(h, 1)) for h in N1}
+for h in N1:
+    print(f"    house {h:.0f}: banked {[round(v) for v in banked(N1[h][1])]} W"
+          f" (before the fix {[round(v) for v in banked(N1_OLD[h][1])]} W), "
+          f"last {N1[h][0][-1][6]}")
+check("⭐ every quarter lands on the aim (3450 W) for a 5000, 6500 and "
+      "7000 W house, and 'Load too high' never fires",
+      all(on_aim(c) and not alarmed(c) for _r, c in N1.values()))
+check("...the battery gives, raised for the peak limit, and stays in its "
+      "HOLD: the phase is hold and the claim still says so",
+      all(c.maints[0].phase == HOLD and cmd(rows[-1])["a"] > 1000.0
+          and "limited by peak" in rows[-1][6]
+          and c.why_words.endswith("raised for the peak limit")
+          for rows, c in N1.values()))
+check("non-vacuous: without the fix the battery sits at 0 W, the quarter "
+      "banks the whole house and 'Load too high' fires",
+      all(all(cmd(r)["a"] == 0.0 for r in rows) and min(banked(c)) >= h - 1
+          and alarmed(c) for h, (rows, c) in N1_OLD.items()))
+
+
+def hob(t):
+    """A 6000 W house with a 5 s spike to 11000 W every 150 s."""
+    return 11000.0 if t % 150 < 5 else 6000.0
+
+
+_sp_rows, _sp = run(hob, 1)
+check("...and 5 s spikes that saturate the guard for a cycle do not fire it "
+      "(SAFETY-81's 10 s hold)",
+      any(r[-1][1] and r[-1][1][1] >= 5000.0 for r in _sp_rows)
+      and not alarmed(_sp))
+
+# ============================================================================ #
+print("\n2. under the aim the HOLD is as before")
+BELOW = {(n, h): (run(h, n, dur=1800.0),
+                  without_fix(lambda: run(h, n, dur=1800.0)))
+         for n, h in ((1, 1200.0), (1, 3000.0), (1, -1500.0),
+                      (2, 1500.0), (2, 3000.0), (2, 5000.0))}
+check("⭐ N=1 at a 1200 W and 3000 W house and a 1500 W surplus, N=2 at "
+      "1500, 3000 and 5000 W (B covers it): battery A is at 0 W on every "
+      "cycle and every row equals the run without the fix",
+      all(all(cmd(r)["a"] == 0.0 for r in new[0]) and new[0] == old[0]
+          for new, old in BELOW.values()))
+check("...and the peak claim stays at P_PEAK on every cycle",
+      all(p == P_PEAK for new, _o in BELOW.values() for r in new[0]
+          for p in peak_prio(r)))
+
+# ============================================================================ #
+print("\n3. N=2: the other battery gives first, the holding one the rest")
+N2 = {h: run(h, 2) for h in (6500.0, 7000.0)}
+N2_OLD = {h: without_fix(lambda: run(h, 2)) for h in N2}
+for h, (rows, c) in N2.items():
+    print(f"    house {h:.0f}: banked {[round(v) for v in banked(c)]} W "
+          f"(before the fix {[round(v) for v in banked(N2_OLD[h][1])]} W), "
+          f"last {rows[-1][2]}")
+check("⭐ house 6500 and 7000 W, B at most 2500 W: every quarter lands on "
+      "the aim, nothing is refused or split both ways, no 'Load too high'",
+      all(on_aim(c) and refused(rows) == 0 and not alarmed(c)
+          and all(cmd(r)["a"] * cmd(r)["b"] >= 0.0 for r in rows)
+          for rows, c in N2.values()))
+_gives = [r for rows, _c in N2.values() for r in rows if cmd(r)["a"] > 0.0]
+check("⭐ A gives only the shortfall: on every cycle A gives, B is at its "
+      "2500 W and A's pin is the guard's floor minus 2500 W",
+      len(_gives) > 500
+      and all(cmd(r)["b"] == 2500.0 and hold_pin(r)
+              and abs(hold_pin(r)[0] - (r[-1][1][1] - 2500.0)) < 1e-6
+              for r in _gives))
+check("...A stays in its HOLD, and its last command is the shortfall "
+      "(6500 - 3450 - 2500 = 550 W, give or take the meter's 1 W)",
+      all(c.maints[0].phase == HOLD for _r, c in N2.values())
+      and 540.0 <= cmd(N2[6500.0][0][-1])["a"] <= 560.0)
+check("non-vacuous: without the fix A sits at 0 W, the quarter goes over "
+      "the limit and 'Load too high' fires",
+      all(all(cmd(r)["a"] == 0.0 for r in rows) and max(banked(c)) > 3900.0
+          and alarmed(c) for rows, c in N2_OLD.values()))
+
+_off_rows, _off = run(6500.0, 2, b_off=True,
+                      extra={"battery_modes_enabled": True})
+print(f"    B Off, house 6500: banked {[round(v) for v in banked(_off)]} W, "
+      f"last {_off_rows[-1][2]}")
+check("⭐ battery modes on, B Off: the Off battery still gives before the "
+      "holding one (maintenance outranks a mode), the quarter lands on the "
+      "aim, nothing refused",
+      on_aim(_off) and cmd(_off_rows[-1])["b"] == 2500.0
+      and 540.0 <= cmd(_off_rows[-1])["a"] <= 560.0
+      and refused(_off_rows) == 0 and not alarmed(_off))
+
+
+
+def noisy(t):
+    """A 6500 W house that moves up to 150 W from one second to the next."""
+    return 6500.0 + ((int(t) * 7919) % 301) - 150.0
+
+
+def no_ceiling(fn):
+    """Run with the pin raised but no `hold` site ceiling (review check)."""
+    real = Controller._peak_over_hold
+
+    def pin_only(self, claims, results):
+        real(self, claims, results)
+    Controller._peak_over_hold = pin_only
+    try:
+        return fn()
+    finally:
+        Controller._peak_over_hold = real
+
+
+def rows_logged(c, word):
+    return sum(1 for e in c.events if word in e)
+
+
+def no_bound(fn):
+    """Run without SAFETY-85's loop bound (modes are off here)."""
+    real = Controller.loop_bound
+    Controller.loop_bound = lambda self, claims: None
+    try:
+        return fn()
+    finally:
+        Controller.loop_bound = real
+
+
+_nz_rows, _nz = run(noisy, 2)
+# SAFETY-85's loop bound also keeps the loop inside what the batteries can
+# give, so the flood needs both the ceiling and the bound taken out.
+_nz_old = no_bound(lambda: no_ceiling(lambda: run(noisy, 2)))[1]
+_nz_nc = no_ceiling(lambda: run(noisy, 2))[1]
+print(f"    noisy house: ALLOCATOR rows {rows_logged(_nz, 'ALLOCATOR')}, "
+      f"clamp rows {rows_logged(_nz, 'OUTPUT_CLAMP')} (without the site "
+      f"ceiling {rows_logged(_nz_old, 'ALLOCATOR')} and "
+      f"{rows_logged(_nz_old, 'OUTPUT_CLAMP')})")
+check("⭐ while A gives, the site target is the guard's floor (the `hold` "
+      "ceiling), so a noisy house does not fill the action log: no ALLOCATOR "
+      "row and at most one clamp row",
+      on_aim(_nz) and all(abs(r[1] - r[-1][1][1]) < 1e-6 for r in _nz_rows
+                          if cmd(r)["a"] > 0.0)
+      and rows_logged(_nz, "ALLOCATOR") == 0
+      and rows_logged(_nz, "OUTPUT_CLAMP") <= 1)
+check("non-vacuous: without the ceiling and SAFETY-85's bound the loop asks "
+      "5000 W and the ALLOCATOR and clamp rows fill the 40-row log",
+      rows_logged(_nz_old, "ALLOCATOR") >= 10 and len(_nz_old.events) == 40)
+check("...and either one alone keeps it clean (without the ceiling: "
+      f"{rows_logged(_nz_nc, 'ALLOCATOR')} ALLOCATOR rows)",
+      on_aim(_nz_nc) and rows_logged(_nz_nc, "ALLOCATOR") == 0
+      and rows_logged(_nz_nc, "OUTPUT_CLAMP") <= 1)
+
+# ============================================================================ #
+print("\n4. a month peak banked above the limit")
+BANK = {n: (run(6500.0, n, month_peak=4000.0),
+            without_fix(lambda: run(6500.0, n, month_peak=4000.0)))
+        for n in (1, 2)}
+for n, (new, old) in BANK.items():
+    print(f"    N={n} house 6500, month peak 4000: banked "
+          f"{[round(v) for v in banked(new[1])]} W (before the fix "
+          f"{[round(v) for v in banked(old[1])]} W)")
+check("⭐ under a month peak of 4000 W the aim is 3950 W (peak - margin), "
+      "at N=1 and N=2, and no 'Load too high'",
+      all(on_aim(new[1], 3950.0) and not alarmed(new[1])
+          for new, _old in BANK.values()))
+check("non-vacuous: before the fix N=1 banks the whole house and N=2 banks "
+      "4000 W, over that aim",
+      min(banked(BANK[1][1][1])) >= 6499.0
+      and min(banked(BANK[2][1][1])) >= 3999.0)
+
+# ============================================================================ #
+print("\n5. a safety stop still wins")
+
+
+def blind_at(t0, t1):
+    """A's power reading is missing from `t0` to `t1`: a site safety SET."""
+    def before(c, t):
+        s84.feed(False)(c, t)
+        if not getattr(c.hass, "_blind", False):
+            real = c.hass.number
+
+            async def number(e, invert=False):
+                if e == "sensor.batt_a" and t0 <= c.hass.t < t1:
+                    return None
+                return await real(e, invert)
+            c.hass.number, c.hass._blind = number, True
+    return before
+
+
+STOP = {n: run(6500.0, n, dur=900.0, before=blind_at(300.0, 600.0))
+        for n in (1, 2)}
+for n, (rows, _c) in STOP.items():
+    print(f"    N={n} reading lost 300-600 s: at {rows[100][0]:.0f} s "
+          f"{rows[100][2]}, {rows[100][6]}; after {rows[-1][2]}")
+check("⭐ with a reading gone the safety SET parks every battery at 0 W, at "
+      "N=1 and N=2, with nothing refused",
+      all(all(v == 0.0 for r in rows if 330.0 <= r[0] < 600.0
+              for v in cmd(r).values())
+          and any(r[6].startswith("safety -> 0 W") for r in rows)
+          and refused(rows) == 0 for rows, _c in STOP.values()))
+check("...the hold gave before the stop and gives again after it",
+      all(cmd(rows[50])["a"] > 0.0 and cmd(rows[-1])["a"] > 0.0
+          for rows, _c in STOP.values()))
+
+# ============================================================================ #
+print("\n6. the level dips below the hold's target")
+
+
+def draining(u, t):
+    """A's level falls 1 % a minute from 99 % (set, not integrated); B 60 %."""
+    return max(20.0, 99.0 - t / 60.0) if u == "a" else 60.0
+
+
+DIP = {n: run(6500.0, n, hold_min=30, dur=2400.0, soc=draining)
+       for n in (1, 2)}
+for n, (rows, c) in DIP.items():
+    print(f"    N={n}: phases {sorted({tuple(x[-1][3]) for x in rows})}, "
+          f"last event {[e for e in c.events if 'maintenance' in e][:1]}")
+check("⭐ the level falls from 99 % to 70 % while the hold gives, and "
+      "the hold still ends on its 30 min clock: HOLD -> IDLE, cycle "
+      "COMPLETE, never back to CHARGE, at N=1 and N=2",
+      all(c.maints[0].phase == IDLE
+          and any("cycle COMPLETE" in e for e in c.events)
+          and {x[-1][3][0] for x in rows} == {HOLD, IDLE}
+          and all(x[-1][3][0] == HOLD for x in rows if x[0] < 1795.0)
+          for rows, c in DIP.values()))
+check("...the hold gave on the way (the level really dipped)",
+      all(any(cmd(r)["a"] > 0.0 for r in rows if r[0] < 1795.0)
+          for rows, _c in DIP.values()))
+
+# ============================================================================ #
+print("\n7. the rule at its boundaries")
+_c = run(1500.0, 2, dur=10.0)[1]
+_c1 = run(1500.0, 1, dur=10.0)[1]
+HOLDING = [MaintResult(HOLD, True, 0.0, False, []),
+           MaintResult(IDLE, False, None, False, [])]
+
+
+def pin_after(floor, *extra, live=(A, B), results=HOLDING, c=_c):
+    fake = types.SimpleNamespace(inverters=c.inverters,
+                                 actuator_of=c.actuator_of,
+                                 live_units=lambda: tuple(live),
+                                 _peak_reserve=frozenset)
+    cl = [Claim.limit("supervised", P_SAFETY, -2500.0, 2500.0, actuator=A),
+          Claim.limit("supervised", P_SAFETY, -2500.0, 2500.0, actuator=B),
+          Claim.set("maintenance", P_MAINTENANCE, 0.0, HOLD, actuator=A),
+          Claim.limit("peak", P_PEAK, lo=floor, reason="quarter peak"),
+          *extra]
+    ceiling = Controller._peak_over_hold(fake, cl, results)
+    pin_after.ceiling = ceiling
+    return next((x.value for x in cl
+                 if x.source == "maintenance" and x.kind == "set"), None), cl
+
+
+check("⭐ at N=2 a floor under or at B's 2500 W leaves A at 0 W (never "
+      "charging); 0.5 W above it raises A's pin to 0.5 W",
+      pin_after(1000.0)[0] == 0.0 and pin_after(2500.0)[0] == 0.0
+      and pin_after(2500.5)[0] == 0.5)
+check("⭐ B not live, contradicting itself, or refusing to give: A gives the "
+      "whole floor",
+      pin_after(2000.0, live=(A,))[0] == 2000.0
+      and pin_after(2000.0, Claim.limit("pack", P_SAFETY, 10.0, -10.0,
+                                        actuator=B))[0] == 2000.0
+      and pin_after(2000.0, Claim.limit("refused", P_SAFETY, hi=0.0,
+                                        actuator=B))[0] == 2000.0)
+_probe = _ctl.PROBE_W
+check("⭐ B probing: giving counts its probe (A gives the rest), charging "
+      "leaves A at 0 W so the site is never split both ways",
+      pin_after(2000.0, Claim.set("refused", P_SAFETY, _probe, "probe",
+                                  actuator=B))[0] == 2000.0 - _probe
+      and pin_after(2000.0, Claim.set("refused", P_SAFETY, -_probe, "probe",
+                                      actuator=B))[0] == 0.0)
+_p, _cl = pin_after(4000.0, Claim.set("safety", P_SAFETY, 0.0,
+                                      "inputs missing"))
+check("⭐ a site safety SET: A stays at 0 W and the site resolves to 0 W; "
+      "a unit safety SET on B does not stop A giving",
+      _p == 0.0 and resolve(_cl, units=(A, B), live={A, B}).target_w == 0.0
+      and pin_after(3000.0, Claim.set("failsafe", P_SAFETY, 0.0,
+                                      actuator=B))[0] == 3000.0)
+_p, _cl = pin_after(2600.0)
+_hi = pin_after.ceiling
+_cl += [Claim.limit("hold", P_MAINTENANCE, hi=_hi, actuator="site"),
+        Claim.set("loop", 10, 5000.0, "the loop asks for the whole house")]
+pin_after(2500.0)
+check("⭐ at N=2 the `hold` site ceiling is the floor itself, only when A "
+      "gives, and a 5000 W loop ask resolves to that floor",
+      _hi == 2600.0 and pin_after.ceiling is None
+      and resolve(_cl, units=(A, B), live={A, B}).target_w == 2600.0)
+check("only a HOLD: a DRAIN pin or an idle pack is not raised",
+      pin_after(4000.0, results=[MaintResult(DRAIN, True, 0.0, False, []),
+                                 HOLDING[1]])[0] == 0.0
+      and pin_after(4000.0, results=[HOLDING[1], HOLDING[1]])[0] == 0.0)
+
+
+def refile(lo, results=(HOLDING[0],)):
+    fake = types.SimpleNamespace(inverters=_c1.inverters,
+                                 actuator_of=_c1.actuator_of)
+    cl = [Claim.set("maintenance", P_MAINTENANCE, 0.0, HOLD),
+          Claim.limit("peak", P_PEAK, lo=lo, reason="quarter peak")]
+    Controller._peak_over_hold(fake, cl, list(results))
+    return cl
+
+
+check("⭐ at N=1 a floor of 0 W stays at P_PEAK, 0.5 W is refiled at "
+      "P_MAINTENANCE, and a blind claim (a ceiling only) is not refiled",
+      refile(0.0)[1].priority == P_PEAK
+      and refile(0.5)[1].priority == P_MAINTENANCE
+      and refile(float("-inf"))[1].priority == P_PEAK)
+_stop = refile(3000.0) + [Claim.set("safety", P_SAFETY, 0.0,
+                                    "inputs missing")]
+check("⭐ at N=1 a refiled floor stays under a safety SET: 0 W",
+      resolve(_stop).target_w == 0.0)
+check("at N=1 outside a HOLD (idle, or a CHARGE) the claim is not touched "
+      "by this rule",
+      refile(3000.0, (MaintResult(IDLE, False, None, False, []),))[1]
+      .priority == P_PEAK
+      and refile(3000.0, (MaintResult(CHARGE, False, None, True, []),))[1]
+      .priority == P_PEAK)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all SAFETY-86 checks passed")
diff --git a/goodwe_controller/test_safety87.py b/goodwe_controller/test_safety87.py
new file mode 100644
index 0000000..b354775
--- /dev/null
+++ b/goodwe_controller/test_safety87.py
@@ -0,0 +1,709 @@
+"""Runnable check for SAFETY-87: the peak guard uses every battery that can
+still give. `python3 test_safety87.py`
+
+At N>=2 the guard graded the EMPTIEST battery (SAFETY-32), so one battery under
+the peak reserve stopped the guard for all of them: it asked for nothing and
+raised the reserve alarm while the other battery was full. Now a battery at or
+under its own reserve is HELD (it gives nothing for the peak, weight 0) and
+the guard's need is placed on the others; the reserve alarm fires only when
+they cannot hold the limit. Drives the REAL Controller (tools/
+safety84_identity.py's harness). DECISIONS/SAFETY-87-guard-uses-able-batteries.md.
+
+1. Maintenance charge at N=2 (A under the reserve, B able), house over the
+   aim: no reserve alarm, the quarter on the aim, A gives nothing for the
+   peak while B can carry it. When B cannot, the alarm fires and names A.
+2. HOLD at N=2 (A full holding, B under the reserve): A gives, B gives
+   nothing, the quarter lands on the aim; at a banked month peak too.
+3. Both under the reserve, or the other one refusing: the alarm still fires
+   and names the right battery.
+4. The alarm at the quarter's edge: a one-cycle miss does not fire it.
+5. place_on_able() at its boundaries, and the claim it files.
+6. The allocator: a held battery gives last, after an Off one.
+7. A held battery draining for maintenance counts for its drain.
+8. The page: a peak alarm does not say "Not ready" or "0 W until the alarm
+   clears" while control goes on.
+9. N=1 is byte-identical to release/1.0 b8ddfd7 (tools/safety87_identity.py).
+
+Mutations (MUTATION.md, purged copies) are listed in the pull request.
+"""
+
+import asyncio
+import dataclasses
+import json
+import logging
+import os
+import sys
+import types
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)
+
+import opt11_identity as rig                                   # noqa: E402
+import safety84_identity as s84                                # noqa: E402
+import safety87_identity as s87                                # noqa: E402
+from app import messages, packmode, peakguard                  # noqa: E402
+from app.arbiter import (Claim, P_MAINTENANCE, P_MODE, P_PEAK,  # noqa: E402
+                         P_SAFETY, UnitBounds, resolve)
+from app.main import Controller                                # noqa: E402
+from app.maintenance import DRAIN, HOLD, IDLE, MaintResult     # noqa: E402
+from app.store import unit_key                                 # noqa: E402
+
+fails = []
+A, B = "inverter-a", "inverter-b"
+AIM = 3450.0            # peak_cap_w 3500 - peak_margin_w 50
+TOL = 10.0              # W over the aim a banked quarter may show (SAFETY-81)
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def store(phase, *, b_off=False):
+    """Battery A in `phase` from the first cycle (B idle, cycle done)."""
+    s = rig._Store()
+    s.data[unit_key(A, "phase")] = phase
+    s.data[unit_key(A, "phase_started")] = rig.BASE.isoformat()
+    s.data[unit_key(B, "last_completed")] = rig.BASE.isoformat()
+    if phase == IDLE:
+        s.data[unit_key(A, "last_completed")] = rig.BASE.isoformat()
+    if b_off:
+        s.data[unit_key(B, packmode.USE_KEY)] = False
+    return s
+
+
+def run(house, phase, socs, *, cheap=False, n=2, **kw):
+    """Rows, controller, the notifications raised and one record per cycle:
+    (floor_limited, held, floor_w, reserve set, alarm latched)."""
+    notes, seen = [], []
+    real_check = Controller.check_peak_floor_limited
+
+    async def spy(self):
+        await real_check(self)
+        g = self.peak_guard
+        seen.append(None if g is None else (
+            g.floor_limited, g.held, g.floor_w, self._peak_reserve(),
+            self._peak_floor_limited))
+
+    def before(c, t):
+        if not getattr(c.hass, "_s87", False):
+            real = c.hass.call
+
+            async def call(*a):
+                if a[:2] == ("persistent_notification", "create"):
+                    notes.append(a[2])
+                return await real(*a)
+            c.hass.call, c.hass._s87 = call, True
+        return s84.feed(cheap)(c, t)
+
+    kw.setdefault("dur", 2700.0)
+    extra = dict({"maintenance_hold_min": 600}, **kw.pop("extra", {}))
+    Controller.check_peak_floor_limited = spy
+    try:
+        rows, c = s84.run(
+            n, load=house if callable(house) else lambda t: house,
+            cheap=cheap, store=kw.pop("store", None) or store(phase),
+            soc=lambda u, t: socs[u], before=before, extra=extra, **kw)
+    finally:
+        Controller.check_peak_floor_limited = real_check
+    return rows, c, notes, seen
+
+
+def without_fix(fn):
+    """The shipped b8ddfd7 behaviour: no battery is ever held back."""
+    real = Controller._peak_on_able
+    Controller._peak_on_able = lambda self, decision, results: decision
+    try:
+        return fn()
+    finally:
+        Controller._peak_on_able = real
+
+
+def cmd(r):
+    return dict(r[2])
+
+
+def banked(c):
+    return [b.offtake_avg_w for b in c.p1.blocks]
+
+
+def on_aim(c, aim=AIM):
+    b = banked(c)
+    return len(b) >= 2 and all(aim - TOL <= v <= aim + TOL for v in b)
+
+
+def reserve_notes(notes):
+    return [x for x in notes
+            if x["notification_id"] == messages.ID_PEAK_RESERVE]
+
+
+def limited_events(c):
+    return sum(1 for e in c.events if "PEAK_GUARD_FLOOR_LIMITED" in e)
+
+
+def show(tag, rows, c, notes, seen):
+    a = [cmd(r)["a"] for r in rows]
+    b = [cmd(r)["b"] for r in rows]
+    print(f"    {tag}: banked {[round(v, 1) for v in banked(c)]} W, mean A "
+          f"{sum(a) / len(a):.0f} W, B {sum(b) / len(b):.0f} W, reserve "
+          f"alarms {len(reserve_notes(notes))}, held "
+          f"{sorted({h for s in seen if s for h in s[1]})}")
+
+
+# ============================================================================ #
+print("1. maintenance charge at N=2: A under the reserve, B able")
+LOW_A = {"a": 11.0, "b": 60.0}
+CH = run(4500.0, "charge", LOW_A, cheap=True)
+CH_OLD = without_fix(lambda: run(4500.0, "charge", LOW_A, cheap=True))
+show("house 4500", *CH)
+show("house 4500, before the fix", *CH_OLD)
+check("⭐ house 4500 W, B can carry the guard alone: no reserve alarm (no "
+      "notification, no PEAK_GUARD_FLOOR_LIMITED line) and every quarter on "
+      "the aim",
+      not reserve_notes(CH[2]) and limited_events(CH[1]) == 0
+      and on_aim(CH[1]))
+check("...A is held (it gives nothing for the peak) on every cycle the guard "
+      "asks for power, and the guard asks for a positive floor",
+      any(s and s[2] and s[2] > 0.0 for s in CH[3])
+      and all(s[1] == (A,) and s[3] == {A} for s in CH[3]
+              if s and s[2] and s[2] > 0.0))
+check("non-vacuous: before the fix the same run raised the reserve alarm "
+      "(the SAFETY-84 rig test's check 2/3 false alarm)",
+      len(reserve_notes(CH_OLD[2])) >= 1 and limited_events(CH_OLD[1]) >= 1)
+_b_carry = [r for r, s in zip(CH[0], CH[3])
+            if s and s[3] == {A} and r[1] <= 2500.0 and r[1] > 0.0]
+check("...and while B can carry the site target (at most its 2500 W) A is "
+      "not asked to give at all (weight 0 behind B)",
+      len(_b_carry) >= 3 and all(cmd(r)["a"] <= 0.0 for r in _b_carry))
+
+CH65 = run(6500.0, "charge", LOW_A, cheap=True)
+show("house 6500", *CH65)
+_n65 = reserve_notes(CH65[2])
+check("⭐ house 6500 W, B (2500 W) cannot hold the 3450 W aim alone: the "
+      "reserve alarm fires and names A, the battery under its reserve, and "
+      "says the others cannot hold the limit alone",
+      len(_n65) >= 1
+      and all("inverter-a is at its peak reserve" in x["message"]
+              and "inverter-b" not in x["message"]
+              and "cannot keep this 15-minute period under your 3 500 W peak "
+                  "limit alone" in x["message"] for x in _n65))
+check("...and while it is limited the guard still asks B for everything B "
+      "has (floor 2500 W), so B is never left idle",
+      any(s and s[0] and s[2] == 2500.0 for s in CH65[3])
+      and all(s[2] == 2500.0 for s in CH65[3] if s and s[0]))
+
+# ============================================================================ #
+print("\n2. HOLD at N=2: A full and holding, B under the reserve")
+LOW_B = {"a": 99.0, "b": 15.0}
+HD = run(5500.0, HOLD, LOW_B)
+HD_OLD = without_fix(lambda: run(5500.0, HOLD, LOW_B))
+show("house 5500", *HD)
+show("house 5500, before the fix", *HD_OLD)
+check("⭐ house 5500 W: A gives, B gives nothing, every quarter lands on the "
+      "aim, no reserve alarm, and A stays in its HOLD",
+      on_aim(HD[1]) and not reserve_notes(HD[2])
+      and limited_events(HD[1]) == 0
+      and all(cmd(r)["b"] == 0.0 for r in HD[0])
+      and max(cmd(r)["a"] for r in HD[0]) > 2000.0
+      and HD[1].maints[0].phase == HOLD)
+check("non-vacuous: before the fix A sat at 0 W, B (at 15 %) gave through "
+      "the loop and the reserve alarm fired (SAFETY-86 rig case 7a)",
+      all(cmd(r)["a"] == 0.0 for r in HD_OLD[0])
+      and max(cmd(r)["b"] for r in HD_OLD[0]) > 2000.0
+      and len(reserve_notes(HD_OLD[2])) >= 1)
+
+HD65 = run(6500.0, HOLD, LOW_B)
+HD65_OLD = without_fix(lambda: run(6500.0, HOLD, LOW_B))
+show("house 6500", *HD65)
+show("house 6500, before the fix", *HD65_OLD)
+_n = reserve_notes(HD65[2])
+check("⭐ house 6500 W, A alone (2500 W) cannot hold the aim: A gives all it "
+      "has, B still gives nothing, and the reserve alarm fires ONCE naming B",
+      all(cmd(r)["b"] == 0.0 for r in HD65[0])
+      and max(cmd(r)["a"] for r in HD65[0]) == 2500.0
+      and len(_n) == 1 and "inverter-b is at its peak reserve" in
+      _n[0]["message"] and "inverter-a" not in _n[0]["message"])
+check("...and the quarter is no worse than before the fix (4051 W in the "
+      "SAFETY-86 review), with B kept at its reserve",
+      max(banked(HD65[1])) <= max(banked(HD65_OLD[1])) + 1.0)
+
+BK = run(6000.0, HOLD, LOW_B, month_peak=4000.0)
+show("house 6000, month peak 4000", *BK)
+check("⭐ under a banked month peak of 4000 W the aim is 3950 W (peak - "
+      "margin): A gives, B nothing, every quarter on 3950 W, no alarm",
+      on_aim(BK[1], 3950.0) and not reserve_notes(BK[2])
+      and all(cmd(r)["b"] == 0.0 for r in BK[0]))
+
+# ============================================================================ #
+print("\n3. a real loss of peak limiting still alarms")
+BOTH = run(5500.0, IDLE, {"a": 15.0, "b": 12.0})
+show("both under", *BOTH)
+_nb = reserve_notes(BOTH[2])
+check("⭐ both batteries under the reserve: the reserve alarm fires and "
+      "names both, the guard asks for nothing (claim lo 0 W, 'SoC floor')",
+      len(_nb) >= 1
+      and all("inverter-a and inverter-b" in x["message"] for x in _nb)
+      and all(not s[2] for s in BOTH[3] if s and s[0])
+      and any(c[0] == "peak" and c[4] == 0.0 and c[6] == "SoC floor"
+              for r in BOTH[0] for c in r[-1][0]))
+
+
+_ctl2 = BOTH[1]
+for _inv, _s, _r in zip(_ctl2.inverters, (15.0, 60.0), (0, 1)):
+    _inv.soc, _inv.refused = _s, _r     # SAFETY-73: B refuses to give
+_ref = _ctl2._peak_on_able(_lim_all := peakguard.PeakDecision(
+    engaged=True, floor_w=0.0, ceiling_w=3500.0,
+    ceiling_from=peakguard.CEILING_CAP, projected_w=4000.0, excess_w=550.0,
+    wanted_w=2000.0, target_w=3450.0, floor_limited=True, soc=15.0,
+    soc_floor=20.0, soc_floor_reason=peakguard.FLOOR_AT_SOC_FLOOR,
+    reason="PEAK_GUARD_FLOOR_LIMITED: x"),
+    [MaintResult(IDLE, False, None, False, [])] * 2)
+check("⭐ A under the reserve and B refusing to give (SAFETY-73): nothing can "
+      "give for the peak, so it stays limited at 0 W (the alarm fires) and "
+      "only A is named (test_peakguard.py part 12h drives the notification)",
+      _ref.floor_limited and _ref.floor_w == 0.0 and _ref.held == (A,)
+      and _ref.able_w is None and _ctl2._peak_reserve() == frozenset())
+_ctl2.inverters[1].refused = 0
+_ctl2.live_units = lambda: (A,)         # B dropped from the split
+_drop = _ctl2._peak_on_able(_lim_all, [MaintResult(IDLE, False, None, False,
+                                                   [])] * 2)
+del _ctl2.live_units
+check("...and the same with B dropped (not live): nothing can give, the "
+      "alarm state stands at 0 W, only A named",
+      _drop.floor_limited and _drop.floor_w == 0.0 and _drop.held == (A,)
+      and _drop.able_w is None)
+
+
+async def _notify(ctl, socs, cutouts, refused):
+    """The shipped check_peak_floor_limited() on `ctl`, its notification."""
+    sent = []
+
+    async def call(*a):
+        sent.append(a)
+        return True
+    for inv, so, cut, ref in zip(ctl.inverters, socs, cutouts, refused):
+        inv.soc, inv.bms_soc_floor, inv.refused = so, cut, ref
+    real, ctl.hass.call = ctl.hass.call, call
+    ctl.peak_guard = ctl._peak_on_able(dataclasses.replace(
+        _lim_all, soc=min(socs), soc_floor=peakguard.binding_soc_floor(
+            ctl.packs, 20.0)), [MaintResult(IDLE, False, None, False, [])] * 2)
+    ctl._peak_floor_limited = False
+    try:
+        await ctl.check_peak_floor_limited()
+    finally:
+        ctl.hass.call = real
+        for inv in ctl.inverters:
+            inv.bms_soc_floor, inv.refused = 10, 0
+    return [a[2]["message"] for a in sent
+            if a[2].get("notification_id") == messages.ID_PEAK_RESERVE]
+
+
+# Cut-outs A 10 % / B 35 % (simulated; rule 8 refuses it, sim/inject.py does
+# not run rule 8), A at 25 % refusing, B at 30 %. Only B is at its own floor;
+# A is above its own but under the site's highest (35 %).
+_msg = asyncio.run(_notify(_ctl2, (25.0, 30.0), (10, 35), (1, 0)))
+print(f"    differing cut-outs: {_msg}")
+check("⭐ the alarm names the battery at ITS OWN floor (B, 30 % <= 35 %), not "
+      "every battery under the site's highest floor (A at 25 % is above its "
+      "own 20 %)",
+      len(_msg) == 1 and "inverter-b is at its peak reserve" in _msg[0]
+      and "inverter-a" not in _msg[0])
+
+
+# ============================================================================ #
+print("\n4. the reserve alarm at the quarter's edge")
+def spiky(t):
+    """A 5000 W house (B alone can hold the aim) with a 5 s spike to
+    11000 W every 150 s, which B alone cannot."""
+    return 11000.0 if t % 150 < 5 else 5000.0
+
+
+LOW_A_IDLE = {"a": 15.0, "b": 60.0}
+SP = run(spiky, IDLE, LOW_A_IDLE)
+_flips = sum(1 for s in SP[3] if s and s[0])
+show("spiky house", *SP)
+print(f"    {_flips} cycles floor-limited (B alone short during a spike)")
+check("⭐ a 5 s spike that B alone cannot cover makes the guard limited for a "
+      "cycle, and that does not fire the alarm: the miss must hold for "
+      "ALARM_HOLD_S, as for 'Load too high'. No quarter goes over the aim",
+      _flips >= 5 and not reserve_notes(SP[2])
+      and not any(s[4] for s in SP[3] if s)
+      and len(banked(SP[1])) >= 2 and max(banked(SP[1])) <= AIM)
+
+
+def ungated(fn):
+    real = Controller._reserve_short
+    Controller._reserve_short = lambda self, g: True
+    try:
+        return fn()
+    finally:
+        Controller._reserve_short = real
+
+
+_ug = ungated(lambda: run(spiky, IDLE, LOW_A_IDLE))
+check("non-vacuous: without the hold the same run raises the alarm",
+      len(reserve_notes(_ug[2])) >= 1)
+
+# ============================================================================ #
+print("\n5. place_on_able() at its boundaries")
+_lim = peakguard.PeakDecision(
+    engaged=True, floor_w=0.0, ceiling_w=3500.0,
+    ceiling_from=peakguard.CEILING_CAP, projected_w=4000.0, excess_w=550.0,
+    wanted_w=2000.0, target_w=3450.0, floor_limited=True, soc=15.0,
+    soc_floor=20.0, soc_floor_reason=peakguard.FLOOR_AT_SOC_FLOOR,
+    reason="PEAK_GUARD_FLOOR_LIMITED: x")
+
+
+def place(d=_lim, held=("b",), able_w=2000.0, soc=60.0, floor=20.0):
+    return peakguard.place_on_able(d, held, able_w=able_w, soc=soc,
+                                   soc_floor=floor)
+
+
+_eq, _short = place(), place(able_w=1999.0)
+check("⭐ the others can give exactly the need (2000 W): not limited, floor "
+      "2000 W, the claim reads 'quarter peak' (the page says 'the peak "
+      "limit')",
+      not _eq.floor_limited and _eq.engaged and _eq.floor_w == 2000.0
+      and _eq.held == ("b",) and _eq.able_w == 2000.0
+      and peakguard.claim(_eq).lo == 2000.0
+      and peakguard.claim(_eq).reason == "quarter peak"
+      and _eq.reason.startswith("PEAK_GUARD: "))
+check("...1 W short: limited, but the claim still asks them for all they "
+      "have (1999 W), not 0 W",
+      _short.floor_limited and _short.floor_w == 1999.0
+      and peakguard.claim(_short).lo == 1999.0
+      and peakguard.claim(_short).reason == "quarter peak"
+      and _short.reason.startswith("PEAK_GUARD_FLOOR_LIMITED: "))
+check("...the others' own permission is graded: at or under their floor, or "
+      "unread, nothing is asked (0 W, 'SoC floor')",
+      all(place(soc=s).floor_w == 0.0 and place(soc=s).floor_limited
+          and peakguard.claim(place(soc=s)).reason == "SoC floor"
+          for s in (20.0, 19.0, None)))
+check("...the roster's verdict is kept as decide() echoed it (soc 15 %, "
+      "floor 20 %), and a decision that was not limited is only labelled",
+      _eq.soc == 15.0 and _eq.soc_floor == 20.0
+      and all(place(d=d) == dataclasses.replace(d, held=("b",))
+              for d in (dataclasses.replace(
+                            _lim, floor_limited=False, engaged=False,
+                            floor_w=None),
+                        dataclasses.replace(_lim, wanted_w=None))))
+check("...and at N=1 the floor-limited claim is unchanged: 0 W, 'SoC floor'",
+      peakguard.claim(_lim).lo == 0.0
+      and peakguard.claim(_lim).reason == "SoC floor")
+
+
+
+def three(socs, cuts):
+    """`_peak_on_able()` on a stub roster of three (SIMULATED packs)."""
+    names = ("x", "y", "z")
+    invs = [types.SimpleNamespace(name=n, refused=0, rating_w=lambda: 2500.0)
+            for n in names]
+    stub = types.SimpleNamespace(
+        inverters=invs, o={"peak_soc_floor": 20},
+        packs=[peakguard.Pack(n, so, c) for n, so, c in zip(names, socs, cuts)],
+        live_units=lambda: names)
+    return Controller._peak_on_able(stub, _lim, [MaintResult(
+        IDLE, False, None, False, [])] * 3)
+
+
+# x 25 % (cut-out 10 -> floor 20), y 40 % (cut-out 30), z 15 % (held). x and
+# y each clear their own floor, but 25 % is not above y's 30 %: the pair is
+# graded min SoC against max floor (SAFETY-32), so nothing is asked.
+_t3 = three((25.0, 40.0, 15.0), (10, 30, 10))
+_t3ok = three((35.0, 40.0, 15.0), (10, 30, 10))
+check("⭐ three batteries, z held: the two others are graded as a pair, the "
+      "EMPTIEST of them (25 %) against the HIGHEST of their floors (30 %), "
+      "so nothing is asked; at 35 % they are asked for the need",
+      _t3.held == ("z",) and _t3.floor_limited and _t3.floor_w == 0.0
+      and _t3ok.held == ("z",) and not _t3ok.floor_limited
+      and _t3ok.floor_w == 2000.0)
+
+# ============================================================================ #
+print("\n6. the allocator: a held battery gives last")
+
+
+def split(target, reserve, modes=(), floor=1500.0):
+    cl = [Claim.set("loop", 10, target),
+          Claim.limit("supervised", P_SAFETY, -2500.0, 2500.0, actuator=A),
+          Claim.limit("supervised", P_SAFETY, -2500.0, 2500.0, actuator=B),
+          Claim.limit("peak", P_PEAK, lo=min(target, floor))]
+    cl += [Claim.limit("mode", P_MODE, 0.0, 0.0, "off", actuator=u)
+           for u in modes]
+    r = resolve(cl, units=(A, B), live=(A, B), weights={A: 1.0, B: 3.0},
+                reserve=reserve)
+    return {u: round(v) for u, v in r.shares.items()}
+
+
+check("⭐ B held: A carries the site target first (B's weight 3.0 ignored) "
+      "and B only takes what A cannot: 1500 -> A 1500 / B 0, 4000 -> A 2500 "
+      "/ B 1500",
+      split(1500.0, {B}) == {A: 1500, B: 0}
+      and split(4000.0, {B}) == {A: 2500, B: 1500})
+check("...no one held: the weights decide, as before",
+      split(1500.0, set()) == {A: 375, B: 1125})
+check("...charging is not touched: a held battery may still charge first",
+      split(-2000.0, {B}) == split(-2000.0, set()))
+check("⭐ A Off and B under the reserve, a 3000 W floor B cannot place: the "
+      "Off battery gives first (2500 W) and B only the last 500 W - not an "
+      "equal 1500/1500 split",
+      split(3000.0, {B}, modes=(A,), floor=3000.0) == {A: 2500, B: 500})
+check("...OPEN, recorded: when B alone CAN place the floor, OPT-11 keeps the "
+      "Off battery resting and B gives it (1500 W). See the DECISIONS entry",
+      split(1500.0, {B}, modes=(A,)) == {A: 0, B: 1500})
+check("...and with B Off and nobody held, Off still gives way to the other "
+      "battery, as before (OPT-11)",
+      split(1500.0, set(), modes=(B,)) == {A: 1500, B: 0})
+
+# ============================================================================ #
+print("\n7. a held battery draining for maintenance")
+_ctl = HD[1]
+
+
+def able_w(results, socs=(15.0, 60.0)):
+    for inv, s in zip(_ctl.inverters, socs):
+        inv.soc, inv.refused = s, 0
+    d = _ctl._peak_on_able(dataclasses.replace(
+        _lim, wanted_w=6000.0), results)
+    return d.able_w, d.held, d.floor_w
+
+
+_idle = [MaintResult(IDLE, False, None, False, [])] * 2
+_drain = [MaintResult(DRAIN, True, 2000.0, False, []),
+          MaintResult(IDLE, False, None, False, [])]
+print(f"    A at 15 % idle: {able_w(_idle)}; draining 2000 W: "
+      f"{able_w(_drain)}")
+check("⭐ A under the reserve but draining 2000 W for its monthly cycle: "
+      "that drain still counts (able 4500 W = B 2500 + 2000), so B is not "
+      "asked to carry it; idle, only B's 2500 W",
+      able_w(_idle) == (2500.0, (A,), 2500.0)
+      and able_w(_drain) == (4500.0, (A,), 4500.0))
+
+# ============================================================================ #
+print("\n8. the page while a peak alarm stands and control goes on")
+_rows65, _c65 = CH65[0], CH65[1]
+_c65._peak_floor_limited = True
+_c65.peak_guard = dataclasses.replace(
+    _lim, floor_w=2500.0, held=(A,), able_w=2500.0)
+_pay = _c65.status_payload()
+_txt = json.dumps(_pay, ensure_ascii=False)
+_row = [r for r in _pay["checks"] if r.get("id") == "peak_guard"]
+print(f"    banner: {_pay['banner']}; row: {_row[0]['text'] if _row else '-'}")
+check("⭐ the banner is the alarm's title without 'Not ready', and nothing "
+      "on the page says the inverters go to 0 W or that an alarm stopped "
+      "control",
+      _pay["banner"] == messages.T_PEAK_RESERVE and _pay["level"] == "bad"
+      and "Not ready" not in _txt and "until the alarm clears" not in _txt
+      and "An alarm stopped control" not in _txt)
+check("...the row names A and says the others cannot hold the limit alone, "
+      "in three short sentences",
+      len(_row) == 1 and _row[0]["text"].startswith(
+          "inverter-a battery at its peak reserve. The others cannot hold "
+          "the 3 500 W peak limit alone."))
+_c65._peak_floor_limited = False
+_blip = [r for r in _c65.checks() if r.get("id") == "peak_guard"]
+_c65._peak_floor_limited = True
+check("...and while the alarm is not latched (a one-cycle miss) the row is "
+      "the ordinary amber guard row, not the red reserve row",
+      len(_blip) == 1 and _blip[0]["warn"] and not _blip[0].get("runs")
+      and "peak reserve" not in _blip[0]["text"])
+_c65.auto = False
+_stopped = _c65.status_payload()
+_c65.auto = True
+check("...a stopped controller still says so: the peak alarm does not take "
+      "the banner from it", _stopped["banner"] != messages.T_PEAK_RESERVE
+      and _stopped["level"] != "bad")
+
+# ============================================================================ #
+print("\n9. N=1 is byte-identical to release/1.0 b8ddfd7")
+PINNED = {   # tools/safety87_identity.py on b8ddfd7
+    "n1_under":
+        "d2395ef8d74fb23607ad864d5a4bf62c03044bbd9367e873675d7ad10e8c169f",
+    "n1_crossing":
+        "97f7321017d9d34ee17a40dfd4abf73d915f25b9faef086a483d2b5cd124b198",
+    "n1_above":
+        "45726a285aa84f40542d56482652397c3c1e212ba4fe2009f6cc52f537ccad52",
+    "n1_under_banked":
+        "a2876c7cc873bc4c974d2b4bd98e23bba2d007b84545587d2fe0b713b0a6249b",
+    "n1_charge_low":
+        "91336e3c0314985a3b00f314c79b5ffb5a740d218de3ad44f88a4db6e4235b32",
+    "n1_hold":
+        "0a1df347754c69166b20d04c15ee878bbcefb02abb824b9b452334f68f03e46d",
+}
+_now = s87.digests()
+for k in PINNED:
+    print(f"    {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'}")
+check("⭐ every N=1 digest (claims, commands, the guard's decision and the "
+      "log) equals b8ddfd7's, under, crossing and above the reserve, in a "
+      "charge and a HOLD, and under a banked peak",
+      _now == PINNED)
+
+# ============================================================================ #
+print("\n10. review: maintenance pins beside a held battery, N=3, the page")
+
+
+def _drain_store():
+    s = rig._Store()
+    s.data[unit_key(B, "phase")] = DRAIN
+    s.data[unit_key(B, "phase_started")] = rig.BASE.isoformat()
+    s.data[unit_key(A, "last_completed")] = rig.BASE.isoformat()
+    return s
+
+
+def _drain_run():
+    return run(8000.0, IDLE, {"a": 15.0, "b": 60.0}, store=_drain_store(),
+               dur=900.0)
+
+
+DR = _drain_run()
+_real_dor = Controller._drain_over_reserve
+Controller._drain_over_reserve = lambda self, claims, results: None
+try:
+    DR_OLD = _drain_run()
+finally:
+    Controller._drain_over_reserve = _real_dor
+
+
+def _a_for_peak(rows):
+    """A's command on the cycles where the site target is the peak floor
+    and B alone (2500 W) could place it."""
+    return [cmd(r)["a"] for r in rows
+            if r[-1][1] and r[-1][1][1] and r[1] <= 2500.0
+            and abs(r[1] - r[-1][1][1]) < 1.0]
+
+
+print(f"    B draining, A held: A for the peak {_a_for_peak(DR[0])[:4]}, "
+      f"without the raise {_a_for_peak(DR_OLD[0])[:4]}")
+check("⭐ B draining (2000 W pin) while A is held: B is raised to its rating "
+      "for the peak floor, so A gives nothing for it (peak > drain)",
+      DR[1].maints[1].phase == DRAIN and _a_for_peak(DR[0])
+      and all(a <= 0.0 for a in _a_for_peak(DR[0])))
+check("non-vacuous: without the raise A gave the floor's rest above B's pin",
+      any(a > 0.0 for a in _a_for_peak(DR_OLD[0])))
+
+
+def _stub(names, reserve, live=None):
+    """A Controller stand-in for the pin rules, on SIMULATED units."""
+    s = types.SimpleNamespace(
+        inverters=[types.SimpleNamespace(name=n) for n in names],
+        actuator_of=lambda src, inv=None: inv.name,
+        live_units=lambda: tuple(live or names),
+        _peak_reserve=lambda: frozenset(reserve))
+    s._held_pin = lambda cl, u: Controller._held_pin(s, cl, u)
+    return s
+
+
+def _hold(floor, names, reserve, extra=(), results=None):
+    """`_peak_over_hold()`: x HOLDs; returns (x's pin, resolved shares)."""
+    s = _stub(names, reserve)
+    cl = [Claim.limit("supervised", P_SAFETY, -2500.0, 2500.0, actuator=n)
+          for n in names]
+    cl += [Claim.set("maintenance", P_MAINTENANCE, 0.0, HOLD, actuator="x"),
+           Claim.limit("peak", P_PEAK, lo=floor, reason="quarter peak"),
+           *extra]
+    res = results or ([MaintResult(HOLD, True, 0.0, False, [])]
+                      + [MaintResult(IDLE, False, None, False, [])]
+                      * (len(names) - 1))
+    hi = Controller._peak_over_hold(s, cl, res)
+    if hi is not None:
+        cl.append(Claim.limit("hold", P_MAINTENANCE, hi=hi))
+    r = resolve(cl + [Claim.set("loop", 10, floor)], units=tuple(names),
+                live=set(names), reserve=reserve)
+    pin = next((c.value for c in cl
+                if c.source == "maintenance" and c.actuator == "x"), None)
+    return pin, {u: round(v) for u, v in r.shares.items()}
+
+
+_h3 = _hold(3000.0, ("x", "y", "z"), {"z"})
+_h3b = _hold(2000.0, ("x", "y", "z"), {"z"})
+print(f"    N=3 HOLD x, y able, z held: floor 3000 {_h3}, 2000 {_h3b}")
+check("⭐ HOLD at N=3 with one held: the able battery gives first, the "
+      "holding one the rest (3000 -> y 2500, x 500), the held one nothing",
+      _h3 == (500.0, {"x": 500, "y": 2500, "z": 0})
+      and _h3b == (0.0, {"x": 0, "y": 2000, "z": 0}))
+_hd = _hold(2000.0, ("x", "z"), {"z"},
+            (Claim.set("maintenance", P_MAINTENANCE, 1500.0, DRAIN,
+                       actuator="z"),),
+            [MaintResult(HOLD, True, 0.0, False, []),
+             MaintResult(DRAIN, True, 1500.0, False, [])])
+_hp = _hold(2000.0, ("x", "z"), {"z"},
+            (Claim.set("refused", P_SAFETY, -50.0, "probe", actuator="z"),))
+print(f"    held z draining 1500: {_hd}; held z charge probe: {_hp}")
+check("⭐ a held battery's own pin counts: draining 1500 W, the hold gives "
+      "only the 500 W rest (no over-placement); a charge probe leaves the "
+      "hold at 0 W (never split both ways, no park)",
+      _hd == (500.0, {"x": 500, "z": 1500}) and _hp[0] == 0.0)
+
+_unk = three((60.0, 60.0, 60.0), (10, None, 10))
+_unr = three((60.0, None, 60.0), (10, 10, 10))
+check("⭐ N=3: an unknown cut-out or an unread level holds that battery "
+      "only; the two others are asked for the need",
+      _unk.held == ("y",) and not _unk.floor_limited
+      and _unk.floor_w == 2000.0 and _unr.held == ("y",)
+      and not _unr.floor_limited and _unr.floor_w == 2000.0)
+
+_stop_row = {"ok": False, "warn": False, "id": "meter", "text": "Meter down."}
+_peak_rows = [r for r in _c65.checks() if r.get("id") == "peak_guard"]
+_c65.checks = lambda: _peak_rows[:1] + [_stop_row]
+_both = _c65.status_payload()
+del _c65.checks
+check("⭐ a row that stops control outranks the running peak alarm: the "
+      "banner says 'Not ready' for it and the Home page shows the hold",
+      len(_peak_rows) == 1 and _peak_rows[0].get("runs")
+      and _both["banner"].startswith(messages.NOT_READY)
+      and "Meter down" in _both["banner"]
+      and "until the alarm clears" in json.dumps(_both, ensure_ascii=False))
+
+for _inv, _s, _r in zip(_ctl2.inverters, (15.0, 60.0), (0, -1)):
+    _inv.soc, _inv.refused = _s, _r     # B refuses only to CHARGE
+_chg = _ctl2._peak_on_able(_lim_all, [MaintResult(IDLE, False, None, False,
+                                                  [])] * 2)
+_ctl2.inverters[1].refused = 0
+check("⭐ a battery that refuses only to charge can still give: it stays "
+      "able and carries the floor (2000 W of 2500 W)",
+      not _chg.floor_limited and _chg.floor_w == 2000.0
+      and _chg.able_w == 2500.0 and _chg.held == (A,))
+
+
+def _short_for(held_w, secs=30.0):
+    """`_reserve_short()` over `secs` of a steady quarter: the meter at
+    `held_w` with the able batteries already at their full 2500 W."""
+    s = types.SimpleNamespace(_reserve_batt_prev=None,
+                              _reserve_high_since=None,
+                              _peak_floor_limited=False, site_batt_w=2500.0)
+    g = dataclasses.replace(_lim, floor_w=2500.0, able_w=2500.0)
+    out = []
+    for k in range(int(secs / 5.0) + 1):
+        s._peak_proj = types.SimpleNamespace(
+            block_start=rig.BASE, elapsed_s=450.0 + 5.0 * k,
+            projected_w=held_w, held_w=held_w)
+        out.append(Controller._reserve_short(s, g))
+    return out
+
+
+_aim_miss, _limit_miss = _short_for(3480.0), _short_for(3600.0)
+check("⭐ the reserve alarm is graded on the real limit, not the aim: a "
+      "quarter ending at 3480 W (over the 3450 W aim, under 3500 W) never "
+      "alarms; one ending at 3600 W alarms once it holds ALARM_HOLD_S",
+      not any(_aim_miss) and not any(_limit_miss[:2])
+      and all(_limit_miss[2:]))
+
+_runs_src = {}
+for _f in ("main.py", "homeview.py"):
+    with open(os.path.join(HERE, "app", _f), encoding="utf-8") as _fh:
+        _src = _fh.read()
+    for _part in _src.split('out.append({')[1:]:
+        if '"runs": True' in _part.split("})", 1)[0]:
+            _runs_src.setdefault(_f, []).append(
+                _part.split('"id": "', 1)[-1].split('"', 1)[0])
+check("⭐ 'control still runs' is set on the two peak rows only (saturated "
+      "and reserve); no row that stops control carries it",
+      _runs_src == {"main.py": ["peak_guard", "peak_guard"]})
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED: " + ", ".join(fails))
+    sys.exit(1)
+print("all SAFETY-87 checks passed")
diff --git a/goodwe_controller/test_selfconfig.py b/goodwe_controller/test_selfconfig.py
index 336ea71..81bd773 100644
--- a/goodwe_controller/test_selfconfig.py
+++ b/goodwe_controller/test_selfconfig.py
@@ -172,7 +172,7 @@ class FakeController:
         self.inverters = []
         self.events = []
 
-    def log_event(self, text):
+    def log_event(self, text, hint=None):
         self.events.append(text)
 
     def status_payload(self):
@@ -236,7 +236,7 @@ check("the stored options are byte-identical to what they were",
 check("...and the refusal carries the validator's OWN sentence, unedited",
       refused.problems == validate_startup_config(bad, None, None))
 check("...which is the sentence that names the key and says what it costs",
-      any("setpoint_entity is not set" in p for p in refused.problems))
+      any("(setpoint_entity) is empty" in p for p in refused.problems))
 
 _good = base()
 res = run(selfconfig.save(sup, _good, fp))
@@ -316,7 +316,7 @@ _probs, _ = run(selfconfig.problems_and_ranges(dict(_live, max_w=""), None))
 check("⚠️ CLEARING max_w ON THE LIVE SHAPE IS REFUSED - rule 10 catches the "
       "rail collapsing to the 2000 default under an explicit 400 W slew, so "
       "the box cannot be emptied into a quietly halved rail",
-      any("site rail of 2000 W" in p for p in _probs))
+      any("for a 2000 W site" in p for p in _probs))
 
 # HALF TWO: the backstop cannot report "no problems" for a config it could not
 # compose. Returning [] there enables Save - a crash became a green.
@@ -430,7 +430,7 @@ _probs = run(selfconfig.problems_for(base(max_w=4000), FakeHass(_ranges)))
 _by, _un = configui.problems_by_field(_probs, ALL_KEYS)
 check("the device-range rule is REACHED from the panel - the setpoint entity's "
       "own range is read, so rule 1 fires here exactly as it does at startup",
-      any("THE DEVICE WINS" in p for p in _probs))
+      any("Lower the rating to" in p for p in _probs))
 check("...and it lands on `max_w`, which is the field the operator has to "
       "change", "max_w" in _by)
 # ⚠️ THE COLLISION, CHECKED HERE AND NOT ONLY IN THE PROBE. `sign_disagree_w`
@@ -467,7 +467,7 @@ _p2, _unread2 = run(selfconfig.problems_and_ranges(base(max_w=4000),
                                                    FakeHass(_ranges)))
 check("...and with the same device answering, the same config IS refused - "
       "which is what makes the line above a skip rather than a pass",
-      any("THE DEVICE WINS" in p for p in _p2) and _unread2 == [])
+      any("Lower the rating to" in p for p in _p2) and _unread2 == [])
 check("the note is about the config UNDER TEST, not about the running roster: "
       "a newly typed entity that does not answer is the one named",
       run(selfconfig.problems_and_ranges(
@@ -495,8 +495,9 @@ _leaked = sorted(k for k in ALL_KEYS
                                              _script))
 check(f"the page's script names NOT ONE option key - so it cannot be rendering "
       f"a field list of its own. Leaked: {_leaked}", not _leaked)
-_phrases = ["THE DEVICE WINS", "has no actuator", "two writers",
-            "setpoint_entity is not set", "would silently never happen"]
+_phrases = ["Lower the rating to", "cannot control the inverter",
+            "point at the same inverter entity", "(setpoint_entity) is empty",
+            "accepts at most"]
 _copied = sorted(p for p in _phrases
                  for f, text in _ui_files.items() if p in text)
 check(f"no phrase out of a validate.py refusal appears anywhere in the three "
@@ -551,7 +552,7 @@ class H:
     async def limits(self, e): return (None, None, None)
 class C:
     o = json.loads(os.environ["OPTS"]); hass = H(); inverters = []
-    def log_event(self, t): pass
+    def log_event(self, t, hint=None): pass
     def status_payload(self): return {}
     async def handle_action(self, w): raise AssertionError("no")
 
