SAFETY-94 review: tests for three surviving mutants; record two gaps

- test_safety94 part 4: time under 250 W is not counted; a command that
  swaps direction every cycle is never refusal evidence; a reading moving
  away from the ask does not restart the evidence. These kill review
  mutants R1, R3 and R6, which survived the PR's tests.
- DECISIONS: at N=1 a battery with B's standby offset no longer latches
  a refusal (SAFETY-97 now covers N=1); a part-time ask is caught after
  35/d s of wall time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-94-lagging-battery.md

@@ -88,7 +88,15 @@ the held number for one 35 s window of asking, so 35 < 75 < 85 still holds.
 ## Known gaps
 
 - B's standby offset (-95 to -118 W at idle) puts a refusing B outside the
-  100 W band some of the time, so a refusing B may not latch. Pre-existing,
-  not touched here.
+  100 W band some of the time, so a refusing B may not latch (SAFETY-97).
+  At N=2 this is unchanged. **At N=1 it is new:** the old one-instant check
+  caught such a battery in 17-105 s; the shared rule needs 12 cycles in the
+  band in a row and, on the review probe, never latched in 1200 s.
+- A command that asks only part of the time (a fraction d) is caught after
+  35 s of asking, which is 35/d s of wall time (0/1500 W every 5 s: 69 s).
+  SAFETY-30's per-unit check restarts when its command stops opposing the
+  held reading, which a lapsing ask normally does, so 35 < 85 holds there.
+  SAFETY-31's circulation check (75 s) ignores the command, so its margin
+  holds only while d >= 0.47.
 - A register frozen under a command that stays near the 250 W travel edge
   is caught late or not at all (survivor 2).