SAFETY-126: a landing error on the aim is not an overrun

During the night grid charge under the peak reserve the guard alarmed
(ERROR PEAK_GUARD_FLOOR_LIMITED, "Battery stopped limiting the peak") and the
Batteries "Why" said "The peak limit needs power" at quarter ends, while every
quarter landed on the aim. The charge lands the period 0-7 W over the aim and
excess_w()'s 900 / remaining turns that into tens of kW in the last second;
with nothing able to give, check_peak_floor_limited() alarmed on any
wanted > 0.

Each cycle the guard wants power, _peak_landing() asks misses_aim(): with the
batteries at 0 W, does the period end more than ALARM_MISS_W over the aim? If
not, the decision is within_aim: no reserve alarm, no red peak row, no "Why"
peak. The claim and the commands are unchanged. A real overrun under the
reserve alarms on the same cycle as before.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/app/peakguard.py

@@ -504,6 +504,11 @@ class PeakDecision:
     # when they are not asked). See `place_on_able()`.
     held: tuple = ()
     able_w: float | None = None
+    # SAFETY-126: the guard wants power, but with the batteries at 0 W the
+    # quarter still ends within ALARM_MISS_W of the aim (`misses_aim()`), as
+    # for a landing error in its last second. Set by main.py. No alarm and no
+    # "Why" peak while it holds; the floor and the claim are unchanged.
+    within_aim: bool = False
 
     def explain(self) -> str:
         """Idle: the status row's plain words (UX-08). Engaged: `reason`, the
@@ -997,6 +1002,18 @@ def load_too_high(projection, *, batt_w, ceiling_w, achievable_w) -> bool:
     return ends_w - float(ceiling_w) > ALARM_MISS_W
 
 
+def misses_aim(projection, *, batt_w, target_w) -> bool:
+    """SAFETY-126. With the batteries at 0 W from now on, does the quarter
+    end more than `ALARM_MISS_W` over the aim (`target_w`)? `decide()`'s
+    `wanted > 0` asks the same question with no margin and with its gain, so a
+    1 W landing error in a quarter's last second reads as tens of kW. A grid
+    charge the add-on runs counts as stoppable: it is in `batt_w`. The caller
+    passes the lower of two cycles' battery readings, as for
+    `load_too_high()`. DECISIONS/SAFETY-126-landing-error-is-not-an-overrun.md."""
+    return load_too_high(projection, batt_w=batt_w, ceiling_w=target_w,
+                         achievable_w=0.0)
+
+
 def charge_headroom_w(decision) -> float | None:
     """SAFETY-45. The hardest this SITE may charge without putting the billed
     quarter over the ceiling, in W, positive - or None when nothing measured it.