feat(web): set a heat pump's curve offset from the Heating view

[frahlg]

Built on merged #741 and #738.

Base: master at 369d120
Head: 5de3525

A pump whose driver declares a control gets a row on its Heating card. A pump that declares nothing keeps the existing telemetry view.

Changes

• Render the control from the driver declaration: label, bounds, step, unit and evidence.
• Keep the Auto label when no hold is active, but base the first absolute step on hp_z1_heat_offset or hp_heating_offset_climate_system_1. Disable the stepper when no current reported offset exists instead of assuming zero; an active hold is shown separately and never becomes the fallback start value.
• Serialize one in-flight request per driver/control. Both stepper directions, rerendered buttons and release are closed while the POST/DELETE and its follow-up refresh settle; the event handler also rejects duplicate requests defensively. A failed request closes through error handling and then permits a later retry.
• Queue one refresh requested during an in-flight refresh and run it after the current cycle settles, including the error path.
• Remove generated driver cache JSON files, go/state.db.clean and go/state.db.snapshot. Ignore the runtime cache and DB snapshot paths.

Verification

• Targeted Heating tests: 18 passing, including double-click/opposite-direction, rerender during in-flight, failure retry, and hold-without-telemetry fail-closed behavior.
• npm test: 295 passing.
• go test -race ./internal/api ./internal/drivers -count=1: passing outside the sandbox.
• make verify-all: passing, including optimizer contract tests, compose and container checks, vet, build and linux arm64, linux amd64 and Windows amd64 cross-builds.
• Final diff against 369d120 contains exactly .changeset/heating-control-ui.md, .gitignore, web/heating.js, web/heating-control.test.mjs and web/heating-request-budget.test.mjs.
• Master overlap check: fix(control): bound every driver command with a deadline #791 control, fix(config): make a settings save durable, and keep it private #792 config, fix(models): version learned PV and load state against its feature vector #793 models, test(e2e): wait for the stack to reach a state, not for the clock #794 e2e, fix(state): keep disk I/O out of the intern write lock #795 state and test(control): golden regression corpus for ComputeDispatch #790 control tests touch Go/.changeset files only; none overlap the five PR files and no semantic overlap was found.
• Fresh synchronized GitHub Actions checks pass for this head.
• Desktop and narrow Heating screenshots are exported as pr749-desktop.png and pr749-narrow.png for human UI review.

All three original review threads are resolved: observed offset start, queued refresh, and generated artifacts. This head also includes the independent rereview fixes for the persistent in-flight control gate and fail-closed telemetry requirement.

A driver-specific controls block remains a follow-up in srcfl/device-drivers.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99690233ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[miravoss26]

Adds a heat-pump curve-offset control to the Heating view, rendered entirely from the driver's declaration and wired to the operator control-hold endpoint (POST/DELETE /api/drivers/{name}/control) from #741.

What I checked:

• Every driver-derived string is escaped: escapeHtml on the name, control id, value and aria-label in the rendered HTML, and encodeURIComponent(name) on the fetch path. No XSS or path-injection surface.
• Declaration-driven: nothing keys on a driver name (a test asserts the control section never names heishamon/myuplink/nibe), a pump that declares nothing renders nothing, and bounds/step/unit come from the declaration. It clamps to the declared min/max for the button-disable state; the server (#741) clamps authoritatively.
• "Auto" when there's no hold rather than printing a 0 it doesn't know; held state carried by text and weight, not colour (deuteranopia); a write_ack driver says "does not confirm this setting". All tested (9 tests).
• stopPropagation so commanding the pump doesn't open the detail drill-in, and refreshAfterControl so a press shows its result mid-30s-refresh.

One question, not a blocker: the PR also adds go/state.db.clean (empty), go/state.db.snapshot (binary), and two go/driver-repository/cache/*.json files. Are those intended committed fixtures, or leftovers from a local run? Worth a glance before merge.

Safe to merge from my read. Not in my auto-merge allowlist, so a human merges.