v1.54.2

v1.54.2: HP-1541-01 — vacuum selected_map fallback obeys the not-nullish map-id contract
The v1.54.1 contract (first not-None value wins, zero is a value) covered the source entity but not the card's fallback on the vacuum's own selected_map: _vacMapId still used truthiness, so selected_map: 0 became 'default' on the frontend while trails.py resolve_map_id stored the run under '0'. Calibration and server trails split across two keys and the recorded run never rendered after reload. The fallback is now the shared pure helper vacMapIdWithFallback (nullish check), mirroring resolve_map_id. Cross-runtime regressions added for selected_map = 0, '0' and '' on both sides; the frontend cases fail on the old truthiness code.
2026-09-29 19:28:46 +00:00 · 2026-07-31 13:47:22 +03:00 · 2026-07-31 13:44:10 +03:00 · 2026-07-31 13:15:12 +03:00 · 2026-07-31 13:12:14 +03:00 · 2026-07-31 13:07:37 +03:00
146 changed files with 17126 additions and 1370 deletions
@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 💬 Telegram chat (@ha_houseplan)
+    url: https://t.me/ha_houseplan
+    about: Questions, setup help, ideas and screenshots — the fastest way to get an answer.
+  - name: 💡 GitHub discussions
+    url: https://github.com/Matysh/houseplan-card/discussions
+    about: Longer-form ideas and show-and-tell.
@@ -34,6 +34,44 @@ jobs:
        run: npm run build
      - name: Card bundle in sync with integration
        run: cmp dist/houseplan-card.js custom_components/houseplan/frontend/houseplan-card.js
+  smoke:
+    # audit T2: the end-to-end layer used to run only when a human remembered.
+    # Gated on `frontend` so a typecheck failure does not burn browser minutes.
+    needs: frontend
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm ci
+      - name: Install Chromium for Playwright
+        run: npx playwright install --with-deps chromium
+      - name: Build a FRESH bundle for the smokes
+        # the committed demo/srv/assets copy is a snapshot; testing it would
+        # report green about code that no longer exists (audit T2)
+        run: npm run build && cp dist/houseplan-card.js demo/srv/assets/houseplan-card.js
+      - name: Smoke suite
+        run: |
+          fail=0
+          mkdir -p /tmp/smoke-logs
+          for f in demo/smoke_*.mjs; do
+            name=$(basename "$f" .mjs)
+            if node "$f" > "/tmp/smoke-logs/$name.log" 2>&1; then
+              echo "ok   $name"
+            else
+              echo "FAIL $name"
+              tail -20 "/tmp/smoke-logs/$name.log"
+              fail=1
+            fi
+          done
+          exit $fail
+      - name: Upload smoke logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-logs
+          path: /tmp/smoke-logs
+
  backend:
    runs-on: ubuntu-latest
    steps:
@@ -3,6 +3,19 @@
 Thanks for your interest! The project is one HACS package: a storage **integration**
 (`custom_components/houseplan/`, Python) and a **Lovelace card** (`src/`, TypeScript + Lit).

+## Changelog
+
+User-visible changes go into **both** changelogs in the same commit:
+`docs/CHANGELOG.md` (English) and `docs/CHANGELOG.ru.md` (Russian). Entries
+older than v1.42.0 exist only in the English file — no need to backfill them.
+
+## Where to ask
+
+Not sure whether something is a bug, or just want to discuss an idea before
+writing code? The **[Telegram chat @ha_houseplan](https://t.me/ha_houseplan)**
+is the quickest route to the author and other users. Bugs and concrete feature
+requests still belong in [issues](https://github.com/Matysh/houseplan-card/issues).
+
 ## Five-minute setup

 ```bash
@@ -5,6 +5,8 @@
 [![GitHub stars](https://img.shields.io/github/stars/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/stargazers)
 [![CI](https://github.com/Matysh/houseplan-card/actions/workflows/validate.yml/badge.svg)](https://github.com/Matysh/houseplan-card/actions)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Live demo](https://img.shields.io/badge/demo-try_it_live-00c853?logo=homeassistant&logoColor=white)](https://demo.houseplan.tech)
+[![Telegram chat](https://img.shields.io/badge/Telegram-chat-2CA5E0?logo=telegram&logoColor=white)](https://t.me/ha_houseplan)

 **Turn Home Assistant into a live, interactive map of your home.** Upload or draw
 a floor plan, outline the rooms with your mouse — and every smart device appears
@@ -15,7 +17,13 @@ right on your Lovelace dashboard.

 ![Interactive Home Assistant floor plan: live rooms, devices, lights and climate on a real floorplan card](docs/images/demo.gif)

-🇷🇺 [Документация на русском](README.ru.md)
+> ### 🚀 Try it live — no install needed
+> **[demo.houseplan.tech](https://demo.houseplan.tech)** — a real Home Assistant
+> with a ready-made plan. Log in as **`demo`** / **`demo`** and click anything:
+> toggle lights, open the editors, break things. The stand resets itself to a
+> pristine state every hour.
+
+🇷🇺 [Документация на русском](README.ru.md) · 💬 [Telegram chat: **@ha_houseplan**](https://t.me/ha_houseplan)

 **Feature highlights**

@@ -32,6 +40,11 @@ right on your Lovelace dashboard.
  explicit button, never an accidental tap.
 - 📺 **Kiosk mode** for wall tablets and TVs: fullscreen, swipe between floors,
  auto-carousel, per-screen icon sizes.
+- 🤖 **Live robot vacuums** — the dock marker stays put while a round puck
+  drives the plan in real time, pouring its path out from under itself;
+  current and previous cleanup runs are recorded server-side. Calibration is
+  one click (rooms matched by name) or a drag-and-stretch overlay. Works with
+  Xiaomi Cloud Map Extractor, Tasshack dreame-vacuum and Valetudo.
 - 🔔 New devices appear automatically with a red “new” dot; the layout is stored
  **server-side** — one shared plan for every user and screen, synced live.

@@ -74,6 +87,12 @@ Key advantages in short:
 - **Automatic device placement.** Outline a room and bind it to a Home Assistant area — the devices of that area appear on the plan by themselves.
 - **Manual additions of your own.** Any device, group or even a "virtual" point can be placed on the plan manually, with a name, icon, model, link and an attached PDF manual.
 - **Live states.** Temperature, Zigbee signal strength, on/off, open/closed — everything updates in real time.
+  Icon colors follow one principle — **yellow means the device is doing its main job right now**:
+  a light is shining, a socket is powering, a fan is spinning, media is playing, a vacuum is
+  cleaning, a radiator valve is actually heating (not merely enabled). Orange = open / unlocked.
+  A pulsing red ring = an emergency (leak, smoke, gas). An RGB bulb's colour lives in its glow
+  spot (glow fill), where the spot itself is the on/off indicator and the badge stays standard.
+  A translucent icon = unavailable. Dark = idle.
 - **Crisp zoom.** Zooming in does not "blur" the picture: the plan, labels and icons remain vector-sharp at any scale.

 ---
@@ -155,7 +174,7 @@ for each floor (names prefilled, a plan image is asked for one by one; any floor

 ![Empty plan — prompt to add a space](docs/images/02-onboarding-empty.png)

-In the dialog, set a **name** (for example, "1st floor") and **upload a background** — a floor-plan image in SVG, PNG or JPG format. Both fields are required: without a plan the "Save" button stays disabled.
+In the dialog, set a **name** (for example, "1st floor") and pick the background: **upload** a floor-plan image (SVG, PNG, JPG, WebP), **choose one already uploaded** to the server earlier, or select **"no background, I'll draw the rooms"** for a hand-drawn space. The canvas is always square; an image keeps its own proportions and is centred inside it.

 ![Space creation dialog](docs/images/03-space-dialog.png)

@@ -198,7 +217,7 @@ walls** (it slides around corners too), and a **double click opens its propertie

 As soon as you save a room bound to an area, **the devices of that area are automatically laid out inside the outline**. These are the same devices shown on the **Settings → Devices → (filtered by the room)** page — only the meaningful ones, without service records, bridges and duplicates.

-By default only meaningful devices make it onto the plan — service records, bridges and duplicates are filtered out. If you need to see **absolutely all** devices of the area, enable the **👁 "Show all devices"** button in the header.
+By default only meaningful devices make it onto the plan: non-physical ones (service records, bridges, scenes, individual lamps folded into a light group) arrive with the **"Hide device from plan"** checkbox already ticked. The checkbox is yours from then on — every device dialog has it, virtual devices included. To see and un-hide them, open the device editor and press **"Show hidden"**: hidden devices appear as translucent blue ghosts, a click opens the dialog. Hidden devices still count toward the room's Zigbee signal, but cast no light.

 From here on you can just use the plan: clicking an icon opens the device card with the model, link and a button to jump into Home Assistant.

@@ -258,11 +277,29 @@ turned the way it is mounted.

 ---

+## Getting help & sharing your plan
+
+- 💬 **[Telegram chat — @ha_houseplan](https://t.me/ha_houseplan)** — questions,
+  setup help, feature ideas, and screenshots of your plans. The fastest way to
+  reach the author and other users.
+- 🐞 [GitHub issues](https://github.com/Matysh/houseplan-card/issues) — bug
+  reports and feature requests (please attach your House Plan version).
+- 💡 [GitHub discussions](https://github.com/Matysh/houseplan-card/discussions) —
+  longer-form ideas.
+- 📜 [Changelog](docs/CHANGELOG.md) — what changed in every version
+  ([на русском](docs/CHANGELOG.ru.md)).
+
+When reporting a problem, the version number helps a lot: it is shown in the
+browser console on load (`HOUSEPLAN-CARD vX.Y.Z`) and in **Settings → Devices &
+Services → House Plan**.
+
+---
+
 ## Frequently asked questions

 **Do I need to write anything in YAML?** No. The only line is adding the card to the dashboard; everything else is done with the mouse.

-**My devices did not appear on the plan.** A device appears only if its Home Assistant area is bound to a drawn room. Check that the device has a room assigned (Settings → Devices) and that the room is outlined and bound to that area. If the device exists but is hidden by curation (bridges, service records, duplicates) — enable the **👁 "Show all devices"** button in the header.
+**My devices did not appear on the plan.** A device appears only if its Home Assistant area is bound to a drawn room. Check that the device has a room assigned (Settings → Devices) and that the room is outlined and bound to that area. If the device exists but is hidden (the "Hide device from plan" checkbox — set automatically for bridges, scenes and other non-physical records) — open the device editor, press **"Show hidden"** and untick the box in its dialog.

 **Can I hide an unwanted device or rename it?** Yes — click the device on the plan and press "Edit" in its card: there you can change the name, icon, model or hide the icon.

@@ -3,6 +3,8 @@
 [![HACS Custom](https://img.shields.io/badge/HACS-Custom-41BDF5.svg)](https://github.com/hacs/integration)
 [![GitHub release](https://img.shields.io/github/v/release/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/releases)
 [![GitHub stars](https://img.shields.io/github/stars/Matysh/houseplan-card)](https://github.com/Matysh/houseplan-card/stargazers)
+[![Live demo](https://img.shields.io/badge/демо-попробовать-00c853?logo=homeassistant&logoColor=white)](https://demo.houseplan.tech)
+[![Telegram chat](https://img.shields.io/badge/Telegram-чат-2CA5E0?logo=telegram&logoColor=white)](https://t.me/ha_houseplan)

 **Превратите Home Assistant в живую интерактивную карту дома.** Загрузите или
 нарисуйте план этажа, обведите комнаты мышкой — и умные устройства появятся на
@@ -13,7 +15,13 @@

 ![Интерактивный план дома для Home Assistant: комнаты, устройства, свет и климат на реальном поэтажном плане](docs/images/demo.gif)

-🇬🇧 [Documentation in English](README.md)
+> ### 🚀 Попробовать вживую — без установки
+> **[demo.houseplan.tech](https://demo.houseplan.tech)** — настоящий Home
+> Assistant с готовым планом. Вход **`demo`** / **`demo`**, можно нажимать всё:
+> включать свет, открывать редакторы, ломать что угодно. Каждый час стенд сам
+> возвращается в исходное состояние.
+
+🇬🇧 [Documentation in English](README.md) · 💬 [Чат в Telegram: **@ha_houseplan**](https://t.me/ha_houseplan)

 **Главное**

@@ -30,6 +38,11 @@
  никогда случайным тапом.
 - 📺 **Киоск-режим** для настенных планшетов и ТВ: полноэкранно, свайп между
  этажами, автокарусель, свои размеры на каждом экране.
+- 🤖 **Роботы-пылесосы вживую** — маркер-база стоит на месте, а круглая
+  шайба ездит по плану в реальном времени, «выливая» путь из-под себя;
+  текущая и прошлая уборки хранятся на сервере. Калибровка — в один клик
+  (по именам комнат) или перетаскиванием призрака карты. Работают Xiaomi
+  Cloud Map Extractor, dreame-vacuum (Tasshack) и Valetudo.
 - 🔔 Новые устройства сами появляются на плане с красной точкой; раскладка
  хранится **на сервере HA** — один план для всех экранов, живая синхронизация.

@@ -73,6 +86,12 @@ House Plan показывает ваш умный дом так, как он в
 - **Автоматическое добавление устройств.** Обвели комнату и привязали её к зоне Home Assistant — устройства этой зоны сами появляются на плане.
 - **Ручное добавление своих.** Любое устройство, группу или даже «виртуальную» точку можно поставить на план вручную, задать имя, иконку, модель, ссылку и приложить PDF-инструкцию.
 - **Живые состояния.** Температура, уровень сигнала Zigbee, вкл/выкл, открыто/закрыто — всё обновляется в реальном времени.
+  Цвета значков подчиняются одному принципу — **жёлтый значит «устройство прямо сейчас выполняет свою основную работу»**:
+  лампа светит, розетка подаёт, вентилятор крутится, медиа играет, пылесос убирает, термоголовка
+  реально греет (а не просто включена). Оранжевый = открыто / не заперто. Пульсирующее красное
+  кольцо = авария (протечка, дым, газ). Цвет RGB-лампы живёт в её пятне света (режим glow),
+  где само пятно — индикатор включения, а подложка значка остаётся стандартной.
+  Полупрозрачный значок = недоступно. Тёмный = покой.
 - **Чёткий зум.** Приближение не «мылит» картинку: план, подписи и иконки остаются векторно-чёткими на любом масштабе.

 ---
@@ -156,7 +175,7 @@ title: План дома

 ![Пустой план — предложение добавить пространство](docs/images/02-onboarding-empty.png)

-В диалоге задайте **название** (например, «1 этаж») и **загрузите подложку** — картинку плана этажа в формате SVG, PNG или JPG. Оба поля обязательны: без плана кнопка «Сохранить» неактивна.
+В диалоге задайте **название** (например, «1 этаж») и выберите подложку: **загрузите** картинку плана (SVG, PNG, JPG, WebP), **возьмите уже загруженную** на сервер ранее или отметьте **«без подложки, нарисую комнаты сам»**. Холст всегда квадратный; картинка сохраняет свои пропорции и центрируется внутри него.

 ![Диалог создания пространства](docs/images/03-space-dialog.png)

@@ -199,7 +218,7 @@ title: План дома

 Как только вы сохранили комнату с привязкой к зоне, **устройства этой зоны автоматически расставляются внутри контура**. Берутся те же устройства, что показаны на странице **Настройки → Устройства → (фильтр по нужной комнате)** — только осмысленные, без служебных записей, мостов и дубликатов.

-По умолчанию на план попадают только осмысленные устройства — служебные записи, мосты и дубликаты отфильтрованы. Если нужно видеть **вообще все** устройства зоны, включите в шапке кнопку **👁 «Показать все устройства»**.
+По умолчанию на план попадают только осмысленные устройства: нефизические (служебные записи, мосты, сцены, лампы, свёрнутые в световую группу) приходят с уже установленной галкой **«Скрыть устройство с плана»**. Дальше галка принадлежит вам — она есть в диалоге каждого устройства, включая виртуальные. Чтобы увидеть и вернуть скрытые, откройте редактор устройств и нажмите **«Показать скрытые»**: скрытые отобразятся полупрозрачными синими призраками, клик открывает диалог. Скрытые устройства учитываются в Zigbee-сигнале комнаты, но света не дают.

 Дальше можно просто пользоваться планом: клик по иконке открывает карточку устройства с моделью, ссылкой и кнопкой перехода в Home Assistant.

@@ -261,11 +280,28 @@ title: План дома

 ---

+## Помощь и обмен опытом
+
+- 💬 **[Чат в Telegram — @ha_houseplan](https://t.me/ha_houseplan)** — вопросы,
+  помощь с настройкой, идеи и скриншоты ваших планов. Самый быстрый способ
+  связаться с автором и другими пользователями.
+- 🐞 [Issues на GitHub](https://github.com/Matysh/houseplan-card/issues) — баги
+  и запросы фич (пожалуйста, указывайте версию House Plan).
+- 💡 [Discussions](https://github.com/Matysh/houseplan-card/discussions) — для
+  развёрнутых обсуждений.
+- 📜 [История изменений](docs/CHANGELOG.ru.md) — что менялось в каждой версии.
+
+Версия видна в консоли браузера при загрузке (`HOUSEPLAN-CARD vX.Y.Z`) и в
+**Настройки → Устройства и службы → House Plan** — с ней разбираться сильно
+быстрее.
+
+---
+
 ## Часто задаваемые вопросы

 **Нужно ли что-то писать в YAML?** Нет. Единственная строчка — это добавление карточки на дашборд; всё остальное делается мышкой.

-**Мои устройства не появились на плане.** Устройство появляется, только если его зона в Home Assistant привязана к нарисованной комнате. Проверьте, что у устройства задана комната (Настройки → Устройства), а комната обведена и привязана к этой зоне. Если устройство есть, но скрыто курированием (мосты, служебные, дубликаты) — включите в шапке кнопку **👁 «Показать все устройства»**.
+**Мои устройства не появились на плане.** Устройство появляется, только если его зона в Home Assistant привязана к нарисованной комнате. Проверьте, что у устройства задана комната (Настройки → Устройства), а комната обведена и привязана к этой зоне. Если устройство есть, но скрыто (галка «Скрыть устройство с плана» — для мостов, сцен и прочих нефизических записей она ставится автоматически) — откройте редактор устройств, нажмите **«Показать скрытые»** и снимите галку в его диалоге.

 **Можно ли скрыть лишнее устройство или переименовать его?** Да — кликните по устройству на плане и в его карточке нажмите «Редактировать»: там можно сменить имя, иконку, модель или скрыть значок.

@@ -2,11 +2,13 @@
 from __future__ import annotations

 import logging
+from datetime import timedelta
 from pathlib import Path

 from homeassistant.components.frontend import add_extra_js_url
 from homeassistant.core import HomeAssistant
 from homeassistant.exceptions import ConfigEntryNotReady
+from homeassistant.helpers.event import async_track_time_interval

 from . import websocket_api as hp_ws
 from .const import (
@@ -18,6 +20,8 @@ from .const import (
    PLANS_URL,
    VERSION,
 )
+from .geometry_migration import migrate_config, migrate_layout, pending_from_config
+from .plans import collect_attachments, collect_plans, sweep_upload_temps
 from .repairs import async_check_plan_files
 from .store import HouseplanConfigEntry, create_data

@@ -28,9 +32,10 @@ async def async_setup(hass: HomeAssistant, config) -> bool:
    """Register global handlers (survive config-entry reloads): WS commands, HTTP view."""
    hass.data.setdefault(DOMAIN, {})
    hp_ws.async_register(hass)
-    from .http_api import HouseplanUploadView
+    from .http_api import HouseplanContentView, HouseplanUploadView

    hass.http.register_view(HouseplanUploadView())
+    hass.http.register_view(HouseplanContentView())
    return True


@@ -45,6 +50,15 @@ async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) ->
        raise ConfigEntryNotReady(f"House Plan storage is not readable: {err}") from err
    entry.runtime_data = data

+    # server-side vacuum trails: the integration records the path itself
+    from .trails import TrailRecorder
+    recorder = TrailRecorder(hass, data)
+    await recorder.async_setup()
+    # setdefault: the CI harness sets entries up without async_setup, so
+    # hass.data[DOMAIN] may not exist yet — a KeyError here failed EVERY
+    # downstream WS test with unknown_error
+    hass.data.setdefault(DOMAIN, {})["trail_recorder"] = recorder
+
    card_path = Path(__file__).parent / "frontend" / "houseplan-card.js"
    plans_path = Path(hass.config.path(PLANS_DIR))
    files_path = Path(hass.config.path(FILES_DIR))
@@ -61,14 +75,14 @@ async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) ->

            if card_path.exists():
                static_paths.append(StaticPathConfig(FRONTEND_URL, str(card_path), cache_headers=False))
-            static_paths.append(StaticPathConfig(PLANS_URL, str(plans_path), cache_headers=True))
-            static_paths.append(StaticPathConfig(FILES_URL, str(files_path), cache_headers=True))
-            await hass.http.async_register_static_paths(static_paths)
+            # NOTE (audit B1): plans and marker files are NO LONGER static.
+            # They are served by HouseplanContentView, which requires auth.
+            # Only the card bundle stays public — Lovelace resources must be.
+            if static_paths:
+                await hass.http.async_register_static_paths(static_paths)
        except ImportError:  # very old HA versions
            if card_path.exists():
                hass.http.register_static_path(FRONTEND_URL, str(card_path), cache_headers=False)
-            hass.http.register_static_path(PLANS_URL, str(plans_path), cache_headers=True)
-            hass.http.register_static_path(FILES_URL, str(files_path), cache_headers=True)

    if not card_path.exists():
        _LOGGER.warning("houseplan-card.js not found next to the integration: %s", card_path)
@@ -95,11 +109,103 @@ async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) ->
            module_url, module_url,
        )

+    # One-time move to the square canvas (v1.48.0). Coordinates used to be
+    # normalised against a per-space aspect ratio; the canvas is now always
+    # square and a plan is centred inside it. Nothing about the drawing changes
+    # — the box is padded and the numbers re-expressed against it.
+    # The two stores are written independently, and the lock is no transaction:
+    # a crash between the writes used to leave the config in square coordinates
+    # with the layout still in the old ones — permanently, because the config
+    # write had already deleted the `aspect` fields the layout half needed
+    # (HP-1490-01). So the intent is made durable FIRST, in the layout store,
+    # and each half carries its own trigger with its own write: the config half
+    # removes `aspect`, the layout half removes the saved intent. Whatever
+    # half is missing after a crash, the next start finishes exactly it.
+    async with data.write_lock:
+        stored = await data.config_store.async_load() or {}
+        cfg = stored.get("config")
+        lay_stored = await data.store.async_load() or {}
+        layout = lay_stored.get("layout") or {}
+        pending = {
+            str(k): v for k, v in (lay_stored.get("geom_pending") or {}).items()
+        }
+        merged = {**pending, **pending_from_config(cfg)}
+        if merged:
+            lay_rev = int(lay_stored.get("rev", 0))
+            if merged != pending:  # 1. the durable intent, before anything moves
+                await data.store.async_save(
+                    {"layout": layout, "rev": lay_rev, "geom_pending": merged}
+                )
+            rev = int(stored.get("rev", 0))
+            if cfg and migrate_config(cfg):  # 2. the config half
+                rev += 1
+                await data.config_store.async_save({"config": cfg, "rev": rev})
+            migrate_layout(layout, merged)  # 3. the layout half + intent cleared
+            await data.store.async_save({"layout": layout, "rev": lay_rev + 1})
+            _LOGGER.info(
+                "House Plan: migrated %s space(s) to the square canvas", len(merged)
+            )
+            # only once both halves are durable — a client refetching on this
+            # event must never see one migrated half and one old one
+            hass.bus.async_fire("houseplan_config_updated", {"rev": rev})
+
    await async_check_plan_files(hass, entry)
+
+    # Scheduled collection of everything nobody ended up referencing.
+    #
+    # A commit collects what that commit superseded, which is the right rule for
+    # a commit — but it only ever runs when somebody saves. Cancel a dialog
+    # after the file has already uploaded, lose the connection after the upload
+    # succeeded, or call the API directly, and the file is unreferenced with no
+    # future write to notice it (HP-1461-01). The earlier version of this sweep
+    # only removed streaming temporaries, which are a different, narrower case.
+    #
+    # Passing the CURRENT configuration as both sides means "nothing was
+    # superseded": every referenced file is preserved and only unreferenced ones
+    # past PLAN_ORPHAN_TTL_S go. It runs under the same lock as a config write,
+    # so it cannot decide from a snapshot that a commit is about to replace.
+    async def _sweep(_now=None) -> None:
+        files_dir = Path(hass.config.path(FILES_DIR))
+        plans_dir = Path(hass.config.path(PLANS_DIR))
+        try:
+            # `data` from the closure, NOT get_data(hass): during
+            # async_setup_entry the entry is still SETUP_IN_PROGRESS, so
+            # async_loaded_entries() does not list it and the lookup returned
+            # None. The startup pass then silently degraded to removing
+            # streaming temporaries only, and the real collection waited a full
+            # day — restarting more often than that meant it never ran at all
+            # (HP-1462-01). The callback is unregistered with the entry, so
+            # closing over its runtime data matches the lifecycle exactly.
+            async with data.write_lock:
+                stored = await data.config_store.async_load() or {}
+                cfg = stored.get("config") or {}
+
+                def _collect() -> int:
+                    n = sweep_upload_temps(files_dir)
+                    # same config on both sides: nothing is superseded, so this
+                    # only ever collects what the shared rules call abandoned
+                    n += collect_attachments(files_dir, cfg, cfg)
+                    n += collect_plans(plans_dir, cfg, cfg)
+                    return n
+
+                n = await hass.async_add_executor_job(_collect)
+            if n:
+                _LOGGER.info("House Plan: removed %s unreferenced file(s)", n)
+        except Exception:  # noqa: BLE001 — housekeeping must never fail a setup
+            _LOGGER.exception("House Plan: sweeping unreferenced files failed")
+
+    data.sweep = _sweep
+    await _sweep()
+    entry.async_on_unload(
+        async_track_time_interval(hass, _sweep, timedelta(hours=24))
+    )
    return True


 async def async_unload_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) -> bool:
+    rec = hass.data.get(DOMAIN, {}).pop("trail_recorder", None)
+    if rec:
+        rec.teardown()
    """Unload the entry.

    WS commands and the HTTP view are global (async_setup) and stay registered —
@@ -0,0 +1,28 @@
+"""Single source of truth for the write-authorization policy.
+
+The WS and HTTP paths used to duplicate this decision and drifted apart: the
+WS copy was fixed to fail closed while the upload view still failed OPEN when
+the config entry was unavailable (audit follow-up B2, 2026-07-27). One helper,
+one behaviour.
+"""
+from __future__ import annotations
+
+from homeassistant.core import HomeAssistant
+
+from .const import CONF_ADMIN_ONLY
+from .store import get_entry
+
+
+def may_write(hass: HomeAssistant, user) -> bool:
+    """True when `user` may modify House Plan data.
+
+    Fails CLOSED: when the entry cannot be read — during a reload, or while the
+    integration is disabled — the policy is unknown, and "unknown" is not the
+    same as "permissive": only admins are allowed through.
+    """
+    is_admin = bool(getattr(user, "is_admin", False))
+    entry = get_entry(hass)
+    if entry is None:
+        return is_admin
+    admin_only = bool(entry.options.get(CONF_ADMIN_ONLY, False))
+    return is_admin if admin_only else True
@@ -9,9 +9,43 @@ FRONTEND_URL = "/houseplan_files/houseplan-card.js"
 PLANS_URL = "/houseplan_files/plans"
 PLANS_DIR = "houseplan/plans"  # relative to the HA configuration directory
 FILES_URL = "/houseplan_files/files"
+# authenticated read path (audit B1): /api/houseplan/content/<plans|files>/<sub>/<name>
+CONTENT_URL = "/api/houseplan/content"
+
+# How many paths one houseplan/content/sign call may carry. The card batches to
+# the same number; a client that sends more used to get a partial answer with no
+# way to tell which paths were dropped (review R2-2).
+MAX_SIGN_PATHS = 200
+
+# Nothing is ever deleted for being old (docs/SCOPE.md), so growth has to be
+# stopped at the door instead. These bound the whole store, not one request: by
+# default any authenticated user may upload, and a per-request cap of 8/50 MB
+# says nothing about how many requests there are (HP-1470-01).
+MAX_PLANS_BYTES = 256 * 1024 * 1024
+MAX_PLANS_FILES = 200
+# How many the picker asks for at once — newest first.
+MAX_PLANS_LISTED = 60
+MAX_FILES_BYTES = 1024 * 1024 * 1024
+MAX_FILES_COUNT = 1000
+# Refuse to write when the disk is nearly full: filling the config partition
+# breaks .storage, the recorder and backups, not just this card.
+MIN_FREE_BYTES = 512 * 1024 * 1024
+
+# An uploaded plan that no accepted configuration references is collected only
+# once it is this old. Age is a race guard, not a policy: a plan uploaded
+# seconds ago may belong to another client's transaction that has not written
+# its configuration yet (review R3-1).
+PLAN_ORPHAN_TTL_S = 3600
+
+# Kept for compatibility with anything reading it; the collectors no longer use
+# a long grace at all. Every attempt to age files out ended badly — first by
+# deleting detached plans, then by racing the save that was about to reference a
+# retried upload. What is left is deliberately simple: files go when the user's
+# action says so, plus staging folders after PLAN_ORPHAN_TTL_S.
+SCHEDULED_GRACE_S = 30 * 24 * 3600
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.42.2"
+VERSION = "1.54.2"

 DEFAULT_CONFIG: dict = {
    "spaces": [],
@@ -0,0 +1,161 @@
+"""One-time migration to a square canvas — pure, so it can be tested alone.
+
+Until v1.48.0 a space had an `aspect`, and coordinates were normalised against
+it: x by the width, y by the HEIGHT. Making every canvas square without touching
+the numbers would stretch every plan vertically.
+
+Nothing about the drawing changes here. The canvas is padded to a square —
+top and bottom for a wide plan, left and right for a tall one — and the
+coordinates are re-expressed against that larger box. In render units it is a
+uniform scale plus an offset, so angles, room proportions and relative positions
+survive exactly. `cell_cm` follows, because the grid is tied to the width: for a
+tall plan the width grew, so the same wall would otherwise measure less.
+"""
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def transform_for(aspect: float) -> tuple[float, float, float, float]:
+    """(dx, dy, kx, ky) that map old normalised coordinates onto the square.
+
+    x' = dx + x * kx, y' = dy + y * ky. Lengths along an axis scale by that
+    axis's factor; both are the same uniform scale in RENDER units, which is
+    why angles are preserved.
+    """
+    a = float(aspect)
+    if not a or a <= 0:
+        a = 1.0
+    k = min(1.0, a)          # how much the old box shrinks inside the square
+    kx = k                   # x was normalised by the width
+    ky = k / a               # y was normalised by the height (= width / aspect)
+    return (1.0 - kx) / 2, (1.0 - ky) / 2, kx, ky
+
+
+def _pt(p: Any, dx: float, dy: float, kx: float, ky: float) -> Any:
+    if isinstance(p, (list, tuple)) and len(p) >= 2:
+        return [dx + float(p[0]) * kx, dy + float(p[1]) * ky]
+    return p
+
+
+def migrate_space(space: dict[str, Any]) -> bool:
+    """Rewrite one space in place. Returns True when anything was changed."""
+    if "aspect" not in space:
+        return False
+    try:
+        aspect = float(space.get("aspect") or 1)
+    except (TypeError, ValueError):
+        aspect = 1.0
+    dx, dy, kx, ky = transform_for(aspect)
+    space.pop("aspect", None)
+
+    for room in space.get("rooms") or []:
+        if room.get("x") is not None:
+            room["x"] = dx + float(room["x"]) * kx
+        if room.get("y") is not None:
+            room["y"] = dy + float(room["y"]) * ky
+        if room.get("w") is not None:
+            room["w"] = float(room["w"]) * kx
+        if room.get("h") is not None:
+            room["h"] = float(room["h"]) * ky
+        if room.get("poly"):
+            room["poly"] = [_pt(p, dx, dy, kx, ky) for p in room["poly"]]
+
+    for op in space.get("openings") or []:
+        op["x"] = dx + float(op.get("x", 0)) * kx
+        op["y"] = dy + float(op.get("y", 0)) * ky
+        # a length is measured along the wall, and the render scale is uniform
+        if op.get("length") is not None:
+            op["length"] = float(op["length"]) * kx
+
+    for shape in space.get("decor") or []:
+        for a, b, fx, fy in (("x1", "y1", kx, ky), ("x2", "y2", kx, ky), ("x", "y", kx, ky)):
+            if shape.get(a) is not None:
+                shape[a] = dx + float(shape[a]) * fx
+            if shape.get(b) is not None:
+                shape[b] = dy + float(shape[b]) * fy
+        if shape.get("w") is not None:
+            shape["w"] = float(shape["w"]) * kx
+        if shape.get("h") is not None:
+            shape["h"] = float(shape["h"]) * ky
+
+    # The viewport becomes the whole square rather than the transformed old
+    # rectangle. It is what the grid is drawn over and what "fit to screen"
+    # fits, so keeping the old box would leave the new margins outside the
+    # canvas — no dots, nothing to draw on — which is exactly the room this
+    # change was meant to give.
+    space["view_box"] = [0.0, 0.0, 1.0, 1.0]
+
+    # The grid pitch is a fraction of the WIDTH. A tall plan just got a wider
+    # canvas, so a wall now covers fewer cells; without this every measurement
+    # in the plan would silently shrink.
+    if kx != 1:
+        try:
+            cell = float(space.get("cell_cm") or 5)
+        except (TypeError, ValueError):
+            cell = 5.0
+        space["cell_cm"] = round(cell / kx, 4)
+
+    # The image keeps its own proportions and is centred; the space no longer
+    # has any of its own.
+    if space.get("plan_url") and not space.get("plan_aspect"):
+        space["plan_aspect"] = round(aspect, 6)
+    return True
+
+
+def pending_from_config(config: dict[str, Any] | None) -> dict[str, float]:
+    """{space_id: old aspect} for every space still carrying one.
