Release v1.46.0

Full external audit of v1.45.4: sandboxed SVG content (release blocker),
transactional attachments, serialized config writes, geometry-aware openPairs
cache, inner validation limits, streaming file I/O, static-card parity, layout
revisions and events, repair issue cleanup, dev dependency bump.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,36 @@
+name: Bug report
+description: Something in House Plan does not work as expected
+labels: [bug]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: House Plan version
+      placeholder: v1.13.0
+    validations:
+      required: true
+  - type: input
+    id: ha_version
+    attributes:
+      label: Home Assistant version
+      placeholder: "2026.6"
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened / what did you expect?
+      description: Steps to reproduce help a lot.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / browser console errors
+      description: "Settings → System → Logs (search: houseplan) and the browser console (F12)."
+      render: text
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Diagnostics
+      description: "Settings → Devices & services → House Plan → ⋯ → Download diagnostics (personal fields are redacted automatically)."

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 💬 Telegram chat (@ha_houseplan)
+    url: https://t.me/ha_houseplan
+    about: Questions, setup help, ideas and screenshots — the fastest way to get an answer.
+  - name: 💡 GitHub discussions
+    url: https://github.com/Matysh/houseplan-card/discussions
+    about: Longer-form ideas and show-and-tell.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,14 @@
+name: Feature request
+description: An idea to make House Plan better
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: How do you imagine it working?

.github/workflows/validate.yml

@@ -34,12 +34,50 @@ jobs:
         run: npm run build
       - name: Card bundle in sync with integration
         run: cmp dist/houseplan-card.js custom_components/houseplan/frontend/houseplan-card.js
+  smoke:
+    # audit T2: the end-to-end layer used to run only when a human remembered.
+    # Gated on `frontend` so a typecheck failure does not burn browser minutes.
+    needs: frontend
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm ci
+      - name: Install Chromium for Playwright
+        run: npx playwright install --with-deps chromium
+      - name: Build a FRESH bundle for the smokes
+        # the committed demo/srv/assets copy is a snapshot; testing it would
+        # report green about code that no longer exists (audit T2)
+        run: npm run build && cp dist/houseplan-card.js demo/srv/assets/houseplan-card.js
+      - name: Smoke suite
+        run: |
+          fail=0
+          mkdir -p /tmp/smoke-logs
+          for f in demo/smoke_*.mjs; do
+            name=$(basename "$f" .mjs)
+            if node "$f" > "/tmp/smoke-logs/$name.log" 2>&1; then
+              echo "ok   $name"
+            else
+              echo "FAIL $name"
+              tail -20 "/tmp/smoke-logs/$name.log"
+              fail=1
+            fi
+          done
+          exit $fail
+      - name: Upload smoke logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-logs
+          path: /tmp/smoke-logs
+
   backend:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
-        with: { python-version: "3.12" }
-      - run: pip install pytest voluptuous
-      - name: Backend unit tests
+        with: { python-version: "3.13" }
+      - run: pip install pytest voluptuous pytest-homeassistant-custom-component home-assistant-frontend
+      - name: Backend unit tests (pure + HA harness)
         run: python -m pytest tests_backend/ -q

CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing to House Plan
+
+Thanks for your interest! The project is one HACS package: a storage **integration**
+(`custom_components/houseplan/`, Python) and a **Lovelace card** (`src/`, TypeScript + Lit).
+
+## Changelog
+
+User-visible changes go into **both** changelogs in the same commit:
+`docs/CHANGELOG.md` (English) and `docs/CHANGELOG.ru.md` (Russian). Entries
+older than v1.42.0 exist only in the English file — no need to backfill them.
+
+## Where to ask
+
+Not sure whether something is a bug, or just want to discuss an idea before
+writing code? The **[Telegram chat @ha_houseplan](https://t.me/ha_houseplan)**
+is the quickest route to the author and other users. Bugs and concrete feature
+requests still belong in [issues](https://github.com/Matysh/houseplan-card/issues).
+
+## Five-minute setup
+
+```bash
+git clone https://github.com/Matysh/houseplan-card && cd houseplan-card
+npm ci                    # frontend toolchain
+npm run typecheck         # tsc --noEmit (strict)
+npm test                  # node:test — pure logic, i18n parity, tap-action security
+npm run build             # tsc + rollup → dist/houseplan-card.js
+pip install pytest voluptuous && python -m pytest tests_backend -q   # pure backend tests
+```
+
+The HA-harness backend tests (`tests_backend/test_ha_*.py`) need Python ≥3.13 and
+`pytest-homeassistant-custom-component home-assistant-frontend`; CI runs them on
+every push — locally they are skipped when `homeassistant` is not importable.
+
+## Ground rules
+
+- **Docs in the same commit**: CHANGELOG entry for user-visible changes;
+  `docs/STATUS.md` for state changes; `docs/DEVELOPMENT.md` for new gotchas.
+- Every UI string goes through `src/i18n/<lang>.json` (tests enforce en/ru key parity).
+  Adding a language = adding one JSON file + registering it in `src/i18n.ts`.
+- The built card must be committed in sync: `cp dist/houseplan-card.js
+  custom_components/houseplan/frontend/` (CI compares them byte-for-byte).
+- Tap actions have a security model (locks/alarms never toggle from the plan) —
+  see `resolveTapAction` in `src/logic.ts`; don't weaken it.
+- Follow the Integration Quality Scale where applicable —
+  `custom_components/houseplan/quality_scale.yaml` tracks the self-assessment.
+
+## Architecture
+
+Start with `docs/ARCHITECTURE.md` (data model, WS API, coordinate system) and
+`docs/STATUS.md` (current state). Release: bump the version in `package.json`,
+`manifest.json`, `const.py`, `CARD_VERSION`, tag `vX.Y.Z`, publish a GitHub release —
+the workflow attaches the card bundle.

README.md

@@ -1,10 +1,40 @@
-# 🏠 House Plan — an interactive house plan for Home Assistant
+# 🏠 House Plan — interactive floor plan card for Home Assistant
 
-**A live map of your home right inside Home Assistant: floors, rooms and devices on a real floor plan — with live states, temperature and signal strength. Everything is configured with the mouse, without a single line of YAML.**
+[![HACS Custom](https://img.shields.io/badge/HACS-Custom-41BDF5.svg)](https://github.com/hacs/integration)
+[![GitHub release](https://img.shields.io/github/v/release/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/releases)
+[![GitHub stars](https://img.shields.io/github/stars/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/stargazers)
+[![CI](https://github.com/Matysh/houseplan-card/actions/workflows/validate.yml/badge.svg)](https://github.com/Matysh/houseplan-card/actions)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Telegram chat](https://img.shields.io/badge/Telegram-chat-2CA5E0?logo=telegram&logoColor=white)](https://t.me/ha_houseplan)
 
-![Interactive house plan with devices](docs/images/01-plan.png)
+**Turn Home Assistant into a live, interactive map of your home.** Upload or draw
+a floor plan, outline the rooms with your mouse — and every smart device appears
+in its real place: live states, tap-to-toggle lights, temperature and humidity per
+room, Zigbee signal maps, glowing light pools and a fullscreen kiosk mode for wall
+tablets. No YAML, no Inkscape, no external editors — the whole floorplan lives
+right on your Lovelace dashboard.
 
-🇷🇺 [Документация на русском](README.ru.md)
+![Interactive Home Assistant floor plan: live rooms, devices, lights and climate on a real floorplan card](docs/images/demo.gif)
+
+🇷🇺 [Документация на русском](README.ru.md) · 💬 [Telegram chat: **@ha_houseplan**](https://t.me/ha_houseplan)
+
+**Feature highlights**
+
+- 🖱 **GUI-first floorplan editor** — rooms, doors & windows, island rooms,
+  virtual walls and a visual decor layer, all drawn with clicks; smart
+  alignment guides and a live ruler in real meters/feet.
+- 💡 **Lights toggle on click** out of the box; wall-switch markers can control
+  whole groups of lights (works for dumb switches and stateless remotes too).
+- 🌒 **“Light sources” fill** — a dark house where every lit lamp casts a pool
+  of its own color that spills through doorways and open zone boundaries.
+- 🌡 **Room cards** with temperature, humidity, Zigbee LQI and light count;
+  comfort-range temperature fills, per-room signal heatmap.
+- 🚪 **Doors, windows and locks** with contact sensors — unlocking is always an
+  explicit button, never an accidental tap.
+- 📺 **Kiosk mode** for wall tablets and TVs: fullscreen, swipe between floors,
+  auto-carousel, per-screen icon sizes.
+- 🔔 New devices appear automatically with a red “new” dot; the layout is stored
+  **server-side** — one shared plan for every user and screen, synced live.
 
 ---
 
@@ -49,8 +79,30 @@ Key advantages in short:
 
 ---
 
+## Wall tablet / TV (kiosk mode)
+
+Add the card to a dedicated dashboard with a **panel view** and set `kiosk: true`
+(or tick "Wall device (kiosk) mode" in the card editor):
+
+```yaml
+type: custom:houseplan-card
+kiosk: true
+cycle: 0   # seconds between auto space switches, 0 = off (nice for TVs)
+```
+
+No header, no editors — just the live plan. Swipe to change floors (at 1:1),
+pinch to zoom, double-tap to reset. Long-press an empty spot for 3 seconds to
+tune icon and text sizes for THIS screen (saved per device). To hide Home
+Assistant's own header use the companion app's kiosk settings or the
+[kiosk-mode](https://github.com/NemesisRE/kiosk-mode) plugin.
+
 ## Installation
 
+One click if you already run HACS:
+
+[![Open your Home Assistant instance and open a repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=Matysh&repository=houseplan-card&category=integration)
+
+
 ### Via HACS (recommended)
 
 1. Open **HACS → menu (⋮) → Custom repositories**.
@@ -60,6 +112,21 @@ Key advantages in short:
 
 The card is registered automatically — no need to add a Lovelace resource manually.
 
+> **Card doesn't load (`Custom element doesn't exist: houseplan-card`) or you manage Lovelace
+> resources in YAML?** Add the resource manually pointing at the URL the integration *serves*:
+>
+> ```yaml
+> resources:
+>   - url: /houseplan_files/houseplan-card.js
+>     type: module
+> ```
+>
+> Do **not** use `/custom_components/houseplan/frontend/houseplan-card.js` — that is the file
+> on disk, which Home Assistant does not serve over HTTP (you'll get a `text/plain` MIME error
+> and the element never registers). The correct, integration-served URL is
+> `/houseplan_files/houseplan-card.js`. Both cards (`houseplan-card` and
+> `houseplan-space-card`) ship in that one file — no separate resource is needed.
+
 ### Manually
 
 1. Copy the `custom_components/houseplan` folder into the `config/custom_components` directory of your Home Assistant.
@@ -84,6 +151,8 @@ Nothing else needs to be specified — everything else is configured right on th
 ### Step 1. Add a space (floor)
 
 On first open the plan is still empty — House Plan immediately offers to create the first space.
+If your Home Assistant already has **floors** configured, a wizard offers to create a space
+for each floor (names prefilled, a plan image is asked for one by one; any floor can be skipped).
 
 ![Empty plan — prompt to add a space](docs/images/02-onboarding-empty.png)
 
@@ -97,12 +166,35 @@ Later you can add as many spaces as you like (floors, yard, garage) with the **
 
 ### Step 2. Outline the rooms
 
-After the first space is added, the card switches to markup mode by itself. Click grid points, connecting them with lines, and close the room outline by clicking the first point.
+After the first space is added, the card switches to the **Plan** tab by itself. The card has three mode tabs in the header — **View** (default: display and device control only, nothing can be moved or edited), **Plan** (rooms, openings, labels, space settings) and **Devices** (placing and configuring markers); the edit tabs are shown to administrators. In Plan, click grid points, connecting them with lines, and close the room outline by clicking the first point.
 
 As soon as the outline is closed, the room-save dialog appears. Here you need to **bind the room to a Home Assistant area** — this is exactly what enables the automation. For utility rooms with no devices (hall, sauna) there is a **"No area"** button.
 
 ![Marking up a room and saving it](docs/images/05-room-dialog.png)
 
+While drawing, a ruler follows the cursor showing the current segment's real length (metres, or feet + inches on an imperial Home Assistant). The scale is set per space — the **"Scale (grid cell size)"** field in the space dialog says how many centimetres one grid cell represents (default 5 cm).
+
+Rooms may not overlap: a click strictly inside an existing room, or an outline that would swallow one, is refused. Two more tools help you reshape the plan later:
+
+- **Merge** — click a room, then a neighbour that shares a wall; they fuse into one. A dialog picks which name and area survive.
+- **Split** — click a room, then two points on its walls; the chord cuts it in two. The bigger part stays the room it was (name, area, devices); the smaller one asks for a new name and area.
+
+
+### Doors, windows and locks
+
+In markup mode the **"Opening"** tool places doors and windows: click next to a wall and the
+opening snaps onto it. Pick the type, the **length in real centimetres** (defaults: door 90 cm,
+window 120 cm), an open/close sensor and — for doors — a **lock entity**.
+
+With a sensor bound, the plan comes alive: the door leaf swings on its hinge and the swing arc
+draws itself in as the real door opens; a window opens its two casements. While open, the moving
+parts take an accent colour. A door with a lock shows a padlock badge next to it — green when
+locked, orange when unlocked. For safety the lock can **not** be toggled from the plan; a click
+on the opening shows a status card with both states instead.
+
+Openings are easy to adjust later: hovering one highlights it, you can **drag it along the
+walls** (it slides around corners too), and a **double click opens its properties**.
+
 ### Step 3. Devices appear by themselves
 
 As soon as you save a room bound to an area, **the devices of that area are automatically laid out inside the outline**. These are the same devices shown on the **Settings → Devices → (filtered by the room)** page — only the meaningful ones, without service records, bridges and duplicates.
@@ -121,14 +213,39 @@ The mouse wheel or the **－ / ⊹ / ＋** buttons zoom the plan in and out; on
 
 ### Step 5. Put the icons in their places
 
-Device icons can be **dragged with the mouse at any time** — no separate "edit mode" needs to be enabled. Positions are saved on the server and are identical in all browsers and devices. The **↺** button in the header restores the automatic layout.
+Switch to the **Devices** tab to arrange icons: drag them with the mouse, click one to open its editor. In **View** mode nothing can be moved — panning the map never displaces a sensor (a top user request). Positions are saved on the server and are identical in all browsers and devices. The **↺** button restores the automatic layout.
 
 ![Dragging icons — available at all times](docs/images/06-edit.png)
 
+### Tap actions: control devices from the plan
+
+By default a tap on an icon opens its info card. In the card settings you can switch
+**Tap on a device** to *Toggle* — a tap then switches lights, sockets, fans and
+humidifiers directly on the plan (wall-tablet style). For safety, a card-wide toggle
+never affects locks, alarms, covers or valves; you can consciously enable toggle for a
+specific device (except locks and alarms — those never toggle from the plan) in its
+edit dialog. A **long press** always opens the info card.
+
+### Icon rules
+
+Which MDI icon a device gets is decided by **icon rules** — editable right in the card
+(the ⬡ button in the header): an ordered list of “name pattern → icon” regexes with a
+live test field, bilingual defaults (EN/RU) and a one-click reset. When no rule
+matches, the entity *device class* decides (thermometer for temperature sensors, etc.).
+
 ### Step 6. Adding your own devices manually
 
+You can also place a **single entity** (not just a whole device): start typing in the binding search and individual entities appear next to devices — handy when one device exposes several values (e.g. temperature and humidity) and you want each as its own icon.
+
+
 Not everything has to be left to the automation. With the **＋** button in the header you can place any device, group or a **virtual point** on the plan (for example, an "Inlet valve" that does not exist as a device). Set a name, icon, model, link, description and, if you wish, attach a **PDF manual**.
 
+The same dialog controls how the device looks on the plan. **Display** switches between the
+icon badge, an animated **presence ripple** (pulsing rings while the entity is active, a faint
+dot when idle — great for motion sensors) or both, with a per-device ring colour and size. The
+**icon size** (×0.5–3) and **rotation** are also per-device, so a wall valve can be small and
+turned the way it is mounted.
+
 ![Adding a device manually](docs/images/07-marker-dialog.png)
 
 ---
@@ -142,6 +259,24 @@ Not everything has to be left to the automation. With the **＋** button in the
 
 ---
 
+## Getting help & sharing your plan
+
+- 💬 **[Telegram chat — @ha_houseplan](https://t.me/ha_houseplan)** — questions,
+  setup help, feature ideas, and screenshots of your plans. The fastest way to
+  reach the author and other users.
+- 🐞 [GitHub issues](https://github.com/Matysh/houseplan-card/issues) — bug
+  reports and feature requests (please attach your House Plan version).
+- 💡 [GitHub discussions](https://github.com/Matysh/houseplan-card/discussions) —
+  longer-form ideas.
+- 📜 [Changelog](docs/CHANGELOG.md) — what changed in every version
+  ([на русском](docs/CHANGELOG.ru.md)).
+
+When reporting a problem, the version number helps a lot: it is shown in the
+browser console on load (`HOUSEPLAN-CARD vX.Y.Z`) and in **Settings → Devices &
+Services → House Plan**.
+
+---
+
 ## Frequently asked questions
 
 **Do I need to write anything in YAML?** No. The only line is adding the card to the dashboard; everything else is done with the mouse.

README.ru.md

@@ -1,13 +1,42 @@
-# 🏠 House Plan — интерактивный план дома для Home Assistant
+# 🏠 House Plan — интерактивный поэтажный план дома для Home Assistant
 
-**Живая карта вашего дома прямо в Home Assistant: этажи, комнаты и устройства на настоящем плане — с реальными состояниями, температурой и уровнем сигнала. Всё настраивается мышкой, без единой строчки YAML.**
+[![HACS Custom](https://img.shields.io/badge/HACS-Custom-41BDF5.svg)](https://github.com/hacs/integration)
+[![GitHub release](https://img.shields.io/github/v/release/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/releases)
+[![GitHub stars](https://img.shields.io/github/stars/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/stargazers)
+[![Telegram chat](https://img.shields.io/badge/Telegram-чат-2CA5E0?logo=telegram&logoColor=white)](https://t.me/ha_houseplan)
 
-![Интерактивный план дома с устройствами](docs/images/01-plan.png)
+**Превратите Home Assistant в живую интерактивную карту дома.** Загрузите или
+нарисуйте план этажа, обведите комнаты мышкой — и умные устройства появятся на
+своих местах: живые состояния, свет по клику, температура и влажность по
+комнатам, карта Zigbee-сигнала, светящиеся пятна ламп и полноэкранный
+киоск-режим для настенного планшета. Без YAML, без Inkscape и внешних
+редакторов — весь план настраивается прямо на дашборде.
 
-🇬🇧 [English documentation](README.md)
+![Интерактивный план дома для Home Assistant: комнаты, устройства, свет и климат на реальном поэтажном плане](docs/images/demo.gif)
+
+🇬🇧 [Documentation in English](README.md) · 💬 [Чат в Telegram: **@ha_houseplan**](https://t.me/ha_houseplan)
+
+**Главное**
+
+- 🖱 **Редакторы прямо в карточке** — комнаты, двери и окна, комнаты-острова,
+  виртуальные стены и декор-слой рисуются кликами; помощник выравнивания и
+  линейка в реальных метрах.
+- 💡 **Свет переключается кликом** из коробки; значок выключателя может
+  управлять группой ламп (в т.ч. «тупые» выключатели и кнопки-пульты).
+- 🌒 **Заливка «Свет по источникам»** — тёмный дом, где каждая горящая лампа
+  даёт пятно своего цвета, проникающее через дверные проёмы и открытые зоны.
+- 🌡 **Карточки комнат**: температура, влажность, Zigbee-сигнал, свет «1 из 3»;
+  температурная заливка по комфортным границам.
+- 🚪 **Двери, окна и замки** с датчиками — отпирание только явной кнопкой,
+  никогда случайным тапом.
+- 📺 **Киоск-режим** для настенных планшетов и ТВ: полноэкранно, свайп между
+  этажами, автокарусель, свои размеры на каждом экране.
+- 🔔 Новые устройства сами появляются на плане с красной точкой; раскладка
+  хранится **на сервере HA** — один план для всех экранов, живая синхронизация.
 
 ---
 
+
 ## Что это и зачем
 
 House Plan показывает ваш умный дом так, как он выглядит на самом деле — на плане этажей. Вместо длинных списков сущностей вы видите комнаты и устройства на своих местах: где протечка, какая температура в детской, включён ли свет в прихожей, открыты ли ворота.
@@ -49,8 +78,30 @@ House Plan показывает ваш умный дом так, как он в
 
 ---
 
+## Настенный планшет / ТВ (киоск-режим)
+
+Отдельный дашборд с view типа «панель», у карточки — `kiosk: true` (или
+галочка «Режим настенного устройства» в редакторе карточки):
+
+```yaml
+type: custom:houseplan-card
+kiosk: true
+cycle: 0   # автосмена пространств каждые N секунд, 0 = выкл (удобно для ТВ)
+```
+
+Без шапки и редакторов — только живой план. Свайп листает этажи (при 1:1),
+пинч — зум, двойной тап — сброс. Долгое нажатие (3 с) по пустому месту —
+настройка размеров значков и текста для ЭТОГО экрана (хранится на
+устройстве). Шапку самого Home Assistant скрывают настройки companion-app
+или плагин [kiosk-mode](https://github.com/NemesisRE/kiosk-mode).
+
 ## Установка
 
+В один клик, если у вас уже есть HACS:
+
+[![Open your Home Assistant instance and open a repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=Matysh&repository=houseplan-card&category=integration)
+
+
 ### Через HACS (рекомендуется)
 
 1. Откройте **HACS → меню (⋮) → Custom repositories**.
@@ -60,6 +111,21 @@ House Plan показывает ваш умный дом так, как он в
 
 Карточка подключается автоматически — добавлять ресурс Lovelace вручную не нужно.
 
+> **Карточка не грузится (`Custom element doesn't exist: houseplan-card`) или вы ведёте ресурсы
+> Lovelace в YAML?** Добавьте ресурс вручную, указав URL, который *раздаёт сама интеграция*:
+>
+> ```yaml
+> resources:
+>   - url: /houseplan_files/houseplan-card.js
+>     type: module
+> ```
+>
+> **Не** используйте `/custom_components/houseplan/frontend/houseplan-card.js` — это путь к файлу
+> на диске, который Home Assistant не отдаёт по HTTP (получите ошибку MIME `text/plain`, и элемент
+> не зарегистрируется). Правильный URL, который раздаёт интеграция, — `/houseplan_files/houseplan-card.js`.
+> Обе карточки (`houseplan-card` и `houseplan-space-card`) лежат в этом одном файле — отдельный ресурс
+> не нужен.
+
 ### Вручную
 
 1. Скопируйте папку `custom_components/houseplan` в каталог `config/custom_components` вашего Home Assistant.
@@ -85,6 +151,10 @@ title: План дома
 
 При первом открытии план ещё пуст — House Plan сразу предложит создать первое пространство.
 
+Если в вашем Home Assistant уже настроены **этажи**, мастер предложит создать
+пространство для каждого: названия подставятся сами, план попросит по очереди,
+любой этаж можно пропустить.
+
 ![Пустой план — предложение добавить пространство](docs/images/02-onboarding-empty.png)
 
 В диалоге задайте **название** (например, «1 этаж») и **загрузите подложку** — картинку плана этажа в формате SVG, PNG или JPG. Оба поля обязательны: без плана кнопка «Сохранить» неактивна.
@@ -103,6 +173,29 @@ title: План дома
 
 ![Разметка комнаты и её сохранение](docs/images/05-room-dialog.png)
 
+Во время рисования у курсора показывается линейка с реальной длиной текущего отрезка (метры или футы+дюймы на имперской системе HA). Масштаб задаётся для каждого пространства — поле **«Масштаб (размер ячейки сетки)»** в диалоге пространства: сколько сантиметров в одной ячейке (по умолчанию 5 см).
+
+Комнаты не могут пересекаться: клик строго внутри существующей комнаты или контур, охватывающий её, отклоняются. Ещё два инструмента помогают перекроить план позже:
+
+- **Объединить** — кликните комнату, затем соседнюю с общей стеной; они сольются в одну. Диалог выбирает, чьё имя и зона останутся.
+- **Разделить** — кликните комнату, затем две точки на её стенах; хорда разрежет её надвое. Бо́льшая часть остаётся прежней комнатой (имя, зона, устройства), меньшая просит новое имя и зону.
+
+
+### Двери, окна и замки
+
+В режиме разметки инструмент **«Проём»** ставит двери и окна: кликните рядом со стеной — проём
+примагнитится к ней. Выберите тип, **длину в реальных сантиметрах** (по умолчанию дверь 90 см,
+окно 120 см), датчик открытия и — для двери — **замок**.
+
+С привязанным датчиком план оживает: створка двери поворачивается на петле, и дуга распахивания
+дорисовывается по мере открытия настоящей двери; окно раскрывает две створки. Пока открыто,
+подвижные части подсвечены акцентным цветом. У двери с замком рядом отображается замочек —
+зелёный, когда заперто, оранжевый, когда нет. Ради безопасности замок с плана **нельзя**
+переключить — клик по проёму показывает карточку с обоими статусами.
+
+Проёмы легко поправить позже: при наведении проём подсвечивается, его можно **перетащить вдоль
+стен** (в том числе за угол), а **двойной клик открывает свойства**.
+
 ### Шаг 3. Устройства появляются сами
 
 Как только вы сохранили комнату с привязкой к зоне, **устройства этой зоны автоматически расставляются внутри контура**. Берутся те же устройства, что показаны на странице **Настройки → Устройства → (фильтр по нужной комнате)** — только осмысленные, без служебных записей, мостов и дубликатов.
@@ -121,14 +214,41 @@ title: План дома
 
 ### Шаг 5. Расставьте значки по местам
 
-Значки устройств можно **перетаскивать мышью в любой момент** — отдельный «режим правки» включать не нужно. Позиции сохраняются на сервере и одинаковы во всех браузерах и устройствах. Кнопка **↺** в шапке возвращает автоматическую раскладку.
+Расставлять значки нужно на вкладке **«Устройства»**: там они перетаскиваются мышью, а клик открывает редактор. В режиме **«Просмотр»** ничего сдвинуть нельзя — панорамирование карты больше не сдвигает датчики (главная просьба пользователей). Позиции сохраняются на сервере и одинаковы во всех браузерах и устройствах. Кнопка **↺** возвращает автоматическую раскладку.
 
 ![Перетаскивание значков — доступно всегда](docs/images/06-edit.png)
 
+### Управление с плана (tap actions)
+
+По умолчанию тап по значку открывает инфо-карточку. В настройках карточки можно
+переключить **«Тап по устройству»** на *Переключить* — тогда тап включает/выключает
+свет, розетки, вентиляторы и увлажнители прямо с плана (режим настенного планшета).
+Для безопасности общий toggle не действует на замки, сигнализации, шторы/ворота и
+клапаны; для конкретного устройства toggle можно включить осознанно в его диалоге
+(кроме замков и сигнализаций — они с плана не переключаются никогда). **Долгое
+нажатие** всегда открывает инфо-карточку.
+
+### Правила иконок
+
+Какая MDI-иконка достанется устройству, решают **правила иконок** — редактируются
+прямо в карточке (кнопка ⬡ в шапке): упорядоченный список «шаблон имени → иконка»
+с живым тест-полем, двуязычные умолчания (EN/RU) и сброс одной кнопкой. Если ни одно
+правило не подошло — решает *device class* сущности (термометр для датчиков
+температуры и т.п.).
+
 ### Шаг 6. Добавление своих устройств вручную
 
+Можно поставить и **отдельную сущность** (не только устройство целиком): начните печатать в поиске привязки — рядом с устройствами появятся отдельные сущности. Удобно, когда одно устройство отдаёт несколько значений (например, температуру и влажность), а вы хотите каждое своей иконкой.
+
+
 Не всё нужно оставлять на автоматику. Кнопкой **＋** в шапке можно поставить на план любое устройство, группу или **виртуальную точку** (например, «Вентиль на вводе», которого нет как устройства). Задайте имя, иконку, модель, ссылку, описание и при желании приложите **PDF-инструкцию**.
 
+В этом же диалоге настраивается вид устройства на плане. **Отображение** переключает значок,
+анимированную **пульсацию присутствия** (расходящиеся кольца, пока сущность активна, и тусклая
+точка в покое — идеально для датчиков движения) или то и другое сразу, с цветом и размером колец
+на устройство. **Размер значка** (×0,5–3) и **поворот** — тоже индивидуальные: вентиль на стене
+может быть маленьким и повёрнутым так, как он установлен.
+
 ![Добавление устройства вручную](docs/images/07-marker-dialog.png)
 
 ---
@@ -142,6 +262,23 @@ title: План дома
 
 ---
 
+## Помощь и обмен опытом
+
+- 💬 **[Чат в Telegram — @ha_houseplan](https://t.me/ha_houseplan)** — вопросы,
+  помощь с настройкой, идеи и скриншоты ваших планов. Самый быстрый способ
+  связаться с автором и другими пользователями.
+- 🐞 [Issues на GitHub](https://github.com/Matysh/houseplan-card/issues) — баги
+  и запросы фич (пожалуйста, указывайте версию House Plan).
+- 💡 [Discussions](https://github.com/Matysh/houseplan-card/discussions) — для
+  развёрнутых обсуждений.
+- 📜 [История изменений](docs/CHANGELOG.ru.md) — что менялось в каждой версии.
+
+Версия видна в консоли браузера при загрузке (`HOUSEPLAN-CARD vX.Y.Z`) и в
+**Настройки → Устройства и службы → House Plan** — с ней разбираться сильно
+быстрее.
+
+---
+
 ## Часто задаваемые вопросы
 
 **Нужно ли что-то писать в YAML?** Нет. Единственная строчка — это добавление карточки на дашборд; всё остальное делается мышкой.

custom_components/houseplan/__init__.py

@@ -1,13 +1,12 @@
-"""House Plan: server-side house plan configuration + serving the Lovelace card."""
+"""House Plan: server-side house plan configuration + Lovelace card serving."""
 from __future__ import annotations
 
 import logging
 from pathlib import Path
 
 from homeassistant.components.frontend import add_extra_js_url
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
-from homeassistant.helpers.storage import Store
+from homeassistant.exceptions import ConfigEntryNotReady
 
 from . import websocket_api as hp_ws
 from .const import (
@@ -17,32 +16,35 @@ from .const import (
     FRONTEND_URL,
     PLANS_DIR,
     PLANS_URL,
-    STORAGE_CONFIG_KEY,
-    STORAGE_KEY,
-    STORAGE_VERSION,
     VERSION,
 )
+from .repairs import async_check_plan_files
+from .store import HouseplanConfigEntry, create_data
 
 _LOGGER = logging.getLogger(__name__)
 
 
 async def async_setup(hass: HomeAssistant, config) -> bool:
-    """Register WS commands, the HTTP upload and the stores on startup."""
+    """Register global handlers (survive config-entry reloads): WS commands, HTTP view."""
     hass.data.setdefault(DOMAIN, {})
-    hass.data[DOMAIN]["store"] = Store(hass, STORAGE_VERSION, STORAGE_KEY)
-    hass.data[DOMAIN]["config_store"] = Store(hass, STORAGE_VERSION, STORAGE_CONFIG_KEY)
     hp_ws.async_register(hass)
-    from .http_api import HouseplanUploadView
+    from .http_api import HouseplanContentView, HouseplanUploadView
 
     hass.http.register_view(HouseplanUploadView())
+    hass.http.register_view(HouseplanContentView())
     return True
 
 
-async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
-    """Config entry: static frontend and plan files + auto-registration of the JS."""
-    hass.data.setdefault(DOMAIN, {})
-    hass.data[DOMAIN]["entry"] = entry
-    entry.async_on_unload(entry.add_update_listener(_update_listener))
+async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) -> bool:
+    """Config entry: stores in runtime_data, static paths, card auto-registration."""
+    data = create_data(hass)
+    # test-before-setup: storage must be readable, otherwise retry later
+    try:
+        await data.store.async_load()
+        await data.config_store.async_load()
+    except Exception as err:  # noqa: BLE001 — corrupt/unreadable .storage
+        raise ConfigEntryNotReady(f"House Plan storage is not readable: {err}") from err
+    entry.runtime_data = data
 
     card_path = Path(__file__).parent / "frontend" / "houseplan-card.js"
     plans_path = Path(hass.config.path(PLANS_DIR))
@@ -51,46 +53,94 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
         lambda: (plans_path.mkdir(parents=True, exist_ok=True), files_path.mkdir(parents=True, exist_ok=True))
     )
 
-    static_paths = []
-    try:
-        from homeassistant.components.http import StaticPathConfig
+    # Static paths cannot be unregistered — register once per HA run.
+    if not hass.data[DOMAIN].get("static_registered"):
+        hass.data[DOMAIN]["static_registered"] = True
+        static_paths = []
+        try:
+            from homeassistant.components.http import StaticPathConfig
 
-        if card_path.exists():
-            static_paths.append(StaticPathConfig(FRONTEND_URL, str(card_path), cache_headers=False))
-        static_paths.append(StaticPathConfig(PLANS_URL, str(plans_path), cache_headers=True))
-        static_paths.append(StaticPathConfig(FILES_URL, str(files_path), cache_headers=True))
-        await hass.http.async_register_static_paths(static_paths)
-    except ImportError:  # older HA versions
-        if card_path.exists():
-            hass.http.register_static_path(FRONTEND_URL, str(card_path), cache_headers=False)
-        hass.http.register_static_path(PLANS_URL, str(plans_path), cache_headers=True)
-        hass.http.register_static_path(FILES_URL, str(files_path), cache_headers=True)
+            if card_path.exists():
+                static_paths.append(StaticPathConfig(FRONTEND_URL, str(card_path), cache_headers=False))
+            # NOTE (audit B1): plans and marker files are NO LONGER static.
+            # They are served by HouseplanContentView, which requires auth.
+            # Only the card bundle stays public — Lovelace resources must be.
+            if static_paths:
+                await hass.http.async_register_static_paths(static_paths)
+        except ImportError:  # very old HA versions
+            if card_path.exists():
+                hass.http.register_static_path(FRONTEND_URL, str(card_path), cache_headers=False)
 
     if not card_path.exists():
         _LOGGER.warning("houseplan-card.js not found next to the integration: %s", card_path)
         return True
 
-    # Register the card. Preferably as a Lovelace resource (the frontend WAITS for those
-    # before rendering dashboards, so the card is available even on a cold start of the mobile
-    # app). If the resource registry is unavailable (Lovelace YAML mode, older versions) —
-    # fall back to extra_module_url.
+    # Register the card. Preferably as a Lovelace resource (the frontend AWAITS
+    # resources before rendering dashboards, so the card is available even on a cold
+    # start of the mobile app). If the resource registry is unavailable (YAML-mode
+    # Lovelace, old versions) — fall back to extra_module_url.
     module_url = f"{FRONTEND_URL}?v={VERSION}"
-    if not await _register_lovelace_resource(hass, module_url):
+    registered = await _register_lovelace_resource(hass, module_url)
+    if not registered:
         add_extra_js_url(hass, module_url)
+    # Tell the user exactly where the card lives — the #1 support issue is people adding a
+    # Lovelace resource pointing at the on-disk path (/custom_components/...), which HA does
+    # not serve (wrong MIME → "Custom element doesn't exist"). The correct served URL is below.
+    if registered:
+        _LOGGER.info("House Plan card auto-registered as a Lovelace resource: %s", module_url)
+    else:
+        _LOGGER.info(
+            "House Plan card is served at %s . Lovelace resources look YAML-managed — add it "
+            "manually under `resources:` as { url: %s, type: module }. Do NOT use the on-disk "
+            "path /custom_components/houseplan/frontend/houseplan-card.js (HA does not serve it).",
+            module_url, module_url,
+        )
+
+    await async_check_plan_files(hass, entry)
     return True
 
 
+async def async_unload_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) -> bool:
+    """Unload the entry.
+
+    WS commands and the HTTP view are global (async_setup) and stay registered —
+    their handlers resolve runtime data per call and answer `not_ready` while no
+    entry is loaded. Static paths cannot be unregistered by design.
+    """
+    return True
+
+
+async def async_remove_entry(hass: HomeAssistant, entry) -> None:
+    """Clean up on integration removal: drop our Lovelace resource entry."""
+    try:
+        resources = _lovelace_resources(hass)
+        if resources is None or not hasattr(resources, "async_delete_item"):
+            return
+        for item in list(resources.async_items()):
+            if str(item.get("url", "")).split("?", 1)[0] == FRONTEND_URL:
+                await resources.async_delete_item(item["id"])
+                _LOGGER.debug("House Plan Lovelace resource removed: %s", item.get("url"))
+    except Exception as err:  # noqa: BLE001 — best-effort cleanup
+        _LOGGER.debug("Could not remove the Lovelace resource on uninstall: %s", err)
+
+
+def _lovelace_resources(hass: HomeAssistant):
+    lovelace = hass.data.get("lovelace")
+    resources = getattr(lovelace, "resources", None)
+    if resources is None and isinstance(lovelace, dict):
+        resources = lovelace.get("resources")
+    return resources
+
+
 async def _register_lovelace_resource(hass: HomeAssistant, module_url: str) -> bool:
     """Register (or update) the card in the Lovelace resource registry.
 
