Release v1.47.0

Pick a plan you already uploaded: the space dialog lists the plans stored on the
server, attaches one on click, and is the only place a plan file is deleted.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,36 @@
+name: Bug report
+description: Something in House Plan does not work as expected
+labels: [bug]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: House Plan version
+      placeholder: v1.13.0
+    validations:
+      required: true
+  - type: input
+    id: ha_version
+    attributes:
+      label: Home Assistant version
+      placeholder: "2026.6"
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened / what did you expect?
+      description: Steps to reproduce help a lot.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / browser console errors
+      description: "Settings → System → Logs (search: houseplan) and the browser console (F12)."
+      render: text
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Diagnostics
+      description: "Settings → Devices & services → House Plan → ⋯ → Download diagnostics (personal fields are redacted automatically)."

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 💬 Telegram chat (@ha_houseplan)
+    url: https://t.me/ha_houseplan
+    about: Questions, setup help, ideas and screenshots — the fastest way to get an answer.
+  - name: 💡 GitHub discussions
+    url: https://github.com/Matysh/houseplan-card/discussions
+    about: Longer-form ideas and show-and-tell.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,14 @@
+name: Feature request
+description: An idea to make House Plan better
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: How do you imagine it working?

.github/workflows/release.yml

@@ -0,0 +1,19 @@
+name: Release
+on:
+  release:
+    types: [published]
+permissions:
+  contents: write
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm ci && npm run build
+      - run: cp dist/houseplan-card.js custom_components/houseplan/frontend/
+      - name: Attach card to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/houseplan-card.js

.github/workflows/validate.yml

@@ -0,0 +1,83 @@
+name: Validate
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "0 4 * * 1"
+jobs:
+  hacs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: HACS validation
+        uses: hacs/action@main
+        with:
+          category: integration
+  hassfest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Hassfest validation
+        uses: home-assistant/actions/hassfest@master
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm ci
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Unit tests
+        run: npm test
+      - name: Build
+        run: npm run build
+      - name: Card bundle in sync with integration
+        run: cmp dist/houseplan-card.js custom_components/houseplan/frontend/houseplan-card.js
+  smoke:
+    # audit T2: the end-to-end layer used to run only when a human remembered.
+    # Gated on `frontend` so a typecheck failure does not burn browser minutes.
+    needs: frontend
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm ci
+      - name: Install Chromium for Playwright
+        run: npx playwright install --with-deps chromium
+      - name: Build a FRESH bundle for the smokes
+        # the committed demo/srv/assets copy is a snapshot; testing it would
+        # report green about code that no longer exists (audit T2)
+        run: npm run build && cp dist/houseplan-card.js demo/srv/assets/houseplan-card.js
+      - name: Smoke suite
+        run: |
+          fail=0
+          mkdir -p /tmp/smoke-logs
+          for f in demo/smoke_*.mjs; do
+            name=$(basename "$f" .mjs)
+            if node "$f" > "/tmp/smoke-logs/$name.log" 2>&1; then
+              echo "ok   $name"
+            else
+              echo "FAIL $name"
+              tail -20 "/tmp/smoke-logs/$name.log"
+              fail=1
+            fi
+          done
+          exit $fail
+      - name: Upload smoke logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-logs
+          path: /tmp/smoke-logs
+
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.13" }
+      - run: pip install pytest voluptuous pytest-homeassistant-custom-component home-assistant-frontend
+      - name: Backend unit tests (pure + HA harness)
+        run: python -m pytest tests_backend/ -q

.gitignore

@@ -0,0 +1,6 @@
+node_modules/
+tsout/
+test-build/
+*.log
+__pycache__/
+.pytest_cache/

CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing to House Plan
+
+Thanks for your interest! The project is one HACS package: a storage **integration**
+(`custom_components/houseplan/`, Python) and a **Lovelace card** (`src/`, TypeScript + Lit).
+
+## Changelog
+
+User-visible changes go into **both** changelogs in the same commit:
+`docs/CHANGELOG.md` (English) and `docs/CHANGELOG.ru.md` (Russian). Entries
+older than v1.42.0 exist only in the English file — no need to backfill them.
+
+## Where to ask
+
+Not sure whether something is a bug, or just want to discuss an idea before
+writing code? The **[Telegram chat @ha_houseplan](https://t.me/ha_houseplan)**
+is the quickest route to the author and other users. Bugs and concrete feature
+requests still belong in [issues](https://github.com/Matysh/houseplan-card/issues).
+
+## Five-minute setup
+
+```bash
+git clone https://github.com/Matysh/houseplan-card && cd houseplan-card
+npm ci                    # frontend toolchain
+npm run typecheck         # tsc --noEmit (strict)
+npm test                  # node:test — pure logic, i18n parity, tap-action security
+npm run build             # tsc + rollup → dist/houseplan-card.js
+pip install pytest voluptuous && python -m pytest tests_backend -q   # pure backend tests
+```
+
+The HA-harness backend tests (`tests_backend/test_ha_*.py`) need Python ≥3.13 and
+`pytest-homeassistant-custom-component home-assistant-frontend`; CI runs them on
+every push — locally they are skipped when `homeassistant` is not importable.
+
+## Ground rules
+
+- **Docs in the same commit**: CHANGELOG entry for user-visible changes;
+  `docs/STATUS.md` for state changes; `docs/DEVELOPMENT.md` for new gotchas.
+- Every UI string goes through `src/i18n/<lang>.json` (tests enforce en/ru key parity).
+  Adding a language = adding one JSON file + registering it in `src/i18n.ts`.
+- The built card must be committed in sync: `cp dist/houseplan-card.js
+  custom_components/houseplan/frontend/` (CI compares them byte-for-byte).
+- Tap actions have a security model (locks/alarms never toggle from the plan) —
+  see `resolveTapAction` in `src/logic.ts`; don't weaken it.
+- Follow the Integration Quality Scale where applicable —
+  `custom_components/houseplan/quality_scale.yaml` tracks the self-assessment.
+
+## Architecture
+
+Start with `docs/ARCHITECTURE.md` (data model, WS API, coordinate system) and
+`docs/STATUS.md` (current state). Release: bump the version in `package.json`,
+`manifest.json`, `const.py`, `CARD_VERSION`, tag `vX.Y.Z`, publish a GitHub release —
+the workflow attaches the card bundle.

DEV-BUILD.json

@@ -1,7 +0,0 @@
-{
-  "schema": 1,
-  "source": "674e589ad841c6580f31d1a495bb207f13e6931e",
-  "fingerprint": "a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e",
-  "files": 30,
-  "builtAt": "2026-09-29T06:30:42.564Z"
-}

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JB (justbusiness)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,292 @@
+# 🏠 House Plan — interactive floor plan card for Home Assistant
+
+[![HACS Custom](https://img.shields.io/badge/HACS-Custom-41BDF5.svg)](https://github.com/hacs/integration)
+[![GitHub release](https://img.shields.io/github/v/release/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/releases)
+[![GitHub stars](https://img.shields.io/github/stars/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/stargazers)
+[![CI](https://github.com/Matysh/houseplan-card/actions/workflows/validate.yml/badge.svg)](https://github.com/Matysh/houseplan-card/actions)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Telegram chat](https://img.shields.io/badge/Telegram-chat-2CA5E0?logo=telegram&logoColor=white)](https://t.me/ha_houseplan)
+
+**Turn Home Assistant into a live, interactive map of your home.** Upload or draw
+a floor plan, outline the rooms with your mouse — and every smart device appears
+in its real place: live states, tap-to-toggle lights, temperature and humidity per
+room, Zigbee signal maps, glowing light pools and a fullscreen kiosk mode for wall
+tablets. No YAML, no Inkscape, no external editors — the whole floorplan lives
+right on your Lovelace dashboard.
+
+![Interactive Home Assistant floor plan: live rooms, devices, lights and climate on a real floorplan card](docs/images/demo.gif)
+
+🇷🇺 [Документация на русском](README.ru.md) · 💬 [Telegram chat: **@ha_houseplan**](https://t.me/ha_houseplan)
+
+**Feature highlights**
+
+- 🖱 **GUI-first floorplan editor** — rooms, doors & windows, island rooms,
+  virtual walls and a visual decor layer, all drawn with clicks; smart
+  alignment guides and a live ruler in real meters/feet.
+- 💡 **Lights toggle on click** out of the box; wall-switch markers can control
+  whole groups of lights (works for dumb switches and stateless remotes too).
+- 🌒 **“Light sources” fill** — a dark house where every lit lamp casts a pool
+  of its own color that spills through doorways and open zone boundaries.
+- 🌡 **Room cards** with temperature, humidity, Zigbee LQI and light count;
+  comfort-range temperature fills, per-room signal heatmap.
+- 🚪 **Doors, windows and locks** with contact sensors — unlocking is always an
+  explicit button, never an accidental tap.
+- 📺 **Kiosk mode** for wall tablets and TVs: fullscreen, swipe between floors,
+  auto-carousel, per-screen icon sizes.
+- 🔔 New devices appear automatically with a red “new” dot; the layout is stored
+  **server-side** — one shared plan for every user and screen, synced live.
+
+---
+
+## What it is and why
+
+House Plan shows your smart home the way it actually looks — on a floor plan. Instead of long lists of entities, you see rooms and devices in their real places: where the leak is, what the temperature is in the kids' room, whether the light is on in the hallway, whether the gate is open.
+
+This is convenient when:
+
+- you have many devices and lists are awkward to use;
+- you need to grasp the state of the house "at a glance";
+- you want to give access to family members — anyone can figure out a picture;
+- you want a beautiful overview screen for a wall-mounted tablet.
+
+The integration consists of two parts that are installed together:
+
+- **the Lovelace card** `houseplan-card` — the interactive plan itself;
+- **the server-side component** — stores the room markup and icon positions in Home Assistant, so the plan is identical in all browsers and on all devices.
+
+---
+
+## How it differs from alternatives
+
+A house plan in Home Assistant is usually built with `picture-elements`, `ha-floorplan` and similar solutions. There you have to write YAML by hand, calculate the coordinates of every icon, and edit the config again after every change. House Plan works differently:
+
+| | House Plan | Typical solutions (picture-elements / ha-floorplan) |
+|---|---|---|
+| **Setup** | Entirely through the UI, with the mouse | Manual YAML and code editing |
+| **Adding devices** | Automatic, by room | You type in every entity by hand |
+| **Icon coordinates** | Drag with the mouse | You count pixels and write them into the config |
+| **Room markup** | Built-in outline editor | You draw in an external SVG editor |
+| **Storage** | On the HA server (shared by all devices) | In the dashboard YAML |
+| **Zoom** | Smooth zoom, everything stays crisp (vector) | Usually a fixed image |
+
+Key advantages in short:
+
+- **No code at all.** Everything — spaces, rooms, devices — is configured with clicks.
+- **Automatic device placement.** Outline a room and bind it to a Home Assistant area — the devices of that area appear on the plan by themselves.
+- **Manual additions of your own.** Any device, group or even a "virtual" point can be placed on the plan manually, with a name, icon, model, link and an attached PDF manual.
+- **Live states.** Temperature, Zigbee signal strength, on/off, open/closed — everything updates in real time.
+- **Crisp zoom.** Zooming in does not "blur" the picture: the plan, labels and icons remain vector-sharp at any scale.
+
+---
+
+## Wall tablet / TV (kiosk mode)
+
+Add the card to a dedicated dashboard with a **panel view** and set `kiosk: true`
+(or tick "Wall device (kiosk) mode" in the card editor):
+
+```yaml
+type: custom:houseplan-card
+kiosk: true
+cycle: 0   # seconds between auto space switches, 0 = off (nice for TVs)
+```
+
+No header, no editors — just the live plan. Swipe to change floors (at 1:1),
+pinch to zoom, double-tap to reset. Long-press an empty spot for 3 seconds to
+tune icon and text sizes for THIS screen (saved per device). To hide Home
+Assistant's own header use the companion app's kiosk settings or the
+[kiosk-mode](https://github.com/NemesisRE/kiosk-mode) plugin.
+
+## Installation
+
+One click if you already run HACS:
+
+[![Open your Home Assistant instance and open a repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=Matysh&repository=houseplan-card&category=integration)
+
+
+### Via HACS (recommended)
+
+1. Open **HACS → menu (⋮) → Custom repositories**.
+2. Paste the URL of this repository, set the category to **Integration**, and click **Add**.
+3. Find **House Plan** in the list, install it and **restart Home Assistant**.
+4. Go to **Settings → Devices & Services → Add integration** and select **House Plan**.
+
+The card is registered automatically — no need to add a Lovelace resource manually.
+
+> **Card doesn't load (`Custom element doesn't exist: houseplan-card`) or you manage Lovelace
+> resources in YAML?** Add the resource manually pointing at the URL the integration *serves*:
+>
+> ```yaml
+> resources:
+>   - url: /houseplan_files/houseplan-card.js
+>     type: module
+> ```
+>
+> Do **not** use `/custom_components/houseplan/frontend/houseplan-card.js` — that is the file
+> on disk, which Home Assistant does not serve over HTTP (you'll get a `text/plain` MIME error
+> and the element never registers). The correct, integration-served URL is
+> `/houseplan_files/houseplan-card.js`. Both cards (`houseplan-card` and
+> `houseplan-space-card`) ship in that one file — no separate resource is needed.
+
+### Manually
+
+1. Copy the `custom_components/houseplan` folder into the `config/custom_components` directory of your Home Assistant.
+2. Restart Home Assistant.
+3. Add the integration: **Settings → Devices & Services → Add integration → House Plan**.
+
+### Adding a plan screen
+
+Create a new dashboard tab (a "Panel" view works best) and add the card:
+
+```yaml
+type: custom:houseplan-card
+title: House plan
+```
+
+Nothing else needs to be specified — everything else is configured right on the screen.
+
+---
+
+## How to use
+
+### Step 1. Add a space (floor)
+
+On first open the plan is still empty — House Plan immediately offers to create the first space.
+If your Home Assistant already has **floors** configured, a wizard offers to create a space
+for each floor (names prefilled, a plan image is asked for one by one; any floor can be skipped).
+
+![Empty plan — prompt to add a space](docs/images/02-onboarding-empty.png)
+
+In the dialog, set a **name** (for example, "1st floor") and **upload a background** — a floor-plan image in SVG, PNG or JPG format. Both fields are required: without a plan the "Save" button stays disabled.
+
+![Space creation dialog](docs/images/03-space-dialog.png)
+
+> 💡 You can draw the background in any floor planner (for example, REMPLANNER) or photograph a paper plan. SVG works best — it stays crisp when zoomed in.
+
+Later you can add as many spaces as you like (floors, yard, garage) with the **＋** button next to the tabs.
+
+### Step 2. Outline the rooms
+
+After the first space is added, the card switches to the **Plan** tab by itself. The card has three mode tabs in the header — **View** (default: display and device control only, nothing can be moved or edited), **Plan** (rooms, openings, labels, space settings) and **Devices** (placing and configuring markers); the edit tabs are shown to administrators. In Plan, click grid points, connecting them with lines, and close the room outline by clicking the first point.
+
+As soon as the outline is closed, the room-save dialog appears. Here you need to **bind the room to a Home Assistant area** — this is exactly what enables the automation. For utility rooms with no devices (hall, sauna) there is a **"No area"** button.
+
+![Marking up a room and saving it](docs/images/05-room-dialog.png)
+
+While drawing, a ruler follows the cursor showing the current segment's real length (metres, or feet + inches on an imperial Home Assistant). The scale is set per space — the **"Scale (grid cell size)"** field in the space dialog says how many centimetres one grid cell represents (default 5 cm).
+
+Rooms may not overlap: a click strictly inside an existing room, or an outline that would swallow one, is refused. Two more tools help you reshape the plan later:
+
+- **Merge** — click a room, then a neighbour that shares a wall; they fuse into one. A dialog picks which name and area survive.
+- **Split** — click a room, then two points on its walls; the chord cuts it in two. The bigger part stays the room it was (name, area, devices); the smaller one asks for a new name and area.
+
+
+### Doors, windows and locks
+
+In markup mode the **"Opening"** tool places doors and windows: click next to a wall and the
+opening snaps onto it. Pick the type, the **length in real centimetres** (defaults: door 90 cm,
+window 120 cm), an open/close sensor and — for doors — a **lock entity**.
+
+With a sensor bound, the plan comes alive: the door leaf swings on its hinge and the swing arc
+draws itself in as the real door opens; a window opens its two casements. While open, the moving
+parts take an accent colour. A door with a lock shows a padlock badge next to it — green when
+locked, orange when unlocked. For safety the lock can **not** be toggled from the plan; a click
+on the opening shows a status card with both states instead.
+
+Openings are easy to adjust later: hovering one highlights it, you can **drag it along the
+walls** (it slides around corners too), and a **double click opens its properties**.
+
+### Step 3. Devices appear by themselves
+
+As soon as you save a room bound to an area, **the devices of that area are automatically laid out inside the outline**. These are the same devices shown on the **Settings → Devices → (filtered by the room)** page — only the meaningful ones, without service records, bridges and duplicates.
+
+By default only meaningful devices make it onto the plan — service records, bridges and duplicates are filtered out. If you need to see **absolutely all** devices of the area, enable the **👁 "Show all devices"** button in the header.
+
+From here on you can just use the plan: clicking an icon opens the device card with the model, link and a button to jump into Home Assistant.
+
+![Device card on click](docs/images/08-info.png)
+
+### Step 4. Zoom
+
+The mouse wheel or the **－ / ⊹ / ＋** buttons zoom the plan in and out; on a touch screen the two-finger pinch works. Zoomed out you see the whole plan, zoomed in you see the details, and everything stays crisp. The zoom level is remembered separately for each space.
+
+![Zoomed-in plan — everything stays crisp](docs/images/09-zoom.png)
+
+### Step 5. Put the icons in their places
+
+Switch to the **Devices** tab to arrange icons: drag them with the mouse, click one to open its editor. In **View** mode nothing can be moved — panning the map never displaces a sensor (a top user request). Positions are saved on the server and are identical in all browsers and devices. The **↺** button restores the automatic layout.
+
+![Dragging icons — available at all times](docs/images/06-edit.png)
+
+### Tap actions: control devices from the plan
+
+By default a tap on an icon opens its info card. In the card settings you can switch
+**Tap on a device** to *Toggle* — a tap then switches lights, sockets, fans and
+humidifiers directly on the plan (wall-tablet style). For safety, a card-wide toggle
+never affects locks, alarms, covers or valves; you can consciously enable toggle for a
+specific device (except locks and alarms — those never toggle from the plan) in its
+edit dialog. A **long press** always opens the info card.
+
+### Icon rules
+
+Which MDI icon a device gets is decided by **icon rules** — editable right in the card
+(the ⬡ button in the header): an ordered list of “name pattern → icon” regexes with a
+live test field, bilingual defaults (EN/RU) and a one-click reset. When no rule
+matches, the entity *device class* decides (thermometer for temperature sensors, etc.).
+
+### Step 6. Adding your own devices manually
+
+You can also place a **single entity** (not just a whole device): start typing in the binding search and individual entities appear next to devices — handy when one device exposes several values (e.g. temperature and humidity) and you want each as its own icon.
+
+
+Not everything has to be left to the automation. With the **＋** button in the header you can place any device, group or a **virtual point** on the plan (for example, an "Inlet valve" that does not exist as a device). Set a name, icon, model, link, description and, if you wish, attach a **PDF manual**.
+
+The same dialog controls how the device looks on the plan. **Display** switches between the
+icon badge, an animated **presence ripple** (pulsing rings while the entity is active, a faint
+dot when idle — great for motion sensors) or both, with a per-device ring colour and size. The
+**icon size** (×0.5–3) and **rotation** are also per-device, so a wall valve can be small and
+turned the way it is mounted.
+
+![Adding a device manually](docs/images/07-marker-dialog.png)
+
+---
+
+## Uninstalling
+
+1. Remove the card (or the tab with the plan) from the dashboard.
+2. **Settings → Devices & Services → House Plan → Delete** the integration entry.
+3. Remove the integration from **HACS** (or delete the `custom_components/houseplan` folder if installed manually) and restart Home Assistant.
+4. Optionally delete the saved plan data: the `config/houseplan/` files (backgrounds and attachments) and the `houseplan.config` / `houseplan.layout` entries in the `config/.storage` directory.
+
+---
+
+## Getting help & sharing your plan
+
+- 💬 **[Telegram chat — @ha_houseplan](https://t.me/ha_houseplan)** — questions,
+  setup help, feature ideas, and screenshots of your plans. The fastest way to
+  reach the author and other users.
+- 🐞 [GitHub issues](https://github.com/Matysh/houseplan-card/issues) — bug
+  reports and feature requests (please attach your House Plan version).
+- 💡 [GitHub discussions](https://github.com/Matysh/houseplan-card/discussions) —
+  longer-form ideas.
+- 📜 [Changelog](docs/CHANGELOG.md) — what changed in every version
+  ([на русском](docs/CHANGELOG.ru.md)).
+
+When reporting a problem, the version number helps a lot: it is shown in the
+browser console on load (`HOUSEPLAN-CARD vX.Y.Z`) and in **Settings → Devices &
+Services → House Plan**.
+
+---
+
+## Frequently asked questions
+
+**Do I need to write anything in YAML?** No. The only line is adding the card to the dashboard; everything else is done with the mouse.
+
+**My devices did not appear on the plan.** A device appears only if its Home Assistant area is bound to a drawn room. Check that the device has a room assigned (Settings → Devices) and that the room is outlined and bound to that area. If the device exists but is hidden by curation (bridges, service records, duplicates) — enable the **👁 "Show all devices"** button in the header.
+
+**Can I hide an unwanted device or rename it?** Yes — click the device on the plan and press "Edit" in its card: there you can change the name, icon, model or hide the icon.
+
+**Is the data stored in the cloud?** No. Everything is stored locally in your Home Assistant.
+
+---
+
+<p align="center"><sub>Screenshots were taken on a real Home Assistant configuration.</sub></p>

README.ru.md

@@ -0,0 +1,294 @@
+# 🏠 House Plan — интерактивный поэтажный план дома для Home Assistant
+
+[![HACS Custom](https://img.shields.io/badge/HACS-Custom-41BDF5.svg)](https://github.com/hacs/integration)
+[![GitHub release](https://img.shields.io/github/v/release/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/releases)
+[![GitHub stars](https://img.shields.io/github/stars/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/stargazers)
+[![Telegram chat](https://img.shields.io/badge/Telegram-чат-2CA5E0?logo=telegram&logoColor=white)](https://t.me/ha_houseplan)
+
+**Превратите Home Assistant в живую интерактивную карту дома.** Загрузите или
+нарисуйте план этажа, обведите комнаты мышкой — и умные устройства появятся на
+своих местах: живые состояния, свет по клику, температура и влажность по
+комнатам, карта Zigbee-сигнала, светящиеся пятна ламп и полноэкранный
+киоск-режим для настенного планшета. Без YAML, без Inkscape и внешних
+редакторов — весь план настраивается прямо на дашборде.
+
+![Интерактивный план дома для Home Assistant: комнаты, устройства, свет и климат на реальном поэтажном плане](docs/images/demo.gif)
+
+🇬🇧 [Documentation in English](README.md) · 💬 [Чат в Telegram: **@ha_houseplan**](https://t.me/ha_houseplan)
+
+**Главное**
+
+- 🖱 **Редакторы прямо в карточке** — комнаты, двери и окна, комнаты-острова,
+  виртуальные стены и декор-слой рисуются кликами; помощник выравнивания и
+  линейка в реальных метрах.
+- 💡 **Свет переключается кликом** из коробки; значок выключателя может
+  управлять группой ламп (в т.ч. «тупые» выключатели и кнопки-пульты).
+- 🌒 **Заливка «Свет по источникам»** — тёмный дом, где каждая горящая лампа
+  даёт пятно своего цвета, проникающее через дверные проёмы и открытые зоны.
+- 🌡 **Карточки комнат**: температура, влажность, Zigbee-сигнал, свет «1 из 3»;
+  температурная заливка по комфортным границам.
+- 🚪 **Двери, окна и замки** с датчиками — отпирание только явной кнопкой,
+  никогда случайным тапом.
+- 📺 **Киоск-режим** для настенных планшетов и ТВ: полноэкранно, свайп между
+  этажами, автокарусель, свои размеры на каждом экране.
+- 🔔 Новые устройства сами появляются на плане с красной точкой; раскладка
+  хранится **на сервере HA** — один план для всех экранов, живая синхронизация.
+
+---
+
+
+## Что это и зачем
+
+House Plan показывает ваш умный дом так, как он выглядит на самом деле — на плане этажей. Вместо длинных списков сущностей вы видите комнаты и устройства на своих местах: где протечка, какая температура в детской, включён ли свет в прихожей, открыты ли ворота.
+
+Это удобно, когда:
+
+- устройств много, и списками пользоваться неудобно;
+- нужно быстро понять состояние дома «одним взглядом»;
+- хочется отдать доступ близким — по картинке разберётся любой;
+- вы хотите красивый обзорный экран для настенного планшета.
+
+Интеграция состоит из двух частей, которые ставятся вместе:
+
+- **карточка Lovelace** `houseplan-card` — сам интерактивный план;
+- **серверный компонент** — хранит разметку комнат и позиции иконок в Home Assistant, поэтому план одинаков во всех браузерах и на всех устройствах.
+
+---
+
+## Чем отличается от аналогов
+
+Обычно план дома в Home Assistant делают через `picture-elements`, `ha-floorplan` и подобные решения. Там приходится вручную писать YAML, вычислять координаты каждой иконки и заново править конфиг при каждом изменении. House Plan устроен иначе:
+
+| | House Plan | Обычные решения (picture-elements / ha-floorplan) |
+|---|---|---|
+| **Настройка** | Полностью через интерфейс, мышкой | Ручной YAML и правка кода |
+| **Добавление устройств** | Автоматически по комнатам | Каждую сущность вписываете руками |
+| **Координаты иконок** | Перетаскиваете мышью | Считаете пиксели и пишете в конфиг |
+| **Разметка комнат** | Встроенный редактор контуров | Рисуете в стороннем редакторе SVG |
+| **Хранение** | На сервере HA (общее для всех устройств) | В YAML дашборда |
+| **Масштаб** | Плавный зум, всё остаётся чётким (вектор) | Обычно фиксированная картинка |
+
+Ключевые преимущества коротко:
+
+- **Никакого кода.** Всё — пространства, комнаты, устройства — настраивается кликами.
+- **Автоматическое добавление устройств.** Обвели комнату и привязали её к зоне Home Assistant — устройства этой зоны сами появляются на плане.
+- **Ручное добавление своих.** Любое устройство, группу или даже «виртуальную» точку можно поставить на план вручную, задать имя, иконку, модель, ссылку и приложить PDF-инструкцию.
+- **Живые состояния.** Температура, уровень сигнала Zigbee, вкл/выкл, открыто/закрыто — всё обновляется в реальном времени.
+- **Чёткий зум.** Приближение не «мылит» картинку: план, подписи и иконки остаются векторно-чёткими на любом масштабе.
+
+---
+
+## Настенный планшет / ТВ (киоск-режим)
+
+Отдельный дашборд с view типа «панель», у карточки — `kiosk: true` (или
+галочка «Режим настенного устройства» в редакторе карточки):
+
+```yaml
+type: custom:houseplan-card
+kiosk: true
+cycle: 0   # автосмена пространств каждые N секунд, 0 = выкл (удобно для ТВ)
+```
+
+Без шапки и редакторов — только живой план. Свайп листает этажи (при 1:1),
+пинч — зум, двойной тап — сброс. Долгое нажатие (3 с) по пустому месту —
+настройка размеров значков и текста для ЭТОГО экрана (хранится на
+устройстве). Шапку самого Home Assistant скрывают настройки companion-app
+или плагин [kiosk-mode](https://github.com/NemesisRE/kiosk-mode).
+
+## Установка
+
+В один клик, если у вас уже есть HACS:
+
+[![Open your Home Assistant instance and open a repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=Matysh&repository=houseplan-card&category=integration)
+
+
+### Через HACS (рекомендуется)
+
+1. Откройте **HACS → меню (⋮) → Custom repositories**.
+2. Вставьте URL этого репозитория, категория — **Integration**, и нажмите **Add**.
+3. Найдите в списке **House Plan**, установите и **перезапустите Home Assistant**.
+4. Перейдите в **Настройки → Устройства и службы → Добавить интеграцию** и выберите **House Plan**.
+
+Карточка подключается автоматически — добавлять ресурс Lovelace вручную не нужно.
+
+> **Карточка не грузится (`Custom element doesn't exist: houseplan-card`) или вы ведёте ресурсы
+> Lovelace в YAML?** Добавьте ресурс вручную, указав URL, который *раздаёт сама интеграция*:
+>
+> ```yaml
+> resources:
+>   - url: /houseplan_files/houseplan-card.js
+>     type: module
+> ```
+>
+> **Не** используйте `/custom_components/houseplan/frontend/houseplan-card.js` — это путь к файлу
+> на диске, который Home Assistant не отдаёт по HTTP (получите ошибку MIME `text/plain`, и элемент
+> не зарегистрируется). Правильный URL, который раздаёт интеграция, — `/houseplan_files/houseplan-card.js`.
+> Обе карточки (`houseplan-card` и `houseplan-space-card`) лежат в этом одном файле — отдельный ресурс
+> не нужен.
+
+### Вручную
+
+1. Скопируйте папку `custom_components/houseplan` в каталог `config/custom_components` вашего Home Assistant.
+2. Перезапустите Home Assistant.
+3. Добавьте интеграцию: **Настройки → Устройства и службы → Добавить интеграцию → House Plan**.
+
+### Добавление экрана с планом
+
+Создайте новую вкладку дашборда (удобнее всего — в режиме «Панель»/Panel) и добавьте карточку:
+
+```yaml
+type: custom:houseplan-card
+title: План дома
+```
+
+Больше ничего указывать не нужно — всё остальное настраивается прямо на экране.
+
+---
+
+## Как пользоваться
+
+### Шаг 1. Добавьте пространство (этаж)
+
+При первом открытии план ещё пуст — House Plan сразу предложит создать первое пространство.
+
+Если в вашем Home Assistant уже настроены **этажи**, мастер предложит создать
+пространство для каждого: названия подставятся сами, план попросит по очереди,
+любой этаж можно пропустить.
+
+![Пустой план — предложение добавить пространство](docs/images/02-onboarding-empty.png)
+
+В диалоге задайте **название** (например, «1 этаж») и **загрузите подложку** — картинку плана этажа в формате SVG, PNG или JPG. Оба поля обязательны: без плана кнопка «Сохранить» неактивна.
+
+![Диалог создания пространства](docs/images/03-space-dialog.png)
+
+> 💡 Подложку можно нарисовать в любом планировщике (например, РЕМПЛАННЕР) или сфотографировать бумажный план. Лучше всего SVG — он остаётся чётким при увеличении.
+
+Позже можно добавить сколько угодно пространств (этажи, двор, гараж) кнопкой **＋** рядом со вкладками.
+
+### Шаг 2. Обведите комнаты
+
+После добавления первого пространства карточка сама переходит в режим разметки. Кликайте по точкам сетки, соединяя их линиями, и замкните контур комнаты кликом по первой точке.
+
+Как только контур замкнётся, появится окно сохранения комнаты. Здесь нужно **привязать комнату к зоне Home Assistant** — именно это включает автоматику. Для служебных помещений без устройств (холл, сауна) есть кнопка **«Без зоны»**.
+
+![Разметка комнаты и её сохранение](docs/images/05-room-dialog.png)
+
+Во время рисования у курсора показывается линейка с реальной длиной текущего отрезка (метры или футы+дюймы на имперской системе HA). Масштаб задаётся для каждого пространства — поле **«Масштаб (размер ячейки сетки)»** в диалоге пространства: сколько сантиметров в одной ячейке (по умолчанию 5 см).
+
+Комнаты не могут пересекаться: клик строго внутри существующей комнаты или контур, охватывающий её, отклоняются. Ещё два инструмента помогают перекроить план позже:
+
+- **Объединить** — кликните комнату, затем соседнюю с общей стеной; они сольются в одну. Диалог выбирает, чьё имя и зона останутся.
+- **Разделить** — кликните комнату, затем две точки на её стенах; хорда разрежет её надвое. Бо́льшая часть остаётся прежней комнатой (имя, зона, устройства), меньшая просит новое имя и зону.
+
+
+### Двери, окна и замки
+
+В режиме разметки инструмент **«Проём»** ставит двери и окна: кликните рядом со стеной — проём
+примагнитится к ней. Выберите тип, **длину в реальных сантиметрах** (по умолчанию дверь 90 см,
+окно 120 см), датчик открытия и — для двери — **замок**.
+
+С привязанным датчиком план оживает: створка двери поворачивается на петле, и дуга распахивания
+дорисовывается по мере открытия настоящей двери; окно раскрывает две створки. Пока открыто,
+подвижные части подсвечены акцентным цветом. У двери с замком рядом отображается замочек —
+зелёный, когда заперто, оранжевый, когда нет. Ради безопасности замок с плана **нельзя**
+переключить — клик по проёму показывает карточку с обоими статусами.
+
+Проёмы легко поправить позже: при наведении проём подсвечивается, его можно **перетащить вдоль
+стен** (в том числе за угол), а **двойной клик открывает свойства**.
+
+### Шаг 3. Устройства появляются сами
+
+Как только вы сохранили комнату с привязкой к зоне, **устройства этой зоны автоматически расставляются внутри контура**. Берутся те же устройства, что показаны на странице **Настройки → Устройства → (фильтр по нужной комнате)** — только осмысленные, без служебных записей, мостов и дубликатов.
+
+По умолчанию на план попадают только осмысленные устройства — служебные записи, мосты и дубликаты отфильтрованы. Если нужно видеть **вообще все** устройства зоны, включите в шапке кнопку **👁 «Показать все устройства»**.
+
+Дальше можно просто пользоваться планом: клик по иконке открывает карточку устройства с моделью, ссылкой и кнопкой перехода в Home Assistant.
+
+![Карточка устройства по клику](docs/images/08-info.png)
+
+### Шаг 4. Масштаб
+
+Колесо мыши или кнопки **－ / ⊹ / ＋** приближают и отдаляют план; на сенсорном экране работает «щипок» двумя пальцами. При отдалении виден весь план целиком, при приближении — детали, и всё остаётся чётким. Масштаб запоминается отдельно для каждого пространства.
+
+![Приближённый план — всё остаётся чётким](docs/images/09-zoom.png)
+
+### Шаг 5. Расставьте значки по местам
+
+Расставлять значки нужно на вкладке **«Устройства»**: там они перетаскиваются мышью, а клик открывает редактор. В режиме **«Просмотр»** ничего сдвинуть нельзя — панорамирование карты больше не сдвигает датчики (главная просьба пользователей). Позиции сохраняются на сервере и одинаковы во всех браузерах и устройствах. Кнопка **↺** возвращает автоматическую раскладку.
+
+![Перетаскивание значков — доступно всегда](docs/images/06-edit.png)
+
+### Управление с плана (tap actions)
+
+По умолчанию тап по значку открывает инфо-карточку. В настройках карточки можно
+переключить **«Тап по устройству»** на *Переключить* — тогда тап включает/выключает
+свет, розетки, вентиляторы и увлажнители прямо с плана (режим настенного планшета).
+Для безопасности общий toggle не действует на замки, сигнализации, шторы/ворота и
+клапаны; для конкретного устройства toggle можно включить осознанно в его диалоге
+(кроме замков и сигнализаций — они с плана не переключаются никогда). **Долгое
+нажатие** всегда открывает инфо-карточку.
+
+### Правила иконок
+
+Какая MDI-иконка достанется устройству, решают **правила иконок** — редактируются
+прямо в карточке (кнопка ⬡ в шапке): упорядоченный список «шаблон имени → иконка»
+с живым тест-полем, двуязычные умолчания (EN/RU) и сброс одной кнопкой. Если ни одно
+правило не подошло — решает *device class* сущности (термометр для датчиков
+температуры и т.п.).
+
+### Шаг 6. Добавление своих устройств вручную
+
+Можно поставить и **отдельную сущность** (не только устройство целиком): начните печатать в поиске привязки — рядом с устройствами появятся отдельные сущности. Удобно, когда одно устройство отдаёт несколько значений (например, температуру и влажность), а вы хотите каждое своей иконкой.
+
+
+Не всё нужно оставлять на автоматику. Кнопкой **＋** в шапке можно поставить на план любое устройство, группу или **виртуальную точку** (например, «Вентиль на вводе», которого нет как устройства). Задайте имя, иконку, модель, ссылку, описание и при желании приложите **PDF-инструкцию**.
+
+В этом же диалоге настраивается вид устройства на плане. **Отображение** переключает значок,
+анимированную **пульсацию присутствия** (расходящиеся кольца, пока сущность активна, и тусклая
+точка в покое — идеально для датчиков движения) или то и другое сразу, с цветом и размером колец
+на устройство. **Размер значка** (×0,5–3) и **поворот** — тоже индивидуальные: вентиль на стене
+может быть маленьким и повёрнутым так, как он установлен.
+
+![Добавление устройства вручную](docs/images/07-marker-dialog.png)
+
+---
+
+## Удаление
+
+1. Уберите карточку (или вкладку с планом) из дашборда.
+2. **Настройки → Устройства и службы → House Plan → Удалить** запись интеграции.
+3. Удалите интеграцию из **HACS** (или папку `custom_components/houseplan` при ручной установке) и перезапустите Home Assistant.
+4. При желании удалите сохранённые данные плана: файлы `config/houseplan/` (подложки и вложения) и записи `houseplan.config` / `houseplan.layout` в каталоге `config/.storage`.
+
+---
+
+## Помощь и обмен опытом
+
+- 💬 **[Чат в Telegram — @ha_houseplan](https://t.me/ha_houseplan)** — вопросы,
+  помощь с настройкой, идеи и скриншоты ваших планов. Самый быстрый способ
+  связаться с автором и другими пользователями.
+- 🐞 [Issues на GitHub](https://github.com/Matysh/houseplan-card/issues) — баги
+  и запросы фич (пожалуйста, указывайте версию House Plan).
+- 💡 [Discussions](https://github.com/Matysh/houseplan-card/discussions) — для
+  развёрнутых обсуждений.
+- 📜 [История изменений](docs/CHANGELOG.ru.md) — что менялось в каждой версии.
+
+Версия видна в консоли браузера при загрузке (`HOUSEPLAN-CARD vX.Y.Z`) и в
+**Настройки → Устройства и службы → House Plan** — с ней разбираться сильно
+быстрее.
+
+---
+
+## Часто задаваемые вопросы
+
+**Нужно ли что-то писать в YAML?** Нет. Единственная строчка — это добавление карточки на дашборд; всё остальное делается мышкой.
+
+**Мои устройства не появились на плане.** Устройство появляется, только если его зона в Home Assistant привязана к нарисованной комнате. Проверьте, что у устройства задана комната (Настройки → Устройства), а комната обведена и привязана к этой зоне. Если устройство есть, но скрыто курированием (мосты, служебные, дубликаты) — включите в шапке кнопку **👁 «Показать все устройства»**.
+
+**Можно ли скрыть лишнее устройство или переименовать его?** Да — кликните по устройству на плане и в его карточке нажмите «Редактировать»: там можно сменить имя, иконку, модель или скрыть значок.
+
+**Данные хранятся в облаке?** Нет. Всё хранится локально в вашем Home Assistant.
+
+---
+
+<p align="center"><sub>Скриншоты сделаны на реальной конфигурации Home Assistant.</sub></p>

