v0.7.7

Fixed (relay, from a code review)

• A damaged LAN key file no longer strands the heater.
  • Before: a corrupt or wrong-shaped lanip.json made the relay mint a
    new key over it, so the module was left holding the old one.
  • Now: the relay renames the file to lanip.json.corrupt-<time>, logs
    an error, then mints a key (and /state counts it in key_quarantined).
  • Writes: the key file, the write queue and the DSN evidence files are
    written atomically and created 0600.
• Telemetry always reaches Ayla: a bug while decoding a report no longer
  turns the module's POST into a 500. It's counted (ingest_errors) and the
  report is forwarded anyway.
• Telemetry decoding:
  • an empty part no longer shifts later blocks into the wrong place;
  • a block too short to decode is a counted decode error, not a stream of
    zeros.
• Firmware hold covers every path: OTA commands in commands.xml replies
  are held even for untrusted or foreign-device requests.
• Several heaters:
  • while the primary's device ID is still unknown, another heater's
    /devices/<id>/ requests no longer reach the primary;
  • the refused-heater list is capped at 64.
• The built-in DNS server:
  • answers only private, link-local and loopback addresses;
  • caps concurrent forwards (128) and each client's rate (100 per second);
  • drops duplicate retransmits, responses and runt packets;
  • answers other opcodes with NOTIMP;
  • refuses to start when dns_upstream points back at itself or has a bad
    port;
  • a client asking over TCP now gets the full answer: a truncated UDP reply
    is re-asked over TCP;
  • drops are counted in /state dns.dropped;
  • new DNS_HOST sets the listening address.
• Robust loading: a queue or device file of the wrong shape no longer
  crashes start-up, and malformed queued writes are dropped.
• Malformed LAN updates: they're refused with a 400 instead of a 500, and
  don't mark the session verified.
• Local Connect callback: the callback address the module is given is
  worked out again when the module's address changes. A relay_ip that is
  set is kept.
• Suspected encryption desync: after 3 unanswered LAN deliveries in a row,
  the relay logs one warning and counts it (lan.suspected_desyncs). It
  doesn't reconnect.

Fixed (integration, from a code review)

• Options dialog on HA before 2024.11: it crashed, because older HA
  doesn't give the flow its entry. It now looks the entry up itself.
• Odd relay data can't take the integration down.
  • Before: one unexpected value in the relay's /state (a string where
    a number belongs, a list where an object belongs) could stop every later
    listener and leave entities frozen.
  • Now:
    • values are type-checked;
    • numeric sensors show unknown rather than raise;
    • each repair check is isolated;
    • a reply that isn't a JSON object is a normal update failure.
• No write to the wrong heater: a write for a heater the relay no longer
  lists is refused. It used to go to the primary heater.
• The same relay can't be added twice: its URL is the entry's unique ID.
• Tank temperatures keep long-term statistics: top, bottom and average
  now have a measurement state class.
• Setting the operation to "off" is refused with a message to use away
  mode. On older HA it used to reach the relay.
• Mode and Heating element show their icons on HA 2024.1 (icon
  translations arrived in 2024.2).
• Connections: responses are always released, including on errors.

Docs

• DNS steering:
  • the built-in dns_server is marked tested (live since 0.5.5), with its
    timeline;
  • a check step to run before the power cycle, taken from a fresh-install
    dry run of 0.7.6, with the log lines to expect;
  • dns_upstream for gateways that don't answer DNS;
  • relay_ip for a heater on its own VLAN.
• README:
  • one power-cycle time (30 s) and the full log sequence;
  • the IP reservation is optional with DNS steering;
  • VLANs are workable;
  • the dashboard wording matches 0.7.5.
• The add-on's Documentation tab now has content: relay/ADDON.md is
  renamed to relay/DOCS.md, the file Home Assistant shows. It covers DNS and
  NAT steering, where the keys live, and the update caveat.
• Corrections across the docs (from a review against the code):
  • STEERING.md no longer says mesh or ISP routers can't be used. They can,
    with dns_server.
  • The trusted peers are listed per port: 8888 doesn't trust the gateway.
  • The LAN key's path is /data/heaters/<DSN>/lanip.json.
  • Across VLANs needs DNAT and SNAT for the callback, plus relay_ip.
  • The own-resolver steps are under their own heading, and say that
    listen_port: 443 is needed.
  • The README's configuration table lists the remaining environment
    variables (DNS_REWRITE for other models, DNS_PORT, CLOUD_IDLE_AFTER,
    and others).
  • Changelog links are absolute, so the add-on's copy works too.
• NAT is no longer presented as the only option:
  • "How it works" names DNS and NAT as the two ways to steer the heater;
  • the add-on's docs page describes dns_server, replacing the pre-0.5.5
    listen_port: 443 + module_ip recipe;
  • the troubleshooting rows cover both;
  • Uninstall says to restore the router's DHCP DNS before removing the
    add-on. Otherwise every device using it loses DNS.

CI and tests (from a code review)

• Home Assistant 2024.1 is tested. hacs.json promised it, but nothing
  checked it. A CI job now runs the integration tests on HA 2024.1.5, and it
  found the options-dialog crash fixed above (integration).
• Least-privilege releases:
  • the release workflow is split into read-only verify, test and image jobs,
    and a publish job, the only one that can write;
  • a tag must be on main, and the release reruns the full test matrix and
    the image build;
  • checkouts don't keep the token.
• Pinned tools: dev tools are hash-locked, the HA test harness is pinned,
  and so is the busybox test image.
• Stricter gates:
  • branch coverage, with a 98.5% minimum;
  • a PR that bumps the version runs the release checks;
  • the changelog section for a release needs at least one entry;
  • missing openssl fails CI instead of skipping the TLS tests.
• Tests:
  • relay modules are imported one way only, so there's one copy of each;
  • environment variables are isolated per test;
  • DNS tests listen on loopback;
  • the freeze thresholds are checked at their exact boundaries;
  • DNS over TCP is covered.
• Release order is documented in docs/RELEASING.md: the add-on ships
  from main, so a version bump has to be green before it merges.