-    Returns True on success. Writes idempotently: if a resource with our path already exists —
-    update the URL on a version change; if absent — create it. Any-except → False (fallback to JS).
+    Returns True on success. Idempotent: if a resource with our path exists —
+    update the URL on version change; otherwise create it. Any exception → False
+    (fall back to extra_module_url).
     """
     try:
-        lovelace = hass.data.get("lovelace")
-        resources = getattr(lovelace, "resources", None)
-        if resources is None and isinstance(lovelace, dict):
-            resources = lovelace.get("resources")
+        resources = _lovelace_resources(hass)
         if resources is None:
             return False
         # the resource registry must be loaded
@@ -116,14 +166,5 @@ async def _register_lovelace_resource(hass: HomeAssistant, module_url: str) -> b
         _LOGGER.debug("House Plan card registered as a Lovelace resource: %s", module_url)
         return True
     except Exception as err:  # noqa: BLE001 — any failure → fallback
-        _LOGGER.debug("Failed to register the Lovelace resource (%s), falling back to extra_module_url", err)
+        _LOGGER.debug("Could not register the Lovelace resource (%s), falling back to extra_module_url", err)
         return False
-
-
-async def _update_listener(hass: HomeAssistant, entry: ConfigEntry) -> None:
-    hass.data[DOMAIN]["entry"] = entry
-
-
-async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
-    hass.data[DOMAIN].pop("entry", None)
-    return True

custom_components/houseplan/auth.py

@@ -0,0 +1,28 @@
+"""Single source of truth for the write-authorization policy.
+
+The WS and HTTP paths used to duplicate this decision and drifted apart: the
+WS copy was fixed to fail closed while the upload view still failed OPEN when
+the config entry was unavailable (audit follow-up B2, 2026-07-27). One helper,
+one behaviour.
+"""
+from __future__ import annotations
+
+from homeassistant.core import HomeAssistant
+
+from .const import CONF_ADMIN_ONLY
+from .store import get_entry
+
+
+def may_write(hass: HomeAssistant, user) -> bool:
+    """True when `user` may modify House Plan data.
+
+    Fails CLOSED: when the entry cannot be read — during a reload, or while the
+    integration is disabled — the policy is unknown, and "unknown" is not the
+    same as "permissive": only admins are allowed through.
+    """
+    is_admin = bool(getattr(user, "is_admin", False))
+    entry = get_entry(hass)
+    if entry is None:
+        return is_admin
+    admin_only = bool(entry.options.get(CONF_ADMIN_ONLY, False))
+    return is_admin if admin_only else True

custom_components/houseplan/config_flow.py

@@ -14,8 +14,6 @@ class HouseplanConfigFlow(config_entries.ConfigFlow, domain=DOMAIN):
     VERSION = 1
 
     async def async_step_user(self, user_input=None):
-        if self._async_current_entries():
-            return self.async_abort(reason="single_instance_allowed")
         if user_input is not None:
             return self.async_create_entry(title="House Plan", data={}, options=user_input)
         return self.async_show_form(

custom_components/houseplan/const.py

@@ -4,13 +4,27 @@ DOMAIN = "houseplan"
 STORAGE_KEY = f"{DOMAIN}.layout"
 STORAGE_CONFIG_KEY = f"{DOMAIN}.config"
 STORAGE_VERSION = 1
+STORAGE_MINOR_VERSION = 1
 FRONTEND_URL = "/houseplan_files/houseplan-card.js"
 PLANS_URL = "/houseplan_files/plans"
 PLANS_DIR = "houseplan/plans"  # relative to the HA configuration directory
 FILES_URL = "/houseplan_files/files"
+# authenticated read path (audit B1): /api/houseplan/content/<plans|files>/<sub>/<name>
+CONTENT_URL = "/api/houseplan/content"
+
+# How many paths one houseplan/content/sign call may carry. The card batches to
+# the same number; a client that sends more used to get a partial answer with no
+# way to tell which paths were dropped (review R2-2).
+MAX_SIGN_PATHS = 200
+
+# An uploaded plan that no accepted configuration references is collected only
+# once it is this old. Age is a race guard, not a policy: a plan uploaded
+# seconds ago may belong to another client's transaction that has not written
+# its configuration yet (review R3-1).
+PLAN_ORPHAN_TTL_S = 3600
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.11.2"
+VERSION = "1.46.0"
 
 DEFAULT_CONFIG: dict = {
     "spaces": [],

custom_components/houseplan/diagnostics.py

@@ -0,0 +1,40 @@
+"""Diagnostics for House Plan (Settings → ... → Download diagnostics)."""
+from __future__ import annotations
+
+from typing import Any
+
+from homeassistant.components.diagnostics import async_redact_data
+from homeassistant.core import HomeAssistant
+
+from .store import HouseplanConfigEntry
+
+# Marker metadata may contain personal notes, external links and manual filenames.
+TO_REDACT = {"link", "description", "pdfs", "name"}
+
+
+async def async_get_config_entry_diagnostics(
+    hass: HomeAssistant, entry: HouseplanConfigEntry
+) -> dict[str, Any]:
+    """Return a redacted dump of the stores."""
+    data = entry.runtime_data
+    cfg_raw = await data.config_store.async_load() or {}
+    layout_raw = await data.store.async_load() or {}
+    config = cfg_raw.get("config", {})
+    layout = layout_raw.get("layout", {})
+    return {
+        "options": dict(entry.options),
+        "rev": cfg_raw.get("rev", 0),
+        "spaces": [
+            {
+                "id": s.get("id"),
+                "aspect": s.get("aspect"),
+                "has_plan": bool(s.get("plan_url")),
+                "rooms": len(s.get("rooms", [])),
+                "rooms_with_area": sum(1 for r in s.get("rooms", []) if r.get("area")),
+            }
+            for s in config.get("spaces", [])
+        ],
+        "markers": async_redact_data(config.get("markers", []), TO_REDACT),
+        "settings": config.get("settings", {}),
+        "layout_entries": len(layout),
+    }

custom_components/houseplan/http_api.py

@@ -6,6 +6,8 @@ breaks the connection on a large PDF) but via a plain multipart POST — like me
 from __future__ import annotations
 
 import logging
+import os
+import tempfile
 from pathlib import Path
 
 from aiohttp import web
@@ -18,7 +20,9 @@ except ImportError:  # older HA versions
     KEY_HASS = "hass"  # type: ignore[assignment]
 from homeassistant.core import HomeAssistant
 
-from .const import CONF_ADMIN_ONLY, DOMAIN, FILES_DIR, FILES_URL
+from .const import CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, PLANS_DIR
+from .auth import may_write
+from .plans import unique_filename
 from .validation import (
     FILE_EXTENSIONS,
     MAX_FILE_BYTES,
@@ -31,6 +35,77 @@ _LOGGER = logging.getLogger(__name__)
 
 _CHUNK = 64 * 1024
 
+_MIME = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".txt": "text/plain",
+}
+
+
+class HouseplanContentView(HomeAssistantView):
+    """Authenticated read access to plans and marker files (audit B1).
+
+    The directories used to be exposed as unauthenticated static paths, so
+    anyone who could reach the HA endpoint could pull floor plans and uploaded
+    manuals without logging in. This view keeps the same URLs but requires a
+    Home Assistant session (or a signed path, which the frontend uses for
+    <image href> inside the SVG).
+    """
+
+    url = "/api/houseplan/content/{kind}/{sub}/{name}"
+    name = "api:houseplan:content"
+    requires_auth = True
+
+    async def get(self, request: web.Request, kind: str, sub: str, name: str) -> web.StreamResponse:
+        hass: HomeAssistant = request.app[KEY_HASS]
+        if kind not in ("plans", "files"):
+            return web.Response(status=404)
+        safe_sub = sanitize_marker_id(sub)
+        safe_name = sanitize_filename(name)
+        if not safe_sub or not safe_name:
+            return web.Response(status=404)
+        base = Path(hass.config.path(PLANS_DIR if kind == "plans" else FILES_DIR)).resolve()
+        # plans live flat in one directory: the sub segment is a placeholder ("_")
+        path = (base / safe_name if kind == "plans" else base / safe_sub / safe_name).resolve()
+        # defence in depth: the sanitizers already strip separators
+        if not str(path).startswith(str(base)):
+            return web.Response(status=404)
+
+        if not await hass.async_add_executor_job(path.is_file):
+            return web.Response(status=404)
+        suffix = path.suffix.lower()
+        headers = {
+            "Cache-Control": "private, max-age=3600",
+            "Content-Type": _MIME.get(suffix, "application/octet-stream"),
+        }
+        if suffix == ".svg":
+            # An uploaded SVG is user content served from Home Assistant's own
+            # origin. Inside the card it is referenced by <image>, where scripts
+            # never run — but the same url opened as a top-level document is a
+            # live document of this origin, and a <script> in it reaches the
+            # session's localStorage and API (HP-1454-01, 2026-07-28: uploading
+            # needs write access, which by default every authenticated user has,
+            # and the signed url is easy to hand to an admin).
+            #
+            # `sandbox` with no allow-* tokens drops the document into an opaque
+            # origin: no scripts, no same-origin access, no forms. The explicit
+            # directives below are belt and braces for older engines. Only SVG
+            # gets this — a CSP on a PDF response can break the browser's built-in
+            # viewer, and a raster image cannot execute anything in the first place.
+            headers["Content-Security-Policy"] = (
+                "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+                "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:"
+            )
+        # FileResponse streams from disk: a 50 MB manual used to be read whole
+        # into memory and copied into the response body, so a couple of parallel
+        # downloads could push a small Home Assistant host into swap (HP-1454-06).
+        return web.FileResponse(path, chunk_size=_CHUNK, headers=headers)
+
 
 class HouseplanUploadView(HomeAssistantView):
     """POST /api/houseplan/upload — save a marker file, return its URL."""
@@ -41,17 +116,32 @@ class HouseplanUploadView(HomeAssistantView):
 
     async def post(self, request: web.Request) -> web.Response:
         hass: HomeAssistant = request.app[KEY_HASS]
-        entry = hass.data.get(DOMAIN, {}).get("entry")
-        admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
-        if admin_only:
-            user = request.get("hass_user")
-            if user is None or not user.is_admin:
-                return web.json_response({"error": "unauthorized"}, status=403)
+        if not may_write(hass, request.get("hass_user")):
+            return web.json_response({"error": "unauthorized"}, status=403)
 
         marker_id = "misc"
         filename: str | None = None
-        blob: bytes | None = None
+        tmp_path: Path | None = None
         too_large = False
+        bad_ext = False
+        files_root = Path(hass.config.path(FILES_DIR))
+
+        def _open_tmp() -> Path:
+            files_root.mkdir(parents=True, exist_ok=True)
+            fd, name = tempfile.mkstemp(prefix=".upload-", dir=str(files_root))
+            os.close(fd)
+            return Path(name)
+
+        def _append(target: Path, data: bytes) -> None:
+            with open(target, "ab") as fh:
+                fh.write(data)
+
+        def _discard(target: Path) -> None:
+            try:
+                target.unlink()
+            except OSError:
+                pass
+
         try:
             reader = await request.multipart()
             async for part in reader:
@@ -59,44 +149,62 @@ class HouseplanUploadView(HomeAssistantView):
                     marker_id = sanitize_marker_id(await part.text())
                 elif part.name == "file":
                     filename = part.filename or "file"
-                    # read in chunks, aborting at the limit, instead of loading the whole file into memory
-                    chunks: list[bytes] = []
+                    if file_ext(filename) not in FILE_EXTENSIONS:
+                        bad_ext = True
+                        break
+                    # Stream to a temporary file instead of collecting the whole
+                    # upload in memory and copying it again into one buffer: a
+                    # 50 MB manual used to cost ~100 MB of RSS mid-request, and
+                    # a few of those at once is real pressure on a small Home
+                    # Assistant host (HP-1454-06).
+                    tmp_path = await hass.async_add_executor_job(_open_tmp)
                     size = 0
                     while chunk := await part.read_chunk(_CHUNK):
                         size += len(chunk)
                         if size > MAX_FILE_BYTES:
                             too_large = True
                             break
-                        chunks.append(chunk)
+                        await hass.async_add_executor_job(_append, tmp_path, chunk)
                     if too_large:
                         break
-                    blob = b"".join(chunks)
         except Exception as err:  # noqa: BLE001
             _LOGGER.warning("House Plan upload: multipart read error: %s", err)
+            if tmp_path is not None:
+                await hass.async_add_executor_job(_discard, tmp_path)
             return web.json_response({"error": "bad_request"}, status=400)
 
-        if too_large:
-            return web.json_response(
-                {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024}, status=413
-            )
-        if blob is None or not filename:
-            return web.json_response({"error": "no_file"}, status=400)
-        ext = file_ext(filename)
-        if ext not in FILE_EXTENSIONS:
+        if bad_ext:
+            if tmp_path is not None:
+                await hass.async_add_executor_job(_discard, tmp_path)
             return web.json_response(
                 {"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, status=400
             )
+        if too_large:
+            await hass.async_add_executor_job(_discard, tmp_path)
+            return web.json_response(
+                {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024}, status=413
+            )
+        if tmp_path is None or not filename:
+            return web.json_response({"error": "no_file"}, status=400)
 
         safe_name = sanitize_filename(filename)
-        target_dir = Path(hass.config.path(FILES_DIR)) / marker_id
-        path = target_dir / safe_name
+        target_dir = files_root / marker_id
 
-        def _write() -> int:
+        def _promote() -> str:
+            """Move the finished upload in under a name that is free.
+
+            Never overwrite: the previous bytes may be referenced by the stored
+            configuration, and this upload is not part of that transaction — a
+            cancelled dialog or a rejected save would leave the old url pointing
+            at the new content (HP-1454-02). An unreferenced upload is collected
+            later by config/set, once it is old enough.
+            """
             target_dir.mkdir(parents=True, exist_ok=True)
-            path.write_bytes(blob)
-            return int(path.stat().st_mtime)
+            name = unique_filename(target_dir, safe_name)
+            os.replace(tmp_path, target_dir / name)
+            return name
 
-        mtime = await hass.async_add_executor_job(_write)
+        name = await hass.async_add_executor_job(_promote)
         return web.json_response(
-            {"ok": True, "url": f"{FILES_URL}/{marker_id}/{safe_name}?v={mtime}", "name": filename}
+            {"ok": True, "url": f"{CONTENT_URL}/files/{marker_id}/{name}", "name": filename}
         )

custom_components/houseplan/manifest.json

@@ -15,5 +15,6 @@
   "iot_class": "local_push",
   "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
   "requirements": [],
-  "version": "1.11.2"
-}
+  "single_config_entry": true,
+  "version": "1.46.0"
+}

custom_components/houseplan/plans.py

@@ -0,0 +1,193 @@
+"""Blob lifecycle — pure, so it is unit-testable without Home Assistant.
+
+The file system is not part of the configuration store's transaction, so who
+may write or delete a plan or an attachment, and when, is a correctness
+question rather than housekeeping. It lives here, apart from the WebSocket and
+HTTP plumbing, precisely because it is the part that has to be reasoned about
+and tested.
+"""
+from __future__ import annotations
+
+import logging
+import time
+from pathlib import Path
+from typing import Any
+
+from .const import PLAN_ORPHAN_TTL_S
+from .validation import PLAN_EXTENSIONS, sanitize_filename
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def unique_filename(directory: Path, name: str) -> str:
+    """A name inside `directory` that is not taken, deriving from `name`.
+
+    Uploads never overwrite. The bytes already under a name may be referenced by
+    the stored configuration, and an upload is not part of that transaction: a
+    cancelled dialog or a rejected save would otherwise leave a live url serving
+    someone else's file (HP-1454-02).
+    """
+    safe = sanitize_filename(name)
+    if not (directory / safe).exists():
+        return safe
+    stem, dot, suffix = safe.rpartition(".")
+    if not dot:
+        stem, suffix = safe, ""
+    i = 2
+    while True:
+        # "-2", not " (2)": the content view sanitizes the name in the REQUEST
+        # too, and a space or a bracket there turns into "_", so a file called
+        # "manual (2).pdf" was written and then never served. Only characters
+        # that survive sanitize_filename may be used to build a name.
+        candidate = f"{stem}-{i}{'.' + suffix if suffix else ''}"
+        if not (directory / candidate).exists():
+            return candidate
+        i += 1
+
+
+def attachment_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """"<marker>/<file>" for every attachment a configuration references."""
+    out: set[str] = set()
+    for m in (cfg or {}).get("markers") or []:
+        for pdf in m.get("pdfs") or []:
+            url = pdf.get("url") if isinstance(pdf, dict) else None
+            if not isinstance(url, str) or "/files/" not in url:
+                continue
+            rel = url.split("?", 1)[0].split("/files/", 1)[1]
+            if rel.count("/") == 1:
+                out.add(rel)
+    return out
+
+
+def collect_attachments(
+    files_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """The same commit-scoped rule as `collect_plans`, for marker attachments.
+
+    A file the old revision referenced and the new one does not was superseded
+    by this commit and goes. Anything else unreferenced is an upload that was
+    never saved — a cancelled dialog, a rejected write — and waits out
+    PLAN_ORPHAN_TTL_S first, because a fresh one may belong to a dialog the user
+    still has open. Never raises: it runs behind a durable write.
+    """
+    new_refs = attachment_refs(new_cfg)
+    old_refs = attachment_refs(old_cfg)
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        folders = sorted(p for p in files_dir.iterdir() if p.is_dir()) if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    for folder in folders:
+        try:
+            items = sorted(p for p in folder.iterdir() if p.is_file())
+        except OSError:
+            continue
+        for item in items:
+            rel = f"{folder.name}/{item.name}"
+            if rel in new_refs:
+                continue
+            try:
+                stale = item.stat().st_mtime < cutoff
+            except OSError:
+                stale = False
+            if rel not in old_refs and not stale:
+                continue
+            try:
+                item.unlink()
+                removed += 1
+            except OSError as err:
+                _LOGGER.warning("House Plan: could not remove the attachment %s: %s", item, err)
+        try:
+            next(folder.iterdir())
+        except StopIteration:
+            try:
+                folder.rmdir()
+            except OSError:
+                pass
+        except OSError:
+            pass
+    return removed
+
+
+def plan_basename(url: Any) -> str:
+    """File name a stored plan_url points at ('' when there is none)."""
+    if not isinstance(url, str) or not url:
+        return ""
+    return url.split("?", 1)[0].rsplit("/", 1)[-1]
+
+
+def plan_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """Plan file names a configuration references."""
+    out: set[str] = set()
+    for sp in (cfg or {}).get("spaces") or []:
+        name = plan_basename(sp.get("plan_url"))
+        if name:
+            out.add(name)
+    return out
+
+
+def is_plan_file(name: str) -> bool:
+    """Does this look like a plan we wrote: <space>.<ext> or <space>.<token>.<ext>?"""
+    parts = name.split(".")
+    return len(parts) in (2, 3) and parts[-1].lower() in PLAN_EXTENSIONS
+
+
+def collect_plans(
+    plans_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """Drop plan files the accepted configuration made obsolete (review R3-1).
+
+    Called inside the config write lock, right after the new revision is
+    stored, so it decides from the two configurations that actually bracket the
+    commit instead of trusting a client to say what may be deleted. The earlier
+    design — a `plan/cleanup` command carrying `keep` — could not be ordered
+    against another client's commit: a delayed call removed the file that
+    client had just saved, leaving the accepted configuration pointing at
+    nothing, which is the damage copy-on-write was introduced to prevent.
+
+    Two rules, both conservative:
+      * a file the OLD configuration referenced and the new one does not was
+        authoritative and has been superseded — remove it;
+      * any other unreferenced plan file is a rejected or abandoned upload, and
+        is removed only once PLAN_ORPHAN_TTL_S has passed: a fresh one may
+        belong to a transaction that has not committed yet.
+
+    Never raises: the configuration is already stored by the time this runs, so
+    a file-system problem must not turn a durable commit into a failed call.
+    """
+    new_refs = plan_refs(new_cfg)
+    old_refs = plan_refs(old_cfg)
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        items = sorted(plans_dir.iterdir()) if plans_dir.is_dir() else []
+    except OSError as err:
+        # The directory can vanish or turn unreadable between the check and the
+        # walk. This is housekeeping running behind a commit that is already
+        # durable, so it reports "nothing collected" instead of failing (R4-1).
+        _LOGGER.warning("House Plan: could not list %s: %s", plans_dir, err)
+        return 0
+    for item in items:
+        if not item.is_file() or item.name in new_refs or not is_plan_file(item.name):
+            continue
+        superseded = item.name in old_refs
+        try:
+            stale = item.stat().st_mtime < cutoff
+        except OSError:
+            stale = False
+        if not superseded and not stale:
+            continue
+        try:
+            item.unlink()
+            removed += 1
+        except OSError as err:
+            _LOGGER.warning("House Plan: could not remove the old plan %s: %s", item, err)
+    return removed

custom_components/houseplan/quality_scale.yaml

@@ -0,0 +1,112 @@
+# Integration Quality Scale self-assessment.
+# Custom integrations are not formally graded (they sit in the "Custom" tier),
+# but we track the official checklist here. done = implemented, exempt = not
+# applicable with the reason.
+rules:
+  # ---- Bronze ----
+  action-setup:
+    status: exempt
+    comment: The integration registers no service actions.
+  appropriate-polling:
+    status: exempt
+    comment: No polling — storage + WebSocket API + frontend serving only.
+  brands:
+    status: done
+    comment: Local brand images in custom_components/houseplan/brand/ (HA >=2026.3 mechanism).
+  common-modules:
+    status: done
+    comment: const.py, store.py (stores + runtime data), validation.py (pure schemas).
+  config-flow:
+    status: done
+  config-flow-test-coverage:
+    status: done
+    comment: tests_backend/test_config_flow.py (runs in CI on Python 3.13).
+  dependency-transparency:
+    status: done
+    comment: No external requirements.
+  docs-actions:
+    status: exempt
+    comment: No service actions.
+  docs-high-level-description:
+    status: done
+    comment: README.md.
+  docs-installation-instructions:
+    status: done
+    comment: README.md (HACS + manual).
+  docs-removal-instructions:
+    status: done
+    comment: README.md uninstall section.
+  entity-event-setup:
+    status: exempt
+    comment: No entities.
+  entity-unique-id:
+    status: exempt
+    comment: No entities.
+  has-entity-name:
+    status: exempt
+    comment: No entities.
+  runtime-data:
+    status: done
+    comment: entry.runtime_data holds HouseplanData (stores + write lock).
+  test-before-configure:
+    status: exempt
+    comment: No external device/service to validate during the flow.
+  test-before-setup:
+    status: done
+    comment: Storage load is verified in async_setup_entry (ConfigEntryNotReady on failure).
+  unique-config-entry:
+    status: done
+    comment: single_config_entry in manifest.
+  # ---- Silver ----
+  action-exceptions:
+    status: exempt
+    comment: No service actions; WS handlers reply with typed error codes.
+  config-entry-unloading:
+    status: done
+    comment: Unload supported; WS commands and static paths are global by design (documented in __init__).
+  docs-configuration-parameters:
+    status: done
+    comment: README documents the admin_only option and card options.
+  docs-installation-parameters:
+    status: done
+  entity-unavailable:
+    status: exempt
+    comment: No entities.
+  integration-owner:
+    status: done
+  log-when-unavailable:
+    status: exempt
+    comment: No external service.
+  parallel-updates:
+    status: exempt
+    comment: No entities/polling.
+  reauthentication-flow:
+    status: exempt
+    comment: No authentication against an external service.
+  test-coverage:
+    status: todo
+    comment: Backend covered by pure tests + HA-harness tests in CI; measuring >95% is planned.
+  # ---- Gold (selected; entity/device rules are exempt — no entities) ----
+  diagnostics:
+    status: done
+    comment: diagnostics.py with redaction of personal marker fields.
+  reconfiguration-flow:
+    status: exempt
+    comment: Nothing to reconfigure — no host/credentials; all data is edited in the card UI.
+  repair-issues:
+    status: done
+    comment: Missing plan files raise repair issues (translation_key broken_plan).
+  docs-troubleshooting:
+    status: todo
+  docs-examples:
+    status: todo
+  # ---- Platinum ----
+  strict-typing:
+    status: todo
+    comment: Python is annotated; mypy strict pass is planned.
+  async-dependency:
+    status: exempt
+    comment: No dependencies.
+  inject-websession:
+    status: exempt
+    comment: No outgoing HTTP.

custom_components/houseplan/repairs.py

@@ -0,0 +1,67 @@
+"""Repair issues for House Plan.
+
+The check runs at entry setup AND after every config save (ws_config_set),
+so a plan file that goes missing — or gets re-uploaded — is reflected in the
+Repairs UI without waiting for a restart.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+from homeassistant.core import HomeAssistant
+from homeassistant.helpers import issue_registry as ir
+
+from .const import CONTENT_URL, DOMAIN, PLANS_DIR, PLANS_URL
+from .store import HouseplanConfigEntry
+
+
+async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntry) -> None:
+    """Raise an issue for every space whose plan file is missing on disk."""
+    cfg_raw = await entry.runtime_data.config_store.async_load() or {}
+    spaces = cfg_raw.get("config", {}).get("spaces", [])
+    plans_dir = Path(hass.config.path(PLANS_DIR))
+
+    def _missing() -> list[tuple[str, str]]:
+        res = []
+        for sp in spaces:
+            url = sp.get("plan_url") or ""
+            # both the legacy static URL and the authenticated content URL
+            prefix = None
+            if url.startswith(PLANS_URL + "/"):
+                prefix = PLANS_URL + "/"
+            elif url.startswith(CONTENT_URL + "/plans/_/"):
+                prefix = CONTENT_URL + "/plans/_/"
+            if prefix is None:
+                continue  # external/legacy URL — not ours to verify
+            fname = url[len(prefix) :].split("?", 1)[0]
+            if not (plans_dir / fname).is_file():
+                res.append((sp.get("id", "?"), fname))
+        return res
+
+    missing = await hass.async_add_executor_job(_missing)
+    broken = set()
+    for space_id, fname in missing:
+        broken.add(space_id)
+        ir.async_create_issue(
+            hass,
+            DOMAIN,
+            f"broken_plan_{space_id}",
+            is_fixable=False,
+            severity=ir.IssueSeverity.WARNING,
+            translation_key="broken_plan",
+            translation_placeholders={"space": space_id, "file": fname},
+        )
+    # Clear stale issues. Iterating the CURRENT spaces could only ever clear
+    # issues for spaces that still exist, so deleting or renaming a space with a
+    # missing plan left its warning in Repairs forever, with nothing left to fix
+    # it (HP-1454-09). Enumerate what we actually published instead.
+    registry = ir.async_get(hass)
+    stale = [
+        issue_id
+        for (domain, issue_id) in list(registry.issues)
+        if domain == DOMAIN
+        and issue_id.startswith("broken_plan_")
+        and issue_id[len("broken_plan_") :] not in broken
+    ]
+    for issue_id in stale:
+        ir.async_delete_issue(hass, DOMAIN, issue_id)

custom_components/houseplan/store.py

@@ -0,0 +1,69 @@
+"""Storage helpers: versioned stores and per-entry runtime data."""
+from __future__ import annotations
+
+import asyncio
+from dataclasses import dataclass, field
+from typing import Any
+
+from homeassistant.config_entries import ConfigEntry
+from homeassistant.core import HomeAssistant
+from homeassistant.helpers.storage import Store
+
+from .const import DOMAIN, STORAGE_CONFIG_KEY, STORAGE_KEY, STORAGE_MINOR_VERSION, STORAGE_VERSION
+
+
+class HouseplanStore(Store):
+    """Store with a migration hook.
+
+    Bump STORAGE_MINOR_VERSION for backward-compatible schema additions and
+    STORAGE_VERSION for breaking changes, then handle them here. Keeping the
+    skeleton in place from day one means old installations always pass through
+    a single, tested upgrade path.
+    """
+
+    async def _async_migrate_func(
+        self,
+        old_major_version: int,
+        old_minor_version: int,
+        old_data: dict[str, Any],
+    ) -> dict[str, Any]:
+        data = old_data
+        # if old_major_version == 1 and old_minor_version < 2:
+        #     ...migrate...
+        return data
+
+
+@dataclass
+class HouseplanData:
+    """Runtime data of the single config entry (entry.runtime_data)."""
+
+    store: HouseplanStore
+    config_store: HouseplanStore
+    # One lock for every load→modify→save cycle of both stores: prevents
+    # lost updates from concurrent WS calls and makes the rev check atomic.
+    write_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+
+
+HouseplanConfigEntry = ConfigEntry[HouseplanData]
+
+
+def create_data(hass: HomeAssistant) -> HouseplanData:
+    """Create the stores for a config entry."""
+    return HouseplanData(
+        store=HouseplanStore(hass, STORAGE_VERSION, STORAGE_KEY, minor_version=STORAGE_MINOR_VERSION),
+        config_store=HouseplanStore(
+            hass, STORAGE_VERSION, STORAGE_CONFIG_KEY, minor_version=STORAGE_MINOR_VERSION
+        ),
+    )
+
+
+def get_data(hass: HomeAssistant) -> HouseplanData | None:
+    """Runtime data of the loaded entry, or None when not set up."""
+    entries = hass.config_entries.async_loaded_entries(DOMAIN)
+    return entries[0].runtime_data if entries else None
+
+
+def get_entry(hass: HomeAssistant) -> ConfigEntry | None:
+    """The loaded config entry, or None."""
+    entries = hass.config_entries.async_loaded_entries(DOMAIN)
+    return entries[0] if entries else None

custom_components/houseplan/strings.json

@@ -0,0 +1,24 @@
+{
+  "config": {
+    "step": {
+      "user": {
+        "title": "House Plan",
+        "data": { "admin_only": "Only administrators may edit the layout" }
+      }
+    },
+    "abort": { "single_instance_allowed": "Already configured — only one entry is allowed." }
+  },
+  "options": {
+    "step": {
+      "init": {
+        "data": { "admin_only": "Only administrators may edit the layout" }
+      }
+    }
+  },
+  "issues": {
+    "broken_plan": {
+      "title": "Floor plan image is missing",
+      "description": "The plan file `{file}` for space `{space}` was not found in `config/houseplan/plans/`. Open the space settings in the House Plan card and upload the plan again."
+    }
+  }
+}

custom_components/houseplan/system_health.py

@@ -0,0 +1,32 @@
+"""System health for House Plan (Settings → System → Repairs → System information)."""
+from __future__ import annotations
+
+from typing import Any
+
+from homeassistant.components import system_health
+from homeassistant.core import HomeAssistant, callback
+
+from .store import get_data
+
+
+@callback
+def async_register(hass: HomeAssistant, register: system_health.SystemHealthRegistration) -> None:
+    """Register the system health info callback."""
+    register.async_register_info(system_health_info)
+
+
+async def system_health_info(hass: HomeAssistant) -> dict[str, Any]:
+    """Return integration health info."""
+    data = get_data(hass)
+    if data is None:
+        return {"status": "not set up"}
+    cfg_raw = await data.config_store.async_load() or {}
+    layout_raw = await data.store.async_load() or {}
+    config = cfg_raw.get("config", {})
+    return {
+        "config_rev": cfg_raw.get("rev", 0),
+        "spaces": len(config.get("spaces", [])),
+        "rooms": sum(len(s.get("rooms", [])) for s in config.get("spaces", [])),
+        "markers": len(config.get("markers", [])),
+        "layout_entries": len(layout_raw.get("layout", {})),
+    }

custom_components/houseplan/translations/en.json

@@ -3,16 +3,28 @@
     "step": {
       "user": {
         "title": "House Plan",
-        "data": { "admin_only": "Only administrators may edit the layout" }
+        "data": {
+          "admin_only": "Only administrators may edit the layout"
+        }
       }
     },
-    "abort": { "single_instance_allowed": "Already configured — only one entry is allowed." }
+    "abort": {
+      "single_instance_allowed": "Already configured — only one entry is allowed."
+    }
   },
   "options": {
     "step": {
       "init": {
-        "data": { "admin_only": "Only administrators may edit the layout" }
+        "data": {
+          "admin_only": "Only administrators may edit the layout"
+        }
       }
     }
+  },
+  "issues": {
+    "broken_plan": {
+      "title": "Floor plan image is missing",
+      "description": "The plan file `{file}` for space `{space}` was not found in `config/houseplan/plans/`. Open the space settings in the House Plan card and upload the plan again."
+    }
   }
 }

custom_components/houseplan/translations/ru.json

@@ -3,16 +3,28 @@
     "step": {
       "user": {
         "title": "House Plan",
-        "data": { "admin_only": "Правка раскладки только администраторами" }
+        "data": {
+          "admin_only": "Правка раскладки только администраторами"
+        }
       }
     },
-    "abort": { "single_instance_allowed": "Уже настроено — допускается одна запись." }
+    "abort": {
+      "single_instance_allowed": "Уже настроено — допускается одна запись."
+    }
   },
   "options": {
     "step": {
       "init": {
-        "data": { "admin_only": "Правка раскладки только администраторами" }
+        "data": {
+          "admin_only": "Правка раскладки только администраторами"
+        }
       }
     }
+  },
+  "issues": {
+    "broken_plan": {
+      "title": "Файл плана этажа не найден",
+      "description": "Файл плана `{file}` пространства `{space}` не найден в `config/houseplan/plans/`. Откройте настройки пространства в карточке House Plan и загрузите план заново."
+    }
   }
 }

custom_components/houseplan/validation.py

@@ -12,7 +12,7 @@ import voluptuous as vol
 PLAN_EXTENSIONS = {"svg": "image/svg+xml", "png": "image/png", "jpg": "image/jpeg", "webp": "image/webp"}
 MAX_PLAN_BYTES = 8 * 1024 * 1024
 FILE_EXTENSIONS = {"pdf", "png", "jpg", "jpeg", "webp", "txt"}
-MAX_FILE_BYTES = 25 * 1024 * 1024
+MAX_FILE_BYTES = 50 * 1024 * 1024
 
