SAFETY-94: a healthy battery that lags or reverses is not flagged as frozen or refusing

The stale-reading gate counted its 35 s from the register's last change, so
after a rest the first read after a new command tripped it (SAFETY-58; live
2026-10-03, four trips 1 s after the command). It now counts only the time
the command asked the register to move.

At N=1 the refusal engaged after 12 frozen cycles if the reading was under
100 W at that moment, which a battery reversing through its lag passes at a
1 s meter. The refusal now needs the N>1 evidence at every roster size: under
100 W, one way, for 12 cycles spanning 22 s, restarting when the reading
moves 50 W towards the ask.

DECISIONS/SAFETY-94-lagging-battery.md; test_safety94.py.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/app/control.py

@@ -484,6 +484,7 @@ def compute(
     refused: int | None = None,
     probe: bool = False,
     bound: tuple | None = None,
+    gave_nothing: bool | None = None,
 ) -> Decision:
     """One control cycle. A cycle is one meter update (~5 s on a HomeWizard P1).
 
@@ -497,6 +498,10 @@ def compute(
     `bound`    OPT-11: `(lo, hi)`, what the batteries may place this tick with
                their modes applied (`allocator.loop_bound()`), or None. See
                MODE_BOUND below. None is the law as it was.
+    `gave_nothing` SAFETY-94: the caller's span check - the reading stayed
+               under REFUSED_BELOW_W, one way, for SETTLE_CYCLES spanning
+               REFUSED_SPAN_S. A refusal engages only with it. None leaves it
+               out (compute() alone, as before).
     """
     reason = "tracking"
     # OPT-11: a bound that leaves out 0 W would FORCE a direction, which no
@@ -817,9 +822,14 @@ def compute(
     # `saturation_w` is a refusal, not a slow plant. The drop to 0 skips the slew
     # limit because it only removes an ask the battery is not meeting.
     if refused is not None:
+        # SAFETY-94: and only when the reading has given nothing for the
+        # whole span, not just now. `sat_count` also counts the cycles a
+        # healthy battery spends reversing through its lag (-2000 W towards
+        # +800 W): at a 1 s meter its 12 cycles end as the reading passes 0.
         if (refused == 0 and frozen and sat_count >= SETTLE_CYCLES
                 and abs(prev_w) > tuning.saturation_w
-                and abs(actual_w) < REFUSED_BELOW_W):
+                and abs(actual_w) < REFUSED_BELOW_W
+                and gave_nothing is not False):
             refused = 1 if prev_w > 0 else -1
         if refused and refused * i_w < 0:
             refused = 0                          # the loop wants the other way