SAFETY-85 review: grade discharge only, over the plant's settle time

Rule 2 graded each battery against last cycle's command and graded charges
too. On plantsim's battery (10 s lag) at the 2 s meter it warned at every
drain or charge start and 15 times an hour under the peak guard at N=2; a
charge tapering near full warned 11 times in 50 min (SAFETY-42 section 7).
Now a discharge is graded against the least it stood at over SHORT_CYCLES /
SHORT_SPAN_S. DOCS lists `mode-bound` under Loop reason. test_safety85 part 7:
peak guard with a dead battery, lagging plant, taper; part 3: the bound ends
with maintenance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DOCS.md

@@ -577,7 +577,7 @@ accumulator is doing:
 | `Loop integrator lead` | W | that value minus **the command it was computed against**, i.e. the command the previous cycle left standing |
 | `Loop reason` | — | the law's own word for this cycle |
 
-`Loop reason` takes one of ten values:
+`Loop reason` takes one of eleven values:
 
 | value | what happened |
 |---|---|
@@ -588,6 +588,7 @@ accumulator is doing:
 | `slew-limited` | the command could not move as far as the integrator asked for; `slew_w` is what stopped it |
 | `saturated-freeze` | the inverter is not following, so the command's magnitude may fall but not rise |
 | `freeze-released` | the freeze had run out of plant-shaped explanations and the command was let move again |
+| `mode-bound` | the batteries' limits set the command, not the meter: their battery modes, or, with two or more inverters, a battery in its monthly maintenance |
 | `not-running` | control is stopped **and** shadow mode is off, so the loop did not run |
 | `battery refuses` | the battery gave less than 100 W for 12 cycles (a minute at a 5-second meter) while asked for more than 500 W, so the add-on asks 0 W in that direction (see below) |
 | `battery probe` | the add-on asks 200 W to test whether a refusing battery gives power again |
@@ -1954,10 +1955,12 @@ notification budget.
 Why: [`DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md`](DECISIONS/SAFETY-40-the-integrator-bound-is-not-a-bug.md).
 
 The integrator bound counts only on a cycle the loop decided. While
-maintenance, the peak guard or a safety limit sets a battery, the same alarm
-fires only when that battery gives more than `saturation_w` less than it was
-told, for `saturation_cycles` cycles. At two or more inverters the loop does not
-wind while maintenance holds a battery.
+maintenance, the peak guard or a safety limit sets a battery to discharge, the
+same alarm fires only when that battery gives more than `saturation_w` less
+than the least it was told over the plant's settle time (at least 23 s), for
+`saturation_cycles` cycles. A charge is not graded: a full battery takes less
+as it tops up. At two or more inverters the loop does not wind while
+maintenance holds a battery.
 Why: [`DECISIONS/SAFETY-85-no-false-not-keeping-up.md`](DECISIONS/SAFETY-85-no-false-not-keeping-up.md).
 
 ### The frozen-meter alarm
@@ -3130,8 +3133,9 @@ short time, for example just after a large load switches on or the sun comes
 out. It is not a fault, and control keeps running. If it keeps coming back,
 check that the battery is switched on, and that it is not empty (when it should
 give power) or full (when it should charge). During the monthly maintenance or
-while the peak limit is guarded, it only shows when the battery gives less than
-it was told. The status page counts how many times it happened.
+while the peak limit is guarded, it only shows when the battery gives
+clearly less than it was told. The status page counts how many times it
+happened.
 
 ### Power request too high
 
@@ -3237,8 +3241,8 @@ link cannot jump to the section.
 
 **Battery is not keeping up.** The grid-following loop's integrator reached its
 anti-windup bound (`integrator_max_w`, SAFETY-40), or a battery that another
-owner set gave less than it was told (SAFETY-85). No command went over the
-rating. The log line is a WARNING with reason code `OUTPUT_CLAMP`. See *The
+owner set to discharge gave less than it was told (SAFETY-85). No command went
+over the rating. The log line is a WARNING with reason code `OUTPUT_CLAMP`. See *The
 winding-loop alarm*.
 
 **Power request too high.** A computed command above a limit was cut before it