custom_components/houseplan/__init__.py

@@ -0,0 +1,222 @@
+"""House Plan: server-side house plan configuration + Lovelace card serving."""
+from __future__ import annotations
+
+import logging
+from datetime import timedelta
+from pathlib import Path
+
+from homeassistant.components.frontend import add_extra_js_url
+from homeassistant.core import HomeAssistant
+from homeassistant.exceptions import ConfigEntryNotReady
+from homeassistant.helpers.event import async_track_time_interval
+
+from . import websocket_api as hp_ws
+from .const import (
+    DOMAIN,
+    FILES_DIR,
+    FILES_URL,
+    FRONTEND_URL,
+    PLANS_DIR,
+    PLANS_URL,
+    VERSION,
+)
+from .plans import collect_attachments, collect_plans, sweep_upload_temps
+from .repairs import async_check_plan_files
+from .store import HouseplanConfigEntry, create_data
+
+_LOGGER = logging.getLogger(__name__)
+
+
+async def async_setup(hass: HomeAssistant, config) -> bool:
+    """Register global handlers (survive config-entry reloads): WS commands, HTTP view."""
+    hass.data.setdefault(DOMAIN, {})
+    hp_ws.async_register(hass)
+    from .http_api import HouseplanContentView, HouseplanUploadView
+
+    hass.http.register_view(HouseplanUploadView())
+    hass.http.register_view(HouseplanContentView())
+    return True
+
+
+async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) -> bool:
+    """Config entry: stores in runtime_data, static paths, card auto-registration."""
+    data = create_data(hass)
+    # test-before-setup: storage must be readable, otherwise retry later
+    try:
+        await data.store.async_load()
+        await data.config_store.async_load()
+    except Exception as err:  # noqa: BLE001 — corrupt/unreadable .storage
+        raise ConfigEntryNotReady(f"House Plan storage is not readable: {err}") from err
+    entry.runtime_data = data
+
+    card_path = Path(__file__).parent / "frontend" / "houseplan-card.js"
+    plans_path = Path(hass.config.path(PLANS_DIR))
+    files_path = Path(hass.config.path(FILES_DIR))
+    await hass.async_add_executor_job(
+        lambda: (plans_path.mkdir(parents=True, exist_ok=True), files_path.mkdir(parents=True, exist_ok=True))
+    )
+
+    # Static paths cannot be unregistered — register once per HA run.
+    if not hass.data[DOMAIN].get("static_registered"):
+        hass.data[DOMAIN]["static_registered"] = True
+        static_paths = []
+        try:
+            from homeassistant.components.http import StaticPathConfig
+
+            if card_path.exists():
+                static_paths.append(StaticPathConfig(FRONTEND_URL, str(card_path), cache_headers=False))
+            # NOTE (audit B1): plans and marker files are NO LONGER static.
+            # They are served by HouseplanContentView, which requires auth.
+            # Only the card bundle stays public — Lovelace resources must be.
+            if static_paths:
+                await hass.http.async_register_static_paths(static_paths)
+        except ImportError:  # very old HA versions
+            if card_path.exists():
+                hass.http.register_static_path(FRONTEND_URL, str(card_path), cache_headers=False)
+
+    if not card_path.exists():
+        _LOGGER.warning("houseplan-card.js not found next to the integration: %s", card_path)
+        return True
+
+    # Register the card. Preferably as a Lovelace resource (the frontend AWAITS
+    # resources before rendering dashboards, so the card is available even on a cold
+    # start of the mobile app). If the resource registry is unavailable (YAML-mode
+    # Lovelace, old versions) — fall back to extra_module_url.
+    module_url = f"{FRONTEND_URL}?v={VERSION}"
+    registered = await _register_lovelace_resource(hass, module_url)
+    if not registered:
+        add_extra_js_url(hass, module_url)
+    # Tell the user exactly where the card lives — the #1 support issue is people adding a
+    # Lovelace resource pointing at the on-disk path (/custom_components/...), which HA does
+    # not serve (wrong MIME → "Custom element doesn't exist"). The correct served URL is below.
+    if registered:
+        _LOGGER.info("House Plan card auto-registered as a Lovelace resource: %s", module_url)
+    else:
+        _LOGGER.info(
+            "House Plan card is served at %s . Lovelace resources look YAML-managed — add it "
+            "manually under `resources:` as { url: %s, type: module }. Do NOT use the on-disk "
+            "path /custom_components/houseplan/frontend/houseplan-card.js (HA does not serve it).",
+            module_url, module_url,
+        )
+
+    await async_check_plan_files(hass, entry)
+
+    # Scheduled collection of everything nobody ended up referencing.
+    #
+    # A commit collects what that commit superseded, which is the right rule for
+    # a commit — but it only ever runs when somebody saves. Cancel a dialog
+    # after the file has already uploaded, lose the connection after the upload
+    # succeeded, or call the API directly, and the file is unreferenced with no
+    # future write to notice it (HP-1461-01). The earlier version of this sweep
+    # only removed streaming temporaries, which are a different, narrower case.
+    #
+    # Passing the CURRENT configuration as both sides means "nothing was
+    # superseded": every referenced file is preserved and only unreferenced ones
+    # past PLAN_ORPHAN_TTL_S go. It runs under the same lock as a config write,
+    # so it cannot decide from a snapshot that a commit is about to replace.
+    async def _sweep(_now=None) -> None:
+        files_dir = Path(hass.config.path(FILES_DIR))
+        plans_dir = Path(hass.config.path(PLANS_DIR))
+        try:
+            # `data` from the closure, NOT get_data(hass): during
+            # async_setup_entry the entry is still SETUP_IN_PROGRESS, so
+            # async_loaded_entries() does not list it and the lookup returned
+            # None. The startup pass then silently degraded to removing
+            # streaming temporaries only, and the real collection waited a full
+            # day — restarting more often than that meant it never ran at all
+            # (HP-1462-01). The callback is unregistered with the entry, so
+            # closing over its runtime data matches the lifecycle exactly.
+            async with data.write_lock:
+                stored = await data.config_store.async_load() or {}
+                cfg = stored.get("config") or {}
+
+                def _collect() -> int:
+                    n = sweep_upload_temps(files_dir)
+                    # same config on both sides: nothing is superseded, so this
+                    # only ever collects what the shared rules call abandoned
+                    n += collect_attachments(files_dir, cfg, cfg)
+                    n += collect_plans(plans_dir, cfg, cfg)
+                    return n
+
+                n = await hass.async_add_executor_job(_collect)
+            if n:
+                _LOGGER.info("House Plan: removed %s unreferenced file(s)", n)
+        except Exception:  # noqa: BLE001 — housekeeping must never fail a setup
+            _LOGGER.exception("House Plan: sweeping unreferenced files failed")
+
+    data.sweep = _sweep
+    await _sweep()
+    entry.async_on_unload(
+        async_track_time_interval(hass, _sweep, timedelta(hours=24))
+    )
+    return True
+
+
+async def async_unload_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) -> bool:
+    """Unload the entry.
+
+    WS commands and the HTTP view are global (async_setup) and stay registered —
+    their handlers resolve runtime data per call and answer `not_ready` while no
+    entry is loaded. Static paths cannot be unregistered by design.
+    """
+    return True
+
+
+async def async_remove_entry(hass: HomeAssistant, entry) -> None:
+    """Clean up on integration removal: drop our Lovelace resource entry."""
+    try:
+        resources = _lovelace_resources(hass)
+        if resources is None or not hasattr(resources, "async_delete_item"):
+            return
+        for item in list(resources.async_items()):
+            if str(item.get("url", "")).split("?", 1)[0] == FRONTEND_URL:
+                await resources.async_delete_item(item["id"])
+                _LOGGER.debug("House Plan Lovelace resource removed: %s", item.get("url"))
+    except Exception as err:  # noqa: BLE001 — best-effort cleanup
+        _LOGGER.debug("Could not remove the Lovelace resource on uninstall: %s", err)
+
+
+def _lovelace_resources(hass: HomeAssistant):
+    lovelace = hass.data.get("lovelace")
+    resources = getattr(lovelace, "resources", None)
+    if resources is None and isinstance(lovelace, dict):
+        resources = lovelace.get("resources")
+    return resources
+
+
+async def _register_lovelace_resource(hass: HomeAssistant, module_url: str) -> bool:
+    """Register (or update) the card in the Lovelace resource registry.
+
+    Returns True on success. Idempotent: if a resource with our path exists —
+    update the URL on version change; otherwise create it. Any exception → False
+    (fall back to extra_module_url).
+    """
+    try:
+        resources = _lovelace_resources(hass)
+        if resources is None:
+            return False
+        # the resource registry must be loaded
+        if hasattr(resources, "loaded") and not resources.loaded:
+            await resources.async_load()
+            resources.loaded = True
+        elif hasattr(resources, "async_get_info"):
+            await resources.async_get_info()
+        # only storage mode allows creating items
+        if not hasattr(resources, "async_create_item"):
+            return False
+        base = FRONTEND_URL
+        existing = [
+            item for item in resources.async_items()
+            if str(item.get("url", "")).split("?", 1)[0] == base
+        ]
+        if existing:
+            item = existing[0]
+            if item.get("url") != module_url and hasattr(resources, "async_update_item"):
+                await resources.async_update_item(item["id"], {"url": module_url})
+            return True
+        await resources.async_create_item({"res_type": "module", "url": module_url})
+        _LOGGER.debug("House Plan card registered as a Lovelace resource: %s", module_url)
+        return True
+    except Exception as err:  # noqa: BLE001 — any failure → fallback
+        _LOGGER.debug("Could not register the Lovelace resource (%s), falling back to extra_module_url", err)
+        return False

custom_components/houseplan/auth.py

@@ -0,0 +1,28 @@
+"""Single source of truth for the write-authorization policy.
+
+The WS and HTTP paths used to duplicate this decision and drifted apart: the
+WS copy was fixed to fail closed while the upload view still failed OPEN when
+the config entry was unavailable (audit follow-up B2, 2026-07-27). One helper,
+one behaviour.
+"""
+from __future__ import annotations
+
+from homeassistant.core import HomeAssistant
+
+from .const import CONF_ADMIN_ONLY
+from .store import get_entry
+
+
+def may_write(hass: HomeAssistant, user) -> bool:
+    """True when `user` may modify House Plan data.
+
+    Fails CLOSED: when the entry cannot be read — during a reload, or while the
+    integration is disabled — the policy is unknown, and "unknown" is not the
+    same as "permissive": only admins are allowed through.
+    """
+    is_admin = bool(getattr(user, "is_admin", False))
+    entry = get_entry(hass)
+    if entry is None:
+        return is_admin
+    admin_only = bool(entry.options.get(CONF_ADMIN_ONLY, False))
+    return is_admin if admin_only else True

custom_components/houseplan/config_flow.py

@@ -0,0 +1,39 @@
+"""Config flow: a single entry with no parameters."""
+from __future__ import annotations
+
+import voluptuous as vol
+
+from homeassistant import config_entries
+
+from .const import CONF_ADMIN_ONLY, DOMAIN
+
+
+class HouseplanConfigFlow(config_entries.ConfigFlow, domain=DOMAIN):
+    """One-step setup."""
+
+    VERSION = 1
+
+    async def async_step_user(self, user_input=None):
+        if user_input is not None:
+            return self.async_create_entry(title="House Plan", data={}, options=user_input)
+        return self.async_show_form(
+            step_id="user",
+            data_schema=vol.Schema({vol.Optional(CONF_ADMIN_ONLY, default=False): bool}),
+        )
+
+    @staticmethod
+    def async_get_options_flow(config_entry):
+        return HouseplanOptionsFlow()
+
+
+class HouseplanOptionsFlow(config_entries.OptionsFlow):
+    """Option: layout editing by administrators only."""
+
+    async def async_step_init(self, user_input=None):
+        if user_input is not None:
+            return self.async_create_entry(title="", data=user_input)
+        current = self.config_entry.options.get(CONF_ADMIN_ONLY, False)
+        return self.async_show_form(
+            step_id="init",
+            data_schema=vol.Schema({vol.Optional(CONF_ADMIN_ONLY, default=current): bool}),
+        )

custom_components/houseplan/const.py

@@ -0,0 +1,40 @@
+"""Constants of the House Plan integration."""
+
+DOMAIN = "houseplan"
+STORAGE_KEY = f"{DOMAIN}.layout"
+STORAGE_CONFIG_KEY = f"{DOMAIN}.config"
+STORAGE_VERSION = 1
+STORAGE_MINOR_VERSION = 1
+FRONTEND_URL = "/houseplan_files/houseplan-card.js"
+PLANS_URL = "/houseplan_files/plans"
+PLANS_DIR = "houseplan/plans"  # relative to the HA configuration directory
+FILES_URL = "/houseplan_files/files"
+# authenticated read path (audit B1): /api/houseplan/content/<plans|files>/<sub>/<name>
+CONTENT_URL = "/api/houseplan/content"
+
+# How many paths one houseplan/content/sign call may carry. The card batches to
+# the same number; a client that sends more used to get a partial answer with no
+# way to tell which paths were dropped (review R2-2).
+MAX_SIGN_PATHS = 200
+
+# An uploaded plan that no accepted configuration references is collected only
+# once it is this old. Age is a race guard, not a policy: a plan uploaded
+# seconds ago may belong to another client's transaction that has not written
+# its configuration yet (review R3-1).
+PLAN_ORPHAN_TTL_S = 3600
+
+# Kept for compatibility with anything reading it; the collectors no longer use
+# a long grace at all. Every attempt to age files out ended badly — first by
+# deleting detached plans, then by racing the save that was about to reference a
+# retried upload. What is left is deliberately simple: files go when the user's
+# action says so, plus staging folders after PLAN_ORPHAN_TTL_S.
+SCHEDULED_GRACE_S = 30 * 24 * 3600
+FILES_DIR = "houseplan/files"
+CONF_ADMIN_ONLY = "admin_only"
+VERSION = "1.47.0"
+
+DEFAULT_CONFIG: dict = {
+    "spaces": [],
+    "markers": [],
+    "settings": {},
+}

custom_components/houseplan/diagnostics.py

@@ -0,0 +1,40 @@
+"""Diagnostics for House Plan (Settings → ... → Download diagnostics)."""
+from __future__ import annotations
+
+from typing import Any
+
+from homeassistant.components.diagnostics import async_redact_data
+from homeassistant.core import HomeAssistant
+
+from .store import HouseplanConfigEntry
+
+# Marker metadata may contain personal notes, external links and manual filenames.
+TO_REDACT = {"link", "description", "pdfs", "name"}
+
+
+async def async_get_config_entry_diagnostics(
+    hass: HomeAssistant, entry: HouseplanConfigEntry
+) -> dict[str, Any]:
+    """Return a redacted dump of the stores."""
+    data = entry.runtime_data
+    cfg_raw = await data.config_store.async_load() or {}
+    layout_raw = await data.store.async_load() or {}
+    config = cfg_raw.get("config", {})
+    layout = layout_raw.get("layout", {})
+    return {
+        "options": dict(entry.options),
+        "rev": cfg_raw.get("rev", 0),
+        "spaces": [
+            {
+                "id": s.get("id"),
+                "aspect": s.get("aspect"),
+                "has_plan": bool(s.get("plan_url")),
+                "rooms": len(s.get("rooms", [])),
+                "rooms_with_area": sum(1 for r in s.get("rooms", []) if r.get("area")),
+            }
+            for s in config.get("spaces", [])
+        ],
+        "markers": async_redact_data(config.get("markers", []), TO_REDACT),
+        "settings": config.get("settings", {}),
+        "layout_entries": len(layout),
+    }

custom_components/houseplan/frontend/houseplan-assets.json

@@ -1,438 +0,0 @@
-{
-  "schema": 1,
-  "fingerprint": "a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e",
-  "entry": "houseplan-card.js",
-  "panelEntry": "houseplan-panel.js",
-  "initialViewFiles": [
-    "houseplan-assets/houseplan-card-BYwTiVnu.js",
-    "houseplan-card.js"
-  ],
-  "initialViewGzipBytes": 300323,
-  "initialPanelFiles": [
-    "houseplan-assets/houseplan-card-BYwTiVnu.js",
-    "houseplan-panel.js"
-  ],
-  "initialPanelGzipBytes": 301845,
-  "initialPanelOnlyFiles": [
-    "houseplan-panel.js"
-  ],
-  "initialPanelOnlyGzipBytes": 2325,
-  "lazyFiles": [
-    "houseplan-assets/backdrop-pick-WDIF6iao.js",
-    "houseplan-assets/de-E17v3gXt.js",
-    "houseplan-assets/editor-CbeYCXUv.js",
-    "houseplan-assets/form-kit.styles-v5DlO12L.js",
-    "houseplan-assets/fr-CpDKyK4Z.js",
-    "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-    "houseplan-assets/houseplan-editor-runtime-DZnn4pgB.js",
-    "houseplan-assets/houseplan-onboarding-runtime-B6AiP0fG.js",
-    "houseplan-assets/hp-zigbee-topology-overlay-8lnIEMWk.js",
-    "houseplan-assets/iso-scene-render-BxXtKC5L.js",
-    "houseplan-assets/live-interaction-runtime-CJ95X8vv.js",
-    "houseplan-assets/namespace-language-zIuNvgGV.js",
-    "houseplan-assets/pdf-export-DL7VmwpB.js",
-    "houseplan-assets/summary-panel-runtime-loaded-B0Dq0vzN.js",
-    "houseplan-assets/zigbee-topology-DOAnbvlu.js",
-    "houseplan-assets/zigbee-topology-runtime-CKlry6R8.js"
-  ],
-  "lazyGzipBytes": 456389,
-  "lazyEditorFiles": [
-    "houseplan-assets/backdrop-pick-WDIF6iao.js",
-    "houseplan-assets/editor-CbeYCXUv.js",
-    "houseplan-assets/form-kit.styles-v5DlO12L.js",
-    "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-    "houseplan-assets/houseplan-editor-runtime-DZnn4pgB.js",
-    "houseplan-assets/namespace-language-zIuNvgGV.js",
-    "houseplan-assets/zigbee-topology-DOAnbvlu.js"
-  ],
-  "lazyEditorGzipBytes": 238192,
-  "lazyOnboardingFiles": [
-    "houseplan-assets/backdrop-pick-WDIF6iao.js",
-    "houseplan-assets/form-kit.styles-v5DlO12L.js",
-    "houseplan-assets/houseplan-onboarding-runtime-B6AiP0fG.js",
-    "houseplan-assets/namespace-language-zIuNvgGV.js"
-  ],
-  "lazyOnboardingGzipBytes": 27950,
-  "lazyLocaleFiles": [
-    "houseplan-assets/de-E17v3gXt.js",
-    "houseplan-assets/fr-CpDKyK4Z.js"
-  ],
-  "lazyLocaleGzipBytes": 56330,
-  "lazyIsometricFiles": [
-    "houseplan-assets/iso-scene-render-BxXtKC5L.js"
-  ],
-  "lazyIsometricGzipBytes": 17885,
-  "lazyFurnitureArtFiles": [
-    "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js"
-  ],
-  "lazyFurnitureArtGzipBytes": 16940,
-  "lazyPdfFiles": [
-    "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-    "houseplan-assets/pdf-export-DL7VmwpB.js"
-  ],
-  "lazyPdfGzipBytes": 126938,
-  "lazyNamespaceLocaleFiles": [
-    "houseplan-assets/settings-de-DfJ7EKF9.js",
-    "houseplan-assets/settings-fr-Bl79E-6s.js",
-    "houseplan-assets/settings-ru-CkNFmChi.js",
-    "houseplan-assets/support-de-DZoi-fxk.js",
-    "houseplan-assets/support-fr-Daosy89Q.js",
-    "houseplan-assets/support-ru-e8-BrqtH.js",
-    "houseplan-assets/topology-de-Cs36ouVE.js",
-    "houseplan-assets/topology-fr-B8yoJGvc.js",
-    "houseplan-assets/topology-ru-BRKShmrQ.js"
-  ],
-  "lazyNamespaceLocaleGzipBytes": 21057,
-  "files": [
-    {
-      "path": "houseplan-assets/backdrop-pick-WDIF6iao.js",
-      "sha256": "5f6dcedf274594075d8acd31295d8c23f6d1408c890c086825db6bcbaa6c9b21",
-      "rawBytes": 54017,
-      "gzipBytes": 17576,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/form-kit.styles-v5DlO12L.js",
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/namespace-language-zIuNvgGV.js"
-      ],
-      "dynamicImports": [
-        "houseplan-assets/settings-de-DfJ7EKF9.js",
-        "houseplan-assets/settings-fr-Bl79E-6s.js",
-        "houseplan-assets/settings-ru-CkNFmChi.js"
-      ]
-    },
-    {
-      "path": "houseplan-assets/de-E17v3gXt.js",
-      "sha256": "ed10d6c5e7a82b275c9422be67c2213219a75dba9aab0ddb3e98813249cbd1d0",
-      "rawBytes": 94196,
-      "gzipBytes": 28393,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/editor-CbeYCXUv.js",
-      "sha256": "75887638c4d76040651a3cf52c56de10dc19e0cbc7583ee169d9b20cc5987788",
-      "rawBytes": 3833,
-      "gzipBytes": 1584,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/form-kit.styles-v5DlO12L.js",
-      "sha256": "cdab9e5e612be9b98c49193a2a6287080c13f62aaefa9a28b69bac94dd934012",
-      "rawBytes": 25600,
-      "gzipBytes": 5056,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/fr-CpDKyK4Z.js",
-      "sha256": "ee9fe5934eea69e549ff48d2e3fdabd7c20e0d9906a6f4623314f6eea48bf269",
-      "rawBytes": 96627,
-      "gzipBytes": 27937,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-      "sha256": "f668d3c0a47a53e096f26728187b1666fbb6b421c1baa2ff1a649fa1ba5340d5",
-      "rawBytes": 52035,
-      "gzipBytes": 16940,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/houseplan-card-BYwTiVnu.js",
-      "sha256": "055b6f8ba3a472be163a15ef6e2348727b5b03e3660b9362f3aed21d7be90426",
-      "rawBytes": 1059790,
-      "gzipBytes": 299520,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": [
-        "houseplan-assets/de-E17v3gXt.js",
-        "houseplan-assets/editor-CbeYCXUv.js",
-        "houseplan-assets/fr-CpDKyK4Z.js",
-        "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-        "houseplan-assets/houseplan-editor-runtime-DZnn4pgB.js",
-        "houseplan-assets/houseplan-onboarding-runtime-B6AiP0fG.js",
-        "houseplan-assets/hp-zigbee-topology-overlay-8lnIEMWk.js",
-        "houseplan-assets/iso-scene-render-BxXtKC5L.js",
-        "houseplan-assets/live-interaction-runtime-CJ95X8vv.js",
-        "houseplan-assets/pdf-export-DL7VmwpB.js",
-        "houseplan-assets/summary-panel-runtime-loaded-B0Dq0vzN.js"
-      ]
-    },
-    {
-      "path": "houseplan-assets/houseplan-editor-runtime-DZnn4pgB.js",
-      "sha256": "f25cbcb0453279e3ac64eda67df52af100d96c54bb93cb657bc08c355e0484ed",
-      "rawBytes": 688848,
-      "gzipBytes": 192327,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/backdrop-pick-WDIF6iao.js",
-        "houseplan-assets/form-kit.styles-v5DlO12L.js",
-        "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/namespace-language-zIuNvgGV.js",
-        "houseplan-assets/zigbee-topology-DOAnbvlu.js"
-      ],
-      "dynamicImports": [
-        "houseplan-assets/support-de-DZoi-fxk.js",
-        "houseplan-assets/support-fr-Daosy89Q.js",
-        "houseplan-assets/support-ru-e8-BrqtH.js",
-        "houseplan-assets/zigbee-topology-runtime-CKlry6R8.js"
-      ]
-    },
-    {
-      "path": "houseplan-assets/houseplan-onboarding-runtime-B6AiP0fG.js",
-      "sha256": "4ea3584c8b2bfc86f96c587549ddce49eaf0b918923df2df8e98c9c0a548f835",
-      "rawBytes": 15886,
-      "gzipBytes": 4908,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/backdrop-pick-WDIF6iao.js",
-        "houseplan-assets/form-kit.styles-v5DlO12L.js",
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/namespace-language-zIuNvgGV.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/hp-zigbee-topology-overlay-8lnIEMWk.js",
-      "sha256": "2a0f9af108b8a39889f90d7119d8e7789716c9960ea8e28af38ada07cdc91a8c",
-      "rawBytes": 10958,
-      "gzipBytes": 3765,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/namespace-language-zIuNvgGV.js",
-        "houseplan-assets/zigbee-topology-DOAnbvlu.js",
-        "houseplan-assets/zigbee-topology-runtime-CKlry6R8.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/iso-scene-render-BxXtKC5L.js",
-      "sha256": "4150eb9120fdaafa745761242ff3285056ceaccd7b016a16364574b90e3e2cfe",
-      "rawBytes": 52970,
-      "gzipBytes": 17885,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/live-interaction-runtime-CJ95X8vv.js",
-      "sha256": "66e70baa00f4c9470ac9a37a229652cf5c5585caa2364de4d467a1c2ebe24358",
-      "rawBytes": 8370,
-      "gzipBytes": 3280,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/namespace-language-zIuNvgGV.js",
-      "sha256": "244bce2d5211106846215be6a9d3dacda4c910d06020144f9ffd5e432c5e8c00",
-      "rawBytes": 675,
-      "gzipBytes": 410,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/pdf-export-DL7VmwpB.js",
-      "sha256": "548dced1a8a54f860dbe57e61019d50f058d3ca13abb738d750a3c107c88de8b",
-      "rawBytes": 236714,
-      "gzipBytes": 109998,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/furniture-plan-art.generated-B9UMtPsh.js",
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/settings-de-DfJ7EKF9.js",
-      "sha256": "0580b9f6191edb664c21dee21e5263489eaf22876bcad67ef12e440abc03e28a",
-      "rawBytes": 7378,
-      "gzipBytes": 2879,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/settings-fr-Bl79E-6s.js",
-      "sha256": "f1bde9db7fe884aabd25130f783a84d8fe27bc9553923c17bcb9b82ee3976475",
-      "rawBytes": 7620,
-      "gzipBytes": 2842,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/settings-ru-CkNFmChi.js",
-      "sha256": "94f96c4a15a3a82ca8be3066629734379dd14eb2ff9e8f6acf369da2378676cb",
-      "rawBytes": 10304,
-      "gzipBytes": 3325,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/summary-panel-editor-C_vpFucN.js",
-      "sha256": "d45dbdfa17a1da9f45bfbca6d6c3cc98849fd5ebcc06c8f72fd6310b04b93aad",
-      "rawBytes": 14862,
-      "gzipBytes": 3425,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/form-kit.styles-v5DlO12L.js",
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/summary-panel-runtime-loaded-B0Dq0vzN.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/summary-panel-metrics-D47J-OjO.js",
-      "sha256": "909d2195fcfca30c2f1279e07e2d7506d470c3daec6fe864c97f7ecc4101e33d",
-      "rawBytes": 2701,
-      "gzipBytes": 1344,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/summary-panel-runtime-loaded-B0Dq0vzN.js",
-      "sha256": "e44860a1af9ec7ffc7ac289c8c76ed1d0dcf0177bd91bbfe1981fdd0d4a62c46",
-      "rawBytes": 72959,
-      "gzipBytes": 20242,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/form-kit.styles-v5DlO12L.js",
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": [
-        "houseplan-assets/summary-panel-editor-C_vpFucN.js",
-        "houseplan-assets/summary-panel-metrics-D47J-OjO.js"
-      ]
-    },
-    {
-      "path": "houseplan-assets/support-de-DZoi-fxk.js",
-      "sha256": "f01d2d00a169519f5f402e99e9c85c9f21a23aeee2a9605d4444910f3250d6de",
-      "rawBytes": 6167,
-      "gzipBytes": 2396,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/support-fr-Daosy89Q.js",
-      "sha256": "e503a1b4e1b1ed31d8fa09bfe0cdc069a82c1d1627d40407472b336fbc98ccf5",
-      "rawBytes": 6333,
-      "gzipBytes": 2432,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/support-ru-e8-BrqtH.js",
-      "sha256": "76742313c4b510163c380f8fd9c7fcaf1cc7f8bde6a41bcb0da48621a7c3a3b3",
-      "rawBytes": 8376,
-      "gzipBytes": 2876,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/topology-de-Cs36ouVE.js",
-      "sha256": "7c808f1139bb1c232627bfe884a579177ec653d16147d6b96066851893b312a4",
-      "rawBytes": 2698,
-      "gzipBytes": 1337,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/topology-fr-B8yoJGvc.js",
-      "sha256": "6ee1530fd0bd7a8c476c79b83404c7d8a5b98cd0b86ee8a73048be75a70cc2c4",
-      "rawBytes": 2718,
-      "gzipBytes": 1354,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/topology-ru-BRKShmrQ.js",
-      "sha256": "7fc89542fa860318d459ce1467a5a8931f3214a9d17f57c177ba01f2cfbbd3e8",
-      "rawBytes": 3669,
-      "gzipBytes": 1616,
-      "isEntry": false,
-      "imports": [],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-assets/zigbee-topology-DOAnbvlu.js",
-      "sha256": "313f71677ba0739d9c978185c2136e73e8037b770eb3f9ef8561f692d654406f",
-      "rawBytes": 10958,
-      "gzipBytes": 4299,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/namespace-language-zIuNvgGV.js"
-      ],
-      "dynamicImports": [
-        "houseplan-assets/topology-de-Cs36ouVE.js",
-        "houseplan-assets/topology-fr-B8yoJGvc.js",
-        "houseplan-assets/topology-ru-BRKShmrQ.js"
-      ]
-    },
-    {
-      "path": "houseplan-assets/zigbee-topology-runtime-CKlry6R8.js",
-      "sha256": "39e4a250de0e67e80d8afc02c39c1a79e42d4b3e113107bb3817f4fa90cab1e2",
-      "rawBytes": 3983,
-      "gzipBytes": 1789,
-      "isEntry": false,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js",
-        "houseplan-assets/namespace-language-zIuNvgGV.js",
-        "houseplan-assets/zigbee-topology-DOAnbvlu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-card.js",
-      "sha256": "d4b480db1327152db7b1459c45692ea6b72fb7ac3bccb525bc06adfe1aab3b8d",
-      "rawBytes": 1205,
-      "gzipBytes": 803,
-      "isEntry": true,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    },
-    {
-      "path": "houseplan-panel.js",
-      "sha256": "5aaa677a9c85f4df0f176be31a91ebb5022f5ce129774919269bb0409c310233",
-      "rawBytes": 6165,
-      "gzipBytes": 2325,
-      "isEntry": true,
-      "imports": [
-        "houseplan-assets/houseplan-card-BYwTiVnu.js"
-      ],
-      "dynamicImports": []
-    }
-  ]
-}

