SAFETY-91 review: a held-back battery is released 1 point above its reserve

A SoC reading flipping across the reserve swapped ~1000 W between the
batteries on each flip (grid +-500 W with unequal lags). Also grades
next_quarter()'s staleness boundary (29.5 / 30.5 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-91-held-battery-last.md

@@ -22,6 +22,10 @@ guard asked for power.
   weigh 0 in every split where the site gives, not only for the peak. With
   nobody able (all held, or the rest refusing or dropped) nobody is held back
   and the split is as before.
+  Review: once held back, a battery stays so until its SoC reads more than 1
+  point above its reserve. A reading flipping 20/21 % otherwise swapped
+  ~1000 W between the batteries on each flip (grid +-500 W with A 10 s and
+  B 3 s lag). The guard's own permission (SAFETY-87) is unchanged.
 - `_drain_rise()`: while a battery is held back, a draining battery's pin
   becomes a floor at its drain rate (`lo`), so it rises towards its rating
   before the held one gives. Not for a held battery's own drain, not under a