SAFETY-38: correct the survivor count, which was stated four ways

Review found the summary lines miscounted, and one of the miscounts filed
a KILL among the survivors. The authoritative tables in §7e and §7f were
right throughout; only the sentences a reader actually relies on were
wrong.

Arithmetic, from §7f's own ledger:
  14 measured = 10 surviving
              +  1 already caught  (C3 allocator.py:162, red in test_alloc.py)
              +  3 caught by round 4 (C6 clamp.py:253, C7 peakguard.py:493,
                                      B12 arbiter.py:264)
Survivors by file: TWO in allocator.py (C1 :154, C2 :160), three in
arbiter.py (C4a/C4b :344, C5 :392), two in tariff.py (C8, C9), two in
arbitrage.py (B17, B18), one in main.py (B19). Two, not three, in
allocator.py - C3 is the kill.

Before: DECISIONS §6c said "Nine" while listing eleven; the CHANGELOG said
"11 SURVIVORS" while listing eleven. Both counted C3 as a survivor.

⚠️ KEPT VISIBLE RATHER THAN QUIETLY FIXED. This is this card's own
recurring defect in prose rather than in code - a claim wider than the
measurement beneath it - and it is the second false statement this ticket
has put into its own decision record. The correction says so at the line,
because a document whose whole value is that it can be trusted should
record when it could not be.

No app/ change; no test change. Full suite: 21 passed, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/DECISIONS/SAFETY-38-site-standing-pin.md

@@ -640,11 +640,21 @@ below, unpinned.
 
 **Open, named, and measured — see §7f for the ledger:**
 
-* **Nine further zero-byte survivors** found by the widened scan, each measured
-  at 21/21 green on this tree: three in `allocator.py`'s `UnitPlan.explain()`,
-  three in `arbiter.py`'s two `explain()`s, two in `tariff.py`, and one each in
-  `arbitrage.py`'s two decision reasons and `main.py`'s SoC-floor notification.
+* **TEN further zero-byte survivors** found by the widened scan, each measured
+  at 21/21 green on this tree: **two** in `allocator.py`'s `UnitPlan.explain()`
+  (C1 :154, C2 :160), three in `arbiter.py`'s two `explain()`s (C4a, C4b :344,
+  C5 :392), two in `tariff.py` (C8, C9), two in `arbitrage.py`'s trade reasons
+  (B17, B18) and one in `main.py`'s SoC-floor notification (B19).
   None is a control decision; every one is a sentence an operator reads.
+  ⚠️ **CORRECTED after review, and the error is worth keeping visible.** This
+  bullet first said "Nine" while listing eleven, and the CHANGELOG said eleven
+  while listing eleven — and BOTH counted `allocator.py:162` (C3) among the
+  survivors when §7f records it as a KILL, red in `test_alloc.py`. The
+  authoritative tables in §7e and §7f were right throughout; only the summary
+  sentences a reader actually relies on were wrong. That is this card's own
+  recurring defect in prose rather than in code: a claim wider than the
+  measurement beneath it. Arithmetic, from §7f: 14 measured = 10 surviving +
+  1 already caught (C3) + 3 caught by this round (C6, C7, B12).
 * **The action-log surface of the peak-guard idle line** (`main.py:1951`) is
   not pinned. The status row (3313) is, and both come off the same `explain()`,
   so the *sentence* is closed and the *second call site* is not — which is