OPT-11 P1 review: a mode never beats the peak floor; SAFETY-03 kept at the rail

- arbiter: a mode now gives way only as far as a site limit above P_MODE
  needs (_unit_modes at N>1, _site_mode at N=1). Before, the modes were
  released only when the peak floor bound S, so a trade won above the floor
  kept them and placed less than the floor (an Off battery at N=1 went to 0 W
  under a 2000 W floor), and a capped grid charge released an Off battery.
  While released, held batteries weigh 0 and carry only the shortfall.
- control: a side of the loop bound that reaches the rail is left to the
  rail, so SAFETY-03's i_clamped still fires with every battery on.
- opt11_identity: add maintenance scenarios and a 6000-case arbiter digest
  (peak floor, trades, maintenance, refusals); a5dddad digests pinned.
- tests: test_arbiter part 11, test_control (g), test_modes (0/1 refused,
  loop bound counts live units only). DOCS and DECISIONS say the new rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UBtqPrG1mDLXzTEBnhEkkV

goodwe_controller/DECISIONS/OPT-11-battery-modes.md

@@ -1,14 +1,21 @@
 # OPT-11 - battery modes, per battery
 
 A battery's mode (on/off, Solar first, Leftover solar) is a soft unit limit at
-`P_MODE` = 35 that always holds 0 W, applies only while the site target is
-decided at or below 35, and is released by anything above it, such as the peak
-guard. Design and owner answers: `goodwe-session/OPT-11-design.md` (2026-09-27);
+`P_MODE` = 35 that always holds 0 W. A SET above 35 (a safety stop) overrides
+it; a limit above 35 (the peak guard) makes it give way only as far as that
+limit needs, and a battery its mode holds back then carries only what the
+others cannot (`arbiter._unit_modes()`, `_site_mode()`). Design and owner answers: `goodwe-session/OPT-11-design.md` (2026-09-27);
 P1 is its section 6 P1, and the pull request lists what was measured.
 
 - Off by default (`battery_modes_enabled`); off, commands are byte-identical to
   a5dddad (`test_modes.py` part 1).
-- Off is a mode range, so the peak guard can still use an Off battery (design
-  sections 2-3). Whether Off should be absolute is an open owner question.
+- Off is a mode range, so the peak guard can still use an Off battery when the
+  others cannot cover the floor (design sections 2-3). Whether Off should be
+  absolute is an open owner question.
+- Review (PR #149): releasing only when the peak floor bound S let a trade won
+  above the floor keep the modes and place less than the floor, and let a
+  capped grid charge release an Off battery. Both are graded in
+  `test_arbiter.py` part 11. The loop bound leaves a side that reaches the
+  rail to the rail, so SAFETY-03 still flags a loop winding into it.
 - In P1 only Off closes a direction; Leftover solar differs by charging last.
   Price runs, selling (`pack_sell`, reserved) and the forecast are P3/P4.