+
+    This is the migration INTENT. The two stores are written independently and
+    either write can fail, so the intent has to survive on its own: it is saved
+    into the layout store BEFORE anything changes (HP-1490-01), and cleared by
+    the same write that stores the migrated layout. A crash between the writes
+    leaves the intent behind, and the next start finishes the missing half —
+    each half is idempotent because its trigger (`aspect` in the config, the
+    saved intent for the layout) travels with that half's own write.
+    """
+    out: dict[str, float] = {}
+    for space in (config or {}).get("spaces") or []:
+        if "aspect" not in space:
+            continue
+        try:
+            out[str(space.get("id"))] = float(space.get("aspect") or 1) or 1.0
+        except (TypeError, ValueError):
+            out[str(space.get("id"))] = 1.0
+    return out
+
+
+def migrate_config(config: dict[str, Any], layout: dict[str, Any] | None = None) -> bool:
+    """The config half: migrate every space still carrying an `aspect`.
+
+    `layout` is accepted for backward compatibility and migrated with the
+    factors found in the config — callers that can crash between store writes
+    should use `pending_from_config()` + `migrate_layout()` instead, so the
+    layout half does not depend on state the config half just deleted.
+    """
+    factors = pending_from_config(config)
+    if not factors:
+        return False
+    for space in config.get("spaces") or []:
+        migrate_space(space)
+    if layout:
+        migrate_layout(layout, factors)
+    return True
+
+
+def migrate_layout(layout: dict[str, Any] | None, pending: dict[str, float]) -> bool:
+    """The layout half: marker and label positions of the spaces in `pending`."""
+    changed = False
+    for pos in (layout or {}).values():
+        if not isinstance(pos, dict) or str(pos.get("s")) not in pending:
+            continue
+        dx, dy, kx, ky = transform_for(pending[str(pos.get("s"))])
+        if pos.get("x") is not None:
+            pos["x"] = dx + float(pos["x"]) * kx
+        if pos.get("y") is not None:
+            pos["y"] = dy + float(pos["y"]) * ky
+        changed = True
+    return changed
@@ -6,6 +6,8 @@ breaks the connection on a large PDF) but via a plain multipart POST — like me
 from __future__ import annotations

 import logging
+import os
+import tempfile
 from pathlib import Path

 from aiohttp import web
@@ -18,8 +20,12 @@ except ImportError:  # older HA versions
    KEY_HASS = "hass"  # type: ignore[assignment]
 from homeassistant.core import HomeAssistant

-from .const import CONF_ADMIN_ONLY, FILES_DIR, FILES_URL
-from .store import get_entry
+from .const import (
+    CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, MAX_FILES_BYTES,
+    MAX_FILES_COUNT, PLANS_DIR,
+)
+from .auth import may_write
+from .plans import TMP_PREFIX, QuotaError, check_quota, reserve_filename
 from .validation import (
    FILE_EXTENSIONS,
    MAX_FILE_BYTES,
@@ -31,6 +37,79 @@ from .validation import (
 _LOGGER = logging.getLogger(__name__)

 _CHUNK = 64 * 1024
+# batch disk writes: one executor job per megabyte instead of per chunk
+_FLUSH_AT = 1024 * 1024
+
+_MIME = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".txt": "text/plain",
+}
+
+
+class HouseplanContentView(HomeAssistantView):
+    """Authenticated read access to plans and marker files (audit B1).
+
+    The directories used to be exposed as unauthenticated static paths, so
+    anyone who could reach the HA endpoint could pull floor plans and uploaded
+    manuals without logging in. This view keeps the same URLs but requires a
+    Home Assistant session (or a signed path, which the frontend uses for
+    <image href> inside the SVG).
+    """
+
+    url = "/api/houseplan/content/{kind}/{sub}/{name}"
+    name = "api:houseplan:content"
+    requires_auth = True
+
+    async def get(self, request: web.Request, kind: str, sub: str, name: str) -> web.StreamResponse:
+        hass: HomeAssistant = request.app[KEY_HASS]
+        if kind not in ("plans", "files"):
+            return web.Response(status=404)
+        safe_sub = sanitize_marker_id(sub)
+        safe_name = sanitize_filename(name)
+        if not safe_sub or not safe_name:
+            return web.Response(status=404)
+        base = Path(hass.config.path(PLANS_DIR if kind == "plans" else FILES_DIR)).resolve()
+        # plans live flat in one directory: the sub segment is a placeholder ("_")
+        path = (base / safe_name if kind == "plans" else base / safe_sub / safe_name).resolve()
+        # defence in depth: the sanitizers already strip separators
+        if not str(path).startswith(str(base)):
+            return web.Response(status=404)
+
+        if not await hass.async_add_executor_job(path.is_file):
+            return web.Response(status=404)
+        suffix = path.suffix.lower()
+        headers = {
+            "Cache-Control": "private, max-age=3600",
+            "Content-Type": _MIME.get(suffix, "application/octet-stream"),
+        }
+        if suffix == ".svg":
+            # An uploaded SVG is user content served from Home Assistant's own
+            # origin. Inside the card it is referenced by <image>, where scripts
+            # never run — but the same url opened as a top-level document is a
+            # live document of this origin, and a <script> in it reaches the
+            # session's localStorage and API (HP-1454-01, 2026-07-28: uploading
+            # needs write access, which by default every authenticated user has,
+            # and the signed url is easy to hand to an admin).
+            #
+            # `sandbox` with no allow-* tokens drops the document into an opaque
+            # origin: no scripts, no same-origin access, no forms. The explicit
+            # directives below are belt and braces for older engines. Only SVG
+            # gets this — a CSP on a PDF response can break the browser's built-in
+            # viewer, and a raster image cannot execute anything in the first place.
+            headers["Content-Security-Policy"] = (
+                "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+                "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:"
+            )
+        # FileResponse streams from disk: a 50 MB manual used to be read whole
+        # into memory and copied into the response body, so a couple of parallel
+        # downloads could push a small Home Assistant host into swap (HP-1454-06).
+        return web.FileResponse(path, chunk_size=_CHUNK, headers=headers)


 class HouseplanUploadView(HomeAssistantView):
@@ -42,62 +121,135 @@ class HouseplanUploadView(HomeAssistantView):

    async def post(self, request: web.Request) -> web.Response:
        hass: HomeAssistant = request.app[KEY_HASS]
-        entry = get_entry(hass)
-        admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
-        if admin_only:
-            user = request.get("hass_user")
-            if user is None or not user.is_admin:
-                return web.json_response({"error": "unauthorized"}, status=403)
+        if not may_write(hass, request.get("hass_user")):
+            return web.json_response({"error": "unauthorized"}, status=403)

+        files_root = Path(hass.config.path(FILES_DIR))
        marker_id = "misc"
        filename: str | None = None
-        blob: bytes | None = None
-        too_large = False
+        # Every temporary file this request creates, promoted or not. The outer
+        # `finally` removes whatever is left: a dropped connection, a second
+        # `file` part or a failure while promoting used to leave a `.upload-*`
+        # behind for good, and the collector only ever walks marker folders, so
+        # nothing would have picked it up (HP-1460-02).
+        temps: list[Path] = []
+        error: tuple[dict, int] | None = None
+
+        def _new_tmp() -> Path:
+            files_root.mkdir(parents=True, exist_ok=True)
+            fd, name = tempfile.mkstemp(prefix=TMP_PREFIX, dir=str(files_root))
+            os.close(fd)
+            return Path(name)
+
+        def _flush(target: Path, blocks: list[bytes]) -> None:
+            with open(target, "ab") as fh:
+                for block in blocks:
+                    fh.write(block)
+
+        def _cleanup(paths: list[Path]) -> None:
+            for path in paths:
+                try:
+                    path.unlink()
+                except OSError:
+                    pass
+
        try:
-            reader = await request.multipart()
-            async for part in reader:
-                if part.name == "marker_id":
-                    marker_id = sanitize_marker_id(await part.text())
-                elif part.name == "file":
-                    filename = part.filename or "file"
-                    # read in chunks, aborting at the limit, instead of loading the whole file into memory
-                    chunks: list[bytes] = []
-                    size = 0
-                    while chunk := await part.read_chunk(_CHUNK):
-                        size += len(chunk)
-                        if size > MAX_FILE_BYTES:
-                            too_large = True
+            try:
+                reader = await request.multipart()
+                async for part in reader:
+                    if part.name == "marker_id":
+                        marker_id = sanitize_marker_id(await part.text())
+                    elif part.name == "file":
+                        if filename is not None:
+                            # one upload per request: a second part would strand
+                            # the first temporary file and make the response
+                            # ambiguous about which url was returned
+                            error = ({"error": "one_file_only"}, 400)
                            break
-                        chunks.append(chunk)
-                    if too_large:
-                        break
-                    blob = b"".join(chunks)
-        except Exception as err:  # noqa: BLE001
-            _LOGGER.warning("House Plan upload: multipart read error: %s", err)
-            return web.json_response({"error": "bad_request"}, status=400)
+                        filename = part.filename or "file"
+                        if file_ext(filename) not in FILE_EXTENSIONS:
+                            error = ({"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, 400)
+                            break
+                        # Stream to a temporary file instead of collecting the
+                        # whole upload in memory and copying it again into one
+                        # buffer: a 50 MB manual used to cost ~100 MB of RSS
+                        # mid-request (HP-1454-06). Blocks are batched so this
+                        # is one executor job per megabyte, not per 64 KB.
+                        tmp = await hass.async_add_executor_job(_new_tmp)
+                        temps.append(tmp)
+                        size = 0
+                        pending: list[bytes] = []
+                        buffered = 0
+                        while chunk := await part.read_chunk(_CHUNK):
+                            size += len(chunk)
+                            if size > MAX_FILE_BYTES:
+                                error = (
+                                    {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024},
+                                    413,
+                                )
+                                break
+                            pending.append(chunk)
+                            buffered += len(chunk)
+                            if buffered >= _FLUSH_AT:
+                                await hass.async_add_executor_job(_flush, tmp, pending)
+                                pending, buffered = [], 0
+                        if error:
+                            break
+                        if pending:
+                            await hass.async_add_executor_job(_flush, tmp, pending)
+            except Exception as err:  # noqa: BLE001
+                _LOGGER.warning("House Plan upload: multipart read error: %s", err)
+                error = ({"error": "bad_request"}, 400)

-        if too_large:
+            if error:
+                return web.json_response(error[0], status=error[1])
+            if not temps or not filename:
+                return web.json_response({"error": "no_file"}, status=400)
+
+            tmp_path = temps[0]
+            try:
+                await hass.async_add_executor_job(
+                    check_quota, files_root, tmp_path.stat().st_size,
+                    MAX_FILES_BYTES, MAX_FILES_COUNT,
+                )
+            except QuotaError as err:
+                _LOGGER.warning("House Plan upload refused: %s", err.detail)
+                return web.json_response({"error": err.reason, "detail": err.detail}, status=507)
+            except OSError:
+                pass
+            target_dir = files_root / marker_id
+            safe_name = filename
+
+            def _promote() -> str:
+                """Claim a free name, then move the finished upload onto it.
+
+                Never overwrite an existing attachment: its bytes may be
+                referenced by the stored configuration, and this upload is not
+                part of that transaction — a cancelled dialog or a rejected save
+                would leave the old url serving the new content (HP-1454-02).
+                The name is reserved atomically, so two uploads racing on the
+                same filename cannot agree on it (HP-1460-01).
+                """
+                name = reserve_filename(target_dir, safe_name)
+                try:
+                    os.replace(tmp_path, target_dir / name)
+                except OSError:
+                    (target_dir / name).unlink(missing_ok=True)
+                    raise
+                return name
+
+            try:
+                name = await hass.async_add_executor_job(_promote)
+            except OSError as err:
+                _LOGGER.warning("House Plan upload: could not store the file: %s", err)
+                return web.json_response({"error": "io_error"}, status=500)
+            temps.remove(tmp_path)  # it is the attachment now, not a temporary
            return web.json_response(
-                {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024}, status=413
+                {"ok": True, "url": f"{CONTENT_URL}/files/{marker_id}/{name}", "name": filename}
            )
-        if blob is None or not filename:
-            return web.json_response({"error": "no_file"}, status=400)
-        ext = file_ext(filename)
-        if ext not in FILE_EXTENSIONS:
-            return web.json_response(
-                {"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, status=400
-            )
-
-        safe_name = sanitize_filename(filename)
-        target_dir = Path(hass.config.path(FILES_DIR)) / marker_id
-        path = target_dir / safe_name
-
-        def _write() -> int:
-            target_dir.mkdir(parents=True, exist_ok=True)
-            path.write_bytes(blob)
-            return int(path.stat().st_mtime)
-
-        mtime = await hass.async_add_executor_job(_write)
-        return web.json_response(
-            {"ok": True, "url": f"{FILES_URL}/{marker_id}/{safe_name}?v={mtime}", "name": filename}
-        )
+        finally:
+            # BaseException too: cancelling the request task raises
+            # asyncio.CancelledError, which an `except Exception` never saw —
+            # an aborted large upload leaked its temporary file every time
+            if temps:
+                await hass.async_add_executor_job(_cleanup, list(temps))
@@ -16,5 +16,5 @@
  "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
  "requirements": [],
  "single_config_entry": true,
-  "version": "1.42.2"
+  "version": "1.54.2"
 }
@@ -0,0 +1,357 @@
+"""Blob lifecycle — pure, so it is unit-testable without Home Assistant.
+
+The file system is not part of the configuration store's transaction, so who
+may write or delete a plan or an attachment, and when, is a correctness
+question rather than housekeeping. It lives here, apart from the WebSocket and
+HTTP plumbing, precisely because it is the part that has to be reasoned about
+and tested.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+from .const import MIN_FREE_BYTES, PLAN_ORPHAN_TTL_S
+from .validation import MAX_FILENAME, PLAN_EXTENSIONS, sanitize_filename
+
+_LOGGER = logging.getLogger(__name__)
+
+# Streaming uploads land here first. The prefix is a dot so the name can never
+# collide with an attachment (sanitize_filename strips leading dots) and is easy
+# to sweep.
+TMP_PREFIX = ".upload-"
+
+
+def reserve_filename(directory: Path, name: str) -> str:
+    """Atomically claim a free name inside `directory` and return it.
+
+    Creates the file, empty, with `O_CREAT | O_EXCL`, so the name is *taken* the
+    moment it is chosen. The previous version asked `exists()` and returned a
+    string; two uploads racing between the check and the write agreed on the
+    same name and one silently overwrote the other, both reporting success
+    (HP-1460-01). The caller writes the real bytes over the placeholder — it
+    owns the name by then — and must remove it if it never gets that far.
+
+    The result is guaranteed to satisfy `sanitize_filename(result) == result`:
+    the content view sanitises the name in the request too, so a name it would
+    shorten or rewrite is a file that is written and then never served.
+    """
+    directory.mkdir(parents=True, exist_ok=True)
+    # Split the extension off the RAW name: sanitize_filename() truncates to
+    # MAX_FILENAME, so sanitising first would cut ".pdf" off a long name and the
+    # attachment would be stored — and served — without its type.
+    base = name.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+    stem, dot, suffix = base.rpartition(".")
+    if not dot:
+        stem, suffix = base, ""
+    stem = sanitize_filename(stem)
+    ext = f".{sanitize_filename(suffix)[:16]}" if suffix else ""
+    i = 1
+    while True:
+        tag = "" if i == 1 else f"-{i}"
+        # budget the stem so the WHOLE name fits, including the collision tag —
+        # appending "-2" to an already maximal name produced a url the view
+        # truncated back to something else, i.e. a permanent 404
+        room = MAX_FILENAME - len(ext) - len(tag)
+        candidate = (stem[:room] if room > 0 else "f") + tag + ext
+        candidate = sanitize_filename(candidate)
+        if candidate.startswith("."):  # a name that is only an extension
+            candidate = "file" + candidate
+        try:
+            fd = os.open(directory / candidate, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
+        except FileExistsError:
+            i += 1
+            if i > 10000:  # pathological directory; do not spin forever
+                raise
+            continue
+        os.close(fd)
+        return candidate
+
+
+def attachment_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """"<marker>/<file>" for every attachment a configuration references."""
+    out: set[str] = set()
+    for m in (cfg or {}).get("markers") or []:
+        for pdf in m.get("pdfs") or []:
+            url = pdf.get("url") if isinstance(pdf, dict) else None
+            if not isinstance(url, str) or "/files/" not in url:
+                continue
+            rel = url.split("?", 1)[0].split("/files/", 1)[1]
+            if rel.count("/") == 1:
+                out.add(rel)
+    return out
+
+
+def sweep_upload_temps(files_dir: Path, now: float | None = None) -> int:
+    """Remove abandoned streaming temporaries (HP-1460-02).
+
+    The request itself deletes its own, but a hard kill — a restart mid-upload,
+    an OOM — leaves one behind, and the attachment collector only walks marker
+    folders, so it would never be seen. Age-gated for the same reason as the
+    rest: a fresh one belongs to a request still in flight.
+    """
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        items = [p for p in files_dir.iterdir() if p.is_file()] if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    for item in items:
+        if not item.name.startswith(TMP_PREFIX):
+            continue
+        try:
+            if item.stat().st_mtime >= cutoff:
+                continue
+            item.unlink()
+            removed += 1
+        except OSError:
+            continue
+    return removed
+
+
+def collect_attachments(
+    files_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """The same commit-scoped rule as `collect_plans`, for marker attachments.
+
+    A file the old revision referenced and the new one does not, whose marker
+    still exists, was removed on purpose — the dialog has a trash button and
+    promises nothing. It goes. Everything else is kept, except a staging folder
+    (`up_*`), which by construction only ever holds an upload from a dialog that
+    was never saved: those go after PLAN_ORPHAN_TTL_S. Never raises: it runs
+    behind a durable write.
+    """
+    new_refs = attachment_refs(new_cfg)
+    old_refs = attachment_refs(old_cfg)
+    # Removing an attachment from a device that still exists is the user saying
+    # "drop this one" — a trash button, no promise that anything is kept. A
+    # device that is GONE is a different transition, and its files follow the
+    # same rule as a deleted space's plan: kept.
+    live_markers = {str(m.get("id")) for m in (new_cfg or {}).get("markers") or []}
+    # Same distinction as for plans. A staging folder (`up_*`) is different: it
+    # only ever holds an upload from a dialog that was never saved, so the short
+    # rule is exactly right there even on the timer.
+    now_s = time.time() if now is None else now
+    staging_cutoff = now_s - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        folders = sorted(p for p in files_dir.iterdir() if p.is_dir()) if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    removed += sweep_upload_temps(files_dir, now)
+    for folder in folders:
+        # A staging folder only ever holds an upload from a dialog that was never
+        # saved — unambiguous, so an hour is right, and no device owns it.
+        staging = folder.name.startswith("up_")
+        try:
+            items = sorted(p for p in folder.iterdir() if p.is_file())
+        except OSError:
+            continue
+        for item in items:
+            rel = f"{folder.name}/{item.name}"
+            if rel in new_refs:
+                continue
+            dropped = rel in old_refs and folder.name in live_markers
+            if not dropped:
+                if not staging:
+                    # Same rule as for plans: not asked for, so kept. A file in
+                    # a device's folder that the device does not list is an
+                    # upload whose save was rejected — and ageing those out
+                    # raced the retry that was about to reference them.
+                    continue
+                try:
+                    if item.stat().st_mtime >= staging_cutoff:
+                        continue
+                except OSError:
+                    continue
+            try:
+                item.unlink()
+                removed += 1
+            except OSError as err:
+                _LOGGER.warning("House Plan: could not remove the attachment %s: %s", item, err)
+        try:
+            next(folder.iterdir())
+        except StopIteration:
+            try:
+                folder.rmdir()
+            except OSError:
+                pass
+        except OSError:
+            pass
+    return removed
+
+
+class QuotaError(Exception):
+    """A store limit would be exceeded. Carries what to tell the user."""
+
+    def __init__(self, reason: str, detail: str) -> None:
+        super().__init__(detail)
+        self.reason = reason
+        self.detail = detail
+
+
+def dir_usage(path: Path) -> tuple[int, int]:
+    """(bytes, files) below `path`, ignoring what we cannot read."""
+    total = count = 0
+    if not path.is_dir():
+        return 0, 0
+    for item in path.rglob("*"):
+        try:
+            if item.is_file():
+                total += item.stat().st_size
+                count += 1
+        except OSError:
+            continue
+    return total, count
+
+
+def check_quota(path: Path, incoming: int, max_bytes: int, max_files: int) -> None:
+    """Raise QuotaError unless `incoming` more bytes fit.
+
+    Deliberately not an age rule. Files are never removed for getting old — that
+    cost real plans twice — so the limit sits where a decision is being made
+    anyway: at the moment somebody asks to store something new.
+    """
+    import shutil
+
+    used, count = dir_usage(path)
+    if count + 1 > max_files:
+        raise QuotaError("too_many_files", f"{count} files already stored, the limit is {max_files}")
+    if used + incoming > max_bytes:
+        raise QuotaError(
+            "quota_exceeded",
+            f"{(used + incoming) // 1024 // 1024} MB would be stored, the limit is "
+            f"{max_bytes // 1024 // 1024} MB",
+        )
+    try:
+        free = shutil.disk_usage(str(path if path.is_dir() else path.parent)).free
+    except OSError:
+        return
+    if free - incoming < MIN_FREE_BYTES:
+        raise QuotaError("low_disk_space", f"only {free // 1024 // 1024} MB free on the disk")
+
+
+def plan_basename(url: Any) -> str:
+    """File name a stored plan_url points at ('' when there is none)."""
+    if not isinstance(url, str) or not url:
+        return ""
+    return url.split("?", 1)[0].rsplit("/", 1)[-1]
+
+
+def plan_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """Plan file names a configuration references."""
+    out: set[str] = set()
+    for sp in (cfg or {}).get("spaces") or []:
+        name = plan_basename(sp.get("plan_url"))
+        if name:
+            out.add(name)
+    return out
+
+
+def plan_by_space(cfg: dict[str, Any] | None) -> dict[str, str]:
+    """space id -> the plan file it references ('' when it has none)."""
+    return {
+        str(sp.get("id")): plan_basename(sp.get("plan_url"))
+        for sp in (cfg or {}).get("spaces") or []
+    }
+
+
+def is_plan_file(name: str) -> bool:
+    """Does this look like a plan we wrote: <space>.<ext> or <space>.<token>.<ext>?"""
+    parts = name.split(".")
+    return len(parts) in (2, 3) and parts[-1].lower() in PLAN_EXTENSIONS
+
+
+def collect_plans(
+    plans_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """Drop plan files the accepted configuration made obsolete (review R3-1).
+
+    Called inside the config write lock, right after the new revision is
+    stored, so it decides from the two configurations that actually bracket the
+    commit instead of trusting a client to say what may be deleted. The earlier
+    design — a `plan/cleanup` command carrying `keep` — could not be ordered
+    against another client's commit: a delayed call removed the file that
+    client had just saved, leaving the accepted configuration pointing at
+    nothing, which is the damage copy-on-write was introduced to prevent.
+
+    Two rules, both conservative:
+      * a file the OLD configuration referenced and the new one does not was
+        authoritative and has been superseded — remove it;
+      * any other unreferenced plan file is a rejected or abandoned upload, and
+        is KEPT — see the rule above; only a staging folder ages out: a fresh one may
+        belong to a transaction that has not committed yet.
+
+    Never raises: the configuration is already stored by the time this runs, so
+    a file-system problem must not turn a durable commit into a failed call.
+    """
+    new_refs = plan_refs(new_cfg)
+    old_refs = plan_refs(old_cfg)
+    # A commit knows what it superseded. The timer only knows what nothing
+    # points at *right now*, and for a plan that is a reversible state: the
+    # editor detaches the image when a space switches to "draw" and says the
+    # file stays on disk. So the scheduled pass keeps anything belonging to a
+    # space that still exists, and waits a month for the rest.
+    # A space with NO plan_url has had its image detached — reversible, and the
+    # editor promises the file stays. A space that HAS one is different: any
+    # other file of its own is a superseded or rejected upload, so the short
+    # rule is right for those. Getting this distinction wrong (protecting
+    # nothing) destroyed two detached plans on 2026-07-28.
+    # The short rule fits exactly one case: a space that HAS a plan, where any
+    # other file of its own can only be a superseded or rejected upload.
+    old_by_space = plan_by_space(old_cfg)
+    new_by_space = plan_by_space(new_cfg)
+    # A file that left the configuration tells us nothing on its own: replacing a
+    # plan, detaching one and deleting a space all look identical from
+    # `old_refs - new_refs`. Only the first is a deletion the user asked for
+    # (HP-1465-01 — the guards below were written and then never reached,
+    # because the code decided "superseded" before asking why).
+    replaced = {
+        name for space, name in old_by_space.items()
+        if new_by_space.get(space) and new_by_space[space] != name
+    }
+    removed = 0
+    try:
+        items = sorted(plans_dir.iterdir()) if plans_dir.is_dir() else []
+    except OSError as err:
+        # The directory can vanish or turn unreadable between the check and the
+        # walk. This is housekeeping running behind a commit that is already
+        # durable, so it reports "nothing collected" instead of failing (R4-1).
+        _LOGGER.warning("House Plan: could not list %s: %s", plans_dir, err)
+        return 0
+    for item in items:
+        if not item.is_file() or item.name in new_refs or not is_plan_file(item.name):
+            continue
+        if item.name not in replaced:
+            # PRODUCT RULE (owner's decision, 2026-07-28): a plan file we were
+            # not told to delete is kept, however long it sits there. Detaching
+            # is one click to undo and the editor says the image stays; deleting
+            # a space is deliberate but the image was imported and may be
+            # nowhere else. The errors are not symmetrical — unnecessary
+            # megabytes can be removed by hand, a deleted file cannot be
+            # brought back.
+            #
+            # There is deliberately no age rule here. An earlier version aged
+            # out "rejected uploads" — a file of a space that has a plan, which
+            # was never the plan — and that raced a save: the sweep deleted the
+            # upload from the failed attempt while a retry was committing a
+            # reference to it. A rule that can delete a file somebody is about
+            # to point at is not worth the disk it reclaims.
+            continue
+        try:
+            item.unlink()
+            removed += 1
+        except OSError as err:
+            _LOGGER.warning("House Plan: could not remove the old plan %s: %s", item, err)
+    return removed
@@ -11,7 +11,7 @@ from pathlib import Path
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers import issue_registry as ir

-from .const import DOMAIN, PLANS_DIR, PLANS_URL
+from .const import CONTENT_URL, DOMAIN, PLANS_DIR, PLANS_URL
 from .store import HouseplanConfigEntry


@@ -25,9 +25,15 @@ async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntr
        res = []
        for sp in spaces:
            url = sp.get("plan_url") or ""
-            if not url.startswith(PLANS_URL + "/"):
+            # both the legacy static URL and the authenticated content URL
+            prefix = None
+            if url.startswith(PLANS_URL + "/"):
+                prefix = PLANS_URL + "/"
+            elif url.startswith(CONTENT_URL + "/plans/_/"):
+                prefix = CONTENT_URL + "/plans/_/"
+            if prefix is None:
                continue  # external/legacy URL — not ours to verify
-            fname = url[len(PLANS_URL) + 1 :].split("?", 1)[0]
+            fname = url[len(prefix) :].split("?", 1)[0]
            if not (plans_dir / fname).is_file():
                res.append((sp.get("id", "?"), fname))
        return res
@@ -45,8 +51,17 @@ async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntr
            translation_key="broken_plan",
            translation_placeholders={"space": space_id, "file": fname},
        )
-    # clear stale issues for spaces that are fine again (or gone)
-    for sp in spaces:
-        sid = sp.get("id", "?")
-        if sid not in broken:
-            ir.async_delete_issue(hass, DOMAIN, f"broken_plan_{sid}")
+    # Clear stale issues. Iterating the CURRENT spaces could only ever clear
+    # issues for spaces that still exist, so deleting or renaming a space with a
+    # missing plan left its warning in Repairs forever, with nothing left to fix
+    # it (HP-1454-09). Enumerate what we actually published instead.
+    registry = ir.async_get(hass)
+    stale = [
+        issue_id
+        for (domain, issue_id) in list(registry.issues)
+        if domain == DOMAIN
+        and issue_id.startswith("broken_plan_")
+        and issue_id[len("broken_plan_") :] not in broken
+    ]
+    for issue_id in stale:
+        ir.async_delete_issue(hass, DOMAIN, issue_id)
@@ -2,6 +2,7 @@
 from __future__ import annotations

 import asyncio
+from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, field
 from typing import Any

@@ -42,6 +43,17 @@ class HouseplanData:
    # One lock for every load→modify→save cycle of both stores: prevents
    # lost updates from concurrent WS calls and makes the rev check atomic.
    write_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    # A separate, narrower lock for the check-quota→write-file pair of an
+    # upload. Without it N parallel uploads all measure the store BEFORE any
+    # of them writes, and all pass a quota only one of them fits under
+    # (HP-1490-02). Separate from write_lock so a slow directory scan does not
+    # stall config/layout commits.
+    upload_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    # Collect files nothing references any more. Set during setup, which also
+    # runs it once and schedules it daily. Exposed so it can be invoked
+    # directly — a test that fakes a 24 h jump proves the timer fires, not that
+    # the work happens, and those are different claims.
+    sweep: Callable[[], Awaitable[None]] | None = None


 HouseplanConfigEntry = ConfigEntry[HouseplanData]
@@ -0,0 +1,242 @@
+"""Server-side vacuum trails.
+
+The integration records the robot's path ITSELF by watching the source
+entity's state changes — no card involvement. This removes every client-side
+race (N open tabs would fight over writes), survives page reloads by
+construction, and keeps recording while no card is open at all. Stored: the
+current run and one previous run per marker (owner call 2026-07-31 — users
+want to see where the cleanup has already been).
+"""
+from __future__ import annotations
+
+import asyncio
+import time
+from typing import Any
+
+from homeassistant.core import HomeAssistant, callback
+from homeassistant.helpers import entity_registry as er
+from homeassistant.helpers.event import async_call_later, async_track_state_change_event
+from homeassistant.helpers.storage import Store
+
+from .const import DOMAIN
+
+import logging
+_LOGGER = logging.getLogger(__name__)
+
+TRAIL_CAP = 2000          # raw points per run before decimation
+SAVE_DELAY_S = 10         # debounce store writes — flash wear over precision
+FIRE_THROTTLE_S = 2.0     # event-bus updates for live cards
+MOVING_STATES = {"cleaning", "returning", "on"}
+
+
+def resolve_map_id(src_attrs: Any, vac_attrs: Any) -> str:
+    """Map-id normalisation contract, shared with the frontend.
+
+    Mirrors src/vacuum.ts vacMapIdFromAttrs (source attrs, `??`-chain) plus the
+    card's _vacMapId fallback to the vacuum entity's selected_map. The FIRST
+    value that is not None wins — truthiness is wrong here: a zero-based
+    `map_index: 0` is a valid first map and an empty string is still an id.
+    The old `or`-chain dropped the zero, so the server stored trails under a
+    key the renderer never looked up (HP-1540-02).
+    """
+    for v in (
+        src_attrs.get("map_name"),
+        src_attrs.get("current_map"),
+        src_attrs.get("map_index"),
+        src_attrs.get("selected_map"),
+        vac_attrs.get("selected_map"),
+    ):
+        if v is not None:
+            return str(v)
+    return "default"
+
+
+class TrailBook:
+    """Pure run bookkeeping: {marker: {current: run, previous: run}}.
+
+    A run is {"map_id", "started", "ended", "points": [[x, y], …]} in RAW
+    robot coordinates — recalibration never invalidates a stored trail.
+    """
+
+    def __init__(self, data: dict[str, Any] | None = None) -> None:
+        self.data: dict[str, Any] = data if isinstance(data, dict) else {}
+
+    def on_point(self, marker: str, map_id: str, x: float, y: float, now: float) -> bool:
+        rec = self.data.setdefault(marker, {})
+        cur = rec.get("current")
+        if not cur or cur.get("ended") or cur.get("map_id") != map_id:
+            # a new run begins: the old one becomes "previous" (and the one
+            # before it is forgotten — we keep exactly two, per the owner)
+            if cur:
+                rec["previous"] = cur
+            cur = {"map_id": map_id, "started": now, "ended": None, "points": []}
+            rec["current"] = cur
+        pts: list[list[float]] = cur["points"]
+        if pts and pts[-1][0] == x and pts[-1][1] == y:
+            return False
+        pts.append([x, y])
+        if len(pts) > TRAIL_CAP:
+            # decimate by two but never lose the freshest point
+            half = pts[0::2]
+            if half[-1] != pts[-1]:
+                half.append(pts[-1])
+            cur["points"] = half
+        return True
+
+    def end_run(self, marker: str, now: float) -> bool:
+        cur = (self.data.get(marker) or {}).get("current")
+        if cur and not cur.get("ended"):
+            cur["ended"] = now
+            return True
+        return False
+
+
+class TrailRecorder:
+    """HA wiring: watch the tracked entities, feed the book, persist, notify."""
+
+    def __init__(self, hass: HomeAssistant, rt: Any) -> None:
+        self.hass = hass
+        self.rt = rt
+        self.store = Store(hass, 1, f"{DOMAIN}.trails")
+        self.book = TrailBook()
+        # HP-1540-03: one source may feed SEVERAL markers — the same robot
+        # placed on two floors is the documented multi-floor case, and a plain
+        # source → (marker, vacuum) dict silently kept only the last one
+        self.pairs: dict[str, list[tuple[str, str]]] = {}  # source → [(marker, vacuum), …]
+        self._unsub_track = None
+        self._unsub_save = None
+        self._last_fire = 0.0
+        # HP-1540-05: config/set fires refresh as a detached task; two of them
+        # interleaving across the awaited load both subscribed and the loser's
+        # unsub handle was overwritten — a leak until HA restart
+        self._refresh_lock = asyncio.Lock()
+        self._closed = False
+
+    async def async_setup(self) -> None:
+        self.book = TrailBook(await self.store.async_load() or {})
+        await self.async_refresh()
+
+    async def async_refresh(self) -> None:
+        """(Re)subscribe after any config change — markers may come and go.