custom_components/houseplan/frontend/houseplan-assets/editor-CbeYCXUv.js

@@ -1,14 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";import{aD as e,l as o,aG as t,ez as s,A as a,eA as i,eB as l,eC as n,E as r,c}from"./houseplan-card-BYwTiVnu.js";class f extends e{constructor(){super(...arguments),this._spaces=null,this._spacesLoading=!1,this._spacesAuthoritative=!1}setConfig(e){this._config=e}async _loadSpaces(){if(!this._spaces&&!this._spacesLoading&&this.hass){this._spacesLoading=!0;try{const e=await this.hass.callWS({type:"houseplan/config/get"});this._spaces=(e?.config?.spaces||[]).map(e=>({value:e.id,label:e.title||e.id})),this._spacesAuthoritative=!0}catch{this._spaces=[],this._spacesAuthoritative=!1}finally{this._spacesLoading=!1}}}get _lang(){return o(this.hass,this._config?.language)}get _floorToken(){const e=this._config?.floor;return"number"==typeof e?`__houseplan_yaml_floor_index__:${String(e)}`:null}get _formData(){const e={...this._config},o=this._floorToken;return o?e.floor=o:Object.prototype.hasOwnProperty.call(e,"floor")||(e.floor=""),e}get _schema(){const e=this._spaces||[],o=this._lang,a=[{value:"",label:t(o,"editor.floor_none")}],i=this._floorToken;i&&a.push({value:i,label:t(o,"editor.floor_index",{index:String(this._config?.floor)})});const l="string"==typeof this._config?.floor?this._config.floor:"";l&&!e.some(e=>e.value===l)&&a.push({value:l,label:l}),a.push(...e);const n="string"==typeof this._config?.default_floor?this._config.default_floor:"",r=[...e];return n&&!e.some(e=>e.value===n)&&r.unshift({value:n,label:n}),[{name:"title",selector:{text:{}}},{name:"floor",selector:{select:{mode:"dropdown",options:a}}},e.length?{name:"default_floor",selector:{select:{mode:"dropdown",options:r}}}:{name:"default_floor",selector:{text:{}}},{name:"language",selector:{select:{mode:"dropdown",options:s(t(o,"editor.lang_auto"),this._config?.language)}}},{name:"icon_size",selector:{number:{min:1,max:6,step:.1,mode:"box"}}},{name:"show_temperature",selector:{boolean:{}}},{name:"live_states",selector:{boolean:{}}},{name:"show_signal",selector:{boolean:{}}},{name:"kiosk",selector:{boolean:{}}},{name:"cycle",selector:{number:{min:0,max:3600,step:5,mode:"box"}}}]}render(){if(!this.hass||!this._config)return a;const e=i(this,l,o(this.hass,this._config.language));if("cold"===e)return n();if("warm"===e)return r;this._loadSpaces();const s=this._lang,f={title:t(s,"editor.title"),floor:t(s,"editor.floor"),default_floor:t(s,"editor.default_floor"),language:t(s,"editor.language"),icon_size:t(s,"editor.icon_size"),show_temperature:t(s,"editor.show_temperature"),live_states:t(s,"editor.live_states"),show_signal:t(s,"editor.show_signal"),kiosk:t(s,"editor.kiosk"),cycle:t(s,"editor.cycle")},h=this._schema,_=function(e,o,t){if(!t||null===o)return null;const s="string"==typeof e?.default_floor?e.default_floor:"";return!s||o.some(e=>e.value===s)?null:s}(this._config,this._spaces,this._spacesAuthoritative),d=e=>c`<ha-form
-        .hass=${this.hass}
-        .data=${this._formData}
-        .schema=${e}
-        .computeLabel=${e=>f[e.name]||e.name}
-        @value-changed=${this._valueChanged}
-      ></ha-form>`;return c`
-      ${d(h.slice(0,3))}
-      ${_?c`<div class="default-floor-error" role="alert"
-        style="color:var(--error-color,#db4437);margin:-4px 0 12px;overflow-wrap:anywhere">
-        ${t(s,"editor.default_floor_missing",{id:_})}
-      </div>`:a}
-      ${d(h.slice(3))}
-    `}_valueChanged(e){const o={...this._config,...e.detail.value};""===o.floor?delete o.floor:o.floor===this._floorToken&&(o.floor=this._config?.floor);const t=new Event("config-changed",{bubbles:!0,composed:!0});t.detail={config:o},this.dispatchEvent(t)}}f.properties={hass:{attribute:!1},_config:{state:!0},_spaces:{state:!0}},customElements.get("houseplan-card-editor")||customElements.define("houseplan-card-editor",f);

custom_components/houseplan/frontend/houseplan-assets/namespace-language-zIuNvgGV.js

@@ -1 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";import{eE as e,eF as n,eB as a}from"./houseplan-card-BYwTiVnu.js";function c(a,c){return new e([{code:"en",dictionary:a},{code:"ru",loadDictionary:c.ru},{code:"de",loadDictionary:c.de},{code:"fr",loadDictionary:c.fr}],"a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e",console.warn,n)}function o(e){return function(e,n){return{state:a=>{const c=e.state(a);return"pending"!==c&&n.some(e=>"pending"===e.state(a))?"pending":c},dictionary:n=>e.dictionary(n),ensure:a=>Promise.all([e,...n].map(e=>e.ensure(a))).then(()=>{})}}(a,e)}export{c as n,o as s};

custom_components/houseplan/frontend/houseplan-assets/summary-panel-editor-C_vpFucN.js

@@ -1,203 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";import{c as a,A as e}from"./houseplan-card-BYwTiVnu.js";import{s,n as t,a as l,m as r,b as o,c as i,d as u}from"./summary-panel-runtime-loaded-B0Dq0vzN.js";import"./form-kit.styles-v5DlO12L.js";const m=m=>{const{host:c,dialog:d,problems:n,t:b}=m,y=n.find(a=>"error"===a.kind),$=d.localShow!==d.baseLocalShow||!d.localOnly&&!s(t(d.draft),d.base),p=$&&!d.busy&&!y,v=a=>n.find(e=>e.path===a),h=a=>a?b(`summary.problem.${a.code}`):"",k=()=>m.close(),g=a`<label class="summary-switch" for="summary-local-show">
-    <span class="summary-switch-caption"><strong>${b("summary.show_local")}</strong>
-      <small id="summary-local-show-hint">${b("summary.show_local_hint")}</small></span>
-    <input id="summary-local-show" data-summary-local-show type="checkbox"
-      .checked=${d.localShow}
-      ?disabled=${d.busy} aria-label=${b("summary.show_local")}
-      aria-describedby="summary-local-show-hint"
-      @change=${a=>m.setDialog({...d,localShow:a.target.checked})} /></label>`;return a`<hp-dialog .hass=${c.hass} data-kind="summary"
-      .title=${b("summary.settings")} wide flex-content
-      dismiss-on-scrim aria-busy=${String(d.busy)}
-      @hp-close=${k}>
-    <div class="body summary-editor" @click=${()=>m.closeSource()}>
-      ${d.localOnly?a`<p class="summary-local-hint">${b(d.localOnlyHint)}</p>`:e}
-      <section class="summary-general" aria-labelledby="summary-general-title">
-        <h3 id="summary-general-title">${b("summary.general_settings")}</h3>
-        <div class="summary-general-grid">
-        ${d.localOnly?e:a`<div class="summary-field">
-        <label for="summary-panel-title">${b("summary.panel_title")}</label>
-        <input id="summary-panel-title" type="text" .value=${d.draft.title}
-          ?disabled=${d.busy}
-          data-summary-error=${String(d.attempted&&"title"===y?.path)}
-          aria-invalid=${"error"===v("title")?.kind?"true":"false"}
-          @input=${a=>m.mutate(e=>{e.title=a.target.value})} />
-        ${v("title")?a`<div class="summary-problem error">${h(v("title"))}</div>`:e}
-        </div>`}
-        ${g}
-        ${d.localOnly?e:a`<label class="summary-switch" for="summary-mobile-show">
-          <span class="summary-switch-caption"><strong>${b("summary.show_mobile")}</strong>
-            <small id="summary-mobile-show-hint">${b("summary.show_mobile_hint")}</small></span>
-          <input id="summary-mobile-show" data-summary-mobile-show type="checkbox"
-          .checked=${d.draft.show_on_mobile} ?disabled=${!d.localShow||d.busy}
-          aria-label=${b("summary.show_mobile")} aria-describedby="summary-mobile-show-hint"
-          @change=${a=>m.mutate(e=>{e.show_on_mobile=a.target.checked})} /></label>`}
-        </div>
-        ${m.storageUnavailable?a`<div class="summary-problem warning">${b("summary.storage_unavailable")}</div>`:e}
-      </section>
-      ${d.localOnly?e:a`
-        <section class="summary-blocks-card" aria-labelledby="summary-blocks-title">
-        <header class="summary-blocks-heading">
-          <div><h3 id="summary-blocks-title">${b("summary.blocks")}</h3>
-            <p>${b("summary.blocks_hint")}</p></div>
-          <span class="summary-block-count">${b("summary.block_count").replace("{count}",String(d.draft.blocks.length)).replace("{limit}","10")}</span>
-        </header>
-        <div class="summary-editor-blocks">
-          ${d.draft.blocks.map((s,t)=>{const u=`blocks.${t}`,n=v(`${u}.scope`);return a`<article class="summary-editor-block"
-                @dragover=${a=>a.preventDefault()}
-                @drop=${a=>m.drop(a,`block:${t}`)}>
-              <div class="summary-block-head">
-                <span class="summary-drag" draggable=${String(!d.busy)} title=${b("summary.drag")}
-                  @dragstart=${a=>m.dragStart(a,`block:${t}`)}>${l("grip")}</span>
-                <div class="summary-order">
-                <button class="summary-icon-button" type="button" title=${b("summary.up")}
-                  aria-label=${b("summary.up")} ?disabled=${0===t||d.busy}
-                  @click=${()=>m.mutate(a=>{a.blocks=r(a.blocks,t,t-1)})}>${l("up")}</button>
-                <button class="summary-icon-button" type="button" title=${b("summary.down")}
-                  aria-label=${b("summary.down")}
-                  ?disabled=${t===d.draft.blocks.length-1||d.busy}
-                  @click=${()=>m.mutate(a=>{a.blocks=r(a.blocks,t,t+1)})}>${l("down")}</button>
-                </div>
-                <input class="summary-block-title" type="text" .value=${s.title}
-                  placeholder=${b("summary.block_title")} aria-label=${b("summary.block_title")}
-                  ?disabled=${d.busy}
-                  data-summary-error=${String(d.attempted&&y?.path===`${u}.title`)}
-                  aria-invalid=${"error"===v(`${u}.title`)?.kind?"true":"false"}
-                  @input=${a=>m.mutate(e=>{e.blocks[t].title=a.target.value})} />
-                <button class="summary-icon-button summary-visibility" type="button"
-                  ?disabled=${d.busy} aria-pressed=${String(s.visible)}
-                  title=${b(s.visible?"summary.hide_block":"summary.show_block")}
-                  aria-label=${b(s.visible?"summary.hide_block":"summary.show_block")}
-                  @click=${()=>m.mutate(a=>{a.blocks[t].visible=!a.blocks[t].visible})}>${l(s.visible?"eye":"eyeOff")}</button>
-              ${v(`${u}.title`)?a`<div class="summary-problem error summary-block-title-error">${h(v(`${u}.title`))}</div>`:e}
-              <div class="summary-scope">
-                <select .value=${s.scope.type} ?disabled=${d.busy}
-                  aria-label=${b("summary.scope")}
-                  @change=${a=>m.mutate(e=>{e.blocks[t].scope="space"===a.target.value?{type:"space",space_id:c._space}:{type:"all"}})}>
-                  <option value="all" ?selected=${"all"===s.scope.type}>${b("summary.scope_all")}</option>
-                  <option value="space" ?selected=${"space"===s.scope.type}>${b("summary.scope_space")}</option>
-                </select>
-                ${"space"===s.scope.type?a`<select .value=${s.scope.space_id}
-                  ?disabled=${d.busy} aria-label=${b("summary.scope_space")}
-                  data-summary-error=${String(d.attempted&&y?.path===`${u}.scope`)}
-                  aria-invalid=${"error"===n?.kind?"true":"false"}
-                  @change=${a=>m.mutate(e=>{const s=e.blocks[t].scope;"space"===s.type&&(s.space_id=a.target.value)})}>
-                ${c._model.some(a=>a.id===s.scope.space_id)?e:a`<option value=${s.scope.space_id} selected>${s.scope.space_id}</option>`}
-                ${c._model.map(e=>a`<option value=${e.id}
-                    ?selected=${e.id===s.scope.space_id}>${e.title}</option>`)}
-                </select>`:e}
-              </div>
-              ${n?a`<div class="summary-problem summary-scope-problem ${n.kind}">${h(n)}</div>`:e}
-              </div>
-              <div class="summary-block-body">
-              <div class="summary-editor-values">
-                ${s.values.map((i,c)=>{const n=`${u}.values.${c}`,$=v(`${n}.source`),p=m.sourceToken(i.source),k=d.activeSource?.blockId===s.id&&d.activeSource.valueId===i.id,g="system"===i.source.type?b(`summary.system.${i.source.key}`):i.source.entity_id?m.entityIndex.labels.get(i.source.entity_id)||i.source.entity_id:b("summary.select_source"),_="system"===i.source.type?b("summary.system_source"):i.source.entity_id,f=k?o(m.entityIndex,d.entityFilter):null,w="entity"===i.source.type&&!!i.source.entity_id&&!m.entityIndex.labels.has(i.source.entity_id),S=`${s.id}\n${i.id}`;return a`<div class="summary-editor-value"
-                      @dragover=${a=>{a.preventDefault(),a.stopPropagation()}}
-                      @drop=${a=>m.drop(a,`value:${t}:${c}`)}>
-                      <span class="summary-drag" draggable=${String(!d.busy)} title=${b("summary.drag")}
-                        @dragstart=${a=>m.dragStart(a,`value:${t}:${c}`)}>${l("grip")}</span>
-                      <div class="summary-order">
-                      <button class="summary-icon-button" type="button" title=${b("summary.up")}
-                        aria-label=${b("summary.up")} ?disabled=${0===c||d.busy}
-                        @click=${()=>m.mutate(a=>{a.blocks[t].values=r(a.blocks[t].values,c,c-1)})}>${l("up")}</button>
-                      <button class="summary-icon-button" type="button" title=${b("summary.down")}
-                        aria-label=${b("summary.down")}
-                        ?disabled=${c===s.values.length-1||d.busy}
-                        @click=${()=>m.mutate(a=>{a.blocks[t].values=r(a.blocks[t].values,c,c+1)})}>${l("down")}</button>
-                      </div>
-                      <div class="summary-value-label">
-                        <input type="text" .value=${i.label} ?disabled=${d.busy}
-                          placeholder=${b("summary.value_name")} aria-label=${b("summary.value_name")}
-                          data-summary-error=${String(d.attempted&&y?.path===`${n}.label`)}
-                          aria-invalid=${"error"===v(`${n}.label`)?.kind?"true":"false"}
-                          @input=${a=>m.mutate(e=>{e.blocks[t].values[c].label=a.target.value})} />
-                        ${v(`${n}.label`)?a`<div class="summary-problem error">${h(v(`${n}.label`))}</div>`:e}
-                      </div>
-                    <div class="summary-source-field">
-                    <button class="summary-source" type="button"
-                      ?disabled=${d.busy}
-                      data-summary-source-owner=${S}
-                      data-summary-error=${String(d.attempted&&y?.path===`${n}.source`)}
-                      aria-invalid=${"error"===$?.kind?"true":"false"}
-                      aria-haspopup="listbox" aria-expanded=${k?"true":"false"}
-                      @click=${a=>{a.stopPropagation(),k?m.closeSource():m.openSource(s.id,i.id)}}>
-                      <span class="summary-source-caption"><strong>${g}</strong>
-                        ${_?a`<small>${_}</small>`:e}</span>
-                      ${l("chevron")}
-                    </button>
-                    ${k&&f?a`<div class="summary-source-picker"
-                        @click=${a=>a.stopPropagation()}
-                        @keydown=${a=>{"Escape"===a.key&&(a.preventDefault(),a.stopPropagation(),m.closeSource(!0))}}>
-                      <label>${b("summary.search_entities")}</label>
-                      <input type="search" data-summary-picker-search
-                        ?disabled=${d.busy}
-                        aria-label=${b("summary.search_entities")} .value=${d.entityFilter}
-                        @input=${a=>m.setDialog({...d,entityFilter:a.target.value})} />
-                      <div class="summary-source-results" role="listbox"
-                          aria-label=${b("summary.select_source")}>
-                        <div class="summary-source-group">${b("summary.system_group")}</div>
-                        ${["device_count","total_area","datetime"].map(e=>a`
-                          <button type="button" role="option"
-                            ?disabled=${d.busy}
-                            aria-selected=${p===`system:${e}`?"true":"false"}
-                            @click=${()=>m.setSource(s.id,i.id,`system:${e}`)}>
-                            ${b(`summary.system.${e}`)}
-                          </button>`)}
-                        ${w?a`<div class="summary-source-group">${b("summary.current_source")}</div>
-                          <button type="button" role="option" class="broken" aria-selected="true"
-                            ?disabled=${d.busy}
-                            @click=${()=>m.setSource(s.id,i.id,p)}>
-                            ${g}
-                          </button>`:e}
-                        <div class="summary-source-group">${b("summary.entities_group")}</div>
-                        ${f.entries.map(e=>a`<button type="button" role="option"
-                            ?disabled=${d.busy}
-                            aria-selected=${p===`entity:${e.id}`?"true":"false"}
-                            @click=${()=>m.setSource(s.id,i.id,`entity:${e.id}`)}>
-                          <span>${e.label}</span><small>${e.id}</small>
-                        </button>`)}
-                        ${f.total?e:a`<div class="summary-empty">${b("summary.no_search_results")}</div>`}
-                        ${f.truncated?a`<div class="summary-refine">${b("summary.refine_search")}</div>`:e}
-                      </div>
-                    </div>`:e}
-                    ${$?a`<div class="summary-problem ${$.kind}">${h($)}</div>`:e}
-                    </div>
-                    <button class="summary-icon-button summary-value-remove" type="button"
-                      title=${b("btn.delete")} aria-label=${b("btn.delete")} ?disabled=${d.busy}
-                      @click=${()=>m.mutate(a=>{a.blocks[t].values.splice(c,1)})}>${l("close")}</button>
-                  </div>`})}
-                <button class="summary-add summary-add-value" type="button"
-                  ?disabled=${s.values.length>=20||d.busy}
-                  title=${s.values.length>=20?b("summary.limit_values"):""}
-                  @click=${()=>m.mutate(a=>{a.blocks[t].values.push(i())})}>
-                  ${l("plus")}${b("summary.add_value")}
-                </button>
-              </div>
-              <footer class="summary-block-footer">
-                <button class="summary-delete-block" type="button" ?disabled=${d.busy}
-                  @click=${()=>m.deleteBlock(t)}>${b("summary.delete_block")}</button>
-              </footer>
-              </div>
-            </article>`})}
-        </div>
-        <button class="summary-add summary-add-block" type="button"
-          ?disabled=${d.draft.blocks.length>=10||d.busy}
-          title=${d.draft.blocks.length>=10?b("summary.limit_blocks"):""}
-          @click=${()=>m.mutate(a=>{a.blocks.push(u(b))})}>
-          ${l("plus")}${b("summary.add_block")}
-        </button>
-        </section>
-        ${d.error?a`<div class="summary-problem error" role="alert">${d.error}</div>`:e}
-        ${d.conflict?a`<button class="btn ghost summary-reload" type="button"
-          ?disabled=${d.busy} @click=${()=>m.reload()}>
-          <ha-icon icon="mdi:reload"></ha-icon>${b("summary.reload_current")}
-        </button>`:e}
-      `}
-    </div>
-    <div class="row summary-editor-footer" slot="footer">
-      <button class="btn ghost" data-hp="dialog-cancel"
-        ?disabled=${d.busy} @click=${k}>${b("btn.cancel")}</button>
-      <button class="btn on" data-hp="dialog-confirm"
-        ?disabled=${d.localOnly?!$||d.busy:!p}
-        @click=${()=>m.save()}>${b("btn.save")}</button>
-    </div>
-  </hp-dialog>`};export{m as renderSummaryPanelEditor};

custom_components/houseplan/frontend/houseplan-assets/summary-panel-metrics-D47J-OjO.js

@@ -1 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";import{eH as e,N as t,b2 as n,L as i,ae as o,ac as r,c9 as s,eI as a,c8 as c,b1 as l,b0 as d,b3 as u,eJ as f,eK as m,cb as g,eL as v}from"./houseplan-card-BYwTiVnu.js";function y(e){if(!e.registry.authoritative)return null;const t=new Set,n=u(e.markers);for(const i of Object.values(e.registry.devices||{}))i?.id&&"service"!==i.entry_type&&!n.devices.has(i.id)&&i.area_id&&e.areaToSpace[i.area_id]&&t.add(i.id);for(const i of e.markers||[]){if(i.removed||"virtual"===i.binding)continue;const o=String(i.binding||"").indexOf(":");if(o<1)continue;const r=i.binding.slice(0,o),s=i.binding.slice(o+1),a="device"===r?e.registry.devices?.[s]:null,c="entity"===r?e.registry.entities?.[s]:null,l="device"===r?s:c?.device_id,d="device"===r?a?.area_id:c?.area_id||l&&e.registry.devices?.[l]?.area_id,u="string"==typeof i.room_id&&i.room_id.length>0&&null===i.area?"":i.area||d||"",f=u&&e.areaToSpace[u]||i.space||e.firstSpaceId;l&&e.registry.devices?.[l]&&e.spaceIds.has(f)&&(!n.devices.has(l)||"entity"===r&&n.liveEntities.has(s))&&t.add(l)}return t}function _(e,t){return e?.length?t?.length?v(e,t):e:t}function h(e,t){const n=l(e.rooms,t.walls,t.openCuts,[],i,t.cellCm,o,r);return{roomGeom:"ok"===n.status||"degraded-extra"===n.status?n.roomGeom:void 0,multiWallNodes:d(e.rooms,t.walls,t.openCuts,i,t.cellCm,o,r)}}function*p(l,d,u=h){try{let f=0;for(const m of d){const d=l.spaces.find(e=>String(e?.id)===m.id);if(!d)continue;const g=e(d,m),v=u(m,g);let y=null;for(const e of m.rooms){if(!e.id)continue;const a=t(e);if(!a)continue;const c=n(m.rooms,e.id,g.walls,g.openCuts,i,g.cellCm,o,r,v.roomGeom,v.multiWallNodes)||a;y=_(y,s(c,g.physicalBodies)),yield}const h=a(y||[],m.stairs);let p=h.next();for(;!p.done;)yield,p=h.next();y=p.value;const b=g.cellCm/o;f+=c(y)*b*b/1e4}return f}catch{return null}}function b(e,t,n=h){const i=p(e,t,n);let o=i.next();for(;!o.done;)o=i.next();return o.value}function S(e,t,n,i){if("system"!==e.type)return null;if("device_count"===e.key)return null===t.deviceCount?null:String(t.deviceCount);if("total_area"===e.key)return null===t.areaM2?null:g(t.areaM2,"mi"===n?.config?.unit_system?.length);try{return new Intl.DateTimeFormat(i||void 0,{dateStyle:"short",timeStyle:"short",timeZone:n?.config?.time_zone||void 0}).format(t.now)}catch{return t.now.toLocaleString()}}function C(e,t){const n=e?.states?.[t];if(!n)return null;const i=f(e,t);return i?m(i,String(n.attributes?.unit_of_measurement||"")):null}export{p as cleanFloorAreaSteps,y as representedHaDeviceIds,h as spaceWallGeometry,C as summaryEntityValue,S as summarySystemValue,b as totalCleanFloorAreaM2};

custom_components/houseplan/frontend/houseplan-assets/topology-de-Cs36ouVE.js

@@ -1 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";var e={title:"Zigbee-Verbindungen",toggle:"Zigbee-Verbindungen beim Darüberfahren über ein Gerät anzeigen",hint:"Es werden nur beobachtete direkte Nachbarn angezeigt. Beim Darüberfahren werden keine Daten abgerufen.",help:"Zeigt, mit welchen Zigbee-Geräten jedes Gerät direkt verbunden ist. Die Linienfarbe ist die Verbindungsqualität (LQI) auf derselben Skala wie der LQI-Wert des Geräts: rot bei 40 und darunter, grün bei 180 und darüber. Eine gestrichelte Linie bedeutet, dass die Qualität nicht gemeldet wurde. Ein Pfeil zeigt auf das nächste Gerät auf dem Weg zum Koordinator: ein Pfeil führt hinaus, eingehende Pfeile sind die Geräte, die über dieses Gerät routen. Eine Linie ohne Pfeil ist ein Ersatznachbar. Das ist der Routenbaum, den House Plan bildet, nicht der Weg eines Pakets in diesem Moment: eine Beschriftung am Pfeilende bedeutet, dass das Ziel nicht auf diesem Plan liegt, und ein fehlender Pfeil, dass die Route unbekannt ist. Die Daten stammen aus dem letzten Laden und veralten; Verbindungen sind nur mit der Maus sichtbar.",help_aria:"Hilfe: Zigbee-Verbindungen",admin_only:"Topologiedaten sind nur für Home-Assistant-Administratoren verfügbar.",save_first:"Speichere diese Einstellung, bevor Topologiedaten geladen werden.",zha:"ZHA",zha_read:"ZHA-Daten lesen",zha_hint:"Liest den ZHA-Topologiecache; es wird kein Funkscan gestartet.",z2m:"Zigbee2MQTT",z2m_topics:"Basistopics (eines pro Zeile)",z2m_update:"Karte aktualisieren",z2m_warning:"Ein Netzwerkscan kann 10 Sekunden bis 2 Minuten dauern und Zigbee vorübergehend verlangsamen.",status_idle:"Daten nicht geladen",status_loading:"Wird geladen…",status_ready:"Empfangen: {time}",status_stale:"Empfangen: {time} · veraltet",status_partial:"Empfangen: {time} · einige Knoten fehlen",status_no_links:"Empfangen: {time} · keine beobachteten Verbindungen gefunden",error_permission:"Administratorrechte sind erforderlich.",error_unsupported:"Dieser Anbieter oder die Home-Assistant-API ist nicht verfügbar.",error_timeout:"Der Anbieter hat nicht rechtzeitig geantwortet.",error_invalid_topic:"Prüfe das Zigbee2MQTT-Basistopic.",error_invalid_payload:"Der Anbieter hat nicht unterstützte Topologiedaten geliefert.",error_provider:"Topologiedaten konnten nicht geladen werden.",remote_count:"+{n} in anderen Bereichen",route_device_not_on_plan:"Gerät ist nicht im Plan",route_coordinator_not_on_plan:"Koordinator ist nicht im Plan",route_other_space:"anderer Bereich"};const n="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";export{e as dictionary,n as fingerprint};

custom_components/houseplan/frontend/houseplan-assets/topology-fr-B8yoJGvc.js

@@ -1 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";var e={title:"Liens Zigbee",toggle:"Afficher les liens Zigbee au survol d’un appareil",hint:"Seuls les voisins directs observés sont affichés. Le survol ne lance aucune requête.",help:"Montre avec quels appareils Zigbee chaque appareil communique directement. La couleur de la ligne est la qualité du lien (LQI) sur la même échelle que l'indicateur LQI de l'appareil : rouge à 40 et en dessous, vert à 180 et au-dessus. Une ligne pointillée signifie que la qualité n'a pas été communiquée. Une flèche pointe vers l'appareil suivant sur le chemin du coordinateur : une flèche part, les flèches entrantes sont les appareils qui passent par celui-ci. Une ligne sans flèche est un voisin de secours. C'est l'arbre de routes que construit House Plan, pas le trajet d'un paquet à cet instant : une étiquette au bout d'une flèche signifie que sa cible n'est pas sur ce plan, et l'absence de flèche que la route est inconnue. Les données proviennent du dernier chargement et vieillissent ; les liens ne sont visibles qu'à la souris.",help_aria:"Aide : liens Zigbee",admin_only:"Les données de topologie sont réservées aux administrateurs Home Assistant.",save_first:"Enregistrez ce réglage avant de charger les données de topologie.",zha:"ZHA",zha_read:"Lire les données ZHA",zha_hint:"Lit la topologie en cache de ZHA sans lancer d’analyse radio.",z2m:"Zigbee2MQTT",z2m_topics:"Topics de base (un par ligne)",z2m_update:"Actualiser la carte",z2m_warning:"L’analyse de la carte réseau peut durer de 10 secondes à 2 minutes et réduire temporairement la réactivité de Zigbee.",status_idle:"Données non chargées",status_loading:"Chargement…",status_ready:"Reçu : {time}",status_stale:"Reçu : {time} · obsolète",status_partial:"Reçu : {time} · certains nœuds sont omis",status_no_links:"Reçu : {time} · aucun lien observé trouvé",error_permission:"Les droits administrateur sont requis.",error_unsupported:"Ce fournisseur ou l’API Home Assistant n’est pas disponible.",error_timeout:"Le fournisseur n’a pas répondu à temps.",error_invalid_topic:"Vérifiez le topic de base Zigbee2MQTT.",error_invalid_payload:"Le fournisseur a renvoyé des données de topologie non prises en charge.",error_provider:"Impossible de charger les données de topologie.",remote_count:"+{n} dans d’autres espaces",route_device_not_on_plan:"appareil absent du plan",route_coordinator_not_on_plan:"coordinateur absent du plan",route_other_space:"autre espace"};const s="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";export{e as dictionary,s as fingerprint};

custom_components/houseplan/frontend/houseplan-assets/topology-ru-BRKShmrQ.js

@@ -1 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";var e={title:"Связи Zigbee",toggle:"Показывать связи Zigbee при наведении на устройство",hint:"Показываются только наблюдаемые прямые соседи. Наведение ничего не запрашивает.",help:"Показывает, с какими устройствами Zigbee каждое связано напрямую. Цвет линии — качество связи (LQI) по той же шкале, что у показателя LQI устройства: красный при 40 и ниже, зелёный при 180 и выше. Пунктир — качество не сообщено. Стрелка ведёт к следующему устройству по пути к координатору: исходящая одна, входящие — те, кто ходит через это устройство. Линия без стрелки — запасной сосед. Это дерево маршрутов, которое строит House Plan, а не путь пакета в эту секунду: подпись на конце стрелки значит, что цель не на этом плане, а отсутствие стрелки — что путь неизвестен. Данные из последней загрузки и устаревают, связи видны только при работе мышью.",help_aria:"Справка: связи Zigbee",admin_only:"Данные топологии доступны только администраторам Home Assistant.",save_first:"Сохраните настройку перед загрузкой данных топологии.",zha:"ZHA",zha_read:"Прочитать данные ZHA",zha_hint:"Читает сохранённую топологию ZHA и не запускает радио-сканирование.",z2m:"Zigbee2MQTT",z2m_topics:"Базовые топики (по одному в строке)",z2m_update:"Обновить карту",z2m_warning:"Сканирование карты сети занимает от 10 секунд до 2 минут и временно может снизить отзывчивость Zigbee.",status_idle:"Данные не загружены",status_loading:"Загрузка…",status_ready:"Получено: {time}",status_stale:"Получено: {time} · данные устарели",status_partial:"Получено: {time} · часть узлов не показана",status_no_links:"Получено: {time} · наблюдаемые связи не найдены",error_permission:"Нужны права администратора.",error_unsupported:"Провайдер или API Home Assistant недоступен.",error_timeout:"Провайдер не ответил вовремя.",error_invalid_topic:"Проверьте базовый топик Zigbee2MQTT.",error_invalid_payload:"Провайдер вернул неподдерживаемые данные топологии.",error_provider:"Не удалось загрузить данные топологии.",remote_count:"+{n} в других пространствах",route_device_not_on_plan:"устройства нет на плане",route_coordinator_not_on_plan:"координатора нет на плане",route_other_space:"другое пространство"};const t="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";export{e as dictionary,t as fingerprint};

custom_components/houseplan/frontend/houseplan-assets/zigbee-topology-runtime-CKlry6R8.js

