SAFETY-119 round 3b: no-clock budget, fixed-seed tests, accepted limits

The rolling budget now holds without a monotonic clock (it never refills).
Quarter-edge tests use seeds 1-3 at 2, 5, 10 and 15 s (no hand-picked seeds).
Re-pin comments point at part 6. DECISIONS lists the limits the owner
accepted with N=8 on 2026-10-20.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md

@@ -58,6 +58,22 @@ and 15 s the meter's lag puts the highest quarter 20 to 55 W over 5000 W,
 the same with and without the fix. Quarter-edge case, 15 s meter: the highest
 quarter is 2327 W to 2680 W, the same with and without the fix.
 
+**Accepted limits (owner, 2026-10-20, with N=8).** The owner accepted N=8
+knowing that:
+- at a 2 s meter the quarter-edge false alarm still shows on about 1 of 30
+  seeds (one notification in 2 h);
+- at a 15 s meter the case above warns in only 1 to 3 of the 7 quarters
+  (some runs are silent for more than one quarter in a row);
+- at a 30 s meter and slower it gives no warning in that case (0 in 2 h,
+  against 7 and 11 without the fix): a real bound is suppressed there;
+- the cap is exceeded at 10 s and slower in that case (and up to 2680 W of
+  2500 W at 15 s on the quarter edge), the same with and without the fix.
+A budget that follows the cycle length (10 cycles up to 3.5 s, 8 to 11 s, 6
+to 16 s, 4 beyond) met both cases on every swept seed at 1 to 20 s (at
+30 s: no false alarm, 3 to 5 of 7 quarters) in the dev round-3 sweep; it was
+not adopted. Without a monotonic clock the budget
+never refills, so a bound that stays is counted after 8 hidden cycles.
+
 **Kept.** The loop in charge at its rail warns on the same cycle as before.
 The start and a restart after a stop are not hand-backs. The quarter-edge
 kick of `test_safety119.py` part 1 stays hidden (0 warnings in 2 h at