+
+        Serialised (HP-1540-05): the lock makes unsubscribe-then-resubscribe
+        atomic across the awaited config load, so overlapping refresh tasks can
+        no longer both subscribe and strand one callback forever. The _closed
+        check covers teardown() racing a refresh that is parked on its await.
+        """
+        async with self._refresh_lock:
+            stored = await self.rt.config_store.async_load() or {}
+            if self._closed:
+                return
+            cfg = stored.get("config") or {}
+            pairs: dict[str, list[tuple[str, str]]] = {}
+            for m in cfg.get("markers") or []:
+                v = m.get("vacuum") or {}
+                src = v.get("source")
+                if not src or v.get("live") is False:
+                    continue
+                vac = self._vacuum_entity(m)
+                if vac:
+                    # HP-1540-03: append, never overwrite — every floor's
+                    # marker records its own copy of the run
+                    pairs.setdefault(src, []).append((str(m.get("id")), vac))
+            self.pairs = pairs
+            if self._unsub_track:
+                self._unsub_track()
+                self._unsub_track = None
+            # deduplicated: two markers of one robot share source AND vacuum
+            ents = set(self.pairs) | {vac for ps in self.pairs.values() for _, vac in ps}
+            _LOGGER.info("Trail recorder: tracking %s", sorted(ents))
+            if ents:
+                self._unsub_track = async_track_state_change_event(
+                    self.hass, sorted(ents), self._on_state
+                )
+            # A run already in progress (HA restarted mid-cleanup, or the user
+            # just finished calibrating) must start recording NOW, not at the
+            # next state change — otherwise the first seconds of the path are
+            # lost.
+            for src in self.pairs:
+                self._sample(src, time.time())
+
+    def teardown(self) -> None:
+        # HP-1540-05: flag FIRST — a refresh parked on its awaited load must
+        # not re-subscribe after this cleanup has already run
+        self._closed = True
+        if self._unsub_track:
+            self._unsub_track()
+            self._unsub_track = None
+        if self._unsub_save:
+            self._unsub_save()
+            self._unsub_save = None
+
+    def _vacuum_entity(self, m: dict[str, Any]) -> str | None:
+        b = str(m.get("binding") or "")
+        if b.startswith("entity:vacuum."):
+            return b[len("entity:"):]
+        if b.startswith("device:"):
+            reg = er.async_get(self.hass)
+            for e in er.async_entries_for_device(reg, b[len("device:"):]):
+                if e.entity_id.startswith("vacuum."):
+                    return e.entity_id
+        return None
+
+    def _sample(self, src: str, now: float) -> bool:
+        """Record one point (or end the run) for EVERY marker fed by src.
+
+        HP-1540-03: the same source serves one marker per floor — all of them
+        must receive the point, not just whichever survived the dict.
+        """
+        changed = False
+        for marker, vac in self.pairs.get(src) or ():
+            st_vac = self.hass.states.get(vac)
+            # "no state yet" is NOT "stopped": during HA boot the vacuum reads
+            # unavailable and ending the run here would split one cleanup into
+            # current+previous on every restart (observed live: 21 points
+            # became previous, the same run restarted at 5)
+            if not st_vac or st_vac.state in ("unavailable", "unknown"):
+                continue
+            if st_vac.state not in MOVING_STATES:
+                changed |= self.book.end_run(marker, now)
+                continue
+            st_src = self.hass.states.get(src)
+            attrs = st_src.attributes if st_src else {}
+            raw = attrs.get("vacuum_position") or attrs.get("robot_position")
+            # Server-side these attributes are often OBJECTS (Tasshack keeps a
+            # Point dataclass in memory — it only becomes a dict when
+            # serialised to the frontend). Caught live on the owner's X50: the
+            # recorder saw every state change and rejected every single one.
+            if isinstance(raw, dict):
+                px, py = raw.get("x"), raw.get("y")
+            else:
+                px, py = getattr(raw, "x", None), getattr(raw, "y", None)
+            try:
+                x, y = float(px), float(py)  # type: ignore[arg-type]
+            except (TypeError, ValueError):
+                continue
+            map_id = resolve_map_id(attrs, st_vac.attributes)
+            changed |= self.book.on_point(marker, map_id, x, y, now)
+        return changed
+
+    @callback
+    def _on_state(self, event: Any) -> None:
+        eid = event.data.get("entity_id")
+        now = time.time()
+        changed = False
+        for src, pair_list in self.pairs.items():
+            if eid == src or any(eid == vac for _, vac in pair_list):
+                changed |= self._sample(src, now)
+        if changed:
+            self._schedule_save()
+            if now - self._last_fire >= FIRE_THROTTLE_S:
+                self._last_fire = now
+                self.hass.bus.async_fire("houseplan_trail_updated", {})
+
+    def _schedule_save(self) -> None:
+        if self._unsub_save:
+            return
+
+        async def _save(_now: Any) -> None:
+            self._unsub_save = None
+            await self.store.async_save(self.book.data)
+
+        self._unsub_save = async_call_later(self.hass, SAVE_DELAY_S, _save)
@@ -16,6 +16,9 @@ MAX_FILE_BYTES = 50 * 1024 * 1024

 SPACE_ID_RE = re.compile(r"^[a-z0-9_-]{1,64}$")
 _SAFE_NAME_RE = re.compile(r"[^A-Za-z0-9._-]+")
+# The name length the content view will accept back in a request. Anything a
+# generated name must fit inside, collision tag included (HP-1460-01).
+MAX_FILENAME = 120

 # ---------- sanitizers ----------

@@ -33,7 +36,7 @@ def sanitize_marker_id(value: str) -> str:
 def sanitize_filename(value: str) -> str:
    """Drop the path and leading dots, keep a safe file name."""
    raw = value.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
-    return _SAFE_NAME_RE.sub("_", raw).lstrip(".")[:120] or "file"
+    return _SAFE_NAME_RE.sub("_", raw).lstrip(".")[:MAX_FILENAME] or "file"


 def file_ext(filename: str) -> str:
@@ -47,13 +50,86 @@ def valid_space_id(value: str) -> bool:


 # ---------- voluptuous schemas ----------
+def _finite(value):
+    """Coerce to float and reject NaN/Infinity (audit B5).
+
+    'NaN' and 'Infinity' pass Coerce(float) and serialize to null on write,
+    silently corrupting a stored position forever.
+    """
+    f = float(value)
+    if f != f or f in (float("inf"), float("-inf")):
+        raise vol.Invalid("coordinate must be a finite number")
+    return f
+
+
+# generous caps: the product targets 20-200 devices and a handful of floors
+MAX_SPACES = 50
+MAX_ROOMS = 400
+MAX_MARKERS = 2000
+MAX_OPENINGS = 500
+MAX_DECOR = 1000
+MAX_LAYOUT = 5000
+# Inner limits (HP-1454-05). The outer collections were capped, the collections
+# INSIDE them were not: a 150 000-point polygon or a 100 000-entry known_devices
+# list passed validation, then made the card build gigantic SVG attributes and
+# walk them on every render. Any authenticated writer could store one, and with
+# `admin_only` off that is every user. These are product limits, not guesses: a
+# hand-drawn room does not need 500 vertices, and no home has 200 lights behind
+# one switch.
+MAX_POLY_POINTS = 500
+MAX_OPEN_TO = 50
+MAX_CONTROLS = 200
+MAX_PDFS = 50
+MAX_KNOWN_DEVICES = 20000
+MAX_TEXT = 500          # names, models, ids
+MAX_DESCRIPTION = 4000
+MAX_URL = 2000
+# Comfortably below the WebSocket frame limit (aiohttp's default is 4 MB): a
+# payload larger than the frame never reaches the handler at all — the socket
+# closes with 1009 and the user sees a dropped connection instead of an error
+# they can act on. For scale, a real three-floor home with ~200 devices stores
+# about 70 KB, so this is ~30x headroom.
+MAX_CONFIG_BYTES = 2 * 1024 * 1024
+
+_TEXT = vol.All(str, vol.Length(max=MAX_TEXT))
+_TEXT_OR_NONE = vol.Any(None, _TEXT)
+_URL = vol.All(str, vol.Length(max=MAX_URL))
+
+# Positions are normalised to the canvas (0..1). Allow generous slack for an
+# icon dragged past an edge, but not arbitrary magnitudes: any finite float
+# used to pass, and a single stored 1e100 stretched every client's view of the
+# space until the plan was invisible (HP-1500-03).
+_COORD = vol.All(_finite, vol.Range(min=-4.0, max=4.0))
+
 POS_SCHEMA = vol.Schema(
-    {vol.Required("x"): vol.Coerce(float), vol.Required("y"): vol.Coerce(float)},
+    {vol.Required("x"): _COORD, vol.Required("y"): _COORD},
    extra=vol.ALLOW_EXTRA,  # v2 records carry the "s" key (space id)
 )
-LAYOUT_SCHEMA = vol.Schema({str: POS_SCHEMA})
+LAYOUT_SCHEMA = vol.All(vol.Schema({str: POS_SCHEMA}), vol.Length(max=MAX_LAYOUT))

-POINT = vol.All([vol.Coerce(float)], vol.Length(min=2, max=2))
+# Geometry is normalised to the canvas (0..1). ±4 is generous slack for a
+# vertex nudged past an edge, not an envelope for arbitrary magnitudes: any
+# finite float used to pass here, and a single 1e100 room vertex stretched the
+# frame until the whole space was unviewable for every client (HP-1501-01) —
+# the exact failure HP-1500-03 closed for layout positions, one schema over.
+_GEOM = vol.All(_finite, vol.Range(min=-4.0, max=4.0))
+
+# A SIZE is not a coordinate (HP-1502-01): SVG requires positive width/height,
+# and the clients divide by these. `view_box: [0,0,0,0]` passed the shared
+# validator and serialised into viewBox="0 0 0 0" — a blank plan on every
+# client. The floor is one thousandth of the canvas (1 render unit): far below
+# any real room, but keeps the maths finite.
+_EXTENT = vol.All(_finite, vol.Range(min=0.001, max=4.0))
+
+
+def _view_box(value):
+    """[x, y, w, h]: the first two are coordinates, the last two are sizes."""
+    if not isinstance(value, (list, tuple)) or len(value) != 4:
+        raise vol.Invalid("view_box must be [x, y, w, h]")
+    return [_GEOM(value[0]), _GEOM(value[1]), _EXTENT(value[2]), _EXTENT(value[3])]
+
+
+POINT = vol.All([_GEOM], vol.Length(min=2, max=2))


 def _require_geometry(room: dict) -> dict:
@@ -65,10 +141,10 @@ def _require_geometry(room: dict) -> dict:
 ROOM_SCHEMA = vol.All(
    vol.Schema(
        {
-            vol.Required("id"): str,
-            vol.Required("name"): str,
-            vol.Optional("area"): vol.Any(str, None),
-            vol.Optional("open_to"): [str],
+            vol.Required("id"): _TEXT,
+            vol.Required("name"): _TEXT,
+            vol.Optional("area"): _TEXT_OR_NONE,
+            vol.Optional("open_to"): vol.All([_TEXT], vol.Length(max=MAX_OPEN_TO)),
            vol.Optional("settings"): vol.Any(
                None,
                vol.Schema(
@@ -82,11 +158,11 @@ ROOM_SCHEMA = vol.All(
                    extra=vol.ALLOW_EXTRA,
                ),
            ),
-            vol.Optional("x"): vol.Coerce(float),
-            vol.Optional("y"): vol.Coerce(float),
-            vol.Optional("w"): vol.Coerce(float),
-            vol.Optional("h"): vol.Coerce(float),
-            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3)),
+            vol.Optional("x"): _GEOM,
+            vol.Optional("y"): _GEOM,
+            vol.Optional("w"): _EXTENT,
+            vol.Optional("h"): _EXTENT,
+            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3, max=MAX_POLY_POINTS)),
        },
        extra=vol.ALLOW_EXTRA,
    ),
@@ -140,18 +216,26 @@ SPACE_SCHEMA = vol.Schema(
        vol.Required("title"): str,
        vol.Optional("settings"): SPACE_DISPLAY_SCHEMA,
        vol.Optional("plan_url"): vol.Any(str, None),
-        vol.Required("aspect"): vol.All(vol.Coerce(float), vol.Range(min=0.05, max=20)),
-        vol.Required("view_box"): vol.All([vol.Coerce(float)], vol.Length(min=4, max=4)),
-        vol.Required("rooms"): [ROOM_SCHEMA],
-        vol.Optional("decor"): [DECOR_SCHEMA],
-        vol.Optional("openings"): [
+        # The canvas is square since v1.48.0. What used to be the space's own
+        # `aspect` is gone; the background image keeps its own proportions and
+        # is centred, so only the IMAGE's ratio is stored. A stale tab may still
+        # send the old field — it is dropped rather than trusted, because the
+        # coordinates it comes with were normalised against a different box.
+        vol.Remove("aspect"): object,
+        vol.Optional("plan_aspect"): vol.Any(
+            None, vol.All(vol.Coerce(float), vol.Range(min=0.05, max=20))
+        ),
+        vol.Required("view_box"): _view_box,
+        vol.Required("rooms"): vol.All([ROOM_SCHEMA], vol.Length(max=MAX_ROOMS)),
+        vol.Optional("decor"): vol.All([DECOR_SCHEMA], vol.Length(max=MAX_DECOR)),
+        vol.Optional("openings"): vol.All([
            vol.Schema(
                {
                    vol.Required("id"): str,
                    vol.Required("type"): vol.Any("door", "window"),
-                    vol.Required("x"): vol.Coerce(float),
-                    vol.Required("y"): vol.Coerce(float),
-                    vol.Required("angle"): vol.Coerce(float),
+                    vol.Required("x"): _GEOM,
+                    vol.Required("y"): _GEOM,
+                    vol.Required("angle"): vol.All(_finite, vol.Range(min=-360.0, max=360.0)),
                    vol.Required("length"): vol.All(vol.Coerce(float), vol.Range(min=0.001, max=1)),
                    vol.Optional("contact"): vol.Any(str, None),
                    vol.Optional("lock"): vol.Any(str, None),
@@ -161,11 +245,14 @@ SPACE_SCHEMA = vol.Schema(
                },
                extra=vol.ALLOW_EXTRA,
            )
-        ],
+        ], vol.Length(max=MAX_OPENINGS)),
        # Legacy: walls are derived from room outlines since v1.19.0 — a line has no
        # independent existence. Still accepted so a stale browser tab cannot fail a save;
        # the card strips the field on every write.
-        vol.Optional("segments"): [vol.All([vol.Coerce(float)], vol.Length(min=4, max=4))],
+        # Accepted so a stale browser tab cannot fail a save, then DROPPED here
+        # (HP-1454-05): relying on a modern client to strip an unbounded legacy
+        # list is not a limit, it is a hope. `Remove` returns the key stripped.
+        vol.Remove("segments"): object,
    },
    extra=vol.ALLOW_EXTRA,
 )
@@ -177,35 +264,63 @@ MARKER_SCHEMA = vol.Schema(
        vol.Optional("space"): vol.Any(str, None),
        vol.Optional("area"): vol.Any(str, None),
        vol.Optional("hidden"): bool,
-        vol.Optional("name"): vol.Any(str, None),
-        vol.Optional("icon"): vol.Any(str, None),
-        vol.Optional("model"): vol.Any(str, None),
-        vol.Optional("link"): vol.Any(str, None),
-        vol.Optional("description"): vol.Any(str, None),
-        vol.Optional("tap_action"): vol.Any("info", "more-info", "toggle", None),
-        vol.Optional("controls"): vol.Any([str], None),
+        vol.Optional("name"): _TEXT_OR_NONE,
+        vol.Optional("icon"): _TEXT_OR_NONE,
+        vol.Optional("model"): _TEXT_OR_NONE,
+        vol.Optional("link"): vol.Any(None, _URL),
+        vol.Optional("description"): vol.Any(None, vol.All(str, vol.Length(max=MAX_DESCRIPTION))),
+        vol.Optional("tap_action"): vol.Any("info", "more-info", "toggle", "run", None),
+        # the 'run' target: only the runnable domains, nothing else is callable
+        vol.Optional("tap_target"): vol.Any(
+            None, vol.All(str, vol.Length(max=MAX_TEXT), vol.Match(r"^(automation|script|scene)\.[A-Za-z0-9_]+$"))
+        ),
+        vol.Optional("tap_confirm"): vol.Any(bool, None),
+        # live robot vacuums (docs/VACUUM.md): everything optional so configs
+        # from older versions stay valid untouched
+        vol.Optional("vacuum"): vol.Any(
+            None,
+            vol.Schema({
+                vol.Optional("live"): vol.Any(bool, None),
+                vol.Optional("trail"): vol.Any(bool, None),
+                vol.Optional("trail_mode"): vol.Any(
+                    None, vol.In(["never", "cleaning", "always"])
+                ),
+                vol.Optional("room_highlight"): vol.Any(bool, None),
+                vol.Optional("source"): vol.Any(str, None),
+                # one 6-number affine per robot map; numbers must be finite
+                vol.Optional("calibration"): vol.Schema(
+                    {str: vol.All([_finite], vol.Length(min=6, max=6))}
+                ),
+                vol.Optional("segment_map"): vol.Schema({str: str}),
+            }),
+        ),
+        vol.Optional("controls"): vol.Any(None, vol.All([_TEXT], vol.Length(max=MAX_CONTROLS))),
        vol.Optional("glow_radius_cm"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)), None),
+        vol.Optional("is_light"): vol.Any(bool, None),
        vol.Optional("room_id"): vol.Any(str, None),
-        vol.Optional("display"): vol.Any("badge", "ripple", "icon_ripple", None),
+        # keep in sync with DISPLAY_MODES in src/logic.ts — a cross-language test
+        # asserts every option the editor offers is accepted here (issue #3)
+        vol.Optional("display"): vol.Any("badge", "ripple", "icon_ripple", "value", None),
        vol.Optional("ripple_color"): vol.Any(str, None),
        vol.Optional("ripple_size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=1, max=20)), None),
        vol.Optional("size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=0.2, max=6)), None),
        vol.Optional("angle"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=-360, max=360)), None),
-        vol.Optional("pdfs"): [
-            vol.Schema({vol.Required("name"): str, vol.Required("url"): str}, extra=vol.ALLOW_EXTRA)
-        ],
+        vol.Optional("pdfs"): vol.All(
+            [vol.Schema({vol.Required("name"): _TEXT, vol.Required("url"): _URL}, extra=vol.ALLOW_EXTRA)],
+            vol.Length(max=MAX_PDFS),
+        ),
    },
    extra=vol.ALLOW_EXTRA,
 )
 CONFIG_SCHEMA = vol.Schema(
    {
-        vol.Required("spaces"): [SPACE_SCHEMA],
-        vol.Optional("markers", default=list): [MARKER_SCHEMA],
+        vol.Required("spaces"): vol.All([SPACE_SCHEMA], vol.Length(max=MAX_SPACES)),
+        vol.Optional("markers", default=list): vol.All([MARKER_SCHEMA], vol.Length(max=MAX_MARKERS)),
        vol.Optional("settings", default=dict): vol.Schema(
            {
                vol.Optional("glow_radius_cm"): vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)),
-                vol.Optional("known_devices"): [str],
-                vol.Optional("new_device_ids"): [str],
+                vol.Optional("known_devices"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
+                vol.Optional("new_device_ids"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
                vol.Optional("fill_colors"): vol.Schema(
                    {
                        str: vol.Schema(
@@ -1,8 +1,12 @@
 """House Plan WS commands: layout, space configuration, plan uploads."""
 from __future__ import annotations

+import logging
+
 import base64
 import binascii
+import json
+import secrets
 from pathlib import Path
 from typing import Any

@@ -12,27 +16,44 @@ from homeassistant.components import websocket_api
 from homeassistant.core import HomeAssistant, callback

 from .const import (
+    DOMAIN,
    CONF_ADMIN_ONLY, DEFAULT_CONFIG,
+    CONTENT_URL, FILES_DIR, MAX_PLANS_BYTES, MAX_PLANS_FILES, MAX_PLANS_LISTED,
+    MAX_SIGN_PATHS,
    PLANS_DIR, PLANS_URL,
 )
+from .auth import may_write
+from .plans import (
+    QuotaError, check_quota, collect_attachments, collect_plans, is_plan_file,
+    plan_basename, plan_refs, reserve_filename,
+)
 from .store import HouseplanData, get_data, get_entry
 from .validation import (
-    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_PLAN_BYTES,
-    PLAN_EXTENSIONS, POS_SCHEMA, valid_space_id,
+    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_CONFIG_BYTES, MAX_PLAN_BYTES,
+    PLAN_EXTENSIONS, POS_SCHEMA, sanitize_filename, valid_space_id,
 )


+_LOGGER = logging.getLogger(__name__)
+
+
@callback
 def async_register(hass: HomeAssistant) -> None:
    """Register the WS commands."""
    websocket_api.async_register_command(hass, ws_layout_get)
+    websocket_api.async_register_command(hass, ws_trail_get)
    websocket_api.async_register_command(hass, ws_layout_set)
+    websocket_api.async_register_command(hass, ws_geometry_repair)
    websocket_api.async_register_command(hass, ws_layout_update)
    websocket_api.async_register_command(hass, ws_layout_delete)
    websocket_api.async_register_command(hass, ws_config_get)
    websocket_api.async_register_command(hass, ws_config_set)
    websocket_api.async_register_command(hass, ws_plan_set)
+    websocket_api.async_register_command(hass, ws_plans_list)
+    websocket_api.async_register_command(hass, ws_plans_delete)
    websocket_api.async_register_command(hass, ws_files_migrate)
+    websocket_api.async_register_command(hass, ws_files_cleanup)
+    websocket_api.async_register_command(hass, ws_content_sign)


 def _runtime(hass: HomeAssistant, connection, msg_id: int) -> HouseplanData | None:
@@ -49,9 +70,8 @@ def _runtime(hass: HomeAssistant, connection, msg_id: int) -> HouseplanData | No


 def _check_write(hass: HomeAssistant, connection) -> bool:
-    entry = get_entry(hass)
-    admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
-    return connection.user.is_admin if admin_only else True
+    """May this connection write? Thin wrapper over the shared policy."""
+    return may_write(hass, getattr(connection, "user", None))


 # ---------------- layout ----------------
@@ -65,15 +85,27 @@ async def ws_layout_get(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
    if rt is None:
        return
    data = await rt.store.async_load() or {}
-    connection.send_result(msg["id"], {"layout": data.get("layout", {})})
+    connection.send_result(
+        msg["id"], {"layout": data.get("layout", {}), "rev": int(data.get("rev", 0))}
+    )


@websocket_api.websocket_command(
-    {vol.Required("type"): "houseplan/layout/set", vol.Required("layout"): LAYOUT_SCHEMA}
+    {
+        vol.Required("type"): "houseplan/layout/set",
+        vol.Required("layout"): LAYOUT_SCHEMA,
+        vol.Optional("expected_rev"): int,
+    }
 )
@websocket_api.async_response
 async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
-    """Replace the layout entirely."""
+    """Replace the layout entirely, with optimistic locking (audit B3).
+
+    Wholesale layout writes used to have no revision check at all, so two
+    clients silently overwrote each other. `expected_rev` is optional for
+    backwards compatibility with older cards, but when supplied it is enforced
+    exactly like the config store does.
+    """
    if not _check_write(hass, connection):
        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit the layout")
        return
@@ -81,8 +113,18 @@ async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
    if rt is None:
        return
    async with rt.write_lock:
-        await rt.store.async_save({"layout": msg["layout"]})
-    connection.send_result(msg["id"], {"ok": True})
+        data = await rt.store.async_load() or {}
+        current_rev = int(data.get("rev", 0))
+        if "expected_rev" in msg and msg["expected_rev"] != current_rev:
+            connection.send_error(
+                msg["id"], "conflict", f"Layout changed elsewhere (rev {current_rev})"
+            )
+            return
+        new_rev = current_rev + 1
+        await rt.store.async_save({**{k: v for k, v in data.items() if k not in ("layout", "rev")},
+                                   "layout": msg["layout"], "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})


@websocket_api.websocket_command(
@@ -105,8 +147,102 @@ async def ws_layout_update(hass: HomeAssistant, connection, msg: dict[str, Any])
        data = await rt.store.async_load() or {}
        layout = data.get("layout", {})
        layout[msg["device_id"]] = msg["pos"]
-        await rt.store.async_save({"layout": layout})
-    connection.send_result(msg["id"], {"ok": True})
+        # keep the revision: a point-wise write used to drop it, which made the
+        # optimistic locking on layout/set meaningless — every drag reset the
+        # counter to 0 (HP-1454-08)
+        new_rev = int(data.get("rev", 0)) + 1
+        await rt.store.async_save({**{k: v for k, v in data.items() if k not in ("layout", "rev")},
+                                   "layout": layout, "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/geometry/repair",
+        vol.Required("space_id"): str,
+        vol.Required("aspect"): vol.All(vol.Coerce(float), vol.Range(min=0.05, max=20)),
+        vol.Optional("dry_run"): bool,
+        vol.Optional("undo"): bool,
+    }
+)
+@websocket_api.async_response
+async def ws_geometry_repair(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Re-apply the square-canvas transform to ONE space's layout, explicitly.
+
+    For installations that hit the v1.48/v1.49 crash window: the config write
+    of the migration landed, the layout write did not, and the trigger fields
+    were already gone — markers and labels of that space are stranded in the
+    old coordinates with nothing able to tell (HP-1500-01). Nothing can be
+    detected reliably after the fact, and re-running a transform on a layout
+    that is already correct would corrupt it, so this NEVER runs by itself:
+    an administrator names the space and its old aspect, may preview with
+    `dry_run`, and gets a one-deep backup written in the same store write —
+    `undo` restores it.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may repair the layout")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    from .geometry_migration import migrate_layout
+
+    space_id = msg["space_id"]
+    if not valid_space_id(space_id):
+        connection.send_error(msg["id"], "invalid_space_id", "space_id: only [a-z0-9_-], up to 64 characters")
+        return
+    async with rt.write_lock:
+        data = await rt.store.async_load() or {}
+        layout = data.get("layout") or {}
+        current_rev = int(data.get("rev", 0))
+        if msg.get("undo"):
+            backup = data.get("repair_backup")
+            if not isinstance(backup, dict) or backup.get("space") != space_id:
+                connection.send_error(msg["id"], "no_backup", "No repair backup stored for this space")
+                return
+            restored = dict(layout)
+            for key, pos in (backup.get("positions") or {}).items():
+                restored[key] = pos
+            new_rev = current_rev + 1
+            await rt.store.async_save({"layout": restored, "rev": new_rev})
+            hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+            connection.send_result(msg["id"], {"ok": True, "rev": new_rev,
+                                               "restored": len(backup.get("positions") or {})})
+            return
+        touched = {
+            k: dict(v) for k, v in layout.items()
+            if isinstance(v, dict) and str(v.get("s")) == space_id
+        }
+        if not touched:
+            # A typo'd space id used to "succeed" with moved: 0 — and its
+            # empty result REPLACED the one-deep backup, destroying the very
+            # undo this endpoint promises (HP-1501-02). Nothing to move means
+            # nothing to save: no write, no revision bump, the backup stays.
+            connection.send_error(
+                msg["id"], "nothing_to_repair",
+                f"No stored positions belong to space '{space_id}'",
+            )
+            return
+        preview = {k: dict(v) for k, v in touched.items()}
+        migrate_layout(preview, {space_id: msg["aspect"]})
+        if msg.get("dry_run"):
+            connection.send_result(msg["id"], {
+                "ok": True, "dry_run": True, "moved": len(preview),
+                "before": touched, "after": preview,
+            })
+            return
+        new_layout = {**layout, **preview}
+        new_rev = current_rev + 1
+        # the backup rides the same store write: either both are durable or
+        # neither — the deletion-shy rules of this project apply to positions
+        # too
+        await rt.store.async_save({
+            "layout": new_layout, "rev": new_rev,
+            "repair_backup": {"space": space_id, "positions": touched},
+        })
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev, "moved": len(preview)})


@websocket_api.websocket_command(
@@ -118,17 +254,24 @@ async def ws_layout_update(hass: HomeAssistant, connection, msg: dict[str, Any])
 )
@websocket_api.async_response
 async def ws_files_migrate(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
-    """Move a marker's uploaded files to its new id (rebinding changes the id).
+    """COPY a marker's uploaded files to its new id and report the exact mapping.

-    Without this the PDF urls keep pointing at the OLD id's folder, which then
-    looks orphaned and is one cleanup away from deletion — the exact way the
-    owner lost the sauna heater manuals (field incident, 2026-07-26).
+    Rebinding changes the marker id, so the files must follow (that is how the
+    owner lost a set of manuals, 2026-07-26). This used to MOVE them before the
+    revision-checked config save: when that save was rejected, the server kept
+    the old urls while the files had already left the old folder — a permanent
+    broken link (review CR-2, 2026-07-27).
+
+    Now it copies, never overwrites, and returns {src: dst} for every file so
+    the client can rewrite EXACTLY the urls that made it (review CR-3). The old
+    folder is removed later by houseplan/files/cleanup, once the config is
+    safely committed.
    """
    if not _check_write(hass, connection):
        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit files")
        return
-    from pathlib import Path
    import shutil
+    from pathlib import Path

    from .const import FILES_DIR
    from .validation import sanitize_marker_id
@@ -136,32 +279,251 @@ async def ws_files_migrate(hass: HomeAssistant, connection, msg: dict[str, Any])
    src_id = sanitize_marker_id(msg["from_id"])
    dst_id = sanitize_marker_id(msg["to_id"])
    if not src_id or not dst_id or src_id == dst_id:
-        connection.send_result(msg["id"], {"ok": True, "moved": 0})
+        connection.send_result(msg["id"], {"ok": True, "mapping": {}, "copied": 0})
        return
    base = Path(hass.config.path(FILES_DIR))
    src = base / src_id
    dst = base / dst_id

-    def _move() -> int:
+    def _copy() -> dict[str, str]:
        if not src.is_dir():
-            return 0
+            return {}
        dst.mkdir(parents=True, exist_ok=True)
-        n = 0
-        for f in src.iterdir():
+        mapping: dict[str, str] = {}
+        for f in sorted(src.iterdir()):
            if not f.is_file():
                continue
-            target = dst / f.name
-            if not target.exists():
-                shutil.move(str(f), str(target))
-                n += 1
-        try:
-            src.rmdir()  # only when empty
-        except OSError:
-            pass
-        return n
+            # a different file may already own this name — do NOT silently point
+            # the url at it. The shared helper CLAIMS a free one atomically, so
+            # a concurrent migrate or upload cannot pick the same one, and the
+            # name it returns is one the content view accepts back in a request.
+            name = reserve_filename(dst, f.name)
+            target = dst / name
+            try:
+                shutil.copy2(str(f), str(target))
+            except OSError:
+                target.unlink(missing_ok=True)  # never leave an empty placeholder
+                raise
+            mapping[f.name] = name
+        return mapping

-    moved = await hass.async_add_executor_job(_move)
-    connection.send_result(msg["id"], {"ok": True, "moved": moved})
+    try:
+        mapping = await hass.async_add_executor_job(_copy)
+    except OSError as err:
+        connection.send_error(msg["id"], "io_error", f"Could not copy marker files: {err}")
+        return
+    connection.send_result(msg["id"], {"ok": True, "mapping": mapping, "copied": len(mapping)})
+
+
+@websocket_api.websocket_command({vol.Required("type"): "houseplan/plans/list"})
+@websocket_api.async_response
+async def ws_plans_list(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Plan images on the server, with what still uses them.
+
+    Files are never removed for being unreferenced (docs/SCOPE.md), which only
+    works as a policy if the user can see them: detaching a plan keeps the
+    image, and this is how it gets picked up again — or deleted on purpose.
+    """
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    stored = await rt.config_store.async_load() or {}
+    cfg = stored.get("config") or {}
+    used: dict[str, list[str]] = {}
+    for space in cfg.get("spaces") or []:
+        name = plan_basename(space.get("plan_url"))
+        if name:
+            used.setdefault(name, []).append(space.get("title") or space.get("id") or "?")
+
+    plans_dir = Path(hass.config.path(PLANS_DIR))
+
+    def _scan() -> list[dict[str, Any]]:
+        out: list[dict[str, Any]] = []
+        if not plans_dir.is_dir():
+            return out
+        for item in sorted(plans_dir.iterdir()):
+            if not item.is_file() or not is_plan_file(item.name):
+                continue
+            try:
+                st = item.stat()
+            except OSError:
+                continue
+            out.append({
+                "name": item.name,
+                "url": f"{CONTENT_URL}/plans/_/{item.name}",
+                "size": st.st_size,
+                "modified": int(st.st_mtime),
+                "used_by": used.get(item.name, []),
+            })
+        out.sort(key=lambda x: -x["modified"])
+        return out
+
+    plans = await hass.async_add_executor_job(_scan)
+    # newest first and capped: a folder with thousands of files would otherwise
+    # become one huge message, one huge list and a signing request per row
+    connection.send_result(
+        msg["id"], {"plans": plans[:MAX_PLANS_LISTED], "total": len(plans)}
+    )
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/plans/delete",
+        vol.Required("name"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_plans_delete(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Delete a plan image because the user asked — the only way one goes.
+
+    Refuses while a space still references it: the answer to "can I delete this"
+    is the stored configuration's, not the client's.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may delete plans")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    name = sanitize_filename(msg["name"])
+    if not is_plan_file(name):
+        connection.send_error(msg["id"], "invalid_name", "Not a plan file")
+        return
+
+    async with rt.write_lock:
+        stored = await rt.config_store.async_load() or {}
+        cfg = stored.get("config") or {}
+        if name in plan_refs(cfg):
+            connection.send_error(
+                msg["id"], "in_use", "A space still uses this plan — detach it first"
+            )
+            return
+        path = Path(hass.config.path(PLANS_DIR)) / name
+
+        def _rm() -> bool:
+            try:
+                path.unlink()
+                return True
+            except FileNotFoundError:
+                return False
+            except OSError as err:
+                _LOGGER.warning("House Plan: could not delete %s: %s", path, err)
+                return False
+
+        removed = await hass.async_add_executor_job(_rm)
+    connection.send_result(msg["id"], {"ok": True, "removed": removed})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/content/sign",
+        vol.Required("paths"): [str],
+    }
+)
+@websocket_api.async_response
+async def ws_content_sign(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Sign content paths so the BROWSER can fetch them.