@@ -1 +0,0 @@
-globalThis.__HOUSEPLAN_BUILD_FINGERPRINT__="a7aa4b718d3f5657591f9cf866d227c415e1f5f46fbc0b11ddce80a6845cf34e";import{n as t,c as n}from"./zigbee-topology-DOAnbvlu.js";import{aM as e}from"./houseplan-card-BYwTiVnu.js";import"./namespace-language-zIuNvgGV.js";const o=new WeakMap;function i(t){const n=function(t){const n=t?.connection||t;return!n||"object"!=typeof n&&"function"!=typeof n?null:n}(t);if(!n)return null;let e=o.get(n);return e||(e={revision:0,topologies:[],states:{},listeners:new Set,inflight:new Map},o.set(n,e)),e}function r(t,n,e){t.states={...t.states,[n]:e},function(t){t.revision++;for(const n of t.listeners)n()}(t)}function s(t){const n=t?.code;if("permission"===n||"unsupported"===n||"timeout"===n||"invalid_topic"===n||"invalid_payload"===n)return n;const e=String(t?.message||"").toLowerCase();return e.includes("unauthor")||e.includes("permission")?"permission":e.includes("unknown_command")||e.includes("not found")?"unsupported":"provider"}function a(t){return Object.assign(new Error(t),{code:t})}function c(t,n,e){const o=t.inflight.get(n);if(o)return o;r(t,n,{phase:"loading"});const i=e().then(n=>{if(!n.nodes.length&&n.warnings.some(t=>"invalid_payload"===t.code))throw a("invalid_payload");!function(t,n){t.topologies=[...t.topologies.filter(t=>!(t.provider===n.provider&&t.instanceId===n.instanceId)),n],r(t,"zha"===n.provider?"zha":`z2m:${n.instanceId}`,{phase:"ready",obtainedAt:n.obtainedAt,partial:n.warnings.length>0})}(t,n)}).catch(e=>{r(t,n,{phase:"error",error:s(e)})}).finally(()=>t.inflight.delete(n));return t.inflight.set(n,i),i}function l(t){const n=i(t);return n?{revision:n.revision,topologies:n.topologies,states:n.states}:{revision:0,topologies:[],states:{}}}function u(t,n){const e=i(t);return e?(e.listeners.add(n),()=>e.listeners.delete(n)):()=>{}}function f(t){if(!0!==t?.user?.is_admin)throw a("permission")}function p(n){const e=i(n);return e?c(e,"zha",async()=>{if(f(n),"function"!=typeof n?.callWS)throw a("unsupported");return t(await n.callWS({type:"zha/devices"}))}):Promise.resolve()}function d(t){return null!==t&&"object"==typeof t?t:null}function h(t){const n=d(t),e=n?.payload??t;if("string"!=typeof e)return e;try{return JSON.parse(e)}catch{return null}}async function m(t,n){let e;try{return await Promise.race([t,new Promise((t,o)=>{e=globalThis.setTimeout(()=>o(a("timeout")),Math.max(1,n))})])}finally{void 0!==e&&globalThis.clearTimeout(e)}}function g(t,o,r=15e4){const s=i(t);if(!s)return Promise.resolve();const l=e(o);return c(s,`z2m:${l||String(o)}`,async()=>{if(f(t),!l)throw a("invalid_topic");const e=t.connection,o=e?.subscribeMessage;if("function"!=typeof o||"function"!=typeof t?.callService)throw a("unsupported");const i=function(){const t=globalThis.crypto;return"function"==typeof t?.randomUUID?`houseplan-${t.randomUUID()}`:`houseplan-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`}(),s=Date.now()+Math.max(1,r);let c=!1,u=null,p=null,g=null;const y=new Promise(t=>{u=t}),w=new Promise((t,n)=>{p=t,g=n}),b=[];try{const r=await o.call(e,t=>{!0===d(t)?.retain&&h(t)&&u?.()},{type:"mqtt/subscribe",topic:`${l}/bridge/info`});"function"==typeof r&&b.push(r);const f=await o.call(e,t=>{if(!0===d(t)?.retain)return;const n=h(t);null!==n?n&&function(t){const n=d(t),e=n?.transaction??d(n?.data)?.transaction;return"string"==typeof e||"number"==typeof e?String(e):null}(n)===i&&p?.(n):c&&g?.(a("invalid_payload"))},{type:"mqtt/subscribe",topic:`${l}/bridge/response/networkmap`});"function"==typeof f&&b.push(f),await m(y,Math.min(4e3,Math.max(1,s-Date.now()))),c=!0,await t.callService("mqtt","publish",{topic:`${l}/bridge/request/networkmap`,payload:JSON.stringify({type:"raw",routes:!1,transaction:i}),qos:0,retain:!1});const v=await m(w,s-Date.now()),_=d(v)?.status;if(_&&"ok"!==_)throw a("provider");return n(v,l)}finally{for(const t of b)try{t()}catch{}}})}export{p as readZhaTopology,g as refreshZ2mTopology,u as subscribeZigbeeTopology,l as zigbeeTopologyRuntimeSnapshot};

custom_components/houseplan/http_api.py

@@ -0,0 +1,242 @@
+"""HTTP endpoint for uploading House Plan manual files.
+
+Files (PDF and the like) are uploaded not over WebSocket (its message size limit
+breaks the connection on a large PDF) but via a plain multipart POST — like media in HA itself.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import tempfile
+from pathlib import Path
+
+from aiohttp import web
+
+from homeassistant.components.http import HomeAssistantView
+
+try:  # KEY_HASS — the modern way to access hass from the aiohttp application
+    from homeassistant.components.http import KEY_HASS
+except ImportError:  # older HA versions
+    KEY_HASS = "hass"  # type: ignore[assignment]
+from homeassistant.core import HomeAssistant
+
+from .const import CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, PLANS_DIR
+from .auth import may_write
+from .plans import TMP_PREFIX, reserve_filename
+from .validation import (
+    FILE_EXTENSIONS,
+    MAX_FILE_BYTES,
+    file_ext,
+    sanitize_filename,
+    sanitize_marker_id,
+)
+
+_LOGGER = logging.getLogger(__name__)
+
+_CHUNK = 64 * 1024
+# batch disk writes: one executor job per megabyte instead of per chunk
+_FLUSH_AT = 1024 * 1024
+
+_MIME = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".txt": "text/plain",
+}
+
+
+class HouseplanContentView(HomeAssistantView):
+    """Authenticated read access to plans and marker files (audit B1).
+
+    The directories used to be exposed as unauthenticated static paths, so
+    anyone who could reach the HA endpoint could pull floor plans and uploaded
+    manuals without logging in. This view keeps the same URLs but requires a
+    Home Assistant session (or a signed path, which the frontend uses for
+    <image href> inside the SVG).
+    """
+
+    url = "/api/houseplan/content/{kind}/{sub}/{name}"
+    name = "api:houseplan:content"
+    requires_auth = True
+
+    async def get(self, request: web.Request, kind: str, sub: str, name: str) -> web.StreamResponse:
+        hass: HomeAssistant = request.app[KEY_HASS]
+        if kind not in ("plans", "files"):
+            return web.Response(status=404)
+        safe_sub = sanitize_marker_id(sub)
+        safe_name = sanitize_filename(name)
+        if not safe_sub or not safe_name:
+            return web.Response(status=404)
+        base = Path(hass.config.path(PLANS_DIR if kind == "plans" else FILES_DIR)).resolve()
+        # plans live flat in one directory: the sub segment is a placeholder ("_")
+        path = (base / safe_name if kind == "plans" else base / safe_sub / safe_name).resolve()
+        # defence in depth: the sanitizers already strip separators
+        if not str(path).startswith(str(base)):
+            return web.Response(status=404)
+
+        if not await hass.async_add_executor_job(path.is_file):
+            return web.Response(status=404)
+        suffix = path.suffix.lower()
+        headers = {
+            "Cache-Control": "private, max-age=3600",
+            "Content-Type": _MIME.get(suffix, "application/octet-stream"),
+        }
+        if suffix == ".svg":
+            # An uploaded SVG is user content served from Home Assistant's own
+            # origin. Inside the card it is referenced by <image>, where scripts
+            # never run — but the same url opened as a top-level document is a
+            # live document of this origin, and a <script> in it reaches the
+            # session's localStorage and API (HP-1454-01, 2026-07-28: uploading
+            # needs write access, which by default every authenticated user has,
+            # and the signed url is easy to hand to an admin).
+            #
+            # `sandbox` with no allow-* tokens drops the document into an opaque
+            # origin: no scripts, no same-origin access, no forms. The explicit
+            # directives below are belt and braces for older engines. Only SVG
+            # gets this — a CSP on a PDF response can break the browser's built-in
+            # viewer, and a raster image cannot execute anything in the first place.
+            headers["Content-Security-Policy"] = (
+                "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+                "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:"
+            )
+        # FileResponse streams from disk: a 50 MB manual used to be read whole
+        # into memory and copied into the response body, so a couple of parallel
+        # downloads could push a small Home Assistant host into swap (HP-1454-06).
+        return web.FileResponse(path, chunk_size=_CHUNK, headers=headers)
+
+
+class HouseplanUploadView(HomeAssistantView):
+    """POST /api/houseplan/upload — save a marker file, return its URL."""
+
+    url = "/api/houseplan/upload"
+    name = "api:houseplan:upload"
+    requires_auth = True
+
+    async def post(self, request: web.Request) -> web.Response:
+        hass: HomeAssistant = request.app[KEY_HASS]
+        if not may_write(hass, request.get("hass_user")):
+            return web.json_response({"error": "unauthorized"}, status=403)
+
+        files_root = Path(hass.config.path(FILES_DIR))
+        marker_id = "misc"
+        filename: str | None = None
+        # Every temporary file this request creates, promoted or not. The outer
+        # `finally` removes whatever is left: a dropped connection, a second
+        # `file` part or a failure while promoting used to leave a `.upload-*`
+        # behind for good, and the collector only ever walks marker folders, so
+        # nothing would have picked it up (HP-1460-02).
+        temps: list[Path] = []
+        error: tuple[dict, int] | None = None
+
+        def _new_tmp() -> Path:
+            files_root.mkdir(parents=True, exist_ok=True)
+            fd, name = tempfile.mkstemp(prefix=TMP_PREFIX, dir=str(files_root))
+            os.close(fd)
+            return Path(name)
+
+        def _flush(target: Path, blocks: list[bytes]) -> None:
+            with open(target, "ab") as fh:
+                for block in blocks:
+                    fh.write(block)
+
+        def _cleanup(paths: list[Path]) -> None:
+            for path in paths:
+                try:
+                    path.unlink()
+                except OSError:
+                    pass
+
+        try:
+            try:
+                reader = await request.multipart()
+                async for part in reader:
+                    if part.name == "marker_id":
+                        marker_id = sanitize_marker_id(await part.text())
+                    elif part.name == "file":
+                        if filename is not None:
+                            # one upload per request: a second part would strand
+                            # the first temporary file and make the response
+                            # ambiguous about which url was returned
+                            error = ({"error": "one_file_only"}, 400)
+                            break
+                        filename = part.filename or "file"
+                        if file_ext(filename) not in FILE_EXTENSIONS:
+                            error = ({"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, 400)
+                            break
+                        # Stream to a temporary file instead of collecting the
+                        # whole upload in memory and copying it again into one
+                        # buffer: a 50 MB manual used to cost ~100 MB of RSS
+                        # mid-request (HP-1454-06). Blocks are batched so this
+                        # is one executor job per megabyte, not per 64 KB.
+                        tmp = await hass.async_add_executor_job(_new_tmp)
+                        temps.append(tmp)
+                        size = 0
+                        pending: list[bytes] = []
+                        buffered = 0
+                        while chunk := await part.read_chunk(_CHUNK):
+                            size += len(chunk)
+                            if size > MAX_FILE_BYTES:
+                                error = (
+                                    {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024},
+                                    413,
+                                )
+                                break
+                            pending.append(chunk)
+                            buffered += len(chunk)
+                            if buffered >= _FLUSH_AT:
+                                await hass.async_add_executor_job(_flush, tmp, pending)
+                                pending, buffered = [], 0
+                        if error:
+                            break
+                        if pending:
+                            await hass.async_add_executor_job(_flush, tmp, pending)
+            except Exception as err:  # noqa: BLE001
+                _LOGGER.warning("House Plan upload: multipart read error: %s", err)
+                error = ({"error": "bad_request"}, 400)
+
+            if error:
+                return web.json_response(error[0], status=error[1])
+            if not temps or not filename:
+                return web.json_response({"error": "no_file"}, status=400)
+
+            tmp_path = temps[0]
+            target_dir = files_root / marker_id
+            safe_name = filename
+
+            def _promote() -> str:
+                """Claim a free name, then move the finished upload onto it.
+
+                Never overwrite an existing attachment: its bytes may be
+                referenced by the stored configuration, and this upload is not
+                part of that transaction — a cancelled dialog or a rejected save
+                would leave the old url serving the new content (HP-1454-02).
+                The name is reserved atomically, so two uploads racing on the
+                same filename cannot agree on it (HP-1460-01).
+                """
+                name = reserve_filename(target_dir, safe_name)
+                try:
+                    os.replace(tmp_path, target_dir / name)
+                except OSError:
+                    (target_dir / name).unlink(missing_ok=True)
+                    raise
+                return name
+
+            try:
+                name = await hass.async_add_executor_job(_promote)
+            except OSError as err:
+                _LOGGER.warning("House Plan upload: could not store the file: %s", err)
+                return web.json_response({"error": "io_error"}, status=500)
+            temps.remove(tmp_path)  # it is the attachment now, not a temporary
+            return web.json_response(
+                {"ok": True, "url": f"{CONTENT_URL}/files/{marker_id}/{name}", "name": filename}
+            )
+        finally:
+            # BaseException too: cancelling the request task raises
+            # asyncio.CancelledError, which an `except Exception` never saw —
+            # an aborted large upload leaked its temporary file every time
+            if temps:
+                await hass.async_add_executor_job(_cleanup, list(temps))

custom_components/houseplan/manifest.json

@@ -0,0 +1,20 @@
+{
+  "domain": "houseplan",
+  "name": "House Plan",
+  "codeowners": [
+    "@Matysh"
+  ],
+  "config_flow": true,
+  "dependencies": [
+    "http",
+    "frontend",
+    "websocket_api"
+  ],
+  "documentation": "https://github.com/Matysh/houseplan-card",
+  "integration_type": "service",
+  "iot_class": "local_push",
+  "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
+  "requirements": [],
+  "single_config_entry": true,
+  "version": "1.47.0"
+}

custom_components/houseplan/plans.py

@@ -0,0 +1,307 @@
+"""Blob lifecycle — pure, so it is unit-testable without Home Assistant.
+
+The file system is not part of the configuration store's transaction, so who
+may write or delete a plan or an attachment, and when, is a correctness
+question rather than housekeeping. It lives here, apart from the WebSocket and
+HTTP plumbing, precisely because it is the part that has to be reasoned about
+and tested.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+from .const import PLAN_ORPHAN_TTL_S
+from .validation import MAX_FILENAME, PLAN_EXTENSIONS, sanitize_filename
+
+_LOGGER = logging.getLogger(__name__)
+
+# Streaming uploads land here first. The prefix is a dot so the name can never
+# collide with an attachment (sanitize_filename strips leading dots) and is easy
+# to sweep.
+TMP_PREFIX = ".upload-"
+
+
+def reserve_filename(directory: Path, name: str) -> str:
+    """Atomically claim a free name inside `directory` and return it.
+
+    Creates the file, empty, with `O_CREAT | O_EXCL`, so the name is *taken* the
+    moment it is chosen. The previous version asked `exists()` and returned a
+    string; two uploads racing between the check and the write agreed on the
+    same name and one silently overwrote the other, both reporting success
+    (HP-1460-01). The caller writes the real bytes over the placeholder — it
+    owns the name by then — and must remove it if it never gets that far.
+
+    The result is guaranteed to satisfy `sanitize_filename(result) == result`:
+    the content view sanitises the name in the request too, so a name it would
+    shorten or rewrite is a file that is written and then never served.
+    """
+    directory.mkdir(parents=True, exist_ok=True)
+    # Split the extension off the RAW name: sanitize_filename() truncates to
+    # MAX_FILENAME, so sanitising first would cut ".pdf" off a long name and the
+    # attachment would be stored — and served — without its type.
+    base = name.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+    stem, dot, suffix = base.rpartition(".")
+    if not dot:
+        stem, suffix = base, ""
+    stem = sanitize_filename(stem)
+    ext = f".{sanitize_filename(suffix)[:16]}" if suffix else ""
+    i = 1
+    while True:
+        tag = "" if i == 1 else f"-{i}"
+        # budget the stem so the WHOLE name fits, including the collision tag —
+        # appending "-2" to an already maximal name produced a url the view
+        # truncated back to something else, i.e. a permanent 404
+        room = MAX_FILENAME - len(ext) - len(tag)
+        candidate = (stem[:room] if room > 0 else "f") + tag + ext
+        candidate = sanitize_filename(candidate)
+        if candidate.startswith("."):  # a name that is only an extension
+            candidate = "file" + candidate
+        try:
+            fd = os.open(directory / candidate, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
+        except FileExistsError:
+            i += 1
+            if i > 10000:  # pathological directory; do not spin forever
+                raise
+            continue
+        os.close(fd)
+        return candidate
+
+
+def attachment_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """"<marker>/<file>" for every attachment a configuration references."""
+    out: set[str] = set()
+    for m in (cfg or {}).get("markers") or []:
+        for pdf in m.get("pdfs") or []:
+            url = pdf.get("url") if isinstance(pdf, dict) else None
+            if not isinstance(url, str) or "/files/" not in url:
+                continue
+            rel = url.split("?", 1)[0].split("/files/", 1)[1]
+            if rel.count("/") == 1:
+                out.add(rel)
+    return out
+
+
+def sweep_upload_temps(files_dir: Path, now: float | None = None) -> int:
+    """Remove abandoned streaming temporaries (HP-1460-02).
+
+    The request itself deletes its own, but a hard kill — a restart mid-upload,
+    an OOM — leaves one behind, and the attachment collector only walks marker
+    folders, so it would never be seen. Age-gated for the same reason as the
+    rest: a fresh one belongs to a request still in flight.
+    """
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        items = [p for p in files_dir.iterdir() if p.is_file()] if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    for item in items:
+        if not item.name.startswith(TMP_PREFIX):
+            continue
+        try:
+            if item.stat().st_mtime >= cutoff:
+                continue
+            item.unlink()
+            removed += 1
+        except OSError:
+            continue
+    return removed
+
+
+def collect_attachments(
+    files_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """The same commit-scoped rule as `collect_plans`, for marker attachments.
+
+    A file the old revision referenced and the new one does not, whose marker
+    still exists, was removed on purpose — the dialog has a trash button and
+    promises nothing. It goes. Everything else is kept, except a staging folder
+    (`up_*`), which by construction only ever holds an upload from a dialog that
+    was never saved: those go after PLAN_ORPHAN_TTL_S. Never raises: it runs
+    behind a durable write.
+    """
+    new_refs = attachment_refs(new_cfg)
+    old_refs = attachment_refs(old_cfg)
+    # Removing an attachment from a device that still exists is the user saying
+    # "drop this one" — a trash button, no promise that anything is kept. A
+    # device that is GONE is a different transition, and its files follow the
+    # same rule as a deleted space's plan: kept.
+    live_markers = {str(m.get("id")) for m in (new_cfg or {}).get("markers") or []}
+    # Same distinction as for plans. A staging folder (`up_*`) is different: it
+    # only ever holds an upload from a dialog that was never saved, so the short
+    # rule is exactly right there even on the timer.
+    now_s = time.time() if now is None else now
+    staging_cutoff = now_s - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        folders = sorted(p for p in files_dir.iterdir() if p.is_dir()) if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    removed += sweep_upload_temps(files_dir, now)
+    for folder in folders:
+        # A staging folder only ever holds an upload from a dialog that was never
+        # saved — unambiguous, so an hour is right, and no device owns it.
+        staging = folder.name.startswith("up_")
+        try:
+            items = sorted(p for p in folder.iterdir() if p.is_file())
+        except OSError:
+            continue
+        for item in items:
+            rel = f"{folder.name}/{item.name}"
+            if rel in new_refs:
+                continue
+            dropped = rel in old_refs and folder.name in live_markers
+            if not dropped:
+                if not staging:
+                    # Same rule as for plans: not asked for, so kept. A file in
+                    # a device's folder that the device does not list is an
+                    # upload whose save was rejected — and ageing those out
+                    # raced the retry that was about to reference them.
+                    continue
+                try:
+                    if item.stat().st_mtime >= staging_cutoff:
+                        continue
+                except OSError:
+                    continue
+            try:
+                item.unlink()
+                removed += 1
+            except OSError as err:
+                _LOGGER.warning("House Plan: could not remove the attachment %s: %s", item, err)
+        try:
+            next(folder.iterdir())
+        except StopIteration:
+            try:
+                folder.rmdir()
+            except OSError:
+                pass
+        except OSError:
+            pass
+    return removed
+
+
+def plan_basename(url: Any) -> str:
+    """File name a stored plan_url points at ('' when there is none)."""
+    if not isinstance(url, str) or not url:
+        return ""
+    return url.split("?", 1)[0].rsplit("/", 1)[-1]
+
+
+def plan_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """Plan file names a configuration references."""
+    out: set[str] = set()
+    for sp in (cfg or {}).get("spaces") or []:
+        name = plan_basename(sp.get("plan_url"))
+        if name:
+            out.add(name)
+    return out
+
+
+def plan_by_space(cfg: dict[str, Any] | None) -> dict[str, str]:
+    """space id -> the plan file it references ('' when it has none)."""
+    return {
+        str(sp.get("id")): plan_basename(sp.get("plan_url"))
+        for sp in (cfg or {}).get("spaces") or []
+    }
+
+
+def is_plan_file(name: str) -> bool:
+    """Does this look like a plan we wrote: <space>.<ext> or <space>.<token>.<ext>?"""
+    parts = name.split(".")
+    return len(parts) in (2, 3) and parts[-1].lower() in PLAN_EXTENSIONS
+
+
+def collect_plans(
+    plans_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """Drop plan files the accepted configuration made obsolete (review R3-1).
+
+    Called inside the config write lock, right after the new revision is
+    stored, so it decides from the two configurations that actually bracket the
+    commit instead of trusting a client to say what may be deleted. The earlier
+    design — a `plan/cleanup` command carrying `keep` — could not be ordered
+    against another client's commit: a delayed call removed the file that
+    client had just saved, leaving the accepted configuration pointing at
+    nothing, which is the damage copy-on-write was introduced to prevent.
+
+    Two rules, both conservative:
+      * a file the OLD configuration referenced and the new one does not was
+        authoritative and has been superseded — remove it;
+      * any other unreferenced plan file is a rejected or abandoned upload, and
+        is removed only once PLAN_ORPHAN_TTL_S has passed: a fresh one may
+        belong to a transaction that has not committed yet.
+
+    Never raises: the configuration is already stored by the time this runs, so
+    a file-system problem must not turn a durable commit into a failed call.
+    """
+    new_refs = plan_refs(new_cfg)
+    old_refs = plan_refs(old_cfg)
+    # A commit knows what it superseded. The timer only knows what nothing
+    # points at *right now*, and for a plan that is a reversible state: the
+    # editor detaches the image when a space switches to "draw" and says the
+    # file stays on disk. So the scheduled pass keeps anything belonging to a
+    # space that still exists, and waits a month for the rest.
+    # A space with NO plan_url has had its image detached — reversible, and the
+    # editor promises the file stays. A space that HAS one is different: any
+    # other file of its own is a superseded or rejected upload, so the short
+    # rule is right for those. Getting this distinction wrong (protecting
+    # nothing) destroyed two detached plans on 2026-07-28.
+    # The short rule fits exactly one case: a space that HAS a plan, where any
+    # other file of its own can only be a superseded or rejected upload.
+    old_by_space = plan_by_space(old_cfg)
+    new_by_space = plan_by_space(new_cfg)
+    # A file that left the configuration tells us nothing on its own: replacing a
+    # plan, detaching one and deleting a space all look identical from
+    # `old_refs - new_refs`. Only the first is a deletion the user asked for
+    # (HP-1465-01 — the guards below were written and then never reached,
+    # because the code decided "superseded" before asking why).
+    replaced = {
+        name for space, name in old_by_space.items()
+        if new_by_space.get(space) and new_by_space[space] != name
+    }
+    removed = 0
+    try:
+        items = sorted(plans_dir.iterdir()) if plans_dir.is_dir() else []
+    except OSError as err:
+        # The directory can vanish or turn unreadable between the check and the
+        # walk. This is housekeeping running behind a commit that is already
+        # durable, so it reports "nothing collected" instead of failing (R4-1).
+        _LOGGER.warning("House Plan: could not list %s: %s", plans_dir, err)
+        return 0
+    for item in items:
+        if not item.is_file() or item.name in new_refs or not is_plan_file(item.name):
+            continue
+        if item.name not in replaced:
+            # PRODUCT RULE (owner's decision, 2026-07-28): a plan file we were
+            # not told to delete is kept, however long it sits there. Detaching
+            # is one click to undo and the editor says the image stays; deleting
+            # a space is deliberate but the image was imported and may be
+            # nowhere else. The errors are not symmetrical — unnecessary
+            # megabytes can be removed by hand, a deleted file cannot be
+            # brought back.
+            #
+            # There is deliberately no age rule here. An earlier version aged
+            # out "rejected uploads" — a file of a space that has a plan, which
+            # was never the plan — and that raced a save: the sweep deleted the
+            # upload from the failed attempt while a retry was committing a
+            # reference to it. A rule that can delete a file somebody is about
+            # to point at is not worth the disk it reclaims.
+            continue
+        try:
+            item.unlink()
+            removed += 1
+        except OSError as err:
+            _LOGGER.warning("House Plan: could not remove the old plan %s: %s", item, err)
+    return removed

custom_components/houseplan/quality_scale.yaml

@@ -0,0 +1,112 @@
+# Integration Quality Scale self-assessment.
+# Custom integrations are not formally graded (they sit in the "Custom" tier),
+# but we track the official checklist here. done = implemented, exempt = not
+# applicable with the reason.
+rules:
+  # ---- Bronze ----
+  action-setup:
+    status: exempt
+    comment: The integration registers no service actions.
+  appropriate-polling:
+    status: exempt
+    comment: No polling — storage + WebSocket API + frontend serving only.
+  brands:
+    status: done
+    comment: Local brand images in custom_components/houseplan/brand/ (HA >=2026.3 mechanism).
+  common-modules:
+    status: done
+    comment: const.py, store.py (stores + runtime data), validation.py (pure schemas).
+  config-flow:
+    status: done
+  config-flow-test-coverage:
+    status: done
+    comment: tests_backend/test_config_flow.py (runs in CI on Python 3.13).
+  dependency-transparency:
+    status: done
+    comment: No external requirements.
+  docs-actions:
+    status: exempt
+    comment: No service actions.
+  docs-high-level-description:
+    status: done
+    comment: README.md.
+  docs-installation-instructions:
+    status: done
+    comment: README.md (HACS + manual).
+  docs-removal-instructions:
+    status: done
+    comment: README.md uninstall section.
+  entity-event-setup:
+    status: exempt
+    comment: No entities.
+  entity-unique-id:
+    status: exempt
+    comment: No entities.
+  has-entity-name:
+    status: exempt
+    comment: No entities.
+  runtime-data:
+    status: done
+    comment: entry.runtime_data holds HouseplanData (stores + write lock).
+  test-before-configure:
+    status: exempt
+    comment: No external device/service to validate during the flow.
+  test-before-setup:
+    status: done
+    comment: Storage load is verified in async_setup_entry (ConfigEntryNotReady on failure).
+  unique-config-entry:
+    status: done
+    comment: single_config_entry in manifest.
+  # ---- Silver ----
+  action-exceptions:
+    status: exempt
+    comment: No service actions; WS handlers reply with typed error codes.
+  config-entry-unloading:
+    status: done
+    comment: Unload supported; WS commands and static paths are global by design (documented in __init__).
+  docs-configuration-parameters:
+    status: done
+    comment: README documents the admin_only option and card options.
+  docs-installation-parameters:
+    status: done
+  entity-unavailable:
+    status: exempt
+    comment: No entities.
+  integration-owner:
+    status: done
+  log-when-unavailable:
+    status: exempt
+    comment: No external service.
+  parallel-updates:
+    status: exempt
+    comment: No entities/polling.
+  reauthentication-flow:
+    status: exempt
+    comment: No authentication against an external service.
+  test-coverage:
+    status: todo
+    comment: Backend covered by pure tests + HA-harness tests in CI; measuring >95% is planned.
+  # ---- Gold (selected; entity/device rules are exempt — no entities) ----
+  diagnostics:
+    status: done
+    comment: diagnostics.py with redaction of personal marker fields.
+  reconfiguration-flow:
+    status: exempt
+    comment: Nothing to reconfigure — no host/credentials; all data is edited in the card UI.
+  repair-issues:
+    status: done
+    comment: Missing plan files raise repair issues (translation_key broken_plan).
+  docs-troubleshooting:
+    status: todo
+  docs-examples:
+    status: todo
+  # ---- Platinum ----
+  strict-typing:
+    status: todo
+    comment: Python is annotated; mypy strict pass is planned.
+  async-dependency:
+    status: exempt
+    comment: No dependencies.
+  inject-websession:
+    status: exempt
+    comment: No outgoing HTTP.

