# SAFETY-137 - the shutdown 0 W is the last write every unit hears

SMA-10 made a hand-back release wait for a write already on its way
(`_release_last`, `Inverter.inflight`). A GoodWe unit skipped that, and rig 5b
saw a cycle write (-2 823 W) land after the shutdown 0 W and stay until relaunch.

Now the 0 W of shutdown and of the Stop button is a *last* write
(`_write_unit(last=True)`), for every driver:

- It first waits, at most `SETTLE_BUDGET_S` (2 s), for the writes already on
  its way to that unit (`_await_inflight`, shared with `_release_last`). A hung
  write is not waited out and not cancelled; the 0 W goes anyway.
- Once shutdown has begun (`stopping`), every other write (cycle, heartbeat,
  safety stop) is dropped at the same place, right before the write is created.
  That is the gate that keeps the control cycle quiet; the cycle itself needs
  no cancelling.
- Worst case for a GoodWe unit is 2 s + `WRITE_BUDGET_S` (4 s) = 6 s, the same
  as `HAND_BACK_WORST_S`; the units are handled together.

Not touched: the heartbeat's own timing, safety-stop paths, the maintenance
abort (still a plain 0 W).