SAFETY-95 review: test the stale-link and contradiction legs; refusal +1 only

F1: test_safety95 checks that a dropped draining battery is this rule's
(stale link, N=3, 4000 W: grid import 676 W vs base 786 W); kills R2.
F2: _charge_track tested directly with a contradicting drain (SAFETY-91's
pin as a floor against a closed pack); kills R3. Today a drain contradicts
only through a refusal; the clause stays, as a contradiction sends 0 W.
F3: a drain ends on a refusal only when the battery will not give
(refused > 0, as _held_back()); one that will not take still drains.
Tested both signs; kills R8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/test_safety95.py

@@ -37,6 +37,7 @@ logging.disable(logging.WARNING)
 import opt11_identity as rig                                   # noqa: E402
 import safety79_identity as s79                                # noqa: E402
 from app import main as app_main, packmode                     # noqa: E402
+from app.arbiter import Claim, P_MAINTENANCE, P_SAFETY         # noqa: E402
 from app.main import Controller                                # noqa: E402
 from app.maintenance import (CHARGE, DRAIN, DRAIN_TIMEOUT_MIN,  # noqa: E402
                              HOLD, IDLE, MaintResult)
@@ -332,6 +333,11 @@ _now, _old = _by[("complete", 3, 4000.0)]
 check("N=3 at 4000 W: the others take A's share at once, as before (the "
       "site does not drop), so the grid does not import",
       _now["imp"] <= 50.0 and abs(_now["imp"] - _old["imp"]) <= 50.0)
+_now, _old = _by[("stale link", 3, 4000.0)]
+check(f"⭐ stale link, N=3, 4000 W: a dropped draining battery is this "
+      f"rule's, not the link-drop reseed's, so the grid imports at least "
+      f"50 W less than base ({_now['imp']:.0f} W, base {_old['imp']:.0f})",
+      _now["imp"] <= _old["imp"] - 50.0)
 
 # ============================================================================ #
 print("\n2. the peak guard still binds across a drain end")
@@ -498,6 +504,39 @@ check("no drain ended: nothing moves (the integrator either)",
 _c._drain_tail, _c._settle, _c.grid = {A}, {}, -800.0
 check("the tail ends with A's settling (SAFETY-96's window)",
       _c._drain_grid_w(AB) == -800.0 and _c._drain_tail == set())
+_UA, _UB = (_c.actuator_of("maintenance", i) for i in _c.inverters)
+_drain = MaintResult(DRAIN, True, 2000.0, False, [])
+
+
+def drain_ends(extra, refused=0):
+    """`_charge_track` with A draining last cycle, its drain SET and the
+    claims `extra` on A: which drains it ends."""
+    _c._draining_was, _c._drain_ended = frozenset({A}), frozenset()
+    _c._charging_was, _c._charge_ended = frozenset(), frozenset()
+    _c.live_units = lambda: (_UA, _UB)
+    _c.inverters[0].refused = refused
+    try:
+        _c._charge_track([Claim.set("maintenance", P_MAINTENANCE, 2000.0,
+                                    actuator=_UA)] + extra, [_drain, _b])
+    finally:
+        del _c.live_units
+        _c.inverters[0].refused = 0
+    return set(_c._drain_ended)
+
+
+_rating = [Claim.limit("device", P_SAFETY, -2500.0, 2500.0, actuator=_UA)]
+check("a drain that still stands does not end (its rating binds, no "
+      "contradiction, no refusal)", drain_ends(_rating) == set())
+check("a drain whose limits contradict ends: A is sent 0 W (SAFETY-91's "
+      "pin as a floor against a closed pack)",
+      drain_ends(_rating + [
+          Claim.limit("maintenance", P_MAINTENANCE, lo=2000.0, actuator=_UA),
+          Claim.limit("pack", P_SAFETY, hi=0.0, actuator=_UA)]) == {A})
+check("a refusal ends a drain only if A will not give (+1); one that will "
+      "not take (-1) leaves the drain standing",
+      drain_ends(_rating, refused=1) == {A}
+      and drain_ends(_rating, refused=-1) == set())
+
 _n1c = run(1, 1200.0, store=store(1), dur=4.0)[1]
 _n1c.target, _n1c.i_w, _n1c._drain_ended = 2000.0, 5.0, frozenset({A})
 _n1c._reseed_drain_end([_pin], {A})