+
+    Home Assistant authenticates HTTP requests by a Bearer header or an
+    `authSig` signed path — there is no cookie auth. An <image href> inside SVG
+    and a plain <a href> can send neither, so after the content endpoint became
+    `requires_auth` the plan backgrounds and PDF links returned 401 (audit
+    follow-up B1 regression, 2026-07-27 — reproduced live).
+
+    The card asks for signatures and uses the signed urls for display.
+    """
+    from datetime import timedelta
+
+    from homeassistant.components.http.auth import async_sign_path
+
+    out: dict[str, str] = {}
+    token_id = getattr(connection, "refresh_token_id", None)
+    for path in msg["paths"][:MAX_SIGN_PATHS]:
+        if not isinstance(path, str) or not path.startswith(CONTENT_URL + "/"):
+            continue  # only ever sign our own content endpoint
+        clean = path.split("?", 1)[0]
+        try:
+            try:
+                signed = async_sign_path(hass, clean, timedelta(hours=24), refresh_token_id=token_id)
+            except TypeError:  # older HA signature: (hass, refresh_token_id, path, expiration)
+                signed = async_sign_path(hass, token_id, clean, timedelta(hours=24))
+        except Exception as err:  # noqa: BLE001 — signing must never break the card
+            _LOGGER.warning("House Plan: could not sign %s: %s", clean, err)
+            continue
+        out[path] = signed
+    connection.send_result(msg["id"], {"urls": out})
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "houseplan/files/cleanup",
+        vol.Required("marker_id"): str,
+    }
+)
+@websocket_api.async_response
+async def ws_files_cleanup(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
+    """Drop a marker folder's leftovers after its files moved elsewhere.
+
+    Called after a rebind: the files were copied to the new marker id and the
+    config that references them is committed, so the source folder is spent.
+
+    It used to `rmtree` the folder on the client's word alone. Two ways that
+    ends badly: a partial copy leaves some urls still pointing INTO this folder
+    (the migration deliberately does not rewrite those), and a wrong or stale
+    id from any client deletes a live marker's attachments outright. So the
+    server checks for itself — under the config lock — and removes only files
+    the stored configuration does not reference. Same principle as the
+    collector: a client may say what it no longer needs, never what may go.
+    """
+    if not _check_write(hass, connection):
+        connection.send_error(msg["id"], "unauthorized", "Only administrators may edit files")
+        return
+    rt = _runtime(hass, connection, msg["id"])
+    if rt is None:
+        return
+    from .const import FILES_DIR
+    from .plans import attachment_refs
+    from .validation import sanitize_marker_id
+
+    mid = sanitize_marker_id(msg["marker_id"])
+    base = Path(hass.config.path(FILES_DIR)).resolve()
+    target = (base / mid).resolve() if mid else base
+    if not mid or not str(target).startswith(str(base)) or target == base:
+        connection.send_result(msg["id"], {"ok": True, "removed": 0, "kept": 0})
+        return
+
+    async with rt.write_lock:
+        stored = await rt.config_store.async_load() or {}
+        refs = attachment_refs(stored.get("config") or {})
+
+        def _rm() -> tuple[int, int]:
+            if not target.is_dir():
+                return 0, 0
+            removed = kept = 0
+            for item in sorted(target.iterdir()):
+                if not item.is_file():
+                    continue
+                if f"{mid}/{item.name}" in refs:
+                    kept += 1
+                    continue
+                try:
+                    item.unlink()
+                    removed += 1
+                except OSError as err:
+                    _LOGGER.warning("House Plan: could not remove %s: %s", item, err)
+            if not kept:
+                try:
+                    target.rmdir()
+                except OSError:
+                    pass
+            return removed, kept
+
+        removed, kept = await hass.async_add_executor_job(_rm)
+    if kept:
+        _LOGGER.info(
+            "House Plan: kept %s file(s) in %s — the configuration still references them", kept, mid
+        )
+    connection.send_result(msg["id"], {"ok": True, "removed": removed, "kept": kept})


@websocket_api.websocket_command(
@@ -179,13 +541,18 @@ async def ws_layout_delete(hass: HomeAssistant, connection, msg: dict[str, Any])
    rt = _runtime(hass, connection, msg["id"])
    if rt is None:
        return
+    new_rev: int | None = None
    async with rt.write_lock:
        data = await rt.store.async_load() or {}
        layout = data.get("layout", {})
        if msg["device_id"] in layout:
            del layout[msg["device_id"]]
-            await rt.store.async_save({"layout": layout})
-    connection.send_result(msg["id"], {"ok": True})
+            new_rev = int(data.get("rev", 0)) + 1
+            await rt.store.async_save({**{k: v for k, v in data.items() if k not in ("layout", "rev")},
+                                       "layout": layout, "rev": new_rev})
+    if new_rev is not None:
+        hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})


 # ---------------- space configuration ----------------
@@ -203,6 +570,47 @@ async def ws_config_get(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
    connection.send_result(msg["id"], {"config": config, "rev": data.get("rev", 0)})


+
+def _internal_plan_names(config: dict[str, Any]) -> set[str]:
+    """Plan file names a configuration names through OUR urls.
+
+    Only `/api/houseplan/content/plans/_/<name>` and the legacy static path
+    count. Anything else belongs to the user and may point wherever they like.
+    """
+    out: set[str] = set()
+    for space in (config or {}).get("spaces") or []:
+        url = space.get("plan_url")
+        if not isinstance(url, str) or not url:
+            continue
+        if not (url.startswith(CONTENT_URL + "/plans/") or url.startswith(PLANS_URL + "/")):
+            continue
+        name = plan_basename(url)
+        if name:
+            out.add(name)
+    return out
+
+
+def _missing_internal_plans(
+    plans_dir: Path, config: dict[str, Any], previous: dict[str, Any] | None = None
+) -> set[str]:
+    """Newly named plan files that are not on disk.
+
+    Guards the pick-then-save window: another client may delete a plan between
+    the moment this one chose it and the moment it saves, which would otherwise
+    store a url with nothing behind it (HP-1470-02).
+
+    A name the stored configuration already carries is deliberately let through.
+    It is already broken — repairs says so — and refusing the write would lock
+    the owner out of every other edit, including the one that detaches it.
+    """
+    known = _internal_plan_names(previous or {})
+    return {
+        name
+        for name in _internal_plan_names(config)
+        if name not in known and not (plans_dir / name).is_file()
+    }
+
+
@websocket_api.websocket_command(
    {
        vol.Required("type"): "houseplan/config/set",
@@ -224,18 +632,69 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
    rt = _runtime(hass, connection, msg["id"])
    if rt is None:
        return
+    # Per-field limits bound each list; this bounds their product (HP-1454-05).
+    # Everything below the caps can still add up to something no dashboard can
+    # render, and the store writes it to disk on every save.
+    size = len(json.dumps(msg["config"], separators=(",", ":")))
+    if size > MAX_CONFIG_BYTES:
+        connection.send_error(
+            msg["id"], "too_large",
+            f"Configuration is {size // 1024} KB, the limit is {MAX_CONFIG_BYTES // 1024} KB",
+        )
+        return
    async with rt.write_lock:
        data = await rt.config_store.async_load() or {}
        current_rev = data.get("rev", 0)
+        if "expected_rev" not in msg and current_rev:
+            # audit B4: expected_rev stays optional for old cards mid-upgrade,
+            # but a blind overwrite of a non-empty store is worth a warning —
+            # it is exactly how a stale client silently discards someone's work.
+            _LOGGER.warning(
+                "House Plan: config/set without expected_rev over rev %s — "
+                "the client bypasses conflict detection (outdated card?)",
+                current_rev,
+            )
        if "expected_rev" in msg and msg["expected_rev"] != current_rev:
            connection.send_error(
                msg["id"], "conflict",
                f"Configuration was changed in another window (rev {current_rev} != {msg['expected_rev']})",
            )
            return
+        # An internal plan url must name a file that exists. The card can pick a
+        # plan and then delete it from the same dialog, and two clients can do
+        # the same thing in either order — the lock serialises them but says
+        # nothing about whether the file survived (HP-1470-02). External and
+        # legacy urls are not ours to check and are left alone.
+        missing = await hass.async_add_executor_job(
+            _missing_internal_plans,
+            Path(hass.config.path(PLANS_DIR)),
+            msg["config"],
+            data.get("config"),
+        )
+        if missing:
+            connection.send_error(
+                msg["id"], "missing_plan",
+                "Plan file no longer exists: " + ", ".join(sorted(missing)),
+            )
+            return
        new_rev = current_rev + 1
        await rt.config_store.async_save({"config": msg["config"], "rev": new_rev})
+        # Still holding the lock: the file system is not part of the store's
+        # transaction, so collection has to be pinned to this commit (R3-1).
+        # It is best-effort housekeeping behind an already durable write — a
+        # failure here must not withhold the event and the success response,
+        # or the client retries an edit the server has already accepted and
+        # gets a conflict for its trouble (R4-1).
+        def _collect() -> None:
+            collect_plans(Path(hass.config.path(PLANS_DIR)), data.get("config"), msg["config"])
+            collect_attachments(Path(hass.config.path(FILES_DIR)), data.get("config"), msg["config"])
+
+        try:
+            await hass.async_add_executor_job(_collect)
+        except Exception:  # noqa: BLE001 — see above: the commit stands regardless
+            _LOGGER.exception("House Plan: collecting superseded files failed")
    hass.bus.async_fire("houseplan_config_updated", {"rev": new_rev})
+    _refresh_trail_recorder(hass)
    # refresh repair issues (broken plan references) without waiting for a restart
    entry = get_entry(hass)
    if entry is not None:
@@ -275,20 +734,54 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
        connection.send_error(msg["id"], "too_large", f"Plan is larger than {MAX_PLAN_BYTES // 1024 // 1024} MB")
        return

+    # Copy-on-write: a plan is written under a NEW unique name and nothing is
+    # deleted here (review R2-1). The old name stays readable, so a config write
+    # that is later rejected — revision conflict, validation, lost connection —
+    # leaves the stored plan exactly as it was. The card calls
+    # nothing here; the file a commit REPLACES is collected by `config/set`
+    # itself, inside the write lock (review R3-1). An upload that never gets
+    # committed is not collected at all — it is offered back in the space
+    # dialog's "already uploaded" list, where the user can attach or delete it.
+    # Every attempt to age these out ended in data loss or a race (v1.46.4-6).
+    #
+    # `.` separates the id from the token because a space id cannot contain one
+    # (SPACE_ID_RE), so "<space>.<token>.<ext>" can never be confused with the
+    # files of a differently named space.
    plans_dir = Path(hass.config.path(PLANS_DIR))
-    path = plans_dir / f"{space_id}.{msg['ext']}"
+    name = f"{space_id}.{secrets.token_hex(4)}.{msg['ext']}"
+    path = plans_dir / name

-    def _write() -> int:
+    def _check_and_write() -> None:
+        # one executor job for the pair, under upload_lock: the measurement
+        # is only a bound if nothing else writes between it and our write
+        # (HP-1490-02). A failed write reserves nothing — the file either
+        # exists and is counted by the next scan, or does not and is not.
+        check_quota(plans_dir, len(raw), MAX_PLANS_BYTES, MAX_PLANS_FILES)
        plans_dir.mkdir(parents=True, exist_ok=True)
-        # remove old variants with a different extension
-        for old_ext in PLAN_EXTENSIONS:
-            old = plans_dir / f"{space_id}.{old_ext}"
-            if old_ext != msg["ext"] and old.exists():
-                old.unlink()
        path.write_bytes(raw)
-        return int(path.stat().st_mtime)

-    mtime = await hass.async_add_executor_job(_write)
-    connection.send_result(
-        msg["id"], {"ok": True, "url": f"{PLANS_URL}/{space_id}.{msg['ext']}?v={mtime}"}
-    )
+    data = _runtime(hass, connection, msg["id"])
+    if data is None:
+        return
+    async with data.upload_lock:
+        try:
+            await hass.async_add_executor_job(_check_and_write)
+        except QuotaError as err:
+            connection.send_error(msg["id"], err.reason, err.detail)
+            return
+    connection.send_result(msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{name}"})
+
+
+def _refresh_trail_recorder(hass: HomeAssistant) -> None:
+    """Markers changed — the trail recorder must re-resolve what it watches."""
+    rec = hass.data.get(DOMAIN, {}).get("trail_recorder")
+    if rec:
+        hass.async_create_task(rec.async_refresh())
+
+
+@websocket_api.websocket_command({vol.Required("type"): "houseplan/trail/get"})
+@websocket_api.async_response
+async def ws_trail_get(hass: HomeAssistant, connection: websocket_api.ActiveConnection, msg: dict) -> None:
+    """Current + previous cleanup runs per marker, raw robot coordinates."""
+    rec = hass.data.get(DOMAIN, {}).get("trail_recorder")
+    connection.send_result(msg["id"], {"trails": rec.book.data if rec else {}})
@@ -6,10 +6,45 @@ import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
 const ROOT = dirname(fileURLToPath(import.meta.url)) + '/srv';
 const CT = { '.html': 'text/html', '.js': 'text/javascript', '.svg': 'image/svg+xml' };
+// ---- assertion harness (audit T1) --------------------------------------
+// Until 2026-07-27 the smokes printed booleans and always exited 0: a broken
+// build reported success. `check()` accumulates named failures, `finish()`
+// prints them and sets the exit code.
+const _failures = [];
+let _pageErrors = 0;
+
+/** Assert one named fact. `expected` defaults to true. */
+export function check(name, actual, expected = true) {
+  const ok = JSON.stringify(actual) === JSON.stringify(expected);
+  if (!ok) _failures.push(`${name}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  return ok;
+}
+
+/** Assert a whole result object: every key must equal true unless listed. */
+export function checkAll(out, expected = {}) {
+  for (const [k, v] of Object.entries(out)) check(k, v, k in expected ? expected[k] : true);
+  return out;
+}
+
+/** Print the result, report failures, close the browser, set the exit code. */
+export async function finish(browser, out) {
+  if (out !== undefined) console.log(JSON.stringify(out, null, 1));
+  if (_pageErrors) _failures.push(`${_pageErrors} uncaught exception(s) inside the card`);
+  await browser?.close?.();
+  if (_failures.length) {
+    console.error('\nFAILED (' + _failures.length + '):');
+    for (const f of _failures) console.error('  - ' + f);
+    process.exitCode = 1;
+  } else {
+    console.log('OK');
+  }
+}
+
 export async function launch(viewport = { width: 820, height: 760 }, scale = 1) {
  const browser = await chromium.launch({ args: ['--no-sandbox'] });
  const page = await (await browser.newContext({ viewport, deviceScaleFactor: scale })).newPage();
-  page.on('pageerror', (e) => console.log('EXC', e.message));
+  // audit T1: an exception inside the card used to be logged and ignored
+  page.on('pageerror', (e) => { _pageErrors++; console.log('EXC', e.message); });
  await page.route('**/*', (r) => {
    const u = new URL(r.request().url());
    let p = decodeURIComponent(u.pathname);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -33,7 +33,7 @@ const res = await page.evaluate(async () => {
  const a = devs[0], b = devs[1];
  const pa = c._pos(a);
  // поставим b на тот же Y, начнём drag
-  c._layout = { ...c._layout, [b.id]: { s: c._space, x: (pa.x + g * 12) / 1000, y: pa.y / (1000 / (c._curSpaceCfg.aspect || 1)) } };
+  c._layout = { ...c._layout, [b.id]: { s: c._space, x: (pa.x + g * 12) / 1000, y: pa.y / 1000 } };
  c._drag = { id: b.id, sx: 0, sy: 0, ox: 0, oy: 0, moved: true };
  c.requestUpdate(); await c.updateComplete;
  out.devGuide = guides() >= 1;
@@ -42,7 +42,7 @@ const res = await page.evaluate(async () => {
  // 4) подложка: рисование прямоугольника с углом на одном X с углом другой фигуры
  c._setMode('decor'); await c.updateComplete;
  c._curSpaceCfg.decor = [{ id: 'd1', kind: 'rect', x: 0.2, y: 0.2, w: 0.1, h: 0.1, color: '#ff0000', width: 3 }];
-  const W = 1000, H = 1000 / (c._curSpaceCfg.aspect || 1);
+  const W = 1000, H = 1000;   // square canvas
  c._decorDraft = { kind: 'rect', a: [0.5 * W, 0.5 * H], b: [0.2 * W, 0.6 * H], pid: 9 }; // b.x == углу d1
  c.requestUpdate(); await c.updateComplete;
  out.decorGuide = guides() >= 1;
@@ -52,5 +52,5 @@ const res = await page.evaluate(async () => {
  out.noneInView = guides() === 0;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,75 @@
+// Аудит v1.49.0: HP-1490-03 (редакторы видят весь холст) и HP-1490-04
+// (Save ждёт пропорции выбранного сохранённого плана, старые не наследуются).
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 1000 }, 1);
+const out = {};
+
+// ---- HP-1490-03: content-fit только в просмотре -------------------------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  // рукописное пространство: одна маленькая комната в центре квадрата
+  const cfg = JSON.parse(JSON.stringify(c._serverCfg));
+  cfg.spaces[0].plan_url = null; cfg.spaces[0].plan_aspect = null;
+  cfg.spaces[0].rooms = [{ id: 'r1', name: 'One', area: 'living_room',
+    poly: [[0.4, 0.4], [0.6, 0.4], [0.6, 0.6], [0.4, 0.6]] }];
+  c._serverCfg = cfg; c._model = null; c._view = null; c.requestUpdate();
+  await c.updateComplete;
+  await new Promise((r) => requestAnimationFrame(r));
+  const inView = c._baseVb();
+  o.viewIsContentFit = inView[2] < 999; // меньше холста (устройства тоже содержимое)
+  c._setMode('plan'); await c.updateComplete;
+  await new Promise((r) => requestAnimationFrame(r));
+  const inPlan = c._baseVb();
+  o.editorSeesWholeCanvas = inPlan[2] === 1000 && inPlan[3] === 1000;
+  const v = c._viewOr(c._baseVb());
+  o.editorViewCoversCanvas = v.w >= 999; // старый cropped view не пережил смену
+  // в редакторе можно ткнуть в дальний угол холста
+  o.canReachFarCorner = (() => {
+    const stage = (c.shadowRoot || c.renderRoot).querySelector('.stage');
+    const pt = c._screenToVb(stage.clientWidth - 1, stage.clientHeight - 1);
+    return pt[0] > 900 || pt[1] > 900;
+  })();
+  c._setMode('view'); await c.updateComplete;
+  await new Promise((r) => requestAnimationFrame(r));
+  const back = c._baseVb();
+  o.contentFitRestored = back[2] < 999;
+  return o;
+}));
+
+// ---- HP-1490-04: Save ждёт aspect --------------------------------------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  let saved = null;
+  let signDelay = 500; // подпись приходит поздно
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plans/list') return { plans: [
+      { name: 'wide.svg', url: '/api/houseplan/content/plans/_/wide.svg', size: 10, modified: 1, used_by: [] },
+    ] };
+    if (m.type === 'houseplan/content/sign') {
+      await new Promise((r) => setTimeout(r, signDelay));
+      const urls = {}; for (const p of m.paths) urls[p] = '/assets/wide.svg'; return { urls };
+    }
+    if (m.type === 'houseplan/config/set') { saved = m.config; return { rev: (c._cfgRev || 0) + 1 }; }
+    if (m.type === 'houseplan/config/get') return { config: saved || c._serverCfg, rev: c._cfgRev || 0 };
+    return base(m);
+  } };
+  // страница отдаёт /assets/wide.svg размером 800x200 (создан рядом)
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, source: 'file', planUrl: null, planFile: null };
+  await c.updateComplete;
+  c._useServerPlan('/api/houseplan/content/plans/_/wide.svg');
+  o.oldAspectCleared = c._spaceDialog.savedAspect === undefined;
+  // Save сразу, до прихода подписи
+  const p = c._saveSpaceDialog();
+  await p;
+  o.savedUrl = saved?.spaces?.[0]?.plan_url === '/api/houseplan/content/plans/_/wide.svg';
+  const a = saved?.spaces?.[0]?.plan_aspect;
+  o.savedAspectIsReal = Math.abs((a || 0) - 4) < 0.01; // 800x200
+  o.notTheOldAspect = a !== 1.25;
+  return o;
+}));
+
+await finish(browser, checkAll(out));
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -46,5 +46,5 @@ const res = await page.evaluate(async () => {
  c._markerDialog = null;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,44 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push([d, s, data.entity_id]); return Promise.resolve(); } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  // устройство с управляемой сущностью
+  const dev = c._devices.find((d) => d.entities?.some((e) => e.startsWith('light.') || e.startsWith('switch.')));
+  out.hasDev = !!dev;
+  c._infoCard = dev; await c.updateComplete;
+  // 1) блок сущностей идёт ПЕРВЫМ, до модели/ссылок
+  const body = sr().querySelector('.dialog .body');
+  out.entListFirst = body.firstElementChild?.classList.contains('entlist')
+    || body.querySelector('.entlist') === body.children[0];
+  const rows = [...sr().querySelectorAll('.entrow')];
+  out.rows = rows.length > 0;
+  // 2) у переключаемой сущности — кнопка с крупной зоной нажатия
+  const btn = sr().querySelector('.entbtn');
+  out.hasButton = !!btn;
+  const box = btn?.getBoundingClientRect();
+  out.tapTarget = box ? box.height >= 30 && box.width >= 60 : null;
+  // 3) кнопка реально переключает
+  const before = calls.length;
+  btn.click(); await c.updateComplete;
+  out.toggles = calls.length > before && calls.at(-1)[1] === 'toggle';
+  // 4) замок никогда не переключается из карточки
+  const n = calls.length;
+  c._cardToggle('lock.front_door');
+  out.lockNeverToggles = calls.length === n;
+  // 5) диагностические/конфиг-сущности не засоряют список
+  const ents = c._cardEntities(dev).map((e) => e.eid);
+  out.noConfigEntities = ents.every((e) => {
+    const cat = c.hass.entities[e]?.entity_category;
+    return cat !== 'config' && cat !== 'diagnostic';
+  });
+  c._infoCard = null; await c.updateComplete;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -47,5 +47,5 @@ const res = await page.evaluate(async () => {
  out.delroomIgnored = !confirmCalled;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,76 @@
+// Ревью R2-3: климат комнат считался отдельным обходом реестра на каждую
+// комнату и каждую величину — 60 комнат × 2000 сущностей съедали кадр на
+// перечитывании метаданных, которые не менялись. Карта строится один раз на
+// снимок hass; при этом новые состояния датчиков обязаны попадать в неё сразу.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+
+  // считаем обходы реестра через ownKeys — именно его дёргает Object.entries
+  let scans = 0;
+  const wrap = (h) => {
+    const ents = h.entities;
+    const traced = new Proxy(ents, { ownKeys(t) { scans++; return Reflect.ownKeys(t); } });
+    return { ...h, entities: traced };
+  };
+  const fresh = () => wrap(window.__mkHass());
+
+  // включаем и заливку по температуре, и подписи — два потребителя климата
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, settings: { ...(s.settings || {}), show_names: true, fill_mode: 'temp', label_temp: true, label_hum: true },
+  })};
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  const fewRooms = scans;
+
+  // повторные рендеры на том же снимке hass реестр не трогают
+  scans = 0;
+  c.requestUpdate(); await c.updateComplete;
+  c.requestUpdate(); await c.updateComplete;
+  out.scansOnRerender = scans;
+
+  // главный инвариант: обходов НЕ становится больше от числа комнат
+  const f1 = c._serverCfg.spaces.find((s) => s.id === 'f1');
+  const extra = [];
+  for (let i = 0; i < 40; i++) {
+    extra.push({ id: 'gen' + i, name: 'R' + i, area: 'living_room',
+      poly: [[0.01, 0.01], [0.02, 0.01], [0.02, 0.02], [0.01, 0.02]] });
+  }
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) =>
+    s.id !== 'f1' ? s : { ...s, rooms: [...s.rooms, ...extra] }) };
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  out.roomCount = c._spaceModel('f1').rooms.length;
+  out.scansSameWith44Rooms = scans === fewRooms;
+  out.scansPerUpdate = scans;
+
+  // при этом новое состояние датчика обязано быть видно, а не взято из кэша
+  out.tempBefore = c._climate().get('living_room')?.temp;
+  const h = fresh();
+  h.states = { ...h.states, 'sensor.living_temp': { ...h.states['sensor.living_temp'], state: '33.3' } };
+  c.hass = h; await c.updateComplete;
+  out.tempAfter = c._climate().get('living_room')?.temp;
+  out.climateIsMap = c._climate() instanceof Map;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом.
+// scansPerUpdate = 2: один обход у areaClimateMap, один у buildDevices. Важно
+// не само число, а что оно не растёт вместе с числом комнат.
+checkAll(res, {
+  scansOnRerender: 0,
+  roomCount: 44,
+  scansSameWith44Rooms: true,
+  scansPerUpdate: 2,
+  tempBefore: 22.4,
+  tempAfter: 33.3,
+  climateIsMap: true,
+});
+await finish(browser);
@@ -0,0 +1,67 @@
+// HP-1454-03: две локальные правки уходили с одной ревизией, вторая терялась.
+// Debounce разносил только СТАРТЫ. Если первый config/set отвечал дольше 500 мс,
+// вторая правка уходила с тем же expected_rev, сервер принимал первую и
+// отклонял вторую как conflict — а обработчик конфликта перечитывал серверную
+// копию поверх локальной. Правка исчезала, и тост винил «другое окно».
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const writes = [];
+  let rev = 10;
+  let releaseFirst;
+  const firstGate = new Promise((r) => { releaseFirst = r; });
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/set') {
+      const n = writes.length + 1;
+      writes.push({ expected: m.expected_rev, titles: m.config.spaces.map((s) => s.title) });
+      if (n === 1) await firstGate;                  // первый ответ задержан
+      if (m.expected_rev !== rev) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      rev += 1;
+      return { ok: true, rev };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { config: JSON.parse(JSON.stringify(r.config)), rev };
+    }
+    return base(m);
+  } };
+  c._cfgRev = rev;
+
+  // правка №1 и, пока первая запись висит, правка №2
+  c._serverCfg.spaces[0].title = 'FIRST';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.oneInFlight = writes.length === 1;
+
+  c._serverCfg.spaces[0].title = 'SECOND';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.stillOneInFlight = writes.length === 1;   // вторая ждёт очереди, не летит параллельно
+
+  releaseFirst();
+  await new Promise((r) => setTimeout(r, 120));
+
+  out.writes = writes.length;
+  out.revisions = writes.map((w) => w.expected);          // вторая обязана взять новую ревизию
+  out.secondCarriedTheEdit = writes[1]?.titles[0] === 'SECOND';
+  out.editSurvived = c._serverCfg.spaces[0].title === 'SECOND';
+  out.noConflictToast = !(c._toast || '').length;
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  oneInFlight: true,
+  stillOneInFlight: true,
+  writes: 2,
+  revisions: [10, 11],
+  secondCarriedTheEdit: true,
+  editSurvived: true,
+  noConflictToast: true,
+});
+await finish(browser);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -57,5 +57,5 @@ const res = await page.evaluate(async () => {
  out.lockFiltered = JSON.stringify(last) === JSON.stringify(['homeassistant', 'turn_on', [lights[0]]]);
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -70,5 +70,5 @@ const res = await page.evaluate(async () => {
  out.deleteKey = c._decorList.length === n1 - 1;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,55 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  let pageError = null;
+  window.addEventListener('error', (e) => { pageError = String(e.message); });
+  // сохранение падает, а диалог закрыт до ответа — карточка не должна умереть
+  c.hass = { ...c.hass, callWS: async (msg) => {
+    if (String(msg.type).endsWith('/set')) { await new Promise((r) => setTimeout(r, 60)); throw new Error('boom'); }
+    return { config: c._serverCfg, rev: c._cfgRev };
+  } };
+  await c.updateComplete;
+  // 1) диалог общих настроек
+  c._openSettingsDialog(); await c.updateComplete;
+  const p = c._saveSettingsDialog();
+  c._settingsDialog = null; // Esc во время сохранения
+  await c.updateComplete;
+  await p.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.settingsStaysClosed = c._settingsDialog === null;
+  out.cardAliveAfterSettings = !!sr().querySelector('.stage');
+  // 2) диалог правил
+  c._openRulesDialog(); await c.updateComplete;
+  const p2 = c._saveRules();
+  c._rulesDialog = null; await c.updateComplete;
+  await p2.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.rulesStaysClosed = c._rulesDialog === null;
+  out.cardAliveAfterRules = !!sr().querySelector('.stage');
+  // 3) диалог устройства
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog(c._devices[0]); await c.updateComplete;
+  const p3 = c._saveMarker();
+  c._markerDialog = null; await c.updateComplete;
+  await p3.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  await c.updateComplete;
+  out.markerStaysClosed = c._markerDialog === null;
+  out.cardAliveAfterMarker = !!sr().querySelector('.stage');
+  out.noPageError = pageError === null;
+  // 4) при ОТКРЫТОМ диалоге ошибка снимает busy (поведение сохранено)
+  c._openSettingsDialog(); await c.updateComplete;
+  const p4 = c._saveSettingsDialog();
+  await p4.catch(() => {});
+  await new Promise((r) => setTimeout(r, 120));
+  out.busyClearedWhenOpen = c._settingsDialog !== null && c._settingsDialog.busy === false;
+  c._settingsDialog = null;
+  return out;
+});
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, check, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -11,7 +11,7 @@ const res = await page.evaluate(async () => {
  document.body.appendChild(c1);
  c1.hass = { language:'en', locale:{language:'en'}, devices:{}, entities:{}, areas:{}, states:{},
    callWS: async (m) => m.type==='houseplan/config/get'
-      ? { config:{ spaces:[{ id:'s1', title:'Empty', plan_url:null, aspect:1.4, view_box:[0,0,1,1], rooms:[], segments:[] }], markers:[], settings:{} }, rev:1 }
+      ? { config:{ spaces:[{ id:'s1', title:'Empty', plan_url:null, view_box:[0,0,1,1], rooms:[], segments:[] }], markers:[], settings:{} }, rev:1 }
      : { layout:{} },
    connection:{ subscribeEvents: async()=>()=>{} } };
  await new Promise(r=>setTimeout(r,150));
@@ -31,7 +31,7 @@ const res = await page.evaluate(async () => {
    devices:{ d1:{ id:'d1', name: evil, model:'M<script>1</script>', area_id:'a1', identifiers:[['x','1']] } },
    entities:{}, areas:{ a1:{ area_id:'a1', name:'A1' } }, states:{},
    callWS: async (m) => m.type==='houseplan/config/get'
-      ? { config:{ spaces:[{ id:'s1', title:'S', plan_url:null, aspect:1, view_box:[0,0,1,1],
+      ? { config:{ spaces:[{ id:'s1', title:'S', plan_url:null, view_box:[0,0,1,1],
          rooms:[{ id:'r1', name: evil, area:'a1', poly:[[0.1,0.1],[0.9,0.1],[0.9,0.9],[0.1,0.9]] }], segments:[] }], markers:[], settings:{} }, rev:1 }
      : { layout:{} },
    connection:{ subscribeEvents: async()=>()=>{} } };
@@ -70,5 +70,18 @@ const res = await page.evaluate(async () => {
  out.bigRenderMs = Math.round(performance.now() - t1);
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+// сборка 100+ устройств должна укладываться в бюджет (docs/TESTING.md)
+// timings are asserted as budgets, not frozen values (CI machines vary)
+check("bigBuildMs under 200ms", res.bigBuildMs < 200);
+check("bigRenderMs under 100ms", res.bigRenderMs < 100);
+delete res.bigBuildMs;
+delete res.bigRenderMs;
+checkAll(res, {
+  "emptyDevices": 0,
+  "emptyCount": "0 dev.",
+  "xssPwned": false,
+  "xssDeviceRendered": 1,
+  "bigCount": 162,
+});
+await finish(browser, res);
@@ -0,0 +1,65 @@
+// На телефоне в редакторах не работали зум и навигация жестами: pointerdown
+// сцены выходил сразу при _markup, так что пинч и пан не начинались вовсе.
