Release v1.46.3

Re-check of v1.46.2: the startup sweep uses the runtime data it already has
instead of a lookup that cannot succeed during setup, and the test that was
supposed to prove it no longer passes for the wrong reason.

custom_components/houseplan/__init__.py

@@ -2,11 +2,13 @@
 from __future__ import annotations
 
 import logging
+from datetime import timedelta
 from pathlib import Path
 
 from homeassistant.components.frontend import add_extra_js_url
 from homeassistant.core import HomeAssistant
 from homeassistant.exceptions import ConfigEntryNotReady
+from homeassistant.helpers.event import async_track_time_interval
 
 from . import websocket_api as hp_ws
 from .const import (
@@ -18,6 +20,7 @@ from .const import (
     PLANS_URL,
     VERSION,
 )
+from .plans import collect_attachments, collect_plans, sweep_upload_temps
 from .repairs import async_check_plan_files
 from .store import HouseplanConfigEntry, create_data
 
@@ -97,6 +100,53 @@ async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) ->
         )
 
     await async_check_plan_files(hass, entry)
+
+    # Scheduled collection of everything nobody ended up referencing.
+    #
+    # A commit collects what that commit superseded, which is the right rule for
+    # a commit — but it only ever runs when somebody saves. Cancel a dialog
+    # after the file has already uploaded, lose the connection after the upload
+    # succeeded, or call the API directly, and the file is unreferenced with no
+    # future write to notice it (HP-1461-01). The earlier version of this sweep
+    # only removed streaming temporaries, which are a different, narrower case.
+    #
+    # Passing the CURRENT configuration as both sides means "nothing was
+    # superseded": every referenced file is preserved and only unreferenced ones
+    # past PLAN_ORPHAN_TTL_S go. It runs under the same lock as a config write,
+    # so it cannot decide from a snapshot that a commit is about to replace.
+    async def _sweep(_now=None) -> None:
+        files_dir = Path(hass.config.path(FILES_DIR))
+        plans_dir = Path(hass.config.path(PLANS_DIR))
+        try:
+            # `data` from the closure, NOT get_data(hass): during
+            # async_setup_entry the entry is still SETUP_IN_PROGRESS, so
+            # async_loaded_entries() does not list it and the lookup returned
+            # None. The startup pass then silently degraded to removing
+            # streaming temporaries only, and the real collection waited a full
+            # day — restarting more often than that meant it never ran at all
+            # (HP-1462-01). The callback is unregistered with the entry, so
+            # closing over its runtime data matches the lifecycle exactly.
+            async with data.write_lock:
+                stored = await data.config_store.async_load() or {}
+                cfg = stored.get("config") or {}
+
+                def _collect() -> int:
+                    n = sweep_upload_temps(files_dir)
+                    n += collect_attachments(files_dir, cfg, cfg)
+                    n += collect_plans(plans_dir, cfg, cfg)
+                    return n
+
+                n = await hass.async_add_executor_job(_collect)
+            if n:
+                _LOGGER.info("House Plan: removed %s unreferenced file(s)", n)
+        except Exception:  # noqa: BLE001 — housekeeping must never fail a setup
+            _LOGGER.exception("House Plan: sweeping unreferenced files failed")
+
+    data.sweep = _sweep
+    await _sweep()
+    entry.async_on_unload(
+        async_track_time_interval(hass, _sweep, timedelta(hours=24))
+    )
     return True
 
 

custom_components/houseplan/const.py

@@ -11,9 +11,20 @@ PLANS_DIR = "houseplan/plans"  # relative to the HA configuration directory
 FILES_URL = "/houseplan_files/files"
 # authenticated read path (audit B1): /api/houseplan/content/<plans|files>/<sub>/<name>
 CONTENT_URL = "/api/houseplan/content"
+
+# How many paths one houseplan/content/sign call may carry. The card batches to
+# the same number; a client that sends more used to get a partial answer with no
+# way to tell which paths were dropped (review R2-2).
+MAX_SIGN_PATHS = 200
+
+# An uploaded plan that no accepted configuration references is collected only
+# once it is this old. Age is a race guard, not a policy: a plan uploaded
+# seconds ago may belong to another client's transaction that has not written
+# its configuration yet (review R3-1).
+PLAN_ORPHAN_TTL_S = 3600
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.44.8"
+VERSION = "1.46.3"
 
 DEFAULT_CONFIG: dict = {
     "spaces": [],

custom_components/houseplan/http_api.py

@@ -6,6 +6,8 @@ breaks the connection on a large PDF) but via a plain multipart POST — like me
 from __future__ import annotations
 
 import logging
+import os
+import tempfile
 from pathlib import Path
 
 from aiohttp import web
@@ -20,6 +22,7 @@ from homeassistant.core import HomeAssistant
 
 from .const import CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, PLANS_DIR
 from .auth import may_write
+from .plans import TMP_PREFIX, reserve_filename
 from .validation import (
     FILE_EXTENSIONS,
     MAX_FILE_BYTES,
@@ -31,6 +34,8 @@ from .validation import (
 _LOGGER = logging.getLogger(__name__)
 
 _CHUNK = 64 * 1024
+# batch disk writes: one executor job per megabyte instead of per chunk
+_FLUSH_AT = 1024 * 1024
 
 _MIME = {
     ".pdf": "application/pdf",
@@ -73,17 +78,35 @@ class HouseplanContentView(HomeAssistantView):
         if not str(path).startswith(str(base)):
             return web.Response(status=404)
 
-        def _read() -> bytes | None:
-            return path.read_bytes() if path.is_file() else None
-
-        blob = await hass.async_add_executor_job(_read)
-        if blob is None:
+        if not await hass.async_add_executor_job(path.is_file):
             return web.Response(status=404)
-        return web.Response(
-            body=blob,
-            content_type=_MIME.get(path.suffix.lower(), "application/octet-stream"),
-            headers={"Cache-Control": "private, max-age=3600"},
-        )
+        suffix = path.suffix.lower()
+        headers = {
+            "Cache-Control": "private, max-age=3600",
+            "Content-Type": _MIME.get(suffix, "application/octet-stream"),
+        }
+        if suffix == ".svg":
+            # An uploaded SVG is user content served from Home Assistant's own
+            # origin. Inside the card it is referenced by <image>, where scripts
+            # never run — but the same url opened as a top-level document is a
+            # live document of this origin, and a <script> in it reaches the
+            # session's localStorage and API (HP-1454-01, 2026-07-28: uploading
+            # needs write access, which by default every authenticated user has,
+            # and the signed url is easy to hand to an admin).
+            #
+            # `sandbox` with no allow-* tokens drops the document into an opaque
+            # origin: no scripts, no same-origin access, no forms. The explicit
+            # directives below are belt and braces for older engines. Only SVG
+            # gets this — a CSP on a PDF response can break the browser's built-in
+            # viewer, and a raster image cannot execute anything in the first place.
+            headers["Content-Security-Policy"] = (
+                "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+                "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:"
+            )
+        # FileResponse streams from disk: a 50 MB manual used to be read whole
+        # into memory and copied into the response body, so a couple of parallel
+        # downloads could push a small Home Assistant host into swap (HP-1454-06).
+        return web.FileResponse(path, chunk_size=_CHUNK, headers=headers)
 
 
 class HouseplanUploadView(HomeAssistantView):
@@ -98,55 +121,122 @@ class HouseplanUploadView(HomeAssistantView):
         if not may_write(hass, request.get("hass_user")):
             return web.json_response({"error": "unauthorized"}, status=403)
 
+        files_root = Path(hass.config.path(FILES_DIR))
         marker_id = "misc"
         filename: str | None = None
-        blob: bytes | None = None
-        too_large = False
+        # Every temporary file this request creates, promoted or not. The outer
+        # `finally` removes whatever is left: a dropped connection, a second
+        # `file` part or a failure while promoting used to leave a `.upload-*`
+        # behind for good, and the collector only ever walks marker folders, so
+        # nothing would have picked it up (HP-1460-02).
+        temps: list[Path] = []
+        error: tuple[dict, int] | None = None
+
+        def _new_tmp() -> Path:
+            files_root.mkdir(parents=True, exist_ok=True)
+            fd, name = tempfile.mkstemp(prefix=TMP_PREFIX, dir=str(files_root))
+            os.close(fd)
+            return Path(name)
+
+        def _flush(target: Path, blocks: list[bytes]) -> None:
+            with open(target, "ab") as fh:
+                for block in blocks:
+                    fh.write(block)
+
+        def _cleanup(paths: list[Path]) -> None:
+            for path in paths:
+                try:
+                    path.unlink()
+                except OSError:
+                    pass
+
         try:
-            reader = await request.multipart()
-            async for part in reader:
-                if part.name == "marker_id":
-                    marker_id = sanitize_marker_id(await part.text())
-                elif part.name == "file":
-                    filename = part.filename or "file"
-                    # read in chunks, aborting at the limit, instead of loading the whole file into memory
-                    chunks: list[bytes] = []
-                    size = 0
-                    while chunk := await part.read_chunk(_CHUNK):
-                        size += len(chunk)
-                        if size > MAX_FILE_BYTES:
-                            too_large = True
+            try:
+                reader = await request.multipart()
+                async for part in reader:
+                    if part.name == "marker_id":
+                        marker_id = sanitize_marker_id(await part.text())
+                    elif part.name == "file":
+                        if filename is not None:
+                            # one upload per request: a second part would strand
+                            # the first temporary file and make the response
+                            # ambiguous about which url was returned
+                            error = ({"error": "one_file_only"}, 400)
                             break
-                        chunks.append(chunk)
-                    if too_large:
-                        break
-                    blob = b"".join(chunks)
-        except Exception as err:  # noqa: BLE001
-            _LOGGER.warning("House Plan upload: multipart read error: %s", err)
-            return web.json_response({"error": "bad_request"}, status=400)
+                        filename = part.filename or "file"
+                        if file_ext(filename) not in FILE_EXTENSIONS:
+                            error = ({"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, 400)
+                            break
+                        # Stream to a temporary file instead of collecting the
+                        # whole upload in memory and copying it again into one
+                        # buffer: a 50 MB manual used to cost ~100 MB of RSS
+                        # mid-request (HP-1454-06). Blocks are batched so this
+                        # is one executor job per megabyte, not per 64 KB.
+                        tmp = await hass.async_add_executor_job(_new_tmp)
+                        temps.append(tmp)
+                        size = 0
+                        pending: list[bytes] = []
+                        buffered = 0
+                        while chunk := await part.read_chunk(_CHUNK):
+                            size += len(chunk)
+                            if size > MAX_FILE_BYTES:
+                                error = (
+                                    {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024},
+                                    413,
+                                )
+                                break
+                            pending.append(chunk)
+                            buffered += len(chunk)
+                            if buffered >= _FLUSH_AT:
+                                await hass.async_add_executor_job(_flush, tmp, pending)
+                                pending, buffered = [], 0
+                        if error:
+                            break
+                        if pending:
+                            await hass.async_add_executor_job(_flush, tmp, pending)
+            except Exception as err:  # noqa: BLE001
+                _LOGGER.warning("House Plan upload: multipart read error: %s", err)
+                error = ({"error": "bad_request"}, 400)
 
-        if too_large:
+            if error:
+                return web.json_response(error[0], status=error[1])
+            if not temps or not filename:
+                return web.json_response({"error": "no_file"}, status=400)
+
+            tmp_path = temps[0]
+            target_dir = files_root / marker_id
+            safe_name = filename
+
+            def _promote() -> str:
+                """Claim a free name, then move the finished upload onto it.
+
+                Never overwrite an existing attachment: its bytes may be
+                referenced by the stored configuration, and this upload is not
+                part of that transaction — a cancelled dialog or a rejected save
+                would leave the old url serving the new content (HP-1454-02).
+                The name is reserved atomically, so two uploads racing on the
+                same filename cannot agree on it (HP-1460-01).
+                """
+                name = reserve_filename(target_dir, safe_name)
+                try:
+                    os.replace(tmp_path, target_dir / name)
+                except OSError:
+                    (target_dir / name).unlink(missing_ok=True)
+                    raise
+                return name
+
+            try:
+                name = await hass.async_add_executor_job(_promote)
+            except OSError as err:
+                _LOGGER.warning("House Plan upload: could not store the file: %s", err)
+                return web.json_response({"error": "io_error"}, status=500)
+            temps.remove(tmp_path)  # it is the attachment now, not a temporary
             return web.json_response(
-                {"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024}, status=413
+                {"ok": True, "url": f"{CONTENT_URL}/files/{marker_id}/{name}", "name": filename}
             )
-        if blob is None or not filename:
-            return web.json_response({"error": "no_file"}, status=400)
-        ext = file_ext(filename)
-        if ext not in FILE_EXTENSIONS:
-            return web.json_response(
-                {"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, status=400
-            )
-
-        safe_name = sanitize_filename(filename)
-        target_dir = Path(hass.config.path(FILES_DIR)) / marker_id
-        path = target_dir / safe_name
-
-        def _write() -> int:
-            target_dir.mkdir(parents=True, exist_ok=True)
-            path.write_bytes(blob)
-            return int(path.stat().st_mtime)
-
-        mtime = await hass.async_add_executor_job(_write)
-        return web.json_response(
-            {"ok": True, "url": f"{CONTENT_URL}/files/{marker_id}/{safe_name}?v={mtime}", "name": filename}
-        )
+        finally:
+            # BaseException too: cancelling the request task raises
+            # asyncio.CancelledError, which an `except Exception` never saw —
+            # an aborted large upload leaked its temporary file every time
+            if temps:
+                await hass.async_add_executor_job(_cleanup, list(temps))

custom_components/houseplan/manifest.json

@@ -16,5 +16,5 @@
   "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
   "requirements": [],
   "single_config_entry": true,
-  "version": "1.44.8"
+  "version": "1.46.3"
 }

