v1.49.0: content-fit zoom, swipe animation, wording, and the v1.47.0 review

Owner's batch:
- zoom now opens on what is DRAWN (rooms + 5% margin) for spaces with no
  background image; with one the image is the plan and still fits whole. A small
  plan on the square canvas no longer opens as a speck.
- swiping between spaces, and the kiosk carousel, slide sideways; honours
  prefers-reduced-motion.
- the room settings button reads 'Room settings' and lightens on hover.
- 'curation' is filtering everywhere: UI strings, docs, code.

Checked the yard while I was there: its drawing sits off-centre because it was
drawn that way — before the migration x spanned 0.12..0.54 with 0.12 and 0.46 of
margin. The migration added 0.1465 on each side, symmetrically. Content-fit zoom
makes it moot anyway.

From the v1.47.0 review:
- HP-1470-02: the picker let you delete the plan you had just selected — it is
  not in the stored config yet, so the server rightly called it free, and the
  save then stored a url with no file. The button is disabled, and since two
  clients can do this in either order, config/set now verifies every internal
  plan url against the disk under the write lock and answers .
  External and legacy urls are not ours to police.
- HP-1470-01: growth is bounded at the door rather than by deleting old files —
  that mistake cost real plans twice. check_quota refuses an upload that would
  push the store past 256 MB / 200 plans (1 GB / 1000 attachments) or leave less
  than 512 MB free. The plan list is capped at 60 newest with a total, and
  thumbnails load lazily.
- HP-1470-03: picking a saved plan waited for nothing and stored a fallback
  ratio when the signature had not arrived — a square plan came out stretched.
  It waits for the signature, binds the result to the dialog that asked, and the
  dialog preview is signed too.
- report §5: the last lifecycle comments still described age-based collection.

Not released yet — the owner asked for a release once the batch is done.

custom_components/houseplan/const.py

@@ -17,6 +17,20 @@ CONTENT_URL = "/api/houseplan/content"
 # way to tell which paths were dropped (review R2-2).
 MAX_SIGN_PATHS = 200
 
+# Nothing is ever deleted for being old (docs/SCOPE.md), so growth has to be
+# stopped at the door instead. These bound the whole store, not one request: by
+# default any authenticated user may upload, and a per-request cap of 8/50 MB
+# says nothing about how many requests there are (HP-1470-01).
+MAX_PLANS_BYTES = 256 * 1024 * 1024
+MAX_PLANS_FILES = 200
+# How many the picker asks for at once — newest first.
+MAX_PLANS_LISTED = 60
+MAX_FILES_BYTES = 1024 * 1024 * 1024
+MAX_FILES_COUNT = 1000
+# Refuse to write when the disk is nearly full: filling the config partition
+# breaks .storage, the recorder and backups, not just this card.
+MIN_FREE_BYTES = 512 * 1024 * 1024
+
 # An uploaded plan that no accepted configuration references is collected only
 # once it is this old. Age is a race guard, not a policy: a plan uploaded
 # seconds ago may belong to another client's transaction that has not written
@@ -31,7 +45,7 @@ PLAN_ORPHAN_TTL_S = 3600
 SCHEDULED_GRACE_S = 30 * 24 * 3600
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.48.0"
+VERSION = "1.49.0"
 
 DEFAULT_CONFIG: dict = {
     "spaces": [],

custom_components/houseplan/http_api.py

@@ -20,9 +20,12 @@ except ImportError:  # older HA versions
     KEY_HASS = "hass"  # type: ignore[assignment]
 from homeassistant.core import HomeAssistant
 