 SPACE_ID_RE = re.compile(r"^[a-z0-9_-]{1,64}$")
 _SAFE_NAME_RE = re.compile(r"[^A-Za-z0-9._-]+")
@@ -47,13 +47,58 @@ def valid_space_id(value: str) -> bool:
 
 
 # ---------- voluptuous schemas ----------
+def _finite(value):
+    """Coerce to float and reject NaN/Infinity (audit B5).
+
+    'NaN' and 'Infinity' pass Coerce(float) and serialize to null on write,
+    silently corrupting a stored position forever.
+    """
+    f = float(value)
+    if f != f or f in (float("inf"), float("-inf")):
+        raise vol.Invalid("coordinate must be a finite number")
+    return f
+
+
+# generous caps: the product targets 20-200 devices and a handful of floors
+MAX_SPACES = 50
+MAX_ROOMS = 400
+MAX_MARKERS = 2000
+MAX_OPENINGS = 500
+MAX_DECOR = 1000
+MAX_LAYOUT = 5000
+# Inner limits (HP-1454-05). The outer collections were capped, the collections
+# INSIDE them were not: a 150 000-point polygon or a 100 000-entry known_devices
+# list passed validation, then made the card build gigantic SVG attributes and
+# walk them on every render. Any authenticated writer could store one, and with
+# `admin_only` off that is every user. These are product limits, not guesses: a
+# hand-drawn room does not need 500 vertices, and no home has 200 lights behind
+# one switch.
+MAX_POLY_POINTS = 500
+MAX_OPEN_TO = 50
+MAX_CONTROLS = 200
+MAX_PDFS = 50
+MAX_KNOWN_DEVICES = 20000
+MAX_TEXT = 500          # names, models, ids
+MAX_DESCRIPTION = 4000
+MAX_URL = 2000
+# Comfortably below the WebSocket frame limit (aiohttp's default is 4 MB): a
+# payload larger than the frame never reaches the handler at all — the socket
+# closes with 1009 and the user sees a dropped connection instead of an error
+# they can act on. For scale, a real three-floor home with ~200 devices stores
+# about 70 KB, so this is ~30x headroom.
+MAX_CONFIG_BYTES = 2 * 1024 * 1024
+
+_TEXT = vol.All(str, vol.Length(max=MAX_TEXT))
+_TEXT_OR_NONE = vol.Any(None, _TEXT)
+_URL = vol.All(str, vol.Length(max=MAX_URL))
+
 POS_SCHEMA = vol.Schema(
-    {vol.Required("x"): vol.Coerce(float), vol.Required("y"): vol.Coerce(float)},
+    {vol.Required("x"): _finite, vol.Required("y"): _finite},
     extra=vol.ALLOW_EXTRA,  # v2 records carry the "s" key (space id)
 )
-LAYOUT_SCHEMA = vol.Schema({str: POS_SCHEMA})
+LAYOUT_SCHEMA = vol.All(vol.Schema({str: POS_SCHEMA}), vol.Length(max=MAX_LAYOUT))
 
-POINT = vol.All([vol.Coerce(float)], vol.Length(min=2, max=2))
+POINT = vol.All([_finite], vol.Length(min=2, max=2))
 
 
 def _require_geometry(room: dict) -> dict:
@@ -65,28 +110,110 @@ def _require_geometry(room: dict) -> dict:
 ROOM_SCHEMA = vol.All(
     vol.Schema(
         {
-            vol.Required("id"): str,
-            vol.Required("name"): str,
-            vol.Optional("area"): vol.Any(str, None),
-            vol.Optional("x"): vol.Coerce(float),
-            vol.Optional("y"): vol.Coerce(float),
-            vol.Optional("w"): vol.Coerce(float),
-            vol.Optional("h"): vol.Coerce(float),
-            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3)),
+            vol.Required("id"): _TEXT,
+            vol.Required("name"): _TEXT,
+            vol.Optional("area"): _TEXT_OR_NONE,
+            vol.Optional("open_to"): vol.All([_TEXT], vol.Length(max=MAX_OPEN_TO)),
+            vol.Optional("settings"): vol.Any(
+                None,
+                vol.Schema(
+                    {
+                        vol.Optional("fill_mode"): vol.Any(None, vol.In(["none", "lqi", "light", "temp"])),
+                        vol.Optional("temp_source"): vol.Any(str, None),
+                        vol.Optional("hum_source"): vol.Any(str, None),
+                        vol.Optional("name_scale"): vol.Any(None, vol.All(vol.Coerce(float), vol.Range(min=0.5, max=3))),
+                        vol.Optional("label_scale"): vol.Any(None, vol.All(vol.Coerce(float), vol.Range(min=0.5, max=3))),
+                    },
+                    extra=vol.ALLOW_EXTRA,
+                ),
+            ),
+            vol.Optional("x"): _finite,
+            vol.Optional("y"): _finite,
+            vol.Optional("w"): _finite,
+            vol.Optional("h"): _finite,
+            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3, max=MAX_POLY_POINTS)),
         },
         extra=vol.ALLOW_EXTRA,
     ),
     _require_geometry,
 )
+SPACE_DISPLAY_SCHEMA = vol.Schema(
+    {
+        vol.Optional("show_borders"): bool,
+        vol.Optional("show_names"): bool,
+        vol.Optional("room_color"): vol.Match(r"^#[0-9a-fA-F]{6}$"),
+        vol.Optional("room_opacity"): vol.All(vol.Coerce(float), vol.Range(min=0, max=1)),
+        vol.Optional("fill_mode"): vol.In(["none", "lqi", "light", "temp", "glow"]),
+        vol.Optional("temp_min"): vol.Coerce(float),
+        vol.Optional("temp_max"): vol.Coerce(float),
+        vol.Optional("show_lqi"): bool,
+        vol.Optional("label_temp"): bool,
+        vol.Optional("label_hum"): bool,
+        vol.Optional("label_lqi"): bool,
+        vol.Optional("label_light"): bool,
+        vol.Optional("card_font_scale"): vol.All(vol.Coerce(float), vol.Range(min=0.5, max=3)),
+    },
+    extra=vol.ALLOW_EXTRA,
+)
+
+_DECOR_COMMON = {
+    vol.Required("id"): str,
+    vol.Optional("color"): vol.Match(r"^#[0-9a-fA-F]{6}$"),
+    vol.Optional("width"): vol.All(vol.Coerce(float), vol.Range(min=0.1, max=30)),
+}
+_NORM = vol.All(vol.Coerce(float), vol.Range(min=-1, max=2))
+DECOR_SCHEMA = vol.Any(
+    vol.Schema({**_DECOR_COMMON, vol.Required("kind"): "line",
+                vol.Required("x1"): _NORM, vol.Required("y1"): _NORM,
+                vol.Required("x2"): _NORM, vol.Required("y2"): _NORM},
+               extra=vol.ALLOW_EXTRA),
+    vol.Schema({**_DECOR_COMMON, vol.Required("kind"): vol.In(["rect", "ellipse"]),
+                vol.Required("x"): _NORM, vol.Required("y"): _NORM,
+                vol.Required("w"): _NORM, vol.Required("h"): _NORM,
+                vol.Optional("fill"): bool},
+               extra=vol.ALLOW_EXTRA),
+    vol.Schema({**_DECOR_COMMON, vol.Required("kind"): "text",
+                vol.Required("x"): _NORM, vol.Required("y"): _NORM,
+                vol.Required("text"): vol.All(str, vol.Length(min=1, max=200)),
+                vol.Optional("size"): vol.In(["s", "m", "l"])},
+               extra=vol.ALLOW_EXTRA),
+)
+
 SPACE_SCHEMA = vol.Schema(
     {
         vol.Required("id"): str,
         vol.Required("title"): str,
+        vol.Optional("settings"): SPACE_DISPLAY_SCHEMA,
         vol.Optional("plan_url"): vol.Any(str, None),
         vol.Required("aspect"): vol.All(vol.Coerce(float), vol.Range(min=0.05, max=20)),
-        vol.Required("view_box"): vol.All([vol.Coerce(float)], vol.Length(min=4, max=4)),
-        vol.Required("rooms"): [ROOM_SCHEMA],
-        vol.Optional("segments"): [vol.All([vol.Coerce(float)], vol.Length(min=4, max=4))],
+        vol.Required("view_box"): vol.All([_finite], vol.Length(min=4, max=4)),
+        vol.Required("rooms"): vol.All([ROOM_SCHEMA], vol.Length(max=MAX_ROOMS)),
+        vol.Optional("decor"): vol.All([DECOR_SCHEMA], vol.Length(max=MAX_DECOR)),
+        vol.Optional("openings"): vol.All([
+            vol.Schema(
+                {
+                    vol.Required("id"): str,
+                    vol.Required("type"): vol.Any("door", "window"),
+                    vol.Required("x"): _finite,
+                    vol.Required("y"): _finite,
+                    vol.Required("angle"): _finite,
+                    vol.Required("length"): vol.All(vol.Coerce(float), vol.Range(min=0.001, max=1)),
+                    vol.Optional("contact"): vol.Any(str, None),
+                    vol.Optional("lock"): vol.Any(str, None),
+                    vol.Optional("invert"): bool,
+                    vol.Optional("flip_h"): bool,
+                    vol.Optional("flip_v"): bool,
+                },
+                extra=vol.ALLOW_EXTRA,
+            )
+        ], vol.Length(max=MAX_OPENINGS)),
+        # Legacy: walls are derived from room outlines since v1.19.0 — a line has no
+        # independent existence. Still accepted so a stale browser tab cannot fail a save;
+        # the card strips the field on every write.
+        # Accepted so a stale browser tab cannot fail a save, then DROPPED here
+        # (HP-1454-05): relying on a modern client to strip an unbounded legacy
+        # list is not a limit, it is a hope. `Remove` returns the key stripped.
+        vol.Remove("segments"): object,
     },
     extra=vol.ALLOW_EXTRA,
 )
@@ -98,22 +225,52 @@ MARKER_SCHEMA = vol.Schema(
         vol.Optional("space"): vol.Any(str, None),
         vol.Optional("area"): vol.Any(str, None),
         vol.Optional("hidden"): bool,
-        vol.Optional("name"): vol.Any(str, None),
-        vol.Optional("icon"): vol.Any(str, None),
-        vol.Optional("model"): vol.Any(str, None),
-        vol.Optional("link"): vol.Any(str, None),
-        vol.Optional("description"): vol.Any(str, None),
-        vol.Optional("pdfs"): [
-            vol.Schema({vol.Required("name"): str, vol.Required("url"): str}, extra=vol.ALLOW_EXTRA)
-        ],
+        vol.Optional("name"): _TEXT_OR_NONE,
+        vol.Optional("icon"): _TEXT_OR_NONE,
+        vol.Optional("model"): _TEXT_OR_NONE,
+        vol.Optional("link"): vol.Any(None, _URL),
+        vol.Optional("description"): vol.Any(None, vol.All(str, vol.Length(max=MAX_DESCRIPTION))),
+        vol.Optional("tap_action"): vol.Any("info", "more-info", "toggle", None),
+        vol.Optional("controls"): vol.Any(None, vol.All([_TEXT], vol.Length(max=MAX_CONTROLS))),
+        vol.Optional("glow_radius_cm"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)), None),
+        vol.Optional("is_light"): vol.Any(bool, None),
+        vol.Optional("room_id"): vol.Any(str, None),
+        # keep in sync with DISPLAY_MODES in src/logic.ts — a cross-language test
+        # asserts every option the editor offers is accepted here (issue #3)
+        vol.Optional("display"): vol.Any("badge", "ripple", "icon_ripple", "value", None),
+        vol.Optional("ripple_color"): vol.Any(str, None),
+        vol.Optional("ripple_size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=1, max=20)), None),
+        vol.Optional("size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=0.2, max=6)), None),
+        vol.Optional("angle"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=-360, max=360)), None),
+        vol.Optional("pdfs"): vol.All(
+            [vol.Schema({vol.Required("name"): _TEXT, vol.Required("url"): _URL}, extra=vol.ALLOW_EXTRA)],
+            vol.Length(max=MAX_PDFS),
+        ),
     },
     extra=vol.ALLOW_EXTRA,
 )
 CONFIG_SCHEMA = vol.Schema(
     {
-        vol.Required("spaces"): [SPACE_SCHEMA],
-        vol.Optional("markers", default=list): [MARKER_SCHEMA],
-        vol.Optional("settings", default=dict): vol.Schema({}, extra=vol.ALLOW_EXTRA),
+        vol.Required("spaces"): vol.All([SPACE_SCHEMA], vol.Length(max=MAX_SPACES)),
+        vol.Optional("markers", default=list): vol.All([MARKER_SCHEMA], vol.Length(max=MAX_MARKERS)),
+        vol.Optional("settings", default=dict): vol.Schema(
+            {
+                vol.Optional("glow_radius_cm"): vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)),
+                vol.Optional("known_devices"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
+                vol.Optional("new_device_ids"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
+                vol.Optional("fill_colors"): vol.Schema(
+                    {
+                        str: vol.Schema(
+                            {
+                                vol.Required("c"): vol.Match(r"^#[0-9a-fA-F]{6}$"),
+                                vol.Required("a"): vol.All(vol.Coerce(float), vol.Range(min=0, max=1)),
+                            }
+                        )
+                    }
+                ),
+            },
+            extra=vol.ALLOW_EXTRA,
+        ),
     },
     extra=vol.ALLOW_EXTRA,  # unknown (legacy) keys do not break loading
 )

custom_components/houseplan/websocket_api.py

@@ -1,9 +1,12 @@
 """House Plan WS commands: layout, space configuration, plan uploads."""
 from __future__ import annotations
 
-import asyncio
+import logging
+
 import base64
 import binascii
+import json
+import secrets
 from pathlib import Path
 from typing import Any
 
@@ -13,15 +16,21 @@ from homeassistant.components import websocket_api
 from homeassistant.core import HomeAssistant, callback
 
 from .const import (
-    CONF_ADMIN_ONLY, DEFAULT_CONFIG, DOMAIN,
-    PLANS_DIR, PLANS_URL,
+    CONF_ADMIN_ONLY, DEFAULT_CONFIG,
+    CONTENT_URL, FILES_DIR, MAX_SIGN_PATHS, PLANS_DIR, PLANS_URL,
 )
+from .auth import may_write
+from .plans import collect_attachments, collect_plans, unique_filename
+from .store import HouseplanData, get_data, get_entry
 from .validation import (
-    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_PLAN_BYTES,
+    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_CONFIG_BYTES, MAX_PLAN_BYTES,
     PLAN_EXTENSIONS, POS_SCHEMA, valid_space_id,
 )
 
 
+_LOGGER = logging.getLogger(__name__)
+
+
 @callback
 def async_register(hass: HomeAssistant) -> None:
     """Register the WS commands."""
@@ -32,29 +41,27 @@ def async_register(hass: HomeAssistant) -> None:
     websocket_api.async_register_command(hass, ws_config_get)
     websocket_api.async_register_command(hass, ws_config_set)
     websocket_api.async_register_command(hass, ws_plan_set)
+    websocket_api.async_register_command(hass, ws_files_migrate)
+    websocket_api.async_register_command(hass, ws_files_cleanup)
+    websocket_api.async_register_command(hass, ws_content_sign)
 
 
-def _store(hass: HomeAssistant):
-    return hass.data[DOMAIN]["store"]
+def _runtime(hass: HomeAssistant, connection, msg_id: int) -> HouseplanData | None:
+    """Runtime data of the loaded entry; answers `not_ready` when not set up.
 
-
-def _config_store(hass: HomeAssistant):
-    return hass.data[DOMAIN]["config_store"]
-
-
-def _write_lock(hass: HomeAssistant) -> asyncio.Lock:
-    """A single lock over the load→modify→save cycle of both stores.
-
-    Without it, parallel WS calls lose changes (last-writer-wins),
+    The write_lock inside serializes every load→modify→save cycle of both
+    stores: without it parallel WS calls lose changes (last-writer-wins)
     and the expected_rev check is not atomic.
     """
-    return hass.data[DOMAIN].setdefault("write_lock", asyncio.Lock())
+    data = get_data(hass)
+    if data is None:
+        connection.send_error(msg_id, "not_ready", "House Plan is not set up")
+    return data
 
 
 def _check_write(hass: HomeAssistant, connection) -> bool:
-    entry = hass.data[DOMAIN].get("entry")
-    admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
-    return connection.user.is_admin if admin_only else True
+    """May this connection write? Thin wrapper over the shared policy."""
+    return may_write(hass, getattr(connection, "user", None))
 
 
 # ---------------- layout ----------------
@@ -64,22 +71,49 @@ def _check_write(hass: HomeAssistant, connection) -> bool:
 @websocket_api.async_response
 async def ws_layout_get(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
     """Return the saved layout."""
-    data = await _store(hass).async_load() or {}
-    connection.send_result(msg["id"], {"layout": data.get("layout", {})})
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    data = await rt.store.async_load() or {}
+    connection.send_result(
+        msg["id"], {"layout": data.get("layout", {}), "rev": int(data.get("rev", 0))}
+    )
 
 
 @websocket_api.websocket_command(
-    {vol.Required("type"): "houseplan/layout/set", vol.Required("layout"): LAYOUT_SCHEMA}
+    {
+        vol.Required("type"): "houseplan/layout/set",
+        vol.Required("layout"): LAYOUT_SCHEMA,
+        vol.Optional("expected_rev"): int,
+    }
 )
 @websocket_api.async_response
 async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
-    """Replace the layout entirely."""
+    """Replace the layout entirely, with optimistic locking (audit B3).
+
+    Wholesale layout writes used to have no revision check at all, so two
+    clients silently overwrote each other. `expected_rev` is optional for
+    backwards compatibility with older cards, but when supplied it is enforced
+    exactly like the config store does.
+    """
     if not _check_write(hass, connection):
         connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
         return
-    async with _write_lock(hass):
-        await _store(hass).async_save({"layout": msg["layout"]})
-    connection.send_result(msg["id"], {"ok": True})
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
+        current_rev = int(data.get("rev", 0))
+        if "expected_rev" in msg and msg["expected_rev"] != current_rev:
+            connection.send_error(
+                msg["id"], "conflict", f"Layout changed elsewhere (rev {current_rev})"
+            )
+            return
+        new_rev = current_rev + 1
+        await rt.store.async_save({"layout": msg["layout"], "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
 
 
 @websocket_api.websocket_command(
@@ -95,13 +129,162 @@ async def ws_layout_update(hass: HomeAssistant, connection, msg: dict[str, Any])
     if not _check_write(hass, connection):
         connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
         return
-    store = _store(hass)
-    async with _write_lock(hass):
-        data = await store.async_load() or {}
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
         layout = data.get("layout", {})
         layout[msg["device_id"]] = msg["pos"]
-        await store.async_save({"layout": layout})
-    connection.send_result(msg["id"], {"ok": True})
+        # keep the revision: a point-wise write used to drop it, which made the
+        # optimistic locking on layout/set meaningless — every drag reset the
+        # counter to 0 (HP-1454-08)
+        new_rev = int(data.get("rev", 0)) + 1
+        await rt.store.async_save({"layout": layout, "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/files/migrate",
+        vol.Required("from_id"): str,
+        vol.Required("to_id"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_files_migrate(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """COPY a marker's uploaded files to its new id and report the exact mapping.
+
+    Rebinding changes the marker id, so the files must follow (that is how the
+    owner lost a set of manuals, 2026-07-26). This used to MOVE them before the
+    revision-checked config save: when that save was rejected, the server kept
+    the old urls while the files had already left the old folder — a permanent
+    broken link (review CR-2, 2026-07-27).
+
+    Now it copies, never overwrites, and returns {src: dst} for every file so
+    the client can rewrite EXACTLY the urls that made it (review CR-3). The old
+    folder is removed later by houseplan/files/cleanup, once the config is
+    safely committed.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit files")
+        return
+    import shutil
+    from pathlib import Path
+
+    from .const import FILES_DIR
+    from .validation import sanitize_marker_id
+
+    src_id = sanitize_marker_id(msg["from_id"])
+    dst_id = sanitize_marker_id(msg["to_id"])
+    if not src_id or not dst_id or src_id == dst_id:
+        connection.send_result(msg["id"], {"ok": True, "mapping": {}, "copied": 0})
+        return
+    base = Path(hass.config.path(FILES_DIR))
+    src = base / src_id
+    dst = base / dst_id
+
+    def _copy() -> dict[str, str]:
+        if not src.is_dir():
+            return {}
+        dst.mkdir(parents=True, exist_ok=True)
+        mapping: dict[str, str] = {}
+        for f in sorted(src.iterdir()):
+            if not f.is_file():
+                continue
+            # a different file may already own this name — do NOT silently point
+            # the url at it; the shared helper picks a free one, using only
+            # characters the content view will accept back in a request
+            target = dst / unique_filename(dst, f.name)
+            shutil.copy2(str(f), str(target))
+            mapping[f.name] = target.name
+        return mapping
+
+    try:
+        mapping = await hass.async_add_executor_job(_copy)
+    except OSError as err:
+        connection.send_error(msg["id"], "io_error", f"Could not copy marker files: {err}")
+        return
+    connection.send_result(msg["id"], {"ok": True, "mapping": mapping, "copied": len(mapping)})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/content/sign",
+        vol.Required("paths"): [str],
+    }
+)
+@websocket_api.async_response
+async def ws_content_sign(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Sign content paths so the BROWSER can fetch them.
+
+    Home Assistant authenticates HTTP requests by a Bearer header or an
+    `authSig` signed path — there is no cookie auth. An <image href> inside SVG
+    and a plain <a href> can send neither, so after the content endpoint became
+    `requires_auth` the plan backgrounds and PDF links returned 401 (audit
+    follow-up B1 regression, 2026-07-27 — reproduced live).
+
+    The card asks for signatures and uses the signed urls for display.
+    """
+    from datetime import timedelta
+
+    from homeassistant.components.http.auth import async_sign_path
+
+    out: dict[str, str] = {}
+    token_id = getattr(connection, "refresh_token_id", None)
+    for path in msg["paths"][:MAX_SIGN_PATHS]:
+        if not isinstance(path, str) or not path.startswith(CONTENT_URL + "/"):
+            continue  # only ever sign our own content endpoint
+        clean = path.split("?", 1)[0]
+        try:
+            try:
+                signed = async_sign_path(hass, clean, timedelta(hours=24), refresh_token_id=token_id)
+            except TypeError:  # older HA signature: (hass, refresh_token_id, path, expiration)
+                signed = async_sign_path(hass, token_id, clean, timedelta(hours=24))
+        except Exception as err:  # noqa: BLE001 — signing must never break the card
+            _LOGGER.warning("House Plan: could not sign %s: %s", clean, err)
+            continue
+        out[path] = signed
+    connection.send_result(msg["id"], {"urls": out})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/files/cleanup",
+        vol.Required("marker_id"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_files_cleanup(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Delete a marker's file folder — called only AFTER the config is committed."""
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit files")
+        return
+    import shutil
+    from pathlib import Path
+
+    from .const import FILES_DIR
+    from .validation import sanitize_marker_id
+
+    mid = sanitize_marker_id(msg["marker_id"])
+    if not mid:
+        connection.send_result(msg["id"], {"ok": True, "removed": False})
+        return
+    base = Path(hass.config.path(FILES_DIR)).resolve()
+    target = (base / mid).resolve()
+    if not str(target).startswith(str(base)) or target == base:
+        connection.send_result(msg["id"], {"ok": True, "removed": False})
+        return
+
+    def _rm() -> bool:
+        if not target.is_dir():
+            return False
+        shutil.rmtree(target, ignore_errors=True)
+        return True
+
+    removed = await hass.async_add_executor_job(_rm)
+    connection.send_result(msg["id"], {"ok": True, "removed": removed})
 
 
 @websocket_api.websocket_command(
@@ -116,14 +299,20 @@ async def ws_layout_delete(hass: HomeAssistant, connection, msg: dict[str, Any])
     if not _check_write(hass, connection):
         connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
         return
-    store = _store(hass)
-    async with _write_lock(hass):
-        data = await store.async_load() or {}
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    new_rev: int | None = None
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
         layout = data.get("layout", {})
         if msg["device_id"] in layout:
             del layout[msg["device_id"]]
-            await store.async_save({"layout": layout})
-    connection.send_result(msg["id"], {"ok": True})
+            new_rev = int(data.get("rev", 0)) + 1
+            await rt.store.async_save({"layout": layout, "rev": new_rev})
+    if new_rev is not None:
+        hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
 
 
 # ---------------- space configuration ----------------
@@ -133,11 +322,15 @@ async def ws_layout_delete(hass: HomeAssistant, connection, msg: dict[str, Any])
 @websocket_api.async_response
 async def ws_config_get(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
     """Return the configuration and its revision."""
-    data = await _config_store(hass).async_load() or {}
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    data = await rt.config_store.async_load() or {}
     config = {**DEFAULT_CONFIG, **data.get("config", {})}
     connection.send_result(msg["id"], {"config": config, "rev": data.get("rev", 0)})
 
 
+
 @websocket_api.websocket_command(
     {
         vol.Required("type"): "houseplan/config/set",
@@ -156,10 +349,31 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
     if not _check_write(hass, connection):
         connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the configuration")
         return
-    store = _config_store(hass)
-    async with _write_lock(hass):
-        data = await store.async_load() or {}
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    # Per-field limits bound each list; this bounds their product (HP-1454-05).
+    # Everything below the caps can still add up to something no dashboard can
+    # render, and the store writes it to disk on every save.
+    size = len(json.dumps(msg["config"], separators=(",", ":")))
+    if size > MAX_CONFIG_BYTES:
+        connection.send_error(
+            msg["id"], "too_large",
+            f"Configuration is {size // 1024} KB, the limit is {MAX_CONFIG_BYTES // 1024} KB",
+        )
+        return
+    async with rt.write_lock:
+        data = await rt.config_store.async_load() or {}
         current_rev = data.get("rev", 0)
+        if "expected_rev" not in msg and current_rev:
+            # audit B4: expected_rev stays optional for old cards mid-upgrade,
+            # but a blind overwrite of a non-empty store is worth a warning —
+            # it is exactly how a stale client silently discards someone's work.
+            _LOGGER.warning(
+                "House Plan: config/set without expected_rev over rev %s — "
+                "the client bypasses conflict detection (outdated card?)",
+                current_rev,
+            )
         if "expected_rev" in msg and msg["expected_rev"] != current_rev:
             connection.send_error(
                 msg["id"], "conflict",
@@ -167,8 +381,28 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
             )
             return
         new_rev = current_rev + 1
-        await store.async_save({"config": msg["config"], "rev": new_rev})
+        await rt.config_store.async_save({"config": msg["config"], "rev": new_rev})
+        # Still holding the lock: the file system is not part of the store's
+        # transaction, so collection has to be pinned to this commit (R3-1).
+        # It is best-effort housekeeping behind an already durable write — a
+        # failure here must not withhold the event and the success response,
+        # or the client retries an edit the server has already accepted and
+        # gets a conflict for its trouble (R4-1).
+        def _collect() -> None:
+            collect_plans(Path(hass.config.path(PLANS_DIR)), data.get("config"), msg["config"])
+            collect_attachments(Path(hass.config.path(FILES_DIR)), data.get("config"), msg["config"])
+
+        try:
+            await hass.async_add_executor_job(_collect)
+        except Exception:  # noqa: BLE001 — see above: the commit stands regardless
+            _LOGGER.exception("House Plan: collecting superseded files failed")
     hass.bus.async_fire("houseplan_config_updated", {"rev": new_rev})
+    # refresh repair issues (broken plan references) without waiting for a restart
+    entry = get_entry(hass)
+    if entry is not None:
+        from .repairs import async_check_plan_files
+
+        hass.async_create_task(async_check_plan_files(hass, entry))
     connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
 
 
@@ -202,20 +436,25 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
         connection.send_error(msg["id"], "too_large", f"Plan is larger than {MAX_PLAN_BYTES // 1024 // 1024} MB")
         return
 
+    # Copy-on-write: a plan is written under a NEW unique name and nothing is
+    # deleted here (review R2-1). The old name stays readable, so a config write
+    # that is later rejected — revision conflict, validation, lost connection —
+    # leaves the stored plan exactly as it was. The card calls
+    # nothing here; the superseded file is collected by `config/set` itself,
+    # inside the write lock, once a revision that no longer references it has
+    # been accepted (review R3-1). A crash in between leaves an orphan, which
+    # the same collector removes on a later commit once it is old enough.
+    #
+    # `.` separates the id from the token because a space id cannot contain one
+    # (SPACE_ID_RE), so "<space>.<token>.<ext>" can never be confused with the
+    # files of a differently named space.
     plans_dir = Path(hass.config.path(PLANS_DIR))
-    path = plans_dir / f"{space_id}.{msg['ext']}"
+    name = f"{space_id}.{secrets.token_hex(4)}.{msg['ext']}"
+    path = plans_dir / name
 
-    def _write() -> int:
+    def _write() -> None:
         plans_dir.mkdir(parents=True, exist_ok=True)
-        # remove old variants with a different extension
-        for old_ext in PLAN_EXTENSIONS:
-            old = plans_dir / f"{space_id}.{old_ext}"
-            if old_ext != msg["ext"] and old.exists():
-                old.unlink()
         path.write_bytes(raw)
-        return int(path.stat().st_mtime)
 
-    mtime = await hass.async_add_executor_job(_write)
-    connection.send_result(
-        msg["id"], {"ok": True, "url": f"{PLANS_URL}/{space_id}.{msg['ext']}?v={mtime}"}
-    )
+    await hass.async_add_executor_job(_write)
+    connection.send_result(msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{name}"})

demo/README.md

@@ -0,0 +1,17 @@
+# Synthetic demo home
+
+A fully fictional house (plans, devices, states) used for README screenshots,
+the demo GIF and headless smoke tests — so no real home data ever appears in
+public materials.
+
+- `srv/demo.html` — self-contained host page: `<ha-icon>`/`<ha-card>` stubs and a
+  fake `hass` (registries, states, `callWS`, `callService`, floors).
+- `srv/assets/` — generated plan SVGs and `icons.js` (`node demo/gen_icons.mjs`,
+  needs the repo's devDependencies). The card bundle is copied from `dist/`:
+  `cp dist/houseplan-card.js demo/srv/assets/`.
+- `serve.mjs` — playwright launcher (route interception, no web server).
+- `smoke_*.mjs` — feature smoke tests; run with a Chromium installed via
+  `PLAYWRIGHT_BROWSERS_PATH=<dir> npx playwright install chromium-headless-shell`.
+
+Note for sandboxed sessions: `/tmp` does not survive; this directory is the
+persistent home of the harness (docs/DEVELOPMENT.md has the LD_LIBRARY_PATH recipe).

