SAFETY-128: control does not act on late Home Assistant readings

Readings that Home Assistant delivers late but still changing passed
every staleness gate, so the loop corrected again each cycle an error
its last command had already fixed (10 s late: the give run swung and
exported to -1.9 kW), and the peak guard pushed to the inverter limit
on the same late figures (OPT-34 F-2).

app/lateness.py fits how long after a power request the meter shows
it. Over 8 s the readings are late: a request the battery reading has
not answered holds the loop (it may not lead the reading by more than
100 W) and caps the peak guard at what stands; unanswered for 23 s it
holds, then 0 W after stale_input_s. An amber row and one log line per
episode say so. With readings on time nothing changes (digests equal).

DECISIONS/SAFETY-128-late-readings.md; test_safety128.py.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC

goodwe_controller/app/control.py

@@ -298,6 +298,9 @@ PROBE_S = 34.0
 # command: every battery that may move this way is at its mode's limit.
 MODE_BOUND = "mode-bound"
 
+# SAFETY-128. The loop's reason while it waits for the readings to answer.
+WAITING = "waiting for readings"
+
 
 @dataclass(frozen=True)
 class Tuning:
@@ -486,6 +489,8 @@ def compute(
     bound: tuple | None = None,
     gave_nothing: bool | None = None,
     idle_w: float = 0.0,
+    hold: int = 0,
+    hold_w: float | None = None,
 ) -> Decision:
     """One control cycle. A cycle is one meter update (~5 s on a HomeWizard P1).
 
@@ -506,6 +511,9 @@ def compute(
     `idle_w`   SAFETY-97: what `actual_w` reads while the batteries give
                nothing (app/idle.py). The refusal's band and its end are
                centred on it. 0 is the law as it was.
+    `hold`     SAFETY-128: +1 / -1, the batteries have not answered the last
+               command that way (app/lateness.py), so the loop may not go
+               past `hold_w` (None: `prev_w`) that way. 0 is the law as it was.
     """
     reason = "tracking"
     # OPT-11: a bound that leaves out 0 W would FORCE a direction, which no
@@ -622,6 +630,11 @@ def compute(
             i_w = min(moved, i_w)
         else:
             i_w = max(moved, i_w)
+    # SAFETY-128: no further than `hold_w` until the readings answer the ask.
+    held_at = float(prev_w if hold_w is None else hold_w)
+    if hold and hold * (i_w - held_at) > 0:
+        i_w = held_at
+        reason = WAITING
 
     # OPT-11: the integrator does not wind past what the modes let the
     # batteries place. Only a side tighter than the rail is left in `bound`