v1.50.0: the v1.49.0 review (HP-1490-01..04) and the owner's zoom batch

Owner's batch (committed to dev earlier today, released here):
- devices count as content for the default zoom;
- the editor no longer shifts the plan — the stage measures its own top
  instead of assuming 118px of header;
- zoom goes out to 0.4x, centred.

From the review:
- HP-1490-01: the square-canvas migration wrote two stores in sequence, and
  the first write deleted the aspects the second needed — a crash between
  them stranded the layout in the old coordinates with nothing able to
  finish it. The intent {space: old aspect} is durable now: saved to the
  layout store before anything moves, cleared by the same write that stores
  the migrated layout, each half idempotent behind its own trigger. The
  update event fires only after both halves are on disk. Proven at the exact
  crash boundary by a harness test that fails the layout write once.
- HP-1490-02: check_quota and the file write were two executor jobs with
  nothing between them, so N parallel uploads all measured the store before
  any of them wrote. One job under a dedicated upload_lock now — narrower
  than write_lock on purpose, a directory scan must not stall config saves.
  A failed write reserves nothing.
- HP-1490-03: the content frame fed pan, zoom, clamp AND pointer maths, so
  the editors were boxed into yesterday's drawing. Edit modes measure from
  the full square; mode switches refit rather than carry a view clamped
  against the wrong base.
- HP-1490-04: Save could outrun the proportions read and ship the previous
  file's ratio. Picking a plan clears it immediately; Save awaits the
  bounded read and stores 'unknown' over a lie.
- §5: package-lock version synced, duplicated comment removed.

New: smoke_audit_1490.mjs, migration crash-recovery pure + harness tests,
parallel-quota harness test. Inventory: 138 unit / 49 pure / 40 harness / 64
smokes.

custom_components/houseplan/__init__.py

@@ -20,7 +20,7 @@ from .const import (
     PLANS_URL,
     VERSION,
 )
-from .geometry_migration import migrate_config
+from .geometry_migration import migrate_config, migrate_layout, pending_from_config
 from .plans import collect_attachments, collect_plans, sweep_upload_temps
 from .repairs import async_check_plan_files
 from .store import HouseplanConfigEntry, create_data
@@ -104,20 +104,40 @@ async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) ->
     # normalised against a per-space aspect ratio; the canvas is now always
     # square and a plan is centred inside it. Nothing about the drawing changes
     # — the box is padded and the numbers re-expressed against it.
+    # The two stores are written independently, and the lock is no transaction:
+    # a crash between the writes used to leave the config in square coordinates
+    # with the layout still in the old ones — permanently, because the config
+    # write had already deleted the `aspect` fields the layout half needed
+    # (HP-1490-01). So the intent is made durable FIRST, in the layout store,
+    # and each half carries its own trigger with its own write: the config half
+    # removes `aspect`, the layout half removes the saved intent. Whatever
+    # half is missing after a crash, the next start finishes exactly it.
     async with data.write_lock:
         stored = await data.config_store.async_load() or {}
         cfg = stored.get("config")
         lay_stored = await data.store.async_load() or {}
         layout = lay_stored.get("layout") or {}
-        if cfg and migrate_config(cfg, layout):
-            rev = int(stored.get("rev", 0)) + 1
-            await data.config_store.async_save({"config": cfg, "rev": rev})
-            await data.store.async_save(
-                {"layout": layout, "rev": int(lay_stored.get("rev", 0)) + 1}
-            )
+        pending = {
+            str(k): v for k, v in (lay_stored.get("geom_pending") or {}).items()
+        }
+        merged = {**pending, **pending_from_config(cfg)}
+        if merged:
+            lay_rev = int(lay_stored.get("rev", 0))
+            if merged != pending:  # 1. the durable intent, before anything moves
+                await data.store.async_save(
+                    {"layout": layout, "rev": lay_rev, "geom_pending": merged}
+                )
+            rev = int(stored.get("rev", 0))
+            if cfg and migrate_config(cfg):  # 2. the config half
+                rev += 1
+                await data.config_store.async_save({"config": cfg, "rev": rev})
+            migrate_layout(layout, merged)  # 3. the layout half + intent cleared
+            await data.store.async_save({"layout": layout, "rev": lay_rev + 1})
             _LOGGER.info(
-                "House Plan: migrated %s space(s) to the square canvas", len(cfg.get("spaces") or [])
+                "House Plan: migrated %s space(s) to the square canvas", len(merged)
             )
+            # only once both halves are durable — a client refetching on this
+            # event must never see one migrated half and one old one
             hass.bus.async_fire("houseplan_config_updated", {"rev": rev})
 
     await async_check_plan_files(hass, entry)

custom_components/houseplan/const.py

@@ -45,7 +45,7 @@ PLAN_ORPHAN_TTL_S = 3600
 SCHEDULED_GRACE_S = 30 * 24 * 3600
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.49.0"
+VERSION = "1.50.0"
 
 DEFAULT_CONFIG: dict = {
     "spaces": [],

custom_components/houseplan/geometry_migration.py

@@ -106,28 +106,56 @@ def migrate_space(space: dict[str, Any]) -> bool:
     return True
 
