SAFETY-126 round 2: state what the 10 W tolerance costs; test the latch reset

Text only (DECISIONS, DOCS, CHANGELOG): a step load alarms on the same cycle
as before; a steadily rising load alarms a little later; with peak_margin_w 0
a period can end up to 10 W over the limit without this alarm, as for 'Load
too high' (SAFETY-81). Owner accepted 2026-10-31.

test_safety126.py part 2: after a real overrun ends, _peak_landing()'s latch
is reset and the night's later landings are quiet (review F3).

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-126-landing-error-is-not-an-overrun.md

@@ -25,16 +25,21 @@ no "Battery stopped limiting the peak" event hint. The claim, the floor and the
 commands are unchanged.
 
 **Still alarms.** House load the batteries cannot cover under the reserve:
-the period would end over the aim with the batteries at 0 W, so the alarm
-fires on the same cycle as before (both under the reserve; a 6 500 W house
-during the night charge). SAFETY-87's case (others able, graded on the limit
-for `ALARM_HOLD_S`) and SAFETY-81's 'Load too high' notification are unchanged.
-A period heading at most 10 W over the aim no longer alarms with nothing able
-to give. That is SAFETY-81's landing tolerance. `misses_aim()` takes the house
-as meter plus batteries, so an export nets off. `decide()`'s projection counts
-offtake only. So a re-alarm while the loop's draw on held batteries covers the
-house with some export, and the period lands under the aim, is gone too
-(test_safety126.py part 2, modes off: 2 notifications, was 4).
+the period would end over the aim with the batteries at 0 W. A step load
+alarms on the same cycle as before. SAFETY-87's case and SAFETY-81's 'Load too
+high' notification are unchanged.
+
+**What the 10 W tolerance costs** (review, owner accepted 2026-10-31):
+- A steadily rising load alarms a little later, once the projected miss passes
+  10 W (3 000 -> 4 000 W over 45 min: 56 s later). With the default 50 W
+  margin the alarm still comes before the limit.
+- With `peak_margin_w` 0, a period can end up to 10 W over the limit without
+  this alarm, the tolerance 'Load too high' already accepts (SAFETY-81).
+
+`misses_aim()` takes the house as meter plus batteries, so an export nets
+off (`decide()`'s projection counts offtake only). A re-alarm while the loop's
+draw on held batteries covers the house is gone too (test_safety126.py part 2,
+modes off: 2 notifications, was 4).
 
 **Not changed.** The one-cycle floor itself: at a period's last instant the
 guard still asks an able battery for its rating, or stops a charge, for a