@@ -94,9 +94,11 @@ async def handle_oauth_401(self):
 # Viewer query to discover all account numbers under the authenticated user
 KRAKEN_VIEWER_QUERY = """{ viewer { accounts { number } } }"""
 
-# GraphQL applicableRates query — fallback when REST product endpoint returns 404
-# (product code removed/replaced while customer is still on the tariff, or TOU tariff
-# with no /standard-unit-rates/ REST endpoint e.g. E-TOU-* tariffs on E.ON Next).
+# GraphQL applicableRates query — fallback when the REST product endpoint cannot serve the
+# tariff: 404/410 (product code removed/replaced while customer is still on the tariff, a private
+# product such as an EDF SEG export tariff, or a TOU tariff absent from the REST API such as
+# E-TOU-* on E.ON Next) or 400 (the product is in the REST API but has no /standard-unit-rates/
+# resource, as day/night-structured EDF tariffs answer — GH#5166).
 # Returns value (pence/kWh inc VAT), validFrom, validTo for the requested window.
 # applicableRates is a Relay-style connection (ApplicableRateConnectionTypeConnection),
 # so the rate fields live under edges { node { ... } }, not directly on the field. The
@@ -206,6 +208,17 @@ async def handle_oauth_401(self):
 # Auth error codes that trigger token refresh + retry
 KRAKEN_AUTH_ERROR_CODES = ("KT-CT-1139", "KT-CT-1111", "KT-CT-1143")
 
+# REST statuses meaning "the products API cannot serve this tariff's rates", as opposed to a
+# transient outage (429/500/503) — these are the ones worth falling back to GraphQL for.
+#  404/410 — the product is not in the REST API at all: a private product (EDF SEG / export
+#            tariffs) or one retired while the customer is still on it.
+#  400     — the tariff exists but has no /standard-unit-rates/ resource. Day/night-structured
+#            tariffs answer "This tariff has day and night rates, not standard." (GH#5166),
+#            which is permanent for the tariff, not a request the customer can fix.
+# Auth makes no difference to a 400, so the authenticated retry stays on 404/410 only.
+KRAKEN_REST_PRODUCT_NOT_FOUND_STATUSES = (404, 410)
+KRAKEN_REST_RATES_UNAVAILABLE_STATUSES = (400,) + KRAKEN_REST_PRODUCT_NOT_FOUND_STATUSES
+
 # applicableRates connection pagination — request this many nodes per page, cap total pages
 # so a runaway cursor can't loop forever. 100 * 20 = 2000 half-hourly periods (~41 days) is far
 # more than the ~4-day planning window ever needs.
@@ -835,7 +848,10 @@ async def async_fetch_rates(self, tariff=None):
         REST auth — EDF SEG / export tariffs are private products that 404 unauthenticated.
         Only if the authenticated retry also fails do we fall back to the GraphQL applicableRates
         query (which is not available on every provider), so export rates are recovered wherever
-        possible.
+        possible. A 400 goes straight to that fallback without the authenticated retry: it means
+        the tariff has no /standard-unit-rates/ resource (day/night-structured tariffs), which
+        auth cannot change. A network error during the authenticated retry keeps the status the
+        public attempt returned, so the fallback still runs for a tariff already proven 404/410.
         """
         tariff = tariff or self.current_tariff
         if not tariff:
@@ -855,22 +871,38 @@ async def async_fetch_rates(self, tariff=None):
         results, err = await self._fetch_rates_rest(url, authenticate=False)
 
         # 2) On a permanent "not found", the product is likely private — retry authenticated.
-        if err in (404, 410):
+        if err in KRAKEN_REST_PRODUCT_NOT_FOUND_STATUSES:
             self.log(f"Kraken: REST rates HTTP {err} for {tariff['tariff_code']}, retrying authenticated")
+            rest_unavailable_status = err
             results, err = await self._fetch_rates_rest(url, authenticate=True)
+            if results is None and err is None:
+                # (None, None) is a network error on the retry, which would otherwise erase the
+                # status the public attempt just proved and drop this cycle into the generic
+                # failure path. The products API still cannot serve this tariff, so keep that
+                # status and take the GraphQL fallback rather than losing the rates to a blip.
+                self.log(f"Warn: Kraken: Authenticated retry for {tariff['tariff_code']} hit a network error, treating as HTTP {rest_unavailable_status}")
+                err = rest_unavailable_status
 