custom_components/houseplan/repairs.py

@@ -0,0 +1,67 @@
+"""Repair issues for House Plan.
+
+The check runs at entry setup AND after every config save (ws_config_set),
+so a plan file that goes missing — or gets re-uploaded — is reflected in the
+Repairs UI without waiting for a restart.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+from homeassistant.core import HomeAssistant
+from homeassistant.helpers import issue_registry as ir
+
+from .const import CONTENT_URL, DOMAIN, PLANS_DIR, PLANS_URL
+from .store import HouseplanConfigEntry
+
+
+async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntry) -> None:
+    """Raise an issue for every space whose plan file is missing on disk."""
+    cfg_raw = await entry.runtime_data.config_store.async_load() or {}
+    spaces = cfg_raw.get("config", {}).get("spaces", [])
+    plans_dir = Path(hass.config.path(PLANS_DIR))
+
+    def _missing() -> list[tuple[str, str]]:
+        res = []
+        for sp in spaces:
+            url = sp.get("plan_url") or ""
+            # both the legacy static URL and the authenticated content URL
+            prefix = None
+            if url.startswith(PLANS_URL + "/"):
+                prefix = PLANS_URL + "/"
+            elif url.startswith(CONTENT_URL + "/plans/_/"):
+                prefix = CONTENT_URL + "/plans/_/"
+            if prefix is None:
+                continue  # external/legacy URL — not ours to verify
+            fname = url[len(prefix) :].split("?", 1)[0]
+            if not (plans_dir / fname).is_file():
+                res.append((sp.get("id", "?"), fname))
+        return res
+
+    missing = await hass.async_add_executor_job(_missing)
+    broken = set()
+    for space_id, fname in missing:
+        broken.add(space_id)
+        ir.async_create_issue(
+            hass,
+            DOMAIN,
+            f"broken_plan_{space_id}",
+            is_fixable=False,
+            severity=ir.IssueSeverity.WARNING,
+            translation_key="broken_plan",
+            translation_placeholders={"space": space_id, "file": fname},
+        )
+    # Clear stale issues. Iterating the CURRENT spaces could only ever clear
+    # issues for spaces that still exist, so deleting or renaming a space with a
+    # missing plan left its warning in Repairs forever, with nothing left to fix
+    # it (HP-1454-09). Enumerate what we actually published instead.
+    registry = ir.async_get(hass)
+    stale = [
+        issue_id
+        for (domain, issue_id) in list(registry.issues)
+        if domain == DOMAIN
+        and issue_id.startswith("broken_plan_")
+        and issue_id[len("broken_plan_") :] not in broken
+    ]
+    for issue_id in stale:
+        ir.async_delete_issue(hass, DOMAIN, issue_id)

custom_components/houseplan/store.py

@@ -0,0 +1,75 @@
+"""Storage helpers: versioned stores and per-entry runtime data."""
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from typing import Any
+
+from homeassistant.config_entries import ConfigEntry
+from homeassistant.core import HomeAssistant
+from homeassistant.helpers.storage import Store
+
+from .const import DOMAIN, STORAGE_CONFIG_KEY, STORAGE_KEY, STORAGE_MINOR_VERSION, STORAGE_VERSION
+
+
+class HouseplanStore(Store):
+    """Store with a migration hook.
+
+    Bump STORAGE_MINOR_VERSION for backward-compatible schema additions and
+    STORAGE_VERSION for breaking changes, then handle them here. Keeping the
+    skeleton in place from day one means old installations always pass through
+    a single, tested upgrade path.
+    """
+
+    async def _async_migrate_func(
+        self,
+        old_major_version: int,
+        old_minor_version: int,
+        old_data: dict[str, Any],
+    ) -> dict[str, Any]:
+        data = old_data
+        # if old_major_version == 1 and old_minor_version < 2:
+        #     ...migrate...
+        return data
+
+
+@dataclass
+class HouseplanData:
+    """Runtime data of the single config entry (entry.runtime_data)."""
+
+    store: HouseplanStore
+    config_store: HouseplanStore
+    # One lock for every load→modify→save cycle of both stores: prevents
+    # lost updates from concurrent WS calls and makes the rev check atomic.
+    write_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    # Collect files nothing references any more. Set during setup, which also
+    # runs it once and schedules it daily. Exposed so it can be invoked
+    # directly — a test that fakes a 24 h jump proves the timer fires, not that
+    # the work happens, and those are different claims.
+    sweep: Callable[[], Awaitable[None]] | None = None
+
+
+HouseplanConfigEntry = ConfigEntry[HouseplanData]
+
+
+def create_data(hass: HomeAssistant) -> HouseplanData:
+    """Create the stores for a config entry."""
+    return HouseplanData(
+        store=HouseplanStore(hass, STORAGE_VERSION, STORAGE_KEY, minor_version=STORAGE_MINOR_VERSION),
+        config_store=HouseplanStore(
+            hass, STORAGE_VERSION, STORAGE_CONFIG_KEY, minor_version=STORAGE_MINOR_VERSION
+        ),
+    )
+
+
+def get_data(hass: HomeAssistant) -> HouseplanData | None:
+    """Runtime data of the loaded entry, or None when not set up."""
+    entries = hass.config_entries.async_loaded_entries(DOMAIN)
+    return entries[0].runtime_data if entries else None
+
+
+def get_entry(hass: HomeAssistant) -> ConfigEntry | None:
+    """The loaded config entry, or None."""
+    entries = hass.config_entries.async_loaded_entries(DOMAIN)
+    return entries[0] if entries else None

custom_components/houseplan/strings.json

@@ -0,0 +1,24 @@
+{
+  "config": {
+    "step": {
+      "user": {
+        "title": "House Plan",
+        "data": { "admin_only": "Only administrators may edit the layout" }
+      }
+    },
+    "abort": { "single_instance_allowed": "Already configured — only one entry is allowed." }
+  },
+  "options": {
+    "step": {
+      "init": {
+        "data": { "admin_only": "Only administrators may edit the layout" }
+      }
+    }
+  },
+  "issues": {
+    "broken_plan": {
+      "title": "Floor plan image is missing",
+      "description": "The plan file `{file}` for space `{space}` was not found in `config/houseplan/plans/`. Open the space settings in the House Plan card and upload the plan again."
+    }
+  }
+}

custom_components/houseplan/system_health.py

@@ -0,0 +1,32 @@
+"""System health for House Plan (Settings → System → Repairs → System information)."""
+from __future__ import annotations
+
+from typing import Any
+
+from homeassistant.components import system_health
+from homeassistant.core import HomeAssistant, callback
+
+from .store import get_data
+
+
+@callback
+def async_register(hass: HomeAssistant, register: system_health.SystemHealthRegistration) -> None:
+    """Register the system health info callback."""
+    register.async_register_info(system_health_info)
+
+
+async def system_health_info(hass: HomeAssistant) -> dict[str, Any]:
+    """Return integration health info."""
+    data = get_data(hass)
+    if data is None:
+        return {"status": "not set up"}
+    cfg_raw = await data.config_store.async_load() or {}
+    layout_raw = await data.store.async_load() or {}
+    config = cfg_raw.get("config", {})
+    return {
+        "config_rev": cfg_raw.get("rev", 0),
+        "spaces": len(config.get("spaces", [])),
+        "rooms": sum(len(s.get("rooms", [])) for s in config.get("spaces", [])),
+        "markers": len(config.get("markers", [])),
+        "layout_entries": len(layout_raw.get("layout", {})),
+    }

custom_components/houseplan/translations/en.json

@@ -0,0 +1,30 @@
+{
+  "config": {
+    "step": {
+      "user": {
+        "title": "House Plan",
+        "data": {
+          "admin_only": "Only administrators may edit the layout"
+        }
+      }
+    },
+    "abort": {
+      "single_instance_allowed": "Already configured — only one entry is allowed."
+    }
+  },
+  "options": {
+    "step": {
+      "init": {
+        "data": {
+          "admin_only": "Only administrators may edit the layout"
+        }
+      }
+    }
+  },
+  "issues": {
+    "broken_plan": {
+      "title": "Floor plan image is missing",
+      "description": "The plan file `{file}` for space `{space}` was not found in `config/houseplan/plans/`. Open the space settings in the House Plan card and upload the plan again."
+    }
+  }
+}

custom_components/houseplan/translations/ru.json

@@ -0,0 +1,30 @@
+{
+  "config": {
+    "step": {
+      "user": {
+        "title": "House Plan",
+        "data": {
+          "admin_only": "Правка раскладки только администраторами"
+        }
+      }
+    },
+    "abort": {
+      "single_instance_allowed": "Уже настроено — допускается одна запись."
+    }
+  },
+  "options": {
+    "step": {
+      "init": {
+        "data": {
+          "admin_only": "Правка раскладки только администраторами"
+        }
+      }
+    }
+  },
+  "issues": {
+    "broken_plan": {
+      "title": "Файл плана этажа не найден",
+      "description": "Файл плана `{file}` пространства `{space}` не найден в `config/houseplan/plans/`. Откройте настройки пространства в карточке House Plan и загрузите план заново."
+    }
+  }
+}

custom_components/houseplan/validation.py

@@ -0,0 +1,279 @@
+"""Pure House Plan validation and sanitizers — no Home Assistant dependencies.
+
+Kept separate so it can be covered by unit tests (only voluptuous is needed).
+"""
+from __future__ import annotations
+
+import re
+
+import voluptuous as vol
+
+# ---------- limits and extension sets ----------
+PLAN_EXTENSIONS = {"svg": "image/svg+xml", "png": "image/png", "jpg": "image/jpeg", "webp": "image/webp"}
+MAX_PLAN_BYTES = 8 * 1024 * 1024
+FILE_EXTENSIONS = {"pdf", "png", "jpg", "jpeg", "webp", "txt"}
+MAX_FILE_BYTES = 50 * 1024 * 1024
+
+SPACE_ID_RE = re.compile(r"^[a-z0-9_-]{1,64}$")
+_SAFE_NAME_RE = re.compile(r"[^A-Za-z0-9._-]+")
+# The name length the content view will accept back in a request. Anything a
+# generated name must fit inside, collision tag included (HP-1460-01).
+MAX_FILENAME = 120
+
+# ---------- sanitizers ----------
+
+
+def sanitize_marker_id(value: str) -> str:
+    """Safe marker identifier for a folder name.
+
+    Strips path separators and leading dots to rule out directory traversal
+    (e.g. '..', '../x'); an empty/dots-only result → 'misc'.
+    """
+    cleaned = _SAFE_NAME_RE.sub("_", value).lstrip(".")[:64]
+    return cleaned or "misc"
+
+
+def sanitize_filename(value: str) -> str:
+    """Drop the path and leading dots, keep a safe file name."""
+    raw = value.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+    return _SAFE_NAME_RE.sub("_", raw).lstrip(".")[:MAX_FILENAME] or "file"
+
+
+def file_ext(filename: str) -> str:
+    """Lowercase file extension ('' if none)."""
+    raw = filename.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+    return raw.rsplit(".", 1)[-1].lower() if "." in raw else ""
+
+
+def valid_space_id(value: str) -> bool:
+    return bool(SPACE_ID_RE.match(value))
+
+
+# ---------- voluptuous schemas ----------
+def _finite(value):
+    """Coerce to float and reject NaN/Infinity (audit B5).
+
+    'NaN' and 'Infinity' pass Coerce(float) and serialize to null on write,
+    silently corrupting a stored position forever.
+    """
+    f = float(value)
+    if f != f or f in (float("inf"), float("-inf")):
+        raise vol.Invalid("coordinate must be a finite number")
+    return f
+
+
+# generous caps: the product targets 20-200 devices and a handful of floors
+MAX_SPACES = 50
+MAX_ROOMS = 400
+MAX_MARKERS = 2000
+MAX_OPENINGS = 500
+MAX_DECOR = 1000
+MAX_LAYOUT = 5000
+# Inner limits (HP-1454-05). The outer collections were capped, the collections
+# INSIDE them were not: a 150 000-point polygon or a 100 000-entry known_devices
+# list passed validation, then made the card build gigantic SVG attributes and
+# walk them on every render. Any authenticated writer could store one, and with
+# `admin_only` off that is every user. These are product limits, not guesses: a
+# hand-drawn room does not need 500 vertices, and no home has 200 lights behind
+# one switch.
+MAX_POLY_POINTS = 500
+MAX_OPEN_TO = 50
+MAX_CONTROLS = 200
+MAX_PDFS = 50
+MAX_KNOWN_DEVICES = 20000
+MAX_TEXT = 500          # names, models, ids
+MAX_DESCRIPTION = 4000
+MAX_URL = 2000
+# Comfortably below the WebSocket frame limit (aiohttp's default is 4 MB): a
+# payload larger than the frame never reaches the handler at all — the socket
+# closes with 1009 and the user sees a dropped connection instead of an error
+# they can act on. For scale, a real three-floor home with ~200 devices stores
+# about 70 KB, so this is ~30x headroom.
+MAX_CONFIG_BYTES = 2 * 1024 * 1024
+
+_TEXT = vol.All(str, vol.Length(max=MAX_TEXT))
+_TEXT_OR_NONE = vol.Any(None, _TEXT)
+_URL = vol.All(str, vol.Length(max=MAX_URL))
+
+POS_SCHEMA = vol.Schema(
+    {vol.Required("x"): _finite, vol.Required("y"): _finite},
+    extra=vol.ALLOW_EXTRA,  # v2 records carry the "s" key (space id)
+)
+LAYOUT_SCHEMA = vol.All(vol.Schema({str: POS_SCHEMA}), vol.Length(max=MAX_LAYOUT))
+
+POINT = vol.All([_finite], vol.Length(min=2, max=2))
+
+
+def _require_geometry(room: dict) -> dict:
+    if "poly" in room or all(k in room for k in ("x", "y", "w", "h")):
+        return room
+    raise vol.Invalid("room: poly or x/y/w/h is required")
+
+
+ROOM_SCHEMA = vol.All(
+    vol.Schema(
+        {
+            vol.Required("id"): _TEXT,
+            vol.Required("name"): _TEXT,
+            vol.Optional("area"): _TEXT_OR_NONE,
+            vol.Optional("open_to"): vol.All([_TEXT], vol.Length(max=MAX_OPEN_TO)),
+            vol.Optional("settings"): vol.Any(
+                None,
+                vol.Schema(
+                    {
+                        vol.Optional("fill_mode"): vol.Any(None, vol.In(["none", "lqi", "light", "temp"])),
+                        vol.Optional("temp_source"): vol.Any(str, None),
+                        vol.Optional("hum_source"): vol.Any(str, None),
+                        vol.Optional("name_scale"): vol.Any(None, vol.All(vol.Coerce(float), vol.Range(min=0.5, max=3))),
+                        vol.Optional("label_scale"): vol.Any(None, vol.All(vol.Coerce(float), vol.Range(min=0.5, max=3))),
+                    },
+                    extra=vol.ALLOW_EXTRA,
+                ),
+            ),
+            vol.Optional("x"): _finite,
+            vol.Optional("y"): _finite,
+            vol.Optional("w"): _finite,
+            vol.Optional("h"): _finite,
+            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3, max=MAX_POLY_POINTS)),
+        },
+        extra=vol.ALLOW_EXTRA,
+    ),
+    _require_geometry,
+)
+SPACE_DISPLAY_SCHEMA = vol.Schema(
+    {
+        vol.Optional("show_borders"): bool,
+        vol.Optional("show_names"): bool,
+        vol.Optional("room_color"): vol.Match(r"^#[0-9a-fA-F]{6}$"),
+        vol.Optional("room_opacity"): vol.All(vol.Coerce(float), vol.Range(min=0, max=1)),
+        vol.Optional("fill_mode"): vol.In(["none", "lqi", "light", "temp", "glow"]),
+        vol.Optional("temp_min"): vol.Coerce(float),
+        vol.Optional("temp_max"): vol.Coerce(float),
+        vol.Optional("show_lqi"): bool,
+        vol.Optional("label_temp"): bool,
+        vol.Optional("label_hum"): bool,
+        vol.Optional("label_lqi"): bool,
+        vol.Optional("label_light"): bool,
+        vol.Optional("card_font_scale"): vol.All(vol.Coerce(float), vol.Range(min=0.5, max=3)),
+    },
+    extra=vol.ALLOW_EXTRA,
+)
+
+_DECOR_COMMON = {
+    vol.Required("id"): str,
+    vol.Optional("color"): vol.Match(r"^#[0-9a-fA-F]{6}$"),
+    vol.Optional("width"): vol.All(vol.Coerce(float), vol.Range(min=0.1, max=30)),
+}
+_NORM = vol.All(vol.Coerce(float), vol.Range(min=-1, max=2))
+DECOR_SCHEMA = vol.Any(
+    vol.Schema({**_DECOR_COMMON, vol.Required("kind"): "line",
+                vol.Required("x1"): _NORM, vol.Required("y1"): _NORM,
+                vol.Required("x2"): _NORM, vol.Required("y2"): _NORM},
+               extra=vol.ALLOW_EXTRA),
+    vol.Schema({**_DECOR_COMMON, vol.Required("kind"): vol.In(["rect", "ellipse"]),
+                vol.Required("x"): _NORM, vol.Required("y"): _NORM,
+                vol.Required("w"): _NORM, vol.Required("h"): _NORM,
+                vol.Optional("fill"): bool},
+               extra=vol.ALLOW_EXTRA),
+    vol.Schema({**_DECOR_COMMON, vol.Required("kind"): "text",
+                vol.Required("x"): _NORM, vol.Required("y"): _NORM,
+                vol.Required("text"): vol.All(str, vol.Length(min=1, max=200)),
+                vol.Optional("size"): vol.In(["s", "m", "l"])},
+               extra=vol.ALLOW_EXTRA),
+)
+
+SPACE_SCHEMA = vol.Schema(
+    {
+        vol.Required("id"): str,
+        vol.Required("title"): str,
+        vol.Optional("settings"): SPACE_DISPLAY_SCHEMA,
+        vol.Optional("plan_url"): vol.Any(str, None),
+        vol.Required("aspect"): vol.All(vol.Coerce(float), vol.Range(min=0.05, max=20)),
+        vol.Required("view_box"): vol.All([_finite], vol.Length(min=4, max=4)),
+        vol.Required("rooms"): vol.All([ROOM_SCHEMA], vol.Length(max=MAX_ROOMS)),
+        vol.Optional("decor"): vol.All([DECOR_SCHEMA], vol.Length(max=MAX_DECOR)),
+        vol.Optional("openings"): vol.All([
+            vol.Schema(
+                {
+                    vol.Required("id"): str,
+                    vol.Required("type"): vol.Any("door", "window"),
+                    vol.Required("x"): _finite,
+                    vol.Required("y"): _finite,
+                    vol.Required("angle"): _finite,
+                    vol.Required("length"): vol.All(vol.Coerce(float), vol.Range(min=0.001, max=1)),
+                    vol.Optional("contact"): vol.Any(str, None),
+                    vol.Optional("lock"): vol.Any(str, None),
+                    vol.Optional("invert"): bool,
+                    vol.Optional("flip_h"): bool,
+                    vol.Optional("flip_v"): bool,
+                },
+                extra=vol.ALLOW_EXTRA,
+            )
+        ], vol.Length(max=MAX_OPENINGS)),
+        # Legacy: walls are derived from room outlines since v1.19.0 — a line has no
+        # independent existence. Still accepted so a stale browser tab cannot fail a save;
+        # the card strips the field on every write.
+        # Accepted so a stale browser tab cannot fail a save, then DROPPED here
+        # (HP-1454-05): relying on a modern client to strip an unbounded legacy
+        # list is not a limit, it is a hope. `Remove` returns the key stripped.
+        vol.Remove("segments"): object,
+    },
+    extra=vol.ALLOW_EXTRA,
+)
+MARKER_SCHEMA = vol.Schema(
+    {
+        vol.Required("id"): str,
+        # 'device:<device_id>' | 'entity:<entity_id>' | 'virtual'
+        vol.Required("binding"): str,
+        vol.Optional("space"): vol.Any(str, None),
+        vol.Optional("area"): vol.Any(str, None),
+        vol.Optional("hidden"): bool,
+        vol.Optional("name"): _TEXT_OR_NONE,
+        vol.Optional("icon"): _TEXT_OR_NONE,
+        vol.Optional("model"): _TEXT_OR_NONE,
+        vol.Optional("link"): vol.Any(None, _URL),
+        vol.Optional("description"): vol.Any(None, vol.All(str, vol.Length(max=MAX_DESCRIPTION))),
+        vol.Optional("tap_action"): vol.Any("info", "more-info", "toggle", None),
+        vol.Optional("controls"): vol.Any(None, vol.All([_TEXT], vol.Length(max=MAX_CONTROLS))),
+        vol.Optional("glow_radius_cm"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)), None),
+        vol.Optional("is_light"): vol.Any(bool, None),
+        vol.Optional("room_id"): vol.Any(str, None),
+        # keep in sync with DISPLAY_MODES in src/logic.ts — a cross-language test
+        # asserts every option the editor offers is accepted here (issue #3)
+        vol.Optional("display"): vol.Any("badge", "ripple", "icon_ripple", "value", None),
+        vol.Optional("ripple_color"): vol.Any(str, None),
+        vol.Optional("ripple_size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=1, max=20)), None),
+        vol.Optional("size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=0.2, max=6)), None),
+        vol.Optional("angle"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=-360, max=360)), None),
+        vol.Optional("pdfs"): vol.All(
+            [vol.Schema({vol.Required("name"): _TEXT, vol.Required("url"): _URL}, extra=vol.ALLOW_EXTRA)],
+            vol.Length(max=MAX_PDFS),
+        ),
+    },
+    extra=vol.ALLOW_EXTRA,
+)
+CONFIG_SCHEMA = vol.Schema(
+    {
+        vol.Required("spaces"): vol.All([SPACE_SCHEMA], vol.Length(max=MAX_SPACES)),
+        vol.Optional("markers", default=list): vol.All([MARKER_SCHEMA], vol.Length(max=MAX_MARKERS)),
+        vol.Optional("settings", default=dict): vol.Schema(
+            {
+                vol.Optional("glow_radius_cm"): vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)),
+                vol.Optional("known_devices"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
+                vol.Optional("new_device_ids"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
+                vol.Optional("fill_colors"): vol.Schema(
+                    {
+                        str: vol.Schema(
+                            {
+                                vol.Required("c"): vol.Match(r"^#[0-9a-fA-F]{6}$"),
+                                vol.Required("a"): vol.All(vol.Coerce(float), vol.Range(min=0, max=1)),
+                            }
+                        )
+                    }
+                ),
+            },
+            extra=vol.ALLOW_EXTRA,
+        ),
+    },
+    extra=vol.ALLOW_EXTRA,  # unknown (legacy) keys do not break loading
+)

custom_components/houseplan/websocket_api.py

@@ -0,0 +1,600 @@
+"""House Plan WS commands: layout, space configuration, plan uploads."""
+from __future__ import annotations
+
+import logging
+
+import base64
+import binascii
+import json
+import secrets
+from pathlib import Path
+from typing import Any
+
+import voluptuous as vol
+
+from homeassistant.components import websocket_api
+from homeassistant.core import HomeAssistant, callback
+
+from .const import (
+    CONF_ADMIN_ONLY, DEFAULT_CONFIG,
+    CONTENT_URL, FILES_DIR, MAX_SIGN_PATHS, PLANS_DIR, PLANS_URL,
+)
+from .auth import may_write
+from .plans import (
+    collect_attachments, collect_plans, is_plan_file, plan_basename, plan_refs,
+    reserve_filename,
+)
+from .store import HouseplanData, get_data, get_entry
+from .validation import (
+    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_CONFIG_BYTES, MAX_PLAN_BYTES,
+    PLAN_EXTENSIONS, POS_SCHEMA, sanitize_filename, valid_space_id,
+)
+
+
+_LOGGER = logging.getLogger(__name__)
+
+
+@callback
+def async_register(hass: HomeAssistant) -> None:
+    """Register the WS commands."""
+    websocket_api.async_register_command(hass, ws_layout_get)
+    websocket_api.async_register_command(hass, ws_layout_set)
+    websocket_api.async_register_command(hass, ws_layout_update)
+    websocket_api.async_register_command(hass, ws_layout_delete)
+    websocket_api.async_register_command(hass, ws_config_get)
+    websocket_api.async_register_command(hass, ws_config_set)
+    websocket_api.async_register_command(hass, ws_plan_set)
+    websocket_api.async_register_command(hass, ws_plans_list)
+    websocket_api.async_register_command(hass, ws_plans_delete)
+    websocket_api.async_register_command(hass, ws_files_migrate)
+    websocket_api.async_register_command(hass, ws_files_cleanup)
+    websocket_api.async_register_command(hass, ws_content_sign)
+
+
+def _runtime(hass: HomeAssistant, connection, msg_id: int) -> HouseplanData | None:
+    """Runtime data of the loaded entry; answers `not_ready` when not set up.
+
+    The write_lock inside serializes every load→modify→save cycle of both
+    stores: without it parallel WS calls lose changes (last-writer-wins)
+    and the expected_rev check is not atomic.
+    """
+    data = get_data(hass)
+    if data is None:
+        connection.send_error(msg_id, "not_ready", "House Plan is not set up")
+    return data
+
+
+def _check_write(hass: HomeAssistant, connection) -> bool:
+    """May this connection write? Thin wrapper over the shared policy."""
+    return may_write(hass, getattr(connection, "user", None))
+
+
+# ---------------- layout ----------------
+
+
+@websocket_api.websocket_command({vol.Required("type"): "houseplan/layout/get"})
+@websocket_api.async_response
+async def ws_layout_get(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Return the saved layout."""
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    data = await rt.store.async_load() or {}
+    connection.send_result(
+        msg["id"], {"layout": data.get("layout", {}), "rev": int(data.get("rev", 0))}
+    )
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/layout/set",
+        vol.Required("layout"): LAYOUT_SCHEMA,
+        vol.Optional("expected_rev"): int,
+    }
+)
+@websocket_api.async_response
+async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Replace the layout entirely, with optimistic locking (audit B3).
+
+    Wholesale layout writes used to have no revision check at all, so two
+    clients silently overwrote each other. `expected_rev` is optional for
+    backwards compatibility with older cards, but when supplied it is enforced
+    exactly like the config store does.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
+        current_rev = int(data.get("rev", 0))
+        if "expected_rev" in msg and msg["expected_rev"] != current_rev:
+            connection.send_error(
+                msg["id"], "conflict", f"Layout changed elsewhere (rev {current_rev})"
+            )
+            return
+        new_rev = current_rev + 1
+        await rt.store.async_save({"layout": msg["layout"], "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/layout/update",
+        vol.Required("device_id"): str,
+        vol.Required("pos"): POS_SCHEMA,
+    }
+)
+@websocket_api.async_response
+async def ws_layout_update(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Update the position of a single device."""
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
+        layout = data.get("layout", {})
+        layout[msg["device_id"]] = msg["pos"]
+        # keep the revision: a point-wise write used to drop it, which made the
+        # optimistic locking on layout/set meaningless — every drag reset the
+        # counter to 0 (HP-1454-08)
+        new_rev = int(data.get("rev", 0)) + 1
+        await rt.store.async_save({"layout": layout, "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/files/migrate",
+        vol.Required("from_id"): str,
+        vol.Required("to_id"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_files_migrate(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """COPY a marker's uploaded files to its new id and report the exact mapping.
+
+    Rebinding changes the marker id, so the files must follow (that is how the
+    owner lost a set of manuals, 2026-07-26). This used to MOVE them before the
+    revision-checked config save: when that save was rejected, the server kept
+    the old urls while the files had already left the old folder — a permanent
+    broken link (review CR-2, 2026-07-27).
+
+    Now it copies, never overwrites, and returns {src: dst} for every file so
+    the client can rewrite EXACTLY the urls that made it (review CR-3). The old
+    folder is removed later by houseplan/files/cleanup, once the config is
+    safely committed.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit files")
+        return
+    import shutil
+    from pathlib import Path
+
+    from .const import FILES_DIR
+    from .validation import sanitize_marker_id
+
+    src_id = sanitize_marker_id(msg["from_id"])
+    dst_id = sanitize_marker_id(msg["to_id"])
+    if not src_id or not dst_id or src_id == dst_id:
+        connection.send_result(msg["id"], {"ok": True, "mapping": {}, "copied": 0})
+        return
+    base = Path(hass.config.path(FILES_DIR))
+    src = base / src_id
+    dst = base / dst_id
+
+    def _copy() -> dict[str, str]:
+        if not src.is_dir():
+            return {}
+        dst.mkdir(parents=True, exist_ok=True)
+        mapping: dict[str, str] = {}
+        for f in sorted(src.iterdir()):
+            if not f.is_file():
+                continue
+            # a different file may already own this name — do NOT silently point
+            # the url at it. The shared helper CLAIMS a free one atomically, so
+            # a concurrent migrate or upload cannot pick the same one, and the
+            # name it returns is one the content view accepts back in a request.
+            name = reserve_filename(dst, f.name)
+            target = dst / name
+            try:
+                shutil.copy2(str(f), str(target))
+            except OSError:
+                target.unlink(missing_ok=True)  # never leave an empty placeholder
+                raise
+            mapping[f.name] = name
+        return mapping
+
+    try:
+        mapping = await hass.async_add_executor_job(_copy)
+    except OSError as err:
+        connection.send_error(msg["id"], "io_error", f"Could not copy marker files: {err}")
+        return
+    connection.send_result(msg["id"], {"ok": True, "mapping": mapping, "copied": len(mapping)})
+
+
+@websocket_api.websocket_command({vol.Required("type"): "houseplan/plans/list"})
+@websocket_api.async_response
+async def ws_plans_list(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Plan images on the server, with what still uses them.
+
+    Files are never removed for being unreferenced (docs/SCOPE.md), which only
+    works as a policy if the user can see them: detaching a plan keeps the
+    image, and this is how it gets picked up again — or deleted on purpose.
+    """
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    stored = await rt.config_store.async_load() or {}
+    cfg = stored.get("config") or {}
+    used: dict[str, list[str]] = {}
+    for space in cfg.get("spaces") or []:
+        name = plan_basename(space.get("plan_url"))
+        if name:
+            used.setdefault(name, []).append(space.get("title") or space.get("id") or "?")
+
+    plans_dir = Path(hass.config.path(PLANS_DIR))
+
+    def _scan() -> list[dict[str, Any]]:
+        out: list[dict[str, Any]] = []
+        if not plans_dir.is_dir():
+            return out
+        for item in sorted(plans_dir.iterdir()):
+            if not item.is_file() or not is_plan_file(item.name):
+                continue
+            try:
+                st = item.stat()
+            except OSError:
+                continue
+            out.append({
+                "name": item.name,
+                "url": f"{CONTENT_URL}/plans/_/{item.name}",
+                "size": st.st_size,
+                "modified": int(st.st_mtime),
+                "used_by": used.get(item.name, []),
+            })
+        out.sort(key=lambda x: -x["modified"])
+        return out
+
+    connection.send_result(msg["id"], {"plans": await hass.async_add_executor_job(_scan)})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/plans/delete",
+        vol.Required("name"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_plans_delete(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Delete a plan image because the user asked — the only way one goes.
+
+    Refuses while a space still references it: the answer to "can I delete this"
+    is the stored configuration's, not the client's.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may delete plans")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    name = sanitize_filename(msg["name"])
+    if not is_plan_file(name):
+        connection.send_error(msg["id"], "invalid_name", "Not a plan file")
+        return
+
+    async with rt.write_lock:
+        stored = await rt.config_store.async_load() or {}
+        cfg = stored.get("config") or {}
+        if name in plan_refs(cfg):
+            connection.send_error(
+                msg["id"], "in_use", "A space still uses this plan — detach it first"
+            )
+            return
+        path = Path(hass.config.path(PLANS_DIR)) / name
+
+        def _rm() -> bool:
+            try:
+                path.unlink()
+                return True
+            except FileNotFoundError:
+                return False
+            except OSError as err:
+                _LOGGER.warning("House Plan: could not delete %s: %s", path, err)
+                return False
+
+        removed = await hass.async_add_executor_job(_rm)
+    connection.send_result(msg["id"], {"ok": True, "removed": removed})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/content/sign",
+        vol.Required("paths"): [str],
+    }
+)
+@websocket_api.async_response
+async def ws_content_sign(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Sign content paths so the BROWSER can fetch them.
+
+    Home Assistant authenticates HTTP requests by a Bearer header or an
+    `authSig` signed path — there is no cookie auth. An <image href> inside SVG
+    and a plain <a href> can send neither, so after the content endpoint became
+    `requires_auth` the plan backgrounds and PDF links returned 401 (audit
+    follow-up B1 regression, 2026-07-27 — reproduced live).
+
+    The card asks for signatures and uses the signed urls for display.
+    """
+    from datetime import timedelta
+
+    from homeassistant.components.http.auth import async_sign_path
+
+    out: dict[str, str] = {}
+    token_id = getattr(connection, "refresh_token_id", None)
+    for path in msg["paths"][:MAX_SIGN_PATHS]:
+        if not isinstance(path, str) or not path.startswith(CONTENT_URL + "/"):
+            continue  # only ever sign our own content endpoint
+        clean = path.split("?", 1)[0]
+        try:
+            try:
+                signed = async_sign_path(hass, clean, timedelta(hours=24), refresh_token_id=token_id)
+            except TypeError:  # older HA signature: (hass, refresh_token_id, path, expiration)
+                signed = async_sign_path(hass, token_id, clean, timedelta(hours=24))
+        except Exception as err:  # noqa: BLE001 — signing must never break the card
+            _LOGGER.warning("House Plan: could not sign %s: %s", clean, err)
+            continue
+        out[path] = signed
+    connection.send_result(msg["id"], {"urls": out})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/files/cleanup",
+        vol.Required("marker_id"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_files_cleanup(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Drop a marker folder's leftovers after its files moved elsewhere.
+
+    Called after a rebind: the files were copied to the new marker id and the
+    config that references them is committed, so the source folder is spent.
+
+    It used to `rmtree` the folder on the client's word alone. Two ways that
+    ends badly: a partial copy leaves some urls still pointing INTO this folder
+    (the migration deliberately does not rewrite those), and a wrong or stale
+    id from any client deletes a live marker's attachments outright. So the
+    server checks for itself — under the config lock — and removes only files
+    the stored configuration does not reference. Same principle as the
+    collector: a client may say what it no longer needs, never what may go.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit files")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    from .const import FILES_DIR
+    from .plans import attachment_refs
+    from .validation import sanitize_marker_id
+
+    mid = sanitize_marker_id(msg["marker_id"])
+    base = Path(hass.config.path(FILES_DIR)).resolve()
+    target = (base / mid).resolve() if mid else base
+    if not mid or not str(target).startswith(str(base)) or target == base:
+        connection.send_result(msg["id"], {"ok": True, "removed": 0, "kept": 0})
+        return
+
+    async with rt.write_lock:
+        stored = await rt.config_store.async_load() or {}
+        refs = attachment_refs(stored.get("config") or {})
+
+        def _rm() -> tuple[int, int]:
+            if not target.is_dir():
+                return 0, 0
+            removed = kept = 0
+            for item in sorted(target.iterdir()):
+                if not item.is_file():
+                    continue
+                if f"{mid}/{item.name}" in refs:
+                    kept += 1
+                    continue
+                try:
+                    item.unlink()
+                    removed += 1
+                except OSError as err:
+                    _LOGGER.warning("House Plan: could not remove %s: %s", item, err)
+            if not kept:
+                try:
+                    target.rmdir()
+                except OSError:
+                    pass
+            return removed, kept
+
+        removed, kept = await hass.async_add_executor_job(_rm)
+    if kept:
+        _LOGGER.info(
+            "House Plan: kept %s file(s) in %s — the configuration still references them", kept, mid
+        )
+    connection.send_result(msg["id"], {"ok": True, "removed": removed, "kept": kept})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/layout/delete",
+        vol.Required("device_id"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_layout_delete(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Delete the position of a single device (cleanup when a marker is removed)."""
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    new_rev: int | None = None
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
+        layout = data.get("layout", {})
+        if msg["device_id"] in layout:
+            del layout[msg["device_id"]]
+            new_rev = int(data.get("rev", 0)) + 1
+            await rt.store.async_save({"layout": layout, "rev": new_rev})
+    if new_rev is not None:
+        hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
+
+
+# ---------------- space configuration ----------------
+
+
+@websocket_api.websocket_command({vol.Required("type"): "houseplan/config/get"})
+@websocket_api.async_response
+async def ws_config_get(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Return the configuration and its revision."""
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    data = await rt.config_store.async_load() or {}
+    config = {**DEFAULT_CONFIG, **data.get("config", {})}
+    connection.send_result(msg["id"], {"config": config, "rev": data.get("rev", 0)})
+
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/config/set",
+        vol.Required("config"): CONFIG_SCHEMA,
+        vol.Optional("expected_rev"): int,
+    }
+)
+@websocket_api.async_response
+async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Replace the configuration with optimistic locking (expected_rev).
+
+    Protects against races between several open clients: if the config has changed since
+    the client's last read — a conflict error is returned, and the client must
+    re-read the config and re-apply its edit on top of the fresh version.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the configuration")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    # Per-field limits bound each list; this bounds their product (HP-1454-05).
+    # Everything below the caps can still add up to something no dashboard can
+    # render, and the store writes it to disk on every save.
+    size = len(json.dumps(msg["config"], separators=(",", ":")))
+    if size > MAX_CONFIG_BYTES:
+        connection.send_error(
+            msg["id"], "too_large",
+            f"Configuration is {size // 1024} KB, the limit is {MAX_CONFIG_BYTES // 1024} KB",
+        )
+        return
+    async with rt.write_lock:
+        data = await rt.config_store.async_load() or {}
+        current_rev = data.get("rev", 0)
+        if "expected_rev" not in msg and current_rev:
+            # audit B4: expected_rev stays optional for old cards mid-upgrade,
+            # but a blind overwrite of a non-empty store is worth a warning —
+            # it is exactly how a stale client silently discards someone's work.
+            _LOGGER.warning(
+                "House Plan: config/set without expected_rev over rev %s — "
+                "the client bypasses conflict detection (outdated card?)",
+                current_rev,
+            )
+        if "expected_rev" in msg and msg["expected_rev"] != current_rev:
+            connection.send_error(
+                msg["id"], "conflict",
+                f"Configuration was changed in another window (rev {current_rev} != {msg['expected_rev']})",
+            )
+            return
+        new_rev = current_rev + 1
+        await rt.config_store.async_save({"config": msg["config"], "rev": new_rev})
+        # Still holding the lock: the file system is not part of the store's
+        # transaction, so collection has to be pinned to this commit (R3-1).
+        # It is best-effort housekeeping behind an already durable write — a
+        # failure here must not withhold the event and the success response,
+        # or the client retries an edit the server has already accepted and
+        # gets a conflict for its trouble (R4-1).
+        def _collect() -> None:
+            collect_plans(Path(hass.config.path(PLANS_DIR)), data.get("config"), msg["config"])
+            collect_attachments(Path(hass.config.path(FILES_DIR)), data.get("config"), msg["config"])
+
+        try:
+            await hass.async_add_executor_job(_collect)
+        except Exception:  # noqa: BLE001 — see above: the commit stands regardless
+            _LOGGER.exception("House Plan: collecting superseded files failed")
+    hass.bus.async_fire("houseplan_config_updated", {"rev": new_rev})
+    # refresh repair issues (broken plan references) without waiting for a restart
+    entry = get_entry(hass)
+    if entry is not None:
+        from .repairs import async_check_plan_files
+
+        hass.async_create_task(async_check_plan_files(hass, entry))
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
+
+
+# ---------------- plan uploads ----------------
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/plan/set",
+        vol.Required("space_id"): str,
+        vol.Required("ext"): vol.In(sorted(PLAN_EXTENSIONS)),
+        vol.Required("data"): str,  # base64
+    }
+)
+@websocket_api.async_response
+async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Save a space plan file; return the URL for the card."""
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may upload plans")
+        return
+    space_id = msg["space_id"]
+    if not valid_space_id(space_id):
+        connection.send_error(msg["id"], "invalid_space_id", "space_id: only [a-z0-9_-], up to 64 characters")
+        return
+    try:
+        raw = base64.b64decode(msg["data"], validate=True)
+    except (binascii.Error, ValueError):
+        connection.send_error(msg["id"], "invalid_data", "data must be valid base64")
+        return
+    if len(raw) > MAX_PLAN_BYTES:
+        connection.send_error(msg["id"], "too_large", f"Plan is larger than {MAX_PLAN_BYTES // 1024 // 1024} MB")
+        return
+
+    # Copy-on-write: a plan is written under a NEW unique name and nothing is
+    # deleted here (review R2-1). The old name stays readable, so a config write
+    # that is later rejected — revision conflict, validation, lost connection —
+    # leaves the stored plan exactly as it was. The card calls
+    # nothing here; the file a commit REPLACES is collected by `config/set`
+    # itself, inside the write lock (review R3-1). An upload that never gets
+    # committed is not collected at all — it is offered back in the space
+    # dialog's "already uploaded" list, where the user can attach or delete it.
+    # Every attempt to age these out ended in data loss or a race (v1.46.4-6).
+    #
+    # `.` separates the id from the token because a space id cannot contain one
+    # (SPACE_ID_RE), so "<space>.<token>.<ext>" can never be confused with the
+    # files of a differently named space.
+    plans_dir = Path(hass.config.path(PLANS_DIR))
+    name = f"{space_id}.{secrets.token_hex(4)}.{msg['ext']}"
+    path = plans_dir / name
+
+    def _write() -> None:
+        plans_dir.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(raw)
+
+    await hass.async_add_executor_job(_write)
+    connection.send_result(msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{name}"})

