perf/fix v1.43.1: external audit P1 — render cost, drag threshold, geometry, backend

L1: memoized space model + open pairs (structural fingerprint key, epoch
bumped synchronously at mutation time, not inside the debounce); hoisted
per-room geometry out of the render loop; smoke asserts zero recomputation
across state pushes.

L4: openings get the 3 px drag threshold used by every other pipeline and
only write when the geometry actually changed — taps open the dialog again.

G2: interiorPoint() replaces the vertex mean, so island rooms inside
concave (U/L) parents are accepted and their evenodd holes render; traced
duplicates still are not containment.

G3: segKey rounds before ordering — one shared wall, one key.

B2: _check_write fails closed when the entry is unavailable.
B3: layout/set honours expected_rev and returns the new rev.
B4: config/set without expected_rev over a non-empty store logs a warning.
B5: coordinates reject NaN/Infinity; spaces/rooms/markers/decor/layout capped.

+2 unit tests (118), +2 backend tests (14), smoke_render_perf; docs
same-commit

custom_components/houseplan/const.py

@@ -13,7 +13,7 @@ FILES_URL = "/houseplan_files/files"
 CONTENT_URL = "/api/houseplan/content"
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.43.0"
+VERSION = "1.43.1"
 
 DEFAULT_CONFIG: dict = {
     "spaces": [],

custom_components/houseplan/manifest.json

@@ -16,5 +16,5 @@
   "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
   "requirements": [],
   "single_config_entry": true,
-  "version": "1.43.0"
+  "version": "1.43.1"
 }

custom_components/houseplan/validation.py

@@ -47,11 +47,31 @@ def valid_space_id(value: str) -> bool:
 
 
 # ---------- voluptuous schemas ----------
+def _finite(value):
+    """Coerce to float and reject NaN/Infinity (audit B5).
+
+    'NaN' and 'Infinity' pass Coerce(float) and serialize to null on write,
+    silently corrupting a stored position forever.
+    """
+    f = float(value)
+    if f != f or f in (float("inf"), float("-inf")):
+        raise vol.Invalid("coordinate must be a finite number")
+    return f
+
+
+# generous caps: the product targets 20-200 devices and a handful of floors
+MAX_SPACES = 50
+MAX_ROOMS = 400
+MAX_MARKERS = 2000
+MAX_OPENINGS = 500
+MAX_DECOR = 1000
+MAX_LAYOUT = 5000
+
 POS_SCHEMA = vol.Schema(
-    {vol.Required("x"): vol.Coerce(float), vol.Required("y"): vol.Coerce(float)},
+    {vol.Required("x"): _finite, vol.Required("y"): _finite},
     extra=vol.ALLOW_EXTRA,  # v2 records carry the "s" key (space id)
 )
-LAYOUT_SCHEMA = vol.Schema({str: POS_SCHEMA})
+LAYOUT_SCHEMA = vol.All(vol.Schema({str: POS_SCHEMA}), vol.Length(max=MAX_LAYOUT))
 
 POINT = vol.All([vol.Coerce(float)], vol.Length(min=2, max=2))
 
@@ -142,8 +162,8 @@ SPACE_SCHEMA = vol.Schema(
         vol.Optional("plan_url"): vol.Any(str, None),
         vol.Required("aspect"): vol.All(vol.Coerce(float), vol.Range(min=0.05, max=20)),
         vol.Required("view_box"): vol.All([vol.Coerce(float)], vol.Length(min=4, max=4)),
-        vol.Required("rooms"): [ROOM_SCHEMA],
-        vol.Optional("decor"): [DECOR_SCHEMA],
+        vol.Required("rooms"): vol.All([ROOM_SCHEMA], vol.Length(max=MAX_ROOMS)),
+        vol.Optional("decor"): vol.All([DECOR_SCHEMA], vol.Length(max=MAX_DECOR)),
         vol.Optional("openings"): [
             vol.Schema(
                 {
@@ -199,8 +219,8 @@ MARKER_SCHEMA = vol.Schema(
 )
 CONFIG_SCHEMA = vol.Schema(
     {
-        vol.Required("spaces"): [SPACE_SCHEMA],
-        vol.Optional("markers", default=list): [MARKER_SCHEMA],
+        vol.Required("spaces"): vol.All([SPACE_SCHEMA], vol.Length(max=MAX_SPACES)),
+        vol.Optional("markers", default=list): vol.All([MARKER_SCHEMA], vol.Length(max=MAX_MARKERS)),
         vol.Optional("settings", default=dict): vol.Schema(
             {
                 vol.Optional("glow_radius_cm"): vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)),

