Document the final stability fixes and the model reset

README: window states and forecast assumptions, Model Error incomplete and
skipped spans, Forecast Error classes and why 2 and 5 minutes, and the
lifecycle tests. docs/MODEL.md: strict inputs, unknown-window assumptions,
the plan-matching table. CHANGELOG gains an Unreleased section (version
unchanged); ROADMAP and AUDIT record the findings, root causes, evidence and
remaining limitations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,78 @@
 
 Engineering findings and test evidence behind each change are in [AUDIT.md](AUDIT.md).
 
+## Unreleased — final stability fixes after 0.4.1
+
+Four correctness fixes from an independent review of 0.4.1, and a **Reset learned
+model** action you asked for. The version stays 0.4.1 until released. Still
+**observation-only**: no service calls; the boiler and thermostat are untouched.
+Tested in the Home Assistant Core harness with HA 2025.12.0 and 2026.2.3; not on
+HAOS.
+
+### Upgrade notes
+
+- No reconfiguration needed. Zones, sensor and comfort weights, weather sources,
+  heat sources, windows, learned coefficients and fingerprints carry over; entity
+  IDs are unchanged.
+- **Configure now opens a menu**: *Settings* (the previous form) or *Reset learned
+  model*.
+- **Forecast Error statistics restart.** 0.4.1 accepted plans the relay followed
+  within 20 % per block; those figures are not comparable with the new rule and
+  are dropped on the first start (they covered at most a day).
+- Model Error statistics carry over. Those from 0.4.0/0.4.1 may include a few
+  spans with unknown window states; they age out within 7 days.
+
+### Added
+
+- **Reset learned model** (Configure, with a confirmation): forgets every zone's
+  learned coefficients, models kept for removed zones, and the Model Error and
+  Forecast Error statistics; keeps the configuration, heat-source baselines and the
+  window event log, and logs the reset in `model_changes`.
+
+### Fixed
+
+- **Model Error no longer scores spans with unknown inputs.** A window unknown
+  during a span was replayed as closed and scored. Spans where a window state, an
+  open window's weather input, or the extended layer's electrical heat or
+  neighbour was unknown are now counted as `incomplete` (with the base model's
+  error kept apart as `incomplete_base_model_mae`); spans that cannot be replayed
+  are counted as `skipped`.
+- **Window sensors unavailable at startup are unknown, not closed.** Last known
+  states, open events and recovery are saved and restored as unknown until the
+  sensor reports; openings and closings count as confirmed only when seen; an
+  unknown window last seen open is assumed open only until the open-window time
+  after it was last seen; other unknown windows are flagged as uncertain in
+  forecasts (`uncertain_windows`) and in Status (`forecast_assumption`). Event
+  durations are given as a range when an end was not seen.
+- **Unload, reload and removal cannot publish or save stale work.** The
+  coordinator is marked closing before platforms unload; the model save checks
+  this, and a removed-model mark, after taking the storage lock and holds the lock
+  until the file write finishes, so a deletion can no longer be undone by a save
+  that was waiting or cancelled mid-write. A failed setup shuts the coordinator
+  down; relay callbacks queued before unload are ignored.
+- **Forecast Error compares the relay's actual timing with the plan.** The
+  deviation is the time the relay spent in another state than planned (unobserved
+  time counts as possible deviation). Up to 2 minutes: matched and scored; up to 5:
+  approximate, scored separately; more: counterfactual; otherwise incomplete, with
+  a reason (relay history, assumed inputs, no poll at the due time, missing
+  reading). Forecasts made with an unknown window or electrical heat are never
+  scored.
+
+### Changed
+
+- Learning no longer substitutes values for an open window: samples where the
+  wind direction (for the directional term) or another zone's windows (for
+  cross-ventilation) were unknown are not learned. With every window closed, the
+  opening terms need no weather input, so recovery can be learned without wind.
+- The gust option's hint refers to Model Error.
+
+### Persisted data
+
+- `schema_version` stays 2. `ventilation` gains `state` (last known window
+  states, open events, recovery); `evaluation` gains `excluded` (incomplete and
+  skipped spans); `operational_evaluation` gains `version` 2 and `approximate`.
+  Missing optional keys load as empty.
+
 ## 0.4.1 — 2026-10-27
 
 Stability and correctness: fixes four problems found in 0.4.0 and separates model