demo/README.md

@@ -0,0 +1,17 @@
+# Synthetic demo home
+
+A fully fictional house (plans, devices, states) used for README screenshots,
+the demo GIF and headless smoke tests — so no real home data ever appears in
+public materials.
+
+- `srv/demo.html` — self-contained host page: `<ha-icon>`/`<ha-card>` stubs and a
+  fake `hass` (registries, states, `callWS`, `callService`, floors).
+- `srv/assets/` — generated plan SVGs and `icons.js` (`node demo/gen_icons.mjs`,
+  needs the repo's devDependencies). The card bundle is copied from `dist/`:
+  `cp dist/houseplan-card.js demo/srv/assets/`.
+- `serve.mjs` — playwright launcher (route interception, no web server).
+- `smoke_*.mjs` — feature smoke tests; run with a Chromium installed via
+  `PLAYWRIGHT_BROWSERS_PATH=<dir> npx playwright install chromium-headless-shell`.
+
+Note for sandboxed sessions: `/tmp` does not survive; this directory is the
+persistent home of the harness (docs/DEVELOPMENT.md has the LD_LIBRARY_PATH recipe).

demo/dbg_click.mjs

@@ -0,0 +1,43 @@
+import { launch } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  // glow на текущем пространстве
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
+  c.requestUpdate(); await c.updateComplete;
+  out.mode = c._mode;
+  out.suppress = c._suppressClick;
+  out.holdFired = c._holdFired;
+  out.drag = !!c._drag;
+  // реальный клик по включённой лампе (элемент .dev)
+  const litDev = c._devices.find((d) => d.space === c._space && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on'));
+  out.hasLit = !!litDev;
+  const el = [...sr().querySelectorAll('.dev')].find((e) => e.textContent.includes(litDev.name) || true);
+  // найдём элемент точно: по индексу устройства
+  const devEls = [...sr().querySelectorAll('.dev')];
+  out.devCount = devEls.length;
+  const target = devEls[c._devices.filter((d) => d.space === c._space).indexOf(litDev)] || devEls[0];
+  const before = calls.length;
+  c._infoCard = null;
+  // эмулируем полный цикл: pointerdown/up + click
+  const opts = { bubbles: true, composed: true };
+  target.dispatchEvent(new PointerEvent('pointerdown', { ...opts, pointerId: 5 }));
+  target.dispatchEvent(new PointerEvent('pointerup', { ...opts, pointerId: 5 }));
+  target.dispatchEvent(new MouseEvent('click', opts));
+  await c.updateComplete;
+  out.reaction = calls.length > before ? 'service:' + JSON.stringify(calls.at(-1)) : c._infoCard ? 'info' : 'NOTHING';
+  out.suppressAfter = c._suppressClick;
+  // и через прямой вызов
+  c._infoCard = null;
+  c._clickDevice(new MouseEvent('click'), litDev);
+  await c.updateComplete;
+  out.directReaction = calls.length > before + 1 ? 'service' : c._infoCard ? 'info' : 'NOTHING';
+  return out;
+});
+console.log(JSON.stringify(res, null, 1));
+await browser.close();

demo/gen_icons.mjs

@@ -0,0 +1,22 @@
+// Generate demo/srv/assets/icons.js: an { "mdi:name": "<svg path>" } map for every
+// mdi: icon referenced in src/ and demo/ (the demo host stubs <ha-icon> with it).
+import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
+import * as mdi from '@mdi/js';
+
+const names = new Set();
+const scan = (dir) => {
+  for (const f of readdirSync(dir, { withFileTypes: true })) {
+    if (f.isDirectory()) { scan(`${dir}/${f.name}`); continue; }
+    if (!/\.(ts|json|html|mjs)$/.test(f.name) || f.name === 'icons.js') continue;
+    const txt = readFileSync(`${dir}/${f.name}`, 'utf8');
+    for (const m of txt.matchAll(/mdi:([a-z0-9-]+)/g)) names.add(m[1]);
+  }
+};
+scan('src'); scan('demo');
+const map = {};
+for (const n of [...names].sort()) {
+  const camel = 'mdi' + n.replace(/(^|-)(\w)/g, (_, __, c) => c.toUpperCase());
+  if (mdi[camel]) map['mdi:' + n] = mdi[camel];
+}
+writeFileSync('demo/srv/assets/icons.js', 'window.__ICONS=' + JSON.stringify(map) + ';\n');
+console.log('icons:', Object.keys(map).length, 'of', names.size, 'referenced');

demo/repro_issue3.mjs

@@ -0,0 +1,25 @@
+// Репро №3: пользовательский путь — открыть диалог, выставить «комфорт от 25», сохранить
+import { launch } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // living room: единственный термометр 22.4 → подменим на 24.0 как у пользователя
+  const h = window.__mkHass();
+  h.states = { ...h.states, 'sensor.living_temp': { ...h.states['sensor.living_temp'], state: '24.0' } };
+  c.hass = h; c._regSignature=''; c._maybeRebuildDevices(); await c.updateComplete;
+  // путь пользователя: диалог → режим temp, min=25 (макс не трогаем) → сохранить
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  out.dialogInit = { min: c._spaceDialog.tempMin, max: c._spaceDialog.tempMax, fill: c._spaceDialog.fillMode };
+  c._spaceDialog = { ...c._spaceDialog, fillMode: 'temp', tempMin: 25 };
+  await c._saveSpaceDialog(); await c.updateComplete;
+  const sp = c._serverCfg.spaces.find(s=>s.id==='f1');
+  out.savedSettings = sp.settings;
+  const styles = [...sr().querySelectorAll('.room.styled')].map(r => (r.getAttribute('style')||'').match(/--room-fill:([^;]+)/)?.[1]);
+  out.livingFill = styles[0];
+  out.expected = '#4fc3f7 (blue: 24 < 25)';
+  return out;
+});
+console.log(JSON.stringify(res, null, 1));
+await browser.close();

demo/serve.mjs

@@ -0,0 +1,63 @@
+// Shared launcher for demo captures: starts headless Chromium serving demo/srv/
+// via request interception (no HTTP server needed). Usage: const {page,browser}=await launch();
+import { chromium } from 'playwright';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+const ROOT = dirname(fileURLToPath(import.meta.url)) + '/srv';
+const CT = { '.html': 'text/html', '.js': 'text/javascript', '.svg': 'image/svg+xml' };
+// ---- assertion harness (audit T1) --------------------------------------
+// Until 2026-07-27 the smokes printed booleans and always exited 0: a broken
+// build reported success. `check()` accumulates named failures, `finish()`
+// prints them and sets the exit code.
+const _failures = [];
+let _pageErrors = 0;
+
+/** Assert one named fact. `expected` defaults to true. */
+export function check(name, actual, expected = true) {
+  const ok = JSON.stringify(actual) === JSON.stringify(expected);
+  if (!ok) _failures.push(`${name}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  return ok;
+}
+
+/** Assert a whole result object: every key must equal true unless listed. */
+export function checkAll(out, expected = {}) {
+  for (const [k, v] of Object.entries(out)) check(k, v, k in expected ? expected[k] : true);
+  return out;
+}
+
+/** Print the result, report failures, close the browser, set the exit code. */
+export async function finish(browser, out) {
+  if (out !== undefined) console.log(JSON.stringify(out, null, 1));
+  if (_pageErrors) _failures.push(`${_pageErrors} uncaught exception(s) inside the card`);
+  await browser?.close?.();
+  if (_failures.length) {
+    console.error('\nFAILED (' + _failures.length + '):');
+    for (const f of _failures) console.error('  - ' + f);
+    process.exitCode = 1;
+  } else {
+    console.log('OK');
+  }
+}
+
+export async function launch(viewport = { width: 820, height: 760 }, scale = 1) {
+  const browser = await chromium.launch({ args: ['--no-sandbox'] });
+  const page = await (await browser.newContext({ viewport, deviceScaleFactor: scale })).newPage();
+  // audit T1: an exception inside the card used to be logged and ignored
+  page.on('pageerror', (e) => { _pageErrors++; console.log('EXC', e.message); });
+  await page.route('**/*', (r) => {
+    const u = new URL(r.request().url());
+    let p = decodeURIComponent(u.pathname);
+    if (p === '/') p = '/demo.html';
+    const f = ROOT + p;
+    existsSync(f)
+      ? r.fulfill({ status: 200, headers: { 'content-type': CT[p.slice(p.lastIndexOf('.'))] || 'application/octet-stream' }, body: readFileSync(f) })
+      : r.fulfill({ status: 404, body: 'nf' });
+  });
+  await page.goto('http://demo.local/demo.html', { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(() => window.__card?._model?.length > 0, { timeout: 9000 });
+  // hass flows continuously in production; the stub sets it once — nudge a rebuild
+  await page.evaluate(() => { const c = window.__card; c.hass = { ...c.hass }; });
+  await page.waitForFunction(() => window.__card._devices.length > 0, { timeout: 9000 });
+  return { page, browser };
+}

demo/smoke_align_guides.mjs

@@ -0,0 +1,56 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const g = c._gridPitch;
+  const guides = () => sr().querySelectorAll('.alignline').length;
+  // 1) рисование контура: курсор на одном X с вершиной комнаты → гид
+  c._setMode('plan'); c._tool = 'draw'; await c.updateComplete;
+  const r1 = c._spaceModel().rooms.find((r) => r.id === 'r1');
+  const poly = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
+  const v = poly[0];
+  c._path = [[v[0] + g * 10, v[1] + g * 10]];
+  c._cursorPt = [v[0], v[1] + g * 20]; // тот же X, что у вершины
+  c.requestUpdate(); await c.updateComplete;
+  out.drawGuide = guides() >= 1;
+  out.dot = sr().querySelectorAll('.aligndot').length >= 1;
+  // нет выравнивания → нет гидов
+  c._cursorPt = [v[0] + g * 7 + 1.7, v[1] + g * 13 + 2.3]; c.requestUpdate(); await c.updateComplete;
+  out.noGuideOffAxis = guides() === 0;
+  // 2) бейдж угла: 45° красит
+  c._cursorPt = [c._path[0][0] + g * 5, c._path[0][1] + g * 5]; c.requestUpdate(); await c.updateComplete;
+  const ml = sr().querySelector('.measurelabel');
+  out.badge45 = !!ml && ml.classList.contains('on45') && ml.textContent.includes('45');
+  c._cursorPt = [c._path[0][0] + g * 5, c._path[0][1] + g * 2]; c.requestUpdate(); await c.updateComplete;
+  const ml2 = sr().querySelector('.measurelabel');
+  out.badgeOff45 = !!ml2 && !ml2.classList.contains('on45') && ml2.textContent.includes('°');
+  c._path = []; c._cursorPt = null;
+  // 3) редактор устройств: drag значка в линию с другим значком
+  c._setMode('devices'); await c.updateComplete;
+  const devs = c._devices.filter((d) => d.space === c._space);
+  const a = devs[0], b = devs[1];
+  const pa = c._pos(a);
+  // поставим b на тот же Y, начнём drag
+  c._layout = { ...c._layout, [b.id]: { s: c._space, x: (pa.x + g * 12) / 1000, y: pa.y / (1000 / (c._curSpaceCfg.aspect || 1)) } };
+  c._drag = { id: b.id, sx: 0, sy: 0, ox: 0, oy: 0, moved: true };
+  c.requestUpdate(); await c.updateComplete;
+  out.devGuide = guides() >= 1;
+  c._drag = null; c.requestUpdate(); await c.updateComplete;
+  out.devGuideGone = guides() === 0;
+  // 4) подложка: рисование прямоугольника с углом на одном X с углом другой фигуры
+  c._setMode('decor'); await c.updateComplete;
+  c._curSpaceCfg.decor = [{ id: 'd1', kind: 'rect', x: 0.2, y: 0.2, w: 0.1, h: 0.1, color: '#ff0000', width: 3 }];
+  const W = 1000, H = 1000 / (c._curSpaceCfg.aspect || 1);
+  c._decorDraft = { kind: 'rect', a: [0.5 * W, 0.5 * H], b: [0.2 * W, 0.6 * H], pid: 9 }; // b.x == углу d1
+  c.requestUpdate(); await c.updateComplete;
+  out.decorGuide = guides() >= 1;
+  c._decorDraft = null; c._curSpaceCfg.decor = []; c.requestUpdate(); await c.updateComplete;
+  // 5) в Просмотре гидов не бывает
+  c._setMode('view'); await c.updateComplete;
+  out.noneInView = guides() === 0;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_binding_ui.mjs

@@ -0,0 +1,50 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('devices'); await c.updateComplete;
+  // новый маркер: радио «Виртуальное» по умолчанию, списка нет
+  c._openMarkerDialog(); await c.updateComplete;
+  const radios = () => [...sr().querySelectorAll('.bindsel input[type="radio"]')];
+  out.twoRadios = radios().length === 2;
+  out.virtDefault = radios()[0].checked && !radios()[1].checked;
+  out.noDropWhenVirtual = !sr().querySelector('.dropbtn');
+  // переключить на «Из списка HA» → появляется дропдаун, открыт (нет выбора), сейв заблокирован
+  radios()[1].click(); await c.updateComplete;
+  out.dropShown = !!sr().querySelector('.dropbtn');
+  out.panelOpen = !!sr().querySelector('.droppanel');
+  const saveBtn = [...sr().querySelectorAll('.dialog .btn.on')].pop();
+  out.saveDisabled = saveBtn?.disabled === true;
+  // без чекбокса в списке нет individual-сущностей устройств
+  const subs = () => [...sr().querySelectorAll('.cand .cs')].map((e) => e.textContent);
+  const entLabel = c._t('marker.sub_entity');
+  out.noDeviceEntities = !subs().some((s) => s.includes(entLabel));
+  // (группы/хелперы в демо все уже размещены и потому скрыты как занятые —
+  // их «всегда в списке» проверяется кодом: блок вне чекбокса)
+  // включить чекбокс → сущности появились
+  const cb = sr().querySelector('.entcheck input');
+  cb.click(); await c.updateComplete;
+  out.entitiesShown = [...sr().querySelectorAll('.cand .cs')].some((s) => s.textContent.includes(entLabel));
+  out.tooltip = sr().querySelector('.entcheck').getAttribute('title') === c._t('marker.show_entities_tip');
+  // выбрать первый кандидат → панель закрылась, сейв разблокирован
+  sr().querySelector('.cand').click(); await c.updateComplete;
+  out.picked = c._markerDialog.binding !== '' && c._markerDialog.binding !== 'virtual';
+  out.panelClosed = !sr().querySelector('.droppanel');
+  out.saveEnabled = [...sr().querySelectorAll('.dialog .btn.on')].pop()?.disabled === false;
+  // радио назад на «Виртуальное» → binding=virtual
+  radios()[0].click(); await c.updateComplete;
+  out.backToVirtual = c._markerDialog.binding === 'virtual' && c._markerDialog.bindingMode === 'virtual';
+  c._markerDialog = null; await c.updateComplete;
+  // редактирование существующего устройства: радио «Из списка», выбранная привязка в кнопке
+  const dev = c._devices.find((d) => !d.virtual && d.bindingKind === 'device');
+  c._openMarkerDialog(dev); await c.updateComplete;
+  out.editHaMode = c._markerDialog.bindingMode === 'ha';
+  out.editShowsCur = sr().querySelector('.dropbtn b') !== null;
+  out.editPanelClosed = !sr().querySelector('.droppanel');
+  c._markerDialog = null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_card_controls.mjs

@@ -0,0 +1,44 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  // устройство с управляемой сущностью
+  const dev = c._devices.find((d) => d.entities?.some((e) => e.startsWith('light.') || e.startsWith('switch.')));
+  out.hasDev = !!dev;
+  c._infoCard = dev; await c.updateComplete;
+  // 1) блок сущностей идёт ПЕРВЫМ, до модели/ссылок
+  const body = sr().querySelector('.dialog .body');
+  out.entListFirst = body.firstElementChild?.classList.contains('entlist')
+    || body.querySelector('.entlist') === body.children[0];
+  const rows = [...sr().querySelectorAll('.entrow')];
+  out.rows = rows.length > 0;
+  // 2) у переключаемой сущности — кнопка с крупной зоной нажатия
+  const btn = sr().querySelector('.entbtn');
+  out.hasButton = !!btn;
+  const box = btn?.getBoundingClientRect();
+  out.tapTarget = box ? box.height >= 30 && box.width >= 60 : null;
+  // 3) кнопка реально переключает
+  const before = calls.length;
+  btn.click(); await c.updateComplete;
+  out.toggles = calls.length > before && calls.at(-1)[1] === 'toggle';
+  // 4) замок никогда не переключается из карточки
+  const n = calls.length;
+  c._cardToggle('lock.front_door');
+  out.lockNeverToggles = calls.length === n;
+  // 5) диагностические/конфиг-сущности не засоряют список
+  const ents = c._cardEntities(dev).map((e) => e.eid);
+  out.noConfigEntities = ents.every((e) => {
+    const cat = c.hass.entities[e]?.entity_category;
+    return cat !== 'config' && cat !== 'diagnostic';
+  });
+  c._infoCard = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_card_tool_conflict.mjs

@@ -0,0 +1,51 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); await c.updateComplete;
+  const stage = sr().querySelector('.stage');
+  const label = sr().querySelector('.roomlabel');
+  out.hasLabel = !!label;
+  // 1) draw: клик по карточке не добавляет точку
+  c._tool = 'draw'; c._path = []; await c.updateComplete;
+  label.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true, clientX: 10, clientY: 10 }));
+  await c.updateComplete;
+  out.drawIgnored = c._path.length === 0;
+  // 2) клик по угловой метке тоже не считается кликом инструмента
+  const handle = label.querySelector('.rlhandle');
+  handle.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true, clientX: 10, clientY: 10 }));
+  await c.updateComplete;
+  out.handleIgnored = c._path.length === 0;
+  // 3) во время резайза клики по сцене игнорируются
+  const room = c._spaceModel().rooms.find((r) => r.name);
+  c._rlResize = { id: 'rl_' + room.id, space: c._space, k0: 1, cx: 0, cy: 0, d0: 50 };
+  const before = c._path.length;
+  c._markupClick(new MouseEvent('click', { bubbles: true, clientX: 200, clientY: 200 }));
+  out.duringResizeIgnored = c._path.length === before;
+  c._rlResize = null;
+  // 4) обычный клик по сцене (мимо карточки) по-прежнему работает — точка ставится
+  const r = stage.getBoundingClientRect();
+  // найти долю экрана, попадающую в свободное место (не внутри комнаты)
+  let fx = 0.4, fy = 0.4;
+  outer: for (let ix = 1; ix < 20; ix++) for (let iy = 1; iy < 20; iy++) {
+    const ev = new MouseEvent('click', { clientX: r.left + r.width * ix / 20, clientY: r.top + r.height * iy / 20 });
+    const raw = c._svgPoint(ev);
+    if (!c._roomAt(c._snap(raw))) { fx = ix / 20; fy = iy / 20; break outer; }
+  }
+  stage.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true,
+    clientX: r.left + r.width * fx, clientY: r.top + r.height * fy }));
+  await c.updateComplete;
+  out.normalClickWorks = c._path.length === 1;
+  // 5) delroom: клик по карточке не зовёт confirm (переопределим)
+  let confirmCalled = false;
+  window.confirm = () => { confirmCalled = true; return false; };
+  c._tool = 'delroom'; c._path = []; await c.updateComplete;
+  label.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true, clientX: 10, clientY: 10 }));
+  await c.updateComplete;
+  out.delroomIgnored = !confirmCalled;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_climate_once.mjs

@@ -0,0 +1,76 @@
+// Ревью R2-3: климат комнат считался отдельным обходом реестра на каждую
+// комнату и каждую величину — 60 комнат × 2000 сущностей съедали кадр на
+// перечитывании метаданных, которые не менялись. Карта строится один раз на
+// снимок hass; при этом новые состояния датчиков обязаны попадать в неё сразу.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+
+  // считаем обходы реестра через ownKeys — именно его дёргает Object.entries
+  let scans = 0;
+  const wrap = (h) => {
+    const ents = h.entities;
+    const traced = new Proxy(ents, { ownKeys(t) { scans++; return Reflect.ownKeys(t); } });
+    return { ...h, entities: traced };
+  };
+  const fresh = () => wrap(window.__mkHass());
+
+  // включаем и заливку по температуре, и подписи — два потребителя климата
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, settings: { ...(s.settings || {}), show_names: true, fill_mode: 'temp', label_temp: true, label_hum: true },
+  })};
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  const fewRooms = scans;
+
+  // повторные рендеры на том же снимке hass реестр не трогают
+  scans = 0;
+  c.requestUpdate(); await c.updateComplete;
+  c.requestUpdate(); await c.updateComplete;
+  out.scansOnRerender = scans;
+
+  // главный инвариант: обходов НЕ становится больше от числа комнат
+  const f1 = c._serverCfg.spaces.find((s) => s.id === 'f1');
+  const extra = [];
+  for (let i = 0; i < 40; i++) {
+    extra.push({ id: 'gen' + i, name: 'R' + i, area: 'living_room',
+      poly: [[0.01, 0.01], [0.02, 0.01], [0.02, 0.02], [0.01, 0.02]] });
+  }
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) =>
+    s.id !== 'f1' ? s : { ...s, rooms: [...s.rooms, ...extra] }) };
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  out.roomCount = c._spaceModel('f1').rooms.length;
+  out.scansSameWith44Rooms = scans === fewRooms;
+  out.scansPerUpdate = scans;
+
+  // при этом новое состояние датчика обязано быть видно, а не взято из кэша
+  out.tempBefore = c._climate().get('living_room')?.temp;
+  const h = fresh();
+  h.states = { ...h.states, 'sensor.living_temp': { ...h.states['sensor.living_temp'], state: '33.3' } };
+  c.hass = h; await c.updateComplete;
+  out.tempAfter = c._climate().get('living_room')?.temp;
+  out.climateIsMap = c._climate() instanceof Map;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом.
+// scansPerUpdate = 2: один обход у areaClimateMap, один у buildDevices. Важно
+// не само число, а что оно не растёт вместе с числом комнат.
+checkAll(res, {
+  scansOnRerender: 0,
+  roomCount: 44,
+  scansSameWith44Rooms: true,
+  scansPerUpdate: 2,
+  tempBefore: 22.4,
+  tempAfter: 33.3,
+  climateIsMap: true,
+});
+await finish(browser);

demo/smoke_config_writer.mjs

@@ -0,0 +1,67 @@
+// HP-1454-03: две локальные правки уходили с одной ревизией, вторая терялась.
+// Debounce разносил только СТАРТЫ. Если первый config/set отвечал дольше 500 мс,
+// вторая правка уходила с тем же expected_rev, сервер принимал первую и
+// отклонял вторую как conflict — а обработчик конфликта перечитывал серверную
+// копию поверх локальной. Правка исчезала, и тост винил «другое окно».
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const writes = [];
+  let rev = 10;
+  let releaseFirst;
+  const firstGate = new Promise((r) => { releaseFirst = r; });
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/set') {
+      const n = writes.length + 1;
+      writes.push({ expected: m.expected_rev, titles: m.config.spaces.map((s) => s.title) });
+      if (n === 1) await firstGate;                  // первый ответ задержан
+      if (m.expected_rev !== rev) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      rev += 1;
+      return { ok: true, rev };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { config: JSON.parse(JSON.stringify(r.config)), rev };
+    }
+    return base(m);
+  } };
+  c._cfgRev = rev;
+
+  // правка №1 и, пока первая запись висит, правка №2
+  c._serverCfg.spaces[0].title = 'FIRST';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.oneInFlight = writes.length === 1;
+
+  c._serverCfg.spaces[0].title = 'SECOND';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.stillOneInFlight = writes.length === 1;   // вторая ждёт очереди, не летит параллельно
+
+  releaseFirst();
+  await new Promise((r) => setTimeout(r, 120));
+
+  out.writes = writes.length;
+  out.revisions = writes.map((w) => w.expected);          // вторая обязана взять новую ревизию
+  out.secondCarriedTheEdit = writes[1]?.titles[0] === 'SECOND';
+  out.editSurvived = c._serverCfg.spaces[0].title === 'SECOND';
+  out.noConflictToast = !(c._toast || '').length;
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  oneInFlight: true,
+  stillOneInFlight: true,
+  writes: 2,
+  revisions: [10, 11],
+  secondCarriedTheEdit: true,
+  editSurvived: true,
+  noConflictToast: true,
+});
+await finish(browser);

demo/smoke_controls.mjs

@@ -0,0 +1,61 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  // два подопытных light-entity
+  const lights = Object.keys(c.hass.states).filter((e) => e.startsWith('light.')).slice(0, 2);
+  out.twoLights = lights.length === 2;
+  const setSt = async (m) => {
+    const st = { ...c.hass.states };
+    for (const [e, v] of Object.entries(m)) st[e] = { ...st[e], state: v };
+    c.hass = { ...c.hass, states: st }; await c.updateComplete;
+  };
+  // виртуальный маркер-выключатель с controls и tap_action=toggle
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog();
+  const room = c._spaceModel().rooms.find((r) => r.id && r.area);
+  c._markerDialog = { ...c._markerDialog, name: 'Выключатель', binding: 'virtual',
+    room: c._space + '#' + room.area, tapAction: 'toggle', controls: lights, icon: 'mdi:light-switch' };
+  await c._saveMarker(); await c.updateComplete;
+  const dev = c._devices.find((d) => d.name === 'Выключатель');
+  out.markerSaved = !!dev && JSON.stringify(dev.marker.controls) === JSON.stringify(lights);
+  c._setMode('view'); await c.updateComplete;
+  // 1) все выключены → клик включает все
+  await setSt({ [lights[0]]: 'off', [lights[1]]: 'off' });
+  const dev2 = () => c._devices.find((d) => d.name === 'Выключатель');
+  c._clickDevice(new MouseEvent('click'), dev2());
+  out.turnOnAll = JSON.stringify(calls.at(-1)) === JSON.stringify(['homeassistant', 'turn_on', lights]);
+  // 2) частично включено → клик выключает все
+  await setSt({ [lights[0]]: 'on', [lights[1]]: 'off' });
+  c._clickDevice(new MouseEvent('click'), dev2());
+  out.partialTurnsOff = JSON.stringify(calls.at(-1)) === JSON.stringify(['homeassistant', 'turn_off', lights]);
+  // 3) значок отражает цели: горит одна → класс on
+  const el = [...sr().querySelectorAll('.dev')].find((e) => e.title === 'Выключатель' || e.textContent.includes(''));
+  out.stateOn = !!c._stateClass(dev2()).includes('on');
+  await setSt({ [lights[0]]: 'off' });
+  out.stateOff = c._stateClass(dev2()) === '';
+  // 4) без tap_action=toggle клик НЕ переключает (инфо)
+  const cfg = c._serverCfg.markers.find((m) => m.name === 'Выключатель');
+  cfg.tap_action = 'info'; c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  const n = calls.length;
+  c._clickDevice(new MouseEvent('click'), dev2());
+  out.infoNoToggle = calls.length === n && !!c._infoCard;
+  // 5) инфо-карточка показывает цели
+  await c.updateComplete;
+  out.infoListsTargets = sr().querySelectorAll('.ctrlstate').length === 2;
+  c._infoCard = null; await c.updateComplete;
+  // 6) замок в controls отфильтрован при клике (защита)
+  cfg.tap_action = 'toggle'; cfg.controls = ['lock.front_door', lights[0]];
+  c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  await setSt({ [lights[0]]: 'off' });
+  c._clickDevice(new MouseEvent('click'), dev2());
+  const last = calls.at(-1);
+  out.lockFiltered = JSON.stringify(last) === JSON.stringify(['homeassistant', 'turn_on', [lights[0]]]);
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_decor.mjs

