feat: experimental native joint EV and home battery planning

[arturonaredo]

Summary

Experimental native joint planning for #5490: a fixed-rate EV and domestic battery
are scheduled together against house demand, PV, tariffs, import/power limits,
losses, curtailment, manual domestic minimum targets and terminal value.

Default off. Shadow remains isolated. Apply is a separate, explicitly gated path;
it has not been activated on hardware. This draft is not a production recommendation.

• Searches preparation, all eligible tariff bands, battery support and subsequent
  replenishment over the complete forecast horizon, not just a cheap-price label.
• Preserves EV pause/restart hysteresis and elapsed OFF cooldown, fixed EV power,
  domestic reserve and timed manual minimum targets. Unsupported overrides block.
• Independently replays each candidate through native Prediction in nominal and
  PV10 cases. Conditional stale-SOC hypotheses are shadow-only and retain blockers.
• Separates expected availability from physical connection and permission. Dated
  sessions expire without next-day renewal.
• After departure, explicit apply can replan the remaining household horizon
  with EV OFF, including replenishment and future manual floors. New nominal/PV10
  replays and every existing evidence/connection/permission gate remain required;
  this is not a stale-data recovery fallback or proof of the EV departure target.
• mode: apply stages only a successful candidate, then revalidates the current
  command inside execute_plan, dispatching through the real
  Inverter.adjust_charge_immediate entry point. Legacy window merging cannot
  erase the joint hold/charge transition or execute another plan on top.
• Apply currently requires the separate local DEYE adapter, a valid ordered
  six-row table, commissioned hold, unchanged limits, fresh field-specific SOC and
  connection timestamps, an explicit permission entity and actual relay state.
• Only a successfully observed battery command can grant a bounded EV-slot lease.
  The existing external EV executor remains the sole switch-service writer. EV OFF
  must be observed before the joint executor withdraws battery support.
• Missing/rejected/pending/stale inputs withdraw the EV signal. Read-only,
  calibration, manual ceiling, Octopus Intelligent and native-plan followers are
  unsupported/gated in apply. Legacy plan broadcasts are suppressed in apply.

Independent PRs and control boundary

This branch starts from upstream main; it does not include #5486's import
diagnostic or #5497's local-DEYE adapter. It is independently testable in off/shadow;
apply deliberately fails closed without the optional DEYE implementation. The
three PRs are combined only in a separate personal integration branch.

The separate apply_verified and ev_executor_lease_verified configuration flags
default false. A matching external EV executor must reject expired/malformed leases
independently of further Predbat updates. This PR neither installs that automation
nor creates another EV executor. Installation-specific expiry latency is a gate.

HA read-back means observed, not hardware confirmation. Reports retain
ready_to_activate: false and hardware_confirmed: false. Standing current limits,
ToU times, work mode, reserve and shutdown settings are not raised or rewritten.
Blocked apply does not perform speculative inverter recovery writes: the last
accepted ToU controls can persist and must be covered by commissioning/recovery.
Ordinary best-plan graphs remain the independent baseline, not the applied joint
trajectory. Session expiry is explicit and does not automatically authorise a new EV session.

Validation

At signed/verified head affe7766d707d2d6701ef017f94ddcaf1914a412:

• Complete local runner with PREDBAT_KERNEL_REQUIRED=1: PASS, no exclusions
  (116.51 seconds; combined head also passed the full runner in 116.75 seconds).
• Joint suites: 19 pure solver cases, 36 native bridge cases, four limited-discharge
  cases, 59 apply contract cases and 17 native entry-point/guard cases.
• Real calculation/replay → native Execute → DEYE entry point tested on an offline
  combined fixture over 48 hours (576 staged commands): household replenishment
  dispatch (18 simulated services), wait for observed EV OFF (zero services),
  and rejection of a later injected EV ON command (zero services).
  Zero physical services in every case; these are synthetic transport tests.
• Read-only fork CI run 38227641825
  passed all three exact PR heads and combined head
  2966374e454d7b5e9d230d618d78c88cf2d3949f. Downloaded artifacts verify SHA,
  pre-commit, required-kernel quick tests and original x86_64 parity (450 random
  configurations per head). Local full runs also include all four slow suites.
• Prepared external-executor lease adaptation tested using the installed HA Core's
  real schema/template/script engines on an isolated in-memory instance:
  33 checks pass, zero live services, not installed.
• Pre-commit and documentation build pass; three pre-existing documentation
  warnings remain. GitNexus refreshed and affected scope reviewed (high risk at
  native entry points); no claim that unit tests establish electrical safety.