demo/dbg_click.mjs

@@ -0,0 +1,43 @@
+import { launch } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  // glow на текущем пространстве
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
+  c.requestUpdate(); await c.updateComplete;
+  out.mode = c._mode;
+  out.suppress = c._suppressClick;
+  out.holdFired = c._holdFired;
+  out.drag = !!c._drag;
+  // реальный клик по включённой лампе (элемент .dev)
+  const litDev = c._devices.find((d) => d.space === c._space && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on'));
+  out.hasLit = !!litDev;
+  const el = [...sr().querySelectorAll('.dev')].find((e) => e.textContent.includes(litDev.name) || true);
+  // найдём элемент точно: по индексу устройства
+  const devEls = [...sr().querySelectorAll('.dev')];
+  out.devCount = devEls.length;
+  const target = devEls[c._devices.filter((d) => d.space === c._space).indexOf(litDev)] || devEls[0];
+  const before = calls.length;
+  c._infoCard = null;
+  // эмулируем полный цикл: pointerdown/up + click
+  const opts = { bubbles: true, composed: true };
+  target.dispatchEvent(new PointerEvent('pointerdown', { ...opts, pointerId: 5 }));
+  target.dispatchEvent(new PointerEvent('pointerup', { ...opts, pointerId: 5 }));
+  target.dispatchEvent(new MouseEvent('click', opts));
+  await c.updateComplete;
+  out.reaction = calls.length > before ? 'service:' + JSON.stringify(calls.at(-1)) : c._infoCard ? 'info' : 'NOTHING';
+  out.suppressAfter = c._suppressClick;
+  // и через прямой вызов
+  c._infoCard = null;
+  c._clickDevice(new MouseEvent('click'), litDev);
+  await c.updateComplete;
+  out.directReaction = calls.length > before + 1 ? 'service' : c._infoCard ? 'info' : 'NOTHING';
+  return out;
+});
+console.log(JSON.stringify(res, null, 1));
+await browser.close();

demo/gen_icons.mjs

@@ -0,0 +1,22 @@
+// Generate demo/srv/assets/icons.js: an { "mdi:name": "<svg path>" } map for every
+// mdi: icon referenced in src/ and demo/ (the demo host stubs <ha-icon> with it).
+import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
+import * as mdi from '@mdi/js';
+
+const names = new Set();
+const scan = (dir) => {
+  for (const f of readdirSync(dir, { withFileTypes: true })) {
+    if (f.isDirectory()) { scan(`${dir}/${f.name}`); continue; }
+    if (!/\.(ts|json|html|mjs)$/.test(f.name) || f.name === 'icons.js') continue;
+    const txt = readFileSync(`${dir}/${f.name}`, 'utf8');
+    for (const m of txt.matchAll(/mdi:([a-z0-9-]+)/g)) names.add(m[1]);
+  }
+};
+scan('src'); scan('demo');
+const map = {};
+for (const n of [...names].sort()) {
+  const camel = 'mdi' + n.replace(/(^|-)(\w)/g, (_, __, c) => c.toUpperCase());
+  if (mdi[camel]) map['mdi:' + n] = mdi[camel];
+}
+writeFileSync('demo/srv/assets/icons.js', 'window.__ICONS=' + JSON.stringify(map) + ';\n');
+console.log('icons:', Object.keys(map).length, 'of', names.size, 'referenced');

demo/repro_issue3.mjs

@@ -0,0 +1,25 @@
+// Репро №3: пользовательский путь — открыть диалог, выставить «комфорт от 25», сохранить
+import { launch } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // living room: единственный термометр 22.4 → подменим на 24.0 как у пользователя
+  const h = window.__mkHass();
+  h.states = { ...h.states, 'sensor.living_temp': { ...h.states['sensor.living_temp'], state: '24.0' } };
+  c.hass = h; c._regSignature=''; c._maybeRebuildDevices(); await c.updateComplete;
+  // путь пользователя: диалог → режим temp, min=25 (макс не трогаем) → сохранить
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  out.dialogInit = { min: c._spaceDialog.tempMin, max: c._spaceDialog.tempMax, fill: c._spaceDialog.fillMode };
+  c._spaceDialog = { ...c._spaceDialog, fillMode: 'temp', tempMin: 25 };
+  await c._saveSpaceDialog(); await c.updateComplete;
+  const sp = c._serverCfg.spaces.find(s=>s.id==='f1');
+  out.savedSettings = sp.settings;
+  const styles = [...sr().querySelectorAll('.room.styled')].map(r => (r.getAttribute('style')||'').match(/--room-fill:([^;]+)/)?.[1]);
+  out.livingFill = styles[0];
+  out.expected = '#4fc3f7 (blue: 24 < 25)';
+  return out;
+});
+console.log(JSON.stringify(res, null, 1));
+await browser.close();

demo/serve.mjs

@@ -0,0 +1,63 @@
+// Shared launcher for demo captures: starts headless Chromium serving demo/srv/
+// via request interception (no HTTP server needed). Usage: const {page,browser}=await launch();
+import { chromium } from 'playwright';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+const ROOT = dirname(fileURLToPath(import.meta.url)) + '/srv';
+const CT = { '.html': 'text/html', '.js': 'text/javascript', '.svg': 'image/svg+xml' };
+// ---- assertion harness (audit T1) --------------------------------------
+// Until 2026-07-27 the smokes printed booleans and always exited 0: a broken
+// build reported success. `check()` accumulates named failures, `finish()`
+// prints them and sets the exit code.
+const _failures = [];
+let _pageErrors = 0;
+
+/** Assert one named fact. `expected` defaults to true. */
+export function check(name, actual, expected = true) {
+  const ok = JSON.stringify(actual) === JSON.stringify(expected);
+  if (!ok) _failures.push(`${name}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  return ok;
+}
+
+/** Assert a whole result object: every key must equal true unless listed. */
+export function checkAll(out, expected = {}) {
+  for (const [k, v] of Object.entries(out)) check(k, v, k in expected ? expected[k] : true);
+  return out;
+}
+
+/** Print the result, report failures, close the browser, set the exit code. */
+export async function finish(browser, out) {
+  if (out !== undefined) console.log(JSON.stringify(out, null, 1));
+  if (_pageErrors) _failures.push(`${_pageErrors} uncaught exception(s) inside the card`);
+  await browser?.close?.();
+  if (_failures.length) {
+    console.error('\nFAILED (' + _failures.length + '):');
+    for (const f of _failures) console.error('  - ' + f);
+    process.exitCode = 1;
+  } else {
+    console.log('OK');
+  }
+}
+
+export async function launch(viewport = { width: 820, height: 760 }, scale = 1) {
+  const browser = await chromium.launch({ args: ['--no-sandbox'] });
+  const page = await (await browser.newContext({ viewport, deviceScaleFactor: scale })).newPage();
+  // audit T1: an exception inside the card used to be logged and ignored
+  page.on('pageerror', (e) => { _pageErrors++; console.log('EXC', e.message); });
+  await page.route('**/*', (r) => {
+    const u = new URL(r.request().url());
+    let p = decodeURIComponent(u.pathname);
+    if (p === '/') p = '/demo.html';
+    const f = ROOT + p;
+    existsSync(f)
+      ? r.fulfill({ status: 200, headers: { 'content-type': CT[p.slice(p.lastIndexOf('.'))] || 'application/octet-stream' }, body: readFileSync(f) })
+      : r.fulfill({ status: 404, body: 'nf' });
+  });
+  await page.goto('http://demo.local/demo.html', { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(() => window.__card?._model?.length > 0, { timeout: 9000 });
+  // hass flows continuously in production; the stub sets it once — nudge a rebuild
+  await page.evaluate(() => { const c = window.__card; c.hass = { ...c.hass }; });
+  await page.waitForFunction(() => window.__card._devices.length > 0, { timeout: 9000 });
+  return { page, browser };
+}

demo/smoke_align_guides.mjs

@@ -0,0 +1,56 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const g = c._gridPitch;
+  const guides = () => sr().querySelectorAll('.alignline').length;
+  // 1) рисование контура: курсор на одном X с вершиной комнаты → гид
+  c._setMode('plan'); c._tool = 'draw'; await c.updateComplete;
+  const r1 = c._spaceModel().rooms.find((r) => r.id === 'r1');
+  const poly = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
+  const v = poly[0];
+  c._path = [[v[0] + g * 10, v[1] + g * 10]];
+  c._cursorPt = [v[0], v[1] + g * 20]; // тот же X, что у вершины
+  c.requestUpdate(); await c.updateComplete;
+  out.drawGuide = guides() >= 1;
+  out.dot = sr().querySelectorAll('.aligndot').length >= 1;
+  // нет выравнивания → нет гидов
+  c._cursorPt = [v[0] + g * 7 + 1.7, v[1] + g * 13 + 2.3]; c.requestUpdate(); await c.updateComplete;
+  out.noGuideOffAxis = guides() === 0;
+  // 2) бейдж угла: 45° красит
+  c._cursorPt = [c._path[0][0] + g * 5, c._path[0][1] + g * 5]; c.requestUpdate(); await c.updateComplete;
+  const ml = sr().querySelector('.measurelabel');
+  out.badge45 = !!ml && ml.classList.contains('on45') && ml.textContent.includes('45');
+  c._cursorPt = [c._path[0][0] + g * 5, c._path[0][1] + g * 2]; c.requestUpdate(); await c.updateComplete;
+  const ml2 = sr().querySelector('.measurelabel');
+  out.badgeOff45 = !!ml2 && !ml2.classList.contains('on45') && ml2.textContent.includes('°');
+  c._path = []; c._cursorPt = null;
+  // 3) редактор устройств: drag значка в линию с другим значком
+  c._setMode('devices'); await c.updateComplete;
+  const devs = c._devices.filter((d) => d.space === c._space);
+  const a = devs[0], b = devs[1];
+  const pa = c._pos(a);
+  // поставим b на тот же Y, начнём drag
+  c._layout = { ...c._layout, [b.id]: { s: c._space, x: (pa.x + g * 12) / 1000, y: pa.y / (1000 / (c._curSpaceCfg.aspect || 1)) } };
+  c._drag = { id: b.id, sx: 0, sy: 0, ox: 0, oy: 0, moved: true };
+  c.requestUpdate(); await c.updateComplete;
+  out.devGuide = guides() >= 1;
+  c._drag = null; c.requestUpdate(); await c.updateComplete;
+  out.devGuideGone = guides() === 0;
+  // 4) подложка: рисование прямоугольника с углом на одном X с углом другой фигуры
+  c._setMode('decor'); await c.updateComplete;
+  c._curSpaceCfg.decor = [{ id: 'd1', kind: 'rect', x: 0.2, y: 0.2, w: 0.1, h: 0.1, color: '#ff0000', width: 3 }];
+  const W = 1000, H = 1000 / (c._curSpaceCfg.aspect || 1);
+  c._decorDraft = { kind: 'rect', a: [0.5 * W, 0.5 * H], b: [0.2 * W, 0.6 * H], pid: 9 }; // b.x == углу d1
+  c.requestUpdate(); await c.updateComplete;
+  out.decorGuide = guides() >= 1;
+  c._decorDraft = null; c._curSpaceCfg.decor = []; c.requestUpdate(); await c.updateComplete;
+  // 5) в Просмотре гидов не бывает
+  c._setMode('view'); await c.updateComplete;
+  out.noneInView = guides() === 0;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_binding_ui.mjs

@@ -0,0 +1,50 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('devices'); await c.updateComplete;
+  // новый маркер: радио «Виртуальное» по умолчанию, списка нет
+  c._openMarkerDialog(); await c.updateComplete;
+  const radios = () => [...sr().querySelectorAll('.bindsel input[type="radio"]')];
+  out.twoRadios = radios().length === 2;
+  out.virtDefault = radios()[0].checked && !radios()[1].checked;
+  out.noDropWhenVirtual = !sr().querySelector('.dropbtn');
+  // переключить на «Из списка HA» → появляется дропдаун, открыт (нет выбора), сейв заблокирован
+  radios()[1].click(); await c.updateComplete;
+  out.dropShown = !!sr().querySelector('.dropbtn');
+  out.panelOpen = !!sr().querySelector('.droppanel');
+  const saveBtn = [...sr().querySelectorAll('.dialog .btn.on')].pop();
+  out.saveDisabled = saveBtn?.disabled === true;
+  // без чекбокса в списке нет individual-сущностей устройств
+  const subs = () => [...sr().querySelectorAll('.cand .cs')].map((e) => e.textContent);
+  const entLabel = c._t('marker.sub_entity');
+  out.noDeviceEntities = !subs().some((s) => s.includes(entLabel));
+  // (группы/хелперы в демо все уже размещены и потому скрыты как занятые —
+  // их «всегда в списке» проверяется кодом: блок вне чекбокса)
+  // включить чекбокс → сущности появились
+  const cb = sr().querySelector('.entcheck input');
+  cb.click(); await c.updateComplete;
+  out.entitiesShown = [...sr().querySelectorAll('.cand .cs')].some((s) => s.textContent.includes(entLabel));
+  out.tooltip = sr().querySelector('.entcheck').getAttribute('title') === c._t('marker.show_entities_tip');
+  // выбрать первый кандидат → панель закрылась, сейв разблокирован
+  sr().querySelector('.cand').click(); await c.updateComplete;
+  out.picked = c._markerDialog.binding !== '' && c._markerDialog.binding !== 'virtual';
+  out.panelClosed = !sr().querySelector('.droppanel');
+  out.saveEnabled = [...sr().querySelectorAll('.dialog .btn.on')].pop()?.disabled === false;
+  // радио назад на «Виртуальное» → binding=virtual
+  radios()[0].click(); await c.updateComplete;
+  out.backToVirtual = c._markerDialog.binding === 'virtual' && c._markerDialog.bindingMode === 'virtual';
+  c._markerDialog = null; await c.updateComplete;
+  // редактирование существующего устройства: радио «Из списка», выбранная привязка в кнопке
+  const dev = c._devices.find((d) => !d.virtual && d.bindingKind === 'device');
+  c._openMarkerDialog(dev); await c.updateComplete;
+  out.editHaMode = c._markerDialog.bindingMode === 'ha';
+  out.editShowsCur = sr().querySelector('.dropbtn b') !== null;
+  out.editPanelClosed = !sr().querySelector('.droppanel');
+  c._markerDialog = null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_card_controls.mjs

@@ -0,0 +1,44 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  // устройство с управляемой сущностью
+  const dev = c._devices.find((d) => d.entities?.some((e) => e.startsWith('light.') || e.startsWith('switch.')));
+  out.hasDev = !!dev;
+  c._infoCard = dev; await c.updateComplete;
+  // 1) блок сущностей идёт ПЕРВЫМ, до модели/ссылок
+  const body = sr().querySelector('.dialog .body');
+  out.entListFirst = body.firstElementChild?.classList.contains('entlist')
+    || body.querySelector('.entlist') === body.children[0];
+  const rows = [...sr().querySelectorAll('.entrow')];
+  out.rows = rows.length > 0;
+  // 2) у переключаемой сущности — кнопка с крупной зоной нажатия
+  const btn = sr().querySelector('.entbtn');
+  out.hasButton = !!btn;
+  const box = btn?.getBoundingClientRect();
+  out.tapTarget = box ? box.height >= 30 && box.width >= 60 : null;
+  // 3) кнопка реально переключает
+  const before = calls.length;
+  btn.click(); await c.updateComplete;
+  out.toggles = calls.length > before && calls.at(-1)[1] === 'toggle';
+  // 4) замок никогда не переключается из карточки
+  const n = calls.length;
+  c._cardToggle('lock.front_door');
+  out.lockNeverToggles = calls.length === n;
+  // 5) диагностические/конфиг-сущности не засоряют список
+  const ents = c._cardEntities(dev).map((e) => e.eid);
+  out.noConfigEntities = ents.every((e) => {
+    const cat = c.hass.entities[e]?.entity_category;
+    return cat !== 'config' && cat !== 'diagnostic';
+  });
+  c._infoCard = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_card_tool_conflict.mjs

@@ -0,0 +1,51 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); await c.updateComplete;
+  const stage = sr().querySelector('.stage');
+  const label = sr().querySelector('.roomlabel');
+  out.hasLabel = !!label;
+  // 1) draw: клик по карточке не добавляет точку
+  c._tool = 'draw'; c._path = []; await c.updateComplete;
+  label.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true, clientX: 10, clientY: 10 }));
+  await c.updateComplete;
+  out.drawIgnored = c._path.length === 0;
+  // 2) клик по угловой метке тоже не считается кликом инструмента
+  const handle = label.querySelector('.rlhandle');
+  handle.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true, clientX: 10, clientY: 10 }));
+  await c.updateComplete;
+  out.handleIgnored = c._path.length === 0;
+  // 3) во время резайза клики по сцене игнорируются
+  const room = c._spaceModel().rooms.find((r) => r.name);
+  c._rlResize = { id: 'rl_' + room.id, space: c._space, k0: 1, cx: 0, cy: 0, d0: 50 };
+  const before = c._path.length;
+  c._markupClick(new MouseEvent('click', { bubbles: true, clientX: 200, clientY: 200 }));
+  out.duringResizeIgnored = c._path.length === before;
+  c._rlResize = null;
+  // 4) обычный клик по сцене (мимо карточки) по-прежнему работает — точка ставится
+  const r = stage.getBoundingClientRect();
+  // найти долю экрана, попадающую в свободное место (не внутри комнаты)
+  let fx = 0.4, fy = 0.4;
+  outer: for (let ix = 1; ix < 20; ix++) for (let iy = 1; iy < 20; iy++) {
+    const ev = new MouseEvent('click', { clientX: r.left + r.width * ix / 20, clientY: r.top + r.height * iy / 20 });
+    const raw = c._svgPoint(ev);
+    if (!c._roomAt(c._snap(raw))) { fx = ix / 20; fy = iy / 20; break outer; }
+  }
+  stage.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true,
+    clientX: r.left + r.width * fx, clientY: r.top + r.height * fy }));
+  await c.updateComplete;
+  out.normalClickWorks = c._path.length === 1;
+  // 5) delroom: клик по карточке не зовёт confirm (переопределим)
+  let confirmCalled = false;
+  window.confirm = () => { confirmCalled = true; return false; };
+  c._tool = 'delroom'; c._path = []; await c.updateComplete;
+  label.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true, clientX: 10, clientY: 10 }));
+  await c.updateComplete;
+  out.delroomIgnored = !confirmCalled;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_climate_once.mjs

@@ -0,0 +1,76 @@
+// Ревью R2-3: климат комнат считался отдельным обходом реестра на каждую
+// комнату и каждую величину — 60 комнат × 2000 сущностей съедали кадр на
+// перечитывании метаданных, которые не менялись. Карта строится один раз на
+// снимок hass; при этом новые состояния датчиков обязаны попадать в неё сразу.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+
+  // считаем обходы реестра через ownKeys — именно его дёргает Object.entries
+  let scans = 0;
+  const wrap = (h) => {
+    const ents = h.entities;
+    const traced = new Proxy(ents, { ownKeys(t) { scans++; return Reflect.ownKeys(t); } });
+    return { ...h, entities: traced };
+  };
+  const fresh = () => wrap(window.__mkHass());
+
+  // включаем и заливку по температуре, и подписи — два потребителя климата
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, settings: { ...(s.settings || {}), show_names: true, fill_mode: 'temp', label_temp: true, label_hum: true },
+  })};
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  const fewRooms = scans;
+
+  // повторные рендеры на том же снимке hass реестр не трогают
+  scans = 0;
+  c.requestUpdate(); await c.updateComplete;
+  c.requestUpdate(); await c.updateComplete;
+  out.scansOnRerender = scans;
+
+  // главный инвариант: обходов НЕ становится больше от числа комнат
+  const f1 = c._serverCfg.spaces.find((s) => s.id === 'f1');
+  const extra = [];
+  for (let i = 0; i < 40; i++) {
+    extra.push({ id: 'gen' + i, name: 'R' + i, area: 'living_room',
+      poly: [[0.01, 0.01], [0.02, 0.01], [0.02, 0.02], [0.01, 0.02]] });
+  }
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) =>
+    s.id !== 'f1' ? s : { ...s, rooms: [...s.rooms, ...extra] }) };
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  out.roomCount = c._spaceModel('f1').rooms.length;
+  out.scansSameWith44Rooms = scans === fewRooms;
+  out.scansPerUpdate = scans;
+
+  // при этом новое состояние датчика обязано быть видно, а не взято из кэша
+  out.tempBefore = c._climate().get('living_room')?.temp;
+  const h = fresh();
+  h.states = { ...h.states, 'sensor.living_temp': { ...h.states['sensor.living_temp'], state: '33.3' } };
+  c.hass = h; await c.updateComplete;
+  out.tempAfter = c._climate().get('living_room')?.temp;
+  out.climateIsMap = c._climate() instanceof Map;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом.
+// scansPerUpdate = 2: один обход у areaClimateMap, один у buildDevices. Важно
+// не само число, а что оно не растёт вместе с числом комнат.
+checkAll(res, {
+  scansOnRerender: 0,
+  roomCount: 44,
+  scansSameWith44Rooms: true,
+  scansPerUpdate: 2,
+  tempBefore: 22.4,
+  tempAfter: 33.3,
+  climateIsMap: true,
+});
+await finish(browser);

demo/smoke_config_writer.mjs

@@ -0,0 +1,67 @@
+// HP-1454-03: две локальные правки уходили с одной ревизией, вторая терялась.
+// Debounce разносил только СТАРТЫ. Если первый config/set отвечал дольше 500 мс,
+// вторая правка уходила с тем же expected_rev, сервер принимал первую и
+// отклонял вторую как conflict — а обработчик конфликта перечитывал серверную
+// копию поверх локальной. Правка исчезала, и тост винил «другое окно».
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const writes = [];
+  let rev = 10;
+  let releaseFirst;
+  const firstGate = new Promise((r) => { releaseFirst = r; });
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/set') {
+      const n = writes.length + 1;
+      writes.push({ expected: m.expected_rev, titles: m.config.spaces.map((s) => s.title) });
+      if (n === 1) await firstGate;                  // первый ответ задержан
+      if (m.expected_rev !== rev) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      rev += 1;
+      return { ok: true, rev };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { config: JSON.parse(JSON.stringify(r.config)), rev };
+    }
+    return base(m);
+  } };
+  c._cfgRev = rev;
+
+  // правка №1 и, пока первая запись висит, правка №2
+  c._serverCfg.spaces[0].title = 'FIRST';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.oneInFlight = writes.length === 1;
+
+  c._serverCfg.spaces[0].title = 'SECOND';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.stillOneInFlight = writes.length === 1;   // вторая ждёт очереди, не летит параллельно
+
+  releaseFirst();
+  await new Promise((r) => setTimeout(r, 120));
+
+  out.writes = writes.length;
+  out.revisions = writes.map((w) => w.expected);          // вторая обязана взять новую ревизию
+  out.secondCarriedTheEdit = writes[1]?.titles[0] === 'SECOND';
+  out.editSurvived = c._serverCfg.spaces[0].title === 'SECOND';
+  out.noConflictToast = !(c._toast || '').length;
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  oneInFlight: true,
+  stillOneInFlight: true,
+  writes: 2,
+  revisions: [10, 11],
+  secondCarriedTheEdit: true,
+  editSurvived: true,
+  noConflictToast: true,
+});
+await finish(browser);

demo/smoke_controls.mjs

@@ -0,0 +1,61 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  // два подопытных light-entity
+  const lights = Object.keys(c.hass.states).filter((e) => e.startsWith('light.')).slice(0, 2);
+  out.twoLights = lights.length === 2;
+  const setSt = async (m) => {
+    const st = { ...c.hass.states };
+    for (const [e, v] of Object.entries(m)) st[e] = { ...st[e], state: v };
+    c.hass = { ...c.hass, states: st }; await c.updateComplete;
+  };
+  // виртуальный маркер-выключатель с controls и tap_action=toggle
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog();
+  const room = c._spaceModel().rooms.find((r) => r.id && r.area);
+  c._markerDialog = { ...c._markerDialog, name: 'Выключатель', binding: 'virtual',
+    room: c._space + '#' + room.area, tapAction: 'toggle', controls: lights, icon: 'mdi:light-switch' };
+  await c._saveMarker(); await c.updateComplete;
+  const dev = c._devices.find((d) => d.name === 'Выключатель');
+  out.markerSaved = !!dev && JSON.stringify(dev.marker.controls) === JSON.stringify(lights);
+  c._setMode('view'); await c.updateComplete;
+  // 1) все выключены → клик включает все
+  await setSt({ [lights[0]]: 'off', [lights[1]]: 'off' });
+  const dev2 = () => c._devices.find((d) => d.name === 'Выключатель');
+  c._clickDevice(new MouseEvent('click'), dev2());
+  out.turnOnAll = JSON.stringify(calls.at(-1)) === JSON.stringify(['homeassistant', 'turn_on', lights]);
+  // 2) частично включено → клик выключает все
+  await setSt({ [lights[0]]: 'on', [lights[1]]: 'off' });
+  c._clickDevice(new MouseEvent('click'), dev2());
+  out.partialTurnsOff = JSON.stringify(calls.at(-1)) === JSON.stringify(['homeassistant', 'turn_off', lights]);
+  // 3) значок отражает цели: горит одна → класс on
+  const el = [...sr().querySelectorAll('.dev')].find((e) => e.title === 'Выключатель' || e.textContent.includes(''));
+  out.stateOn = !!c._stateClass(dev2()).includes('on');
+  await setSt({ [lights[0]]: 'off' });
+  out.stateOff = c._stateClass(dev2()) === '';
+  // 4) без tap_action=toggle клик НЕ переключает (инфо)
+  const cfg = c._serverCfg.markers.find((m) => m.name === 'Выключатель');
+  cfg.tap_action = 'info'; c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  const n = calls.length;
+  c._clickDevice(new MouseEvent('click'), dev2());
+  out.infoNoToggle = calls.length === n && !!c._infoCard;
+  // 5) инфо-карточка показывает цели
+  await c.updateComplete;
+  out.infoListsTargets = sr().querySelectorAll('.ctrlstate').length === 2;
+  c._infoCard = null; await c.updateComplete;
+  // 6) замок в controls отфильтрован при клике (защита)
+  cfg.tap_action = 'toggle'; cfg.controls = ['lock.front_door', lights[0]];
+  c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  await setSt({ [lights[0]]: 'off' });
+  c._clickDevice(new MouseEvent('click'), dev2());
+  const last = calls.at(-1);
+  out.lockFiltered = JSON.stringify(last) === JSON.stringify(['homeassistant', 'turn_on', [lights[0]]]);
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_decor.mjs

@@ -0,0 +1,74 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const esc = async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' })); await c.updateComplete; };
+  // 1) третья вкладка есть
+  const tabs = [...sr().querySelectorAll('.modetab')];
+  out.threeTabs = tabs.length === 3;
+  tabs[2].click(); await c.updateComplete;
+  out.decorMode = c._mode === 'decor';
+  out.decorBar = !!sr().querySelector('.editbar.decorbar');
+  out.toolBtns = sr().querySelectorAll('.decorbar .btn:not(.barclose)').length === 6;
+  // 2) нарисовать прямоугольник drag-ом (через прямые вызовы)
+  c._decorTool = 'rect'; c._decorStyle = { color: '#ff0000', width: 3, fill: true }; await c.updateComplete;
+  const g = c._gridPitch;
+  c._decorDraft = { kind: 'rect', a: [g * 10, g * 10], b: [g * 10, g * 10], pid: 1 };
+  c._decorDraft = { ...c._decorDraft, b: [g * 20, g * 16] };
+  await c.updateComplete;
+  out.draftPreview = !!sr().querySelector('.ddraft');
+  c._decorCommitDraft(); await c.updateComplete;
+  out.rectSaved = c._curSpaceCfg.decor?.length === 1 && c._curSpaceCfg.decor[0].kind === 'rect';
+  out.rectFill = c._curSpaceCfg.decor[0].fill === true && c._curSpaceCfg.decor[0].color === '#ff0000';
+  out.rectRendered = !!sr().querySelector('.decorlayer rect.dshape');
+  // 3) линия и овал
+  c._decorDraft = { kind: 'line', a: [g * 2, g * 2], b: [g * 8, g * 2], pid: 1 };
+  c._decorCommitDraft();
+  c._decorDraft = { kind: 'ellipse', a: [g * 30, g * 30], b: [g * 40, g * 36], pid: 1 };
+  c._decorCommitDraft(); await c.updateComplete;
+  out.threeShapes = c._decorList.length === 3;
+  // вырожденная фигура не сохраняется
+  c._decorDraft = { kind: 'line', a: [g, g], b: [g, g], pid: 1 };
+  c._decorCommitDraft();
+  out.degenerateSkipped = c._decorList.length === 3;
+  // 4) надпись через диалог
+  c._decorTextDialog = { x: 0.5, y: 0.5, text: 'Сауна', size: 'l', color: '#0000ff' };
+  c._decorSaveText(); await c.updateComplete;
+  out.textSaved = c._decorList.some((x) => x.kind === 'text' && x.text === 'Сауна');
+  out.textRendered = [...sr().querySelectorAll('.decorlayer text')].some((t) => t.textContent.includes('Сауна'));
+  // 5) select: перемещение сохраняет форму, drag двигает
+  const rect = c._decorList.find((x) => x.kind === 'rect');
+  c._decorTool = 'select';
+  c._decorMove = { id: rect.id, start: [0, 0], orig: JSON.parse(JSON.stringify(rect)), pid: 7, moved: false };
+  c._decorMoveUpdate({ clientX: 0, clientY: 0, }); // без смещения
+  const before = { ...c._decorList.find((x) => x.id === rect.id) };
+  c._decorMove.start = [0, 0];
+  // сдвиг на 5 клеток по x: подделаем _svgPoint? проще напрямую:
+  const m = c._decorMove; const dx5 = (g * 5) / 1000;
+  c._curSpaceCfg.decor = c._decorList.map((x) => x.id === m.id ? { ...x, x: m.orig.x + dx5 } : x);
+  out.moveKeepsSize = Math.abs(c._decorList.find((x) => x.id === rect.id).w - before.w) < 1e-9;
+  c._decorMove = null;
+  // 6) erase удаляет
+  const n0 = c._decorList.length;
+  c._decorTool = 'erase';
+  c._decorShapeDown({ stopPropagation() {}, preventDefault() {}, target: null, pointerId: 1 }, c._decorList[0]);
+  out.eraseWorks = c._decorList.length === n0 - 1;
+  // 7) Esc-лестница: инструмент → select → выход
+  c._decorTool = 'line'; c._decorSel = null; await c.updateComplete;
+  await esc(); out.escTool = c._decorTool === 'select' && c._mode === 'decor';
+  await esc(); out.escExit = c._mode === 'view';
+  // 8) в Просмотре фигуры видны, но inert
+  const shp = sr().querySelector('.decorlayer .dshape');
+  out.visibleInView = !!shp;
+  out.inertInView = shp ? getComputedStyle(shp).pointerEvents === 'none' : null;
+  // 9) Delete удаляет выбранное
+  sr().querySelectorAll('.modetab')[2].click(); await c.updateComplete;
+  c._decorTool = 'select'; c._decorSel = c._decorList[0].id; const n1 = c._decorList.length; await c.updateComplete;
+  window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Delete' })); await c.updateComplete;
+  out.deleteKey = c._decorList.length === n1 - 1;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_deeplink.mjs

@@ -0,0 +1,26 @@
+// Smoke: the full houseplan-card honours the #space=<id> deep-link (hashchange).
+import { launch } from './serve.mjs';
+const { page, browser } = await launch({ width: 820, height: 760 }, 1);
+const res = await page.evaluate(async () => {
+  const card = window.__card;
+  const ids = card._model.map((s) => s.id);
+  const target = ids[1] || ids[0];
+  const before = card._space;
+  // simulate a deep-link arriving on the already-open dashboard
+  window.location.hash = '#space=' + target;
+  window.dispatchEvent(new HashChangeEvent('hashchange'));
+  await card.updateComplete;
+  const after = card._space;
+  // invalid hash must be ignored
+  window.location.hash = '#space=__nope__';
+  window.dispatchEvent(new HashChangeEvent('hashchange'));
+  await card.updateComplete;
+  const afterBad = card._space;
+  window.location.hash = '';
+  return { ids, before, target, after, afterBad };
+});
+await browser.close();
+const ok = res.after === res.target && res.afterBad === res.target;
+console.log(JSON.stringify(res));
+if (!ok) { console.error('FAIL deeplink smoke'); process.exit(1); }
+console.log('OK deep-link: full card switches to #space=<id>, ignores invalid ids');

demo/smoke_dialog_zombie.mjs

@@ -0,0 +1,55 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  let pageError = null;
+  window.addEventListener('error', (e) => { pageError = String(e.message); });
+  // сохранение падает, а диалог закрыт до ответа — карточка не должна умереть
+  c.hass = { ...c.hass, callWS: async (msg) => {
+    if (String(msg.type).endsWith('/set')) { await new Promise((r) => setTimeout(r, 60)); throw new Error('boom'); }
+    return { config: c._serverCfg, rev: c._cfgRev };
+  } };
+  await c.updateComplete;
+  // 1) диалог общих настроек
+  c._openSettingsDialog(); await c.updateComplete;
+  const p = c._saveSettingsDialog();
+  c._settingsDialog = null; // Esc во время сохранения
+  await c.updateComplete;
+  await p.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.settingsStaysClosed = c._settingsDialog === null;
+  out.cardAliveAfterSettings = !!sr().querySelector('.stage');
+  // 2) диалог правил
+  c._openRulesDialog(); await c.updateComplete;
+  const p2 = c._saveRules();
+  c._rulesDialog = null; await c.updateComplete;
+  await p2.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.rulesStaysClosed = c._rulesDialog === null;
+  out.cardAliveAfterRules = !!sr().querySelector('.stage');
+  // 3) диалог устройства
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog(c._devices[0]); await c.updateComplete;
+  const p3 = c._saveMarker();
+  c._markerDialog = null; await c.updateComplete;
+  await p3.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.markerStaysClosed = c._markerDialog === null;
+  out.cardAliveAfterMarker = !!sr().querySelector('.stage');
+  out.noPageError = pageError === null;
+  // 4) при ОТКРЫТОМ диалоге ошибка снимает busy (поведение сохранено)
+  c._openSettingsDialog(); await c.updateComplete;
+  const p4 = c._saveSettingsDialog();
+  await p4.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  out.busyClearedWhenOpen = c._settingsDialog !== null && c._settingsDialog.busy === false;
+  c._settingsDialog = null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_edge_cases.mjs