@@ -635,12 +636,18 @@ _app = web.build_app(FakeController(), FakeSupervisor())
 _routes = sorted({(r.method, r.get_info().get("path"))
                   for r in _app.router.routes() if r.method != "HEAD"})
 print("    " + "  ".join(f"{m} {p}" for m, p in _routes))
-check("the configuration surface adds five routes and touches none of the "
-      "three that were there",
+check("the configuration surface adds five routes and UX-13 one GET, and "
+      "none touches the three that were there",
       _routes == [("GET", "/"), ("GET", "/config"), ("GET", "/config/model"),
-                  ("GET", "/status"), ("POST", "/action"),
-                  ("POST", "/config/restart"), ("POST", "/config/save"),
-                  ("POST", "/config/validate")])
+                  ("GET", "/ha/entities"), ("GET", "/status"),
+                  ("POST", "/action"), ("POST", "/config/restart"),
+                  ("POST", "/config/save"), ("POST", "/config/validate")])
+_ents_src = io.open(os.path.join(HERE, "app", "haentities.py"),
+                    encoding="utf-8").read()
+check("UX-13's entity list only reads: haentities.py calls hass.states() and "
+      "no service, setter or action",
+      "hass.states()" in _ents_src
+      and not re.search(r"\.(call|set_number|handle_action|post)\(", _ents_src))
 _selfconfig_src = io.open(os.path.join(HERE, "app", "selfconfig.py"),
                           encoding="utf-8").read()
 for forbidden in ("set_number", "write_setpoint", "handle_action",
@@ -691,6 +698,10 @@ async def _e2e():
             async with s.post(f"{root}/config/validate",
                               json={"options": base(setpoint_entity="")}) as r:
                 out["invalid"] = await r.json()
+            async with s.post(f"{root}/config/validate",
+                              json={"options": base(integrator_max_w=3000)}
+                              ) as r:
+                out["warned"] = await r.json()
             # ⚠️ THE COUNTS ARE SNAPSHOTTED AT EACH STAGE. Asserting
             # `sup.writes == []` after the whole sequence would be asserting
             # about the LAST request, not this one - the first draft did, and
@@ -748,6 +759,11 @@ check("...and it honours the browser's language per key, falling back to "
 check("POST config/validate returns the validator's sentences, anchored",
       E["invalid"]["problems"]
       and "setpoint_entity" in E["invalid"]["by_key"])
+check("UX-13: POST config/validate also returns the validator's warnings, "
+      "beside no refusal",
+      E["warned"]["problems"] == [] and [n["keys"] for n in
+                                         E["warned"]["notes"]]
+      == [["integrator_max_w"]] and E["warned"]["notes"][0]["tier"] == "warn")
 check("a save of an invalid blob answers 422 and the Supervisor got nothing",
       E["save_invalid"][0] == 422
       and E["save_invalid"][1]["kind"] == "invalid"
diff --git a/goodwe_controller/test_settings.py b/goodwe_controller/test_settings.py
new file mode 100644
index 0000000..0df8da0
--- /dev/null
+++ b/goodwe_controller/test_settings.py
@@ -0,0 +1,466 @@
+"""UX-13 P2: the Installer settings view.  `python3 test_settings.py`
+
+The view is drawn from app/uilayout.py through app/uipage.py and saves the
+page model through app/uimodel.py and the shipped validator. Part 1 checks
+that every group and every mapped field reaches the page with its words,
+range and choices. Part 2 checks the page script names no option key. Parts
+3-5 drive the real routes over HTTP against a fake Supervisor: the save round
+trip, where a refusal lands, and a stale save. Part 6 holds the view's words
+to STYLE. The headless-browser click-through is in the PR, not in CI (the CI
+image has no browser).
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import asyncio
+import copy
+import glob
+import io
+import json
+import logging
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)            # the validator's own log lines
+
+from aiohttp import ClientSession, web as aioweb                # noqa: E402
+
+import translations_lint as TL                                  # noqa: E402
+import ux13_demo as D                                           # noqa: E402
+from app import selfconfig, uilayout as L, uimodel as U, uipage, web  # noqa: E402
+from app.validate import validate_startup_config                # noqa: E402
+from named_absence import field                        # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+SCHEMA = D.schema_ui(D.CONFIG)
+TRANSLATIONS = {"en": TL.parse_translation_file(
+    os.path.join(HERE, "translations", "en.yaml"))}
+DEFAULTS = D.defaults(D.CONFIG)
+SITE = dict(DEFAULTS, setpoint_entity="number.goodwe_setpoint",
+            soc_entity="sensor.soc", batt_entity="sensor.batt")
+TWO = dict(SITE, setpoint_entity="", inverters=[
+    {"name": "inverter-a", "setpoint_entity": "number.a", "max_w": 2500,
+     "bms_soc_floor": 10},
+    {"name": "inverter-b", "setpoint_entity": "number.b", "max_w": 2500,
+     "bms_soc_floor": 10}])
+UI_TEXT = uipage.ui_text()
+W = UI_TEXT["settings"]
+
+
+def browser(value):
+    """What JSON.parse then JSON.stringify does to a value: 3.0 becomes 3."""
+    if isinstance(value, float) and value.is_integer():
+        return int(value)
+    if isinstance(value, list):
+        return [browser(v) for v in value]
+    if isinstance(value, dict):
+        return {k: browser(v) for k, v in value.items()}
+    return value
+
+
+# --------------------------------------------------------------------------- #
+print("1. every group and every mapped field reaches the page")
+# --------------------------------------------------------------------------- #
+LAYOUT = uipage.layout(SCHEMA, TRANSLATIONS)
+_flat = []
+for _g in LAYOUT["groups"]:
+    for _p in _g["parts"]:
+        for _f in _p["fields"]:
+            _flat.append((_g["id"], _f))
+            _flat += [(_g["id"], _s) for _s in _f.get("fields", [])]
+_keys = [f["key"] for _g, f in _flat]
+FIELD = {f["key"]: f for _g, f in _flat}
+check("the six groups, in the design's order",
+      [g["id"] for g in LAYOUT["groups"]]
+      == ["meter", "inverters", "tariff", "safety", "maintenance", "tuning"]
+      and [g["name"] for g in LAYOUT["groups"]]
+      == ["Meter", "Inverters and batteries", "Tariff and prices",
+          "Safety limits", "Maintenance", "Control tuning"])
+check(f"every field of the table is on the page once ({len(_keys)} fields)",
+      sorted(_keys) == sorted(f.key for _g, _p, f in L.fields())
+      and len(_keys) == len(set(_keys)))
+_counts = {g["id"]: sum(1 for gid, _f in _flat if gid == g["id"])
+           for g in LAYOUT["groups"]}
+print(f"    fields per group: {_counts}")
+check("every field has a label, and every option field's label is its "
+      "translation without the group prefix",
+      all(f["label"] and " · " not in f["label"] for _g, f in _flat)
+      and field(FIELD, "meter_source")["label"]
+      == "Where the meter reading comes from")
+_ranged = [(f["key"], f.get("min"), f.get("max")) for _g, f in _flat
+           if f["control"] in (L.SLIDER, L.LOCKED)]
+check(f"every slider and locked value has its range from the schema "
+      f"({len(_ranged)})", all(lo is not None and hi is not None
+                               for _k, lo, hi in _ranged)
+      and ("peak_cap_w", 500.0, 15000.0) in _ranged)
+check("the peak limit is a kW slider over a value stored in W, and its label "
+      "does not say W (the unit is shown beside the control)",
+      field(FIELD, "peak_cap_w")["scale"] == 1000
+      and field(FIELD, "peak_cap_w")["label"] == "Peak limit"
+      and not [f["key"] for _g, f in _flat
+               if f["unit"] and re.search(r"\([^()\s]{1,6}\)", f["label"])])
+_choice = [f for _g, f in _flat
+           if f["control"] in (L.SEGMENTED, L.SELECT, L.CHOICE)]
+check("every choice control has choices with words",
+      all(f["choices"] and all(c[1] for c in f["choices"]) for f in _choice))
+_ms = field(FIELD, "meter_source")
+check("the meter source is radio cards with a line of help on each",
+      _ms["control"] == L.CHOICE and set(_ms["hints"]) == {c[0] for c in
+                                                            _ms["choices"]})
+_reg = field(FIELD, "ui.region")
+check("the region shows its preset year beside the choice (P0 review)",
+      ["flanders", "Flanders, Fluvius Antwerpen, 2026 figures", False]
+      in _reg["choices"] and _reg["presets"]["flanders"]["year"] == 2026)
+check("...and says plainly that Wallonia and Brussels have no preset yet "
+      "(TARIFF-22)", _reg["later"] == [["wallonia", "Wallonia, no preset yet"],
+                                      ["brussels", "Brussels, no preset yet"]]
+      and "Wallonia or Brussels" in _reg["help"])
+_locked = sorted(f["key"] for _g, f in _flat if f["control"] == L.LOCKED)
+check(f"measured and derived values are locked behind 'Change' "
+      f"({len(_locked)}): every control tuning value, every safety stop and "
+      "the peak reserve",
+      {f.key for p in L.GROUPS[-1].parts for f in p.fields} <= set(_locked)
+      and "sign_disagree_w" in _locked and "peak_soc_floor" in _locked
+      and LAYOUT["groups"][-1]["support_only"])
+check("each group says when its settings apply",
+      all(g["applies"] == [UI_TEXT["applies"]["restart"]["name"]]
+          for g in LAYOUT["groups"]))
+_inv = field(FIELD, "inverters")
+check("the inverter cards carry their count, and adding one makes a list",
+      _inv["count"] == U.COUNT and _inv["grow"] == U.GROWN
+      and [s["key"] for s in _inv["fields"]]
+      == [f.key for f in L.ROSTER_FIELDS])
+check("a page-only field names the option keys it writes, for the grey key "
+      "line", _reg["writes"] == ["price_taxes_profile"]
+      and field(FIELD, "ui.solar")["writes"]
+      == ["pv_entities", "pv_entity", "pv_invert_entities"]
+      and "static_profile" in field(FIELD, "ui.contract")["writes"])
+check("without a Supervisor schema the page still draws, with no ranges",
+      len(uipage.layout([], {})["groups"]) == 6)
+
+# --------------------------------------------------------------------------- #
+print("\n2. the page script names no option key")
+# --------------------------------------------------------------------------- #
+JS = io.open(os.path.join(HERE, "app", "static", "settings.js"),
+             encoding="utf-8").read()
+ORDER, _nested = TL.config_surface(D.CONFIG)
+_leak = sorted(k for k in ORDER if re.search(
+    r"[^A-Za-z0-9_]" + re.escape(k) + r"[^A-Za-z0-9_]", JS))
+check(f"settings.js names no option key ({_leak})", not _leak)
+check("data is set as text, never as HTML",
+      "innerHTML" not in JS and "insertAdjacentHTML" not in JS)
+_fetch = sorted(set(re.findall(r'fetch\("([^"?]+)', JS)))
+check(f"every request is relative, to the add-on's own routes ({_fetch})",
+      _fetch == ["config/model", "config/restart", "config/save",
+                 "config/validate", "ha/entities"])
+
+
+def _resolve(path, node=W):
+    for k in path.split("."):
+        if not isinstance(node, dict) or k not in node:
+            return None
+        node = node[k]
+    return node
+
+
+_used = {re.sub(r"\.(replace|join|length)$", "", k) for k in
+         re.findall(r'\bW\.([a-z_]+(?:\.[a-z_]+)*)', JS)}
+_used |= set(re.findall(r'data-s(?:-ph|-label)?="([\w.]+)"', io.open(
+    os.path.join(HERE, "app", "static", "index.html"), encoding="utf-8").read()))
+_miss = sorted(k for k in _used if _resolve(k) is None)
+check(f"every word the view asks for is in app/ui_text ({len(_used)} keys, "
+      f"missing: {_miss})", len(_used) > 25 and not _miss)
+check("search matches a field's label, its key and its help",
+      "(f.label + \" \" + keys + \" \" + f.key + \" \" + (f.help || \"\"))"
+      in JS)
+check("a locked value shows no input until 'Change' is pressed",
+      re.search(r"function locked\(.*?\n  }\n", JS, re.S)
+      and "UNLOCKED.has(id)) { open(); return box; }" in JS)
+check("nothing is saved while the add-on's own checks refuse the model",
+      "if (MSG.some((m) => m.tier === \"bad\")) { toast(" in JS)
+check("Discard reloads the stored settings (after a stale save the page's "
+      "copy is no longer what is stored)",
+      re.search(r'"#sb-discard"\)\.addEventListener\("click", async \(\) => '
+                r'\{\s*await load\(\);', JS) is not None)
+check("a load locks every locked value again, and a choice the page can only "
+      "keep stays offered while it is the stored value",
+      "UNLOCKED.clear();" in JS.split("async function load")[1].split("render();")[0]
+      and "same(c[0], was)" in JS)
+check("removing cards back to one restores the stored shape (a flat inverter "
+      "is not turned into a list of one)",
+      "if (V[f.key].length === 1) for (const k in f.grow) V[k] = clone(ORIG[k]);"
+      in JS)
+check("the old settings page stays reachable (until P5)",
+      'href="config" id="set-classic"' in web.page())
+
+
+# --------------------------------------------------------------------------- #
+# The real routes, over HTTP, against a fake Supervisor
+# --------------------------------------------------------------------------- #
+class Supervisor:
+    def __init__(self, options):
+        self.options = copy.deepcopy(options)
+        self.writes = []
+
+    async def info(self):
+        return {"options": copy.deepcopy(self.options), "schema": SCHEMA,
+                "translations": TRANSLATIONS}
+
+    async def write_options(self, options):
+        self.writes.append(copy.deepcopy(options))
+        self.options = copy.deepcopy(options)
+
+    async def restart(self, confirm):
+        raise AssertionError("no restart here")
+
+
+class Hass:
+    session = None
+    token = ""
+
+    async def limits(self, _e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def states(self):
+        return []
+
+
+class Controller:
+    def __init__(self, opts):
+        self.o, self.hass, self.inverters = dict(opts), Hass(), []
+
+    def log_event(self, text, hint=None):
+        pass
+
+    def status_payload(self):
+        return {"banner": "", "level": "ok", "rows": [], "checks": []}
+
+    async def handle_action(self, what):
+        raise AssertionError(f"the settings view reached {what!r}")
+
+
+async def session(stored, steps):
+    """Run `steps(s, root)` against the app over a fake Supervisor."""
+    sup = Supervisor(stored)
+    runner = aioweb.AppRunner(web.build_app(Controller(stored), sup))
+    await runner.setup()
+    site = aioweb.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    root = f"http://127.0.0.1:{site._server.sockets[0].getsockname()[1]}/"
+    try:
+        async with ClientSession() as s:
+            out = await steps(s, root, sup)
+    finally:
+        await runner.cleanup()
+    return out, sup
+
+
+async def _get(s, url):
+    async with s.get(url) as r:
+        return await r.json()
+
+
+async def _post(s, url, body):
+    async with s.post(url, json=body) as r:
+        return r.status, await r.json()
+
+
+# --------------------------------------------------------------------------- #
+print("\n3. the save round trip")
+# --------------------------------------------------------------------------- #
+check("the fixture site starts (so a refusal below is the edit's)",
+      not validate_startup_config(TWO) and not validate_startup_config(SITE))
+
+
+async def _round(s, root, sup):
+    out = {}
+    m = await _get(s, root + "config/model?lang=en")
+    out["model"] = m
+    model = browser(m["ui"])
+    out["same"] = await _post(s, root + "config/save",
+                              {"model": model, "fingerprint": m["fingerprint"]})
+    out["after_same"] = copy.deepcopy(sup.options)
+    m = await _get(s, root + "config/model?lang=en")
+    model = browser(m["ui"])
+    model["peak_cap_w"] = 4200
+    model["inverters"][1]["max_w"] = 2200
+    out["edit"] = await _post(s, root + "config/save",
+                              {"model": model, "fingerprint": m["fingerprint"]})
+    return out
+
+
+_stored = dict(TWO, gain=0.5, target_grid_w=-10.0, peak_cap_w=3500)
+_r, _sup = asyncio.run(session(_stored, _round))
+check("config/model carries the layout and the page model",
+      _r["model"]["layout"] == json.loads(json.dumps(uipage.layout(
+          SCHEMA, TRANSLATIONS))) and _r["model"]["ui"]["inverter_count"] == 2)
+check("a save that changed nothing writes an identical blob: same values, "
+      "types and key order, although the browser turned -10.0 into -10",
+      _r["same"][0] == 200 and json.dumps(_r["after_same"])
+      == json.dumps(_stored) and isinstance(_r["after_same"]["target_grid_w"],
+                                            float))
+_written = _sup.writes[-1]
+print(f"    the edit: {_r['edit']}, changed "
+      f"{sorted(k for k in _stored if _written[k] != _stored[k])}")
+check("an edit writes exactly the fields edited, the peak limit in W",
+      _r["edit"][0] == 200
+      and sorted(k for k in _stored if _written[k] != _stored[k])
+      == ["inverters", "peak_cap_w"] and _written["peak_cap_w"] == 4200
+      and _written["inverters"][1]["max_w"] == 2200
+      and _written["inverters"][0] == _stored["inverters"][0])
+_blobs = [("config.yaml", DEFAULTS), ("site", SITE), ("two", TWO)] + [
+    (os.path.basename(f), json.load(open(f))) for f in sorted(glob.glob(
+        os.path.join(HERE, "scenarios", "ux13", "test23", "*.json")))]
+_bad = [n for n, o in _blobs if json.dumps(uipage.to_options(browser(
+    json.loads(json.dumps(U.options_to_ui(o)))), o)) != json.dumps(o)]
+check(f"every known blob comes back byte for byte through the browser "
+      f"({len(_blobs)} blobs, not: {_bad})", not _bad and len(_blobs) >= 8)
+_grown = U.options_to_ui(SITE)
+_grown["inverters"].append(dict(_grown["inverters"][0], name="b",
+                                setpoint_entity="number.b"))
+_grown["inverters"][0]["name"] = "a"
+_grown.update(U.GROWN)
+_g = U.ui_to_options(_grown)
+check("'Add an inverter' on a flat site writes a list and clears the flat "
+      "power request entity, which the validator refuses beside a list",
+      [e["name"] for e in _g["inverters"]] == ["a", "b"]
+      and _g["setpoint_entity"] == "" and not validate_startup_config(_g))
+
+# --------------------------------------------------------------------------- #
+print("\n4. a refusal lands beside the field it is about")
+# --------------------------------------------------------------------------- #
+
+
+async def _refuse(s, root, sup):
+    out = {}
+    m = await _get(s, root + "config/model?lang=en")
+    base = m["ui"]
+
+    async def validate(**edits):
+        model = copy.deepcopy(base)
+        for k, v in edits.items():
+            if k == "card":
+                model["inverters"][v[0]][v[1]] = v[2]
+            else:
+                model[k.replace("__", ".")] = v
+        return (await _post(s, root + "config/validate", {"model": model}))[1]
+
+    out["card"] = await validate(card=(1, "setpoint_entity", ""))
+    out["same"] = await validate(card=(1, "setpoint_entity", "number.a"))
+    out["floor"] = await validate(peak_soc_floor=5)
+    out["derive"] = await validate(ui__contract="dynamic", price_provider="")
+    model = copy.deepcopy(base)
+    model.update({"ui.contract": "dynamic", "price_provider": ""})
+    out["derive_save"] = await _post(s, root + "config/save", {
+        "model": model, "fingerprint": m["fingerprint"]})
+    out["derive_writes"] = len(sup.writes)
+    model = copy.deepcopy(base)
+    model["inverters"][1]["setpoint_entity"] = ""
+    out["save"] = await _post(s, root + "config/save",
+                              {"model": model, "fingerprint": m["fingerprint"]})
+    return out
+
+
+_r, _sup = asyncio.run(session(TWO, _refuse))
+
+
+def _at(payload, tier="bad"):
+    return {(m["field"], m["card"]) for m in payload["messages"]
+            if m["tier"] == tier}
+
+
+print(f"    blank power request entity on card 2: {_r['card']['messages']}")
+check("a blank power request entity on the second card is refused beside "
+      "that card's field, and not beside the list as well",
+      ("inverters.setpoint_entity", 1) in _at(_r["card"])
+      and ("inverters", None) not in _at(_r["card"]))
+print(f"    two cards on one entity: {_r['same']['messages']}")
+check("two cards on one entity are refused beside that field on both cards",
+      {("inverters.setpoint_entity", 0), ("inverters.setpoint_entity", 1)}
+      == _at(_r["same"]))
+check("a peak reserve under the cut-out level lands on the peak reserve and "
+      "on each card's cut-out level",
+      {("peak_soc_floor", None), ("inverters.bms_soc_floor", 0),
+       ("inverters.bms_soc_floor", 1)} <= _at(_r["floor"]))
+check("a model no blob can say is refused beside its field, in plain words",
+      _r["derive"]["messages"] == [{
+          "field": "price_provider", "card": None, "tier": "bad",
+          "text": W["derive"]["no_source"]["description"]}])
+check("a save no blob can say answers 422 with its sentence and writes nothing",
+      _r["derive_save"][0] == 422 and _r["derive_writes"] == 0
+      and _r["derive_save"][1]["messages"] == _r["derive"]["messages"])
+check("a refused save answers 422 with the same placement and writes nothing",
+      _r["save"][0] == 422 and ("inverters.setpoint_entity", 1)
+      in _at(_r["save"][1]) and _sup.writes == [])
+_fixed = U.options_to_ui(dict(TWO, static_profile="not json"))
+check("a sentence about a key the page derives goes to the field that writes "
+      "it, or to the visible choice that sets it",
+      uipage.targets("static_profile", "", _fixed) == [("ui.contract", None)]
+      and uipage.targets("max_w", "", U.options_to_ui(SITE))
+      == [("inverters.max_w", 0)]
+      and uipage.targets("pv_entity", "", _fixed) == [("ui.solar", None)])
+check("a sentence naming no setting on the page is kept, with no field",
+      uipage.anchors(["Something odd."], [], _fixed, ["gain"])
+      == [{"field": None, "card": None, "tier": "bad",
+           "text": "Something odd."}])
+
+# --------------------------------------------------------------------------- #
+print("\n5. a stale save names the fields that changed elsewhere")
+# --------------------------------------------------------------------------- #
+
+
+async def _stale(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    sup.options["peak_cap_w"] = 5000          # the Configuration tab saves
+    model = copy.deepcopy(m["ui"])
+    model["gain"] = 0.4
+    return await _post(s, root + "config/save",
+                       {"model": model, "fingerprint": m["fingerprint"]})
+
+
+_r, _sup = asyncio.run(session(TWO, _stale))
+check("409 with the page fields to look at, and nothing written. Only the "
+      "field the other surface changed, not the page's own edit (P4, P2 "
+      "test finding a)",
+      _r[0] == 409 and _r[1]["kind"] == "stale"
+      and _r[1]["changed_fields"] == ["peak_cap_w"] and _sup.writes == []
+      and _r[1]["fingerprint"] == selfconfig.fingerprint(_sup.options))
+
+# --------------------------------------------------------------------------- #
+print("\n6. the view's words keep to STYLE")
+# --------------------------------------------------------------------------- #
+
+
+def _texts(node, path=""):
+    for k, v in node.items():
+        if isinstance(v, dict):
+            yield from _texts(v, f"{path}{k}.")
+        elif isinstance(v, str):
+            yield f"{path}{k}", v
+
+
+_long = [(p, t) for p, t in _texts(W)
+         if len(t.split()) > (25 if p.endswith("description") else 6)
+         or (p.endswith("description") and len(re.findall(r"[.!?](?:\s|$)", t)) > 1)
+         or ";" in t]
+check(f"every settings string is one sentence of at most 25 words, or a "
+      f"name of at most 6 ({_long})", not _long)
+_labels = [c[1] for _g, f in _flat for c in f.get("choices", [])]
+check("every choice, including the region with its year, is at most 6 words",
+      all(len(x.split()) <= 6 for x in _labels))
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_setup.py b/goodwe_controller/test_setup.py
new file mode 100644
index 0000000..bf37557
--- /dev/null
+++ b/goodwe_controller/test_setup.py
@@ -0,0 +1,894 @@
+"""UX-13 P4: the setup wizard.  `python3 test_setup.py`
+
+The wizard is the Installer view's page model drawn one step at a time from
+each field's `wizard` step (app/uilayout.py), saved through the same routes.
+Part 1 checks the steps and the tables the page reads. Part 2 the kettle
+test's sign logic. Part 3 which refusals block which step. Part 4 the
+first-run rule on new and existing sites. Part 5 the last step's live checks.
+Part 6 the save through the P2 path, and every blob the wizard can produce
+(tools/ux13_wizard_blobs.py; the Supervisor's own validator runs over the same
+set in the PR, not in CI, which has no Supervisor image). Part 7 the stale
+save names only what changed elsewhere (P2 test, finding a). Part 8 the
+words. Part 9 UX-15's fixes: F1, F2 with two tabs, a missing meter entity and
+step 1 after a skip. The headless-browser click-through is in the PR.
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import asyncio
+import copy
+import io
+import json
+import logging
+import os
+import re
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+logging.disable(logging.WARNING)            # the validator's own log lines
+
+from aiohttp import ClientSession, ContentTypeError, web as aioweb  # noqa: E402
+
+import translations_lint as TL                                  # noqa: E402
+import ux13_demo as D                                           # noqa: E402
+import ux13_wizard_blobs as B                                   # noqa: E402
+from app import uilayout as L, uimodel as U, uipage, web        # noqa: E402
+from app.validate import setup_checks, validate_startup_config  # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+SCHEMA = D.schema_ui(D.CONFIG)
+TRANSLATIONS = {"en": TL.parse_translation_file(
+    os.path.join(HERE, "translations", "en.yaml"))}
+DEFAULTS = D.defaults(D.CONFIG)
+NEW = dict(DEFAULTS, setpoint_entity="number.inv1_power")
+UI_TEXT = uipage.ui_text()
+WS = UI_TEXT["settings"]["setup"]
+WS_D = UI_TEXT["settings"]["derive"]
+JS = io.open(os.path.join(HERE, "app", "static", "settings.js"),
+             encoding="utf-8").read()
+
+# --------------------------------------------------------------------------- #
+print("1. six steps, drawn from the layout table")
+# --------------------------------------------------------------------------- #
+LAYOUT = uipage.layout(SCHEMA, TRANSLATIONS)
+TOP = [f for g in LAYOUT["groups"] for p in g["parts"] for f in p["fields"]]
+BY_STEP = {n: [f["key"] for f in TOP if f["wizard"] == n]
+           for n in range(1, L.WIZARD_STEPS + 1)}
+print(f"    {BY_STEP}")
+check("every field reaches the page with its wizard step",
+      all("wizard" in f for f in TOP)
+      and all(s["wizard"] == 2 for f in TOP for s in f.get("fields", [])))
+check("the mockup's six steps: meter, inverters, solar, prices, peak limit, "
+      "check and start",
+      BY_STEP[1][0] == "meter_source" and BY_STEP[2] == ["inverters"]
+      and BY_STEP[3] == ["ui.solar"] and BY_STEP[4][0] == "ui.contract"
+      and BY_STEP[5] == ["peak_cap_w", "peak_forecast_entity"]
+      and BY_STEP[6] == [L.SHADOW[0]]
+      and [WS["steps"][str(n)]["name"] for n in range(1, 7)]
+      == ["Your meter", "Inverters and batteries", "Solar", "Prices",
+          "Peak limit", "Check and start"])
+check("battery modes are not a wizard step (OPT-11): step 5 points to the Batteries screen",
+      "Batteries screen" in WS["modes_later"]["description"]
+      and not any("mode" in k for k in BY_STEP[5]))
+SPEC = uipage.setup_spec()
+check("the spec the page reads is the table's",
+      SPEC["steps"] == 6 and SPEC["final"] == 6 and SPEC["optional"] == [3]
+      and SPEC["kettle"]["min_w"] == L.KETTLE_MIN_W
+      and set(SPEC["kettle"]["sources"]) == set(L.KETTLE)
+      and SPEC["shadow"] == {"field": "shadow_mode", "on": "on",
+                             "off": "auto"})
+_src = L.field(L.KETTLE_SOURCE)
+_choices = {c[0] for f in TOP if f["key"] == L.KETTLE_SOURCE
+            for c in f["choices"]}
+_bad = []
+for source, (read, outcomes) in L.KETTLE.items():
+    model = {L.KETTLE_SOURCE: source}
+    for key, _sign in read:
+        fld = L.field(key)
+        if not (fld and fld.wizard == 1 and fld.control == L.ENTITY
+                and L.visible(fld, model)):
+            _bad.append(key)
+    for _say, sets in outcomes.values():
+        for key in (sets or {}):
+            fld = L.field(key)
+            if not (fld and fld.wizard == 1 and L.visible(fld, model)):
+                _bad.append(key)
+check(f"each kettle source is a meter choice, and reads and sets only step-1 "
+      f"fields shown for it ({_bad})",
+      set(L.KETTLE) <= _choices and not _bad and _src.wizard == 1)
+_shadow = next((f for f in TOP if f["key"] == L.SHADOW[0]), {})
+check("the shadow switch writes two of shadow mode's own choices",
+      {L.SHADOW[1], L.SHADOW[2]} <= {c[0] for c in _shadow.get("choices", [])})
+
+# --------------------------------------------------------------------------- #
+print("\n2. the kettle test's sign logic")
+# --------------------------------------------------------------------------- #
+K = uipage.kettle
+check("one grid entity: up keeps the sign, down flips it",
+      K("off", -10, 1990) == ("ok", {"meter_invert": False}, 2000)
+      and K("off", 400, -1600) == ("flip", {"meter_invert": True}, -2000))
+check("the direction is the change, not the sign: exporting 3 kW, a kettle "
+      "still moves the reading up",
+      K("off", -3000, -1000)[0] == "ok" and K("off", 3000, 1000)[0] == "flip")
+check(f"a change under {L.KETTLE_MIN_W:.0f} W sets nothing and is not passed",
+      K("off", 0, 499)[:2] == ("none", None)
+      and K("off", 0, -499)[:2] == ("none", None)
+      and K("off", 0, 500)[0] == "ok")
+check("a net entity that goes down cannot be fixed by an option, so the step "
+      "is not passed",
+      K("ha_signed", 0, 2000) == ("ok", {}, 2000)
+      and K("ha_signed", 0, -2000)[:2] == ("wrong_signed", None))
+check("import and export are read as their difference",
+      L.KETTLE["ha_dsmr"][0] == (("p1_import_entity", 1),
+                                 ("p1_export_entity", -1))
+      and K("ha_dsmr", -3000, -1000)[0] == "ok"
+      and K("ha_dsmr", 0, -2000)[0] == "wrong_dsmr")
+check("a meter the add-on reads itself has no kettle test on the page",
+      K("homewizard_local", 0, 2000) is None and K("mqtt_p1", 0, 2000) is None)
+_js = re.search(r"function kettleOutcome\(src, before, after\) \{(.*?)\n  \}",
+                JS, re.S)
+check("the page reaches the same verdict: settings.js kettleOutcome() is "
+      "uipage.kettle() line for line",
+      _js and "const d = after - before;" in _js.group(1)
+      and "Math.abs(d) < M.setup.kettle.min_w" in _js.group(1)
+      and 'src[d > 0 ? "up" : "down"]' in _js.group(1))
+check("...and it applies what the verdict sets, and passes the step only on "
+      "a verdict that sets something",
+      "if (o.sets) { Object.assign(V, o.sets); queueValidate(); }" in JS
+      and "ok: o.sets != null" in JS)
+check("a changed meter or entity forgets the result, so the test runs again",
+      "if (WZ.kettle && WZ.kettle.sig !== sig) WZ.kettle = null;" in JS)
+check("each verdict has words", all(say in WS["kettle"] for _r, o in
+                                     L.KETTLE.values()
+                                     for say, _s in o.values())
+      and {"none", "unread", "skipped", "self"} <= set(WS["kettle"]))
+
+# --------------------------------------------------------------------------- #
+print("\n3. which refusals block which step")
+# --------------------------------------------------------------------------- #
+_m = U.options_to_ui(dict(NEW, meter_source="ha_signed"))
+_msgs = [{"field": "p1_net_entity", "card": None, "tier": "bad", "text": "a"},
+         {"field": "meter_entity", "card": None, "tier": "bad", "text": "b"},
+         {"field": "inverters.setpoint_entity", "card": 0, "tier": "bad",
+          "text": "c"},
+         {"field": "maintenance_charge_w", "card": None, "tier": "bad",
+          "text": "d"},
+         {"field": None, "card": None, "tier": "bad", "text": "e"},
+         {"field": "peak_cap_w", "card": None, "tier": "warn", "text": "f"}]
+check("a refusal blocks the step of its field, a hidden or non-wizard field's "
+      "and an unplaced one the last step, and a warning blocks nothing",
+      uipage.step_problems(_msgs, _m)
+      == {"1": 1, "2": 1, "3": 0, "4": 0, "5": 0, "6": 3})
+
+
+class Store:
+    """app/store.py's shape: a dict under .data, and set()."""
+
+    def __init__(self, data=None, fresh=False):
+        self.data = dict(data or {})
+        self.fresh = fresh
+
+    def set(self, key, value):
+        self.data[key] = value
+
+
+def state(eid, value, unit="W", cls=None):
+    return {"entity_id": eid, "state": value,
+            "attributes": {"friendly_name": eid, "unit_of_measurement": unit,
+                           "device_class": cls}}
+
+
+class Hass:
+    session = None
+    token = ""
+
+    def __init__(self, states):
+        self.states_now = states
+        self.reads = []
+
+    async def limits(self, _e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def states(self):
+        return copy.deepcopy(self.states_now)
+
+    async def state(self, entity):
+        self.reads.append(entity)
+        return next((copy.deepcopy(s) for s in self.states_now
+                     if s["entity_id"] == entity), None)
+
+
+class Supervisor:
+    def __init__(self, options):
+        self.options = copy.deepcopy(options)
+        self.writes = []
+        self.restarts = 0
+
+    async def info(self):
+        return {"options": copy.deepcopy(self.options), "schema": SCHEMA,
+                "translations": TRANSLATIONS}
+
+    async def write_options(self, options):
+        self.writes.append(copy.deepcopy(options))
+        self.options = copy.deepcopy(options)
+
+    async def restart(self, confirm):
+        self.restarts += 1
+
+
+class Controller:
+    def __init__(self, opts, states, store=None, auto=False, grid=None):
+        self.o, self.hass, self.inverters = dict(opts), Hass(states), []
+        self.store, self.auto, self.grid = store, auto, grid
+
+    def log_event(self, text, hint=None):
+        pass
+
+    def status_payload(self):
+        return {"banner": "", "level": "ok", "rows": [], "checks": [],
+                "plan": {"prices": [{"eur_kwh": 0.2}] * 20
+                         + [{"eur_kwh": None}] * 4}}
+
+    async def handle_action(self, what):
+        raise AssertionError(f"the wizard reached {what!r}")
+
+
+async def session(ctl, stored, steps):
+    sup = Supervisor(stored)
+    runner = aioweb.AppRunner(web.build_app(ctl, sup))
+    await runner.setup()
+    site = aioweb.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    root = f"http://127.0.0.1:{site._server.sockets[0].getsockname()[1]}/"
+    try:
+        async with ClientSession() as s:
+            out = await steps(s, root, sup)
+    finally:
+        await runner.cleanup()
+    return out, sup
+
+
+async def _get(s, url):
+    async with s.get(url) as r:
+        return await r.json()
+
+
+async def _post(s, url, body):
+    async with s.post(url, json=body) as r:
+        try:
+            return r.status, await r.json()
+        except (ValueError, ContentTypeError):    # e.g. a plain-text 500
+            return r.status, {}
+
+
+STATES = [state("sensor.grid", "402"), state("number.inv1_power", "0"),
+          state("sensor.inv1_level", "62", "%", "battery"),
+          state("sensor.inv1_battery", "-800"),
+          state("sensor.pv", "-1200", "W", "power"),
+          state("sensor.net", "-3.1", "kW", "power")]
+
+
+async def _steps(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    model = copy.deepcopy(m["ui"])
+    model["inverters"][0]["setpoint_entity"] = ""
+    return (await _post(s, root + "config/validate", {"model": model}))[1]
+
+
+_r, _sup = asyncio.run(session(Controller(NEW, STATES), NEW, _steps))
+print(f"    blank power request entity: steps {_r['steps']}")
+check("over HTTP, a blank power request entity blocks step 2 and no other",
+      _r["steps"]["2"] >= 1
+      and all(v == 0 for k, v in _r["steps"].items() if k != "2"))
+check("the page moves on only when the step's count is 0, the kettle test is "
+      "done on step 1, and the last step saves only with nothing red",
+      "if ((STEPS[n] || 0) > 0) { toast(W.toast.blocked.description); "
+      "firstBad(); return; }" in JS
+      and "if (n === 1 && !kettleOk())" in JS
+      and "if (WZ.blocked) { toast(WS.check.blocked.description); return; }"
+      in JS)
+
+# --------------------------------------------------------------------------- #
+print("\n4. first run: a new install opens the wizard, a working site not")
+# --------------------------------------------------------------------------- #
+S = uipage.setup_needed
+check("a new install: no Store file at this boot, never set up, control "
+      "never started or stopped",
+      S(NEW, {}, False, fresh=True) == "first_start"
+      and S(NEW, {"phase": "idle", "sign_tripped": False}, False, fresh=True)
+      == "first_start")
+check("a site that runs control, or ever ran or stopped it, is not sent to "
+      "the wizard", S(NEW, {}, True, fresh=True) is None
+      and S(NEW, {"auto": True}, False, fresh=True) is None
+      and S(NEW, {"auto": False}, False, fresh=True) is None)
+check("a site the wizard saved is not sent again",
+      S(NEW, {uipage.SETUP_DONE: "2026-09-28T10:00:00+00:00"}, False,
+        fresh=True) is None)
+# Review R1: the Stores the two TEST-23 add-ons really have (2026-09-28): no
+# `auto` (Start/Stop never pressed, auto_start off), no setup_done, stopped,
+# one of them in shadow for weeks. A Store read from a file is an old site.
+_T23_ADDON = dict.fromkeys((
+    "circ_reason", "circ_tripped", "last_completed", "last_start_attempt",
+    "maint_schema_version", "phase", "phase_started", "schema_version",
+    "sign_reason", "sign_tripped", "site_sign_reason", "site_sign_tripped",
+    "unit/inverter-a/last_completed", "unit/inverter-a/last_start_attempt",
+    "unit/inverter-a/phase", "unit/inverter-a/phase_started",
+    "unit/inverter-a/sign_reason", "unit/inverter-a/sign_tripped"))
+_T23_ARB = dict.fromkeys((
+    "circ_reason", "circ_tripped", "last_completed", "last_start_attempt",
+    "phase", "phase_started", "schema_version", "sign_reason", "sign_tripped",
+    "site_sign_reason", "site_sign_tripped", "unit/inverter-a/sign_reason",
+    "unit/inverter-a/sign_tripped"))
+check("an old site never started (the real TEST-23 Stores, one in shadow) is "
+      "not sent to the wizard: its Store came from a file (review R1)",
+      S(NEW, _T23_ADDON, False) is None and S(NEW, _T23_ARB, False) is None
+      and S(dict(NEW, shadow_mode="on"), _T23_ARB, False) is None
+      and S(NEW, {}, False) is None)
+check("stored options with no inverter to control always open it, whatever "
+      "the Store says",
+      S(DEFAULTS, {uipage.SETUP_DONE: "x", "auto": True}, True)
+      == "no_power_request"
+      and S(dict(DEFAULTS, inverters=[{"name": "a", "setpoint_entity": " "}]),
+            None, True) == "no_power_request")
+check("a list roster with a power request entity is set up",
+      S(dict(DEFAULTS, inverters=[{"name": "a", "setpoint_entity": "number.a"}]),
+        {"auto": True}, True) is None)
+check("without a Store the answer is no (never nag on a guess)",
+      S(NEW, None, False) is None)
+_sites = [(n, dict(DEFAULTS, **json.load(open(os.path.join(
+    HERE, "scenarios", "ux13", "test23", n))))) for n in sorted(os.listdir(
+        os.path.join(HERE, "scenarios", "ux13", "test23")))]
+_starting = [(n, o) for n, o in _sites if not validate_startup_config(o)]
+check(f"the TEST-23 sites that start, and run control, are not sent to the "
+      f"wizard ({[n for n, _o in _starting]})", len(_starting) >= 3
+      and all(S(o, {"auto": True, "phase": "idle"}, True) is None
+              for _n, o in _starting))
+check("...and the one that cannot start (no power request entity) is",
+      [S(o, {"auto": True}, True) for n, o in _sites
+       if (n, o) not in _starting] == ["no_power_request"])
+
+
+async def _first(s, root, sup):
+    out = {"model": await _get(s, root + "config/model?lang=en")}
+    m = out["model"]
+    model = copy.deepcopy(m["ui"])
+    model["peak_cap_w"] = 4000
+    out["plain"] = await _post(s, root + "config/save", {
+        "model": model, "fingerprint": m["fingerprint"]})
+    out["store_plain"] = dict(_store.data)
+    out["after_plain"] = await _get(s, root + "config/model?lang=en")
+    m = out["after_plain"]
+    model = copy.deepcopy(m["ui"])
+    out["wizard"] = await _post(s, root + "config/save", {
+        "model": model, "fingerprint": m["fingerprint"], "setup": "done"})
+    out["after"] = await _get(s, root + "config/model?lang=en")
+    return out
+
+
+_store = Store({"phase": "idle"}, fresh=True)
+_r, _sup = asyncio.run(session(Controller(NEW, STATES, _store), NEW, _first))
+check("over HTTP, /config/model says a new install needs setup, with the spec",
+      _r["model"]["setup_needed"] == "first_start"
+      and _r["model"]["setup"] == json.loads(json.dumps(SPEC)))
+check("a save from the Installer view does not count as setup",
+      _r["plain"][0] == 200 and _r["after_plain"]["setup_needed"]
+      == "first_start" and uipage.SETUP_DONE not in _r["store_plain"])
+check("the wizard's save writes the Store marker, and the wizard stops "
+      "opening by itself",
+      _r["wizard"][0] == 200 and _store.data.get(uipage.SETUP_DONE)
+      and _r["after"]["setup_needed"] is None)
+_r, _sup = asyncio.run(session(Controller(NEW, STATES, Store(_T23_ARB)), NEW,
+                               _first))
+check("over HTTP, an old site never started (a Store read from a file) is not "
+      "sent to the wizard (review R1)", _r["model"]["setup_needed"] is None)
+with tempfile.TemporaryDirectory() as _d:
+    from app.store import Store as _RealStore
+    _path = os.path.join(_d, "state.json")
+    _new = _RealStore(_path)
+    _new.set("phase", "idle")
+    _old = _RealStore(_path)
+    with open(_path, "w") as _fh:
+        _fh.write("{not json")
+    _bad = _RealStore(_path)
+check("app/store.py: fresh only when this boot found no state file (a new "
+      "/data), not after a save and not for an unreadable file",
+      _new.fresh is True and _old.fresh is False and _bad.fresh is False)
+_r, _sup = asyncio.run(session(Controller(NEW, STATES, Store({"auto": True}),
+                                          auto=True), NEW, _first))
+check("a working site's /config/model says no", _r["model"]["setup_needed"]
+      is None)
+check("the page goes to Setup by itself only when opened with no route and "
+      "only while still on Home",
+      "first: !location.hash" in io.open(os.path.join(
+          HERE, "app", "static", "app.js"), encoding="utf-8").read()
+      and 'if (M && M.setup_needed && location.hash === "#home") '
+          'location.hash = "#setup";' in JS)
+
+# --------------------------------------------------------------------------- #
+print("\n5. the last step's live checks")
+# --------------------------------------------------------------------------- #
+ROWS = {s["entity_id"]: {"entity_id": s["entity_id"], "state": s["state"],
+                         "unit": s["attributes"]["unit_of_measurement"]}
+        for s in STATES}
+SITE = dict(NEW, meter_entity="sensor.grid", soc_entity="sensor.inv1_level",
+            batt_entity="sensor.inv1_battery", pv_entity="sensor.pv")
+
+
+def tiers(notes):
+    return [(n.tier, n.text) for n in notes]
+
+
+_c = tiers(setup_checks(SITE, entities=ROWS))
+for t in _c:
+    print(f"    {t}")
+check("the meter reads, as the add-on will see it",
+      ("ok", "The meter reads 402 W taken from the grid now.") in _c)
+check("with the sign flipped, the same reading is fed in",
+      ("ok", "The meter reads 402 W fed into the grid now.") in tiers(
+          setup_checks(dict(SITE, meter_invert=True), entities=ROWS)))
+check("the power request entity exists in Home Assistant (a write cannot "
+      "tell: SAFETY-77)",
+      ("ok", "Home Assistant has number.inv1_power, the power request "
+             "entity.") in _c)
+check("the battery level reads, and the battery power with its direction",
+      ("ok", "The battery level reads 62 %.") in _c
+      and ("info", "The battery reads 800 W charging now, so check the "
+                   "inverter shows the same.") in _c)
+check("a solar entity below zero, not flipped, looks reversed",
+      ("warn", "sensor.pv reads below zero now, so turn on its “Reads "
+               "negative” switch in the Solar step.") in _c
+      and ("ok", "sensor.pv reads 1 200 W of solar production now.")
+      in tiers(setup_checks(dict(SITE, pv_invert_entities=["sensor.pv"]),
+                            entities=ROWS)))
+_miss = tiers(setup_checks(dict(SITE, setpoint_entity="number.typo"),
+                           entities=ROWS))
+check("a power request entity Home Assistant does not have is red, so the "
+      "wizard does not save",
+      ("bad", "Home Assistant has no entity number.typo, which “Inverter "
+              "setpoint entity” (setpoint_entity) names.") in _miss)
+check("a missing battery level entity is a warning, not red (the add-on "
+      "holds 0 W and says so)",
+      [t for t, x in tiers(setup_checks(dict(SITE, soc_entity="sensor.x"),
+                                        entities=ROWS))
+       if "sensor.x" in x] == ["warn"])
+_two = dict(DEFAULTS, meter_source="ha_signed", p1_net_entity="sensor.net",
+            inverters=[{"name": "a", "setpoint_entity": "number.inv1_power",
+                        "soc_entity": "sensor.inv1_level", "max_w": 2000,
+                        "bms_soc_floor": 10},
+                       {"name": "b", "setpoint_entity": "number.b",
+                        "max_w": 2000, "bms_soc_floor": 10}])
+_c2 = tiers(setup_checks(_two, entities=ROWS))
+check("with two inverters each is named, and a kW meter is shown as the "
+      "add-on reads it, beside the warning to pick a sensor in W",
+      ("ok", "The meter reads 3 W fed into the grid now.") in _c2
+      and [t for t, x in _c2 if "reads in kW" in x] == ["warn"]
+      and ("bad", "Home Assistant has no entity number.b, which “Inverter "
+                  "setpoint entity” for b (inverters.setpoint_entity) names.")
+      in _c2
+      and ("ok", "The battery level for a reads 62 %.") in _c2
+      and ("warn", "There is no battery level entity for b, so pick one in "
+                   "step 2 or the add-on holds 0 W.") in _c2)
+_dsmr = dict(SITE, meter_source="ha_dsmr", p1_import_entity="sensor.grid",
+             p1_export_entity="sensor.inv1_level")
+check("import and export are read as their difference",
+      ("ok", "The meter reads 340 W taken from the grid now.")
+      in tiers(setup_checks(dict(_dsmr), entities=dict(
+          ROWS, **{"sensor.inv1_level": {"state": "62", "unit": "W"}}))))
+_hw = dict(SITE, meter_source="homewizard_local", p1_host="192.0.2.5")
+check("a meter the add-on reads itself: its live reading when it already "
+      "runs on it, else a note that Home shows it after the restart",
+      ("ok", "The meter reads 250 W taken from the grid now.") in tiers(
+          setup_checks(_hw, entities=ROWS, running=_hw, meter_now_w=250))
+      and [t for t, x in tiers(setup_checks(_hw, entities=ROWS, running=SITE,
+                                            meter_now_w=250))
+           if "meter" in x] == ["info"])
+check("an unreadable meter is a warning",
+      ("warn", "sensor.grid reads unavailable now, so check it in Home "
+               "Assistant before you start.") in tiers(setup_checks(SITE, entities=dict(
+                   ROWS, **{"sensor.grid": {"state": "unavailable",
+                                            "unit": "W"}}))))
+_down = tiers(setup_checks(SITE, entities=None))
+check("Home Assistant down: red, because the power request entity cannot be "
+      "checked (review R4), and nothing claimed ok about an entity",
+      _down[0] == ("bad", "Home Assistant is not answering, so press Check "
+                          "again once it is back.")
+      and not [x for t, x in _down if t in ("ok", "bad") and "entity" in x])
+# Review R5: meter + solar + battery is the house's use, never below zero. A
+# battery giving 1 500 W whose sensor reads it the wrong way (-1 500 W).
+_rev = dict(ROWS, **{"sensor.pv": {"state": "0", "unit": "W"},
+                     "sensor.inv1_battery": {"state": "-1500", "unit": "W"}})
+_bal = ("warn", "The readings add up to -1 098 W of house use, so check each "
+                "battery's “Battery power sign is reversed” switch in step 2.")
+check("a battery sensor reading the wrong way while giving power is flagged "
+      "(review R5); not once its switch is on, not without solar, not with "
+      "the battery reading unknown, and not on the normal site",
+      _bal in tiers(setup_checks(SITE, entities=_rev))
+      and not [x for t, x in tiers(setup_checks(dict(SITE, batt_invert=True),
+                                                entities=_rev))
+               if "add up" in x]
+      and not [x for t, x in tiers(setup_checks(dict(SITE, pv_entity=""),
+                                                entities=_rev))
+               if "add up" in x]
+      and not [x for t, x in tiers(setup_checks(dict(SITE, batt_entity=""),
+                                                entities=_rev))
+               if "add up" in x]
+      and not [x for x in (t[1] for t in _c) if "add up" in x])
+_fixed = U.ui_to_options(dict(U.options_to_ui(SITE), **{
+    "ui.contract": "fixed", "ui.fallback": "fixed", "ui.fixed_price": 0.3}))
+_dyn = dict(SITE, price_provider="generic_dayahead")
+check("prices: known from a contract; for a feed, today's count when it "
+      "already runs, else after the restart; none when none is set",
+      ("ok", "Your prices come from your contract, so they are always known.")
+      in tiers(setup_checks(_fixed, entities=ROWS))
+      and ("ok", "Prices for today are in, for 20 of 24 hours.")
+      in tiers(setup_checks(_dyn, entities=ROWS, running=_dyn,
+                            prices_known=20))
+      and ("info", "Prices are fetched after the restart, and Home shows "
+                   "them.") in tiers(setup_checks(_dyn, entities=ROWS,
+                                                  running=SITE,
+                                                  prices_known=20))
+      and ("info", "No prices are set, so the batteries do not charge on "
+                   "price.") in _c)
+
+
+async def _final(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    model = copy.deepcopy(m["ui"])
+    model["inverters"][0]["setpoint_entity"] = "number.typo"
+    out = {"ok": (await _post(s, root + "config/validate",
+                              {"model": m["ui"], "setup": True}))[1],
+           "typo": (await _post(s, root + "config/validate",
+                                {"model": model, "setup": True}))[1],
+           "plain": (await _post(s, root + "config/validate",
+                                 {"model": m["ui"]}))[1]}
+    return out
+
+
+_r, _sup = asyncio.run(session(Controller(SITE, STATES, Store(), grid=402.0),
+                               SITE, _final))
+check("over HTTP, the last step gets the checks beside the refusals, read "
+      "from a fresh entity list",
+      [x["tier"] for x in _r["ok"]["setup"] if "number.inv1_power" in x["text"]]
+      == ["ok"] and not [m for m in _r["ok"]["messages"] if m["tier"] == "bad"]
+      and "setup" not in _r["plain"])
+check("...and a typed power request entity HA does not have is red there",
+      ["bad"] == [x["tier"] for x in _r["typo"]["setup"]
+                  if "number.typo" in x["text"]])
+
+
+async def _kettle(s, root, sup):
+    return (await _get(s, root + "ha/entities?entity=sensor.net"),
+            await _get(s, root + "ha/entities?entity=sensor.gone"))
+
+
+(_k, _gone), _sup = asyncio.run(session(Controller(SITE, STATES), SITE,
+                                        _kettle))
+check("the kettle test reads one entity now, in W, and says when it is not "
+      "there", _k == {"entity_id": "sensor.net", "found": True,
+                      "state": "-3.1", "unit": "kW", "watts": -3100.0}
+      and _gone["found"] is False and _gone["watts"] is None)
+
+# --------------------------------------------------------------------------- #
+print("\n6. the save goes through the P2 path and writes a valid blob")
+# --------------------------------------------------------------------------- #
+_plan = {"meter": "signed", "roster": "two", "solar": "two",
+         "prices": "daynight", "region": "flanders", "peak": "forecast",
+         "shadow": "on"}
+
+
+async def _wizard(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    model = B.browser(B.apply(m["ui"], _plan))
+    v = (await _post(s, root + "config/validate", {"model": model,
+                                                   "setup": True}))[1]
+    saved = await _post(s, root + "config/save", {
+        "model": model, "fingerprint": m["fingerprint"], "setup": "done"})
+    return v, saved
+
+
+_store = Store()
+(_v, _saved), _sup = asyncio.run(session(Controller(NEW, STATES, _store),
+                                         NEW, _wizard))
+_blob = _sup.writes[-1] if _sup.writes else {}
+check("the wizard's model validates clean and saves with 200",
+      not [m for m in _v["messages"] if m["tier"] == "bad"]
+      and _saved[0] == 200 and len(_sup.writes) == 1)
+check("the blob written starts: the shipped validator accepts it",
+      not validate_startup_config(_blob))
+check("it has what the six steps set: the net meter, two named inverters, "
+      "two solar rows with one flipped, day and night prices, the Flanders "
+      "levies, the peak limit, and shadow mode on",
+      _blob["meter_source"] == "ha_signed"
+      and [i["name"] for i in _blob["inverters"]] == ["inverter-1",
+                                                      "inverter-2"]
+      and _blob["setpoint_entity"] == ""
+      and _blob["pv_entities"] == ["sensor.pv_a", "sensor.pv_b"]
+      and _blob["pv_invert_entities"] == ["sensor.pv_b"]
+      and json.loads(_blob["static_profile"])["periods"][0]["eur_per_kwh"]
+      == 0.34 and _blob["price_taxes_eur_kwh"]
+      == U.REGION_PRESETS["flanders"]["taxes_eur_kwh"]
+      and _blob["peak_cap_w"] == 4200 and _blob["shadow_mode"] == "on")
+check("every key config.yaml declares is written, in the stored order",
+      list(_blob)[:len(NEW)] == list(NEW) and set(_blob) == set(NEW))
+check("the wizard saved without a restart of its own: the restart is a "
+      "second, confirmed request", _sup.restarts == 0
+      and 'JSON.stringify({ confirm: "restart" })' in JS.split(
+          "async function finish")[1])
+_all = B.blobs()
+_new = [(n, r) for n, _b, r in _all if n.startswith("new-")]
+_ok = [n for n, _b, r in _all if not r]
+print(f"    {len(_all)} blobs from {len(B.starts())} starts; "
+      f"{len(_ok)} accepted")
+check(f"every plan from a new install is accepted by the shipped validator "
+      f"({len(_new)} plans)", len(_new) >= 25 and not [n for n, r in _new
+                                                     if r])
+_windows = [(n, b) for n, b, r in _all if "periods" in n and not r]
+check(f"UX-13 P5: the time-window plans are among them and write the "
+      f"windows as typed ({len(_windows)} blobs)",
+      len(_windows) >= 12 and all(
+          len(json.loads(b["static_profile"])["periods"]) in (1, 2, 5)
+          for _n, b in _windows))
+_empty = [(n, r) for n, _b, r in _all if n.startswith("empty-")]
+check(f"every plan from a new install as shipped (no power request entity, "
+      f"setup-only mode) is accepted ({len(_empty)} plans)",
+      len(_empty) == len(_new) and not [n for n, r in _empty if r])
+check("every plan from the TEST-23 sites is accepted, except where the site "
+      "trades on price with a plan that has no meter or no prices, which the "
+      "last step then lists",
+      all(not r or ("options.arb" in n and "arbitrage_enabled" in r[0])
+          for n, _b, r in _all) and len(_ok) >= 100)
+check("every accepted blob keeps every option key (the Supervisor count, 78)",
+      all(set(b) == set(DEFAULTS) for _n, b, r in _all if not r))
+
+# --------------------------------------------------------------------------- #
+print("\n7. a stale save names only what changed elsewhere (P2 finding a)")
+# --------------------------------------------------------------------------- #
+
+
+async def _stale(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    sup.options["peak_cap_w"] = 5000              # the Configuration tab
+    model = copy.deepcopy(m["ui"])
+    model["price_timeout_s"] = 12                 # the operator's own edit
+    first = await _post(s, root + "config/save",
+                        {"model": model, "base": m["ui"],
+                         "fingerprint": m["fingerprint"]})
+    again = await _post(s, root + "config/save",
+                        {"model": model, "base": m["ui"],
+                         "fingerprint": first[1]["fingerprint"]})
+    return first, again
+
+
+(_first_r, _again), _sup = asyncio.run(session(Controller(SITE, STATES), SITE,
+                                                _stale))
+print(f"    changed_fields {_first_r[1]['changed_fields']}, moved "
+      f"{_first_r[1]['moved']}, changed {_first_r[1]['changed']}")
+check("the banner's list is the other surface's key only, not the operator's "
+      "own edit", _first_r[0] == 409
+      and _first_r[1]["changed_fields"] == ["peak_cap_w"]
+      and _first_r[1]["moved"] == ["peak_cap_w"])
+check("`changed` (stored against what this page would write) is only the "
+      "page's own edit, since a save writes only that (UX-15 F2)",
+      _first_r[1]["changed"] == ["price_timeout_s"])
+check("saving again with the new token is the deliberate second press: it "
+      "stores this page's own edit and keeps the other surface's change "
+      "(UX-15 F2)",
+      _again[0] == 200 and _sup.options["peak_cap_w"] == 5000
+      and _sup.options["price_timeout_s"] == 12)
+
+
+async def _two_pages(s, root, sup):
+    """The classic page and this one open the same blob; the classic one
+    saves first (the browser run found the token was dropped then)."""
+    m = await _get(s, root + "config/model?lang=en")
+    classic = await _get(s, root + "config/model?lang=en")
+    theirs = dict(classic["options"], peak_cap_w=5000)
+    await _post(s, root + "config/save", {"options": theirs,
+                                          "fingerprint": classic["fingerprint"]})
+    model = copy.deepcopy(m["ui"])
+    model["price_timeout_s"] = 12
+    return await _post(s, root + "config/save",
+                       {"model": model, "fingerprint": m["fingerprint"]})
+
+
+_r, _sup = asyncio.run(session(Controller(SITE, STATES), SITE, _two_pages))
+check("two pages on one blob: after the other page saved, this one's banner "
+      "still names only the other page's change",
+      _r[0] == 409 and _r[1]["changed_fields"] == ["peak_cap_w"])
+
+
+async def _unknown(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    sup.options["peak_cap_w"] = 5000
+    model = copy.deepcopy(m["ui"])
+    model["price_timeout_s"] = 12
+    return await _post(s, root + "config/save",
+                       {"model": model, "fingerprint": "not-handed-out"})
+
+
+_r, _sup = asyncio.run(session(Controller(SITE, STATES), SITE, _unknown))
+check("a token the add-on did not hand out (it restarted) falls back to "
+      "every key that differs, as before",
+      _r[0] == 409 and _r[1]["moved"] is None
+      and _r[1]["changed_fields"] == ["peak_cap_w", "price_timeout_s"])
+
+# --------------------------------------------------------------------------- #
+print("\n8. the wizard's words keep to STYLE")
+# --------------------------------------------------------------------------- #
+
+
+def _texts(node, path=""):
+    for k, v in node.items():
+        if isinstance(v, dict):
+            yield from _texts(v, f"{path}{k}.")
+        elif isinstance(v, str):
+            yield f"{path}{k}", v
+
+
+def _sentences(t):
+    return len(re.findall(r"[.!?](?:\s|$)", t))
+
+
+_long = [(p, t) for p, t in _texts(WS)
+         if len(t.split()) > (25 if p.endswith("description") else 6)
+         or (p.endswith("description") and _sentences(t) > 1) or ";" in t]
+check(f"every wizard string is one sentence of at most 25 words, or a name "
+      f"of at most 6 ({_long})", not _long and len(list(_texts(WS))) > 50)
+_rendered = [x for notes in (
+    setup_checks(SITE, entities=ROWS), _c2 and setup_checks(_two, entities=ROWS),
+    setup_checks(SITE, entities=None), setup_checks(_hw, entities=ROWS),
+    setup_checks(_fixed, entities=ROWS), setup_checks(SITE, entities=_rev),
+    setup_checks(dict(
+        SITE, soc_entity="sensor.gone", batt_entity="sensor.grid_x"),
+        entities=dict(ROWS, **{"sensor.grid": {"state": "x", "unit": "W"}})))
+    for x in (n.text for n in notes)]
+_over = [t for t in _rendered if len(t.split()) > 25 or _sentences(t) > 1
+         or ";" in t]
+check(f"every live check, rendered with real values, is one sentence of at "
+      f"most 25 words ({len(_rendered)} rendered, over: {_over})",
+      len(_rendered) > 20 and not _over)
+_dialogs = [WS["dialog"]["description"], WS["dialog_live"]["description"]]
+check("both restart dialogs name the 0 W, and the shadow one says it stays",
+      all("0 W" in d for d in _dialogs) and "shadow mode keeps them at 0 W"
+      in _dialogs[0])
+check("the wizard defaults to shadow mode: the switch starts on",
+      "shadowOn: true" in JS)
+check("the shadow switch never writes into V, which the Installer view saves "
+      "too: it goes only on the model the wizard posts (review R3)",
+      "V[M.setup.shadow.field]" not in JS and "V[s.field]" not in JS
+      and JS.count("model: posted()") == 2)
+check("a skip after a fall keeps saying the reading went down (review R2)",
+      "wrong: !!k.wrong }; drawStep();" in JS
+      and "WZ.kettle.wrong ? WS.kettle.skipped_wrong : WS.kettle.skipped" in JS
+      and 'const wrong = o.say === "none" ? !!k.wrong : o.sets == null;' in JS)
+_leak = sorted(k for k in TL.config_surface(D.CONFIG)[0] if re.search(
+    r"[^A-Za-z0-9_]" + re.escape(k) + r"[^A-Za-z0-9_]", JS))
+check(f"settings.js, wizard included, names no option key ({_leak})",
+      not _leak)
+
+# --------------------------------------------------------------------------- #
+print("\n9. UX-15: F1, F2, a missing meter entity, and step 1 after a skip")
+# --------------------------------------------------------------------------- #
+
+
+async def _f1(s, root, sup):
+    m = await _get(s, root + "config/model?lang=en")
+    price = copy.deepcopy(m["ui"])
+    price.update({"ui.contract": "daynight", "ui.fallback": "daynight",
+                  "ui.day_price": None, "ui.night_price": 0.25})
+    none = copy.deepcopy(m["ui"])
+    none["inverters"] = []
+    none[U.COUNT] = 0
+    return {"price": (await _post(s, root + "config/validate",
+                                  {"model": price, "setup": True}))[1],
+            "none": (await _post(s, root + "config/validate",
+                                 {"model": none}))[1],
+            "save": await _post(s, root + "config/save", {
+                "model": price, "base": m["ui"], "setup": "done",
+                "fingerprint": m["fingerprint"]})}
+
+
+_r, _sup = asyncio.run(session(Controller(SITE, STATES, Store(), grid=402.0),
+                               SITE, _f1))
+print(f"    empty day price: steps {_r['price'].get('steps')}")
+check("F1: a price the page cannot turn into options blocks step 4, beside "
+      "its own field",
+      _r["price"].get("steps", {}).get("4", 0) >= 1
+      and {"field": "ui.day_price", "card": None, "tier": "bad",
+           "text": WS_D["no_price"]["description"]} in _r["price"].get("messages", []))
+check("F1: ...and the last step's live checks still run on the rest",
+      [x["tier"] for x in _r["price"].get("setup", [])
+       if "number.inv1_power" in x["text"]] == ["ok"]
+      and any("402 W" in x["text"] for x in _r["price"]["setup"]))
+check("F1: no inverter card blocks step 2, not the last step alone",
+      _r["none"].get("steps", {}).get("2", 0) >= 1)
+check("F1: the save refuses it (422) and says which step to go back to",
+      _r["save"][0] == 422 and _r["save"][1]["steps"]["4"] >= 1
+      and _sup.writes == [])
+
+
+async def _tabs(s, root, sup):
+    """Two tabs open one blob. A saves a peak limit; B edited only the
+    timeout, gets the 409, and presses Save again."""
+    a = await _get(s, root + "config/model?lang=en")
+    b = await _get(s, root + "config/model?lang=en")
+    va = copy.deepcopy(a["ui"])
+    va["peak_cap_w"] = 4000
+    ra = await _post(s, root + "config/save", {
+        "model": va, "base": a["ui"], "fingerprint": a["fingerprint"]})
+    after_a = copy.deepcopy(sup.options)
+    vb = copy.deepcopy(b["ui"])
+    vb["price_timeout_s"] = 12
+    first = await _post(s, root + "config/save", {
+        "model": vb, "base": b["ui"], "fingerprint": b["fingerprint"]})
+    again = await _post(s, root + "config/save", {
+        "model": vb, "base": b["ui"], "fingerprint": first[1]["fingerprint"]})
+    return ra, after_a, first, again
+
+
+(_ra, _after_a, _first_b, _again_b), _sup = asyncio.run(
+    session(Controller(SITE, STATES), dict(SITE, peak_cap_w=3600), _tabs))
+_moved = sorted(k for k in _sup.options
+                if _sup.options[k] != _after_a.get(k))
+print(f"    A: {_ra[0]}, B: {_first_b[0]} then {_again_b[0]}; B's re-save "
+      f"moved {_moved}")
+check("F2: two tabs. A saves peak 4.0; B, which edited only the timeout, "
+      "gets the 409 naming the peak limit",
+      _ra[0] == 200 and _first_b[0] == 409
+      and _first_b[1]["changed_fields"] == ["peak_cap_w"])
+check("F2: B's second press keeps A's peak 4.0 and writes only B's own key",
+      _again_b[0] == 200 and _sup.options["peak_cap_w"] == 4000
+      and _sup.options["price_timeout_s"] == 12
+      and _moved == ["price_timeout_s"])
+_both = uipage.only_edits({"a": 2, "b": 1, "c": 5}, {"a": 1, "b": 1, "c": 3},
+                          {"a": 1, "b": 9, "c": 4, "d": 0})
+check("F2: only_edits() keeps every stored key the page did not edit, and a "
+      "key both edited takes this page's value (the deliberate press)",
+      _both == {"a": 2, "b": 9, "c": 5, "d": 0}
+      and list(_both) == ["a", "b", "c", "d"])
+
+_gone = tiers(setup_checks(dict(SITE, meter_entity="sensor.gone"),
+                           entities=ROWS))
+check("a meter entity Home Assistant does not have is red on the last step, "
+      "so the wizard does not save it with the kettle test skipped",
+      ("bad", "Home Assistant has no entity sensor.gone, which “Grid power "
+              "entity” (meter_entity) names.") in _gone)
+_net_gone = tiers(setup_checks(dict(SITE, meter_source="ha_signed",
+                                    p1_net_entity="sensor.gone"),
+                               entities=ROWS))
+check("...for a net or import and export meter too",
+      [t for t, x in _net_gone if "sensor.gone" in x] == ["bad"])
+from app.validate import config_notes                            # noqa: E402
+check("...while the Installer view keeps it a warning, which never blocks "
+      "a save there",
+      [n.tier for n in config_notes(dict(SITE, meter_entity="sensor.gone"),
+                                    entities=ROWS)
+       if "sensor.gone" in n.text] == ["warn"])
+
+check("step 1 after a skip that followed a fall says plainly that the "
+      "reading went down",
+      'k.say === "skipped" && k.wrong ? "skipped_down" : k.say' in JS
+      and "went down" in WS["kettle"]["skipped_down"]["description"]
+      and "not tested" not in WS["kettle"]["skipped_down"]["description"])
+check("in setup-only mode the wizard's restart dialog does not claim a 0 W "
+      "wind-down that nothing runs, and the shadow one says 0 W",
+      "M.setup_only ? (shadow ? WS.dialog_setup : WS.dialog_setup_live)" in JS
+      and "0 W" in WS["dialog_setup"]["description"]
+      and "0 W" not in WS["dialog_setup_live"]["description"])
+check("the page posts the model it opened with every save (F2)",
+      "model: V, base: ORIG, fingerprint: FP" in JS)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_setup_only.py b/goodwe_controller/test_setup_only.py
new file mode 100644
index 0000000..3da2d5e
--- /dev/null
+++ b/goodwe_controller/test_setup_only.py
@@ -0,0 +1,494 @@
+"""UX-15: setup-only mode.  `python3 test_setup_only.py`
+
+A new install names no inverter, and instead of exiting 78 it serves the setup
+wizard and commands nothing (DECISIONS/UX-15-setup-only-mode.md).
+Part 1 checks when it applies. Part 2 the write path refuses in that mode.
+Part 3 boots the REAL `app.main.main()` in a child process (this file with
+`--driver`) against a fake Supervisor and Home Assistant over HTTP, and logs
+every request they get: the shipped defaults serve the wizard with no service
+call, also with `auto_start` on, a Store that says control was started and a
+Start pressed on the page; the wizard saves; the next boot passes the normal
+gate and runs in shadow. Part 4: a refused but complete configuration still
+exits 78 and serves nothing.
+Takes ~25 s. Mutating a module this file grades? Read MUTATION.md first.
+"""
+
+import asyncio
+import copy
+import json
+import os
+import shutil
+import signal
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+DEADLINE_S = 60
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def defaults():
+    import ux13_demo as D
+    return D.defaults(D.CONFIG)
+
+
+def state(eid, value, unit="W", cls=None, **attrs):
+    return {"entity_id": eid, "state": value,
+            "attributes": dict({"friendly_name": eid,
+                                "unit_of_measurement": unit,
+                                "device_class": cls}, **attrs)}
+
+
+STATES = [state("sensor.grid", "402"),
+          state("number.inv1_power", "0", min=-2500, max=2500, step=1),
+          state("sensor.inv1_level", "62", "%", "battery"),
+          state("sensor.inv1_battery", "0")]
+
+
+# --------------------------------------------------------------------------- #
+# The child: the real main(), with only the outside world faked over HTTP.
+# --------------------------------------------------------------------------- #
+def driver(scenario, work):
+    """`work` holds options.json, state.json and the files the parent reads.
+    Every request the fakes get is streamed as `EV [...]` lines."""
+    import aiohttp
+    from aiohttp import web as aioweb
+    from aiohttp.abc import AbstractResolver
+    import app.main as M
+    import app.store
+    import app.web
+    import ux13_demo as D
+    import ux13_wizard_blobs as B
+    import translations_lint as TL
+
+    def event(*e):
+        print("EV " + json.dumps(list(e)), flush=True)
+
+    opts = json.load(open(os.path.join(work, "options.json")))
+    stored = {"options": copy.deepcopy(opts)}
+    schema = D.schema_ui(D.CONFIG)
+    translations = {"en": TL.parse_translation_file(
+        os.path.join(HERE, "translations", "en.yaml"))}
+
+    # --- the fake Supervisor and Home Assistant ---------------------------
+    async def h_probe(_r):
+        event("GET", "/core/api/")
+        return aioweb.Response(text="API running.")
+
+    async def h_states(_r):
+        event("GET", "/core/api/states")
+        return aioweb.json_response(STATES)
+
+    async def h_state(r):
+        eid = r.match_info["eid"]
+        event("GET", "/core/api/states/" + eid)
+        found = next((s for s in STATES if s["entity_id"] == eid), None)
+        return (aioweb.json_response(found) if found
+                else aioweb.json_response({"message": "not found"}, status=404))
+
+    async def h_service(r):
+        body = await r.json()
+        event("SERVICE", r.match_info["domain"], r.match_info["service"], body)
+        return aioweb.json_response([])
+
+    async def h_mqtt(_r):
+        event("GET", "/services/mqtt")
+        return aioweb.json_response({"result": "error"}, status=400)
+
+    async def h_info(_r):
+        return aioweb.json_response({"data": {"slug": "local_goodwe",
+                                              "homeassistant": "2026.9.1"}})
+
+    async def h_self_info(_r):
+        return aioweb.json_response({"data": {
+            "slug": "local_goodwe", "options": stored["options"],
+            "schema": schema, "translations": translations}})
+
+    async def h_options(r):
+        body = await r.json()
+        stored["options"] = body["options"]
+        event("OPTIONS")
+        with open(os.path.join(work, "saved.json"), "w") as f:
+            json.dump(body["options"], f)
+        return aioweb.json_response({"result": "ok", "data": {}})
+
+    async def h_restart(_r):
+        event("RESTART")
+        return aioweb.json_response({"result": "ok", "data": {}})
+
+    async def h_other(r):
+        event("OTHER", r.method, r.path)
+        return aioweb.json_response({}, status=404)
+
+    fake = aioweb.Application()
+    fake.add_routes([
+        aioweb.get("/core/api/", h_probe),
+        aioweb.get("/core/api/states", h_states),
+        aioweb.get("/core/api/states/{eid}", h_state),
+        aioweb.post("/core/api/services/{domain}/{service}", h_service),
+        aioweb.get("/services/mqtt", h_mqtt),
+        aioweb.get("/info", h_info),
+        aioweb.get("/addons/self/info", h_self_info),
+        aioweb.post("/addons/self/options", h_options),
+        aioweb.post("/addons/self/restart", h_restart),
+        aioweb.route("*", "/{tail:.*}", h_other)])
+
+    fake_port = free_port()
+
+    class ToFake(AbstractResolver):
+        """`http://supervisor` is the fake, on its port."""
+        async def resolve(self, host, port=0, family=socket.AF_INET):
+            return [{"hostname": host, "host": "127.0.0.1", "port": fake_port,
+                     "family": socket.AF_INET, "proto": 0, "flags": 0}]
+
+        async def close(self):
+            pass
+
+    Real = aiohttp.ClientSession
+
+    def session(*a, **k):
+        k.setdefault("connector", aiohttp.TCPConnector(resolver=ToFake()))
+        return Real(*a, **k)
+
+    aiohttp.ClientSession = session
+    os.environ["SUPERVISOR_TOKEN"] = "test-token"
+    M.OPTIONS_PATH = os.path.join(work, "options.json")
+    app.store.STATE_PATH = os.path.join(work, "state.json")
+    M.INGRESS_PORT = free_port()
+    kw = M.Controller.__init__.__kwdefaults__
+    kw["peak_db_path"] = os.path.join(work, "tariff.db")
+    kw["price_history_path"] = os.path.join(work, "price_history.json")
+
+    served = []
+    real_start = app.web.start
+
+    async def start(controller, port=8099, selfcfg=None):
+        runner = await real_start(controller, port, selfcfg)
+        served.append(type(controller).__name__)        # listening now
+        event("SERVED", type(controller).__name__,
+              getattr(controller.hass, "read_only", None))
+        return runner
+
+    app.web.start = start
+    real_amain = M.amain
+    root = f"http://127.0.0.1:{M.INGRESS_PORT}/"
+
+    async def ask(s, method, path, body=None):
+        async with s.request(method, root + path, json=body) as r:
+            try:
+                out = await r.json(content_type=None)
+            except ValueError:
+                out = None
+            event("PAGE", method, path, r.status, out)
+            return r.status, out
+
+    async def scenario_steps():
+        async with Real() as s:
+            await ask(s, "GET", "status")
+            _st, model = await ask(s, "GET", "config/model?lang=en")
+            event("STATE_FILE", os.path.exists(app.store.STATE_PATH))
+            await ask(s, "POST", "action", {"action": "auto_toggle"})
+            if scenario.startswith("setup"):
+                await ask(s, "POST", "action", {"action": "maint_start"})
+                wiz = B.apply(model["ui"], B.BASE)
+                wiz = B.browser(json.loads(json.dumps(wiz)))
+                await ask(s, "POST", "config/validate",
+                          {"model": wiz, "setup": True})
+                event("STATE_FILE", os.path.exists(app.store.STATE_PATH))
+                await ask(s, "POST", "config/save",
+                          {"model": wiz, "base": model["ui"],
+                           "fingerprint": model["fingerprint"],
+                           "setup": "done"})
+                await ask(s, "POST", "config/restart", {"confirm": "restart"})
+            await asyncio.sleep(3.0)        # room for any stray task to write
+            await ask(s, "GET", "status")
+
+    async def wrapped():
+        runner = aioweb.AppRunner(fake)
+        await runner.setup()
+        await aioweb.TCPSite(runner, "127.0.0.1", fake_port).start()
+        task = asyncio.create_task(real_amain())
+        try:
+            t0 = time.monotonic()
+            while not served and not task.done() \
+                    and time.monotonic() - t0 < 20:
+                await asyncio.sleep(0.05)
+            if task.done():
+                event("ENDED_BEFORE_SERVING")
+                await task
+                return
+            await scenario_steps()
+            os.kill(os.getpid(), signal.SIGTERM)    # the Supervisor's stop
+            await asyncio.wait_for(task, 20)
+        finally:
+            await runner.cleanup()
+
+    M.amain = wrapped
+    M.main()
+
+
+def free_port():
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def run_child(scenario, options, state=None):
+    work = tempfile.mkdtemp(prefix="ux15-")
+    with open(os.path.join(work, "options.json"), "w") as f:
+        json.dump(options, f)
+    if state is not None:
+        with open(os.path.join(work, "state.json"), "w") as f:
+            json.dump(state, f)
+    env = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
+    try:
+        p = subprocess.run([sys.executable, "-B", __file__, "--driver",
+                            scenario, work], cwd=HERE, env=env,
+                           capture_output=True, text=True, timeout=DEADLINE_S)
+        rc, out, err = p.returncode, p.stdout, p.stderr
+    except subprocess.TimeoutExpired as e:
+        rc, out, err = None, e.stdout or "", e.stderr or ""
+    out = out.decode() if isinstance(out, bytes) else out
+    err = err.decode() if isinstance(err, bytes) else err
+    ev = [json.loads(ln[3:]) for ln in out.splitlines() if ln.startswith("EV ")]
+    files = {}
+    for name in ("saved.json", "state.json"):
+        path = os.path.join(work, name)
+        if os.path.exists(path):
+            files[name] = json.load(open(path))
+    shutil.rmtree(work, ignore_errors=True)
+    return rc, ev, err, files
+
+
+def page(ev, method, path):
+    """(status, body) of each page request, in order."""
+    return [(e[3], e[4]) for e in ev
+            if e[0] == "PAGE" and e[1] == method and e[2].startswith(path)]
+
+
+def tail(text, n=12):
+    return "\n".join("      | " + ln for ln in text.splitlines()[-n:])
+
+
+if len(sys.argv) == 4 and sys.argv[1] == "--driver":
+    driver(sys.argv[2], sys.argv[3])
+    sys.exit(0)
+
+
+# --------------------------------------------------------------------------- #
+print("1. when setup-only mode applies")
+# --------------------------------------------------------------------------- #
+from app import setuponly                                        # noqa: E402
+from app.validate import validate_startup_config                 # noqa: E402
+
+SHIPPED = defaults()
+V = validate_startup_config
+check("the shipped defaults are refused only for the missing power request "
+      "entity, and that is setup-only mode",
+      setuponly.applies(SHIPPED, V(SHIPPED)) and len(V(SHIPPED)) == 1)
+_blank_bad = dict(SHIPPED, maintenance_charge_w=2500)
+check("no power request entity AND another refusal: not setup-only, exit 78",
+      len(V(_blank_bad)) >= 2 and not setuponly.applies(_blank_bad,
+                                                       V(_blank_bad)))
+_complete_bad = dict(SHIPPED, setpoint_entity="number.inv1_power",
+                     maintenance_charge_w=2500)
+check("a complete configuration that is refused: not setup-only, exit 78",
+      V(_complete_bad) and not setuponly.applies(_complete_bad,
+                                                 V(_complete_bad)))
+_list_blank = dict(SHIPPED, inverters=[{
+    "name": "inverter-a", "setpoint_entity": "", "soc_entity": "sensor.s",
+    "batt_entity": "sensor.b", "max_w": 2000, "bms_soc_floor": 10}])
+check("an inverter list whose entry has no power request entity: not "
+      "setup-only (someone edited it), exit 78",
+      V(_list_blank) and not setuponly.applies(_list_blank, V(_list_blank)))
+_ok = dict(SHIPPED, setpoint_entity="number.inv1_power")
+check("a startable configuration: nothing refused, the normal start",
+      V(_ok) == [] and not setuponly.applies(_ok, V(_ok)))
+
+# --------------------------------------------------------------------------- #
+print("\n2. in setup-only mode the write path refuses")
+# --------------------------------------------------------------------------- #
+from app import hass as H                                         # noqa: E402
+import app.main as M                                              # noqa: E402
+
+
+class Session:
+    """Records every request a HomeAssistant would send."""
+
+    def __init__(self):
+        self.sent = []
+
+    def post(self, url, **k):
+        self.sent.append(("POST", url))
+        raise AssertionError("a request was sent")
+
+    def get(self, url, **k):
+        self.sent.append(("GET", url))
+        raise AssertionError("a request was sent")
+
+
+def _refused(coro):
+    """True only for the read-only refusal; a request that reached the
+    session (AssertionError there) or no refusal at all is False."""
+    try:
+        asyncio.run(coro)
+    except H.ReadOnly:
+        return True
+    except Exception:                                   # noqa: BLE001
+        return False
+    return False
+
+
+_s = Session()
+_ro = H.HomeAssistant(_s, "t", read_only=True)
+check("a read-only HomeAssistant refuses number.set_value before it sends "
+      "anything", _refused(_ro.set_number("number.inv1_power", 0.0))
+      and _s.sent == [])
+check("...and any other service call, e.g. a notification",
+      _refused(_ro.call("persistent_notification", "create",
+                        {"message": "x"})) and _s.sent == [])
+try:
+    _ro.read_only = False
+    _flipped = True
+except AttributeError:
+    _flipped = False
+check("...and read-only cannot be switched off afterwards",
+      not _flipped and _ro.read_only is True)
+_rw = H.HomeAssistant(Session(), "t")
+try:
+    asyncio.run(_rw.set_number("number.inv1_power", 0.0))
+    _sent = False
+except AssertionError:
+    _sent = True
+check("control: a normal HomeAssistant does send the write", _sent
+      and _rw.read_only is False)
+try:
+    M.Controller(dict(_ok), _ro, None, None, stop=asyncio.Event())
+    _built = True
+except ValueError as err:
+    _built = "read-only" not in str(err)
+except Exception:                                       # noqa: BLE001
+    _built = True           # it got past the check and failed on something else
+check("no controller can be built on a read-only HomeAssistant", not _built)
+try:
+    setuponly.SetupOnly(SHIPPED, _rw, None)
+    _took = True
+except ValueError:
+    _took = False
+check("setup-only mode refuses a HomeAssistant that can write", not _took)
+_so = setuponly.SetupOnly(SHIPPED, _ro, None)
+check("setup-only mode holds no inverter and never says control is started",
+      list(_so.inverters) == [] and _so.auto is False
+      and _so.status_payload()["setup_only"] is True)
+
+# --------------------------------------------------------------------------- #
+print("\n3. the real main(): the shipped defaults serve the wizard, 0 writes")
+# --------------------------------------------------------------------------- #
+_runs = {
+    "setup": (dict(SHIPPED), None),
+    # A started-control attempt three ways: auto_start on, a Store that says
+    # control was started, and the page's own Start (the driver presses it).
+    "setup_started": (dict(SHIPPED, auto_start=True), {"auto": True}),
+}
+SAVED = None
+for name, (options, st) in _runs.items():
+    rc, ev, err, files = run_child(name, options, st)
+    services = [e for e in ev if e[0] == "SERVICE"]
+    print(f"    {name}: exit {rc}, {len(ev)} requests logged, "
+          f"{len(services)} service calls")
+    check(f"{name}: the process served the page in setup-only mode on a "
+          "read-only HomeAssistant, and exited 0 when stopped",
+          rc == 0 and ["SERVED", "SetupOnly", True] in ev)
+    if rc != 0:
+        print(tail(err))
+    check(f"{name}: 0 service calls to Home Assistant (no set_value, no "
+          "notification), and MQTT was never asked for",
+          services == [] and ["GET", "/services/mqtt"] not in ev)
+    _status = page(ev, "GET", "status")
+    check(f"{name}: /status says setup_only, with the setup banner",
+          _status and all(b and b.get("setup_only") is True
+                          and b.get("mode") == "setup_only"
+                          and b.get("banner", "").startswith("Setup")
+                          for _c, b in _status))
+    _model = page(ev, "GET", "config/model")
+    check(f"{name}: the page model opens the wizard (no power request) and "
+          "says setup-only",
+          _model and _model[0][1]["setup_needed"] == "no_power_request"
+          and _model[0][1]["setup_only"] is True)
+    _acts = page(ev, "POST", "action")
+    check(f"{name}: Start and the battery cycle are refused with 409",
+          len(_acts) == 2 and all(c == 409 for c, _b in _acts))
+    check(f"{name}: setup-only mode writes no Store file before the wizard "
+          "saves, so the first-run rule still sees a new install",
+          [e for e in ev if e[0] == "STATE_FILE"][:2]
+          == [["STATE_FILE", st is not None]] * 2)
+    _val = page(ev, "POST", "config/validate")
+    check(f"{name}: the wizard's live checks run and find nothing red",
+          _val and _val[0][0] == 200
+          and not [m for m in _val[0][1]["messages"] if m["tier"] == "bad"]
+          and not [m for m in _val[0][1]["setup"] if m["tier"] == "bad"])
+    _save = page(ev, "POST", "config/save")
+    check(f"{name}: the wizard saves (200) and asks for the restart",
+          _save and _save[0][0] == 200 and ["RESTART"] in ev
+          and "saved.json" in files)
+    check(f"{name}: the Store gets setup_done from the save",
+          bool(files.get("state.json", {}).get("setup_done")))
+    if name == "setup":
+        SAVED, SAVED_STATE = files.get("saved.json"), files.get("state.json")
+
+check("the saved blob passes the normal gate: no refusal, not setup-only",
+      SAVED is not None and V(SAVED) == []
+      and not setuponly.applies(SAVED, V(SAVED))
+      and SAVED.get("shadow_mode") == "on")
+
+print("\n    after the restart, on the saved settings:")
+rc, ev, err, files = run_child("after", SAVED or {}, SAVED_STATE)
+services = [e for e in ev if e[0] == "SERVICE"]
+writes = [e[3].get("value") for e in services
+          if e[1:3] == ["number", "set_value"]]
+print(f"    after: exit {rc}, {len(services)} service calls, set_value "
+      f"values {sorted(set(writes))}")
+check("the next boot passes the normal gate: a Controller serves the page, "
+      "and it exits 0 when stopped", rc == 0 and ["SERVED", "Controller",
+                                                   False] in ev)
+if rc != 0:
+    print(tail(err))
+check("...where Start is accepted (200), unlike in setup-only mode",
+      [c for c, _b in page(ev, "POST", "action")] == [200])
+_status = page(ev, "GET", "status")
+check("...its /status is not setup-only", _status and all(
+    b and "setup_only" not in b for _c, b in _status))
+_model = page(ev, "GET", "config/model")
+check("...and the wizard does not open again: setup_done is in the Store",
+      _model and _model[0][1]["setup_needed"] is None
+      and _model[0][1]["setup_only"] is False)
+check("...and it runs in shadow, even after Start: every service call is "
+      "number.set_value 0 W", writes and len(writes) == len(services)
+      and all(w == 0.0 for w in writes))
+
+# --------------------------------------------------------------------------- #
+print("\n4. a refused configuration that is not only missing setup: exit 78")
+# --------------------------------------------------------------------------- #
+for name, options in (("refused", _complete_bad), ("refused_blank", _blank_bad)):
+    rc, ev, err, _files = run_child(name, options)
+    print(f"    {name}: exit {rc}")
+    check(f"{name}: exit 78 and nothing served, no service call",
+          rc == 78 and not [e for e in ev if e[0] in ("SERVED", "SERVICE")]
+          and ["ENDED_BEFORE_SERVING"] in ev)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_static_tariff.py b/goodwe_controller/test_static_tariff.py
index d5d6d38..cc9f2d1 100644
--- a/goodwe_controller/test_static_tariff.py
+++ b/goodwe_controller/test_static_tariff.py
@@ -63,6 +63,8 @@ import ast
 import gzip
 import json
 import sys
+
+from named_absence import first
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
@@ -525,7 +527,7 @@ check("...and arbitrage is refused, per §11.4",
       _none.arbitrage(peak_guard_active=False, min_spread_eur_kwh=0.0, uncertainty=frozenset()).kind == "refused"
       and arbitrage_allowed(_none.read) is False)
 check("...and static_status() says so in words rather than reporting a price",
-      static_status(opts(None), THU) == (False, "no static profile"))
+      static_status(opts(None), THU) == (False, "No fixed tariff set"))
 
 # ⚠️ THE TILING REFUSAL. An uncovered hour has no price and the only ways to
 # serve it are to invent one or to fail when the clock reaches it.
@@ -848,7 +850,7 @@ check("a good static_profile starts",
 check("a gapped one is REFUSED at startup, not at 22:00 on the day it bites",
       why(validate_startup_config(vbase(static_profile=json.dumps(_gap)),
                                   -5000, 5000),
-          "static_profile cannot be used"))
+          "“Fixed or day/night tariff” cannot be used"))
 check("...and the refusal names the uncovered range",
       why(validate_startup_config(vbase(static_profile=json.dumps(_gap)),
                                   -5000, 5000), "22:00-23:00"))
@@ -857,7 +859,7 @@ check("static_profile alongside the Home Assistant price entities is refused - "
       why(validate_startup_config(
           vbase(static_profile=json.dumps(TWO_PERIOD),
                 price_now_entity="sensor.now", price_avg_entity="sensor.avg"),
-          -5000, 5000), "HOME ASSISTANT"))
+          -5000, 5000), "(price_avg_entity) would win over it"))
 check("...and the Home Assistant pair ALONE still starts, so nothing is taken "
       "away from a live install",
       validate_startup_config(vbase(price_now_entity="sensor.now",
@@ -1213,8 +1215,9 @@ check("...and the pin is not vacuous: each of those names really is a "
 
 def _t17_sig(module, name):
     tree = ast.parse((HERE / "app" / module).read_text(encoding="utf-8"))
-    fn = next(n for n in tree.body
-              if isinstance(n, ast.FunctionDef) and n.name == name)
+    fn = first((n for n in tree.body
+                if isinstance(n, ast.FunctionDef) and n.name == name),
+               f"def {name} in {module}")
     return [a.arg for a in fn.args.args]
 
 
diff --git a/goodwe_controller/test_tariff.py b/goodwe_controller/test_tariff.py
index e18a076..d1a6069 100644
--- a/goodwe_controller/test_tariff.py
+++ b/goodwe_controller/test_tariff.py
@@ -90,9 +90,9 @@ guard has to improve on, which is the useful thing a 2-day replay can say.
 
