v1.46.4: detached plans were being collected as garbage — data loss

Deployed v1.46.3 to my own instance, restarted, and the startup sweep deleted
both floor plans: config/houseplan/plans/ went from f1.svg + f2.png to empty.
The backup is a SecureTar, so they are gone.

The rule was wrong, not the code. v1.46.0 introduced collection that treats
'nothing references this right now' as abandoned and gives it an hour. But
detaching a plan — switching a space to 'draw' — is a normal, reversible action,
and the editor's own comment says the file stays on disk. Those two plans had
been detached for weeks; every pass since v1.46.0 was entitled to remove them,
and the one that finally ran did.

New rule, one for every path:
  * superseded by a commit (was in the old revision, is not in the new) — goes
    immediately; that is the one thing a commit knows for certain;
  * belongs to a space or marker that still exists — never collected, at any
    age, because unreferenced is not abandoned;
  * a per-dialog staging folder (up_*) — one hour, unchanged: by construction it
    only ever holds an upload from a dialog that was never saved;
  * anything else — thirty days.

The  flag I added an hour ago is gone with it: two rules for the same
question is how this happened. Tests updated to the new grace, plus two that pin
the distinction directly.

I am sorry about the files.

docs/ARCHITECTURE.md

@@ -207,8 +207,15 @@ happen when somebody saves, and a file uploaded into a dialog that was then
 cancelled would wait for a write that may never come. A new icon has no id yet, so its
 files go to a per-dialog staging folder and move to the real id once the config
 write is accepted — the same copy → save → cleanup order as a rebind.
-`config/set` collects what its commit superseded, and anything unreferenced and
-older than `PLAN_ORPHAN_TTL_S`.
+`config/set` collects what its commit superseded — and only that, because
+supersession is the one thing a commit knows for certain. *Unreferenced* is a
+much weaker signal: detaching a plan is reversible and the editor promises the
+file stays. So a file belonging to a space or marker that still exists is never
+collected, and anything else waits `SCHEDULED_GRACE_S` (30 days). The exception
+is a per-dialog staging folder, which by construction only holds an upload from
+a dialog that was never saved — `PLAN_ORPHAN_TTL_S` (1 hour) is right there.
+This is not theoretical caution: the one-hour rule applied to unreferenced files
+destroyed two detached plans on 2026-07-28.
 
 **Config writes are serialized** (HP-1454-03). `_writeConfig()` chains onto a
 single promise: one `config/set` in flight, each carrying the revision the

docs/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## v1.46.4 — 2026-07-28 (data loss: detached plans were collected as garbage)
+- **A plan you detach is no longer deleted an hour later.** Switching a space to
+  "draw" clears the reference and, as the editor has always said, leaves the
+  image on disk so you can put it back. The collection added in v1.46.0 did not
+  make that distinction: it treated "nothing points at this right now" as
+  abandoned and applied a one-hour rule. On the author's own instance the
+  scheduled pass then removed two floor plans that had been detached weeks
+  earlier, with no way to get them back. If you have detached a plan since
+  v1.46.0 and your instance restarted or ran for a day, check
+  `config/houseplan/plans/` before updating anything else — and please report it
+  in the Telegram chat if a file is missing.
+  The rule now: **a commit still removes exactly what it replaced**, because
+  that it knows for certain. Everything else is only *unreferenced*, which is a
+  reversible state — a file belonging to a space or a device that still exists
+  is never collected, and anything else waits thirty days instead of an hour.
+  The one unambiguous case keeps the short rule: a per-dialog staging folder
+  only ever holds an upload from a dialog that was never saved.
+
 ## v1.46.3 — 2026-07-28 (re-check of v1.46.2: HP-1462-01)
 - **The cleanup at startup now actually cleans up.** It looked its own runtime
   data up by domain, and during startup Home Assistant does not yet consider

docs/CHANGELOG.ru.md

@@ -6,6 +6,23 @@
 > **Правило проекта:** оба файла пополняются в одном коммите с самим
 > изменением — как и остальная документация (см. docs/STATUS.md).
 