 
+def pending_from_config(config: dict[str, Any] | None) -> dict[str, float]:
+    """{space_id: old aspect} for every space still carrying one.
+
+    This is the migration INTENT. The two stores are written independently and
+    either write can fail, so the intent has to survive on its own: it is saved
+    into the layout store BEFORE anything changes (HP-1490-01), and cleared by
+    the same write that stores the migrated layout. A crash between the writes
+    leaves the intent behind, and the next start finishes the missing half —
+    each half is idempotent because its trigger (`aspect` in the config, the
+    saved intent for the layout) travels with that half's own write.
+    """
+    out: dict[str, float] = {}
+    for space in (config or {}).get("spaces") or []:
+        if "aspect" not in space:
+            continue
+        try:
+            out[str(space.get("id"))] = float(space.get("aspect") or 1) or 1.0
+        except (TypeError, ValueError):
+            out[str(space.get("id"))] = 1.0
+    return out
+
+
 def migrate_config(config: dict[str, Any], layout: dict[str, Any] | None = None) -> bool:
-    """Migrate every space, and the marker positions that belong to them."""
-    spaces = config.get("spaces") or []
-    factors = {}
-    for space in spaces:
-        if "aspect" in space:
-            factors[str(space.get("id"))] = transform_for(space.get("aspect") or 1)
+    """The config half: migrate every space still carrying an `aspect`.
+
+    `layout` is accepted for backward compatibility and migrated with the
+    factors found in the config — callers that can crash between store writes
+    should use `pending_from_config()` + `migrate_layout()` instead, so the
+    layout half does not depend on state the config half just deleted.
+    """
+    factors = pending_from_config(config)
     if not factors:
         return False
-
-    for space in spaces:
+    for space in config.get("spaces") or []:
         migrate_space(space)
+    if layout:
+        migrate_layout(layout, factors)
+    return True
 
+
+def migrate_layout(layout: dict[str, Any] | None, pending: dict[str, float]) -> bool:
+    """The layout half: marker and label positions of the spaces in `pending`."""
+    changed = False
     for pos in (layout or {}).values():
-        if not isinstance(pos, dict):
+        if not isinstance(pos, dict) or str(pos.get("s")) not in pending:
             continue
-        f = factors.get(str(pos.get("s")))
-        if not f:
-            continue
-        dx, dy, kx, ky = f
+        dx, dy, kx, ky = transform_for(pending[str(pos.get("s"))])
         if pos.get("x") is not None:
             pos["x"] = dx + float(pos["x"]) * kx
         if pos.get("y") is not None:
             pos["y"] = dy + float(pos["y"]) * ky
-    return True
+        changed = True
+    return changed

custom_components/houseplan/manifest.json

@@ -16,5 +16,5 @@
   "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
   "requirements": [],
   "single_config_entry": true,
-  "version": "1.49.0"
+  "version": "1.50.0"
 }

custom_components/houseplan/store.py

@@ -43,6 +43,12 @@ class HouseplanData:
     # One lock for every load→modify→save cycle of both stores: prevents
     # lost updates from concurrent WS calls and makes the rev check atomic.
     write_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    # A separate, narrower lock for the check-quota→write-file pair of an
+    # upload. Without it N parallel uploads all measure the store BEFORE any
+    # of them writes, and all pass a quota only one of them fits under
+    # (HP-1490-02). Separate from write_lock so a slow directory scan does not
+    # stall config/layout commits.
+    upload_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
     # Collect files nothing references any more. Set during setup, which also
     # runs it once and schedules it daily. Exposed so it can be invoked
     # directly — a test that fakes a 24 h jump proves the timer fires, not that

custom_components/houseplan/websocket_api.py

@@ -653,19 +653,25 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
     # (SPACE_ID_RE), so "<space>.<token>.<ext>" can never be confused with the
     # files of a differently named space.
     plans_dir = Path(hass.config.path(PLANS_DIR))
-    try:
-        await hass.async_add_executor_job(
-            check_quota, plans_dir, len(raw), MAX_PLANS_BYTES, MAX_PLANS_FILES
-        )
-    except QuotaError as err:
-        connection.send_error(msg["id"], err.reason, err.detail)
-        return
     name = f"{space_id}.{secrets.token_hex(4)}.{msg['ext']}"
     path = plans_dir / name
 
-    def _write() -> None:
+    def _check_and_write() -> None:
+        # one executor job for the pair, under upload_lock: the measurement
+        # is only a bound if nothing else writes between it and our write
+        # (HP-1490-02). A failed write reserves nothing — the file either
+        # exists and is counted by the next scan, or does not and is not.
+        check_quota(plans_dir, len(raw), MAX_PLANS_BYTES, MAX_PLANS_FILES)
         plans_dir.mkdir(parents=True, exist_ok=True)
         path.write_bytes(raw)
 
-    await hass.async_add_executor_job(_write)
+    data = _runtime(hass, connection, msg["id"])
+    if data is None:
+        return
+    async with data.upload_lock:
+        try:
+            await hass.async_add_executor_job(_check_and_write)
+        except QuotaError as err:
+            connection.send_error(msg["id"], err.reason, err.detail)
+            return
     connection.send_result(msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{name}"})