MAINT-21 round 2: keep the move pure - revert the added DECISIONS text, restore cut comments

Router T241: the comments commit had put new rationale into
MAIN-orchestration.md and cut comment lines that the note at 56fc41f did not
hold.

- DECISIONS/MAIN-orchestration.md is the 56fc41f text plus the one sentence
  that the Controller is split into app/main.py and app/ctl_*.py.
- Comments whose content is not in a DECISIONS note at 56fc41f are back in the
  code verbatim: MAINT-05 one config, the SAFETY-02, SAFETY-42/34,
  SAFETY-30 site half, SAFETY-31 and SAFETY-18 latch blocks in __init__, the
  _grade_store_migration docstring and comment, the trade_power_w docstring,
  the rows.py docstrings.
- Kept: cuts of text already in the note, the SMA-10 / SAFETY-137 / SMA-2
  pointers, the SAFETY-32 line fix.

No code change: maint21_same_ast OK, maint20_same_code -OO same.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/app/ctl_tasks.py

@@ -21,8 +21,13 @@ _LOG = logging.getLogger("goodwe")
 class TasksMixin:
     def _grade_store_migration(self, store) -> None:
         """DEV-02. Did SAFETY-02's latch actually survive the key rename?
-        Graded on EVERY start: a latch that silently fails to move is a
-        disarmed safety guard, so a disagreement re-arms it by hand.
+        Graded, not performed: a latch that silently fails to move is a
+        DISARMED SAFETY GUARD on an install that believes it is protected. The
+        pre-DEV-02 flat value is compared with what the roster came up with; a
+        disagreement re-arms the latch by hand (the fail-safe direction is ON).
+        It runs on EVERY start, not only the migrating one: gating on `rep.ran`
+        swallowed store.py's rule-2 round trip (upgrade, downgrade with a trip
+        in the window, upgrade; performed on this site 2026-09-02).
         DECISIONS/MAIN-orchestration.md."""
         rep = self.store_migration
         if rep.ran and not rep.ok:
@@ -33,10 +38,16 @@ class TasksMixin:
         legacy_tripped = bool(data.get("sign_tripped", False))
         if not legacy_tripped or not self.inverters:
             return
-        # Is any namespaced latch set THAT A MACHINE READS (SAFETY-44)? Asked
-        # of the STORE's keys, not the roster's objects. On the roster: stop;
-        # off-roster `UNIT_A`: repair onto `inverters[0]`; any other
-        # off-roster name: stop. DECISIONS/MAIN-orchestration.md.
+        # The question is "is any namespaced latch set THAT A MACHINE READS"
+        # (SAFETY-44), asked of the STORE's keys, not the roster's objects:
+        # re-arming A off a flat key that B's trip mirrored would latch a
+        # healthy inverter on every restart. Three cases: on the roster, stop;
+        # off-roster named `UNIT_A` (the broken migration's fingerprint),
+        # repair onto `inverters[0]`; off-roster, other name: stop unless a
+        # stranded `UNIT_A` latch is present. This guard is the ONLY repair for
+        # sites upgraded before the fix. Residual: a first unit really named
+        # `inverter-a`, latched and removed, is re-armed on `inverters[0]`
+        # (conservative). DECISIONS/MAIN-orchestration.md.
         on_roster = {inv.name for inv in self.inverters}
         stranded, on_roster_latched, other_off_roster = [], False, False
         for k, v in data.items():