+// Рисование кликается, жесты двигаются — они совместимы; палец с движением
+// панорамирует, два пальца зумируют, отпускание после жеста не рисует точку.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = {};
+
+const pd = (c, id, x, y) => c._stagePointerDown({ pointerId: id, clientX: x, clientY: y, target: c._stageEl, preventDefault() {} });
+const pm = (c, id, x, y) => c._stagePointerMove({ pointerId: id, clientX: x, clientY: y });
+const pu = (c, id, x, y) => c._stagePointerUp({ pointerId: id, clientX: x, clientY: y });
+
+// --- пинч-зум в редакторе плана -----------------------------------------
+out.pinchZoomsInPlanEditor = await page.evaluate(() => {
+  const c = window.__card;
+  c._setMode('plan');
+  const pd = (id, x, y) => c._stagePointerDown({ pointerId: id, clientX: x, clientY: y, target: c._stageEl, preventDefault() {} });
+  const pm = (id, x, y) => c._stagePointerMove({ pointerId: id, clientX: x, clientY: y });
+  const pu = (id, x, y) => c._stagePointerUp({ pointerId: id, clientX: x, clientY: y });
+  c._resetZoom();
+  const z0 = c._zoom;
+  pd(1, 300, 300); pd(2, 400, 300);          // два пальца
+  pm(1, 250, 300); pm(2, 450, 300);          // разводим
+  const zoomed = c._zoom > z0 * 1.5;
+  pu(1, 250, 300); pu(2, 450, 300);
+  return zoomed && c._path.length === 0;
+});
+
+// --- пан одним пальцем в редакторе, точка не рисуется --------------------
+out.panWorksAndDoesNotDraw = await page.evaluate(async () => {
+  const c = window.__card;
+  const pd = (id, x, y) => c._stagePointerDown({ pointerId: id, clientX: x, clientY: y, target: c._stageEl, preventDefault() {} });
+  const pm = (id, x, y) => c._stagePointerMove({ pointerId: id, clientX: x, clientY: y });
+  const pu = (id, x, y) => c._stagePointerUp({ pointerId: id, clientX: x, clientY: y });
+  const st = c._stageEl;
+  c._zoomAt(st.clientWidth / 2, st.clientHeight / 2, 3); // есть куда панорамировать
+  const v0 = { ...c._view };
+  pd(3, 300, 300);
+  pm(3, 380, 340); pm(3, 420, 360);
+  const panned = Math.abs(c._view.x - v0.x) > 1 || Math.abs(c._view.y - v0.y) > 1;
+  const suppressed = c._suppressClick === true;
+  c._markupClick({ composedPath: () => [], clientX: 420, clientY: 360 }); // синтезированный click после пана
+  const noDot = c._path.length === 0;
+  pu(3, 420, 360);
+  await new Promise((r) => setTimeout(r, 10));
+  return panned && suppressed && noDot;
+});
+
+// --- обычный клик без движения по-прежнему рисует ------------------------
+out.tapStillDraws = await page.evaluate(() => {
+  const c = window.__card;
+  const pd = (id, x, y) => c._stagePointerDown({ pointerId: id, clientX: x, clientY: y, target: c._stageEl, preventDefault() {} });
+  const pu = (id, x, y) => c._stagePointerUp({ pointerId: id, clientX: x, clientY: y });
+  c._resetZoom();
+  c._tool = 'draw';
+  const before = c._path.length;
+  pd(4, 300, 300); pu(4, 300, 300);
+  const st = c._stageEl.getBoundingClientRect();
+  c._markupClick({ composedPath: () => [], clientX: st.left + 200, clientY: st.top + 200 });
+  const drew = c._path.length > before;
+  c._path = []; c._setMode('view');
+  return drew;
+});
+
+await finish(browser, checkAll(out));
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -35,5 +35,8 @@ const res = await page.evaluate(async () => {
  out.tabCrossWorks = c._mode === 'view';
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "labels": ["Plan editor", "Device editor", "Background editor"],
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -31,5 +31,5 @@ const res = await page.evaluate(async () => {
  await esc(); out.undoPointStillWorks = c._path.length === 1;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,52 @@
+import { launch, check, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // 1) кнопка настроек комнаты в редакторе плана: заметная, фиксированного размера
+  c._setMode('plan'); await c.updateComplete;
+  const btn = sr().querySelector('.rlgearbtn');
+  out.gearButtonShown = !!btn;
+  const cs = btn ? getComputedStyle(btn) : null;
+  // 2026-07-29: владелец вдвое уменьшил кнопку — контракт теперь не «не
+  // меньше N px», а «размер от иконки устройства и кликабельность»
+  out.gearReadable = cs ? parseFloat(cs.fontSize) > 0 && cs.pointerEvents === 'auto' : null;
+  out.gearHasLabel = btn ? btn.textContent.trim().length > 0 : null;
+  const box = btn?.getBoundingClientRect();
+  // (в редакторе плана .dev скрыты display:none — сравнивать не с чем)
+  out.gearTapTarget = box ? box.height > 6 && box.height < 40 : null;
+  btn.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true }));
+  await c.updateComplete;
+  out.gearOpensDialog = c._roomDialog === true && !!c._roomEditId;
+  c._roomDialogCancel(); await c.updateComplete;
+  // 2) комната без имени тоже получает кнопку (её там и называют)
+  const room = c._curSpaceCfg.rooms[0];
+  const savedName = room.name;
+  room.name = '';
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  out.unnamedStillHasGear = sr().querySelectorAll('.rlgearbtn').length >= 1;
+  room.name = savedName; c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  // 3) метрики стали крупнее: 0.75em вместо 0.62em
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== c._space ? s : ({
+    ...s, settings: { ...(s.settings || {}), show_names: true, label_temp: true } })) };
+  c._setMode('view'); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+  const lbl = [...sr().querySelectorAll('.roomlabel')].find((l) => l.querySelector('.rlmetrics'));
+  if (lbl) {
+    const nameSz = parseFloat(getComputedStyle(lbl.querySelector('.rlname')).fontSize);
+    const metaSz = parseFloat(getComputedStyle(lbl.querySelector('.rlmetrics')).fontSize);
+    out.metricsRatio = Math.round((metaSz / nameSz) * 100) / 100;
+  } else out.metricsRatio = 'no-metrics';
+  // 4) касание помечает сессию как тач и гасит тултип
+  c._tip = { x: 1, y: 1, title: 't', meta: 'm' };
+  c._notePointer(new PointerEvent('pointerdown', { pointerType: 'touch' }));
+  out.touchClearsTip = c._tip === null;
+  c._showTip(new MouseEvent('mousemove', { clientX: 5, clientY: 5 }), 'x', 'y');
+  out.noTipAfterTouch = !c._tip;
+  return out;
+});
+check('metricsRatio 0.75', res.metricsRatio, 0.75);
+delete res.metricsRatio;
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -54,5 +54,5 @@ const res = await page.evaluate(async () => {
  c._spaceDialog = null; await c.updateComplete;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -31,5 +31,8 @@ const res = await page.evaluate(async () => {
  out.addInPlan = !!sr().querySelector('.tab.tabadd');
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "alignDelta": 0,
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -26,5 +26,12 @@ const res = await page.evaluate(async () => {
  out.lqiAfter = sr().querySelectorAll('.dev .lqi').length;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "rows": 11,
+  "groups": ["Fill: lights", "Fill: temperature", "Fill: zigbee signal", "Light-sources fill"],
+  "saved": {"c": "#ff00ff", "a": 0.5},
+  "lqiBefore": 7,
+  "lqiAfter": 0,
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -44,7 +44,7 @@ const res = await page.evaluate(async () => {
  const c2 = c._roomCenter(r2);
  const poly1 = r1.poly || [[r1.x, r1.y], [r1.x + r1.w, r1.y], [r1.x + r1.w, r1.y + r1.h], [r1.x, r1.y + r1.h]];
  // общая стена вертикальная — дверь ставим на неё
-  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  const H = 1000;   // square canvas
  const doorPt = (() => {
    let best = null, bd = 1e9;
    for (const [x, y] of [[550, 150], [550, 200], [550, 250]]) {
@@ -57,9 +57,8 @@ const res = await page.evaluate(async () => {
    ...s, openings: [{ id: 'gd', type: 'door', x: doorPt[0] / 1000, y: doorPt[1] / H, angle: 90, length: 0.09 }] })) };
  c.requestUpdate(); await c.updateComplete;
  // источник детерминированно ставим в центр r1 (двигаем реальную включённую лампу)
-  const aspect = c._curSpaceCfg.aspect || 1;
  const c1 = c._roomCenter(r1);
-  c._layout = { ...c._layout, [litLight.id]: { s: spId, x: c1[0] / 1000, y: c1[1] / (1000 / aspect) } };
+  c._layout = { ...c._layout, [litLight.id]: { s: spId, x: c1[0] / 1000, y: c1[1] / 1000 } };
  // радиус 6 м, чтобы дверь заведомо была в зоне досягаемости
  c._serverCfg = { ...c._serverCfg, settings: { ...(c._serverCfg.settings || {}), glow_radius_cm: 600 } };
  c.requestUpdate(); await c.updateComplete;
@@ -73,7 +72,7 @@ const res = await page.evaluate(async () => {
  const minX = Math.min(...poly1.map((p) => p[0]));
  const yMid = (Math.min(...poly1.map((p) => p[1])) + Math.max(...poly1.map((p) => p[1]))) / 2;
  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== spId ? s : ({
-    ...s, openings: [{ id: 'gd2', type: 'door', x: minX / 1000, y: yMid / (1000 / aspect), angle: 90, length: 0.09 }] })) };
+    ...s, openings: [{ id: 'gd2', type: 'door', x: minX / 1000, y: yMid / 1000, angle: 90, length: 0.09 }] })) };
  c.requestUpdate(); await c.updateComplete;
  const clipEls2 = [...sr().querySelectorAll('defs clipPath[id^="hp-glowclip"]')];
  out.entranceNoSector = clipEls2.every((cp) => cp.querySelectorAll('path').length === 1);
@@ -93,6 +92,22 @@ const res = await page.evaluate(async () => {
  out.perSourceRadius = Math.abs(rOwn - c._cmToUnits(150)) < 0.5;
  c._serverCfg = { ...c._serverCfg, markers: (c._serverCfg.markers || []).filter((m) => m.id !== litMarkerId) };
  c._regSignature = ''; c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  // 6в) флаг «источник света»: умный выключатель с обычными светильниками
+  const swDev = c._devices.find((d) => d.space === spId && d.entities.some((e) => e.startsWith('switch.')));
+  if (swDev) {
+    const swEid = swDev.entities.find((e) => e.startsWith('switch.'));
+    c.hass = { ...c.hass, states: { ...c.hass.states, [swEid]: { ...c.hass.states[swEid], state: 'on' } } };
+    const spotsBefore = sr().querySelectorAll('.glowlayer circle').length;
+    c._serverCfg = { ...c._serverCfg, markers: [
+      ...(c._serverCfg.markers || []).filter((m) => m.id !== swDev.id),
+      { id: swDev.id, binding: swDev.bindingKind + ':' + swDev.bindingRef, is_light: true },
+    ] };
+    c._regSignature = ''; c._maybeRebuildDevices(); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+    out.switchGlows = sr().querySelectorAll('.glowlayer circle').length === spotsBefore + 1;
+    c._serverCfg = { ...c._serverCfg, markers: (c._serverCfg.markers || []).filter((m) => m.id !== swDev.id) };
+    c._regSignature = ''; c._maybeRebuildDevices(); c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+    out.switchGlowsOffByDefault = sr().querySelectorAll('.glowlayer circle').length === spotsBefore;
+  } else { out.switchGlows = 'no-switch'; out.switchGlowsOffByDefault = 'no-switch'; }
  // 7) радиус из настроек: 600 см против 300 см — вдвое больше
  const r600 = Number(sr().querySelector('.glowlayer circle')?.getAttribute('r'));
  c._serverCfg = { ...c._serverCfg, settings: { ...(c._serverCfg.settings || {}), glow_radius_cm: 300 } };
@@ -101,5 +116,8 @@ const res = await page.evaluate(async () => {
  out.radiusReacts = Math.abs(r600 / r300 - 2) < 0.01;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "spots": 1,
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -33,5 +33,5 @@ const res = await page.evaluate(async () => {
  out.notFadedInView = room3 ? Number(getComputedStyle(room3).opacity) > 0.9 : null;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -14,5 +14,5 @@ const res = await page.evaluate(async () => {
  out.opensInView = !!c._settingsDialog;
  return out;
 });
-console.log(JSON.stringify(res));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,237 @@
+// docs/FILTERING.md: скрытие — явная галка. Конфиг материализуется сеятелем
+// (filter_seeded), галка в диалоге у всех устройств, «Показать скрытые» —
+// локальный режим редактора, скрытые рисуются призраками и только там.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = {};
+
+// --- сеятель материализует конфиг при загрузке ---------------------------
+out.configSeeded = await page.evaluate(async () => {
+  const c = window.__card;
+  const t0 = Date.now();
+  while (!c._serverCfg?.settings?.filter_seeded && Date.now() - t0 < 3000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  return c._serverCfg?.settings?.filter_seeded === true;
+});
+
+// --- галка прячет, счётчик не считает, призрак только в редакторе --------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const visibleIds = () => [...sr().querySelectorAll('.dev')].length;
+  const before = visibleIds();
+
+  const d = c._devices.find((x) => x.space === 'f1' && x.bindingKind === 'device');
+  c._serverCfg.markers = c._serverCfg.markers || [];
+  c._serverCfg.markers.push({ id: d.id, binding: 'device:' + d.bindingRef, hidden: true });
+  c._cfgEpoch++; c._regSignature = '';
+  c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+
+  o.hiddenNotRendered = visibleIds() === before - 1;
+  const built = c._devices.find((x) => x.id === d.id);
+  o.stillBuilt = !!built && built.hidden === true;
+  o.countExcludesHidden = (sr().querySelector('.count')?.textContent || '').includes(String(before - 1));
+
+  // в просмотре тумблера нет эффекта — призраки только в редакторе устройств
+  c._showHidden = true; c.requestUpdate(); await c.updateComplete;
+  o.noGhostsInView = !sr().querySelector('.dev.ghost');
+  c._setMode('devices'); c.requestUpdate(); await c.updateComplete;
+  o.ghostInEditor = !!sr().querySelector('.dev.ghost');
+  // призрак — конфигурация, не статус: ни жёлтого, ни unavail, ни тревоги
+  const g = sr().querySelector('.dev.ghost');
+  o.ghostHasNoState = !!g && !g.classList.contains('on') && !g.classList.contains('open')
+    && !g.classList.contains('unavail') && !g.classList.contains('alarm');
+  // и он синий, а не тёмный — отличим от недоступного устройства
+  o.ghostIsBlue = !!g && getComputedStyle(g).borderStyle.includes('dashed')
+    && getComputedStyle(g).borderColor !== 'rgb(255, 255, 255)';
+  // тумблер локальный: конфиг не трогается
+  o.toggleIsLocal = c._serverCfg.settings.show_all === undefined;
+
+  // --- галка в диалоге у авто-устройства, кнопки «Удалить» нет -----------
+  const ghost = c._devices.find((x) => x.id === d.id);
+  c._openMarkerDialog(ghost); await c.updateComplete;
+  o.checkboxOn = c._markerDialog?.hideFromPlan === true;
+  o.noDeleteForAuto = !sr().querySelector('.dialog .btn.danger');
+  // снимаем галку и сохраняем — маркер остаётся с hidden:false (анти-повтор)
+  c._markerDialog = { ...c._markerDialog, hideFromPlan: false };
+  await c._saveMarker(); await c.updateComplete;
+  const m = (c._serverCfg.markers || []).find((x) => x.binding === 'device:' + d.bindingRef);
+  o.untickKeepsMarker = !!m && m.hidden === false;
+  const back = c._devices.find((x) => x.id === d.id) || c._devices.find((x) => x.bindingRef === d.bindingRef);
+  o.deviceVisibleAgain = !!back && !back.hidden;
+
+  // --- у виртуального кнопка «Удалить» есть -------------------------------
+  c._openMarkerDialog(); await c.updateComplete;
+  c._markerDialog = { ...c._markerDialog, name: 'Тест', binding: 'virtual' };
+  await c._saveMarker(); await c.updateComplete;
+  const virt = c._devices.find((x) => x.virtual);
+  c._openMarkerDialog(virt); await c.updateComplete;
+  o.deleteForVirtual = !!sr().querySelector('.dialog .btn.danger');
+  c._markerDialog = null; c._setMode('view');
+  return o;
+}));
+
+// --- HP-1510-02: призрак не показывает live-значения ----------------------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // датчик с числом + display:value, скрыт
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'sensor.power_meter': { state: '42', attributes: { unit_of_measurement: 'kW' } } } };
+  c._serverCfg.markers = c._serverCfg.markers || [];
+  c._serverCfg.markers.push({ id: 'pm', binding: 'entity:sensor.power_meter',
+    display: 'value', hidden: true, space: 'f1' });
+  c._cfgEpoch++; c._regSignature = '';
+  c._maybeRebuildDevices();
+  c._setMode('devices'); c._showHidden = true;
+  c.requestUpdate(); await c.updateComplete;
+  const ghosts = [...sr().querySelectorAll('.dev.ghost')];
+  const pm = ghosts.find((g) => g.textContent.includes('42')) || null;
+  o.ghostHidesValue = pm === null; // «42 kW» не отрисован
+  o.ghostNoLiveBadges = ghosts.every((g) =>
+    !g.querySelector('.valtext') && !g.querySelector('.tval') && !g.querySelector('.hval') && !g.querySelector('.lqi'));
+  // у КАЖДОГО призрака есть базовая иконка — «noicon» не оправдание
+  // (HP-1511-02: ripple-призрак был безликим пульсом)
+  o.ghostKeepsIcon = ghosts.every((g) => !!g.querySelector('ha-icon') && !g.classList.contains('noicon'));
+  c._setMode('view'); c._showHidden = false;
+  return o;
+}));
+
+// --- HP-1511-02: ripple-призрак с базовой иконкой, без пульса -------------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const lamp = c._devices.find((x) => x.space === 'f1' && x.bindingKind === 'device' && !x.hidden);
+  c._serverCfg.markers = c._serverCfg.markers || [];
+  c._serverCfg.markers = c._serverCfg.markers.filter((m) => m.id !== lamp.id);
+  c._serverCfg.markers.push({ id: lamp.id, binding: 'device:' + lamp.bindingRef,
+    display: 'ripple', hidden: true });
+  c._cfgEpoch++; c._regSignature = '';
+  c._maybeRebuildDevices();
+  c._setMode('devices'); c._showHidden = true;
+  c.requestUpdate(); await c.updateComplete;
+  const g = [...sr().querySelectorAll('.dev.ghost')].find((x) => x.querySelector('.ripple') || !x.classList.contains('noicon'));
+  const ghosts = [...sr().querySelectorAll('.dev.ghost')];
+  o.rippleGhostHasIcon = ghosts.length > 0 && ghosts.every((x) => !!x.querySelector('ha-icon'));
+  o.rippleGhostNoNoicon = ghosts.every((x) => !x.classList.contains('noicon'));
+  o.rippleGhostNoRipple = ghosts.every((x) => !x.querySelector('.ripple'));
+  c._serverCfg.markers = c._serverCfg.markers.filter((m) => m.id !== lamp.id);
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices();
+  c._setMode('view'); c._showHidden = false;
+  return o;
+}));
+
+// --- HP-1511-01: авто-сетка одинакова на обеих карточках ------------------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  await customElements.whenDefined('houseplan-space-card');
+  const cfg = JSON.parse(JSON.stringify(c._serverCfg));
+  const f1 = cfg.spaces.find((s) => s.id === 'f1');
+  // один видимый, остальные зоны living_room скрыты; layout пуст
+  const vis = c._devices.filter((x) => x.area === 'living_room' && !x.virtual);
+  const keep = vis[0];
+  for (const d of vis.slice(1)) {
+    cfg.markers = (cfg.markers || []).filter((m) => m.id !== d.id);
+    cfg.markers.push({ id: d.id, binding: d.bindingKind + ':' + d.bindingRef, hidden: true });
+  }
+  cfg.markers = cfg.markers.filter((m) => m.id !== keep.id || !m.hidden);
+  c._serverCfg = cfg; c._cfgEpoch++; c._regSignature = '';
+  c._layout = {}; // пустой layout: работают только авто-позиции
+  c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  const full = [...(c.shadowRoot || c.renderRoot).querySelectorAll('.dev')]
+    .find((el) => el.style.left && !el.classList.contains('ghost'));
+  // проценты полной карточки считаются от content-fit view — переводим в vb
+  const v = c._viewOr(c._baseVb());
+  const fullVb = full && [
+    v.x + (parseFloat(full.style.left) / 100) * v.w,
+    v.y + (parseFloat(full.style.top) / 100) * v.h,
+  ];
+
+  const hass = { ...c.hass, callWS: async (m) => {
+    // rev уникален: у статичной карточки модульный кэш конфига по rev,
+    // и одинаковый rev в соседних тестах подсовывает чужой конфиг
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 31 };
+    if (m.type === 'houseplan/layout/get') return { layout: {}, rev: 31 };
+    return { ok: true };
+  },
+  // модульный кэш конфига инвалидируется только через это событие — стаб
+  // сохраняет колбэк, чтобы следующий тест мог сбросить кэш
+  connection: { subscribeEvents: async (cb) => { window.__hpInvalidate = cb; return () => {}; } } };
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('[style*="left"]') && Date.now() - t0 < 6000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  await card.updateComplete;
+  const st = [...card.renderRoot.querySelectorAll('[style*="left"]')]
+    .find((el) => /%$/.test(el.style.left || '') && el.style.top);
+  // статичная карточка рендерит от полного квадрата 0..1000
+  const stVb = st && [parseFloat(st.style.left) * 10, parseFloat(st.style.top) * 10];
+  o.autoGridParity = !!fullVb && !!stVb
+    && Math.abs(fullVb[0] - stVb[0]) < 6 && Math.abs(fullVb[1] - stVb[1]) < 6;
+  if (!o.autoGridParity) console.log('full', fullVb, 'static', stVb);
+  host.remove();
+  return o;
+}));
+
+// --- HP-1510-01: LQI комнаты одинаков на полной и статичной карточке ------
+Object.assign(out, await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  await customElements.whenDefined('houseplan-space-card');
+  const cfg = JSON.parse(JSON.stringify(c._serverCfg));
+  const f1 = cfg.spaces.find((s) => s.id === 'f1');
+  f1.settings = { ...(f1.settings || {}), fill_mode: 'lqi', show_borders: true };
+  // прячем ВСЕ устройства зоны living_room: комнату красит только скрытое
+  for (const d of c._devices.filter((x) => x.area === 'living_room' && !x.virtual)) {
+    if (!cfg.markers.some((m) => m.id === d.id)) {
+      cfg.markers.push({ id: d.id, binding: d.bindingKind + ':' + d.bindingRef, hidden: true });
+    } else {
+      cfg.markers = cfg.markers.map((m) => (m.id === d.id ? { ...m, hidden: true } : m));
+    }
+  }
+  c._serverCfg = cfg; c._cfgEpoch++; c._regSignature = '';
+  c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  const fullRoom = [...(c.shadowRoot || c.renderRoot).querySelectorAll('.room')]
+    .find((r) => (r.getAttribute('style') || '').includes('--room-fill'));
+  const fullFill = fullRoom ? (fullRoom.getAttribute('style').match(/--room-fill:([^;]+)/) || [])[1] : null;
+
+  window.__hpInvalidate?.(); // сбросить модульный кэш от предыдущей карточки
+  const hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 57 };
+    if (m.type === 'houseplan/layout/get') return { layout: {}, rev: 57 };
+    return { ok: true };
+  },
+  connection: { subscribeEvents: async () => () => {} } };
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('.room') && Date.now() - t0 < 6000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  await card.updateComplete;
+  const stRoom = [...card.renderRoot.querySelectorAll('.room')]
+    .find((r) => (r.getAttribute('style') || '').includes('--room-fill'));
+  const stFill = stRoom ? (stRoom.getAttribute('style').match(/--room-fill:([^;]+)/) || [])[1] : null;
+  o.fullPaintsHiddenLqi = !!fullFill;
+  o.staticPaintsHiddenLqi = !!stFill;
+  o.lqiParity = !!fullFill && fullFill === stFill;
+  host.remove();
+  return o;
+}));
+
+await finish(browser, checkAll(out));
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -27,5 +27,5 @@ const res = await page.evaluate(async () => {
  c._markerDialog = null; await c.updateComplete;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,38 @@
+// Множитель «размер значка» обязан масштабировать ГЛИФ вместе с подложкой:
+// --mdc-icon-size считался от базового --icon-size, и «увеличенный» значок
+// был пустой рамкой вокруг дефолтной иконки (репорт пользователя, 2026-07-29).
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const d = c._devices.find((x) => x.space === 'f1' && x.bindingKind === 'device');
+  const glyphW = () => {
+    const el = [...sr().querySelectorAll('.dev')].find((e) => !e.classList.contains('ghost'));
+    const ic = el?.querySelector('ha-icon');
+    return ic ? ic.getBoundingClientRect().width : 0;
+  };
+  const badgeW = () => {
+    const el = [...sr().querySelectorAll('.dev')].find((e) => !e.classList.contains('ghost'));
+    return el ? el.getBoundingClientRect().width : 0;
+  };
+  // базовый размер
+  const g1 = glyphW(), b1 = badgeW();
+  // множитель ×3 на всех авто-устройствах через маркер первого
+  c._serverCfg.markers = (c._serverCfg.markers || []).filter((m) => m.id !== d.id);
+  c._serverCfg.markers.push({ id: d.id, binding: 'device:' + d.bindingRef, size: 3 });
+  c._cfgEpoch++; c._regSignature = '';
+  c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 100));
+  const scaled = [...sr().querySelectorAll('.dev')].find((e) => (e.getAttribute('style') || '').includes('--dev-scale:3'));
+  const g3 = scaled?.querySelector('ha-icon')?.getBoundingClientRect().width || 0;
+  const b3 = scaled?.getBoundingClientRect().width || 0;
+  o.badgeScales = b3 > b1 * 2.5;
+  o.glyphScalesWithBadge = g3 > g1 * 2.5; // раньше глиф оставался базовым
+  o.glyphFillsBadge = g3 / b3 > 0.45 && g3 / b3 < 0.8; // пропорция сохранена
+  c._serverCfg.markers = c._serverCfg.markers.filter((m) => m.id !== d.id);
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices();
+  return o;
+});
+await finish(browser, checkAll(out));
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -43,5 +43,10 @@ const res = await page.evaluate(async () => {
  c._openingDialog = null; c._setMode('view');
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "lockBadgeInert": "no-badge",
+  "viewDevCursor": "pointer",
+  "devModeCursor": "grab",
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -55,5 +55,5 @@ const res = await page.evaluate(async () => {
  out.islandRendered = !!islandEl;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -69,5 +69,5 @@ const res = await page.evaluate(async () => {
  c.remove();
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,103 @@
+// HP-1460-03: позиции — отдельное состояние. В v1.46.0 событие layout_updated
+// научилась слушать статическая карточка, а полная — нет, поэтому две полные
+// карточки рядом расходились до перезагрузки. Проверяем и обратное: приход
+// чужой ревизии не должен затирать перетаскивание, которое ещё не улетело.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+
+  // общий «сервер»: layout с ревизией и подписчики на событие
+  let rev = 5;
+  let layout = { dev_a: { x: 10, y: 10 }, dev_b: { x: 20, y: 20 } };
+  const subs = [];
+  let gets = 0;
+  const hass = { ...c.hass,
+    callWS: async (m) => {
+      if (m.type === 'houseplan/layout/get') { gets++; return { layout: JSON.parse(JSON.stringify(layout)), rev }; }
+      if (m.type === 'houseplan/layout/update') {
+        layout = { ...layout, [m.device_id]: m.pos }; rev += 1;
+        subs.forEach((f) => f({ data: { rev } }));
+        return { ok: true, rev };
+      }
+      return base(m);
+    },
+    connection: { subscribeEvents: async (cb, ev) => {
+      if (ev === 'houseplan_layout_updated') { subs.push(cb); return () => {}; }
+      return () => {};
+    } },
+  };
+  c.hass = hass;
+  c._serverStorage = true;
+  c._layout = JSON.parse(JSON.stringify(layout));
+  c._layoutRev = rev;
+  c._unsubLayout = await hass.connection.subscribeEvents(
+    (e) => c._onLayoutEvent(Number(e?.data?.rev ?? -1)),
+    'houseplan_layout_updated',
+  );
+  out.subscribed = subs.length === 1;
+
+  // 1) чужая карточка подвинула иконку — наша обязана подхватить без перезагрузки
+  layout = { ...layout, dev_a: { x: 77, y: 88 } }; rev += 1;
+  subs.forEach((f) => f({ data: { rev } }));
+  await new Promise((r) => setTimeout(r, 350));
+  out.adoptedRemoteMove = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 77, y: 88 });
+  out.revFollowed = c._layoutRev === rev;
+
+  // 2) собственная запись не вызывает лишнего перечитывания
+  const before = gets;
+  c._layout = { ...c._layout, dev_b: { x: 31, y: 32 } };
+  c._dirtyPos.add('dev_b');
+  c._persistLayout();
+  c._persistLayout.flush();
+  await new Promise((r) => setTimeout(r, 350));
+  out.ownWriteNoReload = gets === before;
+  out.ownWriteKept = JSON.stringify(c._layout.dev_b) === JSON.stringify({ x: 31, y: 32 });
+
+  // 3) НАСТОЯЩЕЕ перетаскивание: debounce запланирован, запись задержана, а
+  //    layout/get отвечает мгновенно. Именно этот порядок и терял позицию:
+  //    flush() внутри перечитывания опустошал _dirtyPos ДО снятия снимка.