 The two days are committed here as `scenarios/p1-net-<date>.jsonl.gz`
 (`{"t": iso8601, "w": signed_watts}` per line, derived from the HA recorder
-export) for the reason `scenarios/p1-age-2026-08-26.jsonl.gz` already is: the
-infra repo is private, CI's token is minted for this repository only, and a
-regression fixture that CI cannot see is not a regression fixture.
+export), as `scenarios/p1-age-2026-08-26.jsonl.gz` already is. When they were
+committed, CI could not see the infra repo; since CI-12 it checks admin/goodwe
+out at `.gitea/infra-pin`, but these fixtures stay here with the tests.
 
 The recorder's window rolls: 2026-08-01 leaves it around 2026-09-15, which is
 why the committed copy is the artefact and not the API call.
@@ -114,6 +114,9 @@ import tempfile
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+from named_absence import given, nth, present
+
+from app import messages
 from app.main import Controller
 from app.p1 import P1Ingest, QuarterAverager, QUARTER_S, make_sample, split_signed
 from app.tariff import (
@@ -260,7 +263,7 @@ deg = QuarterAverager(phases=1, max_hold_s=MAX_HOLD_S)
 deg_closed = []
 for i in range(0, QUARTER_S + 1, 5):
     deg_closed += deg.add(sample(B + timedelta(seconds=i), HELD_W))
-d_block = deg_closed[0].offtake_avg_w
+d_block = nth(deg_closed, 0).offtake_avg_w
 deg2 = QuarterAverager(phases=1, max_hold_s=MAX_HOLD_S)
 LAST_S = QUARTER_S - 5
 for i in range(0, LAST_S + 1, 5):
@@ -311,7 +314,7 @@ def feed(avg, t0_s, t1_s, w=RUN_W):
 # (a) the control: no restart at all.
 ctrl = QuarterAverager(phases=1, max_hold_s=MAX_HOLD_S)
 ctrl_closed = feed(ctrl, 0, QUARTER_S)
-CTRL_W = ctrl_closed[0].offtake_avg_w
+CTRL_W = nth(ctrl_closed, 0).offtake_avg_w
 
 # (b) restarted at minute 10, checkpoint restored through a real SQLite file.
 st = fresh_store("restart")
@@ -332,8 +335,8 @@ a3 = QuarterAverager(phases=1, max_hold_s=MAX_HOLD_S)
 n_closed = feed(a3, RESTART_AT_S + STEP_S, QUARTER_S)
 NORESTORE_W = n_closed[0].offtake_avg_w if n_closed else None
 
-print(f"    uninterrupted {CTRL_W:.2f} W | restored {RESTART_W:.2f} W | "
-      f"restart with no restore {NORESTORE_W:.2f} W")
+print(f"    uninterrupted {CTRL_W:.2f} W | restored {given(RESTART_W):.2f} W | "
+      f"restart with no restore {given(NORESTORE_W):.2f} W")
 check(f"a restart at {RESTART_AT_S} s lands on the SAME billed block as an "
       f"uninterrupted run", near(RESTART_W, CTRL_W, 1e-6))
 check("...and without the restore it lands LOWER - so 'the restore works' is "
@@ -357,18 +360,18 @@ o_closed = feed(a4, RESTART_AT_S + OUTAGE_S, QUARTER_S)
 OUTAGE_UNCOVERED_S = OUTAGE_S - MAX_HOLD_S
 print(f"    a {OUTAGE_S} s outage inside the quarter, of which "
       f"{OUTAGE_UNCOVERED_S:.0f} s is past the {MAX_HOLD_S:.0f} s hold: "
-      f"{o_closed[0].offtake_avg_w:.2f} W")
+      f"{nth(o_closed, 0).offtake_avg_w:.2f} W")
 check(f"...reads lower than the uninterrupted block by exactly the uncovered "
       f"seconds ({RUN_W * OUTAGE_UNCOVERED_S / QUARTER_S:.2f} W) - a gap is "
       f"never held forward across the whole outage",
-      near(CTRL_W - o_closed[0].offtake_avg_w,
+      near(CTRL_W - nth(o_closed, 0).offtake_avg_w,
            RUN_W * OUTAGE_UNCOVERED_S / QUARTER_S, 1e-6))
 
 # (e) double counting is answered by the primary key, not by care.
 st5 = fresh_store("dedupe")
-st5.record_block(ctrl_closed[0])
-st5.record_block(ctrl_closed[0])
-st5.record_block(ctrl_closed[0])
+if ctrl_closed:
+    for _ in range(3):
+        st5.record_block(ctrl_closed[0])
 rows = st5.blocks_in(month_key(B))
 check("banking the same quarter three times leaves ONE row - quarter_start is "
       "the primary key, so a replay or a restart cannot double-count",
@@ -376,7 +379,9 @@ check("banking the same quarter three times leaves ONE row - quarter_start is "
 
 # ...and a later pass with LESS coverage may not lower a banked figure.
 from app.tariff import _ClosedBlock as _CB
-st5.record_block(_CB(start=B, offtake_avg_w=CTRL_W / 2, per_phase_offtake_avg_w=None))
+if present(CTRL_W):
+    st5.record_block(_CB(start=B, offtake_avg_w=CTRL_W / 2,
+                         per_phase_offtake_avg_w=None))
 after = st5.blocks_in(month_key(B))
 check(f"...and re-banking the same quarter at half the figure leaves it at "
       f"{CTRL_W:.0f} W - a restart's partial re-run must never lower a "
@@ -443,7 +448,7 @@ print(f"    restore() across the boundary said: {said}")
 aug7, sep7 = st7.peak(month="2026-08"), st7.peak(month="2026-09")
 check("a restart that straddles the month boundary BANKS the dead August "
       "quarter rather than dropping measured energy",
-      said.startswith("closed a stale block") and aug7.is_observed)
+      said.startswith("closed the 15-minute period") and aug7.is_observed)
 check(f"...at its partial-coverage figure ({aug7.peak_w:.2f} W = "
       f"{RUN_W * 399 / QUARTER_S:.2f} W, the seconds it actually covered)",
       near(aug7.peak_w, RUN_W * 399 / QUARTER_S, 1e-6))
@@ -665,10 +670,10 @@ u = QuarterAverager(phases=3, max_hold_s=MAX_HOLD_S)
 u_closed = []
 for i in range(0, QUARTER_S + 1, 5):
     u_closed += u.add(sample(B + timedelta(seconds=i), NET, phases=3, phase_net=PH))
-blk = u_closed[0]
+blk = nth(u_closed, 0)
 vals = {p: billed_w(blk, p) for p in (POLICY_NET, POLICY_SUM, POLICY_MAX)}
 print(f"    phases {PH} (net {NET:+.0f} W) -> "
-      + ", ".join(f"{k}={v:.0f} W" for k, v in vals.items()))
+      + ", ".join(f"{k}={given(v):.0f} W" for k, v in vals.items()))
 check(f"the NET policy bills the connection's net offtake ({NET:.0f} W)",
       near(vals[POLICY_NET], NET, 1e-6))
 check(f"the SUM policy clips each phase first, so the exporting phase does not "
@@ -687,7 +692,7 @@ b_closed = []
 for i in range(0, QUARTER_S + 1, 5):
     b_closed += bal.add(sample(B + timedelta(seconds=i), 3000.0, phases=3,
                                phase_net=(1000.0, 1000.0, 1000.0)))
-b_vals = {p: billed_w(b_closed[0], p) for p in (POLICY_NET, POLICY_SUM, POLICY_MAX)}
+b_vals = {p: billed_w(nth(b_closed, 0), p) for p in (POLICY_NET, POLICY_SUM, POLICY_MAX)}
 check(f"...and on a BALANCED load NET and SUM coincide ({b_vals[POLICY_NET]:.0f} W), "
       f"so a balanced fixture could not have told them apart",
       near(b_vals[POLICY_NET], b_vals[POLICY_SUM], 1e-6))
@@ -746,7 +751,7 @@ check(f"...and record_block() with NO policy argument banks the NET figure "
 # fixture change ever made two of these coincide, the triple above would start
 # passing under a hardcoded policy and would be silently back where it started.
 print(f"    banked through the store: "
-      + ", ".join(f"{k}={v:.0f} W" for k, v in _banked.items()))
+      + ", ".join(f"{k}={given(v):.0f} W" for k, v in _banked.items()))
 check("the three BANKED figures are three distinct numbers, so this triple is "
       "not itself degenerate - it can only pass if the argument is read",
       len({round(v, 6) for v in _banked.values() if v is not None}) == 3)
@@ -855,16 +860,16 @@ for path in REPLAY:
     print(f"    {path.name}: {span_h:.1f} h, {len(qs)} closed quarters, "
           f"month peak {peak:.0f} W, "
           f"{ok_q}/{len(qs)} = {100.0 * ok_q / max(len(qs), 1):.1f} % under the "
-          f"{SHIPPED_CAP_W:.0f} W soft limit")
+          f"{given(SHIPPED_CAP_W):.0f} W soft limit")
     check(f"{path.name}: the month's peak equals its own largest quarter",
-          near(st9.peak(month=sorted(months)[0]).peak_w, peak, 1e-9))
+          bool(months) and near(st9.peak(month=sorted(months)[0]).peak_w, peak, 1e-9))
     check(f"{path.name}: a full day of real telegrams produces ~96 quarters, "
           f"got {len(qs)}", 90 <= len(qs) <= 96)
 
 PCT = 100.0 * under / max(total_q, 1)
 print()
 print(f"    AC 3 MEASURED: {under}/{total_q} quarters = {PCT:.1f} % under the "
-      f"{SHIPPED_CAP_W:.0f} W soft limit, over {replay_days:.1f} DAYS of "
+      f"{given(SHIPPED_CAP_W):.0f} W soft limit, over {replay_days:.1f} DAYS of "
       f"replay, UNCONTROLLED (no peak shaving was running on either day).")
 print(f"    AC 3 ASKS FOR 30 DAYS and this run is {replay_days:.1f}, so it "
       f"does not settle it either way. The 30 days DO now exist - "
@@ -928,7 +933,7 @@ def built(db_path, opts=None):
 
 c = built(TMP / "wired.db")
 check(f"a Controller built with peak_cap_w ABSENT takes the SHIPPED "
-      f"{SHIPPED_CAP_W:.0f} W, so config.yaml and main.py's fallback cannot "
+      f"{given(SHIPPED_CAP_W):.0f} W, so config.yaml and main.py's fallback cannot "
       f"drift apart unnoticed", c.peak.cap_w == SHIPPED_CAP_W)
 
 # Drive one real quarter through the real ingest, then the real cycle's sync.
@@ -973,16 +978,22 @@ check("...and the peak is unchanged by the repeat",
 # quarter in August, so every check below passed in August and failed from
 # 2026-09-01 - on a commit nobody had touched. The suite must grade the month
 # it created, not the month the machine happens to be running in.
-rows = [r for r in c.checks(when=B) if "capacity-tariff" in r["text"] or "peak" in r["text"]]
-peak_rows = [r for r in rows if "peak" in r["text"] and "quarter(s) banked" in r["text"]]
+# UX-08 2d: the rows are in plain words and are found by their `id`. The peak
+# and the coverage figure (TARIFF-13) are two rows now, one sentence each.
+rows = c.checks(when=B)
+peak_rows = [r for r in rows if r.get("id") == "month_peak"]
+cov_rows = [r for r in rows if r.get("id") == "periods_measured"]
 print("    status row: " + (peak_rows[0]["text"] if peak_rows else "(none)"))
-check("the status page carries exactly one capacity-tariff peak row",
-      len(peak_rows) == 1)
-check("...naming the peak, the soft limit and a coverage figure, all derived "
-      "from the controller that was actually built",
-      bool(peak_rows) and "4998 W" in peak_rows[0]["text"]
-      and f"{SHIPPED_CAP_W:.0f} W soft limit" in peak_rows[0]["text"]
-      and "quarter(s) banked" in peak_rows[0]["text"])
+print("    status row: " + (cov_rows[0]["text"] if cov_rows else "(none)"))
+check("the status page carries exactly one capacity-tariff peak row, and one "
+      "coverage row beside it",
+      len(peak_rows) == 1 and len(cov_rows) == 1)
+check("...naming the peak and its share of the peak limit, and the coverage "
+      "figure, all derived from the controller that was actually built",
+      bool(peak_rows) and "Month peak: 4 998 W on " in peak_rows[0]["text"]
+      and f"{4998 / given(SHIPPED_CAP_W) * 100:.0f} % of the peak limit"
+      in peak_rows[0]["text"]
+      and bool(cov_rows) and "periods measured" in cov_rows[0]["text"])
 
 # ⚠️ AND THE COVERAGE FIGURE IN THAT ROW IS SCOPED TO THE LIVE BILLING MONTH,
 # NOT TO `when` - TARIFF-13, and it is a KNOWN GAP stated rather than rounded
@@ -1003,22 +1014,23 @@ print(f"    the row read at {month_key(B)} carries the tally for "
 check("the row's coverage figure is the LIVE month's tally - graded against a "
       "row count taken straight from quarter_blocks, so this pins the gap "
       "rather than restating the property that produces it",
-      bool(peak_rows)
-      and f"; {_live_rows} quarter(s) banked" in peak_rows[0]["text"])
+      bool(cov_rows)
+      and cov_rows[0]["text"].endswith(f"this month: {_live_rows}"))
 check("...and it is FLAGGED, because 4998 W is over §9.1's 80 % warning point "
-      f"on a {SHIPPED_CAP_W:.0f} W limit",
+      f"on a {given(SHIPPED_CAP_W):.0f} W limit",
       bool(peak_rows) and not peak_rows[0]["ok"] and peak_rows[0]["warn"])
 
 # The half that matters: the same page with a store that cannot answer.
 c2 = built(TMP / "no-such-dir" / "nope.db")
-u_rows = [r for r in c2.checks(when=B) if "capacity-tariff peak" in r["text"]]
+u_rows = [r for r in c2.checks(when=B) if r.get("id") == "month_peak"]
 print("    status row (unreadable store): "
       + (u_rows[0]["text"] if u_rows else "(none)"))
-check("an unreadable store gets its OWN row, saying UNREADABLE", len(u_rows) == 1)
+check("an unreadable store gets its OWN row, saying it cannot be read",
+      len(u_rows) == 1)
 check("...and it does NOT read as a quiet month at 0 W - without this, a broken "
       "instrument looks exactly like a month with no peak",
-      bool(u_rows) and "UNREADABLE" in u_rows[0]["text"]
-      and "0 %" not in u_rows[0]["text"] and u_rows[0]["warn"])
+      bool(u_rows) and "cannot be read" in u_rows[0]["text"]
+      and "%" not in u_rows[0]["text"] and u_rows[0]["warn"])
 check("...and the healthy row and the unreadable row are different text",
       bool(u_rows) and bool(peak_rows)
       and u_rows[0]["text"] != peak_rows[0]["text"])
@@ -1036,7 +1048,7 @@ check("...and the healthy row and the unreadable row are different text",
 # (That asymmetry in the row's own text is worth a look on its own; it is what
 # made the original filter brittle. Not changed here - it is product text with
 # other suites reading it.)
-_peak_rows = lambda rows: [r for r in rows if "quarter(s) banked" in r["text"]]
+_peak_rows = lambda rows: [r for r in rows if r.get("id") == "month_peak"]
 
 _later = B + timedelta(days=45)          # same fixture, a later billing month
 _other_peak = _peak_rows(c.checks(when=_later))
@@ -1044,12 +1056,12 @@ print(f"    the SAME controller read at {_later.date()}: "
       + (_other_peak[0]["text"] if _other_peak else "(no peak row)"))
 check("asked for a LATER month, the same controller reports that month's "
       "absence of a quarter, not August's 4998 W - the row follows `when`",
-      bool(_other_peak) and "4998 W" not in _other_peak[0]["text"]
-      and "no completed quarter recorded yet" in _other_peak[0]["text"])
+      bool(_other_peak) and "4 998 W" not in _other_peak[0]["text"]
+      and "none recorded yet" in _other_peak[0]["text"])
 check("...and that is NO_RECORD, distinguishable from BOTH an observed peak and "
       "an unreadable store - a month with no quarter is not a broken instrument",
       bool(_other_peak) and bool(peak_rows)
-      and "UNREADABLE" not in _other_peak[0]["text"]
+      and "cannot be read" not in _other_peak[0]["text"]
       and _other_peak[0]["text"] != peak_rows[0]["text"])
 check("...and it is not FLAGGED, because an empty month is not an exceedance",
       bool(_other_peak) and _other_peak[0]["ok"] and not _other_peak[0]["warn"])
@@ -1072,7 +1084,7 @@ check("calling checks() with NO argument still reads the month being billed "
       bool(_now_peak) and (bool(peak_rows)
                            and _now_peak[0]["text"] == peak_rows[0]["text"]
                            if _today_is_fixture_month
-                           else "no completed quarter recorded yet"
+                           else "none recorded yet"
                                 in _now_peak[0]["text"]))
 
 # THE MEASUREMENT IS OF DELIVERED POWER (SAFETY-20). Graded on the parsed
@@ -1249,21 +1261,25 @@ for _q in range(_N13):
 # Ground truth from the OTHER tier, which the tracker did not supply - the count
 # under test must be graded against something that is not itself (habit 2).
 _truth_before = len(c13.peak.store.blocks_in(_mon13))
+_cov_row = lambda c: [r for r in c.checks()
+                      if r.get("id") == "periods_measured"][0]["text"]
 _row_before = _peak_rows(c13.checks())[0]["text"]
-print("    before restart: " + _row_before)
+_cov_before = _cov_row(c13)
+print("    before restart: " + _row_before + " / " + _cov_before)
 check(f"precondition: the fixture banked {_N13} quarters in {_mon13}, so a "
       f"count of 0 and a count of the truth are different numbers",
       _truth_before == _N13 and _N13 > 1)
 check(f"...and the row says so before the restart",
-      f"{_N13} quarter(s) banked" in _row_before)
+      _cov_before.endswith(f"this month: {_N13}"))
 
 c13.peak.store.close()
 
 # THE RESTART.
 c13b = built(_T13)
 _row_after = _peak_rows(c13b.checks())[0]["text"]
+_cov_after = _cov_row(c13b)
 _truth_after = len(c13b.peak.store.blocks_in(_mon13))
-print("    after  restart: " + _row_after)
+print("    after  restart: " + _row_after + " / " + _cov_after)
 print(f"    rows in quarter_blocks: {_truth_before} before, "
       f"{_truth_after} after; the restarted tracker has banked "
       f"{len(c13b.peak._seen)} block(s) of its own through sync()")
@@ -1275,16 +1291,17 @@ check("precondition: the second Controller is a REAL restart - it shares no "
 check("the peak and its attributed quarter survive the restart - the durable "
       "half, asserted so that the coverage claim below is not graded against a "
       "reading that had already collapsed",
-      _row_before.split(" - ")[0] == _row_after.split(" - ")[0]
-      and f"{_W13:.0f} W" in _row_after)
+      _row_before == _row_after
+      and f"Month peak: {messages.watts(_W13)} on" in _row_after)
 check("...and the COUNT BESIDE IT DOES NOT COLLAPSE TO ZERO, which is the "
       "defect: a coverage figure that resets while the value beside it "
       "persists actively misinforms",
-      "; 0 quarter(s) banked" not in _row_after)
+      not _cov_after.endswith("this month: 0"))
 check(f"...and it is the store's own tally, {_truth_after}, not a "
       f"process-lifetime counter - graded against a COUNT OF ROWS in the "
       f"other tier rather than against the property under test",
-      f"{_truth_after} quarter(s) banked" in _row_after and _truth_after >= _N13)
+      _cov_after.endswith(f"this month: {_truth_after}")
+      and _truth_after >= _N13)
 
 # ⚠️ The restarted run banks one MORE than it drove, and that is correct: the
 # checkpointed open block was stale, so `restore()` closed and banked it. The
@@ -1308,7 +1325,7 @@ print(f"    quarters banked in {month_key(_sb)}: {_before_stale} -> "
 check("a block closed by restore() rather than by sync() is counted too - the "
       "old counter incremented only in sync() and missed it entirely",
       _before_stale == 0 and _tr13.recorded_in(_sb) == 1
-      and "banked" in _state)
+      and "and saved it" in _state)
 
 # --- the count is scoped to the MONTH it is printed beside --------------------
 # ⚠️ TWO MONTHS AT DIFFERENT COUNTS. Equal counts would be satisfied by a
diff --git a/goodwe_controller/test_tool_inputs.py b/goodwe_controller/test_tool_inputs.py
new file mode 100644
index 0000000..602e7c6
--- /dev/null
+++ b/goodwe_controller/test_tool_inputs.py
@@ -0,0 +1,262 @@
+"""SAFETY-60/62: the operator tools refuse input they cannot read.  `python3 test_tool_inputs.py`
+
+Each tool is driven as the operator runs it, first on good input (the accepted
+baseline, MUTATION.md habit 7) and then on the shapes that used to pass.
+"""
+import contextlib
+import copy
+import importlib.util
+import io
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+TOOLS = HERE / "tools"
+FIX = TOOLS / "rehearsal"
+CAPTURE = HERE / "scenarios" / "safety57-2026-09-21" / \
+    "bus-a-2026-09-21-1030-1110.log.gz"
+TMP = tempfile.mkdtemp(prefix="test_tool_inputs.")
+ENV = {**os.environ, "PYTHONDONTWRITEBYTECODE": "1"}
+
+fails = []
+
+
+def check(name, ok):
+    print(f"  {'ok  ' if ok else 'FAIL'}  {name}")
+    if not ok:
+        fails.append(name)
+
+
+def dump(name, obj=None, text=None):
+    p = Path(TMP) / name
+    p.write_text(text if text is not None else json.dumps(obj, indent=1),
+                 encoding="utf-8")
+    return str(p)
+
+
+def tool(script, *args):
+    r = subprocess.run([sys.executable, str(TOOLS / script), *args],
+                       capture_output=True, text=True, env=ENV)
+    return r.returncode, r.stdout + r.stderr
+
+
+def ha_apps_info(options):
+    """What `ha apps info <slug> --raw-json` prints: the options sit under data.options."""
+    text = {"en": ("Setpoint entity", "The ESPHome number carrying the setpoint."),
+            "nl": ("Setpoint-entiteit", "Het ESPHome-getal met het setpoint.")}
+    return {"result": "ok", "data": {
+        "name": "GoodWe RS485 Controller", "slug": "local_goodwe_controller",
+        "version": "0.12.0", "version_latest": "0.12.0", "state": "started",
+        "boot": "auto", "ingress": True, "hassio_api": True,
+        "options": copy.deepcopy(options),
+        "schema": [{"name": k, "required": True, "optional": False,
+                    "type": "string"} for k in options],
+        "translations": {lang: {"configuration": {
+            "setpoint_entity": {"name": name, "description": desc},
+            "inverters": {"name": "Inverters", "description": "Roster.",
+                          "fields": {"setpoint_entity": {
+                              "name": name, "description": f"{desc} (per unit)"}}}}}
+            for lang, (name, desc) in text.items()}}}
+
+
+# --------------------------------------------------------------------------- #
+print("1. predeploy_check.py --options (SAFETY-60)")
+# --------------------------------------------------------------------------- #
+# A deployed version that differs from the shipped one, so only the options half decides.
+BARE = {"setpoint_entity": "number.goodwe_setpoint_w", "inverters": [],
+        "max_w": 5000, "slew_w": 0, "gain": 0.6, "target_grid_w": -10,
+        "deadband_w": 15, "meter_source": "off", "log_level": "info"}
+NOREPO = tempfile.mkdtemp(prefix="norepo.", dir=TMP)
+
+
+def gate(opts_path):
+    return tool("predeploy_check.py", "--deployed-version", "0.0.0-test",
+                "--repo", NOREPO, "--options", opts_path)
+
+
+code, out = gate(dump("bare.json", BARE))
+print(f"      bare options -> exit {code}")
+check("baseline: the bare options object is CLEARED (exit 0)",
+      code == 0 and "CLEARED for deploy" in out)
+code, out = gate(dump("bare-bad.json", dict(BARE, slew_w=5000)))
+check("baseline: the bare object with slew_w 5000 is REFUSED by the validator",
+      code == 1 and "(slew_w) is 5000 W" in out)
+
+for label, doc in (("wrapped", ha_apps_info(BARE)),
+                   ("wrapped, slew_w 5000", ha_apps_info(dict(BARE, slew_w=5000)))):
+    code, out = gate(dump("wrapped.json", doc))
+    print(f"      {label} -> exit {code}")
+    check(f"the `ha apps info` capture ({label}) is REFUSED, exit 1",
+          code == 1 and "CLEARED" not in out)
+    check("...naming the shape and the fix, not a validator rule",
+          "0 of 2 top-level key(s) recognised" in out and ".data.options" in out
+          and "VALIDATOR" not in out)
+
+from app.validate import actuator_writers, validate_startup_config  # noqa: E402
+_w = ha_apps_info(dict(BARE, slew_w=5000))
+print(f"      (for reference: the validator alone, handed that capture, finds "
+      f"{len(validate_startup_config(_w))} problem(s) and "
+      f"{len(actuator_writers(_w))} 'actuators' - the gate has to refuse it)")
+
+code, out = gate(dump("list.json", [BARE]))
+check("a list-wrapped options object is REFUSED, naming the type",
+      code == 1 and "is a JSON list, not an object" in out)
+code, out = gate(dump("mostly-foreign.json",
+                      {"setpoint_entity": "number.x", "a": 1, "b": 2}))
+check("an object with fewer than half its keys recognised is REFUSED",
+      code == 1 and "1 of 3 top-level key(s) recognised" in out)
+
+# --------------------------------------------------------------------------- #
+print("\n2. rehearse_roster.py --state/--before/--after (SAFETY-62)")
+# --------------------------------------------------------------------------- #
+sys.path.insert(0, str(TOOLS))
+import rehearse_roster as RR  # noqa: E402
+
+STATE = FIX / "state-legacy.json"
+LIVE = ["--live-entities", str(FIX / "live-entities-recorded.txt"),
+        "--reference", str(FIX / "announced-reference.txt")]
+
+
+def rehearse(state=str(STATE), before=str(FIX / "flat.yaml"),
+             after=str(FIX / "roster.yaml"), extra=LIVE):
+    return tool("rehearse_roster.py", "--state", state, "--before", before,
+                "--after", after, *extra)
+
+
+code, out = rehearse()
+print(f"      control -> exit {code}")
+check("baseline: the control run reports its 2 findings, exit 1",
+      code == RR.EXIT_FINDING and "2 FINDING(S)" in out)
+code, out = rehearse(state=str(FIX / "state-fresh.json"))
+check("baseline: a fresh (comment-only) state file still runs clean, exit 0",
+      code == RR.EXIT_OK and "NO FINDINGS" in out)
+
+raw = STATE.read_text(encoding="utf-8")
+state = json.loads(raw)
+cases = {
+    "wrapped": (dump("s-wrapped.json", {"result": "ok", "data": state}),
+                "0 of 2 top-level key(s) recognised"),
+    "truncated by 20 bytes": (dump("s-trunc.json", text=raw[:-20]),
+                              "not a readable JSON state file"),
+    "list-wrapped": (dump("s-list.json", [state]),
+                     "is a JSON list, not an object"),
+}
+for label, (path, words) in cases.items():
+    code, out = rehearse(state=path)
+    print(f"      state {label} -> exit {code}")
+    check(f"state {label}: REFUSED with exit 2 and the reason",
+          code == RR.EXIT_COULD_NOT_RUN and words in out
+          and "NO FINDINGS" not in out)
+
+try:
+    _auto = RR.load_state(dump("s-auto.json", {"auto": True}))
+except RR.Refused as err:
+    _auto = str(err)
+check("a state holding only the Automatic toggle (`auto`, app/main.py) is "
+      "recognised as a store", _auto == {"auto": True})
+
+flat = RR.load_options(str(FIX / "flat.yaml"))
+roster = RR.load_options(str(FIX / "roster.yaml"))
+for side, kw in (("--before", {"before": dump("b.json", ha_apps_info(flat))}),
+                 ("--after", {"after": dump("a.json", ha_apps_info(roster))})):
+    code, out = rehearse(**kw)
+    print(f"      {side} wrapped -> exit {code}")
+    check(f"{side} as an `ha apps info` capture: REFUSED with exit 2",
+          code == RR.EXIT_COULD_NOT_RUN and ".data.options" in out
+          and "NO FINDINGS" not in out)
+
+code, out = rehearse(after=str(FIX / "roster-inverter-a.yaml"),
+                     extra=["--no-live-entities", "--reference",
+                            str(FIX / "announced-reference.txt")])
+check("a clean --no-live-entities run is exit 3, not 0",
+      code == RR.EXIT_DEGRADED and "NO FINDINGS" in out)
+
+# --------------------------------------------------------------------------- #
+print("\n3. alloc_sim.py - the split-invariance verdict reaches the exit code")
+# --------------------------------------------------------------------------- #
+spec = importlib.util.spec_from_file_location("_alloc_sim", TOOLS / "alloc_sim.py")
+AS = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(AS)
+
+
+class _Run:
+    """One rig run, reduced to what `splits()` reads."""
+
+    def __init__(self, grid):
+        self.samples = [{"shares": [1000.0, 1000.0]}]
+        self._grid = grid
+
+    def grids(self):
+        return self._grid
+
+    def targets(self):
+        return [2000.0] * len(self._grid)
+
+
+class _Sitesim:
+    def load_addon(self, *_):
+        return None
+
+
+def alloc_main(same):
+    """`main(--splits)` with the rig stubbed; the real `splits()` grades the traces."""
+    seen = []
+
+    def fake(_sitesim, _control, mode, *a, **kw):
+        seen.append(mode)
+        return _Run([0.0, 1.0] if same or len(seen) == 1 else [0.0, 2.0])
+
+    AS.find_sim = lambda: Path("/nonexistent-rig")
+    AS.load = lambda _sim: (None, _Sitesim(), None, None)
+    AS.run_site_feedback = fake
+    os.environ["GOODWE_ADDON_REPO"] = str(HERE.parent)
+    sys.argv = ["alloc_sim.py", "--splits"]
+    buf = io.StringIO()
+    with contextlib.redirect_stdout(buf):
+        rc = AS.main()
+    return rc, buf.getvalue()
+
+
+rc, out = alloc_main(same=True)
+check("baseline: identical traces HOLD, exit 0",
+      rc == 0 and "split-invariance HOLDS" in out)
+rc, out = alloc_main(same=False)
+print(f"      differing traces -> exit {rc}")
+check("differing traces FAIL, exit 1",
+      rc == 1 and "split-invariance FAILS" in out)
+
+# --------------------------------------------------------------------------- #
+print("\n4. decode_bus_capture.py - a file that is not a capture")
+# --------------------------------------------------------------------------- #
+code, out = tool("decode_bus_capture.py", str(CAPTURE))
+check("baseline: the committed capture decodes, exit 0",
+      code == 0 and "writes         1200" in out and "REFUSED" not in out)
+junk = dump("junk.log", text="hello\nthis is not a capture\n")
+code, out = tool("decode_bus_capture.py", junk)
+print(f"      junk -> exit {code}")
+check("a junk file is REFUSED, exit 1",
+      code == 1 and "REFUSED" in out and "0 of 2 line(s) decoded" in out)
+code, out = tool("decode_bus_capture.py", dump("empty.log", text=""))
+check("an empty file is REFUSED, exit 1",
+      code == 1 and "0 of 0 line(s) decoded" in out)
+code, out = tool("decode_bus_capture.py", str(CAPTURE), junk)
+check("several paths, as the docstring's glob passes them: each is decoded and "
+      "one bad file makes the run exit 1",
+      code == 1 and f"== {CAPTURE}" in out and f"== {junk}" in out)
+code, out = tool("decode_bus_capture.py", str(CAPTURE), str(CAPTURE))
+check("...and two good files exit 0", code == 0 and out.count("REFUSED") == 0)
+
+shutil.rmtree(TMP, ignore_errors=True)
+print()
+if fails:
+    print(f"FAILED: {len(fails)}")
+    for f in fails:
+        print(f"  - {f}")
+    sys.exit(1)
+print("all tool-input checks passed")
diff --git a/goodwe_controller/test_translations.py b/goodwe_controller/test_translations.py
index 822d21f..47e1db8 100644
--- a/goodwe_controller/test_translations.py
+++ b/goodwe_controller/test_translations.py
@@ -12,10 +12,11 @@ the sentence that says WHETHER TO TOUCH THE VALUE, because the tab presents a
 constant derived from 1890 closed-loop test runs and the operator's own inverter
 rating as the same kind of field.
 
-⚠️ WHAT THIS FILE CANNOT SEE, SAID FIRST. It grades COVERAGE and PROVENANCE
-CITATIONS - that every option has a name and a description in both languages,
-that no translation names an option that does not exist, and that each derived
-constant's English description cites the record it was derived from. It does NOT
+⚠️ WHAT THIS FILE CANNOT SEE, SAID FIRST. It grades COVERAGE and PROVENANCE -
+that every option has a name and a description in both languages, that no
+translation names an option that does not exist, that each derived constant's
+English description says to leave it, and that DOCS.md's "For installers"
+entry for it names the record it came from (moved there by UX-08). It does NOT
 grade whether a sentence is true, whether the Dutch is good Dutch, or whether
 the result looks right on screen. The last of those is measured, not asserted,
 by `tools/supervisor_shape_probe.py` section F, which loads these files with
@@ -107,83 +108,95 @@ check("...and no Dutch string was left as a copy of the English one, which is "
            == TR["nl"]["configuration"][k]["description"]])
 
 print("\n3. ⭐ the description says WHETHER TO TOUCH IT")
-# ⚠️ THE HIGHEST-VALUE ITEM IN THE CARD, AND THE ONE A COVERAGE COUNT CANNOT
-# REACH. Sixty-odd descriptions that all say "the threshold, in watts" would
-# pass part 2 completely. What makes this surface safe is that a DERIVED
-# constant names the campaign it came from and says the value is not a knob,
-# while a number that really is the operator's says so too.
-#
-# ⚠️ AND THIS IS A TEXT CHECK, WHICH IS WEAK ON PURPOSE AND IS SAID TO BE. It
-# cannot know whether a citation is TRUE; it can only know that the citation is
-# there and names the right record, so that deleting the provenance - or
-# renaming the card it points at - goes red instead of shipping. The table is
-# written out rather than derived because there is nothing in config.yaml that
-# distinguishes a derived constant from an operator's number; that distinction
-# is the whole of what this card had to add.
+# The value of this surface is the sentence that says whether a number is a
+# knob. Since UX-08 phase 2c the tab keeps that sentence short ("Measured value,
+# leave it unchanged.") and the record it came from lives in DOCS.md under
+# "For installers: where the numbers come from", where UX-01's citations moved.
+# So each derived key is pinned twice:
+# its English description tells the reader what to do, and its DOCS entry names
+# the record. A text check, weak on purpose: it cannot know a citation is TRUE,
+# only that deleting it, or the instruction, goes red.
+DOCS = (HERE / "DOCS.md").read_text(encoding="utf-8")
+_inst = DOCS.split("\n### For installers: where the numbers come from\n", 1)
+INSTALLERS = _inst[-1].split("\n#", 1)[0] if len(_inst) == 2 else ""
+check("DOCS.md has the 'For installers: where the numbers come from' section",
+      bool(INSTALLERS.strip()))
+
+
+def docs_entry(key):
+    """The DOCS bullet that names `key` in backticks, lower-cased."""
+    hits = [b for b in INSTALLERS.split("\n- ") if f"`{key}`" in b]
+    return hits[0].lower() if hits else ""
+
+
+LEAVE_M, LEAVE_D = "Measured value, leave it unchanged", \
+    "Derived value, leave it unchanged"
+# key: (what the English description must say, what its DOCS entry must name)
 DERIVED = {
-    "sign_disagree_w": ("SAFETY-02", "MEASURED"),
-    "sign_disagree_s": ("SAFETY-02", "MEASURED"),
-    "unit_sign_disagree_w": ("SAFETY-30", "1890"),
-    "unit_sign_disagree_s": ("SAFETY-30", "1890"),
-    "site_sign_disagree_w": ("SAFETY-30", "CARRIED"),
-    "site_sign_disagree_s": ("SAFETY-30", "1890"),
-    "meter_freeze_s": ("SAFETY-18", "MEASURED"),
-    "circulation_w": ("SAFETY-31", "924"),
-    "circulation_hold_s": ("SAFETY-31", "DERIVED"),
-    # SAFETY-42. Two needles rather than one: the campaign it was derived from,
-    # and the word that says what it does NOT do. An operator who reads
-    # "not-delivering report" and assumes the add-on has handled it is the
-    # failure this alarm's whole wording is written against.
-    "delivery_hold_s": ("SAFETY-42", "DERIVED FROM", "REPORTS ONLY"),
-    "peak_soc_floor": ("SAFETY-24", "DERIVED"),
-    "bms_soc_floor": ("0x0560", "MEASURED"),
-    "integrator_max_w": ("MEASURED", "Do not raise it"),
-    "gain": ("MEASURED ON", "do not raise it"),
-    # SAFETY-39. `slew_w` joins the table because it stopped being an
-    # operator's convenience and became a DERIVED value the moment it was
-    # tied to the rating: 0 resolves to about a ninth of `max_w`, from an
-    # ~18 s measured step response. It is the one entry here whose value is
-    # a RATIO, so the description has to say what it follows as well as
-    # where the ratio came from - a citation alone would leave an operator
-    # reading "0" on the tab with no idea it is not "off".
-    "slew_w": ("SAFETY-39", "DERIVED", "0 MEANS FOLLOW"),
-    # TARIFF-18. `price_taxes_eur_kwh` joins the table for `slew_w`'s reason:
-    # it stopped being a figure somebody picked and became one SUMMED FROM
-    # NAMED CARD ROWS. Three needles, because three different things about it
-    # can go wrong on the Configuration tab and only the first is provenance:
-    # where the number came from, that the operator's own DSO gives a
-    # different one, and that changing it moves no trade - which is the claim
-    # an operator is most likely to assume the opposite of when a number
-    # doubles.
-    "price_taxes_eur_kwh": ("TARIFF-18", "YOUR OWN DSO",
-                            "MOVES NO TRADING DECISION"),
+    "sign_disagree_w": (LEAVE_M, ("SAFETY-02", "measured")),
+    "sign_disagree_s": (LEAVE_M, ("SAFETY-02", "measured")),
+    "unit_sign_disagree_w": (LEAVE_D, ("SAFETY-30", "1890")),
+    "unit_sign_disagree_s": (LEAVE_D, ("SAFETY-30", "1890")),
+    "site_sign_disagree_w": (LEAVE_M, ("SAFETY-30", "carried")),
+    "site_sign_disagree_s": (LEAVE_D, ("SAFETY-30", "1890")),
+    "meter_freeze_s": (LEAVE_M, ("SAFETY-18", "measured")),
+    "circulation_w": (LEAVE_M, ("SAFETY-31", "924")),
+    "circulation_hold_s": (LEAVE_D, ("SAFETY-31", "derived")),
+    # SAFETY-42: the alarm changes nothing, and both surfaces say so.
+    "delivery_hold_s": (LEAVE_D, ("SAFETY-42", "derived from",
+                                  "reports only")),
+    "peak_soc_floor": (LEAVE_D, ("SAFETY-24", "derived")),
+    "bms_soc_floor": ("Read it off your battery", ("0x0560", "measured")),
+    "integrator_max_w": ("Do not raise it above", ("measured",)),
+    "gain": ("do not raise it", ("measured on",)),
+    # SAFETY-39: 0 is not "off", it follows the rating.
+    "slew_w": ("0 follows", ("SAFETY-39", "derived", "0 means follow")),
+    # TARIFF-18: where the figure came from, that your DSO differs, and that
+    # changing it moves no trade.
+    "price_taxes_eur_kwh": ("Check it against your own grid operator",
+                            ("TARIFF-18", "your own dso",
+                             "moves no trading decision")),
 }
 _uncited = []
-for key, needles in sorted(DERIVED.items()):
-    desc = TR["en"]["configuration"][key]["description"]
+for key, (says, needles) in sorted(DERIVED.items()):
+    if says not in TR["en"]["configuration"][key]["description"]:
+        _uncited.append(f"{key} description does not say {says!r}")
     for needle in needles:
-        if needle not in desc:
-            _uncited.append(f"{key} does not cite {needle!r}")
-print(f"    {len(DERIVED)} derived constants must cite their campaign; "
-      f"{len(_uncited)} do not")
-check(f"every derived constant's English description names WHERE THE NUMBER "
-      f"CAME FROM, so an operator reading the tab can tell it apart from their "
-      f"own inverter rating. Uncited: {_uncited}", not _uncited)
-# The other direction, and it matters as much: a number that IS the operator's
-# must not be dressed up as derived, or the labels stop meaning anything.
+        if needle.lower() not in docs_entry(key):
+            _uncited.append(f"{key}: DOCS does not name {needle!r}")
+print(f"    {len(DERIVED)} derived constants; {len(_uncited)} problem(s)")
+check(f"every derived constant's description says what to do with it, and its "
+      f"DOCS entry names where the number came from. Problems: {_uncited}",
+      not _uncited)
 _theirs = ["max_w", "peak_cap_w"]
-check("...and the numbers that really are the OPERATOR'S say so instead of "
-      "carrying a citation - `max_w` and `peak_cap_w` are the two the card "
-      "names, and both read 'THIS IS YOUR NUMBER'",
-      all("THIS IS YOUR NUMBER" in TR["en"]["configuration"][k]["description"]
+check("...and the numbers that really are the OPERATOR'S say so instead - "
+      "`max_w` and `peak_cap_w` start 'Your own number', here and in DOCS",
+      all(TR["en"]["configuration"][k]["description"].startswith(
+          "Your own number") and "your own number" in docs_entry(k)
           for k in _theirs))
 check("...and the one threshold that is NOT derived from a measurement admits "
-      "it rather than borrowing the others' authority - "
-      "`cycle_cost_threshold_eur` is an open product question (OPT-08)",
-      "NOT DERIVED FROM A MEASUREMENT"
+      "it - `cycle_cost_threshold_eur` is a product choice, and DOCS names the "
+      "open question (OPT-08)",
+      "product choice, not a measured one"
       in TR["en"]["configuration"]["cycle_cost_threshold_eur"]["description"]
-      and "OPT-08"
-      in TR["en"]["configuration"]["cycle_cost_threshold_eur"]["description"])
+      and "opt-08" in docs_entry("cycle_cost_threshold_eur")
+      and "not derived from a measurement"
+      in docs_entry("cycle_cost_threshold_eur"))
+# DOCS.md's "Settings at a glance" shows the tab's text. It must not drift.
+_glance = DOCS.split("\n### Settings at a glance\n", 1)[-1].split("\n#", 1)[0]
+_rows = {}
+for line in _glance.splitlines():
+    cells = [c.strip() for c in line.strip().strip("|").split("|")]
+    if len(cells) == 4 and cells[2].startswith("`"):
+        _rows[cells[2].strip("`")] = (cells[1], cells[3])
+_drift = []
+for key in ORDER:
+    conf = TR["en"]["configuration"][key]
+    want = (conf["name"].split(" · ")[-1], conf["description"])
+    if _rows.get(key) != want:
+        _drift.append(key)
+check(f"DOCS.md 'Settings at a glance' shows every option's English label and "
+      f"description exactly as the tab does. Drifted: {_drift}", not _drift)
 
