SAFETY-40 review: integrator-bound WARNING gets its own notification id

A later anti-windup notice could replace a write-path BUG SIGNAL notice
under the shared goodwe_output_clamp id (escalation ignores the budget).
The WARNING now uses goodwe_integrator_bound and points to DOCS; the
cadence sentence in DOCS is corrected. Tests pin both ids (red on fd14569).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DOCS.md

@@ -1641,10 +1641,10 @@ other guard's entries out of it.
 **There is nothing to configure**, deliberately. The bound is `max_w`, which you
 already set; giving the guard a limit of its own would be a second number that
 can disagree with the first, which is exactly the failure the startup validation
-exists to prevent. The alarm's cadence - at most one notification per 150 s
-(an episode that has not yet notified does so once it has engaged 3 cycles in
-a row), cleared after 3 clean
-cycles - is fixed for the same reason `RAIL_FRAC` is: it describes the
+exists to prevent. The alarm's cadence - normally at most one notification per
+150 s (an episode that has not yet notified does so once it has engaged 3
+cycles in a row, and an over-rating has its own 150 s budget), cleared after 3
+clean cycles - is fixed for the same reason `RAIL_FRAC` is: it describes the
 notification bus, not the plant.
 
 WARNING: **on a default install the engagement you will see is the integrator's,
@@ -1657,10 +1657,12 @@ every standard configuration.
 **The integrator bound is not a bug, and it is reported as what it is.** It
 reads *"the loop's integrator reached its +5000 W anti-windup bound; the loop's
 command this cycle was +2000 W"*, titled *"the control loop is at its integrator
-bound"*, logged as a `WARNING`, with an amber (not red) status row. Brief
+bound"*, logged as a `WARNING`, with an amber (not red) status row and its own
+notification (`goodwe_integrator_bound`), so it never replaces a BUG SIGNAL
+notice still on screen. Brief
 engagements after a large load or solar step are normal. If it stays engaged,
 check that the battery is following its commands. Only a command over the rating
-carries the BUG SIGNAL text, and it never waits behind integrator-bound notices.
+carries the BUG SIGNAL text, and it has its own notification budget.
 Why: [`DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md`](DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md).
 
 ### The frozen-meter alarm