The prior eight-hour checkpoint and its per-revision durations remain documented
in the final observation comment. That observation concerns the earlier shadow
revision, not this apply implementation. It did not demonstrate a fresh EV SOC
at departure or achievement of the departure target.

Upstream workflow execution still requires a maintainer's fork-run approval.
Independent read-only fork CI does not substitute for that approval or a merge-ref run.

[arturonaredo]

Combined local shadow trial — initial evidence, not the final-duration report

The three independent draft PRs are #5486 (import diagnostics), #5497 (local DEYE)
and #5498 (joint planning). They are combined on
arturonaredo/batpred:test/three-pr-shadow-20261012.

• Initial combined revision 7a800b7e67bcb60781740c16fe0efd89f20d1d82 installed at
  2026-10-12 00:32:55 UTC. Revision
  f9cdd87e4107df91f618adc1e8783c927b1f2de9 installed at 00:49:00 UTC.
  Both have GitHub-verified signatures. The latter includes feat: experimental native joint EV and home battery planning #5498's clock fix
  5653cc0e; it must not be credited with the earlier revision's runtime duration.
• Only Predbat was restarted. Source/config hashes, protected automation/template
  files and configured ceilings were independently checked after installation.
  SK remains the real inverter profile and the existing single EV executor remains
  in control; both experimental outputs are non-executing. The unchanged bounded
  passive audit retains its original stop time.
• Full quick suites passed on the two independent feature branches and their
  combination with the native kernel required. Four existing slow suites were
  excluded. Both golden debug cases passed on the combination. Post-clock-fix
  focused tests for all three features passed. Pre-commit passed; docs retain
  three unrelated pre-existing warnings. This is local evidence, not a claim
  that upstream CI has approved or passed these fork runs.

What the live trial has found so far:

1. Fresh HA observations later than Predbat's rounded five-minute reference were
   incorrectly rejected as future-dated on startup. Fixed in feat: experimental native joint EV and home battery planning #5498, with a regression
   using a mid-slot startup and a separate rejection for genuinely future data.
2. The existing six-row physical timetable is not sequential. DEYE correctly reports
   blocked; a separately labelled sorted-table hypothesis succeeds in memory.
   The real timetable was not modified and this is not a hardware-commissioning pass.
3. The joint model currently reports no_plan_found for the observed configuration.
   This is a bounded-search/model result, not proof of physical infeasibility and
   not readiness to activate. Investigation continues.
4. Existing native SK hold behaviour can command 0 A discharge. Verification
   distinguishes that temporary command from the preserved configured ceiling;
   no competing process forces the register back upward.

As of 00:55 UTC, this is roughly 22 minutes of combined-trial evidence,
not eight hours. The final comment will state actual observed duration per revision,
coverage gaps/stale readings, successes, failures and remaining activation gates.
No activation, outage/disconnection experiment, increased current limit or BMS
bypass is part of this trial. Private captures/configuration/vehicle identifiers
are retained locally and are not attached to the PRs.

[arturonaredo]

Shadow trial update — corrected planner and command replay installed

The integration branch now runs signed revision
2e62ea57e5a39943a96e37bd65f97b0867d8c4bb, installed 2026-10-12 03:37:59 UTC.
It combines #5486, #5497 at 68682c7a, and #5498 at 091716c8. Two subsequent
healthy native cycles and installed/protected-file hashes were verified.

Corrections supported by a real-data replay:

• Reproduced 576 native battery-SOC points with 0.0 kWh difference before
  evaluating alternatives. The data snapshot was taken at 01:04 UTC, not now.
• Added a limited battery-discharge action (fixed per-period battery power ceiling;
  EV remains full-rate), and reachability pruning for future manual SOC minima.
• A bounded forecast-envelope retry produces a candidate passing native nominal
  and PV10 checks over 2880 minutes, with modelled peak import 5998.5 W.
• All 576 candidate steps were translated through the real inverter entry
  point in memory: 804 simulated services, no real services. The table-repair
  and hold-commissioning assumptions remain explicitly labelled, not fulfilled.
• Native prediction hot loop and kernel ABI are unchanged. These numbers are
  simulation evidence, not measured savings, physical confirmation or optimality proof.

Validation: the complete local test runner, with the native kernel required,
passed without the quick-suite exclusions (113.47 s). The four slow suites
also passed separately; both golden cases, pre-commit, docs and 33 isolated tests
of the installed HA executor passed. Upstream CI remains action_required;
these local results do not replace upstream approval.