@@ -0,0 +1,87 @@
+import { launch, check, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const mk = () => document.createElement('houseplan-card');
+  const sr = (c) => c.shadowRoot || c.renderRoot;
+
+  // 1) пустая инсталляция: ноль устройств/зон, конфиг с пространством без комнат
+  const c1 = mk();
+  c1.setConfig({ type: 'custom:houseplan-card' });
+  document.body.appendChild(c1);
+  c1.hass = { language:'en', locale:{language:'en'}, devices:{}, entities:{}, areas:{}, states:{},
+    callWS: async (m) => m.type==='houseplan/config/get'
+      ? { config:{ spaces:[{ id:'s1', title:'Empty', plan_url:null, aspect:1.4, view_box:[0,0,1,1], rooms:[], segments:[] }], markers:[], settings:{} }, rev:1 }
+      : { layout:{} },
+    connection:{ subscribeEvents: async()=>()=>{} } };
+  await new Promise(r=>setTimeout(r,150));
+  c1.hass = { ...c1.hass };
+  await c1.updateComplete; await new Promise(r=>setTimeout(r,50)); await c1.updateComplete;
+  out.emptyDevices = c1._devices.length;
+  out.emptyRenders = !!sr(c1).querySelector('.stage');
+  out.emptyCount = sr(c1).querySelector('.count')?.textContent.trim();
+  c1.remove();
+
+  // 2) XSS в именах комнат и устройств
+  const c2 = mk();
+  c2.setConfig({ type: 'custom:houseplan-card' });
+  document.body.appendChild(c2);
+  const evil = '<img src=x onerror=window.__pwned=1><b>bold</b>';
+  c2.hass = { language:'en', locale:{language:'en'},
+    devices:{ d1:{ id:'d1', name: evil, model:'M<script>1</script>', area_id:'a1', identifiers:[['x','1']] } },
+    entities:{}, areas:{ a1:{ area_id:'a1', name:'A1' } }, states:{},
+    callWS: async (m) => m.type==='houseplan/config/get'
+      ? { config:{ spaces:[{ id:'s1', title:'S', plan_url:null, aspect:1, view_box:[0,0,1,1],
+          rooms:[{ id:'r1', name: evil, area:'a1', poly:[[0.1,0.1],[0.9,0.1],[0.9,0.9],[0.1,0.9]] }], segments:[] }], markers:[], settings:{} }, rev:1 }
+      : { layout:{} },
+    connection:{ subscribeEvents: async()=>()=>{} } };
+  await new Promise(r=>setTimeout(r,150));
+  c2.hass = { ...c2.hass };
+  await c2.updateComplete; await new Promise(r=>setTimeout(r,50)); await c2.updateComplete;
+  out.xssPwned = !!window.__pwned;
+  const lbl = sr(c2).querySelector('.roomlabel');
+  out.xssLabelIsText = lbl ? lbl.innerHTML.includes('&lt;img') || lbl.textContent.includes('<img') : 'no label';
+  out.xssDeviceRendered = sr(c2).querySelectorAll('.dev').length;
+  c2.remove();
+
+  // 3) легаси-записи layout v1 {x,y} без ключа s — игнорируются в norm-режиме
+  const c = window.__card;
+  c._layout = { ...c._layout, d_light1_legacy_test: { x: 500, y: 300 } };
+  const fake = { id: 'd_light1_legacy_test', space: 'f1' };
+  const p = c._pos(fake);
+  out.legacyIgnored = p.y !== 300; // centre y=400 if ignored; raw 300 would mean it leaked through
+  delete c._layout.d_light1_legacy_test;
+
+  // 4) перф: 150 устройств
+  const t0 = performance.now();
+  const devices = {}; const entities = {}; const states = {};
+  for (let i = 0; i < 150; i++) {
+    devices['p'+i] = { id:'p'+i, name:'Plug '+i, model:'Smart Plug', area_id:'living_room', identifiers:[['demo','p'+i]] };
+    entities['switch.p'+i] = { entity_id:'switch.p'+i, device_id:'p'+i, platform:'demo' };
+    states['switch.p'+i] = { state: i%2?'on':'off', attributes:{ linkquality: 50+i } };
+  }
+  const bigHass = { ...window.__mkHass(), devices:{...window.__mkHass().devices, ...devices},
+    entities:{...window.__mkHass().entities, ...entities}, states:{...window.__mkHass().states, ...states} };
+  c.hass = bigHass; c._regSignature=''; c._maybeRebuildDevices();
+  out.bigBuildMs = Math.round(performance.now() - t0);
+  out.bigCount = c._devices.length;
+  await c.updateComplete;
+  const t1 = performance.now(); c.requestUpdate(); await c.updateComplete;
+  out.bigRenderMs = Math.round(performance.now() - t1);
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+// сборка 100+ устройств должна укладываться в бюджет (docs/TESTING.md)
+// timings are asserted as budgets, not frozen values (CI machines vary)
+check("bigBuildMs under 200ms", res.bigBuildMs < 200);
+check("bigRenderMs under 100ms", res.bigRenderMs < 100);
+delete res.bigBuildMs;
+delete res.bigRenderMs;
+checkAll(res, {
+  "emptyDevices": 0,
+  "emptyCount": "0 dev.",
+  "xssPwned": false,
+  "xssDeviceRendered": 1,
+  "bigCount": 162,
+});
+await finish(browser, res);

demo/smoke_editor_tabs.mjs

@@ -0,0 +1,42 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const tabs = () => [...sr().querySelectorAll('.modetab')];
+  // 1) две вкладки, Просмотра нет, крестиков в неактивных нет
+  out.twoTabs = tabs().length === 3; // третья — Редактор подложки (v1.33.0)
+  out.labels = tabs().map((t) => t.textContent.trim());
+  out.noCrossIdle = sr().querySelectorAll('.modetab .closex').length === 0;
+  out.startView = c._mode === 'view';
+  // 2) клик по «Редактор плана» → активна, панель с крестиком
+  tabs()[0].click(); await c.updateComplete;
+  out.planActive = c._mode === 'plan' && tabs()[0].classList.contains('active');
+  out.planBar = !!sr().querySelector('.editbar');
+  out.planBarClose = !!sr().querySelector('.editbar .barclose');
+  out.tabCross = !!tabs()[0].querySelector('.closex');
+  // 3) повторный клик по активной вкладке — ничего
+  tabs()[0].click(); await c.updateComplete;
+  out.reclickNoop = c._mode === 'plan';
+  // 4) прямое переключение План → Устройства
+  tabs()[1].click(); await c.updateComplete;
+  out.directSwitch = c._mode === 'devices';
+  out.devBar = !!sr().querySelector('.editbar.devbar');
+  out.devBarBtns = sr().querySelectorAll('.editbar.devbar .btn:not(.barclose)').length === 3; // add/show-all/rules (v1.33.2: Reset removed)
+  // 5) инструменты устройств из шапки исчезли (в .bar их больше нет)
+  out.headerCleanInDev = !sr().querySelector('.bar > .btn[title*="' + (c._t('title.add_device')) + '"]');
+  // 6) крестик на панели → Просмотр
+  sr().querySelector('.editbar .barclose').click(); await c.updateComplete;
+  out.barCloseWorks = c._mode === 'view' && !sr().querySelector('.editbar');
+  // 7) крестик в самой вкладке → Просмотр (и не переключает режим)
+  tabs()[1].click(); await c.updateComplete;
+  tabs()[1].querySelector('.closex').click(); await c.updateComplete;
+  out.tabCrossWorks = c._mode === 'view';
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "labels": ["Plan editor", "Device editor", "Background editor"],
+});
+await finish(browser, res);

demo/smoke_esc_dialogs.mjs

@@ -0,0 +1,35 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const esc = async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' })); await c.updateComplete; };
+  // общие настройки
+  c._openSettingsDialog(); await c.updateComplete;
+  await esc(); out.settings = !c._settingsDialog;
+  // правила иконок
+  c._openRulesDialog(); await c.updateComplete;
+  await esc(); out.rules = !c._rulesDialog;
+  // диалог устройства
+  c._setMode('devices'); c._openMarkerDialog(); await c.updateComplete;
+  await esc(); out.marker = !c._markerDialog;
+  // диалог пространства (+ очистка очереди импорта)
+  c._openSpaceDialog('edit', c._space); c._importQueue = ['x']; c._importTotal = 1; await c.updateComplete;
+  await esc(); out.space = !c._spaceDialog && c._importQueue.length === 0;
+  // инфо-карточка устройства
+  c._setMode('view'); c._infoCard = c._devices[0]; await c.updateComplete;
+  await esc(); out.info = !c._infoCard;
+  // инфо двери/замка
+  c._openingInfo = { id: 'op1', type: 'door', rx: 550, ry: 200, len_cm: 90, lock: 'lock.front_door' }; await c.updateComplete;
+  await esc(); out.openingInfo = !c._openingInfo;
+  // приоритет: инфо поверх настроек — Esc закрывает только инфо
+  c._openSettingsDialog(); c._infoCard = c._devices[0]; await c.updateComplete;
+  await esc(); out.stacked = !c._infoCard && !!c._settingsDialog;
+  await esc(); out.stacked2 = !c._settingsDialog;
+  // Esc в разметке по-прежнему откатывает точку, а не только диалоги
+  c._setMode('plan'); c._tool = 'draw'; c._path = [[1, 2], [3, 4]]; await c.updateComplete;
+  await esc(); out.undoPointStillWorks = c._path.length === 1;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_feedback_v2.mjs

@@ -0,0 +1,49 @@
+import { launch, check, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) кнопка настроек комнаты в редакторе плана: заметная, фиксированного размера
+  c._setMode('plan'); await c.updateComplete;
+  const btn = sr().querySelector('.rlgearbtn');
+  out.gearButtonShown = !!btn;
+  const cs = btn ? getComputedStyle(btn) : null;
+  out.gearReadable = cs ? parseFloat(cs.fontSize) >= 10 && cs.pointerEvents === 'auto' : null;
+  out.gearHasLabel = btn ? btn.textContent.trim().length > 0 : null;
+  const box = btn?.getBoundingClientRect();
+  out.gearTapTarget = box ? box.height >= 18 && box.width >= 40 : null;
+  btn.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true }));
+  await c.updateComplete;
+  out.gearOpensDialog = c._roomDialog === true && !!c._roomEditId;
+  c._roomDialogCancel(); await c.updateComplete;
+  // 2) комната без имени тоже получает кнопку (её там и называют)
+  const room = c._curSpaceCfg.rooms[0];
+  const savedName = room.name;
+  room.name = '';
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  out.unnamedStillHasGear = sr().querySelectorAll('.rlgearbtn').length >= 1;
+  room.name = savedName; c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  // 3) метрики стали крупнее: 0.75em вместо 0.62em
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true, label_temp: true } })) };
+  c._setMode('view'); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+  const lbl = [...sr().querySelectorAll('.roomlabel')].find((l) => l.querySelector('.rlmetrics'));
+  if (lbl) {
+    const nameSz = parseFloat(getComputedStyle(lbl.querySelector('.rlname')).fontSize);
+    const metaSz = parseFloat(getComputedStyle(lbl.querySelector('.rlmetrics')).fontSize);
+    out.metricsRatio = Math.round((metaSz / nameSz) * 100) / 100;
+  } else out.metricsRatio = 'no-metrics';
+  // 4) касание помечает сессию как тач и гасит тултип
+  c._tip = { x: 1, y: 1, title: 't', meta: 'm' };
+  c._notePointer(new PointerEvent('pointerdown', { pointerType: 'touch' }));
+  out.touchClearsTip = c._tip === null;
+  c._showTip(new MouseEvent('mousemove', { clientX: 5, clientY: 5 }), 'x', 'y');
+  out.noTipAfterTouch = !c._tip;
+  return out;
+});
+check('metricsRatio 0.75', res.metricsRatio, 0.75);
+delete res.metricsRatio;
+checkAll(res);
+await finish(browser, res);

demo/smoke_font_scales.mjs

@@ -0,0 +1,58 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const spId = c._space;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true, label_temp: true } })) };
+  c._setMode('view'); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 100));
+  const lbl = () => sr().querySelector('.roomlabel');
+  const nameSize = () => parseFloat(getComputedStyle(lbl().querySelector('.rlname')).fontSize);
+  const metaEl = () => lbl().querySelector('.rlmetrics');
+  const n0 = nameSize();
+  const m0 = metaEl() ? parseFloat(getComputedStyle(metaEl()).fontSize) : null;
+  out.baseline = n0 > 0;
+  // 1) пер-комнатный name_scale ×2 — имя удвоилось, подписи нет
+  const room = c._curSpaceCfg.rooms.find((r) => r.name && r.area);
+  room.settings = { ...(room.settings || {}), name_scale: 2 };
+  c.requestUpdate(); await c.updateComplete;
+  const lblR = [...sr().querySelectorAll('.roomlabel')].find((l) => l.textContent.includes(room.name));
+  const n1 = parseFloat(getComputedStyle(lblR.querySelector('.rlname')).fontSize);
+  out.nameDoubled = Math.abs(n1 / n0 - 2) < 0.05;
+  const meta1 = lblR.querySelector('.rlmetrics');
+  out.metaUntouched = meta1 ? Math.abs(parseFloat(getComputedStyle(meta1).fontSize) - m0) < 0.5 : 'no-meta';
+  // 2) label_scale ×2 — подписи удвоились
+  room.settings.label_scale = 2;
+  c.requestUpdate(); await c.updateComplete;
+  const meta2 = lblR.querySelector('.rlmetrics');
+  out.metaDoubled = meta2 && m0 ? Math.abs(parseFloat(getComputedStyle(meta2).fontSize) / m0 - 2) < 0.05 : 'no-meta';
+  // 3) базовый множитель пространства ×1.5 — умножает всё
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), card_font_scale: 1.5 } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const lblR2 = [...sr().querySelectorAll('.roomlabel')].find((l) => l.textContent.includes(room.name));
+  const n2 = parseFloat(getComputedStyle(lblR2.querySelector('.rlname')).fontSize);
+  out.spaceMultiplies = Math.abs(n2 / n0 - 3) < 0.1; // 2 × 1.5
+  // 4) диалог комнаты: слайдеры + живой пример реагирует
+  c._setMode('plan'); await c.updateComplete;
+  const model = c._spaceModel().rooms.find((r) => r.id === room.id);
+  c._openRoomEdit(model); await c.updateComplete;
+  out.slidersPrefilled = c._roomNameScale === 2 && c._roomLabelScale === 2;
+  const pv = () => sr().querySelector('.cardpreview .cpname');
+  const p0 = parseFloat(pv().style.fontSize);
+  c._roomNameScale = 1; c.requestUpdate(); await c.updateComplete;
+  const p1 = parseFloat(pv().style.fontSize);
+  out.previewLive = Math.abs(p0 / p1 - 2) < 0.05;
+  c._roomDialogCancel(); await c.updateComplete;
+  // 5) превью есть и в диалоге пространства
+  c._openSpaceDialog('edit', spId); await c.updateComplete;
+  out.spacePreview = !!sr().querySelector('.cardpreview');
+  out.spaceSlider = [...sr().querySelectorAll('.dialog label')].some((l) => l.textContent === c._t('space.card_font'));
+  c._spaceDialog = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_gear_tabs.mjs

@@ -0,0 +1,38 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const gears = () => sr().querySelectorAll('.tab .tabedit').length;
+  // шестерёнки видны во всех трёх режимах
+  out.viewGears = gears() > 0;
+  c._setMode('plan'); await c.updateComplete;
+  out.planGears = gears() > 0;
+  c._setMode('devices'); await c.updateComplete;
+  out.devGears = gears() > 0;
+  c._setMode('view'); await c.updateComplete;
+  // выравнивание: центр иконки ~ центру текста таба
+  const tab = sr().querySelector('.tab');
+  const icon = tab.querySelector('.tabedit');
+  const tb = tab.getBoundingClientRect(), ib = icon.getBoundingClientRect();
+  const tabMid = tb.top + tb.height / 2, iconMid = ib.top + ib.height / 2;
+  out.alignDelta = Math.abs(tabMid - iconMid);
+  out.aligned = out.alignDelta <= 1.5;
+  // клик по шестерёнке в Просмотре открывает диалог пространства и не переключает таб
+  const cur = c._space;
+  icon.click(); await c.updateComplete;
+  out.dialogOpens = !!c._spaceDialog;
+  out.tabNotSwitched = c._space === cur;
+  c._spaceDialog = null; await c.updateComplete;
+  // кнопка "+" по-прежнему только в Плане
+  out.noAddInView = !sr().querySelector('.tab.tabadd');
+  c._setMode('plan'); await c.updateComplete;
+  out.addInPlan = !!sr().querySelector('.tab.tabadd');
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "alignDelta": 0,
+});
+await finish(browser, res);

demo/smoke_general_settings.mjs

@@ -0,0 +1,37 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) диалог общих настроек: 7 цветовых строк, 3 группы
+  c._openSettingsDialog(); await c.updateComplete;
+  out.rows = sr().querySelectorAll('.gsrow').length;
+  out.groups = [...sr().querySelectorAll('.dialog .dispsection')].map((l) => l.textContent.trim());
+  // 2) сменить цвет light_on и сохранить
+  c._setFillColor('light_on', { c: '#ff00ff', a: 0.5 });
+  await c._saveSettingsDialog(); await c.updateComplete;
+  out.saved = c._serverCfg.settings.fill_colors?.light_on;
+  // 3) заливка light использует кастомный цвет
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({ ...s,
+    settings: { ...(s.settings||{}), show_borders: true, fill_mode: 'light' } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const styles = [...sr().querySelectorAll('.room.styled')].map((r) => r.getAttribute('style') || '');
+  out.customFillUsed = styles.some((st) => st.includes('#ff00ff') && st.includes('0.500'));
+  // 4) show_lqi=false у пространства скрывает LQI-бейджи
+  out.lqiBefore = sr().querySelectorAll('.dev .lqi').length;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({ ...s,
+    settings: { ...(s.settings||{}), show_lqi: false } })) };
+  c.requestUpdate(); await c.updateComplete;
+  out.lqiAfter = sr().querySelectorAll('.dev .lqi').length;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "rows": 11,
+  "groups": ["Fill: lights", "Fill: temperature", "Fill: zigbee signal", "Light-sources fill"],
+  "saved": {"c": "#ff00ff", "a": 0.5},
+  "lqiBefore": 7,
+  "lqiAfter": 0,
+});
+await finish(browser, res);

demo/smoke_glow.mjs

@@ -0,0 +1,124 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const spId = c._space;
+  // включить glow-режим
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
+  c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  // 1) все комнаты залиты темнотой одинаково (независимо от ламп)
+  const rooms = [...sr().querySelectorAll('.room.styled')];
+  out.roomsDark = rooms.length > 0 && rooms.every((el) => {
+    const st = el.getAttribute('style') || '';
+    return st.includes('--room-fill:#0d1b2a');
+  });
+  // 2) пятна от включённых ламп
+  const litLight = c._devices.find((d) => d.space === spId && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on'));
+  out.hasLitLight = !!litLight;
+  out.spots = sr().querySelectorAll('.glowlayer circle').length;
+  out.spotsMatchLights = out.spots === c._devices.filter((d) => d.space === spId && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on')).length;
+  // 3) выключение лампы убирает её пятно
+  const eid = litLight.entities.find((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on');
+  const st0 = c.hass.states[eid];
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: { ...st0, state: 'off' } } };
+  await c.updateComplete;
+  out.spotGone = sr().querySelectorAll('.glowlayer circle').length === out.spots - 1;
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: st0 } }; await c.updateComplete;
+  // 4) rgb-лампа красит градиент своим цветом (форсируем rgb у лампы)
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: { ...st0, state: 'on', attributes: { ...st0.attributes, rgb_color: [255, 0, 0] } } } };
+  await c.updateComplete;
+  out.gradientColored = [...sr().querySelectorAll('defs radialGradient stop')].some((s2) => s2.getAttribute('stop-color') === 'rgb(255, 0, 0)');
+  c.hass = { ...c.hass, states: { ...c.hass.states, [eid]: st0 } }; await c.updateComplete;
+  // 5) пятно обрезано комнатой (есть clipPath)
+  out.clipped = sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]').length > 0;
+  // 6) дверь в соседнюю комнату → в clip добавлен сектор (2 сабпути M)
+  // добавим дверь между r1 и r2 на общей стене x=0.55… найдём общую стену программно:
+  const spm = c._spaceModel();
+  const r1 = spm.rooms.find((r) => r.id === 'r1');
+  const r2 = spm.rooms.find((r) => r.id === 'r2');
+  // возьмём точку на границе r1, ближайшую к центру r2
+  const c2 = c._roomCenter(r2);
+  const poly1 = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
+  // общая стена вертикальная — дверь ставим на неё
+  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  const doorPt = (() => {
+    let best = null, bd = 1e9;
+    for (const [x, y] of [[550, 150], [550, 200], [550, 250]]) {
+      const d2 = Math.hypot(x - c2[0], y - c2[1]);
+      if (d2 < bd) { bd = d2; best = [x, y]; }
+    }
+    return best;
+  })();
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, openings: [{ id: 'gd', type: 'door', x: doorPt[0] / 1000, y: doorPt[1] / H, angle: 90, length: 0.09 }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  // источник детерминированно ставим в центр r1 (двигаем реальную включённую лампу)
+  const aspect = c._curSpaceCfg.aspect || 1;
+  const c1 = c._roomCenter(r1);
+  c._layout = { ...c._layout, [litLight.id]: { s: spId, x: c1[0] / 1000, y: c1[1] / (1000 / aspect) } };
+  // радиус 6 м, чтобы дверь заведомо была в зоне досягаемости
+  c._serverCfg = { ...c._serverCfg, settings: { ...(c._serverCfg.settings || {}), glow_radius_cm: 600 } };
+  c.requestUpdate(); await c.updateComplete;
+  // теперь каждый под-контур — отдельный path внутри clipPath
+  const clipEls = [...sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]')];
+  out.sectorAdded = clipEls.some((cp) => cp.querySelectorAll('path').length >= 2);
+  // и сектор в том же направлении обхода не выедает комнату: каждый path — один контур
+  out.singleSubpathPerPath = clipEls.every((cp) => [...cp.querySelectorAll('path')]
+    .every((p) => ((p.getAttribute('d') || '').match(/M /g) || []).length === 1));
+  // у входной двери (наружу) сектора нет: дверь на внешней стене r1 (x=min)
+  const minX = Math.min(...poly1.map((p) => p[0]));
+  const yMid = (Math.min(...poly1.map((p) => p[1])) + Math.max(...poly1.map((p) => p[1]))) / 2;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, openings: [{ id: 'gd2', type: 'door', x: minX / 1000, y: yMid / (1000 / aspect), angle: 90, length: 0.09 }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const clipEls2 = [...sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]')];
+  out.entranceNoSector = clipEls2.every((cp) => cp.querySelectorAll('path').length === 1);
+  // 6б) профиль градиента: плато до 80%, спад на внешних 20%
+  const stops = [...sr().querySelectorAll('defs radialGradient')][0];
+  const offs = stops ? [...stops.querySelectorAll('stop')].map((st2) => [st2.getAttribute('offset'), st2.getAttribute('stop-opacity')]) : [];
+  out.plateau80 = offs.length === 3 && offs[0][0] === '0%' && offs[1][0] === '70%'
+    && offs[0][1] === offs[1][1] && offs[2][1] === '0';
+  // 7а) персональный радиус источника перекрывает глобальный
+  const litMarkerId = litLight.id;
+  c._serverCfg = { ...c._serverCfg, markers: [
+    ...(c._serverCfg.markers || []).filter((m) => m.id !== litMarkerId),
+    { id: litMarkerId, binding: litLight.bindingKind === 'virtual' ? 'virtual' : litLight.bindingKind + ':' + litLight.bindingRef, glow_radius_cm: 150 },
+  ] };
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  const rOwn = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
+  out.perSourceRadius = Math.abs(rOwn - c._cmToUnits(150)) < 0.5;
+  c._serverCfg = { ...c._serverCfg, markers: (c._serverCfg.markers || []).filter((m) => m.id !== litMarkerId) };
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  // 6в) флаг «источник света»: умный выключатель с обычными светильниками
+  const swDev = c._devices.find((d) => d.space === spId && d.entities.some((e) => e.startsWith('switch.')));
+  if (swDev) {
+    const swEid = swDev.entities.find((e) => e.startsWith('switch.'));
+    c.hass = { ...c.hass, states: { ...c.hass.states, [swEid]: { ...c.hass.states[swEid], state: 'on' } } };
+    const spotsBefore = sr().querySelectorAll('.glowlayer circle').length;
+    c._serverCfg = { ...c._serverCfg, markers: [
+      ...(c._serverCfg.markers || []).filter((m) => m.id !== swDev.id),
+      { id: swDev.id, binding: swDev.bindingKind + ':' + swDev.bindingRef, is_light: true },
+    ] };
+    c._regSignature = ''; c._maybeRebuildDevices(); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+    out.switchGlows = sr().querySelectorAll('.glowlayer circle').length === spotsBefore + 1;
+    c._serverCfg = { ...c._serverCfg, markers: (c._serverCfg.markers || []).filter((m) => m.id !== swDev.id) };
+    c._regSignature = ''; c._maybeRebuildDevices(); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+    out.switchGlowsOffByDefault = sr().querySelectorAll('.glowlayer circle').length === spotsBefore;
+  } else { out.switchGlows = 'no-switch'; out.switchGlowsOffByDefault = 'no-switch'; }
+  // 7) радиус из настроек: 600 см против 300 см — вдвое больше
+  const r600 = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
+  c._serverCfg = { ...c._serverCfg, settings: { ...(c._serverCfg.settings || {}), glow_radius_cm: 300 } };
+  c.requestUpdate(); await c.updateComplete;
+  const r300 = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
+  out.radiusReacts = Math.abs(r600 / r300 - 2) < 0.01;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "spots": 1,
+});
+await finish(browser, res);

demo/smoke_grid_fade.mjs

@@ -0,0 +1,37 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const grid = () => !!sr().querySelector('rect[fill="url(#hp-grid)"]');
+  // Просмотр: сетки нет
+  out.noGridInView = !grid();
+  // все три редактора: сетка есть
+  c._setMode('plan'); await c.updateComplete; out.gridInPlan = grid();
+  c._setMode('devices'); await c.updateComplete; out.gridInDevices = grid();
+  c._setMode('decor'); await c.updateComplete; out.gridInDecor = grid();
+  await new Promise((r) => setTimeout(r, 250)); // transition .room 0.12s
+  // decor: комнаты и устройства полупрозрачны
+  const room = sr().querySelector('.room');
+  out.roomFaded = room ? Number(getComputedStyle(room).opacity) < 0.5 : null;
+  const dl = sr().querySelector('.devlayer');
+  out.devsFaded = dl ? Number(getComputedStyle(dl).opacity) < 0.5 : null;
+  // а декор-слой — нет
+  c._curSpaceCfg.decor = [{ id: 'd1', kind: 'line', x1: 0.1, y1: 0.1, x2: 0.3, y2: 0.1, color: '#ff0000', width: 3 }];
+  c.requestUpdate(); await c.updateComplete;
+  const shp = sr().querySelector('.decorlayer .dshape');
+  out.decorNotFaded = shp ? Number(getComputedStyle(shp).opacity) > 0.9 : null;
+  // в других редакторах прозрачности нет
+  c._setMode('devices'); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const room2 = sr().querySelector('.room');
+  out.notFadedInDevices = room2 ? Number(getComputedStyle(room2).opacity) > 0.9 : null;
+  c._setMode('view'); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const room3 = sr().querySelector('.room');
+  out.notFadedInView = room3 ? Number(getComputedStyle(room3).opacity) > 0.9 : null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_gs_always.mjs

@@ -0,0 +1,18 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const gs = () => !!sr().querySelector('.head .btn[title="' + c._t('title.general_settings') + '"]');
+  out.view = gs();
+  c._setMode('plan'); await c.updateComplete; out.plan = gs();
+  c._setMode('devices'); await c.updateComplete; out.devices = gs();
+  c._setMode('view'); await c.updateComplete;
+  sr().querySelector('.head .btn[title="' + c._t('title.general_settings') + '"]').click();
+  await c.updateComplete;
+  out.opensInView = !!c._settingsDialog;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_icon_center.mjs

@@ -0,0 +1,28 @@
+// Asserts device icon badges sit exactly on their anchor point (no content-box/border drift).
+import { launch } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 1000 }, 2);
+const bad = await page.evaluate(() => {
+  const c = window.__card;
+  c._space = 'f1'; c._resetZoom(); c.requestUpdate();
+  const layer = c.renderRoot.querySelector('.devlayer');
+  const lr = layer.getBoundingClientRect();
+  const bad = [];
+  for (const d of layer.querySelectorAll('.dev')) {
+    const ax = lr.left + (parseFloat(d.style.left) / 100) * lr.width;
+    const ay = lr.top + (parseFloat(d.style.top) / 100) * lr.height;
+    const r = d.getBoundingClientRect();
+    const cx = r.left + r.width / 2, cy = r.top + r.height / 2;
+    const offX = cx - ax, offY = cy - ay;
+    // glyph centred within the badge
+    const icon = d.querySelector('ha-icon');
+    const svg = icon?.shadowRoot?.querySelector('svg') || icon?.shadowRoot?.querySelector('ha-svg-icon')?.shadowRoot?.querySelector('svg');
+    let gX = 0, gY = 0;
+    if (svg) { const sr = svg.getBoundingClientRect(); gX = sr.left + sr.width / 2 - cx; gY = sr.top + sr.height / 2 - cy; }
+    if (Math.abs(offX) > 0.6 || Math.abs(offY) > 0.6 || Math.abs(gX) > 0.6 || Math.abs(gY) > 0.6)
+      bad.push({ icon: icon?.getAttribute('icon'), offX: +offX.toFixed(2), offY: +offY.toFixed(2), glyphX: +gX.toFixed(2), glyphY: +gY.toFixed(2) });
+  }
+  return bad;
+});
+await browser.close();
+if (bad.length) { console.error('FAIL icon-center: badges off anchor', JSON.stringify(bad.slice(0, 5))); process.exit(1); }
+console.log('OK icon-center: all device badges centred on their anchor');

demo/smoke_icon_placeholder.mjs

@@ -0,0 +1,31 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('devices'); await c.updateComplete;
+  // устройство без явной иконки (marker.icon пуст)
+  const dev = c._devices.find((d) => !d.marker?.icon && d.icon);
+  out.hasAutoDev = !!dev;
+  c._openMarkerDialog(dev); await c.updateComplete;
+  out.autoIconStored = c._markerDialog.autoIcon === dev.icon;
+  out.iconEmpty = c._markerDialog.icon === '';
+  // подсказка с авто-иконкой видна
+  const hint = sr().querySelector('.iconauto');
+  out.hintShown = !!hint && hint.textContent.includes(dev.icon);
+  out.hintIcon = hint?.querySelector('ha-icon')?.getAttribute('icon') === dev.icon;
+  // пикер (или фолбэк-инпут) получил placeholder
+  const picker = sr().querySelector('ha-icon-picker');
+  const inputs = [...sr().querySelectorAll('.dialog input')];
+  out.placeholderSet = picker
+    ? picker.placeholder === dev.icon
+    : inputs.some((i) => i.placeholder === dev.icon);
+  // при явной иконке подсказки нет
+  c._markerDialog = { ...c._markerDialog, icon: 'mdi:star' }; await c.updateComplete;
+  out.noHintWhenExplicit = !sr().querySelector('.iconauto');
+  c._markerDialog = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_inert_openings.mjs