 print("\n4. task ordering, and the labels that carry it")
 # ⚠️ ADD-ON OPTIONS ARE A FLAT LIST - no section headers, no per-option advanced
diff --git a/goodwe_controller/test_ui_text.py b/goodwe_controller/test_ui_text.py
new file mode 100644
index 0000000..d23a8cd
--- /dev/null
+++ b/goodwe_controller/test_ui_text.py
@@ -0,0 +1,293 @@
+"""UX-13 P5: the page's words, English and Dutch, follow STYLE.md.   `python3 test_ui_text.py`
+
+app/ui_text/en.json and nl.json hold every word the Home, Batteries, Settings
+and Setup screens show that is not an option label (those are
+translations/*.yaml, test_translations.py) or a status row (app/messages.py,
+test_messages.py). This check fails CI and names the offending string when:
+
+1. the two files differ in keys, or a string's {placeholders} differ;
+2. a string breaks STYLE.md: a name or label over 6 words, a description over
+   1 sentence of 25 words, any other line over 2 sentences, a semicolon, a
+   banned or jargon word (English and Dutch lists), an option key or entity id;
+3. a string carries its own details (a link, a section number, a file name)
+   instead of leaving them to the page's DOCS link;
+4. Home's sentences, rendered by app/homeview.py in each language, break
+   the Home rules of test_messages.py part 8 (checked there too);
+5. a Dutch string is left in English, outside the short list of words that
+   are the same in both;
+6. the English words that mirror app/messages.py drift from it.
+Each rule is shown to catch a spoiled input (habit 1 of MUTATION.md).
+"""
+
+import json
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+from style_rules import (PLACEHOLDER, sentences, text_problems,   # noqa: E402
+                         title_problems, words)
+from app import homeview, messages, uitext                        # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def load(lang):
+    with open(os.path.join(HERE, "app", "ui_text", f"{lang}.json"),
+              encoding="utf-8") as f:
+        return json.load(f)
+
+
+EN, NL = load("en"), load("nl")
+
+
+def leaves(node, path=()):
+    """(path, text) for every string, lists included (the month names)."""
+    if isinstance(node, dict):
+        for k, v in node.items():
+            yield from leaves(v, path + (k,))
+    elif isinstance(node, list):
+        for i, v in enumerate(node):
+            yield from leaves(v, path + (i,))
+    else:
+        yield path, node
+
+
+def where(lang, path):
+    return f"{lang}.json:" + ".".join(str(p) for p in path)
+
+
+# ============================================================================ #
+print("1. English and Dutch have the same keys and placeholders")
+_en, _nl = dict(leaves(EN)), dict(leaves(NL))
+
+
+def missing(en, nl):
+    """The keys only one language has."""
+    return (sorted(where("en", p) for p in en if p not in nl),
+            sorted(where("nl", p) for p in nl if p not in en))
+
+
+def holes(en, nl):
+    """The Dutch strings whose {placeholders} differ from the English."""
+    return sorted(
+        f"{where('nl', p)}: {sorted(PLACEHOLDER.findall(str(en[p])))} vs "
+        f"{sorted(PLACEHOLDER.findall(str(t)))}"
+        for p, t in nl.items() if p in en
+        and sorted(PLACEHOLDER.findall(str(t)))
+        != sorted(PLACEHOLDER.findall(str(en[p]))))
+
+
+_only_en, _only_nl = missing(_en, _nl)
+for x in _only_en + _only_nl:
+    print(f"       MISSING in the other language: {x}")
+check(f"every one of the {len(_en)} English strings has a Dutch one, and no "
+      "Dutch string is extra", not _only_en and not _only_nl and len(_en) > 300)
+_holes = holes(_en, _nl)
+for x in _holes:
+    print(f"       PLACEHOLDERS differ: {x}")
+check("every Dutch string fills the same {placeholders} as its English one",
+      not _holes)
+
+
+# ============================================================================ #
+print("\n2. every string follows STYLE.md, in both languages")
+# STYLE.md section 4, the "Not" column, plus the Dutch words for the same
+# things (translations/nl.yaml keeps "setpoint" in two option names, which the
+# page never shows). Matched as whole words, case-insensitive.
+JARGON = {
+    "en": r"controllers?|control loop|setpoints?|SoC|state of charge|BMS|PV|"
+          r"failsafe|trip(?:ped)?|parked|discharg\w*|P1 feed|quarter-hour|"
+          r"payload|endpoint|JSON|API|timeout|boolean|config|commands?|"
+          r"charge level|ceiling|billed quarter|quarters?|banked|soft limit|"
+          r"open block|actuator|ESP32|master|meter source|circulating|"
+          r"sign disagreement|rail",
+    "nl": r"setpoints?|setpunt\w*|SoC|laadtoestand|BMS|PV|failsafe|regelaar|"
+          r"regellus|controller|latch|ontlad\w*|payload|endpoint|JSON|API|"
+          r"time-?out|boolean|config|kwartuur\w*|commando\w*|geparkeerd|"
+          r"ESP32|master",
+}
+JARGON = {k: re.compile(r"\b(?:" + v + r")\b", re.I) for k, v in JARGON.items()}
+# Details belong behind the page's DOCS link, never in the string itself.
+DETAILS = re.compile(r"https?:|www\.|DOCS|documentation, section|§|"
+                     r"\bsee section\b|\bzie sectie\b", re.I)
+NAME_WORDS, DESC_WORDS, LINE_SENTENCES = 6, 25, 2
+
+
+def kind_of(path):
+    if path[0] == "home_words":
+        return "template"          # part 4 renders and checks these
+    return "description" if path[-1] == "description" else "name"
+
+
+def problems(lang, path, text):
+    kind = kind_of(path)
+    out = []
+    if not isinstance(text, str) or not text.strip():
+        return ["empty"]
+    if kind == "name" and len(words(text)) > NAME_WORDS:
+        out.append(f"name over {NAME_WORDS} words ({len(words(text))})")
+    if kind == "name" and sentences(text) > LINE_SENTENCES:
+        out.append(f"over {LINE_SENTENCES} sentences ({sentences(text)})")
+    if kind == "description":
+        if sentences(text) > 1:
+            out.append(f"description over 1 sentence ({sentences(text)})")
+        if len(words(text)) > DESC_WORDS:
+            out.append(f"description over {DESC_WORDS} words "
+                       f"({len(words(text))})")
+    if ";" in text:
+        out.append("semicolon")
+    hit = JARGON[lang].search(PLACEHOLDER.sub("X", text))
+    if hit:
+        out.append(f"jargon: {hit.group(0)!r}")
+    if DETAILS.search(text):
+        out.append(f"details belong behind the DOCS link: "
+                   f"{DETAILS.search(text).group(0)!r}")
+    # The picker's own help names "entity id": the one place it is the word.
+    ok_entity = path[:2] == ("settings", "picker")
+    return out + [p for p in text_problems(text, keys=False, entities=False)
+                  if not (ok_entity and p.startswith("entity id"))]
+
+
+_bad = []
+for lang, data in (("en", EN), ("nl", NL)):
+    for path, text in leaves(data):
+        for p in problems(lang, path, text):
+            _bad.append(f"{where(lang, path)}: {p} :: {text!r}")
+for x in _bad:
+    print(f"       STYLE  {x}")
+check(f"every string in en.json and nl.json follows STYLE.md "
+      f"({len(_en) + len(_nl)} strings, {len(_bad)} breaking it)", not _bad)
+
+
+# ============================================================================ #
+print("\n3. the rule catches a spoiled input")
+check("a 7-word name is caught",
+      problems("en", ("fields", "x", "name"),
+               "One two three four five six seven"))
+check("a 2-sentence description is caught",
+      problems("nl", ("fields", "x", "description"), "Eén zin. Twee zinnen."))
+check("jargon is caught in English and in Dutch",
+      problems("en", ("x",), "Setpoint sent") and
+      problems("nl", ("x",), "De SoC is laag"))
+check("a link or section in a string is caught",
+      problems("en", ("x", "description"),
+               "See https://example.org for the rest."))
+check("a snake_case option key is caught",
+      problems("nl", ("x",), "Zet peak_cap_w hoger"))
+check("a semicolon is caught",
+      problems("en", ("x",), "Saved; restart to apply"))
+check("a 26-word description is caught, and 25 words pass",
+      problems("en", ("x", "description"), " ".join(["word"] * 26) + ".")
+      and not problems("en", ("x", "description"),
+                       " ".join(["word"] * 25) + "."))
+check("a 3-sentence line is caught",
+      problems("en", ("x",), "One. Two. Three."))
+check("a key only one language has is caught, both ways",
+      missing({("a",): "x", ("b",): "y"}, {("a",): "x"}) == (["en.json:b"], [])
+      and missing({("a",): "x"}, {("a",): "x", ("c",): "z"})
+      == ([], ["nl.json:c"]))
+check("a placeholder dropped or renamed in Dutch is caught",
+      holes({("a",): "Window {row}"}, {("a",): "Tijdvak"})
+      and holes({("a",): "{w} now"}, {("a",): "nu {d}"})
+      and not holes({("a",): "{a} {b}"}, {("a",): "{b} {a}"}))
+
+
+# ============================================================================ #
+print("\n4. Home's sentences, rendered in each language (as test_messages 8)")
+PLAN_WORDS, PLAN_SENTENCES = 12, 2
+
+
+def home_problems(kind, text):
+    if "{" in text or "}" in text:
+        return ["a placeholder was not filled"]
+    if kind == "title":
+        return title_problems(text)
+    out = text_problems(text, keys=False, entities=False)
+    if kind == "line":
+        if sentences(text) > 1 or len(words(text)) > 25:
+            out.append("line over 1 sentence of 25 words")
+        return out
+    if sentences(text) > PLAN_SENTENCES:
+        out.append(f"plan line over {PLAN_SENTENCES} sentences")
+    out += [f"plan sentence over {PLAN_WORDS} words: {x!r}"
+            for x in re.split(r"(?<=[.!?])\s+", text)
+            if len(words(x)) > PLAN_WORDS]
+    return out
+
+
+for lang in ("en", "nl"):
+    _samples = homeview.text_samples(lang)
+    _hb = [f"{lang} {k}: {p} :: {t!r}" for k, t in _samples
+           for p in home_problems(k, t)]
+    _hb += [f"{lang}: jargon {JARGON[lang].search(t).group(0)!r} :: {t!r}"
+            for _k, t in _samples if JARGON[lang].search(t)]
+    for x in _hb:
+        print(f"       HOME  {x}")
+    check(f"{lang}: every Home sentence follows its rule "
+          f"({len(_samples)} rendered, {len(_hb)} breaking it)",
+          len(_samples) > 80 and not _hb)
+_en_s = [t for _k, t in homeview.text_samples("en")]
+_nl_s = [t for _k, t in homeview.text_samples("nl")]
+check("Home in Dutch is not Home in English: most sentences differ, and "
+      "numbers use a decimal comma",
+      sum(a != b for a, b in zip(_en_s, _nl_s)) > 0.9 * len(_en_s)
+      and "2,5 kW" in homeview.text_samples("nl").__repr__()
+      and "2.5 kW" in _en_s.__repr__())
+check("the language resets after a Dutch build, so English callers stay "
+      "English", homeview.pill("running") == EN["home_words"]["pill"]["running"])
+
+
+# ============================================================================ #
+print("\n5. no Dutch string is left in English")
+# Words that are the same in both, or names. Anything else equal is untranslated.
+SAME = {"Meter", "Timing", "Support", "Details", "Alarm", "Info", "per kWh",
+        "{hour}:00 UTC", "Flanders, Fluvius Antwerpen", "Modus", "Status"}
+
+
+def english(en, nl):
+    return sorted(f"{where('nl', p)} = {t!r}" for p, t in nl.items()
+                  if p in en and t == en[p] and t not in SAME
+                  and PLACEHOLDER.sub("", t).strip(" .:,"))
+
+
+_same = english(_en, _nl)
+for x in _same:
+    print(f"       ENGLISH  {x}")
+check(f"every Dutch string is Dutch ({len(_same)} still English)", not _same)
+_spoiled = dict(_nl)
+_spoiled[("settings", "savebar", "save")] = _en[("settings", "savebar",
+                                                  "save")]
+check("mutation: an English string left in nl.json is caught",
+      english(_en, _spoiled) == ["nl.json:settings.savebar.save = 'Save'"])
+
+
+# ============================================================================ #
+print("\n6. the words that mirror app/messages.py")
+check("the setup-only banner on Home is messages.banner_setup_only()",
+      EN["home"]["setup_only"]["name"] == messages.banner_setup_only())
+_mirror = {k: (EN["home_words"]["attn"][k], v)
+           for k, v in homeview.ATTN_FROM_MESSAGES.items()}
+_drift = {k: v for k, v in _mirror.items() if v[0] != v[1]}
+check(f"five Home titles are the notification's own title ({_drift})",
+      len(_mirror) == 5 and not _drift)
+check("app/uitext.py falls back to English per key and reads nl-BE as nl",
+      uitext.lang_of("nl-BE") == "nl" and uitext.lang_of("fr") == "en"
+      and uitext.words("nl")["home"]["tabs"]["home"]
+      == NL["home"]["tabs"]["home"]
+      and uitext._merge({"a": {"b": 1, "c": 2}}, {"a": {"b": 3}})
+      == {"a": {"b": 3, "c": 2}})
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_uilayout.py b/goodwe_controller/test_uilayout.py
new file mode 100644
index 0000000..70c4bdb
--- /dev/null
+++ b/goodwe_controller/test_uilayout.py
@@ -0,0 +1,205 @@
+"""UX-13 P0: the layout table places every option once.  `python3 test_uilayout.py`
+
+app/uilayout.py is the one place UI code names an option key
+(DECISIONS/UX-13-one-layout-table.md). This file fails CI when config.yaml
+gains an option the table does not place, and checks each row against the
+sources UX-02 keeps authoritative: config.yaml for ranges, translations and
+app/ui_text for words, validate.py for which entities are read as watts.
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import io
+import json
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import translations_lint as TL                                  # noqa: E402
+from app import uilayout as L, uimodel, validate                 # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+CONFIG = io.open(os.path.join(HERE, "config.yaml"), encoding="utf-8").read()
+ORDER, NESTED = TL.config_surface(CONFIG)
+TYPES = dict(re.findall(r"^  ([a-z_0-9]+): *(\S.*?) *$",
+                        CONFIG[CONFIG.index("\nschema:"):], re.M))
+EN = TL.parse_translation_file(os.path.join(HERE, "translations", "en.yaml"))
+UI_TEXT = json.load(io.open(os.path.join(HERE, "app", "ui_text", "en.json"),
+                            encoding="utf-8"))
+ROWS = list(L.fields())
+KEYS = [f.key for _g, _p, f in ROWS]
+
+
+def coverage_problems(order, nested):
+    """Every way the table and config.yaml's schema disagree."""
+    out = []
+    placed = [k for k in KEYS if not k.startswith(("ui.", "inverters."))]
+    for k in order:
+        n = placed.count(k) + (k in L.DERIVED) + (k in L.HIDDEN)
+        if n != 1:
+            out.append(f"{k} is placed {n} times")
+    out += [f"{k} is not in config.yaml" for k in
+            set(placed) | set(L.DERIVED) | set(L.HIDDEN) if k not in order]
+    sub = [k.split(".", 1)[1] for k in KEYS if k.startswith("inverters.")]
+    out += [f"inverters.{k} has no card field" for k in nested.get("inverters", [])
+            if sub.count(k) != 1]
+    out += [f"inverters.{k} is not in config.yaml" for k in sub
+            if k not in nested.get("inverters", [])]
+    return out
+
+
+print("1. every option has exactly one place")
+_p = coverage_problems(ORDER, NESTED)
+_fields = sum(1 for k in ORDER if k in KEYS)
+print(f"    {len(ORDER)} options: {_fields} fields, {len(L.DERIVED)} derived, "
+      f"{len(L.HIDDEN)} hidden. Problems: {_p}")
+check(f"config.yaml's {len(ORDER)} options are each a field, derived or hidden, "
+      "once", not _p and len(ORDER) >= 78)
+check("a new option without a place fails this check",
+      coverage_problems(ORDER + ["new_option_w"], NESTED)
+      == ["new_option_w is placed 0 times"])
+check("...and so does a new inverter field",
+      coverage_problems(ORDER, {"inverters": NESTED["inverters"] + ["mode"]})
+      == ["inverters.mode has no card field"])
+check("no key is both a field and derived",
+      not set(KEYS) & (set(L.DERIVED) | set(L.HIDDEN)))
+check("each derived key names the page field that writes it",
+      all(any(f.key == how for _g, _p2, f in ROWS)
+          for how in L.DERIVED.values()))
+
+print("\n2. each row is well formed")
+check("every control, entity kind and show operator is a known one",
+      all(f.control in L.CONTROLS and (not f.kind or f.kind in L.ENTITY_KINDS)
+          and all(op in L.SHOW_OPS for _n, op, _v in f.show)
+          for _g, _p2, f in ROWS))
+_names = set(ORDER) | set(KEYS) | {uimodel.COUNT} | set(uimodel.GROWN)
+check("every show condition reads an option, a page field, or the inverter "
+      "count or shape",
+      all(n in _names for _g, _p2, f in ROWS for n, _o, _v in f.show))
+check("every entity control has a kind, and no other control has one",
+      all((f.control in (L.ENTITY, L.ENTITY_LIST, L.SOLAR_LIST)) == bool(f.kind)
+          for _g, _p2, f in ROWS))
+check("everything applies after a restart: options are read at start, and "
+      "OPT-11's runtime switches are not built yet",
+      all(f.applies == L.RESTART for _g, _p2, f in ROWS))
+check("no unit states a number, so no range is written here",
+      all(not re.search(r"\d", f.unit) for _g, _p2, f in ROWS))
+
+
+_SCHEMA = CONFIG[CONFIG.index("\nschema:"):]
+_ROSTER = re.search(r"^  inverters:\n((?: {4,}.*\n)+)", _SCHEMA, re.M).group(1)
+ROSTER_TYPES = dict(re.findall(r"^ {4,}(?:- )?([a-z_0-9]+): *(\S+)", _ROSTER,
+                               re.M))
+
+
+def _type(key):
+    if key.startswith("inverters."):
+        return ROSTER_TYPES.get(key.split(".", 1)[1], "")
+    return TYPES.get(key, "")
+
+
+_ranged = [f.key for _g, _p2, f in ROWS
+           if f.control in (L.SLIDER, L.NUMBER, L.LOCKED)
+           and not f.key.startswith("ui.")]
+_unranged = [k for k in _ranged if not re.match(r"(int|float)\(", _type(k))]
+check(f"every slider, number and locked value has a range in config.yaml "
+      f"({len(_ranged)} of them, without: {_unranged})", not _unranged)
+_SUFFIX = (("_eur_kwh", "€/kWh"), ("_eur", "€/kWh"), ("_kwh", "kWh"),
+           ("_w", "W"), ("_s", "s"), ("_h", "h"), ("_min", "min"),
+           ("_days", "days"), ("_floor", "%"), ("_ceiling", "%"),
+           ("_target", "%"))
+
+
+def _unit_problem(f):
+    want = next((u for suf, u in _SUFFIX if f.key.endswith(suf)), None)
+    if want is None or f.control not in (L.SLIDER, L.NUMBER, L.LOCKED):
+        return False
+    return f.unit != want and not (want == "W" and f.unit == "kW"
+                                   and f.scale == 1000)
+
+
+_mism = [(f.key, f.unit) for _g, _p2, f in ROWS if _unit_problem(f)]
+check(f"each unit matches its key's suffix (mismatched: {_mism})", not _mism)
+check("the peak limit is shown in kW and stored in W",
+      L.field("peak_cap_w").unit == "kW" and L.field("peak_cap_w").scale == 1000)
+_watt = sorted({f.key.split(".")[-1] for _g, _p2, f in ROWS
+                if f.kind == "power_w"})
+check(f"the pickers that expect watts are exactly the entities validate.py "
+      f"reads as watts ({_watt})",
+      _watt == sorted(validate.WATT_ENTITY_KEYS))
+check("range_of() reads a Supervisor-shaped schema, nested ones too",
+      L.range_of("max_w", [{"name": "max_w", "lengthMin": 100,
+                            "lengthMax": 5000}]) == (100, 5000)
+      and L.range_of("inverters.max_w", [{"name": "inverters", "schema": [
+          {"name": "max_w", "lengthMin": 100, "lengthMax": 5000}]}])
+      == (100, 5000)
+      and L.range_of("p1_host", [{"name": "p1_host"}]) is None)
+
+print("\n3. the words come from translations and app/ui_text")
+_conf = EN["configuration"]
+_no_tr = [k for k in KEYS if not k.startswith("ui.") and not (
+    k in _conf if "." not in k
+    else k.split(".")[1] in _conf["inverters"]["fields"])]
+check(f"every option field has an en.yaml name (missing: {_no_tr})", not _no_tr)
+_no_ui = [k for k in KEYS if k.startswith("ui.")
+          and k[3:] not in UI_TEXT["fields"]]
+check(f"every page-only field has words in ui_text (missing: {_no_ui})",
+      not _no_ui)
+_titles = [g.id for g in L.GROUPS if g.id not in UI_TEXT["groups"]] + [
+    f"{g.id}.{p.id}" for g in L.GROUPS for p in g.parts
+    if p.id and f"{g.id}.{p.id}" not in UI_TEXT["parts"]]
+check(f"every group and part has a title (missing: {_titles})", not _titles)
+_contract = {"none", "fixed", "daynight", "dynamic", "custom"}
+check("every contract, fallback and region the model can hold has words",
+      set(UI_TEXT["choices"]["contract"]) == _contract
+      and set(UI_TEXT["choices"]["fallback"]) == _contract - {"dynamic"}
+      and set(UI_TEXT["choices"]["region"])
+      == set(uimodel.REGION_PRESETS) | {uimodel.OWN})
+check("both 'applies' labels have words",
+      set(UI_TEXT["applies"]) == {L.RESTART, L.NOW})
+
+print("\n4. visibility follows the page model")
+_m = uimodel.options_to_ui({"meter_source": "ha_signed", "meter_phases": 3,
+                            "inverters": [], "maintenance_enabled": False})
+check("a signed meter shows its net entity, and three phases its net list",
+      L.visible(L.field("p1_net_entity"), _m)
+      and L.visible(L.field("p1_phase_net_entities"), _m)
+      and not L.visible(L.field("meter_entity"), _m)
+      and not L.visible(L.field("p1_phase_import_entities"), _m))
+check("one inverter shows the one-inverter stops, not the per-inverter ones",
+      L.visible(L.field("sign_disagree_w"), _m)
+      and not L.visible(L.field("unit_sign_disagree_w"), _m))
+check("maintenance details hide while maintenance is off",
+      not L.visible(L.field("maintenance_charge_w"), _m))
+
+print("\n5. UI code names option keys in two files only")
+_KEY = re.compile(r"""["']([a-z0-9]+(?:_[a-z0-9]+)+)["']""")
+_src = io.open(os.path.join(HERE, "app", "uimodel.py"), encoding="utf-8").read()
+_owned = set(L.DERIVED) | {"inverters", "price_provider",
+                           "price_taxes_eur_kwh", "arbitrage_enabled"}
+_extra = sorted({k for k in _KEY.findall(_src) if k in ORDER} - _owned)
+check(f"uimodel.py names only the keys its derivations write (others: "
+      f"{_extra})", not _extra)
+_leak = sorted({f"{name}:{k}" for name in ("haentities.py", "web.py",
+                                          "uipage.py")
+                for k in _KEY.findall(io.open(os.path.join(HERE, "app", name),
+                                              encoding="utf-8").read())
+                if k in ORDER})
+check(f"haentities.py, web.py and uipage.py name no option key ({_leak})",
+      not _leak)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_uimodel.py b/goodwe_controller/test_uimodel.py
new file mode 100644
index 0000000..092e1da
--- /dev/null
+++ b/goodwe_controller/test_uimodel.py
@@ -0,0 +1,334 @@
+"""UX-13 P0: stored options <-> page model, exactly.  `python3 test_uimodel.py`
+
+app/uimodel.py derives the keys the page does not show (the flat inverter,
+the solar keys, static_profile, the levies figure, arbitrage_enabled). Part 1
+round-trips every options blob the test suite hands the validator
+(scenarios/ux13/, recorded by tools/ux13_validator_calls.py at 652097a), the
+TEST-23 option files and config.yaml's defaults: options -> model -> JSON ->
+options must be identical. Parts 2-6 edit one page field and check the blob.
+Mutating a module this file grades? Read MUTATION.md first (purge __pycache__).
+"""
+
+import glob
+import gzip
+import io
+import json
+import logging
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+logging.disable(logging.WARNING)            # the validator's own log lines
+
+from app import uimodel as U                                   # noqa: E402
+from app.price import (FLEMISH_TAXES_COMPONENTS_EUR_KWH,        # noqa: E402
+                       PRICE_OPTION_DEFAULTS)
+from app.static_tariff import parse_static_profile              # noqa: E402
+from app.validate import validate_startup_config                # noqa: E402
+
+fails = []
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        fails.append(name)
+
+
+def trip(options):
+    return U.ui_to_options(json.loads(json.dumps(U.options_to_ui(options))))
+
+
+def edit(options, **fields):
+    model = json.loads(json.dumps(U.options_to_ui(options)))
+    for k, v in fields.items():
+        model[k.replace("__", ".")] = v
+    return U.ui_to_options(model)
+
+
+def raises(fn):
+    try:
+        fn()
+    except U.DeriveError:
+        return True
+    return False
+
+
+def defaults():
+    """config.yaml's `options:` block, read without PyYAML (not in CI)."""
+    text = io.open(os.path.join(HERE, "config.yaml"), encoding="utf-8").read()
+    block = text[text.index("\noptions:"):text.index("\nschema:")]
+    out = {}
+    for key, raw in re.findall(r"^  ([a-z_0-9]+):(.*)$", block, re.M):
+        raw = raw.split(" #")[0].strip()
+        try:
+            out[key] = json.loads(raw)
+        except ValueError:
+            out[key] = raw
+    return out
+
+
+DEFAULTS = defaults()
+SITE = dict(DEFAULTS, setpoint_entity="number.goodwe_setpoint",
+            soc_entity="sensor.soc", batt_entity="sensor.batt")
+
+print("1. every known blob survives the round trip unchanged")
+_calls = [json.loads(line) for line in gzip.open(os.path.join(
+    HERE, "scenarios", "ux13", "validator-calls-652097a.jsonl.gz"), "rt")]
+_test23 = sorted(glob.glob(os.path.join(HERE, "scenarios", "ux13", "test23",
+                                        "*.json")))
+_blobs = ([("config.yaml", DEFAULTS)]
+          + [(c["source"], c["opts"]) for c in _calls
+             if isinstance(c["opts"], dict)]
+          + [(os.path.basename(f), json.load(open(f))) for f in _test23])
+_bad = []
+for _src, _o in _blobs:
+    try:
+        _back = trip(_o)
+    except Exception as e:                               # noqa: BLE001
+        _bad.append(f"{_src}: {type(e).__name__} {e}")
+        continue
+    if json.dumps(_back, sort_keys=True) != json.dumps(_o, sort_keys=True):
+        _bad.append(f"{_src}: {sorted(set(_back) ^ set(_o)) or 'values'}")
+print(f"    {len(_calls)} validator calls, {len(_test23)} TEST-23 files, "
+      f"config.yaml defaults")
+check(f"all {len(_blobs)} are identical after options -> model -> JSON -> "
+      f"options (not: {_bad[:3]})", not _bad and len(_calls) >= 200
+      and len(_test23) >= 5 and len(DEFAULTS) >= 78)
+check("config.yaml was read whole: the defaults hold every option",
+      "inverters" in DEFAULTS and DEFAULTS["inverters"] == []
+      and DEFAULTS["price_taxes_eur_kwh"] == 0.11736)
+_m = U.options_to_ui(DEFAULTS)
+check("the page model never shows a derived key: it keeps them aside",
+      not {"setpoint_entity", "pv_entity", "pv_entities", "static_profile",
+           "price_taxes_profile"} & set(_m)
+      and set(_m["keep"]) >= {"static_profile", "pv_entity", "max_w"})
+check("a blob that lacks keys gains none", trip({"max_w": 900}) == {"max_w": 900})
+
+print("\n2. one inverter or a list")
+_one = edit(SITE, inverters=[dict(U.options_to_ui(SITE)["inverters"][0],
+                                  max_w=1500)])
+check("editing the one inverter writes the flat keys and keeps the list empty",
+      _one["max_w"] == 1500 and _one["inverters"] == []
+      and _one["setpoint_entity"] == "number.goodwe_setpoint")
+_card = U.options_to_ui(SITE)["inverters"][0]
+_two = edit(SITE, inverters=[
+    dict(_card, name="inverter-a", capacity_kwh=None),
+    dict(_card, name="inverter-b", setpoint_entity="number.goodwe_b",
+         soc_entity="sensor.soc_b", batt_entity="sensor.batt_b")])
+check("a second inverter writes the list and clears the flat power request "
+      "entity, which the validator refuses beside a list",
+      len(_two["inverters"]) == 2 and _two["setpoint_entity"] == ""
+      and "capacity_kwh" not in _two["inverters"][0]
+      and not validate_startup_config(_two))
+_listed = dict(SITE, setpoint_entity="", inverters=[
+    {"name": "garage", "setpoint_entity": "number.g", "max_w": 2000,
+     "bms_soc_floor": 10}])
+_l1 = edit(_listed, inverters=[dict(_listed["inverters"][0], max_w=1800)])
+check("a list of one stays a list, so the inverter keeps its name and stored "
+      "state", _l1["inverters"] == [dict(_listed["inverters"][0], max_w=1800)])
+check("editing a listed inverter keeps the unread flat keys as stored",
+      all(_l1[k] == _listed[k] for k in ("setpoint_entity", "soc_entity",
+                                          "batt_entity", "max_w")))
+check("a name on the flat inverter is refused rather than dropped",
+      raises(lambda: edit(SITE, inverters=[dict(_card, name="garage")])))
+_raw = dict(SITE, inverters="garage")
+check("a roster no card can show is kept when another field is saved, and "
+      "cannot be edited here",
+      edit(_raw, gain=0.5)["inverters"] == "garage"
+      and raises(lambda: edit(_raw, inverters=[_card])))
+
+print("\n3. solar rows")
+check("a stored flip reads as a reversed row",
+      U.options_to_ui(dict(DEFAULTS, pv_entity="sensor.pv",
+                           pv_invert_entities=["sensor.pv"]))["ui.solar"]
+      == [{"entity": "sensor.pv", "reversed": True}])
+check("one row writes pv_entity",
+      edit(DEFAULTS, ui__solar=[{"entity": "sensor.pv", "reversed": False}])
+      ["pv_entity"] == "sensor.pv")
+_pv2 = edit(dict(DEFAULTS, pv_entity="sensor.a"), ui__solar=[
+    {"entity": "sensor.a", "reversed": False},
+    {"entity": "sensor.b", "reversed": True}])
+check("two rows write pv_entities, clear pv_entity and flip the reversed one",
+      _pv2["pv_entities"] == ["sensor.a", "sensor.b"] and _pv2["pv_entity"] == ""
+      and _pv2["pv_invert_entities"] == ["sensor.b"])
+_stray = dict(DEFAULTS, pv_entities=["sensor.a", "sensor.b"],
+              pv_invert_entities=["sensor.b", "sensor.old"])
+_pv1 = edit(_stray, ui__solar=[{"entity": "sensor.a", "reversed": False}])
+check("removing a reversed row drops its flip, and a flip that was never a row "
+      "stays as stored", _pv1["pv_entities"] == ["sensor.a"]
+      and _pv1["pv_invert_entities"] == ["sensor.old"])
+
+print("\n4. contract and prices")
+_fixed = edit(DEFAULTS, ui__contract="fixed", ui__fixed_price=0.31)
+check("a fixed price writes a profile the tariff parser reads as one price",
+      _fixed["price_provider"] == "off"
+      and [p.eur_per_kwh for p in parse_static_profile(
+          _fixed["static_profile"]).periods] == [0.31]
+      and U.options_to_ui(_fixed)["ui.contract"] == "fixed")
+_dn = edit(SITE, ui__contract="daynight", ui__day_price=0.34,
+           ui__night_price=0.26)
+check("day and night write a profile that starts and reads back the same",
+      not validate_startup_config(_dn)
+      and U.options_to_ui(_dn)["ui.day_price"] == 0.34
+      and U.options_to_ui(_dn)["ui.night_price"] == 0.26)
+_dyn = edit(_dn, ui__contract="dynamic", price_provider="generic_dayahead")
+check("a dynamic contract keeps the day and night profile as its fallback",
+      _dyn["price_provider"] == "generic_dayahead"
+      and _dyn["static_profile"] == _dn["static_profile"])
+check("a dynamic contract without a price source is refused here",
+      raises(lambda: edit(DEFAULTS, ui__contract="dynamic")))
+_odd = json.dumps({"periods": [
+    {"from": "00:00", "to": "12:00", "days": "mon-sun", "eur_per_kwh": 0.2},
+    {"from": "12:00", "to": "24:00", "days": "mon-sun", "eur_per_kwh": 0.3}]})
+_om = U.options_to_ui(dict(DEFAULTS, static_profile=_odd))
+check("odd windows show as 'custom' and survive saving another field",
+      _om["ui.contract"] == "custom"
+      and edit(dict(DEFAULTS, static_profile=_odd), gain=0.5)
+      ["static_profile"] == _odd)
+
+print("\n5. region presets")
+_fl = U.REGION_PRESETS["flanders"]
+check("the Flanders preset is the sum of app/price.py's components, and is the "
+      "shipped default", _fl["taxes_eur_kwh"] == round(sum(
+          v for _n, v in FLEMISH_TAXES_COMPONENTS_EUR_KWH), 5)
+      == PRICE_OPTION_DEFAULTS["price_taxes_eur_kwh"] == DEFAULTS[
+          "price_taxes_eur_kwh"])
+check("every preset carries its year", all(
+    isinstance(p["year"], int) and p["year"] >= 2026
+    for p in U.REGION_PRESETS.values()))
+_own = dict(DEFAULTS, price_taxes_eur_kwh=0.06)
+check("a figure that is no preset reads as 'own', and choosing Flanders "
+      "writes the preset", U.options_to_ui(_own)["ui.region"] == U.OWN
+      and edit(_own, ui__region="flanders")["price_taxes_eur_kwh"] == 0.11736)
+_prof = dict(DEFAULTS, price_taxes_eur_kwh=0.12,
+             price_taxes_profile='{"day": 0.14, "night": 0.1}')
+check("'own' keeps a stored levies table when the figure is edited",
+      edit(_prof, price_taxes_eur_kwh=0.13)["price_taxes_profile"]
+      == _prof["price_taxes_profile"])
+check("'own' stores the typed figure",
+      edit(DEFAULTS, ui__region=U.OWN, price_taxes_eur_kwh=0.13)
+      ["price_taxes_eur_kwh"] == 0.13)
+
+print("\n6. arbitrage_enabled: the OPT-11 hook changes nothing yet")
+check("the hook answers None while battery modes do not exist",
+      U.arbitrage_from_batteries(U.options_to_ui(DEFAULTS)) is None)
+check("so the toggle is stored as the page has it",
+      edit(DEFAULTS, arbitrage_enabled=True)["arbitrage_enabled"] is True)
+
+print("\n7. the time-window editor (UX-13 P5)")
+
+
+def rows(*spec):
+    return [{"from": a, "to": b, "days": d, "price": p} for a, b, d, p in spec]
+
+
+def periods(r, base=SITE):
+    return edit(base, ui__contract="custom", ui__fallback="custom",
+                ui__periods=r)
+
+
+def refused(r):
+    """(code, values) of the DeriveError the rows give, or None."""
+    try:
+        periods(r)
+    except U.DeriveError as err:
+        return err.code, err.values
+    return None
+
+
+# Five windows the day/night preset cannot say: a weekday peak, a weekday
+# night, Saturday split at noon, and Sunday.
+_five = rows(("06:30", "21:15", "mon-fri", 0.31), ("21:15", "06:30", "mon-fri", 0.19),
+             ("00:00", "12:00", "sat", 0.2), ("12:00", "00:00", "sat", 0.25),
+             ("00:00", "24:00", "sun", 0.18))
+_p5 = periods(_five)
+_prof5 = parse_static_profile(_p5["static_profile"])
+check("five odd windows write a profile the tariff parser reads, with every "
+      "price in place", [p.eur_per_kwh for p in _prof5.periods]
+      == [0.31, 0.19, 0.2, 0.25, 0.18] and _prof5.periods[3].end_min == 1440)
+check("...that the shipped start checks accept, and that reads back as the "
+      "same rows", not validate_startup_config(_p5)
+      and U.options_to_ui(_p5)["ui.contract"] == "custom"
+      and [(r["from"], r["to"], r["days"], r["price"])
+           for r in U.options_to_ui(_p5)["ui.periods"]]
+      == [("06:30", "21:15", "mon-fri", 0.31), ("21:15", "06:30", "mon-fri", 0.19),
+          ("00:00", "12:00", "sat", 0.2), ("12:00", "24:00", "sat", 0.25),
+          ("00:00", "24:00", "sun", 0.18)])
+_named = dict(SITE, static_profile=json.dumps({"periods": [
+    {"name": "peak", "from": "08:00", "to": "20:00", "days": "mon-sun",
+     "eur_per_kwh": 0.33},
+    {"name": "offpeak", "from": "20:00", "to": "08:00", "days": "mon-sun",
+     "eur_per_kwh": 0.21}]}))
+_rows = U.options_to_ui(_named)["ui.periods"]
+_rows[1]["price"] = 0.2
+check("a stored profile's window names are kept when a price changes",
+      [p.name for p in parse_static_profile(periods(_rows, base=_named)
+                                            ["static_profile"]).periods]
+      == ["peak", "offpeak"])
+check("the day and night preset shows as three rows, so 'Other time windows' "
+      "starts from what is stored",
+      [r["days"] for r in U.options_to_ui(
+          edit(SITE, ui__contract="daynight", ui__day_price=0.3,
+               ui__night_price=0.2))["ui.periods"]]
+      == ["mon-fri", "mon-fri", "sat,sun"])
+check("an overlap is named: the two windows, the day and the times",
+      refused(rows(("07:00", "23:00", "mon-fri", 0.3),
+                   ("22:00", "07:00", "mon-fri", 0.2),
+                   ("00:00", "24:00", "sat,sun", 0.2)))
+      == ("period_overlap", {"day": "mon", "from": "22:00", "to": "23:00",
+                             "a": 1, "b": 2}))
+check("a gap is named: the day and the times",
+      refused(rows(("07:00", "22:00", "mon-sun", 0.3),
+                   ("22:00", "24:00", "mon-sun", 0.2)))
+      == ("period_gap", {"day": "mon", "from": "00:00", "to": "07:00"}))
+check("an overlap that changes partners is named piece by piece: windows 1 "
+      "and 2 first, over their own times only",
+      refused(rows(("00:00", "24:00", "mon-sun", 0.3),
+                   ("06:00", "08:00", "mon-sun", 0.2),
+                   ("08:00", "10:00", "mon-sun", 0.2)))
+      == ("period_overlap", {"day": "mon", "from": "06:00", "to": "08:00",
+                             "a": 1, "b": 2}))
+check("a gap on one day only is found on that day",
+      refused(rows(("00:00", "24:00", "mon-fri", 0.3),
+                   ("00:00", "24:00", "sat", 0.2)))
+      == ("period_gap", {"day": "sun", "from": "00:00", "to": "24:00"}))
+check("bad times are named by window: '7h', '25:00', '07:60', '24:00' as a "
+      "start", all(refused(rows(("00:00", "24:00", "mon-sun", 0.2), (a, b, "mon", 0.1)))
+                   == ("period_time", {"row": 2}) for a, b in
+                   (("7h", "08:00"), ("25:00", "08:00"), ("07:60", "08:00"),
+                    ("24:00", "08:00"), ("07:00", "")))
+      and refused(rows(("7:00", "07:00", "mon-sun", 0.2)))
+      == ("period_zero", {"row": 1}))
+check("an empty price, and a price in cents, are named by window",
+      refused(rows(("00:00", "24:00", "mon-sun", None)))
+      == ("period_price", {"row": 1})
+      and refused(rows(("00:00", "24:00", "mon-sun", 34)))
+      == ("period_price_range", {"row": 1}))
+check("no windows at all is refused", refused([]) == ("no_periods", {}))
+from app import uipage                                          # noqa: E402
+_msg = uipage.derive_message(U.DeriveError("x", "period_overlap", "ui.periods",
+                                           day="sat", a=1, b=3, **{
+                                               "from": "06:00", "to": "07:00"}))
+_nl = uipage.derive_message(U.DeriveError("x", "period_gap", "ui.periods",
+                                          day="sun", **{"from": "00:00",
+                                                        "to": "07:00"}), "nl")
+check(f"the page shows the error beside the editor, with the day by name "
+      f"({_msg['text']!r}, {_nl['text']!r})",
+      _msg["field"] == "ui.periods" and "Windows 1 and 3" in _msg["text"]
+      and "Saturday 06:00 to 07:00" in _msg["text"]
+      and "zondag 00:00 tot 07:00" in _nl["text"])
+_raw = json.dumps({"periods": [
+    {"from": "00:00", "to": "24:00", "days": "mon,wed", "eur_per_kwh": 0.2},
+    {"from": "00:00", "to": "24:00", "days": "tue,thu-sun", "eur_per_kwh": 0.3}]})
+check("days the editor has no choice for stay in the Configuration tab, and "
+      "survive a save", U.options_to_ui(dict(SITE, static_profile=_raw))
+      ["ui.periods"] is None and edit(dict(SITE, static_profile=_raw), gain=0.5)
+      ["static_profile"] == _raw)
+
+print()
+if fails:
+    print(f"{len(fails)} FAILED")
+    sys.exit(1)
+print("all passed")
diff --git a/goodwe_controller/test_validate.py b/goodwe_controller/test_validate.py
index c38a704..ea9c5df 100644
--- a/goodwe_controller/test_validate.py
+++ b/goodwe_controller/test_validate.py
@@ -77,7 +77,7 @@ p = validate_startup_config(base(max_w=8000), -5000, 5000)
 check("max_w above the device maximum is refused", len(p) == 1)
 check("...and the message names the configured value", why(p, "8000"))
 check("...and the device's value", why(p, "5000"))
-check("...and says which one wins", why(p, "THE DEVICE WINS"))
+check("...and says what to lower it to", why(p, "Lower the rating to 5000 W"))
 check("max_w exactly at the device maximum is fine",
       validate_startup_config(base(max_w=5000), -5000, 5000) == [])
 check("max_w under it is fine",
@@ -85,7 +85,7 @@ check("max_w under it is fine",
 # The charge side is a separate rail and an asymmetric device is legal.
 p = validate_startup_config(base(max_w=4000), -2500, 5000)
 check("a max_w the device cannot take on the CHARGE side is refused too",
-      len(p) == 1 and why(p, "charge side"))
+      len(p) == 1 and why(p, "when charging"))
 check("...naming the device's floor", why(p, "-2500"))
 # ⚠️ Not guessed at: the entity may simply not have booted yet. run_control()
 # re-runs this the moment the real rating arrives.
@@ -122,7 +122,7 @@ check("...and rule 2 REFUSES that whole configuration at startup, which is why "
       len(validate_startup_config(base(max_w=_CEIL), -_DEV, _DEV)) == 1)
 check("...on the rating side specifically, not incidentally through some other "
       "rule", why(validate_startup_config(base(max_w=_CEIL), -_DEV, _DEV),
-                  "THE DEVICE WINS"))
+                  "Lower the rating to"))
 check("...and the case the refusal CANNOT reach - the rating unread because "
       "ESPHome was not up - still starts, which is precisely why SAFETY-20's "
       "answer had to be a runtime status row and not a startup gate",
@@ -136,9 +136,9 @@ print("2. an actuator to write to")
 for blank in ("", "   ", None):
     p = validate_startup_config(base(setpoint_entity=blank), None, None)
     check(f"setpoint_entity {blank!r} is refused", len(p) == 1)
-check("...and the message says why it is dangerous rather than untidy",
+check("...and the message says what it costs: nothing is controlled",
       why(validate_startup_config(base(setpoint_entity=""), None, None),
-          "heartbeat"))
+          "cannot control the inverter"))
 # --------------------------------------------------------------------------- #
 # specs §1.5: TWO WRITERS ON ONE ACTUATOR, AND WHAT ACTUALLY GRADES IT
 # --------------------------------------------------------------------------- #
@@ -181,7 +181,7 @@ check("...and the replacement SEES it, because it counts writers per ACTUATOR "
       and len(_census["number.goodwe_setpoint"]) == 3)
 _hazard_problems = validate_startup_config(_PER_INVERTER_HAZARD, -5000, 5000)
 check("AC 3: and the config is REFUSED, where today it starts",
-      why(_hazard_problems, "one actuator"))
+      why(_hazard_problems, "point at the same inverter entity"))
 check("...and the refusal names the actuator and every writer aimed at it, so "
       "an operator can see WHICH declarations to remove rather than being told "
       "only that something is wrong",
@@ -243,7 +243,8 @@ check("...and entity ids are folded to lower case, so a second writer cannot "
       "be smuggled past the census on Number.X versus number.x",
       why(validate_startup_config(base(inverters=[{"setpoint_entity":
                                                    "NUMBER.GOODWE_SETPOINT"}]),
-                                  -5000, 5000), "one actuator"))
+                                  -5000, 5000),
+          "point at the same inverter entity"))
 # ⚠️ THIS CHECK CHANGED SHAPE IN CFG-04, AND THE REASON IS A DECISION RATHER
 # THAN AN ADJUSTMENT. It used to assert that a blank per-inverter entity left
 # the whole config ACCEPTED - "blank is how an operator leaves a slot
@@ -265,7 +266,8 @@ check("...but the ENTRY is refused all the same, by rule 9 and not by the "
       why(validate_startup_config(base(inverters=[{"name": "inverter-b",
                                                    "max_w": 2000,
                                                    "setpoint_entity": "  "}]),
-                                  -5000, 5000), "has no setpoint_entity"))
+                                  -5000, 5000),
+          "has no “Inverter setpoint entity” (setpoint_entity)"))
 
 # --- OPT-09: `capacity_kwh`, which is OPTIONAL but not PARTIAL ---------------
 # ⚠️ RULE 9 GAINED TWO CLAUSES AND BOTH REFUSE A CONFIG THAT WOULD OTHERWISE
@@ -303,9 +305,9 @@ check("⚠️ AND A PARTIAL ROSTER IS REFUSED - stated on one entry and left emp
       "weighing a dimensionless 1.0 is not a comparison, so the key would "
       "silently change nothing at all",
       why(validate_startup_config(_with_cap(15.36, None), -5000, 5000),
-          "not PARTIAL")
+          "Set it on every inverter, or on none")
       and why(validate_startup_config(_with_cap(None, 20.48), -5000, 5000),
-              "not PARTIAL"))
+              "Set it on every inverter, or on none"))
 check("...and the refusal names WHICH entry is which, because an operator with "
       "three inverters told 'one of them is wrong' is sent to the wrong "
       "cupboard",
@@ -339,7 +341,7 @@ check("a phase list disagreeing with meter_phases is refused",
       why(validate_startup_config(base(meter_source="ha_signed",
                                        p1_net_entity="sensor.n", meter_phases=3,
                                        p1_phase_net_entities=["a", "b"]),
-                                  -5000, 5000), "phase-count"))
+                                  -5000, 5000), "Make them match"))
 check("mqtt_p1 with no topic is refused",
       why(validate_startup_config(base(meter_source="mqtt_p1"), -5000, 5000),
           "meter_mqtt_topic"))
@@ -349,7 +351,7 @@ check("ha_dsmr with only half its entities is refused",
           "p1_export_entity"))
 check("a misspelt meter_source is refused rather than silently ignored",
       why(validate_startup_config(base(meter_source="ha_signd"), -5000, 5000),
-          "is not one of"))
+          "Choose one of"))
 
 # --------------------------------------------------------------------------- #
 print("4. meter_max_age_s against the firmware's compile-time veto")
@@ -361,7 +363,8 @@ p = validate_startup_config(base(**hw, meter_max_age_s=120), -5000, 5000)
 check("a meter_max_age_s above the firmware veto is refused", len(p) == 1)
 check("...naming the configured value", why(p, "120"))
 check("...naming the firmware's value", why(p, "30"))
-check("...and saying which one wins", why(p, "THE FIRMWARE WINS"))
+check("...and saying that the control board stops the inverter first",
+      why(p, "control board stops the inverter after 30 s"))
 check("the tested pair 30/30 is accepted",
       validate_startup_config(base(**hw, meter_max_age_s=30), -5000, 5000) == [])
 check("one second above it is refused",
@@ -391,7 +394,7 @@ p = validate_startup_config(base(max_w=2000, maintenance_charge_w=2500),
 check("maintenance_charge_w above max_w is refused", len(p) == 1)
 check("...and the message names the charge rate", why(p, "2500"))
 check("...and the ceiling", why(p, "2000"))
-check("...and says which one wins", why(p, "THE CEILING WINS"))
+check("...and says what it blocks", why(p, "monthly recharge cannot run"))
 # ⚠️ Equality is REACHABLE, not a near miss: lo=-2000, hi=-2000 is the single
 # point -2000 W. Refusing it would be exactly the trivia that gets a validator
 # deleted, and it is the boundary the rule is written `>` for.
@@ -407,7 +410,8 @@ check("below it starts",
 check("...and it is refused with maintenance_enabled off, as shipped",
       why(validate_startup_config(
           base(max_w=2000, maintenance_charge_w=2500,
-               maintenance_enabled=False), -5000, 5000), "THE CEILING WINS"))
+               maintenance_enabled=False), -5000, 5000),
+      "monthly recharge cannot run"))
 
 # ⚠️ MAINT-05: AND AT TWO PACKS IT IS THE WEAKEST CAP, NOT THE FIRST ENTRY'S.
 # The comment this replaces in validate.py said, in as many words, that it took
@@ -448,11 +452,11 @@ check("⚠️ A CHARGE RATE THE SMALLEST PACK CANNOT TAKE IS REFUSED, even thoug
       "recalibrated, so its cap could not contradict anything; it is now, and "
       "its cheap-window charge would ask for hi=-3000 against lo=-2000 - the "
       "`lo > hi` contradiction, 0 W, on the pack nobody was watching",
-      len(_p_two) == 1 and why(_p_two, "max_w (inverter-b) is 2000 W"))
+      len(_p_two) == 1 and why(_p_two, "for inverter-b (inverters.max_w) is 2000 W"))
 check("...and the message names the pack the number came off, not the first "
       "entry - an operator told to lower a number on the wrong device is being "
       "sent to the wrong device by the message that exists to stop that",
-      not why(_p_two, "max_w (inverter-a)"))
+      not why(_p_two, "for inverter-a (inverters.max_w)"))
 check("...while the same rate against two packs that can both take it starts, "
       "so this is a comparison and not a blanket refusal of rosters",
       [p for p in validate_startup_config(
@@ -463,7 +467,7 @@ check("...while the same rate against two packs that can both take it starts, "
 check("...and at a ROSTER OF ONE `min()` over one cap is that cap: the same "
       "message, the same boundary, the same refusal the flat config always got",
       why(validate_startup_config(base(max_w=2000, maintenance_charge_w=2500),
-                                  -5000, 5000), "THE CEILING WINS")
+                                  -5000, 5000), "monthly recharge cannot run")
       and validate_startup_config(base(max_w=2000, maintenance_charge_w=2000),
                                   -5000, 5000) == [])
 
@@ -539,17 +543,15 @@ check("⭐ RESTORING THE 2026-09-05 PAIR - slew_w 1000 at max_w 5000 - IS REFUSE
       "It crosses the whole output range in 10 s against a plant measured at "
       "18 s, which is not a fast loop, it is a loop that commands its entire "
       "range before it can observe its answer to the first step",
-      len(_broken) == 1 and why(_broken, "slew_w is 1000 W"))
-check("...and the refusal says WHICH RAIL it graded against and HOW LONG the "
-      "crossing takes, because 'slew_w is too high' sends an operator to lower "
-      "a number when raising max_w or setting 0 are both correct answers too",
-      why(_broken, "site rail of 5000 W")
-      and why(_broken, "crosses its whole output range in 5.0 cycles"))
-check("...and it names the plant measurement it is graded against, so the "
-      "number is traceable to a step response rather than to a preference",
-      why(_broken, "goodwe/NOTES.md §5.10"))
+      len(_broken) == 1 and why(_broken, "(slew_w) is 1000 W"))
+check("...and the refusal says WHICH RAIL it graded against, because 'slew_w "
+      "is too high' sends an operator to lower a number when raising max_w or "
+      "setting 0 are both correct answers too",
+      why(_broken, "for a 5000 W site"))
+# UX-08 2c: the plant measurement the rule is graded against (the ~18 s step
+# response) is in DOCS.md "For installers", beside slew_w, not in the refusal.
 check("...and it says what to DO, including the setting that cannot go stale",
-      why(_broken, "Set slew_w to 0") and why(_broken, "556 W"))
+      why(_broken, "Set it to 0") and why(_broken, "556 W"))
 
 # THE BOUNDARY. Equality is the DERIVED VALUE, not a violation - at exactly
 # `SLEW_RAIL_FRAC * rail` the loop takes precisely the plant's settling time to
@@ -600,7 +602,7 @@ check("slew_w 0 - FOLLOW THE RAIL - is never refused at any rating, which it "
 check("a negative slew_w is refused as nonsense rather than treated as 0 - it "
       "is a magnitude, and 0 already has a meaning here",
       why(validate_startup_config(dict(_R5000, slew_w=-400), -5000, 5000),
-          "must not be negative"))
+          "cannot be negative"))
 
 # ⭐ THE ROSTER, WHICH IS THE WHOLE REASON THIS GRADES A SUM. `slew_w` is not a
 # per-unit quantity: main.py builds `Tuning(max_w=self.site_max_w)` and
@@ -649,7 +651,7 @@ check("...so the same explicit slew_w that is REFUSED at a 5000 W rail is "
 check("...and a slew that outruns even the doubled rail is still refused there, "
       "so the roster path is not simply un-graded",
       why(validate_startup_config(_roster(slew_w=2000)),
-          "site rail of 9600 W"))
+          "for a 9600 W site"))
 
 # --------------------------------------------------------------------------- #
 print("the SHIPPED defaults must pass the rule they are governed by (AC3)")
@@ -777,9 +779,10 @@ print("max_w must be a positive magnitude")
 # sim/inject.py's entry point and can be handed any dict at all.
 for bad in (0, -1, -2000):
     p = validate_startup_config(base(max_w=bad), -5000, 5000)
-    check(f"max_w {bad} is refused", len(p) == 1 and why(p, "must be positive"))
-check("...and the message explains it would read as a trip, not a mistake",
-      why(validate_startup_config(base(max_w=0), -5000, 5000), "contradiction"))
+    check(f"max_w {bad} is refused", len(p) == 1 and why(p, "Set it above 0 W"))
+check("...and the message names the setting by its label and its key",
+      why(validate_startup_config(base(max_w=0), -5000, 5000),
+          "“Inverter rating” (max_w) is 0 W"))
 # ⚠️ SAFETY-02 changed what this case has to say, and the change is real rather
 # than bookkeeping: with a 1 W ceiling the default 300 W sign-disagreement
 # threshold is unreachable, so rule 5 refuses - correctly, because the watchdog
@@ -792,7 +795,7 @@ check("the smallest sane max_w still starts",
                                    unit_sign_disagree_w=0.5,
                                    maintenance_charge_w=1), -5000, 5000) == [])
 check("...but that same 1 W ceiling with the DEFAULT sign threshold is refused",
-      why(validate_startup_config(base(max_w=1), -5000, 5000), "never fire"))
+      why(validate_startup_config(base(max_w=1), -5000, 5000), "can never trip"))
 # ⚠️ SAFETY-30 ADDED A SECOND WAY TO DISARM A SIGN WATCHDOG BY CONFIGURATION,
 # and the fixture above now has to name BOTH thresholds - which is the check
 # doing its job rather than a bookkeeping edit. `unit_sign_disagree_w` bounds a
@@ -1188,9 +1191,9 @@ def _roster_n(caps, **over):
 # The three rules that reduce over `unit_caps_indexed()`, each as
 # (option name, the token its refusal is recognised by).
 _CAP_RULES = (
-    ("sign_disagree_w", "SAFETY-02 sign-disagreement"),
-    ("unit_sign_disagree_w", "SAFETY-30 per-inverter sign-disagreement"),
-    ("maintenance_charge_w", "maintenance charge in a cheap window"),
+    ("sign_disagree_w", "(sign_disagree_w) is"),
+    ("unit_sign_disagree_w", "(unit_sign_disagree_w) is"),
+    ("maintenance_charge_w", "monthly recharge cannot run"),
 )
 _QUIET = {"sign_disagree_w": 300.0, "unit_sign_disagree_w": 300.0,
           "maintenance_charge_w": 1000.0, "maintenance_discharge_w": 1000.0}
@@ -1220,7 +1223,8 @@ def _verdict(opts, token):
     ps = [p for p in validate_startup_config(opts, -5000, 5000) if token in p]
     if not ps:
         return (False, None, None)
-    m = re.search(r"max_w \(([^)]+)\) is (\d+) W", ps[0])
+    m = re.search(r"for (\S+) \(inverters\.max_w\),? (?:is|at) (\d+) W",
+                  ps[0])
     return (True, m.group(1) if m else None, float(m.group(2)) if m else None)
 
 
@@ -1330,7 +1334,7 @@ check("...and at a ROSTER OF ONE every candidate that still has a member to "
       and {n for n, v in _at_one.items() if v is None}
       == {"min(caps[1:])", "min(caps[:-1])"}
       and _verdict(_roster_n([_SMALL], **dict(_QUIET, sign_disagree_w=_RATE)),
-                   "SAFETY-02 sign-disagreement")[0])
+                   "(sign_disagree_w) is")[0])
 
 # --- rule 5's SIBLING BRANCH, which was reading the FLAT max_w --------------
 # ⚠️ FOUND BY READING THE THREE BRANCHES SIDE BY SIDE, NOT BY THE STRUCTURAL
@@ -1342,7 +1346,7 @@ check("...and at a ROSTER OF ONE every candidate that still has a member to "
 _leftover = _roster_n([_SMALL, _SMALL],
                       **dict(_QUIET, unit_sign_disagree_w=_RATE))
 _leftover["max_w"] = _BIG          # what a single-inverter install leaves behind
-_lv = _verdict(_leftover, "SAFETY-30 per-inverter sign-disagreement")
+_lv = _verdict(_leftover, "(unit_sign_disagree_w) is")
 print(f"    leftover flat max_w {_BIG:.0f} beside a roster of two "
       f"{_SMALL:.0f} W units, unit_sign_disagree_w {_RATE:.0f} -> {_lv}")
 check("⚠️ A LEFTOVER FLAT `max_w` NO LONGER DISARMS SAFETY-30's PER-UNIT "
@@ -1358,7 +1362,7 @@ check("...and the over-refusal in the OTHER direction is gone too: a roster of "
       "reach. It starts",
       _verdict(_roster_n([_BIG, _BIG],
                          **dict(_QUIET, unit_sign_disagree_w=_RATE)),
-               "SAFETY-30 per-inverter sign-disagreement")
+               "(unit_sign_disagree_w) is")
       == (False, None, None))
 check("...and the flat single-inverter config it always refused is refused "
       "IDENTICALLY - `unit_caps()` at a roster of one is `[max_w]`, so this is "
@@ -1411,7 +1415,7 @@ print(f"    {(_T17_P_GAP or [''])[0][:120]}")
 check("a table that leaves 00:00-07:00 unpriced is REFUSED, by the same tiling "
       "rule static_profile has - and the refusal names the KEY and the HOURS, "
       "not merely that something was wrong",
-      why(_T17_P_GAP, "price_taxes_profile cannot be used:")
+      why(_T17_P_GAP, "“Day/night levies and VAT” cannot be used.")
       and why(_T17_P_GAP, "leaves mon 00:00-07:00 with no period"))
 check("...and it is refused for THAT reason and not as a side effect of "
       "something else this fixture happens to break: exactly one problem",
@@ -1427,9 +1431,9 @@ print(f"    {(_T17_P_BOTH or [''])[0][:120]}")
 check("the table AND a non-default price_taxes_eur_kwh is refused, and the "
       "refusal says WHICH ONE WINS and what to do - not merely that the two "
       "are incompatible",
-      why(_T17_P_BOTH, "price_taxes_profile is set AND price_taxes_eur_kwh is "
-                       "0.1198")
-      and why(_T17_P_BOTH, "THE TABLE WINS"))
+      why(_T17_P_BOTH, "(price_taxes_profile) is set, so")
+      and why(_T17_P_BOTH, "(price_taxes_eur_kwh) is not used. Set it "
+                           "back to"))
 check("...and the SHIPPED scalar beside the table is NOT refused, or every "
       "Walloon site would have to clear a key it never touched. The refusal is "
       "about a value the operator chose, and the shipped default is the one "
@@ -1479,19 +1483,16 @@ check("...while a value that is NEITHER the shipped default NOR a superseded "
       "one is still REFUSED beside the table, naming it - the set of "
       "'untouched' figures widened by exactly the old defaults and by nothing "
       "else",
-      why(_T17_P_BOTH, "price_taxes_profile is set AND price_taxes_eur_kwh is "
-                       "0.1198")
+      why(_T17_P_BOTH, "from 0.1198, or clear")
       and 0.1198 not in _T18_SUPERSEDED
       and abs(0.1198 - _T18_SHIPPED_TAXES) > 1e-9)
 # ⚠️ AND THE REFUSAL SAYS SO, so an operator who HAS typed a number is told
 # both which figure to return to and that the old default is not the problem.
-check("...and the refusal names the SHIPPED default to return to AND says the "
-      "superseded default is accepted, so the sentence is actionable on both "
-      "sides of the upgrade",
+# UX-08 2c: that a superseded default is accepted is said in DOCS.md "For
+# installers" now. The refusal keeps the one figure the operator acts on.
+check("...and the refusal names the SHIPPED default to return to",
       bool(_T18_SUPERSEDED)
-      and why(_T17_P_BOTH, f"back to {_T18_SHIPPED_TAXES}")
-      and why(_T17_P_BOTH, "SUPERSEDED")
-      and all(why(_T17_P_BOTH, str(u)) for u in _T18_SUPERSEDED))
+      and why(_T17_P_BOTH, f"back to {_T18_SHIPPED_TAXES}"))
 check("...and the same non-default scalar WITHOUT the table still starts, "
       "which is what makes the line above about the PAIR rather than about "
       "0.1198 being disliked",
@@ -1531,18 +1532,18 @@ print(f"    ORES    : {(_T17_P_ORES or [''])[0][:110]}")
 print(f"    Sibelga : {(_T17_P_SIB or [''])[0][:110]}")
 check("ORES's card typed in CENTS is refused by the PARSER's bound, and the "
       "sentence is the parser's - `beyond +-10.0`, naming the row",
-      why(_T17_P_ORES, "price_taxes_profile cannot be used:")
+      why(_T17_P_ORES, "“Day/night levies and VAT” cannot be used.")
       and why(_T17_P_ORES, "beyond +-10.0"))
 check("...and SIBELGA's whole card - 9,39 and 7,10, BOTH under that bound - is "
       "refused by THIS rung instead, naming both bands and the factor. Without "
       "it a Brussels site would price a 9.39 EUR/kWh levy and start",
-      why(_T17_P_SIB, "price_taxes_profile carries [7.1, 9.39] EUR/kWh")
-      and why(_T17_P_SIB, "factor of 100"))
+      why(_T17_P_SIB, "(price_taxes_profile) has [7.1, 9.39] EUR/kWh")
+      and why(_T17_P_SIB, "Divide the figures by 100"))
 check("...and the two refusals are DIFFERENT sentences, so the rungs cannot "
       "mask each other: deleting the units rung leaves the Sibelga line red "
       "while the ORES line goes on passing for the parser's reason",
       _T17_P_ORES != _T17_P_SIB
-      and not why(_T17_P_ORES, "factor of 100")
+      and not why(_T17_P_ORES, "Divide the figures by 100")
       and not why(_T17_P_SIB, "beyond +-10.0"))
 check("...and BOTH cards divided by 100 start, which is habit 7: the refusals "
       "above are about the units and not about Brussels or Wallonia",
@@ -1639,13 +1640,13 @@ check("PRECONDITION: each of those two blobs differs from the accepted "
       == _T16_ENECO)
 check("a factor 100x out is REFUSED at startup, by the pass-through rung, "
       "naming the option the operator typed",
-      why(_T16_P_PT, "price_export_formula cannot be used:")
+      why(_T16_P_PT, "“Your own injection formula” cannot be used.")
       and why(_T16_P_PT, "passes through")
-      and not why(_T16_P_PT, "|offset| above"))
+      and not why(_T16_P_PT, "larger than"))
 check("...and an offset 100x out is refused by the OFFSET rung, so the two "
       "rungs are graded on their reasons and cannot mask each other",
-      why(_T16_P_OFF, "price_export_formula cannot be used:")
-      and why(_T16_P_OFF, "|offset| above")
+      why(_T16_P_OFF, "“Your own injection formula” cannot be used.")
+      and why(_T16_P_OFF, "larger than")
       and not why(_T16_P_OFF, "passes through"))
 check("...and a malformed blob is refused as a malformed blob, naming the "
       "field rather than 'invalid configuration'",
@@ -1659,7 +1660,7 @@ check("...and a malformed blob is refused as a malformed blob, naming the "
 # coefficients against arithmetic done with the same coefficients. So the leg
 # starts, and the operator is told WHICH check did not run.
 _T16_UNGRADED = [m for lvl, m in _T16_OK_LOG
-                 if lvl == "WARNING" and "UNGRADED" in m]
+                 if lvl == "WARNING" and "not checked against a printed price" in m]
 print(f"    {(_T16_UNGRADED or [''])[0][:118]}")
 check("a leg with no card block starts, and says at startup that its "
       "coefficients are UNGRADED - naming what was checked instead, so the "
@@ -1682,21 +1683,21 @@ check("...and a leg that DOES carry a card does NOT print it, or the sentence "
       "would be noise an operator learns to ignore rather than a report of "
       "which check ran",
       _T16_WITH_CARD == []
-      and not [m for lvl, m in _T16_CARD_LOG if "UNGRADED" in m])
+      and not [m for lvl, m in _T16_CARD_LOG if "not checked against a printed price" in m])
 # ⚠️ AND A CARD ON THIS LEG IS STILL GRADED, at startup, by the same rung.
 check("...and a card ON THIS LEG that the coefficients do not reproduce is "
       "REFUSED at startup, so the optional block is optional and not inert",
       why(_t16_start(price_export_formula=_T16_CONS.replace(
           '"expect_incl_vat":15.55', '"expect_incl_vat":15.05'))[0],
-          "price_export_formula does not reproduce its own card"))
+          "price_export_formula gives"))
 
 # ⚠️ THE SENTENCE DOCS.md RESTS ON, AND IT IS THE ONE MOST LIKELY TO ROT.
 _T16_INFO = [m for lvl, m in _T16_OK_LOG if lvl == "INFO"
-             and "NO STRATEGY IN THIS ADD-ON READS IT" in m]
+             and "No part of the add-on reads it yet" in m]
 check("the startup line says, in so many words, that NO STRATEGY IN THIS "
       "ADD-ON READS IT - the operator is told what the option does not do in "
       "the same breath as it being accepted",
-      len(_T16_INFO) == 1 and "displaced IMPORT" in _T16_INFO[0])
+      len(_T16_INFO) == 1 and "displaced import" in _T16_INFO[0])
 # ⚠️ THE ASYMMETRY IS ASSERTED AS AN ORDERED PAIR, NOT AS TWO NUMBERS IN ONE
 # SENTENCE (MUTATION.md habit 14). "6 and 0 appear somewhere" is satisfied by
 # the two legs TRANSPOSED - which is the sentence telling an operator that the
@@ -1736,7 +1737,7 @@ for _v in _S10_BAD:
     _p = validate_startup_config(base(shadow_mode=_v), -5000, 5000)
     check(f"shadow_mode={_v!r} is REFUSED, and the refusal SPELLS the key so "
           "configui.problems_by_field() can file it under the right control",
-          why(_p, "shadow_mode is") and why(_p, "'auto'")
+          why(_p, "(shadow_mode) is") and why(_p, "'auto'")
           and why(_p, "'on'") and why(_p, "'off'"))
 for _v in ("auto", "on", "off", "AUTO", " on ", "Auto "):
     check(f"shadow_mode={_v!r} starts - the three values and the tolerant "
@@ -1807,6 +1808,47 @@ check("an UNREADABLE shadow_mode resolves to SHADOW, not to live - the "
       and shadow.engaged({"shadow_mode": ""}, control_started=True) is True
       and shadow.mode({"shadow_mode": "garbage"}) == "on")
 
+# --------------------------------------------------------------------------- #
+print("\nUX-13 - the warning tier: notes for the settings page, never refusals")
+from app.validate import Note, WATT_ENTITY_KEYS, config_notes  # noqa: E402
+
+_warned = base(integrator_max_w=3000, maintenance_discharge_w=2500,
+               price_provider="generic_dayahead", static_profile="")
+_notes = []
+_with = validate_startup_config(_warned, -5000, 5000, notes=_notes)
+check("a config with three logged warnings starts, and gives three notes, "
+      "each filed under the setting it names",
+      _with == [] and validate_startup_config(_warned, -5000, 5000) == []
+      and sorted(n.keys for n in _notes) == [
+          ("integrator_max_w",), ("maintenance_discharge_w",),
+          ("static_profile",)]
+      and all(n.tier == "warn" and f"({n.keys[0]})" in n.text for n in _notes))
+_refused = base(setpoint_entity="", integrator_max_w=3000)
+_n2 = []
+check("collecting notes changes no refusal",
+      validate_startup_config(_refused, notes=_n2)
+      == validate_startup_config(_refused) != [] and len(_n2) == 1)
+_rows = {"number.goodwe_setpoint": {"unit": None},
+         "sensor.soc": {"unit": "%"}, "sensor.batt": {"unit": "kW"}}
+_cn = config_notes(base(), entities=_rows)
+check("a battery power sensor in kW is warned about: the add-on takes it as "
+      "watts", [n.keys for n in _cn] == [("batt_entity",)]
+      and "kW" in _cn[0].text)
+_cn = config_notes(base(meter_entity="sensor.grid"), entities={})
+check("an entity Home Assistant does not have is named, and only the ones "
+      "this meter source and roster shape read",
+      sorted(n.keys[0] for n in _cn) == ["batt_entity", "meter_entity",
+                                         "setpoint_entity", "soc_entity"])
+check("with no entity list (Home Assistant down) those checks are skipped",
+      config_notes(base(), entities=None) == [])
+check("a peak limit below this month's peak is warned about",
+      [n.keys for n in config_notes(base(peak_cap_w=2500),
+                                    month_peak_w=2900)] == [("peak_cap_w",)]
+      and config_notes(base(peak_cap_w=3500), month_peak_w=2900) == [])
+check("pv.py converts solar units itself, so no solar key is read as watts",
+      not [k for k in WATT_ENTITY_KEYS if k.startswith("pv_")]
+      and isinstance(_cn[0], Note))
+
 # --------------------------------------------------------------------------- #
 print()
 if fails:
diff --git a/goodwe_controller/test_version_gate.py b/goodwe_controller/test_version_gate.py
index 13a0bf8..d32e1d4 100644
--- a/goodwe_controller/test_version_gate.py
+++ b/goodwe_controller/test_version_gate.py
@@ -138,7 +138,7 @@ r5 = run_gate(addon3, root3, "0.7.0", opts_file(bad))
 check("refuses a config the validator rejects", r5.returncode == 1)
 check("...and warns it is exit 78", "78" in r5.stdout)
 check("...and warns the ingress panel goes too", "ingress panel" in r5.stdout)
-check("...and prints the validator's own words", "slew_w is 1000 W" in r5.stdout)
+check("...and prints the validator's own words", "(slew_w) is 1000 W" in r5.stdout)
 
 print()
 print("⭐ HISTORY WITH MORE THAN ONE BUMP - THE FIXTURE THE FIRST DRAFT LACKED")
diff --git a/goodwe_controller/test_watchdog.py b/goodwe_controller/test_watchdog.py
index 8ec0ea0..7188da8 100644
--- a/goodwe_controller/test_watchdog.py
+++ b/goodwe_controller/test_watchdog.py
@@ -20,6 +20,9 @@ Read MUTATION.md before you report a survivor.
 import sys
 from datetime import datetime, timedelta, timezone
 
+from named_absence import nth, present
+
+from app import messages  # noqa: E402
 from app.watchdog import (
     SignWatchdog, SignWatchdogConfig, loop_is_following,
 )
@@ -151,7 +154,7 @@ p = validate_startup_config({**base, "max_w": 2000, "sign_disagree_w": 300},
 check("300 W under a 2000 W ceiling is accepted", p == [])
 p = validate_startup_config({**base, "max_w": 2000, "sign_disagree_w": 2000},
                             -5000, 5000)
-check("a threshold AT max_w is refused", len(p) == 1 and "never fire" in p[0])
+check("a threshold AT max_w is refused", len(p) == 1 and "can never trip" in p[0])
 # ⚠️ maintenance_charge_w is named here only to keep this case about the SIGN
 # rule. MAINT-04 added a second rule against the same ceiling, and a 500 W
 # max_w is also below the 2000 W shipped maintenance charge - so without this
@@ -159,7 +162,7 @@ check("a threshold AT max_w is refused", len(p) == 1 and "never fire" in p[0])
 # `len(p) == 1` below would be measuring the interaction rather than this rule.
 p = validate_startup_config({**base, "max_w": 500, "sign_disagree_w": 3000,
                              "maintenance_charge_w": 500}, -5000, 5000)
-check("a threshold above max_w is refused", len(p) == 1 and "never fire" in p[0])
+check("a threshold above max_w is refused", len(p) == 1 and "can never trip" in p[0])
 p = validate_startup_config({**base, "max_w": 2000, "sign_disagree_w": 1999},
                             -5000, 5000)
 check("one watt under the ceiling is reachable, so accepted", p == [])
@@ -366,10 +369,19 @@ check("0 W actually reached the device", 0.0 in hass.writes)
 check("and it got there through the failsafe claim, not by accident",
       "failsafe" in ctrl.reason)
 print(f"       status line: {ctrl.reason!r}")
-check("the status page says so in words",
-      any("SIGN-DISAGREEMENT FAILSAFE" in c["text"] for c in ctrl.checks()))
+check("the status page says so in words: a red row, at 0 W, cleared by start",
+      any(c.get("id") == "direction" and not c["ok"] and not c["warn"]
+          and "set to 0 W" in c["text"] and "start control" in c["text"]
+          for c in ctrl.checks()))
 check("the banner leads with it",
-      "FAILSAFE" in ctrl.status_payload()["banner"])
+      ctrl.status_payload()["banner"] == messages.banner_direction(False))
+check("...the line under the buttons says it in plain words, and the action "
+      "log with the raw reason is still reachable in the status JSON",
+      ctrl.status_payload()["hint"].endswith(
+          messages.hint("direction", unit=ctrl.inverters[0].name))
+      and ctrl.status_payload()["events"] == ctrl.events
+      and any(e.split(" ", 1)[1].startswith("FAILSAFE ")
+              for e in ctrl.status_payload()["events"]))
 check("it stays at 0 W on later cycles too",
       hass.writes[-1] == 0.0 and hass.writes.count(0.0) >= 1)
 
@@ -476,7 +488,7 @@ check("...commands 0 W from its very first cycle", post.target == 0.0)
 check("...and never commanded anything else after the restart",
       hass2.writes != [] and set(hass2.writes) == {0.0})
 check("the banner still leads with the failsafe",
-      "FAILSAFE" in post.status_payload()["banner"])
+      post.status_payload()["banner"] == messages.banner_direction(False))
 # ⚠️ TWO PRESSES, and the first one must NOT clear it. `auto` is True while
 # tripped, so the first press stops control; only the transition back to True
 # clears. That is the documented behaviour and it is worth an assertion, because
@@ -949,12 +961,25 @@ check("...and it got there through the `circulation` claim, by name, rather "
       "circulation" in _c.reason)
 print(f"       status line: {_c.reason!r}")
 check("the status page says so in words, and says the meter cannot see it",
-      any("CIRCULATING POWER" in ck["text"] and "meter cannot see" in ck["text"]
-          for ck in _c.checks()))
+      any(ck.get("id") == "circulating" and not ck["ok"] and not ck["warn"]
+          and "meter cannot see" in ck["text"] for ck in _c.checks()))
 check("the banner leads with it - above the sign failsafe, because a sign "
       "disagreement is visible on every dashboard in the house and this is "
       "visible nowhere at all",
-      "CIRCULATING POWER" in _c.status_payload()["banner"])
+      _c.status_payload()["banner"] == messages.banner_circulating())
+# UX-09: the red shadow banner no longer names the latch, so the latch's own
+# red row must stay on the list in shadow mode, name it and say how it clears.
+_c_mode = _c.o.get("shadow_mode")
+_c.o["shadow_mode"] = "on"
+check("in shadow mode the banner goes red and says a safety stop stays on, and "
+      "the circulating row is still red and says only starting control clears "
+      "it",
+      _c.status_payload()["level"] == "bad"
+      and "safety stop" in _c.status_payload()["banner"]
+      and any(ck.get("id") == "circulating" and not ck["ok"] and not ck["warn"]
+              and "Only starting control clears this" in ck["text"]
+              for ck in _c.checks()))
+_c.o["shadow_mode"] = _c_mode
 _pub = {}
 _c.mqtt = type("P", (), {"enabled": True,
                          "publish": lambda _s, v: _pub.update(v),
@@ -1025,7 +1050,8 @@ check("...no `circulation` claim is ever filed, so the arbitration is "
 check("...and the status page says n/a rather than claiming to watch something "
       "that cannot happen - an 'armed' row for an identically-zero quantity is "
       "a guard advertising work it is not doing",
-      any("circulating power: n/a at one inverter" in ck["text"]
+      any(ck.get("id") == "circulating" and ck["ok"]
+          and "not needed with one inverter" in ck["text"]
           for ck in _c1.checks()))
 _pub1 = {}
 _c1.mqtt = type("P", (), {"enabled": True,
@@ -1053,8 +1079,8 @@ async def _circ_restart():
         await a.read_inputs()
         await a.cycle()
         await asyncio.sleep(0.25)
-    # THE RESTART. Same store, brand new Controller and Hass - which is exactly
-    # what a Home Assistant restart does to this add-on. The house has stopped
+    # THE RESTART. Same store, brand new Controller and Hass - an ADD-ON
+    # restart. A Core-only restart keeps the process; graded below (SAFETY-34). The house has stopped
     # circulating in the meantime, so nothing in the new process's own
     # measurements could re-derive the trip.
     h2 = _CircHass(a_w=0.0, b_w=0.0)
@@ -1102,18 +1128,50 @@ check("...under a fixed notification_id of its own, so a second episode "
       all(c[2]["notification_id"] == "goodwe_circulating_power"
           for c in _notes1 + _notes2)
       and len({c[2]["notification_id"] for c in _notes1 + _notes2}) == 1)
-_msg = _notes2[0][2]["message"]
+_msg = nth(_notes2, 0)[2]["message"]
+
+
+def _says_three(m):
+    """UX-08: the three things only this alarm can say, in its plain words
+    (messages.circulating): the meter cannot see it, control is stopped at
+    0 W, and if the grid does not move a person at the isolator is next."""
+    return ("meter cannot see this" in m and "Control stays stopped" in m
+            and "Every inverter is set to 0 W" in m and "isolator" in m
+            and "if the grid power does not change" in m)
+
+
 check("...and the message tells the operator the three things only this alarm "
       "can: that the meter cannot see it, that control has been stopped, and "
       "that if the grid reading does not move afterwards one inverter is no "
       "longer listening and a human at the isolator is the last actuator",
-      "METER CANNOT SEE" in _msg and "CONTROL HAS BEEN STOPPED" in _msg
-      and "isolator" in _msg)
+      _says_three(_msg))
 check("...and it does not raise the same card on every cycle - a per-PROCESS "
       "flag, deliberately not persisted, is what makes 'has a human been shown "
       "this' a different question from 'is this site tripped'",
       len(_notes2) == 1)
 
+# SAFETY-34: a Core-ONLY restart. The add-on process lives on (measured on
+# TEST-23), HA's memory is wiped, so the SAME process must re-assert the card.
+import app.main as _main_mod  # noqa: E402
+_real_mono, _clock = _main_mod._mono, [_main_mod._mono()]
+_main_mod._mono = lambda: _clock[0]
+try:
+    _h3 = _CircHass(a_w=0.0, b_w=0.0)
+    _b.hass = _h3
+    asyncio.run(_b.check_circulating())
+    _early = [c for c in _h3.calls if c[0] == "persistent_notification"]
+    _clock[0] += _main_mod.REANNOUNCE_S
+    asyncio.run(_b.check_circulating())
+    _late = [c for c in _h3.calls if c[0] == "persistent_notification"]
+finally:
+    _main_mod._mono = _real_mono
+check("SAFETY-34: inside REANNOUNCE_S the same process does not re-raise - no "
+      "storm on the event bus", len(_early) == 0)
+check("SAFETY-34: a Core-only restart wipes the card and the add-on process "
+      "survives it, so after REANNOUNCE_S the SAME process re-asserts it",
+      len(_late) == 1
+      and _late[0][2]["notification_id"] == "goodwe_circulating_power")
+
 
 print()
 print("6a. AC 4: THE ALARM NAMES WHICH PACKS, AND WHICH WAY ROUND")
@@ -1238,8 +1296,8 @@ check("PRECONDITION: both runs actually tripped and actually raised the card, "
       and len(_notes_g) == 1 and len(_notes_s) == 1)
 
 # --- AC 4: THE ATTRIBUTION ITSELF -------------------------------------------
-_WHO_G = "Right now garage is discharging while shed charges."
-_WHO_S = "Right now shed is discharging while garage charges."
+_WHO_G = "garage was giving power while shed was charging"
+_WHO_S = "shed was giving power while garage was charging"
 check("⚠️ THE ALARM NAMES THE TWO PACKS AND SAYS WHICH WAY EACH ONE IS PULLING. "
       "`circulation.py` calls this the first thing somebody woken at 3 a.m. "
       "needs and impossible to reconstruct from the watts alone, and until this "
@@ -1260,12 +1318,14 @@ check("...and the RESTING pack is not named. `cellar` is on the roster, is read
       "beside a 6 kW loop is not reported as one of its two participants",
       "cellar" not in _msg_g and "cellar" not in _msg_s
       and _cg.inverters[2].batt == _REST_W)
-check("...and the sentence sits with the figure, not instead of it: the same "
-      "card still carries the watts, the window and the three things only this "
-      "alarm can say",
-      all("CIRCULATING_POWER" in m and "METER CANNOT SEE" in m
-          and "CONTROL HAS BEEN STOPPED" in m and "isolator" in m
-          for m in (_msg_g, _msg_s)))
+# UX-08: the watts and the window moved out of the card into the reason the
+# log line and the status row carry; the card keeps the three things.
+check("...and the sentence sits with the three things only this alarm can say, "
+      "while the watts and the window stay in the reason behind it",
+      all(_says_three(m) for m in (_msg_g, _msg_s))
+      and all("CIRCULATING_POWER" in c.circ_wd.reason
+              and "W measured going round" in c.circ_wd.reason
+              for c in (_cg, _cs)))
 print()
 print("   the operator's press is the only way out, and it clears BOTH halves")
 
@@ -1362,14 +1422,28 @@ for _t in range(0, 400, 5):
     _wd_unit.evaluate(-1000.0, 1500.0, True, T0 + timedelta(seconds=_t))
 print(f"       site: {_wd_site.reason!r}")
 print(f"       unit: {_wd_unit.reason!r}")
-check("⚠️ THE SITE INSTANCE'S SENTENCE IS BYTE-IDENTICAL TO THE ONE THAT "
-      "SHIPPED. It is what an operator reads on the status page, what goes in "
-      "the action log and what is persisted to /data/state.json, so it is "
-      "asserted against the literal rather than against a format string",
-      _wd_site.reason == (
-          "SIGN_DISAGREEMENT: commanded -1000 W against a meter reading "
-          "+1500 W for 180 s continuously (limits: both over 300 W, held over "
-          "180 s)"))
+# UX-11: this was a byte pin. The reason is now the evidence: the action
+# log, the DEBUG line and /data/state.json carry it, and the ERROR line quotes
+# only its code (`messages.reason_code()`). So what is pinned is what it says:
+# the code in front, where every saved reason has had it and where the ERROR
+# line finds it, then the command and the reading in that order (habit 14),
+# the time held and both limits.
+_sr = _wd_site.reason
+_order = [_sr.find(t) for t in ("commanded -1000 W", "meter reading +1500 W",
+                                "for 180 s", "both over 300 W",
+                                "held over 180 s")]
+check("⚠️ THE SITE INSTANCE'S REASON SAYS WHAT SHIPPED, IN THE SAME ORDER: "
+      "the code first, then what was commanded, what the meter read, how "
+      f"long, and the two limits ({_order})",
+      _sr.startswith("SIGN_DISAGREEMENT: ")
+      and messages.reason_code(_sr) == "SIGN_DISAGREEMENT"
+      and all(i > 0 for i in _order) and _order == sorted(_order))
+# UX-11 review: the text itself did not change, and it is what state.json
+# holds, so the byte pin stays beside the meaning pin.
+check("...and it is still byte-identical to the one that shipped",
+      _sr == ("SIGN_DISAGREEMENT: commanded -1000 W against a meter reading "
+              "+1500 W for 180 s continuously (limits: both over 300 W, held "
+              "over 180 s)"))
 check("...and the per-unit instance names what it ACTUALLY compared instead. "
       "'against a meter reading' there would be a false statement about which "
       "instrument produced the evidence, on the one line somebody woken by "
@@ -1706,7 +1780,7 @@ print(f"       {_b30.sign_wd.reason!r}")
 # the objects - and not off the fixture's constants, so the check cannot be
 # satisfied by two numbers the fixture happens to hold anyway (habit 2).
 _preb30 = [x for x in _s30 if not x["b"]]
-_midb30 = _preb30[-1]
+_midb30 = nth(_preb30, -1, "no cycle before B latched")
 print(f"       last cycle before B latched: B stood "
       f"{_midb30['stood'][1]:+.0f} W, B measured {_midb30['meas'][1]:+.0f} W")
 check("⚠️ ...AND THE ORDERED PAIR, on the ONE SIGN-DISAGREEMENT SENTENCE A "
@@ -1840,7 +1914,7 @@ _c31, _h31, _s31 = asyncio.run(_site_reversed())
 # stopped. This is `Run.p2p_between`'s lesson from the rig, in a unit test: name
 # the window rather than inferring it.
 _pre31 = [x for x in _s31 if not x["site"]]
-_mid31 = _pre31[-1]
+_mid31 = nth(_pre31, -1, "no cycle before the trip")
 print(f"       last cycle before the trip: stood "
       f"{[round(x) for x in _mid31['stood']]}  "
       f"measured {[round(x) for x in _mid31['meas']]}  "
@@ -1849,7 +1923,8 @@ check("PRECONDITION: EVERY inverter is obeying - each unit's measured power "
       "agrees in sign with its own share - and the site is still charging into "
       "an importing house. Without this the site trip below could be a "
       "per-unit fault in disguise",
-      all(s * m > 0 for s, m in zip(_mid31["stood"], _mid31["meas"]))
+      present(_mid31)
+      and all(s * m > 0 for s, m in zip(_mid31["stood"], _mid31["meas"]))
       and sum(_mid31["stood"]) * _mid31["grid"] < 0)
 check("⚠️ AC 3. THE SITE WATCHDOG TRIPS AND NOT ONE PER-UNIT WATCHDOG DOES. "
       "That asymmetry is the card: the fault is in the number the site was "
@@ -1873,9 +1948,23 @@ check("...the latch is FLAT - `site_sign_tripped`, beside SAFETY-31's pair - "
 check("the status page carries a SITE row of its own, and the banner says the "
       "site's TOTAL command opposed the meter rather than naming an inverter - "
       "naming one would send an operator to swap the wrong box",
-      any("SITE SIGN-DISAGREEMENT FAILSAFE" in ck["text"]
+      any(ck.get("id") == "site_direction" and not ck["ok"]
+          and not ck["warn"] and "every inverter" in ck["text"]
           for ck in _c31.checks())
-      and "total command" in _c31.status_payload()["banner"])
+      and "Total power" in _c31.status_payload()["banner"]
+      and "inverter-" not in _c31.status_payload()["banner"])
+_c31_mode = _c31.o.get("shadow_mode")
+_c31.o["shadow_mode"] = "on"
+check("UX-09: in shadow mode the banner goes red and says a safety stop stays "
+      "on, and the site row is still red and says only starting control "
+      "clears it",
+      _c31.status_payload()["level"] == "bad"
+      and "safety stop" in _c31.status_payload()["banner"]
+      and any(ck.get("id") == "site_direction" and not ck["ok"]
+              and not ck["warn"]
+              and "Only starting control clears this" in ck["text"]
+              for ck in _c31.checks()))
+_c31.o["shadow_mode"] = _c31_mode
 _pub30 = {}
 _c31.mqtt = type("P", (), {"enabled": True,
                            "publish": lambda _s, v: _pub30.update(v),
@@ -2053,7 +2142,7 @@ check("...the reason sentence still says 'a meter reading', word for word - it "
 # consecutive commands IDENTICAL; at a rail-following slew the loop ramps and
 # they differ by exactly one step, which is how this was found.
 _first1s = [x for x in _seen1s if x["tripped"]]
-_mid1s = _first1s[0]
+_mid1s = nth(_first1s, 0, "no tripped cycle")
 print(f"       the cycle the latch happened on: stood {_mid1s['stood']:+.0f} W, "
       f"meter {_mid1s['grid']:+.0f} W")
 print(f"       {_inv1.sign_wd.reason!r}")
@@ -2104,16 +2193,16 @@ check("⚠️ ...AND THE SITE DETECTOR IS NEVER ARMED. Not 'did not trip', and n
       _n1_site_calls == []
       and not _c1s.site_sign_wd.tripped
       and _c1s.site_sign_wd.disagree_since is None)
-check("...the banner is the sentence that shipped",
-      _c1s.status_payload()["banner"]
-      == "FAILSAFE — the command opposed the meter. Inverter held at 0 W.")
+check("...the banner is the one-inverter sentence, naming the meter",
+      _c1s.status_payload()["banner"] == messages.banner_direction(False)
+      and "meter" in messages.banner_direction(False))
 check("...the status page carries ONE sign row, with no unit tag and no site "
       "row - an extra row for an identically-duplicated question is a page "
       "advertising two guards where the install has one",
-      len([ck for ck in _c1s.checks()
-           if "sign watchdog" in ck["text"] or "SIGN-DISAGREEMENT" in ck["text"]
-           ]) == 1
-      and not any("site sign" in ck["text"].lower() for ck in _c1s.checks()))
+      len([ck for ck in _c1s.checks() if ck.get("id") == "direction"]) == 1
+      and not any(ck.get("id") == "site_direction" for ck in _c1s.checks())
+      and not any("inverter-" in ck["text"] for ck in _c1s.checks()
+                  if ck.get("id") == "direction"))
 check("...and no `sign_site` claim can be filed at a roster of one, so the "
       "arbitration is byte-identical to what shipped",
       "sign_site" not in _c1s.reason)
@@ -2285,12 +2374,12 @@ check("⚠️ AND THE BANNER LEADS WITH THE FAILSAFE WHICHEVER UNIT IS LATCHED,
       "the page then leads with whatever the next branch says",
       _bn_b["level"] == _bn_a["level"] == "bad"
       and _bn_b["banner"] == _bn_a["banner"]
-      and _bn_b["banner"].startswith("FAILSAFE")
-      and "its own measured power" in _bn_b["banner"])
+      and _bn_b["banner"] == messages.banner_direction(True)
+      and "own power" in _bn_b["banner"])
 check("...and the counterfactual again: the same site with nothing latched "
       "carries neither that level nor that sentence, so the banner really is "
       "being produced by the reduction under test",
-      not _bn_n["banner"].startswith("FAILSAFE")
+      _bn_n["banner"] != messages.banner_direction(True)
       and _bn_n["banner"] != _bn_b["banner"])
 
 
@@ -2501,13 +2590,13 @@ _c38, _s38seen = asyncio.run(_s38_site())
 # The last sample BEFORE the trip, named rather than indexed - part 5's lesson.
 # After the trip every command is 0 W, so a fixed index reads the REMEDY.
 _pre38 = [x for x in _s38seen if not x["site"]]
-_mid38 = _pre38[-1]
+_mid38 = nth(_pre38, -1, "no cycle before the trip")
 _GATE38 = _c38.site_sign_wd.cfg.min_w
 _share38 = list(_mid38["stood"])
 _red38 = {"sum": sum(_share38),
           "mean": sum(_share38) / max(1, len(_share38)),
-          "max(key=abs)": max(_share38, key=abs),
-          "[0]": _share38[0]}
+          "max(key=abs)": max(_share38, key=abs, default=nth([], 0)),
+          "[0]": nth(_share38, 0)}
 print(f"       last cycle before the trip: stood "
       f"{[round(x) for x in _share38]}  measured "
       f"{[round(x) for x in _mid38['meas']]}  meter {_mid38['grid']:+.0f} W")
@@ -2538,7 +2627,8 @@ check("PRECONDITION: EVERY inverter is obeying - each unit's measured power "
       "agrees in sign with its own share - and the site is charging into an "
       "importing house. Without this the trip below could be a per-unit fault "
       "in disguise rather than the site fault this grades",
-      all(s * m > 0 for s, m in zip(_mid38["stood"], _mid38["meas"]))
+      present(_mid38)
+      and all(s * m > 0 for s, m in zip(_mid38["stood"], _mid38["meas"]))
       and sum(_mid38["stood"]) * _mid38["grid"] < 0
       and _mid38["following"] is True)
 check("⚠️ THE SITE WATCHDOG TRIPS ON THE SUM, and no per-unit watchdog does. "
diff --git a/goodwe_controller/tools/alloc_sim.py b/goodwe_controller/tools/alloc_sim.py
index 1e16dfc..9618c8d 100644
--- a/goodwe_controller/tools/alloc_sim.py
+++ b/goodwe_controller/tools/alloc_sim.py
@@ -5,6 +5,9 @@
     python3 tools/alloc_sim.py --splits      # AC 2: split-invariance at the meter
     python3 tools/alloc_sim.py --sweep       # AC 3: gain to 1.0 at every split
     python3 tools/alloc_sim.py --all
+    python3 tools/alloc_sim.py --spill       # OPT-11: surplus solar, by mode
+
+    Exit 0 only if every split-invariance run HOLDS; 1 if one FAILS; 2 if no rig.
 