Live findings and preserved boundaries:

• Vehicle SOC stopped updating. Optional conditional_* scenarios retain the
  original timestamp/age and freshness blocker; they never represent an old
  value as a fresh measurement or authorise activation.
• The real ToU timetable remains unchanged and blocked for activation.
• Logbook reconciliation resolved the suspected short automatic restart: rapid
  ON events had direct authenticated-action context, not executor attribution.
  The attributed automatic restart waited 604.6 s. No guard was rewritten and
  no restart experiment was performed.
• The original bounded audit remains untouched. Its old forecast check references
  retired external-planner entities, so that portion is unchecked; supplemental
  captures record the current native diagnostic and joint outputs.

SK and the existing EV executor still control the installation. There is no joint
apply route or automatic activation in this trial. The final comment will report
actual observation duration per revision, gaps, deadline evidence and remaining
implementation/commissioning blockers after the bounded window ends.

[arturonaredo]

Observed PR source: 091716c82864650cf05d356614dfadc53e0c4653.

The live shadow did not demonstrate that the EV departure target was met. A successful earlier offline candidate does not change that evidential limit; staged apply development is outside this observation evidence.

Final bounded shadow-observation checkpoint — not an activation approval

The scheduled eight-hour checkpoint closed at 2026-10-12 07:37:44 UTC.
It did not provide eight hours on any one installed revision. Three independent
PRs were combined only for this personal shadow installation; existing native
control and the sole Home Assistant EV executor retained physical authority.

Combined revision	Installed at (UTC)	Elapsed until replacement/checkpoint
7a800b7e67bc	2026-10-12T00:32:55.731601+00:00	0h 16m 4s
f9cdd87e4107	2026-10-12T00:49:00.191482+00:00	2h 48m 59s
2e62ea57e5a3	2026-10-12T03:37:59.309487+00:00	3h 59m 44s

Combined-installation elapsed time: 7h 4m 48s.
There were 94 passive five-minute HA-cache captures, from
2026-10-11T23:47:26.576775+00:00 to 2026-10-12T07:33:03.477804+00:00; earlier captures precede
the first combined installation. Collector errors: 0.
Captured native-error records: 0; captured gaps
over 420 seconds: 0. These are sample
results, not continuous health or electrical measurements.

Observed outcome and limits

• Final read-only verification confirmed installed source hashes, protected
  automation/template hashes and configured limits unchanged. Grid ceiling 6000 W;
  domestic reserve/shutdown 10%/5%; charge/discharge ceilings 3000 W/8192 W
  (59 A/160 A). Temporary native current commands below those ceilings are valid.
• Maximum grid value in the five-minute captures was
  5970 W. Recorder reconciliation additionally
  found a 6060 W observation at 00:30:43.896975 UTC, followed 0.825625 seconds
  later by the EV relay OFF attributed to the existing HA executor with the grid
  sensor as trigger. Its grid <= 6000 guard rejects that value. Shadow did not
  send that OFF. Coarse sampling therefore cannot establish absence of peaks.
• The historical last_reported value is not reconstructible from ordinary
  recorder last_updated; no second freshness-guard failure is claimed. The
  source of the simultaneous total-load increase is also undetermined.
• Recorded post-OFF domestic-SOC samples before departure were 18–21%, below
  the existing 25% restart gate. No forced restart or reduced reserve was used.
  Separate recorder/logbook reconciliation found an automatic OFF-to-ON interval
  of 604.616 seconds; faster examined ON events had direct authenticated-action
  context, not automatic-executor attribution.
• At the exact 07:30 local departure checkpoint, EV SOC had no fresh reading:
  the last reported value was 53%, dated 00:30:09 UTC. 100% by departure was not
  demonstrated, nor is 53% claimed as a fresh departure measurement. The dated
  session then became departure_passed, with no proposed EV windows or next-day
  automatic renewal.
• Joint states sampled: {"conditional_no_plan_found": 22, "departure_passed": 25, "invalid_input": 9, "no_plan_found": 12, "unsupported": 26}.
  Conditional calculations retained the stale-input blocker. The real ToU table
  remains unordered and hold/firmware/topology/capacity commissioning is unfinished.

Reproducible software checks

The installed combined source previously passed the complete local native-kernel
runner without exclusions, both golden replay cases and isolated installed-HA
executor checks (no physical switching). The real-data replay reproduced 576
native SOC points with zero error; a corrected offline candidate passed nominal
and PV10 over 2880 minutes. Command binding translated 576 steps through the real
DEYE inverter entry point against copied observations. These are software/model
checks, not measured target attainment or commissioned hardware behaviour.