+  let releaseUpdate;
+  const updateGate = new Promise((r) => { releaseUpdate = r; });
+  let delayUpdate = true;
+  const plain = hass.callWS;
+  c.hass = { ...hass, callWS: async (m) => {
+    if (m.type === 'houseplan/layout/update' && delayUpdate) {
+      delayUpdate = false;
+      await updateGate;
+    }
+    return plain(m);
+  } };
+
+  c._layout = { ...c._layout, dev_a: { x: 5, y: 6 } };
+  c._dirtyPos.add('dev_a');
+  c._persistLayout();                              // debounce запланирован, не сброшен вручную
+  layout = { ...layout, dev_b: { x: 99, y: 99 } }; rev += 1;
+  subs.forEach((f) => f({ data: { rev } }));
+  await new Promise((r) => setTimeout(r, 400));
+  out.dragKeptWhileWriteInFlight = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.remoteChangeApplied = JSON.stringify(c._layout.dev_b) === JSON.stringify({ x: 99, y: 99 });
+
+  releaseUpdate();
+  await new Promise((r) => setTimeout(r, 350));
+  out.localDragSurvived = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.serverAgrees = JSON.stringify(layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.sentPosDrained = c._sentPos.size === 0;
+  return out;
+});
+// зафиксировано прогоном на v1.46.1 и сверено с кодом
+checkAll(res, {
+  subscribed: true,
+  adoptedRemoteMove: true,
+  revFollowed: true,
+  ownWriteNoReload: true,
+  ownWriteKept: true,
+  dragKeptWhileWriteInFlight: true,
+  remoteChangeApplied: true,
+  localDragSurvived: true,
+  serverAgrees: true,
+  sentPosDrained: true,
+});
+await finish(browser);
@@ -0,0 +1,65 @@
+// HP-1503-01: один и тот же повреждённый store обязан рендериться одинаково в
+// ОБЕИХ карточках. Полная карточка строила модель рукописной копией
+// spaceModels и прошла мимо safeViewBox/normRect: статическая показывала
+// восстановленный план, полная — viewBox="0 0 0 0" и rect с отрицательной
+// шириной. Вектор аудита исполняется через обе модели и оба DOM-дерева.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+
+  // ровно вектор из отчёта: нулевой viewport + отрицательный legacy-rect
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  const f1 = cfg.spaces.find((s) => s.id === 'f1');
+  f1.plan_url = null; f1.plan_aspect = null;
+  f1.view_box = [0, 0, 0, 0];
+  f1.rooms = [{ id: 'r1', name: 'R', area: 'living_room', x: 0.6, y: 0.7, w: -0.2, h: -0.3 }];
+  f1.settings = { ...(f1.settings || {}), show_borders: true };
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {}, rev: 1 };
+    return { ok: true };
+  } };
+
+  main._serverCfg = cfg;
+  main._cfgEpoch++;
+  main._view = null;
+  main.requestUpdate(); await main.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+
+  // модель полной карточки: fallback на весь холст + нормализованный rect
+  const m = main._spaceModel('f1');
+  out.fullVbFallsBack = JSON.stringify(m.vb) === JSON.stringify([0, 0, 1000, 1000]);
+  const r = m.rooms[0];
+  out.fullRectNormalised =
+    Math.round(r.x) === 400 && Math.round(r.y) === 400
+    && Math.round(r.w) === 200 && Math.round(r.h) === 300;
+
+  // DOM полной карточки: конечный положительный viewBox, никаких минусов в rect
+  const svg = (main.shadowRoot || main.renderRoot).querySelector('.stage svg');
+  const vbAttr = (svg?.getAttribute('viewBox') || '').split(/\s+/).map(Number);
+  out.fullDomViewBoxSane = vbAttr.length === 4 && vbAttr[2] > 0 && vbAttr[3] > 0;
+  const rect = (main.shadowRoot || main.renderRoot).querySelector('.stage svg rect.room, .stage svg .room rect, .stage svg rect[width]');
+  out.fullDomRectSane = !rect || (Number(rect.getAttribute('width')) >= 0 && Number(rect.getAttribute('height')) >= 0);
+
+  // статическая карточка того же store — паритет
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('svg') && Date.now() - t0 < 6000) {
+    await new Promise((r2) => setTimeout(r2, 60));
+  }
+  await card.updateComplete;
+  const svb = (card.renderRoot.querySelector('svg')?.getAttribute('viewBox') || '').split(/\s+/).map(Number);
+  out.staticDomViewBoxSane = svb.length === 4 && svb[2] > 0 && svb[3] > 0;
+  out.parity = JSON.stringify(vbAttr.length === 4 && svb.length === 4
+    ? [vbAttr[2] > 0, vbAttr[3] > 0] : null) === JSON.stringify([svb[2] > 0, svb[3] > 0]);
+  return out;
+});
+await finish(browser, checkAll(res));
@@ -0,0 +1,78 @@
+// Правило владельца (2026-07-29): у источников света подложка в glow-режиме
+// всегда стандартная — индикатор включения это ПЯТНО; в остальных режимах
+// горящий источник жёлтый, как греющая термоголовка. RGB лампы красит только
+// пятно (и фолбэк цвета пульсации); окраска иконки/рамки убрана. Морф иконки
+// остаётся везде. Розетка в glow-режиме остаётся жёлтой — она не источник.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const setFill = async (mode) => {
+    const cfg = JSON.parse(JSON.stringify(c._serverCfg));
+    const f1 = cfg.spaces.find((s) => s.id === 'f1');
+    f1.settings = { ...(f1.settings || {}), fill_mode: mode };
+    c._serverCfg = cfg; c._cfgEpoch++; c._regSignature = '';
+    c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+    await new Promise((r) => setTimeout(r, 80));
+  };
+  const lamp = c._devices.find((x) => x.id === 'd_lamp');
+  const kettle = c._devices.find((x) => x.id === 'd_kettle'); // розетка/чайник
+  // зажигаем лампу с RGB и розетку
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    [lamp.primary]: { ...c.hass.states[lamp.primary], state: 'on',
+      attributes: { ...(c.hass.states[lamp.primary]?.attributes || {}), rgb_color: [255, 120, 40] } },
+    [kettle.primary]: { ...c.hass.states[kettle.primary], state: 'on' } } };
+  const devEl = (id) => {
+    // надёжнее по индексу в списке devs: ищем по позиции через _pos
+    const d = c._devices.find((x) => x.id === id);
+    const v = c._viewOr(c._baseVb());
+    const p = c._pos(d);
+    const left = (((p.x - v.x) / v.w) * 100).toFixed(0);
+    return [...sr().querySelectorAll('.dev')].find((e) => Math.abs(parseFloat(e.style.left) - left) < 1.5);
+  };
+
+  // --- режим light: горящая RGB-лампа ЖЁЛТАЯ, без rgb-класса --------------
+  await setFill('light');
+  let le = devEl('d_lamp');
+  o.litLampYellowInLightMode = !!le && le.classList.contains('on') && !le.classList.contains('rgb');
+  o.morphInLightMode = le?.querySelector('ha-icon')?.getAttribute('icon')?.includes('lightbulb') ?? false;
+
+  // --- режим glow: лампа ТЁМНАЯ (индикатор — пятно), розетка жёлтая -------
+  await setFill('glow');
+  le = devEl('d_lamp');
+  const ke = devEl('d_kettle');
+  o.litLampDarkInGlow = !!le && !le.classList.contains('on') && !le.classList.contains('rgb');
+  o.glowSpotPresent = !!sr().querySelector('.stage svg radialGradient, .stage svg [id*=glow]');
+  o.socketStaysYellowInGlow = !!ke && ke.classList.contains('on');
+  o.morphInGlow = le?.querySelector('ha-icon')?.getAttribute('icon')?.includes('lightbulb') ?? false;
+
+  // --- HP-1520-01: в редакторах, где glow-слой скрыт, индикатор возвращается
+  // (лампа горит; в devices-редакторе слой рисуется — там лампа тёмная,
+  // в plan-редакторе слоя нет — там класс on должен вернуться)
+  c._setMode('devices'); c.requestUpdate(); await c.updateComplete;
+  le = devEl('d_lamp');
+  o.devicesEditorLampDark = !!le && !le.classList.contains('on');
+  o.devicesEditorHasGlow = !!sr().querySelector('.stage svg radialGradient, .stage svg [id*=glow]');
+  c._setMode('plan'); c.requestUpdate(); await c.updateComplete;
+  // ИМЕННО лампа (mutation-проверка аудита HP-1521-01: розетка тоже on и
+  // удовлетворяла бы поиску «любой .dev.on», пряча регресс самой лампы)
+  le = devEl('d_lamp');
+  o.planEditorLampYellow = !!le && le.classList.contains('on'); // слой скрыт — жёлтый вернулся
+  o.planEditorKettleStillOn = !!devEl('d_kettle')?.classList.contains('on');
+  o.planEditorNoGlow = !sr().querySelector('.stage svg radialGradient, .stage svg [id*=glow]');
+  c._setMode('view'); c.requestUpdate(); await c.updateComplete;
+
+  // --- выключенная лампа тёмная в обоих режимах ---------------------------
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    [lamp.primary]: { ...c.hass.states[lamp.primary], state: 'off' } } };
+  c.requestUpdate(); await c.updateComplete;
+  le = devEl('d_lamp');
+  o.offLampDarkInGlow = !!le && !le.classList.contains('on');
+  await setFill('light');
+  le = devEl('d_lamp');
+  o.offLampDarkInLightMode = !!le && !le.classList.contains('on');
+  return o;
+});
+await finish(browser, checkAll(out));
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -30,5 +30,5 @@ const res = await page.evaluate(async () => {
  out.explicitInfoWins = calls.length === n2 && !!c._infoCard;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,10 +1,11 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
  const c = window.__card;
  const sr = () => c.shadowRoot || c.renderRoot;
  const calls = [];
+  window.confirm = () => true; // review CR-1: unlocking now confirms
  c.hass = { ...c.hass, callService: (d, s, data) => calls.push([d, s, data.entity_id]) };
  await c.updateComplete;
  // добавить дверь с замком на f1
@@ -47,5 +48,5 @@ const res = await page.evaluate(async () => {
  }
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,48 @@
+// review CR-1: exercise EVERY actuation path and prove locks/alarms are safe
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const calls = [];
+  c.hass = { ...c.hass, callService: (d, s, data) => { calls.push(`${d}.${s}:${data.entity_id}`); return Promise.resolve(); },
+    states: { ...c.hass.states,
+      'lock.front_door': { state: 'locked', attributes: { friendly_name: 'Front door' } },
+      'alarm_control_panel.home': { state: 'armed_away', attributes: {} } } };
+  await c.updateComplete;
+  c._setMode('view'); await c.updateComplete;
+  const lockCalls = () => calls.filter((x) => x.includes('lock.') || x.includes('alarm_control_panel.'));
+  // 1) тап по значку устройства с замком
+  const lockDev = c._devices.find((d) => d.entities?.some((e) => e.startsWith('lock.'))) || c._devices[0];
+  const fake = { ...lockDev, primary: 'lock.front_door', tapAction: 'toggle',
+    marker: { ...(lockDev.marker || {}), tap_action: 'toggle' } };
+  c._clickDevice(new MouseEvent('click'), fake);
+  out.iconTapSafe = lockCalls().length === 0;
+  // 2) controls[] с замком внутри
+  const withControls = { ...fake, tapAction: 'toggle',
+    marker: { controls: ['lock.front_door', 'alarm_control_panel.home'], tap_action: 'toggle' } };
+  c._clickDevice(new MouseEvent('click'), withControls);
+  out.controlsSafe = lockCalls().length === 0;
+  // 3) карточка устройства: замок отдаётся в more-info, а не тумблером
+  const kinds = c._cardEntities({ ...fake, entities: ['lock.front_door', 'alarm_control_panel.home'] });
+  out.cardNoToggleForLocks = kinds.every((k) => k.kind !== 'toggle');
+  c._cardToggle('lock.front_door');
+  c._cardToggle('alarm_control_panel.home');
+  out.cardToggleRefuses = lockCalls().length === 0;
+  // 4) кнопка в карточке двери — единственная разрешённая поверхность, и спрашивает подтверждение
+  let asked = null;
+  window.confirm = (msg) => { asked = msg; return false; };
+  c._lockAction('lock.front_door', 'unlock');
+  out.unlockAsksConfirm = asked !== null && lockCalls().length === 0;
+  window.confirm = () => true;
+  c._lockAction('lock.front_door', 'unlock');
+  out.unlockAfterConfirm = calls.at(-1) === 'lock.unlock:lock.front_door';
+  // запирание не спрашивает
+  asked = null;
+  window.confirm = (m) => { asked = m; return true; };
+  c._lockAction('lock.front_door', 'lock');
+  out.lockNoConfirm = asked === null && calls.at(-1) === 'lock.lock:lock.front_door';
+  return out;
+});
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -38,9 +38,8 @@ const res = await page.evaluate(async () => {
  const vid = c._serverCfg.markers.find((m) => m.name === 'Тест')?.id;
  const center = c._roomCenter(room);
  const vpos = c._layout[vid];
-  const aspect = c._curSpaceCfg.aspect || 1;
-  out.newCentered = vpos && Math.abs(vpos.x * 1000 - center[0]) < 1 && Math.abs(vpos.y * (1000 / aspect) - center[1]) < 1;
+  out.newCentered = vpos && Math.abs(vpos.x * 1000 - center[0]) < 1 && Math.abs(vpos.y * 1000 - center[1]) < 1;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -20,5 +20,5 @@ const res = await page.evaluate(async () => {
  out.splitPicked = !!el2 && getComputedStyle(el2).stroke.includes('255, 193, 77');
  return out;
 });
-console.log(JSON.stringify(res));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,5 +1,5 @@
 // Merge & split room ops (v1.21.0) via the card's markup handlers (norm coords).
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const snap = await page.evaluate(() => JSON.stringify(window.__card._serverCfg));
 const restore = () => page.evaluate((s) => {
@@ -9,7 +9,7 @@ const restore = () => page.evaluate((s) => {
 }, snap);
 // norm→render helper mirrors what _markupClick passes to handlers
 const R = (nx, ny) => page.evaluate(([nx, ny]) => {
-  const c = window.__card; const H = 1000 / c._curSpaceCfg.aspect; return [nx * 1000, ny * H];
+  return [nx * 1000, ny * 1000];   // the canvas is square (v1.48.0)
 }, [nx, ny]);
 const S = () => page.evaluate(() => {
  const c = window.__card;
@@ -79,5 +79,9 @@ await page.evaluate((p)=>window.__card._splitClick(p), await R(0.4,0.0625));
 s = await S();
 out.alongWallRefused = !s.roomDlg && !s.pendingSplit;

-console.log(JSON.stringify(out,null,1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(out, {
+  "mergeRooms": 3,
+  "newRoom": "Cabinet",
+});
+await finish(browser, out);
@@ -1,5 +1,5 @@
 // UX modes shell (v1.25.0): view is display-only; plan/devices gate the tools.
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const out = {};
 const q = (sel) => page.evaluate((s) => (window.__card.shadowRoot || window.__card.renderRoot).querySelectorAll(s).length, sel);
@@ -75,5 +75,12 @@ out.devClickOpensEditor = await page.evaluate(async () => {
 // 5) назад в view
 await page.evaluate(() => window.__card._setMode('view'));
 out.backToView = (await st()).mode;
-console.log(JSON.stringify(out, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(out, {
+  "start": {"mode": "view", "modeTabs": 3, "editBtns": 1, "gears": 2, "markupBar": false, "stageClass": "stage    mode-view"},
+  "viewDragMoved": false,
+  "plan": {"mode": "plan", "modeTabs": 3, "active": "Plan editor", "editBtns": 1, "gears": 2, "markupBar": true, "stageClass": "stage markup tool-draw   mode-plan"},
+  "devices": {"mode": "devices", "modeTabs": 3, "active": "Device editor", "editBtns": 1, "gears": 2, "markupBar": true, "stageClass": "stage    mode-devices"},
+  "backToView": "view",
+});
+await finish(browser, out);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -31,5 +31,5 @@ const res = await page.evaluate(async () => {
  c._setMode('view'); c._space = 'f1'; c._saveNav(); await c.updateComplete;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -28,5 +28,5 @@ const res = await page.evaluate(async () => {
  out.stillKnown = c._serverCfg.settings.known_devices.includes('d_new');
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -39,5 +39,5 @@ const res = await page.evaluate(async () => {
  out.noGhostOverExisting = !sr().querySelector('.opghost');
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -6,7 +6,7 @@ const res = await page.evaluate(async () => {
  const sr = () => c.shadowRoot || c.renderRoot;
  c._setMode('plan'); c._tool = 'openwall'; await c.updateComplete;
  // r1|r2 делят стену x=0.55 → клик по ней открывает границу
-  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  const H = 1000;   // square canvas
  c._openWallClick([550, 0.25 * H]);
  await c.updateComplete;
  const r1 = c._curSpaceCfg.rooms.find((r) => r.id === 'r1');
@@ -53,8 +53,7 @@ const res = await page.evaluate(async () => {
    ...s, settings: { ...(s.settings || {}), fill_mode: 'glow' } })) };
  const litLight = c._devices.find((d) => d.space === c._space && d.entities.some((e) => e.startsWith('light.') && c.hass.states[e]?.state === 'on'));
  const c1 = c._roomCenter(c._spaceModel().rooms.find((r) => r.id === 'r1'));
-  const aspect = c._curSpaceCfg.aspect || 1;
-  c._layout = { ...c._layout, [litLight.id]: { s: c._space, x: c1[0] / 1000, y: c1[1] / (1000 / aspect) } };
+  c._layout = { ...c._layout, [litLight.id]: { s: c._space, x: c1[0] / 1000, y: c1[1] / 1000 } };
  c.requestUpdate(); await c.updateComplete;
  const clip = sr().querySelector('defs clipPath[id^="hp-glowclip"]');
  out.zoneClip = clip ? clip.querySelectorAll('path').length >= 2 : false;
@@ -70,5 +69,5 @@ const res = await page.evaluate(async () => {
  } else out.transitive = 'no r3';
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -6,7 +6,7 @@ const res = await page.evaluate(async () => {
  const sr = () => c.shadowRoot || c.renderRoot;
  const stage = () => sr().querySelector('.stage');
  c._setMode('plan'); c._tool = 'openwall'; await c.updateComplete;
-  const H = 1000 / (c._curSpaceCfg.aspect || 1);
+  const H = 1000;   // square canvas
  // 1) без наведения: курсор default, превью нет
  c._cursorPt = null; c.requestUpdate(); await c.updateComplete;
  out.idleCursor = getComputedStyle(stage()).cursor === 'default';
@@ -32,5 +32,5 @@ const res = await page.evaluate(async () => {
  c._openWallClick([550, 0.25 * H]); await c.updateComplete;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,76 @@
+// Подложка (фон плана) лежит за requires_auth-эндпоинтом: браузер не умеет
+// авторизовать <image href>, поэтому карточка просит бэкенд подписать путь.
+// Регрессия 2026-07-27: _display() вызывался внутри _buildModel(), а модель
+// мемоизируется по отпечатку конфига — неподписанный url «замерзал» в кэше,
+// подпись до <image> не доезжала. План не отображался никогда, а браузер
+// продолжал дёргать неподписанный путь → 401 → HA писал «неудачный вход»
+// с собственного IP пользователя.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const bgHref = () => {
+    const im = sr().querySelector('.stage svg image');
+    return im ? im.getAttribute('href') : null;
+  };
+
+  let signCalls = 0;
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  const base = c.hass.callWS;
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/content/sign') {
+      signCalls++;
+      const n = signCalls;
+      if (n === 1) await gate;
+      const urls = {};
+      for (const p of m.paths) urls[p] = p.split('?')[0] + '?authSig=SIG' + n;
+      return { urls };
+    }
+    return base(m);
+  } };
+
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, plan_url: '/api/houseplan/content/plans/_/f1.svg?v=17831509',
+  })};
+  c._cfgEpoch++;
+  c.requestUpdate(); await c.updateComplete;
+
+  // до подписи ничего не рисуем: неподписанный запрос вернул бы 401
+  out.hrefBeforeSign = bgHref();
+
+  release();
+  await new Promise((r) => setTimeout(r, 150));
+  await c.updateComplete;
+
+  // подпись доехала до атрибута, а не осела в кэше модели
+  out.signRequested = signCalls;
+  out.hrefSigned = bgHref();
+
+  // перерисовка по состоянию HA не теряет подпись и не просит её заново
+  c.requestUpdate(); await c.updateComplete;
+  out.hrefAfterRerender = bgHref();
+  out.signRequestedAfterRerender = signCalls;
+
+  // ре-подпись на долгоживущем экране: старый url держится до нового ответа
+  const before = bgHref();
+  c._resign();
+  out.resignKeepsPlan = bgHref() === before;
+  await new Promise((r) => setTimeout(r, 80));
+  await c.updateComplete;
+  out.hrefAfterResign = bgHref();
+  return out;
+});
+// зафиксировано прогоном на v1.44.7 и сверено с кодом
+checkAll(res, {
+  hrefBeforeSign: null,
+  signRequested: 1,
+  hrefSigned: '/api/houseplan/content/plans/_/f1.svg?authSig=SIG1',
+  hrefAfterRerender: '/api/houseplan/content/plans/_/f1.svg?authSig=SIG1',
+  signRequestedAfterRerender: 1,
+  resignKeepsPlan: true,
+  hrefAfterResign: '/api/houseplan/content/plans/_/f1.svg?authSig=SIG2',
+});
+await finish(browser);
@@ -0,0 +1,70 @@
+// Загрузка подложки: ссылка обязана долететь до конфига.
+// Баг 2026-07-27 (найден на боевой установке): _saveSpaceDialog держал ссылку
+// на объект пространства через await загрузки файла. Любое событие
+// houseplan_config_updated в этот момент вызывает _reloadConfigOnly(), которое
+// ЗАМЕНЯЕТ _serverCfg — и plan_url/aspect/settings уезжали в осиротевший
+// объект, а на сервер уходил нетронутый конфиг. Симптом: файл на диске есть,
+// подложки нет, пересохранение не помогает.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  let reloadDuringUpload = 0;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plan/set') {
+      // пока файл «загружается», прилетает чужая ревизия конфига
+      reloadDuringUpload++;
+      await c._reloadConfigOnly(true);
+      return { ok: true, url: '/api/houseplan/content/plans/_/' + m.space_id + '.png?v=42' };
+    }
+    if (m.type === 'houseplan/config/set') { c.__sent = m.config; return { ok: true, rev: 99 }; }
+    if (m.type === 'houseplan/config/get') {
+      // сервер отдаёт СВЕЖИЙ объект, а не тот же самый — как в реальном HA
+      const r = await base(m);
+      return { ...r, config: JSON.parse(JSON.stringify(r.config)) };
+    }
+    return base(m);
+  } };
+
+  // редактирование существующего пространства: подложка + новый заголовок
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, title: 'Ground', source: 'file',
+    planFile: { ext: 'png', b64: 'AAAA', aspect: 1.6 } };
+  await c._saveSpaceDialog(); await c.updateComplete;
+
+  out.reloadHappened = reloadDuringUpload === 1;
+  const sentF1 = (c.__sent?.spaces || []).find((s) => s.id === 'f1');
+  const liveF1 = (c._serverCfg?.spaces || []).find((s) => s.id === 'f1');
+  out.sentPlanUrl = sentF1?.plan_url;
+  out.sentPlanAspect = sentF1?.plan_aspect;   // the IMAGE's ratio; the canvas is square
+  out.sentTitle = sentF1?.title;
+  out.livePlanUrl = liveF1?.plan_url;
+  out.dialogClosed = c._spaceDialog === null;
+
+  // создание пространства при том же сбое: оно должно доехать целиком
+  c._openSpaceDialog('create'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, title: 'Attic', source: 'file',
+    planFile: { ext: 'png', b64: 'BBBB', aspect: 0.8 } };
+  await c._saveSpaceDialog(); await c.updateComplete;
+  const attic = (c.__sent?.spaces || []).find((s) => s.title === 'Attic');
+  out.atticSaved = !!attic;
+  out.atticHasPlan = !!attic && typeof attic.plan_url === 'string' && attic.plan_url.includes('/content/plans/');
+  out.atticPlanAspect = attic?.plan_aspect;
+  return out;
+});
+// зафиксировано прогоном на v1.44.8 и сверено с кодом
+checkAll(res, {
+  reloadHappened: true,
+  sentPlanUrl: '/api/houseplan/content/plans/_/f1.png?v=42',
+  sentPlanAspect: 1.6,
+  sentTitle: 'Ground',
+  livePlanUrl: '/api/houseplan/content/plans/_/f1.png?v=42',
+  dialogClosed: true,
+  atticSaved: true,
+  atticHasPlan: true,
+  atticPlanAspect: 0.8,
+});
+await finish(browser);
@@ -0,0 +1,71 @@
+// Граница транзакции загрузки подложки (ревью R2-1, уточнено в R3-1).
+// Файл плана пишется на диск ДО проверки ревизии конфига, поэтому отвергнутое
+// сохранение не имеет права трогать сохранённый план. Со стороны карточки
+// контракт теперь такой: она НЕ управляет удалением файлов вообще — уборку
+// делает сам config/set под блокировкой (клиент не может упорядочить свою
+// уборку относительно чужого коммита, R3-1). Здесь проверяем, что карточка
+// не отправляет никаких команд удаления и корректно ведёт себя при отказе.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  let uploads = 0;
+  const cleanups = [];
+  let rejectSave = true;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plan/set') {
+      uploads++;
+      return { ok: true, url: '/api/houseplan/content/plans/_/' + m.space_id + '.tok' + uploads + '.png' };
+    }
+    // любая команда удаления файлов от клиента — нарушение контракта R3-1
+    if (m.type === 'houseplan/plan/cleanup' || m.type === 'houseplan/plan/delete') { cleanups.push(m); return { ok: true }; }
+    if (m.type === 'houseplan/config/set') {
+      if (rejectSave) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      c.__sent = m.config; return { ok: true, rev: 77 };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { ...r, config: JSON.parse(JSON.stringify(r.config)) };
+    }
+    return base(m);
+  } };
+
+  const attach = async () => {
+    c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+    c._spaceDialog = { ...c._spaceDialog, title: 'Ground', source: 'file',
+      planFile: { ext: 'png', b64: 'AAAA', aspect: 1.6 } };
+    await c._saveSpaceDialog(); await c.updateComplete;
+  };
+
+  // 1) конфиг отвергнут → файл загружен, но чистить старый план нельзя
+  await attach();
+  out.uploadedOnReject = uploads === 1;
+  out.cleanupsAfterReject = cleanups.length;
+  out.dialogStaysOpenOnReject = c._spaceDialog !== null;
+
+  // 2) конфиг принят → чистка уходит, и ровно на тот файл, что записан в конфиг
+  rejectSave = false;
+  c._spaceDialog = null; await c.updateComplete;
+  await attach();
+  out.cleanupsAfterAccept = cleanups.length;
+  const f1 = (c.__sent?.spaces || []).find((s) => s.id === 'f1');
+  out.savedPlanUrl = f1?.plan_url;
+  out.dialogClosedOnAccept = c._spaceDialog === null;
+  // вторая загрузка не переиспользует имя первой: старый файл жив до коммита
+  out.versionedNames = uploads === 2;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом
+checkAll(res, {
+  uploadedOnReject: true,
+  cleanupsAfterReject: 0,
+  dialogStaysOpenOnReject: true,
+  cleanupsAfterAccept: 0,
+  savedPlanUrl: '/api/houseplan/content/plans/_/f1.tok2.png',
+  dialogClosedOnAccept: true,
+  versionedNames: true,
+});
+await finish(browser);
@@ -0,0 +1,59 @@
+// HP-1454-07: статическая карточка строит модель другой функцией, и room.settings
+// в неё не переносились — переопределение заливки на уровне комнаты она
+// игнорировала и красила комнату, которую полная карточка оставляет прозрачной.
+// Плюс HP-1454-08: layout-события должны доходить до статической карточки без
+// перезагрузки страницы.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+
+  // заливка по свету на пространстве, у первой комнаты — переопределение "none"
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  const f1 = cfg.spaces.find((s) => s.id === 'f1');
+  f1.settings = { ...(f1.settings || {}), show_borders: true, show_names: true, fill_mode: 'light' };
+  f1.rooms[0].settings = { fill_mode: 'none' };
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {}, rev: 1 };
+    return { ok: true };
+  } };
+
+  main._serverCfg = cfg;
+  main._cfgEpoch++;
+  main.requestUpdate(); await main.updateComplete;
+
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  await card.updateComplete;
+
+  const overridden = (root) => {
+    const rooms = [...root.querySelectorAll('.room')];
+    return rooms.length ? ((rooms[0].getAttribute('style') || '').match(/--room-fill:([^;]+)/) || [])[1] || null : 'missing';
+  };
+
+  out.fullCardRoom0 = overridden(main.shadowRoot || main.renderRoot);
+  out.staticCardRoom0 = overridden(card.renderRoot);
+  out.parity = out.fullCardRoom0 === out.staticCardRoom0;
+  out.overrideRespected = out.staticCardRoom0 === 'transparent';
+
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  fullCardRoom0: 'transparent',
+  staticCardRoom0: 'transparent',
+  parity: true,
+  overrideRespected: true,
+});
+await finish(browser);
@@ -0,0 +1,40 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  // счётчики вызовов тяжёлой геометрии
+  let pairsCalls = 0, buildCalls = 0;
+  const origPairs = c._computeOpenPairs.bind(c);
+  c._computeOpenPairs = (...a) => { pairsCalls++; return origPairs(...a); };
+  const origBuild = c._buildModel.bind(c);
+  c._buildModel = (...a) => { buildCalls++; return origBuild(...a); };
+  // открыть границу, чтобы pairs было что считать
+  const sp = c._curSpaceCfg;
+  const r1 = sp.rooms[0], r2 = sp.rooms[1];
+  r1.open_to = [r2.id]; r2.open_to = [r1.id];
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  pairsCalls = 0; buildCalls = 0;
+  // 10 «пушей состояния» от HA без изменения конфига
+  for (let i = 0; i < 10; i++) {
+    c.hass = { ...c.hass, states: { ...c.hass.states } };
+    await c.updateComplete;
+  }
+  out.pairsPerRender = pairsCalls;      // должно быть 0: кэш живёт между рендерами
+  out.modelBuildsPer10Renders = buildCalls;
+  // правка конфига обязана инвалидировать кэш
+  const before = pairsCalls;
+  const r3 = sp.rooms[2] || sp.rooms[0];
+  r3.open_to = [r1.id]; r1.open_to = [r2.id, r3.id];
+  c._saveConfig(); c.requestUpdate(); await c.updateComplete;
+  out.invalidatesOnEdit = pairsCalls > before;
+  // геометрия по-прежнему правильная: пунктир на месте
+  out.dashesStillRendered = (c.shadowRoot || c.renderRoot).querySelectorAll('.openwall').length > 0;
+  return out;
+});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "pairsPerRender": 0,
+  "modelBuildsPer10Renders": 0,
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -8,9 +8,20 @@ const res = await page.evaluate(async () => {
  c.hass = { ...c.hass, states: { ...c.hass.states,
    'light.ceiling': { entity_id: 'light.ceiling', state: 'on', attributes: { friendly_name: 'Ceiling light', rgb_color: [255, 0, 128] } } } };
  await c.updateComplete;
-  const rgbDev = sr().querySelector('.dev.rgb');
-  out.rgbClass = !!rgbDev;
-  out.rgbVar = rgbDev?.getAttribute('style')?.includes('--light-color:rgb(255, 0, 128)');
+  // v1.52.0 (правило владельца): RGB больше НЕ красит значок — цвет лампы
+  // живёт только в glow-пятне и в фолбэке цвета пульсации
+  out.rgbClassGone = !sr().querySelector('.dev.rgb');
+  out.litLampIsYellow = [...sr().querySelectorAll('.dev.on')].length > 0;
+  // фолбэк пульсации сохраняет цвет свечения: маркер icon_ripple на лампе
+  const lampDev = c._devices.find((x) => x.entities.includes('light.ceiling'));
+  c._serverCfg.markers = (c._serverCfg.markers || []).filter((m) => m.id !== lampDev.id);
+  c._serverCfg.markers.push({ id: lampDev.id, binding: 'device:' + lampDev.bindingRef, display: 'icon_ripple' });
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices();
+  c.requestUpdate(); await c.updateComplete;
+  const rippleDev = [...sr().querySelectorAll('.dev')].find((e) => (e.getAttribute('style') || '').includes('--ripple-color'));
+  out.rippleKeepsLightColor = !!rippleDev && rippleDev.getAttribute('style').includes('rgb(255, 0, 128)');
+  c._serverCfg.markers = c._serverCfg.markers.filter((m) => m.id !== lampDev.id);
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
  // тревога: датчик протечки on
  c.hass = { ...c.hass, states: { ...c.hass.states,
    'binary_sensor.sink_leak': { entity_id: 'binary_sensor.sink_leak', state: 'on', attributes: { friendly_name: 'Leak', device_class: 'moisture' } } } };
@@ -28,5 +39,8 @@ const res = await page.evaluate(async () => {
  out.outageSafe = sr().querySelectorAll('.dev.alarm').length === 0;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "alarmCount": 1,
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -36,8 +36,14 @@ const res = await page.evaluate(async () => {
  c._setMode('plan'); await c.updateComplete;
  const planLbl = sr().querySelector('.roomlabel');
  out.handlesInPlan = planLbl?.querySelectorAll('.rlhandle').length === 4;
-  // метрики скрыты в редакторе плана (карточка = имя, чтобы не мешать разметке)
-  out.plainInPlan = sr().querySelectorAll('.roomlabel.card').length === 0;
+  // метрики видны и в редакторе плана (решение владельца, 2026-07-29)
+  out.plainInPlan = sr().querySelectorAll('.roomlabel.card').length > 0;
+  // кнопка настроек — отдельно от подписи, в центре комнаты, с размером от иконки
+  out.gearDetached = (() => {
+    const g = sr().querySelector('.rlgearbtn');
+    if (!g || g.closest('.roomlabel')) return false;
+    return getComputedStyle(g).height !== 'auto';
+  })();
  // масштаб: сымитируем resize через прямой вызов
  const room = c._spaceModel().rooms.find((r) => r.name);
  c._rlResize = { id: 'rl_' + room.id, space: spId, k0: 1, cx: 100, cy: 100, d0: 50 };
@@ -57,5 +63,11 @@ const res = await page.evaluate(async () => {
  out.dragKeepsScale = c._layout['rl_' + room.id].k <= 3 && c._layout['rl_' + room.id].k >= 2.9;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "labels": 4,
+  "cardsWithMetrics": 4,
+  "sampleMetrics": ["22.4°", "175", "1 of 2"],
+  "partialText": "1 of 2",
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -34,5 +34,5 @@ const res = await page.evaluate(async () => {
  c._setMode('view'); await c.updateComplete;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -10,7 +10,7 @@ const res = await page.evaluate(async () => {
    ...s, settings: { ...(s.settings || {}), show_names: true, fill_mode: 'temp', label_temp: true } })) };
  c._setMode('plan'); c.requestUpdate(); await c.updateComplete;
  // 1) шестерёнка на карточке комнаты в редакторе плана
-  const gear = sr().querySelector('.rlgear');
+  const gear = sr().querySelector('.rlgearbtn');
  out.gearShown = !!gear;
  gear.dispatchEvent(new MouseEvent('click', { bubbles: true, composed: true }));
  await c.updateComplete;
@@ -58,5 +58,5 @@ const res = await page.evaluate(async () => {
  out.glowOptOut = darkCount === areaRooms - 1 && darkCount === styledRooms.length;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,36 @@
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sent = [];
+  // перехват WS: config/set логируем, config/get отдаёт "серверную" копию БЕЗ локальной правки
+  const server = { cfg: JSON.parse(JSON.stringify(c._serverCfg)), rev: c._cfgRev };
+  c.hass = { ...c.hass, callWS: async (msg) => {
+    if (msg.type === 'houseplan/config/set') {
+      sent.push(JSON.parse(JSON.stringify(msg.config)));
+      server.cfg = JSON.parse(JSON.stringify(msg.config));
+      server.rev = (msg.expected_rev ?? server.rev) + 1;
+      return { rev: server.rev };
+    }
+    if (msg.type === 'houseplan/config/get') return { config: JSON.parse(JSON.stringify(server.cfg)), rev: server.rev };
+    return {};
+  } };
+  await c.updateComplete;
+  // локальная правка (как разметка комнаты) + дебаунс
+  const sp = c._curSpaceCfg;
+  sp.rooms.push({ id: 'race_room', name: 'RACE', area: null, poly: [[0.8, 0.8], [0.9, 0.8], [0.9, 0.9], [0.8, 0.9]] });
+  c._saveConfig();
+  out.pending = c._saveConfigDebounced.pending();
+  // через 100 мс приходит событие о чужой ревизии — раньше это стирало правку
+  c._cfgRev = server.rev; // симулируем: наша ревизия отстала
+  await c._reloadConfigOnly();
+  await new Promise((r) => setTimeout(r, 900));
+  // правка обязана уцелеть и уйти на сервер
+  out.editSent = sent.some((cf) => cf.spaces.some((s) => s.rooms?.some((r) => r.id === 'race_room')));
+  out.editInMemory = c._serverCfg.spaces.some((s) => s.rooms?.some((r) => r.id === 'race_room'));
+  out.serverHasIt = server.cfg.spaces.some((s) => s.rooms?.some((r) => r.id === 'race_room'));
+  return out;
+});
+checkAll(res);
+await finish(browser, res);
@@ -0,0 +1,93 @@
+// «Уже загруженные»: план, который не удаляется за ненадобностью, обязан быть
+// находимым. Иначе обещание «отцепил — файл остался» неполноценно: вернуть его
+// из карточки было нельзя, старый URL нигде не хранится (HP-1466-02).