custom_components/houseplan/plans.py

@@ -0,0 +1,248 @@
+"""Blob lifecycle — pure, so it is unit-testable without Home Assistant.
+
+The file system is not part of the configuration store's transaction, so who
+may write or delete a plan or an attachment, and when, is a correctness
+question rather than housekeeping. It lives here, apart from the WebSocket and
+HTTP plumbing, precisely because it is the part that has to be reasoned about
+and tested.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+from .const import PLAN_ORPHAN_TTL_S
+from .validation import MAX_FILENAME, PLAN_EXTENSIONS, sanitize_filename
+
+_LOGGER = logging.getLogger(__name__)
+
+# Streaming uploads land here first. The prefix is a dot so the name can never
+# collide with an attachment (sanitize_filename strips leading dots) and is easy
+# to sweep.
+TMP_PREFIX = ".upload-"
+
+
+def reserve_filename(directory: Path, name: str) -> str:
+    """Atomically claim a free name inside `directory` and return it.
+
+    Creates the file, empty, with `O_CREAT | O_EXCL`, so the name is *taken* the
+    moment it is chosen. The previous version asked `exists()` and returned a
+    string; two uploads racing between the check and the write agreed on the
+    same name and one silently overwrote the other, both reporting success
+    (HP-1460-01). The caller writes the real bytes over the placeholder — it
+    owns the name by then — and must remove it if it never gets that far.
+
+    The result is guaranteed to satisfy `sanitize_filename(result) == result`:
+    the content view sanitises the name in the request too, so a name it would
+    shorten or rewrite is a file that is written and then never served.
+    """
+    directory.mkdir(parents=True, exist_ok=True)
+    # Split the extension off the RAW name: sanitize_filename() truncates to
+    # MAX_FILENAME, so sanitising first would cut ".pdf" off a long name and the
+    # attachment would be stored — and served — without its type.
+    base = name.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
+    stem, dot, suffix = base.rpartition(".")
+    if not dot:
+        stem, suffix = base, ""
+    stem = sanitize_filename(stem)
+    ext = f".{sanitize_filename(suffix)[:16]}" if suffix else ""
+    i = 1
+    while True:
+        tag = "" if i == 1 else f"-{i}"
+        # budget the stem so the WHOLE name fits, including the collision tag —
+        # appending "-2" to an already maximal name produced a url the view
+        # truncated back to something else, i.e. a permanent 404
+        room = MAX_FILENAME - len(ext) - len(tag)
+        candidate = (stem[:room] if room > 0 else "f") + tag + ext
+        candidate = sanitize_filename(candidate)
+        if candidate.startswith("."):  # a name that is only an extension
+            candidate = "file" + candidate
+        try:
+            fd = os.open(directory / candidate, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
+        except FileExistsError:
+            i += 1
+            if i > 10000:  # pathological directory; do not spin forever
+                raise
+            continue
+        os.close(fd)
+        return candidate
+
+
+def attachment_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """"<marker>/<file>" for every attachment a configuration references."""
+    out: set[str] = set()
+    for m in (cfg or {}).get("markers") or []:
+        for pdf in m.get("pdfs") or []:
+            url = pdf.get("url") if isinstance(pdf, dict) else None
+            if not isinstance(url, str) or "/files/" not in url:
+                continue
+            rel = url.split("?", 1)[0].split("/files/", 1)[1]
+            if rel.count("/") == 1:
+                out.add(rel)
+    return out
+
+
+def sweep_upload_temps(files_dir: Path, now: float | None = None) -> int:
+    """Remove abandoned streaming temporaries (HP-1460-02).
+
+    The request itself deletes its own, but a hard kill — a restart mid-upload,
+    an OOM — leaves one behind, and the attachment collector only walks marker
+    folders, so it would never be seen. Age-gated for the same reason as the
+    rest: a fresh one belongs to a request still in flight.
+    """
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        items = [p for p in files_dir.iterdir() if p.is_file()] if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    for item in items:
+        if not item.name.startswith(TMP_PREFIX):
+            continue
+        try:
+            if item.stat().st_mtime >= cutoff:
+                continue
+            item.unlink()
+            removed += 1
+        except OSError:
+            continue
+    return removed
+
+
+def collect_attachments(
+    files_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """The same commit-scoped rule as `collect_plans`, for marker attachments.
+
+    A file the old revision referenced and the new one does not was superseded
+    by this commit and goes. Anything else unreferenced is an upload that was
+    never saved — a cancelled dialog, a rejected write — and waits out
+    PLAN_ORPHAN_TTL_S first, because a fresh one may belong to a dialog the user
+    still has open. Never raises: it runs behind a durable write.
+    """
+    new_refs = attachment_refs(new_cfg)
+    old_refs = attachment_refs(old_cfg)
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        folders = sorted(p for p in files_dir.iterdir() if p.is_dir()) if files_dir.is_dir() else []
+    except OSError as err:
+        _LOGGER.warning("House Plan: could not list %s: %s", files_dir, err)
+        return 0
+    removed += sweep_upload_temps(files_dir, now)
+    for folder in folders:
+        try:
+            items = sorted(p for p in folder.iterdir() if p.is_file())
+        except OSError:
+            continue
+        for item in items:
+            rel = f"{folder.name}/{item.name}"
+            if rel in new_refs:
+                continue
+            try:
+                stale = item.stat().st_mtime < cutoff
+            except OSError:
+                stale = False
+            if rel not in old_refs and not stale:
+                continue
+            try:
+                item.unlink()
+                removed += 1
+            except OSError as err:
+                _LOGGER.warning("House Plan: could not remove the attachment %s: %s", item, err)
+        try:
+            next(folder.iterdir())
+        except StopIteration:
+            try:
+                folder.rmdir()
+            except OSError:
+                pass
+        except OSError:
+            pass
+    return removed
+
+
+def plan_basename(url: Any) -> str:
+    """File name a stored plan_url points at ('' when there is none)."""
+    if not isinstance(url, str) or not url:
+        return ""
+    return url.split("?", 1)[0].rsplit("/", 1)[-1]
+
+
+def plan_refs(cfg: dict[str, Any] | None) -> set[str]:
+    """Plan file names a configuration references."""
+    out: set[str] = set()
+    for sp in (cfg or {}).get("spaces") or []:
+        name = plan_basename(sp.get("plan_url"))
+        if name:
+            out.add(name)
+    return out
+
+
+def is_plan_file(name: str) -> bool:
+    """Does this look like a plan we wrote: <space>.<ext> or <space>.<token>.<ext>?"""
+    parts = name.split(".")
+    return len(parts) in (2, 3) and parts[-1].lower() in PLAN_EXTENSIONS
+
+
+def collect_plans(
+    plans_dir: Path,
+    old_cfg: dict[str, Any] | None,
+    new_cfg: dict[str, Any],
+    now: float | None = None,
+) -> int:
+    """Drop plan files the accepted configuration made obsolete (review R3-1).
+
+    Called inside the config write lock, right after the new revision is
+    stored, so it decides from the two configurations that actually bracket the
+    commit instead of trusting a client to say what may be deleted. The earlier
+    design — a `plan/cleanup` command carrying `keep` — could not be ordered
+    against another client's commit: a delayed call removed the file that
+    client had just saved, leaving the accepted configuration pointing at
+    nothing, which is the damage copy-on-write was introduced to prevent.
+
+    Two rules, both conservative:
+      * a file the OLD configuration referenced and the new one does not was
+        authoritative and has been superseded — remove it;
+      * any other unreferenced plan file is a rejected or abandoned upload, and
+        is removed only once PLAN_ORPHAN_TTL_S has passed: a fresh one may
+        belong to a transaction that has not committed yet.
+
+    Never raises: the configuration is already stored by the time this runs, so
+    a file-system problem must not turn a durable commit into a failed call.
+    """
+    new_refs = plan_refs(new_cfg)
+    old_refs = plan_refs(old_cfg)
+    cutoff = (time.time() if now is None else now) - PLAN_ORPHAN_TTL_S
+    removed = 0
+    try:
+        items = sorted(plans_dir.iterdir()) if plans_dir.is_dir() else []
+    except OSError as err:
+        # The directory can vanish or turn unreadable between the check and the
+        # walk. This is housekeeping running behind a commit that is already
+        # durable, so it reports "nothing collected" instead of failing (R4-1).
+        _LOGGER.warning("House Plan: could not list %s: %s", plans_dir, err)
+        return 0
+    for item in items:
+        if not item.is_file() or item.name in new_refs or not is_plan_file(item.name):
+            continue
+        superseded = item.name in old_refs
+        try:
+            stale = item.stat().st_mtime < cutoff
+        except OSError:
+            stale = False
+        if not superseded and not stale:
+            continue
+        try:
+            item.unlink()
+            removed += 1
+        except OSError as err:
+            _LOGGER.warning("House Plan: could not remove the old plan %s: %s", item, err)
+    return removed

custom_components/houseplan/repairs.py

@@ -51,8 +51,17 @@ async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntr
             translation_key="broken_plan",
             translation_placeholders={"space": space_id, "file": fname},
         )
-    # clear stale issues for spaces that are fine again (or gone)
-    for sp in spaces:
-        sid = sp.get("id", "?")
-        if sid not in broken:
-            ir.async_delete_issue(hass, DOMAIN, f"broken_plan_{sid}")
+    # Clear stale issues. Iterating the CURRENT spaces could only ever clear
+    # issues for spaces that still exist, so deleting or renaming a space with a
+    # missing plan left its warning in Repairs forever, with nothing left to fix
+    # it (HP-1454-09). Enumerate what we actually published instead.
+    registry = ir.async_get(hass)
+    stale = [
+        issue_id
+        for (domain, issue_id) in list(registry.issues)
+        if domain == DOMAIN
+        and issue_id.startswith("broken_plan_")
+        and issue_id[len("broken_plan_") :] not in broken
+    ]
+    for issue_id in stale:
+        ir.async_delete_issue(hass, DOMAIN, issue_id)

custom_components/houseplan/store.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import asyncio
+from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, field
 from typing import Any
 
@@ -42,6 +43,11 @@ class HouseplanData:
     # One lock for every load→modify→save cycle of both stores: prevents
     # lost updates from concurrent WS calls and makes the rev check atomic.
     write_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    # Collect files nothing references any more. Set during setup, which also
+    # runs it once and schedules it daily. Exposed so it can be invoked
+    # directly — a test that fakes a 24 h jump proves the timer fires, not that
+    # the work happens, and those are different claims.
+    sweep: Callable[[], Awaitable[None]] | None = None
 
 
 HouseplanConfigEntry = ConfigEntry[HouseplanData]

custom_components/houseplan/validation.py

@@ -16,6 +16,9 @@ MAX_FILE_BYTES = 50 * 1024 * 1024
 
 SPACE_ID_RE = re.compile(r"^[a-z0-9_-]{1,64}$")
 _SAFE_NAME_RE = re.compile(r"[^A-Za-z0-9._-]+")
+# The name length the content view will accept back in a request. Anything a
+# generated name must fit inside, collision tag included (HP-1460-01).
+MAX_FILENAME = 120
 
 # ---------- sanitizers ----------
 
@@ -33,7 +36,7 @@ def sanitize_marker_id(value: str) -> str:
 def sanitize_filename(value: str) -> str:
     """Drop the path and leading dots, keep a safe file name."""
     raw = value.rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
-    return _SAFE_NAME_RE.sub("_", raw).lstrip(".")[:120] or "file"
+    return _SAFE_NAME_RE.sub("_", raw).lstrip(".")[:MAX_FILENAME] or "file"
 
 
 def file_ext(filename: str) -> str:
@@ -66,6 +69,31 @@ MAX_MARKERS = 2000
 MAX_OPENINGS = 500
 MAX_DECOR = 1000
 MAX_LAYOUT = 5000
+# Inner limits (HP-1454-05). The outer collections were capped, the collections
+# INSIDE them were not: a 150 000-point polygon or a 100 000-entry known_devices
+# list passed validation, then made the card build gigantic SVG attributes and
+# walk them on every render. Any authenticated writer could store one, and with
+# `admin_only` off that is every user. These are product limits, not guesses: a
+# hand-drawn room does not need 500 vertices, and no home has 200 lights behind
+# one switch.
+MAX_POLY_POINTS = 500
+MAX_OPEN_TO = 50
+MAX_CONTROLS = 200
+MAX_PDFS = 50
+MAX_KNOWN_DEVICES = 20000
+MAX_TEXT = 500          # names, models, ids
+MAX_DESCRIPTION = 4000
+MAX_URL = 2000
+# Comfortably below the WebSocket frame limit (aiohttp's default is 4 MB): a
+# payload larger than the frame never reaches the handler at all — the socket
+# closes with 1009 and the user sees a dropped connection instead of an error
+# they can act on. For scale, a real three-floor home with ~200 devices stores
+# about 70 KB, so this is ~30x headroom.
+MAX_CONFIG_BYTES = 2 * 1024 * 1024
+
+_TEXT = vol.All(str, vol.Length(max=MAX_TEXT))
+_TEXT_OR_NONE = vol.Any(None, _TEXT)
+_URL = vol.All(str, vol.Length(max=MAX_URL))
 