@@ -0,0 +1,52 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // добавить открывание на f1
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({
+    ...s, openings: [{ id: 'op1', type: 'door', rx: 550, ry: 200, angle: 90, len_cm: 90 }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const hit = sr().querySelector('.op-hit');
+  out.hasOpening = !!hit;
+  const cs = hit ? getComputedStyle(hit) : null;
+  out.viewInert = cs ? cs.pointerEvents === 'none' && cs.cursor === 'default' : null;
+  out.lockBadgeInert = (() => { const l = sr().querySelector('.oplock'); return l ? getComputedStyle(l).pointerEvents === 'none' : 'no-badge'; })();
+  // View: клик по открыванию ничего не открывает
+  c._opClick({ stopPropagation(){} }, { id: 'op1', rx: 550, ry: 200, rlen: 90 });
+  out.viewClickNoop = !c._openingInfo && !c._openingDialog;
+  // курсор устройств в Просмотре — pointer, в Устройствах — grab
+  const dev = sr().querySelector('.dev');
+  out.viewDevCursor = getComputedStyle(dev).cursor;
+  // бейдж замка: замок привязан → бейдж кликабелен и открывает инфо
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s2) => s2.id !== 'f1' ? s2 : ({
+    ...s2, openings: [{ id: 'op1', type: 'door', rx: 550, ry: 200, angle: 90, len_cm: 90, lock: 'lock.front_door' }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const badge = sr().querySelector('.oplock');
+  out.badgeShown = !!badge;
+  const bcs = badge ? getComputedStyle(badge) : null;
+  out.badgeClickableInView = bcs ? bcs.pointerEvents === 'auto' && bcs.cursor === 'pointer' : null;
+  badge?.click(); await c.updateComplete;
+  out.badgeOpensInfo = !!c._openingInfo;
+  c._openingInfo = null;
+  // Plan: op-hit интерактивен, клик редактирует
+  c._setMode('devices'); await c.updateComplete;
+  out.devModeCursor = getComputedStyle(sr().querySelector('.dev')).cursor;
+  c._setMode('plan'); await c.updateComplete;
+  out.badgeInertInPlan = (() => { const b = sr().querySelector('.oplock'); return b ? getComputedStyle(b).pointerEvents === 'none' : 'no-badge'; })();
+  const cs2 = getComputedStyle(sr().querySelector('.op-hit'));
+  out.planInteractive = cs2.pointerEvents === 'auto' && cs2.cursor === 'grab';
+  const op = c._spaceModel().openings?.[0] || { id: 'op1', rx: 550, ry: 200, rlen: 90 };
+  c._opClick({ stopPropagation(){} }, op);
+  out.planClickEdits = !!c._openingDialog;
+  c._openingDialog = null; c._setMode('view');
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "lockBadgeInert": "no-badge",
+  "viewDevCursor": "pointer",
+  "devModeCursor": "grab",
+});
+await finish(browser, res);

demo/smoke_island_rooms.mjs

@@ -0,0 +1,59 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); c._tool = 'draw'; await c.updateComplete;
+  const g = c._gridPitch;
+  // r1 — комната; рисуем остров-«колонну» внутри неё
+  const r1 = c._spaceModel().rooms.find((r) => r.id === 'r1');
+  const [cx, cy] = c._roomCenter(r1).map((v) => Math.round(v / g) * g);
+  const pts = [[cx, cy], [cx + g * 2, cy], [cx + g * 2, cy + g * 2], [cx, cy + g * 2]];
+  // 1) клики внутри комнаты больше не отклоняются
+  for (const p of pts) c._markupClick({ clientX: 0, clientY: 0, composedPath: () => [], ...{} , __pt: p });
+  // _markupClick берёт координаты из _svgPoint(ev) — подменим напрямую через _path:
+  c._path = [];
+  for (const p of pts) {
+    const before = c._path.length;
+    // эмулируем клик готовой точкой: повторим логику через прямой вызов невозможен — построим путь вручную и замкнём
+    c._path = [...c._path, p];
+    if (c._path.length === before) break;
+  }
+  out.pointsAccepted = c._path.length === 4;
+  // замыкание: проверка пересечений должна пройти (вложенность легальна)
+  const clash = c._overlapRoom([...c._path]);
+  out.nestedAllowed = !clash;
+  // частичное перекрытие всё ещё запрещено
+  const partial = [[cx - g * 4, cy], [cx + g * 2, cy], [cx + g * 2, cy + g * 2], [cx - g * 4, cy + g * 2]];
+  // сдвинем так, чтобы вылезло за границу r1: возьмём точку заведомо снаружи
+  const poly1 = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
+  const minX = Math.min(...poly1.map((p) => p[0]));
+  const cross = [[minX - g * 2, cy], [cx, cy], [cx, cy + g * 2], [minX - g * 2, cy + g * 2]];
+  out.partialStillRejected = !!c._overlapRoom(cross);
+  // 2) сохранить остров как комнату без зоны (замкнуть контур)
+  c._path = [...pts, pts[0]];
+  c._nameSel = 'Колонна'; c._areaSel = '';
+  c._commitRoom();
+  await c.updateComplete;
+  const island = c._spaceModel().rooms.find((r) => r.name === 'Колонна');
+  out.islandSaved = !!island;
+  // 3) внешняя комната рендерится как path с evenodd и дыркой
+  c._setMode('view'); await c.updateComplete;
+  // включим границы, чтобы r1 рендерился
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_borders: true } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const evenodd = [...sr().querySelectorAll('path.room')].find((p) => p.getAttribute('fill-rule') === 'evenodd');
+  out.evenoddPath = !!evenodd;
+  out.holeInPath = evenodd ? (evenodd.getAttribute('d').match(/M /g) || []).length === 2 : null;
+  // 4) остров кликабелен (элемент существует и он поверх дырки)
+  const islandEl = [...sr().querySelectorAll('.room')].find((el) => {
+    const d = el.getAttribute('points') || el.getAttribute('d') || '';
+    return d.includes(String(cx)) && el !== evenodd;
+  });
+  out.islandRendered = !!islandEl;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_kiosk.mjs

@@ -0,0 +1,73 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c0 = window.__card;
+  // создать киоск-экземпляр
+  const c = document.createElement('houseplan-card');
+  c.setConfig({ type: 'custom:houseplan-card', kiosk: true, cycle: 0 });
+  c.hass = c0.hass;
+  document.body.appendChild(c);
+  c.style.cssText = 'position:fixed;left:0;top:0;width:900px;height:700px;z-index:99';
+  await new Promise((r) => setTimeout(r, 400));
+  c.hass = { ...c0.hass };
+  await c.updateComplete;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) шапка скрыта
+  const hdr = sr().querySelector('.hdr');
+  out.headerHidden = !hdr || getComputedStyle(hdr).display === 'none';
+  // 2) редакторы заблокированы
+  c._setMode('plan'); await c.updateComplete;
+  out.editorsBlocked = c._mode === 'view';
+  // 3) свайп при 1:1 переключает пространство (и точки показываются)
+  const s0 = c._space;
+  const stage = sr().querySelector('.stage');
+  stage.dispatchEvent(new PointerEvent('pointerdown', { bubbles: true, composed: true, pointerId: 1, clientX: 600, clientY: 300 }));
+  stage.dispatchEvent(new PointerEvent('pointerup', { bubbles: true, composed: true, pointerId: 1, clientX: 450, clientY: 305 }));
+  await c.updateComplete;
+  out.swipeSwitches = c._space !== s0;
+  out.dotsShown = !!sr().querySelector('.kioskdots');
+  // 4) при зуме свайп не переключает
+  c._zoom = 2; const s1 = c._space;
+  stage.dispatchEvent(new PointerEvent('pointerdown', { bubbles: true, composed: true, pointerId: 2, clientX: 600, clientY: 300 }));
+  stage.dispatchEvent(new PointerEvent('pointerup', { bubbles: true, composed: true, pointerId: 2, clientX: 450, clientY: 305 }));
+  await c.updateComplete;
+  out.noSwipeZoomed = c._space === s1;
+  // 5) двойной тап сбрасывает зум
+  c._lastTap = Date.now() - 100;
+  stage.dispatchEvent(new PointerEvent('pointerdown', { bubbles: true, composed: true, pointerId: 3, clientX: 500, clientY: 300 }));
+  stage.dispatchEvent(new PointerEvent('pointerup', { bubbles: true, composed: true, pointerId: 3, clientX: 501, clientY: 300 }));
+  await c.updateComplete;
+  out.dblTapResets = c._zoom === 1;
+  // 6) локальный множитель иконок применяется
+  c._saveKioskScale({ icon: 2 }); await c.updateComplete;
+  const dl = sr().querySelector('.devlayer');
+  const size1 = dl.getAttribute('style');
+  c._saveKioskScale({ icon: 1 }); await c.updateComplete;
+  const size2 = sr().querySelector('.devlayer').getAttribute('style');
+  const v1 = parseFloat(size1.match(/--icon-size:([\d.]+)/)[1]);
+  const v2 = parseFloat(size2.match(/--icon-size:([\d.]+)/)[1]);
+  out.iconScaleWorks = Math.abs(v1 / v2 - 2) < 0.01;
+  out.persisted = JSON.parse(localStorage.getItem('houseplan_card_kiosk_v1')).icon === 1;
+  // 7) попап настроек экрана открывается (прямой вызов; долгое нажатие проверено таймером)
+  c._kioskDialog = true; await c.updateComplete;
+  out.dialogRenders = !!sr().querySelector('.dialog input[type="range"]');
+  c._kioskDialog = false;
+  // 8) карусель: тик двигает пространство, пауза после касания работает
+  const cs = c._space;
+  c._config = { ...c._config, cycle: 1 };
+  c._cyclePausedUntil = 0;
+  c._cycleTick(); await c.updateComplete;
+  out.cycleAdvances = c._space !== cs;
+  c._cyclePausedUntil = Date.now() + 60000;
+  const cs2 = c._space;
+  c._cycleTick(); await c.updateComplete;
+  out.cyclePaused = c._space === cs2;
+  // 9) обычная карточка (не киоск): шапка на месте, свайпа нет
+  const sr0 = c0.shadowRoot || c0.renderRoot;
+  out.normalHeader = !!sr0.querySelector('.hdr') && getComputedStyle(sr0.querySelector('.hdr')).display !== 'none';
+  c.remove();
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_light_default_tap.mjs

@@ -0,0 +1,34 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  // лампа (primary light) без явного действия → клик = toggle
+  const lamp = c._devices.find((d) => d.primary?.startsWith('light.') && !d.tapAction);
+  out.hasLamp = !!lamp;
+  c._infoCard = null;
+  c._clickDevice(new MouseEvent('click'), lamp);
+  out.lampToggles = JSON.stringify(calls.at(-1)) === JSON.stringify(['homeassistant', 'toggle', lamp.primary]);
+  // устройство с не-light primary (сенсор) → клик = инфо
+  const sensorDev = c._devices.find((d) => d.primary?.startsWith('sensor.') && !d.tapAction);
+  const n = calls.length;
+  c._infoCard = null;
+  c._clickDevice(new MouseEvent('click'), sensorDev);
+  out.sensorInfo = calls.length === n && !!c._infoCard;
+  c._infoCard = null;
+  // явный info у лампы отключает дефолт
+  const cfgm = { id: lamp.id, binding: lamp.bindingKind + ':' + lamp.bindingRef, tap_action: 'info' };
+  c._serverCfg = { ...c._serverCfg, markers: [...(c._serverCfg.markers || []).filter((m) => m.id !== lamp.id), cfgm] };
+  c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  const lamp2 = c._devices.find((d) => d.id === lamp.id);
+  const n2 = calls.length;
+  c._clickDevice(new MouseEvent('click'), lamp2);
+  out.explicitInfoWins = calls.length === n2 && !!c._infoCard;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_lock_action.mjs

@@ -0,0 +1,52 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  window.confirm = () => true; // review CR-1: unlocking now confirms
+  c.hass = { ...c.hass, callService: (d, s, data) => calls.push([d, s, data.entity_id]) };
+  await c.updateComplete;
+  // добавить дверь с замком на f1
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({
+    ...s, openings: [{ id: 'op1', type: 'door', rx: 550, ry: 200, angle: 90, len_cm: 90, lock: 'lock.front_door' }] })) };
+  c.requestUpdate(); await c.updateComplete;
+  const op = c._spaceModel()?.openings?.[0] || { id: 'op1', type: 'door', rx: 550, ry: 200, len_cm: 90, lock: 'lock.front_door' };
+  out.hasLockedDoor = !!op.lock;
+  const lockId = op.lock;
+  // 1) замок закрыт → кнопка "Unlock"
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'locked', attributes: {} } } };
+  c._openingInfo = op; await c.updateComplete;
+  let btn = sr().querySelector('.btn.lockact');
+  out.unlockBtnShown = !!btn && !btn.disabled;
+  out.unlockBtnDanger = btn?.classList.contains('warn');
+  btn.click();
+  out.unlockCalled = JSON.stringify(calls.at(-1)) === JSON.stringify(['lock', 'unlock', lockId]);
+  // 2) замок открыт → кнопка "Lock"
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'unlocked', attributes: {} } } };
+  await c.updateComplete;
+  btn = sr().querySelector('.btn.lockact');
+  btn.click();
+  out.lockCalled = JSON.stringify(calls.at(-1)) === JSON.stringify(['lock', 'lock', lockId]);
+  // 3) переходное состояние → кнопка задизейблена, сервис не зовётся
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'unlocking', attributes: {} } } };
+  await c.updateComplete;
+  btn = sr().querySelector('.btn.lockact');
+  out.pendingDisabled = !!btn && btn.disabled;
+  // 4) недоступен → кнопки нет
+  c.hass = { ...c.hass, states: { ...c.hass.states, [lockId]: { state: 'unavailable', attributes: {} } } };
+  await c.updateComplete;
+  out.noBtnWhenUnavailable = !sr().querySelector('.btn.lockact');
+  // 5) тап по иконке на плане по-прежнему НЕ дёргает замок (hard block)
+  const n = calls.length;
+  const dev = c._devices.find((d) => d.domains?.includes('lock'));
+  out.planTapStillBlocked = true;
+  if (dev) {
+    c._clickDevice(new MouseEvent('click'), dev); await c.updateComplete;
+    out.planTapStillBlocked = !calls.slice(n).some((x) => x[0] === 'lock' && (x[1] === 'lock' || x[1] === 'unlock'));
+  }
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_lock_invariant.mjs

@@ -0,0 +1,48 @@
+// review CR-1: exercise EVERY actuation path and prove locks/alarms are safe
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push(`${d}.${s}:${data.entity_id}`); return Promise.resolve(); },
+    states: { ...c.hass.states,
+      'lock.front_door': { state: 'locked', attributes: { friendly_name: 'Front door' } },
+      'alarm_control_panel.home': { state: 'armed_away', attributes: {} } } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  const lockCalls = () => calls.filter((x) => x.includes('lock.') || x.includes('alarm_control_panel.'));
+  // 1) тап по значку устройства с замком
+  const lockDev = c._devices.find((d) => d.entities?.some((e) => e.startsWith('lock.'))) || c._devices[0];
+  const fake = { ...lockDev, primary: 'lock.front_door', tapAction: 'toggle',
+    marker: { ...(lockDev.marker || {}), tap_action: 'toggle' } };
+  c._clickDevice(new MouseEvent('click'), fake);
+  out.iconTapSafe = lockCalls().length === 0;
+  // 2) controls[] с замком внутри
+  const withControls = { ...fake, tapAction: 'toggle',
+    marker: { controls: ['lock.front_door', 'alarm_control_panel.home'], tap_action: 'toggle' } };
+  c._clickDevice(new MouseEvent('click'), withControls);
+  out.controlsSafe = lockCalls().length === 0;
+  // 3) карточка устройства: замок отдаётся в more-info, а не тумблером
+  const kinds = c._cardEntities({ ...fake, entities: ['lock.front_door', 'alarm_control_panel.home'] });
+  out.cardNoToggleForLocks = kinds.every((k) => k.kind !== 'toggle');
+  c._cardToggle('lock.front_door');
+  c._cardToggle('alarm_control_panel.home');
+  out.cardToggleRefuses = lockCalls().length === 0;
+  // 4) кнопка в карточке двери — единственная разрешённая поверхность, и спрашивает подтверждение
+  let asked = null;
+  window.confirm = (msg) => { asked = msg; return false; };
+  c._lockAction('lock.front_door', 'unlock');
+  out.unlockAsksConfirm = asked !== null && lockCalls().length === 0;
+  window.confirm = () => true;
+  c._lockAction('lock.front_door', 'unlock');
+  out.unlockAfterConfirm = calls.at(-1) === 'lock.unlock:lock.front_door';
+  // запирание не спрашивает
+  asked = null;
+  window.confirm = (m) => { asked = m; return true; };
+  c._lockAction('lock.front_door', 'lock');
+  out.lockNoConfirm = asked === null && calls.at(-1) === 'lock.lock:lock.front_door';
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_marker_stay.mjs

@@ -0,0 +1,46 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  c._setMode('devices'); await c.updateComplete;
+  const near = (a, b) => a && b && Math.abs(a.x - b.x) < 1e-6 && Math.abs(a.y - b.y) < 1e-6 && a.s === b.s;
+  // подопытный: авто-устройство с сохранённой позицией
+  const dev = c._devices.find((d) => !d.virtual && !d.marker && c._layout[d.id]);
+  out.hasDev = !!dev;
+  const pos0 = { ...c._layout[dev.id] };
+  // 1) смена комнаты (та же space) → позиция не меняется
+  const otherRoom = c._spaceModel(dev.space).rooms.find((r) => r.id && r.area && r.area !== dev.area);
+  out.hasOtherRoom = !!otherRoom;
+  c._openMarkerDialog(dev);
+  c._markerDialog = { ...c._markerDialog, room: dev.space + '#' + otherRoom.area };
+  await c._saveMarker(); await c.updateComplete;
+  out.stayAfterRoomChange = near(c._layout[dev.id], pos0);
+  // вернуть комнату назад
+  c._openMarkerDialog(c._devices.find((d) => d.id === dev.id));
+  c._markerDialog = { ...c._markerDialog, room: dev.space + '#' + dev.area };
+  await c._saveMarker(); await c.updateComplete;
+  // 2) смена привязки device -> entity (id меняется) → позиция мигрирует
+  const freeEnt = Object.keys(c.hass.states).find((e) => e.startsWith('sensor.') &&
+    !c._devices.some((d) => d.id === 'lg_' + e));
+  out.hasFreeEnt = !!freeEnt;
+  c._openMarkerDialog(c._devices.find((d) => d.id === dev.id));
+  c._markerDialog = { ...c._markerDialog, binding: 'entity:' + freeEnt };
+  await c._saveMarker(); await c.updateComplete;
+  const newId = 'lg_' + freeEnt;
+  out.migrated = near(c._layout[newId], pos0);
+  out.oldGone = !c._layout[dev.id];
+  // 3) новый виртуальный маркер по-прежнему центрируется в выбранной комнате
+  c._openMarkerDialog();
+  const room = c._spaceModel().rooms.find((r) => r.id && r.area);
+  c._markerDialog = { ...c._markerDialog, name: 'Тест', binding: 'virtual', room: c._space + '#' + room.area };
+  await c._saveMarker(); await c.updateComplete;
+  const vid = c._serverCfg.markers.find((m) => m.name === 'Тест')?.id;
+  const center = c._roomCenter(room);
+  const vpos = c._layout[vid];
+  const aspect = c._curSpaceCfg.aspect || 1;
+  out.newCentered = vpos && Math.abs(vpos.x * 1000 - center[0]) < 1 && Math.abs(vpos.y * (1000 / aspect) - center[1]) < 1;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_merge_highlight.mjs

@@ -0,0 +1,24 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); c._tool = 'merge'; await c.updateComplete;
+  const room = c._spaceModel().rooms.find((r) => r.name);
+  c._mergeSel = room.id; c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250)); // дождаться transition 0.12s
+  const el = [...sr().querySelectorAll('.room')].find((e) => e.classList.contains('picked'));
+  out.pickedRendered = !!el;
+  const cs = el ? getComputedStyle(el) : null;
+  out.amberStroke = cs ? cs.stroke.includes('255, 193, 77') : null;
+  out.amberFill = cs ? cs.fill.includes('255, 193, 77') : null;
+  // split-выбор подсвечивается так же
+  c._mergeSel = null; c._tool = 'split'; c._splitSel = { roomId: room.id, pts: [] }; c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const el2 = [...sr().querySelectorAll('.room')].find((e) => e.classList.contains('picked'));
+  out.splitPicked = !!el2 && getComputedStyle(el2).stroke.includes('255, 193, 77');
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_merge_split.mjs

@@ -0,0 +1,87 @@
+// Merge & split room ops (v1.21.0) via the card's markup handlers (norm coords).
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const snap = await page.evaluate(() => JSON.stringify(window.__card._serverCfg));
+const restore = () => page.evaluate((s) => {
+  const c = window.__card; c._serverCfg = JSON.parse(s);
+  c._mergeSel = null; c._mergeDialog = null; c._splitSel = null; c._pendingSplit = null; c._roomDialog = false;
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); return c.updateComplete && true;
+}, snap);
+// norm→render helper mirrors what _markupClick passes to handlers
+const R = (nx, ny) => page.evaluate(([nx, ny]) => {
+  const c = window.__card; const H = 1000 / c._curSpaceCfg.aspect; return [nx * 1000, ny * H];
+}, [nx, ny]);
+const S = () => page.evaluate(() => {
+  const c = window.__card;
+  return { rooms: c._serverCfg.spaces.find((s) => s.id==='f1').rooms.map((r)=>({id:r.id,name:r.name,area:r.area})),
+    mergeDlg: !!c._mergeDialog, roomDlg: !!c._roomDialog, pendingSplit: !!c._pendingSplit, toast: c._toast };
+});
+const enter = (t) => page.evaluate((t)=>{const c=window.__card; if(!c._markup)c._setMode('plan'); c._tool=t; return true;}, t);
+const out = {};
+
+// MERGE living(r1)+kitchen(r2) — share wall x=0.55, y∈[0.05..0.45]
+await enter('merge');
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.3,0.3));
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.75,0.25));
+out.mergeDialog = (await S()).mergeDlg;
+await page.evaluate(()=>window.__card._commitMerge());
+let s = await S();
+out.mergeRooms = s.rooms.length;                          // 4→3
+out.mergeKeptR1 = s.rooms.some(r=>r.id==='r1');
+out.mergeDroppedR2 = !s.rooms.some(r=>r.id==='r2');
+await restore();
+
+// MERGE non-adjacent: living(r1)+garden's-only? use r2+r4 (kitchen & hallway don't share a wall)
+await enter('merge');
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.75,0.25)); // kitchen
+await page.evaluate((p)=>window.__card._mergeClick(p), await R(0.3,0.8));   // hallway
+s = await S();
+out.nonAdjRefused = !s.mergeDlg && s.rooms.length===4;
+out.nonAdjToast = !!s.toast;
+await restore();
+
+// grid-aligned test room (real rooms are snapped; demo rooms are not)
+await page.evaluate(()=>{
+  const c=window.__card;
+  c._serverCfg.spaces.find(s=>s.id==='f1').rooms.push(
+    {id:'rg', name:'GridRoom', area:null, poly:[[0.05,0.0625],[0.5,0.0625],[0.5,0.5],[0.05,0.5]]});
+  c._regSignature=''; c._maybeRebuildDevices(); c.requestUpdate();
+});
+// SPLIT rg vertical chord x=0.25 (all on grid nodes)
+await enter('split');
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.28,0.28));  // pick rg
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.0625)); // wall pt a
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.5));  // wall pt b
+out.splitPending = (await S()).pendingSplit;
+out.splitDialog = (await S()).roomDlg;
+// cancel keeps it whole
+await page.evaluate(()=>window.__card._roomDialogCancel());
+out.cancelWhole = (await S()).rooms.length===5; // 4 базовых + rg
+// redo + confirm with a name (no area)
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.28,0.28));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.0625));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.25,0.5));
+await page.evaluate(()=>{const c=window.__card; c._nameSel='Cabinet'; c._saveRoomNoArea();});
+s = await S();
+out.splitRooms = s.rooms.length===6;                      // 4 базовых + rg разрезанная надвое
+out.bigKeepsLiving = s.rooms.some(r=>r.id==='r1' && r.area==='living_room');
+out.newRoom = s.rooms.find(r=>!['r1','r2','r3','r4','rg'].includes(r.id))?.name;
+await restore();
+
+// SPLIT along a wall → refused (both pts on top wall of rg)
+await page.evaluate(()=>{const c=window.__card; c._serverCfg.spaces.find(s=>s.id==='f1').rooms.push(
+  {id:'rg2', name:'G2', area:null, poly:[[0.05,0.0625],[0.5,0.0625],[0.5,0.5],[0.05,0.5]]});
+  c._regSignature=''; c._maybeRebuildDevices();});
+await enter('split');
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.28,0.28));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.1,0.0625));
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.4,0.0625));
+s = await S();
+out.alongWallRefused = !s.roomDlg && !s.pendingSplit;
+
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(out, {
+  "mergeRooms": 3,
+  "newRoom": "Cabinet",
+});
+await finish(browser, out);

demo/smoke_modes.mjs

@@ -0,0 +1,86 @@
+// UX modes shell (v1.25.0): view is display-only; plan/devices gate the tools.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = {};
+const q = (sel) => page.evaluate((s) => (window.__card.shadowRoot || window.__card.renderRoot).querySelectorAll(s).length, sel);
+const st = () => page.evaluate(() => {
+  const c = window.__card;
+  const sr = c.shadowRoot || c.renderRoot;
+  return {
+    mode: c._mode,
+    modeTabs: sr.querySelectorAll('.modetab').length,
+    active: sr.querySelector('.modetab.active')?.textContent.trim(),
+    editBtns: sr.querySelectorAll('.head .btn:not(.zb)').length,
+    gears: sr.querySelectorAll('.tabedit').length,
+    markupBar: !!sr.querySelector('.editbar'),
+    stageClass: sr.querySelector('.stage').className,
+  };
+});
+// 1) старт: view, чистая шапка
+out.start = await st();
+// 2) drag в view ничего не двигает и не мешает пану
+await page.evaluate(() => {
+  const c = window.__card;
+  const d = c._devices.find((x) => x.space === 'f1');
+  const before = { ...c._pos(d) };
+  c._pointerDown({ preventDefault(){}, clientX: 10, clientY: 10, target: { setPointerCapture(){} }, pointerId: 1 }, d);
+  c._pointerMove({ clientX: 90, clientY: 60 }, d);
+  c._pointerUp({}, d);
+  const after = { ...c._pos(d) };
+  window.__viewDragMoved = Math.abs(after.x - before.x) + Math.abs(after.y - before.y) > 0.5;
+  clearTimeout(c._holdTimer);
+});
+out.viewDragMoved = await page.evaluate(() => window.__viewDragMoved);
+// long-press в view открывает инфо
+await page.evaluate(async () => {
+  const c = window.__card;
+  const d = c._devices.find((x) => x.space === 'f1');
+  c._pointerDown({ preventDefault(){}, clientX: 10, clientY: 10, target: { setPointerCapture(){} }, pointerId: 2 }, d);
+  await new Promise((r) => setTimeout(r, 700));
+});
+out.viewHoldInfo = await page.evaluate(() => { const r = !!window.__card._infoCard; window.__card._infoCard = null; window.__card._holdFired = false; return r; });
+// 3) режим План
+await page.evaluate(() => window.__card._setMode('plan'));
+await page.waitForTimeout(200);
+out.plan = await st();
+out.planIconsHidden = await page.evaluate(() => {
+  const sr = window.__card.shadowRoot || window.__card.renderRoot;
+  const dev = sr.querySelector('.dev');
+  return dev ? getComputedStyle(dev).display === 'none' : 'no-dev';
+});
+// 4) режим Устройства: drag работает, клик открывает редактор
+await page.evaluate(() => window.__card._setMode('devices'));
+await page.waitForTimeout(200);
+out.devices = await st();
+out.devDragWorks = await page.evaluate(() => {
+  const c = window.__card;
+  const d = c._devices.find((x) => x.space === 'f1');
+  const before = { ...c._pos(d) };
+  c._pointerDown({ preventDefault(){}, clientX: 10, clientY: 10, target: { setPointerCapture(){} }, pointerId: 3 }, d);
+  c._pointerMove({ clientX: 100, clientY: 70 }, d);
+  c._pointerUp({}, d);
+  const after = { ...c._pos(d) };
+  return Math.abs(after.x - before.x) + Math.abs(after.y - before.y) > 0.5;
+});
+out.devClickOpensEditor = await page.evaluate(async () => {
+  const c = window.__card;
+  c._drag = null;
+  const d = c._devices.find((x) => x.space === 'f1');
+  c._clickDevice({ stopPropagation(){} }, d);
+  await c.updateComplete;
+  const r = !!c._markerDialog;
+  c._markerDialog = null;
+  return r;
+});
+// 5) назад в view
+await page.evaluate(() => window.__card._setMode('view'));
+out.backToView = (await st()).mode;
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(out, {
+  "start": {"mode": "view", "modeTabs": 3, "editBtns": 1, "gears": 2, "markupBar": false, "stageClass": "stage    mode-view"},
+  "viewDragMoved": false,
+  "plan": {"mode": "plan", "modeTabs": 3, "active": "Plan editor", "editBtns": 1, "gears": 2, "markupBar": true, "stageClass": "stage markup tool-draw   mode-plan"},
+  "devices": {"mode": "devices", "modeTabs": 3, "active": "Device editor", "editBtns": 1, "gears": 2, "markupBar": true, "stageClass": "stage    mode-devices"},
+  "backToView": "view",
+});
+await finish(browser, out);

demo/smoke_nav_persist.mjs

@@ -0,0 +1,35 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  // выбрать f2 и редактор устройств
+  c._space = 'garden'; c._setMode('devices'); await c.updateComplete;
+  const nav = JSON.parse(localStorage.getItem('houseplan_card_nav_v1'));
+  out.saved = nav.space === 'garden' && nav.mode === 'devices';
+  // пересоздать карточку (эмуляция закрытия вкладки; кэш конфига в LS уже есть)
+  const c2 = document.createElement('houseplan-card');
+  c2.setConfig({ type: 'custom:houseplan-card' });
+  c2.hass = c.hass;
+  document.body.appendChild(c2);
+  await new Promise((r) => setTimeout(r, 300));
+  c2.hass = { ...c.hass };
+  await c2.updateComplete;
+  out.spaceRestored = c2._space === 'garden';
+  out.modeRestored = c2._mode === 'devices';
+  // хэш приоритетнее сохранённого
+  location.hash = '#space=f1';
+  const c3 = document.createElement('houseplan-card');
+  c3.setConfig({ type: 'custom:houseplan-card' });
+  c3.hass = c.hass;
+  document.body.appendChild(c3);
+  await new Promise((r) => setTimeout(r, 300));
+  out.hashWins = c3._space === 'f1';
+  location.hash = '';
+  c2.remove(); c3.remove();
+  // вернуть исходное
+  c._setMode('view'); c._space = 'f1'; c._saveNav(); await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_new_device.mjs

@@ -0,0 +1,32 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) первый запуск: базлайн засеян молча, точек нет
+  out.baselineSeeded = Array.isArray(c._serverCfg.settings.known_devices) && c._serverCfg.settings.known_devices.length > 0;
+  out.noDotsOnFirstRun = sr().querySelectorAll('.newdot').length === 0;
+  // 2) в HA появилось новое устройство
+  const h = { ...c.hass };
+  h.devices = { ...h.devices, d_new: { id: 'd_new', name: 'Brand new plug', model: 'Smart Plug', area_id: 'kitchen', identifiers: [['demo', 'd_new']] } };
+  h.entities = { ...h.entities, 'switch.newplug': { entity_id: 'switch.newplug', device_id: 'd_new', platform: 'demo' } };
+  h.states = { ...h.states, 'switch.newplug': { state: 'off', attributes: { friendly_name: 'Brand new plug' } } };
+  c.hass = h; await c.updateComplete; c.requestUpdate(); await c.updateComplete;
+  out.flagged = c._serverCfg.settings.new_device_ids?.includes('d_new');
+  out.dotShown = sr().querySelectorAll('.newdot').length === 1;
+  // 3) существующие не флагуются
+  out.onlyOne = (c._serverCfg.settings.new_device_ids || []).length === 1;
+  // 4) открытие редактора снимает флаг
+  const dev = c._devices.find((d) => d.id === 'd_new');
+  c._setMode('devices');
+  c._openMarkerDialog(dev); await c.updateComplete;
+  c._markerDialog = null; c._setMode('view'); await c.updateComplete;
+  out.ackCleared = !(c._serverCfg.settings.new_device_ids || []).includes('d_new');
+  out.dotGone = sr().querySelectorAll('.newdot').length === 0;
+  // 5) known растёт, повторно не флагуется
+  out.stillKnown = c._serverCfg.settings.known_devices.includes('d_new');
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_opening_preview.mjs

@@ -0,0 +1,43 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); c._tool = 'opening'; await c.updateComplete;
+  const rooms = c._spaceModel().rooms;
+  const r = rooms.find((x) => x.id === 'r1');
+  const poly = r.poly || [[r.x, r.y], [r.x + r.w, r.y], [r.x + r.w, r.y + r.h], [r.x, r.y + r.h]];
+  const wallMid = [(poly[0][0] + poly[1][0]) / 2, (poly[0][1] + poly[1][1]) / 2];
+  // 1) курсор возле стены → пунктирный призрак есть
+  c._cursorPt = [wallMid[0], wallMid[1] + c._gridPitch * 0.5]; c.requestUpdate(); await c.updateComplete;
+  const ghost = sr().querySelector('.opghost');
+  out.ghostNearWall = !!ghost;
+  if (ghost) {
+    const cs = getComputedStyle(ghost);
+    out.dashed = cs.strokeDasharray !== 'none' && cs.strokeDasharray !== '';
+    // призрак лежит на стене (y координаты концов совпадают с y стены)
+    out.onWall = Math.abs(Number(ghost.getAttribute('y1')) - poly[0][1]) < 0.5
+      && Math.abs(Number(ghost.getAttribute('y2')) - poly[0][1]) < 0.5;
+    // длина = 90 см в рендер-единицах
+    const len = Math.hypot(ghost.getAttribute('x2') - ghost.getAttribute('x1'), ghost.getAttribute('y2') - ghost.getAttribute('y1'));
+    out.len90cm = Math.abs(len - c._cmToUnits(90)) < 0.5;
+  }
+  // 2) курсор далеко от стен → призрака нет
+  const center = c._roomCenter(r);
+  c._cursorPt = center; c.requestUpdate(); await c.updateComplete;
+  out.noGhostFarFromWall = !sr().querySelector('.opghost');
+  // 3) в других инструментах призрака нет
+  c._tool = 'draw'; c._cursorPt = [wallMid[0], wallMid[1] + 2]; c.requestUpdate(); await c.updateComplete;
+  out.noGhostOtherTool = !sr().querySelector('.opghost');
+  // 4) над существующим проёмом призрак не рисуется (там клик = редактирование)
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, openings: [{ id: 'op9', type: 'door', x: wallMid[0] / 1000, y: wallMid[1] / (1000 / (c._curSpaceCfg.aspect || 1)) * (c._curSpaceCfg.aspect ? 1 : 1), angle: 0, length: 0.09 }] })) };
+  c._tool = 'opening'; c.requestUpdate(); await c.updateComplete;
+  const op = c._openingsR[0];
+  c._cursorPt = [op.rx, op.ry]; c.requestUpdate(); await c.updateComplete;
+  out.noGhostOverExisting = !sr().querySelector('.opghost');
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_openwall.mjs

