SAFETY-94: a healthy battery that lags or reverses is not flagged as frozen or refusing

The stale-reading gate counted its 35 s from the register's last change, so
after a rest the first read after a new command tripped it (SAFETY-58; live
2026-10-03, four trips 1 s after the command). It now counts only the time
the command asked the register to move.

At N=1 the refusal engaged after 12 frozen cycles if the reading was under
100 W at that moment, which a battery reversing through its lag passes at a
1 s meter. The refusal now needs the N>1 evidence at every roster size: under
100 W, one way, for 12 cycles spanning 22 s, restarting when the reading
moves 50 W towards the ask.

DECISIONS/SAFETY-94-lagging-battery.md; test_safety94.py.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/app/main.py

@@ -281,6 +281,14 @@ def pack_energy_of(inv):
 # ordinary load steps. At 2 s and slower this changes nothing.
 REFUSED_SPAN_S = (_ctl.SETTLE_CYCLES - 1) * _ctl.LOOP_TICK_S
 
+# SAFETY-94: the evidence restarts when the reading has moved this far towards
+# the ask since the evidence began. A refusing battery reads flat (-4 W live,
+# 2026-09-06); live readings wander by under 25 W at rest (B's standby, -95 to
+# -118 W, 2026-10-03). A battery crossing the 100 W band on a first-order lag
+# gains 50 W in at most tau x ln(151/101) = 0.4 tau, so the evidence cannot
+# span REFUSED_SPAN_S unless the lag is over 54 s.
+REFUSED_PROGRESS_W = _ctl.PROBE_ANSWER_W / 2
+
 # SAFETY-85 review: a battery another owner set is graded against the least it
 # was told over the same span as above (the plant's measured settle time), so
 # a healthy battery still settling on a new command is not short.
@@ -1360,27 +1368,42 @@ class Controller:
                     self._unit_refusal_end(
                         inv, "the battery takes power the other way")
                 continue
-            if b is None:
-                continue        # a gap keeps the count: the gate's trip seeds
-            standing = inv.standing_w()
-            sign = 1 if standing > 0 else -1
-            # One direction throughout: a command that swaps sign every cycle
-            # (a flapping load) reads ~0 through the plant's own lag, and that
-            # is a battery following, not refusing (TEST-19 flapping family).
-            if abs(standing) > _ctl.PROBE_W and abs(b) < _ctl.REFUSED_BELOW_W:
-                if sign != inv.ref_sign or not inv.ref_count:
-                    inv.ref_count, inv.ref_since = 0, self._now_mono
-                inv.ref_count = min(inv.ref_count + 1, _ctl.SETTLE_CYCLES)
-            else:
-                inv.ref_count = 0
-            inv.ref_sign = sign
-            if inv.ref_count >= _ctl.SETTLE_CYCLES and (
-                    inv.ref_since is None or self._now_mono is None
-                    or self._now_mono - inv.ref_since >= REFUSED_SPAN_S):
+            sign = self._gave_nothing(inv)
+            if sign:
                 self._unit_refusal_start(
                     inv, sign,
-                    f"asked {standing:+.0f} W, the battery gave {b:+.0f} W "
-                    f"for {_ctl.SETTLE_CYCLES} cycles")
+                    f"asked {inv.standing_w():+.0f} W, the battery gave "
+                    f"{b:+.0f} W for {_ctl.SETTLE_CYCLES} cycles")
+
+    def _gave_nothing(self, inv) -> int:
+        """The refusal evidence, one cycle of it: the sign `inv` has given
+        under REFUSED_BELOW_W while asked over PROBE_W, one way, for
+        SETTLE_CYCLES spanning REFUSED_SPAN_S, else 0. SAFETY-73 at N>1;
+        SAFETY-94 adds it to the N=1 engage in compute()."""
+        b = inv.batt
+        if b is None:
+            return 0            # a gap keeps the count: the gate's trip seeds
+        standing = inv.standing_w()
+        sign = 1 if standing > 0 else -1
+        # One direction throughout: a command that swaps sign every cycle
+        # (a flapping load) reads ~0 through the plant's own lag, and that
+        # is a battery following, not refusing (TEST-19 flapping family).
+        if abs(standing) > _ctl.PROBE_W and abs(b) < _ctl.REFUSED_BELOW_W:
+            # SAFETY-94: a reading still moving towards the ask is a battery
+            # catching up through its lag, not one refusing: start again.
+            if (sign != inv.ref_sign or not inv.ref_count
+                    or sign * (b - inv.ref_from) >= REFUSED_PROGRESS_W):
+                inv.ref_count, inv.ref_since, inv.ref_from = (
+                    0, self._now_mono, b)
+            inv.ref_count = min(inv.ref_count + 1, _ctl.SETTLE_CYCLES)
+        else:
+            inv.ref_count = 0
+        inv.ref_sign = sign
+        if inv.ref_count >= _ctl.SETTLE_CYCLES and (
+                inv.ref_since is None or self._now_mono is None
+                or self._now_mono - inv.ref_since >= REFUSED_SPAN_S):
+            return sign
+        return 0
 
     def _site_refused(self):
         """Owner decision 4: every unit refuses the same way, so the site law
@@ -3162,8 +3185,9 @@ class Controller:
                        inv.batt_fresh.bound.move_w,
                        messages.reason_code(inv.batt_fresh.reason))
             _LOG.debug("Evidence for %s: %s.", inv.name, inv.batt_fresh.reason)
-            _LOG.debug("%s: the limits are unchanged over %.0f s, a command "
-                       "over %.0f W and a move by over %.0f W.", inv.name,
+            _LOG.debug("%s: the limits are unchanged for %.0f s while asked "
+                       "to move: a command over %.0f W that moved over %.0f W.",
+                       inv.name,
                        inv.batt_fresh.bound.unchanged_s,
                        inv.batt_fresh.bound.move_w,
                        inv.batt_fresh.bound.move_w)
@@ -4660,6 +4684,10 @@ class Controller:
                 refused=self.batt_refused if len(self.inverters) == 1
                 else self._site_refused(),
                 probe=probe,
+                # SAFETY-94: at N=1 the engage also needs the reading to have
+                # given nothing for the whole span, as at N>1.
+                gave_nothing=(bool(self._gave_nothing(self.inverters[0]))
+                              if len(self.inverters) == 1 else None),
                 # OPT-11: None unless battery modes are on. SAFETY-85: or while
                 # maintenance holds a battery at N>=2, so the loop does not
                 # wind past what the others can give and jump when it ends.