 POS_SCHEMA = vol.Schema(
     {vol.Required("x"): _finite, vol.Required("y"): _finite},
@@ -85,10 +113,10 @@ def _require_geometry(room: dict) -> dict:
 ROOM_SCHEMA = vol.All(
     vol.Schema(
         {
-            vol.Required("id"): str,
-            vol.Required("name"): str,
-            vol.Optional("area"): vol.Any(str, None),
-            vol.Optional("open_to"): [str],
+            vol.Required("id"): _TEXT,
+            vol.Required("name"): _TEXT,
+            vol.Optional("area"): _TEXT_OR_NONE,
+            vol.Optional("open_to"): vol.All([_TEXT], vol.Length(max=MAX_OPEN_TO)),
             vol.Optional("settings"): vol.Any(
                 None,
                 vol.Schema(
@@ -106,7 +134,7 @@ ROOM_SCHEMA = vol.All(
             vol.Optional("y"): _finite,
             vol.Optional("w"): _finite,
             vol.Optional("h"): _finite,
-            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3)),
+            vol.Optional("poly"): vol.All([POINT], vol.Length(min=3, max=MAX_POLY_POINTS)),
         },
         extra=vol.ALLOW_EXTRA,
     ),
@@ -185,7 +213,10 @@ SPACE_SCHEMA = vol.Schema(
         # Legacy: walls are derived from room outlines since v1.19.0 — a line has no
         # independent existence. Still accepted so a stale browser tab cannot fail a save;
         # the card strips the field on every write.
-        vol.Optional("segments"): [vol.All([vol.Coerce(float)], vol.Length(min=4, max=4))],
+        # Accepted so a stale browser tab cannot fail a save, then DROPPED here
+        # (HP-1454-05): relying on a modern client to strip an unbounded legacy
+        # list is not a limit, it is a hope. `Remove` returns the key stripped.
+        vol.Remove("segments"): object,
     },
     extra=vol.ALLOW_EXTRA,
 )
@@ -197,24 +228,27 @@ MARKER_SCHEMA = vol.Schema(
         vol.Optional("space"): vol.Any(str, None),
         vol.Optional("area"): vol.Any(str, None),
         vol.Optional("hidden"): bool,
-        vol.Optional("name"): vol.Any(str, None),
-        vol.Optional("icon"): vol.Any(str, None),
-        vol.Optional("model"): vol.Any(str, None),
-        vol.Optional("link"): vol.Any(str, None),
-        vol.Optional("description"): vol.Any(str, None),
+        vol.Optional("name"): _TEXT_OR_NONE,
+        vol.Optional("icon"): _TEXT_OR_NONE,
+        vol.Optional("model"): _TEXT_OR_NONE,
+        vol.Optional("link"): vol.Any(None, _URL),
+        vol.Optional("description"): vol.Any(None, vol.All(str, vol.Length(max=MAX_DESCRIPTION))),
         vol.Optional("tap_action"): vol.Any("info", "more-info", "toggle", None),
-        vol.Optional("controls"): vol.Any([str], None),
+        vol.Optional("controls"): vol.Any(None, vol.All([_TEXT], vol.Length(max=MAX_CONTROLS))),
         vol.Optional("glow_radius_cm"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)), None),
         vol.Optional("is_light"): vol.Any(bool, None),
         vol.Optional("room_id"): vol.Any(str, None),
-        vol.Optional("display"): vol.Any("badge", "ripple", "icon_ripple", None),
+        # keep in sync with DISPLAY_MODES in src/logic.ts — a cross-language test
+        # asserts every option the editor offers is accepted here (issue #3)
+        vol.Optional("display"): vol.Any("badge", "ripple", "icon_ripple", "value", None),
         vol.Optional("ripple_color"): vol.Any(str, None),
         vol.Optional("ripple_size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=1, max=20)), None),
         vol.Optional("size"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=0.2, max=6)), None),
         vol.Optional("angle"): vol.Any(vol.All(vol.Coerce(float), vol.Range(min=-360, max=360)), None),
-        vol.Optional("pdfs"): [
-            vol.Schema({vol.Required("name"): str, vol.Required("url"): str}, extra=vol.ALLOW_EXTRA)
-        ],
+        vol.Optional("pdfs"): vol.All(
+            [vol.Schema({vol.Required("name"): _TEXT, vol.Required("url"): _URL}, extra=vol.ALLOW_EXTRA)],
+            vol.Length(max=MAX_PDFS),
+        ),
     },
     extra=vol.ALLOW_EXTRA,
 )
@@ -225,8 +259,8 @@ CONFIG_SCHEMA = vol.Schema(
         vol.Optional("settings", default=dict): vol.Schema(
             {
                 vol.Optional("glow_radius_cm"): vol.All(vol.Coerce(float), vol.Range(min=10, max=10000)),
-                vol.Optional("known_devices"): [str],
-                vol.Optional("new_device_ids"): [str],
+                vol.Optional("known_devices"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
+                vol.Optional("new_device_ids"): vol.All([_TEXT], vol.Length(max=MAX_KNOWN_DEVICES)),
                 vol.Optional("fill_colors"): vol.Schema(
                     {
                         str: vol.Schema(

custom_components/houseplan/websocket_api.py

@@ -5,6 +5,8 @@ import logging
 
 import base64
 import binascii
+import json
+import secrets
 from pathlib import Path
 from typing import Any
 
@@ -15,12 +17,13 @@ from homeassistant.core import HomeAssistant, callback
 
 from .const import (
     CONF_ADMIN_ONLY, DEFAULT_CONFIG,
-    CONTENT_URL, PLANS_DIR, PLANS_URL,
+    CONTENT_URL, FILES_DIR, MAX_SIGN_PATHS, PLANS_DIR, PLANS_URL,
 )
 from .auth import may_write
+from .plans import collect_attachments, collect_plans, reserve_filename
 from .store import HouseplanData, get_data, get_entry
 from .validation import (
-    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_PLAN_BYTES,
+    CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_CONFIG_BYTES, MAX_PLAN_BYTES,
     PLAN_EXTENSIONS, POS_SCHEMA, valid_space_id,
 )
 
@@ -72,7 +75,9 @@ async def ws_layout_get(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
     if rt is None:
         return
     data = await rt.store.async_load() or {}
-    connection.send_result(msg["id"], {"layout": data.get("layout", {})})
+    connection.send_result(
+        msg["id"], {"layout": data.get("layout", {}), "rev": int(data.get("rev", 0))}
+    )
 
 
 @websocket_api.websocket_command(
@@ -105,8 +110,10 @@ async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
                 msg["id"], "conflict", f"Layout changed elsewhere (rev {current_rev})"
             )
             return
-        await rt.store.async_save({"layout": msg["layout"], "rev": current_rev + 1})
-    connection.send_result(msg["id"], {"ok": True, "rev": current_rev + 1})
+        new_rev = current_rev + 1
+        await rt.store.async_save({"layout": msg["layout"], "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
 
 
 @websocket_api.websocket_command(
@@ -129,8 +136,13 @@ async def ws_layout_update(hass: HomeAssistant, connection, msg: dict[str, Any])
         data = await rt.store.async_load() or {}
         layout = data.get("layout", {})
         layout[msg["device_id"]] = msg["pos"]
-        await rt.store.async_save({"layout": layout})
-    connection.send_result(msg["id"], {"ok": True})
+        # keep the revision: a point-wise write used to drop it, which made the
+        # optimistic locking on layout/set meaningless — every drag reset the
+        # counter to 0 (HP-1454-08)
+        new_rev = int(data.get("rev", 0)) + 1
+        await rt.store.async_save({"layout": layout, "rev": new_rev})
+    hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
 
 
 @websocket_api.websocket_command(
@@ -181,17 +193,18 @@ async def ws_files_migrate(hass: HomeAssistant, connection, msg: dict[str, Any])
         for f in sorted(src.iterdir()):
             if not f.is_file():
                 continue
-            target = dst / f.name
-            if target.exists():
-                # a different file already owns this name — do NOT silently
-                # point the url at it; give the copy a unique name instead
-                stem, suffix = f.stem, f.suffix
-                i = 2
-                while (dst / f"{stem} ({i}){suffix}").exists():
-                    i += 1
-                target = dst / f"{stem} ({i}){suffix}"
-            shutil.copy2(str(f), str(target))
-            mapping[f.name] = target.name
+            # a different file may already own this name — do NOT silently point
+            # the url at it. The shared helper CLAIMS a free one atomically, so
+            # a concurrent migrate or upload cannot pick the same one, and the
+            # name it returns is one the content view accepts back in a request.
+            name = reserve_filename(dst, f.name)
+            target = dst / name
+            try:
+                shutil.copy2(str(f), str(target))
+            except OSError:
+                target.unlink(missing_ok=True)  # never leave an empty placeholder
+                raise
+            mapping[f.name] = name
         return mapping
 
     try:
@@ -226,7 +239,7 @@ async def ws_content_sign(hass: HomeAssistant, connection, msg: dict[str, Any])
 
     out: dict[str, str] = {}
     token_id = getattr(connection, "refresh_token_id", None)
-    for path in msg["paths"][:200]:
+    for path in msg["paths"][:MAX_SIGN_PATHS]:
         if not isinstance(path, str) or not path.startswith(CONTENT_URL + "/"):
             continue  # only ever sign our own content endpoint
         clean = path.split("?", 1)[0]
@@ -295,13 +308,17 @@ async def ws_layout_delete(hass: HomeAssistant, connection, msg: dict[str, Any])
     rt = _runtime(hass, connection, msg["id"])
     if rt is None:
         return
+    new_rev: int | None = None
     async with rt.write_lock:
         data = await rt.store.async_load() or {}
         layout = data.get("layout", {})
         if msg["device_id"] in layout:
             del layout[msg["device_id"]]
-            await rt.store.async_save({"layout": layout})
-    connection.send_result(msg["id"], {"ok": True})
+            new_rev = int(data.get("rev", 0)) + 1
+            await rt.store.async_save({"layout": layout, "rev": new_rev})
+    if new_rev is not None:
+        hass.bus.async_fire("houseplan_layout_updated", {"rev": new_rev})
+    connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
 
 
 # ---------------- space configuration ----------------
@@ -319,6 +336,7 @@ async def ws_config_get(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
     connection.send_result(msg["id"], {"config": config, "rev": data.get("rev", 0)})
 
 
+
 @websocket_api.websocket_command(
     {
         vol.Required("type"): "houseplan/config/set",
@@ -340,6 +358,16 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
     rt = _runtime(hass, connection, msg["id"])
     if rt is None:
         return
+    # Per-field limits bound each list; this bounds their product (HP-1454-05).
+    # Everything below the caps can still add up to something no dashboard can
+    # render, and the store writes it to disk on every save.
+    size = len(json.dumps(msg["config"], separators=(",", ":")))
+    if size > MAX_CONFIG_BYTES:
+        connection.send_error(
+            msg["id"], "too_large",
+            f"Configuration is {size // 1024} KB, the limit is {MAX_CONFIG_BYTES // 1024} KB",
+        )
+        return
     async with rt.write_lock:
         data = await rt.config_store.async_load() or {}
         current_rev = data.get("rev", 0)
@@ -360,6 +388,20 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
             return
         new_rev = current_rev + 1
         await rt.config_store.async_save({"config": msg["config"], "rev": new_rev})
+        # Still holding the lock: the file system is not part of the store's
+        # transaction, so collection has to be pinned to this commit (R3-1).
+        # It is best-effort housekeeping behind an already durable write — a
+        # failure here must not withhold the event and the success response,
+        # or the client retries an edit the server has already accepted and
+        # gets a conflict for its trouble (R4-1).
+        def _collect() -> None:
+            collect_plans(Path(hass.config.path(PLANS_DIR)), data.get("config"), msg["config"])
+            collect_attachments(Path(hass.config.path(FILES_DIR)), data.get("config"), msg["config"])
+
+        try:
+            await hass.async_add_executor_job(_collect)
+        except Exception:  # noqa: BLE001 — see above: the commit stands regardless
+            _LOGGER.exception("House Plan: collecting superseded files failed")
     hass.bus.async_fire("houseplan_config_updated", {"rev": new_rev})
     # refresh repair issues (broken plan references) without waiting for a restart
     entry = get_entry(hass)
@@ -400,20 +442,25 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
         connection.send_error(msg["id"], "too_large", f"Plan is larger than {MAX_PLAN_BYTES // 1024 // 1024} MB")
         return
 
+    # Copy-on-write: a plan is written under a NEW unique name and nothing is
+    # deleted here (review R2-1). The old name stays readable, so a config write
+    # that is later rejected — revision conflict, validation, lost connection —
+    # leaves the stored plan exactly as it was. The card calls
+    # nothing here; the superseded file is collected by `config/set` itself,
+    # inside the write lock, once a revision that no longer references it has
+    # been accepted (review R3-1). A crash in between leaves an orphan, which
+    # the same collector removes on a later commit once it is old enough.
+    #
+    # `.` separates the id from the token because a space id cannot contain one
+    # (SPACE_ID_RE), so "<space>.<token>.<ext>" can never be confused with the
+    # files of a differently named space.
     plans_dir = Path(hass.config.path(PLANS_DIR))
-    path = plans_dir / f"{space_id}.{msg['ext']}"
+    name = f"{space_id}.{secrets.token_hex(4)}.{msg['ext']}"
+    path = plans_dir / name
 
-    def _write() -> int:
+    def _write() -> None:
         plans_dir.mkdir(parents=True, exist_ok=True)
-        # remove old variants with a different extension
-        for old_ext in PLAN_EXTENSIONS:
-            old = plans_dir / f"{space_id}.{old_ext}"
-            if old_ext != msg["ext"] and old.exists():
-                old.unlink()
         path.write_bytes(raw)
-        return int(path.stat().st_mtime)
 
