Local Thermostat Rules
2026-10-04: the software candidate and parameter form are implemented; source admission, the form, and a 14-item thermostat run regression passed on the host. The full candidate still awaits unified verification. Device wiring, relay contacts, real temperature calibration, and continuous operation have not been accepted; do not enable dangerous loads based on this.
First save and enable a local Celsius temperature collection rule, then select the thermostat action in the PeriphExec form. The source must be a unique local producer with fixed parameters and an explicit Celsius unit; temperature cannot be guessed from arbitrary Modbus/UART values. The output must also be saved and enabled, and only a dedicated native digital output is allowed: low-level energized, HIGH at power-on, no inversion, no buzzer, no expander. Enable it in the field only after confirming the electrical conditions.
The form provides heating/cooling, stop threshold, hysteresis, minimum on/off seconds, maximum sample age, plus startup, fault, and recovery policies. Available ranges and defaults load with the device description; when no matching description is obtained, old parameters are kept and saving is blocked — defaults are not guessed. Threshold and hysteresis must also satisfy the combined range, and all fields are finally validated by the device.
The current development candidate also verifies the actual driver and sampling channel of saved peripherals. DHT humidity, pressure, acceleration, or raw voltage channels of registered drivers cannot be relabeled as Celsius and used for thermostat control; when the DHT form switches between temperature/humidity, the unit is fixed accordingly. DS18B20, NTC, and temperature channels explicitly provided by the driver can be used; the temperature engineering conversion of analog, voltage, and current must still be confirmed and calibrated by the user. The 4-20mA action must also explicitly enable mapToEngineering: true (compatible with engineeringMapping: true) and fill in the correct temperature range with Celsius units; unmapped current values cannot serve as a temperature source.
When the attribute name differs from the actual channel, judge by the real channel. Thermostat is rejected when two saved collection actions share the same actual cache source, whether they are in the same rule or different rules; a second action in a disabled rule also counts. When a registered I2C driver does not explicitly fill channelField, the firmware first tries to parse dataField as a valid channel; when defaulted or only a Thing Model alias, the default channel of the current mode is used. Single-value actions such as DS18B20 and NTC that leave the channel or data field empty keep the peripheral ID as the cache suffix — do not assume all sources end with _temperature. If a scale factor and offset are explicitly provided, they must be numbers that stay finite; when omitted, 1 and 0 are used. These fixes have local regression evidence and have not yet updated field devices.
"Set up standalone thermostat trigger" only prepares a disabled draft: a single action checked every 1 second, mixing no scripts, other actions, action delays, or received-value substitutions. Saving the draft does not mean the output is enabled, and manually running the thermostat action only reads the persistent controller state; it does not restart the controller or clear a fault.
Heating requests on when the temperature is less than or equal to "stop threshold minus hysteresis" and requests off when greater than or equal to the stop threshold; cooling requests on when the temperature is greater than or equal to "stop threshold plus hysteresis" and requests off when less than or equal to the stop threshold. Normal switching respects the minimum on/off times. First startup must first confirm off, then obtain a valid new sample after the session started and wait the full minimum-off time. Stale, invalid, future-timestamped, wrong-unit, or source-changed samples request off; a missing sample must not be treated as zero degrees.
The manual recovery policy stays off and must be inspected, disabled, and re-enabled; fresh-sample recovery is only for recoverable data or memory faults and still needs a new sample and the minimum-off time. Output failures and source changes do not auto-recover. Peripheral configuration changes may also conservatively latch the output off. When off/release fails, the fault state is kept and safe-off retries continue; it is not shown as successfully disabled.
Pin confirmation in the state only means an MCU pin readback, not contact or load feedback. Field acceptance must check sensor disconnection, parameter changes, resource pressure, off failures, real polarity, contacts, and low-risk loads separately, then complete a continuous run test. Dangerous loads must have independent hardware protection.