SAFETY-95 review: test the stale-link and contradiction legs; refusal +1 only

F1: test_safety95 checks that a dropped draining battery is this rule's
(stale link, N=3, 4000 W: grid import 676 W vs base 786 W); kills R2.
F2: _charge_track tested directly with a contradicting drain (SAFETY-91's
pin as a floor against a closed pack); kills R3. Today a drain contradicts
only through a refusal; the clause stays, as a contradiction sends 0 W.
F3: a drain ends on a refusal only when the battery will not give
(refused > 0, as _held_back()); one that will not take still drains.
Tested both signs; kills R8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-95-drain-end.md

@@ -28,8 +28,11 @@ only). On the cycle a drain ends:
 4. Then the loop moves one slew step a cycle.
 
 A drain ends when its battery leaves DRAIN, is not live, its claims
-contradict, or it refuses (SAFETY-73's limit outranks the pin without a
-contradiction, so the refusal is read from the battery). The end is kept
+contradict, or it will not give (SAFETY-73's limit outranks the pin
+without a contradiction, so the refusal is read from the battery; +1 only,
+as `_held_back()`). Today a contradiction on a drain only arises through
+a refusal; the clause stays because a contradiction sends A 0 W, which is
+an end (tested directly). The end is kept
 until the loop runs (a missed poll). A dropped draining battery is this
 rule's, not `_reseed_drop()`'s. Order in one cycle: drop/rejoin
 (SAFETY-96), charge end (SAFETY-93), drain end (this) last; each moves the