-    mtime = await hass.async_add_executor_job(_write)
-    connection.send_result(
-        msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{space_id}.{msg['ext']}?v={mtime}"}
-    )
+    await hass.async_add_executor_job(_write)
+    connection.send_result(msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{name}"})

demo/smoke_climate_once.mjs

@@ -0,0 +1,76 @@
+// Ревью R2-3: климат комнат считался отдельным обходом реестра на каждую
+// комнату и каждую величину — 60 комнат × 2000 сущностей съедали кадр на
+// перечитывании метаданных, которые не менялись. Карта строится один раз на
+// снимок hass; при этом новые состояния датчиков обязаны попадать в неё сразу.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const sr = () => c.shadowRoot || c.renderRoot;
+
+  // считаем обходы реестра через ownKeys — именно его дёргает Object.entries
+  let scans = 0;
+  const wrap = (h) => {
+    const ents = h.entities;
+    const traced = new Proxy(ents, { ownKeys(t) { scans++; return Reflect.ownKeys(t); } });
+    return { ...h, entities: traced };
+  };
+  const fresh = () => wrap(window.__mkHass());
+
+  // включаем и заливку по температуре, и подписи — два потребителя климата
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) => s.id !== 'f1' ? s : {
+    ...s, settings: { ...(s.settings || {}), show_names: true, fill_mode: 'temp', label_temp: true, label_hum: true },
+  })};
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  const fewRooms = scans;
+
+  // повторные рендеры на том же снимке hass реестр не трогают
+  scans = 0;
+  c.requestUpdate(); await c.updateComplete;
+  c.requestUpdate(); await c.updateComplete;
+  out.scansOnRerender = scans;
+
+  // главный инвариант: обходов НЕ становится больше от числа комнат
+  const f1 = c._serverCfg.spaces.find((s) => s.id === 'f1');
+  const extra = [];
+  for (let i = 0; i < 40; i++) {
+    extra.push({ id: 'gen' + i, name: 'R' + i, area: 'living_room',
+      poly: [[0.01, 0.01], [0.02, 0.01], [0.02, 0.02], [0.01, 0.02]] });
+  }
+  c._serverCfg = { ...c._serverCfg, spaces: c._serverCfg.spaces.map((s) =>
+    s.id !== 'f1' ? s : { ...s, rooms: [...s.rooms, ...extra] }) };
+  c._cfgEpoch++;
+  c.hass = fresh(); await c.updateComplete;
+  scans = 0;
+  c.hass = fresh(); await c.updateComplete;
+  out.roomCount = c._spaceModel('f1').rooms.length;
+  out.scansSameWith44Rooms = scans === fewRooms;
+  out.scansPerUpdate = scans;
+
+  // при этом новое состояние датчика обязано быть видно, а не взято из кэша
+  out.tempBefore = c._climate().get('living_room')?.temp;
+  const h = fresh();
+  h.states = { ...h.states, 'sensor.living_temp': { ...h.states['sensor.living_temp'], state: '33.3' } };
+  c.hass = h; await c.updateComplete;
+  out.tempAfter = c._climate().get('living_room')?.temp;
+  out.climateIsMap = c._climate() instanceof Map;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом.
+// scansPerUpdate = 2: один обход у areaClimateMap, один у buildDevices. Важно
+// не само число, а что оно не растёт вместе с числом комнат.
+checkAll(res, {
+  scansOnRerender: 0,
+  roomCount: 44,
+  scansSameWith44Rooms: true,
+  scansPerUpdate: 2,
+  tempBefore: 22.4,
+  tempAfter: 33.3,
+  climateIsMap: true,
+});
+await finish(browser);

demo/smoke_config_writer.mjs

@@ -0,0 +1,67 @@
+// HP-1454-03: две локальные правки уходили с одной ревизией, вторая терялась.
+// Debounce разносил только СТАРТЫ. Если первый config/set отвечал дольше 500 мс,
+// вторая правка уходила с тем же expected_rev, сервер принимал первую и
+// отклонял вторую как conflict — а обработчик конфликта перечитывал серверную
+// копию поверх локальной. Правка исчезала, и тост винил «другое окно».
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const writes = [];
+  let rev = 10;
+  let releaseFirst;
+  const firstGate = new Promise((r) => { releaseFirst = r; });
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/set') {
+      const n = writes.length + 1;
+      writes.push({ expected: m.expected_rev, titles: m.config.spaces.map((s) => s.title) });
+      if (n === 1) await firstGate;                  // первый ответ задержан
+      if (m.expected_rev !== rev) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      rev += 1;
+      return { ok: true, rev };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { config: JSON.parse(JSON.stringify(r.config)), rev };
+    }
+    return base(m);
+  } };
+  c._cfgRev = rev;
+
+  // правка №1 и, пока первая запись висит, правка №2
+  c._serverCfg.spaces[0].title = 'FIRST';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.oneInFlight = writes.length === 1;
+
+  c._serverCfg.spaces[0].title = 'SECOND';
+  c._saveConfig();
+  c._saveConfigDebounced.flush();
+  await new Promise((r) => setTimeout(r, 30));
+  out.stillOneInFlight = writes.length === 1;   // вторая ждёт очереди, не летит параллельно
+
+  releaseFirst();
+  await new Promise((r) => setTimeout(r, 120));
+
+  out.writes = writes.length;
+  out.revisions = writes.map((w) => w.expected);          // вторая обязана взять новую ревизию
+  out.secondCarriedTheEdit = writes[1]?.titles[0] === 'SECOND';
+  out.editSurvived = c._serverCfg.spaces[0].title === 'SECOND';
+  out.noConflictToast = !(c._toast || '').length;
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  oneInFlight: true,
+  stillOneInFlight: true,
+  writes: 2,
+  revisions: [10, 11],
+  secondCarriedTheEdit: true,
+  editSurvived: true,
+  noConflictToast: true,
+});
+await finish(browser);

demo/smoke_layout_sync.mjs

@@ -0,0 +1,103 @@
+// HP-1460-03: позиции — отдельное состояние. В v1.46.0 событие layout_updated
+// научилась слушать статическая карточка, а полная — нет, поэтому две полные
+// карточки рядом расходились до перезагрузки. Проверяем и обратное: приход
+// чужой ревизии не должен затирать перетаскивание, которое ещё не улетело.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+
+  // общий «сервер»: layout с ревизией и подписчики на событие
+  let rev = 5;
+  let layout = { dev_a: { x: 10, y: 10 }, dev_b: { x: 20, y: 20 } };
+  const subs = [];
+  let gets = 0;
+  const hass = { ...c.hass,
+    callWS: async (m) => {
+      if (m.type === 'houseplan/layout/get') { gets++; return { layout: JSON.parse(JSON.stringify(layout)), rev }; }
+      if (m.type === 'houseplan/layout/update') {
+        layout = { ...layout, [m.device_id]: m.pos }; rev += 1;
+        subs.forEach((f) => f({ data: { rev } }));
+        return { ok: true, rev };
+      }
+      return base(m);
+    },
+    connection: { subscribeEvents: async (cb, ev) => {
+      if (ev === 'houseplan_layout_updated') { subs.push(cb); return () => {}; }
+      return () => {};
+    } },
+  };
+  c.hass = hass;
+  c._serverStorage = true;
+  c._layout = JSON.parse(JSON.stringify(layout));
+  c._layoutRev = rev;
+  c._unsubLayout = await hass.connection.subscribeEvents(
+    (e) => c._onLayoutEvent(Number(e?.data?.rev ?? -1)),
+    'houseplan_layout_updated',
+  );
+  out.subscribed = subs.length === 1;
+
+  // 1) чужая карточка подвинула иконку — наша обязана подхватить без перезагрузки
+  layout = { ...layout, dev_a: { x: 77, y: 88 } }; rev += 1;
+  subs.forEach((f) => f({ data: { rev } }));
+  await new Promise((r) => setTimeout(r, 350));
+  out.adoptedRemoteMove = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 77, y: 88 });
+  out.revFollowed = c._layoutRev === rev;
+
+  // 2) собственная запись не вызывает лишнего перечитывания
+  const before = gets;
+  c._layout = { ...c._layout, dev_b: { x: 31, y: 32 } };
+  c._dirtyPos.add('dev_b');
+  c._persistLayout();
+  c._persistLayout.flush();
+  await new Promise((r) => setTimeout(r, 350));
+  out.ownWriteNoReload = gets === before;
+  out.ownWriteKept = JSON.stringify(c._layout.dev_b) === JSON.stringify({ x: 31, y: 32 });
+
+  // 3) НАСТОЯЩЕЕ перетаскивание: debounce запланирован, запись задержана, а
+  //    layout/get отвечает мгновенно. Именно этот порядок и терял позицию:
+  //    flush() внутри перечитывания опустошал _dirtyPos ДО снятия снимка.
+  let releaseUpdate;
+  const updateGate = new Promise((r) => { releaseUpdate = r; });
+  let delayUpdate = true;
+  const plain = hass.callWS;
+  c.hass = { ...hass, callWS: async (m) => {
+    if (m.type === 'houseplan/layout/update' && delayUpdate) {
+      delayUpdate = false;
+      await updateGate;
+    }
+    return plain(m);
+  } };
+
+  c._layout = { ...c._layout, dev_a: { x: 5, y: 6 } };
+  c._dirtyPos.add('dev_a');
+  c._persistLayout();                              // debounce запланирован, не сброшен вручную
+  layout = { ...layout, dev_b: { x: 99, y: 99 } }; rev += 1;
+  subs.forEach((f) => f({ data: { rev } }));
+  await new Promise((r) => setTimeout(r, 400));
+  out.dragKeptWhileWriteInFlight = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.remoteChangeApplied = JSON.stringify(c._layout.dev_b) === JSON.stringify({ x: 99, y: 99 });
+
+  releaseUpdate();
+  await new Promise((r) => setTimeout(r, 350));
+  out.localDragSurvived = JSON.stringify(c._layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.serverAgrees = JSON.stringify(layout.dev_a) === JSON.stringify({ x: 5, y: 6 });
+  out.sentPosDrained = c._sentPos.size === 0;
+  return out;
+});
+// зафиксировано прогоном на v1.46.1 и сверено с кодом
+checkAll(res, {
+  subscribed: true,
+  adoptedRemoteMove: true,
+  revFollowed: true,
+  ownWriteNoReload: true,
+  ownWriteKept: true,
+  dragKeptWhileWriteInFlight: true,
+  remoteChangeApplied: true,
+  localDragSurvived: true,
+  serverAgrees: true,
+  sentPosDrained: true,
+});
+await finish(browser);

demo/smoke_plan_upload_reject.mjs

@@ -0,0 +1,71 @@
+// Граница транзакции загрузки подложки (ревью R2-1, уточнено в R3-1).
+// Файл плана пишется на диск ДО проверки ревизии конфига, поэтому отвергнутое
+// сохранение не имеет права трогать сохранённый план. Со стороны карточки
+// контракт теперь такой: она НЕ управляет удалением файлов вообще — уборку
+// делает сам config/set под блокировкой (клиент не может упорядочить свою
+// уборку относительно чужого коммита, R3-1). Здесь проверяем, что карточка
+// не отправляет никаких команд удаления и корректно ведёт себя при отказе.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  let uploads = 0;
+  const cleanups = [];
+  let rejectSave = true;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/plan/set') {
+      uploads++;
+      return { ok: true, url: '/api/houseplan/content/plans/_/' + m.space_id + '.tok' + uploads + '.png' };
+    }
+    // любая команда удаления файлов от клиента — нарушение контракта R3-1
+    if (m.type === 'houseplan/plan/cleanup' || m.type === 'houseplan/plan/delete') { cleanups.push(m); return { ok: true }; }
+    if (m.type === 'houseplan/config/set') {
+      if (rejectSave) { const e = new Error('conflict'); e.code = 'conflict'; throw e; }
+      c.__sent = m.config; return { ok: true, rev: 77 };
+    }
+    if (m.type === 'houseplan/config/get') {
+      const r = await base(m);
+      return { ...r, config: JSON.parse(JSON.stringify(r.config)) };
+    }
+    return base(m);
+  } };
+
+  const attach = async () => {
+    c._openSpaceDialog('edit', 'f1'); await c.updateComplete;
+    c._spaceDialog = { ...c._spaceDialog, title: 'Ground', source: 'file',
+      planFile: { ext: 'png', b64: 'AAAA', aspect: 1.6 } };
+    await c._saveSpaceDialog(); await c.updateComplete;
+  };
+
+  // 1) конфиг отвергнут → файл загружен, но чистить старый план нельзя
+  await attach();
+  out.uploadedOnReject = uploads === 1;
+  out.cleanupsAfterReject = cleanups.length;
+  out.dialogStaysOpenOnReject = c._spaceDialog !== null;
+
+  // 2) конфиг принят → чистка уходит, и ровно на тот файл, что записан в конфиг
+  rejectSave = false;
+  c._spaceDialog = null; await c.updateComplete;
+  await attach();
+  out.cleanupsAfterAccept = cleanups.length;
+  const f1 = (c.__sent?.spaces || []).find((s) => s.id === 'f1');
+  out.savedPlanUrl = f1?.plan_url;
+  out.dialogClosedOnAccept = c._spaceDialog === null;
+  // вторая загрузка не переиспользует имя первой: старый файл жив до коммита
+  out.versionedNames = uploads === 2;
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом
+checkAll(res, {
+  uploadedOnReject: true,
+  cleanupsAfterReject: 0,
+  dialogStaysOpenOnReject: true,
+  cleanupsAfterAccept: 0,
+  savedPlanUrl: '/api/houseplan/content/plans/_/f1.tok2.png',
+  dialogClosedOnAccept: true,
+  versionedNames: true,
+});
+await finish(browser);

demo/smoke_render_parity.mjs

@@ -0,0 +1,59 @@
+// HP-1454-07: статическая карточка строит модель другой функцией, и room.settings
+// в неё не переносились — переопределение заливки на уровне комнаты она
+// игнорировала и красила комнату, которую полная карточка оставляет прозрачной.
+// Плюс HP-1454-08: layout-события должны доходить до статической карточки без
+// перезагрузки страницы.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+
+  // заливка по свету на пространстве, у первой комнаты — переопределение "none"
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  const f1 = cfg.spaces.find((s) => s.id === 'f1');
+  f1.settings = { ...(f1.settings || {}), show_borders: true, show_names: true, fill_mode: 'light' };
+  f1.rooms[0].settings = { fill_mode: 'none' };
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {}, rev: 1 };
+    return { ok: true };
+  } };
+
+  main._serverCfg = cfg;
+  main._cfgEpoch++;
+  main.requestUpdate(); await main.updateComplete;
+
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+  const t0 = Date.now();
+  while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) {
+    await new Promise((r) => setTimeout(r, 60));
+  }
+  await card.updateComplete;
+
+  const overridden = (root) => {
+    const rooms = [...root.querySelectorAll('.room')];
+    return rooms.length ? ((rooms[0].getAttribute('style') || '').match(/--room-fill:([^;]+)/) || [])[1] || null : 'missing';
+  };
+
+  out.fullCardRoom0 = overridden(main.shadowRoot || main.renderRoot);
+  out.staticCardRoom0 = overridden(card.renderRoot);
+  out.parity = out.fullCardRoom0 === out.staticCardRoom0;
+  out.overrideRespected = out.staticCardRoom0 === 'transparent';
+
+  return out;
+});
+// зафиксировано прогоном на v1.46.0 и сверено с кодом
+checkAll(res, {
+  fullCardRoom0: 'transparent',
+  staticCardRoom0: 'transparent',
+  parity: true,
+  overrideRespected: true,
+});
+await finish(browser);