custom_components/houseplan/websocket_api.py

@@ -1,6 +1,8 @@
 """House Plan WS commands: layout, space configuration, plan uploads."""
 from __future__ import annotations
 
+import logging
+
 import base64
 import binascii
 from pathlib import Path
@@ -22,6 +24,9 @@ from .validation import (
 )
 
 
+_LOGGER = logging.getLogger(__name__)
+
+
 @callback
 def async_register(hass: HomeAssistant) -> None:
     """Register the WS commands."""
@@ -49,8 +54,17 @@ def _runtime(hass: HomeAssistant, connection, msg_id: int) -> HouseplanData | No
 
 
 def _check_write(hass: HomeAssistant, connection) -> bool:
+    """May this connection write?
+
+    Fails CLOSED (audit B2): when the entry cannot be read — during a reload or
+    while the integration is disabled — the policy is unknown, and "unknown" is
+    not the same as "permissive". Previously this returned True and ws_plan_set,
+    which never touches the runtime helper, accepted uploads in that window.
+    """
     entry = get_entry(hass)
-    admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
+    if entry is None:
+        return bool(getattr(connection.user, "is_admin", False))
+    admin_only = bool(entry.options.get(CONF_ADMIN_ONLY, False))
     return connection.user.is_admin if admin_only else True
 
 
@@ -69,11 +83,21 @@ async def ws_layout_get(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
 
 
 @websocket_api.websocket_command(
-    {vol.Required("type"): "houseplan/layout/set", vol.Required("layout"): LAYOUT_SCHEMA}
+    {
+        vol.Required("type"): "houseplan/layout/set",
+        vol.Required("layout"): LAYOUT_SCHEMA,
+        vol.Optional("expected_rev"): int,
+    }
 )
 @websocket_api.async_response
 async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
-    """Replace the layout entirely."""
+    """Replace the layout entirely, with optimistic locking (audit B3).
+
+    Wholesale layout writes used to have no revision check at all, so two
+    clients silently overwrote each other. `expected_rev` is optional for
+    backwards compatibility with older cards, but when supplied it is enforced
+    exactly like the config store does.
+    """
     if not _check_write(hass, connection):
         connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
         return
@@ -81,8 +105,15 @@ async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
     if rt is None:
         return
     async with rt.write_lock:
-        await rt.store.async_save({"layout": msg["layout"]})
-    connection.send_result(msg["id"], {"ok": True})
+        data = await rt.store.async_load() or {}
+        current_rev = int(data.get("rev", 0))
+        if "expected_rev" in msg and msg["expected_rev"] != current_rev:
+            connection.send_error(
+                msg["id"], "conflict", f"Layout changed elsewhere (rev {current_rev})"
+            )
+            return
+        await rt.store.async_save({"layout": msg["layout"], "rev": current_rev + 1})
+    connection.send_result(msg["id"], {"ok": True, "rev": current_rev + 1})
 
 
 @websocket_api.websocket_command(
@@ -227,6 +258,15 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
     async with rt.write_lock:
         data = await rt.config_store.async_load() or {}
         current_rev = data.get("rev", 0)
+        if "expected_rev" not in msg and current_rev:
+            # audit B4: expected_rev stays optional for old cards mid-upgrade,
+            # but a blind overwrite of a non-empty store is worth a warning —
+            # it is exactly how a stale client silently discards someone's work.
+            _LOGGER.warning(
+                "House Plan: config/set without expected_rev over rev %s — "
+                "the client bypasses conflict detection (outdated card?)",
+                current_rev,
+            )
         if "expected_rev" in msg and msg["expected_rev"] != current_rev:
             connection.send_error(
                 msg["id"], "conflict",