SAFETY-97: centre the band on the idle reading clamped to 75 W

Owner decision 2026-10-04 (review R1). A wrong idle reading more than
about 100 W off hid every refusal on that battery. Clamped under the band,
the band keeps 0 W +-25 W, so a battery reading about 0 W while refusing is
caught whatever was learned or restored. Samples are still taken to 250 W.
Beyond about +-170 W of idle a battery behaves as in 0.14.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-97-idle-offset.md

@@ -1,8 +1,9 @@
 # SAFETY-97 - "gives nothing" is graded against each battery's idle reading
 
 **Status: implemented 2026-10-04, folded into PR #171 (SAFETY-94), for
-review.** Tests: `test_safety97.py` (rig: `tools/safety94_rig.py`). Closes
-SAFETY-94 review finding F1.
+review.** Owner decision 2026-10-04: the band's centre is clamped to
++-75 W (see Bounds). Tests: `test_safety97.py` (rig: `tools/safety94_rig.py`).
+Closes SAFETY-94 review finding F1.
 
 ## The defect
 
@@ -27,10 +28,11 @@ B sat on the band's edge and never latched:
   than 50 W, and while refused it does not learn, so its refusal cannot be
   learned as idle. A capped battery under a big ask is not sampled either.
 - **How:** the first value is the mean of 120 s of samples; then it follows
-  drift with a 30 min time constant. A sample beyond 250 W (`IDLE_MAX_W`)
-  is dropped (a register held at a giving value); the value is clamped to it.
+  drift with a 30 min time constant. A sample beyond 250 W (`IDLE_SAMPLE_W`)
+  is dropped (a register held at a giving value). The band is centred on
+  the value clamped to 75 W (`IDLE_MAX_W`; owner decision below).
 - **Restart:** saved per unit (`unit/<name>/idle_w`, on first learn and each
-  5 W move) and restored, clamped. Without it a battery refusing from the
+  5 W move) and restored, clamped to 250 W. Without it a battery refusing from the
   start is never quiet, so never learned, so never caught.
 - **Until learned the idle reading is 0 W**: the rule as it was.
 
@@ -70,16 +72,29 @@ Every test of "gives nothing / gives / takes" now uses `reading - idle`:
 | SAFETY-30 per-unit sign | unchanged: opposition needs both over 250 W; B's 100 W idle cannot make or hide one alone |
 | SAFETY-42 shortfall | unchanged: B reads ~100 W short at every power, which errs towards reporting (report only) |
 
-## Bounds
+## Bounds: owner decision 2026-10-04 (review R1)
 
-- Band: `|reading - idle| < 100 W`, `|idle| <= 250 W`.
-- A correct idle reading: a refusing B behaves as a refusing A.
-- A wrong one (worst, 250 W off): a refusing battery reading outside the band
-  is not refused by this rule; a frozen register is still caught by the stale
-  gate at 35 s of asking. Learning only at a ~0 W command for 2 min keeps a
-  wrong value unlikely. Once learned, a 10 min transient moves it by 28 %;
-  the first value (a 2 min mean) is the exposed one.
-- An idle reading beyond 250 W is never learned: such a unit keeps 0 W.
+Band: `|reading - centre| < 100 W`, centre = idle clamped to +-75 W.
+
+- **Why a clamp under the band.** A wrong idle reading (taught during a
+  rest while the reading shows something else, e.g. a grid top-up of a unit
+  held at 0 W, or restored onto a swapped inverter) more than about 100 W off
+  hid every refusal on that battery, at N=1 and N=2; with the first +-250 W
+  clamp the rig missed a refusing A whenever the error was 110-250 W. At
+  +-75 W the band always keeps 0 W +-25 W, so a battery reading about 0 W
+  while refusing is caught whatever was learned or restored, and a wrong idle
+  cannot refuse a healthy 0 W battery (its ask is over 200 W).
+- **The trade-off.** Options: keep +-250 W (covers idle readings to about
+  +-350 W, any 100 W mis-learn hides refusals); clamp to +-75 W (chosen);
+  "old band or centred band" (rejected: a correct B would need to give 200 W
+  to answer its 200 W probe).
+- **Cost.** A battery whose idle reading is beyond about +-170 W is centred
+  at most 75 W out, so its refusal falls outside the band: it behaves as in
+  0.14.0 (not caught by this rule). B (-95 to -118 W) reads 20-43 W from its
+  clamped centre. B is caught across -150..+90 W of error in its idle
+  reading; learned 110 W or more too high it is missed, as in 0.14.0 at N=2.
+- A frozen register is still caught by the stale gate at 35 s of asking.
+- Recovery from a wrong value needs quiet time: tau 30 min.
 
 ## Catch times (rig, refusing from 200 s after a 400 s rest, +-4 W)