demo/smoke_sign_cap.mjs

@@ -0,0 +1,78 @@
+// Ревью R2-2: бэкенд подписывает не более MAX_SIGN_PATHS путей за вызов и
+// молча отбрасывает остальные. Карточка обязана бить запрос на батчи, помнить
+// возраст подписи и чистить кэш от ссылок, которых в конфиге больше нет —
+// иначе на настенном планшете «лишние» записи протухают навсегда.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch();
+const res = await page.evaluate(async () => {
+  const out = {};
+  const c = window.__card;
+  const base = c.hass.callWS;
+  const batchSizes = [];
+  let round = 0;
+
+  c.hass = { ...c.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/content/sign') {
+      batchSizes.push(m.paths.length);
+      const urls = {};
+      // как настоящий бэкенд: не больше 200 за раз, про остальные — молчание
+      for (const p of m.paths.slice(0, 200)) urls[p] = p.split('?')[0] + '?authSig=R' + round;
+      return { urls };
+    }
+    return base(m);
+  } };
+
+  // 201 вложение, разложенное по маркерам: столько же подписанных ссылок
+  const pdfs = [];
+  for (let i = 0; i < 201; i++) pdfs.push({ name: 'm' + i, url: '/api/houseplan/content/files/m/doc' + i + '.pdf' });
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'mk1', pdfs }] };
+  c._cfgEpoch++;
+
+  round = 1;
+  for (const p of pdfs) c._display(p.url);
+  await new Promise((r) => setTimeout(r, 120));
+  out.firstBatches = [...batchSizes];
+  out.signedAfterFirst = Object.keys(c._signer.entries).length;
+
+  // переподписывание: все 201, снова батчами, ни одна запись не остаётся старой
+  batchSizes.length = 0;
+  round = 2;
+  c._resign();
+  await new Promise((r) => setTimeout(r, 120));
+  out.resignBatches = [...batchSizes];
+  const vals = Object.values(c._signer.entries).map((v) => v.url);
+  out.allRefreshed = vals.length === 201 && vals.every((u) => u.endsWith('authSig=R2'));
+
+  // ссылка, исчезнувшая из конфига, выбывает из кэша и не занимает слот
+  c._serverCfg = { ...c._serverCfg, markers: [{ id: 'mk1', pdfs: pdfs.slice(0, 5) }] };
+  c._cfgEpoch++;
+  batchSizes.length = 0;
+  round = 3;
+  c._resign();
+  await new Promise((r) => setTimeout(r, 120));
+  out.prunedTo = Object.keys(c._signer.entries).length;
+  out.pruneBatches = [...batchSizes];
+
+  // протухшая подпись не отдаётся: она вернула бы 401 и «попытку входа»
+  const one = pdfs[0].url;
+  c._signer.entries[one] = { url: one + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
+  out.expiredNotServed = c._display(one) === '';
+  out.expiredDropped = c._signer.entries[one] === undefined;
+  // а стареющая, но ещё живая — отдаётся, пока едет замена
+  c._signer.entries[one] = { url: one + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
+  out.agingStillServed = c._display(one) === one + '?authSig=AGING';
+  return out;
+});
+// зафиксировано прогоном на v1.45.0 и сверено с кодом
+checkAll(res, {
+  firstBatches: [200, 1],
+  signedAfterFirst: 201,
+  resignBatches: [200, 1],
+  allRefreshed: true,
+  prunedTo: 5,
+  pruneBatches: [5],
+  expiredNotServed: true,
+  expiredDropped: true,
+  agingStillServed: true,
+});
+await finish(browser);

demo/smoke_space_card_bg.mjs

@@ -0,0 +1,99 @@
+// Ревью R3-2: houseplan-space-card подписывала URL подложки и выбрасывала
+// результат — getCardSize() правил временную модель, а render() строил свою
+// заново из конфига, поэтому <image> запрашивал сырой requires_auth-путь и на
+// каждом рендере получал 401. Проверяем весь контракт подписи для этой карточки.
+import { launch, checkAll, finish } from './serve.mjs';
+const { page, browser } = await launch({ width: 900, height: 900 }, 1);
+const res = await page.evaluate(async () => {
+  const out = {};
+  await customElements.whenDefined('houseplan-space-card');
+  const main = window.__card;
+  const raw = '/api/houseplan/content/plans/_/f1.tok.svg';
+
+  // подложка на защищённом эндпоинте + управляемый ответ на подпись
+  const cfg = JSON.parse(JSON.stringify(main._serverCfg));
+  cfg.spaces = cfg.spaces.map((s) => (s.id === 'f1' ? { ...s, plan_url: raw } : s));
+  let signCalls = 0;
+  let failFirst = true;
+  const requestedHrefs = [];
+  const hass = { ...main.hass, callWS: async (m) => {
+    if (m.type === 'houseplan/config/get') return { config: cfg, rev: 1 };
+    if (m.type === 'houseplan/layout/get') return { layout: {} };
+    if (m.type === 'houseplan/content/sign') {
+      signCalls++;
+      if (failFirst && signCalls === 1) throw new Error('ws down');
+      const urls = {};
+      for (const p of m.paths) urls[p] = p + '?authSig=SIG' + signCalls;
+      return { urls };
+    }
+    return { ok: true };
+  } };
+
+  const host = document.createElement('div');
+  document.body.appendChild(host);
+  const card = document.createElement('houseplan-space-card');
+  card.setConfig({ type: 'custom:houseplan-space-card', space: 'f1' });
+  card.hass = hass;
+  host.appendChild(card);
+
+  const stage = async () => {
+    const t0 = Date.now();
+    while (!card.renderRoot?.querySelector('.hp-static-stage') && Date.now() - t0 < 6000) {
+      await new Promise((r) => setTimeout(r, 60));
+    }
+    await card.updateComplete;
+    return card.renderRoot.querySelector('.hp-static-stage svg image');
+  };
+  const href = async () => { const im = await stage(); return im ? im.getAttribute('href') : null; };
+
+  // 1) первая подпись упала → сырой URL в DOM не попадает (иначе 401)
+  await stage();
+  await new Promise((r) => setTimeout(r, 120));
+  out.hrefAfterFailedSign = await href();
+
+  // 2) сразу повтора нет: после ошибки подпись уходит в backoff (ревью R4-2),
+  //    иначе нестабильный сокет получал бы по запросу на каждый рендер
+  for (let i = 0; i < 5; i++) { card.requestUpdate(); await card.updateComplete; }
+  await new Promise((r) => setTimeout(r, 150));
+  out.noRetryStorm = signCalls === 1;
+
+  // 3) после выдержки повтор проходит
+  await new Promise((r) => setTimeout(r, 2100));
+  card.requestUpdate(); await card.updateComplete;
+  await new Promise((r) => setTimeout(r, 150));
+  out.hrefAfterRetry = await href();
+  out.retried = signCalls === 2;
+
+  // 4) повторный рендер не теряет подпись и не просит её заново
+  const before = signCalls;
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefStable = await href();
+  out.noExtraSignOnRerender = signCalls === before;
+
+  // 5) протухшая подпись не отдаётся, стареющая — отдаётся, пока едет замена
+  const ent = card._signer.entries;
+  ent[raw] = { url: raw + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefWhenExpired = await href();
+  ent[raw] = { url: raw + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
+  card.requestUpdate(); await card.updateComplete;
+  out.hrefWhenAging = await href();
+
+  // ни один сырой (неподписанный) путь не должен уходить в сеть
+  for (const im of card.renderRoot.querySelectorAll('image')) requestedHrefs.push(im.getAttribute('href'));
+  out.noRawHrefEver = !requestedHrefs.includes(raw);
+  return out;
+});
+// зафиксировано прогоном на v1.45.1 и сверено с кодом
+checkAll(res, {
+  hrefAfterFailedSign: null,
+  noRetryStorm: true,
+  hrefAfterRetry: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=SIG2',
+  retried: true,
+  hrefStable: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=SIG2',
+  noExtraSignOnRerender: true,
+  hrefWhenExpired: null,
+  hrefWhenAging: '/api/houseplan/content/plans/_/f1.tok.svg?authSig=AGING',
+  noRawHrefEver: true,
+});
+await finish(browser);

demo/smoke_svg_sandbox.mjs

@@ -0,0 +1,78 @@
+// HP-1454-01: загруженный SVG — пользовательский контент, который Home Assistant
+// отдаёт со своего origin. Внутри карточки он подключён через <image>, где
+// скрипты не выполняются, но тот же URL, открытый как отдельный документ,
+// становится живым документом этого origin: <script> в нём получает доступ к
+// localStorage сессии и к API. Проверяем, что заголовок sandbox это снимает,
+// и что обычный SVG при этом продолжает отображаться.
+import { chromium } from 'playwright';
+import { check, finish } from './serve.mjs';
+
+const EVIL = `<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="#eee"/>
+  <script>
+    document.title = 'HOUSEPLAN_XSS_EXECUTED';
+    try { localStorage.setItem('hp_xss', 'executed'); } catch (e) {}
+  </script>
+</svg>`;
+
+// ровно тот набор, который отдаёт HouseplanContentView для .svg
+const CSP = "sandbox; default-src 'none'; script-src 'none'; object-src 'none'; "
+  + "base-uri 'none'; form-action 'none'; style-src 'unsafe-inline'; img-src data:";
+
+const browser = await chromium.launch({ args: ['--no-sandbox'] });
+const ctx = await browser.newContext();
+
+async function serve(page, { csp }) {
+  await page.route('**/*', (route) => {
+    const url = route.request().url();
+    if (url.endsWith('/evil.svg')) {
+      const headers = { 'Content-Type': 'image/svg+xml', 'X-Content-Type-Options': 'nosniff' };
+      if (csp) headers['Content-Security-Policy'] = CSP;
+      return route.fulfill({ status: 200, headers, body: EVIL });
+    }
+    return route.fulfill({ status: 200, contentType: 'text/html', body: '<html><body>host</body></html>' });
+  });
+}
+
+// 1) как было до фикса: скрипт исполняется в origin Home Assistant
+const before = await ctx.newPage();
+await serve(before, { csp: false });
+await before.goto('https://ha.example/api/houseplan/content/plans/_/evil.svg');
+await before.waitForTimeout(200);
+const noCsp = await before.evaluate(() => ({
+  title: document.title,
+  storage: (() => { try { return localStorage.getItem('hp_xss'); } catch (e) { return 'blocked'; } })(),
+}));
+
+// 2) с заголовком: opaque origin, скрипт не выполняется, storage недоступен
+const after = await ctx.newPage();
+await serve(after, { csp: true });
+await after.goto('https://ha.example/api/houseplan/content/plans/_/evil.svg');
+await after.waitForTimeout(200);
+const withCsp = await after.evaluate(() => ({
+  title: document.title,
+  storage: (() => { try { return localStorage.getItem('hp_xss'); } catch (e) { return 'blocked'; } })(),
+}));
+
+// 3) тот же файл как <image> внутри страницы — рисуется и без скрипта
+const card = await ctx.newPage();
+await serve(card, { csp: true });
+await card.goto('https://ha.example/');
+const drawn = await card.evaluate(async () => {
+  const img = new Image();
+  const ok = await new Promise((res) => {
+    img.onload = () => res(true);
+    img.onerror = () => res(false);
+    img.src = '/api/houseplan/content/plans/_/evil.svg';
+  });
+  return { loaded: ok, width: img.naturalWidth, title: document.title };
+});
+
+check('без CSP скрипт выполняется (иначе тест ничего не доказывает)', noCsp.title, 'HOUSEPLAN_XSS_EXECUTED');
+check('без CSP скрипт пишет в storage origin', noCsp.storage, 'executed');
+check('с CSP скрипт не выполняется', withCsp.title !== 'HOUSEPLAN_XSS_EXECUTED', true);
+check('с CSP storage origin недоступен', withCsp.storage !== 'executed', true);
+check('SVG по-прежнему грузится как картинка', drawn.loaded, true);
+check('и имеет размеры', drawn.width, 100);
+check('картинка ничего не выполнила на странице-хосте', drawn.title, '');
+await finish(browser);

demo/smoke_ux_fixes.mjs

@@ -1,3 +1,5 @@
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { launch, checkAll, finish } from './serve.mjs';
 const { page, browser } = await launch({ width: 640, height: 980 }, 2);
 const res = await page.evaluate(async () => {
@@ -33,7 +35,10 @@ const res = await page.evaluate(async () => {
   out.nanGuard = !Number.isFinite(n) && c._spaceDialog.tempMax === before;
   return out;
 });
-await page.screenshot({ path: '/tmp/ux_dialog.png' });
+// артефакт для глазами: путь берём у ОС, а не хардкодим unix-овый — на Windows
+// '/tmp/...' указывает в несуществующий C:\tmp и смоук падал, не дойдя до
+// ассертов (портируемость, ревью 2026-07-27)
+await page.screenshot({ path: join(tmpdir(), 'houseplan_ux_dialog.png') }).catch(() => {});
 // значения зафиксированы прогоном на v1.43.1 и сверены с кодом (audit T1)
 checkAll(res, {
   "filledClass": 1,

docs/ARCHITECTURE.md

@@ -172,14 +172,86 @@ double click → properties dialog. In markup mode the "Opening" tool handles cl
 
 | Command | Parameters | Response |
 |---|---|---|
-| `houseplan/layout/get` | — | `{layout: {device_id: {x,y}}}` |
-| `houseplan/layout/set` | `layout` | `{ok}` (admin_only optional) |
-| `houseplan/layout/update` | `device_id`, `pos` | `{ok}` |
+| `houseplan/layout/get` | — | `{layout: {device_id: {x,y}}, rev}` |
+| `houseplan/layout/set` | `layout`, `expected_rev?` | `{ok, rev}` / err `conflict`; event `houseplan_layout_updated` |
+| `houseplan/layout/update` | `device_id`, `pos` | `{ok, rev}`; event `houseplan_layout_updated` |
 | `houseplan/config/get` | — | `{config, rev}` |
 | `houseplan/config/set` | `config`, `expected_rev?` | `{ok, rev}` / err `conflict`; event `houseplan_config_updated` |
-| `houseplan/plan/set` | `space_id`, `ext` (svg/png/jpg/webp), `data` (b64, ≤8 MB) | `{ok, url}` |
+| `houseplan/plan/set` | `space_id`, `ext` (svg/png/jpg/webp), `data` (b64, ≤8 MB) | `{ok, url}` — writes `<space>.<token>.<ext>`, deletes nothing |
 | `houseplan/file/set` | `marker_id`, `filename`, `data` (b64) | `{ok,url,name}` (legacy, WS limit) |
 
