# GREE Controller v0.8.7 - audit remediation and cleanup report

Source baseline: GREE Controller v0.8.5 audited on 2026-08-28.

## Implemented remediation

This build addresses the ownership, safety, lifecycle and scheduling findings from the v0.8.5 control-logic audit, including the critical K1-K9 findings and high-priority H1-H14 findings.

Main changes:

- separated ordinary Quick Thermostat handback state from Temporary Quick Thermostat lifecycle;
- made `activated_at` the sole authoritative marker for Temporary-session ownership;
- added explicit Temporary lifecycle states and preserved/restored the underlying Quick/manual state;
- delayed capture of `restore_zone_enabled` until actual takeover for delayed/at sessions;
- manual/direct device takeover now outranks Temporary completion and pauses condition/runtime accounting;
- active Temporary sessions freeze their active mode/target and defer house/group mode/preset changes until handback;
- whole-house/group ON no longer sends a bare `power=true` when there is no valid effective Heat/Cool decision;
- generic Settings cannot mutate house master/mode outside the House transition APIs;
- configuration export/import strips ephemeral runtime ownership, safely stops detached devices, reconciles gates and repolls devices;
- direct climate automations for thermostat-managed devices now modify durable zone state instead of competing one-shot frames;
- schedule boundaries and time automations participate in the common next-deadline wakeup;
- continuous temperature hold requires fresh observations and is reset across controller restarts/manual takeover;
- disabling a device or zone now follows the safe shutdown/cleanup path;
- active delayed/at Temporary sessions can be edited without accidentally rescheduling their historical start;
- Temporary schedule-boundary deadlines are refreshed after schedule edits;
- conflicting same-cycle automations are resolved deterministically, and blocked automations do not consume cooldown;
- UI exposes scheduled/waiting-master/paused-manual/active Temporary states and uses the same `activated_at` ownership rule as the backend.
- removed the legacy Temporary-session `generation=0` / `local_thermostat_power` activation fallback and the compatibility-only model field/test path.

## Validation executed in this environment

- JavaScript syntax checks for web application files;
- JSON parsing for language and Home Assistant manifest files;
- Python syntax compilation for Home Assistant integration files;
- shell syntax checks for `scripts/*.sh`;
- regenerated and verified `FILE_MANIFEST.sha256`;
- final ZIP integrity check;
- verified that no Temporary-session references to `generation`, `generation=0`, or the removed local-power activation fallback remain in `src/` or `web/`;
- retained the compiler fix for Rust E0382 in `src/api.rs` by evaluating the `start_kind == "now"` predicate before moving `start_kind` into `TemporaryQuickThermostat`.

## Rust toolchain note

This environment does not contain `cargo`, `rustc`, `rustfmt` or `rust-analyzer`, so the Rust build and Rust test suite for v0.8.7 could not be executed here. The modified Rust files were checked for balanced delimiters and all removed model-field references were verified absent. Run `bash scripts/update.sh` on the target host to execute the full Rust test suite before service replacement.