Merge release/1.0 (PKG-07) into UX-02

release/1.0 moved twice while this branch was open. PKG-07 cut the 0.8.0
section and rewrote the head of CHANGELOG.md, which is the whole conflict.

Resolved by taking PKG-07's text for all three hunks and putting UX-02 back
under a NEW `## Unreleased` heading rather than into 0.8.0's contents table.
0.8.0 is a section somebody cut on purpose - PKG-07's own subject is "stop the
changelog calling shipped work unreleased" - and editing a cut record to slip
another card into it is the same defect from the other side.

⚠️ AND THE VERSION IS DELIBERATELY NOT BUMPED HERE. The right number depends on
whether 0.8.0's image has already been built and pulled, which this branch
cannot observe: if it has not, UX-02 belongs inside 0.8.0 before it ships; if it
has, it needs 0.8.1. The new section says so in those words rather than picking
one and being quietly wrong.

Nothing in this merge touches app/, the tests or config.yaml on this branch's
side; PKG-07's `version: "0.8.0"` comes across untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/CHANGELOG.md

@@ -1,39 +1,18 @@
 # Changelog
 
-## 0.8.0
+## Unreleased
 
-⚠️ **`slew_w` CHANGED MEANING, AND THAT IS WHY THIS IS A MINOR BUMP.**
-[[SAFETY-39]] makes the ramp limit a **ratio to the site rail** rather than an
-absolute number of watts, and makes `slew_w: 0` mean *follow the rail* instead
-of *no limit*. Two consequences for an existing config:
-
-- A config that leaves `slew_w` at `0` now gets the derived rail-proportional
-  limit. This is the intended fix - the live install was overshooting because
-  its `slew_w` had been derived against a 1500 W clamp and was running against a
-  5000 W one.
-- ⚠️ **A config that sets `slew_w` explicitly above `SLEW_RAIL_FRAC` x the roster
-  sum is now REFUSED at startup** by validator rule 10. `SLEW_RAIL_FRAC` is
-  `LOOP_TICK_S / PLANT_SETTLE_S` = 2/18. On a 5000 W single-inverter install the
-  ceiling is therefore about 555 W; the reference install runs `slew_w: 400` and
-  is unaffected.
-
-CFG-04's rule again, and PKG-06's: the Supervisor keys the built image by
-`version:`, so shipping a schema or semantic change without a bump means
-`ha apps update` is a silent no-op and nobody reads the new rule. **Six merges
-accumulated behind an unbumped 0.7.0 before this was caught a second time** -
-the check that would have caught it automatically is still not written, and that
-gap is the standing content of PKG-06's follow-up.
-
-Contents, in merge order since 0.7.0 (`bbc903b`):
+⚠️ **THIS HAS NO VERSION AND CANNOT REACH AN INSTALL UNTIL IT GETS ONE.**
+PKG-06's and PKG-07's rule: the Supervisor keys the built image by `version:`,
+so `ha apps update` is a silent no-op on an unbumped change. This branch
+deliberately does **not** pick the number, because the right one depends on a
+fact the branch cannot observe - whether 0.8.0's image has already been built
+and pulled. If it has not, this belongs inside 0.8.0's section before it ships;
+if it has, it needs 0.8.1. Whoever deploys decides, and PKG-07 is the record of
+what happens when nobody does.
 
 | | |
 |---|---|
-| `9e42cec` | CI-06 - `test_peakguard.py` answered two of its checks with the wall clock |
-| `24c3d87` | SAFETY-38 - pin `site_standing` with shares that cannot answer for the site |
-| `a4290d3` | SAFETY-39 - `slew_w` becomes a ratio to the rail; validator rule 10 |
-| `c8dcb38` | SAFETY-37 - a stale reading is `None`, and arrival cannot be what says so |
-| `0581648` | SAFETY-13 - the output freeze gets a bounded exit, and only where it needs one |
-| `464d398` | SAFETY-42 - a unit that stops delivering its share is no longer invisible |
 | _this branch_ | UX-02 - a configuration page in the ingress panel, where the validator's refusals can be seen |
 
 ⚠️ **UX-02 ADDS A SECOND PLACE TO CONFIGURE THIS ADD-ON, AND NO NEW WAY TO
@@ -66,15 +45,57 @@ all by this card: the permissions the panel needs - `ingress: true`,
 `ingress_port: 8099`, `hassio_api: true`, `homeassistant_api: true` - were
 already declared, and the panel was already live.
 `tools/supervisor_selfapi_probe.py` re-measures them against Supervisor
-2026.08.0's own code, and found two things the card had wrong: Supervisor's own
+2026.08.0's own code, and found things the card had wrong: Supervisor's own
 `/addons/self/options/validate` is **not** reachable from inside an add-on, and
 the Configuration tab **can** be removed - at the cost of all 71 options, which
 is why it stays. `DECISIONS/UX-02-two-config-surfaces.md` carries both.
 
