Merge release/1.0 into SAFETY-30

CFG-04 (#45) merged first and moved the base. Two conflicts, both resolved
as the union of the two sides:

- app/main.py: an import-block collision. CFG-04 added validate_unit_ranges
  to the .validate import; SAFETY-30 added AGAINST_METER, AGAINST_OWN_POWER,
  SIGN_OPTION_DEFAULTS and SignWatchdog to the .watchdog import. Neither
  side dropped anything, so the resolution keeps both lists whole.
- CHANGELOG.md: two adjacent new entries under ## Unreleased. Both kept.

Both sides also independently rewrote large parts of test_peakguard.py
(60 and 47 insertions against the merge base) and git merged them
textually, so the full suite was run on the MERGE RESULT rather than
inferred from the two parents: 19 passed, 0 failed, twice.

One caveat recorded rather than hidden: test_peakguard.py failed once
during the first sequential full-suite run and then passed 10/10 in
isolation and in two further full runs on this same tree. It passes on
both parents too, so this is the pre-existing flakiness CFG-04 already
disclosed, not a merge defect - it is timing- or load-sensitive. It sits
on the required CI context and can therefore block an unrelated merge at
random, which wants a card of its own.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/config.yaml

@@ -1,5 +1,5 @@
 name: GoodWe RS485 Controller
-version: "0.5.2"
+version: "0.6.0"
 slug: goodwe_controller
 description: >-
   Drives a GoodWe ES/BP battery inverter over RS485 by emulating its smart
@@ -39,6 +39,59 @@ options:
   batt_invert: false
   setpoint_entity: ""
 
+  # --- ARCH-01 / CFG-04: the inverter roster ---------------------------------
+  # ⚠️ EMPTY IS NOT "UNCONFIGURED", IT IS THE SINGLE-INVERTER CONFIGURATION, and
+  # it is what every install that upgrades into this version lands on. An empty
+  # list means THE FIVE FLAT KEYS ABOVE DESCRIBE THE ONE INVERTER - same
+  # entities, same rating, same behaviour, no operator action - which is the
+  # only migration story this key was allowed to have. `build_roster()` reads
+  # this and nothing else decides the shape.
+  #
+  # Declared, it REPLACES those five keys rather than extending them. Each entry
+  # names its own actuator, its own rating and its own sensors:
+  #
+  #   inverters:
+  #     - name: inverter-a
+  #       setpoint_entity: number.goodwe_a_setpoint_w
+  #       soc_entity: sensor.goodwe_a_soc
+  #       batt_entity: sensor.goodwe_a_battery_power
+  #       max_w: 5000
+  #     - name: inverter-b
+  #       setpoint_entity: number.goodwe_b_setpoint_w
+  #       soc_entity: sensor.goodwe_b_soc
+  #       batt_entity: sensor.goodwe_b_battery_power
+  #       max_w: 3000
+  #
+  # ⚠️ NOTHING IS INHERITED FROM THE FLAT KEYS BY AN ENTRY THAT OMITS IT, and
+  # that is the whole of DEV-02 restated as a config rule. `soc`, `batt` and the
+  # rating became per-instance precisely so that no inverter is ever graded
+  # against a sibling's numbers; an entry silently inheriting `soc_entity` would
+  # rebuild that defect in YAML. `name`, `setpoint_entity` and `max_w` are
+  # therefore REQUIRED of every entry (the schema below enforces it, and
+  # validate.py rule 9 enforces it again for the callers the Supervisor never
+  # sees). An omitted `soc_entity`/`batt_entity` means THIS UNIT HAS NO SUCH
+  # SENSOR - `inputs_ok` already stops the site for that - and never means
+  # "use the other one's".
+  #
+  # ⚠️ AND THE FLAT `setpoint_entity` MUST THEN BE BLANK. Leaving it set while a
+  # roster is declared is two config sites aimed at actuators, one of which
+  # nothing writes; if it names an entity an entry also names, SAFETY-28's
+  # writer census refuses it as two writers on one actuator, and if it names a
+  # different one the add-on would run a site quietly smaller than the config
+  # reads. Rule 9 refuses both rather than picking one.
+  #
+  # ⚠️ THE SHAPE WAS MEASURED, NOT ASSUMED. A list of objects is not used
+  # anywhere else in this file, and whether Supervisor's options validator
+  # accepts one was an open question - `static_profile` carries its structure as
+  # a JSON string in a `str?` for exactly that doubt. It was settled by running
+  # Supervisor 2026.08.0's OWN `AppOptions` validator (the version this site
+  # runs) against both candidates: tools/supervisor_shape_probe.py is the
+  # script, DECISIONS/CFG-04-inverter-roster.md is what it printed and why the
+  # list won. The default `[]` is load-bearing in that record: WITHOUT it the
+  # validator answers `Missing option 'inverters' in root` for every existing
+  # options blob, and the upgrade leaves an add-on that cannot start.
+  inverters: []
+
   # --- P1 meter ingestion (specs §5.2 / §14 `meter:`) -------------------------
   # `off` keeps the original single meter_entity path above, so an existing
   # install is untouched until it opts in. ha_dsmr subscribes to the DSMR
@@ -425,6 +478,32 @@ schema:
   batt_invert: bool
   setpoint_entity: str
 
+  # CFG-04. THE ONE LIST-OF-OBJECTS IN THIS FILE, and see the options block for
+  # the measurement that says Supervisor 2026.08.0 accepts it: nested types are
+  # enforced per entry, a missing required key names the key, a scalar where the
+  # list belongs is refused, and the UI renders it as a repeatable section.
+  #
+  # ⚠️ THREE KEYS ARE REQUIRED PER ENTRY AND THAT IS DELIBERATE. An entry with
+  # no `name` has no Store namespace and would share another unit's SAFETY-02
+  # latch; one with no `setpoint_entity` is a unit nothing can command; one with
+  # no `max_w` would have to borrow a rating, which is the sibling-grading
+  # defect DEV-02 removed. The optional pair is the sensors, whose absence
+  # honestly means "this unit reports none".
+  #
+  # ⚠️ THIS BLOCK IS DECLARED BEFORE `max_w:` ON PURPOSE. `max_w` now appears
+  # TWICE under `schema:` - once nested here, once flat below - and a reader
+  # that matches a stripped line takes the nested one FIRST. That is the
+  # first-match trap this card had to fix in three checks; leaving the nesting
+  # first keeps the trap baited, so the fix stays graded rather than assumed.
+  # test_inverter.py part 12 asserts the ordering is still hostile.
+  inverters:
+    - name: str
+      setpoint_entity: str
+      max_w: int(100,5000)
+      soc_entity: str?
+      batt_entity: str?
+      batt_invert: bool?
+
   meter_source: list(off|ha_dsmr|mqtt_p1|ha_signed|homewizard_local)
   # ⚠️ 2 is accepted by this range but is not a real Belgian connection. A
   # telegram whose phase count disagrees is rejected at ingest and logged, so a