+**User content is served inert** (HP-1454-01). An uploaded SVG is the only
+thing here that a browser will happily treat as a *document* rather than an
+image, and it would be a document of Home Assistant's own origin. Inside the
+card that never matters — `<image>` does not run scripts — but the url is
+reachable directly, and uploading needs only write access, which by default
+every user has. `HouseplanContentView` therefore sends a `sandbox` CSP with SVG
+and only with SVG: a CSP on a PDF response can break the browser's built-in
+viewer, and a raster image has no execution model to disable.
+
+**Attachments follow the same commit-scoped lifecycle as plans** (HP-1454-02).
+An upload takes a free name and never overwrites, because the bytes under an
+existing name may be referenced by the stored configuration and an upload is
+not part of that transaction. `reserve_filename` *claims* the name as it picks
+it (`O_CREAT | O_EXCL`) — asking `exists()` and returning a string let two
+uploads agree on one name and quietly overwrite each other. It also budgets the
+length so the result survives the sanitiser the content view applies to the
+request, since a name the view rewrites is a file written and never served.
+Streaming temporaries live in the files root under `.upload-`, are removed on
+every exit path of the request (including cancellation, which is a
+BaseException and slips past `except Exception`), and are swept at startup and
+daily. That scheduled pass also runs the two collectors with the stored
+configuration as *both* sides — nothing superseded, so every referenced file is
+kept and only aged unreferenced ones go. Without it, collection would only ever
+happen when somebody saves, and a file uploaded into a dialog that was then
+cancelled would wait for a write that may never come. A new icon has no id yet, so its
+files go to a per-dialog staging folder and move to the real id once the config
+write is accepted — the same copy → save → cleanup order as a rebind.
+`config/set` collects what its commit superseded, and anything unreferenced and
+older than `PLAN_ORPHAN_TTL_S`.
+
+**Config writes are serialized** (HP-1454-03). `_writeConfig()` chains onto a
+single promise: one `config/set` in flight, each carrying the revision the
+previous one returned. The debounce still spaces out *when* a write starts;
+what it cannot do — and used to be relied on for — is keep two writes from
+overlapping, which produced a self-inflicted conflict and lost the newer edit.
+
+**Plan uploads are copy-on-write, and collection belongs to the commit**
+(reviews R2-1, R3-1). The file system is not part of the config's
+optimistic-locking transaction, so nothing referenced may be overwritten or
+deleted before the CAS succeeds: the upload writes a new versioned name and
+removes nothing. Deciding what may then go is *not* a client's call — a cleanup
+request cannot be ordered against another client's commit, and a delayed one
+deletes a plan that was just saved. So `config/set` collects itself, inside its
+write lock, from the pair of configurations that bracket the commit
+(`plans.collect_plans`): superseded files go immediately, other unreferenced
+uploads only once `PLAN_ORPHAN_TTL_S` has passed, since a fresh one may belong
+to a transaction still in flight. The `.` between id and token is load-bearing —
+a space id cannot contain one, so `<space>.<token>.<ext>` can never be confused
+with the files of a space whose name merely starts the same way.
+
+**Signed content urls are batched, aged and deduplicated** (reviews R2-2, R3-2, R4-2). `ContentSigner`
+in `src/signing.ts` is the single implementation, used by both cards; the
+duplicate inside houseplan-space-card signed correctly and never handed the
+result to its renderer, which is the failure mode a second copy invites. `MAX_SIGN_PATHS`
+(200) is a shared contract between `logic.ts` and `const.py`: the backend caps a
+request there and says nothing about the rest, so the card must chunk. Cached
+signatures carry the time they were issued — an aging one keeps rendering while
+its replacement is fetched, an expired one is dropped rather than served (it
+would 401 and raise a failed-login warning). The cache is pruned to the urls the
+live config references, so it cannot grow past the cap through history alone.
+Queued and in-flight are distinct states: a render happening while a request is
+out must not queue the same url again, a failure backs off rather than retrying
+on the next frame, and an in-flight entry expires after `SIGN_INFLIGHT_MS` so a
+promise that never settles cannot block retries forever.
+
+**Room climate is one pass per hass snapshot** (review R2-3). `areaClimateMap()`
+classifies the whole registry once and returns `Map<area, {temp, hum}>`; the
+card memoizes it on `hass` identity, which Home Assistant replaces on every
+state change. Per-room lookups are O(1). `areaClimate()` survives as a
+single-area wrapper for tests — using it in a render reintroduces the
+O(rooms × entities) cost it was extracted from.
+
 **File uploads go over HTTP** (not WS, which has a message-size limit): `POST /api/houseplan/upload`
 (multipart: marker_id + file), HomeAssistantView, requires_auth. Served from `/houseplan_files/files/`.
 

docs/CHANGELOG.md

@@ -1,5 +1,265 @@
 # Changelog
 
+## v1.46.3 — 2026-07-28 (re-check of v1.46.2: HP-1462-01)
+- **The cleanup at startup now actually cleans up.** It looked its own runtime
+  data up by domain, and during startup Home Assistant does not yet consider
+  the integration loaded — so the lookup came back empty and the pass quietly
+  degraded to removing half-finished transfers, leaving the real work to a timer
+  24 hours away. Restart more often than that and it never ran at all. It uses
+  the object it was given at startup now.
+- **The test that was supposed to prove this was passing for the wrong
+  reason.** It created the stray files *before* saving the configuration — and
+  saving collects too, so everything was already gone by the time the restart
+  happened. Rewritten to seed after the save, plus a second test that fires the
+  scheduled timer on its own, and a third that runs a restart and a save at the
+  same time and asserts the accepted configuration never points at a file the
+  cleanup removed.
+
+## v1.46.2 — 2026-07-28 (re-check of v1.46.1: HP-1461-01, -02)
+- **A file nobody ended up using is now cleaned up even if nothing is ever
+  saved again (HP-1461-01).** Collection is tied to a configuration write,
+  which is right for what a write supersedes but leaves a gap: cancel a dialog
+  after the file has already uploaded, lose the connection just after, or call
+  the upload API directly, and nothing references the file and no future write
+  notices it. The daily sweep added in v1.46.1 only removed half-finished
+  transfers, so the promise that a cancelled attachment disappears after an hour
+  did not hold on an instance nobody edits. The sweep now compares against the
+  stored configuration — under the same lock a write uses — and collects aged
+  unreferenced attachments and plans as well.
+- **A drag is no longer undone by someone else's move (HP-1461-02).** When the
+  full card learned to follow position changes in v1.46.1, it protected the
+  positions you had moved but not yet sent — except it read that list *after*
+  flushing the pending write, and flushing empties it first. In a real drag,
+  where a write is already scheduled, the list was therefore empty and the
+  server's older position was painted over your move. The card now takes the
+  snapshot before flushing and also holds on to positions that are sent but not
+  yet acknowledged: until the server confirms a position, the card that moved it
+  is the authority on it.
+- Two tests grew up to their docstrings: the upload test now actually cancels
+  the request task instead of only exercising error paths, and the position-sync
+  smoke schedules a real debounced write and delays it, which is the ordering
+  that lost the drag.
+
+## v1.46.1 — 2026-07-28 (re-check of v1.46.0: HP-1460-01 … -03)
+- **Two uploads of the same file name can no longer collide (HP-1460-01).**
+  v1.46.0 stopped overwriting attachments, but choosing a free name and taking
+  it were two steps: two uploads racing between them agreed on the same name,
+  both reported success, and one set of bytes replaced the other. The name is
+  now claimed atomically as it is chosen — twenty simultaneous uploads of
+  `manual.pdf` produce twenty files. The same helper is used when rebinding
+  moves files, which had the same gap.
+  Also fixed there: a name at the length limit lost its extension, and the
+  collision suffix pushed it past the limit, so the attachment was stored under
+  a name the server would not serve back — a permanent 404 on a file the UI
+  reported as attached.
+- **An interrupted upload no longer leaves a temporary file forever
+  (HP-1460-02).** Cleanup ran in an `except Exception`, which a cancelled
+  request walks straight past, and the collector only ever looks inside marker
+  folders — so an aborted transfer left a `.upload-*` in place with nothing able
+  to remove it. Every exit path now cleans up, a request carrying two files is
+  refused outright, and abandoned temporaries are swept at startup and daily.
+  Uploads also write in 1 MB batches instead of one disk task per 64 KB.
+- **Two full cards side by side keep the same positions (HP-1460-03).** v1.46.0
+  taught the static card to follow position changes and left the full one
+  behind, so dragging an icon in one window did not move it in another until a
+  reload. It follows now, without disturbing a drag of its own: a revision
+  arriving mid-drag is merged rather than applied over the top, and a card does
+  not re-read what it just wrote itself.
+
+## v1.46.0 — 2026-07-28 (full external audit of v1.45.4: HP-1454-01 … -10)
+
+**Security**
+
+- **An uploaded SVG plan is no longer a live document of your Home Assistant
+  origin (HP-1454-01, high — release blocker).** Inside the card a plan is
+  referenced by `<image>`, where scripts never run; but the same url opened
+  directly became a top-level document of HA's own origin, and a `<script>` in
+  it could read the session's `localStorage` and call the API. Uploading needs
+  write access, which by default every authenticated user has, and a signed url
+  is easy to hand to an administrator. Plan responses for SVG now carry a
+  `sandbox` Content-Security-Policy, which drops the document into an opaque
+  origin. Only SVG gets it — a CSP on a PDF can break the browser's built-in
+  viewer, and a raster image cannot execute anything. Nothing changes for
+  existing plans: the card renders them exactly as before.
+
+**Data integrity**
+
+- **A manual attached to a device no longer overwrites the previous one
+  (HP-1454-02).** The upload wrote straight to `<marker>/<filename>`, outside
+  the configuration transaction: cancelling the dialog, or a rejected save, left
+  the stored url serving the new bytes. And every new icon uploaded into one
+  shared folder, so two of them attaching `manual.pdf` ended up pointing at the
+  same physical file. Uploads now take a free name and never overwrite, a new
+  icon gets its own staging folder whose files move to the real icon when the
+  save is accepted, and an upload nobody saved is collected an hour later. The
+  name a collision falls back to changed from `manual (2).pdf` to `manual-2.pdf`
+  — the old one was sanitised on the way back in, so a renamed attachment was
+  written and then never served (found by the new test, and it applied to
+  rebind collisions before this release too).
+- **Two quick edits can no longer lose the second one (HP-1454-03).** The
+  debounce spaced out the starts of a save, not the saves themselves. If one
+  took longer than half a second — a busy instance, a slow link — the next edit
+  went out with the same revision, the server accepted the first and rejected
+  the second, and the conflict handler reloaded the server copy over the local
+  one. The edit was gone, with a message blaming another window when there was
+  none. Writes are now serialized: one at a time, each carrying the revision the
+  previous one returned.
+
+**Correctness and limits**
+
+- **Open boundaries follow the geometry again (HP-1454-04).** Their cache was
+  keyed on room ids and links only, so changing a space's aspect ratio or
+  dragging a vertex left the open boundaries — and the light spilling through
+  them — at their old coordinates until a reload. The cache is now keyed on the
+  rendered model itself, which is exactly what it is computed from.
+- **The configuration can no longer be made arbitrarily heavy (HP-1454-05).**
+  The outer collections were capped; the ones inside them were not. A polygon
+  with 150 000 points, or a list of 100 000 device ids, validated fine and then
+  made every render walk it. There are now limits on polygon vertices, open-to
+  links, controls, attachments, text and url lengths, plus a cap on the whole
+  serialized configuration. The obsolete `segments` field is dropped by the
+  server instead of trusting the card to strip it.
+- **Large files stream instead of being held in memory (HP-1454-06).** A 50 MB
+  manual was read whole into memory on the way in and again on the way out; a
+  couple of parallel downloads were real pressure on a small Home Assistant
+  host. Uploads stream to a temporary file, downloads stream from disk.
+
+**Consistency**
+
+- **The static space card honours per-room fill settings (HP-1454-07).** It
+  builds its model with a different function, and room settings were not carried
+  into it, so a room you had set to "no fill" was still painted.
+- **Moving an icon updates the static card immediately (HP-1454-08).** Layout is
+  separate state with no revision and no event: a drag on the full card left a
+  static card next to it showing the old position until the configuration
+  changed or the page was reloaded. Layout writes now keep a revision, return
+  it, and announce themselves — which also makes the optimistic locking on a
+  wholesale layout write mean something, since a point-wise write used to reset
+  the counter.
+- **A repair warning about a missing plan disappears with its space
+  (HP-1454-09).** The cleanup only looked at spaces that still exist, so
+  deleting or renaming one left its warning in Repairs with nothing able to
+  clear it.
+- Build chain: `serialize-javascript` pinned past two advisories (HP-1454-10).
+  Not reachable at runtime and production dependencies were already clean, but
+  it is one line.
+
+## v1.45.4 — 2026-07-28 (review of v1.45.3: R5-1, R5-2)
+- **A partly successful signing answer no longer skips the backoff (R5-1).**
+  The backend signs each path independently: one it cannot sign is logged,
+  skipped, and the call still succeeds with the remaining urls. The card took
+  any successful call as "the whole batch is done", cleared the backoff for
+  every path in it, and then wrote only the urls that came back — so a path the
+  backend kept skipping was requested again on every single render, which is
+  exactly the amplification v1.45.2 added the backoff to prevent. A path is now
+  counted as signed only if the answer actually carries a url for it; the rest
+  back off individually, keys nobody asked for are ignored, and a re-render is
+  only triggered when at least one new signature arrived.
+- **The status snapshot no longer contradicts the repository (R5-2).** It still
+  described `main` as carrying releases up to v1.40.1 and quoted test counts
+  from several releases back, while the version line right beside them was kept
+  current — a maintainer or an agent reading it for handoff got a wrong branch
+  model and a smaller picture of the coverage than exists. The branch roles are
+  described accurately, and the counts are gone: `npm run inventory` prints them
+  from the tree, so there is nothing left to go stale.
+
+## v1.45.3 — 2026-07-27
+- **"Value instead of an icon" could not be saved (issue #3).** The option was
+  added to the device editor in v1.26.0, but the server-side schema only ever
+  accepted `badge`, `ripple` and `icon_ripple`. Choosing it produced
+  `not a valid value for dictionary value @ data['config']['markers'][n]['display']`
+  — and because a single rejected marker fails the whole configuration write,
+  the plan could not be saved at all until the setting was undone. Thanks to
+  @RemyRoux for the report and the exact error text.
+- **The option lists now live in one place and are checked across languages.**
+  `DISPLAY_MODES`, `TAP_ACTIONS`, `SPACE_FILL_MODES` and `ROOM_FILL_MODES` are
+  exported from the card and read by a backend test that asserts the schema
+  accepts every value a user can actually pick. Adding an option to an editor
+  and forgetting the schema now fails the test suite instead of surfacing
+  through somebody's error message.
+
+## v1.45.2 — 2026-07-27 (hardening from the v1.45.1 review: R4-1, R4-2)
+- **A failed cleanup no longer reports an accepted save as an error (R4-1).**
+  Collecting superseded plan files runs after the configuration is already
+  stored, but an error while listing the directory — it can vanish or turn
+  unreadable between the check and the walk — propagated out of `config/set`.
+  The client then saw a failure for a revision the server had committed, and its
+  retry came back as a conflict. The collector now reports "nothing collected"
+  instead of raising, and `config/set` logs and proceeds: the event fires and
+  the new revision is returned.
+- **One signing request per url instead of one per render (R4-2).** The pending
+  set was cleared when the batch went out rather than when it came back, so
+  while a `content/sign` call was in flight every re-render queued another one —
+  six calls where one was needed, and far worse on a socket that is slow rather
+  than merely busy. Queued and in-flight are now separate states, a failure
+  backs off (2 s doubling to 60 s) instead of retrying on the next frame, and a
+  request that never settles stops blocking retries after 15 s. A late answer
+  arriving after the card was torn down no longer triggers a render.
+- Tests: eight unit tests for the signer with hand-settled promises (four fail
+  on v1.45.1), a backend test asserting a broken collector still yields a
+  successful save with a usable revision, and the pure-collector test extended
+  to a disappearing directory.
+
+## v1.45.1 — 2026-07-27 (follow-up review of v1.45.0: R3-1, R3-2)
+- **Collecting old plan files moved into the config transaction (R3-1, high).**
+  v1.45.0 made the upload safe but handed the deletion to the client: after a
+  successful save the card asked the backend to remove everything except the
+  file it had just committed. Two open editors could not be ordered — a delayed
+  request from one client deleted the plan the other had just saved, and the
+  accepted configuration was left pointing at nothing, which is the exact damage
+  copy-on-write was added to prevent. The `houseplan/plan/cleanup` command is
+  gone. `config/set` now collects inside its own write lock, comparing the
+  configuration it replaced with the one it accepted: a file the old revision
+  referenced and the new one does not is removed, and any other unreferenced
+  upload is left alone until it is an hour old, because a fresh one may belong
+  to a transaction that has not committed yet.
+- **The static space card shows its plan background again (R3-2).** It signed
+  the url and then threw the result away — `getCardSize()` mutated a throwaway
+  model while `render()` rebuilt its own from the config — so the `<image>` kept
+  requesting the protected path and got a 401 on every render. Both cards now
+  share one signer, which also gives the static card the batching, the
+  expiry handling and the periodic re-signing the main card already had. Its
+  pending set is released in `finally`, so a single failed request no longer
+  wedges a url for the life of the page.
+- New tests: five backend cases for the two-client interleavings from the report
+  (late commit, uncommitted upload, aged orphan, foreign files, rejected save),
+  the collector extracted to a pure module and unit-tested, and
+  `smoke_space_card_bg` for the signed background — it fails on v1.45.0 with the
+  raw url in the DOM.
+
+## v1.45.0 — 2026-07-27 (external review of v1.44.8: R2-1, R2-2, R2-3)
+- **A rejected save can no longer damage a working plan (R2-1, high).** The
+  plan file was written to its final name — deleting the previous extension on
+  the way — *before* the revision-checked config write. If that write was then
+  rejected (revision conflict, validation, lost connection), the live plan had
+  already been replaced, or the stored config was left pointing at a file that
+  no longer existed. Uploads now go to a versioned name
+  (`<space>.<token>.<ext>`) and nothing is deleted; the card asks the backend to
+  drop the superseded files only after the config write is accepted. A crash in
+  between leaves one orphan, which the next successful upload collects.
+- **Signed urls no longer expire for good on long-lived screens (R2-2).** The
+  backend signs at most 200 paths per request and silently ignores the rest,
+  while the card sent its whole cache in one call and treated any cached entry
+  as valid forever. Past 200 attachments the later ones stopped being refreshed
+  and, 24 hours in, quietly broke. Requests are now batched to the shared limit,
+  entries carry their age (aging urls keep working while a replacement is
+  fetched, expired ones are never served), and the cache is pruned to the urls
+  the current config still references.
+- **Room climate is computed once per update instead of once per room (R2-3).**
+  Each room asked for temperature and humidity separately, and every ask
+  rescanned the entire entity registry: with 60 rooms and 2000 entities that is
+  ~120 traversals per render, enough to spend a whole frame on metadata that had
+  not changed. One pass now builds a map for all areas, keyed on the Home
+  Assistant snapshot, so fresh states are always observed while unrelated
+  re-renders cost nothing. Measured in the smoke: 133 registry scans per update
+  before, 2 after — and no longer growing with the number of rooms.
+- `smoke_ux_fixes` wrote its screenshot to a hard-coded `/tmp` path and could
+  not run on Windows; it uses the OS temp directory now.
+- New tests: `smoke_plan_upload_reject` (cleanup happens only after an accepted
+  save), `smoke_sign_cap` (201 urls, batching, pruning, expiry),
+  `smoke_climate_once` (scan count does not grow with rooms), plus backend
+  coverage for the versioned plan names and unit tests for the new helpers.
+
 ## v1.44.8 — 2026-07-27
 - **An uploaded plan is actually attached to the space.** `_saveSpaceDialog`
   held a reference to the space object across the `await` that uploads the