         if err is not None:
-            # A 404/410 with a known MPAN is the EXPECTED path for private products — EDF SEG
-            # export tariffs are never served by the REST products API, so this fires on every
-            # export fetch. Recover via GraphQL applicableRates and only count a failure if that
-            # also comes back empty; otherwise the failure counter would climb every cycle
-            # despite the fetch succeeding. Transient errors (429/500/503) fall through to the
-            # genuine-failure path below.
-            if err in (404, 410) and fallback_mpan:
+            # A "REST cannot serve this tariff" status with a known MPAN is the EXPECTED path for
+            # two tariff families: EDF SEG export tariffs are private products never served by the
+            # REST products API (404), and day/night-structured tariffs have no standard-unit-rates
+            # resource at all (400). Both fire on every fetch. Recover via GraphQL applicableRates
+            # and only count a failure if that also comes back empty; otherwise the failure counter
+            # would climb every cycle despite the fetch succeeding. Transient errors (429/500/503)
+            # fall through to the genuine-failure path below.
+            if err in KRAKEN_REST_RATES_UNAVAILABLE_STATUSES and fallback_mpan:
                 kind = "export" if is_export else "import"
-                self.log(f"Kraken: REST rates HTTP {err} for {tariff['tariff_code']} (private product), using GraphQL applicableRates for {kind} MPAN {fallback_mpan}")
+                # 404/410 covers both a private product and one retired from the REST API, so the
+                # label has to fit both — a retired product is not a private one.
+                reason = "product not in the REST API" if err in KRAKEN_REST_PRODUCT_NOT_FOUND_STATUSES else "tariff has no standard-unit-rates endpoint"
+                self.log(f"Kraken: REST rates HTTP {err} for {tariff['tariff_code']} ({reason}), using GraphQL applicableRates for {kind} MPAN {fallback_mpan}")
+                failures_before = self.failures_total
                 rates = await self.async_fetch_rates_graphql(fallback_mpan, account_id=fallback_account)
-                if rates is None:
+                if rates is None and self.failures_total == failures_before:
+                    # async_graphql_query counts its own failures (auth, non-200, GraphQL errors,
+                    # network), so only add a count when the fallback came back empty without
+                    # counting one — otherwise a down GraphQL would score 2 per cycle.
                     self.failures_total += 1
                 return rates
             self.log(f"Warn: Kraken: Rates HTTP {err} for {url}")
@@ -935,9 +967,11 @@ async def async_fetch_standing_charges_graphql(self, mpan):
     async def async_fetch_standing_charges(self, tariff=None):
         """Fetch standing charges from public REST endpoint. No auth needed.
 
-        Falls back to GraphQL applicableStandingCharges if the REST endpoint returns a non-200
-        status (e.g. 404 for TOU tariffs on E.ON Next whose product is not in the REST API)
-        and self.import_mpan is known.
+        Falls back to GraphQL applicableStandingCharges only on a permanent "product not found"
+        status (404/410 — e.g. TOU tariffs on E.ON Next whose product is not in the REST API)
+        when self.import_mpan is known. Transient statuses (429/500/503) are counted as failures
+        instead, and unlike the rates endpoint a 400 does not arise here: /standing-charges/ is
+        register-independent, so day/night-structured tariffs still serve it (GH#5166).
         """
         tariff = tariff or self.current_tariff
         if not tariff:
@@ -963,10 +997,12 @@ async def async_fetch_standing_charges(self, tariff=None):
             return None
 
         if http_error_status is not None:
-            # Only fall back to GraphQL for permanent "product not found" responses (404/410).
-            # Transient errors (429, 500, 503, …) should surface as failures, not trigger
-            # an extra GraphQL request that would mask the outage.
-            if http_error_status in (404, 410) and self.import_mpan:
+            # Only fall back to GraphQL for permanent "product not found" responses (404/410) —
+            # the same statuses the rates fallback retries authenticated on, shared via the
+            # constant so the gates cannot drift. Transient errors (429, 500, 503, …) should
+            # surface as failures, not trigger an extra GraphQL request that would mask the
+            # outage. 400 is deliberately absent: it is a rates-endpoint-only answer.
+            if http_error_status in KRAKEN_REST_PRODUCT_NOT_FOUND_STATUSES and self.import_mpan:
                 self.log(f"Kraken: REST standing charges returned HTTP {http_error_status}, falling back to GraphQL applicableStandingCharges for MPAN {self.import_mpan}")
                 return await self.async_fetch_standing_charges_graphql(self.import_mpan)
             return None
 
@@ -1193,6 +1193,90 @@ def test_fetch_rates_rest_410_falls_back_to_graphql_for_import():
     api.async_fetch_rates_graphql.assert_called_once_with("1900000000456", account_id="A-AA8A473C")
 