+// Заодно это единственный способ удалить план — явным действием.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 1000 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const base = c.hass.callWS;
+
+  let serverPlans = [
+    { name: 'f1.aaa.png', url: '/api/houseplan/content/plans/_/f1.aaa.png', size: 121335, modified: 2, used_by: [] },
+    { name: 'f2.bbb.png', url: '/api/houseplan/content/plans/_/f2.bbb.png', size: 26931, modified: 1, used_by: ['2 этаж'] },
+  ];
+  const deleted = [];
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plans/list') return { plans: serverPlans };
+    if (m.type === 'houseplan/plans/delete') {
+      const p = serverPlans.find((x) => x.name === m.name);
+      if (p?.used_by.length) { const e = new Error('in_use'); e.code = 'in_use'; throw e; }
+      deleted.push(m.name);
+      serverPlans = serverPlans.filter((x) => x.name !== m.name);
+      return { ok: true, removed: true };
+    }
+    if (m.type === 'houseplan/content/sign') {
+      const urls = {}; for (const p of m.paths) urls[p] = p + '?authSig=X'; return { urls };
+    }
+    return base(m);
+  } };
+  window.confirm = () => true;
+
+  // пространство без плана — как после отцепления
+  c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+  c._spaceDialog = { ...c._spaceDialog, source: 'file', planUrl: null, planFile: null };
+  await c.updateComplete;
+  out.saveBlockedWithoutPlan = !!sr().querySelector('.dialog .btn.on[disabled]');
+
+  // открываем список сохранённых
+  await c._toggleServerPlans();
+  await new Promise((r) => setTimeout(r, 60));
+  await c.updateComplete;
+  const rows = [...sr().querySelectorAll('.savedplan')];
+  out.listed = rows.length;
+  out.showsUsage = (rows[1]?.textContent || '').includes('2 этаж');
+  out.deleteDisabledForUsed = !!rows[1]?.querySelector('.btn.danger[disabled]');
+  out.deleteEnabledForFree = !rows[0]?.querySelector('.btn.danger[disabled]');
+  out.thumbnailSigned = (rows[0]?.querySelector('img')?.getAttribute('src') || '').includes('authSig=');
+
+  // выбираем свободный план — он подставляется в диалог
+  c._useServerPlan(serverPlans[0].url);
+  await new Promise((r) => setTimeout(r, 80));
+  await c.updateComplete;
+  out.picked = c._spaceDialog.planUrl === '/api/houseplan/content/plans/_/f1.aaa.png';
+  out.listClosed = !c._spaceDialog.pickSaved;
+  out.saveEnabledAfterPick = !sr().querySelector('.dialog .btn.on[disabled]');
+
+  // выбранный в этом же диалоге удалить нельзя: сохранение записало бы ссылку
+  // на несуществующий файл (HP-1470-02)
+  await c._toggleServerPlans();
+  await new Promise((r) => setTimeout(r, 60));
+  await c.updateComplete;
+  const rows2 = [...sr().querySelectorAll('.savedplan')];
+  const picked = rows2.find((r) => r.textContent.includes('f1.aaa.png'));
+  out.deleteDisabledForPicked = !!picked?.querySelector('.btn.danger[disabled]');
+  c._spaceDialog = { ...c._spaceDialog, planUrl: null };
+  await c.updateComplete;
+  await c._deleteServerPlan('f2.bbb.png').catch(() => {});
+  out.usedNotDeleted = !deleted.includes('f2.bbb.png');
+  await c._deleteServerPlan('f1.aaa.png');
+  await c.updateComplete;
+  out.freeDeleted = deleted.includes('f1.aaa.png');
+  out.rowGone = !(c._spaceDialog.saved || []).some((p) => p.name === 'f1.aaa.png');
+  return out;
+});
+// зафиксировано прогоном на v1.47.0 и сверено с кодом
+checkAll(res, {
+  saveBlockedWithoutPlan: true,
+  listed: 2,
+  showsUsage: true,
+  deleteDisabledForUsed: true,
+  deleteEnabledForFree: true,
+  thumbnailSigned: true,
+  picked: true,
+  listClosed: true,
+  saveEnabledAfterPick: true,
+  deleteDisabledForPicked: true,
+  usedNotDeleted: true,
+  freeDeleted: true,
+  rowGone: true,
+});
+await finish(browser);
@@ -0,0 +1,78 @@
+// Ревью R2-2: бэкенд подписывает не более MAX_SIGN_PATHS путей за вызов и
+// молча отбрасывает остальные. Карточка обязана бить запрос на батчи, помнить
+// возраст подписи и чистить кэш от ссылок, которых в конфиге больше нет —
+// иначе на настенном планшете «лишние» записи протухают навсегда.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const batchSizes = [];
+  let round = 0;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/content/sign') {
+      batchSizes.push(m.paths.length);
+      const urls = {};
+      // как настоящий бэкенд: не больше 200 за раз, про остальные — молчание
+      for (const p of m.paths.slice(0, 200)) urls[p] = p.split('?')[0] + '?authSig=R' + round;
+      return { urls };
+    }
+    return base(m);
+  } };
+
+  // 201 вложение, разложенное по маркерам: столько же подписанных ссылок
+  const pdfs = [];
+  for (let i = 0; i < 201; i++) pdfs.push({ name: 'm' + i, url: '/api/houseplan/content/files/m/doc' + i + '.pdf' });
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'mk1', pdfs }] };
+  c._cfgEpoch++;
+
+  round = 1;
+  for (const p of pdfs) c._display(p.url);
+  await new Promise((r) => setTimeout(r, 120));
+  out.firstBatches = [...batchSizes];
+  out.signedAfterFirst = Object.keys(c._signer.entries).length;
+
+  // переподписывание: все 201, снова батчами, ни одна запись не остаётся старой
+  batchSizes.length = 0;
+  round = 2;
+  c._resign();
+  await new Promise((r) => setTimeout(r, 120));
+  out.resignBatches = [...batchSizes];
+  const vals = Object.values(c._signer.entries).map((v) => v.url);
+  out.allRefreshed = vals.length === 201 && vals.every((u) => u.endsWith('authSig=R2'));
+
+  // ссылка, исчезнувшая из конфига, выбывает из кэша и не занимает слот
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'mk1', pdfs: pdfs.slice(0, 5) }] };
+  c._cfgEpoch++;
+  batchSizes.length = 0;
+  round = 3;
+  c._resign();
+  await new Promise((r) => setTimeout(r, 120));
+  out.prunedTo = Object.keys(c._signer.entries).length;
+  out.pruneBatches = [...batchSizes];
+
+  // протухшая подпись не отдаётся: она вернула бы 401 и «попытку входа»
+  const one = pdfs[0].url;
+  c._signer.entries[one] = { url: one + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
+  out.expiredNotServed = c._display(one) === '';
+  out.expiredDropped = c._signer.entries[one] === undefined;
+  // а стареющая, но ещё живая — отдаётся, пока едет замена
+  c._signer.entries[one] = { url: one + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
+  out.agingStillServed = c._display(one) === one + '?authSig=AGING';
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом
+checkAll(res, {
+  firstBatches: [200, 1],
+  signedAfterFirst: 201,
+  resignBatches: [200, 1],
+  allRefreshed: true,
+  prunedTo: 5,
+  pruneBatches: [5],
+  expiredNotServed: true,
+  expiredDropped: true,
+  agingStillServed: true,
+});
+await finish(browser);
@@ -0,0 +1,61 @@
+// HP-1513-01: один и тот же маркер (size 3, angle 37) обязан выглядеть
+// одинаково на полной и статичной карточках — статичная игнорировала и
+// множитель размера, и поворот.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const out = await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  await customElements.whenDefined('houseplan-space-card');
+  const d = c._devices.find((x) => x.space === 'f1' && x.bindingKind === 'device');
+  const cfg = JSON.parse(JSON.stringify(c._serverCfg));
+  cfg.markers = (cfg.markers || []).filter((m) => m.id !== d.id);
+  cfg.markers.push({ id: d.id, binding: 'device:' + d.bindingRef, size: 3, angle: 37 });
+  c._serverCfg = cfg; c._cfgEpoch++; c._regSignature = '';
+  c._maybeRebuildDevices(); c.requestUpdate(); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 100));
+  const pick = (root) => [...root.querySelectorAll('.dev')]
+    .find((e) => (e.getAttribute('style') || '').includes('--dev-scale:3'));
+  const full = pick(c.shadowRoot || c.renderRoot);
+  const fW = full?.getBoundingClientRect().width || 0;
+  const fT = full ? getComputedStyle(full.querySelector('ha-icon')).transform : 'none';
+
+  window.__hpInvalidate?.();
+  const hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 83 };
+    if (m.type === 'houseplan/layout/get') return { layout: c._layout, rev: 83 };
+    return { ok: true };
+  }, connection: { subscribeEvents: async (cb) => { window.__hpInvalidate = cb; return () => {}; } } };
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!pick(card.renderRoot || { querySelectorAll: () => [] }) && Date.now() - t0 < 6000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  const st = pick(card.renderRoot);
+  const sW = st?.getBoundingClientRect().width || 0;
+  const sT = st ? getComputedStyle(st.querySelector('ha-icon')).transform : 'none';
+  o.staticCarriesScale = sW > 0;
+  // абсолютные px несравнимы (разные контейнеры/letterbox) — контракт в том,
+  // что множитель РАБОТАЕТ на обеих карточках: базовый значок той же карточки
+  // втрое меньше масштабированного
+  const stBase = [...card.renderRoot.querySelectorAll('.dev')]
+    .find((e) => !(e.getAttribute('style') || '').includes('--dev-scale'));
+  const sBaseW = stBase?.getBoundingClientRect().width || 0;
+  o.staticRatioIs3 = sBaseW > 0 && Math.abs(sW / sBaseW - 3) < 0.35;
+  const fBase = [...(c.shadowRoot || c.renderRoot).querySelectorAll('.dev')]
+    .find((e) => !(e.getAttribute('style') || '').includes('--dev-scale') && !e.classList.contains('ghost'));
+  const fBaseW = fBase?.getBoundingClientRect().width || 0;
+  o.fullRatioIs3 = fBaseW > 0 && Math.abs(fW / fBaseW - 3) < 0.35;
+  o.bothRotated = fT !== 'none' && sT !== 'none' && fT.startsWith('matrix') && sT.startsWith('matrix');
+  if (!o.staticRatioIs3) console.log('static', sW, sBaseW);
+  host.remove();
+  c._serverCfg.markers = c._serverCfg.markers.filter((m) => m.id !== d.id);
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices();
+  return o;
+});
+await finish(browser, checkAll(out));
@@ -0,0 +1,99 @@
+// Ревью R3-2: houseplan-space-card подписывала URL подложки и выбрасывала
+// результат — getCardSize() правил временную модель, а render() строил свою
+// заново из конфига, поэтому <image> запрашивал сырой requires_auth-путь и на
+// каждом рендере получал 401. Проверяем весь контракт подписи для этой карточки.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+  const raw = '/api/houseplan/content/plans/_/f1.tok.svg';
+
+  // подложка на защищённом эндпоинте + управляемый ответ на подпись
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  cfg.spaces = cfg.spaces.map((s) => (s.id === 'f1' ? { ...s, plan_url: raw } : s));
+  let signCalls = 0;
+  let failFirst = true;
+  const requestedHrefs = [];
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {} };
+    if (m.type === 'houseplan/content/sign') {
+      signCalls++;
+      if (failFirst && signCalls === 1) throw new Error('ws down');
+      const urls = {};
+      for (const p of m.paths) urls[p] = p + '?authSig=SIG' + signCalls;
+      return { urls };
+    }
+    return { ok: true };
+  } };
+
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+
+  const stage = async () => {
+    const t0 = Date.now();
+    while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) {
+      await new Promise((r) => setTimeout(r, 60));
+    }
+    await card.updateComplete;
+    return card.renderRoot.querySelector('.hp-static-stage svg image');
+  };
+  const href = async () => { const im = await stage(); return im ? im.getAttribute('href') : null; };
+
+  // 1) первая подпись упала → сырой URL в DOM не попадает (иначе 401)
+  await stage();
+  await new Promise((r) => setTimeout(r, 120));
+  out.hrefAfterFailedSign = await href();
+
+  // 2) сразу повтора нет: после ошибки подпись уходит в backoff (ревью R4-2),
+  //    иначе нестабильный сокет получал бы по запросу на каждый рендер
+  for (let i = 0; i < 5; i++) { card.requestUpdate(); await card.updateComplete; }
+  await new Promise((r) => setTimeout(r, 150));
+  out.noRetryStorm = signCalls === 1;
+
+  // 3) после выдержки повтор проходит
+  await new Promise((r) => setTimeout(r, 2100));
+  card.requestUpdate(); await card.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+  out.hrefAfterRetry = await href();
+  out.retried = signCalls === 2;
+
+  // 4) повторный рендер не теряет подпись и не просит её заново
+  const before = signCalls;
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefStable = await href();
+  out.noExtraSignOnRerender = signCalls === before;
+
+  // 5) протухшая подпись не отдаётся, стареющая — отдаётся, пока едет замена
+  const ent = card._signer.entries;
+  ent[raw] = { url: raw + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefWhenExpired = await href();
+  ent[raw] = { url: raw + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefWhenAging = await href();
+
+  // ни один сырой (неподписанный) путь не должен уходить в сеть
+  for (const im of card.renderRoot.querySelectorAll('image')) requestedHrefs.push(im.getAttribute('href'));
+  out.noRawHrefEver = !requestedHrefs.includes(raw);
+  return out;
+});
+// зафиксировано прогоном на v1.45.1 и сверено с кодом
+checkAll(res, {
+  hrefAfterFailedSign: null,
+  noRetryStorm: true,
+  hrefAfterRetry: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=SIG2',
+  retried: true,
+  hrefStable: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=SIG2',
+  noExtraSignOnRerender: true,
+  hrefWhenExpired: null,
+  hrefWhenAging: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=AGING',
+  noRawHrefEver: true,
+});
+await finish(browser);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -27,7 +27,8 @@ const res = await page.evaluate(async () => {
  })};
  c.requestUpdate(); await c.updateComplete;
  out.lqiFills = [...sr().querySelectorAll('.room.styled')].filter((r) => (r.getAttribute('style') || '').includes('hsl(')).length;
-  // 4) drag лейбла → layout rl_
+  // 4) drag лейбла → layout rl_ (только в редакторе плана, с v1.25)
+  c._setMode('plan'); await c.updateComplete;
  const lbl = sr().querySelector('.roomlabel');
  c._labelDown({ preventDefault(){}, stopPropagation(){}, clientX: 100, clientY: 100, target: { setPointerCapture(){} }, pointerId: 5 },
    c._spaceModel().rooms[0], 'f1');
@@ -41,10 +42,22 @@ const res = await page.evaluate(async () => {
  out.saveEnabled = !sr().querySelector('.dialog .btn.on[disabled]');
  await c._saveSpaceDialog(); await c.updateComplete;
  const attic = c._serverCfg.spaces.find((s) => s.title === 'Attic');
-  out.atticAspect = attic?.aspect;
+  out.atticSquare = attic?.aspect === undefined;  // no per-space ratio any more
  out.atticSettings = attic?.settings;
  out.atticNoPlan = attic ? attic.plan_url === null : null;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "defaultStyled": 0,
+  "defaultLabels": 0,
+  "styled": 4,
+  "labels": ["Living room", "Kitchen", "Bedroom", "Hallway"],
+  "livingStyle": "--room-stroke:#ff8800;--room-stroke-op:0.8;--room-fill:#ffd45c;--room-fill-op:0.180",
+  "lqiFills": 0,
+  "atticSquare": true,
+  // fill_mode 'glow' — the default for NEW spaces since v1.54 (owner call).
+  // Existing spaces with an absent fill_mode still resolve to 'none'.
+  "atticSettings": {"show_borders": true, "show_names": true, "room_color": "#3ea6ff", "room_opacity": 0.55, "fill_mode": "glow", "temp_min": 20, "temp_max": 25, "show_lqi": true, "label_temp": false, "label_hum": false, "label_lqi": false, "label_light": false},
+});
+await finish(browser, res);
@@ -1,14 +1,14 @@
 // Split now works on a non-grid-aligned room (imported/legacy polygons).
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const R = (nx, ny) => page.evaluate(([nx, ny]) => {
-  const c = window.__card; const H = 1000 / c._curSpaceCfg.aspect; return [nx * 1000, ny * H];
+  return [nx * 1000, ny * 1000];   // square canvas (v1.48.0)
 }, [nx, ny]);
 const out = {};
 await page.evaluate(()=>{const c=window.__card; if(!c._markup)c._setMode('plan'); c._tool='split';});
-// living room (r1) has walls at y=0.05 which are NOT grid nodes; click near the wall
+// living room (r1) has walls at y=0.14 which are NOT grid nodes; click near the wall
 await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.3));   // pick living
-await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.052)); // near top wall (off grid)
+await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.142)); // near top wall (off grid)
 await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.58));  // near bottom wall
 out.pending = await page.evaluate(()=>!!window.__card._pendingSplit);
 out.dialog = await page.evaluate(()=>!!window.__card._roomDialog);
@@ -17,5 +17,5 @@ await page.evaluate(()=>{const c=window.__card; c._roomDialog=false; c._pendingS
 await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.3));   // pick again
 await page.evaluate((p)=>window.__card._splitClick(p), await R(0.3,0.3));   // centre click = miss
 out.centreRefused = await page.evaluate(()=>window.__card._splitSel?.a == null);
-console.log(JSON.stringify(out));
-await browser.close();
+checkAll(out);
+await finish(browser, out);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -51,5 +51,8 @@ const res = await page.evaluate(async () => {
  await esc(); out.escExitsMerge = c._tool === 'draw';
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "partsPolys": [6, 4],
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -30,5 +30,14 @@ const res = await page.evaluate(async () => {
  out.noSmallBadge = !vd[0]?.querySelector('.tval');
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "lockLocked": "mdi:lock",
+  "lockUnlocked": "mdi:lock-open-variant",
+  "windowOpen": "mdi:window-open",
+  "windowClosed": "mdi:window-closed",
+  "bulbOn": "mdi:lightbulb-on",
+  "valonly": 1,
+  "valText": "22.4°",
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -31,5 +31,9 @@ const res = await page.evaluate(async () => {
  c._markerDialog = null;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "markerRoomId": "rc",
+  "reopenRoom": "f1#@rc",
+});
+await finish(browser, res);
@@ -0,0 +1,78 @@
+// HP-1454-01: загруженный SVG — пользовательский контент, который Home Assistant
+// отдаёт со своего origin. Внутри карточки он подключён через <image>, где
+// скрипты не выполняются, но тот же URL, открытый как отдельный документ,
+// становится живым документом этого origin: <script> в нём получает доступ к
+// localStorage сессии и к API. Проверяем, что заголовок sandbox это снимает,
+// и что обычный SVG при этом продолжает отображаться.
+import { chromium } from 'playwright';
+import { check, finish } from './serve.mjs';
+
+const EVIL = `<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="#eee"/>
+  <script>
+    document.title = 'HOUSEPLAN_XSS_EXECUTED';
+    try { localStorage.setItem('hp_xss', 'executed'); } catch (e) {}
+  </script>
+</svg>`;
+
+// ровно тот набор, который отдаёт HouseplanContentView для .svg
+const CSP = "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+  + "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:";
+
+const browser = await chromium.launch({ args: ['--no-sandbox'] });
+const ctx = await browser.newContext();
+
+async function serve(page, { csp }) {
+  await page.route('**/*', (route) => {
+    const url = route.request().url();
+    if (url.endsWith('/evil.svg')) {
+      const headers = { 'Content-Type': 'image/svg+xml', 'X-Content-Type-Options': 'nosniff' };
+      if (csp) headers['Content-Security-Policy'] = CSP;
+      return route.fulfill({ status: 200, headers, body: EVIL });
+    }
+    return route.fulfill({ status: 200, contentType: 'text/html', body: '<html><body>host</body></html>' });
+  });
+}
+
+// 1) как было до фикса: скрипт исполняется в origin Home Assistant
+const before = await ctx.newPage();
+await serve(before, { csp: false });
+await before.goto('https://ha.example/api/houseplan/content/plans/_/evil.svg');
+await before.waitForTimeout(200);
+const noCsp = await before.evaluate(() => ({
+  title: document.title,
+  storage: (() => { try { return localStorage.getItem('hp_xss'); } catch (e) { return 'blocked'; } })(),
+}));
+
+// 2) с заголовком: opaque origin, скрипт не выполняется, storage недоступен
+const after = await ctx.newPage();
+await serve(after, { csp: true });
+await after.goto('https://ha.example/api/houseplan/content/plans/_/evil.svg');
+await after.waitForTimeout(200);
+const withCsp = await after.evaluate(() => ({
+  title: document.title,
+  storage: (() => { try { return localStorage.getItem('hp_xss'); } catch (e) { return 'blocked'; } })(),
+}));
+
+// 3) тот же файл как <image> внутри страницы — рисуется и без скрипта
+const card = await ctx.newPage();
+await serve(card, { csp: true });
+await card.goto('https://ha.example/');
+const drawn = await card.evaluate(async () => {
+  const img = new Image();
+  const ok = await new Promise((res) => {
+    img.onload = () => res(true);
+    img.onerror = () => res(false);
+    img.src = '/api/houseplan/content/plans/_/evil.svg';
+  });
+  return { loaded: ok, width: img.naturalWidth, title: document.title };
+});
+
+check('без CSP скрипт выполняется (иначе тест ничего не доказывает)', noCsp.title, 'HOUSEPLAN_XSS_EXECUTED');
+check('без CSP скрипт пишет в storage origin', noCsp.storage, 'executed');
+check('с CSP скрипт не выполняется', withCsp.title !== 'HOUSEPLAN_XSS_EXECUTED', true);
+check('с CSP storage origin недоступен', withCsp.storage !== 'executed', true);
+check('SVG по-прежнему грузится как картинка', drawn.loaded, true);
+check('и имеет размеры', drawn.width, 100);
+check('картинка ничего не выполнила на странице-хосте', drawn.title, '');
+await finish(browser);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -6,11 +6,13 @@ const res = await page.evaluate(async () => {
  const sr = () => c.shadowRoot || c.renderRoot;
  // 1) в селекте действий 3 опции, дефолт «Карточка устройства»
  c._setMode('devices'); await c.updateComplete;
-  const dev = c._devices.find((d) => !d.virtual && d.primary);
+  // v1.39.0: у ЛАМП дефолт 'toggle', поэтому для проверки дефолта 'info'
+  // берём заведомо не-световое устройство
+  const dev = c._devices.find((d) => !d.virtual && d.primary && !d.primary.startsWith('light.'));
  c._openMarkerDialog(dev); await c.updateComplete;
  const sel = [...sr().querySelectorAll('.dialog select')].find((s) =>
    [...s.options].some((o) => o.textContent === c._t('tap.toggle')));
-  out.threeOptions = sel && sel.options.length === 3;
+  out.threeOptions = sel && sel.options.length === 4; // + «Запустить…» (2026-07-29)
  out.noAutoOption = sel && ![...sel.options].some((o) => o.value === '');
  out.defaultInfo = sel && sel.value === 'info';
  c._markerDialog = null; await c.updateComplete;
@@ -41,14 +43,19 @@ const res = await page.evaluate(async () => {
  const calls = [];
  c.hass = { ...c.hass, callService: (d2, s2, data) => { calls.push([d2, s2, data]); return Promise.resolve(); } };
  await c.updateComplete;
-  const plain = c._devices.find((d) => !d.virtual && d.primary?.startsWith('light.') && !d.tapAction);
+  // card-wide tap_action игнорируется: НЕ-световое устройство остаётся на инфо
+  const plain = c._devices.find((d) => !d.virtual && d.primary
+    && !d.primary.startsWith('light.') && !d.tapAction && !d.marker?.controls?.length);
  if (plain) {
    c._infoCard = null;
    c._clickDevice(new MouseEvent('click'), plain);
    out.cardTapIgnored = calls.length === 0 && !!c._infoCard;
    c._infoCard = null;
-  } else out.cardTapIgnored = 'no-plain-light';
+  } else out.cardTapIgnored = 'no-plain-device';
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "virtInfo": "no-virt",
+});
+await finish(browser, res);
@@ -0,0 +1,84 @@
+// ТЗ 2026-07-29: действие по нажатию «Запустить автоматизацию/скрипт/сцену»
+// с пикером и поиском + чекбокс «Спрашивать подтверждение» для toggle/run.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = await page.evaluate(async () => {
+  const o = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const calls = [];
+  c.hass = { ...c.hass,
+    states: { ...c.hass.states,
+      'automation.evening': { state: 'on', attributes: { friendly_name: 'Вечерний свет' } },
+      'script.curtains': { state: 'off', attributes: { friendly_name: 'Шторы' } },
+      'scene.movie': { state: '', attributes: { friendly_name: 'Кино' } } },
+    callService: async (dom, svc, data) => { calls.push([dom, svc, data]); return {}; } };
+
+  // --- диалог: выбор run + пикер с поиском --------------------------------
+  const d = c._devices.find((x) => x.space === 'f1' && x.bindingKind === 'device');
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog(d); await c.updateComplete;
+  c._markerDialog = { ...c._markerDialog, tapAction: 'run' }; await c.updateComplete;
+  // ВИДИМОСТЬ, не просто наличие в DOM: список — flex-item со скроллом и
+  // однажды схлопнулся в полоску 1px при 26 кандидатах внутри (репорт
+  // пользователя 2026-07-30, поймано только замером высоты)
+  const listEl = () => sr().querySelector('.dialog .candlist');
+  o.pickerShown = !!listEl() && listEl().getBoundingClientRect().height > 30;
+  c._markerDialog = { ...c._markerDialog, runFilter: 'штор' }; await c.updateComplete;
+  const cands = [...sr().querySelectorAll('.dialog .cand')].map((x) => x.textContent);
+  o.searchWorks = cands.length >= 1 && cands.some((t) => t.includes('Шторы'));
+  // и найденная строка реально нарисована, а не сплющена
+  const row = sr().querySelector('.dialog .cand');
+  o.resultRowVisible = !!row && row.getBoundingClientRect().height > 10
+    && row.getBoundingClientRect().bottom <= listEl().getBoundingClientRect().bottom + 1;
+  // сохранение без цели блокируется
+  await c._saveMarker(); await c.updateComplete;
+  o.saveBlockedWithoutTarget = !!c._markerDialog;
+  // выбираем цель + подтверждение, сохраняем
+  c._markerDialog = { ...c._markerDialog, tapTarget: 'script.curtains', tapConfirm: true };
+  await c.updateComplete;
+  o.confirmCheckboxShown = [...sr().querySelectorAll('.dialog .srcrow')].length >= 2;
+  await c._saveMarker(); await c.updateComplete;
+  const saved = (c._serverCfg.markers || []).find((m) => m.binding === 'device:' + d.bindingRef);
+  o.markerSaved = saved?.tap_action === 'run' && saved?.tap_target === 'script.curtains' && saved?.tap_confirm === true;
+
+  // --- тап: подтверждение → отмена → вызова нет ---------------------------
+  c._setMode('view'); c._regSignature = ''; c._maybeRebuildDevices();
+  c.requestUpdate(); await c.updateComplete;
+  const dev = c._devices.find((x) => x.id === (saved?.id ?? d.id)) || c._devices.find((x) => x.bindingRef === d.bindingRef);
+  c._clickDevice({ stopPropagation() {} }, dev); await c.updateComplete;
+  o.confirmDialogShown = !!c._tapConfirm && c._tapConfirm.text.includes('Шторы');
+  c._tapConfirm = null; await c.updateComplete;
+  o.cancelNoCall = calls.length === 0;
+
+  // --- тап: подтвердили → script.turn_on ----------------------------------
+  c._clickDevice({ stopPropagation() {} }, dev); await c.updateComplete;
+  const conf = c._tapConfirm; c._tapConfirm = null; conf.exec();
+  await new Promise((r) => setTimeout(r, 10));
+  o.runCalled = calls.length === 1 && calls[0][0] === 'script' && calls[0][1] === 'turn_on'
+    && calls[0][2].entity_id === 'script.curtains';
+
+  // --- без подтверждения: сразу вызов; автоматизация → trigger ------------
+  c._serverCfg.markers = c._serverCfg.markers.map((m) =>
+    m.id === (saved?.id ?? d.id) ? { ...m, tap_target: 'automation.evening', tap_confirm: null } : m);
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices(); await c.updateComplete;
+  const dev2 = c._devices.find((x) => x.bindingRef === d.bindingRef);
+  calls.length = 0;
+  c._clickDevice({ stopPropagation() {} }, dev2); await c.updateComplete;
+  await new Promise((r) => setTimeout(r, 10));
+  o.automationTriggered = calls.length === 1 && calls[0][0] === 'automation' && calls[0][1] === 'trigger';
+  o.noConfirmWhenOff = !c._tapConfirm;
+
+  // --- цель удалена → тост, вызова нет ------------------------------------
+  const states2 = { ...c.hass.states }; delete states2['automation.evening'];
+  c.hass = { ...c.hass, states: states2 };
+  calls.length = 0;
+  c._clickDevice({ stopPropagation() {} }, dev2); await c.updateComplete;
+  o.missingTargetSafe = calls.length === 0 && !!c._toast;
+
+  // очистка
+  c._serverCfg.markers = c._serverCfg.markers.filter((m) => m.id !== (saved?.id ?? d.id));
+  c._cfgEpoch++; c._regSignature = ''; c._maybeRebuildDevices();
+  return o;
+});
+await finish(browser, checkAll(out));
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 const res = await page.evaluate(async () => {
  const out = {};
@@ -26,5 +26,13 @@ const res = await page.evaluate(async () => {
  c._spaceDialog = null;
  return out;
 });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "comfy": ["#66d17a", "transparent", "transparent", "transparent"],
+  "cold": ["#4fc3f7", "transparent", "transparent", "transparent"],
+  "hot": ["#ffd45c", "transparent", "transparent", "transparent"],
+  "swapped": ["#66d17a", "transparent", "transparent", "transparent"],
+  "dialogTempFields": 3,
+  "dialogHiddenWhenNone": 1,
+});
+await finish(browser, res);
@@ -1,4 +1,4 @@
-import { launch } from './serve.mjs';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch();
 // эмуляция тач-устройства: переопределяем matchMedia ДО загрузки бандла
 await page.addInitScript(() => {
@@ -19,5 +19,5 @@ const res = await page.evaluate(async () => {
  out.noTipOnTouch = c._tip === null || c._tip === undefined || !c._tip;
  return out;
 });
-console.log(JSON.stringify(res));
-await browser.close();
+checkAll(res);
+await finish(browser, res);
@@ -1,4 +1,6 @@
-import { launch } from './serve.mjs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch({ width: 640, height: 980 }, 2);
 const res = await page.evaluate(async () => {
  const out = {};
@@ -33,6 +35,17 @@ const res = await page.evaluate(async () => {
  out.nanGuard = !Number.isFinite(n) && c._spaceDialog.tempMax === before;
  return out;
 });
-await page.screenshot({ path: '/tmp/ux_dialog.png' });
-console.log(JSON.stringify(res, null, 1));
-await browser.close();
+// артефакт для глазами: путь берём у ОС, а не хардкодим unix-овый — на Windows
+// '/tmp/...' указывает в несуществующий C:\tmp и смоук падал, не дойдя до
+// ассертов (портируемость, ревью 2026-07-27)
+await page.screenshot({ path: join(tmpdir(), 'houseplan_ux_dialog.png') }).catch(() => {});
+// значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
+checkAll(res, {
+  "filledClass": 1,
+  "unfilled": 3,
+  "tipTemp": 22.4,
+  "fillRadios": 5,
+  "tempInputs": 2,
+  "dialogWidth": 502,
+});
+await finish(browser, res);
@@ -0,0 +1,231 @@
+// Live vacuum P1 (docs/VACUUM.md): puck, trail, calibration, hidden rules.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+
+const out = await page.evaluate(async () => {
+  const c = window.__card;
+  const o = {};
+  const sr = () => c.shadowRoot || c.renderRoot;
+  // a vacuum device bound to space f1, dock placed by layout, plus a source
+  // camera whose coords live in "robot mm": target = 0.02*x+? — we calibrate
+  // via the 6-number matrix directly (0.5 scale: robot 0..2000 -> canvas 0..1000)
+  const M = [0.5, 0, 0, 0, 0.5, 0];
+  const mkAttrs = (x, y, extra) => ({ vacuum_position: { x, y, a: 45 }, map_name: 'm1', ...extra });
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'vacuum.robo': { state: 'docked', attributes: { friendly_name: 'Робот' } },
+    'camera.robo_map': { state: 'idle', attributes: mkAttrs(600, 800) },
+  } };
+  const cfg = c._serverCfg;
+  cfg.markers = cfg.markers || [];
+  cfg.markers.push({ id: 'e_vacuum_robo', binding: 'entity:vacuum.robo', space: 'f1',
+    vacuum: { source: 'camera.robo_map', calibration: { m1: M } } });
+  c._layout['e_vacuum_robo'] = { s: 'f1', x: 0.1, y: 0.1 };
+  c._regSignature = ''; c._setMode('view'); await c.updateComplete;
+
+  o.dockedNoPuck = !sr().querySelector('.vacpuck');
+  o.baseMarkerThere = !!sr().querySelector('.dev');
+
+  // start cleaning -> puck appears at transformed coords, base marker stays
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'vacuum.robo': { state: 'cleaning', attributes: { friendly_name: 'Робот' } } } };
+  await c.updateComplete; await new Promise((r) => setTimeout(r, 50));
+  let puck = sr().querySelector('.vacpuck');
+  o.puckAppears = !!puck;
+  o.puckRound = puck && getComputedStyle(puck).borderRadius === '50%';
+  // owner 2026-07-31: the base badge, but round and 20% smaller — same plate
+  // vs a NEUTRAL badge: the robot's own base is yellow while cleaning
+  const devEl = sr().querySelector('.dev:not(.on)');
+  const pcs = getComputedStyle(puck), dcs = getComputedStyle(devEl);
+  o.puckPlateMatchesDev = pcs.backgroundColor === dcs.backgroundColor
+    && pcs.borderTopColor === dcs.borderTopColor;
+  o.puck80pct = Math.abs(puck.getBoundingClientRect().width
+    - devEl.getBoundingClientRect().width * 0.8) < 2;
+  o.noWedge = !sr().querySelector('.vacwedge'); // owner 2026-07-31: no heading arrow
+  // the glyph is DEAD centre (owner report: it floated on the text baseline)
+  const pr = puck.getBoundingClientRect();
+  const ir = sr().querySelector('.vacpuck ha-icon').getBoundingClientRect();
+  o.iconCentred = Math.abs(ir.left + ir.width / 2 - (pr.left + pr.width / 2)) < 0.75
+    && Math.abs(ir.top + ir.height / 2 - (pr.top + pr.height / 2)) < 0.75;
+  o.baseStaysDuringCleaning = !!sr().querySelector('.dev');
+
+  // drive: two more points -> trail polyline grows; puck moves
+  const p1 = puck.getBoundingClientRect();
+  for (const [x, y] of [[900, 800], [900, 1100]]) {
+    c.hass = { ...c.hass, states: { ...c.hass.states,
+      'camera.robo_map': { state: 'idle', attributes: mkAttrs(x, y) } } };
+    await c.updateComplete; await new Promise((r) => setTimeout(r, 30));
+  }
+  const trail = sr().querySelector('.vactrail polyline');
+  // the trail LAGS one point behind the puck: after 3 telemetry points only
+  // the first two are drawn — a segment never outruns the icon (owner)
+  o.trailDrawn = !!trail && trail.getAttribute('points').split(' ').length === 2;
+  o.trailScaledByMatrix = !!trail && trail.getAttribute('points').startsWith('300.0,400.0');
+  o.trailBehindPuck = !!trail && !trail.getAttribute('points').includes('450.0,550.0');
+  // a zoom/view change TELEPORTS the puck instead of gliding across the plan
+  c._applyView(1.35); c.requestUpdate(); await c.updateComplete;
+  o.zoomTeleports = sr().querySelector('.vacpuck').classList.contains('jump');
+  c._applyView(1); c.requestUpdate(); await c.updateComplete;
+  // casing pair: dark halo + light core with identical geometry — the trail
+  // must survive any room fill underneath (owner 2026-07-31)
+  const tcase = sr().querySelector('.vactrail .case');
+  const tcore = sr().querySelector('.vactrail .core');
+  o.trailCasing = !!tcase && !!tcore
+    && tcase.getAttribute('points') === tcore.getAttribute('points')
+    && parseFloat(getComputedStyle(tcase).strokeWidth) > parseFloat(getComputedStyle(tcore).strokeWidth)
+    && getComputedStyle(tcase).stroke.includes('0, 0, 0')
+    && getComputedStyle(tcore).stroke.includes('255, 255, 255');
+
+
+  // trail off via marker option
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').vacuum.trail = false;
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  o.trailToggleOff = !sr().querySelector('.vactrail');
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').vacuum.trail = null;
+
+  // dock -> puck dissolves, trail lingers (linger window)
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'vacuum.robo': { state: 'docked', attributes: { friendly_name: 'Робот' } } } };
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete; await new Promise((r) => setTimeout(r, 30));
+  o.puckGoneWhenDocked = !sr().querySelector('.vacpuck');
+  // default mode 'cleaning': the trail HIDES the moment the run ends (owner)
+  o.trailHiddenAfterDock = !sr().querySelector('.vactrail polyline');
+
+  // hidden marker renders neither puck nor trail
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'vacuum.robo': { state: 'cleaning', attributes: { friendly_name: 'Робот' } } } };
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').hidden = true;
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  o.hiddenNoPuck = !sr().querySelector('.vacpuck') && !sr().querySelector('.vactrail');
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').hidden = false;
+
+  // no calibration for the active map -> no puck (graceful degradation)
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'camera.robo_map': { state: 'idle', attributes: mkAttrs(900, 1100, { map_name: 'm2' }) } } };
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  o.unknownMapNoPuck = !sr().querySelector('.vacpuck');
+
+  // ---- server-side runs: current + one previous (owner 2026-07-31) ----
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').vacuum.trail_mode = 'always';
+  c._vacSrvTrails = { e_vacuum_robo: {
+    current: { map_id: 'm1', started: 1, ended: null,
+      points: [[700, 500], [900, 500], [1100, 640], [950, 1150]] },
+    previous: { map_id: 'm1', started: 0, ended: 1,
+      points: [[600, 1300], [800, 1300], [800, 1500]] },
+  } };
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'vacuum.robo': { state: 'cleaning', attributes: { friendly_name: 'Робот' } },
+    'camera.robo_map': { state: 'idle', attributes: { vacuum_position: { x: 950, y: 1150, a: 0 }, map_name: 'm1' } } } };
+  await c.updateComplete;
+  c.hass = { ...c.hass, states: { ...c.hass.states } }; await c.updateComplete;
+  const prevG = sr().querySelector('.vactrail g.prev');
+  o.srvPrevRunShown = !!prevG && prevG.querySelectorAll('polyline').length === 2
+    && prevG.querySelector('.case').getAttribute('points').split(' ').length === 3;
+  const curLines = [...sr().querySelectorAll('.vactrail > polyline.case, .vactrail g:not(.prev) polyline.case')];
+  const cur = curLines.find((x) => !x.closest('g.prev'));
+  // 4 server points, the live tail trimmed while moving -> 3 rendered
+  o.srvCurTrimmed = !!cur && cur.getAttribute('points').split(' ').length === 3;
+  o.srvPrevFaded = !!prevG && getComputedStyle(prevG).opacity === '0.4';
+  // the growing tip is glued to the puck by the rAF sampler
+  const tip = sr().querySelector('line.tip');
+  o.tipExists = !!tip;
+  await new Promise((r) => setTimeout(r, 250));
+  const puckNow = sr().querySelector('.vacpuck').getBoundingClientRect();
+  const svgT = sr().querySelector('.vactrail');
+  const vbT = svgT.viewBox.baseVal; const sbT = svgT.getBoundingClientRect();
+  const tx = sbT.left + ((parseFloat(tip.getAttribute('x2')) - vbT.x) / vbT.width) * sbT.width;
+  const ty = sbT.top + ((parseFloat(tip.getAttribute('y2')) - vbT.y) / vbT.height) * sbT.height;
+  o.tipGluedToPuck = Math.hypot(tx - (puckNow.left + puckNow.width / 2), ty - (puckNow.top + puckNow.height / 2)) < 12;
+  // 'never' kills every line including the previous run
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').vacuum.trail_mode = 'never';
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  o.neverHidesAll = !sr().querySelector('.vactrail');
+  cfg.markers.find((m) => m.id === 'e_vacuum_robo').vacuum.trail_mode = null;
+  c._vacSrvTrails = {};
+
+  // ---- the fit panel (drag + corner-stretch) end to end ----
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  const dev = c._devices.find((x) => x.id === 'e_vacuum_robo');
+  o.fitDevFound = !!dev;
+  // map m2 with rooms (bboxes) and a parked robot
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'camera.robo_map': { state: 'idle', attributes: { vacuum_position: { x: 500, y: 500, a: 0 }, map_name: 'm2',
+      rooms: { 1: { name: 'Кухня', x0: 0, y0: 0, x1: 1000, y1: 800 },
+               2: { name: 'Зал', x0: 0, y0: 800, x1: 1000, y1: 2000 } } } } } };
+  await c.updateComplete;
+  c._vacStartFit(dev); await c.updateComplete;
+  o.fitOverlay = !!sr().querySelector('.vacfit');
+  o.fitGhostRooms = sr().querySelectorAll('.vacfit polygon').length === 2;
+  o.fitLabels = [...sr().querySelectorAll('.vacfit text')].map((t) => t.textContent.trim()).join('|') === 'Кухня|Зал';
+  o.fitHandles = sr().querySelectorAll('.vacfithandle').length === 4;
+  // REAL hit-tests: what would an actual click land on? Synthetic dispatch
+  // bypasses pointer-events, and that let the untouchable overlay pass once.