All three published PR heads also passed a read-only GitHub Actions matrix on
the fork: https://github.com/arturonaredo/batpred/actions/runs/38216980983. Each job checks its exact SHA, runs all pre-commit checks,
builds the kernel, runs quick tests (four slow suites skipped), and verifies the
original checked-in x86_64 binary, including 450 random parity configurations.
The harness cannot push commits and did not modify any PR branch.
This is head-SHA evidence, not the upstream merge-ref run or maintainer approval.

Maintainer request: please approve the pending upstream code-quality run
for this fork PR. My account lacks upstream write permission; no approval policy
has been bypassed or changed.

Decision

Not ready to activate. The observed installation is still off/shadow-only.
An explicit apply implementation is being developed separately and has neither
been installed nor observed in this window. Fresh EV/connection evidence, ordered
physical ToU configuration, hold and installation-specific commissioning, and
reviewed executable integration remain prerequisites. There was no automatic
activation. The independent original audit retains its separate stop at
2026-10-12 14:55:57.696791 UTC; its legacy forecast references do not establish
native forecast verification, and its outstanding incident/T6 work is not closed.

[arturonaredo]

Default-off apply implementation and separate shadow rollout

The gated native execution path is now published at signed/GitHub-verified
6c6dcf8705d04d9287e898d9e32387bf37d3da80. The independent DEYE and import
diagnostic PR heads are unchanged. The personal combined test head is
84bc4a9c9e3858cfb4f041bbdea09815c03108ad, also signed and verified.

Software evidence

• Read-only fork CI run 38223083470
  passed all four exact heads: Add configurable whole-site import diagnostics (no enforcement) #5486, feat: add experimental local Deye ToU adapter and isolated preview #5497, feat: experimental native joint EV and home battery planning #5498 and the combination.
  Downloaded artifacts confirm the tested SHAs, all-file pre-commit, required-native-
  kernel quick tests and original checked-in x86_64 parity (450 random configurations
  per head). The workflow cannot auto-commit or push.
• The combined local full required-kernel runner passed in 119.57 s, including
  all four slow suites and the golden debug cases; no exclusions. Apply has 59
  contract tests and ten native entry-point/guard tests.
• Offline real solver/replay → native Execute → real DEYE inverter entry point:
  twelve captured simulated HA services, zero physical services.
• A proposed lease guard for the existing sole external EV executor passed 33
  checks using actual HA schema/template/script engines on an isolated Core.
  It is not installed. No new EV executor or hardware polling was added.

New shadow installation, not an apply trial

Installed the combined head at 2026-10-12T08:37:26.431229Z, with a scoped
backup/restart of Predbat only. Read-back at 08:37:46Z and 08:40:09Z verified
source/protected-file hashes, healthy native cycles, existing SK control, preserved
limits and both apply attestations false. The existing HA executor, real ToU
table and standing current/reserve settings were not changed.

Joint state is departure_passed; local-DEYE shadow is blocked. Those are
honest gates, not a successful applied plan. No new control was activated.

The earlier final observation comment remains unchanged and applies only to its
earlier revisions. Its 94 samples and per-revision durations do not count as
observation of this new head, much less as evidence that apply works electrically.

Still not ready to activate

Ordered physical ToU, commissioned hold/topology/current sharing, fresh EV-field
observations, external-executor expiry behaviour and recovery of persistent
inverter controls still require commissioning. Session-end household control is
also under review: the current apply gate closes the dated session rather than
automatically renewing it or silently falling through to legacy execution.
The backup incident and physical EV departure target remain unproven.

The original bounded audit retains its original end and unchanged source/timer
hashes. Its legacy forecast checks do not establish native forecast acceptance.
Elapsed audit time cannot close the outstanding physical recovery cases.

Maintainer action remains required: please approve upstream fork workflows.
This fork-head run is not an upstream merge-ref check or approval to merge/activate.

[arturonaredo]

Session-end correction validated; remains shadow-only on hardware

Follow-up to the preceding implementation note: the household-continuation gap
is fixed at signed/GitHub-verified head
affe7766d707d2d6701ef017f94ddcaf1914a412.

After a dated EV session ends, explicit apply can calculate a new house-only
plan with nominal and PV10 replay across the full horizon. It keeps the measured
EV SOC, waits for observed relay OFF before withdrawing battery support, prohibits
EV ON anywhere in the closed-session plan, and does not roll the session into the
next day. Expiry during dispatch also revokes authority. Every existing freshness,
connection, permission, manual-floor, read-only and commissioning guard remains;
this is not a fallback for missing or stale EV evidence.