docs/CHANGELOG.ru.md

@@ -6,6 +6,271 @@
 > **Правило проекта:** оба файла пополняются в одном коммите с самим
 > изменением — как и остальная документация (см. docs/STATUS.md).
 
+## v1.46.3 — 2026-07-28 (перепроверка v1.46.2: HP-1462-01)
+- **Уборка при старте действительно убирает.** Она искала свои же runtime-данные
+  по домену, а во время запуска Home Assistant ещё не считает интеграцию
+  загруженной — поэтому поиск возвращал пустоту, и проход тихо вырождался в
+  удаление незавершённых передач, оставляя настоящую работу таймеру через
+  24 часа. При перезапусках чаще, чем раз в сутки, она не выполнялась вообще.
+  Теперь используется объект, который у неё и так был на руках.
+- **Тест, который должен был это доказать, проходил по неверной причине.** Он
+  создавал лишние файлы *до* сохранения конфигурации, а сохранение тоже
+  собирает мусор — так что к моменту перезапуска убирать было уже нечего.
+  Переписан: файлы создаются после сохранения; добавлен второй тест, который
+  дёргает плановый таймер отдельно, и третий, который запускает перезапуск и
+  сохранение одновременно и проверяет, что принятая конфигурация никогда не
+  ссылается на удалённый уборкой файл.
+
+## v1.46.2 — 2026-07-28 (перепроверка v1.46.1: HP-1461-01, -02)
+- **Файл, который в итоге никому не понадобился, убирается, даже если больше
+  ничего не сохраняют (HP-1461-01).** Сборка привязана к записи конфигурации —
+  это верно для того, что запись вытесняет, но оставляет зазор: отмените диалог
+  после того, как файл уже загрузился, потеряйте связь сразу после, или
+  вызовите API загрузки напрямую — и на файл никто не ссылается, а будущей
+  записи, которая бы это заметила, нет. Добавленное в v1.46.1 ежедневное
+  подметание убирало только незавершённые передачи, поэтому обещание «отменённое
+  вложение исчезнет через час» не выполнялось там, где никто ничего не правит.
+  Теперь подметание сверяется с сохранённой конфигурацией — под той же
+  блокировкой, что и запись, — и собирает устаревшие непривязанные вложения и
+  планы тоже.
+- **Перетаскивание больше не отменяется чужим перемещением (HP-1461-02).** Когда
+  в v1.46.1 полная карточка научилась следить за позициями, она защищала те,
+  что вы подвинули, но ещё не отправили, — вот только читала этот список *после*
+  сброса отложенной записи, а сброс его первым делом опустошает. При настоящем
+  перетаскивании, когда запись уже запланирована, список оказывался пустым, и
+  старая серверная позиция закрашивала ваше движение. Теперь снимок снимается до
+  сброса, и вдобавок удерживаются позиции, отправленные, но ещё не
+  подтверждённые: пока сервер не подтвердил позицию, авторитет по ней — та
+  карточка, которая её подвинула.
+- Два теста доросли до своих же описаний: тест загрузки теперь действительно
+  отменяет задачу запроса, а не только проходит по путям ошибок, а смоук
+  синхронизации позиций планирует настоящую отложенную запись и задерживает её —
+  именно этот порядок и терял перетаскивание.
+
+## v1.46.1 — 2026-07-28 (перепроверка v1.46.0: HP-1460-01 … -03)
+- **Две загрузки с одинаковым именем больше не сталкиваются (HP-1460-01).**
+  v1.46.0 перестала затирать вложения, но выбор свободного имени и его занятие
+  были двумя шагами: две загрузки, попавшие между ними, сходились на одном
+  имени, обе рапортовали успех, и одни байты заменяли другие. Теперь имя
+  занимается атомарно в момент выбора — двадцать одновременных загрузок
+  `manual.pdf` дают двадцать файлов. Тот же механизм используется при переносе
+  файлов на перепривязке, где был ровно такой же зазор.
+  Заодно там же: имя предельной длины теряло расширение, а суффикс коллизии
+  выталкивал его за предел, и вложение сохранялось под именем, которое сервер
+  обратно не отдаёт — вечный 404 на файл, который интерфейс считал
+  прикреплённым.
+- **Прерванная загрузка больше не оставляет временный файл навсегда
+  (HP-1460-02).** Уборка стояла в `except Exception`, мимо которого отменённый
+  запрос проходит насквозь, а сборщик заглядывает только в папки маркеров —
+  поэтому оборванная передача оставляла `.upload-*`, и убрать его было некому.
+  Теперь убирает любой путь выхода, запрос с двумя файлами отклоняется сразу, а
+  брошенные временные подметаются при старте и раз в сутки. Запись идёт
+  порциями по мегабайту, а не отдельной задачей на каждые 64 КБ.
+- **Две полные карточки рядом держат одинаковые позиции (HP-1460-03).** v1.46.0
+  научила следить за перемещениями статическую карточку и оставила позади
+  полную, поэтому перетаскивание иконки в одном окне не двигало её в другом до
+  перезагрузки. Теперь следит — и не мешает собственному перетаскиванию: чужая
+  ревизия, пришедшая в его разгар, сливается, а не накатывается сверху, и
+  карточка не перечитывает то, что записала сама.
+
+## v1.46.0 — 2026-07-28 (полный внешний аудит v1.45.4: HP-1454-01 … -10)
+
+**Безопасность**
+
+- **Загруженный SVG-план больше не является живым документом origin вашего
+  Home Assistant (HP-1454-01, high — блокер релиза).** Внутри карточки план
+  подключён через `<image>`, где скрипты не выполняются; но тот же URL,
+  открытый напрямую, становился документом верхнего уровня в origin самого HA,
+  и `<script>` в нём мог читать `localStorage` сессии и обращаться к API. Для
+  загрузки нужно право записи, а оно по умолчанию есть у каждого
+  аутентифицированного пользователя, и подписанную ссылку несложно передать
+  администратору. Ответы с SVG теперь несут заголовок Content-Security-Policy
+  `sandbox`, который помещает документ в opaque origin. Только SVG — CSP на PDF
+  способен сломать встроенный просмотрщик браузера, а растровая картинка ничего
+  выполнить не может. Для существующих планов ничего не меняется: карточка
+  рисует их ровно как раньше.
+
+**Целостность данных**
+
+- **Инструкция, приложенная к устройству, больше не затирает предыдущую
+  (HP-1454-02).** Загрузка писала прямо в `<маркер>/<имя файла>`, вне
+  транзакции конфигурации: отмена диалога или отвергнутое сохранение оставляли
+  сохранённую ссылку указывающей на новые байты. А все новые иконки грузили в
+  одну общую папку, поэтому две с файлом `manual.pdf` начинали ссылаться на
+  один физический файл. Теперь загрузка занимает свободное имя и никогда не
+  перезаписывает, новая иконка получает собственную промежуточную папку, файлы
+  из которой переезжают к настоящей иконке при принятом сохранении, а загрузка,
+  которую никто не сохранил, убирается через час. Имя, на которое уходит
+  коллизия, сменилось с `manual (2).pdf` на `manual-2.pdf`: старое санитайзилось
+  на обратном пути, поэтому переименованное вложение записывалось и больше не
+  отдавалось (нашёл новый тест; до этого релиза так же ломались коллизии при
+  перепривязке).
+- **Две быстрые правки больше не теряют вторую (HP-1454-03).** Debounce
+  разносил старты сохранения, а не сами сохранения. Если одно длилось дольше
+  полусекунды — занятый сервер, медленная связь, — следующая правка уходила с
+  той же ревизией, сервер принимал первую и отклонял вторую, а обработчик
+  конфликта перечитывал серверную копию поверх локальной. Правка исчезала, и
+  сообщение винило «другое окно», которого не было. Записи сериализованы: по
+  одной за раз, каждая с ревизией, которую вернула предыдущая.
+
+**Корректность и пределы**
+
+- **Открытые границы снова следуют за геометрией (HP-1454-04).** Их кэш
+  ключевался только по id комнат и связям, поэтому смена пропорций
+  пространства или перетаскивание вершины оставляли открытые границы — и свет,
+  который через них проходит, — в старых координатах до перезагрузки. Ключом
+  стала сама отрисованная модель, из которой они и вычисляются.
+- **Конфигурацию больше нельзя сделать сколь угодно тяжёлой (HP-1454-05).**
+  Внешние коллекции были ограничены, вложенные — нет. Полигон на 150 000 точек
+  или список из 100 000 идентификаторов проходили валидацию, а потом каждый
+  рендер по ним ходил. Появились пределы на вершины полигона, связи открытых
+  границ, управляемые сущности, вложения, длину текста и ссылок, плюс общий
+  предел размера сериализованной конфигурации. Устаревшее поле `segments`
+  отбрасывает сервер, а не надежда на современный клиент.
+- **Большие файлы передаются потоком, а не через память (HP-1454-06).**
+  Инструкция на 50 МБ целиком читалась в память на приёме и ещё раз на отдаче;
+  пара параллельных скачиваний — заметная нагрузка на слабый хост Home
+  Assistant. Загрузка пишется во временный файл потоком, отдача идёт с диска.
+
+**Согласованность**
+
+- **Статическая карточка пространства учитывает настройки заливки комнаты
+  (HP-1454-07).** Она строит модель другой функцией, и настройки комнаты в неё
+  не переносились — комната, которой вы выключили заливку, всё равно
+  закрашивалась.
+- **Перемещение иконки сразу видно на статической карточке (HP-1454-08).**
+  Layout — отдельное состояние без ревизии и без события: перетаскивание на
+  полной карточке оставляло соседнюю статическую со старой позицией до
+  изменения конфигурации или перезагрузки страницы. Теперь записи layout хранят
+  ревизию, возвращают её и сообщают о себе — заодно оптимистическая блокировка
+  на полной записи layout начала что-то значить, ведь точечная запись раньше
+  сбрасывала счётчик.
+- **Предупреждение о пропавшем плане исчезает вместе с пространством
+  (HP-1454-09).** Уборка смотрела только на существующие пространства, поэтому
+  удаление или переименование оставляло предупреждение в «Ремонте» навсегда.
+- Сборка: `serialize-javascript` поднят выше двух advisory (HP-1454-10). В
+  рантайме недостижим, production-зависимости и так были чисты, но это одна
+  строка.
+
+## v1.45.4 — 2026-07-28 (ревью v1.45.3: R5-1, R5-2)
+- **Частично успешный ответ на подпись больше не пропускает выдержку (R5-1).**
+  Бэкенд подписывает каждый путь независимо: тот, что подписать не удалось,