+## v1.46.4 — 2026-07-28 (потеря данных: отцеплённые планы убирались как мусор)
+- **Отцеплённый план больше не удаляется через час.** Переключение пространства
+  в режим «нарисовать» снимает ссылку и, как редактор всегда и говорил,
+  оставляет картинку на диске, чтобы её можно было вернуть. Уборка, добавленная
+  в v1.46.0, этой разницы не делала: считала «на файл сейчас никто не
+  ссылается» синонимом «файл брошен» и применяла часовое правило. На установке
+  автора плановый проход в итоге удалил два плана этажей, отцеплённых
+  несколькими неделями раньше, — восстановить их было нечем. Если вы отцепляли
+  план после v1.46.0 и инстанс перезапускался или проработал сутки — загляните в
+  `config/houseplan/plans/` и напишите в Telegram-чат, если файла нет.
+  Правило теперь такое: **коммит по-прежнему удаляет ровно то, что заменил**, —
+  это он знает наверняка. Всё остальное лишь «непривязано», а это обратимое
+  состояние: файл, принадлежащий существующему пространству или устройству, не
+  удаляется никогда, а всё прочее ждёт тридцать дней вместо часа. Один
+  однозначный случай сохраняет короткое правило: промежуточная папка диалога
+  содержит только загрузку из диалога, который так и не сохранили.
+
 ## v1.46.3 — 2026-07-28 (перепроверка v1.46.2: HP-1462-01)
 - **Уборка при старте действительно убирает.** Она искала свои же runtime-данные
   по домену, а во время запуска Home Assistant ещё не считает интеграцию

docs/STATUS.md

@@ -15,12 +15,12 @@
 
 | Item | State |
 |---|---|
-| Version | **v1.46.3** everywhere (manifest, const.py, package.json, CARD_VERSION); deployed to the home instance |
+| Version | **v1.46.4** everywhere (manifest, const.py, package.json, CARD_VERSION); deployed to the home instance |
 | Workflow | Since 2026-07-22: minor changes go to branch **`dev`** (build + smokes → deploy home → commit → push, NO release); releases are batched on the owner's command (merge dev→main, one tag, one release with a summary changelog, CI checked on dev beforehand) |
 | GitHub | https://github.com/Matysh/houseplan-card — **`main` carries every published release, the latest tag is the current version above**; `dev` is where work lands and is merged into `main` at release time (so `dev` is normally equal to or ahead of `main`, never behind). Push via SSH key `ha_jb` (remote git@github.com:…); API releases via the fine-grained PAT in `~/.git-credentials` (Contents R/W, issued 2026-07-23) |
 | CI | validate.yml (hacs + hassfest + frontend + backend) green; release.yml attaches the bundle on release publish |
 | HACS | Custom repository works. **Inclusion PR: hacs/default#9004** — open, valid, labeled; ~864 older open PRs but merge rate ≈180/mo; realistic ETA 1–3 months (checked 2026-07-24) |
-| Home instance | ha.jbstudio.pro (SSH port 323, key `ha_jb`), deployed **v1.46.3** via direct copy (HACS custom repo also installed) |
+| Home instance | ha.jbstudio.pro (SSH port 323, key `ha_jb`), deployed **v1.46.4** via direct copy (HACS custom repo also installed) |
 | Localization | UI en/ru (src/i18n/*.json), everything user-visible localized incl. kiosk popover |
 | Tests | Four layers: frontend unit (`npm test`, node:test over `test-build/`), pure backend (`pytest tests_backend`, runs anywhere), HA-harness backend (same folder, CI only — needs py3.13 + pytest-homeassistant-custom-component), and browser smokes (`demo/smoke_*.mjs`, headless chromium). **Counts are not written down here** — they went stale within two releases while the version line beside them was kept current, which reads as less coverage than exists (review R5-2). Run `npm run inventory` for the current numbers, or read them off the last CI run |
 | Community | **Telegram chat: https://t.me/ha_houseplan** (created 2026-07-27) — the primary user-facing support channel; GitHub issues stay for bugs/features. Link it from any new release notes and posts |

docs/TESTING.md

@@ -239,6 +239,10 @@ Run the *core flows* (marked ★ below) in each environment at least once per mi
       on the plan after a reload. Same for each tap action and each fill mode
       [auto: backend test_every_display_mode_the_editor_offers_is_accepted and
       neighbours, test_a_marker_showing_its_value_can_be_saved]
+- [ ] Detaching a plan keeps the file (v1.46.4): switch a space to "draw",
+      restart, wait a day — the image is still in `config/houseplan/plans/` and
+      can be re-attached. Replacing a plan still removes the one it replaced,
+      immediately [auto: unit: test_scheduled_collection_never_takes_a_detached_plan]
 - [ ] Nothing accumulates on an idle instance (v1.46.2/v1.46.3, HP-1461-01,
       HP-1462-01): attach a file, cancel the dialog, and do not save anything
       else — the file is gone after a restart AND after the daily pass, while