SAFETY-119 review: DECISIONS states the worst delay and the no-warn case

The delay is 11 cycles, so up to 11 min at a 60 s cycle. A loop that loses
the wire again within 11 cycles is never counted; review measured one such
case (N=2, cheap-window charge, no forecast, house just over the rating).
The over-rating rule applies on cycles the loop decided. Text only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC

goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md

@@ -14,22 +14,24 @@ battery gave what it was told, and the cap held.
 **Decision.** After a hand-back, the loop's integrator bound is not counted
 until the plant's settle has passed (`SHORT_CYCLES` cycles and
 `SHORT_SPAN_S`, the window SAFETY-85 grades a battery on). After that it
-counts as before. An over-rating (`clamped`, a bug) always counts. No command
-changes, and no text was added or changed.
+counts as before. An over-rating (`clamped`, a bug) on a cycle the loop
+decided always counts. No command changes, and no text was added or changed.
 
 **Kept.** The loop in charge at its rail warns on the same cycle as before.
-A loop still at its rail after a hand-back warns once the window has passed:
-22 s at a 2 s meter, 55 s at 5 s. Delay, not loss. The start and a restart
-after a stop are not hand-backs.
+A loop still at its rail after a hand-back warns 11 cycles later (at least
+22 s): 22 s at a 2 s meter, 55 s at 5 s, 11 min at a 60 s cycle. The start
+and a restart after a stop are not hand-backs.
 
 **Re-pinned.** test_safety84 (all six) and test_safety87 (`n1_crossing`,
 `n1_above`, `n1_charge_low`): only OUTPUT_CLAMP log rows differ; commands and
 claims are the same (`test_safety119.py` part 5).
 
-**Open.** If another owner and the loop swapped the wire every few cycles,
-each swap restarts the window and the loop's bound would not be counted.
-A loop at its rail beats a floor or ceiling on its own side, so it keeps the
-wire; a swap needs a claim that keeps outranking it.
+**Open.** Each hand-back restarts the window, so a loop that loses the wire
+again within 11 cycles is never counted. Seen in review: N=2 (2 x 2500 W), a
+5 s meter, a cheap-window charge with no usable forecast, a house 50-100 W
+over the 5000 W rating. The guard and the charge took the wire back at least
+every 11 cycles. 0 notifications in 2 h, 28 without this rule. The cap held.
+From 200 W over the rating it warns about once a quarter.
 
 **Not changed.** The kick itself is control behaviour: for a few seconds at
 a quarter's edge the loop asks up to its rail. In `test_safety119.py` part 1