SAFETY-93 review: a charge that ends by a stale link or a refusal hands back smoothly too

A battery still in CHARGE but dropped by the allocator (stale link, or a
SAFETY-73 refusal contradicting its charge) left its -2000 W in the loop's
start point, and B went 0 -> -1600 W in one cycle. The end is now noted
after the unit claims are filed: in CHARGE, live and not contradicted.
Tests: part 6 (stale link, refusal) and a spy on the guard suspension.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-93-charge-end.md

@@ -25,6 +25,13 @@ step a cycle. The ending battery's own step (-2000 -> 0 W) is maintenance's
 pin, as before; it lowers the grid import. The end is kept until the loop
 next runs, so a missed poll on that cycle (the input hold) does not lose it.
 
+Review: a charge also ends, for the site, when the battery is still in
+CHARGE but can no longer be placed: a stale link or a refusal (SAFETY-73)
+drops it, and its -2000 W landed on B the same way (B 0 -> -1600 W at a
+1200 W house). So the end is noted after the unit claims are filed: a
+battery leaves the charge when it leaves CHARGE, is not live, or its own
+claims contradict. The guard suspending the charge (SAFETY-84) is no end.
+
 Why a start-point reseed, and not a per-battery slew in the allocator: the
 jump comes from one stale number at one edge, the kind of edge SAFETY-73
 (`_unit_refusal_end`) and OPT-11 P3 (`_reseed_run_edge`) already reseed.
@@ -39,6 +46,7 @@ The change stays at that edge; nothing else at N>=2 moves.
 | charge times out / A switched Off | B 0 -> -1600 | B 0 -> 400 |
 | guard suspended the charge, A gives 1825 | B step 675 W | B step 395 W |
 | missed poll on the end cycle | B 0 -> -1600 a cycle later | B 0 -> 400 |
+| A dropped mid-charge (stale link, refusal), house 1200 | B 0 -> -1600 | B 0 -> 400 |
 | N=1, both charge ends above | | byte-identical |
 
 No pinned digest moved: the 46 digests of `tools/*identity*.py` (N=1 and