-from .const import CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, PLANS_DIR
+from .const import (
+    CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, MAX_FILES_BYTES,
+    MAX_FILES_COUNT, PLANS_DIR,
+)
 from .auth import may_write
-from .plans import TMP_PREFIX, reserve_filename
+from .plans import TMP_PREFIX, QuotaError, check_quota, reserve_filename
 from .validation import (
     FILE_EXTENSIONS,
     MAX_FILE_BYTES,
@@ -204,6 +207,16 @@ class HouseplanUploadView(HomeAssistantView):
                 return web.json_response({"error": "no_file"}, status=400)
 
             tmp_path = temps[0]
+            try:
+                await hass.async_add_executor_job(
+                    check_quota, files_root, tmp_path.stat().st_size,
+                    MAX_FILES_BYTES, MAX_FILES_COUNT,
+                )
+            except QuotaError as err:
+                _LOGGER.warning("House Plan upload refused: %s", err.detail)
+                return web.json_response({"error": err.reason, "detail": err.detail}, status=507)
+            except OSError:
+                pass
             target_dir = files_root / marker_id
             safe_name = filename
 

custom_components/houseplan/manifest.json

@@ -16,5 +16,5 @@
   "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
   "requirements": [],
   "single_config_entry": true,
-  "version": "1.48.0"
+  "version": "1.49.0"
 }

custom_components/houseplan/plans.py

@@ -14,7 +14,7 @@ import time
 from pathlib import Path
 from typing import Any
 
-from .const import PLAN_ORPHAN_TTL_S
+from .const import MIN_FREE_BYTES, PLAN_ORPHAN_TTL_S
 from .validation import MAX_FILENAME, PLAN_EXTENSIONS, sanitize_filename
 
 _LOGGER = logging.getLogger(__name__)
@@ -189,6 +189,56 @@ def collect_attachments(
     return removed
 
 
+class QuotaError(Exception):
+    """A store limit would be exceeded. Carries what to tell the user."""
+
+    def __init__(self, reason: str, detail: str) -> None:
+        super().__init__(detail)
+        self.reason = reason
+        self.detail = detail
+
+
+def dir_usage(path: Path) -> tuple[int, int]:
+    """(bytes, files) below `path`, ignoring what we cannot read."""
+    total = count = 0
+    if not path.is_dir():
+        return 0, 0
+    for item in path.rglob("*"):
+        try:
+            if item.is_file():
+                total += item.stat().st_size
+                count += 1
+        except OSError:
+            continue
+    return total, count
+
+
+def check_quota(path: Path, incoming: int, max_bytes: int, max_files: int) -> None:
+    """Raise QuotaError unless `incoming` more bytes fit.
+
+    Deliberately not an age rule. Files are never removed for getting old — that
+    cost real plans twice — so the limit sits where a decision is being made
+    anyway: at the moment somebody asks to store something new.
+    """
+    import shutil
+
+    used, count = dir_usage(path)
+    if count + 1 > max_files:
+        raise QuotaError("too_many_files", f"{count} files already stored, the limit is {max_files}")
+    if used + incoming > max_bytes:
+        raise QuotaError(
+            "quota_exceeded",
+            f"{(used + incoming) // 1024 // 1024} MB would be stored, the limit is "
+            f"{max_bytes // 1024 // 1024} MB",
+        )
+    try:
+        free = shutil.disk_usage(str(path if path.is_dir() else path.parent)).free
+    except OSError:
+        return
+    if free - incoming < MIN_FREE_BYTES:
+        raise QuotaError("low_disk_space", f"only {free // 1024 // 1024} MB free on the disk")
+
+
 def plan_basename(url: Any) -> str:
     """File name a stored plan_url points at ('' when there is none)."""
     if not isinstance(url, str) or not url:
@@ -240,7 +290,7 @@ def collect_plans(
       * a file the OLD configuration referenced and the new one does not was
         authoritative and has been superseded — remove it;
       * any other unreferenced plan file is a rejected or abandoned upload, and
-        is removed only once PLAN_ORPHAN_TTL_S has passed: a fresh one may
+        is KEPT — see the rule above; only a staging folder ages out: a fresh one may
         belong to a transaction that has not committed yet.
 