 
+def test_fetch_rates_rest_400_day_night_tariff_falls_back_to_graphql():
+    """async_fetch_rates() falls back to GraphQL when REST returns 400 on a day/night tariff.
+
+    GH#5166: EDF day/night-structured tariffs (e.g. E-FLAT2R-EDF_STANDARD_VARIABLE-D) have no
+    /standard-unit-rates/ resource — the API answers HTTP 400 "This tariff has day and night
+    rates, not standard." That is as permanent as a 404, so it must reach the GraphQL fallback
+    instead of being logged as a failure on every cycle. Auth cannot change a 400, so unlike the
+    404 path there must be no authenticated retry of the same URL.
+    """
+    api = make_kraken_api(provider="edf", account_id="A-9C006563")
+    api.current_tariff = {"tariff_code": "E-FLAT2R-EDF_STANDARD_VARIABLE-D", "product_code": "EDF_STANDARD_VARIABLE"}
+    api.import_mpan = "1900000000456"
+    api.failures_total = 0
+
+    graphql_rates = [{"value_inc_vat": 27.5, "value_exc_vat": round(27.5 / 1.05, 4), "valid_from": "2026-09-19T00:00:00Z", "valid_to": "2026-09-21T00:00:00Z"}]
+    api.async_fetch_rates_graphql = AsyncMock(return_value=graphql_rates)
+
+    mock_session = AsyncMock()
+    mock_session.get = MagicMock(side_effect=lambda url, **kwargs: _mk_get_ctx(400))
+    mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+    mock_session.__aexit__ = AsyncMock(return_value=None)
+
+    with patch("aiohttp.ClientSession", return_value=mock_session):
+        result = asyncio.run(api.async_fetch_rates())
+
+    assert result is graphql_rates
+    api.async_fetch_rates_graphql.assert_called_once_with("1900000000456", account_id="A-9C006563")
+    assert mock_session.get.call_count == 1, f"400 must not trigger an authenticated retry, got {mock_session.get.call_count} REST requests"
+    assert api.failures_total == 0, "A recovered 400 must not count as a failure"
+
+
+def test_fetch_rates_rest_400_falls_back_to_graphql_for_export():
+    """A day/night-structured EXPORT tariff's 400 falls back on the export MPAN and account.
+
+    The 400 gate shares the fallback wiring with the 404 path, which selects export_mpan and
+    export_account_id for an export tariff — but only the 404 side of that wiring was covered,
+    so a 400 mis-routed to the import MPAN/account would have passed the suite.
+    """
+    api = make_kraken_api(provider="edf", account_id="A-9C006563", export_account_id="A-EXPORT456")
+    api.current_tariff = {"tariff_code": "E-1R-IMP-01-J", "product_code": "IMP-01"}
+    api.import_mpan = "1900000000456"
+    export_tariff = {"tariff_code": "E-FLAT2R-EDF_EXPORT_VARIABLE-D", "product_code": "EDF_EXPORT_VARIABLE"}
+    api.export_tariff = export_tariff
+    api.export_mpan = "2000000000789"
+    api.failures_total = 0
+
+    graphql_rates = [{"value_inc_vat": 15.0, "value_exc_vat": round(15.0 / 1.05, 4), "valid_from": "2026-09-19T00:00:00Z", "valid_to": "2026-09-21T00:00:00Z"}]
+    api.async_fetch_rates_graphql = AsyncMock(return_value=graphql_rates)
+
+    mock_session = AsyncMock()
+    mock_session.get = MagicMock(side_effect=lambda url, **kwargs: _mk_get_ctx(400))
+    mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+    mock_session.__aexit__ = AsyncMock(return_value=None)
+
+    with patch("aiohttp.ClientSession", return_value=mock_session):
+        result = asyncio.run(api.async_fetch_rates(tariff=export_tariff))
+
+    assert result is graphql_rates
+    api.async_fetch_rates_graphql.assert_called_once_with("2000000000789", account_id="A-EXPORT456")
+    assert mock_session.get.call_count == 1, f"400 must not trigger an authenticated retry, got {mock_session.get.call_count} REST requests"
+    assert api.failures_total == 0, "A recovered 400 must not count as a failure"
+
+
+def test_fetch_rates_rest_400_no_fallback_without_import_mpan():
+    """async_fetch_rates() returns None and counts a failure when REST 400s with no MPAN to fall back on."""
+    api = make_kraken_api(provider="edf")
+    api.current_tariff = {"tariff_code": "E-FLAT2R-EDF_STANDARD_VARIABLE-D", "product_code": "EDF_STANDARD_VARIABLE"}
+    api.import_mpan = None  # Not yet discovered
+    api.failures_total = 0
+    api.async_fetch_rates_graphql = AsyncMock()
+
+    mock_session = AsyncMock()
+    mock_session.get = MagicMock(side_effect=lambda url, **kwargs: _mk_get_ctx(400))
+    mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+    mock_session.__aexit__ = AsyncMock(return_value=None)
+
+    with patch("aiohttp.ClientSession", return_value=mock_session):
+        result = asyncio.run(api.async_fetch_rates())
+
+    assert result is None
+    api.async_fetch_rates_graphql.assert_not_called()
+    assert api.failures_total == 1
+
+
 def test_fetch_rates_transient_error_does_not_fall_back_to_graphql():
     """async_fetch_rates() returns None (no GraphQL fallback) for transient errors like 500/429."""
     for status_code in (429, 500, 503):
@@ -1397,6 +1481,79 @@ def test_fetch_rates_404_graphql_fallback_empty_counts_one_failure():
     assert api.failures_total == 1
 
