Document second audit pass

Record findings, evidence, compatibility notes and remaining gaps in
AUDIT.md; add user-facing upgrade notes to README and update test
counts; note progress against Milestone 0 in ROADMAP. No version bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -128,6 +128,38 @@ Options to match your sensors, and verify fallback/recovery with an unavailable
 source. Generic Thermostat remains the sole controller. No HAOS trial was performed.
 
 
+## Unreleased: radiator-lag tracking and learner stability
+
+See the second-pass section of [AUDIT.md](AUDIT.md). Still shadow-only; no new
+options, translations or entities; the manifest version is unchanged.
+
+- **Radiator lag now follows the relay.** Previously the lag estimate jumped to
+  fully hot or fully cold at each relay change, which biased the learned heating
+  coefficient low and gave wrong starting points to forecasts right after a boiler
+  cycle. A relay change between polls is now integrated at its timestamp.
+- **Learning pauses briefly when the lag is unknown**: after an HA restart, a relay
+  outage, or two relay changes inside one five-minute poll. The Status attribute
+  `heat_lag_uncertainty` shows the error bound; learning resumes once it is at most
+  0.1, about 32 minutes after a restart. Forecasts continue meanwhile.
+- **Long OFF periods no longer destabilize learning.** The learner's covariance is
+  bounded, so a summer without heating cannot make coefficients jump when heating
+  resumes, and older saved models with large covariance are loaded rather than reset.
+- **Optional weather sources can be removed in Configure.** Clearing wind, cloud or
+  any additional metric now saves an empty list instead of restoring the old sources.
+- The proposed-heat entity is no longer marked unavailable when only a
+  diagnostic weather sensor or the thermostat's current temperature changed during
+  the calculation.
+- New Status attributes: `heat_lag`, `heat_lag_uncertainty`, `sample_result` (why the
+  last poll was or was not learned).
+
+**After upgrading:** saved models load unchanged, but coefficients learned before
+this change were fitted with the wrong lag. Expect them to re-converge over a few
+days of heating and judge forecasts only on data after the upgrade, or delete and
+re-add the integration for a clean model (this deletes learned data). After a
+restart, check that `sample_result` moves from `lag_uncertain` to `learned` within
+about 35 minutes. Generic Thermostat remains the sole relay controller. No HAOS
+trial was performed.
+
 ## Developer checks and Forgejo/Gitea Actions
 
 The HA Core test suite targets **Home Assistant 2025.12.0 on Python 3.13**,
@@ -142,7 +174,7 @@ python -m pip install -r requirements-test.txt
 sh scripts/check.sh
 ```
 
-The check script runs dependency consistency checks, 42 offline tests, 14 tests
+The check script runs dependency consistency checks, 56 offline tests, 16 tests
 using the real HA Core/fixture package, compilation, lightweight package metadata
 and translation checks, and diff whitespace checks. A compatible DNS dependency
 is pinned because pycares 5 breaks the older HA dependency's import. The script