SAFETY-119 round 3b: no-clock budget, fixed-seed tests, accepted limits

The rolling budget now holds without a monotonic clock (it never refills).
Quarter-edge tests use seeds 1-3 at 2, 5, 10 and 15 s (no hand-picked seeds).
Re-pin comments point at part 6. DECISIONS lists the limits the owner
accepted with N=8 on 2026-10-20.

Co-Authored-By: Claude <noreply@anthropic.com>

goodwe_controller/app/main.py

@@ -301,7 +301,8 @@ REFUSED_PROGRESS_W = _ctl.PROBE_ANSWER_W / 2
 SHORT_CYCLES, SHORT_SPAN_S = _ctl.SETTLE_CYCLES, REFUSED_SPAN_S
 # SAFETY-119: across all hand-backs, the loop's bound is hidden on at most
 # this many cycles in any ROLLING_S seconds (a budget measured in
-# DECISIONS/SAFETY-119-bound-after-hand-back.md).
+# DECISIONS/SAFETY-119-bound-after-hand-back.md). Without a monotonic clock
+# the budget never refills.
 ROLLING_BOUND_CYCLES, ROLLING_S = 8, 900.0
 
 
@@ -5886,7 +5887,8 @@ class Controller:
             self._handback = None
             return False
         if self.loop_clamped[0] and not self.loop_clamped[2]:
-            kept = tuple(t for t in self._hidden if not aged(t, ROLLING_S))
+            kept = tuple(t for t in self._hidden if now is None or (
+                t is not None and now - t < ROLLING_S))
             if len(kept) >= ROLLING_BOUND_CYCLES:
                 self._hidden = kept
                 return False