@@ -0,0 +1,74 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const esc = async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' })); await c.updateComplete; };
+  // 1) третья вкладка есть
+  const tabs = [...sr().querySelectorAll('.modetab')];
+  out.threeTabs = tabs.length === 3;
+  tabs[2].click(); await c.updateComplete;
+  out.decorMode = c._mode === 'decor';
+  out.decorBar = !!sr().querySelector('.editbar.decorbar');
+  out.toolBtns = sr().querySelectorAll('.decorbar .btn:not(.barclose)').length === 6;
+  // 2) нарисовать прямоугольник drag-ом (через прямые вызовы)
+  c._decorTool = 'rect'; c._decorStyle = { color: '#ff0000', width: 3, fill: true }; await c.updateComplete;
+  const g = c._gridPitch;
+  c._decorDraft = { kind: 'rect', a: [g * 10, g * 10], b: [g * 10, g * 10], pid: 1 };
+  c._decorDraft = { ...c._decorDraft, b: [g * 20, g * 16] };
+  await c.updateComplete;
+  out.draftPreview = !!sr().querySelector('.ddraft');
+  c._decorCommitDraft(); await c.updateComplete;
+  out.rectSaved = c._curSpaceCfg.decor?.length === 1 && c._curSpaceCfg.decor[0].kind === 'rect';
+  out.rectFill = c._curSpaceCfg.decor[0].fill === true && c._curSpaceCfg.decor[0].color === '#ff0000';
+  out.rectRendered = !!sr().querySelector('.decorlayer rect.dshape');
+  // 3) линия и овал
+  c._decorDraft = { kind: 'line', a: [g * 2, g * 2], b: [g * 8, g * 2], pid: 1 };
+  c._decorCommitDraft();
+  c._decorDraft = { kind: 'ellipse', a: [g * 30, g * 30], b: [g * 40, g * 36], pid: 1 };
+  c._decorCommitDraft(); await c.updateComplete;
+  out.threeShapes = c._decorList.length === 3;
+  // вырожденная фигура не сохраняется
+  c._decorDraft = { kind: 'line', a: [g, g], b: [g, g], pid: 1 };
+  c._decorCommitDraft();
+  out.degenerateSkipped = c._decorList.length === 3;
+  // 4) надпись через диалог
+  c._decorTextDialog = { x: 0.5, y: 0.5, text: 'Сауна', size: 'l', color: '#0000ff' };
+  c._decorSaveText(); await c.updateComplete;
+  out.textSaved = c._decorList.some((x) => x.kind === 'text' && x.text === 'Сауна');
+  out.textRendered = [...sr().querySelectorAll('.decorlayer text')].some((t) => t.textContent.includes('Сауна'));
+  // 5) select: перемещение сохраняет форму, drag двигает
+  const rect = c._decorList.find((x) => x.kind === 'rect');
+  c._decorTool = 'select';
+  c._decorMove = { id: rect.id, start: [0, 0], orig: JSON.parse(JSON.stringify(rect)), pid: 7, moved: false };
+  c._decorMoveUpdate({ clientX: 0, clientY: 0, }); // без смещения
+  const before = { ...c._decorList.find((x) => x.id === rect.id) };
+  c._decorMove.start = [0, 0];
+  // сдвиг на 5 клеток по x: подделаем _svgPoint? проще напрямую:
+  const m = c._decorMove; const dx5 = (g * 5) / 1000;
+  c._curSpaceCfg.decor = c._decorList.map((x) => x.id === m.id ? { ...x, x: m.orig.x + dx5 } : x);
+  out.moveKeepsSize = Math.abs(c._decorList.find((x) => x.id === rect.id).w - before.w) < 1e-9;
+  c._decorMove = null;
+  // 6) erase удаляет
+  const n0 = c._decorList.length;
+  c._decorTool = 'erase';
+  c._decorShapeDown({ stopPropagation() {}, preventDefault() {}, target: null, pointerId: 1 }, c._decorList[0]);
+  out.eraseWorks = c._decorList.length === n0 - 1;
+  // 7) Esc-лестница: инструмент → select → выход
+  c._decorTool = 'line'; c._decorSel = null; await c.updateComplete;
+  await esc(); out.escTool = c._decorTool === 'select' && c._mode === 'decor';
+  await esc(); out.escExit = c._mode === 'view';
+  // 8) в Просмотре фигуры видны, но inert
+  const shp = sr().querySelector('.decorlayer .dshape');
+  out.visibleInView = !!shp;
+  out.inertInView = shp ? getComputedStyle(shp).pointerEvents === 'none' : null;
+  // 9) Delete удаляет выбранное
+  sr().querySelectorAll('.modetab')[2].click(); await c.updateComplete;
+  c._decorTool = 'select'; c._decorSel = c._decorList[0].id; const n1 = c._decorList.length; await c.updateComplete;
+  window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Delete' })); await c.updateComplete;
+  out.deleteKey = c._decorList.length === n1 - 1;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_deeplink.mjs

@@ -0,0 +1,26 @@
+// Smoke: the full houseplan-card honours the #space=<id> deep-link (hashchange).
+import { launch } from './serve.mjs';
+const { page, browser } = await launch({ width: 820, height: 760 }, 1);
+const res = await page.evaluate(async () => {
+  const card = window.__card;
+  const ids = card._model.map((s) => s.id);
+  const target = ids[1] || ids[0];
+  const before = card._space;
+  // simulate a deep-link arriving on the already-open dashboard
+  window.location.hash = '#space=' + target;
+  window.dispatchEvent(new HashChangeEvent('hashchange'));
+  await card.updateComplete;
+  const after = card._space;
+  // invalid hash must be ignored
+  window.location.hash = '#space=__nope__';
+  window.dispatchEvent(new HashChangeEvent('hashchange'));
+  await card.updateComplete;
+  const afterBad = card._space;
+  window.location.hash = '';
+  return { ids, before, target, after, afterBad };
+});
+await browser.close();
+const ok = res.after === res.target && res.afterBad === res.target;
+console.log(JSON.stringify(res));
+if (!ok) { console.error('FAIL deeplink smoke'); process.exit(1); }
+console.log('OK deep-link: full card switches to #space=<id>, ignores invalid ids');

demo/smoke_dialog_zombie.mjs

@@ -0,0 +1,55 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  let pageError = null;
+  window.addEventListener('error', (e) => { pageError = String(e.message); });
+  // сохранение падает, а диалог закрыт до ответа — карточка не должна умереть
+  c.hass = { ...c.hass, callWS: async (msg) => {
+    if (String(msg.type).endsWith('/set')) { await new Promise((r) => setTimeout(r, 60)); throw new Error('boom'); }
+    return { config: c._serverCfg, rev: c._cfgRev };
+  } };
+  await c.updateComplete;
+  // 1) диалог общих настроек
+  c._openSettingsDialog(); await c.updateComplete;
+  const p = c._saveSettingsDialog();
+  c._settingsDialog = null; // Esc во время сохранения
+  await c.updateComplete;
+  await p.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.settingsStaysClosed = c._settingsDialog === null;
+  out.cardAliveAfterSettings = !!sr().querySelector('.stage');
+  // 2) диалог правил
+  c._openRulesDialog(); await c.updateComplete;
+  const p2 = c._saveRules();
+  c._rulesDialog = null; await c.updateComplete;
+  await p2.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.rulesStaysClosed = c._rulesDialog === null;
+  out.cardAliveAfterRules = !!sr().querySelector('.stage');
+  // 3) диалог устройства
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog(c._devices[0]); await c.updateComplete;
+  const p3 = c._saveMarker();
+  c._markerDialog = null; await c.updateComplete;
+  await p3.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.markerStaysClosed = c._markerDialog === null;
+  out.cardAliveAfterMarker = !!sr().querySelector('.stage');
+  out.noPageError = pageError === null;
+  // 4) при ОТКРЫТОМ диалоге ошибка снимает busy (поведение сохранено)
+  c._openSettingsDialog(); await c.updateComplete;
+  const p4 = c._saveSettingsDialog();
+  await p4.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  out.busyClearedWhenOpen = c._settingsDialog !== null && c._settingsDialog.busy === false;
+  c._settingsDialog = null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_edge_cases.mjs

@@ -0,0 +1,87 @@
+import { launch, check, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const mk = () => document.createElement('houseplan-card');
+  const sr = (c) => c.shadowRoot || c.renderRoot;
+
+  // 1) пустая инсталляция: ноль устройств/зон, конфиг с пространством без комнат
+  const c1 = mk();
+  c1.setConfig({ type: 'custom:houseplan-card' });
+  document.body.appendChild(c1);
+  c1.hass = { language:'en', locale:{language:'en'}, devices:{}, entities:{}, areas:{}, states:{},
+    callWS: async (m) => m.type==='houseplan/config/get'
+      ? { config:{ spaces:[{ id:'s1', title:'Empty', plan_url:null, aspect:1.4, view_box:[0,0,1,1], rooms:[], segments:[] }], markers:[], settings:{} }, rev:1 }
+      : { layout:{} },
+    connection:{ subscribeEvents: async()=>()=>{} } };
+  await new Promise(r=>setTimeout(r,150));
+  c1.hass = { ...c1.hass };
+  await c1.updateComplete; await new Promise(r=>setTimeout(r,50)); await c1.updateComplete;
+  out.emptyDevices = c1._devices.length;
+  out.emptyRenders = !!sr(c1).querySelector('.stage');
+  out.emptyCount = sr(c1).querySelector('.count')?.textContent.trim();
+  c1.remove();
+
+  // 2) XSS в именах комнат и устройств
+  const c2 = mk();
+  c2.setConfig({ type: 'custom:houseplan-card' });
+  document.body.appendChild(c2);
+  const evil = '<img src=x onerror=window.__pwned=1><b>bold</b>';
+  c2.hass = { language:'en', locale:{language:'en'},
+    devices:{ d1:{ id:'d1', name: evil, model:'M<script>1</script>', area_id:'a1', identifiers:[['x','1']] } },
+    entities:{}, areas:{ a1:{ area_id:'a1', name:'A1' } }, states:{},
+    callWS: async (m) => m.type==='houseplan/config/get'
+      ? { config:{ spaces:[{ id:'s1', title:'S', plan_url:null, aspect:1, view_box:[0,0,1,1],
+          rooms:[{ id:'r1', name: evil, area:'a1', poly:[[0.1,0.1],[0.9,0.1],[0.9,0.9],[0.1,0.9]] }], segments:[] }], markers:[], settings:{} }, rev:1 }
+      : { layout:{} },
+    connection:{ subscribeEvents: async()=>()=>{} } };
+  await new Promise(r=>setTimeout(r,150));
+  c2.hass = { ...c2.hass };
+  await c2.updateComplete; await new Promise(r=>setTimeout(r,50)); await c2.updateComplete;
+  out.xssPwned = !!window.__pwned;
+  const lbl = sr(c2).querySelector('.roomlabel');
+  out.xssLabelIsText = lbl ? lbl.innerHTML.includes('&lt;img') || lbl.textContent.includes('<img') : 'no label';
+  out.xssDeviceRendered = sr(c2).querySelectorAll('.dev').length;
+  c2.remove();
+
+  // 3) легаси-записи layout v1 {x,y} без ключа s — игнорируются в norm-режиме
+  const c = window.__card;
+  c._layout = { ...c._layout, d_light1_legacy_test: { x: 500, y: 300 } };
+  const fake = { id: 'd_light1_legacy_test', space: 'f1' };
+  const p = c._pos(fake);
+  out.legacyIgnored = p.y !== 300; // centre y=400 if ignored; raw 300 would mean it leaked through
+  delete c._layout.d_light1_legacy_test;
+
+  // 4) перф: 150 устройств
+  const t0 = performance.now();
+  const devices = {}; const entities = {}; const states = {};
+  for (let i = 0; i < 150; i++) {
+    devices['p'+i] = { id:'p'+i, name:'Plug '+i, model:'Smart Plug', area_id:'living_room', identifiers:[['demo','p'+i]] };
+    entities['switch.p'+i] = { entity_id:'switch.p'+i, device_id:'p'+i, platform:'demo' };
+    states['switch.p'+i] = { state: i%2?'on':'off', attributes:{ linkquality: 50+i } };
+  }
+  const bigHass = { ...window.__mkHass(), devices:{...window.__mkHass().devices, ...devices},
+    entities:{...window.__mkHass().entities, ...entities}, states:{...window.__mkHass().states, ...states} };
+  c.hass = bigHass; c._regSignature=''; c._maybeRebuildDevices();
+  out.bigBuildMs = Math.round(performance.now() - t0);
+  out.bigCount = c._devices.length;
+  await c.updateComplete;
+  const t1 = performance.now(); c.requestUpdate(); await c.updateComplete;
+  out.bigRenderMs = Math.round(performance.now() - t1);
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+// сборка 100+ устройств должна укладываться в бюджет (docs/TESTING.md)
+// timings are asserted as budgets, not frozen values (CI machines vary)
+check("bigBuildMs under 200ms", res.bigBuildMs < 200);
+check("bigRenderMs under 100ms", res.bigRenderMs < 100);
+delete res.bigBuildMs;
+delete res.bigRenderMs;
+checkAll(res, {
+  "emptyDevices": 0,
+  "emptyCount": "0 dev.",
+  "xssPwned": false,
+  "xssDeviceRendered": 1,
+  "bigCount": 162,
+});
+await finish(browser, res);

demo/smoke_editor_tabs.mjs

@@ -0,0 +1,42 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const tabs = () => [...sr().querySelectorAll('.modetab')];
+  // 1) две вкладки, Просмотра нет, крестиков в неактивных нет
+  out.twoTabs = tabs().length === 3; // третья — Редактор подложки (v1.33.0)
+  out.labels = tabs().map((t) => t.textContent.trim());
+  out.noCrossIdle = sr().querySelectorAll('.modetab .closex').length === 0;
+  out.startView = c._mode === 'view';
+  // 2) клик по «Редактор плана» → активна, панель с крестиком
+  tabs()[0].click(); await c.updateComplete;
+  out.planActive = c._mode === 'plan' && tabs()[0].classList.contains('active');
+  out.planBar = !!sr().querySelector('.editbar');
+  out.planBarClose = !!sr().querySelector('.editbar .barclose');
+  out.tabCross = !!tabs()[0].querySelector('.closex');
+  // 3) повторный клик по активной вкладке — ничего
+  tabs()[0].click(); await c.updateComplete;
+  out.reclickNoop = c._mode === 'plan';
+  // 4) прямое переключение План → Устройства
+  tabs()[1].click(); await c.updateComplete;
+  out.directSwitch = c._mode === 'devices';
+  out.devBar = !!sr().querySelector('.editbar.devbar');
+  out.devBarBtns = sr().querySelectorAll('.editbar.devbar .btn:not(.barclose)').length === 3; // add/show-all/rules (v1.33.2: Reset removed)
+  // 5) инструменты устройств из шапки исчезли (в .bar их больше нет)
+  out.headerCleanInDev = !sr().querySelector('.bar > .btn[title*="' + (c._t('title.add_device')) + '"]');
+  // 6) крестик на панели → Просмотр
+  sr().querySelector('.editbar .barclose').click(); await c.updateComplete;
+  out.barCloseWorks = c._mode === 'view' && !sr().querySelector('.editbar');
+  // 7) крестик в самой вкладке → Просмотр (и не переключает режим)
+  tabs()[1].click(); await c.updateComplete;
+  tabs()[1].querySelector('.closex').click(); await c.updateComplete;
+  out.tabCrossWorks = c._mode === 'view';
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "labels": ["Plan editor", "Device editor", "Background editor"],
+});
+await finish(browser, res);

demo/smoke_esc_dialogs.mjs

@@ -0,0 +1,35 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const esc = async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' })); await c.updateComplete; };
+  // общие настройки
+  c._openSettingsDialog(); await c.updateComplete;
+  await esc(); out.settings = !c._settingsDialog;
+  // правила иконок
+  c._openRulesDialog(); await c.updateComplete;
+  await esc(); out.rules = !c._rulesDialog;
+  // диалог устройства
+  c._setMode('devices'); c._openMarkerDialog(); await c.updateComplete;
+  await esc(); out.marker = !c._markerDialog;
+  // диалог пространства (+ очистка очереди импорта)
+  c._openSpaceDialog('edit', c._space); c._importQueue = ['x']; c._importTotal = 1; await c.updateComplete;
+  await esc(); out.space = !c._spaceDialog && c._importQueue.length === 0;
+  // инфо-карточка устройства
+  c._setMode('view'); c._infoCard = c._devices[0]; await c.updateComplete;
+  await esc(); out.info = !c._infoCard;
+  // инфо двери/замка
+  c._openingInfo = { id: 'op1', type: 'door', rx: 550, ry: 200, len_cm: 90, lock: 'lock.front_door' }; await c.updateComplete;
+  await esc(); out.openingInfo = !c._openingInfo;
+  // приоритет: инфо поверх настроек — Esc закрывает только инфо
+  c._openSettingsDialog(); c._infoCard = c._devices[0]; await c.updateComplete;
+  await esc(); out.stacked = !c._infoCard && !!c._settingsDialog;
+  await esc(); out.stacked2 = !c._settingsDialog;
+  // Esc в разметке по-прежнему откатывает точку, а не только диалоги
+  c._setMode('plan'); c._tool = 'draw'; c._path = [[1, 2], [3, 4]]; await c.updateComplete;
+  await esc(); out.undoPointStillWorks = c._path.length === 1;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_feedback_v2.mjs

@@ -0,0 +1,49 @@
+import { launch, check, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) кнопка настроек комнаты в редакторе плана: заметная, фиксированного размера
+  c._setMode('plan'); await c.updateComplete;
+  const btn = sr().querySelector('.rlgearbtn');
+  out.gearButtonShown = !!btn;
+  const cs = btn ? getComputedStyle(btn) : null;
+  out.gearReadable = cs ? parseFloat(cs.fontSize) >= 10 && cs.pointerEvents === 'auto' : null;
+  out.gearHasLabel = btn ? btn.textContent.trim().length > 0 : null;
+  const box = btn?.getBoundingClientRect();
+  out.gearTapTarget = box ? box.height >= 18 && box.width >= 40 : null;
+  btn.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true }));
+  await c.updateComplete;
+  out.gearOpensDialog = c._roomDialog === true && !!c._roomEditId;
+  c._roomDialogCancel(); await c.updateComplete;
+  // 2) комната без имени тоже получает кнопку (её там и называют)
+  const room = c._curSpaceCfg.rooms[0];
+  const savedName = room.name;
+  room.name = '';
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  out.unnamedStillHasGear = sr().querySelectorAll('.rlgearbtn').length >= 1;
+  room.name = savedName; c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  // 3) метрики стали крупнее: 0.75em вместо 0.62em
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true, label_temp: true } })) };
+  c._setMode('view'); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+  const lbl = [...sr().querySelectorAll('.roomlabel')].find((l) => l.querySelector('.rlmetrics'));
+  if (lbl) {
+    const nameSz = parseFloat(getComputedStyle(lbl.querySelector('.rlname')).fontSize);
+    const metaSz = parseFloat(getComputedStyle(lbl.querySelector('.rlmetrics')).fontSize);
+    out.metricsRatio = Math.round((metaSz / nameSz) * 100) / 100;
+  } else out.metricsRatio = 'no-metrics';
+  // 4) касание помечает сессию как тач и гасит тултип
+  c._tip = { x: 1, y: 1, title: 't', meta: 'm' };
+  c._notePointer(new PointerEvent('pointerdown', { pointerType: 'touch' }));
+  out.touchClearsTip = c._tip === null;
+  c._showTip(new MouseEvent('mousemove', { clientX: 5, clientY: 5 }), 'x', 'y');
+  out.noTipAfterTouch = !c._tip;
+  return out;
+});
+check('metricsRatio 0.75', res.metricsRatio, 0.75);
+delete res.metricsRatio;
+checkAll(res);
+await finish(browser, res);

demo/smoke_font_scales.mjs

@@ -0,0 +1,58 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const spId = c._space;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true, label_temp: true } })) };
+  c._setMode('view'); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 100));
+  const lbl = () => sr().querySelector('.roomlabel');
+  const nameSize = () => parseFloat(getComputedStyle(lbl().querySelector('.rlname')).fontSize);
+  const metaEl = () => lbl().querySelector('.rlmetrics');
+  const n0 = nameSize();
+  const m0 = metaEl() ? parseFloat(getComputedStyle(metaEl()).fontSize) : null;
+  out.baseline = n0 > 0;
+  // 1) пер-комнатный name_scale ×2 — имя удвоилось, подписи нет
+  const room = c._curSpaceCfg.rooms.find((r) => r.name && r.area);
+  room.settings = { ...(room.settings || {}), name_scale: 2 };
+  c.requestUpdate(); await c.updateComplete;
+  const lblR = [...sr().querySelectorAll('.roomlabel')].find((l) => l.textContent.includes(room.name));
+  const n1 = parseFloat(getComputedStyle(lblR.querySelector('.rlname')).fontSize);
+  out.nameDoubled = Math.abs(n1 / n0 - 2) < 0.05;
+  const meta1 = lblR.querySelector('.rlmetrics');
+  out.metaUntouched = meta1 ? Math.abs(parseFloat(getComputedStyle(meta1).fontSize) - m0) < 0.5 : 'no-meta';
+  // 2) label_scale ×2 — подписи удвоились
+  room.settings.label_scale = 2;
+  c.requestUpdate(); await c.updateComplete;
+  const meta2 = lblR.querySelector('.rlmetrics');
+  out.metaDoubled = meta2 && m0 ? Math.abs(parseFloat(getComputedStyle(meta2).fontSize) / m0 - 2) < 0.05 : 'no-meta';
+  // 3) базовый множитель пространства ×1.5 — умножает всё
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), card_font_scale: 1.5 } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const lblR2 = [...sr().querySelectorAll('.roomlabel')].find((l) => l.textContent.includes(room.name));
+  const n2 = parseFloat(getComputedStyle(lblR2.querySelector('.rlname')).fontSize);
+  out.spaceMultiplies = Math.abs(n2 / n0 - 3) < 0.1; // 2 × 1.5
+  // 4) диалог комнаты: слайдеры + живой пример реагирует
+  c._setMode('plan'); await c.updateComplete;
+  const model = c._spaceModel().rooms.find((r) => r.id === room.id);
+  c._openRoomEdit(model); await c.updateComplete;
+  out.slidersPrefilled = c._roomNameScale === 2 && c._roomLabelScale === 2;
+  const pv = () => sr().querySelector('.cardpreview .cpname');
+  const p0 = parseFloat(pv().style.fontSize);
+  c._roomNameScale = 1; c.requestUpdate(); await c.updateComplete;
+  const p1 = parseFloat(pv().style.fontSize);
+  out.previewLive = Math.abs(p0 / p1 - 2) < 0.05;
+  c._roomDialogCancel(); await c.updateComplete;
+  // 5) превью есть и в диалоге пространства
+  c._openSpaceDialog('edit', spId); await c.updateComplete;
+  out.spacePreview = !!sr().querySelector('.cardpreview');
+  out.spaceSlider = [...sr().querySelectorAll('.dialog label')].some((l) => l.textContent === c._t('space.card_font'));
+  c._spaceDialog = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_gear_tabs.mjs

@@ -0,0 +1,38 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const gears = () => sr().querySelectorAll('.tab .tabedit').length;
+  // шестерёнки видны во всех трёх режимах
+  out.viewGears = gears() > 0;
+  c._setMode('plan'); await c.updateComplete;
+  out.planGears = gears() > 0;
+  c._setMode('devices'); await c.updateComplete;
+  out.devGears = gears() > 0;
+  c._setMode('view'); await c.updateComplete;
+  // выравнивание: центр иконки ~ центру текста таба
+  const tab = sr().querySelector('.tab');
+  const icon = tab.querySelector('.tabedit');
+  const tb = tab.getBoundingClientRect(), ib = icon.getBoundingClientRect();
+  const tabMid = tb.top + tb.height / 2, iconMid = ib.top + ib.height / 2;
+  out.alignDelta = Math.abs(tabMid - iconMid);
+  out.aligned = out.alignDelta <= 1.5;
+  // клик по шестерёнке в Просмотре открывает диалог пространства и не переключает таб
+  const cur = c._space;
+  icon.click(); await c.updateComplete;
+  out.dialogOpens = !!c._spaceDialog;
+  out.tabNotSwitched = c._space === cur;
+  c._spaceDialog = null; await c.updateComplete;
+  // кнопка "+" по-прежнему только в Плане
+  out.noAddInView = !sr().querySelector('.tab.tabadd');
+  c._setMode('plan'); await c.updateComplete;
+  out.addInPlan = !!sr().querySelector('.tab.tabadd');
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "alignDelta": 0,
+});
+await finish(browser, res);

demo/smoke_general_settings.mjs

@@ -0,0 +1,37 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) диалог общих настроек: 7 цветовых строк, 3 группы
+  c._openSettingsDialog(); await c.updateComplete;
+  out.rows = sr().querySelectorAll('.gsrow').length;
+  out.groups = [...sr().querySelectorAll('.dialog .dispsection')].map((l) => l.textContent.trim());
+  // 2) сменить цвет light_on и сохранить
+  c._setFillColor('light_on', { c: '#ff00ff', a: 0.5 });
+  await c._saveSettingsDialog(); await c.updateComplete;
+  out.saved = c._serverCfg.settings.fill_colors?.light_on;
+  // 3) заливка light использует кастомный цвет
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({ ...s,
+    settings: { ...(s.settings||{}), show_borders: true, fill_mode: 'light' } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const styles = [...sr().querySelectorAll('.room.styled')].map((r) => r.getAttribute('style') || '');
+  out.customFillUsed = styles.some((st) => st.includes('#ff00ff') && st.includes('0.500'));
+  // 4) show_lqi=false у пространства скрывает LQI-бейджи
+  out.lqiBefore = sr().querySelectorAll('.dev .lqi').length;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({ ...s,
+    settings: { ...(s.settings||{}), show_lqi: false } })) };
+  c.requestUpdate(); await c.updateComplete;
+  out.lqiAfter = sr().querySelectorAll('.dev .lqi').length;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "rows": 11,
+  "groups": ["Fill: lights", "Fill: temperature", "Fill: zigbee signal", "Light-sources fill"],
+  "saved": {"c": "#ff00ff", "a": 0.5},
+  "lqiBefore": 7,
+  "lqiAfter": 0,
+});
+await finish(browser, res);

demo/smoke_glow.mjs

@@ -0,0 +1,124 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const spId = c._space;
+  // включить glow-режим
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
+  c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  // 1) все комнаты залиты темнотой одинаково (независимо от ламп)
+  const rooms = [...sr().querySelectorAll('.room.styled')];
+  out.roomsDark = rooms.length > 0 && rooms.every((el) => {
+    const st = el.getAttribute('style') || '';
+    return st.includes('--room-fill:#0d1b2a');
+  });
+  // 2) пятна от включённых ламп
+  const litLight = c._devices.find((d) => d.space === spId && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on'));
+  out.hasLitLight = !!litLight;
+  out.spots = sr().querySelectorAll('.glowlayer circle').length;
+  out.spotsMatchLights = out.spots === c._devices.filter((d) => d.space === spId && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on')).length;
+  // 3) выключение лампы убирает её пятно
+  const eid = litLight.entities.find((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on');
+  const st0 = c.hass.states[eid];
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: { ...st0, state: 'off' } } };
+  await c.updateComplete;
+  out.spotGone = sr().querySelectorAll('.glowlayer circle').length === out.spots - 1;
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: st0 } }; await c.updateComplete;
+  // 4) rgb-лампа красит градиент своим цветом (форсируем rgb у лампы)
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: { ...st0, state: 'on', attributes: { ...st0.attributes, rgb_color: [255, 0, 0] } } } };
+  await c.updateComplete;
+  out.gradientColored = [...sr().querySelectorAll('defs radialGradient stop')].some((s2) => s2.getAttribute('stop-color') === 'rgb(255, 0, 0)');
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: st0 } }; await c.updateComplete;
+  // 5) пятно обрезано комнатой (есть clipPath)
+  out.clipped = sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]').length > 0;
+  // 6) дверь в соседнюю комнату → в clip добавлен сектор (2 сабпути M)
+  // добавим дверь между r1 и r2 на общей стене x=0.55… найдём общую стену программно:
+  const spm = c._spaceModel();
+  const r1 = spm.rooms.find((r) => r.id === 'r1');
+  const r2 = spm.rooms.find((r) => r.id === 'r2');
+  // возьмём точку на границе r1, ближайшую к центру r2
+  const c2 = c._roomCenter(r2);
+  const poly1 = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
+  // общая стена вертикальная — дверь ставим на неё
+  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  const doorPt = (() => {
+    let best = null, bd = 1e9;
+    for (const [x, y] of [[550, 150], [550, 200], [550, 250]]) {
+      const d2 = Math.hypot(x - c2[0], y - c2[1]);
+      if (d2 < bd) { bd = d2; best = [x, y]; }
+    }
+    return best;
+  })();
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, openings: [{ id: 'gd', type: 'door', x: doorPt[0] / 1000, y: doorPt[1] / H, angle: 90, length: 0.09 }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  // источник детерминированно ставим в центр r1 (двигаем реальную включённую лампу)
+  const aspect = c._curSpaceCfg.aspect || 1;
+  const c1 = c._roomCenter(r1);
+  c._layout = { ...c._layout, [litLight.id]: { s: spId, x: c1[0] / 1000, y: c1[1] / (1000 / aspect) } };
+  // радиус 6 м, чтобы дверь заведомо была в зоне досягаемости
+  c._serverCfg = { ...c._serverCfg, settings: { ...(c._serverCfg.settings || {}), glow_radius_cm: 600 } };
+  c.requestUpdate(); await c.updateComplete;
+  // теперь каждый под-контур — отдельный path внутри clipPath
+  const clipEls = [...sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]')];
+  out.sectorAdded = clipEls.some((cp) => cp.querySelectorAll('path').length >= 2);
+  // и сектор в том же направлении обхода не выедает комнату: каждый path — один контур
+  out.singleSubpathPerPath = clipEls.every((cp) => [...cp.querySelectorAll('path')]
+    .every((p) => ((p.getAttribute('d') || '').match(/M /g) || []).length === 1));
+  // у входной двери (наружу) сектора нет: дверь на внешней стене r1 (x=min)
+  const minX = Math.min(...poly1.map((p) => p[0]));
+  const yMid = (Math.min(...poly1.map((p) => p[1])) + Math.max(...poly1.map((p) => p[1]))) / 2;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, openings: [{ id: 'gd2', type: 'door', x: minX / 1000, y: yMid / (1000 / aspect), angle: 90, length: 0.09 }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const clipEls2 = [...sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]')];
+  out.entranceNoSector = clipEls2.every((cp) => cp.querySelectorAll('path').length === 1);
+  // 6б) профиль градиента: плато до 80%, спад на внешних 20%
+  const stops = [...sr().querySelectorAll('defs radialGradient')][0];
+  const offs = stops ? [...stops.querySelectorAll('stop')].map((st2) => [st2.getAttribute('offset'), st2.getAttribute('stop-opacity')]) : [];
+  out.plateau80 = offs.length === 3 && offs[0][0] === '0%' && offs[1][0] === '70%'
+    && offs[0][1] === offs[1][1] && offs[2][1] === '0';
+  // 7а) персональный радиус источника перекрывает глобальный
+  const litMarkerId = litLight.id;
+  c._serverCfg = { ...c._serverCfg, markers: [
+    ...(c._serverCfg.markers || []).filter((m) => m.id !== litMarkerId),
+    { id: litMarkerId, binding: litLight.bindingKind === 'virtual' ? 'virtual' : litLight.bindingKind + ':' + litLight.bindingRef, glow_radius_cm: 150 },
+  ] };
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  const rOwn = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
+  out.perSourceRadius = Math.abs(rOwn - c._cmToUnits(150)) < 0.5;
+  c._serverCfg = { ...c._serverCfg, markers: (c._serverCfg.markers || []).filter((m) => m.id !== litMarkerId) };
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  // 6в) флаг «источник света»: умный выключатель с обычными светильниками
+  const swDev = c._devices.find((d) => d.space === spId && d.entities.some((e) => e.startsWith('switch.')));
+  if (swDev) {
+    const swEid = swDev.entities.find((e) => e.startsWith('switch.'));
+    c.hass = { ...c.hass, states: { ...c.hass.states, [swEid]: { ...c.hass.states[swEid], state: 'on' } } };
+    const spotsBefore = sr().querySelectorAll('.glowlayer circle').length;
+    c._serverCfg = { ...c._serverCfg, markers: [
+      ...(c._serverCfg.markers || []).filter((m) => m.id !== swDev.id),
+      { id: swDev.id, binding: swDev.bindingKind + ':' + swDev.bindingRef, is_light: true },
+    ] };
+    c._regSignature = ''; c._maybeRebuildDevices(); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+    out.switchGlows = sr().querySelectorAll('.glowlayer circle').length === spotsBefore + 1;
+    c._serverCfg = { ...c._serverCfg, markers: (c._serverCfg.markers || []).filter((m) => m.id !== swDev.id) };
+    c._regSignature = ''; c._maybeRebuildDevices(); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+    out.switchGlowsOffByDefault = sr().querySelectorAll('.glowlayer circle').length === spotsBefore;
+  } else { out.switchGlows = 'no-switch'; out.switchGlowsOffByDefault = 'no-switch'; }
+  // 7) радиус из настроек: 600 см против 300 см — вдвое больше
+  const r600 = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
+  c._serverCfg = { ...c._serverCfg, settings: { ...(c._serverCfg.settings || {}), glow_radius_cm: 300 } };
+  c.requestUpdate(); await c.updateComplete;
+  const r300 = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
+  out.radiusReacts = Math.abs(r600 / r300 - 2) < 0.01;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "spots": 1,
+});
+await finish(browser, res);

demo/smoke_grid_fade.mjs

@@ -0,0 +1,37 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const grid = () => !!sr().querySelector('rect[fill="url(#hp-grid)"]');
+  // Просмотр: сетки нет
+  out.noGridInView = !grid();
+  // все три редактора: сетка есть
+  c._setMode('plan'); await c.updateComplete; out.gridInPlan = grid();
+  c._setMode('devices'); await c.updateComplete; out.gridInDevices = grid();
+  c._setMode('decor'); await c.updateComplete; out.gridInDecor = grid();
+  await new Promise((r) => setTimeout(r, 250)); // transition .room 0.12s
+  // decor: комнаты и устройства полупрозрачны
+  const room = sr().querySelector('.room');
+  out.roomFaded = room ? Number(getComputedStyle(room).opacity) < 0.5 : null;
+  const dl = sr().querySelector('.devlayer');
+  out.devsFaded = dl ? Number(getComputedStyle(dl).opacity) < 0.5 : null;
+  // а декор-слой — нет
+  c._curSpaceCfg.decor = [{ id: 'd1', kind: 'line', x1: 0.1, y1: 0.1, x2: 0.3, y2: 0.1, color: '#ff0000', width: 3 }];
+  c.requestUpdate(); await c.updateComplete;
+  const shp = sr().querySelector('.decorlayer .dshape');
+  out.decorNotFaded = shp ? Number(getComputedStyle(shp).opacity) > 0.9 : null;
+  // в других редакторах прозрачности нет
+  c._setMode('devices'); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const room2 = sr().querySelector('.room');
+  out.notFadedInDevices = room2 ? Number(getComputedStyle(room2).opacity) > 0.9 : null;
+  c._setMode('view'); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const room3 = sr().querySelector('.room');
+  out.notFadedInView = room3 ? Number(getComputedStyle(room3).opacity) > 0.9 : null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_gs_always.mjs