     # DEV-02: the split-invariance finding ALLOC-01's review handed on, and the
     # sensing change that closed it. The two rows are the evidence.
@@ -243,12 +246,98 @@ def sweep(sitesim, control, watchdog, cycles, load_w):
     return worst
 
 
+def spill(sitesim, control, arbiter, allocator, packmode, gain=0.6,
+          cycles=30, load_w=1000.0, pv_w=9000.0):
+    """OPT-11 P1: surplus solar spills from Solar first to Leftover solar.
+
+    The rig's two plants and the add-on's own `compute()`, `resolve()`,
+    `loop_bound()` and `packmode.charge_weights()`, with the claims main.py
+    files for this state: each unit's rating, each unit's mode, the loop, and
+    OPT-09's `pack` limit (`lo = 0`) once battery A is full. A is Solar first
+    and B Leftover solar. Three phases of `cycles` each: A has room; A is full;
+    then B is switched off. The loop is fed the site total (DEV-02).
+    Returns (rows, verdicts).
+    """
+    from plantsim import INVERTER_A, INVERTER_B, Inverter, Site
+    names = ("inverter-a", "inverter-b")
+    specs = [("A", INVERTER_A), ("B", INVERTER_B)]
+    invs = [Inverter.from_spec(n, dict(sp, **sitesim.INSTANT))
+            for n, sp in specs]
+    site = Site(invs, load=load_w, pv=pv_w)
+    tun = control.Tuning(gain=gain, max_w=sum(sp["rating_w"] for _n, sp in specs),
+                         slew_w=sitesim.EXPERIMENT_SLEW_W)
+    C = arbiter.Claim
+    prev, i_w, sat = 0.0, None, 0
+    rows = []
+    phases = (("A has room", False, True), ("A full", True, True),
+              ("A full, B off", True, False))
+    for label, a_full, b_on in phases:
+        modes = {names[0]: packmode.PackMode(True, packmode.SOLAR_FIRST),
+                 names[1]: packmode.PackMode(b_on, packmode.LEFTOVER_SOLAR)}
+        for _c in range(cycles):
+            claims = []
+            for u, (_n, sp) in zip(names, specs):
+                r = sp["rating_w"]
+                claims.append(C.limit("supervised", arbiter.P_SAFETY, -r, r,
+                                      actuator=u))
+                lo, hi = packmode.mode_range(modes[u], r)
+                claims.append(C.limit("mode", arbiter.P_MODE, lo, hi,
+                                      actuator=u))
+            if a_full:
+                claims.append(C.limit("pack", arbiter.P_SAFETY, lo=0.0,
+                                      actuator=names[0]))
+            bound = allocator.loop_bound(
+                {u: arbiter.pre_resolve([c for c in claims if c.actuator == u])
+                 for u in names})
+            d = control.compute(prev, site.grid, site.battery, tun, sat, i_w,
+                                bound=bound)
+            prev, i_w, sat = d.target_w, d.i_w, d.sat_count
+            claims.append(C.set("loop", arbiter.P_LOOP, d.target_w))
+            res = arbiter.resolve(
+                claims, units=names,
+                weights=lambda t: packmode.charge_weights(None, modes, t))
+            for inv, u in zip(invs, names):
+                inv.command(float(res.shares[u]))
+            site.settle(sitesim.CYCLE_S, dt=0.05)
+            rows.append(dict(phase=label, target=d.target_w, grid=site.grid,
+                             a=res.shares[names[0]], b=res.shares[names[1]],
+                             unmet=res.allocation.unmet_w, frozen=d.frozen,
+                             reason=d.reason, bound=bound))
+    return rows
+
+
+def spill_report(rows, cycles):
+    print("=== OPT-11 P1: surplus solar, A Solar first, B Leftover solar ===")
+    ok = True
+    for label in dict.fromkeys(r["phase"] for r in rows):
+        ph = [r for r in rows if r["phase"] == label]
+        last = ph[-1]
+        frozen = sum(r["frozen"] for r in ph)
+        print(f"  {label:15} A {last['a']:+6.0f} W  B {last['b']:+6.0f} W  "
+              f"grid {last['grid']:+7.0f} W  loop bound "
+              f"[{last['bound'][0]:.0f}, {last['bound'][1]:.0f}]  "
+              f"unmet {last['unmet']} W  frozen cycles {frozen}  "
+              f"({last['reason']})")
+        ok &= frozen == 0 and all(r["a"] <= 0 and r["b"] <= 0 for r in ph)
+        if label == "A has room":
+            ok &= last["a"] == -5000 and last["b"] < 0
+        elif label == "A full":
+            ok &= last["a"] == 0 and last["b"] == -5000
+        else:
+            ok &= last["a"] == 0 and last["b"] == 0 and last["unmet"] == 0
+    print(f"  -> spill {'HOLDS' if ok else 'FAILS'}: A fills first, the rest "
+          f"spills to B, a full A and an Off B send the surplus to the grid, "
+          f"and the loop never freezes on watts no battery may take")
+    return ok
+
+
 def main():
     ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     ap.add_argument("--table", action="store_true")
     ap.add_argument("--splits", action="store_true")
     ap.add_argument("--sweep", action="store_true")
     ap.add_argument("--all", action="store_true")
+    ap.add_argument("--spill", action="store_true")
     ap.add_argument("--cycles", type=int, default=40)
     ap.add_argument("--load", type=float, default=2000.0)
     ap.add_argument("--gain", type=float, default=1.0)
@@ -259,7 +348,7 @@ def main():
                          "or one inverter's power (the PRE-DEV-02 sensing, "
                          "kept because the comparison is the evidence)")
     a = ap.parse_args()
-    if not (a.table or a.splits or a.sweep):
+    if not (a.table or a.splits or a.sweep or a.spill):
         a.all = True
 
     sim = find_sim()
@@ -279,13 +368,19 @@ def main():
     if a.table or a.all:
         table(sitesim, control, watchdog, a.cycles, a.load)
         print()
+    held = True
     if a.splits or a.all:
-        splits(sitesim, control, watchdog, a.cycles, a.load, a.gain,
-               a.feedback)
+        held = splits(sitesim, control, watchdog, a.cycles, a.load, a.gain,
+                      a.feedback)
         print()
     if a.sweep or a.all:
         sweep(sitesim, control, watchdog, a.cycles, a.load)
-    return 0
+        print()
+    if a.spill or a.all:
+        packmode = sitesim.load_addon("app.packmode", "alloc_sim")
+        held &= spill_report(spill(sitesim, control, arbiter, allocator,
+                                   packmode), 30)
+    return 0 if held else 1
 
 
 if __name__ == "__main__":
diff --git a/goodwe_controller/tools/decode_bus_capture.py b/goodwe_controller/tools/decode_bus_capture.py
index 18f56fb..a9a8c33 100644
--- a/goodwe_controller/tools/decode_bus_capture.py
+++ b/goodwe_controller/tools/decode_bus_capture.py
@@ -195,14 +195,37 @@ def _hms(t):
     return f"{int(t // 3600):02d}:{int(t % 3600 // 60):02d}:{t % 60:06.3f}"
 
 
+def unreadable(stats):
+    """Why a capture decoded to too little to trust, or None: most lines must be frames."""
+    framed = sum(stats[k] for k in ("requests", "responses", "writes",
+                                     "write_echoes"))
+    if framed > 0 and stats["lines"] - framed <= framed:
+        return None
+    return (f"{framed} of {stats['lines']} line(s) decoded as frames "
+            f"(unparsed {stats['unparsed']}, bad_crc {stats['bad_crc']}, "
+            f"unknown {stats['unknown']}) - not a capture this decoder can read")
+
+
 def main(argv):
-    if len(argv) != 2:
+    """Decode each capture named; exit 1 if any is unreadable, 2 on no argument."""
+    if len(argv) < 2:
         print(__doc__.splitlines()[2].strip())
         return 2
-    events, stats = decode(argv[1])
-    print(f"== {argv[1]}")
+    rc = 0
+    for path in argv[1:]:
+        rc |= _report(path)
+    return rc
+
+
+def _report(path):
+    events, stats = decode(path)
+    print(f"== {path}")
     for k, v in stats.items():
         print(f"   {k:14} {v}")
+    bad = unreadable(stats)
+    if bad:
+        print(f"REFUSED: {path}: {bad}")
+        return 1
     for kind in ("setpoint_w", "batt_w", "soc_pct"):
         rows = series(events, kind)
         if not rows:
diff --git a/goodwe_controller/tools/opt11_identity.py b/goodwe_controller/tools/opt11_identity.py
new file mode 100644
index 0000000..3339a97
--- /dev/null
+++ b/goodwe_controller/tools/opt11_identity.py
@@ -0,0 +1,289 @@
+#!/usr/bin/env python3
+"""OPT-11: with battery modes off, is every command byte-identical to before?
+
+    python3 tools/opt11_identity.py          # prints one digest per scenario
+
+Drives the REAL `Controller` (read_inputs + cycle: the freshness gate, the
+arbiter, the allocator, OPT-09's pack claim, SAFETY-73's refusal claims) in
+simulated time, and hashes, per cycle, everything a command depends on: the
+site target, each inverter's written value, the loop's reason, integrator and
+saturation count, and the allocation record. It uses only the Controller API
+that release/1.0 a5dddad already had, so the SAME file runs on the old tree and
+the new one. test_modes.py part 1 holds the new tree to the digests this file
+printed on a5dddad (they are written there, with that provenance).
+
+Scenarios: N=1 and N=2, a house that steps, a surplus of solar, a battery
+reaching its cut-out level and, at N=2, a battery that refuses (SAFETY-73) and
+is probed; the same with both batteries due for maintenance; and the arbiter
+alone on 6000 seeded claim lists (peak floor, trades, maintenance, refusals).
+"""
+
+import asyncio
+import hashlib
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import app.main as m                                      # noqa: E402
+from app.main import Controller                           # noqa: E402
+
+TICK = 5.0
+BASE = datetime(2026, 9, 20, 11, 0, tzinfo=timezone.utc)
+
+
+class _Store:
+    def __init__(self):
+        from app.store import DEFAULTS
+        self.data = dict(DEFAULTS)
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def get_time(self, k):
+        v = self.data.get(k)
+        return datetime.fromisoformat(v) if v else None
+
+    def set_time(self, k, when):
+        self.data[k] = when.isoformat() if when else None
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, *a, **k):
+        pass
+
+    def close(self):
+        pass
+
+
+def house(t):
+    """A house that steps, then a solar surplus, then an evening load."""
+    if t < 300:
+        return 800.0
+    if t < 900:
+        return 3200.0
+    if t < 1500:
+        return -2600.0          # more solar than the house uses
+    if t < 2100:
+        return 1400.0
+    return 4200.0
+
+
+class _Hass:
+    """One meter, `units` batteries that follow their command unless `cut`."""
+
+    def __init__(self, units, soc, cut, load=house):
+        self.units, self.soc, self.cut, self.load = units, soc, cut, load
+        self.cmd = {u: 0.0 for u in units}
+        self.t = 0.0
+
+    def power(self, u):
+        c = self.cmd[u]
+        if self.cut(u, self.t) and c >= -4.0:
+            return -4.0
+        return float(round(c))
+
+    def grid(self):
+        return self.load(self.t) - sum(self.power(u) for u in self.units)
+
+    async def limits(self, e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def call(self, *a):
+        return True
+
+    async def number(self, e, invert=False):
+        if e == "sensor.grid":
+            return self.grid()
+        u = e[-1]
+        if e.startswith("sensor.soc"):
+            return self.soc(u, self.t)
+        if e.startswith("sensor.batt"):
+            return self.power(u)
+        return None
+
+    async def set_number(self, e, v):
+        self.cmd[e[-1]] = float(v)
+        return True
+
+
+def _options(n, extra):
+    common = {"meter_entity": "sensor.grid", "meter_source": "off",
+              "gain": 0.6, "slew_w": 400, "target_grid_w": -10,
+              "deadband_w": 15, "step_w": 10, "heartbeat_s": 10,
+              "stale_input_s": 15, "auto_start": True}
+    if n == 1:
+        common.update({"setpoint_entity": "number.sp_a",
+                       "soc_entity": "sensor.soc_a",
+                       "batt_entity": "sensor.batt_a", "max_w": 5000,
+                       "bms_soc_floor": 10})
+    else:
+        common["inverters"] = [
+            {"name": f"inverter-{u}", "setpoint_entity": f"number.sp_{u}",
+             "soc_entity": f"sensor.soc_{u}", "batt_entity": f"sensor.batt_{u}",
+             "max_w": 2500, "bms_soc_floor": 10} for u in "ab"[:n]]
+    common.update(extra or {})
+    return common
+
+
+def _soc(u, t):
+    # A empties toward its cut-out level over the run; B stays half full.
+    return max(8.0, 60.0 - t / 40.0) if u == "a" else 50.0
+
+
+def run(n, *, extra=None, dur=2700.0, store=None, on_cycle=None, load=house,
+        soc=_soc, cut=None, before=None):
+    """Cycle a real Controller; returns (rows, controller). `before(c, t)`
+    runs before each cycle, `on_cycle(c, t)` after it."""
+    units = tuple("ab"[:n])
+    if cut is None:
+        def cut(u, t):
+            return n > 1 and u == "a" and 1600.0 <= t < 2300.0
+
+    async def go():
+        hass = _Hass(units, soc, cut, load)
+        c = Controller(_options(n, extra), hass, store or _Store(), _Pub(),
+                       stop=asyncio.Event())
+        for i in c.inverters:
+            i.dev_min, i.dev_max = -5000.0, 5000.0
+        c.auto = True
+        real_dt = m.datetime
+        clock = [0.0]
+
+        class _DT(real_dt):
+            @classmethod
+            def now(cls, tz=None):
+                return BASE + timedelta(seconds=clock[0])
+
+        m.datetime = _DT
+        rows = []
+        try:
+            t = 0.0
+            while t < dur:
+                hass.t = clock[0] = t
+                if before is not None:
+                    r = before(c, t)
+                    if asyncio.iscoroutine(r):
+                        await r
+                await c.read_inputs(now_mono=t)
+                await c.cycle()
+                alloc = getattr(c, "allocation", None)
+                rows.append((t, c.target, tuple(sorted(hass.cmd.items())),
+                             c.loop_reason, round(float(c.i_w), 6),
+                             c.sat_count, c.reason,
+                             alloc.explain() if alloc is not None else None))
+                if on_cycle is not None:
+                    on_cycle(c, t)
+                t += TICK
+        finally:
+            m.datetime = real_dt
+        return rows, c
+    return asyncio.run(go())
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+# Both batteries due for their monthly cycle at the run's first cycle, so the
+# maintenance slot, its pins and its shaping are in every row (PR #149 review:
+# the scenarios above never reach maintenance).
+_MAINT = {"maintenance_enabled": True, "maintenance_start_hour": 11}
+
+SCENARIOS = {
+    "n1": dict(n=1),
+    "n2": dict(n=2),
+    # The option present and false: what an install that saved the new
+    # option without turning it on runs. The old tree ignores the key.
+    "n1_off": dict(n=1, extra={"battery_modes_enabled": False}),
+    "n2_off": dict(n=2, extra={"battery_modes_enabled": False}),
+    "n1_maint": dict(n=1, extra=_MAINT),
+    "n2_maint": dict(n=2, extra=_MAINT),
+}
+
+
+def resolve_rows(cases=6000, seed=1149):
+    """The arbiter alone, on seeded random claim lists with no mode claim:
+    the peak floor, a trade, the loop, maintenance pins and shaping, SAFETY-73
+    refusal limits and probe pins, packs, ratings and safety stops, at one to
+    three inverters. The peak guard needs a P1 meter the cycle runs above do
+    not have, so its claim is graded here. Uses only a5dddad's API."""
+    import random
+    from math import inf
+    from app import arbiter as a
+    rnd = random.Random(seed)
+    rows = []
+    for _ in range(cases):
+        n = rnd.choice((1, 2, 3))
+        units = ("inverter-a", "inverter-b", "inverter-c")[:n]
+
+        def act(src, u):
+            return a.actuator_for(src, u, units)
+        cl = []
+        for u in units:
+            r = rnd.choice((1000.0, 2500.0, 5000.0))
+            cl.append(a.Claim.limit("supervised", a.P_SAFETY, -r, r, "max_w",
+                                    actuator=act("supervised", u)))
+            x = rnd.random()
+            if x < 0.15:
+                cl.append(a.Claim.limit("pack", a.P_SAFETY, *rnd.choice(
+                    ((0.0, inf), (-inf, 0.0))), actuator=act("pack", u)))
+            elif x < 0.25:
+                cl.append(a.Claim.limit("refused", a.P_SAFETY, *rnd.choice(
+                    ((-inf, 0.0), (0.0, inf))), "refused",
+                    actuator=act("refused", u)))
+            elif x < 0.32:
+                cl.append(a.Claim.set("refused", a.P_SAFETY,
+                                      rnd.choice((200.0, -200.0)), "probing",
+                                      actuator=act("refused", u)))
+            elif x < 0.42:
+                cl.append(a.Claim.set("maintenance", a.P_MAINTENANCE,
+                                      rnd.choice((2000.0, -2000.0)), "drain",
+                                      actuator=act("maintenance", u)))
+            elif x < 0.5:
+                cl.append(a.Claim.limit("maintenance", a.P_MAINT_SHAPE,
+                                        hi=-rnd.choice((500.0, 2000.0)),
+                                        actuator=act("maintenance", u)))
+        y = rnd.random()
+        if y < 0.8:
+            cl.append(a.Claim.set("loop", a.P_LOOP, rnd.uniform(-8000, 8000)))
+        if 0.5 < y < 0.9:
+            cl.append(a.Claim.set("arbitrage", a.P_ARBITRAGE,
+                                  rnd.uniform(-6000, 6000)))
+        if rnd.random() < 0.6:
+            cl.append(a.Claim.limit("peak", a.P_PEAK,
+                                    lo=rnd.uniform(-4000, 6000)))
+        if rnd.random() < 0.05:
+            cl.append(a.Claim.set("safety", a.P_SAFETY, 0.0, "stopped"))
+        rnd.shuffle(cl)
+        r = a.resolve(cl, units=units if n > 1 else None,
+                      weights=(None if rnd.random() < 0.5 else
+                               {u: rnd.choice((0.0, 0.5, 1.0)) for u in units}))
+        rows.append((r.target_w, r.winner, r.bound_by, r.contradiction,
+                     tuple(sorted((r.shares or {}).items())), r.allocated,
+                     r.allocation.explain() if r.allocation else None))
+    return rows
+
+
+def digests() -> dict:
+    out = {k: digest(run(**v)[0]) for k, v in SCENARIOS.items()}
+    out["resolve"] = digest(resolve_rows())
+    return out
+
+
+if __name__ == "__main__":
+    if "--summary" in sys.argv:
+        for k, v in SCENARIOS.items():
+            rows = run(**v)[0]
+            print(f"{k}: {len(rows)} cycles, loop reasons "
+                  f"{sorted({r[3] for r in rows})}, arbiter "
+                  f"{sorted({r[6].split(' ->')[0] for r in rows})}")
+        rr = resolve_rows()
+        print(f"resolve: {len(rr)} claim lists, winners "
+              f"{sorted({r[1] for r in rr})}, bound by "
+              f"{sorted({str(r[2]).split('(')[0] for r in rr})}")
+    for k, v in digests().items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/opt11p3_identity.py b/goodwe_controller/tools/opt11p3_identity.py
new file mode 100644
index 0000000..279777e
--- /dev/null
+++ b/goodwe_controller/tools/opt11p3_identity.py
@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+"""OPT-11 P3: with battery modes off, is every command byte-identical to
+release/1.0 7a00f12, on the paths P3 changed?
+
+    python3 tools/opt11p3_identity.py          # prints one digest per scenario
+
+tools/safety79_identity.py's harness (the REAL Controller on a P1 meter, so
+the peak guard runs) plus a day-ahead price series and `arbitrage_enabled`,
+so the site trade P3 now skips with modes on (`arbitrage.decide()`, its
+claim, the sizing to the guard's headroom) runs on every cycle, with a buy
+period, a sell period and periods in between, and a house that goes over the
+limit. Each row hashes safety79's fields plus the trade's action, watts and
+sentence. Uses only the API 7a00f12 has, so the same file runs on both trees;
+test_modes_p3.py part 1 holds this tree to the digests printed on 7a00f12.
+"""
+
+import functools
+import hashlib
+import os
+import sys
+import tempfile
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import safety79_identity as s79                            # noqa: E402
+from app.price import PricePoint, PriceProduct, PriceRead, brussels  # noqa
+from app.static_tariff import TariffPlan                   # noqa: E402
+
+DUR = 5400.0
+
+
+def prices():
+    """15-minute firm prices: the cheapest period 15-30 min into the run,
+    the dearest 75-90 min in, and ones in between."""
+    pts = []
+    for i in range(-8, 40):
+        s = rig.BASE + timedelta(minutes=15 * i)
+        p = 0.08 if i == 1 else 0.52 if i == 5 else 0.20 + 0.003 * (i % 7)
+        pts.append(PricePoint(start=brussels(s), eur_per_kwh=p,
+                              provisional=False))
+    return TariffPlan(PriceRead.series(pts, PriceProduct.DAY_AHEAD,
+                                       "generic_dayahead", rig.BASE), None,
+                      "provider")
+
+
+PLAN = prices()
+
+
+def _feed(c, t):
+    c.tariff_plan, c.tariff_at = PLAN, rig.BASE + timedelta(seconds=t)
+    s79._feed(c, t)
+
+
+def load(t):
+    """Under the limit, over it, a surplus, a big evening load."""
+    k = int(t // 600) % 5
+    return (900.0, 3200.0, -2200.0, 1500.0, 4200.0)[k]
+
+
+def soc(u, t):
+    return 55.0 if u == "a" else 45.0
+
+
+ARB = {"arbitrage_enabled": True, "cycle_cost_threshold_eur": 0.05}
+SCENARIOS = {
+    "n1": dict(n=1),
+    "n2": dict(n=2),
+    # The option present and false: an install that saved it off.
+    "n1_off": dict(n=1, extra={"battery_modes_enabled": False}),
+    "n2_off": dict(n=2, extra={"battery_modes_enabled": False}),
+}
+
+
+def run(n, *, extra=None, dur=DUR):
+    opts = dict(s79.P1, **ARB, **(extra or {}))
+    trade = []
+
+    def on_cycle(c, t):
+        a = c.arb
+        trade.append(None if a is None else (a.action, a.power_w, a.reason))
+    db = os.path.join(tempfile.mkdtemp(prefix="p3id-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        rows, c = rig.run(n, extra=opts, dur=dur, load=load, soc=soc,
+                          cut=lambda u, t: False, before=_feed,
+                          on_cycle=on_cycle)
+    finally:
+        rig.Controller = real
+    return [r + (x,) for r, x in zip(rows, trade)], c
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+def digests() -> dict:
+    return {k: digest(run(**v)[0]) for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    if "--summary" in sys.argv:
+        for k, v in SCENARIOS.items():
+            rows = run(**v)[0]
+            acts = sorted({str(r[-1][0]) if r[-1] else "None" for r in rows})
+            print(f"{k}: {len(rows)} cycles, trade actions {acts}")
+    for k, v in digests().items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/opt11p3_replay.py b/goodwe_controller/tools/opt11p3_replay.py
new file mode 100644
index 0000000..58b00ef
--- /dev/null
+++ b/goodwe_controller/tools/opt11p3_replay.py
@@ -0,0 +1,394 @@
+#!/usr/bin/env python3
+"""OPT-11 P3: replay days of recorded house load and real prices through the
+REAL Controller (read_inputs + cycle, the arbiter, the allocator, the peak
+guard on a P1 meter), with two modelled batteries, and report energy, cycles
+and money, plus the P3 invariants on every tick.
+
+    python3 tools/opt11p3_replay.py --days 16 --variant p3_ls
+    python3 tools/opt11p3_replay.py --captured          # 2026-09-09/10
+
+The same file runs on release/1.0 7a00f12 (the P2 baseline) and on this
+branch: it uses only the Controller API 7a00f12 has, and sets the batteries'
+choices through the store keys P1 defined (`pack_sell` was reserved there).
+
+REAL: the house (grid + battery power recorded 2026-09-02..17 on the live
+install, scenarios/loop-2026-09-02_2026-09-17: the house's own net demand,
+solar included), the prices (EPEX BE day-ahead, hourly, same weekday one year
+earlier (364 days), or the captured quarter-hourly energy-charts bodies for
+2026-09-09/10), the decision code.
+MODELLED: the batteries (a first-order lag, 3 s, 800 W/s ramp, SoC
+integrated, 95 % each way, a reading that jitters by a few watts, and
+optionally a device limit or a refusal to charge), the all-in price (the EPEX file's own stated
+assumption: (wholesale + 0.02 + 0.10) x 1.06), export paid at the wholesale
+price, tomorrow's prices known from 13:00 local. The absolute money is
+therefore an estimate; the comparison between variants is the point.
+"""
+
+import argparse
+import asyncio
+import gzip
+import json
+import math
+import os
+import sys
+import time
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, HERE)
+
+import app.main as m                                      # noqa: E402
+from app.main import Controller                           # noqa: E402
+from app.p1 import make_sample, split_signed               # noqa: E402
+from app.price import PricePoint, PriceProduct, PriceRead, brussels  # noqa
+from app.static_tariff import TariffPlan                  # noqa: E402
+from app.store import unit_key                            # noqa: E402
+
+LOOP = os.path.join(HERE, "scenarios", "loop-2026-09-02_2026-09-17")
+EPEX = os.path.join(HERE, "scenarios",
+                    "epex-be-dayahead-2025-09-01_2026-09-01.json")
+QH = os.path.join(HERE, "scenarios",
+                  "energy-charts-be-price-2026-09-09_2026-09-10-twoday.json")
+TICK = 5.0
+CAP_KWH = 10.0
+RATING = 2500.0
+PEAK_CAP = 3500
+
+
+def all_in(wholesale_kwh):
+    return round((wholesale_kwh + 0.02 + 0.10) * 1.06, 6)
+
+
+def load_house(days):
+    """[(t_utc_epoch, house_w)] from the recording: grid + battery power."""
+    out = []
+    for d in days:
+        def rd(kind):
+            f = os.path.join(LOOP, f"{d}-{kind}.jsonl.gz")
+            rows = []
+            with gzip.open(f, "rt") as fh:
+                for line in fh:
+                    r = json.loads(line)
+                    try:
+                        v = float(r["v"])
+                    except ValueError:
+                        continue
+                    rows.append((datetime.fromisoformat(r["t"]).timestamp(),
+                                 v))
+            return rows
+        g, b = rd("grid"), rd("batt")
+        j = 0
+        for t, gw in g:
+            while j + 1 < len(b) and b[j + 1][0] <= t:
+                j += 1
+            bw = b[j][1] if b and b[j][0] <= t else 0.0
+            out.append((t, gw + bw))
+    out.sort()
+    return out
+
+
+def epex_points(shift_days=364):
+    d = json.load(open(EPEX))["prices"]
+    pts = []
+    for r in d:
+        s = datetime.fromisoformat(r["start"]) + timedelta(days=shift_days)
+        pts.append((s.astimezone(timezone.utc), 3600,
+                    float(r["eur_per_kwh"])))
+    return pts
+
+
+def qh_points():
+    d = json.load(open(QH))
+    return [(datetime.fromtimestamp(t, timezone.utc), 900, p / 1000.0)
+            for t, p in zip(d["unix_seconds"], d["price"])
+            if p is not None]
+
+
+class Plant:
+    def __init__(self, soc, refuse_charge=False):
+        self.cmd, self.p, self.soc = 0.0, 0.0, float(soc)
+        self.refuse_charge = refuse_charge
+
+    def step(self, dt, floor):
+        c = self.cmd
+        if c > 0 and self.soc <= floor:
+            c = 0.0
+        if c < 0 and (self.soc >= 100.0 or self.refuse_charge):
+            c = 0.0
+        want = self.p + (c - self.p) * (1 - math.exp(-dt / 3.0))
+        dp = max(-800.0 * dt, min(800.0 * dt, want - self.p))
+        self.p += dp
+        e = self.p * dt / 3600.0 / 1000.0            # kWh, + = out
+        eff = 1 / 0.95 if e > 0 else 0.95
+        self.soc -= e * eff / CAP_KWH * 100.0
+        self.soc = max(0.0, min(100.0, self.soc))
+
+
+class Hass:
+    def __init__(self, units, house_at, soc0=None, refuse=(), limits=None):
+        self.units = units
+        self.lim = limits or {}
+        self.plants = {u: Plant((soc0 or {}).get(u, 50.0), u in refuse)
+                       for u in units}
+        self.house_at = house_at
+        self.t = 0.0
+
+    def grid(self):
+        return self.house_at(self.t) - sum(p.p for p in self.plants.values())
+
+    async def limits(self, e):
+        lo, hi = self.lim.get(e[-1], (-5000.0, 5000.0))
+        return (lo, hi, 1.0)
+
+    async def call(self, *a):
+        return True
+
+    async def number(self, e, invert=False):
+        if e == "sensor.grid":
+            return self.grid()
+        u = e[-1]
+        if e.startswith("sensor.soc"):
+            return round(self.plants[u].soc, 1)
+        if e.startswith("sensor.batt"):
+            # A real reading jitters by a few watts; a dead-flat one is a
+            # stale register to the add-on (SAFETY-37), which is not modelled.
+            j = (ord(u) * 31 + int(self.t)) % 7 - 3
+            return float(round(self.plants[u].p) + j)
+        return None
+
+    async def set_number(self, e, v):
+        self.plants[e[-1]].cmd = float(v)
+        return True
+
+
+class _Store:
+    def __init__(self):
+        from app.store import DEFAULTS
+        self.data = dict(DEFAULTS)
+
+    def set(self, k, v):
+        self.data[k] = v
+
+    def get_time(self, k):
+        v = self.data.get(k)
+        return datetime.fromisoformat(v) if v else None
+
+    def set_time(self, k, when):
+        self.data[k] = when.isoformat() if when else None
+
+
+class _Pub:
+    enabled = False
+
+    def publish(self, *a, **k):
+        pass
+
+    def close(self):
+        pass
+
+
+VARIANTS = {
+    # (modes on, arbitrage_enabled, {unit: (use, mode, sell)})
+    "modes_off": (False, False, {}),
+    "arb_only": (False, True, {}),
+    "p2_sf_ls": (True, False, {"a": (True, "solar_first", False),
+                               "b": (True, "leftover_solar", False)}),
+    "p2_arb": (True, True, {"a": (True, "solar_first", False),
+                            "b": (True, "leftover_solar", False)}),
+    "p3_ls": (True, False, {"a": (True, "solar_first", False),
+                            "b": (True, "leftover_solar", False)}),
+    "p3_ch_sell": (True, False, {"a": (True, "solar_first", False),
+                                 "b": (True, "cheap_hours", True)}),
+    "p3_both_ch": (True, False, {"a": (True, "cheap_hours", False),
+                                 "b": (True, "cheap_hours", True)}),
+}
+
+
+def options(modes, arb, n=2):
+    o = {"meter_entity": "sensor.grid", "meter_source": "ha_signed",
+         "p1_net_entity": "sensor.net", "meter_phases": 1,
+         "peak_cap_w": PEAK_CAP, "gain": 0.6, "slew_w": 400,
+         "target_grid_w": -10, "deadband_w": 15, "step_w": 10,
+         "heartbeat_s": 10, "stale_input_s": 15, "auto_start": True,
+         "battery_modes_enabled": modes, "arbitrage_enabled": arb,
+         "cycle_cost_threshold_eur": 0.10,
+         "inverters": [{"name": f"inverter-{u}",
+                        "setpoint_entity": f"number.sp_{u}",
+                        "soc_entity": f"sensor.soc_{u}",
+                        "batt_entity": f"sensor.batt_{u}",
+                        "max_w": int(RATING), "bms_soc_floor": 10,
+                        "capacity_kwh": CAP_KWH} for u in "ab"[:n]]}
+    return o
+
+
+def plan_at(now, pts):
+    """The firm day-ahead points a site holds at `now`: today, and tomorrow
+    once published (13:00 local)."""
+    loc = brussels(now)
+    day0 = loc.replace(hour=0, minute=0, second=0, microsecond=0)
+    end = day0 + timedelta(days=2 if loc.hour >= 13 else 1)
+    sel = [PricePoint(start=brussels(s), eur_per_kwh=all_in(p),
+                      provisional=False)
+           for s, span, p in pts if day0 <= s < end]
+    if len(sel) < 2:
+        return None
+    return TariffPlan(PriceRead.series(sel, PriceProduct.DAY_AHEAD,
+                                       "generic_dayahead", now), None,
+                      "provider")
+
+
+def run(variant, house, pts, start, dur, *, check=None, stride=1, n=2,
+        soc0=None, refuse=(), extra=None, choice=None, patch=None,
+        limits=None):
+    modes, arb, var_choice = VARIANTS[variant]
+    choice = var_choice if choice is None else choice
+    units = tuple("ab"[:n])
+    import bisect
+    ts = [h[0] for h in house]
+
+    def house_at(t):
+        i = bisect.bisect_right(ts, start.timestamp() + t) - 1
+        return house[max(0, i)][1]
+
+    wholesale = {s: (span, p) for s, span, p in pts}
+    starts = sorted(wholesale)
+
+    def price_at(now):
+        i = bisect.bisect_right(starts, now) - 1
+        if i < 0:
+            return None
+        s = starts[i]
+        span, p = wholesale[s]
+        return p if now < s + timedelta(seconds=span) else None
+
+    store = _Store()
+    for u, (use, mode, sell) in choice.items():
+        store.data[unit_key(f"inverter-{u}", "pack_use")] = use
+        store.data[unit_key(f"inverter-{u}", "pack_mode")] = mode
+        store.data[unit_key(f"inverter-{u}", "pack_sell")] = sell
+    stats = dict(imp_kwh=0.0, exp_kwh=0.0, cost=0.0, exp_rev=0.0,
+                 out_kwh={u: 0.0 for u in "ab"[:n]},
+                 in_kwh={u: 0.0 for u in "ab"[:n]},
+                 ticks=0, quarters={}, trade_ticks=0)
+
+    async def go():
+        hass = Hass(units, house_at, soc0, refuse, limits)
+        import tempfile
+        db = os.path.join(tempfile.mkdtemp(prefix="p3r-"), "tariff.db")
+        c = Controller(dict(options(modes, arb, n), **(extra or {})), hass,
+                       store, _Pub(), stop=asyncio.Event(), peak_db_path=db)
+        for i in c.inverters:
+            i.dev_min, i.dev_max = (limits or {}).get(i.name[-1],
+                                                      (-5000.0, 5000.0))
+        if patch is not None:
+            patch(c)
+        c.auto = True
+        real_dt = m.datetime
+        clock = [start]
+
+        class _DT(real_dt):
+            @classmethod
+            def now(cls, tz=None):
+                return clock[0] if tz is None else clock[0].astimezone(tz)
+
+        m.datetime = _DT
+        plan_hour = None
+        try:
+            t = 0.0
+            while t < dur:
+                now = start + timedelta(seconds=t)
+                hass.t = t
+                clock[0] = now
+                if plan_hour != now.replace(minute=0, second=0,
+                                            microsecond=0):
+                    plan_hour = now.replace(minute=0, second=0,
+                                            microsecond=0)
+                    c.tariff_plan, c.tariff_at = plan_at(now, pts), now
+                else:
+                    c.tariff_at = now
+                imp, exp = split_signed(hass.grid())
+                c.p1.submit(make_sample("ha_signed", imp, exp, phases=1,
+                                        ingest_ts=now,
+                                        ingest_mono=time.monotonic()))
+                await c.read_inputs(now_mono=t)
+                await c.cycle()
+                for p in hass.plants.values():
+                    p.step(TICK, 10.0)
+                g = hass.grid()
+                pr = price_at(now)
+                dt_h = TICK / 3600.0
+                if g > 0:
+                    stats["imp_kwh"] += g / 1000 * dt_h
+                    stats["cost"] += g / 1000 * dt_h * (all_in(pr) if pr
+                                                         is not None else 0)
+                else:
+                    stats["exp_kwh"] += -g / 1000 * dt_h
+                    stats["exp_rev"] += -g / 1000 * dt_h * (pr or 0.0)
+                for u, p in hass.plants.items():
+                    if p.p > 0:
+                        stats["out_kwh"][u] += p.p / 1000 * dt_h
+                    else:
+                        stats["in_kwh"][u] -= p.p / 1000 * dt_h
+                q = int(now.timestamp() // 900)
+                acc = stats["quarters"].setdefault(q, [0.0, 0, False])
+                acc[0] += max(0.0, g)
+                acc[1] += 1
+                if (getattr(c.arb, "action", None) or "").endswith("CHARGE"):
+                    acc[2] = True
+                    stats["trade_ticks"] += 1
+                stats["ticks"] += 1
+                if check is not None:
+                    check(c, hass, now, pr)
+                t += TICK
+        finally:
+            m.datetime = real_dt
+        return c
+    c = asyncio.run(go())
+    return stats, c
+
+
+def summary(stats):
+    qs = stats["quarters"]
+    worst = max((a[0] / a[1] for a in qs.values()), default=0.0)
+    worst_trade = max((a[0] / a[1] for a in qs.values() if a[2]),
+                      default=0.0)
+    cyc = {u: round(v / CAP_KWH, 2) for u, v in stats["out_kwh"].items()}
+    return {"import_kwh": round(stats["imp_kwh"], 2),
+            "export_kwh": round(stats["exp_kwh"], 2),
+            "import_eur": round(stats["cost"], 2),
+            "export_eur": round(stats["exp_rev"], 2),
+            "net_eur": round(stats["cost"] - stats["exp_rev"], 2),
+            "cycles": cyc, "worst_quarter_w": round(worst, 1),
+            "worst_charge_quarter_w": round(worst_trade, 1),
+            "charge_ticks": stats["trade_ticks"]}
+
+
+LOOP_DAYS = [f"2026-09-{d:02d}" for d in range(2, 18)]
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--variant", default="p3_ls")
+    ap.add_argument("--days", type=int, default=16)
+    ap.add_argument("--captured", action="store_true")
+    a = ap.parse_args()
+    if a.captured:
+        days = ["2026-09-09", "2026-09-10"]
+        pts = qh_points()
+    else:
+        days = LOOP_DAYS[:a.days]
+        pts = epex_points()
+    house = load_house(days)
+    start = datetime.fromisoformat(days[0] + "T00:00:00+02:00") \
+        .astimezone(timezone.utc)
+    dur = 86400.0 * len(days)
+    t0 = time.time()
+    stats, _c = run(a.variant, house, pts, start, dur)
+    out = summary(stats)
+    out["variant"], out["days"] = a.variant, len(days)
+    out["wall_s"] = round(time.time() - t0, 1)
+    print(json.dumps(out))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/goodwe_controller/tools/opt11p4_identity.py b/goodwe_controller/tools/opt11p4_identity.py
new file mode 100644
index 0000000..92ec7e8
--- /dev/null
+++ b/goodwe_controller/tools/opt11p4_identity.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""OPT-11 P4: with no usable solar forecast, is every command byte-identical
+to release/1.0 5a4cdc2 (P3, owner option A)?
+
+    python3 tools/opt11p4_identity.py          # one digest per scenario
+
+tools/opt11p3_identity.py's harness (the REAL Controller on a P1 meter, a
+cheap slot, a dear slot, a house over the limit, `arbitrage_enabled`), now
+with battery modes ON and each battery's mode set in the store, so P3's run
+code runs on every cycle. Each row adds the trade and the roles. Scenarios:
+* `ls`, `ch`, `ls_ls`, `ch_ls`: no `pv_forecast_entity` (the day plan never
+  runs); N=1 and N=2.
+* `*_fc_down`: `pv_forecast_entity` set but the sensor reads `unavailable`,
+  with a ready house profile in the store (the plan falls back); 5a4cdc2
+  ignores both keys, so the digest must match the scenario without them.
+Uses only the API 5a4cdc2 has; test_modes_p4.py part 1 holds this tree to the
+digests printed on 5a4cdc2.
+"""
+
+import functools
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import opt11p3_identity as p3                              # noqa: E402
+import safety79_identity as s79                            # noqa: E402
+from app.store import unit_key                             # noqa: E402
+
+FC = {"pv_forecast_entity": "sensor.energy_production_today_remaining",
+      "pv_forecast_tomorrow_entity": "sensor.energy_production_tomorrow"}
+
+
+async def _unavailable(self, e):
+    return {"state": "unavailable", "attributes": {},
+            "last_updated": "2026-09-20T11:00:00+00:00"}
+
+
+rig._Hass.state = _unavailable
+
+SCENARIOS = {
+    "n1_ls": dict(n=1, modes={"inverter-a": "leftover_solar"}),
+    "n1_ch": dict(n=1, modes={"inverter-a": "cheap_hours"}),
+    "n2_sf_ls": dict(n=2, modes={"inverter-a": "solar_first",
+                                 "inverter-b": "leftover_solar"}),
+    "n2_ch_ls": dict(n=2, modes={"inverter-a": "cheap_hours",
+                                 "inverter-b": "leftover_solar"}),
+    "n2_ls_ls": dict(n=2, modes={"inverter-a": "leftover_solar",
+                                 "inverter-b": "leftover_solar"}),
+    "n2_sf_ch": dict(n=2, modes={"inverter-a": "solar_first",
+                                 "inverter-b": "cheap_hours"}),
+}
+for _k, _v in list(SCENARIOS.items()):
+    SCENARIOS[_k + "_fc_down"] = dict(_v, extra=FC)
+
+
+def run(n, *, modes, extra=None, dur=p3.DUR):
+    opts = dict(s79.P1, **p3.ARB, battery_modes_enabled=True,
+                **(extra or {}))
+    if n == 2:
+        # A capacity on each battery, so a day plan could size a level;
+        # small, so the cheap run is the one cheap slot.
+        opts["inverters"] = [
+            {"name": f"inverter-{u}", "setpoint_entity": f"number.sp_{u}",
+             "soc_entity": f"sensor.soc_{u}", "batt_entity": f"sensor.batt_{u}",
+             "max_w": 2500, "bms_soc_floor": 10, "capacity_kwh": 1.0}
+            for u in "ab"]
+    store = rig._Store()
+    # At N=1 the one battery is named after the site; the key is per name.
+    for name, mode in modes.items():
+        store.data[unit_key(name, "pack_mode")] = mode
+    if extra:
+        # A ready house profile (a day, 600 W, 3 kW 17:00-22:00), so only
+        # the missing forecast stops a plan here. 5a4cdc2 ignores the key.
+        store.data["house_profile"] = {"2026-09-19": {
+            str(h): (3000.0 if 17 <= h < 22 else 600.0) for h in range(24)}}
+    trade = []
+
+    def on_cycle(c, t):
+        a, tick = c.arb, getattr(c, "mode_tick", None)
+        trade.append((None if a is None else (a.action, a.power_w, a.reason),
+                      None if tick is None else
+                      tuple(sorted(tick.roles.items()))))
+    db = os.path.join(tempfile.mkdtemp(prefix="p4id-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        rows, c = rig.run(n, extra=opts, dur=dur, load=p3.load, soc=p3.soc,
+                          cut=lambda u, t: False, before=p3._feed,
+                          on_cycle=on_cycle, store=store)
+    finally:
+        rig.Controller = real
+    return [r + (x,) for r, x in zip(rows, trade)], c
+
+
+def digests() -> dict:
+    return {k: p3.digest(run(**v)[0]) for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    if "--summary" in sys.argv:
+        for k, v in SCENARIOS.items():
+            rows = run(**v)[0]
+            acts = sorted({str(r[-1][0][0]) if r[-1][0] else "None"
+                           for r in rows})
+            roles = sorted({x for r in rows if r[-1][1]
+                            for x in (y for _n, y in r[-1][1])})
+            print(f"{k}: {len(rows)} cycles, trade {acts}, roles {roles}")
+    for k, v in digests().items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/opt11p4_replay.py b/goodwe_controller/tools/opt11p4_replay.py
new file mode 100644
index 0000000..2559a3c
--- /dev/null
+++ b/goodwe_controller/tools/opt11p4_replay.py
@@ -0,0 +1,246 @@
+#!/usr/bin/env python3
+"""OPT-11 P4: does the solar forecast pay? Replays recorded days through the
+REAL Controller with tools/opt11p3_replay.py's engine (house, batteries,
+prices, peak guard), plus a solar forecast sensor in Home Assistant.
+
+    python3 tools/opt11p4_replay.py --variant p4_ls --fc recorded
+    python3 tools/opt11p4_replay.py --variant p3_ls --prices real2026
+
+Runs unchanged on release/1.0 7a00f12 (P2) and 5a4cdc2 (P3): an older tree
+ignores `pv_forecast_entity` and never reads the sensor.
+
+HOW THE FORECAST IS MADE (the site's own solar was not recorded for these
+days; the 2026-09-24 PV recording is only in the live Home Assistant):
+* The site's solar, hour by hour, is rebuilt from the recording: the house's
+  net use (grid + battery) is house - solar, so solar = max(0, H - net),
+  where H is the median net use of the night hours (22:00-06:00) over all
+  days (`--fc perfect` feeds exactly this).
+* `recorded`: that solar times the day's error of the real Belgian day-ahead
+  solar forecast (Elia, via energy-charts): forecast / actual, per day.
+* `national`: the Belgian day-ahead forecast itself, scaled to the site
+  (one factor: the site's total over the national total, all days). It
+  carries local weather differences too, so it is the harder test.
+* `zero`: a forecast of no sun at all (is the gain the forecast's, or only
+  Leftover solar buying the evening's shortfall?).
+* `high`: `national` x 1.5. `missing`: the sensor is configured but reads
+  `unavailable`. The sensor has Open-Meteo's shape (state = kWh left today,
+  `wh_period` = Wh per hour); `--shape state` drops `wh_period`
+  (Forecast.Solar's shape).
+
+MONEY: as opt11p3_replay.py (all-in import (wholesale + 0.12) x 1.06, export
+at wholesale), plus `stored_eur`: the change in usable energy (above the
+10 % cut-out) from start to end, x 0.95, at the median all-in import price
+of the run. `net_after_eur` = net - stored_eur.
+"""
+
+import argparse
+import bisect
+import json
+import os
+import statistics
+import sys
+import time
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+import opt11p3_replay as rp                               # noqa: E402
+
+EC = os.path.join(HERE, "scenarios",
+                  "energy-charts-be-solar-price-2026-09-01_2026-09-17.json")
+FC_ENTITY = "sensor.energy_production_today_remaining"
+FC_TOMORROW = "sensor.energy_production_tomorrow"
+
+rp.VARIANTS.update({
+    "p4_ls": (True, False, {"a": (True, "solar_first", False),
+                            "b": (True, "leftover_solar", False)}),
+    "p4_ch": (True, False, {"a": (True, "solar_first", False),
+                            "b": (True, "cheap_hours", False)}),
+})
+LOCAL = timezone(timedelta(hours=2))        # CEST for every replayed day
+
+
+def ec():
+    return json.load(open(EC))
+
+
+def real2026_points():
+    """The real day-ahead prices of the replayed days (15-minute)."""
+    d = ec()["price"]
+    return [(datetime.fromtimestamp(t, timezone.utc), 900, p / 1000.0)
+            for t, p in zip(d["unix_seconds"], d["eur_mwh"]) if p is not None]
+
+
+def site_solar(house):
+    """{hour start (UTC epoch): site solar kWh}, and H (W)."""
+    by_h = {}
+    for t, w in house:
+        by_h.setdefault(int(t // 3600) * 3600, []).append(w)
+    net = {h: statistics.fmean(v) for h, v in by_h.items() if len(v) > 20}
+    night = [w for h, w in net.items()
+             if datetime.fromtimestamp(h, LOCAL).hour in
+             (22, 23, 0, 1, 2, 3, 4, 5)]
+    base = statistics.median(night)
+    return {h: max(0.0, base - w) / 1000.0 for h, w in net.items()}, base
+
+
+def national():
+    s = ec()["solar"]
+    act = dict(zip(s["unix_seconds"], s["actual_mw"]))
+    fc = dict(zip(s["dayahead_unix_seconds"], s["dayahead_mw"]))
+    return act, fc
+
+
+def forecast_table(kind, house, days):
+    """{hour start epoch: forecast kWh}, and a report of its accuracy."""
+    pv, base = site_solar(house)
+    act, fc = national()
+    day_of = {h: datetime.fromtimestamp(h, LOCAL).date() for h in pv}
+    if kind in ("perfect", "missing"):
+        out = dict(pv)
+    elif kind == "zero":
+        out = {h: 0.0 for h in pv}
+    elif kind == "recorded":
+        ratio = {}
+        for d in set(day_of.values()):
+            hs = [h for h in pv if day_of[h] == d]
+            a = sum(act.get(h) or 0.0 for h in hs)
+            f = sum(fc.get(h) or 0.0 for h in hs)
+            ratio[d] = f / a if a > 0 else 1.0
+        out = {h: pv[h] * ratio[day_of[h]] for h in pv}
+    else:
+        k = sum(pv.values()) / max(1e-9, sum(act.get(h) or 0.0 for h in pv))
+        out = {h: (fc.get(h) or 0.0) * k * (1.5 if kind == "high" else 1.0)
+               for h in pv}
+    rep = []
+    for d in sorted(set(day_of.values())):
+        a = sum(pv[h] for h in pv if day_of[h] == d)
+        f = sum(out[h] for h in out if day_of[h] == d)
+        rep.append((d.isoformat(), round(a, 1), round(f, 1)))
+    return out, base, rep
+
+
+def install_sensor(table, kind, shape):
+    """Give opt11p3_replay's Hass a `state()` for the forecast sensors."""
+    hours = sorted(table)
+    t0 = rp_start[0]
+
+    def day_bounds(now):
+        loc = now.astimezone(LOCAL)
+        d0 = loc.replace(hour=0, minute=0, second=0, microsecond=0)
+        return d0, d0 + timedelta(days=1)
+
+    def sensor(now, tomorrow):
+        d0, d1 = day_bounds(now)
+        if tomorrow:
+            d0, d1 = d1, d1 + timedelta(days=1)
+        a, b = d0.timestamp(), d1.timestamp()
+        i, j = bisect.bisect_left(hours, a), bisect.bisect_left(hours, b)
+        rows = [(h, table[h]) for h in hours[i:j]]
+        if not rows:
+            return None
+        n = now.timestamp()
+        left = 0.0
+        for h, kwh in rows:
+            if tomorrow or h >= n:
+                left += kwh
+            elif h + 3600 > n:
+                left += kwh * (h + 3600 - n) / 3600.0
+        attrs = {"unit_of_measurement": "kWh"}
+        if shape == "periods":
+            attrs["wh_period"] = {
+                datetime.fromtimestamp(h, timezone.utc).isoformat():
+                round(kwh * 1000.0, 1) for h, kwh in rows}
+        # The forecast refreshes every hour.
+        rep = datetime.fromtimestamp(int(n // 3600) * 3600, timezone.utc)
+        return {"state": f"{left:.3f}", "attributes": attrs,
+                "last_updated": rep.isoformat(),
+                "last_reported": rep.isoformat()}
+
+    async def state(self, e):
+        now = t0 + timedelta(seconds=self.t)
+        if kind == "missing":
+            return {"state": "unavailable", "attributes": {},
+                    "last_updated": now.isoformat()}
+        if e == FC_ENTITY:
+            return sensor(now, False)
+        if e == FC_TOMORROW:
+            return sensor(now, True)
+        return None
+    rp.Hass.state = state
+
+
+rp_start = [None]
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--variant", default="p4_ls")
+    ap.add_argument("--fc", default="recorded",
+                    choices=("none", "recorded", "national", "perfect",
+                             "high", "missing", "zero"))
+    ap.add_argument("--prices", default="epex2025",
+                    choices=("epex2025", "real2026"))
+    ap.add_argument("--shape", default="periods",
+                    choices=("periods", "state"))
+    ap.add_argument("--first", type=int, default=2)
+    ap.add_argument("--days", type=int, default=16)
+    ap.add_argument("--trust", type=int, default=None)
+    ap.add_argument("--report", action="store_true",
+                    help="print the forecast's accuracy and exit")
+    a = ap.parse_args()
+    days = [f"2026-09-{d:02d}" for d in range(a.first, a.first + a.days)]
+    house = rp.load_house(days)
+    pts = rp.epex_points() if a.prices == "epex2025" else real2026_points()
+    start = datetime.fromisoformat(days[0] + "T00:00:00+02:00") \
+        .astimezone(timezone.utc)
+    rp_start[0] = start
+    extra = {}
+    if a.fc != "none":
+        table, base, rep = forecast_table(a.fc, house, days)
+        if a.report:
+            print(json.dumps({"fc": a.fc, "night_base_w": round(base),
+                              "days": rep}))
+            return
+        install_sensor(table, a.fc, a.shape)
+        extra = {"pv_forecast_entity": FC_ENTITY,
+                 "pv_forecast_tomorrow_entity": FC_TOMORROW}
+        if a.trust is not None:
+            extra["solar_trust_pct"] = a.trust
+    socs = {}
+
+    def check(c, hass, now, pr):
+        if "start" not in socs:
+            socs["start"] = {u: p.soc for u, p in hass.plants.items()}
+        socs["end"] = {u: p.soc for u, p in hass.plants.items()}
+        dp = getattr(c, "day_plan", None)
+        if dp is not None:
+            socs.setdefault("verdicts", {})[
+                now.astimezone(LOCAL).date().isoformat()] = dp.verdict
+    t0 = time.time()
+    stats, _c = rp.run(a.variant, house, pts, start, 86400.0 * len(days),
+                       extra=extra, check=check)
+    out = rp.summary(stats)
+    prices = sorted(rp.all_in(p) for _s, _n, p in pts
+                    if start <= _s < start + timedelta(days=len(days)))
+    med = prices[len(prices) // 2]
+
+    def usable(soc):
+        return sum(max(0.0, v - 10.0) / 100.0 * rp.CAP_KWH
+                   for v in soc.values())
+    d_kwh = usable(socs["end"]) - usable(socs["start"])
+    out["stored_change_kwh"] = round(d_kwh, 2)
+    out["stored_eur"] = round(d_kwh * 0.95 * med, 2)
+    out["net_after_eur"] = round(out["net_eur"] - out["stored_eur"], 2)
+    out["end_soc"] = {u: round(v, 1) for u, v in socs["end"].items()}
+    out.update(variant=a.variant, fc=a.fc, prices=a.prices, shape=a.shape,
+               first=days[0], days=len(days),
+               verdicts=socs.get("verdicts", {}),
+               wall_s=round(time.time() - t0, 1))
+    print(json.dumps(out))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/goodwe_controller/tools/predeploy_check.py b/goodwe_controller/tools/predeploy_check.py
index cc718af..f72f16a 100644
--- a/goodwe_controller/tools/predeploy_check.py
+++ b/goodwe_controller/tools/predeploy_check.py
@@ -39,8 +39,10 @@ and not at merge. The check belongs where the mistake is made.
 