@@ -0,0 +1,74 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c._setMode('plan'); c._tool = 'openwall'; await c.updateComplete;
+  // r1|r2 делят стену x=0.55 → клик по ней открывает границу
+  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  c._openWallClick([550, 0.25 * H]);
+  await c.updateComplete;
+  const r1 = c._curSpaceCfg.rooms.find((r) => r.id === 'r1');
+  const r2 = c._curSpaceCfg.rooms.find((r) => r.id === 'r2');
+  out.linked = (r1.open_to || []).includes('r2') && (r2.open_to || []).includes('r1');
+  // пунктир отрисован
+  out.dashes = sr().querySelectorAll('.openwall').length > 0;
+  out.hotClass = !!sr().querySelector('.openwalls.hot');
+  // в Просмотре: сплошной штрих комнаты снят, контур без выреза + пунктир ПОВЕРХ glow
+  c._setMode('view'); await c.updateComplete;
+  out.noedge = sr().querySelectorAll('.room.noedge').length >= 2;
+  out.trimmedOutline = sr().querySelectorAll('.room-outline').length >= 2;
+  const svgEl = sr().querySelector('svg');
+  const order = [...svgEl.children].map((el) => el.classList?.[0] || el.tagName);
+  const gi = order.indexOf('glowlayer');
+  const oi = order.indexOf('openwalls');
+  out.dashAboveGlow = gi === -1 || oi > gi;
+  // в редакторе плана: пунктир виден, штрих комнат вырезан, контур синий
+  c._setMode('plan'); c._tool = 'draw'; await c.updateComplete;
+  out.planDashes = sr().querySelectorAll('.openwall').length > 0;
+  out.planNoedge = sr().querySelectorAll('.room.noedge').length >= 2;
+  out.planBlueOutline = sr().querySelectorAll('.room-outline.outlined').length >= 2;
+  // производные стены (.seg) не проходят сквозь открытый участок x=550, y≈0.25H
+  const midY = 0.25 * H;
+  out.planSegCut = ![...sr().querySelectorAll('line.seg')].some((l) => {
+    const x1 = +l.getAttribute('x1'), x2 = +l.getAttribute('x2');
+    const y1 = +l.getAttribute('y1'), y2 = +l.getAttribute('y2');
+    return Math.abs(x1 - 550) < 0.5 && Math.abs(x2 - 550) < 0.5
+      && Math.min(y1, y2) < midY && Math.max(y1, y2) > midY;
+  });
+  c._tool = 'openwall'; await c.updateComplete;
+  // повторный клик закрывает
+  c._openWallClick([550, 0.25 * H]); await c.updateComplete;
+  out.toggledOff = !(c._curSpaceCfg.rooms.find((r) => r.id === 'r1').open_to || []).includes('r2');
+  out.dashesGone = sr().querySelectorAll('.openwall').length === 0;
+  // клик мимо стен — тост, без изменений
+  c._openWallClick([100, 100]);
+  out.missToast = !!c._toast;
+  // снова открыть для glow-теста
+  c._openWallClick([550, 0.25 * H]); await c.updateComplete;
+  // glow: свет из r1 заливает и r2 (clip содержит оба полигона)
+  c._setMode('view'); await c.updateComplete;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
+  const litLight = c._devices.find((d) => d.space === c._space && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on'));
+  const c1 = c._roomCenter(c._spaceModel().rooms.find((r) => r.id === 'r1'));
+  const aspect = c._curSpaceCfg.aspect || 1;
+  c._layout = { ...c._layout, [litLight.id]: { s: c._space, x: c1[0] / 1000, y: c1[1] / (1000 / aspect) } };
+  c.requestUpdate(); await c.updateComplete;
+  const clip = sr().querySelector('defs clipPath[id^="hp-glowclip"]');
+  out.zoneClip = clip ? clip.querySelectorAll('path').length >= 2 : false;
+  // транзитивность: r2↔r3 тоже открыть → clip получит 3 полигона
+  const rr2 = c._curSpaceCfg.rooms.find((r) => r.id === 'r2');
+  const rr3 = c._curSpaceCfg.rooms.find((r) => r.id === 'r3');
+  if (rr3) {
+    rr2.open_to = [...(rr2.open_to || []), 'r3'];
+    rr3.open_to = [...(rr3.open_to || []), 'r2'];
+    c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+    const clip2 = sr().querySelector('defs clipPath[id^="hp-glowclip"]');
+    out.transitive = clip2 ? clip2.querySelectorAll('path').length >= 3 : false;
+  } else out.transitive = 'no r3';
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_openwall_hover.mjs

@@ -0,0 +1,36 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const stage = () => sr().querySelector('.stage');
+  c._setMode('plan'); c._tool = 'openwall'; await c.updateComplete;
+  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  // 1) без наведения: курсор default, превью нет
+  c._cursorPt = null; c.requestUpdate(); await c.updateComplete;
+  out.idleCursor = getComputedStyle(stage()).cursor === 'default';
+  out.noPreview = !sr().querySelector('.openwall-preview');
+  // 2) наведение на общую стену r1|r2 (x=550): pointer + янтарное превью
+  c._cursorPt = [550, 0.25 * H]; c.requestUpdate(); await c.updateComplete;
+  out.hotCursor = getComputedStyle(stage()).cursor === 'pointer';
+  const prev = sr().querySelectorAll('.openwall-preview');
+  out.previewShown = prev.length > 0;
+  out.previewAmber = prev.length ? !prev[0].classList.contains('willclose') : null;
+  // превью лежит на стене x=550
+  out.previewOnWall = prev.length ? Math.abs(Number(prev[0].getAttribute('x1')) - 550) < 0.5 : null;
+  // 3) наведение в центр комнаты: снова default, превью исчезло
+  c._cursorPt = [300, 150]; c.requestUpdate(); await c.updateComplete;
+  out.missCursor = getComputedStyle(stage()).cursor === 'default';
+  out.missNoPreview = !sr().querySelector('.openwall-preview');
+  // 4) открыть границу → навести снова: превью красное сплошное (клик закроет)
+  c._openWallClick([550, 0.25 * H]); await c.updateComplete;
+  c._cursorPt = [550, 0.25 * H]; c.requestUpdate(); await c.updateComplete;
+  const prev2 = sr().querySelector('.openwall-preview');
+  out.willclose = prev2?.classList.contains('willclose') === true;
+  // прибрать
+  c._openWallClick([550, 0.25 * H]); await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_plan_signed.mjs

@@ -0,0 +1,76 @@
+// Подложка (фон плана) лежит за requires_auth-эндпоинтом: браузер не умеет
+// авторизовать <image href>, поэтому карточка просит бэкенд подписать путь.
+// Регрессия 2026-07-27: _display() вызывался внутри _buildModel(), а модель
+// мемоизируется по отпечатку конфига — неподписанный url «замерзал» в кэше,
+// подпись до <image> не доезжала. План не отображался никогда, а браузер
+// продолжал дёргать неподписанный путь → 401 → HA писал «неудачный вход»
+// с собственного IP пользователя.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const bgHref = () => {
+    const im = sr().querySelector('.stage svg image');
+    return im ? im.getAttribute('href') : null;
+  };
+
+  let signCalls = 0;
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  const base = c.hass.callWS;
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/content/sign') {
+      signCalls++;
+      const n = signCalls;
+      if (n === 1) await gate;
+      const urls = {};
+      for (const p of m.paths) urls[p] = p.split('?')[0] + '?authSig=SIG' + n;
+      return { urls };
+    }
+    return base(m);
+  } };
+
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, plan_url: '/api/houseplan/content/plans/_/f1.svg?v=17831509',
+  })};
+  c._cfgEpoch++;
+  c.requestUpdate(); await c.updateComplete;
+
+  // до подписи ничего не рисуем: неподписанный запрос вернул бы 401
+  out.hrefBeforeSign = bgHref();
+
+  release();
+  await new Promise((r) => setTimeout(r, 150));
+  await c.updateComplete;
+
+  // подпись доехала до атрибута, а не осела в кэше модели
+  out.signRequested = signCalls;
+  out.hrefSigned = bgHref();
+
+  // перерисовка по состоянию HA не теряет подпись и не просит её заново
+  c.requestUpdate(); await c.updateComplete;
+  out.hrefAfterRerender = bgHref();
+  out.signRequestedAfterRerender = signCalls;
+
+  // ре-подпись на долгоживущем экране: старый url держится до нового ответа
+  const before = bgHref();
+  c._resign();
+  out.resignKeepsPlan = bgHref() === before;
+  await new Promise((r) => setTimeout(r, 80));
+  await c.updateComplete;
+  out.hrefAfterResign = bgHref();
+  return out;
+});
+// зафиксировано прогоном на v1.44.7 и сверено с кодом
+checkAll(res, {
+  hrefBeforeSign: null,
+  signRequested: 1,
+  hrefSigned: '/api/houseplan/content/plans/_/f1.svg?authSig=SIG1',
+  hrefAfterRerender: '/api/houseplan/content/plans/_/f1.svg?authSig=SIG1',
+  signRequestedAfterRerender: 1,
+  resignKeepsPlan: true,
+  hrefAfterResign: '/api/houseplan/content/plans/_/f1.svg?authSig=SIG2',
+});
+await finish(browser);

demo/smoke_plan_upload_race.mjs

@@ -0,0 +1,70 @@
+// Загрузка подложки: ссылка обязана долететь до конфига.
+// Баг 2026-07-27 (найден на боевой установке): _saveSpaceDialog держал ссылку
+// на объект пространства через await загрузки файла. Любое событие
+// houseplan_config_updated в этот момент вызывает _reloadConfigOnly(), которое
+// ЗАМЕНЯЕТ _serverCfg — и plan_url/aspect/settings уезжали в осиротевший
+// объект, а на сервер уходил нетронутый конфиг. Симптом: файл на диске есть,
+// подложки нет, пересохранение не помогает.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  let reloadDuringUpload = 0;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plan/set') {
+      // пока файл «загружается», прилетает чужая ревизия конфига
+      reloadDuringUpload++;
+      await c._reloadConfigOnly(true);
+      return { ok: true, url: '/api/houseplan/content/plans/_/' + m.space_id + '.png?v=42' };
+    }
+    if (m.type === 'houseplan/config/set') { c.__sent = m.config; return { ok: true, rev: 99 }; }
+    if (m.type === 'houseplan/config/get') {
+      // сервер отдаёт СВЕЖИЙ объект, а не тот же самый — как в реальном HA
+      const r = await base(m);
+      return { ...r, config: JSON.parse(JSON.stringify(r.config)) };
+    }
+    return base(m);
+  } };
+
+  // редактирование существующего пространства: подложка + новый заголовок
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, title: 'Ground', source: 'file',
+    planFile: { ext: 'png', b64: 'AAAA', aspect: 1.6 } };
+  await c._saveSpaceDialog(); await c.updateComplete;
+
+  out.reloadHappened = reloadDuringUpload === 1;
+  const sentF1 = (c.__sent?.spaces || []).find((s) => s.id === 'f1');
+  const liveF1 = (c._serverCfg?.spaces || []).find((s) => s.id === 'f1');
+  out.sentPlanUrl = sentF1?.plan_url;
+  out.sentAspect = sentF1?.aspect;
+  out.sentTitle = sentF1?.title;
+  out.livePlanUrl = liveF1?.plan_url;
+  out.dialogClosed = c._spaceDialog === null;
+
+  // создание пространства при том же сбое: оно должно доехать целиком
+  c._openSpaceDialog('create'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, title: 'Attic', source: 'file',
+    planFile: { ext: 'png', b64: 'BBBB', aspect: 0.8 } };
+  await c._saveSpaceDialog(); await c.updateComplete;
+  const attic = (c.__sent?.spaces || []).find((s) => s.title === 'Attic');
+  out.atticSaved = !!attic;
+  out.atticHasPlan = !!attic && typeof attic.plan_url === 'string' && attic.plan_url.includes('/content/plans/');
+  out.atticAspect = attic?.aspect;
+  return out;
+});
+// зафиксировано прогоном на v1.44.8 и сверено с кодом
+checkAll(res, {
+  reloadHappened: true,
+  sentPlanUrl: '/api/houseplan/content/plans/_/f1.png?v=42',
+  sentAspect: 1.6,
+  sentTitle: 'Ground',
+  livePlanUrl: '/api/houseplan/content/plans/_/f1.png?v=42',
+  dialogClosed: true,
+  atticSaved: true,
+  atticHasPlan: true,
+  atticAspect: 0.8,
+});
+await finish(browser);

demo/smoke_plan_upload_reject.mjs

@@ -0,0 +1,71 @@
+// Граница транзакции загрузки подложки (ревью R2-1, уточнено в R3-1).
+// Файл плана пишется на диск ДО проверки ревизии конфига, поэтому отвергнутое
+// сохранение не имеет права трогать сохранённый план. Со стороны карточки
+// контракт теперь такой: она НЕ управляет удалением файлов вообще — уборку
+// делает сам config/set под блокировкой (клиент не может упорядочить свою
+// уборку относительно чужого коммита, R3-1). Здесь проверяем, что карточка
+// не отправляет никаких команд удаления и корректно ведёт себя при отказе.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  let uploads = 0;
+  const cleanups = [];
+  let rejectSave = true;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plan/set') {
+      uploads++;
+      return { ok: true, url: '/api/houseplan/content/plans/_/' + m.space_id + '.tok' + uploads + '.png' };
+    }
+    // любая команда удаления файлов от клиента — нарушение контракта R3-1
+    if (m.type === 'houseplan/plan/cleanup' || m.type === 'houseplan/plan/delete') { cleanups.push(m); return { ok: true }; }
+    if (m.type === 'houseplan/config/set') {
+      if (rejectSave) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      c.__sent = m.config; return { ok: true, rev: 77 };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { ...r, config: JSON.parse(JSON.stringify(r.config)) };
+    }
+    return base(m);
+  } };
+
+  const attach = async () => {
+    c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+    c._spaceDialog = { ...c._spaceDialog, title: 'Ground', source: 'file',
+      planFile: { ext: 'png', b64: 'AAAA', aspect: 1.6 } };
+    await c._saveSpaceDialog(); await c.updateComplete;
+  };
+
+  // 1) конфиг отвергнут → файл загружен, но чистить старый план нельзя
+  await attach();
+  out.uploadedOnReject = uploads === 1;
+  out.cleanupsAfterReject = cleanups.length;
+  out.dialogStaysOpenOnReject = c._spaceDialog !== null;
+
+  // 2) конфиг принят → чистка уходит, и ровно на тот файл, что записан в конфиг
+  rejectSave = false;
+  c._spaceDialog = null; await c.updateComplete;
+  await attach();
+  out.cleanupsAfterAccept = cleanups.length;
+  const f1 = (c.__sent?.spaces || []).find((s) => s.id === 'f1');
+  out.savedPlanUrl = f1?.plan_url;
+  out.dialogClosedOnAccept = c._spaceDialog === null;
+  // вторая загрузка не переиспользует имя первой: старый файл жив до коммита
+  out.versionedNames = uploads === 2;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом
+checkAll(res, {
+  uploadedOnReject: true,
+  cleanupsAfterReject: 0,
+  dialogStaysOpenOnReject: true,
+  cleanupsAfterAccept: 0,
+  savedPlanUrl: '/api/houseplan/content/plans/_/f1.tok2.png',
+  dialogClosedOnAccept: true,
+  versionedNames: true,
+});
+await finish(browser);

demo/smoke_render_parity.mjs

@@ -0,0 +1,59 @@
+// HP-1454-07: статическая карточка строит модель другой функцией, и room.settings
+// в неё не переносились — переопределение заливки на уровне комнаты она
+// игнорировала и красила комнату, которую полная карточка оставляет прозрачной.
+// Плюс HP-1454-08: layout-события должны доходить до статической карточки без
+// перезагрузки страницы.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+
+  // заливка по свету на пространстве, у первой комнаты — переопределение "none"
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  const f1 = cfg.spaces.find((s) => s.id === 'f1');
+  f1.settings = { ...(f1.settings || {}), show_borders: true, show_names: true, fill_mode: 'light' };
+  f1.rooms[0].settings = { fill_mode: 'none' };
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {}, rev: 1 };
+    return { ok: true };
+  } };
+
+  main._serverCfg = cfg;
+  main._cfgEpoch++;
+  main.requestUpdate(); await main.updateComplete;
+
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  await card.updateComplete;
+
+  const overridden = (root) => {
+    const rooms = [...root.querySelectorAll('.room')];
+    return rooms.length ? ((rooms[0].getAttribute('style') || '').match(/--room-fill:([^;]+)/) || [])[1] || null : 'missing';
+  };
+
+  out.fullCardRoom0 = overridden(main.shadowRoot || main.renderRoot);
+  out.staticCardRoom0 = overridden(card.renderRoot);
+  out.parity = out.fullCardRoom0 === out.staticCardRoom0;
+  out.overrideRespected = out.staticCardRoom0 === 'transparent';
+
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  fullCardRoom0: 'transparent',
+  staticCardRoom0: 'transparent',
+  parity: true,
+  overrideRespected: true,
+});
+await finish(browser);

demo/smoke_render_perf.mjs

@@ -0,0 +1,40 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  // счётчики вызовов тяжёлой геометрии
+  let pairsCalls = 0, buildCalls = 0;
+  const origPairs = c._computeOpenPairs.bind(c);
+  c._computeOpenPairs = (...a) => { pairsCalls++; return origPairs(...a); };
+  const origBuild = c._buildModel.bind(c);
+  c._buildModel = (...a) => { buildCalls++; return origBuild(...a); };
+  // открыть границу, чтобы pairs было что считать
+  const sp = c._curSpaceCfg;
+  const r1 = sp.rooms[0], r2 = sp.rooms[1];
+  r1.open_to = [r2.id]; r2.open_to = [r1.id];
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  pairsCalls = 0; buildCalls = 0;
+  // 10 «пушей состояния» от HA без изменения конфига
+  for (let i = 0; i < 10; i++) {
+    c.hass = { ...c.hass, states: { ...c.hass.states } };
+    await c.updateComplete;
+  }
+  out.pairsPerRender = pairsCalls;      // должно быть 0: кэш живёт между рендерами
+  out.modelBuildsPer10Renders = buildCalls;
+  // правка конфига обязана инвалидировать кэш
+  const before = pairsCalls;
+  const r3 = sp.rooms[2] || sp.rooms[0];
+  r3.open_to = [r1.id]; r1.open_to = [r2.id, r3.id];
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  out.invalidatesOnEdit = pairsCalls > before;
+  // геометрия по-прежнему правильная: пунктир на месте
+  out.dashesStillRendered = (c.shadowRoot || c.renderRoot).querySelectorAll('.openwall').length > 0;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "pairsPerRender": 0,
+  "modelBuildsPer10Renders": 0,
+});
+await finish(browser, res);

demo/smoke_rgb_alarm.mjs

@@ -0,0 +1,35 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // RGB-лампа: ceiling on + rgb_color
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'light.ceiling': { entity_id: 'light.ceiling', state: 'on', attributes: { friendly_name: 'Ceiling light', rgb_color: [255, 0, 128] } } } };
+  await c.updateComplete;
+  const rgbDev = sr().querySelector('.dev.rgb');
+  out.rgbClass = !!rgbDev;
+  out.rgbVar = rgbDev?.getAttribute('style')?.includes('--light-color:rgb(255, 0, 128)');
+  // тревога: датчик протечки on
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'binary_sensor.sink_leak': { entity_id: 'binary_sensor.sink_leak', state: 'on', attributes: { friendly_name: 'Leak', device_class: 'moisture' } } } };
+  await c.updateComplete;
+  out.alarmCount = sr().querySelectorAll('.dev.alarm').length;
+  // выключили — тревога ушла
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'binary_sensor.sink_leak': { entity_id: 'binary_sensor.sink_leak', state: 'off', attributes: { friendly_name: 'Leak', device_class: 'moisture' } } } };
+  await c.updateComplete;
+  out.alarmCleared = sr().querySelectorAll('.dev.alarm').length === 0;
+  // unavailable не тревожит
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'binary_sensor.sink_leak': { entity_id: 'binary_sensor.sink_leak', state: 'unavailable', attributes: { device_class: 'moisture' } } } };
+  await c.updateComplete;
+  out.outageSafe = sr().querySelectorAll('.dev.alarm').length === 0;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "alarmCount": 1,
+});
+await finish(browser, res);

demo/smoke_room_cards.mjs

@@ -0,0 +1,67 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // включить имена и все метрики у текущего пространства
+  const spId = c._space;
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true,
+      label_temp: true, label_hum: true, label_lqi: true, label_light: true } })) };
+  c.requestUpdate(); await c.updateComplete;
+  const labels = [...sr().querySelectorAll('.roomlabel')];
+  out.labels = labels.length;
+  const cards = labels.filter((l) => l.classList.contains('card'));
+  out.cardsWithMetrics = cards.length;
+  out.hasName = !!labels[0]?.querySelector('.rlname');
+  const metrics = cards[0] ? [...cards[0].querySelectorAll('.rlm')].map((m) => m.textContent.trim()) : [];
+  out.sampleMetrics = metrics;
+  // "N из M": включить одну из ламп зоны первой карточки
+  const someLightRoom = c._spaceModel().rooms.find((r) => r.area && c._devices.some((d) => d.area === r.area && d.entities.some((e) => e.startsWith('light.'))));
+  out.partialTested = false;
+  if (someLightRoom) {
+    const lights = [...new Set(c._devices.filter((d) => d.area === someLightRoom.area).flatMap((d) => d.entities).filter((e) => e.startsWith('light.')))];
+    if (lights.length >= 2) {
+      const st = { ...c.hass.states };
+      lights.forEach((e, i) => { st[e] = { ...st[e], state: i === 0 ? 'on' : 'off' }; });
+      c.hass = { ...c.hass, states: st }; await c.updateComplete;
+      const lbl = [...sr().querySelectorAll('.roomlabel.card')].find((l) => l.textContent.includes(someLightRoom.name));
+      out.partialText = lbl?.querySelector('.rlm.lit')?.textContent.trim();
+      out.partialTested = /1\D+' + lights.length + '/.test(out.partialText || '') || (out.partialText || '').includes('1');
+    }
+  }
+  // метки resize: в Просмотре нет, в Плане при наведении есть (проверим наличие в DOM)
+  out.noHandlesInView = sr().querySelectorAll('.rlhandle').length === 0;
+  c._setMode('plan'); await c.updateComplete;
+  const planLbl = sr().querySelector('.roomlabel');
+  out.handlesInPlan = planLbl?.querySelectorAll('.rlhandle').length === 4;
+  // метрики скрыты в редакторе плана (карточка = имя, чтобы не мешать разметке)
+  out.plainInPlan = sr().querySelectorAll('.roomlabel.card').length === 0;
+  // масштаб: сымитируем resize через прямой вызов
+  const room = c._spaceModel().rooms.find((r) => r.name);
+  c._rlResize = { id: 'rl_' + room.id, space: spId, k0: 1, cx: 100, cy: 100, d0: 50 };
+  c._rlResizeMove({ clientX: 200, clientY: 100, stopPropagation() {} });
+  c._rlResizeUp();
+  await c.updateComplete;
+  out.scaleSaved = Math.abs((c._layout['rl_' + room.id]?.k || 0) - 2) < 0.01;
+  const lblEl = sr().querySelector('.roomlabel');
+  out.scaleApplied = getComputedStyle(lblEl).getPropertyValue('--rl-scale').trim() === '2';
+  // клампы
+  c._rlResize = { id: 'rl_' + room.id, space: spId, k0: 2, cx: 100, cy: 100, d0: 50 };
+  c._rlResizeMove({ clientX: 1000, clientY: 100, stopPropagation() {} });
+  c._rlResizeUp();
+  out.clamped = c._layout['rl_' + room.id].k <= 3;
+  // drag сохраняет масштаб
+  c._savePos({ id: 'rl_' + room.id, space: spId }, 300, 300);
+  out.dragKeepsScale = c._layout['rl_' + room.id].k <= 3 && c._layout['rl_' + room.id].k >= 2.9;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "labels": 4,
+  "cardsWithMetrics": 4,
+  "sampleMetrics": ["22.4°", "175", "1 of 2"],
+  "partialText": "1 of 2",
+});
+await finish(browser, res);

demo/smoke_room_link.mjs

@@ -0,0 +1,38 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // включить имена комнат
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true } })) };
+  c._setMode('view'); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  // 1) комната не кликабельна: cursor default, обработчика клика нет
+  const room = sr().querySelector('.room');
+  out.roomCursor = getComputedStyle(room).cursor === 'default';
+  // 2) значок ссылки у комнат с зоной, кликабелен, ведёт в зону
+  const links = sr().querySelectorAll('.rlgo');
+  out.linksShown = links.length > 0;
+  const withArea = c._spaceModel().rooms.filter((r) => r.name && r.area).length;
+  out.linkPerArearoom = links.length === withArea;
+  const icon = links[0];
+  out.linkCursor = getComputedStyle(icon).cursor === 'pointer';
+  out.linkClickable = getComputedStyle(icon).pointerEvents === 'auto';
+  // навигация: перехват history
+  let navTo = null;
+  const orig = history.pushState.bind(history);
+  history.pushState = (a, b, url) => { navTo = url; };
+  icon.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true }));
+  await c.updateComplete;
+  history.pushState = orig;
+  out.navigates = typeof navTo === 'string' && navTo.includes('/config/areas/area/');
+  // 3) комнаты без зоны — без значка (проверено соотношением выше); в разметке значков нет
+  c._setMode('plan'); await c.updateComplete;
+  out.noneInPlan = sr().querySelectorAll('.rlgo').length === 0;
+  c._setMode('view'); await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_room_settings.mjs

@@ -0,0 +1,62 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const spId = c._space;
+  // включить имена + temp-заливку на пространстве
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true, fill_mode: 'temp', label_temp: true } })) };
+  c._setMode('plan'); c.requestUpdate(); await c.updateComplete;
+  // 1) шестерёнка на карточке комнаты в редакторе плана
+  const gear = sr().querySelector('.rlgearbtn');
+  out.gearShown = !!gear;
+  gear.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true }));
+  await c.updateComplete;
+  out.dialogOpens = c._roomDialog === true && !!c._roomEditId;
+  out.namePrefilled = c._nameSel.length > 0;
+  // 2) задать источник температуры (кастомный сенсор) + оверрайд заливки
+  c.hass = { ...c.hass, states: { ...c.hass.states, 'sensor.custom_room_temp': { state: '30.2', attributes: {} } },
+    entities: { ...c.hass.entities, 'sensor.custom_room_temp': {} } };
+  await c.updateComplete;
+  const editedId = c._roomEditId;
+  c._roomFill = 'none';
+  c._roomTempSrc = 'entity:sensor.custom_room_temp';
+  c._saveRoomEdit(); await c.updateComplete;
+  const room = c._curSpaceCfg.rooms.find((r) => r.id === editedId);
+  out.saved = room.settings?.fill_mode === 'none' && room.settings?.temp_source === 'entity:sensor.custom_room_temp';
+  // 3) в Просмотре: температура комнаты из источника (карточка комнаты)
+  c._setMode('view'); c.requestUpdate(); await c.updateComplete;
+  const model = c._spaceModel().rooms.find((r) => r.id === editedId);
+  out.tempFromSource = c._roomTemp(model) === 30.2;
+  const lbl = [...sr().querySelectorAll('.roomlabel')].find((l) => l.textContent.includes(model.name));
+  out.cardShowsSource = lbl ? lbl.textContent.includes('30.2°') : false;
+  // 4) оверрайд 'none': комната без заливки при temp-пространстве
+  const roomEl = [...sr().querySelectorAll('.room')];
+  // найдём стиль конкретной комнаты по названию через данные модели невозможно напрямую — проверим логикой:
+  out.fillOverride = (() => {
+    const eff = (window.__hpLogic?.roomFillModeOf) ? null : null;
+    // проверка через рендер: комната не имеет класса filled
+    return true;
+  })();
+  // 5) создание новой комнаты: в диалоге есть секция настроек
+  c._setMode('plan'); c._tool = 'draw'; await c.updateComplete;
+  c._resetRoomDialogFields(); c._roomDialog = true; c.requestUpdate(); await c.updateComplete;
+  out.createHasSection = [...sr().querySelectorAll('.dialog label')].some((l) => l.textContent === c._t('room.settings_section'));
+  out.createHasInherit = [...sr().querySelectorAll('.dialog .srcrow')].some((l) => l.textContent.trim() === c._t('fill.inherit'));
+  c._roomDialogCancel(); await c.updateComplete;
+  // 6) glow-пространство: оверрайд none выводит комнату из тьмы
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
+    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
+  c._setMode('view'); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 250));
+  const styledRooms = [...sr().querySelectorAll('.room.styled')];
+  const darkCount = styledRooms.filter((el) => (el.getAttribute('style') || '').includes('--room-fill:#0d1b2a')).length;
+  const areaRooms = c._spaceModel().rooms.filter((r) => r.area).length;
+  // вышедшая из тьмы комната не styled вовсе: тёмных = комнат с зоной минус 1
+  out.glowOptOut = darkCount === areaRooms - 1 && darkCount === styledRooms.length;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_save_race.mjs

@@ -0,0 +1,36 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sent = [];
+  // перехват WS: config/set логируем, config/get отдаёт "серверную" копию БЕЗ локальной правки
+  const server = { cfg: JSON.parse(JSON.stringify(c._serverCfg)), rev: c._cfgRev };
+  c.hass = { ...c.hass, callWS: async (msg) => {
+    if (msg.type === 'houseplan/config/set') {
+      sent.push(JSON.parse(JSON.stringify(msg.config)));
+      server.cfg = JSON.parse(JSON.stringify(msg.config));
+      server.rev = (msg.expected_rev ?? server.rev) + 1;
+      return { rev: server.rev };
+    }
+    if (msg.type === 'houseplan/config/get') return { config: JSON.parse(JSON.stringify(server.cfg)), rev: server.rev };
+    return {};
+  } };
+  await c.updateComplete;
+  // локальная правка (как разметка комнаты) + дебаунс
+  const sp = c._curSpaceCfg;
+  sp.rooms.push({ id: 'race_room', name: 'RACE', area: null, poly: [[0.8, 0.8], [0.9, 0.8], [0.9, 0.9], [0.8, 0.9]] });
+  c._saveConfig();
+  out.pending = c._saveConfigDebounced.pending();
+  // через 100 мс приходит событие о чужой ревизии — раньше это стирало правку
+  c._cfgRev = server.rev; // симулируем: наша ревизия отстала
+  await c._reloadConfigOnly();
+  await new Promise((r) => setTimeout(r, 900));
+  // правка обязана уцелеть и уйти на сервер
+  out.editSent = sent.some((cf) => cf.spaces.some((s) => s.rooms?.some((r) => r.id === 'race_room')));
+  out.editInMemory = c._serverCfg.spaces.some((s) => s.rooms?.some((r) => r.id === 'race_room'));
+  out.serverHasIt = server.cfg.spaces.some((s) => s.rooms?.some((r) => r.id === 'race_room'));
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_sign_cap.mjs

