SAFETY-52 review: a refusal is under 100 W, and any delivery ends it

- Engage (and seed from a stale stop) below REFUSED_BELOW_W, the probe's
  own 100 W answer, not below saturation_w: a battery derated to 100-499 W
  was held at 0 W ~93 % of the time.
- A reading of 100 W or more in the held direction ends the refusal, probe
  or not: at a 1 s meter SETTLE_CYCLES is 12 s, shorter than a healthy
  reading's lag, and that held a healthy step at 0 W until the next probe.
- test_refusal part 5b and a seed test; DOCS states the N>1 limit; the
  DECISIONS record carries the traced cause of the replay's extra trips.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-52-a-battery-that-refuses.md

@@ -19,12 +19,13 @@ instead and ran SAFETY-59's ~70 s trip cycle.
 
 1. **A refused direction is held at 0 W**, reason `battery refuses`. It engages
    in `compute()` when the freeze has held `SETTLE_CYCLES` and the reading is
-   within `saturation_w` of 0 against an ask beyond it. The drop to 0 skips
+   below `REFUSED_BELOW_W` (100 W, the probe's own answer) against an ask beyond
+   `saturation_w`. The drop to 0 skips
    the slew limit (it only removes an ask nobody meets). The direction is
    carried like `sat_count` (`refused=`, `Decision.refused`).
 2. **A 200 W probe every 15 minutes, 34 s long** (`PROBE_W`, `PROBE_EVERY_S`,
-   `PROBE_S`; twice `BATT_OBLIGED_S`). An answer of at least 100 W ends the
-   refusal. 200 W is below `freshness.MOVE_W` (250 W), so a probe cannot arm
+   `PROBE_S`; twice `BATT_OBLIGED_S`). A reading of at least 100 W in the held
+   direction ends the refusal, during a probe or not. 200 W is below `freshness.MOVE_W` (250 W), so a probe cannot arm
    the gate. The clock is main.py's `now_mono`; `compute()` stays clockless.
 3. **A gate trip while the loop is frozen on a ~0 W reading is a refusal** for
    control (`Controller._refusal_from_stale`). This is what stops the ~70 s
@@ -52,18 +53,43 @@ shapes, recovery with no sign change, the probe cadence, every exit).
 | plant | law | gate trips | request >1 kW above delivery | longest held | import / export kWh | worst 15-min |
 |---|---|---|---|---|---|---|
 | fitted | old | 85 | 113.3 h | 16.57 h | 112.0 / 35.2 | 3434 W |
-| fitted | new | 130 | 11.4 h | 0.21 h | 112.3 / 35.4 | 3456 W |
+| fitted | new | 130 (133 after review) | 11.4 h | 0.21 h | 112.3 / 35.4 | 3456 W |
 | offset 0 W | old | 1010 | 102.2 h | 16.58 h | 112.0 / 35.2 | 3434 W |
 | offset 0 W | new | 85 | 6.1 h | 0.33 h | 111.9 / 35.1 | 3434 W |
 
-The +22 W worst quarter and the +45 trips on the fitted plant follow the fit's
--22 W offset, which slowly charges the modelled pack above its floor while the
-hold stands. With the offset at 0 both vanish. That is inferred from these two
-rows and was not traced further. Rejected alternatives and their figures are in
+**Traced in review (#141).** The +22 W worst quarter is the old law's worst
+quarter too. There the old law stands at +2060 W on a pack giving 0 W, and the
+new law asks 0 W, which the fitted plant answers with its -22 W offset: 22 W
+charged from the grid. The fit above the floor reads `batt = cmd - 28 W`, so a
+real inverter asked 0 W may do the same. Of the 71 new-law trips with no
+old-law trip within 2 min, 59 come 85-97 s after an answered probe. The offset has lifted the modelled pack
+just above its floor, the probe is answered, control ramps, the pack empties
+again mid-ramp, and the gate trips, which re-seeds the hold. The other 12
+follow an other-direction exit the same way. On a site this is one
+`STALE_READING` ERROR line per answered probe at most, and only on a battery
+that answers a probe and then cuts out again. Catching the re-cut before the
+gate needs a faster engage than `SETTLE_CYCLES`, which accuses a healthy slow
+battery, so it is left to SAFETY-58/59. After the review changes below the
+fitted-plant row reads 133 trips (the delivery exit now also catches answers
+that arrive after the probe window); the other figures are unchanged. Rejected alternatives and their figures are in
 the phase A plan: bounding the integrator by demand made the worst quarter
 +541 W worse or cycled the gate 3368 times, and an SoC envelope needs the
 configured floor to be right and needs SoC.
 
+## Review changes (#141)
+
+- **"Gives nothing" is below 100 W, not below 500 W.** At `saturation_w` a
+  battery derated to 100-499 W (cold, a tapering battery) was held at 0 W for
+  ~93 % of the time: 300 W derated gave 86 Wh in 4 h against 1 200 Wh on the
+  old law. The capture has 0.11 h in that band, so the replay does not move.
+- **Any delivery ends the hold, not only an answered probe.** With
+  `meter_poll_s: 1` the 12 cycles last 12 s, less than a healthy battery's
+  reading lag (up to `BATT_OBLIGED_S`, 17 s). That engaged on a healthy step and
+  held it for 15 min. Now the late reading ends it within seconds (2 s held in
+  `test_refusal.py` part 5b).
+- **N>1 is stated as a limit in DOCS.** The pack limit there covers an empty
+  battery only when its cut-out level is configured right.
+
 ## Not covered
 
 A battery that gives a steady part of the ask (e.g. a 500 W keep-alive) is a