 ⚠️ WHAT THIS DOES NOT DO. It does not read the live box. The options blob is
 reachable only through the Supervisor API, which needs a supervisor token, so
-the operator exports it and passes `--options`. Without that flag the validator
-half is SKIPPED and says so - a skipped check must never look like a passed one.
+the operator exports it and passes `--options` - the bare options object
+(`.data.options` of `ha apps info <slug> --raw-json`); any other shape is
+refused. Without that flag the validator half is SKIPPED and says so - a
+skipped check must never look like a passed one.
 """
 import argparse
 import json
@@ -79,6 +81,43 @@ def shipped_version(tree=ADDON):
     return m.group(1) if m else None
 
 
+def option_keys(addon=ADDON):
+    """Top-level option names in `addon`'s config.yaml `options:`/`schema:` blocks."""
+    keys, section = set(), None
+    with open(os.path.join(addon, "config.yaml"), encoding="utf-8") as fh:
+        for line in fh:
+            if not line.strip() or line.startswith("#"):
+                continue
+            if not line[0].isspace():
+                section = line.split(":", 1)[0].strip()
+                continue
+            m = re.match(r"  ([A-Za-z_][A-Za-z0-9_]*):", line)
+            if m and section in ("options", "schema"):
+                keys.add(m.group(1))
+    return keys
+
+
+def shape_problem(doc, known, what, allow_empty=False):
+    """Why `doc` is not a document of `known` keys, or None (SAFETY-60/62).
+
+    Positive property: a JSON object, at least half of whose top-level keys
+    (`_`-prefixed comments aside) `known(key)` recognises.
+    """
+    if not isinstance(doc, dict):
+        return f"{what} is a JSON {type(doc).__name__}, not an object"
+    keys = [k for k in doc if not str(k).startswith("_")]
+    hits = [k for k in keys if known(k)]
+    if (keys or allow_empty) and len(hits) * 2 >= len(keys):
+        return None
+    msg = (f"{what} is not the expected document: {len(hits)} of {len(keys)} "
+           f"top-level key(s) recognised {sorted(map(str, keys))[:8]}")
+    inner = doc.get("data")
+    if isinstance(inner, dict) and isinstance(inner.get("options"), dict):
+        msg += ("; this is `ha apps info --raw-json` output - pass its "
+                "`.data.options` instead")
+    return msg
+
+
 def is_runtime(path):
     return any(path == p or path.startswith(p) for p in RUNTIME)
 
@@ -256,6 +295,12 @@ def main():
         except (json.JSONDecodeError, OSError, UnicodeDecodeError) as exc:
             problems.append(f"--options file could not be read as JSON "
                             f"({type(exc).__name__}: {exc}); the config was NOT checked")
+        # SAFETY-60: the validator accepts any dict, so the shape is checked here.
+        bad = (shape_problem(opts, option_keys().__contains__, "--options")
+               if opts is not None else None)
+        if bad:
+            problems.append(f"{bad}; the config was NOT checked")
+            opts = None
     if a.options and opts is not None:
         try:
             from app.validate import validate_startup_config
@@ -281,7 +326,7 @@ def main():
                     print(f"      - {p}")
             else:
                 print("  live options pass this version's validator")
-    else:
+    elif not a.options:
         skipped.append("--options was not given, so the live config was NEVER CHECKED "
                        "against this version's validator. A config refused at startup is "
                        "exit 78. Export the options and re-run before deploying.")
diff --git a/goodwe_controller/tools/rehearse_roster.py b/goodwe_controller/tools/rehearse_roster.py
index 418f44e..ebe8452 100644
--- a/goodwe_controller/tools/rehearse_roster.py
+++ b/goodwe_controller/tools/rehearse_roster.py
@@ -46,8 +46,11 @@ EXIT CODES
     1   ⭐ AT LEAST ONE OF THOSE HAPPENED. This is the code that must be
         reachable: `test_rehearse.py` mutates the shipped migration nine
         different ways and requires this exit code for each.
-    2   the rehearsal could not be performed (bad file, unparseable config, the
-        entity-id model failed its own anchor). ⚠️ NOT A PASS.
+    2   the rehearsal could not be performed (bad file, unparseable config, a
+        state or options file of the wrong shape, the entity-id model failed
+        its own anchor). ⚠️ NOT A PASS.
+    3   no findings, but --no-live-entities: the orphan check was not graded
+        against the install. ⚠️ NOT A PASS.
 """
 
 import argparse
@@ -64,10 +67,12 @@ from app.inverter import UNIT_A, UNIT_STORE_KEYS, Inverter, roster_names  # noqa
 from app.main import Controller  # noqa: E402
 from app import mqtt  # noqa: E402
 from app.p1 import is_enabled  # noqa: E402
-from app.store import (DEFAULTS, MAINT_UNIT_KEYS, Store,  # noqa: E402
-                       unit_key)
+from app.store import (DEFAULTS, MAINT_SCHEMA_KEY, MAINT_UNIT_KEYS,  # noqa: E402
+                       SCHEMA_KEY, Store, unit_key)
+from predeploy_check import option_keys, shape_problem  # noqa: E402
 
-EXIT_OK, EXIT_FINDING, EXIT_COULD_NOT_RUN = 0, 1, 2
+EXIT_OK, EXIT_FINDING, EXIT_COULD_NOT_RUN, EXIT_DEGRADED = 0, 1, 2, 3
+ADDON = Path(__file__).resolve().parent.parent
 
 
 class Refused(Exception):
@@ -184,8 +189,30 @@ def load_options(path: str) -> dict:
             obj = _mini_yaml(text)
         else:
             obj = yaml.safe_load(text)
-    if not isinstance(obj, dict):
-        raise Refused(f"{path}: options must be a mapping, got {type(obj).__name__}")
+    # SAFETY-62: a wrapped export is a dict too, so assert the keys are options.
+    bad = shape_problem(obj, option_keys(str(ADDON)).__contains__, path)
+    if bad:
+        raise Refused(bad)
+    return obj
+
+
+_UNIT_PREFIX = unit_key("\0", "").split("\0")[0]
+# "auto" is the Automatic toggle, written by app/main.py outside DEFAULTS.
+_STORE_KEYS = {*DEFAULTS, *MAINT_UNIT_KEYS, SCHEMA_KEY, MAINT_SCHEMA_KEY, "auto"}
+
+
+def load_state(path: str) -> dict:
+    """Refuse a state file `Store.load()` would silently start fresh on (SAFETY-62)."""
+    try:
+        obj = json.loads(Path(path).read_text(encoding="utf-8"))
+    except ValueError as err:
+        raise Refused(f"{path}: not a readable JSON state file ({err}); "
+                      "Store.load() would start fresh and grade an empty store")
+    bad = shape_problem(
+        obj, lambda k: k in _STORE_KEYS or str(k).startswith(_UNIT_PREFIX),
+        path, allow_empty=True)
+    if bad:
+        raise Refused(bad)
     return obj
 
 
@@ -1061,6 +1088,7 @@ def main(argv=None) -> int:
                      if args.live_entities else None)
         if not Path(args.state).is_file():
             raise Refused(f"{args.state}: not a file")
+        load_state(args.state)
     except (OSError, Refused) as err:
         print(f"REFUSED: {err}", file=sys.stderr)
         return EXIT_COULD_NOT_RUN
@@ -1179,7 +1207,9 @@ def main(argv=None) -> int:
         print("     the install's own entity list. This result does not cover "
               "orphaned entities.")
     print("=" * 78)
-    return EXIT_FINDING if findings else EXIT_OK
+    if findings:
+        return EXIT_FINDING
+    return EXIT_DEGRADED if degraded else EXIT_OK
 
 
 if __name__ == "__main__":
diff --git a/goodwe_controller/tools/replay_ac3.py b/goodwe_controller/tools/replay_ac3.py
index f11de9a..92bae6a 100644
--- a/goodwe_controller/tools/replay_ac3.py
+++ b/goodwe_controller/tools/replay_ac3.py
@@ -176,7 +176,7 @@ def replay(paths, *, guarded: bool, cap_w, max_w, max_hold_s, cycle_s,
             next_cycle = t + timedelta(seconds=cycle_s)
             cycles += 1
             d = decide(PeakTracker.project(ing.averager, t), batt_w=batt,
-                       cap_w=cap_w, reading=tracker.peak(t),
+                       cap_w=cap_w, margin_w=0.0, reading=tracker.peak(t),
                        achievable_w=max_w, max_hold_s=max_hold_s, soc=soc,
                        soc_floor=soc_floor, frozen=False)
             if d.engaged:
diff --git a/goodwe_controller/tools/replay_refusal.py b/goodwe_controller/tools/replay_refusal.py
new file mode 100644
index 0000000..6b53173
--- /dev/null
+++ b/goodwe_controller/tools/replay_refusal.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""SAFETY-52's evidence: the 16-day capture replayed with and without the
+battery-refuses hold.  `python3 tools/replay_refusal.py`
+
+Same disturbance, fitted plant and pack floor as `replay_recorded_loop.py`,
+plus main.py's reseed, 15 s input hold and 0 W rules and the REAL SAFETY-37/57
+gate on a register published every 10 s. `old` is `compute()` with
+`refused=None`, which is release/1.0's law unchanged; `new` carries the refusal,
+runs the probe on main.py's clock and seeds a refusal from a gate trip.
+Modelled watt-hours: read the deltas, not the absolutes (see that tool).
+"""
+import math
+import pathlib
+import sys
+
+ADDON = pathlib.Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ADDON))
+sys.path.insert(0, str(ADDON / "tools"))
+import replay_recorded_loop as R                            # noqa: E402
+from app import freshness, control as NEW                   # noqa: E402
+
+def go(which, rows, fit, publish_s=10.0, stale_input_s=15.0):
+    law = NEW
+    tun = law.Tuning(**R.LIVE)
+    t0, g0, b0, sp0, soc0 = rows[0]
+    pl = R.Plant(*fit[:4], soc0); pl.seed(t0, b0, sp0)
+    st = dict(target=sp0, i_w=sp0, sat=0, loop_w=sp0, ref=0, anchor=None)
+    fr = freshness.Freshness(freshness.BOUNDS["batt"]); reg, reg_t = None, -1e18
+    bad, trips, was = None, 0, False
+    M = dict(und=0.0, imp=0.0, exp=0.0, q={}, run=0.0, mx=0.0, last=None, refh=0.0, probes=0)
+    for i in range(1, len(rows)):
+        t, gr, ba, sp, soc = rows[i]
+        dt = t - rows[i - 1][0]
+        if dt > R.TICK_CAP_S:
+            pl = R.Plant(*fit[:4], soc); pl.seed(t, ba, sp)
+            st.update(target=sp, i_w=sp, sat=0, loop_w=sp, ref=0, anchor=None)
+            fr = freshness.Freshness(freshness.BOUNDS["batt"]); reg_t = -1e18; bad = None
+            continue
+        b = pl.step(t, dt, st["target"]); grid = gr + ba - b
+        if t - reg_t >= publish_s:
+            reg, reg_t = float(round(b)), t
+        fr.submit(reg, st["target"], t); batt = fr.reading()
+        if fr.stale and not was:
+            trips += 1
+            if (which == "new" and not st["ref"] and st["sat"] >= tun.saturation_cycles
+                    and abs(reg) < NEW.REFUSED_BELOW_W and abs(st["target"]) > tun.saturation_w):
+                st["ref"], st["anchor"] = (1 if st["target"] > 0 else -1), t
+        was = fr.stale
+        if batt is None:
+            bad = t if bad is None else bad
+            if t - bad >= stale_input_s:
+                st.update(target=0.0, i_w=0.0, loop_w=None)
+        else:
+            bad = None
+            if st["loop_w"] is None or st["target"] != st["loop_w"]:
+                st["i_w"] = st["target"]
+            if which == "old":
+                d = law.compute(st["target"], grid, batt, tun, st["sat"], st["i_w"],
+                                refused=None)
+            else:
+                probe = False
+                if st["ref"] and st["anchor"] is not None:
+                    h = t - st["anchor"]
+                    if h >= NEW.PROBE_EVERY_S + NEW.PROBE_S: st["anchor"] = t
+                    else: probe = h >= NEW.PROBE_EVERY_S
+                d = law.compute(st["target"], grid, batt, tun, st["sat"], st["i_w"], refused=st["ref"], probe=probe)
+                if d.refused and not st["ref"]: st["anchor"] = t
+                if not d.refused: st["anchor"] = None
+                if probe and d.target_w == NEW.PROBE_W and M["last"] != NEW.PROBE_W: M["probes"] += 1
+                st["ref"] = d.refused
+            st.update(sat=d.sat_count, i_w=d.i_w, loop_w=d.target_w, target=d.target_w)
+        tg = st["target"]
+        if tg - b > 1000: M["und"] += dt / 3600
+        if st["ref"]: M["refh"] += dt / 3600
+        M["imp"] += max(0, grid) * dt / 3.6e6; M["exp"] += max(0, -grid) * dt / 3.6e6
+        k = math.floor(t / 900); a = M["q"].setdefault(k, [0.0, 0.0]); a[0] += grid * dt; a[1] += dt
+        M["run"] = M["run"] + dt if (M["last"] == tg and abs(tg) >= 250) else 0.0
+        M["mx"] = max(M["mx"], M["run"]); M["last"] = tg
+    worst = max(max(0.0, s / d) for s, d in M["q"].values() if d > 600)
+    return trips, M, worst
+
+def main():
+    rows = R.stream()
+    fit = R.fit_plant(rows, stride=7)
+    print(f"fit {[round(x, 2) for x in fit]}, {len(rows)} meter instants")
+    for label, f in (("fitted plant", fit),
+                     ("plant offset 0 W", (fit[0], fit[1], fit[2], 0.0, fit[4]))):
+        for which in ("old", "new"):
+            tr, M, w = go(which, rows, f)
+            print(f"{label:17s} {which}: gate trips {tr:4d} | request >1 kW above "
+                  f"delivery {M['und']:6.1f} h | longest held >=250 W "
+                  f"{M['mx'] / 3600:5.2f} h | import {M['imp']:6.1f} kWh export "
+                  f"{M['exp']:5.1f} kWh | worst 15-min {w:5.0f} W | refused "
+                  f"{M['refh']:5.1f} h, probes {M['probes']}", flush=True)
+
+if __name__ == "__main__":
+    main()
diff --git a/goodwe_controller/tools/safety78_identity.py b/goodwe_controller/tools/safety78_identity.py
new file mode 100644
index 0000000..06af703
--- /dev/null
+++ b/goodwe_controller/tools/safety78_identity.py
@@ -0,0 +1,186 @@
+#!/usr/bin/env python3
+"""SAFETY-78: at one inverter, is a maintenance drain byte-identical to before?
+
+    python3 tools/safety78_identity.py          # prints one digest per scenario
+
+tools/safety79_identity.py's harness (the REAL Controller on a P1 meter, so
+the peak guard runs) with the battery draining for its monthly cycle from the
+first cycle, under a house below, at and above the drain rate, a solar
+surplus and a load over the peak limit. Each row hashes safety79's fields,
+the modes' roles and the trade, the action log's newest line, and every claim
+main.py hands `resolve()`, so a claim or a log line added at N=1 that changes
+no watt still moves the digest. The `_modes` scenarios run battery modes on,
+Cheap hours only, over opt11p3_identity's prices. Uses only the API release/1.0 5a4cdc2 has, so the same file runs on
+both trees; test_safety78.py part 5 holds this tree to the digests printed
+there.
+
+SAFETY-83 adds the owner's settings (limit 3500, drain 2500, margin 50) with a
+house that goes over drain + aim and back, and N=2 runs of both. At N=1 the
+peak floor now outranks the drain where it asks for more, so the N=1 digests
+moved; `--dump FILE` on the base tree and `--diff FILE` here list every
+changed cycle and whether the peak guard wanted more than the drain on it.
+"""
+
+import functools
+import hashlib
+import os
+import pickle
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import opt11p3_identity as p3                              # noqa: E402
+import safety79_identity as s79                            # noqa: E402
+import app.main as m                                       # noqa: E402
+from app import packmode                                  # noqa: E402
+from app.store import unit_key                            # noqa: E402
+
+DUR = 2400.0
+DRAIN = {"maintenance_enabled": True, "maintenance_start_hour": 11}
+
+
+def load(t):
+    """Below the 2000 W drain, at it, above it, a surplus, over the limit."""
+    k = int(t // 480)
+    return (1200.0, 2000.0, 3000.0, -1500.0, 6000.0)[min(k, 4)]
+
+
+def store_cheap(n):
+    s = rig._Store()
+    for u in ("inverter-a", "inverter-b")[:n]:
+        s.data[unit_key(u, packmode.MODE_KEY)] = packmode.CHEAP_HOURS
+    return s
+
+
+def load_owner(t):
+    """Below the 2500 W drain, above it, over drain + aim (5950 W), back."""
+    return (1200.0, 3000.0, 6500.0, 3000.0, -1500.0)[min(int(t // 480), 4)]
+
+
+OWNER = {"peak_cap_w": 3500, "peak_margin_w": 50,
+         "maintenance_discharge_w": 2500}
+
+SCENARIOS = {
+    "n1_drain": dict(n=1),
+    "n1_drain_modes": dict(n=1, modes=True),
+    "n1_drain_owner": dict(n=1, load=load_owner, extra=OWNER),
+    "n2_drain": dict(n=2),
+    "n2_drain_owner": dict(n=2, load=load_owner, extra=OWNER),
+}
+
+
+def run(n, *, modes=False, dur=DUR, load=load, extra=None):
+    extra = dict(s79.P1, **DRAIN, **(extra or {}))
+    if modes:
+        extra.update(p3.ARB, battery_modes_enabled=True)
+    seen, extra_rows = [], []
+    real_resolve = m.resolve
+
+    def spy(claims, **kw):
+        seen.append(tuple((c.source, c.priority, c.kind, c.value, c.lo, c.hi,
+                           c.reason, c.actuator) for c in claims))
+        return real_resolve(claims, **kw)
+
+    def on_cycle(c, t):
+        g, tick, a = c.peak_guard, c.mode_tick, c.arb
+        extra_rows.append((
+            seen[-1] if seen else None,
+            None if g is None else (g.engaged, g.floor_w, g.reason),
+            None if tick is None else (tuple(sorted(tick.roles.items())),
+                                       tick.action, tick.why),
+            None if a is None else (a.action, a.power_w, a.reason),
+            [mm.phase for mm in c.maints],
+            len(c.events), c.events[0] if c.events else None))
+    db = os.path.join(tempfile.mkdtemp(prefix="s78-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    m.resolve = spy
+    try:
+        rows, c = rig.run(n, extra=extra, dur=dur, load=load, soc=s79.soc,
+                          cut=lambda u, t: False,
+                          before=p3._feed if modes else s79._feed,
+                          on_cycle=on_cycle,
+                          store=store_cheap(n) if modes else None)
+    finally:
+        rig.Controller = real
+        m.resolve = real_resolve
+    return [r + (x,) for r, x in zip(rows, extra_rows)], c
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+def digests() -> dict:
+    return {k: digest(run(**v)[0]) for k, v in SCENARIOS.items()}
+
+
+FIELDS = ("t", "target", "commands", "loop reason", "integrator",
+          "saturation", "why", "allocation")
+XFIELDS = ("claims", "guard", "roles", "trade", "phase", "log length",
+           "newest log line")
+
+
+def wanted_more(row) -> bool:
+    """Did the peak guard ask for more than the drain rate on this cycle?"""
+    claims, guard = row[-1][0] or (), row[-1][1]
+    rate = [c[3] for c in claims if c[0] == "maintenance" and c[2] == "set"]
+    return (bool(rate) and guard is not None and bool(guard[0])
+            and guard[1] is not None and guard[1] > max(rate))
+
+
+def diff(base: dict, now: dict) -> dict:
+    """Per scenario: (cycles, changed, changed where the guard wanted more on
+    either tree, changed cycles whose commands differ without that)."""
+    out = {}
+    for k, rows in now.items():
+        old = base.get(k)
+        if old is None:
+            continue
+        ch = [i for i, (a, b) in enumerate(zip(old, rows)) if a != b]
+        ch += list(range(min(len(old), len(rows)), max(len(old), len(rows))))
+        more = [i for i in ch if i < min(len(old), len(rows))
+                and (wanted_more(old[i]) or wanted_more(rows[i]))]
+        cmd = [i for i in ch if i not in more
+               and (i >= min(len(old), len(rows))
+                    or old[i][1:3] != rows[i][1:3])]
+        fields = set()
+        for i in set(ch) - set(more) - set(cmd):
+            fields |= {FIELDS[j] for j in range(8) if old[i][j] != rows[i][j]}
+            fields |= {XFIELDS[j] for j in range(7)
+                       if old[i][8][j] != rows[i][8][j]}
+        out[k] = (len(rows), ch, more, cmd, sorted(fields))
+    return out
+
+
+def all_rows() -> dict:
+    return {k: run(**v)[0] for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    if "--dump" in sys.argv:
+        with open(sys.argv[sys.argv.index("--dump") + 1], "wb") as f:
+            pickle.dump(all_rows(), f)
+        sys.exit(0)
+    if "--diff" in sys.argv:
+        with open(sys.argv[sys.argv.index("--diff") + 1], "rb") as f:
+            base = pickle.load(f)
+        for k, (n, ch, more, cmd, fields) in diff(base, all_rows()).items():
+            rest = sorted(set(ch) - set(more))
+            print(f"{k}: {n} cycles, {len(ch)} changed, {len(more)} with the "
+                  f"guard above the drain, {len(rest)} others "
+                  f"({len(cmd)} with a different target or command"
+                  + (f"; the rest differ only in {', '.join(fields)}"
+                     if fields else "") + ")"
+                  + (f", first changed t={ch[0] * rig.TICK:.0f} s" if ch else ""))
+        sys.exit(0)
+    if "--summary" in sys.argv:
+        for k, v in SCENARIOS.items():
+            rows = run(**v)[0]
+            print(f"{k}: {len(rows)} cycles, phases "
+                  f"{sorted({str(r[-1][-1]) for r in rows})}, targets "
+                  f"{sorted({r[1] for r in rows})[:6]}")
+    for k, v in digests().items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/safety79_identity.py b/goodwe_controller/tools/safety79_identity.py
new file mode 100644
index 0000000..61eed07
--- /dev/null
+++ b/goodwe_controller/tools/safety79_identity.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""SAFETY-79: with `peak_margin_w: 0`, is every command byte-identical to before?
+
+    python3 tools/safety79_identity.py          # prints one digest per scenario
+
+tools/opt11_identity.py's harness (the REAL Controller, read_inputs + cycle, in
+simulated time) with a P1 meter, so the peak guard runs, and a peak limit the
+house goes over. Each row hashes opt11_identity's fields plus the guard's floor,
+limit and sentence, its charge headroom (what arbitrage is sized to) and the
+maintenance shaping's suspension. The two `_maint` scenarios run a maintenance
+charge in a cheap window with a demand forecast that crosses cap - 50 .. cap,
+so `shaping_suspended()` and `maintenance_charge_floor()` are both reached.
+It uses only the API release/1.0 ed739d4 already had, so
+the same file runs on the old tree (which ignores `peak_margin_w`) and the new.
+test_peak_margin.py part 1 holds the new tree to the digests printed on ed739d4.
+"""
+
+import functools
+import hashlib
+import os
+import sys
+import tempfile
+import time
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+from app import packmode, peakguard                       # noqa: E402
+from app.p1 import make_sample, split_signed              # noqa: E402
+from app.store import unit_key                            # noqa: E402
+
+CAP_W = 2500
+
+
+def load(t):
+    """A house under the limit, over it, a solar surplus, far over, over."""
+    if t < 300:
+        return 800.0
+    if t < 900:
+        return 3200.0
+    if t < 1500:
+        return -2600.0
+    if t < 2100:
+        return 6000.0
+    return 4200.0
+
+
+def soc(u, t):
+    return 60.0         # above the peak reserve: the guard may discharge
+
+
+def _feed(c, t):
+    """One P1 telegram per cycle: the meter reads what the house and the
+    batteries' measured power leave."""
+    imp, exp = split_signed(c.hass.grid())
+    c.p1.submit(make_sample("ha_signed", imp, exp, phases=1,
+                            ingest_ts=rig.BASE + timedelta(seconds=t),
+                            ingest_mono=time.monotonic()))
+
+
+def store_off(name):
+    """A store where battery `name` is switched Off (OPT-11)."""
+    s = rig._Store()
+    s.data[unit_key(name, packmode.USE_KEY)] = False
+    return s
+
+
+def forecast(t):
+    """A demand forecast that sweeps 2300-2600 W every 10 minutes: across
+    cap - 50 and the cap, so the margin moves the forecast checks."""
+    return 2300.0 + (t % 600) / 600 * 300
+
+
+def _feed_maint(c, t):
+    """`_feed`, plus the forecast and a cheap price (now under average)."""
+    if not getattr(c.hass, "_s79", False):
+        read = c.hass.number
+        fixed = {"sensor.pnow": 0.05, "sensor.pavg": 0.20}
+
+        async def number(e, invert=False):
+            if e == "sensor.fc":
+                return forecast(c.hass.t)
+            if e in fixed:
+                return fixed[e]
+            return await read(e, invert)
+        c.hass.number, c.hass._s79 = number, True
+    _feed(c, t)
+
+
+def store_charging(n):
+    """A store where the first battery is in its maintenance CHARGE phase."""
+    s = rig._Store()
+    for k in ("phase", "phase_started"):
+        s.data[k if n == 1 else unit_key("inverter-a", k)] = (
+            "charge" if k == "phase" else rig.BASE.isoformat())
+    return s
+
+
+P1 = {"meter_source": "ha_signed", "p1_net_entity": "sensor.net",
+      "meter_phases": 1, "peak_cap_w": CAP_W}
+MODES = {"battery_modes_enabled": True}
+MAINT = {"maintenance_enabled": True, "maintenance_start_hour": 11,
+         "peak_forecast_entity": "sensor.fc", "price_now_entity": "sensor.pnow",
+         "price_avg_entity": "sensor.pavg"}
+
+SCENARIOS = {
+    "n1": dict(n=1),
+    "n2": dict(n=2),
+    # OPT-11: the only battery Off, so only the peak guard makes it give.
+    "n1_off": dict(n=1, modes=True, off="inverter-a"),
+    # OPT-11: B Off, so B covers what A cannot.
+    "n2_off": dict(n=2, modes=True, off="inverter-b"),
+    # A maintenance charge in a cheap window, with a demand forecast.
+    "n1_maint": dict(n=1, maint=True),
+    "n2_maint": dict(n=2, maint=True),
+}
+
+
+def run(n, *, margin=None, modes=False, off=None, maint=False, dur=2700.0):
+    """Rows for one scenario; `margin=None` leaves the key out."""
+    extra = dict(P1, **(MODES if modes else {}), **(MAINT if maint else {}))
+    if margin is not None:
+        extra["peak_margin_w"] = margin
+    guard = []
+
+    def on_cycle(c, t):
+        g = c.peak_guard
+        guard.append((c._maint_shape_suspended, None if g is None else (
+            g.engaged, g.floor_w, g.ceiling_w, g.ceiling_from, g.reason,
+            peakguard.charge_headroom_w(g))))
+    db = os.path.join(tempfile.mkdtemp(prefix="s79-"), "tariff.db")
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    try:
+        rows, c = rig.run(n, extra=extra, dur=dur, load=load, soc=soc,
+                          cut=lambda u, t: False,
+                          before=_feed_maint if maint else _feed,
+                          on_cycle=on_cycle,
+                          store=(store_off(off) if off else
+                                 store_charging(n) if maint else None))
+    finally:
+        rig.Controller = real
+    return [r + (g,) for r, g in zip(rows, guard)], c
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+def digests(margin=None) -> dict:
+    return {k: digest(run(**v, margin=margin)[0]) for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    m = None if len(sys.argv) < 2 else int(sys.argv[1])
+    for k, v in digests(m).items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/safety81_sim.py b/goodwe_controller/tools/safety81_sim.py
new file mode 100644
index 0000000..9d00ad8
--- /dev/null
+++ b/goodwe_controller/tools/safety81_sim.py
@@ -0,0 +1,229 @@
+#!/usr/bin/env python3
+"""SAFETY-81: when does "Load too high for battery" fire?
+
+    python3 tools/safety81_sim.py            # alarms and a control digest per run
+
+The REAL Controller (read_inputs + cycle) at a 1 s cycle, on a plant shaped
+like the SAFETY-79 test rig: one battery switched Off (so only the peak guard
+makes it give, max 2000 W), a 3500 W cap, and a P1 meter that publishes
+0.3 s before each cycle. The battery reaches a new command 0.5 s after it is
+written. One meter sample in ten arrives late (the add-on still holds the one
+before), so the held meter reading can predate the battery's last change:
+the double count behind the rig's false alarms. The cycle on a quarter
+boundary, before the new quarter's first sample, files no peak claim, which
+is the rig's 1 s grid spike at each quarter change. Each run returns the
+alarm times and a digest of every command, so the same runs show both what
+changed and what did not.
+"""
+
+import asyncio
+import hashlib
+import logging
+import os
+import random
+import sys
+import tempfile
+import time
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import app.main as m                                       # noqa: E402
+from app import packmode                                   # noqa: E402
+from app.main import Controller                            # noqa: E402
+from app.p1 import make_sample, split_signed               # noqa: E402
+from app.store import unit_key                             # noqa: E402
+
+TICK = 1.0
+SAMPLE_LEAD_S = 0.3     # the meter publishes this long before each cycle
+RESPONSE_S = 0.5        # a new command reaches the battery this much later
+LATE_P = 0.1            # share of meter samples that arrive late
+ALARM = "goodwe_peak_saturated"
+
+
+def constant(w):
+    return lambda t: w
+
+
+def noisy(mean, amp, seed=81):
+    """`mean` +/- `amp`, a new uniform value every second."""
+    rnd = random.Random(seed)
+    table = {}
+
+    def f(t):
+        k = int(t)
+        if k not in table:
+            table[k] = mean + rnd.uniform(-amp, amp)
+        return table[k]
+    return f
+
+
+def sine(mean, amp, period=120.0, noise=50.0):
+    import math
+    n = noisy(0.0, noise, seed=79)
+    return lambda t: mean + amp * math.sin(2 * math.pi * t / period) + n(t)
+
+
+def step(before, after, at):
+    return lambda t: before if t < at else after
+
+
+def ramp(before, after, at, secs):
+    return lambda t: before + (after - before) * min(max(t - at, 0.0) / secs, 1.0)
+
+
+class _Plant:
+    """One battery that reaches its command RESPONSE_S after the write."""
+
+    def __init__(self, load, rating, soc, batt_gap=()):
+        self.load, self.rating, self.soc = load, rating, soc
+        self.batt_gap = batt_gap      # (from, to): the battery reading is lost
+        self.t = 0.0
+        self.hist = [(-1e9, 0.0)]     # (time the command takes effect, W)
+        self.notes = []
+        self.meter = 0.0              # the last meter reading delivered
+
+    def batt(self, at):
+        w = 0.0
+        for when, v in self.hist:
+            if when <= at:
+                w = v
+        return max(-self.rating, min(self.rating, float(round(w))))
+
+    def grid(self, at):
+        return self.load(at) - self.batt(at)
+
+    async def limits(self, e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def call(self, domain, service, data):
+        if service == "create":
+            self.notes.append((self.t, data.get("notification_id")))
+        return True
+
+    async def number(self, e, invert=False):
+        if e in ("sensor.grid", "sensor.net"):
+            return self.meter
+        if e.startswith("sensor.soc"):
+            return self.soc
+        if e.startswith("sensor.batt"):
+            if self.batt_gap and self.batt_gap[0] <= self.t < self.batt_gap[1]:
+                return None
+            return self.batt(self.t)
+        return None
+
+    async def set_number(self, e, v):
+        self.hist.append((self.t + RESPONSE_S, float(v)))
+        return True
+
+
+def run(load, *, margin=50, dur=2700.0, rating=2000.0, cap=3500.0,
+        late_at=(), soc=60.0, batt_gap=()):
+    """Alarm times (s from the start of the first quarter), a digest of every
+    cycle's target and written command, the Controller, the rows, and the
+    times of the ERROR log line. A sample is also late at each `t % 900` in
+    `late_at`."""
+    opts = rig._options(1, {
+        "meter_source": "ha_signed", "p1_net_entity": "sensor.net",
+        "meter_phases": 1, "peak_cap_w": cap, "peak_margin_w": margin,
+        "battery_modes_enabled": True, "max_w": rating})
+    store = rig._Store()
+    store.data[unit_key("inverter-a", packmode.USE_KEY)] = False
+    store.data[packmode.USE_KEY] = False
+    db = os.path.join(tempfile.mkdtemp(prefix="s81-"), "tariff.db")
+
+    async def go():
+        plant = _Plant(load, rating, soc, batt_gap)
+        c = Controller(opts, plant, store, rig._Pub(), stop=asyncio.Event(),
+                       peak_db_path=db)
+        for i in c.inverters:
+            i.dev_min, i.dev_max = -5000.0, 5000.0
+        c.auto = True
+        real_dt, clock = m.datetime, [0.0]
+
+        class _DT(real_dt):
+            @classmethod
+            def now(cls, tz=None):
+                return rig.BASE + timedelta(seconds=clock[0])
+        m.datetime = _DT
+        rows, late = [], random.Random(8100)
+        errors = []
+
+        class _Err(logging.Handler):
+            def emit(self, r):
+                if "battery alone cannot keep" in r.getMessage():
+                    errors.append(plant.t)
+        h = _Err()
+        logging.getLogger("goodwe").addHandler(h)
+        try:
+            t = 0.0
+            while t < dur:
+                plant.t = clock[0] = t
+                ts = t - SAMPLE_LEAD_S
+                if late.random() >= LATE_P and t % 900 not in late_at:
+                    plant.meter = plant.grid(ts)
+                    imp, exp = split_signed(plant.meter)
+                    c.p1.submit(make_sample(
+                        "ha_signed", imp, exp, phases=1,
+                        ingest_ts=rig.BASE + timedelta(seconds=ts),
+                        ingest_mono=time.monotonic()))
+                await c.read_inputs(now_mono=t)
+                await c.cycle()
+                rows.append((t, c.target, round(plant.hist[-1][1], 6)))
+                t += TICK
+        finally:
+            m.datetime = real_dt
+            logging.getLogger("goodwe").removeHandler(h)
+        return plant, c, rows, errors
+    plant, c, rows, errors = asyncio.run(go())
+    alarms = [t for t, nid in plant.notes if nid == ALARM]
+    return (alarms, hashlib.sha256(repr(rows).encode()).hexdigest(), c, rows,
+            errors)
+
+
+# Three quarters each (2700 s); a new quarter starts at 900 s and 1800 s.
+SCENARIOS = {
+    # F1: constant and sine loads the battery carries, across quarter edges.
+    "const4500": dict(load=constant(4500.0)),
+    "const4500_m0": dict(load=constant(4500.0), margin=0),
+    "sine4500": dict(load=sine(4500.0, 400.0)),
+    # F1 at the start of a quarter: the sample after the battery's return
+    # is late, so the held reading is the 1 s spike (the battery at 0 W).
+    "edge4600": dict(load=constant(4600.0), late_at=(2.0,)),
+    "edge4600_m0": dict(load=constant(4600.0), margin=0, late_at=(2.0,)),
+    # 6000 W in a quarter's last 20 s: over cap + battery, but the quarter
+    # still lands between the aim and the cap.
+    "burst_end": dict(load=lambda t: 6000.0 if t % 900 >= 880 else 4500.0),
+    # F2: a noisy load the battery carries, at margin 50 and 0.
+    "noise5000_m50": dict(load=noisy(5000.0, 150.0)),
+    "noise5000_m0": dict(load=noisy(5000.0, 150.0), margin=0),
+    # Real: from 1200 s the house needs 1000 W more than cap + battery.
+    "step6500": dict(load=step(4500.0, 6500.0, 1200.0)),
+    # Real, small: from 1200 s, 60 W (+/- 20 W noise) more than cap + battery.
+    "miss5560": dict(load=lambda t: step(4500.0, 5560.0, 1200.0)(t)
+                     + noisy(0.0, 20.0)(t)),
+    # Real, slow: 4500 -> 6500 W over 200 s from 1200 s, through the band
+    # between the aim (cap - 50) and the real cap.
+    "ramp6500": dict(load=ramp(4500.0, 6500.0, 1200.0, 200.0)),
+    # The pack under its peak reserve (20 %), and a load far over cap +
+    # battery: that is "Battery stopped limiting the peak", not this alarm.
+    "step7500_reserve": dict(load=step(4500.0, 7500.0, 1200.0), soc=15.0),
+    # Review: a load swinging 4500 +/- 1200 W every 30 s (a hob or heater
+    # cycling). It tops cap + battery for about 5 s a swing, and the quarter
+    # still lands under the aim.
+    "sine4500_fast": dict(load=sine(4500.0, 1200.0, period=30.0, noise=200.0)),
+    # Review: two real overloads in one quarter, 1000-1100 s and 1500-1700 s.
+    "twice7000": dict(load=lambda t: 7000.0 if (1000 <= t < 1100
+                                                or 1500 <= t < 1700)
+                      else 4500.0),
+    # Review: step6500, and the battery reading is lost 1203-1215 s.
+    "step6500_gap": dict(load=step(4500.0, 6500.0, 1200.0),
+                         batt_gap=(1203.0, 1215.0)),
+}
+
+
+if __name__ == "__main__":
+    for k, v in SCENARIOS.items():
+        a, d, _, _, _ = run(**v)
+        print(f"{k:16s} alarms at {a} digest {d}")
diff --git a/goodwe_controller/tools/safety84_identity.py b/goodwe_controller/tools/safety84_identity.py
new file mode 100644
index 0000000..87730c0
--- /dev/null
+++ b/goodwe_controller/tools/safety84_identity.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""SAFETY-84: at one inverter, is a maintenance charge byte-identical to before?
+
+    python3 tools/safety84_identity.py          # prints one digest per scenario
+
+safety78_identity's harness (the REAL Controller on a P1 meter, every claim
+hashed) with the battery in its maintenance CHARGE phase from the first cycle,
+on the owner's settings (limit 3500, margin 50, charge 2000 W). The house steps
+below the charge rate, at it, under the aim, over it and into a solar surplus,
+in a cheap window, outside one, and under a month peak banked at 4000 W. Uses
+only the API release/1.0 9d5b7d1 has, so the same file runs on both trees;
+test_safety84.py holds this tree to the digests printed there (N=1) and to the
+new N=2 ones.
+"""
+
+import functools
+import hashlib
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import safety79_identity as s79                            # noqa: E402
+import app.main as m                                       # noqa: E402
+from app import tariff                                     # noqa: E402
+
+DUR = 2400.0
+OPT = {"peak_cap_w": 3500, "peak_margin_w": 50, "maintenance_enabled": True,
+       "maintenance_start_hour": 11, "maintenance_charge_w": 2000,
+       "price_now_entity": "sensor.pnow", "price_avg_entity": "sensor.pavg"}
+
+
+def load(t):
+    """Below the 2000 W charge, at it, under the aim, over it, a surplus."""
+    return (800.0, 2000.0, 3000.0, 5000.0, -1500.0)[min(int(t // 480), 4)]
+
+
+def feed(cheap):
+    """s79's P1 feed plus a price now under (cheap) or over the average."""
+    now = 0.05 if cheap else 0.30
+
+    def before(c, t):
+        if not getattr(c.hass, "_s84", False):
+            read = c.hass.number
+
+            async def number(e, invert=False):
+                if e == "sensor.pnow":
+                    return now
+                if e == "sensor.pavg":
+                    return 0.20
+                return await read(e, invert)
+            c.hass.number, c.hass._s84 = number, True
+        s79._feed(c, t)
+    return before
+
+
+SCENARIOS = {
+    "n1_charge": dict(n=1),
+    "n1_charge_dear": dict(n=1, cheap=False),
+    "n1_charge_banked": dict(n=1, month_peak=4000.0),
+    "n2_charge": dict(n=2),
+    "n2_charge_dear": dict(n=2, cheap=False),
+    "n2_charge_banked": dict(n=2, month_peak=4000.0),
+}
+
+
+def run(n, *, cheap=True, month_peak=None, dur=DUR, load=load, soc=None,
+        before=None, cut=None, extra=None, store=None):
+    """Rows (opt11_identity's fields plus every claim, the guard and the
+    phases) and the controller. `month_peak` banks that peak this month."""
+    seen, extra_rows = [], []
+    real_resolve = m.resolve
+
+    def spy(claims, **kw):
+        seen.append(tuple((c.source, c.priority, c.kind, c.value, c.lo, c.hi,
+                           c.reason, c.actuator) for c in claims))
+        return real_resolve(claims, **kw)
+
+    def on_cycle(c, t):
+        g = c.peak_guard
+        extra_rows.append((
+            seen[-1] if seen else None,
+            None if g is None else (g.engaged, g.floor_w, g.reason),
+            c._maint_shape_suspended, [mm.phase for mm in c.maints],
+            len(c.events), c.events[0] if c.events else None))
+    db = os.path.join(tempfile.mkdtemp(prefix="s84-"), "tariff.db")
+    if month_peak is not None:
+        tariff.PeakStore(db)._db.execute(
+            "INSERT INTO monthly_peak VALUES (?, ?, ?, NULL)",
+            (tariff.month_key(rig.BASE), month_peak,
+             "2026-09-02T10:00:00+00:00")).connection.commit()
+    real = rig.Controller
+    rig.Controller = functools.partial(real, peak_db_path=db)
+    m.resolve = spy
+    try:
+        rows, c = rig.run(n, extra=dict(s79.P1, **OPT, **(extra or {})),
+                          dur=dur, load=load, soc=soc or s79.soc,
+                          cut=cut or (lambda u, t: False),
+                          before=before or feed(cheap), on_cycle=on_cycle,
+                          store=store or s79.store_charging(n))
+    finally:
+        rig.Controller = real
+        m.resolve = real_resolve
+    return [r + (x,) for r, x in zip(rows, extra_rows)], c
+
+
+def digest(rows) -> str:
+    return hashlib.sha256(repr(rows).encode()).hexdigest()
+
+
+def digests() -> dict:
+    return {k: digest(run(**v)[0]) for k, v in SCENARIOS.items()}
+
+
+if __name__ == "__main__":
+    for k, v in digests().items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/safety87_identity.py b/goodwe_controller/tools/safety87_identity.py
new file mode 100644
index 0000000..209c2a6
--- /dev/null
+++ b/goodwe_controller/tools/safety87_identity.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""SAFETY-87: at one inverter, is the peak guard byte-identical to before?
+
+    python3 tools/safety87_identity.py          # prints one digest per scenario
+
+safety84_identity's harness (the REAL Controller on a P1 meter, every claim
+and the guard's decision hashed) with the battery under, crossing and above
+the peak reserve, the house over the aim, in a maintenance charge and HOLD,
+and under a month peak banked at 4000 W. Uses only the API release/1.0
+b8ddfd7 has, so the same file runs on both trees; test_safety87.py holds this
+tree to the digests printed there.
+"""
+
+import os
+import sys
+from datetime import timedelta
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import opt11_identity as rig                               # noqa: E402
+import safety84_identity as s84                            # noqa: E402
+
+DUR = 1800.0
+
+
+def crossing(u, t):
+    """30 % falling 1 % a minute to 12 %: crosses the 20 % reserve."""
+    return max(12.0, 30.0 - t / 60.0)
+
+
+def store(phase=None):
+    """In `phase` from the first cycle, or idle with a cycle done yesterday."""
+    s = rig._Store()
+    if phase is None:
+        s.data["last_completed"] = (rig.BASE - timedelta(days=1)).isoformat()
+    else:
+        s.data["phase"], s.data["phase_started"] = phase, rig.BASE.isoformat()
+    return s
+
+
+SCENARIOS = {
+    "n1_under": dict(soc=lambda u, t: 15.0, load=lambda t: 5500.0),
+    "n1_crossing": dict(soc=crossing, load=lambda t: 5000.0),
+    "n1_above": dict(soc=lambda u, t: 60.0, load=lambda t: 5500.0),
+    "n1_under_banked": dict(soc=lambda u, t: 15.0, load=lambda t: 6000.0,
+                            month_peak=4000.0),
+    "n1_charge_low": dict(soc=lambda u, t: 11.0, load=lambda t: 5000.0,
+                          store="charge"),
+    "n1_hold": dict(soc=lambda u, t: 99.0, load=lambda t: 5500.0,
+                    store="hold", cheap=False,
+                    extra={"maintenance_hold_min": 600}),
+}
+
+
+def digests() -> dict:
+    out = {}
+    for k, v in SCENARIOS.items():
+        v = dict(v)
+        st = store(v.pop("store", None))
+        out[k] = s84.digest(s84.run(1, dur=DUR, store=st, **v)[0])
+    return out
+
+
+if __name__ == "__main__":
+    for k, v in digests().items():
+        print(f"{k} {v}")
diff --git a/goodwe_controller/tools/style_rules.py b/goodwe_controller/tools/style_rules.py
new file mode 100644
index 0000000..2fb29dd
--- /dev/null
+++ b/goodwe_controller/tools/style_rules.py
@@ -0,0 +1,58 @@
+"""STYLE.md sections 1 and 4 as code: the banned words and the counts.
+
+Shared by test_messages.py (UX-08) and test_ui_text.py (UX-13 P5), so the two
+checks cannot drift apart. Moved here unchanged from test_messages.py.
+"""
+
+import re
+
+BANNED = re.compile(
+    r"\b(?:(?:SAFETY|TARIFF|TEL|CFG|FCST|OPT|UX|HW|FW|WITNESS|PKG|ARCH)-\d+|"
+    r"integrator|anti-?windup|windup|clamp(?:ed|s)?|i_clamped|saturat\w*|"
+    r"BUG SIGNAL|latch(?:ed)?|arbiter|allocator|registers?|0x[0-9A-Fa-f]+|"
+    r"layer [123]|heartbeat|watchdog|telegrams?|ACKs?|CRC|OTA|Modbus|planner|"
+    r"capaciteitstarief|journalctl|ssh|grep|"
+    r"\d+\.\d+\.\d+\.\d+|[\w-]+\.(?:py|md|yaml|json|db))\b|§\s?\d", re.I)
+ENTITY = re.compile(r"\b(?:sensor|number|binary_sensor|input_\w+|switch|select)"
+                    r"\.[a-z0-9_*]+")
+SNAKE = re.compile(r"\b[a-z0-9]+(?:_[a-z0-9]+)+\b")
+SHOUT = re.compile(r"\b[A-Z]{2,}[A-Z0-9]*(?:[\s-]+[A-Z]{2,}[A-Z0-9]*)+\b")
+PLACEHOLDER = re.compile(r"\{[^{}]*\}|%[-+ #0-9.]*[sdrfgx%]")
+
+
+def words(text):
+    return [w for w in re.findall(r"\S+", PLACEHOLDER.sub("X", text))
+            if re.search(r"[A-Za-z0-9]", w)]
+
+
+def sentences(text):
+    """Sentence count: a stop followed by a space and a capital, or the end."""
+    t = PLACEHOLDER.sub("X", text.strip())
+    t = re.sub(r"\b(e\.g|i\.e|etc)\.", "eg", t)
+    return len([s for s in re.split(r"[.!?](?:\s+|$)", t) if s.strip()])
+
+
+def title_problems(title):
+    out = []
+    if len(words(title)) > 5:
+        out.append(f"title over 5 words ({len(words(title))})")
+    if title.lower().startswith("goodwe"):
+        out.append("title carries a GoodWe prefix")
+    if title.rstrip().endswith("."):
+        out.append("title ends in a full stop")
+    return out + text_problems(title, keys=False, entities=False)
+
+
+def text_problems(text, *, keys, entities):
+    t = PLACEHOLDER.sub("X", text)
+    out = []
+    hit = sorted({m.group(0) for m in BANNED.finditer(t)})
+    if hit:
+        out.append("banned: " + ", ".join(hit[:4]))
+    if not entities and ENTITY.search(t):
+        out.append("entity id: " + ENTITY.search(t).group(0))
+    if not keys and SNAKE.search(ENTITY.sub("", t)):
+        out.append("option key: " + SNAKE.search(ENTITY.sub("", t)).group(0))
+    if SHOUT.search(t):
+        out.append("capitals: " + SHOUT.search(t).group(0))
+    return out
diff --git a/goodwe_controller/tools/supervisor_shape_probe.py b/goodwe_controller/tools/supervisor_shape_probe.py
index 90e8e01..702dc73 100644
--- a/goodwe_controller/tools/supervisor_shape_probe.py
+++ b/goodwe_controller/tools/supervisor_shape_probe.py
@@ -683,6 +683,72 @@ except vol.Invalid as e:
          str(e))
 