     Never raises: the configuration is already stored by the time this runs, so

custom_components/houseplan/websocket_api.py

@@ -17,12 +17,14 @@ from homeassistant.core import HomeAssistant, callback
 
 from .const import (
     CONF_ADMIN_ONLY, DEFAULT_CONFIG,
-    CONTENT_URL, FILES_DIR, MAX_SIGN_PATHS, PLANS_DIR, PLANS_URL,
+    CONTENT_URL, FILES_DIR, MAX_PLANS_BYTES, MAX_PLANS_FILES, MAX_PLANS_LISTED,
+    MAX_SIGN_PATHS,
+    PLANS_DIR, PLANS_URL,
 )
 from .auth import may_write
 from .plans import (
-    collect_attachments, collect_plans, is_plan_file, plan_basename, plan_refs,
-    reserve_filename,
+    QuotaError, check_quota, collect_attachments, collect_plans, is_plan_file,
+    plan_basename, plan_refs, reserve_filename,
 )
 from .store import HouseplanData, get_data, get_entry
 from .validation import (
@@ -263,7 +265,12 @@ async def ws_plans_list(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
         out.sort(key=lambda x: -x["modified"])
         return out
 
-    connection.send_result(msg["id"], {"plans": await hass.async_add_executor_job(_scan)})
+    plans = await hass.async_add_executor_job(_scan)
+    # newest first and capped: a folder with thousands of files would otherwise
+    # become one huge message, one huge list and a signing request per row
+    connection.send_result(
+        msg["id"], {"plans": plans[:MAX_PLANS_LISTED], "total": len(plans)}
+    )
 
 
 @websocket_api.websocket_command(
@@ -470,6 +477,26 @@ async def ws_config_get(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
 
 
 
+def _missing_internal_plans(plans_dir: Path, config: dict[str, Any]) -> set[str]:
+    """Plan files a configuration names that are not on disk.
+
+    Only OUR urls are checked — `/api/houseplan/content/plans/_/<name>` and the
+    legacy static path. Anything else belongs to the user and may point wherever
+    they like.
+    """
+    out: set[str] = set()
+    for space in (config or {}).get("spaces") or []:
+        url = space.get("plan_url")
+        if not isinstance(url, str) or not url:
+            continue
+        if not (url.startswith(CONTENT_URL + "/plans/") or url.startswith(PLANS_URL + "/")):
+            continue
+        name = plan_basename(url)
+        if name and not (plans_dir / name).is_file():
+            out.add(name)
+    return out
+
+
 @websocket_api.websocket_command(
     {
         vol.Required("type"): "houseplan/config/set",
@@ -519,6 +546,20 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
                 f"Configuration was changed in another window (rev {current_rev} != {msg['expected_rev']})",
             )
             return
+        # An internal plan url must name a file that exists. The card can pick a
+        # plan and then delete it from the same dialog, and two clients can do
+        # the same thing in either order — the lock serialises them but says
+        # nothing about whether the file survived (HP-1470-02). External and
+        # legacy urls are not ours to check and are left alone.
+        missing = await hass.async_add_executor_job(
+            _missing_internal_plans, Path(hass.config.path(PLANS_DIR)), msg["config"]
+        )
+        if missing:
+            connection.send_error(
+                msg["id"], "missing_plan",
+                "Plan file no longer exists: " + ", ".join(sorted(missing)),
+            )
+            return
         new_rev = current_rev + 1
         await rt.config_store.async_save({"config": msg["config"], "rev": new_rev})
         # Still holding the lock: the file system is not part of the store's
@@ -589,6 +630,13 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
     # (SPACE_ID_RE), so "<space>.<token>.<ext>" can never be confused with the
     # files of a differently named space.
     plans_dir = Path(hass.config.path(PLANS_DIR))
+    try:
+        await hass.async_add_executor_job(
+            check_quota, plans_dir, len(raw), MAX_PLANS_BYTES, MAX_PLANS_FILES
+        )
+    except QuotaError as err:
+        connection.send_error(msg["id"], err.reason, err.detail)
+        return
     name = f"{space_id}.{secrets.token_hex(4)}.{msg['ext']}"
     path = plans_dir / name