+  const hitAt = (el) => {
+    const r = el.getBoundingClientRect();
+    let n = document.elementFromPoint(r.left + r.width / 2, r.top + r.height / 2);
+    while (n && n.shadowRoot) {
+      const deeper = n.shadowRoot.elementFromPoint(r.left + r.width / 2, r.top + r.height / 2);
+      if (!deeper || deeper === n) break;
+      n = deeper;
+    }
+    return n;
+  };
+  o.fitHandleHittable = hitAt(sr().querySelector('.vacfithandle'))?.classList?.contains('vacfithandle') === true;
+  o.fitGhostHittable = !!hitAt(sr().querySelector('.vacfit polygon'))?.closest?.('.vacfit');
+  o.fitBar = !!sr().querySelector('.vaccalbar');
+  o.fitMirrorDefault = c._vacFit.p.mir === true;
+  // drag: the ghost centre must follow; rotate: the centre must NOT move
+  const before = { ...c._vacFit.p };
+  const svgEl = sr().querySelector('.vacfit');
+  const sb2 = svgEl.getBoundingClientRect();
+  const fire = (type, x, y, target) => (target || svgEl).dispatchEvent(new PointerEvent(type, {
+    bubbles: true, composed: true, pointerId: 7, clientX: x, clientY: y }));
+  fire('pointerdown', sb2.left + sb2.width * 0.5, sb2.top + sb2.height * 0.5);
+  fire('pointermove', sb2.left + sb2.width * 0.6, sb2.top + sb2.height * 0.55);
+  fire('pointerup', sb2.left + sb2.width * 0.6, sb2.top + sb2.height * 0.55);
+  await c.updateComplete;
+  o.fitDragMoves = c._vacFit.p.ox !== before.ox && c._vacFit.p.oy !== before.oy;
+  const centreBefore = (() => { const t = c._vacFit.p; const m = [t.s * (t.mir ? -1 : 1), 0, t.ox, 0, t.s, t.oy];
+    return [m[0] * 500 + m[2], m[4] * 1000 + m[5]]; })();
+  c._vacFitTurn({ rot: 90 }); await c.updateComplete;
+  o.fitRotateKeepsCentre = c._vacFit.p.rot === 90;
+  // corner-stretch scales
+  const s0 = c._vacFit.p.s;
+  const handle = sr().querySelector('.vacfithandle');
+  const hb = handle.getBoundingClientRect();
+  fire('pointerdown', hb.left + hb.width / 2, hb.top + hb.height / 2, handle);
+  fire('pointermove', hb.left + hb.width / 2 + 60, hb.top + hb.height / 2 + 60);
+  fire('pointerup', hb.left + hb.width / 2 + 60, hb.top + hb.height / 2 + 60);
+  await c.updateComplete;
+  o.fitCornerScales = Math.abs(c._vacFit.p.s - s0) > 1e-6;
+  // save -> matrix stored for m2, panel closed, puck appears while cleaning
+  c._vacFitSave(); await c.updateComplete;
+  const savedM = c._serverCfg.markers.find((m) => m.id === 'e_vacuum_robo').vacuum.calibration.m2;
+  o.fitSavedMatrix = Array.isArray(savedM) && savedM.length === 6 && savedM.every(Number.isFinite);
+  o.fitClosed = !c._vacFit && !sr().querySelector('.vacfit');
+  o.oldWizardGone = typeof c._vacCalClick === 'undefined' && typeof c._vacStartWizard === 'undefined';
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'camera.robo_map': { state: 'idle', attributes: { vacuum_position: { x: 501, y: 501, a: 0 }, map_name: 'm2',
+      rooms: {} } } } };
+  await c.updateComplete;
+  c.hass = { ...c.hass, states: { ...c.hass.states } }; await c.updateComplete;
+  o.puckAfterFit = !!sr().querySelector('.vacpuck');
+
+  return o;
+});
+
+checkAll(out, {
+  dockedNoPuck: true, baseMarkerThere: true, puckAppears: true, puckRound: true,
+  puckPlateMatchesDev: true, puck80pct: true,
+  noWedge: true, iconCentred: true, baseStaysDuringCleaning: true, trailDrawn: true,
+  trailScaledByMatrix: true, trailBehindPuck: true, zoomTeleports: true,
+  trailCasing: true, trailToggleOff: true,
+  puckGoneWhenDocked: true, trailHiddenAfterDock: true, hiddenNoPuck: true,
+  unknownMapNoPuck: true,
+  srvPrevRunShown: true, srvCurTrimmed: true, srvPrevFaded: true,
+  tipExists: true, tipGluedToPuck: true, neverHidesAll: true,
+  fitDevFound: true, fitOverlay: true, fitGhostRooms: true, fitLabels: true,
+  fitHandles: true, fitHandleHittable: true, fitGhostHittable: true, fitBar: true, fitMirrorDefault: true, fitDragMoves: true,
+  fitRotateKeepsCentre: true, fitCornerScales: true, fitSavedMatrix: true,
+  fitClosed: true, oldWizardGone: true, puckAfterFit: true,
+});
+await finish(browser);
@@ -0,0 +1,108 @@
+// v1.54.0 audit regressions (HP-1540-01/-04/-06): the FIRST-USE path.
+// An auto-discovered vacuum has NO marker in the config — cfg.markers stays
+// empty here, unlike smoke_vacuum.mjs which always pushes one by hand (the
+// audit called that gap out explicitly). Every vacuum action must materialise
+// the marker and actually persist; plan rooms are legacy RECTANGLES.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+
+const out = await page.evaluate(async () => {
+  const c = window.__card;
+  const o = {};
+  const sr = () => c.shadowRoot || c.renderRoot;
+  const cfg = c._serverCfg;
+
+  // legacy rectangle rooms (x/y/w/h, HP-1540-04) in the garden space where
+  // the auto-discovered vacuum.mower already lives
+  const g = cfg.spaces.find((s) => s.id === 'garden');
+  g.rooms = [
+    { id: 'ga', name: 'Кухня', area: 'garden', x: 0.05, y: 0.10, w: 0.25, h: 0.30 },
+    { id: 'gb', name: 'Зал', x: 0.40, y: 0.10, w: 0.25, h: 0.30 },
+    { id: 'gc', name: 'Спальня', x: 0.05, y: 0.50, w: 0.25, h: 0.30 },
+  ];
+  // robot rooms: same centres in "robot mm" (scale 4), map_index is a
+  // NUMERIC ZERO — the cross-runtime zero-map contract (HP-1540-02)
+  const robotRooms = {
+    1: { name: 'Кухня', x0: 300, y0: 600, x1: 1100, y1: 1400 },
+    2: { name: 'Зал', x0: 1700, y0: 600, x1: 2500, y1: 1400 },
+    3: { name: 'Спальня', x0: 300, y0: 2200, x1: 1100, y1: 3000 },
+  };
+  const camAttrs = { vacuum_position: { x: 700, y: 1000, a: 0 }, map_index: 0, rooms: robotRooms };
+  c.hass = { ...c.hass,
+    entities: { ...c.hass.entities,
+      'camera.mower_map': { entity_id: 'camera.mower_map', device_id: 'd_mower', platform: 'demo' } },
+    states: { ...c.hass.states,
+      'camera.mower_map': { state: 'idle', attributes: camAttrs } } };
+  c._regSignature = '';
+  c.requestUpdate(); await c.updateComplete;
+
+  // spy on config writes: a success toast is only honest after one of these
+  const writes = [];
+  const realWS = c.hass.callWS;
+  c.hass.callWS = async (m) => { if (m.type === 'houseplan/config/set') writes.push(m); return realWS(m); };
+
+  const dev = c._devices.find((x) => x.id === 'd_mower');
+  o.devFound = !!dev;
+  o.freshNoMarker = (cfg.markers || []).length === 0 && !dev.marker;
+
+  // ---- auto-calibration from scratch (HP-1540-01 + HP-1540-04) ----
+  c._vacAutoCalibrate(dev);
+  await c.updateComplete;
+  const m1 = (cfg.markers || []).find((x) => x.id === 'd_mower');
+  o.markerMaterialised = !!m1 && m1.binding === 'device:d_mower';
+  const cal0 = m1?.vacuum?.calibration?.['0'];
+  o.rectRoomsCalibrated = Array.isArray(cal0) && cal0.length === 6 && cal0.every(Number.isFinite);
+  o.sourceStored = m1?.vacuum?.source === 'camera.mower_map';
+  // the matrix really maps robot mm → canvas: centre of «Кухня» → (175, 250)
+  const ap = (mm, x, y) => [mm[0] * x + mm[1] * y + mm[2], mm[3] * x + mm[4] * y + mm[5]];
+  const hit = cal0 ? ap(cal0, 700, 1000) : [0, 0];
+  o.matrixMapsRooms = Math.hypot(hit[0] - 175, hit[1] - 250) < 2;
+  o.successToastShown = (c._toast || '').startsWith('Done: bound via 3 rooms');
+  await new Promise((r) => setTimeout(r, 700)); // debounced _saveConfig
+  o.configWritePersisted = writes.length >= 1
+    && !!writes[writes.length - 1].config.markers.find((x) => x.id === 'd_mower')?.vacuum?.calibration?.['0'];
+
+  // ---- manual fit from scratch (HP-1540-01) ----
+  cfg.markers = [];
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  const dev2 = c._devices.find((x) => x.id === 'd_mower');
+  o.fitFreshNoMarker = !dev2.marker;
+  c._vacStartFit(dev2); await c.updateComplete;
+  c._vacFitSave(); await c.updateComplete;
+  const m2 = (cfg.markers || []).find((x) => x.id === 'd_mower');
+  const calFit = m2?.vacuum?.calibration?.['0'];
+  o.fitMaterialises = !!m2 && Array.isArray(calFit) && calFit.length === 6;
+  o.fitToastAfterSave = c._toast === c._t('vac.cal_done');
+
+  // ---- live checkbox + trail select from scratch (HP-1540-01) ----
+  cfg.markers = [];
+  c._regSignature = ''; c.requestUpdate(); await c.updateComplete;
+  c._setMode('devices'); await c.updateComplete;
+  c._openMarkerDialog(c._devices.find((x) => x.id === 'd_mower')); await c.updateComplete;
+  const liveBox = sr().querySelector('.vacbox input[type=checkbox]');
+  o.vacSectionShown = !!liveBox;
+  if (liveBox) { liveBox.click(); await c.updateComplete; }
+  const m3 = (cfg.markers || []).find((x) => x.id === 'd_mower');
+  o.liveToggleMaterialises = !!m3 && m3.vacuum?.live === false;
+  const sel = sr().querySelector('.vacbox select');
+  if (sel) { sel.value = 'always'; sel.dispatchEvent(new Event('change')); await c.updateComplete; }
+  o.trailModePersists = m3?.vacuum?.trail_mode === 'always';
+  c._markerDialog = null; c._setMode('view'); await c.updateComplete;
+
+  // ---- error copy never points at the removed point calibration (HP-1540-06) ----
+  const toasts = ['vac.autocal_no_rooms', 'vac.autocal_no_match', 'vac.autocal_res_warn']
+    .map((k) => c._t(k)).join(' | ');
+  o.noPointCalibrationCopy = !/point|точк/i.test(toasts);
+  // and the real no-rooms path shows the reworded toast
+  c.hass = { ...c.hass, states: { ...c.hass.states,
+    'camera.mower_map': { state: 'idle', attributes: { vacuum_position: { x: 1, y: 2, a: 0 }, map_index: 0 } } } };
+  await c.updateComplete;
+  c._vacAutoCalibrate(c._devices.find((x) => x.id === 'd_mower'));
+  o.noRoomsToastReworded = c._toast === c._t('vac.autocal_no_rooms') && !/point|точк/i.test(c._toast);
+
+  c.hass.callWS = realWS;
+  return o;
+});
+
+checkAll(out);
+await finish(browser, out);
@@ -0,0 +1,60 @@
+// Единый принцип жёлтого (2026-07-29): жёлтый = устройство прямо сейчас
+// выполняет основную функцию. Термоголовка желтеет от реального нагрева
+// (hvac_action), а не от служебного свитча защиты от накипи; горящая лампа
+// желтит значок в любом режиме заливки тем же условием, что зажигает пятно.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = await page.evaluate(() => {
+  const o = {};
+  const c = window.__card;
+  const cls = (d, states) => {
+    const saved = c.hass;
+    c.hass = { ...c.hass, states: { ...c.hass.states, ...states } };
+    const r = c._stateClass(d);
+    c.hass = saved;
+    return r;
+  };
+  const trv = { id: 't', primary: 'climate.trv', entities: ['climate.trv', 'switch.trv_anti_scaling'], marker: null };
+
+  // реально греет → жёлтая
+  o.heatingIsYellow = cls(trv, {
+    'climate.trv': { state: 'heat', attributes: { hvac_action: 'heating' } },
+    'switch.trv_anti_scaling': { state: 'on' },
+  }) === 'on';
+
+  // включена, но не греет (idle) → чёрная, даже со включённой защитой от накипи
+  o.idleIsDark = cls(trv, {
+    'climate.trv': { state: 'heat', attributes: { hvac_action: 'idle' } },
+    'switch.trv_anti_scaling': { state: 'on' },
+  }) === '';
+
+  // выключена → чёрная
+  o.offIsDark = cls(trv, {
+    'climate.trv': { state: 'off', attributes: { hvac_action: 'off' } },
+  }) === '';
+
+  // без hvac_action фолбэк на state
+  o.stateFallback = cls(trv, { 'climate.trv': { state: 'heat', attributes: {} } }) === ''
+    ? false : cls(trv, { 'climate.trv': { state: 'heat', attributes: {} } }) === 'on';
+
+  // горящая лампа устройства желтит значок, даже если primary — не она
+  const lamp = { id: 'l', primary: 'sensor.lamp_power', entities: ['sensor.lamp_power', 'light.lamp'], marker: null };
+  o.litLightWins = cls(lamp, {
+    'sensor.lamp_power': { state: '5' },
+    'light.lamp': { state: 'on' },
+  }) === 'on';
+  o.darkLampIdle = cls(lamp, {
+    'sensor.lamp_power': { state: '5' },
+    'light.lamp': { state: 'off' },
+  }) === '';
+
+  // «источник света»: умный выключатель с глупыми светильниками — жёлтый от
+  // того же условия, что и пятно glow
+  const wall = { id: 'w', primary: 'sensor.w', entities: ['sensor.w'],
+    marker: { is_light: true, controls: ['switch.fixtures'] } };
+  o.forcedSourceYellow = cls(wall, {
+    'sensor.w': { state: '1' }, 'switch.fixtures': { state: 'on' },
+  }) === 'on';
+  return o;
+});
+await finish(browser, checkAll(out));
@@ -0,0 +1,81 @@
+// v1.49.x: zoom goes below the base fit, the editor does not shift the plan.
+// - the stage height follows the MEASURED header, not a hard-coded 118px, so
+//   entering an editor keeps the plan inside the viewport;
+// - zoom < 1 centres the content instead of pinning it to a corner;
+// - the content frame (default zoom) includes devices standing outside rooms.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const out = {};
+
+// -- editor entry keeps the stage inside the viewport --------------------
+const stageBox = () => page.evaluate(() => {
+  const sr = window.__card.shadowRoot || window.__card.renderRoot;
+  const b = sr.querySelector('.stage').getBoundingClientRect();
+  return { top: Math.round(b.top), bottom: Math.round(b.bottom) };
+});
+const vh = await page.evaluate(() => window.innerHeight);
+const inView = await stageBox();
+await page.evaluate(() => window.__card._setMode('plan'));
+await page.waitForTimeout(400);
+const inPlan = await stageBox();
+out.viewFitsViewport = inView.bottom <= vh + 2;
+out.editorFitsViewport = inPlan.bottom <= vh + 2; // used to overflow by ~90px
+out.editorStageShrinks = inPlan.top > inView.top && inPlan.bottom <= inView.bottom + 2;
+await page.evaluate(() => window.__card._setMode('view'));
+await page.waitForTimeout(300);
+
+// -- zoom out below the base fit -----------------------------------------
+out.zoomOut = await page.evaluate(() => {
+  const c = window.__card;
+  c._resetZoom();
+  const fit = { ...c._viewOr(c._baseVb()) };
+  const stage = (c.shadowRoot || c.renderRoot).querySelector('.stage');
+  c._zoomAt(stage.clientWidth / 2, stage.clientHeight / 2, 0.5);
+  const v = { ...c._view };
+  const base = c._baseVb();
+  const cx = v.x + v.w / 2, cy = v.y + v.h / 2;
+  return {
+    zoom: c._zoom,
+    wider: v.w > fit.w * 1.9,                                   // actually zoomed out
+    centredX: Math.abs(cx - (base[0] + base[2] / 2)) < 1,       // not pinned to a corner
+    centredY: Math.abs(cy - (base[1] + base[3] / 2)) < 1,
+  };
+});
+out.zoomOutWorks = out.zoomOut.zoom === 0.5 && out.zoomOut.wider
+  && out.zoomOut.centredX && out.zoomOut.centredY;
+delete out.zoomOut;
+out.floorIsHalf = await page.evaluate(() => { window.__card._resetZoom(); const c = window.__card;
+  c._applyView(0.1); return c._zoom; }) === 0.4; // clamped at the floor
+await page.evaluate(() => window.__card._resetZoom());
+
+// -- devices outside rooms stretch the default frame ---------------------
+out.devicesStretchFrame = await page.evaluate(() => {
+  const c = window.__card;
+  const cfg = JSON.parse(JSON.stringify(c._serverCfg));
+  cfg.spaces[0].plan_url = null; cfg.spaces[0].plan_aspect = null;
+  c._serverCfg = cfg; c._model = null;
+  const before = c._baseVb();
+  // walk one lamp far outside every room
+  c._layout = { ...c._layout, d_lamp: { s: 'f1', x: 0.99, y: 0.5 } };
+  const after = c._baseVb();
+  return after[0] + after[2] > before[0] + before[2] + 20; // right edge follows the lamp
+});
+
+// -- a card BELOW other dashboard content still gets a stage (HP-1500-02) --
+out.stageSurvivesContentAbove = await page.evaluate(async () => {
+  const spacer = document.createElement('div');
+  spacer.style.height = '900px';
+  document.body.insertBefore(spacer, document.body.firstChild);
+  window.dispatchEvent(new Event('resize'));
+  await new Promise((r) => setTimeout(r, 120));
+  const c = window.__card;
+  const sr = c.shadowRoot || c.renderRoot;
+  const h = sr.querySelector('.stage').getBoundingClientRect().height;
+  spacer.remove();
+  window.dispatchEvent(new Event('resize'));
+  await new Promise((r) => setTimeout(r, 120));
+  // the old code billed the 900px spacer as "header" and left a 0px stage
+  return h > 300;
+});
+
+await finish(browser, checkAll(out));
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="800" height="200" viewBox="0 0 800 200"><rect width="800" height="200" fill="#eee"/></svg>
@@ -51,17 +51,17 @@ customElements.define('ha-card',HaCard);
 <script type="module">
 const CFG = {
  spaces: [
-    { id:'f1', title:'Ground floor', plan_url:'/assets/f1.svg', aspect:1.25,
+    { id:'f1', title:'Ground floor', plan_url:'/assets/f1.svg', plan_aspect:1.25,
      view_box:[0,0,1,1],
      rooms:[
-        {id:'r1', name:'Living room', area:'living_room', poly:[[0.04,0.05],[0.55,0.05],[0.55,0.6],[0.04,0.6]]},
-        {id:'r2', name:'Kitchen', area:'kitchen', poly:[[0.55,0.05],[0.96,0.05],[0.96,0.45],[0.55,0.45]]},
-        {id:'r3', name:'Bedroom', area:'bedroom', poly:[[0.55,0.45],[0.96,0.45],[0.96,0.95],[0.55,0.95]]},
-        {id:'r4', name:'Hallway', area:'hallway', poly:[[0.04,0.6],[0.55,0.6],[0.55,0.95],[0.04,0.95]]}
+        {id:'r1', name:'Living room', area:'living_room', poly:[[0.04,0.14],[0.55,0.14],[0.55,0.58],[0.04,0.58]]},
+        {id:'r2', name:'Kitchen', area:'kitchen', poly:[[0.55,0.14],[0.96,0.14],[0.96,0.46],[0.55,0.46]]},
+        {id:'r3', name:'Bedroom', area:'bedroom', poly:[[0.55,0.46],[0.96,0.46],[0.96,0.86],[0.55,0.86]]},
+        {id:'r4', name:'Hallway', area:'hallway', poly:[[0.04,0.58],[0.55,0.58],[0.55,0.86],[0.04,0.86]]}
      ], segments:[] },
-    { id:'garden', title:'Garden', plan_url:'/assets/garden.svg', aspect:1.4286,
+    { id:'garden', title:'Garden', plan_url:'/assets/garden.svg', plan_aspect:1.4286,
      view_box:[0,0,1,1],
-      rooms:[ {id:'g1', name:'Garden', area:'garden', poly:[[0.03,0.04],[0.97,0.04],[0.97,0.96],[0.03,0.96]]} ], segments:[] }
+      rooms:[ {id:'g1', name:'Garden', area:'garden', poly:[[0.03,0.178],[0.97,0.178],[0.97,0.822],[0.03,0.822]]} ], segments:[] }
  ],
  markers: [],
  settings: {}
@@ -0,0 +1,13 @@
+# Demo-stand extras
+
+Things that live on the public stand (demo.houseplan.tech) but are not part
+of the shipped integration.
+
+- `demo_robot/` — the scripted robot vacuum (docs/VACUUM.md, "demo stand gets
+  a scripted synthetic robot"). Deployed by copying the folder to
+  `custom_components/demo_robot` in both stand seeds and adding `demo_robot:`
+  to configuration.yaml; the dev stand picks it up automatically from this
+  path (`/opt/hp/bin/hp-update-dev.sh`). The rest of the stand-only config
+  (template LQI sensors, alarm helpers, the smoke automation) lives in the
+  seeds on the stand host — see `docs/TESTING-DEMO.md` and the memory note
+  `houseplan-demo-stand`.
@@ -0,0 +1,181 @@
+"""Scripted robot vacuum for the public demo stand.
+
+The real feature (docs/VACUUM.md) targets Tier-A map integrations — Xiaomi
+Cloud Map Extractor, Tasshack dreame-vacuum, Valetudo. None of them can run
+on the stand (no hardware), so the stand ships this simulator instead: a
+`vacuum` entity with start/pause/return_to_base and a `sensor` whose
+attributes follow the Tasshack shape (`vacuum_position` as a dict, `rooms`
+with names matching the plan rooms, `map_index`). Room names match the demo
+house on purpose — that is what makes «Настроить автоматически» demonstrable.
+
+Coordinates are millimetres in 0..8000 with the Y axis flipped versus the
+screen (like every real robot map seen so far) so the mirror toggle in the
+fit panel has meaning on the stand too.
+"""
+from __future__ import annotations
+
+import math
+from datetime import timedelta
+from typing import Any, Callable
+
+from homeassistant.core import HomeAssistant, callback
+from homeassistant.helpers import discovery
+from homeassistant.helpers.event import async_track_time_interval
+from homeassistant.helpers.typing import ConfigType
+
+DOMAIN = "demo_robot"
+TICK_S = 2          # telemetry cadence
+SPEED_MM = 600      # per tick ≈ 0.3 m/s, a realistic robot pace
+DOCK = (3900.0, 2600.0)
+
+# Robot-map rooms, mm, Y up (flipped vs screen). Bboxes mirror the plan's
+# room polygons; the names MUST equal the plan room names — auto-calibration
+# matches by name.
+ROOMS: dict[str, tuple[str, float, float, float, float]] = {
+    "1": ("Гостиная", 480, 4320, 4160, 7360),
+    "2": ("Кухня", 4160, 5120, 7520, 7360),
+    "3": ("Спальня", 4160, 2400, 7520, 5120),
+    "4": ("Кабинет", 480, 2400, 2720, 4320),
+    "5": ("Прихожая", 2720, 2400, 4160, 4320),
+}
+# cleaning order: start at the dock in the hallway, end next to it
+CLEAN_ORDER = ("5", "4", "1", "2", "3")
+INSET = 350.0       # keep lanes away from walls
+LANE_MM = 650.0     # serpentine lane spacing
+
+
+def _serpentine(x0: float, y0: float, x1: float, y1: float) -> list[tuple[float, float]]:
+    """Boustrophedon lanes across a room bbox, like a real vacuum drives."""
+    x0, y0, x1, y1 = x0 + INSET, y0 + INSET, x1 - INSET, y1 - INSET
+    pts: list[tuple[float, float]] = []
+    y = y0
+    left_to_right = True
+    while y <= y1 + 1:
+        xs = (x0, x1) if left_to_right else (x1, x0)
+        pts.append((xs[0], y))
+        pts.append((xs[1], y))
+        left_to_right = not left_to_right
+        y += LANE_MM
+    return pts
+
+
+def build_route() -> list[tuple[float, float]]:
+    route: list[tuple[float, float]] = [DOCK]
+    for rid in CLEAN_ORDER:
+        _, x0, y0, x1, y1 = ROOMS[rid]
+        route.extend(_serpentine(x0, y0, x1, y1))
+    route.append(DOCK)
+    return route
+
+
+class RobotSim:
+    """One shared simulation both entities read from."""
+
+    def __init__(self, hass: HomeAssistant) -> None:
+        self.hass = hass
+        self.route = build_route()
+        self.state = "docked"        # docked|cleaning|paused|returning
+        self.pos: tuple[float, float] = DOCK
+        self.heading = 0.0
+        self._seg = 0                # index of the segment being driven
+        self._seg_done = 0.0         # mm driven inside the current segment
+        self._back: list[tuple[float, float]] | None = None  # manual return path
+        self._listeners: list[Callable[[], None]] = []
+
+    # ---- entity plumbing ----
+    def add_listener(self, cb: Callable[[], None]) -> Callable[[], None]:
+        self._listeners.append(cb)
+
+        def _remove() -> None:
+            if cb in self._listeners:
+                self._listeners.remove(cb)
+        return _remove
+
+    def _notify(self) -> None:
+        for cb in list(self._listeners):
+            cb()
+
+    # ---- commands (called by the vacuum entity) ----
+    def start(self) -> None:
+        if self.state == "paused":
+            self.state = "returning" if self._back else "cleaning"
+        else:
+            self.state = "cleaning"
+            self._seg = 0
+            self._seg_done = 0.0
+            self._back = None
+            self.pos = DOCK
+        self._notify()
+
+    def pause(self) -> None:
+        if self.state in ("cleaning", "returning"):
+            self.state = "paused"
+            self._notify()
+
+    def stop(self) -> None:
+        self.pause()
+
+    def return_to_base(self) -> None:
+        if self.state == "docked":
+            return
+        # retrace the visited waypoints backwards — a straight line to the
+        # dock would cut through walls
+        visited = self.route[: self._seg + 1]
+        self._back = [self.pos] + list(reversed(visited))
+        self._seg = 0
+        self._seg_done = 0.0
+        self.state = "returning"
+        self._notify()
+
+    # ---- physics ----
+    def _polyline(self) -> list[tuple[float, float]]:
+        return self._back if self._back is not None else self.route
+
+    def tick(self, _now: Any = None) -> None:
+        if self.state not in ("cleaning", "returning"):
+            return
+        line = self._polyline()
+        # manual return drives twice as fast, like the real thing hurrying home
+        budget = SPEED_MM * (2 if self._back is not None else 1)
+        while budget > 0 and self._seg < len(line) - 1:
+            ax, ay = line[self._seg]
+            bx, by = line[self._seg + 1]
+            seg_len = math.hypot(bx - ax, by - ay)
+            left = seg_len - self._seg_done
+            if left <= budget:
+                budget -= left
+                self._seg += 1
+                self._seg_done = 0.0
+                continue
+            self._seg_done += budget
+            t = self._seg_done / seg_len
+            self.pos = (ax + (bx - ax) * t, ay + (by - ay) * t)
+            self.heading = math.degrees(math.atan2(by - ay, bx - ax)) % 360
+            budget = 0
+        if self._seg >= len(line) - 1:
+            # arrived: either the route is finished or the manual return is
+            self.pos = line[-1]
+            self.state = "docked"
+            self._back = None
+        elif self._back is None and self._seg >= len(line) - 2:
+            # the last route leg is the drive home
+            self.state = "returning"
+        self._notify()
+
+
+async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:
+    sim = RobotSim(hass)
+    hass.data[DOMAIN] = sim
+
+    @callback
+    def _tick(now: Any) -> None:
+        sim.tick(now)
+
+    async_track_time_interval(hass, _tick, timedelta(seconds=TICK_S))
+    hass.async_create_task(
+        discovery.async_load_platform(hass, "vacuum", DOMAIN, {}, config)
+    )
+    hass.async_create_task(
+        discovery.async_load_platform(hass, "sensor", DOMAIN, {}, config)
+    )
+    return True
@@ -0,0 +1,10 @@
+{
+  "domain": "demo_robot",
+  "name": "Demo Robot Vacuum",
+  "codeowners": [],
+  "dependencies": [],
+  "documentation": "https://github.com/Matysh/houseplan-card/tree/dev/demo/stand/demo_robot",
+  "iot_class": "calculated",
+  "requirements": [],
+  "version": "1.0.0"
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" width="800" height="200" viewBox="0 0 800 200"><rect width="800" height="200" fill="#eee"/></svg>`