 
+print("\n== H. TEL-14: the SHAPE of a per-entity PV sign option ==")
+# Four candidate shapes, each against a 0.12.0 blob (`pv_entities` set, no new
+# key). Transcript and decision: DECISIONS/TEL-14-pv-sign.md.
+PV12 = {"pv_entity": "", "pv_entities": ["sensor.pv_inverter", "sensor.pv_meter"]}
+_pv12 = MERGER.merge(copy.deepcopy(defaults), copy.deepcopy(PV12))
+_nk = "pv_invert_entities"
+
+
+def _ui_of(sch, name):
+    return [e for e in UiOptions(None)(sch) if e.get("name") == name]
+
+
+# (a) a `-` prefix on a list item, under the shipped `- str`.
+ok_a, out_a = validate(dict(_pv12, pv_entities=["sensor.pv_inverter",
+                                                  "-sensor.pv_meter"]))
+show("(a) PREFIX: `-sensor.pv_meter` validates under the shipped `- str` - "
+     "Supervisor does not look inside the string, so the sign would live in a "
+     "syntax that only the description text explains",
+     ok_a and out_a.get("pv_entities") == ["sensor.pv_inverter",
+                                           "-sensor.pv_meter"],
+     "" if ok_a else out_a)
+
+# (b) a parallel list - THE SHIPPED SHAPE.
+ok_b, out_b = validate(_pv12)
+show("(b) ⭐ PARALLEL LIST, SHIPPED: the 0.12.0 blob (no `pv_invert_entities` "
+     "key) validates unchanged and the new key defaults to []",
+     ok_b and out_b.get(_nk) == []
+     and out_b.get("pv_entities") == PV12["pv_entities"],
+     "" if ok_b else out_b)
+ok_b2, out_b2 = validate(dict(_pv12, **{_nk: ["sensor.pv_meter"]}))
+show("...and one entity marked inverted validates",
+     ok_b2 and out_b2.get(_nk) == ["sensor.pv_meter"], "" if ok_b2 else out_b2)
+ok_b3, out_b3 = validate({k: v for k, v in defaults.items() if k != _nk})
+show("⭐ ...and the shipped `options:` block with ONLY `pv_invert_entities` "
+     "removed is REFUSED BY NAME - its `[]` default is load-bearing, as "
+     "`pv_entities: []` is",
+     (not ok_b3) and f"Missing option '{_nk}' in root" in str(out_b3), out_b3)
+_ui_b = _ui_of(schema, _nk)
+show("...and the Configuration tab renders it as a REPEATABLE string field "
+     "with its own top-level (translated) label",
+     len(_ui_b) == 1 and _ui_b[0].get("multiple") is True
+     and _ui_b[0].get("type") == "string", json.dumps(_ui_b))
+
+# (c) a list of dicts - on `pv_entities` itself, and as a new key.
+_s_dicts = dict(schema, pv_entities=[{"entity": "str", "invert": "bool?"}])
+ok_c, out_c = validate_with(_s_dicts, _pv12)
+show("(c) LIST OF DICTS ON `pv_entities`: the STRINGS a 0.12.0 install stored "
+     "are REFUSED - that shape would stop the add-on starting on upgrade",
+     (not ok_c) and "pv_entities" in str(out_c), out_c)
+_s_src = dict(schema, pv_sources=[{"entity": "str", "invert": "bool?"}])
+ok_c2, out_c2 = validate_with(_s_src, dict(_pv12, pv_sources=[]))
+_ui_c = _ui_of(_s_src, "pv_sources")
+show("(c2) ...as a THIRD key it validates, but renders as a type-schema "
+     "repeatable section whose per-entry keys reach the screen RAW "
+     "(`entity`, `invert`) on this frontend - see section F",
+     ok_c2 and len(_ui_c) == 1 and _ui_c[0].get("type") == "schema"
+     and _ui_c[0].get("multiple") is True,
+     json.dumps(_ui_c)[:200] if ok_c2 else out_c2)
+
+# (d) one global bool.
+_s_bool = dict(schema, pv_invert="bool")
+ok_d, out_d = validate_with(_s_bool, dict(_pv12, pv_invert=False))
+show("(d) GLOBAL `pv_invert: bool` validates too - it loses on SEMANTICS (one "
+     "sign for a mixed roster), not on the schema", ok_d, "" if ok_d else out_d)
+
+
 # ⚠️ THE EXIT CODE IS PART OF THE INSTRUMENT. Without it the probe prints FAIL
 # and still succeeds, and a transcript is only evidence if a wrong answer is
 # distinguishable from a right one by something other than reading it.
diff --git a/goodwe_controller/tools/ux13_browser_check.py b/goodwe_controller/tools/ux13_browser_check.py
new file mode 100644
index 0000000..ad5df4a
--- /dev/null
+++ b/goodwe_controller/tools/ux13_browser_check.py
@@ -0,0 +1,233 @@
+"""UX-13 P3: the headless-browser check of the Batteries screen and Settings,
+Simple. Run by `CHECK=1 tools/ux13_screenshots.sh`, like the screenshots.
+
+For every battery-mode fixture (tools/ux13_demo.py) it opens both screens at
+phone and desktop width, light and dark, in English and Dutch, and fails on a
+page error, a console error or a sideways scroll. Then it clicks the switch
+and the mode list on both screens and checks what was posted and what the
+cards show after.
+
+    python3 ux13_browser_check.py        # DEMO_<STATE> = the fixture's URL
+"""
+
+import json
+import os
+import sys
+
+from playwright.sync_api import sync_playwright
+
+STATES = ("running", "modes", "off", "off_peak", "refusal", "maint")
+SIZES = {"phone": {"width": 390, "height": 844},
+         "desktop": {"width": 1000, "height": 900}}
+FAILS = []
+
+
+def url(state):
+    return os.environ[f"DEMO_{state.upper()}"]
+
+
+def check(name, cond):
+    print(f"  {'ok  ' if cond else 'FAIL'} {name}")
+    if not cond:
+        FAILS.append(name)
+
+
+def open_page(browser, state, route, *, size, scheme, lang):
+    ctx = browser.new_context(locale=lang, viewport=SIZES[size],
+                              color_scheme=scheme, reduced_motion="reduce")
+    page = ctx.new_page()
+    errors = []
+    page.on("pageerror", lambda e: errors.append(f"pageerror {e}"))
+    page.on("console", lambda m: errors.append(f"console {m.text}")
+            if m.type == "error" else None)
+    page.goto(url(state) + route)
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1200)
+    return ctx, page, errors
+
+
+def sweep(browser):
+    n = 0
+    for state in STATES:
+        for route in ("#batteries", "#settings"):
+            for size in SIZES:
+                for scheme in ("light", "dark"):
+                    for lang in ("en-GB", "nl-BE"):
+                        ctx, page, errors = open_page(
+                            browser, state, route, size=size, scheme=scheme,
+                            lang=lang)
+                        wide = page.evaluate(
+                            "document.documentElement.scrollWidth > "
+                            "document.documentElement.clientWidth")
+                        if route == "#batteries":
+                            cards = page.locator("#bcards .bcard").count()
+                            texts = page.locator("#bcards dd").all_inner_texts()
+                            ok = cards == 2 and all(t.strip() for t in texts)
+                        else:
+                            ok = (page.locator("#simple .card").count() >= 3
+                                  and page.locator("#groups").is_hidden())
+                        where = f"{state} {route} {size} {scheme} {lang}"
+                        if errors or wide or not ok:
+                            FAILS.append(f"{where}: errors={errors} "
+                                         f"wide={wide} drawn={ok}")
+                            print(f"  FAIL {where}: {errors} wide={wide} "
+                                  f"drawn={ok}")
+                        n += 1
+                        ctx.close()
+    check(f"{n} views: 0 page errors, 0 console errors, no sideways scroll, "
+          f"every card drawn", not [f for f in FAILS if " #" in f])
+
+
+def posts(page):
+    sent = []
+    page.on("request", lambda r: sent.append(json.loads(r.post_data))
+            if r.url.endswith("/action") and r.method == "POST" else None)
+    return sent
+
+
+def actions(browser):
+    # The Batteries screen: switch B off, then set A to Leftover solar.
+    ctx, page, errors = open_page(browser, "modes", "#batteries",
+                                  size="desktop", scheme="light", lang="en-GB")
+    sent = posts(page)
+    page.locator("#bsw-c1").click()
+    page.wait_for_timeout(1500)
+    card_b = page.locator("#bcards .bcard").nth(1)
+    check("Batteries: B's switch posts pack_use false, and B's card turns Off "
+          "with its mode list greyed out",
+          sent[-1:] == [{"action": "pack_use", "unit": "Battery B",
+                         "value": False}]
+          and "off" in (card_b.get_attribute("class") or "")
+          and page.locator("#bsel-c1").is_disabled()
+          and "You switched it off." in card_b.inner_text())
+    page.locator("#bsel-c0").focus()
+    page.locator("#bsel-c0").select_option("leftover_solar")
+    page.wait_for_timeout(1500)
+    check("...A's list posts pack_mode leftover_solar and the card keeps it",
+          sent[-1:] == [{"action": "pack_mode", "unit": "Battery A",
+                         "value": "leftover_solar"}]
+          and page.locator("#bsel-c0").input_value() == "leftover_solar"
+          and "Leftover solar" in page.locator("#bcards .bcard").nth(0)
+          .inner_text())
+    check("...the cheap-hours choice and the selling switch are greyed out",
+          page.locator("#bsel-c0 option[disabled]").count() == 1
+          and page.locator("#bcards .bcard .f .switch[disabled]").count() == 2)
+    check("...and the focus stays on the control that was used",
+          page.evaluate("document.activeElement.id") == "bsel-c0")
+    check("...with 0 page errors", not errors)
+    ctx.close()
+    # Settings, Simple: the same switch, and the Installer view is one tap.
+    ctx, page, errors = open_page(browser, "modes", "#settings",
+                                  size="phone", scheme="dark", lang="nl-BE")
+    sent = posts(page)
+    page.locator("#bsw-s1").click()
+    page.wait_for_timeout(1500)
+    check("Simple (NL, phone, dark): B's switch posts pack_use true and reads "
+          "Aan", sent[-1:] == [{"action": "pack_use", "unit": "Battery B",
+                                "value": True}]
+          and page.locator("#bsw-s1").get_attribute("aria-checked") == "true")
+    page.locator("#set-view [data-v=installer]").click()
+    page.wait_for_timeout(500)
+    check("...Installer shows the groups and hides Simple",
+          page.locator("#groups").is_visible()
+          and page.locator("#simple").is_hidden())
+    check("...with 0 page errors", not errors)
+    ctx.close()
+
+
+def switching(browser):
+    # Review: an unsaved change survives the view switch both ways, the
+    # Installer's locked values still need "Change", and only the person's
+    # own pick of a view is remembered.
+    ctx, page, errors = open_page(browser, "modes", "#settings",
+                                  size="desktop", scheme="light", lang="en-GB")
+    chips = [c.locator(".chip").first.inner_text()
+             for c in page.locator("#simple > .card").all()]
+    check(f"Simple's badges: the peak limit and shadow mode need a restart, "
+          f"the batteries apply at once ({chips})",
+          chips == ["Applies after a restart", "Applies right away",
+                    "Applies after a restart"])
+    num = page.locator("#simple .card input.num").first
+    num.fill("4.2")
+    num.dispatch_event("change")
+    page.wait_for_timeout(600)
+    n1 = page.locator("#sb-text").inner_text()
+    page.locator("#set-view [data-v=installer]").click()
+    page.wait_for_timeout(600)
+    val = page.locator("#groups [data-key=peak_cap_w] input.num").input_value()
+    n2 = page.locator("#sb-text").inner_text()
+    locked = (page.locator("#groups [data-key=peak_soc_floor] input").count(),
+              page.locator("#groups [data-key=peak_soc_floor] button.link")
+              .count())
+    page.locator("#set-view [data-v=simple]").click()
+    page.wait_for_timeout(600)
+    back = page.locator("#simple .card input.num").first.input_value()
+    n3 = page.locator("#sb-text").inner_text()
+    check("an unsaved peak limit survives Simple -> Installer -> Simple, and "
+          "the save bar counts it once", n1.startswith("1 ") and n2 == n1
+          and n3 == n1 and val == "4.2" and back == "4.2"
+          and page.locator("#savebar").is_visible())
+    check("...the Installer's locked value has no input until 'Change'",
+          locked == (0, 1))
+    ctx.close()
+    ctx, page, errors = open_page(browser, "running", "#batteries",
+                                  size="desktop", scheme="light", lang="en-GB")
+    page.locator("#batt-off a").click()
+    page.wait_for_timeout(800)
+    page.reload()
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1200)
+    check("a jump to Installer from a link is not remembered: Settings "
+          "opens on Simple again", page.locator("#simple").is_visible()
+          and page.locator("#groups").is_hidden() and not errors)
+    ctx.close()
+
+
+def modes_off(browser):
+    ctx, page, errors = open_page(browser, "running", "#batteries",
+                                  size="phone", scheme="light", lang="en-GB")
+    page.locator("#batt-off a").click()
+    page.wait_for_timeout(1500)
+    check("modes off: the card's button opens Settings on the Installer view",
+          page.url.endswith("#settings") and page.locator("#groups")
+          .is_visible() and not errors)
+    ctx.close()
+
+
+def month_peak(browser):
+    # The fixture has no month peak yet, so give /status one on the way in.
+    ctx = browser.new_context(locale="en-GB", viewport=SIZES["desktop"])
+    page = ctx.new_page()
+
+    def with_peak(route):
+        r = route.fetch()
+        body = r.json()
+        body["month_peak"]["peak_w"] = 2860.0
+        route.fulfill(response=r, json=body)
+    page.route("**/status*", with_peak)
+    page.goto(url("modes") + "#settings")
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1500)
+    check("Simple: the peak card shows this month's peak from /status",
+          "This month's peak so far: 2.9 kW." in page.locator("#simple")
+          .inner_text())
+    ctx.close()
+
+
+def main():
+    with sync_playwright() as p:
+        b = p.chromium.launch()
+        sweep(b)
+        actions(b)
+        month_peak(b)
+        switching(b)
+        modes_off(b)
+        b.close()
+    if FAILS:
+        print(f"{len(FAILS)} FAILED")
+        sys.exit(1)
+    print("all passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/goodwe_controller/tools/ux13_demo.py b/goodwe_controller/tools/ux13_demo.py
new file mode 100644
index 0000000..90b2177
--- /dev/null
+++ b/goodwe_controller/tools/ux13_demo.py
@@ -0,0 +1,336 @@
+"""UX-13: serve the real page and routes over a fixture controller, for a
+headless browser check.  `python3 tools/ux13_demo.py STATE PORT [HOST]`
+
+STATE is running, shadow, alarm, new (P4) or setup (UX-15's setup-only
+mode, P5). P3 adds the battery-mode states in `P3`: modes (on, B on Leftover
+solar), off (B switched off), off_peak (B off but giving for the peak limit),
+refusal (A refuses to give power) and maint (A in its monthly cycle). The controller is the shipped `Controller`
+with its readings set by hand (two batteries, solar, today's prices in the
+mockup's shape, trading on). Nothing here talks to Home Assistant or to an
+inverter: `/action` changes only this fixture. Used for the P1 render check
+(no JS errors, tooltips, phone width, dark mode) described in the PR.
+
+P2: the fixture Supervisor serves config.yaml's defaults with this site's
+options, a schema read off config.yaml the way the Supervisor renders it
+(`schema_ui()`) and translations/en.yaml, and keeps what the settings view
+saves in memory, so the Installer view can be clicked through end to end.
+
+P4: STATE `new` is a new install (config.yaml's defaults with one power
+request entity, an empty Store made at this boot, control never started), so the page opens
+the setup wizard by itself. A one-entity read of sensor.grid steps through
+KETTLE_READS, so the kettle test sees the kettle go on (up) and then a
+reversed meter (down).
+"""
+
+import asyncio
+import io
+import json
+import os
+import re
+import sys
+from datetime import datetime, timedelta, timezone
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, HERE)
+sys.path.insert(0, os.path.join(HERE, "tools"))
+
+from aiohttp import web as aioweb                                # noqa: E402
+
+from app import homeview, packmode, web                          # noqa: E402
+from app.main import Controller                                  # noqa: E402
+from app.maintenance import DRAIN                                # noqa: E402
+from app.setuponly import SetupOnly                              # noqa: E402
+from app.peakguard import PeakDecision                           # noqa: E402
+from app.price import PricePoint, PriceProduct, PriceRead        # noqa: E402
+from app.static_tariff import TariffPlan                         # noqa: E402
+import translations_lint as TL                                   # noqa: E402
+
+PRICES = [.24, .22, .21, .20, .21, .22, .24, .27, .26, .22, .18, .16, .15,
+          .14, .16, .19, .23, .28, .33, .36, .34, .29, .26, .24]
+
+
+class Store(dict):
+    fresh = False           # app/store.py: no state file at this boot
+
+    def set(self, k, v):
+        self[k] = v
+
+    def set_time(self, k, v):
+        self[k] = v.isoformat()
+
+    def get_time(self, k):
+        v = self.get(k)
+        return None if v is None else datetime.fromisoformat(v)
+
+    @property
+    def data(self):
+        return self
+
+
+class Pub:
+    enabled = False
+
+    def publish(self, _v):
+        pass
+
+    def close(self):
+        pass
+
+
+class Hass:
+    session = None
+    token = ""
+
+    async def limits(self, _e):
+        return (-5000.0, 5000.0, 1.0)
+
+    async def number(self, _e, invert=False):
+        return None
+
+    async def state(self, e):
+        s = next((dict(x) for x in STATES if x["entity_id"] == e), None)
+        if s and e == "sensor.grid":
+            n = KETTLE_COUNT[0] = KETTLE_COUNT[0] + 1
+            s["state"] = str(KETTLE_READS[(n - 1) % len(KETTLE_READS)])
+        return s
+
+    async def set_number(self, _e, _v):
+        return True
+
+    async def call(self, *_a):
+        return True
+
+    async def states(self):
+        return STATES
+
+
+KETTLE_READS = (-10, 1990, 1990, -10)
+KETTLE_COUNT = [0]
+
+
+def _state(eid, name, state, unit=None, cls=None):
+    return {"entity_id": eid, "state": state,
+            "attributes": {"friendly_name": name, "unit_of_measurement": unit,
+                           "device_class": cls}}
+
+
+STATES = [
+    _state("sensor.grid", "Grid power", "-10", "W", "power"),
+    _state("sensor.grid_kw", "Grid power in kW", "-0.01", "kW", "power"),
+    _state("sensor.pv", "Solar power", "3900", "W", "power"),
+    _state("sensor.soc_a", "Battery A level", "62", "%", "battery"),
+    _state("sensor.soc_b", "Battery B level", "35", "%", "battery"),
+    _state("sensor.batt_a", "Battery A power", "-2500", "W", "power"),
+    _state("sensor.batt_b", "Battery B power", "-300", "W", "power"),
+    _state("number.a", "Battery A power request", "0", "W"),
+    _state("number.b", "Battery B power request", "0", "W"),
+    _state("sensor.peak_forecast", "Quarter-hour peak forecast", "1240", "W",
+           "power"),
+]
+
+
+# --- config.yaml as the Supervisor renders it (App.schema_ui) --------------- #
+def _node(name, spec):
+    spec = spec.strip()
+    optional = spec.endswith("?")
+    spec = spec.rstrip("?")
+    out = {"name": name, "required": not optional, "optional": optional}
+    m = re.match(r"(int|float)\(([^,]*),([^)]*)\)$", spec)
+    if m:
+        out.update(type="integer" if m.group(1) == "int" else "float",
+                   lengthMin=float(m.group(2)), lengthMax=float(m.group(3)))
+    elif spec.startswith("list("):
+        out.update(type="select", options=spec[5:-1].split("|"))
+    elif spec in ("bool",):
+        out["type"] = "boolean"
+    elif spec in ("int", "float"):
+        out["type"] = "integer" if spec == "int" else "float"
+    else:
+        out["type"] = "string"
+    return out
+
+
+def schema_ui(text):
+    """config.yaml's `schema:` block in the Supervisor's schema_ui shape: the
+    fixture for tests and this demo, which cannot run the Supervisor."""
+    block = text[text.index("\nschema:"):].splitlines()[1:]
+    out, i = [], 0
+    while i < len(block):
+        line = block[i]
+        m = re.match(r"^  ([a-z_0-9]+):\s*(\S.*?)?\s*$", line)
+        i += 1
+        if not m:
+            continue
+        name, spec = m.group(1), m.group(2)
+        if spec:
+            out.append(_node(name, spec))
+            continue
+        items = []
+        while i < len(block) and (block[i].startswith("    ") or not block[i].strip()):
+            if block[i].strip() and not block[i].strip().startswith("#"):
+                items.append(block[i].strip())
+            i += 1
+        if items and items[0].startswith("- ") and ":" in items[0]:
+            fields = [items[0][2:]] + items[1:]
+            out.append({"name": name, "type": "schema", "optional": True,
+                        "multiple": True,
+                        "schema": [_node(*f.split(":", 1)) for f in fields]})
+        else:
+            node = _node(name, items[0][2:] if items else "str")
+            node.update(multiple=True, required=False, optional=True)
+            out.append(node)
+    return out
+
+
+def defaults(text):
+    """config.yaml's `options:` block (as test_uimodel.py reads it)."""
+    block = text[text.index("\noptions:"):text.index("\nschema:")]
+    out = {}
+    for key, raw in re.findall(r"^  ([a-z_0-9]+):(.*)$", block, re.M):
+        raw = raw.split(" #")[0].strip()
+        try:
+            out[key] = json.loads(raw)
+        except ValueError:
+            out[key] = raw
+    return out
+
+
+CONFIG = io.open(os.path.join(HERE, "config.yaml"), encoding="utf-8").read()
+
+
+class Supervisor:
+    """The stored options, kept in memory: a save here writes nothing else."""
+
+    def __init__(self, options):
+        self.options = options
+        self.writes = 0
+
+    async def info(self):
+        return {"options": json.loads(json.dumps(self.options)),
+                "schema": schema_ui(CONFIG),
+                "translations": {lang: TL.parse_translation_file(
+                    os.path.join(HERE, "translations", f"{lang}.yaml"))
+                    for lang in ("en", "nl")}}
+
+    async def write_options(self, options):
+        self.options = json.loads(json.dumps(options))
+        self.writes += 1
+        print(f"options saved ({self.writes})", flush=True)
+
+    async def restart(self, confirm):
+        print(f"restart asked ({confirm!r})", flush=True)
+
+
+OPTS = {"meter_entity": "sensor.grid", "meter_source": "off",
+        "pv_entity": "sensor.pv", "maintenance_enabled": True,
+        "maintenance_start_hour": 18, "arbitrage_enabled": True,
+        "cycle_cost_threshold_eur": 0.05,
+        "inverters": [
+            {"name": "Battery A", "setpoint_entity": "number.a",
+             "soc_entity": "sensor.soc_a", "batt_entity": "sensor.batt_a",
+             "max_w": 2500, "capacity_kwh": 9.6},
+            {"name": "Battery B", "setpoint_entity": "number.b",
+             "soc_entity": "sensor.soc_b", "batt_entity": "sensor.batt_b",
+             "max_w": 2500, "capacity_kwh": 5.4}]}
+
+
+# UX-13 P3: the battery-mode states, each with battery modes on.
+P3 = ("modes", "off", "off_peak", "refusal", "maint")
+
+
+def controller(state):
+    opts = dict(OPTS, shadow_mode="on" if state == "shadow" else "off")
+    if state in P3:
+        opts["battery_modes_enabled"] = True
+    c = Controller(opts, Hass(), Store(), Pub(), stop=asyncio.Event())
+    c.auto = True
+    now = datetime.now(timezone.utc)
+    day0, _day1 = homeview.local_day(now)
+    pts = tuple(PricePoint(day0 + timedelta(days=d, hours=k), p, False)
+                for d in range(2) for k, p in enumerate(PRICES))
+    c.tariff_plan = TariffPlan(PriceRead.series(
+        pts, PriceProduct.DAY_AHEAD, "generic_dayahead", now), None,
+        "provider")
+    c.tariff_at = now
+    c.peak_guard = PeakDecision(engaged=False, floor_w=None,
+                                ceiling_w=3500.0, ceiling_from="cap",
+                                projected_w=1240.0)
+    for inv, soc, batt in zip(c.inverters, (62.0, 35.0), (-2500.0, -300.0)):
+        inv.soc, inv.batt = soc, (0.0 if state == "shadow" else batt)
+        inv.dev_min, inv.dev_max = -5000.0, 5000.0
+        if state != "running":          # 0 W accepted: Home says "Held"
+            inv.last_write = 0.0
+    c.grid = -10.0 if state != "shadow" else -2810.0
+    c.pv_w = 3900.0
+    if state == "alarm":
+        c.inverters[0].sign_wd.tripped = True
+    if state in P3:
+        a, b = c.inverters
+        b.store_set(packmode.MODE_KEY, packmode.LEFTOVER_SOLAR)
+        if state in ("off", "off_peak"):
+            b.store_set(packmode.USE_KEY, False)
+            b.batt = 0.0
+        if state == "off_peak":
+            # A cloudy evening: the house takes 6 kW and the peak limit needs
+            # both batteries, so B gives 0.5 kW although it is switched off.
+            c.pv_w, c.grid = 0.0, 3490.0
+            a.batt, b.batt = 2000.0, 510.0
+            c.peak_guard = PeakDecision(engaged=True, floor_w=2500.0,
+                                        ceiling_w=3500.0, ceiling_from="cap",
+                                        projected_w=3600.0)
+        if state == "refusal":
+            # A is at its cut-out level and refuses: asked 0 W, B takes over.
+            c.pv_w, c.grid = 0.0, 5.0
+            a.soc, a.batt, a.refused = 9.0, -4.0, 1
+            b.batt = 1210.0
+        if state == "maint":
+            c.maints[0].store.set("phase", DRAIN)   # MAINT-05: A's own key
+            c.pv_w, c.grid = 0.0, 0.0
+            a.batt, b.batt = 2000.0, 0.0
+    return c
+
+
+class ReadOnlyHass(Hass):
+    read_only = True        # app/setuponly.py serves only on a read-only HA
+
+
+async def main(state, port, host="127.0.0.1"):
+    if state == "setup":
+        # UX-15's setup-only mode: shipped defaults, nothing controlled.
+        stored = defaults(CONFIG)
+        c = SetupOnly(dict(stored), ReadOnlyHass(), Store())
+        runner = aioweb.AppRunner(web.build_app(c, Supervisor(stored)))
+        await runner.setup()
+        await aioweb.TCPSite(runner, host, port).start()
+        print(f"serving setup on http://127.0.0.1:{port}/", flush=True)
+        await asyncio.Event().wait()
+    if state == "new":
+        stored = dict(defaults(CONFIG), setpoint_entity="number.a")
+        store = Store()
+        store.fresh = True          # a new /data: the wizard opens by itself
+        c = Controller(dict(stored), Hass(), store, Pub(),
+                       stop=asyncio.Event())
+        c.auto = False
+        runner = aioweb.AppRunner(web.build_app(c, Supervisor(stored)))
+        await runner.setup()
+        await aioweb.TCPSite(runner, host, port).start()
+        print(f"serving new on http://127.0.0.1:{port}/", flush=True)
+        await asyncio.Event().wait()
+    c = controller(state)
+    stored = dict(defaults(CONFIG), **OPTS)
+    stored.update(setpoint_entity="", meter_source="ha_signed",
+                  p1_net_entity="sensor.grid", price_provider="generic_dayahead",
+                  peak_forecast_entity="sensor.peak_forecast",
+                  shadow_mode=c.o.get("shadow_mode", "off"),
+                  battery_modes_enabled=state in P3,
+                  inverters=[dict(i, bms_soc_floor=10)
+                             for i in OPTS["inverters"]])
+    runner = aioweb.AppRunner(web.build_app(c, Supervisor(stored)))
+    await runner.setup()
+    await aioweb.TCPSite(runner, host, port).start()
+    print(f"serving {state} on http://127.0.0.1:{port}/", flush=True)
+    await asyncio.Event().wait()
+
+
+if __name__ == "__main__":
+    asyncio.run(main(sys.argv[1], int(sys.argv[2]), *sys.argv[3:4]))
diff --git a/goodwe_controller/tools/ux13_screenshots.py b/goodwe_controller/tools/ux13_screenshots.py
new file mode 100644
index 0000000..8e5220f
--- /dev/null
+++ b/goodwe_controller/tools/ux13_screenshots.py
@@ -0,0 +1,110 @@
+"""UX-13 P5: the DOCS screenshots of the new screens, taken from the real page.
+
+Run by tools/ux13_screenshots.sh, which serves tools/ux13_demo.py fixtures and
+runs this inside the Playwright image. Each shot fails the run on a page
+error, so a broken screen is never pictured.
+
+    python3 ux13_screenshots.py OUT_DIR    # DEMO_<STATE> = the fixture's URL
+
+P3 adds the Batteries screen and Settings, Simple (the default Settings
+view), so the Installer shots click Installer first.
+"""
+
+import os
+import sys
+
+from playwright.sync_api import sync_playwright
+
+OUT = sys.argv[1]
+DESKTOP = {"width": 1000, "height": 900}
+PHONE = {"width": 390, "height": 844}
+
+
+def url(state):
+    return os.environ[f"DEMO_{state.upper()}"]
+
+
+def shot(browser, name, state, route, *, lang="en-GB", size=DESKTOP,
+         full=True, act=None, only=None):
+    ctx = browser.new_context(locale=lang, viewport=size,
+                              color_scheme="light", reduced_motion="reduce")
+    page = ctx.new_page()
+    errors = []
+    page.on("pageerror", lambda e: errors.append(str(e)))
+    page.goto(url(state) + route)
+    page.wait_for_load_state("networkidle")
+    page.wait_for_timeout(1500)             # the first /status and checks
+    if act:
+        act(page)
+        page.wait_for_timeout(1500)         # the debounced start checks
+    path = os.path.join(OUT, name + ".png")
+    if only:
+        page.locator(only).screenshot(path=path)
+    else:
+        page.screenshot(path=path, full_page=full)
+    ctx.close()
+    if errors:
+        raise SystemExit(f"{name}: page errors {errors}")
+    print(f"  {name}.png")
+
+
+def installer(page):
+    page.locator("#set-view [data-v=installer]").click()
+
+
+def open_tariff(page):
+    installer(page)
+    page.locator("details.grp[data-g=tariff] > summary").click()
+    page.locator("details.grp[data-g=meter] > summary").click()   # close it
+    # The fixture site is on a dynamic contract: its fallback gets windows.
+    page.get_by_role("radiogroup", name="Price when the feed is down") \
+        .get_by_role("radio", name="Other time windows").click()
+
+
+def windows(page, overlap=False):
+    open_tariff(page)
+    add = page.get_by_role("button", name="+ Add a time window")
+    rows = (("07:00", "23:00" if overlap else "22:00", "mon-fri", "0.34"),
+            ("22:00", "07:00", "mon-fri", "0.26"),
+            ("00:00", "24:00", "sat,sun", "0.24"))
+    for i, (a, b, days, price) in enumerate(rows, start=1):
+        add.click()
+        page.get_by_label(f"Window {i}, From").fill(a)
+        page.get_by_label(f"Window {i}, To").fill(b)
+        page.get_by_label(f"Window {i}, Days").select_option(days)
+        page.get_by_label(f"Window {i}, Price").fill(price)
+    page.locator("[data-key='ui.periods']").scroll_into_view_if_needed()
+
+
+def main():
+    os.makedirs(OUT, exist_ok=True)
+    with sync_playwright() as p:
+        b = p.chromium.launch()
+        shot(b, "home-running", "running", "#home")
+        shot(b, "home-running-nl", "running", "#home", lang="nl-BE")
+        shot(b, "home-shadow", "shadow", "#home")
+        shot(b, "home-phone", "running", "#home", size=PHONE)
+        shot(b, "home-setup-only", "setup", "#home", full=False)
+        shot(b, "settings-installer", "running", "#settings", act=installer)
+        shot(b, "settings-installer-nl", "running", "#settings", lang="nl-BE",
+             act=installer)
+        shot(b, "batteries", "modes", "#batteries")
+        shot(b, "batteries-nl", "modes", "#batteries", lang="nl-BE")
+        shot(b, "batteries-off-peak", "off_peak", "#batteries")
+        shot(b, "batteries-phone", "refusal", "#batteries", size=PHONE,
+             full=False)
+        shot(b, "batteries-modes-off", "running", "#batteries", full=False)
+        shot(b, "settings-simple", "modes", "#settings")
+        shot(b, "settings-simple-nl", "modes", "#settings", lang="nl-BE")
+        tariff = "details.grp[data-g=tariff]"
+        shot(b, "settings-time-windows", "running", "#settings",
+             act=windows, only=tariff)
+        shot(b, "settings-time-windows-overlap", "running", "#settings",
+             act=lambda page: windows(page, overlap=True), only=tariff)
+        shot(b, "setup-step-1", "new", "#setup")
+        shot(b, "setup-step-1-nl", "new", "#setup", lang="nl-BE")
+        b.close()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/goodwe_controller/tools/ux13_screenshots.sh b/goodwe_controller/tools/ux13_screenshots.sh
new file mode 100755
index 0000000..daf4993
--- /dev/null
+++ b/goodwe_controller/tools/ux13_screenshots.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+# UX-13 P5: regenerate the DOCS screenshots in docs/img/ux13/ from the real page.
+#
+#   sh goodwe_controller/tools/ux13_screenshots.sh [OUT_DIR]
+#   CHECK=1 sh goodwe_controller/tools/ux13_screenshots.sh   # P3 browser check
+#
+# Serves tools/ux13_demo.py's fixtures (running, shadow, new, setup) in the CI
+# test image, then runs tools/ux13_screenshots.py in the Playwright image on a
+# private Docker network (the image has the browsers; the matching Python
+# package is installed into the container on each run). Nothing talks to Home Assistant or an inverter. The
+# prices and the "now" line follow the clock, so the pictures change a little
+# from run to run. Needs Docker and PyPI access; pulls the Playwright image once.
+set -eu
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+OUT=${1:-$HERE/../docs/img/ux13}
+PW=mcr.microsoft.com/playwright/python:v1.55.0-noble
+NET=ux13-shots-$$
+STATES="running shadow new setup modes off off_peak refusal maint"
+RUN=/t/ux13_screenshots.py
+[ "${CHECK:-}" = 1 ] && RUN=/t/ux13_browser_check.py
+mkdir -p "$OUT"
+OUT=$(cd "$OUT" && pwd)
+
+cleanup() {
+    for s in $STATES; do docker rm -f "$NET-$s" >/dev/null 2>&1 || true; done
+    docker network rm "$NET" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+
+docker build -q -t goodwe-addon-checks:1 "$HERE/../.gitea/ci" >/dev/null
+docker network create "$NET" >/dev/null
+ENVS=""
+for s in $STATES; do
+    docker run -d --name "$NET-$s" --network "$NET" -e PYTHONDONTWRITEBYTECODE=1 \
+        -v "$HERE:/w:ro" goodwe-addon-checks:1 \
+        python3 /w/tools/ux13_demo.py "$s" 8099 0.0.0.0 >/dev/null
+    ENVS="$ENVS -e DEMO_$(echo "$s" | tr a-z A-Z)=http://$NET-$s:8099/"
+done
+sleep 3
+# shellcheck disable=SC2086
+docker run --rm --network "$NET" --user "$(id -u):$(id -g)" -e HOME=/tmp \
+    $ENVS -v "$HERE/tools:/t:ro" -v "$OUT:/out" "$PW" \
+    sh -euc 'pip install -q --disable-pip-version-check --target /tmp/pw \
+                 playwright==1.55.0
+             PYTHONPATH=/tmp/pw python3 '"$RUN"' /out'
+echo "screenshots in $OUT"
diff --git a/goodwe_controller/tools/ux13_validator_calls.py b/goodwe_controller/tools/ux13_validator_calls.py
new file mode 100644
index 0000000..bcd75d1
--- /dev/null
+++ b/goodwe_controller/tools/ux13_validator_calls.py
@@ -0,0 +1,106 @@
+"""UX-13: record every `validate_startup_config()` call the test suite makes,
+and compare two validators over those calls.
+
+    python3 tools/ux13_validator_calls.py record OUT.jsonl.gz
+    python3 tools/ux13_validator_calls.py compare OLD_APP_PARENT OUT.jsonl.gz
+
+`record` runs each test_*.py with the validator wrapped (in this directory, so
+run it where the suite runs: the CI image). `compare` runs the recorded calls
+through the validator under OLD_APP_PARENT (a directory holding an `app/`,
+e.g. from `git archive <base> goodwe_controller/app`) and through this tree's,
+and prints every call whose refusals differ. P0 of UX-13 used it to show that
+adding the warning tier changed no refusal. scenarios/ux13/ holds the record
+test_uimodel.py round-trips.
+"""
+
+import gzip
+import json
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+_WRAP = r"""
+import json, runpy, sys
+sys.path.insert(0, ".")
+from app import validate
+real = validate.validate_startup_config
+out = open(sys.argv[1], "a")
+def rec(opts, dev_min=None, dev_max=None, *a, **kw):
+    try:
+        out.write(json.dumps({"opts": opts, "dev_min": dev_min,
+                              "dev_max": dev_max}) + "\n")
+    except (TypeError, ValueError):
+        pass
+    return real(opts, dev_min, dev_max, *a, **kw)
+validate.validate_startup_config = rec
+sys.argv = sys.argv[2:]
+try:
+    runpy.run_path(sys.argv[0], run_name="__main__")
+except SystemExit:
+    pass
+"""
+
+
+def record(out_path):
+    tmp = out_path + ".part"
+    open(tmp, "w").close()
+    rows, seen = [], set()
+    for name in sorted(f for f in os.listdir(HERE)
+                       if f.startswith("test_") and f.endswith(".py")):
+        before = sum(1 for _ in open(tmp))
+        subprocess.run([sys.executable, "-B", "-c", _WRAP, tmp, name],
+                       cwd=HERE, stdout=subprocess.DEVNULL,
+                       stderr=subprocess.DEVNULL)
+        with open(tmp) as fh:
+            for line in list(fh)[before:]:
+                call = json.loads(line)
+                key = json.dumps(call, sort_keys=True)
+                if key not in seen:
+                    seen.add(key)
+                    rows.append(dict(call, source=name))
+    os.remove(tmp)
+    with gzip.open(out_path, "wt") as fh:
+        for row in rows:
+            fh.write(json.dumps(row, sort_keys=True) + "\n")
+    print(f"{len(rows)} distinct validator calls -> {out_path}")
+
+
+def _run(app_parent, path):
+    code = r"""
+import gzip, json, logging, sys
+logging.disable(logging.CRITICAL)
+sys.path.insert(0, sys.argv[1])
+from app.validate import validate_startup_config as v
+out = []
+for line in gzip.open(sys.argv[2], "rt"):
+    c = json.loads(line)
+    try:
+        out.append(v(c["opts"], c["dev_min"], c["dev_max"]))
+    except Exception as e:
+        out.append("raised " + type(e).__name__)
+print(json.dumps(out))
+"""
+    got = subprocess.run([sys.executable, "-B", "-c", code, app_parent, path],
+                         capture_output=True, text=True, check=True)
+    return json.loads(got.stdout)
+
+
+def compare(old_parent, path):
+    old, new = _run(old_parent, path), _run(HERE, path)
+    differ = [i for i, (a, b) in enumerate(zip(old, new)) if a != b]
+    print(f"{len(old)} calls, {sum(1 for r in old if r)} refused by the old "
+          f"validator, {len(differ)} with different refusals")
+    for i in differ:
+        print(f"  call {i}:\n    old {old[i]}\n    new {new[i]}")
+    return 1 if differ else 0
+
+
+if __name__ == "__main__":
+    if len(sys.argv) == 3 and sys.argv[1] == "record":
+        record(sys.argv[2])
+    elif len(sys.argv) == 4 and sys.argv[1] == "compare":
+        sys.exit(compare(sys.argv[2], sys.argv[3]))
+    else:
+        sys.exit(__doc__)
diff --git a/goodwe_controller/tools/ux13_wizard_blobs.py b/goodwe_controller/tools/ux13_wizard_blobs.py
new file mode 100644
index 0000000..b219b2e
--- /dev/null
+++ b/goodwe_controller/tools/ux13_wizard_blobs.py
@@ -0,0 +1,282 @@
+"""UX-13 P4: every options blob the setup wizard can save, and the Supervisor's
+own validator run over them.
+
+    python3 tools/ux13_wizard_blobs.py --dump DIR     # write the blobs
+    docker run --rm --network none -v "$PWD:/w:ro" -v DIR:/blobs:ro \
+      --entrypoint python3 \
+      ghcr.io/home-assistant/amd64-hassio-supervisor:2026.08.0 \
+      /w/tools/ux13_wizard_blobs.py --supervisor /blobs
+
+The wizard edits the page model one step at a time and saves it through
+uipage.to_options(), like the Installer view. `blobs()` walks each step's
+choices (meter source and sign, one to three inverters, solar rows, every
+contract and price source, time windows (P5), region, peak limit, shadow
+mode) from a new
+install as shipped, one with a power request entity, and the TEST-23 sites, and keeps what the shipped validator
+accepts, because the wizard saves nothing it refuses. test_setup.py checks
+the set; `--supervisor` runs it through Supervisor 2026.08.0's `AppOptions`
+offline, as the P2 test did. It touches nothing: no network, no Supervisor.
+"""
+
+import copy
+import glob
+import json
+import os
+import sys
+
+HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+def browser(value):
+    """What JSON.parse then JSON.stringify does to a value: 3.0 becomes 3."""
+    if isinstance(value, float) and value.is_integer():
+        return int(value)
+    if isinstance(value, list):
+        return [browser(v) for v in value]
+    if isinstance(value, dict):
+        return {k: browser(v) for k, v in value.items()}
+    return value
+
+
+# --- the wizard's steps, as edits to the page model ------------------------ #
+METERS = {
+    "entity": {"meter_source": "off", "meter_entity": "sensor.grid"},
+    "entity_flipped": {"meter_source": "off", "meter_entity": "sensor.grid",
+                       "meter_invert": True},
+    "signed": {"meter_source": "ha_signed", "p1_net_entity": "sensor.net"},
+    "signed_3": {"meter_source": "ha_signed", "p1_net_entity": "sensor.net",
+                 "meter_phases": 3, "p1_phase_net_entities": [
+                     "sensor.l1", "sensor.l2", "sensor.l3"]},
+    "dsmr": {"meter_source": "ha_dsmr", "p1_import_entity": "sensor.imp",
+             "p1_export_entity": "sensor.exp"},
+    "homewizard": {"meter_source": "homewizard_local",
+                   "p1_host": "192.0.2.50"},
+    "mqtt": {"meter_source": "mqtt_p1", "meter_mqtt_topic": "p1/power"},
+}
+
+
+def _card(i, flat=False, **more):
+    card = {"setpoint_entity": f"number.inv{i}_power",
+            "soc_entity": f"sensor.inv{i}_level",
+            "batt_entity": f"sensor.inv{i}_battery", "batt_invert": False,
+            "max_w": 2500, "bms_soc_floor": 10}
+    if flat:
+        card.update(name="", capacity_kwh=None)
+    else:
+        card.update(name=f"inverter-{i}", capacity_kwh=5.0)
+    card.update(more)
+    return card
+
+
+ROSTERS = {
+    "one": ("flat", [_card(1, flat=True)]),
+    "one_flipped": ("flat", [_card(1, flat=True, batt_invert=True,
+                                   max_w=3000)]),
+    "two": ("list", [_card(1), _card(2, max_w=4600, bms_soc_floor=15)]),
+    "three": ("list", [_card(1), _card(2), _card(3, capacity_kwh=9.6)]),
+}
+SOLAR = {
+    "none": [],
+    "one": [{"entity": "sensor.pv", "reversed": False}],
+    "one_reversed": [{"entity": "sensor.pv", "reversed": True}],
+    "two": [{"entity": "sensor.pv_a", "reversed": False},
+            {"entity": "sensor.pv_b", "reversed": True}],
+}
+PRICES = {
+    "none": {"ui.contract": "none", "ui.fallback": "none"},
+    "fixed": {"ui.contract": "fixed", "ui.fallback": "fixed",
+              "ui.fixed_price": 0.31},
+    "daynight": {"ui.contract": "daynight", "ui.fallback": "daynight",
+                 "ui.day_price": 0.34, "ui.night_price": 0.25},
+    "dynamic": {"ui.contract": "dynamic", "price_provider": "generic_dayahead",
+                "ui.fallback": "none"},
+    "dynamic_fixed": {"ui.contract": "dynamic",
+                      "price_provider": "generic_dayahead",
+                      "ui.fallback": "fixed", "ui.fixed_price": 0.3},
+    "dynamic_daynight": {"ui.contract": "dynamic",
+                         "price_provider": "generic_dayahead",
+                         "ui.fallback": "daynight", "ui.day_price": 0.3,
+                         "ui.night_price": 0.2},
+    "formula": {"ui.contract": "dynamic", "price_provider": "custom_formula",
+                "price_formula": "<the documented example>",
+                "ui.fallback": "fixed",
+                "ui.fixed_price": 0.3},
+    "csv": {"ui.contract": "dynamic", "price_provider": "manual_csv",
+            "price_csv_path": "/share/prices.csv", "ui.fallback": "fixed",
+            "ui.fixed_price": 0.3},
+    # P5: the time-window editor, odd windows the day/night preset cannot say.
+    "periods": {"ui.contract": "custom", "ui.fallback": "custom",
+                "ui.periods": [
+                    {"from": "06:30", "to": "21:15", "days": "mon-fri",
+                     "price": 0.31},
+                    {"from": "21:15", "to": "06:30", "days": "mon-fri",
+                     "price": 0.19},
+                    {"from": "00:00", "to": "12:00", "days": "sat",
+                     "price": 0.2},
+                    {"from": "12:00", "to": "24:00", "days": "sat",
+                     "price": 0.25},
+                    {"from": "00:00", "to": "24:00", "days": "sun",
+                     "price": 0.18}]},
+    "periods_one": {"ui.contract": "custom", "ui.fallback": "custom",
+                    "ui.periods": [{"from": "00:00", "to": "00:00",
+                                    "days": "mon-sun", "price": 0.29}]},
+    "dynamic_periods": {"ui.contract": "dynamic",
+                        "price_provider": "generic_dayahead",
+                        "ui.fallback": "custom", "ui.periods": [
+                            {"from": "07:00", "to": "23:00",
+                             "days": "mon-sun", "price": 0.32},
+                            {"from": "23:00", "to": "07:00",
+                             "days": "mon-sun", "price": 0.21}]},
+}
+REGIONS = {"flanders": {"ui.region": "flanders"},
+           "own": {"ui.region": "own", "price_taxes_eur_kwh": 0.15}}
+PEAKS = {"low": {"peak_cap_w": 2500, "peak_forecast_entity": ""},
+         "forecast": {"peak_cap_w": 4200,
+                      "peak_forecast_entity": "sensor.peak_forecast"},
+         "high": {"peak_cap_w": 10000, "peak_forecast_entity": ""}}
+SHADOWS = ("on", "auto")        # the switch on, or off (uilayout.SHADOW)
+BASE = {"meter": "entity", "roster": "one", "solar": "none",
+        "prices": "none", "region": "own", "peak": "low", "shadow": "on"}
+
+
+def plans():
+    """Each step's choices once, with the other steps at BASE, then a few
+    whole sites that combine them."""
+    axes = {"meter": METERS, "roster": ROSTERS, "solar": SOLAR,
+            "prices": PRICES, "region": REGIONS, "peak": PEAKS,
+            "shadow": dict.fromkeys(SHADOWS)}
+    seen = []
+    for axis, choices in axes.items():
+        for choice in choices:
+            plan = dict(BASE, **{axis: choice})
+            if plan not in seen:
+                seen.append(plan)
+    for plan in (
+            {"meter": "dsmr", "roster": "two", "solar": "two",
+             "prices": "dynamic_daynight", "region": "flanders",
+             "peak": "forecast", "shadow": "on"},
+            {"meter": "signed_3", "roster": "three", "solar": "one_reversed",
+             "prices": "daynight", "region": "flanders", "peak": "high",
+             "shadow": "auto"},
+            {"meter": "homewizard", "roster": "one_flipped", "solar": "one",
+             "prices": "fixed", "region": "own", "peak": "forecast",
+             "shadow": "on"},
+            {"meter": "mqtt", "roster": "two", "solar": "none",
+             "prices": "formula", "region": "flanders", "peak": "low",
+             "shadow": "on"},
+            {"meter": "dsmr", "roster": "two", "solar": "one",
+             "prices": "periods", "region": "flanders", "peak": "forecast",
+             "shadow": "on"}):
+        seen.append(plan)
+    return seen
+
+
+def apply(model, plan):
+    """The page model after the wizard's six steps, as the page leaves it."""
+    from app import uilayout as L, uimodel as U
+    m = copy.deepcopy(model)
+    m.update(copy.deepcopy(METERS[plan["meter"]]))
+    shape, cards = ROSTERS[plan["roster"]]
+    cards = copy.deepcopy(cards)
+    if m.get("inverter_shape") == "list":
+        # A site stored as a list stays one: one card keeps a name.
+        for i, card in enumerate(cards, 1):
+            card.update(name=card["name"] or f"inverter-{i}",
+                        capacity_kwh=card["capacity_kwh"] or 5.0)
+    m["inverters"] = cards
+    m[U.COUNT] = len(cards)
+    if shape == "list":
+        m.update(U.GROWN)
+    m["ui.solar"] = copy.deepcopy(SOLAR[plan["solar"]])
+    m.update(copy.deepcopy(PRICES[plan["prices"]]))
+    if plan["prices"] == "formula":
+        from app.custom_formula import _LEGS
+        m["price_formula"] = _LEGS["price_formula"].example
+    m.update(copy.deepcopy(REGIONS[plan["region"]]))
+    if plan["region"] != "own":
+        m["price_taxes_eur_kwh"] = U.REGION_PRESETS[plan["region"]][
+            "taxes_eur_kwh"]
+    m.update(PEAKS[plan["peak"]])
+    field, on, off = L.SHADOW
+    m[field] = on if plan["shadow"] == "on" else (
+        m.get(field) if m.get(field) != on else off)
+    return m
+
+
+def starts():
+    """(name, stored options) the wizard opens on: a new install as shipped
+    (config.yaml's defaults, served in setup-only mode since UX-15), one with a
+    power request entity typed in the Configuration tab, and the TEST-23
+    sites."""
+    sys.path.insert(0, os.path.join(HERE, "tools"))
+    import ux13_demo as D
+    new = dict(D.defaults(D.CONFIG), setpoint_entity="number.inv1_power")
+    out = [("empty", D.defaults(D.CONFIG)), ("new", new)]
+    for f in sorted(glob.glob(os.path.join(HERE, "scenarios", "ux13", "test23",
+                                           "*.json")))[:3]:
+        out.append((os.path.basename(f)[:-5], dict(D.defaults(D.CONFIG),
+                                                   **json.load(open(f)))))
+    return out
+
+
+def blobs():
+    """[(name, blob, refusals)] for every plan from every start."""
+    sys.path.insert(0, HERE)
+    from app import uimodel as U, uipage
+    from app.validate import validate_startup_config
+    out = []
+    for start, stored in starts():
+        model = json.loads(json.dumps(U.options_to_ui(stored)))
+        for plan in plans():
+            name = start + "-" + "-".join(f"{k}.{v}" for k, v in plan.items())
+            posted = browser(json.loads(json.dumps(apply(model, plan))))
+            blob = uipage.to_options(posted, stored)
+            out.append((name, blob, validate_startup_config(blob)))
+    return out
+
+
+# --- run inside the Supervisor image --------------------------------------- #
+def supervisor(folder):
+    sys.path.insert(0, "/usr/src/supervisor")
+    import voluptuous as vol
+    from pathlib import Path
+    from supervisor.apps.options import AppOptions
+    from supervisor.apps.validate import SCHEMA_APP_CONFIG
+    from supervisor.utils.yaml import read_yaml_file
+    cfg = SCHEMA_APP_CONFIG(read_yaml_file(Path(HERE) / "config.yaml"))
+    check = vol.Schema(vol.All(dict, AppOptions(
+        None, cfg["schema"], cfg["name"], "local_goodwe_controller")))
+    bad = 0
+    files = sorted(glob.glob(os.path.join(folder, "*.json")))
+    for f in files:
+        blob = json.load(open(f))
+        try:
+            got = check(copy.deepcopy(blob))
+            dropped = sorted(set(blob) - set(got))
+            ok = not dropped
+            why = f"dropped {dropped}" if dropped else f"{len(got)} keys"
+        except vol.Invalid as err:
+            ok, why = False, str(err)
+        bad += not ok
+        print(f"  {'PASS' if ok else 'FAIL'}  {os.path.basename(f)}: {why}")
+    print(f"{len(files) - bad} of {len(files)} accepted by AppOptions "
+          f"({cfg['version']})")
+    return 1 if bad or not files else 0
+
+
+if __name__ == "__main__":
+    if sys.argv[1:2] == ["--supervisor"]:
+        sys.exit(supervisor(sys.argv[2]))
+    if sys.argv[1:2] == ["--dump"]:
+        os.makedirs(sys.argv[2], exist_ok=True)
+        n = 0
+        for name, blob, refused in blobs():
+            if refused:
+                print("refused, not written:", name, refused[0])
+                continue
+            with open(os.path.join(sys.argv[2], name + ".json"), "w") as f:
+                json.dump(blob, f, indent=1)
+            n += 1
+        print(f"{n} blobs written to {sys.argv[2]}")
+        sys.exit(0)
+    print(__doc__)
diff --git a/goodwe_controller/translations/en.yaml b/goodwe_controller/translations/en.yaml
index 1a03e6c..f7f8631 100644
--- a/goodwe_controller/translations/en.yaml
+++ b/goodwe_controller/translations/en.yaml
@@ -34,266 +34,282 @@
 # is approximated by ORDER plus the `Group · ` prefix in each label. Do not
 # promise the operator visual sections; there are none.
 #
-# ⚠️ EVERY DERIVED CONSTANT SAYS WHERE IT CAME FROM. The Configuration tab
-# presents a number read off 1890 closed-loop test runs and the operator's own
-# inverter rating as the same kind of field. The descriptions are the only place
-# that difference can be stated, so a derived value names its campaign and says
-# "do not change without re-deriving", and a value that is genuinely the
-# operator's says so too.
+# Names and descriptions follow STYLE.md (UX-08): a short label with its unit,
+# and one or two plain sentences. A measured or derived value says "leave it
+# unchanged", and where it came from is in DOCS.md under "For installers:
+# where the numbers come from".
 configuration:
   setpoint_entity:
     name: "Hardware · Inverter setpoint entity"
-    description: "The ESPHome number entity this add-on writes the power setpoint to, normally number.*_goodwe_setpoint_w. This is the only thing the add-on commands. Leave it empty if you fill in the inverter list below: a site with a roster must not also name one loose actuator, and the add-on refuses to start when both are set."
+    description: "The ESPHome number entity the add-on writes the inverter's power to. Leave it empty when you fill in the inverter list."
   soc_entity:
-    name: "Hardware · Battery charge level entity (%)"
-    description: "The sensor that reports the pack's state of charge in percent. Use the ESP32's own reading, not a figure computed somewhere else. The maintenance cycle and every charge-level floor read this."
+    name: "Hardware · Battery level entity (%)"
+    description: "The sensor with the battery level in percent. Use the control board's own reading."
   batt_entity:
     name: "Hardware · Battery power entity (W)"
-    description: "The sensor that reports this inverter's own battery power, positive while discharging. On this installation that is holding register 0x0518, read by the ESP32. The sign watchdog and the circulating-power alarm both grade the inverter against this reading."
+    description: "The sensor with this inverter's battery power. Positive must mean the battery is giving power."
   batt_invert:
     name: "Hardware · Battery power sign is reversed"
-    description: "Only switch this on if your battery power sensor reports discharging as a negative number. The add-on expects positive to mean discharging."
+    description: "Switch this on only if your battery power sensor shows giving power as a negative number."
   inverters:
-    name: "Hardware · Inverter list (leave empty if you have one inverter)"
-    description: "Leave this empty unless the site really has more than one inverter. EMPTY DOES NOT MEAN 'not configured yet': it means the four entity settings above, together with the inverter rating and the battery cut-out under Limits, describe the one inverter you have. That is what every existing installation reads, and nobody has to touch anything. Filling this in REPLACES those settings instead of extending them, and nothing is inherited: each entry has to name its own actuator, its own rating and its own battery cut-out, so that no inverter is ever judged against another unit's numbers. The flat setpoint entity above must then be left empty."
+    name: "Hardware · Inverter list"
+    description: "Leave it empty if you have one inverter. With two or more, add one entry per inverter, which replaces the inverter settings above."
     fields:
       name:
         name: "Name"
-        description: "A short identifier for this inverter, for example inverter-a. It gives this unit its own namespace for its safety latch, heartbeat and write bookkeeping in the add-on's state file, so two units may not share one."
+        description: "A short, unique name for this inverter, for example inverter-a."
       setpoint_entity:
         name: "Setpoint entity"
-        description: "This inverter's own ESPHome number.*_goodwe_setpoint_w. Two entries may not name the same one - two writers on one actuator is refused at startup."
+        description: "This inverter's own ESPHome setpoint entity. Two entries may not use the same one."
       max_w:
         name: "Inverter rating (W)"
-        description: "The supervised ceiling on what may be written to THIS inverter; the site's ceiling is the sum over the list. Required of every entry: an entry without one would have to borrow a rating, and judging one inverter against another unit's numbers is exactly the fault this per-entry list exists to remove."
+        description: "The most power the add-on may ask of this inverter. The site total is the sum of the list."
       bms_soc_floor:
         name: "Battery cut-out level (%)"
-        description: "The percent at which THIS pack's own battery management system cuts out. Read it off the pack that is actually installed (register 0x0560) before that pack is ever commanded; do not copy another unit's figure. Required of every entry, deliberately: an optional one would be a defaulted one, and one default for two batteries of different models protects the shallower pack with the deeper pack's number."
+        description: "The level at which this battery's own management system stops giving power. Read it off the battery that is installed."
       soc_entity:
-        name: "Battery charge level entity (%) (optional)"
-        description: "This pack's own state of charge. Leave it empty if this unit reports none - that is what it means, and it never falls back to another unit's sensor."
+        name: "Battery level entity (%) (optional)"
+        description: "This battery's own level sensor. Leave it empty if this inverter has none."
       batt_entity:
         name: "Battery power entity (W) (optional)"
-        description: "This unit's own battery power, positive while discharging. Leave it empty if this unit reports none; nothing is inherited from another entry."
+        description: "This inverter's own battery power sensor. Leave it empty if it has none."
       batt_invert:
         name: "Battery power sign is reversed (optional)"
-        description: "Only for this entry: switch it on if this unit's battery power sensor reports discharging as a negative number."
+        description: "Switch this on if this inverter's sensor shows giving power as a negative number."
       capacity_kwh:
         name: "Usable battery capacity (kWh) (optional)"
-        description: "THIS pack's usable capacity in kilowatt-hours, from its datasheet or its label. It is read for one purpose: dividing the site's target between the inverters by how much ENERGY each pack has left rather than by how many watts it is rated for. The two packs at the reference site are 5000 W with 15.36 kWh and 4600 W with 20.48 kWh, so those two ways of dividing the work hand it to different batteries, and the energy one is the question worth asking. Optional: leave it empty and the add-on has no opinion, dividing the target evenly exactly as it did before. State it on EVERY inverter or on none of them - a pack measured in kWh next to one that is not is not a comparison, and the add-on refuses to start rather than ignore half of what you filled in."
+        description: "This battery's usable capacity from its datasheet. Fill it in on every inverter or on none. The add-on then shares the work by the energy each battery has left."
   estop_fitted:
     name: "Hardware · RS485 emergency stop is fitted"
-    description: "Whether the RS485 emergency stop is physically installed. It only drives the warning banner on the status page; it changes no control behaviour."
+    description: "Switch this on if the emergency stop is installed. It only changes a warning on the status page."
+  battery_modes_enabled:
+    name: "Hardware · Battery modes"
+    description: "Give each battery an on and off switch and a mode, set on the Batteries screen."
+  pv_forecast_entity:
+    name: "Hardware · Solar forecast, today (kWh)"
+    description: "Optional. A forecast sensor with today's remaining solar energy, such as Forecast.Solar or Solcast. A battery then buys only what the sun will not give."
+  pv_forecast_tomorrow_entity:
+    name: "Hardware · Solar forecast, tomorrow (kWh)"
+    description: "Optional. The same forecast for tomorrow. It helps plan a cheap hour before midnight."
+  solar_trust_pct:
+    name: "Hardware · Trust in the forecast (%)"
+    description: "Forecasts are often too sunny. At 70 % the add-on plans with 7 of every 10 kWh forecast."
   pv_entity:
-    name: "Hardware · PV production entity (W)"
-    description: "Optional, and MEASUREMENT ONLY - it changes no control behaviour whatsoever. Point it at your solar inverter's own power sensor (any brand Home Assistant reads; it does not have to be on the RS485 bus) and the add-on records production beside the grid and battery figures, so a day of unstored surplus can be told apart from a day with no sun. POSITIVE MUST MEAN PRODUCING. The unit is read from the entity itself - W, kW and the rest of Home Assistant's power units - so a sensor with no unit is refused rather than guessed at, and the status page says so. Leave it empty and nothing is read, nothing is published and nothing is shown."
+    name: "Hardware · Solar production entity (W)"
+    description: "Optional. Your solar inverter's power sensor, positive while producing. The add-on records it and does not use it for control."
   pv_entities:
-    name: "Hardware · PV production entities, one per inverter (W)"
-    description: "Optional, and MEASUREMENT ONLY - it changes no control behaviour whatsoever. Use this instead of the single entity above when your roof has SEVERAL solar inverters: add one row per inverter, pointing at each one's own power sensor, and the add-on records the SITE total. Each entity's own unit is read, so a kW inverter beside a W one adds up correctly. ⚠️ SETTING THIS IGNORES THE SINGLE ENTITY ABOVE - clear that one when you fill this in, or you will see a caution on the status page saying so. ⚠️ AND IF ANY ONE OF THESE STOPS REPORTING THERE IS NO SITE TOTAL: the sensor goes to 'unknown' and the history records a gap, rather than publishing the sum of the ones that did answer. Two inverters out of three add up to a smaller number that looks exactly like a real one, and a week later that reads as 'there was less sun than there was' - which is the one conclusion this recording exists to test. The status page names which entity is missing, why, and what the others reported. Leave it empty and nothing is read, nothing is published and nothing is shown."
+    name: "Hardware · Solar production entities, per inverter (W)"
+    description: "Optional. Use one row per solar inverter instead of “Solar production entity” when you have several. If one stops reporting, no total is recorded."
+  pv_invert_entities:
+    name: "Hardware · Reversed-sign solar entities"
+    description: "Optional. Add each solar entity above that reads negative while producing, spelled the same way. Its sign is flipped before adding up."
   meter_source:
     name: "Meter · Where the meter reading comes from"
-    description: "'off' keeps the single Home Assistant entity below, which is what an existing installation runs on until you choose otherwise. ha_dsmr subscribes to the DSMR integration; mqtt_p1 reads an MQTT topic; ha_signed reads one signed entity, which is what a HomeWizard P1 publishes; homewizard_local polls the meter's own local API and skips Home Assistant entirely. ⚠️ Only homewizard_local can tell 'the meter has not answered' apart from 'the value has not changed', so it is the only source on which the frozen-meter alarm means anything."
+    description: "How the add-on reads your meter. 'off' uses “Grid power entity” below, and only homewizard_local can spot a stuck meter."
   meter_entity:
     name: "Meter · Grid power entity (W)"
-    description: "The net grid power sensor, used when the meter source is 'off'. POSITIVE MUST MEAN DRAWING FROM THE GRID. Get this the wrong way round and the loop drives the battery in the wrong direction; use the sign switch below rather than a template sensor."
+    description: "Used when the meter source is 'off'. Positive must mean drawing from the grid."
   meter_invert:
     name: "Meter · Grid power sign is reversed"
-    description: "Switch this on if your grid sensor reports drawing from the grid as a negative number."
+    description: "Switch this on if your grid sensor shows drawing from the grid as a negative number."
   meter_phases:
     name: "Meter · Number of phases (1 or 3)"
-    description: "Must match your connection. A telegram whose phase count disagrees is rejected as it arrives and logged, so a wrong value shows up straight away as 'no telegrams accepted' rather than as a quietly wrong number. The range accepts 2, but that is not a real Belgian connection."
+    description: "Must match your grid connection. Meter readings with a different number of phases are rejected."
   p1_host:
     name: "Meter · HomeWizard P1 address"
-    description: "For meter source homewizard_local only: the meter's own address on your network, as host or host:port, for example 192.168.2.250."
+    description: "For homewizard_local only. The meter's address on your network, as host or host:port."
   meter_poll_s:
-    name: "Meter · Seconds between meter polls"
-    description: "For meter source homewizard_local only. 5 s is the meter's own update rate, so there is nothing to gain below it. It must stay well under the staleness limit below - the reading is never fresher than this interval - and the add-on refuses to start if it is at or above that limit."
+    name: "Meter · Time between meter reads (s)"
+    description: "For homewizard_local only. The meter updates every 5 s, so lower gains nothing. Keep it well below “Reading too old after”."
   meter_max_age_s:
-    name: "Meter · A reading counts as stale after (s)"
-    description: "Beyond this the grid figure counts as missing. On its own it does not command 0 W: the 'inputs missing' timer under Advanced starts only after this one has expired, and the two stack. 30 s is six polls of headroom at the default poll interval."
+    name: "Meter · Reading too old after (s)"
+    description: "After this a meter reading counts as missing. The “Missing inputs time limit” starts only after this one runs out."
   meter_mqtt_topic:
     name: "Meter · MQTT topic"
-    description: "For meter source mqtt_p1 only: the topic the P1 readings are published on."
+    description: "For mqtt_p1 only. The topic your meter readings are published on."
   p1_import_entity:
-    name: "Meter · Import register entity (W)"
-    description: "The UNSIGNED consumption register. Do not point this at a signed template sensor: the add-on works out net power itself as import minus export, so the sign convention lives in tested code rather than in unreviewed YAML."
+    name: "Meter · Grid import entity (W)"
+    description: "The sensor for power drawn from the grid, never negative. The add-on works out the net value itself."
   p1_export_entity:
-    name: "Meter · Export register entity (W)"
-    description: "The UNSIGNED injection register, the counterpart of the import register above. Same rule: no signed template sensor."
+    name: "Meter · Grid export entity (W)"
+    description: "The sensor for power fed into the grid, never negative. It pairs with “Grid import entity”."
   p1_net_entity:
     name: "Meter · Signed net power entity (W)"
-    description: "For meter source ha_signed only. ONE signed sensor: positive is drawn from the grid, negative is fed back into it. Do not split it into two template sensors - the add-on does that split itself, so that it is tested."
+    description: "For ha_signed only. One sensor that is positive when drawing from the grid and negative when feeding in."
   p1_phase_import_entities:
-    name: "Meter · Per-phase import entities (L1, L2, L3)"
-    description: "Optional, in L1..L3 order. Needed for the capacity-tariff quarter-hour peak on a three-phase connection. The number of entries must equal the number of phases above."
+    name: "Meter · Import entities per phase (L1-L3)"
+    description: "Optional, in L1, L2, L3 order. Needed for the peak limit on a three-phase connection, one entry per phase."
   p1_phase_export_entities:
-    name: "Meter · Per-phase export entities (L1, L2, L3)"
-    description: "Optional, in L1..L3 order, alongside the per-phase import entities above. The number of entries must equal the number of phases."
+    name: "Meter · Export entities per phase (L1-L3)"
+    description: "Optional, in L1, L2, L3 order, next to the import entities per phase. One entry per phase."
   p1_phase_net_entities:
-    name: "Meter · Per-phase signed net entities (L1, L2, L3)"
-    description: "For meter source ha_signed only. Optional, in L1..L3 order, each signed the same way as the net entity above. Same job as the per-phase import and export entities: the capacity-tariff quarter-hour peak on a three-phase connection. The number of entries must equal the number of phases."
+    name: "Meter · Net entities per phase (L1-L3)"
+    description: "For ha_signed only. Optional, in L1, L2, L3 order, signed like “Signed net power entity”, one entry per phase."
   max_w:
     name: "Limits · Inverter rating (W)"
-    description: "THIS IS YOUR NUMBER, not a derived one: the hard ceiling on what may ever be commanded, in watts. Set it to what your inverter is actually rated for, start low and raise it once the site has been commissioned. It is not read at all when the inverter list is filled in - each entry then carries its own, and the site ceiling is their sum. Several safety thresholds must stay below it, and the add-on refuses to start if one does not."
+    description: "Your own number: the most power the add-on may ever ask of the inverter. Start low and raise it after commissioning."
   bms_soc_floor:
     name: "Limits · Battery cut-out level (%)"
-    description: "MEASURED, not chosen: the percent at which the pack's OWN battery management system stops discharging, whatever this add-on is set to. Register 0x0560 reads 10 on the reference GW5000S-BP. Read it off the pack you actually have rather than copying this figure. It is here so the add-on can refuse a capacity-guard floor at or below it: such a floor could never bind, the BMS would win first, and the status page would report an energy backstop that does not exist. Not read when the inverter list is filled in - each entry then states its own pack's cut-out."
+    description: "The level where the battery's own management system stops giving power. Read it off your battery rather than copying a figure."
   peak_cap_w:
-    name: "Limits · Capacity-tariff target (W)"
-    description: "THIS IS YOUR NUMBER: the quarter-hour average demand the peak guard tries to stay under. Take it from your grid contract - in Belgium it is the capacity-tariff peak your distribution charge is billed on."
+    name: "Limits · Peak limit (W)"
+    description: "Your own number: the 15-minute average power the add-on keeps the grid under. Take it from your grid contract."
+  peak_margin_w:
+    name: "Limits · Margin below the peak limit (W)"
+    description: "The add-on aims this much below the peak limit, so a 15-minute period that ends a little high still stays under it."
   peak_forecast_entity:
-    name: "Limits · Quarter-hour demand forecast entity (W)"
-    description: "Optional. A forecast of the current billing quarter's average demand. Leave it empty and there is no capacity cap at all."
+    name: "Limits · 15-minute demand forecast entity (W)"
+    description: "Optional. A forecast of this 15-minute period's average power. Leave it empty and there is no peak limit."
   peak_soc_floor:
-    name: "Limits · Peak guard will not discharge below (%)"
-    description: "DERIVED, not picked (SAFETY-24): the reference pack holds 13.8 kWh usable and the worst modelled peak-shaving day asks for 878 Wh, which is 6.4 %, so 20 % sits ten points above the pack's own cut-out and still leaves the guard about 1.6 of its worst observed days of room. ⚠️ IT BOUNDS THE PEAK GUARD ONLY. It is not a reserve for the whole pack: ordinary self-consumption discharges straight past it and goes on down to the battery cut-out, and raising this number does not change that by a tenth of a percent. It must stay strictly above the battery cut-out or the add-on refuses to start. Do not change it without re-deriving it."
+    name: "Limits · Peak reserve (%)"
+    description: "Peak limiting will not draw the battery below this level, but ordinary use can. Derived value, leave it unchanged."
   price_provider:
     name: "Tariff · Dynamic price source"
-    description: "Where day-ahead or real-time prices come from. 'off' is what ships, and means this site runs on the static tariff below with no trading. ⚠️ SWITCHING THIS ON IS WHAT STARTS THE PRICE FETCH - not the trading switch further down. With a source selected the add-on fetches the feed every half hour, checks it, records the day and shows what it holds on the Price history row, whether or not price trading is armed. On its own it still moves no energy: trading is the separate switch, and the cheap window the monthly maintenance cycle uses comes from the fixed or day/night tariff below. It may not be combined with the two legacy Home Assistant price entities further down: two price sources on one site, one of which silently wins, is refused at startup rather than left looking armed. ⚠️ THREE IDS IN THIS LIST ARE WITHDRAWN AND WILL NOT START: engie_dynamic, totalenergies_dynamic and eneco_eddy. Their endpoints do not exist and never did, so those plugins never once fetched a price - a site set to one of them has silently been running on the fixed or day/night tariff below, or on nothing, since the day it was set. They are still offered here only so that such a site gets that explanation at startup instead of an unreadable schema error. Choose generic_dayahead for the wholesale curve with a flat markup, custom_formula to enter your own contract's B x index + A coefficients off your tariff card, manual_csv for a file you write yourself, or off."
+    description: "Where prices come from. Choosing a source starts the price fetch, even with trading off."
   price_markup_eur_kwh:
     name: "Tariff · Supplier markup (EUR/kWh)"
-    description: "Your supplier's margin. The add-on adds it ONLY when the chosen price source does not already include it - under manual_csv, whose figures are all-in, it is ignored, and logged as ignored, never applied twice."
+    description: "Your supplier's margin. It is added only when the price source does not already include it."
   price_taxes_eur_kwh:
     name: "Tariff · Distribution, levies and VAT (EUR/kWh)"
-    description: "Everything on your bill that is not the energy itself - distribution, levies, excise and VAT - per kWh, added under the same rule as the supplier markup: only when the chosen price source does not already carry them. ⚠️ THIS NUMBER IS NOT A PREFERENCE AND IT IS NOT YOUR INVERTER'S. It ships at 0.11736, DERIVED in TARIFF-18 from the Eneco residential card for Flanders of September 2026 including 6% VAT: Fluvius distribution for Antwerpen 5,35 plus bijzondere accijns 4,876 plus bijdrage groene stroom en WKK 1,51 c/kWh. The energiebijdrage is 0 since 1 August 2026 - it was merged into the excise, so a figure copied from an older guide would count it twice. ⚠️ CHECK IT AGAINST YOUR OWN DSO. Only the distribution row moves: across the eight Fluvius DSOs it runs from 5,28 c/kWh in Midden-Vlaanderen to 6,70 in West-Vlaanderen, so the Flemish total runs from about 0.117 to 0.131. In Wallonia or Brussels the distribution tariff has a separate day and night rate and does not belong in this field at all - use the levies-by-time-of-day option below instead. ⚠️ CHANGING IT MOVES NO TRADING DECISION: the same amount is added to every hour, so it cancels out of both the cheapest hour and the spread. What it does move is every price you are shown, and the rule that refuses to discharge into an hour whose all-in price is below zero."
+    description: "Grid costs, levies and VAT per kWh, preset for Flanders. Check it against your own grid operator's rates."
   export_price_eur_kwh:
     name: "Tariff · Injection price (EUR/kWh)"
-    description: "What you are paid for feeding a kWh back into the grid, all in. One number rather than a series: no supplier here publishes a dynamic injection curve. In Belgium it is often close to zero, which on its own strongly favours using your own production over exporting it. It may be negative - at midday in summer you can be paying to export."
+    description: "What you are paid per kWh fed into the grid, all in. It may be negative."
   static_profile:
-    name: "Tariff · Fixed or day/night tariff (one line of JSON)"
-    description: "Your fixed or day/night contract, written as a single line of JSON. RECOMMENDED EVEN ON A DYNAMIC CONTRACT: this is what the add-on falls back to when the price feed dies, and with it empty a dead feed leaves the site with no tariff at all. The periods must cover every day type exactly once, with no gap and no overlap - a gap is refused at startup rather than filled in, because an invented price is one a strategy would trade on. A fully fixed tariff is one period covering 00:00-24:00 on all days. Prices are ALL IN; the markup and levies above are not added to them. Note that a window written 22:00-07:00 for mon-fri does NOT cover Saturday morning, so a weekend row is required rather than decorative."
+    name: "Tariff · Fixed or day/night tariff"
+    description: "Your fixed or day/night contract on one line, prices all in, as the documentation shows. Fill it in even on a dynamic contract, as the fallback."
   price_taxes_profile:
-    name: "Tariff · Levies and VAT by time of day (one line of JSON)"
-    description: "Leave this empty unless your network tariff really does charge a different day and night rate - in Flanders it does not, Fluvius distribution is one rate, and the flat figure above is correct. In Wallonia and Brussels it does: ORES charges 13,27 c/kWh by day against 7,39 at night, AIESH 15,17 against 8,21, Sibelga 9,39 against 7,10. Written as a single line of JSON in exactly the same shape as the fixed or day/night tariff above, with the same rule that the periods must cover every day type once with no gap and no overlap. ⚠️ THE NUMBERS HERE ARE THE LEVIES ALONE, NOT A FULL PRICE - the add-on adds them to whatever your price source publishes, exactly as it adds the flat figure. Why it matters: a flat figure is the same in every hour, so it moves every hour equally and cannot change which hour is cheapest - and a night network rate is cheap in the same hours the market is cheap, so flattening it makes the add-on think the day is flatter than it is and turn down battery cycles that would have paid for themselves. Set this or the flat figure above, not both: the add-on refuses to start if the two disagree."
+    name: "Tariff · Day/night levies and VAT"
+    description: "Leave it empty unless your grid operator charges a different day and night rate, as in Wallonia and Brussels. Set this or the flat figure above, not both."
   price_formula:
-    name: "Tariff · Your own tariff formula (one line of JSON)"
-    description: "For price source custom_formula only: your own contract's two coefficients, written as a single line of JSON. Your supplier's tariff card prints the formula as B x index + A - those two numbers exist only on your card, there is no public index of them anywhere, and you are the only person who can read them. Type what the card prints, IN THE UNITS THE CARD PRINTS: every unit conversion and the VAT step are the add-on's job, because those are the two places a human silently loses a factor of 10, 100 or 1.06. Example: {\"index\":\"epex_be\",\"resolution\":\"hourly\",\"factor\":0.102,\"offset\":1.00,\"units\":\"c_eur_per_kwh\",\"vat_pct\":6,\"card\":{\"month\":\"2026-09\",\"index_eur_per_mwh\":133.9905,\"expect_incl_vat\":15.55}}. ⚠️ THE card BLOCK IS REQUIRED AND IT IS WHAT MAKES THIS SAFE: your card also prints the reference index it assumed and the price that comes out, so the add-on recomputes that price from your numbers and REFUSES TO START if it does not come out, telling you by how much. That catches a wrong unit, VAT left out or counted twice, a transposed digit, and the expensive one - network charges folded into the offset, which the add-on would then bill you for a second time. ⚠️ AND ITS LIMIT, IN THE SAME BREATH: it checks your coefficients against your card, not your card against reality, so two numbers copied off the wrong product agree with each other and pass. Fixed numbers only - no expression of any kind is evaluated, and an unrecognised field is refused rather than ignored."
+    name: "Tariff · Your own tariff formula"
+    description: "For custom_formula only. Type the numbers from your supplier's tariff card on one line, as the documentation shows. The add-on checks them against the card."
   price_export_formula:
-    name: "Tariff · Your own INJECTION formula (one line of JSON)"
-    description: "Optional, and only if your supplier pays you a price that moves with the market. Your tariff card has a SECOND formula for what you are paid for the electricity you export, and it is not the first one with a minus in front: Eneco prints `0,1 x BELPEX-H - 1,188` c/kWh for injection against `0,102 x ...` for consumption, and Aspiravi `0,07 x Belpex - 2`. Written in exactly the same shape as your own tariff formula above. ⚠️ INJECTION IS EXEMPT FROM VAT in Belgium while consumption is at 6%, so vat_pct here is normally 0 - that is the one field people copy across from the other formula and get wrong. ⚠️ THE PRICE THIS GIVES CAN BE NEGATIVE, and that is not an error: Eneco pays below zero whenever BELPEX-H is under 11,88 EUR/MWh, which is the middle of a sunny day - you can be charged to export. The add-on accepts that rather than hiding it. The card block is OPTIONAL here and required above, because Eneco prints the injection formula with NO example price beside it and there would be nothing to check your numbers against; if your card does print one, fill it in and the add-on will refuse to start unless your numbers reproduce it. ⚠️ WHAT THIS DOES NOT DO: no part of the add-on trades on an injection price today - it charges cheap to avoid buying dear, and both sides of that comparison are consumption prices. This is what you are shown, and what a future export strategy would read. Leave it empty and the flat injection price above is used, which is what every installation does now."
+    name: "Tariff · Your own injection formula"
+    description: "Optional. The injection formula from your tariff card, in the same shape as your own tariff formula. Leave it empty to use the flat injection price."
   price_csv_path:
     name: "Tariff · Price CSV file"
-    description: "For price source manual_csv only: where in /share the add-on reads your own price file from."
+    description: "For manual_csv only. Where in /share the add-on reads your price file."
   price_feed_url:
     name: "Tariff · Price feed URL override"
-    description: "Leave empty to use the chosen source's own feed. Only a host that source itself declares is accepted, so this cannot be pointed anywhere. WHAT YOU TYPE IS SENT EXACTLY AS WRITTEN: the add-on adds nothing to it, not even the date range it normally asks its own feed for, so an override gets whatever horizon that URL returns - often a single day, with the rest of the plan carried over from yesterday and excluded from price arbitrage. A warning in the log says so on every price refresh. Clear this option to get the full horizon back."
+    description: "Leave it empty to use the source's own feed. An override is sent exactly as typed and often returns only one day."
   price_horizon_h:
-    name: "Tariff · How far ahead to fetch prices (hours)"
+    name: "Tariff · Price look-ahead (hours)"
     description: "How many hours of prices to ask the source for."
   price_timeout_s:
     name: "Tariff · Price request timeout (s)"
-    description: "How long a single request to the price source may take before it is given up on."
+    description: "How long one request to the price source may take before it is given up."
   price_now_entity:
-    name: "Tariff · Current price entity (older price path)"
-    description: "The older way of getting a price, kept because retiring it would take the maintenance cycle's only price signal away from a live installation. The add-on reads this and the average below and derives exactly one thing from them - whether now is cheaper than average - which only the maintenance cycle's cheap-window charging uses. It may not be combined with a dynamic price source."
+    name: "Tariff · Current price entity (older)"
+    description: "The older way to get a price, used only to charge in a cheap window during maintenance. Do not combine it with a dynamic price source."
   price_avg_entity:
-    name: "Tariff · Average price entity (older price path)"
-    description: "The average the current price is compared against. Only meaningful together with the current-price entity above, and like it, may not be combined with a dynamic price source."
+    name: "Tariff · Average price entity (older)"
+    description: "The average the current price is compared with. Use it only with the current price entity, not with a dynamic price source."
   arbitrage_enabled:
     name: "Tariff · Trade on the price spread"