Verified software

• Local complete required-kernel runners: joint 116.51 s, combined 116.75 s,
  no exclusions; all four slow suites and golden debug cases included.
• 59 apply contract tests + 17 native entry-point/guard tests, including the
  failing-before/passing-after expiry regression, observed OFF interlock, future
  EV injection rejection, exact departure/next-day boundaries and dispatch expiry.
• Three offline real solver/replay → Execute → real DEYE scenarios, each with a
  48-hour / 576-command candidate. The replenishment case dispatched 18 simulated
  HA services; the two blocked cases dispatched zero. Zero physical services.
• Fork CI run 38227641825
  passed all three exact PR heads plus combined head
  2966374e454d7b5e9d230d618d78c88cf2d3949f. SHA/artifact checks, pre-commit,
  required-kernel quick tests and original x86_64 parity (450 random configurations
  per head) verified. Add configurable whole-site import diagnostics (no enforcement) #5486 and feat: add experimental local Deye ToU adapter and isolated preview #5497 are unchanged.

Separate shadow installation

Combined head 2966374e454d7b5e9d230d618d78c88cf2d3949f was installed at
2026-10-12T09:14:08.684096Z. Only two runtime modules and the version marker
changed; configuration bytes, the existing SK controller, the sole HA EV executor,
real ToU table and standing limits were preserved. Predbat alone was restarted
after a scoped backup.

Read-back at 09:14:29Z and 09:15:10Z verified installed/protected hashes,
healthy native cycles and both apply attestations still false. Joint shadow
remains departure_passed, DEYE shadow blocked, ready_to_activate: false.
This short deployment check is not an apply trial or eight-hour observation.

Hardware commissioning, fresh field-specific EV evidence, the proposed external
lease consumer, persistent-control recovery and the unresolved backup incident
still block activation. The historical EV departure target was not demonstrated.
The original audit end is unchanged; timer completion alone cannot close T6's
physical cases. Earlier observation comments remain valid only for their stated
revisions and durations.

Upstream workflows still require maintainer approval. Fork-head CI does not
substitute for upstream merge-ref validation. This remains a draft, not a
production-readiness or hardware-safety claim.

[arturonaredo]

Local three-PR validation and review status

#5486, #5498 and the replacement #5505 are now Ready for review. This updates the earlier draft-status wording, not the hardware/commissioning claims or the revisions covered by the earlier deployment evidence.

Fresh complete local suites, with a freshly built native kernel and PREDBAT_KERNEL_REQUIRED=1:

Tree	Exact published head	Registered test groups	Result
#5486	1a4368f2acf362f076fd2282f968bc6f0c910a81	341	Pass, 160.97 s
#5498	affe7766d707d2d6701ef017f94ddcaf1914a412	345	Pass, 163.19 s
#5505	718476cc446d8354080c73599038e952e70d3342	345	Pass, 162.10 s
Local combination of those heads	Uncommitted integration tree	351	Pass, 131.22 s

No quick-mode exclusions; golden debug cases and the slow suites ran. Source hashes matched before/after. The only merge conflict was the test registry: both sets of imports, isolated runners and registrations were retained. All pre-commit hooks pass; MkDocs builds with only the pre-existing unrelated warnings. No PR head was changed.

Important: suite success is not joint-apply compatibility

An additional cross-PR probe constructed the real DeyeSolarman Inverter from the shared YAML, rather than the fake DEYE inverter used in isolated apply tests:

• Native joint shadow reports unsupported / freeze_required; the new template deliberately has no commissioned hold/freeze capability.
• Apply is blocked with its default attestations. Even with affirmative synthetic test-only attestations, it remains blocked by the unsupported inputs/capabilities. The EV-slot signal is OFF and there are zero service attempts.
• The old deye_local adapter was not included to make the test pass. The additional dependencies on that adapter, the DEYE type and the immediate-control power/result contract remain a separate migration task.

The probe also retained a bounded-search limitation: in a synthetic 48-hour, zero-PV/1 kW household case with a 25 kWh EV starting at 13%, charging at 6.77 kW and due at 07:30, the default beam width 128 returned no_plan_found. Width 512 found a counterfactual candidate passing nominal and PV10 native replays over all 2,880 minutes, using the companion raw import diagnostics (peak 5,997.3 W against a 6,000 W limit). A separate hand-constructed trajectory also passed both replays. The default-width miss is therefore retained as a search limitation, not called physical infeasibility or silently counted as success.