 
+def test_fetch_rates_404_then_network_error_on_retry_still_falls_back_to_graphql():
+    """A network error during the authenticated retry must not lose the GraphQL fallback.
+
+    _fetch_rates_rest returns (None, None) on a network error, which would otherwise erase the
+    404 the public attempt just proved and drop the cycle into the generic-failure path — losing
+    a private product's rates to a transient blip even though GraphQL would have served them.
+    """
+    import aiohttp
+
+    api = make_kraken_api()
+    export_tariff = {"tariff_code": "E-1R-EDF_EXPORT_SEG_12M_HH-B", "product_code": "EDF_EXPORT_SEG_12M"}
+    api.export_tariff = export_tariff
+    api.export_mpan = "2000000000789"
+    api.failures_total = 0
+
+    graphql_rates = [{"value_inc_vat": 15.0, "value_exc_vat": round(15.0 / 1.05, 4), "valid_from": "2026-09-19T00:00:00Z", "valid_to": "2026-09-21T00:00:00Z"}]
+    api.async_fetch_rates_graphql = AsyncMock(return_value=graphql_rates)
+
+    call_count = [0]
+
+    def get_side_effect(url, **kwargs):
+        """Public attempt 404s; the authenticated retry fails with a connection error."""
+        call_count[0] += 1
+        if call_count[0] == 1:
+            return _mk_get_ctx(404)
+        raise aiohttp.ClientConnectionError("connection reset")
+
+    mock_session = AsyncMock()
+    mock_session.get = MagicMock(side_effect=get_side_effect)
+    mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+    mock_session.__aexit__ = AsyncMock(return_value=None)
+
+    with patch("aiohttp.ClientSession", return_value=mock_session):
+        result = asyncio.run(api.async_fetch_rates(tariff=export_tariff))
+
+    assert result is graphql_rates
+    assert call_count[0] == 2, "expected an unauthenticated attempt then an authenticated retry"
+    api.async_fetch_rates_graphql.assert_called_once_with("2000000000789", account_id="A-TEST123")
+    assert api.failures_total == 0, "rates recovered via GraphQL must not count as a failure"
+
+
+def test_fetch_rates_graphql_fallback_failure_counts_one_failure_not_two():
+    """A GraphQL fallback that fails internally is counted once, not once per counting layer.
+
+    async_graphql_query increments failures_total on every one of its own failure paths (auth
+    unavailable, no token, non-200, GraphQL errors, network), so async_fetch_rates must not add
+    a second count for the same cycle: for a day/night tariff whose GraphQL is down that would
+    score 2 every 5 minutes and mislead anything watching the metric for component health.
+    """
+    api = make_kraken_api(provider="edf", account_id="A-9C006563")
+    api.current_tariff = {"tariff_code": "E-FLAT2R-EDF_STANDARD_VARIABLE-D", "product_code": "EDF_STANDARD_VARIABLE"}
+    api.import_mpan = "1900000000456"
+    api.failures_total = 0
+
+    def graphql_failure(mpan, account_id=None):
+        """Stand in for a fallback that failed inside async_graphql_query, which counts its own."""
+        api.failures_total += 1
+        return None
+
+    api.async_fetch_rates_graphql = AsyncMock(side_effect=graphql_failure)
+
+    mock_session = AsyncMock()
+    mock_session.get = MagicMock(side_effect=lambda url, **kwargs: _mk_get_ctx(400))
+    mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+    mock_session.__aexit__ = AsyncMock(return_value=None)
+
+    with patch("aiohttp.ClientSession", return_value=mock_session):
+        result = asyncio.run(api.async_fetch_rates())
+
+    assert result is None
+    assert api.failures_total == 1, f"one failed cycle must count once, got {api.failures_total}"
+
+
 def test_connection_nodes_extracts_edges():
     """_connection_nodes returns node dicts from a Relay connection and tolerates other shapes."""
     from kraken import KrakenAPI