SAFETY-73 review: a refusal needs 22 s of evidence, and the cut-out warning is for giving only

- REFUSED_SPAN_S: the 12 cycles of evidence must also span (SETTLE_CYCLES-1) *
  LOOP_TICK_S = 22 s. At a 1 s meter, lagged healthy readings refused both
  units 10-16 times an hour after load steps (site held 0 W). 2 s and slower
  ticks are unchanged.
- REFUSES_ABOVE_CUT_OUT only for a refusal to give power: a full battery that
  stops taking charge is always above its cut-out level.
- test_delivery: its wedged fixture (0.2 s cycles) no longer reaches a refusal;
  the release/1.0 checks are restored and a span check added.
- test_refusal_units: lagged-reading and full-battery plants, two new checks,
  U14/U15 in the mutation table. Stale "> 500 W" wording fixed. DOCS/DECISIONS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-73-refusal-per-inverter.md

@@ -26,14 +26,15 @@ standing import, new -16 W. Both cut out: old keeps asking two empty batteries
 
 1. **A refusing unit is closed in that direction** by its own P_SAFETY unit
    claim, source `refused`. It engages when the unit gives under
-   `REFUSED_BELOW_W` (100 W) for `SETTLE_CYCLES` (12) cycles in one direction
-   while asked more than `PROBE_W` (200 W), or when its stale-reading gate
+   `REFUSED_BELOW_W` (100 W) for `SETTLE_CYCLES` (12) cycles, spanning at least
+   `REFUSED_SPAN_S` (22 s), in one direction while asked more than `PROBE_W`
+   (200 W), or when its stale-reading gate
    trips on a held reading under 100 W. The allocator then hands its share to
    the others within their own limits (owner decision 1). It is a hard unit
    limit that always intersects, so OPT-11's P_MODE layer fits inside it.
 2. **It binds every strategy's ask on that unit** (decision 2): peak guard,
    arbitrage and maintenance are placed around it like the loop.
-3. **A refusal above the configured cut-out** logs INFO plus one WARNING ending
+3. **A refusal to give power above the configured cut-out** logs INFO plus one WARNING ending
    in `REFUSES_ABOVE_CUT_OUT` (decision 3). SAFETY-42/43 no longer report such a
    unit: its share is 0 W, and `account()` treats it as parked.
 4. **All units refusing the same way** pass that sign to `compute()`, so the
@@ -79,6 +80,20 @@ SAFETY-73 method made to raise.
   target: worst grid +0 W with the reseed. Phase A measured -1059 W without the
   reseed and the site hold.
 
+## Review changes
+
+- **The evidence must span 22 s, not only 12 cycles.** At a 1 s meter the 12
+  cycles were 11 s, shorter than a healthy reading's lag (dead time plus a
+  10-17 s publish). The reviewer's harness (real `Controller`, both units with
+  6 s dead time and a 13-17 s publish, load steps 300/3000 W every 2 min) then
+  refused both healthy units 10-16 times an hour, and each time the site held
+  0 W: +50-85 Wh import an hour and a +4.6 kW grid peak against +3.7 kW without
+  the refusal. At a 2 s tick there were none. `REFUSED_SPAN_S` is
+  `(SETTLE_CYCLES - 1) * LOOP_TICK_S`, so 2 s and slower ticks are unchanged.
+- **The cut-out WARNING is for a refusal to give power only.** A full battery
+  that stops taking charge is always above its cut-out level, and the WARNING
+  told the installer to check a setting that has nothing to do with it.
+
 ## Not covered
 
 - A unit that gives a steady part of its ask (100 W or more) is a limit, as at