@@ -0,0 +1,18 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const gs = () => !!sr().querySelector('.head .btn[title="' + c._t('title.general_settings') + '"]');
+  out.view = gs();
+  c._setMode('plan'); await c.updateComplete; out.plan = gs();
+  c._setMode('devices'); await c.updateComplete; out.devices = gs();
+  c._setMode('view'); await c.updateComplete;
+  sr().querySelector('.head .btn[title="' + c._t('title.general_settings') + '"]').click();
+  await c.updateComplete;
+  out.opensInView = !!c._settingsDialog;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_icon_center.mjs

@@ -0,0 +1,28 @@
+// Asserts device icon badges sit exactly on their anchor point (no content-box/border drift).
+import { launch } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 1000 }, 2);
+const bad = await page.evaluate(() => {
+  const c = window.__card;
+  c._space = 'f1'; c._resetZoom(); c.requestUpdate();
+  const layer = c.renderRoot.querySelector('.devlayer');
+  const lr = layer.getBoundingClientRect();
+  const bad = [];
+  for (const d of layer.querySelectorAll('.dev')) {
+    const ax = lr.left + (parseFloat(d.style.left) / 100) * lr.width;
+    const ay = lr.top + (parseFloat(d.style.top) / 100) * lr.height;
+    const r = d.getBoundingClientRect();
+    const cx = r.left + r.width / 2, cy = r.top + r.height / 2;
+    const offX = cx - ax, offY = cy - ay;
+    // glyph centred within the badge
+    const icon = d.querySelector('ha-icon');
+    const svg = icon?.shadowRoot?.querySelector('svg') || icon?.shadowRoot?.querySelector('ha-svg-icon')?.shadowRoot?.querySelector('svg');
+    let gX = 0, gY = 0;
+    if (svg) { const sr = svg.getBoundingClientRect(); gX = sr.left + sr.width / 2 - cx; gY = sr.top + sr.height / 2 - cy; }
+    if (Math.abs(offX) > 0.6 || Math.abs(offY) > 0.6 || Math.abs(gX) > 0.6 || Math.abs(gY) > 0.6)
+      bad.push({ icon: icon?.getAttribute('icon'), offX: +offX.toFixed(2), offY: +offY.toFixed(2), glyphX: +gX.toFixed(2), glyphY: +gY.toFixed(2) });
+  }
+  return bad;
+});
+await browser.close();
+if (bad.length) { console.error('FAIL icon-center: badges off anchor', JSON.stringify(bad.slice(0, 5))); process.exit(1); }
+console.log('OK icon-center: all device badges centred on their anchor');

demo/smoke_icon_placeholder.mjs

@@ -0,0 +1,31 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('devices'); await c.updateComplete;
+  // устройство без явной иконки (marker.icon пуст)
+  const dev = c._devices.find((d) => !d.marker?.icon && d.icon);
+  out.hasAutoDev = !!dev;
+  c._openMarkerDialog(dev); await c.updateComplete;
+  out.autoIconStored = c._markerDialog.autoIcon === dev.icon;
+  out.iconEmpty = c._markerDialog.icon === '';
+  // подсказка с авто-иконкой видна
+  const hint = sr().querySelector('.iconauto');
+  out.hintShown = !!hint && hint.textContent.includes(dev.icon);
+  out.hintIcon = hint?.querySelector('ha-icon')?.getAttribute('icon') === dev.icon;
+  // пикер (или фолбэк-инпут) получил placeholder
+  const picker = sr().querySelector('ha-icon-picker');
+  const inputs = [...sr().querySelectorAll('.dialog input')];
+  out.placeholderSet = picker
+    ? picker.placeholder === dev.icon
+    : inputs.some((i) => i.placeholder === dev.icon);
+  // при явной иконке подсказки нет
+  c._markerDialog = { ...c._markerDialog, icon: 'mdi:star' }; await c.updateComplete;
+  out.noHintWhenExplicit = !sr().querySelector('.iconauto');
+  c._markerDialog = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_inert_openings.mjs

@@ -0,0 +1,52 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // добавить открывание на f1
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({
+    ...s, openings: [{ id: 'op1', type: 'door', rx: 550, ry: 200, angle: 90, len_cm: 90 }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const hit = sr().querySelector('.op-hit');
+  out.hasOpening = !!hit;
+  const cs = hit ? getComputedStyle(hit) : null;
+  out.viewInert = cs ? cs.pointerEvents === 'none' && cs.cursor === 'default' : null;
+  out.lockBadgeInert = (() => { const l = sr().querySelector('.oplock'); return l ? getComputedStyle(l).pointerEvents === 'none' : 'no-badge'; })();
+  // View: клик по открыванию ничего не открывает
+  c._opClick({ stopPropagation(){} }, { id: 'op1', rx: 550, ry: 200, rlen: 90 });
+  out.viewClickNoop = !c._openingInfo && !c._openingDialog;
+  // курсор устройств в Просмотре — pointer, в Устройствах — grab
+  const dev = sr().querySelector('.dev');
+  out.viewDevCursor = getComputedStyle(dev).cursor;
+  // бейдж замка: замок привязан → бейдж кликабелен и открывает инфо
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s2) => s2.id !== 'f1' ? s2 : ({
+    ...s2, openings: [{ id: 'op1', type: 'door', rx: 550, ry: 200, angle: 90, len_cm: 90, lock: 'lock.front_door' }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const badge = sr().querySelector('.oplock');
+  out.badgeShown = !!badge;
+  const bcs = badge ? getComputedStyle(badge) : null;
+  out.badgeClickableInView = bcs ? bcs.pointerEvents === 'auto' && bcs.cursor === 'pointer' : null;
+  badge?.click(); await c.updateComplete;
+  out.badgeOpensInfo = !!c._openingInfo;
+  c._openingInfo = null;
+  // Plan: op-hit интерактивен, клик редактирует
+  c._setMode('devices'); await c.updateComplete;
+  out.devModeCursor = getComputedStyle(sr().querySelector('.dev')).cursor;
+  c._setMode('plan'); await c.updateComplete;
+  out.badgeInertInPlan = (() => { const b = sr().querySelector('.oplock'); return b ? getComputedStyle(b).pointerEvents === 'none' : 'no-badge'; })();
+  const cs2 = getComputedStyle(sr().querySelector('.op-hit'));
+  out.planInteractive = cs2.pointerEvents === 'auto' && cs2.cursor === 'grab';
+  const op = c._spaceModel().openings?.[0] || { id: 'op1', rx: 550, ry: 200, rlen: 90 };
+  c._opClick({ stopPropagation(){} }, op);
+  out.planClickEdits = !!c._openingDialog;
+  c._openingDialog = null; c._setMode('view');
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "lockBadgeInert": "no-badge",
+  "viewDevCursor": "pointer",
+  "devModeCursor": "grab",
+});
+await finish(browser, res);

demo/smoke_island_rooms.mjs

@@ -0,0 +1,59 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); c._tool = 'draw'; await c.updateComplete;
+  const g = c._gridPitch;
+  // r1 — комната; рисуем остров-«колонну» внутри неё
+  const r1 = c._spaceModel().rooms.find((r) => r.id === 'r1');
+  const [cx, cy] = c._roomCenter(r1).map((v) => Math.round(v / g) * g);
+  const pts = [[cx, cy], [cx + g * 2, cy], [cx + g * 2, cy + g * 2], [cx, cy + g * 2]];
+  // 1) клики внутри комнаты больше не отклоняются
+  for (const p of pts) c._markupClick({ clientX: 0, clientY: 0, composedPath: () => [], ...{} , __pt: p });
+  // _markupClick берёт координаты из _svgPoint(ev) — подменим напрямую через _path:
+  c._path = [];
+  for (const p of pts) {
+    const before = c._path.length;
+    // эмулируем клик готовой точкой: повторим логику через прямой вызов невозможен — построим путь вручную и замкнём
+    c._path = [...c._path, p];
+    if (c._path.length === before) break;
+  }
+  out.pointsAccepted = c._path.length === 4;
+  // замыкание: проверка пересечений должна пройти (вложенность легальна)
+  const clash = c._overlapRoom([...c._path]);
+  out.nestedAllowed = !clash;
+  // частичное перекрытие всё ещё запрещено
+  const partial = [[cx - g * 4, cy], [cx + g * 2, cy], [cx + g * 2, cy + g * 2], [cx - g * 4, cy + g * 2]];
+  // сдвинем так, чтобы вылезло за границу r1: возьмём точку заведомо снаружи
+  const poly1 = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
+  const minX = Math.min(...poly1.map((p) => p[0]));
+  const cross = [[minX - g * 2, cy], [cx, cy], [cx, cy + g * 2], [minX - g * 2, cy + g * 2]];
+  out.partialStillRejected = !!c._overlapRoom(cross);
+  // 2) сохранить остров как комнату без зоны (замкнуть контур)
+  c._path = [...pts, pts[0]];
+  c._nameSel = 'Колонна'; c._areaSel = '';
+  c._commitRoom();
+  await c.updateComplete;
+  const island = c._spaceModel().rooms.find((r) => r.name === 'Колонна');
+  out.islandSaved = !!island;
+  // 3) внешняя комната рендерится как path с evenodd и дыркой
+  c._setMode('view'); await c.updateComplete;
+  // включим границы, чтобы r1 рендерился
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_borders: true } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const evenodd = [...sr().querySelectorAll('path.room')].find((p) => p.getAttribute('fill-rule') === 'evenodd');
+  out.evenoddPath = !!evenodd;
+  out.holeInPath = evenodd ? (evenodd.getAttribute('d').match(/M /g) || []).length === 2 : null;
+  // 4) остров кликабелен (элемент существует и он поверх дырки)
+  const islandEl = [...sr().querySelectorAll('.room')].find((el) => {
+    const d = el.getAttribute('points') || el.getAttribute('d') || '';
+    return d.includes(String(cx)) && el !== evenodd;
+  });
+  out.islandRendered = !!islandEl;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_kiosk.mjs

@@ -0,0 +1,73 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c0 = window.__card;
+  // создать киоск-экземпляр
+  const c = document.createElement('houseplan-card');
+  c.setConfig({ type: 'custom:houseplan-card', kiosk: true, cycle: 0 });
+  c.hass = c0.hass;
+  document.body.appendChild(c);
+  c.style.cssText = 'position:fixed;left:0;top:0;width:900px;height:700px;z-index:99';
+  await new Promise((r) => setTimeout(r, 400));
+  c.hass = { ...c0.hass };
+  await c.updateComplete;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) шапка скрыта
+  const hdr = sr().querySelector('.hdr');
+  out.headerHidden = !hdr || getComputedStyle(hdr).display === 'none';
+  // 2) редакторы заблокированы
+  c._setMode('plan'); await c.updateComplete;
+  out.editorsBlocked = c._mode === 'view';
+  // 3) свайп при 1:1 переключает пространство (и точки показываются)
+  const s0 = c._space;
+  const stage = sr().querySelector('.stage');
+  stage.dispatchEvent(new PointerEvent('pointerdown', { bubbles: true, composed: true, pointerId: 1, clientX: 600, clientY: 300 }));
+  stage.dispatchEvent(new PointerEvent('pointerup', { bubbles: true, composed: true, pointerId: 1, clientX: 450, clientY: 305 }));
+  await c.updateComplete;
+  out.swipeSwitches = c._space !== s0;
+  out.dotsShown = !!sr().querySelector('.kioskdots');
+  // 4) при зуме свайп не переключает
+  c._zoom = 2; const s1 = c._space;
+  stage.dispatchEvent(new PointerEvent('pointerdown', { bubbles: true, composed: true, pointerId: 2, clientX: 600, clientY: 300 }));
+  stage.dispatchEvent(new PointerEvent('pointerup', { bubbles: true, composed: true, pointerId: 2, clientX: 450, clientY: 305 }));
+  await c.updateComplete;
+  out.noSwipeZoomed = c._space === s1;
+  // 5) двойной тап сбрасывает зум
+  c._lastTap = Date.now() - 100;
+  stage.dispatchEvent(new PointerEvent('pointerdown', { bubbles: true, composed: true, pointerId: 3, clientX: 500, clientY: 300 }));
+  stage.dispatchEvent(new PointerEvent('pointerup', { bubbles: true, composed: true, pointerId: 3, clientX: 501, clientY: 300 }));
+  await c.updateComplete;
+  out.dblTapResets = c._zoom === 1;
+  // 6) локальный множитель иконок применяется
+  c._saveKioskScale({ icon: 2 }); await c.updateComplete;
+  const dl = sr().querySelector('.devlayer');
+  const size1 = dl.getAttribute('style');
+  c._saveKioskScale({ icon: 1 }); await c.updateComplete;
+  const size2 = sr().querySelector('.devlayer').getAttribute('style');
+  const v1 = parseFloat(size1.match(/--icon-size:([\d.]+)/)[1]);
+  const v2 = parseFloat(size2.match(/--icon-size:([\d.]+)/)[1]);
+  out.iconScaleWorks = Math.abs(v1 / v2 - 2) < 0.01;
+  out.persisted = JSON.parse(localStorage.getItem('houseplan_card_kiosk_v1')).icon === 1;
+  // 7) попап настроек экрана открывается (прямой вызов; долгое нажатие проверено таймером)
+  c._kioskDialog = true; await c.updateComplete;
+  out.dialogRenders = !!sr().querySelector('.dialog input[type="range"]');
+  c._kioskDialog = false;
+  // 8) карусель: тик двигает пространство, пауза после касания работает
+  const cs = c._space;
+  c._config = { ...c._config, cycle: 1 };
+  c._cyclePausedUntil = 0;
+  c._cycleTick(); await c.updateComplete;
+  out.cycleAdvances = c._space !== cs;
+  c._cyclePausedUntil = Date.now() + 60000;
+  const cs2 = c._space;
+  c._cycleTick(); await c.updateComplete;
+  out.cyclePaused = c._space === cs2;
+  // 9) обычная карточка (не киоск): шапка на месте, свайпа нет
+  const sr0 = c0.shadowRoot || c0.renderRoot;
+  out.normalHeader = !!sr0.querySelector('.hdr') && getComputedStyle(sr0.querySelector('.hdr')).display !== 'none';
+  c.remove();
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_layout_sync.mjs

@@ -0,0 +1,103 @@
+// HP-1460-03: позиции — отдельное состояние. В v1.46.0 событие layout_updated
+// научилась слушать статическая карточка, а полная — нет, поэтому две полные
+// карточки рядом расходились до перезагрузки. Проверяем и обратное: приход
+// чужой ревизии не должен затирать перетаскивание, которое ещё не улетело.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+
+  // общий «сервер»: layout с ревизией и подписчики на событие
+  let rev = 5;
+  let layout = { dev_a: { x: 10, y: 10 }, dev_b: { x: 20, y: 20 } };
+  const subs = [];
+  let gets = 0;
+  const hass = { ...c.hass,
+    callWS: async (m) => {
+      if (m.type === 'houseplan/layout/get') { gets++; return { layout: JSON.parse(JSON.stringify(layout)), rev }; }
+      if (m.type === 'houseplan/layout/update') {
+        layout = { ...layout, [m.device_id]: m.pos }; rev += 1;
+        subs.forEach((f) => f({ data: { rev } }));
+        return { ok: true, rev };
+      }
+      return base(m);
+    },
+    connection: { subscribeEvents: async (cb, ev) => {
+      if (ev === 'houseplan_layout_updated') { subs.push(cb); return () => {}; }
+      return () => {};
+    } },
+  };
+  c.hass = hass;
+  c._serverStorage = true;
+  c._layout = JSON.parse(JSON.stringify(layout));
+  c._layoutRev = rev;
+  c._unsubLayout = await hass.connection.subscribeEvents(
+    (e) => c._onLayoutEvent(Number(e?.data?.rev ?? -1)),
+    'houseplan_layout_updated',
+  );
+  out.subscribed = subs.length === 1;
+
+  // 1) чужая карточка подвинула иконку — наша обязана подхватить без перезагрузки
+  layout = { ...layout, dev_a: { x: 77, y: 88 } }; rev += 1;
+  subs.forEach((f) => f({ data: { rev } }));
+  await new Promise((r) => setTimeout(r, 350));
+  out.adoptedRemoteMove = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 77, y: 88 });
+  out.revFollowed = c._layoutRev === rev;
+
+  // 2) собственная запись не вызывает лишнего перечитывания
+  const before = gets;
+  c._layout = { ...c._layout, dev_b: { x: 31, y: 32 } };
+  c._dirtyPos.add('dev_b');
+  c._persistLayout();
+  c._persistLayout.flush();
+  await new Promise((r) => setTimeout(r, 350));
+  out.ownWriteNoReload = gets === before;
+  out.ownWriteKept = JSON.stringify(c._layout.dev_b) === JSON.stringify({ x: 31, y: 32 });
+
+  // 3) НАСТОЯЩЕЕ перетаскивание: debounce запланирован, запись задержана, а
+  //    layout/get отвечает мгновенно. Именно этот порядок и терял позицию:
+  //    flush() внутри перечитывания опустошал _dirtyPos ДО снятия снимка.
+  let releaseUpdate;
+  const updateGate = new Promise((r) => { releaseUpdate = r; });
+  let delayUpdate = true;
+  const plain = hass.callWS;
+  c.hass = { ...hass, callWS: async (m) => {
+    if (m.type === 'houseplan/layout/update' && delayUpdate) {
+      delayUpdate = false;
+      await updateGate;
+    }
+    return plain(m);
+  } };
+
+  c._layout = { ...c._layout, dev_a: { x: 5, y: 6 } };
+  c._dirtyPos.add('dev_a');
+  c._persistLayout();                              // debounce запланирован, не сброшен вручную
+  layout = { ...layout, dev_b: { x: 99, y: 99 } }; rev += 1;
+  subs.forEach((f) => f({ data: { rev } }));
+  await new Promise((r) => setTimeout(r, 400));
+  out.dragKeptWhileWriteInFlight = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.remoteChangeApplied = JSON.stringify(c._layout.dev_b) === JSON.stringify({ x: 99, y: 99 });
+
+  releaseUpdate();
+  await new Promise((r) => setTimeout(r, 350));
+  out.localDragSurvived = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.serverAgrees = JSON.stringify(layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.sentPosDrained = c._sentPos.size === 0;
+  return out;
+});
+// зафиксировано прогоном на v1.46.1 и сверено с кодом
+checkAll(res, {
+  subscribed: true,
+  adoptedRemoteMove: true,
+  revFollowed: true,
+  ownWriteNoReload: true,
+  ownWriteKept: true,
+  dragKeptWhileWriteInFlight: true,
+  remoteChangeApplied: true,
+  localDragSurvived: true,
+  serverAgrees: true,
+  sentPosDrained: true,
+});
+await finish(browser);

demo/smoke_light_default_tap.mjs

@@ -0,0 +1,34 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  // лампа (primary light) без явного действия → клик = toggle
+  const lamp = c._devices.find((d) => d.primary?.startsWith('light.') && !d.tapAction);
+  out.hasLamp = !!lamp;
+  c._infoCard = null;
+  c._clickDevice(new MouseEvent('click'), lamp);
+  out.lampToggles = JSON.stringify(calls.at(-1)) === JSON.stringify(['homeassistant', 'toggle', lamp.primary]);
+  // устройство с не-light primary (сенсор) → клик = инфо
+  const sensorDev = c._devices.find((d) => d.primary?.startsWith('sensor.') && !d.tapAction);
+  const n = calls.length;
+  c._infoCard = null;
+  c._clickDevice(new MouseEvent('click'), sensorDev);
+  out.sensorInfo = calls.length === n && !!c._infoCard;
+  c._infoCard = null;
+  // явный info у лампы отключает дефолт
+  const cfgm = { id: lamp.id, binding: lamp.bindingKind + ':' + lamp.bindingRef, tap_action: 'info' };
+  c._serverCfg = { ...c._serverCfg, markers: [...(c._serverCfg.markers || []).filter((m) => m.id !== lamp.id), cfgm] };
+  c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  const lamp2 = c._devices.find((d) => d.id === lamp.id);
+  const n2 = calls.length;
+  c._clickDevice(new MouseEvent('click'), lamp2);
+  out.explicitInfoWins = calls.length === n2 && !!c._infoCard;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_lock_action.mjs

@@ -0,0 +1,52 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  window.confirm = () => true; // review CR-1: unlocking now confirms
+  c.hass = { ...c.hass, callService: (d, s, data) => calls.push([d, s, data.entity_id]) };
+  await c.updateComplete;
+  // добавить дверь с замком на f1
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({
+    ...s, openings: [{ id: 'op1', type: 'door', rx: 550, ry: 200, angle: 90, len_cm: 90, lock: 'lock.front_door' }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const op = c._spaceModel()?.openings?.[0] || { id: 'op1', type: 'door', rx: 550, ry: 200, len_cm: 90, lock: 'lock.front_door' };
+  out.hasLockedDoor = !!op.lock;
+  const lockId = op.lock;
+  // 1) замок закрыт → кнопка "Unlock"
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'locked', attributes: {} } } };
+  c._openingInfo = op; await c.updateComplete;
+  let btn = sr().querySelector('.btn.lockact');
+  out.unlockBtnShown = !!btn && !btn.disabled;
+  out.unlockBtnDanger = btn?.classList.contains('warn');
+  btn.click();
+  out.unlockCalled = JSON.stringify(calls.at(-1)) === JSON.stringify(['lock', 'unlock', lockId]);
+  // 2) замок открыт → кнопка "Lock"
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'unlocked', attributes: {} } } };
+  await c.updateComplete;
+  btn = sr().querySelector('.btn.lockact');
+  btn.click();
+  out.lockCalled = JSON.stringify(calls.at(-1)) === JSON.stringify(['lock', 'lock', lockId]);
+  // 3) переходное состояние → кнопка задизейблена, сервис не зовётся
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'unlocking', attributes: {} } } };
+  await c.updateComplete;
+  btn = sr().querySelector('.btn.lockact');
+  out.pendingDisabled = !!btn && btn.disabled;
+  // 4) недоступен → кнопки нет
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'unavailable', attributes: {} } } };
+  await c.updateComplete;
+  out.noBtnWhenUnavailable = !sr().querySelector('.btn.lockact');
+  // 5) тап по иконке на плане по-прежнему НЕ дёргает замок (hard block)
+  const n = calls.length;
+  const dev = c._devices.find((d) => d.domains?.includes('lock'));
+  out.planTapStillBlocked = true;
+  if (dev) {
+    c._clickDevice(new MouseEvent('click'), dev); await c.updateComplete;
+    out.planTapStillBlocked = !calls.slice(n).some((x) => x[0] === 'lock' && (x[1] === 'lock' || x[1] === 'unlock'));
+  }
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_lock_invariant.mjs

@@ -0,0 +1,48 @@
+// review CR-1: exercise EVERY actuation path and prove locks/alarms are safe
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push(`${d}.${s}:${data.entity_id}`); return Promise.resolve(); },
+    states: { ...c.hass.states,
+      'lock.front_door': { state: 'locked', attributes: { friendly_name: 'Front door' } },
+      'alarm_control_panel.home': { state: 'armed_away', attributes: {} } } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  const lockCalls = () => calls.filter((x) => x.includes('lock.') || x.includes('alarm_control_panel.'));
+  // 1) тап по значку устройства с замком
+  const lockDev = c._devices.find((d) => d.entities?.some((e) => e.startsWith('lock.'))) || c._devices[0];
+  const fake = { ...lockDev, primary: 'lock.front_door', tapAction: 'toggle',
+    marker: { ...(lockDev.marker || {}), tap_action: 'toggle' } };
+  c._clickDevice(new MouseEvent('click'), fake);
+  out.iconTapSafe = lockCalls().length === 0;
+  // 2) controls[] с замком внутри
+  const withControls = { ...fake, tapAction: 'toggle',
+    marker: { controls: ['lock.front_door', 'alarm_control_panel.home'], tap_action: 'toggle' } };
+  c._clickDevice(new MouseEvent('click'), withControls);
+  out.controlsSafe = lockCalls().length === 0;
+  // 3) карточка устройства: замок отдаётся в more-info, а не тумблером
+  const kinds = c._cardEntities({ ...fake, entities: ['lock.front_door', 'alarm_control_panel.home'] });
+  out.cardNoToggleForLocks = kinds.every((k) => k.kind !== 'toggle');
+  c._cardToggle('lock.front_door');
+  c._cardToggle('alarm_control_panel.home');
+  out.cardToggleRefuses = lockCalls().length === 0;
+  // 4) кнопка в карточке двери — единственная разрешённая поверхность, и спрашивает подтверждение
+  let asked = null;
+  window.confirm = (msg) => { asked = msg; return false; };
+  c._lockAction('lock.front_door', 'unlock');
+  out.unlockAsksConfirm = asked !== null && lockCalls().length === 0;
+  window.confirm = () => true;
+  c._lockAction('lock.front_door', 'unlock');
+  out.unlockAfterConfirm = calls.at(-1) === 'lock.unlock:lock.front_door';
+  // запирание не спрашивает
+  asked = null;
+  window.confirm = (m) => { asked = m; return true; };
+  c._lockAction('lock.front_door', 'lock');
+  out.lockNoConfirm = asked === null && calls.at(-1) === 'lock.lock:lock.front_door';
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_marker_stay.mjs

@@ -0,0 +1,46 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  c._setMode('devices'); await c.updateComplete;
+  const near = (a, b) => a && b && Math.abs(a.x - b.x) < 1e-6 && Math.abs(a.y - b.y) < 1e-6 && a.s === b.s;
+  // подопытный: авто-устройство с сохранённой позицией
+  const dev = c._devices.find((d) => !d.virtual && !d.marker && c._layout[d.id]);
+  out.hasDev = !!dev;
+  const pos0 = { ...c._layout[dev.id] };
+  // 1) смена комнаты (та же space) → позиция не меняется
+  const otherRoom = c._spaceModel(dev.space).rooms.find((r) => r.id && r.area && r.area !== dev.area);
+  out.hasOtherRoom = !!otherRoom;
+  c._openMarkerDialog(dev);
+  c._markerDialog = { ...c._markerDialog, room: dev.space + '#' + otherRoom.area };
+  await c._saveMarker(); await c.updateComplete;
+  out.stayAfterRoomChange = near(c._layout[dev.id], pos0);
+  // вернуть комнату назад
+  c._openMarkerDialog(c._devices.find((d) => d.id === dev.id));
+  c._markerDialog = { ...c._markerDialog, room: dev.space + '#' + dev.area };
+  await c._saveMarker(); await c.updateComplete;
+  // 2) смена привязки device -> entity (id меняется) → позиция мигрирует
+  const freeEnt = Object.keys(c.hass.states).find((e) => e.startsWith('sensor.') &&
+    !c._devices.some((d) => d.id === 'lg_' + e));
+  out.hasFreeEnt = !!freeEnt;
+  c._openMarkerDialog(c._devices.find((d) => d.id === dev.id));
+  c._markerDialog = { ...c._markerDialog, binding: 'entity:' + freeEnt };
+  await c._saveMarker(); await c.updateComplete;
+  const newId = 'lg_' + freeEnt;
+  out.migrated = near(c._layout[newId], pos0);
+  out.oldGone = !c._layout[dev.id];
+  // 3) новый виртуальный маркер по-прежнему центрируется в выбранной комнате
+  c._openMarkerDialog();
+  const room = c._spaceModel().rooms.find((r) => r.id && r.area);
+  c._markerDialog = { ...c._markerDialog, name: 'Тест', binding: 'virtual', room: c._space + '#' + room.area };
+  await c._saveMarker(); await c.updateComplete;
+  const vid = c._serverCfg.markers.find((m) => m.name === 'Тест')?.id;
+  const center = c._roomCenter(room);
+  const vpos = c._layout[vid];
+  const aspect = c._curSpaceCfg.aspect || 1;
+  out.newCentered = vpos && Math.abs(vpos.x * 1000 - center[0]) < 1 && Math.abs(vpos.y * (1000 / aspect) - center[1]) < 1;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_merge_highlight.mjs

@@ -0,0 +1,24 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); c._tool = 'merge'; await c.updateComplete;
+  const room = c._spaceModel().rooms.find((r) => r.name);
+  c._mergeSel = room.id; c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250)); // дождаться transition 0.12s
+  const el = [...sr().querySelectorAll('.room')].find((e) => e.classList.contains('picked'));
+  out.pickedRendered = !!el;
+  const cs = el ? getComputedStyle(el) : null;
+  out.amberStroke = cs ? cs.stroke.includes('255, 193, 77') : null;
+  out.amberFill = cs ? cs.fill.includes('255, 193, 77') : null;
+  // split-выбор подсвечивается так же
+  c._mergeSel = null; c._tool = 'split'; c._splitSel = { roomId: room.id, pts: [] }; c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const el2 = [...sr().querySelectorAll('.room')].find((e) => e.classList.contains('picked'));
+  out.splitPicked = !!el2 && getComputedStyle(el2).stroke.includes('255, 193, 77');
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_merge_split.mjs

@@ -0,0 +1,87 @@
+// Merge & split room ops (v1.21.0) via the card's markup handlers (norm coords).
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const snap = await page.evaluate(() => JSON.stringify(window.__card._serverCfg));
+const restore = () => page.evaluate((s) => {
+  const c = window.__card; c._serverCfg = JSON.parse(s);
+  c._mergeSel = null; c._mergeDialog = null; c._splitSel = null; c._pendingSplit = null; c._roomDialog = false;
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); return c.updateComplete && true;
+}, snap);
+// norm→render helper mirrors what _markupClick passes to handlers
+const R = (nx, ny) => page.evaluate(([nx, ny]) => {
+  const c = window.__card; const H = 1000 / c._curSpaceCfg.aspect; return [nx * 1000, ny * H];
+}, [nx, ny]);
+const S = () => page.evaluate(() => {
+  const c = window.__card;
+  return { rooms: c._serverCfg.spaces.find((s) => s.id==='f1').rooms.map((r)=>({id:r.id,name:r.name,area:r.area})),
+    mergeDlg: !!c._mergeDialog, roomDlg: !!c._roomDialog, pendingSplit: !!c._pendingSplit, toast: c._toast };
+});
+const enter = (t) => page.evaluate((t)=>{const c=window.__card; if(!c._markup)c._setMode('plan'); c._tool=t; return true;}, t);
+const out = {};
+
+// MERGE living(r1)+kitchen(r2) — share wall x=0.55, y∈[0.05..0.45]
+await enter('merge');
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.3,0.3));
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.75,0.25));
+out.mergeDialog = (await S()).mergeDlg;
+await page.evaluate(()=>window.__card._commitMerge());
+let s = await S();
+out.mergeRooms = s.rooms.length;                          // 4→3
+out.mergeKeptR1 = s.rooms.some(r=>r.id==='r1');
+out.mergeDroppedR2 = !s.rooms.some(r=>r.id==='r2');
+await restore();
+
+// MERGE non-adjacent: living(r1)+garden's-only? use r2+r4 (kitchen & hallway don't share a wall)
+await enter('merge');
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.75,0.25)); // kitchen
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.3,0.8));   // hallway
+s = await S();
+out.nonAdjRefused = !s.mergeDlg && s.rooms.length===4;
+out.nonAdjToast = !!s.toast;
+await restore();
+
+// grid-aligned test room (real rooms are snapped; demo rooms are not)
+await page.evaluate(()=>{
+  const c=window.__card;
+  c._serverCfg.spaces.find(s=>s.id==='f1').rooms.push(
+    {id:'rg', name:'GridRoom', area:null, poly:[[0.05,0.0625],[0.5,0.0625],[0.5,0.5],[0.05,0.5]]});
+  c._regSignature=''; c._maybeRebuildDevices(); c.requestUpdate();
+});
+// SPLIT rg vertical chord x=0.25 (all on grid nodes)
+await enter('split');
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.28,0.28));  // pick rg
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.0625)); // wall pt a
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.5));  // wall pt b
+out.splitPending = (await S()).pendingSplit;
+out.splitDialog = (await S()).roomDlg;
+// cancel keeps it whole
+await page.evaluate(()=>window.__card._roomDialogCancel());
+out.cancelWhole = (await S()).rooms.length===5; // 4 базовых + rg
+// redo + confirm with a name (no area)
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.28,0.28));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.0625));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.5));
+await page.evaluate(()=>{const c=window.__card; c._nameSel='Cabinet'; c._saveRoomNoArea();});
+s = await S();
+out.splitRooms = s.rooms.length===6;                      // 4 базовых + rg разрезанная надвое
+out.bigKeepsLiving = s.rooms.some(r=>r.id==='r1' && r.area==='living_room');
+out.newRoom = s.rooms.find(r=>!['r1','r2','r3','r4','rg'].includes(r.id))?.name;
+await restore();
+
+// SPLIT along a wall → refused (both pts on top wall of rg)
+await page.evaluate(()=>{const c=window.__card; c._serverCfg.spaces.find(s=>s.id==='f1').rooms.push(
+  {id:'rg2', name:'G2', area:null, poly:[[0.05,0.0625],[0.5,0.0625],[0.5,0.5],[0.05,0.5]]});
+  c._regSignature=''; c._maybeRebuildDevices();});
+await enter('split');
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.28,0.28));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.1,0.0625));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.4,0.0625));
+s = await S();
+out.alongWallRefused = !s.roomDlg && !s.pendingSplit;
+
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(out, {
+  "mergeRooms": 3,
+  "newRoom": "Cabinet",
+});
+await finish(browser, out);