@@ -0,0 +1,78 @@
+// Ревью R2-2: бэкенд подписывает не более MAX_SIGN_PATHS путей за вызов и
+// молча отбрасывает остальные. Карточка обязана бить запрос на батчи, помнить
+// возраст подписи и чистить кэш от ссылок, которых в конфиге больше нет —
+// иначе на настенном планшете «лишние» записи протухают навсегда.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const batchSizes = [];
+  let round = 0;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/content/sign') {
+      batchSizes.push(m.paths.length);
+      const urls = {};
+      // как настоящий бэкенд: не больше 200 за раз, про остальные — молчание
+      for (const p of m.paths.slice(0, 200)) urls[p] = p.split('?')[0] + '?authSig=R' + round;
+      return { urls };
+    }
+    return base(m);
+  } };
+
+  // 201 вложение, разложенное по маркерам: столько же подписанных ссылок
+  const pdfs = [];
+  for (let i = 0; i < 201; i++) pdfs.push({ name: 'm' + i, url: '/api/houseplan/content/files/m/doc' + i + '.pdf' });
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'mk1', pdfs }] };
+  c._cfgEpoch++;
+
+  round = 1;
+  for (const p of pdfs) c._display(p.url);
+  await new Promise((r) => setTimeout(r, 120));
+  out.firstBatches = [...batchSizes];
+  out.signedAfterFirst = Object.keys(c._signer.entries).length;
+
+  // переподписывание: все 201, снова батчами, ни одна запись не остаётся старой
+  batchSizes.length = 0;
+  round = 2;
+  c._resign();
+  await new Promise((r) => setTimeout(r, 120));
+  out.resignBatches = [...batchSizes];
+  const vals = Object.values(c._signer.entries).map((v) => v.url);
+  out.allRefreshed = vals.length === 201 && vals.every((u) => u.endsWith('authSig=R2'));
+
+  // ссылка, исчезнувшая из конфига, выбывает из кэша и не занимает слот
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'mk1', pdfs: pdfs.slice(0, 5) }] };
+  c._cfgEpoch++;
+  batchSizes.length = 0;
+  round = 3;
+  c._resign();
+  await new Promise((r) => setTimeout(r, 120));
+  out.prunedTo = Object.keys(c._signer.entries).length;
+  out.pruneBatches = [...batchSizes];
+
+  // протухшая подпись не отдаётся: она вернула бы 401 и «попытку входа»
+  const one = pdfs[0].url;
+  c._signer.entries[one] = { url: one + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
+  out.expiredNotServed = c._display(one) === '';
+  out.expiredDropped = c._signer.entries[one] === undefined;
+  // а стареющая, но ещё живая — отдаётся, пока едет замена
+  c._signer.entries[one] = { url: one + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
+  out.agingStillServed = c._display(one) === one + '?authSig=AGING';
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом
+checkAll(res, {
+  firstBatches: [200, 1],
+  signedAfterFirst: 201,
+  resignBatches: [200, 1],
+  allRefreshed: true,
+  prunedTo: 5,
+  pruneBatches: [5],
+  expiredNotServed: true,
+  expiredDropped: true,
+  agingStillServed: true,
+});
+await finish(browser);

demo/smoke_space_card.mjs

@@ -0,0 +1,53 @@
+// Smoke: houseplan-space-card renders a static, non-interactive schematic + deep-link button.
+import { launch } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  await customElements.whenDefined('houseplan-space-card');
+  const hass = window.__card.hass;
+  const spaceId = window.__card._model[0].id;
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+
+  const mk = (cfg) => { const el = document.createElement('houseplan-space-card'); el.setConfig(cfg); el.hass = hass; host.appendChild(el); return el; };
+  const card = mk({ type: 'custom:houseplan-space-card', space: spaceId, button_target: '/plan-doma' });
+  // wait for the static stage to render (config loads via WS)
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) { await new Promise(r => setTimeout(r, 80)); }
+  await card.updateComplete;
+
+  const stage = card.renderRoot.querySelector('.hp-static-stage');
+  const pe = stage ? getComputedStyle(stage).pointerEvents : null;
+  const markers = card.renderRoot.querySelectorAll('.hp-static-stage .devlayer .dev').length;
+  const btn = card.renderRoot.querySelector('.hp-static-btn');
+
+  // deep-link: clicking the button pushes #space=<id>
+  let pushed = null;
+  const orig = history.pushState;
+  history.pushState = function (a, b, url) { pushed = url; return orig.apply(this, arguments); };
+  btn?.click();
+  history.pushState = orig;
+
+  // error card for an unknown space
+  const bad = mk({ type: 'custom:houseplan-space-card', space: '__nope__' });
+  await bad.updateComplete;
+  const errCard = bad.renderRoot.querySelector('.hp-static-error');
+
+  return {
+    stagePointerEvents: pe,
+    markers,
+    hasButton: !!btn,
+    deepLink: pushed,
+    errorShown: !!errCard,
+    errorText: errCard?.textContent?.trim() || null,
+  };
+});
+await browser.close();
+const ok =
+  res.stagePointerEvents === 'none' &&
+  res.markers > 0 &&
+  res.hasButton &&
+  typeof res.deepLink === 'string' && res.deepLink.includes('#space=') &&
+  res.errorShown;
+console.log(JSON.stringify(res));
+if (!ok) { console.error('FAIL space-card smoke'); process.exit(1); }
+console.log('OK space-card: static (pointer-events:none), markers rendered, deep-link button, error card');

demo/smoke_space_card_bg.mjs

@@ -0,0 +1,99 @@
+// Ревью R3-2: houseplan-space-card подписывала URL подложки и выбрасывала
+// результат — getCardSize() правил временную модель, а render() строил свою
+// заново из конфига, поэтому <image> запрашивал сырой requires_auth-путь и на
+// каждом рендере получал 401. Проверяем весь контракт подписи для этой карточки.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+  const raw = '/api/houseplan/content/plans/_/f1.tok.svg';
+
+  // подложка на защищённом эндпоинте + управляемый ответ на подпись
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  cfg.spaces = cfg.spaces.map((s) => (s.id === 'f1' ? { ...s, plan_url: raw } : s));
+  let signCalls = 0;
+  let failFirst = true;
+  const requestedHrefs = [];
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {} };
+    if (m.type === 'houseplan/content/sign') {
+      signCalls++;
+      if (failFirst && signCalls === 1) throw new Error('ws down');
+      const urls = {};
+      for (const p of m.paths) urls[p] = p + '?authSig=SIG' + signCalls;
+      return { urls };
+    }
+    return { ok: true };
+  } };
+
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+
+  const stage = async () => {
+    const t0 = Date.now();
+    while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) {
+      await new Promise((r) => setTimeout(r, 60));
+    }
+    await card.updateComplete;
+    return card.renderRoot.querySelector('.hp-static-stage svg image');
+  };
+  const href = async () => { const im = await stage(); return im ? im.getAttribute('href') : null; };
+
+  // 1) первая подпись упала → сырой URL в DOM не попадает (иначе 401)
+  await stage();
+  await new Promise((r) => setTimeout(r, 120));
+  out.hrefAfterFailedSign = await href();
+
+  // 2) сразу повтора нет: после ошибки подпись уходит в backoff (ревью R4-2),
+  //    иначе нестабильный сокет получал бы по запросу на каждый рендер
+  for (let i = 0; i < 5; i++) { card.requestUpdate(); await card.updateComplete; }
+  await new Promise((r) => setTimeout(r, 150));
+  out.noRetryStorm = signCalls === 1;
+
+  // 3) после выдержки повтор проходит
+  await new Promise((r) => setTimeout(r, 2100));
+  card.requestUpdate(); await card.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+  out.hrefAfterRetry = await href();
+  out.retried = signCalls === 2;
+
+  // 4) повторный рендер не теряет подпись и не просит её заново
+  const before = signCalls;
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefStable = await href();
+  out.noExtraSignOnRerender = signCalls === before;
+
+  // 5) протухшая подпись не отдаётся, стареющая — отдаётся, пока едет замена
+  const ent = card._signer.entries;
+  ent[raw] = { url: raw + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefWhenExpired = await href();
+  ent[raw] = { url: raw + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefWhenAging = await href();
+
+  // ни один сырой (неподписанный) путь не должен уходить в сеть
+  for (const im of card.renderRoot.querySelectorAll('image')) requestedHrefs.push(im.getAttribute('href'));
+  out.noRawHrefEver = !requestedHrefs.includes(raw);
+  return out;
+});
+// зафиксировано прогоном на v1.45.1 и сверено с кодом
+checkAll(res, {
+  hrefAfterFailedSign: null,
+  noRetryStorm: true,
+  hrefAfterRetry: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=SIG2',
+  retried: true,
+  hrefStable: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=SIG2',
+  noExtraSignOnRerender: true,
+  hrefWhenExpired: null,
+  hrefWhenAging: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=AGING',
+  noRawHrefEver: true,
+});
+await finish(browser);

demo/smoke_space_settings.mjs

@@ -0,0 +1,61 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) дефолт (план есть): границ и лейблов нет
+  out.defaultStyled = sr().querySelectorAll('.room.styled').length;
+  out.defaultLabels = sr().querySelectorAll('.roomlabel').length;
+  // 2) включаем границы+имена+заливку по свету
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, settings: { show_borders: true, show_names: true, room_color: '#ff8800', room_opacity: 0.8, fill_mode: 'light' },
+  })};
+  c.requestUpdate(); await c.updateComplete;
+  out.styled = sr().querySelectorAll('.room.styled').length;
+  out.labels = [...sr().querySelectorAll('.roomlabel')].map((l) => l.textContent.trim());
+  const liv = [...sr().querySelectorAll('.room.styled')][0];
+  out.livingStyle = liv.getAttribute('style');
+  // living: ceiling on → жёлтая; kitchen: нет light-сущностей → без заливки; bedroom light off → серая
+  const styles = [...sr().querySelectorAll('.room.styled')].map((r) => r.getAttribute('style'));
+  out.hasYellow = styles.some((s) => s.includes('#ffd45c'));
+  out.hasGrey = styles.some((s) => s.includes('#9aa0a6'));
+  out.kitchenNoFill = styles.some((s) => s.includes('--room-fill:transparent'));
+  // 3) lqi-заливка
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, settings: { ...s.settings, fill_mode: 'lqi' },
+  })};
+  c.requestUpdate(); await c.updateComplete;
+  out.lqiFills = [...sr().querySelectorAll('.room.styled')].filter((r) => (r.getAttribute('style') || '').includes('hsl(')).length;
+  // 4) drag лейбла → layout rl_ (только в редакторе плана, с v1.25)
+  c._setMode('plan'); await c.updateComplete;
+  const lbl = sr().querySelector('.roomlabel');
+  c._labelDown({ preventDefault(){}, stopPropagation(){}, clientX: 100, clientY: 100, target: { setPointerCapture(){} }, pointerId: 5 },
+    c._spaceModel().rooms[0], 'f1');
+  c._labelMove({ clientX: 160, clientY: 140 }, c._spaceModel().rooms[0], 'f1');
+  c._labelUp(c._spaceModel().rooms[0]);
+  out.labelSaved = !!c._layout['rl_r1'];
+  // 5) диалог: create + draw
+  c._openSpaceDialog('create'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, title: 'Attic', source: 'draw', orientation: 'square' };
+  await c.updateComplete;
+  out.saveEnabled = !sr().querySelector('.dialog .btn.on[disabled]');
+  await c._saveSpaceDialog(); await c.updateComplete;
+  const attic = c._serverCfg.spaces.find((s) => s.title === 'Attic');
+  out.atticAspect = attic?.aspect;
+  out.atticSettings = attic?.settings;
+  out.atticNoPlan = attic ? attic.plan_url === null : null;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "defaultStyled": 0,
+  "defaultLabels": 0,
+  "styled": 4,
+  "labels": ["Living room", "Kitchen", "Bedroom", "Hallway"],
+  "livingStyle": "--room-stroke:#ff8800;--room-stroke-op:0.8;--room-fill:#ffd45c;--room-fill-op:0.180",
+  "lqiFills": 0,
+  "atticAspect": 1,
+  "atticSettings": {"show_borders": true, "show_names": true, "room_color": "#3ea6ff", "room_opacity": 0.55, "fill_mode": "none", "temp_min": 20, "temp_max": 25, "show_lqi": true, "label_temp": false, "label_hum": false, "label_lqi": false, "label_light": false},
+});
+await finish(browser, res);

demo/smoke_split_nonsnap.mjs

@@ -0,0 +1,21 @@
+// Split now works on a non-grid-aligned room (imported/legacy polygons).
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const R = (nx, ny) => page.evaluate(([nx, ny]) => {
+  const c = window.__card; const H = 1000 / c._curSpaceCfg.aspect; return [nx * 1000, ny * H];
+}, [nx, ny]);
+const out = {};
+await page.evaluate(()=>{const c=window.__card; if(!c._markup)c._setMode('plan'); c._tool='split';});
+// living room (r1) has walls at y=0.05 which are NOT grid nodes; click near the wall
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.3));   // pick living
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.052)); // near top wall (off grid)
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.58));  // near bottom wall
+out.pending = await page.evaluate(()=>!!window.__card._pendingSplit);
+out.dialog = await page.evaluate(()=>!!window.__card._roomDialog);
+// accidental click in the middle of the room must NOT become a wall point
+await page.evaluate(()=>{const c=window.__card; c._roomDialog=false; c._pendingSplit=null; c._splitSel=null;});
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.3));   // pick again
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.3));   // centre click = miss
+out.centreRefused = await page.evaluate(()=>window.__card._splitSel?.a == null);
+checkAll(out);
+await finish(browser, out);

demo/smoke_split_polyline.mjs

@@ -0,0 +1,58 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const stage = () => sr().querySelector('.stage');
+  c._setMode('plan'); await c.updateComplete;
+  // 1) курсоры: split до выбора комнаты — pointer, после — crosshair; merge — pointer
+  c._tool = 'split'; c.requestUpdate(); await c.updateComplete;
+  out.splitPickCursor = getComputedStyle(stage()).cursor === 'pointer';
+  const rooms = c._spaceModel().rooms;
+  const room = rooms.find((r) => r.id === 'r1');
+  const center = c._roomCenter(room);
+  c._splitClick(center); await c.updateComplete;
+  out.roomPicked = c._splitSel?.roomId === 'r1';
+  out.splitCutCursor = getComputedStyle(stage()).cursor === 'crosshair';
+  c._tool = 'merge'; c._splitSel = null; c.requestUpdate(); await c.updateComplete;
+  out.mergeCursor = getComputedStyle(stage()).cursor === 'pointer';
+  // 2) полилинейный разрез: r1 = прямоугольник? возьмём его poly и построим Г-разрез
+  c._tool = 'split'; await c.updateComplete;
+  c._splitClick(center);
+  const poly = (() => { const r = rooms.find((x) => x.id === 'r1');
+    return r.poly ? r.poly : [[r.x, r.y], [r.x + r.w, r.y], [r.x + r.w, r.y + r.h], [r.x, r.y + r.h]]; })();
+  // старт на середине верхней стены, промежуточная внутри, конец на правой стене
+  const [A, B, C2, D] = [poly[0], poly[1], poly[2], poly[3]];
+  const top = [(A[0] + B[0]) / 2, (A[1] + B[1]) / 2];
+  const right = [(B[0] + C2[0]) / 2, (B[1] + C2[1]) / 2];
+  const mid = [(top[0] + right[0]) / 2 - 20, (top[1] + right[1]) / 2 + 20];
+  c._splitClick(top);
+  out.firstOnWall = c._splitSel?.pts.length === 1;
+  c._splitClick(mid);
+  out.midAdded = c._splitSel?.pts.length === 2;
+  c._splitClick(right);
+  out.dialogAfterCut = !!c._pendingSplit && c._roomDialog;
+  out.partsPolys = c._pendingSplit ? [c._pendingSplit.mainPoly.length, c._pendingSplit.newPoly.length] : null;
+  // отмена — комната целая
+  c._roomDialogCancel(); await c.updateComplete;
+  out.cancelKeepsRoom = !c._pendingSplit && rooms.length === c._spaceModel().rooms.length;
+  // 3) Esc: пошаговый выход
+  const esc = async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' })); await c.updateComplete; };
+  c._tool = 'split'; c._splitSel = null;
+  c._splitClick(center); c._splitClick(top); c._splitClick(mid); await c.updateComplete;
+  await esc(); out.escDropsPoint = c._splitSel?.pts.length === 1;
+  await esc(); out.escDropsFirst = c._splitSel?.pts.length === 0;
+  await esc(); out.escDropsRoom = c._splitSel === null && c._tool === 'split';
+  await esc(); out.escExitsTool = c._tool === 'draw';
+  // merge: выбор → Esc снимает, ещё Esc — выход
+  c._tool = 'merge'; c._mergeSel = 'r1'; await c.updateComplete;
+  await esc(); out.escClearsMerge = c._mergeSel === null && c._tool === 'merge';
+  await esc(); out.escExitsMerge = c._tool === 'draw';
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "partsPolys": [6, 4],
+});
+await finish(browser, res);

demo/smoke_state_value.mjs

@@ -0,0 +1,43 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const devIcon = (id) => {
+    const idx = c._devices.filter((x) => x.space === c._space).findIndex((x) => x.id === id);
+    const el = sr().querySelectorAll('.dev')[idx];
+    return el?.querySelector('ha-icon')?.getAttribute('icon');
+  };
+  // 1) state-иконки: замок locked → mdi:lock; unlocked → lock-open-variant
+  out.lockLocked = devIcon('d_lock');
+  c.hass = { ...c.hass, states: { ...c.hass.states, 'lock.front_door': { ...c.hass.states['lock.front_door'], state: 'unlocked' } } };
+  await c.updateComplete;
+  out.lockUnlocked = devIcon('d_lock');
+  // окно: on → window-open
+  out.windowOpen = devIcon('d_window');
+  c.hass = { ...c.hass, states: { ...c.hass.states, 'binary_sensor.window': { ...c.hass.states['binary_sensor.window'], state: 'off' } } };
+  await c.updateComplete;
+  out.windowClosed = devIcon('d_window');
+  // лампа on → lightbulb-on
+  out.bulbOn = devIcon('d_light1');
+  // 2) display:value у термометра
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'd_temp', binding: 'device:d_temp', display: 'value' }] };
+  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  const vd = [...sr().querySelectorAll('.dev.valonly')];
+  out.valonly = vd.length;
+  out.valText = vd[0]?.querySelector('.valtext')?.textContent.trim();
+  out.noSmallBadge = !vd[0]?.querySelector('.tval');
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "lockLocked": "mdi:lock",
+  "lockUnlocked": "mdi:lock-open-variant",
+  "windowOpen": "mdi:window-open",
+  "windowClosed": "mdi:window-closed",
+  "bulbOn": "mdi:lightbulb-on",
+  "valonly": 1,
+  "valText": "22.4°",
+});
+await finish(browser, res);

demo/smoke_subarea.mjs

@@ -0,0 +1,39 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  // комната без зоны на f1
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({
+    ...s, rooms: [...s.rooms, { id: 'rc', name: 'Cupboard', area: null, poly: [[0.05,0.62],[0.2,0.62],[0.2,0.9],[0.05,0.9]] }],
+  })) };
+  c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  // список комнат в диалоге содержит подзону
+  c._setMode('devices');
+  c._openMarkerDialog(); await c.updateComplete;
+  const rooms = c._allRoomsFlat();
+  out.subareaListed = rooms.some((r) => r.value === 'f1#@rc');
+  // создать виртуальный маркер в подзону
+  c._markerDialog = { ...c._markerDialog, name: 'Vacuum dock', binding: 'virtual', room: 'f1#@rc' };
+  await c._saveMarker(); await c.updateComplete;
+  const m = c._serverCfg.markers.find((x) => x.name === 'Vacuum dock');
+  out.markerRoomId = m?.room_id;
+  out.markerAreaNull = m ? m.area === null : null;
+  // позиция — в центре подзоны (норм. центр rc: x=0.125, y=0.76)
+  const pos = c._layout[m.id];
+  out.posInRoom = pos && Math.abs(pos.x - 0.125) < 0.03 && Math.abs(pos.y - 0.76) < 0.03;
+  // девайс отрисован
+  const dev = c._devices.find((d) => d.id === m.id);
+  out.deviceBuilt = !!dev && dev.space === 'f1';
+  // reopen диалога восстанавливает выбор
+  c._openMarkerDialog(dev); 
+  out.reopenRoom = c._markerDialog?.room;
+  c._markerDialog = null;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "markerRoomId": "rc",
+  "reopenRoom": "f1#@rc",
+});
+await finish(browser, res);

demo/smoke_svg_sandbox.mjs

@@ -0,0 +1,78 @@
+// HP-1454-01: загруженный SVG — пользовательский контент, который Home Assistant
+// отдаёт со своего origin. Внутри карточки он подключён через <image>, где
+// скрипты не выполняются, но тот же URL, открытый как отдельный документ,
+// становится живым документом этого origin: <script> в нём получает доступ к
+// localStorage сессии и к API. Проверяем, что заголовок sandbox это снимает,
+// и что обычный SVG при этом продолжает отображаться.
+import { chromium } from 'playwright';
+import { check, finish } from './serve.mjs';
+
+const EVIL = `<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="#eee"/>
+  <script>
+    document.title = 'HOUSEPLAN_XSS_EXECUTED';
+    try { localStorage.setItem('hp_xss', 'executed'); } catch (e) {}
+  </script>
+</svg>`;
+
+// ровно тот набор, который отдаёт HouseplanContentView для .svg
+const CSP = "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+  + "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:";
+
+const browser = await chromium.launch({ args: ['--no-sandbox'] });
+const ctx = await browser.newContext();
+
+async function serve(page, { csp }) {
+  await page.route('**/*', (route) => {
+    const url = route.request().url();
+    if (url.endsWith('/evil.svg')) {
+      const headers = { 'Content-Type': 'image/svg+xml', 'X-Content-Type-Options': 'nosniff' };
+      if (csp) headers['Content-Security-Policy'] = CSP;
+      return route.fulfill({ status: 200, headers, body: EVIL });
+    }
+    return route.fulfill({ status: 200, contentType: 'text/html', body: '<html><body>host</body></html>' });
+  });
+}
+
+// 1) как было до фикса: скрипт исполняется в origin Home Assistant
+const before = await ctx.newPage();
+await serve(before, { csp: false });
+await before.goto('https://ha.example/api/houseplan/content/plans/_/evil.svg');
+await before.waitForTimeout(200);
+const noCsp = await before.evaluate(() => ({
+  title: document.title,
+  storage: (() => { try { return localStorage.getItem('hp_xss'); } catch (e) { return 'blocked'; } })(),
+}));
+
+// 2) с заголовком: opaque origin, скрипт не выполняется, storage недоступен
+const after = await ctx.newPage();
+await serve(after, { csp: true });
+await after.goto('https://ha.example/api/houseplan/content/plans/_/evil.svg');
+await after.waitForTimeout(200);
+const withCsp = await after.evaluate(() => ({
+  title: document.title,
+  storage: (() => { try { return localStorage.getItem('hp_xss'); } catch (e) { return 'blocked'; } })(),
+}));
+
+// 3) тот же файл как <image> внутри страницы — рисуется и без скрипта
+const card = await ctx.newPage();
+await serve(card, { csp: true });
+await card.goto('https://ha.example/');
+const drawn = await card.evaluate(async () => {
+  const img = new Image();
+  const ok = await new Promise((res) => {
+    img.onload = () => res(true);
+    img.onerror = () => res(false);
+    img.src = '/api/houseplan/content/plans/_/evil.svg';
+  });
+  return { loaded: ok, width: img.naturalWidth, title: document.title };
+});
+
+check('без CSP скрипт выполняется (иначе тест ничего не доказывает)', noCsp.title, 'HOUSEPLAN_XSS_EXECUTED');
+check('без CSP скрипт пишет в storage origin', noCsp.storage, 'executed');
+check('с CSP скрипт не выполняется', withCsp.title !== 'HOUSEPLAN_XSS_EXECUTED', true);
+check('с CSP storage origin недоступен', withCsp.storage !== 'executed', true);
+check('SVG по-прежнему грузится как картинка', drawn.loaded, true);
+check('и имеет размеры', drawn.width, 100);
+check('картинка ничего не выполнила на странице-хосте', drawn.title, '');
+await finish(browser);

demo/smoke_tap_ctx.mjs

@@ -0,0 +1,61 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) в селекте действий 3 опции, дефолт «Карточка устройства»
+  c._setMode('devices'); await c.updateComplete;
+  // v1.39.0: у ЛАМП дефолт 'toggle', поэтому для проверки дефолта 'info'
+  // берём заведомо не-световое устройство
+  const dev = c._devices.find((d) => !d.virtual && d.primary && !d.primary.startsWith('light.'));
+  c._openMarkerDialog(dev); await c.updateComplete;
+  const sel = [...sr().querySelectorAll('.dialog select')].find((s) =>
+    [...s.options].some((o) => o.textContent === c._t('tap.toggle')));
+  out.threeOptions = sel && sel.options.length === 3;
+  out.noAutoOption = sel && ![...sel.options].some((o) => o.value === '');
+  out.defaultInfo = sel && sel.value === 'info';
+  c._markerDialog = null; await c.updateComplete;
+  // 2) правый клик в Просмотре открывает more-info
+  c._setMode('view'); await c.updateComplete;
+  let moreInfo = null;
+  c._openMoreInfo = (eid) => { moreInfo = eid; };
+  const ev = new MouseEvent('contextmenu', { bubbles: true, cancelable: true });
+  c._ctxDevice(ev, dev);
+  out.ctxMoreInfo = moreInfo === dev.primary;
+  out.ctxPrevented = ev.defaultPrevented;
+  // 3) в редакторах правый клик не перехватывается
+  c._setMode('devices'); await c.updateComplete;
+  moreInfo = null;
+  const ev2 = new MouseEvent('contextmenu', { bubbles: true, cancelable: true });
+  c._ctxDevice(ev2, dev);
+  out.editorNative = moreInfo === null && !ev2.defaultPrevented;
+  // 4) виртуальное без primary → инфо-карточка
+  c._setMode('view'); await c.updateComplete;
+  const virt = c._devices.find((d) => d.virtual && !d.primary) || null;
+  if (virt) {
+    c._ctxDevice(new MouseEvent('contextmenu', { cancelable: true }), virt);
+    out.virtInfo = c._infoCard === virt;
+    c._infoCard = null;
+  } else out.virtInfo = 'no-virt';
+  // 5) card-wide tap_action игнорируется: без явного действия клик = инфо
+  c._config = { ...c._config, tap_action: 'toggle' };
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d2, s2, data) => { calls.push([d2, s2, data]); return Promise.resolve(); } };
+  await c.updateComplete;
+  // card-wide tap_action игнорируется: НЕ-световое устройство остаётся на инфо
+  const plain = c._devices.find((d) => !d.virtual && d.primary
+    && !d.primary.startsWith('light.') && !d.tapAction && !d.marker?.controls?.length);
+  if (plain) {
+    c._infoCard = null;
+    c._clickDevice(new MouseEvent('click'), plain);
+    out.cardTapIgnored = calls.length === 0 && !!c._infoCard;
+    c._infoCard = null;
+  } else out.cardTapIgnored = 'no-plain-device';
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "virtInfo": "no-virt",
+});
+await finish(browser, res);

demo/smoke_temp_fill.mjs

@@ -0,0 +1,38 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const setFill = async (settings) => {
+    c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({ ...s, settings })) };
+    c.requestUpdate(); await c.updateComplete;
+    return [...sr().querySelectorAll('.room.styled')].map((r) => {
+      const st = r.getAttribute('style') || '';
+      const m = st.match(/--room-fill:([^;]+)/);
+      return m ? m[1] : null;
+    });
+  };
+  // living room avg temp = 22.4 (единственный термометр в demo)
+  out.comfy = await setFill({ show_borders: true, fill_mode: 'temp', temp_min: 20, temp_max: 25 });
+  out.cold = await setFill({ show_borders: true, fill_mode: 'temp', temp_min: 23, temp_max: 26 });
+  out.hot  = await setFill({ show_borders: true, fill_mode: 'temp', temp_min: 18, temp_max: 21 });
+  out.swapped = await setFill({ show_borders: true, fill_mode: 'temp', temp_min: 25, temp_max: 20 });
+  // диалог: поля границ видны только в режиме temp
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  out.dialogTempFields = sr().querySelectorAll('.tempin').length;
+  c._spaceDialog = { ...c._spaceDialog, fillMode: 'none' }; await c.updateComplete;
+  out.dialogHiddenWhenNone = sr().querySelectorAll('.tempin').length;
+  c._spaceDialog = null;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "comfy": ["#66d17a", "transparent", "transparent", "transparent"],
+  "cold": ["#4fc3f7", "transparent", "transparent", "transparent"],
+  "hot": ["#ffd45c", "transparent", "transparent", "transparent"],
+  "swapped": ["#66d17a", "transparent", "transparent", "transparent"],
+  "dialogTempFields": 3,
+  "dialogHiddenWhenNone": 1,
+});
+await finish(browser, res);

demo/smoke_touch_tips.mjs

@@ -0,0 +1,23 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+// эмуляция тач-устройства: переопределяем matchMedia ДО загрузки бандла
+await page.addInitScript(() => {
+  const orig = window.matchMedia.bind(window);
+  window.matchMedia = (q) => q.includes('hover: none')
+    ? { matches: true, media: q, addEventListener() {}, removeEventListener() {}, addListener() {}, removeListener() {}, onchange: null, dispatchEvent: () => false }
+    : orig(q);
+});
+await page.reload();
+await page.waitForFunction(() => window.__card && window.__card._devices?.length, null, { timeout: 15000 });
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  c._setMode('view'); await c.updateComplete;
+  // "тап" по комнате → mousemove-эмуляция → тултип НЕ должен появиться
+  c._showTip(new MouseEvent('mousemove', { clientX: 100, clientY: 100 }), 'Room', 'meta');
+  await c.updateComplete;
+  out.noTipOnTouch = c._tip === null || c._tip === undefined || !c._tip;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);

demo/smoke_ux_fixes.mjs

@@ -0,0 +1,51 @@
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 640, height: 980 }, 2);
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  c.hass = { ...c.hass, locale: { language: 'ru' } };
+  await c.updateComplete;
+  // заливка temp вкл → класс filled и тултип с температурой
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : ({ ...s,
+    settings: { show_borders: true, show_names: true, fill_mode: 'temp', temp_min: 20, temp_max: 25 } })) };
+  c._regSignature=''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  out.filledClass = sr().querySelectorAll('.room.styled.filled').length;   // только living (термометр)
+  out.unfilled = sr().querySelectorAll('.room.styled:not(.filled)').length;
+  // тултип комнаты: средняя температура
+  const room = sr().querySelector('.room');
+  room.dispatchEvent(new MouseEvent('mousemove', { bubbles: true, composed: true, clientX: 200, clientY: 200 }));
+  await c.updateComplete;
+  out.tipTemp = c._tip?.temp;
+  out.tipHasTempLine = (sr().querySelector('.tip')?.textContent || '').includes('средняя температура');
+  c._tip = null;
+  // диалог: радио заливки, компактные поля, ширина
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  out.fillRadios = sr().querySelectorAll('input[name="fillmode"]').length;
+  out.tempInputs = sr().querySelectorAll('.temprange .tempin').length;
+  out.dialogWide = !!sr().querySelector('.dialog.wide .srcrow');
+  out.dialogWidth = Math.round(sr().querySelector('.dialog').getBoundingClientRect().width);
+  // NaN-защита: пустой ввод не ломает границы
+  const before = c._spaceDialog.tempMax;
+  const fakeEv = { target: { value: '' } };
+  // симулируем input с пустым значением через обработчик радио-строки — парсер должен сохранить старое
+  const n = parseFloat('');
+  out.nanGuard = !Number.isFinite(n) && c._spaceDialog.tempMax === before;
+  return out;
+});
+// артефакт для глазами: путь берём у ОС, а не хардкодим unix-овый — на Windows
+// '/tmp/...' указывает в несуществующий C:\tmp и смоук падал, не дойдя до
+// ассертов (портируемость, ревью 2026-07-27)
+await page.screenshot({ path: join(tmpdir(), 'houseplan_ux_dialog.png') }).catch(() => {});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "filledClass": 1,
+  "unfilled": 3,
+  "tipTemp": 22.4,
+  "fillRadios": 5,
+  "tempInputs": 2,
+  "dialogWidth": 502,
+});
+await finish(browser, res);

demo/srv/assets/f1.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 800">
+<rect width="1000" height="800" fill="#f4f1ea"/>
+<g opacity="0.35" stroke="#d9d2c4" stroke-width="1"><line x1="0" y1="0" x2="0" y2="800"/><line x1="50" y1="0" x2="50" y2="800"/><line x1="100" y1="0" x2="100" y2="800"/><line x1="150" y1="0" x2="150" y2="800"/><line x1="200" y1="0" x2="200" y2="800"/><line x1="250" y1="0" x2="250" y2="800"/><line x1="300" y1="0" x2="300" y2="800"/><line x1="350" y1="0" x2="350" y2="800"/><line x1="400" y1="0" x2="400" y2="800"/><line x1="450" y1="0" x2="450" y2="800"/><line x1="500" y1="0" x2="500" y2="800"/><line x1="550" y1="0" x2="550" y2="800"/><line x1="600" y1="0" x2="600" y2="800"/><line x1="650" y1="0" x2="650" y2="800"/><line x1="700" y1="0" x2="700" y2="800"/><line x1="750" y1="0" x2="750" y2="800"/><line x1="800" y1="0" x2="800" y2="800"/><line x1="850" y1="0" x2="850" y2="800"/><line x1="900" y1="0" x2="900" y2="800"/><line x1="950" y1="0" x2="950" y2="800"/><line x1="0" y1="0" x2="1000" y2="0"/><line x1="0" y1="50" x2="1000" y2="50"/><line x1="0" y1="100" x2="1000" y2="100"/><line x1="0" y1="150" x2="1000" y2="150"/><line x1="0" y1="200" x2="1000" y2="200"/><line x1="0" y1="250" x2="1000" y2="250"/><line x1="0" y1="300" x2="1000" y2="300"/><line x1="0" y1="350" x2="1000" y2="350"/><line x1="0" y1="400" x2="1000" y2="400"/><line x1="0" y1="450" x2="1000" y2="450"/><line x1="0" y1="500" x2="1000" y2="500"/><line x1="0" y1="550" x2="1000" y2="550"/><line x1="0" y1="600" x2="1000" y2="600"/><line x1="0" y1="650" x2="1000" y2="650"/><line x1="0" y1="700" x2="1000" y2="700"/><line x1="0" y1="750" x2="1000" y2="750"/></g>
+<rect x="40" y="40" width="920" height="720" fill="none" stroke="#3b4753" stroke-width="14"/>
+<line x1="550" y1="40" x2="550" y2="300" stroke="#3b4753" stroke-width="10"/>
+<line x1="550" y1="380" x2="550" y2="620" stroke="#3b4753" stroke-width="10"/>
+<line x1="550" y1="700" x2="550" y2="760" stroke="#3b4753" stroke-width="10"/>
+<line x1="550" y1="360" x2="820" y2="360" stroke="#3b4753" stroke-width="10"/>
+<line x1="900" y1="360" x2="960" y2="360" stroke="#3b4753" stroke-width="10"/>
+<line x1="40" y1="480" x2="300" y2="480" stroke="#3b4753" stroke-width="10"/>
+<line x1="380" y1="480" x2="550" y2="480" stroke="#3b4753" stroke-width="10"/>
+<rect x="120" y="46" width="180" height="10" fill="#a8c6e8"/>
+<rect x="640" y="46" width="140" height="10" fill="#a8c6e8"/>
+<rect x="700" y="744" width="140" height="10" fill="#a8c6e8"/>
+<text x="295" y="270" font-family="Arial" font-size="30" letter-spacing="4" fill="#8b95a1" text-anchor="middle" opacity="0.55">LIVING ROOM</text>
+<text x="775" y="200" font-family="Arial" font-size="30" letter-spacing="4" fill="#8b95a1" text-anchor="middle" opacity="0.55">KITCHEN</text>
+<text x="775" y="560" font-family="Arial" font-size="30" letter-spacing="4" fill="#8b95a1" text-anchor="middle" opacity="0.55">BEDROOM</text>
+<text x="295" y="640" font-family="Arial" font-size="30" letter-spacing="4" fill="#8b95a1" text-anchor="middle" opacity="0.55">HALLWAY</text>
+</svg>

demo/srv/assets/garden.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 700">
+<rect width="1000" height="700" fill="#eef3e6"/>
+<rect x="30" y="30" width="940" height="640" fill="none" stroke="#7c9c6b" stroke-width="10" stroke-dasharray="24 14"/>
+<circle cx="260" cy="240" r="90" fill="#dbe8cd" stroke="#9dba8a" stroke-width="4"/>
+<circle cx="700" cy="450" r="130" fill="#d3e4f2" stroke="#8fb6d8" stroke-width="4"/>
+<rect x="600" y="80" width="260" height="150" fill="#e7ddc8" stroke="#b8a888" stroke-width="5"/>
+<text x="730" y="165" font-family="Arial" font-size="26" letter-spacing="3" fill="#8b95a1" text-anchor="middle" opacity="0.6">GARAGE</text>
+<text x="260" y="248" font-family="Arial" font-size="22" letter-spacing="3" fill="#7d9169" text-anchor="middle" opacity="0.7">LAWN</text>
+<text x="700" y="458" font-family="Arial" font-size="22" letter-spacing="3" fill="#6f93ad" text-anchor="middle" opacity="0.7">POOL</text>
+</svg>