-⚠️ **SAFETY-13 ships a disclosed residual.** Its bounded freeze-exit shows 0
-spurious releases on the sweep's measured-plant slice but **2 of 272 on a finer
-grid**. The shipped documentation carries the 2-of-272 figure rather than the
-flattering one, deliberately.
+## 0.8.0
+
+⚠️ **A CONFIG THAT STARTED ON 0.7.0 CAN BE REFUSED ON 0.8.0, AND THAT IS WHY
+THIS IS A MINOR BUMP.** [[SAFETY-39]] adds validator rule 10, which refuses an
+explicit `slew_w` above `SLEW_RAIL_FRAC` x the site rail, where `SLEW_RAIL_FRAC`
+is `LOOP_TICK_S / PLANT_SETTLE_S` = 2/18. On a 5000 W rail that ceiling is
+**555.6 W**.
+
+⚠️ **THE VALUE THAT BREAKS IS 0.7.0'S OWN SHIPPED DEFAULT.** `slew_w` defaulted
+to **1000** and the schema was `int(50,5000)`; 1000 > 555.6, so an install that
+never touched the key and simply took the default is refused on 0.8.0 until the
+value is lowered. That is as backward-incompatible as it gets, and it is the
+whole justification for MINOR over PATCH.
+
+The schema also widens from `int(50,5000)` to `int(0,5000)`, and `slew_w: 0` -
+**a value that was not legal before** - now means *follow the rail* and is the
+shipped default. This is a new capability rather than a changed meaning.
+
+⚠️ Refusal is `SystemExit(78)` (`EX_CONFIG`): the add-on does not start. **Read
+the live options and check them against the ceiling BEFORE `ha apps update`.**
+That check is NOT performed by this PR and cannot be - see the PR body.
+
+CFG-04's rule and PKG-06's: the Supervisor keys the built image by `version:`,
+so shipping a change without a bump means `ha apps update` is a silent no-op.
+**Six merges accumulated behind an unbumped 0.7.0 before this was caught, for
+the second time in two days.** The automated check that would catch it without
+a human noticing is still unwritten, and that is PKG-06's standing follow-up.
+
+Contents, in merge order since 0.7.0 (`bbc903b`). ⚠️ Each row carries the merge
+subject's **whole** claim, including the half that is not flattering:
+
+| | |
+|---|---|
+| `9e42cec` | CI-06 - `test_peakguard.py` answered two of its checks with the wall clock |
+| `24c3d87` | SAFETY-38 - pin `site_standing` with shares that cannot answer for the site |
+| `a4290d3` | SAFETY-39 - `slew_w` is a ratio to the rail, **and `gain` is the constant that is still wrong** |
+| `c8dcb38` | SAFETY-37 - a stale reading is `None`, and arrival cannot be what says so |
+| `0581648` | SAFETY-13 - the output freeze gets an exit, and only where it needs one |
+| `464d398` | SAFETY-42 - a unit that stops delivering, **and the discriminator the card asked for does not exist** |
+
+⚠️ **TWO DISCLOSED RESIDUALS SHIP IN THIS RELEASE.** SAFETY-13's bounded
+freeze-exit shows 0 spurious releases on the sweep's measured-plant slice but
+**2 of 272 on a finer grid**, and the docs carry the 2-of-272 figure rather than
+the flattering one. SAFETY-42's card proposed a discriminator that **turned out
+not to exist**, and the branch says so rather than shipping a weaker check under
+the original name.
 
 ## 0.7.0
 
@@ -3471,7 +3492,7 @@ operating point.
 
 ## Detail notes from the 0.4.x era — NOT unreleased
 
-⚠️ Retitled with the same correction as the section above: TEL-05 and the
+⚠️ Retitled with the same correction as the section above: [[TEL-05]] and the
 entries under this heading shipped long ago. Two headings in one file both
 claiming "Unreleased" is how a reader ends up believing running behaviour is
 still pending.