-    description: "Charge in the cheapest published hour and discharge in the dearest, but only when the spread covers what the round trip costs. OFF in the shipped configuration, deliberately: this is the first strategy in the add-on that moves energy against the meter on purpose, so it is armed on purpose or not at all. ⚠️ LEAVING IT OFF DOES NOT TURN THE PRICE FEED OFF. A price source selected above is fetched, checked and recorded either way; this switch decides only whether the add-on ACTS on those prices. It needs both a price source and a P1 meter, and the add-on refuses the combinations that cannot work rather than letting them look armed."
+    description: "Charge in the cheapest hour and draw the battery down in the dearest, when the spread covers the cost. Turning it off does not turn the price feed off."
   cycle_cost_threshold_eur:
-    name: "Tariff · Cost of one full charge/discharge cycle (EUR/kWh)"
-    description: "What one full round trip costs per kWh: wear on the pack plus conversion losses. A price spread smaller than this loses money and battery life, so it is not traded. ⚠️ THIS ONE IS NOT DERIVED FROM A MEASUREMENT. 0.10 is a product decision and it is still an open question with the owner (OPT-08). At this value a fixed day/night site does not trade at all - the realistic Belgian day/night spread is about 0.08 EUR/kWh - and that is the correct verdict at this number, not a fault."
+    name: "Tariff · Battery cycle cost (EUR/kWh)"
+    description: "What one full battery cycle costs per kWh. A smaller price spread is not traded, and the value is a product choice, not a measured one."
   arbitrage_soc_floor:
-    name: "Tariff · Trading may not discharge below (%)"
-    description: "The reserve price trading may not spend. Deliberately not the same key as the maintenance floor: pointing a trading strategy at the monthly balancing cycle's numbers would couple two unrelated policies through one setting."
+    name: "Tariff · Trading keeps at least (%)"
+    description: "Price trading will not draw the battery below this level. It is separate from the maintenance settings."
   arbitrage_soc_ceiling:
-    name: "Tariff · Trading may not charge above (%)"
-    description: "The headroom price trading may not fill. The counterpart of the trading floor above, and kept separate from the maintenance target for the same reason."
+    name: "Tariff · Trading charges at most (%)"
+    description: "Price trading will not charge the battery above this level."
   maintenance_enabled:
     name: "Maintenance · Run the monthly battery cycle"
-    description: "A deliberate deep discharge followed by a full recharge and a hold, so the battery management system can recalibrate its charge estimate and balance the cells. Off by default."
+    description: "Once a month, empty the battery deeply, charge it full and hold it there, so its level reading stays accurate. Off by default."
   maintenance_interval_days:
     name: "Maintenance · Minimum days between cycles"
     description: "The shortest gap between two maintenance cycles."
   maintenance_start_hour:
-    name: "Maintenance · Hour of day a due cycle starts"
-    description: "Local hour, 0 to 23, at which a cycle that has become due begins."
+    name: "Maintenance · Start hour"
+    description: "The local hour, 0 to 23, at which a due cycle starts."
   maintenance_discharge_w:
-    name: "Maintenance · Discharge rate (W)"
-    description: "How fast the cycle drains the pack; the surplus is exported. Above the inverter rating it is CLAMPED to the rating rather than refused - the cycle still completes, just more slowly, and the status page says so. It ships at 2000 to match the shipped rating; raise the rating first, then this."
+    name: "Maintenance · Draw-down rate (W)"
+    description: "How fast the cycle empties the battery. Above “Inverter rating” it is cut back to the rating, and the cycle just takes longer."
   maintenance_charge_w:
     name: "Maintenance · Recharge rate (W)"
-    description: "⚠️ MUST STAY AT OR BELOW the inverter rating, and the add-on refuses to start otherwise. Above it, the cheap-window charge shaping asks for more than the supervised limit allows, the arbiter resolves that contradiction to 0 W, and maintenance would silently never charge in a cheap window on a default installation. It is also capped again by whatever headroom the peak guard leaves."
+    description: "How fast the cycle recharges the battery. It must be at or below “Inverter rating”, or the add-on will not start."
   maintenance_soc_floor:
-    name: "Maintenance · Discharge down to (%)"
-    description: "The depth the monthly recalibration deliberately goes to, once a month, on purpose. ⚠️ THIS IS NOT THE PEAK GUARD'S FLOOR: that one is the depth a money-saving discharge may never reach on any day. The right values genuinely differ - 11 here against 20 there - which is why they are two separate settings and must not be merged."
+    name: "Maintenance · Draw down to (%)"
+    description: "The level the monthly cycle empties the battery to. It is not the “Peak reserve”, and the two differ on purpose."
   maintenance_soc_target:
     name: "Maintenance · Recharge up to (%)"
-    description: "The level the recharge phase aims for before the hold begins."
+    description: "The level the recharge aims for before the hold starts."
   maintenance_hold_min:
     name: "Maintenance · Hold at full for (minutes)"
-    description: "How long to sit at the target so the battery management system can finish balancing the cells."
+    description: "How long the battery stays full so its cells can balance."
   sign_disagree_w:
-    name: "Safety · Sign watchdog threshold (W) — measured, do not change"
-    description: "MEASURED, NOT CHOSEN (SAFETY-02). Both the setpoint being emitted and the grid reading must exceed this before their opposite signs count as a disagreement at all. On the captured healthy day (2026-08-23) sign agreement over the gated samples is 93.4 %; on the captured fault day (2026-08-20) the clusters run 0.0-10.5 % with opposed runs up to 1752 s. There is no reason to move this without a new capture that says so. It must stay below the inverter rating or the watchdog can never fire, and the add-on refuses that configuration."
+    name: "Safety · Wrong-direction threshold (W)"
+    description: "Part of the safety stop for an inverter pushing the wrong way. It counts only when command and meter reading both exceed this. Measured value, leave it unchanged."
   sign_disagree_s:
-    name: "Safety · Sign watchdog hold (s) — measured, do not change"
-    description: "MEASURED, NOT CHOSEN (SAFETY-02). How long the setpoint and the meter must stay opposed, continuously, before the add-on commands 0 W and latches until an operator starts control again. 180 s sits in the middle of a very wide measured gap: the longest legitimate opposed run on the healthy day is 30 s, while the fault day still trips 13 times at 300 s. Do not change it without a new capture."
+    name: "Safety · Wrong-direction time (s)"
+    description: "How long a wrong direction may last before a safety stop sets every inverter to 0 W. Measured value, leave it unchanged."
   unit_sign_disagree_w:
-    name: "Safety · Per-inverter sign threshold (W) — derived, do not change"
-    description: "TWO OR MORE INVERTERS ONLY; with one inverter this setting does nothing at all. DERIVED FROM 1890 CLOSED-LOOP TEST RUNS on the two-master rig (SAFETY-30), in which nothing was faulty, swept across the whole range this add-on accepts for loop gain and slew rate. 250 W is exactly half the saturation threshold, so the smallest divergence this can see is precisely the gap at which the control law itself already says the inverter is not following. Do not change it without re-deriving it. It must stay below the inverter rating or it can never fire."
+    name: "Safety · Per-inverter wrong-direction threshold (W)"
+    description: "For two or more inverters: the wrong-direction threshold for each inverter. Derived value, leave it unchanged."
   unit_sign_disagree_s:
-    name: "Safety · Per-inverter sign hold (s) — derived, do not change"
-    description: "TWO OR MORE INVERTERS ONLY. DERIVED FROM 1890 CLOSED-LOOP TEST RUNS (SAFETY-30): 85 s is 8.5 times the worst legitimate opposition those runs produce (10.0 s), 2.8 times the firmware's own 30 s link veto, and under half the 180 s the site-wide check takes. Do not change it without re-deriving it."
+    name: "Safety · Per-inverter wrong-direction time (s)"
+    description: "For two or more inverters: how long one inverter may push the wrong way before it is set to 0 W. Derived value, leave it unchanged."
   site_sign_disagree_w:
-    name: "Safety · Site-wide sign threshold (W) — measured, do not change"
-    description: "TWO OR MORE INVERTERS ONLY. The same 300 W as the single-inverter threshold, CARRIED ACROSS DELIBERATELY (SAFETY-30): the argument behind it does not depend on how many inverters there are - near zero the sign is noise, the deadband is 15 W, and there is one meter whatever is behind it. Do not change it without a capture that says so."
+    name: "Safety · Site wrong-direction threshold (W)"
+    description: "For two or more inverters: the wrong-direction threshold for the whole site. Measured value, leave it unchanged."
   site_sign_disagree_s:
-    name: "Safety · Site-wide sign hold (s) — derived, do not change"
-    description: "TWO OR MORE INVERTERS ONLY. DERIVED FROM 1890 CLOSED-LOOP TEST RUNS (SAFETY-30), and deliberately NOT carried across from the single-inverter 180 s. On those runs the worst legitimate opposition at 300 W is 110 s with one inverter and 215 s with two, because the command has to travel the whole site rail at a slew rate that is not the site's - so carrying 180 s across would have shipped a false trip reachable at the lowest gain and slew with an ordinary 2.2 kW load reversal. 325 s is 1.51 times that, still inside the 900 s billing quarter, and still inside every episode of the captured fault day. Do not change it without re-deriving it."
+    name: "Safety · Site wrong-direction time (s)"
+    description: "For two or more inverters: how long the whole site may push the wrong way before a safety stop. Derived value, leave it unchanged."
   meter_freeze_s:
-    name: "Safety · Frozen-meter alarm after (s) — measured, do not change"
-    description: "MEASURED, NOT CHOSEN (SAFETY-18). How long the meter may keep answering with an UNCHANGED reading, while the command stands at the rail, before the add-on raises an alarm. Over 2399 s of this house at its settled operating point - 1194 polls, 735 of them repeating the previous reading - the longest run without a distinct reading is 15.4 s; 300 s is 19.5 times that and still inside the 900 s billing quarter. ALARM ONLY: it does not command 0 W and does not latch. ⚠️ Only the homewizard_local meter source can see this at all; on every other source the status page says NOT COVERED rather than armed. Do not change it without re-deriving it."
+    name: "Safety · Stuck meter alarm after (s)"
+    description: "An alarm when the meter repeats one reading this long while the command is at full power, with homewizard_local only. Measured value, leave it unchanged."
   circulation_w:
-    name: "Safety · Circulating-power threshold (W) — measured, do not change"
-    description: "TWO OR MORE INVERTERS ONLY; with one inverter the quantity is identically zero. Two inverters pushing against each other net out to zero at the meter and are invisible to every other guard in this add-on. MEASURED ON 924 CLOSED-LOOP TEST RUNS in which nothing was faulty (SAFETY-31): the worst legitimate opposition collapses from 505 s at a 100 W threshold to 5 s at 400 W, and 400 W is the sharp knee this add-on will not let you go below - under it, ordinary operation holds the sensor over the threshold for minutes and nothing shorter than the billing quarter could tell that from a fault. 700 W is 1.75 times the knee, and the extra margin is there because the second inverter's ramp and lag are still copied from the first one rather than measured. Do not change it without re-deriving it."
+    name: "Safety · Opposing inverters threshold (W)"
+    description: "For two or more inverters: how much power one may push against another before it counts. Measured value, leave it unchanged."
   circulation_hold_s:
-    name: "Safety · Circulating-power hold (s) — derived, do not change"
-    description: "TWO OR MORE INVERTERS ONLY. DERIVED (SAFETY-31): 75 s is fifteen control cycles - 15 times the worst legitimate episode the rig can produce, 2.5 times the firmware's own 30 s link veto, and twelve times inside the 900 s billing quarter. It is deliberately not a round 60 or 120, which would be a guess wearing a measurement's clothes. Do not change it without re-deriving it."
+    name: "Safety · Opposing inverters time (s)"
+    description: "For two or more inverters: how long they may push against each other before a safety stop. Derived value, leave it unchanged."
   delivery_hold_s:
-    name: "Safety · Not-delivering report after (s) — derived, do not change"
-    description: "TWO OR MORE INVERTERS ONLY; with one inverter this check cannot fire at all, and that is deliberate rather than a limitation. How long ONE inverter may stand at a discharge share it is not producing - short by more than the saturation threshold, with nothing this add-on can read to explain it - while at least one sibling is NOT in that state, before it is named. REPORTS ONLY (SAFETY-42): nothing is commanded differently, the loop is untouched, and the site goes on running short by that unit's share until you look. DERIVED FROM 2640 CLOSED-LOOP TEST RUNS in which nothing was faulty (SAFETY-42, plus a one-inverter arm as the control, which reports nothing at any threshold): the worst legitimate episode those runs produce is 35.0 s, and the ceiling is the 900 s quarter that bills the capacity tariff. 185 s is 5.29 times that. ⚠️ The schema lets you set this as low as 30 s, which is BELOW that measured 35.0 s - at 30 s you should expect reports on legitimate saturation. The second inverter in those tests is a COPY OF THE FIRST, because the second inverter does not exist yet: what a unit four times slower would produce (75.0 s) is a sensitivity study on that idea, not a measurement of any real second inverter. Do not change it without re-deriving it - and it can be re-derived now: admin/goodwe sim/delivery_window.py --campaign --blag (TEST-21). A pack at or below its own bms_soc_floor is never reported: an empty pack and a wedged one are identical watt for watt, and that setting is the only thing that tells them apart - so if this fires on a pack you believe is empty, that setting does not describe your battery."
+    name: "Safety · Not delivering alarm after (s)"
+    description: "For two or more inverters: how long one may fall short of its share before an alarm, which changes nothing. Derived value, leave it unchanged."
   shadow_mode:
-    name: "Safety · Shadow mode — run every decision, command nothing"
-    description: "Runs the whole decision path — strategies, arbiter, clamps and guards — and sends NOTHING to the inverter. Every inverter is held at 0 W, refreshed on the ordinary heartbeat, and the status page says plainly that the battery is not being controlled; the decision it WOULD have commanded, and why, is on the status page and in the action log. This is how you watch a site for a day before letting it trade. 'auto' (the shipped value) means shadow mode while control is stopped and ordinary control once you press Start — so a NEW install observes before it ever commands anything, and an install that is already controlling is not changed by one watt. 'on' means shadow mode always, whatever the Start / stop button says: that is the setting to pick when you want the loop and the strategies running on a live site with nothing reaching the battery. 'off' is ordinary control. ⚠️ While this is on the battery is NOT being regulated — the grid is not held at zero, no arbitrage trade is executed and no capacity peak is shaved. ⚠️ A failsafe latch that was already up stays up: shadow mode does not clear it, and the banner names it."
+    name: "Safety · Shadow mode"
+    description: "The add-on makes every decision but keeps every inverter at 0 W. 'auto' does this while control is stopped, 'on' always, 'off' never."
   auto_start:
-    name: "Advanced · Start controlling automatically on boot"
-    description: "Off by default. Leave it off until the site has been commissioned: with it off, somebody has to press Start after every restart of the add-on, which is what you want while you are still checking signs and entities."
+    name: "Advanced · Start control on boot"
+    description: "Off by default. Leave it off until the site is commissioned, so someone presses Start after each restart."
   gain:
-    name: "Advanced · Loop gain"
-    description: "How much of the remaining error the loop corrects each cycle. MEASURED ON REAL HARDWARE and already at the limit - do not raise it. Lower is slower and safer."
+    name: "Advanced · Control gain"
+    description: "How much of the remaining error control corrects each cycle. Measured on real hardware, do not raise it."
   slew_w:
     name: "Advanced · Largest change per cycle (W)"
-    description: "How far the setpoint may move in one control cycle. ⚠️ 0 MEANS FOLLOW THE INVERTER RATING and is the recommended setting: the limit becomes about a ninth of the rating, so the loop takes the plant's own MEASURED settling time to cross its whole output range and the number cannot be left behind when the rating changes. DERIVED (SAFETY-39) from an ~18 s measured step response against a 2 s meter tick. A fixed number is accepted and is never silently reduced, but a number faster than the rating allows is refused at startup - at 1000 W against a 5000 W rating this loop drove the meter from 3.4 kW of export to 2.8 kW of import on 2026-09-05. Lower is always accepted."
+    description: "How far the command may move in one cycle. 0 follows “Inverter rating” and is recommended."
   deadband_w:
-    name: "Advanced · Deadband (W)"
-    description: "Errors smaller than this are ignored. ⚠️ The deadband is a one-way ratchet: any resting point inside it holds forever, and the meter's import register counts every positive watt with no export to cancel it - which is exactly why the resting point below is slightly negative."
+    name: "Advanced · Ignore errors below (W)"
+    description: "Errors smaller than this are ignored. Keep it small, since any resting point inside it holds."
   target_grid_w:
-    name: "Advanced · Resting point at the meter (W)"
-    description: "What the meter should sit at when nothing is happening; negative means a slight export. -10 W is deliberate: resting at 0 W leaks about half the deadband in billed import all day - roughly 0.2 to 0.35 kWh at a 15 W deadband - and biasing the rest point below zero moves that leak into the export register, which is not billed. It costs about this many watts of given-away export, so keep it small."
+    name: "Advanced · Meter resting point (W)"
+    description: "What the meter should show when nothing happens. A slight export avoids paying for tiny imports all day."
   step_w:
-    name: "Advanced · Setpoint quantisation (W)"
-    description: "The setpoint is rounded to a multiple of this before it is written, so the inverter is not handed a new number for every watt of noise."
+    name: "Advanced · Command rounding (W)"
+    description: "The command is rounded to a multiple of this, so noise does not change it every cycle."
   saturation_w:
-    name: "Advanced · Saturation threshold (W)"
-    description: "The gap between what was commanded and what the inverter delivers that counts as 'this inverter is at a limit'. ⚠️ The per-inverter sign threshold under Safety is derived as exactly half of this, so moving this moves that measurement's argument with it."
+    name: "Advanced · At-limit shortfall (W)"
+    description: "When an inverter delivers this much less than asked, it counts as at its limit. The per-inverter wrong-direction threshold is half of this."
   saturation_cycles:
-    name: "Advanced · Saturated cycles before freezing (count)"
-    description: "How many consecutive saturated cycles before the loop stops winding up. ⚠️ Do not set this to 1: a single noisy cycle would then freeze the loop."
+    name: "Advanced · Cycles at limit before freezing"
+    description: "How many cycles in a row at the limit before control stops building up error. Do not set it to 1."
   integrator_max_w:
-    name: "Advanced · Integrator bound (W, 0 means the same as the rating)"
-    description: "Caps how much stale error can be waiting to unwind when the sign flips. MEASURED on the closed-loop simulator with a 4000 W load dropped to zero: at a bound equal to the rating the command is 1000 W two cycles later, at 1.5 times the rating it is 1800 W. ⚠️ Do not raise it above the inverter rating - the output clamp already bounds what reaches the wire, so extra headroom buys nothing but wrong-direction watts after every saturation event. Lowering it below the rating is the useful direction, and the only reason this is a separate setting."
+    name: "Advanced · Catch-up limit (W)"
+    description: "Limits how hard control keeps pushing while the battery falls behind. 0 means “Inverter rating”. Do not raise it above the rating."
   heartbeat_s:
-    name: "Advanced · Setpoint refresh interval (s)"
-    description: "How often the setpoint is rewritten even when it has not changed. It must stay well under the firmware's own watchdog, which vetoes a link that has been quiet for 30 s."
+    name: "Advanced · Command refresh interval (s)"
+    description: "How often the command is sent again even when unchanged. Keep it well under the control board's own 30 s limit."
   stale_input_s:
-    name: "Advanced · Command 0 W after inputs missing for (s)"
-    description: "How long the inputs may be missing before the add-on commands 0 W. With a P1 meter this clock starts only AFTER the meter staleness limit has already expired, so the two stack: the total is longer than this number on its own."
+    name: "Advanced · Missing inputs time limit (s)"
+    description: "How long inputs may be missing before every inverter is set to 0 W. With a P1 meter it starts after “Reading too old after”."
   cycle_floor_s:
-    name: "Advanced · Longest gap between control cycles (s)"
-    description: "A deadline on the gap between cycles, reset by every cycle. On a healthy meter it never elapses and changes nothing. Raise it only if your meter is slower than about 10 s, and keep it under the meter staleness limit - past that there is no reading left to evaluate anyway."
+    name: "Advanced · Longest time between cycles (s)"
+    description: "A deadline between control cycles that a healthy meter never reaches. Raise it only for a meter slower than about 10 s."
   log_level:
     name: "Advanced · Log level"
-    description: "How much detail the add-on writes to its log. 'info' is the shipped setting; 'debug' and 'trace' are for diagnosing a problem and are noisy."
+    description: "How much detail the add-on writes to its log. 'debug' and 'trace' are for finding a problem."
diff --git a/goodwe_controller/translations/nl.yaml b/goodwe_controller/translations/nl.yaml
index 50fc5d4..a4f910b 100644
--- a/goodwe_controller/translations/nl.yaml
+++ b/goodwe_controller/translations/nl.yaml
@@ -16,264 +16,281 @@
 # volgorde van het `schema:`-blok van config.yaml; de volgorde hieronder is
 # alleen een spiegel daarvan, zodat beide bestanden gelijk lezen.
 #
-# ⚠️ AFGELEIDE CONSTANTEN VERMELDEN WAAR ZE VANDAAN KOMEN. Het tabblad toont een
-# getal dat uit 1890 gesloten-lustests komt en het omvormervermogen van de
-# eigenaar als hetzelfde soort veld. De beschrijving is de enige plek waar dat
-# verschil gezegd kan worden.
+# Namen en beschrijvingen volgen STYLE.md (UX-08): een kort label met de
+# eenheid, en een of twee eenvoudige zinnen. Waar een gemeten of afgeleide
+# waarde vandaan komt, staat in DOCS.md onder "For installers".
 configuration:
   setpoint_entity:
     name: "Hardware · Setpoint-entiteit van de omvormer"
-    description: "De ESPHome number-entiteit waar deze add-on het vermogen naartoe schrijft, meestal number.*_goodwe_setpoint_w. Dit is het enige wat de add-on aanstuurt. Laat leeg als u hieronder de lijst met omvormers invult: een installatie met een lijst mag niet óók één losse aansturing hebben, en de add-on start dan niet op."
+    description: "De ESPHome-entiteit waar de add-on het vermogen van de omvormer naartoe schrijft. Laat dit leeg als u de lijst met omvormers invult."
   soc_entity:
-    name: "Hardware · Entiteit met het laadniveau van de batterij (%)"
-    description: "De sensor die de laadtoestand van de batterij in procent doorgeeft. Gebruik de meting van de ESP32 zelf, geen waarde die elders berekend wordt. De onderhoudscyclus en alle ondergrenzen voor het laadniveau lezen deze sensor."
+    name: "Hardware · Entiteit laadniveau (%)"
+    description: "De sensor met het laadniveau van de batterij in procent. Gebruik de meting van de stuurmodule zelf."
   batt_entity:
-    name: "Hardware · Entiteit met het batterijvermogen (W)"
-    description: "De sensor die het batterijvermogen van deze omvormer doorgeeft, positief bij ontladen. Op deze installatie is dat holding register 0x0518, uitgelezen door de ESP32. Zowel de tekenbewaking als het alarm voor rondpompend vermogen beoordelen de omvormer aan de hand van deze meting."
+    name: "Hardware · Entiteit batterijvermogen (W)"
+    description: "De sensor met het batterijvermogen van deze omvormer. Positief moet betekenen dat de batterij stroom levert."
   batt_invert:
-    name: "Hardware · Teken van het batterijvermogen omkeren"
-    description: "Zet dit alleen aan als uw sensor ontladen als een negatief getal doorgeeft. De add-on gaat ervan uit dat positief ontladen betekent."
+    name: "Hardware · Teken batterijvermogen omkeren"
+    description: "Zet dit alleen aan als uw sensor het leveren van stroom als een negatief getal toont."
   inverters:
-    name: "Hardware · Lijst met omvormers (leeg laten bij één omvormer)"
-    description: "Laat dit leeg tenzij er echt meer dan één omvormer staat. LEEG BETEKENT NIET 'nog niet ingesteld': het betekent dat de vier entiteiten hierboven, samen met het omvormervermogen en de uitschakelgrens van de batterij onder Grenzen, de ene omvormer beschrijven die u hebt. Dat is wat elke bestaande installatie leest, zonder dat iemand iets hoeft aan te passen. Vult u de lijst wel in, dan VERVANGT die de instellingen hierboven in plaats van ze aan te vullen, en wordt er niets overgenomen: elk item moet zijn eigen aansturing, zijn eigen vermogen en zijn eigen uitschakelgrens vermelden, zodat geen enkele omvormer ooit beoordeeld wordt op de cijfers van een andere. De losse setpoint-entiteit hierboven moet dan leeg blijven."
+    name: "Hardware · Lijst met omvormers"
+    description: "Laat dit leeg als u één omvormer hebt. Hebt u er meer, voeg dan per omvormer een item toe. De lijst vervangt dan de instellingen hierboven."
     fields:
       name:
         name: "Naam"
-        description: "Een korte aanduiding voor deze omvormer, bijvoorbeeld inverter-a. Ze geeft deze omvormer een eigen naamruimte voor haar veiligheidsvergrendeling, hartslag en schrijfadministratie in het statusbestand van de add-on, dus twee omvormers mogen er niet één delen."
+        description: "Een korte, unieke naam voor deze omvormer, bijvoorbeeld inverter-a."
       setpoint_entity:
         name: "Setpoint-entiteit"
-        description: "De eigen ESPHome-entiteit number.*_goodwe_setpoint_w van deze omvormer. Twee items mogen niet dezelfde entiteit noemen - twee schrijvers op één aansturing wordt bij het opstarten geweigerd."
+        description: "De eigen ESPHome-setpoint-entiteit van deze omvormer. Twee items mogen niet dezelfde gebruiken."
       max_w:
         name: "Vermogen van deze omvormer (W)"
-        description: "De bewaakte bovengrens van wat er naar DEZE omvormer geschreven mag worden; het plafond van de installatie is de som over de lijst. Verplicht bij elk item: een item zonder deze waarde zou een vermogen moeten lenen, en een omvormer beoordelen op de cijfers van een andere is precies de fout die deze lijst per omvormer moet wegnemen."
+        description: "Het hoogste vermogen dat de add-on aan deze omvormer mag vragen. Het totaal van de installatie is de som van de lijst."
       bms_soc_floor:
         name: "Uitschakelniveau van de batterij (%)"
-        description: "Het percentage waarbij het batterijmanagementsysteem van DEZE batterij uitschakelt. Lees dit af van de batterij die er werkelijk staat (register 0x0560) voordat die batterij ooit aangestuurd wordt; neem geen waarde van een andere omvormer over. Bewust verplicht bij elk item: optioneel maken zou neerkomen op een standaardwaarde, en één standaardwaarde voor twee verschillende batterijen beschermt de kleinste batterij met het getal van de grootste."
+        description: "Het niveau waarop het beheersysteem van deze batterij stopt met leveren. Lees het af van de batterij die er staat."
       soc_entity:
-        name: "Entiteit met het laadniveau (%) (optioneel)"
-        description: "Het laadniveau van deze batterij zelf. Laat leeg als deze omvormer dat niet doorgeeft - dat is wat het betekent, en er wordt nooit teruggevallen op de sensor van een andere omvormer."
+        name: "Entiteit laadniveau (%) (optioneel)"
+        description: "De eigen sensor voor het laadniveau van deze batterij. Laat leeg als deze omvormer er geen heeft."
       batt_entity:
-        name: "Entiteit met het batterijvermogen (W) (optioneel)"
-        description: "Het batterijvermogen van deze omvormer zelf, positief bij ontladen. Laat leeg als deze omvormer dat niet doorgeeft; er wordt niets van een ander item overgenomen."
+        name: "Entiteit batterijvermogen (W) (optioneel)"
+        description: "De eigen sensor voor het batterijvermogen van deze omvormer. Laat leeg als die er niet is."
       batt_invert:
-        name: "Teken van het batterijvermogen omkeren (optioneel)"
-        description: "Alleen voor dit item: zet dit aan als de sensor van deze omvormer ontladen als een negatief getal doorgeeft."
+        name: "Teken batterijvermogen omkeren (optioneel)"
+        description: "Zet dit aan als de sensor van deze omvormer leveren als een negatief getal toont."
       capacity_kwh:
-        name: "Bruikbare capaciteit van de batterij (kWh) (optioneel)"
-        description: "De bruikbare capaciteit van DEZE batterij in kilowattuur, van het datablad of het typeplaatje. Ze wordt voor één ding gelezen: het verdelen van de doelwaarde van de installatie over de omvormers volgens hoeveel ENERGIE elke batterij nog heeft, in plaats van volgens het vermogen waarvoor ze gebouwd is. De twee batterijen op de referentiesite zijn 5000 W met 15,36 kWh en 4600 W met 20,48 kWh, dus die twee manieren van verdelen wijzen het werk aan verschillende batterijen toe, en de energieverdeling is de juiste vraag. Optioneel: laat leeg en de add-on heeft geen voorkeur en verdeelt gelijk, precies zoals voordien. Vul ze in bij ELKE omvormer of bij geen enkele - een batterij in kWh naast een batterij zonder waarde is geen vergelijking, en de add-on start liever niet op dan de helft van wat u invulde te negeren."
+        name: "Bruikbare capaciteit (kWh) (optioneel)"
+        description: "De bruikbare capaciteit van deze batterij, van het datablad. Vul ze bij elke omvormer in of bij geen. Dan verdeelt de add-on het werk volgens de energie in elke batterij."
   estop_fitted:
     name: "Hardware · RS485-noodstop is geplaatst"
-    description: "Of de RS485-noodstop fysiek geïnstalleerd is. Dit stuurt alleen de waarschuwingsbalk op de statuspagina aan en verandert niets aan de regeling."
+    description: "Zet dit aan als de noodstop geïnstalleerd is. Het verandert alleen een waarschuwing op de statuspagina."
+  battery_modes_enabled:
+    name: "Hardware · Batterijmodi"
+    description: "Geef elke batterij een aan- en uitschakelaar en een modus, in te stellen op het scherm Batterijen."
+  pv_forecast_entity:
+    name: "Hardware · Zonneprognose, vandaag (kWh)"
+    description: "Optioneel. Een prognosesensor met de zonne-energie die vandaag nog komt, zoals Forecast.Solar of Solcast. Een batterij koopt dan alleen wat de zon niet geeft."
+  pv_forecast_tomorrow_entity:
+    name: "Hardware · Zonneprognose, morgen (kWh)"
+    description: "Optioneel. Dezelfde prognose voor morgen. Ze helpt een goedkoop uur voor middernacht te plannen."
+  solar_trust_pct:
+    name: "Hardware · Vertrouwen in de prognose (%)"
+    description: "Prognoses zijn vaak te zonnig. Bij 70 % plant de add-on met 7 van elke 10 kWh uit de prognose."
   pv_entity:
-    name: "Hardware · Zonneproductie-entiteit (W)"
-    description: "Optioneel, en UITSLUITEND EEN METING - het verandert niets aan de regeling. Verwijs naar de vermogenssensor van je omvormer (elk merk dat Home Assistant kan lezen; hij hoeft niet op de RS485-bus te zitten) en de add-on registreert de productie naast de meter- en batterijwaarden, zodat een dag met niet-opgeslagen overschot te onderscheiden is van een dag zonder zon. POSITIEF MOET PRODUCEREN BETEKENEN. De eenheid wordt van de entiteit zelf gelezen - W, kW en de overige vermogenseenheden van Home Assistant - dus een sensor zonder eenheid wordt geweigerd in plaats van geraden, en de statuspagina zegt waarom. Laat leeg en er wordt niets gelezen, niets gepubliceerd en niets getoond."
+    name: "Hardware · Entiteit zonneproductie (W)"
+    description: "Optioneel. De vermogenssensor van uw zonne-omvormer, positief tijdens productie. De add-on houdt ze bij en regelt er niet mee."
   pv_entities:
-    name: "Hardware · Zonneproductie-entiteiten, één per omvormer (W)"
-    description: "Optioneel, en UITSLUITEND EEN METING - het verandert niets aan de regeling. Gebruik dit in plaats van de losse entiteit hierboven wanneer uw dak MEERDERE zonne-omvormers heeft: voeg één rij per omvormer toe, elk verwijzend naar haar eigen vermogenssensor, en de add-on registreert het totaal van de installatie. De eenheid van elke entiteit wordt afzonderlijk gelezen, dus een omvormer in kW naast een in W telt correct op. ⚠️ ALS U DIT INVULT WORDT DE LOSSE ENTITEIT HIERBOVEN GENEGEERD - maak die leeg, anders verschijnt er een waarschuwing op de statuspagina die dat meldt. ⚠️ EN ALS ÉÉN VAN DEZE ENTITEITEN NIETS MEER DOORGEEFT, IS ER GEEN TOTAAL: de sensor gaat naar 'unknown' en de geschiedenis bewaart een gat, in plaats van de som van de entiteiten die wél antwoordden te publiceren. Twee omvormers van de drie tellen op tot een kleiner getal dat precies op een echt getal lijkt, en een week later leest dat als 'er was minder zon dan er was' - net de conclusie die deze registratie moet kunnen testen. De statuspagina noemt welke entiteit ontbreekt, waarom, en wat de andere doorgaven. Laat leeg en er wordt niets gelezen, niets gepubliceerd en niets getoond."
+    name: "Hardware · Entiteiten zonneproductie, per omvormer (W)"
+    description: "Optioneel. Eén rij per zonne-omvormer, in plaats van de losse entiteit hierboven, als u er meerdere hebt. Valt er één weg, dan wordt er geen totaal bijgehouden."
+  pv_invert_entities:
+    name: "Hardware · Zonne-entiteiten met omgekeerd teken"
+    description: "Optioneel. Zet hier elke zonne-entiteit van hierboven die negatief leest tijdens productie, precies zo gespeld. Het teken wordt omgedraaid voor het optellen."
   meter_source:
     name: "Meter · Waar de meterstand vandaan komt"
-    description: "'off' houdt de losse Home Assistant-entiteit hieronder aan, waar een bestaande installatie op draait tot u iets anders kiest. ha_dsmr luistert mee met de DSMR-integratie; mqtt_p1 leest een MQTT-topic; ha_signed leest één entiteit met teken, wat een HomeWizard P1 publiceert; homewizard_local bevraagt de lokale API van de meter zelf en slaat Home Assistant helemaal over. ⚠️ Alleen homewizard_local kan 'de meter heeft niet geantwoord' onderscheiden van 'de waarde is niet veranderd', en is dus de enige bron waarop het alarm voor een vastgelopen meter iets betekent."
+    description: "Hoe de add-on uw meter uitleest. Met 'off' gebruikt ze de entiteit netvermogen hieronder. Alleen homewizard_local merkt een vastgelopen meter op."
   meter_entity:
-    name: "Meter · Entiteit met het netvermogen (W)"
-    description: "De sensor met het netto netvermogen, gebruikt wanneer de meterbron 'off' is. POSITIEF MOET AFNAME VAN HET NET BETEKENEN. Staat dit omgekeerd, dan stuurt de regeling de batterij de verkeerde kant op; gebruik daarvoor de tekenschakelaar hieronder en geen template-sensor."
+    name: "Meter · Entiteit netvermogen (W)"
+    description: "Gebruikt als de meterbron 'off' is. Positief moet afname van het net betekenen."
   meter_invert:
-    name: "Meter · Teken van het netvermogen omkeren"
-    description: "Zet dit aan als uw netsensor afname van het net als een negatief getal doorgeeft."
+    name: "Meter · Teken netvermogen omkeren"
+    description: "Zet dit aan als uw netsensor afname als een negatief getal toont."
   meter_phases:
     name: "Meter · Aantal fasen (1 of 3)"
-    description: "Moet overeenkomen met uw aansluiting. Een telegram met een ander aantal fasen wordt bij binnenkomst geweigerd en gelogd, zodat een verkeerde waarde meteen zichtbaar wordt als 'geen telegrammen aanvaard' in plaats van als een stil verkeerd getal. Het bereik aanvaardt 2, maar dat is geen echte Belgische aansluiting."
+    description: "Moet overeenkomen met uw aansluiting. Meterstanden met een ander aantal fasen worden geweigerd."
   p1_host:
     name: "Meter · Adres van de HomeWizard P1"
-    description: "Alleen voor meterbron homewizard_local: het adres van de meter zelf op uw netwerk, als host of host:poort, bijvoorbeeld 192.168.2.250."
+    description: "Alleen voor homewizard_local. Het adres van de meter op uw netwerk, als host of host:poort."
   meter_poll_s:
-    name: "Meter · Seconden tussen twee uitlezingen"
-    description: "Alleen voor meterbron homewizard_local. 5 s is het tempo waarin de meter zelf ververst, dus lager instellen levert niets op. Deze waarde moet ruim onder de verouderingsgrens hieronder blijven - de meting is nooit verser dan dit interval - en de add-on start niet op als ze eraan gelijk is of erboven ligt."
+    name: "Meter · Tijd tussen twee uitlezingen (s)"
+    description: "Alleen voor homewizard_local. De meter ververst elke 5 s, lager levert niets op. Houd dit ruim onder de grens voor een te oude meting."
   meter_max_age_s:
-    name: "Meter · Een meting is verouderd na (s)"
-    description: "Daarna geldt de netwaarde als ontbrekend. Op zichzelf stuurt dit nog geen 0 W aan: de teller 'invoer ontbreekt' onder Geavanceerd begint pas te lopen nadat deze verstreken is, en de twee stapelen. 30 s is zes uitlezingen speling bij het standaard uitleesinterval."
+    name: "Meter · Meting te oud na (s)"
+    description: "Daarna telt een meterstand als ontbrekend. De tijdslimiet voor ontbrekende invoer begint pas daarna te lopen."
   meter_mqtt_topic:
     name: "Meter · MQTT-topic"
-    description: "Alleen voor meterbron mqtt_p1: het topic waarop de P1-metingen gepubliceerd worden."
+    description: "Alleen voor mqtt_p1. Het topic waarop uw meterstanden verschijnen."
   p1_import_entity:
-    name: "Meter · Entiteit van het afnameregister (W)"
-    description: "Het afnameregister ZONDER teken. Wijs dit niet aan een template-sensor mét teken toe: de add-on berekent het nettovermogen zelf als afname min injectie, zodat de tekenafspraak in geteste code zit en niet in ongecontroleerde YAML."
+    name: "Meter · Entiteit afname (W)"
+    description: "De sensor voor afname van het net, nooit negatief. De add-on berekent het nettovermogen zelf."
   p1_export_entity:
-    name: "Meter · Entiteit van het injectieregister (W)"
-    description: "Het injectieregister ZONDER teken, de tegenhanger van het afnameregister hierboven. Zelfde regel: geen template-sensor mét teken."
+    name: "Meter · Entiteit injectie (W)"
+    description: "De sensor voor injectie in het net, nooit negatief. Hoort bij de entiteit afname hierboven."
   p1_net_entity:
-    name: "Meter · Entiteit met het nettovermogen mét teken (W)"
-    description: "Alleen voor meterbron ha_signed. ÉÉN sensor mét teken: positief is afname van het net, negatief is injectie. Splits die niet in twee template-sensoren op - de add-on doet die splitsing zelf, juist zodat ze getest is."
+    name: "Meter · Entiteit nettovermogen met teken (W)"
+    description: "Alleen voor ha_signed. Eén sensor die positief is bij afname en negatief bij injectie."
   p1_phase_import_entities:
-    name: "Meter · Afname-entiteiten per fase (L1, L2, L3)"
-    description: "Optioneel, in de volgorde L1..L3. Nodig voor de kwartierpiek van het capaciteitstarief op een driefasige aansluiting. Het aantal items moet gelijk zijn aan het aantal fasen hierboven."
+    name: "Meter · Afname-entiteiten per fase (L1-L3)"
+    description: "Optioneel, in de volgorde L1, L2, L3. Nodig voor de piekgrens bij een driefasige aansluiting, één item per fase."
   p1_phase_export_entities:
-    name: "Meter · Injectie-entiteiten per fase (L1, L2, L3)"
-    description: "Optioneel, in de volgorde L1..L3, naast de afname-entiteiten per fase hierboven. Het aantal items moet gelijk zijn aan het aantal fasen."
+    name: "Meter · Injectie-entiteiten per fase (L1-L3)"
+    description: "Optioneel, in de volgorde L1, L2, L3, naast de afname-entiteiten per fase. Eén item per fase."
   p1_phase_net_entities:
-    name: "Meter · Netto-entiteiten per fase mét teken (L1, L2, L3)"
-    description: "Alleen voor meterbron ha_signed. Optioneel, in de volgorde L1..L3, elk met hetzelfde teken als de netto-entiteit hierboven. Zelfde rol als de afname- en injectie-entiteiten per fase: de kwartierpiek van het capaciteitstarief op een driefasige aansluiting. Het aantal items moet gelijk zijn aan het aantal fasen."
+    name: "Meter · Netto-entiteiten per fase (L1-L3)"
+    description: "Alleen voor ha_signed. Optioneel, in de volgorde L1, L2, L3, met hetzelfde teken als de netto-entiteit. Eén item per fase."
   max_w:
     name: "Grenzen · Vermogen van de omvormer (W)"
-    description: "DIT IS UW GETAL, geen afgeleide waarde: de harde bovengrens van wat er ooit gestuurd mag worden, in watt. Zet het op wat uw omvormer werkelijk aankan, begin laag en verhoog het pas na de indienstname. Het wordt helemaal niet gelezen zodra de lijst met omvormers is ingevuld - elk item draagt dan zijn eigen waarde en het plafond van de installatie is hun som. Verschillende veiligheidsdrempels moeten eronder blijven; de add-on start niet op als er één niet aan voldoet."
+    description: "Uw eigen getal: het hoogste vermogen dat de add-on ooit aan de omvormer mag vragen. Begin laag en verhoog het na de indienstname."
   bms_soc_floor:
     name: "Grenzen · Uitschakelniveau van de batterij (%)"
-    description: "GEMETEN, niet gekozen: het percentage waarbij het batterijmanagementsysteem van de batterij ZELF stopt met ontladen, wat u hier ook instelt. Register 0x0560 leest 10 op de referentie-GW5000S-BP. Lees deze waarde af van de batterij die er werkelijk staat in plaats van dit getal over te nemen. Ze staat hier zodat de add-on een ondergrens voor de piekbewaking op of onder deze waarde kan weigeren: zo'n ondergrens kan nooit werken, het BMS wint altijd eerst, en de statuspagina zou een reserve tonen die niet bestaat. Wordt niet gelezen zodra de lijst met omvormers is ingevuld - elk item vermeldt dan de uitschakelgrens van zijn eigen batterij."
+    description: "Het niveau waarop het beheersysteem van de batterij zelf stopt met leveren. Lees het af van uw batterij in plaats van een getal over te nemen."
   peak_cap_w:
-    name: "Grenzen · Streefwaarde capaciteitstarief (W)"
-    description: "DIT IS UW GETAL: het gemiddelde kwartiervermogen waar de piekbewaking onder probeert te blijven. Neem het over uit uw netcontract - in België is dit de kwartierpiek waarop het capaciteitstarief van uw distributiefactuur berekend wordt."
+    name: "Grenzen · Piekgrens (W)"
+    description: "Uw eigen getal: het gemiddelde vermogen per kwartier waaronder de add-on de afname houdt. Neem het over uit uw netcontract."
+  peak_margin_w:
+    name: "Grenzen · Marge onder de piekgrens (W)"
+    description: "De add-on mikt zoveel onder de piekgrens, zodat een kwartier dat iets hoger uitvalt er toch onder blijft."
   peak_forecast_entity:
-    name: "Grenzen · Entiteit met de kwartierprognose (W)"
-    description: "Optioneel. Een prognose van het gemiddelde vermogen in het lopende factuurkwartier. Laat u dit leeg, dan is er helemaal geen piekbegrenzing."
+    name: "Grenzen · Entiteit kwartierprognose (W)"
+    description: "Optioneel. Een prognose van het gemiddelde vermogen in het lopende kwartier. Laat u dit leeg, dan is er geen piekgrens."
   peak_soc_floor:
-    name: "Grenzen · Piekbewaking ontlaadt niet onder (%)"
-    description: "AFGELEID, niet gekozen (SAFETY-24): de referentiebatterij heeft 13,8 kWh bruikbaar en de zwaarste doorgerekende afvlakdag vraagt 878 Wh, oftewel 6,4 %, dus 20 % ligt tien punten boven de uitschakelgrens van de batterij zelf en laat de bewaking nog ongeveer 1,6 van haar zwaarste waargenomen dagen speling. ⚠️ DIT BEGRENST ALLEEN DE PIEKBEWAKING. Het is geen reserve voor de hele batterij: gewoon eigenverbruik ontlaadt er dwars doorheen en gaat door tot aan de uitschakelgrens van de batterij, en dit getal verhogen verandert daar geen tiende procent aan. Het moet strikt boven de uitschakelgrens van de batterij blijven, anders start de add-on niet op. Verander het niet zonder de afleiding opnieuw te maken."
+    name: "Grenzen · Piekreserve (%)"
+    description: "De piekbeperking laat de batterij niet onder dit niveau zakken, gewoon verbruik wel. Afgeleide waarde, laat ze ongewijzigd."
   price_provider:
     name: "Tarief · Bron van dynamische prijzen"
-    description: "Waar day-ahead- of realtimeprijzen vandaan komen. 'off' is de standaardinstelling en betekent dat deze installatie op het vaste tarief hieronder draait, zonder handel. ⚠️ DIT AANZETTEN IS WAT HET OPHALEN VAN PRIJZEN START - niet de handelsschakelaar verderop. Met een bron ingesteld haalt de add-on de feed elk half uur op, controleert die, bewaart de dag en toont op de rij Prijsgeschiedenis wat er bewaard is, of prijshandel nu aan staat of niet. Op zichzelf verplaatst dat nog geen energie: handelen is de aparte schakelaar, en het goedkope venster dat de maandelijkse onderhoudscyclus gebruikt komt uit het vaste of dag/nacht-tarief hieronder. Het mag niet gecombineerd worden met de twee oude Home Assistant-prijsentiteiten verderop: twee prijsbronnen op één installatie, waarvan er stilzwijgend één wint, wordt bij het opstarten geweigerd in plaats van schijnbaar actief gelaten. ⚠️ DRIE IDS IN DEZE LIJST ZIJN INGETROKKEN EN STARTEN NIET MEER: engie_dynamic, totalenergies_dynamic en eneco_eddy. Hun endpoints bestaan niet en hebben nooit bestaan, dus die plugins hebben nooit één prijs opgehaald - een installatie die op zo'n bron stond, draait sindsdien stilzwijgend op het vaste of dag/nacht-tarief hieronder, of op niets. Ze staan hier alleen nog zodat zo'n installatie bij het opstarten die uitleg krijgt in plaats van een onleesbare schemafout. Kies generic_dayahead voor de groothandelscurve met een vaste marge, custom_formula om de coëfficiënten B x index + A van uw eigen contract van uw tariefkaart over te typen, manual_csv voor een bestand dat u zelf schrijft, of off."
+    description: "Waar de prijzen vandaan komen. Een bron kiezen start het ophalen van prijzen, ook als handelen uit staat."
   price_markup_eur_kwh:
     name: "Tarief · Marge van de leverancier (EUR/kWh)"
-    description: "De marge van uw energieleverancier. De add-on telt die ALLEEN op wanneer de gekozen prijsbron ze niet al bevat - bij manual_csv, waarvan de bedragen alles inbegrepen zijn, wordt ze genegeerd, en dat wordt ook gelogd, zodat ze nooit dubbel wordt aangerekend."
+    description: "De marge van uw leverancier. Ze wordt alleen opgeteld als de prijsbron ze nog niet bevat."
   price_taxes_eur_kwh:
     name: "Tarief · Distributie, heffingen en btw (EUR/kWh)"
-    description: "Alles op uw factuur dat niet de energie zelf is - distributie, heffingen, accijns en btw - per kWh, opgeteld volgens dezelfde regel als de marge: alleen wanneer de gekozen prijsbron ze nog niet bevat. ⚠️ DIT GETAL IS GEEN VOORKEUR EN HET IS NIET DAT VAN UW OMVORMER. Het staat standaard op 0.11736, AFGELEID in TARIFF-18 van de Eneco-kaart voor residentiele klanten in Vlaanderen van september 2026, inclusief 6% btw: Fluvius-distributie voor Antwerpen 5,35 plus bijzondere accijns 4,876 plus bijdrage groene stroom en WKK 1,51 c/kWh. De energiebijdrage is sinds 1 augustus 2026 nul - ze is opgegaan in de accijns, dus een bedrag uit een oudere gids telt ze dubbel. ⚠️ CONTROLEER HET BIJ UW EIGEN DISTRIBUTIENETBEHEERDER. Alleen de distributieregel verschilt: over de acht Fluvius-netgebieden loopt die van 5,28 c/kWh in Midden-Vlaanderen tot 6,70 in West-Vlaanderen, zodat het Vlaamse totaal ongeveer van 0.117 tot 0.131 loopt. In Wallonie en Brussel heeft het distributietarief een apart dag- en nachttarief en hoort het hier helemaal niet thuis - gebruik dan de optie voor heffingen per tijdstip hieronder. ⚠️ DIT WIJZIGEN VERANDERT GEEN ENKELE HANDELSBESLISSING: hetzelfde bedrag komt bij elk uur, dus het valt weg uit zowel het goedkoopste uur als het prijsverschil. Wat het wel verandert is elke prijs die u te zien krijgt, en de regel die weigert te ontladen in een uur waarvan de totaalprijs onder nul ligt."
+    description: "Netkosten, heffingen en btw per kWh, ingesteld voor Vlaanderen. Controleer het bij uw eigen netbeheerder."
   export_price_eur_kwh:
     name: "Tarief · Injectievergoeding (EUR/kWh)"
-    description: "Wat u krijgt voor een kWh die u op het net zet, alles inbegrepen. Eén getal en geen reeks: geen enkele leverancier hier publiceert een dynamische injectiecurve. In België ligt dit vaak dicht bij nul, wat op zich al sterk pleit voor eigenverbruik in plaats van injectie. De waarde mag negatief zijn - op een zomerse middag betaalt u soms om te injecteren."
+    description: "Wat u krijgt per kWh die u op het net zet, alles inbegrepen. Dit mag negatief zijn."
   static_profile:
-    name: "Tarief · Vast of dag/nacht-tarief (één regel JSON)"
-    description: "Uw vaste of dag/nacht-contract, geschreven als één regel JSON. AANBEVOLEN ZELFS BIJ EEN DYNAMISCH CONTRACT: hierop valt de add-on terug wanneer de prijsfeed uitvalt, en staat dit leeg dan blijft de installatie bij een dode feed helemaal zonder tarief achter. De periodes moeten elk dagtype precies één keer bedekken, zonder gat en zonder overlap - een gat wordt bij het opstarten geweigerd in plaats van opgevuld, want een verzonnen prijs is er één waarop een strategie zou handelen. Een volledig vast tarief is één periode van 00:00 tot 24:00 op alle dagen. De prijzen zijn ALLES INBEGREPEN; de marge en heffingen hierboven worden er niet bij opgeteld. Let op: een venster van 22:00 tot 07:00 voor ma-vr dekt zaterdagochtend NIET, dus een regel voor het weekend is noodzakelijk en niet decoratief."
+    name: "Tarief · Vast of dag/nacht-tarief"
+    description: "Uw vaste of dag/nacht-contract op één regel, prijzen alles inbegrepen, zoals de documentatie toont. Vul dit ook in bij een dynamisch contract. Het is de reserve als de prijsfeed uitvalt."
   price_taxes_profile:
-    name: "Tarief · Heffingen en btw per dagdeel (één regel JSON)"
-    description: "Laat dit leeg tenzij uw netbeheerder werkelijk een ander dag- en nachttarief aanrekent - in Vlaanderen is dat niet zo, de Fluvius-distributie is één tarief, en het vaste bedrag hierboven klopt. In Wallonië en Brussel is dat wél zo: ORES rekent 13,27 c/kWh overdag tegen 7,39 's nachts, AIESH 15,17 tegen 8,21, Sibelga 9,39 tegen 7,10. Geschreven als één regel JSON in precies dezelfde vorm als het vaste of dag/nacht-tarief hierboven, met dezelfde regel dat de periodes elk dagtype één keer moeten bedekken zonder gat en zonder overlap. ⚠️ DE BEDRAGEN HIER ZIJN ALLEEN DE HEFFINGEN, GEEN VOLLEDIGE PRIJS - de add-on telt ze op bij wat uw prijsbron publiceert, net zoals bij het vaste bedrag. Waarom het uitmaakt: een vast bedrag is in elk uur hetzelfde, verschuift dus elk uur evenveel en kan niet veranderen welk uur het goedkoopste is - en een nachttarief van het net is goedkoop in dezelfde uren waarin de markt goedkoop is, dus door het plat te slaan lijkt de dag vlakker dan hij is en weigert de add-on batterijcycli die zichzelf zouden terugverdienen. Vul dit in óf het vaste bedrag hierboven, niet allebei: de add-on weigert te starten als de twee elkaar tegenspreken."
+    name: "Tarief · Heffingen en btw dag/nacht"
+    description: "Laat dit leeg, tenzij uw netbeheerder een ander dag- en nachttarief rekent, zoals in Wallonië en Brussel. Vul dit of het vaste bedrag hierboven in, niet allebei."
   price_formula:
-    name: "Tarief · Uw eigen tariefformule (één regel JSON)"
-    description: "Alleen voor prijsbron custom_formula: de twee coëfficiënten van uw eigen contract, als één regel JSON. De tariefkaart van uw leverancier drukt de formule af als B x index + A - die twee getallen staan alleen op uw kaart, er bestaat nergens een publieke lijst van, en u bent de enige die ze kan lezen. Typ wat de kaart afdrukt, IN DE EENHEID DIE DE KAART GEBRUIKT: elke eenheidsomrekening en de btw-stap zijn het werk van de add-on, want dat zijn precies de twee plaatsen waar een mens stilzwijgend een factor 10, 100 of 1,06 verliest. Voorbeeld: {\"index\":\"epex_be\",\"resolution\":\"hourly\",\"factor\":0.102,\"offset\":1.00,\"units\":\"c_eur_per_kwh\",\"vat_pct\":6,\"card\":{\"month\":\"2026-09\",\"index_eur_per_mwh\":133.9905,\"expect_incl_vat\":15.55}}. ⚠️ HET BLOK card IS VERPLICHT EN MAAKT DIT VEILIG: uw kaart vermeldt ook de referentie-index die ze veronderstelt en de prijs die eruit volgt, dus de add-on berekent die prijs opnieuw uit uw getallen en START NIET als het resultaat niet klopt - met vermelding van het verschil. Dat vangt een verkeerde eenheid, btw die ontbreekt of dubbel geteld is, een omgewisseld cijfer, en de dure fout: nettarieven die in de offset verwerkt zitten en die de add-on er dan nog een tweede keer bovenop zou rekenen. ⚠️ EN DE GRENS DAARVAN, IN DEZELFDE ZIN: ze toetst uw coëfficiënten aan uw kaart, niet uw kaart aan de werkelijkheid - twee getallen van het verkeerde product kloppen onderling en komen er dus door. Alleen vaste getallen: er wordt geen enkele expressie geëvalueerd, en een onbekend veld wordt geweigerd in plaats van genegeerd."
+    name: "Tarief · Uw eigen tariefformule"
+    description: "Alleen voor custom_formula. Typ de getallen van de tariefkaart van uw leverancier op één regel, zoals de documentatie toont. De add-on controleert ze met de kaart."
   price_export_formula:
-    name: "Tarief · Uw eigen INJECTIEformule (één regel JSON)"
-    description: "Optioneel, en alleen als uw leverancier u een prijs betaalt die met de markt meebeweegt. Op uw tariefkaart staat een TWEEDE formule voor wat u krijgt voor de stroom die u injecteert, en dat is niet de eerste met een minteken ervoor: Eneco drukt `0,1 x BELPEX-H - 1,188` c/kWh af voor injectie tegenover `0,102 x ...` voor afname, en Aspiravi `0,07 x Belpex - 2`. Geschreven in precies dezelfde vorm als uw eigen tariefformule hierboven. ⚠️ INJECTIE IS IN BELGIË VRIJGESTELD VAN BTW terwijl afname op 6% staat, dus vat_pct is hier normaal 0 - dat is het ene veld dat men van de andere formule overneemt en verkeerd invult. ⚠️ DE PRIJS DIE HIERUIT VOLGT KAN NEGATIEF ZIJN, en dat is geen fout: Eneco betaalt onder nul zodra BELPEX-H lager is dan 11,88 EUR/MWh, en dat is het midden van een zonnige dag - u kunt moeten betalen om te injecteren. De add-on aanvaardt dat in plaats van het te verbergen. Het blok card is hier OPTIONEEL en hierboven verplicht, omdat Eneco de injectieformule afdrukt ZONDER voorbeeldprijs ernaast en er dan niets is om uw getallen aan te toetsen; drukt uw kaart er wél een af, vul ze dan in en de add-on start niet als uw getallen die prijs niet reproduceren. ⚠️ WAT DIT NIET DOET: geen enkel onderdeel van de add-on handelt vandaag op een injectieprijs - hij laadt goedkoop op om duur te vermijden, en beide zijden van die vergelijking zijn afnameprijzen. Dit is wat u te zien krijgt, en wat een toekomstige exportstrategie zou lezen. Laat het leeg en de vaste injectieprijs hierboven wordt gebruikt, zoals elke installatie nu doet."
+    name: "Tarief · Uw eigen injectieformule"
+    description: "Optioneel. De injectieformule van uw tariefkaart, in dezelfde vorm als uw eigen tariefformule. Laat leeg om de vaste injectievergoeding te gebruiken."
   price_csv_path:
     name: "Tarief · CSV-bestand met prijzen"
-    description: "Alleen voor prijsbron manual_csv: waar in /share de add-on uw eigen prijsbestand leest."
+    description: "Alleen voor manual_csv. Waar in /share de add-on uw prijsbestand leest."
   price_feed_url:
     name: "Tarief · Afwijkende URL voor de prijsfeed"
-    description: "Laat leeg om de eigen feed van de gekozen bron te gebruiken. Alleen een host die die bron zelf opgeeft, wordt aanvaard, zodat dit niet zomaar ergens naar kan verwijzen. WAT U HIER TYPT WORDT LETTERLIJK VERSTUURD: de add-on voegt er niets aan toe, ook niet het datumbereik dat ze normaal aan haar eigen feed vraagt. Een afwijkende URL levert dus de horizon op die die URL zelf teruggeeft - vaak één dag, waarna de rest van het plan uit de prijzen van gisteren wordt overgenomen en buiten de prijsarbitrage valt. Bij elke prijsvernieuwing verschijnt daarover een waarschuwing in het logboek. Maak dit veld leeg om de volledige horizon terug te krijgen."
+    description: "Laat leeg om de eigen feed van de bron te gebruiken. Een afwijkende URL wordt letterlijk verstuurd en geeft vaak maar één dag terug."
   price_horizon_h:
-    name: "Tarief · Hoe ver vooruit prijzen ophalen (uren)"
-    description: "Hoeveel uur aan prijzen er bij de bron opgevraagd wordt."
+    name: "Tarief · Prijzen vooruit (uren)"
+    description: "Hoeveel uur aan prijzen de add-on bij de bron opvraagt."
   price_timeout_s:
-    name: "Tarief · Time-out voor een prijsaanvraag (s)"
-    description: "Hoe lang één aanvraag bij de prijsbron mag duren voordat ze wordt opgegeven."
+    name: "Tarief · Time-out prijsaanvraag (s)"
+    description: "Hoe lang één aanvraag bij de prijsbron mag duren voor ze wordt opgegeven."
   price_now_entity:
-    name: "Tarief · Entiteit met de huidige prijs (oudere prijsweg)"
-    description: "De oudere manier om aan een prijs te komen, behouden omdat ze weghalen de onderhoudscyclus op een draaiende installatie zijn enige prijssignaal zou afnemen. De add-on leest deze entiteit en het gemiddelde hieronder en leidt er precies één ding uit af - of het nu goedkoper is dan gemiddeld - wat alleen gebruikt wordt om tijdens de onderhoudscyclus in een goedkoop venster te laden. Mag niet gecombineerd worden met een dynamische prijsbron."
+    name: "Tarief · Entiteit huidige prijs (oud)"
+    description: "De oudere manier om een prijs te krijgen, alleen gebruikt om tijdens onderhoud goedkoop te laden. Niet combineren met een dynamische prijsbron."
   price_avg_entity:
-    name: "Tarief · Entiteit met de gemiddelde prijs (oudere prijsweg)"
-    description: "Het gemiddelde waarmee de huidige prijs vergeleken wordt. Alleen zinvol samen met de entiteit hierboven en, net als die, niet te combineren met een dynamische prijsbron."
+    name: "Tarief · Entiteit gemiddelde prijs (oud)"
+    description: "Het gemiddelde waarmee de huidige prijs vergeleken wordt. Alleen samen met de entiteit huidige prijs, niet met een dynamische prijsbron."
   arbitrage_enabled:
     name: "Tarief · Handelen op het prijsverschil"
-    description: "Laden in het goedkoopste gepubliceerde uur en ontladen in het duurste, maar alleen wanneer het verschil de kosten van de volledige cyclus dekt. STAAT UIT in de standaardinstelling, met opzet: dit is de eerste strategie in de add-on die bewust energie tegen de meter in verplaatst, dus ze wordt bewust aangezet of helemaal niet. ⚠️ DIT UIT LATEN STAAN ZET DE PRIJSFEED NIET UIT. Een prijsbron die hierboven gekozen is, wordt hoe dan ook opgehaald, gecontroleerd en bewaard; deze schakelaar bepaalt alleen of de add-on op die prijzen HANDELT. Ze heeft zowel een prijsbron als een P1-meter nodig, en de add-on weigert combinaties die niet kunnen werken in plaats van ze schijnbaar actief te laten."
+    description: "Laden in het goedkoopste uur en de batterij laten leveren in het duurste, als het verschil de kosten dekt. Dit uitzetten zet de prijsfeed niet uit."
   cycle_cost_threshold_eur:
-    name: "Tarief · Kostprijs van één volledige laad/ontlaadcyclus (EUR/kWh)"
-    description: "Wat één volledige cyclus per kWh kost: slijtage van de batterij plus omzettingsverliezen. Een prijsverschil dat hier onder ligt, kost geld en levensduur en wordt dus niet verhandeld. ⚠️ DIT GETAL IS NIET AFGELEID UIT EEN METING. 0,10 is een productbeslissing en staat nog open bij de eigenaar (OPT-08). Bij deze waarde handelt een installatie met een vast dag/nachttarief helemaal niet - het realistische Belgische dag/nachtverschil is ongeveer 0,08 EUR/kWh - en dat is bij dit getal het juiste antwoord, geen fout."
+    name: "Tarief · Kosten van een batterijcyclus (EUR/kWh)"
+    description: "Wat één volledige batterijcyclus per kWh kost. Een kleiner prijsverschil wordt niet verhandeld. De waarde is een productkeuze, geen meting."
   arbitrage_soc_floor:
-    name: "Tarief · Handel ontlaadt niet onder (%)"
-    description: "De reserve die de prijshandel niet mag aanspreken. Bewust een andere instelling dan de ondergrens van het onderhoud: een handelsstrategie op de cijfers van de maandelijkse balanceercyclus richten, zou twee ongerelateerde keuzes aan één getal koppelen."
+    name: "Tarief · Handel houdt minstens (%)"
+    description: "Prijshandel laat de batterij niet onder dit niveau zakken. Dit staat los van de onderhoudsinstellingen."
   arbitrage_soc_ceiling:
-    name: "Tarief · Handel laadt niet boven (%)"
-    description: "De ruimte die de prijshandel niet mag volmaken. De tegenhanger van de ondergrens hierboven, en om dezelfde reden losgehouden van het onderhoudsdoel."
+    name: "Tarief · Handel laadt hoogstens (%)"
+    description: "Prijshandel laadt de batterij niet boven dit niveau."
   maintenance_enabled:
-    name: "Onderhoud · Maandelijkse batterijcyclus uitvoeren"
-    description: "Een bewuste diepe ontlading, gevolgd door volledig opladen en een rustperiode op vol, zodat het batterijmanagementsysteem zijn schatting van het laadniveau kan herijken en de cellen kan balanceren. Staat standaard uit."
+    name: "Onderhoud · Maandelijkse batterijcyclus"
+    description: "Eén keer per maand de batterij diep leegmaken, volladen en vol houden, zodat het laadniveau juist blijft. Staat standaard uit."
   maintenance_interval_days:
-    name: "Onderhoud · Minimum aantal dagen tussen cycli"
+    name: "Onderhoud · Minimum dagen tussen cycli"
     description: "De kortste tijd tussen twee onderhoudscycli."
   maintenance_start_hour:
-    name: "Onderhoud · Uur waarop een geplande cyclus start"
-    description: "Lokaal uur, 0 tot 23, waarop een cyclus die aan de beurt is begint."
+    name: "Onderhoud · Startuur"
+    description: "Het lokale uur, 0 tot 23, waarop een geplande cyclus begint."
   maintenance_discharge_w:
     name: "Onderhoud · Ontlaadvermogen (W)"
-    description: "Hoe snel de cyclus de batterij leegtrekt; het overschot gaat naar het net. Boven het vermogen van de omvormer wordt dit BEGRENSD tot dat vermogen en niet geweigerd - de cyclus loopt gewoon door, alleen trager, en de statuspagina meldt dat. Standaard 2000, afgestemd op het standaardvermogen; verhoog eerst het omvormervermogen en dan pas dit."
+    description: "Hoe snel de cyclus de batterij leegmaakt. Boven het vermogen van de omvormer wordt het daartoe beperkt, en duurt de cyclus gewoon langer."
   maintenance_charge_w:
     name: "Onderhoud · Laadvermogen (W)"
-    description: "⚠️ MOET GELIJK AAN OF LAGER ZIJN dan het vermogen van de omvormer; anders start de add-on niet op. Erboven vraagt het laden in een goedkoop venster meer dan de bewaakte grens toelaat, lost de arbiter die tegenstrijdigheid op naar 0 W, en zou het onderhoud op een standaardinstallatie stilzwijgend nooit laden in een goedkoop venster. Daarnaast wordt dit nog eens begrensd door de ruimte die de piekbewaking overlaat."
+    description: "Hoe snel de cyclus de batterij weer vollaadt. Het moet gelijk aan of lager zijn dan het vermogen van de omvormer, anders start de add-on niet."
   maintenance_soc_floor:
     name: "Onderhoud · Ontladen tot (%)"
-    description: "De diepte waar de maandelijkse herijking bewust naartoe gaat, één keer per maand, met opzet. ⚠️ DIT IS NIET DE ONDERGRENS VAN DE PIEKBEWAKING: die geeft aan hoe diep een besparende ontlading op geen enkele dag mag komen. De juiste waarden verschillen echt - 11 hier tegenover 20 daar - en daarom zijn het twee aparte instellingen die niet samengevoegd mogen worden."
+    description: "Het niveau tot waar de maandelijkse cyclus de batterij leegmaakt. Dit is niet de piekreserve, en de twee verschillen bewust."
   maintenance_soc_target:
     name: "Onderhoud · Opladen tot (%)"
-    description: "Het niveau waar de laadfase naartoe werkt voordat de rustperiode begint."
+    description: "Het niveau waartoe de cyclus oplaadt voor het vasthouden begint."
   maintenance_hold_min:
-    name: "Onderhoud · Op vol houden gedurende (minuten)"
-    description: "Hoe lang er op het streefniveau gebleven wordt zodat het batterijmanagementsysteem het balanceren van de cellen kan afmaken."
+    name: "Onderhoud · Vol houden gedurende (minuten)"
+    description: "Hoe lang de batterij vol blijft zodat de cellen in evenwicht komen."
   sign_disagree_w:
-    name: "Veiligheid · Drempel tekenbewaking (W) — gemeten, niet wijzigen"
-    description: "GEMETEN, NIET GEKOZEN (SAFETY-02). Zowel het uitgestuurde setpoint als de netmeting moet boven deze waarde liggen voordat hun tegengestelde tekens überhaupt als onenigheid tellen. Op de vastgelegde gezonde dag (23-08-2026) komt het teken in 93,4 % van de beoordeelde metingen overeen; op de vastgelegde foutdag (20-08-2026) ligt dat tussen 0,0 en 10,5 %, met tegengestelde periodes tot 1752 s. Er is geen reden om hieraan te sleutelen zonder een nieuwe meetcampagne die dat onderbouwt. De waarde moet onder het omvormervermogen blijven, anders kan de bewaking nooit aanslaan, en de add-on weigert die instelling."
+    name: "Veiligheid · Drempel verkeerde richting (W)"
+    description: "Deel van de veiligheidsstop voor een omvormer die de verkeerde kant op duwt. Het telt pas als commando en meterstand allebei boven deze waarde liggen. Gemeten waarde, laat ze ongewijzigd."
   sign_disagree_s:
-    name: "Veiligheid · Wachttijd tekenbewaking (s) — gemeten, niet wijzigen"
-    description: "GEMETEN, NIET GEKOZEN (SAFETY-02). Hoe lang het setpoint en de meter onafgebroken tegengesteld moeten blijven voordat de add-on 0 W stuurt en vergrendelt tot iemand de regeling opnieuw start. 180 s ligt midden in een zeer brede gemeten marge: de langste terechte tegengestelde periode op de gezonde dag duurt 30 s, terwijl de foutdag bij 300 s nog altijd 13 keer aanslaat. Verander dit niet zonder nieuwe metingen."
+    name: "Veiligheid · Tijd verkeerde richting (s)"
+    description: "Hoe lang een verkeerde richting mag duren voor een veiligheidsstop elke omvormer op 0 W zet. Gemeten waarde, laat ze ongewijzigd."
   unit_sign_disagree_w:
-    name: "Veiligheid · Tekendrempel per omvormer (W) — afgeleid, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS; bij één omvormer doet deze instelling niets. AFGELEID UIT 1890 GESLOTEN-LUSTESTS op de testopstelling met twee omvormers (SAFETY-30), waarbij niets defect was, over het volledige bereik dat deze add-on toelaat voor versterking en volgsnelheid. 250 W is precies de helft van de verzadigingsdrempel, zodat het kleinste verschil dat hier zichtbaar is, exact de afwijking is waarbij de regeling zelf al zegt dat de omvormer niet volgt. Verander dit niet zonder de afleiding opnieuw te maken. De waarde moet onder het omvormervermogen blijven, anders kan ze nooit aanslaan."
+    name: "Veiligheid · Drempel verkeerde richting per omvormer (W)"
+    description: "Bij twee of meer omvormers: de drempel voor verkeerde richting per omvormer. Afgeleide waarde, laat ze ongewijzigd."
   unit_sign_disagree_s:
-    name: "Veiligheid · Wachttijd per omvormer (s) — afgeleid, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS. AFGELEID UIT 1890 GESLOTEN-LUSTESTS (SAFETY-30): 85 s is 8,5 keer de langste terechte tegengestelde periode die die tests opleveren (10,0 s), 2,8 keer het eigen veto van 30 s in de firmware, en minder dan de helft van de 180 s die de installatiebrede controle neemt. Verander dit niet zonder de afleiding opnieuw te maken."
+    name: "Veiligheid · Tijd verkeerde richting per omvormer (s)"
+    description: "Bij twee of meer omvormers: hoe lang één omvormer de verkeerde kant op mag duwen voor ze op 0 W gaat. Afgeleide waarde, laat ze ongewijzigd."
   site_sign_disagree_w:
-    name: "Veiligheid · Tekendrempel voor de hele installatie (W) — gemeten, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS. Dezelfde 300 W als de drempel voor één omvormer, BEWUST OVERGENOMEN (SAFETY-30): de onderbouwing hangt niet af van het aantal omvormers - rond nul is het teken ruis, de dode zone is 15 W, en er is één meter, wat er ook achter hangt. Verander dit niet zonder metingen die dat onderbouwen."
+    name: "Veiligheid · Drempel verkeerde richting installatie (W)"
+    description: "Bij twee of meer omvormers: de drempel voor verkeerde richting van de hele installatie. Gemeten waarde, laat ze ongewijzigd."
   site_sign_disagree_s:
-    name: "Veiligheid · Wachttijd voor de hele installatie (s) — afgeleid, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS. AFGELEID UIT 1890 GESLOTEN-LUSTESTS (SAFETY-30), en bewust NIET overgenomen van de 180 s voor één omvormer. In die tests duurt de langste terechte tegengestelde periode bij 300 W 110 s met één omvormer en 215 s met twee, omdat het commando de volledige installatiegrens moet doorlopen aan een volgsnelheid die niet die van de installatie is. 180 s overnemen zou dus een vals alarm hebben opgeleverd bij de laagste versterking en volgsnelheid en een gewone belastingomkering van 2,2 kW. 325 s is 1,51 keer die waarde, blijft binnen het factuurkwartier van 900 s en binnen elke episode van de vastgelegde foutdag. Verander dit niet zonder de afleiding opnieuw te maken."
+    name: "Veiligheid · Tijd verkeerde richting installatie (s)"
+    description: "Bij twee of meer omvormers: hoe lang de hele installatie de verkeerde kant op mag duwen voor een veiligheidsstop. Afgeleide waarde, laat ze ongewijzigd."
   meter_freeze_s:
-    name: "Veiligheid · Alarm vastgelopen meter na (s) — gemeten, niet wijzigen"
-    description: "GEMETEN, NIET GEKOZEN (SAFETY-18). Hoe lang de meter mag blijven antwoorden met een ONVERANDERDE waarde, terwijl het commando op de grens staat, voordat de add-on alarm slaat. Over 2399 s van deze woning op haar ingeregelde werkpunt - 1194 uitlezingen, waarvan 735 een herhaling van de vorige waarde - duurt de langste periode zonder een nieuwe waarde 15,4 s; 300 s is 19,5 keer zoveel en blijft binnen het factuurkwartier van 900 s. ALLEEN EEN ALARM: er wordt geen 0 W gestuurd en er wordt niets vergrendeld. ⚠️ Alleen de meterbron homewizard_local kan dit überhaupt zien; bij elke andere bron meldt de statuspagina NIET GEDEKT in plaats van actief. Verander dit niet zonder de afleiding opnieuw te maken."
+    name: "Veiligheid · Alarm vastgelopen meter na (s)"
+    description: "Een alarm als de meter zo lang dezelfde waarde herhaalt terwijl het commando op vol vermogen staat, alleen met homewizard_local. Gemeten waarde, laat ze ongewijzigd."
   circulation_w:
-    name: "Veiligheid · Drempel rondpompend vermogen (W) — gemeten, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS; bij één omvormer is deze grootheid altijd nul. Twee omvormers die tegen elkaar in duwen, heffen elkaar aan de meter op en zijn onzichtbaar voor elke andere bewaking in deze add-on. GEMETEN OVER 924 GESLOTEN-LUSTESTS waarbij niets defect was (SAFETY-31): de langste terechte tegenwerking valt terug van 505 s bij een drempel van 100 W naar 5 s bij 400 W, en 400 W is de scherpe knik waaronder deze add-on u niet laat gaan - daaronder houdt gewone werking de sensor minutenlang boven de drempel en kan niets korter dan het factuurkwartier dat van een storing onderscheiden. 700 W is 1,75 keer de knik; die extra marge is er omdat het aanloopgedrag van de tweede omvormer nog gekopieerd is van de eerste en niet gemeten. Verander dit niet zonder de afleiding opnieuw te maken."
+    name: "Veiligheid · Drempel tegenwerkende omvormers (W)"
+    description: "Bij twee of meer omvormers: hoeveel vermogen de ene tegen de andere in mag duwen voor het telt. Gemeten waarde, laat ze ongewijzigd."
   circulation_hold_s:
-    name: "Veiligheid · Wachttijd rondpompend vermogen (s) — afgeleid, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS. AFGELEID (SAFETY-31): 75 s zijn vijftien regelcycli - 15 keer de langste terechte episode die de testopstelling kan produceren, 2,5 keer het eigen veto van 30 s in de firmware, en twaalf keer binnen het factuurkwartier van 900 s. Het is bewust geen ronde 60 of 120, want dat zou een gok zijn in het jasje van een meting. Verander dit niet zonder de afleiding opnieuw te maken."
+    name: "Veiligheid · Tijd tegenwerkende omvormers (s)"
+    description: "Bij twee of meer omvormers: hoe lang ze tegen elkaar in mogen duwen voor een veiligheidsstop. Afgeleide waarde, laat ze ongewijzigd."
   delivery_hold_s:
-    name: "Veiligheid · Melding niet-leverende omvormer na (s) — afgeleid, niet wijzigen"
-    description: "ALLEEN BIJ TWEE OF MEER OMVORMERS; bij één omvormer kan deze controle helemaal niet aanslaan, en dat is een bewuste keuze en geen tekortkoming. Hoe lang één omvormer mag blijven staan op een ontlaadaandeel dat hij niet levert - meer dan de verzadigingsdrempel te weinig, zonder dat deze add-on er een verklaring voor kan uitlezen - terwijl minstens één andere omvormer dat NIET doet, voordat hij bij naam wordt gemeld. ALLEEN MELDEN (SAFETY-42): er wordt niets anders gestuurd, de regeling blijft ongemoeid, en de installatie blijft draaien met het aandeel van die omvormer te weinig tot u gaat kijken. AFGELEID UIT 2640 GESLOTEN-LUSTESTS waarbij niets defect was (SAFETY-42, plus een arm met één omvormer als controlegroep, die bij geen enkele drempel iets meldt): de langste terechte episode in die tests duurt 35,0 s, en de bovengrens is het factuurkwartier van 900 s. 185 s is 5,29 keer zoveel. ⚠️ Het schema laat u zo laag als 30 s instellen, en dat is ONDER die gemeten 35,0 s - op 30 s moet u meldingen bij terechte verzadiging verwachten. De tweede omvormer in die tests is een KOPIE VAN DE EERSTE, want de tweede omvormer bestaat nog niet: wat een vier keer tragere eenheid zou opleveren (75,0 s) is een gevoeligheidsstudie op dat idee en geen meting aan een echte tweede omvormer. Verander dit niet zonder de afleiding opnieuw te maken - en dat kan nu: admin/goodwe sim/delivery_window.py --campaign --blag (TEST-21). Een accu op of onder zijn eigen bms_soc_floor wordt nooit gemeld: een lege accu en een vastgelopen omvormer zijn watt voor watt identiek, en die instelling is het enige wat ze uit elkaar houdt - slaat dit toch aan bij een accu die volgens u leeg is, dan beschrijft die instelling uw batterij niet."
+    name: "Veiligheid · Alarm niet-leverende omvormer na (s)"
+    description: "Bij twee of meer omvormers: hoe lang één omvormer te weinig mag leveren voor een alarm. Het alarm verandert niets. Afgeleide waarde, laat ze ongewijzigd."
   shadow_mode:
-    name: "Veiligheid · Schaduwmodus — alles beslissen, niets sturen"
-    description: "Doorloopt het volledige beslispad — strategieën, arbiter, begrenzers en bewakingen — en stuurt NIETS naar de omvormer. Elke omvormer wordt op 0 W gehouden, ververst op de gewone hartslag, en de statuspagina zegt onomwonden dat de batterij niet wordt aangestuurd; wat er gestuurd ZOU zijn, en waarom, staat op de statuspagina en in het actielogboek. Zo bekijkt u een installatie een dag lang voordat u hem laat handelen. 'auto' (de meegeleverde waarde) betekent schaduwmodus zolang de regeling gestopt is en gewone regeling zodra u op Start drukt — een NIEUWE installatie kijkt dus eerst toe voordat ze ooit iets stuurt, en een installatie die al regelt verandert geen watt. 'on' betekent altijd schaduwmodus, wat de Start/stop-knop ook zegt: die stand kiest u als u de lus en de strategieën wilt laten draaien op een werkende installatie zonder dat er iets bij de batterij aankomt. 'off' is gewone regeling. ⚠️ Zolang dit aanstaat wordt de batterij NIET geregeld — het net wordt niet op nul gehouden, er wordt geen prijshandel uitgevoerd en er wordt geen capaciteitspiek afgevlakt. ⚠️ Een vergrendeling die al aanstond blijft aanstaan: schaduwmodus heft die niet op, en de banner noemt hem."
+    name: "Veiligheid · Schaduwmodus"
+    description: "De add-on neemt elke beslissing maar houdt elke omvormer op 0 W. 'auto' doet dit zolang de regeling gestopt is, 'on' altijd, 'off' nooit."
   auto_start:
-    name: "Geavanceerd · Automatisch beginnen te regelen bij opstarten"
-    description: "Staat standaard uit. Laat het uit tot de installatie in dienst is genomen: zolang het uit staat, moet iemand na elke herstart van de add-on op Start drukken, en dat is precies wat u wilt terwijl u tekens en entiteiten nog aan het nakijken bent."
+    name: "Geavanceerd · Regeling starten bij opstarten"
+    description: "Staat standaard uit. Laat het uit tot de installatie in dienst is, zodat iemand na elke herstart op Start drukt."
   gain:
-    name: "Geavanceerd · Versterking van de regellus"
-    description: "Welk deel van de resterende afwijking de regeling per cyclus wegregelt. GEMETEN OP ECHTE HARDWARE en al aan de bovengrens - niet verhogen. Lager is trager en veiliger."
+    name: "Geavanceerd · Versterking van de regeling"
+    description: "Welk deel van de resterende afwijking de regeling per cyclus wegwerkt. Gemeten op echte hardware, verhoog dit niet."
   slew_w:
-    name: "Geavanceerd · Grootste verandering per cyclus (W)"
-    description: "Hoeveel het setpoint in één regelcyclus mag verspringen. ⚠️ 0 BETEKENT VOLG HET OMVORMERVERMOGEN en is de aanbevolen instelling: de grens wordt ongeveer een negende van dat vermogen, zodat de regeling er de GEMETEN insteltijd van de installatie over doet om haar volledige bereik te doorlopen en het getal niet achterblijft wanneer het vermogen verandert. AFGELEID (SAFETY-39) uit een gemeten stapresponsie van ~18 s bij een meterinterval van 2 s. Een vast getal wordt aanvaard en wordt nooit stilzwijgend verlaagd, maar een getal sneller dan het vermogen toelaat wordt bij het starten geweigerd - bij 1000 W tegen 5000 W dreef deze regeling de meter op 2026-09-05 van 3,4 kW injectie naar 2,8 kW afname. Lager wordt altijd aanvaard."
+    name: "Geavanceerd · Grootste stap per cyclus (W)"
+    description: "Hoe ver het commando in één cyclus mag verschuiven. 0 volgt het vermogen van de omvormer en is aanbevolen."
   deadband_w:
-    name: "Geavanceerd · Dode zone (W)"
-    description: "Afwijkingen kleiner dan deze waarde worden genegeerd. ⚠️ De dode zone werkt maar één kant op: elk rustpunt erbinnen blijft eeuwig staan, en het afnameregister van de meter telt elke positieve watt mee zonder injectie die dat compenseert - en precies daarom staat het rustpunt hieronder licht negatief."
+    name: "Geavanceerd · Negeer afwijkingen onder (W)"
+    description: "Kleinere afwijkingen worden genegeerd. Houd dit klein, want elk rustpunt daarbinnen blijft staan."
   target_grid_w:
     name: "Geavanceerd · Rustpunt aan de meter (W)"
-    description: "Waar de meter moet staan wanneer er niets gebeurt; negatief betekent een lichte injectie. -10 W is bewust gekozen: rusten op 0 W lekt de hele dag door ongeveer de helft van de dode zone aan gefactureerde afname - grofweg 0,2 tot 0,35 kWh bij een dode zone van 15 W - en het rustpunt onder nul leggen verplaatst dat lek naar het injectieregister, dat niet gefactureerd wordt. Het kost ongeveer evenveel watt weggegeven injectie, dus houd het klein."
+    description: "Waar de meter moet staan als er niets gebeurt. Een kleine injectie voorkomt dat u de hele dag kleine afname betaalt."
   step_w:
-    name: "Geavanceerd · Afronding van het setpoint (W)"
-    description: "Het setpoint wordt op een veelvoud hiervan afgerond voordat het geschreven wordt, zodat de omvormer niet voor elke watt ruis een nieuw getal krijgt."
+    name: "Geavanceerd · Afronding van het commando (W)"
+    description: "Het commando wordt afgerond op een veelvoud hiervan, zodat ruis het niet elke cyclus verandert."
   saturation_w:
-    name: "Geavanceerd · Verzadigingsdrempel (W)"
-    description: "Het verschil tussen wat gevraagd werd en wat de omvormer levert dat geldt als 'deze omvormer zit aan een grens'. ⚠️ De tekendrempel per omvormer onder Veiligheid is afgeleid als precies de helft hiervan, dus deze waarde verschuiven, verschuift ook de onderbouwing daarvan."
+    name: "Geavanceerd · Tekort aan de grens (W)"
+    description: "Levert een omvormer zoveel minder dan gevraagd, dan zit ze aan haar grens. De drempel verkeerde richting per omvormer is de helft hiervan."
   saturation_cycles:
-    name: "Geavanceerd · Verzadigde cycli voor bevriezen (aantal)"
-    description: "Hoeveel opeenvolgende verzadigde cycli er nodig zijn voordat de regeling stopt met verder oplopen. ⚠️ Zet dit niet op 1: één ruiscyclus zou de regeling dan al bevriezen."
+    name: "Geavanceerd · Cycli aan grens voor bevriezen"
+    description: "Hoeveel cycli na elkaar aan de grens voor de regeling stopt met afwijking opbouwen. Zet dit niet op 1."
   integrator_max_w:
-    name: "Geavanceerd · Begrenzing van de integrator (W, 0 betekent gelijk aan het vermogen)"
-    description: "Begrenst hoeveel oude afwijking er kan klaarstaan om af te bouwen wanneer het teken omslaat. GEMETEN op de gesloten-lussimulator met een belasting van 4000 W die naar nul valt: bij een grens gelijk aan het omvormervermogen staat het commando twee cycli later op 1000 W, bij anderhalf keer dat vermogen op 1800 W. ⚠️ Zet dit niet hoger dan het omvormervermogen - de uitgangsbegrenzing bepaalt toch al wat er naar de omvormer gaat, dus extra ruimte levert alleen watts in de verkeerde richting op na elke verzadiging. Lager zetten dan het omvormervermogen is de nuttige richting, en de enige reden dat dit een aparte instelling is."
+    name: "Geavanceerd · Inhaalgrens (W)"
+    description: "Begrenst hoe hard de regeling blijft duwen als de batterij achterloopt. 0 betekent het vermogen van de omvormer. Zet dit niet hoger dan dat vermogen."
   heartbeat_s:
-    name: "Geavanceerd · Verversingsinterval van het setpoint (s)"
-    description: "Hoe vaak het setpoint opnieuw geschreven wordt, ook als het niet veranderd is. Dit moet ruim onder de eigen bewaking van de firmware blijven, die een verbinding die 30 s stil is geweest, blokkeert."
+    name: "Geavanceerd · Commando opnieuw sturen na (s)"
+    description: "Hoe vaak het commando opnieuw gestuurd wordt, ook als het gelijk bleef. Houd dit ruim onder de eigen grens van 30 s van de stuurmodule."
   stale_input_s:
-    name: "Geavanceerd · 0 W sturen nadat invoer ontbreekt gedurende (s)"
-    description: "Hoe lang de invoer mag ontbreken voordat de add-on 0 W stuurt. Bij een P1-meter begint deze teller pas te lopen NADAT de verouderingsgrens van de meter al verstreken is, dus de twee stapelen: het totaal is langer dan dit getal op zich."
+    name: "Geavanceerd · Tijdslimiet ontbrekende invoer (s)"
+    description: "Hoe lang invoer mag ontbreken voor elke omvormer op 0 W gaat. Bij een P1-meter begint dit pas na de grens voor een te oude meting."
   cycle_floor_s:
-    name: "Geavanceerd · Langste tijd tussen twee regelcycli (s)"
-    description: "Een uiterste termijn voor de tijd tussen twee cycli, die door elke cyclus opnieuw begint. Bij een gezonde meter verstrijkt hij nooit en verandert hij niets. Verhoog hem alleen als uw meter trager is dan ongeveer 10 s, en houd hem onder de verouderingsgrens van de meter - daarna is er toch geen meting meer om te beoordelen."
+    name: "Geavanceerd · Langste tijd tussen cycli (s)"
+    description: "Een uiterste termijn tussen twee regelcycli die een gezonde meter nooit haalt. Verhoog dit alleen voor een meter trager dan ongeveer 10 s."
   log_level:
     name: "Geavanceerd · Logniveau"
-    description: "Hoeveel detail de add-on naar zijn logboek schrijft. 'info' is de standaardinstelling; 'debug' en 'trace' dienen om een probleem te onderzoeken en leveren veel tekst op."
+    description: "Hoeveel detail de add-on in zijn logboek schrijft. 'debug' en 'trace' zijn om een probleem te zoeken."
diff --git a/goodwe_controller/ux08_allowlist.txt b/goodwe_controller/ux08_allowlist.txt
new file mode 100644
index 0000000..605e7db
--- /dev/null
+++ b/goodwe_controller/ux08_allowlist.txt
@@ -0,0 +1,5 @@
+# UX-08 ratchet (test_messages.py part 3). Each line would be a user-facing
+# string that does not follow STYLE.md yet: "<kind> <sha1-12 of its text>  #
+# where :: start". Phase 2d emptied it: every row, banner, refusal, option text
+# and WARNING+ log line now follows STYLE.md, and ALLOWLIST_MAX is 0. Never add
+# a line for a new string: write the new string to STYLE.md instead.