No live HA/inverter/EV configuration, limits, controller ownership or deployment changed during these tests. The wider-beam result is a model-only finding, not evidence that #5505 can execute its hold/limited-discharge actions. Upstream CI/maintainer review and physical commissioning remain separate gates.

[arturonaredo]

Published the joint-planner integration/search fixes in signed commit 66d92ec5ae1f61a19e9acbdd129059731e47486f. These changes belong to this PR; the heads and ownership of diagnostics #5486 and the shared template/core #5505 are unchanged.

• New explicit deye_solarman model searches only the real template's demand/charge capabilities. No hold, limited discharge, old adapter resurrection, physical ToU-time, global-current or protection writes.
• The no-hold beam now retains both cost and stored-energy alternatives, fixing the demonstrated feasible-trajectory pruning miss without increasing the default beam or changing the default all-mode ranking. A bounded, reported retry remains available; no optimality/infeasibility claim is made.
• Apply uses the actual native Inverter.adjust_charge_immediate plus the original verified sequences, with canonical six-row source/SOC preflight, complete observation, model/mapping drift checks and fail-closed partial failures. Commissioning, permission, independent SOC/connection freshness, EV hysteresis/cooldown and expiring sole-executor lease gates remain intact.
• This PR still imports/tests independently without Add shared Deye/Solarman template with observed service sequences #5505: missing-core guards pass, and the two optional real-template groups explicitly identify the unavailable dependency. PREDBAT_JOINT_TEMPLATE_REQUIRED=1 makes absence a test failure for combined validation, never a hidden skip.

Fresh required-kernel full suites passed: 348 groups standalone (including missing-core rejection; real-template scenarios explicitly unavailable) and 354 groups with #5486 + #5505, the latter with the real template required and zero optional skips. Pre-commit and MkDocs also passed; source/index hashes remained unchanged during both suites. The combined 48-hour fixed-power EV scenario passes nominal/PV10 native replay under the grid cap and dated departure target.

This is software/test evidence, not physical commissioning, deployment or upstream CI approval. HA read-back remains observed, never hardware-confirmed; live hardware activation is still gated. No running Home Assistant installation, inverter or EV executor was changed. This PR remains Ready for review, not a claim of production readiness.

Upstream code-quality run 38258472061 currently reports action_required with no jobs. The local passing suites do not bypass that GitHub workflow gate or establish an upstream CI result.

[arturonaredo]

Real-site follow-up for published repair 66d92ec5ae1f61a19e9acbdd129059731e47486f: a code-only runtime update was integrated on the previously installed baseline rather than importing unrelated upstream runtime changes. 353 registered groups passed with the real shared template required and zero optional integration skips, plus isolated installation/rollback tests. Published joint runtime modules are byte-identical in that installation; a small local compatibility bridge keeps the new custom profile separate from the already installed old adapter while preserving SK's existing path. That bridge is not a change to this PR.

An isolated replay of cached real household/heating history, rates and PV forecasts reproduced the original native baseline (576 SOC points, zero error). With the actual shared custom Inverter, fixed EV 6.77 kW, last-known EV energy 3.25 kWh, target 25 kWh, domestic reserve 10%, and unchanged charge/discharge 3000 / 8192 W, the proposed next dated session produced a conditional_candidate. Both native 48-hour scenarios passed with peaks 5498.6 / 5948.8 W below 6000 W. The last proposed EV interval ends 2026-10-13 01:55 +02:00, before the proposed 07:30 +02:00 departure. Native full-step EV energy 25.049 kWh is the conservative replay envelope, not evidence of physical overcharging or actual target completion.

The installed update is healthy over two fresh normal native plan cycles. Hash-verified backup and guarded, code-only rollback are available; they do not restore old configuration/automations over later user edits. Existing EV sole executor, tariffs, forecasts/history, manual domestic targets, 59 A / 160 A, shutdown 5%, 15% / 25% hysteresis and 600 s OFF delay were preserved.

Live joint apply was not enabled. The installed controller remains SK/shadow; the shared profile is staged as an inactive example, not an active migration. EV SOC is stale, field-specific fresh connection/SOC evidence and commissioning of persistent inverter control / independent EV lease expiry remain outstanding. The old dated live session was not renewed as execution authority. Real-data calculation works conditionally; live hardware behaviour and departure success are unverified. Upstream workflow approval remains separate from these local results.