+  логируется, пропускается, и вызов всё равно завершается успешно с остальными
+  ссылками. Карточка считала любой успешный вызов «весь батч готов», сбрасывала
+  выдержку для всех путей в нём и записывала только вернувшиеся ссылки — и путь,
+  который бэкенд стабильно пропускал, запрашивался заново на каждом рендере, то
+  есть ровно то усиление, ради которого выдержка и вводилась в v1.45.2. Теперь
+  путь считается подписанным, только если в ответе действительно есть ссылка на
+  него; остальные уходят в выдержку по отдельности, ключи, которых не просили,
+  игнорируются, а перерисовка запускается лишь при появлении хотя бы одной новой
+  подписи.
+- **Снимок состояния больше не противоречит репозиторию (R5-2).** Там всё ещё
+  было написано, что в `main` лежат релизы только до v1.40.1, и приводились
+  счётчики тестов на несколько релизов назад — при том что строка версии рядом
+  исправно обновлялась. Читающий его человек или агент получал неверную
+  модель веток и заниженное представление о покрытии. Роли веток описаны точно,
+  а счётчики убраны: `npm run inventory` печатает их из дерева, и устаревать
+  больше нечему.
+
+## v1.45.3 — 2026-07-27
+- **«Значение вместо иконки» невозможно было сохранить (issue #3).** Опция
+  появилась в редакторе устройств ещё в v1.26.0, но серверная схема всё это
+  время принимала только `badge`, `ripple` и `icon_ripple`. При её выборе
+  сохранение падало с
+  `not a valid value for dictionary value @ data['config']['markers'][n]['display']`,
+  а поскольку один отвергнутый маркер валит всю запись конфигурации, план не
+  сохранялся вообще, пока настройку не отменишь. Спасибо @RemyRoux за отчёт и
+  точный текст ошибки.
+- **Списки опций теперь в одном месте и сверяются между языками.**
+  `DISPLAY_MODES`, `TAP_ACTIONS`, `SPACE_FILL_MODES` и `ROOM_FILL_MODES`
+  экспортируются из карточки, и backend-тест читает их, проверяя, что схема
+  принимает каждое значение, которое пользователь реально может выбрать.
+  Теперь добавить опцию в редактор и забыть про схему — значит уронить тесты, а
+  не узнать об этом из чужого сообщения об ошибке.
+
+## v1.45.2 — 2026-07-27 (закалка по ревью v1.45.1: R4-1, R4-2)
+- **Сбой уборки больше не превращает принятое сохранение в ошибку (R4-1).**
+  Сборка вытесненных файлов плана идёт уже после того, как конфигурация
+  сохранена, но ошибка при обходе каталога — он может исчезнуть или стать
+  недоступным между проверкой и обходом — вылетала наружу из `config/set`.
+  Клиент видел неудачу для ревизии, которую сервер закоммитил, а его повтор
+  возвращался с конфликтом. Теперь сборщик сообщает «ничего не убрано» вместо
+  исключения, а `config/set` пишет в лог и продолжает: событие уходит, новая
+  ревизия возвращается.
+- **Один запрос подписи на ссылку вместо одного на рендер (R4-2).** Множество
+  ожидающих очищалось в момент отправки батча, а не по возвращении, поэтому
+  пока запрос `content/sign` был в полёте, каждая перерисовка ставила ещё
+  один — шесть вызовов там, где нужен один, и куда хуже на медленном (а не
+  просто занятом) сокете. Состояния «в очереди» и «в полёте» теперь разделены,
+  после ошибки включается выдержка (2 с с удвоением до 60 с) вместо повтора на
+  следующем кадре, а запрос, который так и не завершился, перестаёт блокировать
+  повторы через 15 с. Поздний ответ, пришедший после размонтирования карточки,
+  больше не вызывает перерисовку.
+- Тесты: восемь юнит-тестов подписывателя с ручным разрешением promise (четыре
+  падают на v1.45.1), backend-тест на то, что сломанный сборщик оставляет
+  сохранение успешным с рабочей ревизией, и проверка исчезнувшего каталога в
+  тестах чистого сборщика.
+
+## v1.45.1 — 2026-07-27 (повторное ревью v1.45.0: R3-1, R3-2)
+- **Уборка старых файлов плана перенесена внутрь транзакции конфига (R3-1,
+  high).** v1.45.0 сделала загрузку безопасной, но отдала удаление клиенту:
+  после успешного сохранения карточка просила бэкенд убрать всё, кроме только
+  что закоммиченного файла. Два открытых редактора невозможно упорядочить —
+  задержавшийся запрос одного клиента удалял план, который только что сохранил
+  другой, и принятая конфигурация оставалась со ссылкой в пустоту, то есть
+  ровно с тем ущербом, ради которого вводился copy-on-write. Команда
+  `houseplan/plan/cleanup` убрана. Теперь `config/set` убирает сам, под своей
+  блокировкой, сравнивая конфигурацию, которую заменил, с той, которую принял:
+  файл, на который ссылалась старая ревизия и не ссылается новая, удаляется, а
+  любая другая непривязанная загрузка не трогается, пока ей не исполнится час —
+  свежая может принадлежать ещё не завершённой чужой транзакции.
+- **Статическая карточка пространства снова показывает подложку (R3-2).** Она
+  подписывала URL и выбрасывала результат — `getCardSize()` правил временную
+  модель, а `render()` строил свою заново из конфига, — поэтому `<image>`
+  запрашивал защищённый путь и на каждом рендере получал 401. Обе карточки
+  теперь используют один подписыватель, и статическая заодно получила батчи,
+  учёт срока годности и периодическое переподписывание, которые были только у
+  основной. Её множество ожидающих запросов освобождается в `finally`, так что
+  одна неудача больше не блокирует ссылку до конца жизни страницы.
+- Новые тесты: пять backend-сценариев чередования двух клиентов из отчёта
+  (поздний коммит, незакоммиченная загрузка, устаревший сирота, чужие файлы,
+  отвергнутое сохранение), сборщик вынесен в чистый модуль и покрыт юнит-
+  тестами, плюс `smoke_space_card_bg` на подписанный фон — он падает на
+  v1.45.0, где в DOM попадает сырой URL.
+
+## v1.45.0 — 2026-07-27 (внешнее ревью v1.44.8: R2-1, R2-2, R2-3)
+- **Отвергнутое сохранение больше не может испортить рабочий план (R2-1,
+  high).** Файл плана записывался под финальным именем — попутно удаляя вариант
+  с другим расширением — *до* проверки ревизии конфига. Если запись потом
+  отвергалась (конфликт ревизий, валидация, обрыв связи), живой план оказывался
+  уже подменён, а сохранённый конфиг мог ссылаться на удалённый файл. Теперь
+  загрузка идёт в версионированное имя (`<space>.<токен>.<ext>`) и ничего не
+  удаляется; карточка просит бэкенд убрать устаревшие файлы только после
+  принятой записи конфига. Падение между шагами оставляет один осиротевший
+  файл, который подберёт следующая успешная загрузка.
+- **Подписанные ссылки больше не протухают навсегда на долгоживущих экранах
+  (R2-2).** Бэкенд подписывает не более 200 путей за запрос и молча отбрасывает
+  остальные, а карточка отправляла весь кэш одним вызовом и считала любую
+  запись годной вечно. Начиная с 201-го вложения поздние ссылки переставали
+  обновляться и через 24 часа тихо ломались. Теперь запросы бьются на батчи по
+  общему лимиту, записи помнят свой возраст (стареющая ссылка работает, пока
+  едет замена, протухшая не отдаётся вовсе), а кэш чистится до ссылок, на
+  которые конфиг всё ещё ссылается.
+- **Климат комнат считается один раз на обновление, а не на каждую комнату
+  (R2-3).** Каждая комната запрашивала температуру и влажность по отдельности,
+  и каждый запрос заново обходил весь реестр сущностей: 60 комнат и 2000
+  сущностей — это ~120 обходов на рендер, целый кадр на метаданные, которые не
+  менялись. Теперь один проход строит карту по всем зонам с привязкой к снимку
+  Home Assistant: свежие состояния видны всегда, а посторонние перерисовки не
+  стоят ничего. Замер в смоуке: 133 обхода реестра на обновление до, 2 после —
+  и число больше не растёт с числом комнат.
+- `smoke_ux_fixes` писал скриншот по жёстко зашитому пути `/tmp` и не запускался
+  на Windows — теперь берёт временную папку у ОС.
+- Новые тесты: `smoke_plan_upload_reject` (чистка только после принятого
+  сохранения), `smoke_sign_cap` (201 ссылка, батчи, чистка, срок годности),
+  `smoke_climate_once` (число обходов не растёт с числом комнат), плюс
+  backend-покрытие версионированных имён и юнит-тесты новых хелперов.
+
 ## v1.44.8 — 2026-07-27
 - **Загруженная подложка действительно привязывается к пространству.**
   `_saveSpaceDialog` держал ссылку на объект пространства через `await`

docs/STATUS.md

@@ -11,18 +11,18 @@
 > (versions, publication, infrastructure), DEVELOPMENT.md for new gotchas,
 > ARCHITECTURE.md for design changes, ROADMAP.md when plans move.
 
-## Snapshot (2026-07-27)
+## Snapshot (2026-07-28)
 
 | Item | State |
 |---|---|
-| Version | **v1.44.8** everywhere (manifest, const.py, package.json, CARD_VERSION); deployed to the home instance |
+| Version | **v1.46.3** everywhere (manifest, const.py, package.json, CARD_VERSION); deployed to the home instance |
 | Workflow | Since 2026-07-22: minor changes go to branch **`dev`** (build + smokes → deploy home → commit → push, NO release); releases are batched on the owner's command (merge dev→main, one tag, one release with a summary changelog, CI checked on dev beforehand) |
-| GitHub | https://github.com/Matysh/houseplan-card — `main` = releases up to **v1.40.1**; `dev` ahead with v1.40.2+ (speaker icons, kiosk). Push via SSH key `ha_jb` (remote git@github.com:…); API releases via the fine-grained PAT in `~/.git-credentials` (Contents R/W, issued 2026-07-23) |
+| GitHub | https://github.com/Matysh/houseplan-card — **`main` carries every published release, the latest tag is the current version above**; `dev` is where work lands and is merged into `main` at release time (so `dev` is normally equal to or ahead of `main`, never behind). Push via SSH key `ha_jb` (remote git@github.com:…); API releases via the fine-grained PAT in `~/.git-credentials` (Contents R/W, issued 2026-07-23) |
 | CI | validate.yml (hacs + hassfest + frontend + backend) green; release.yml attaches the bundle on release publish |
 | HACS | Custom repository works. **Inclusion PR: hacs/default#9004** — open, valid, labeled; ~864 older open PRs but merge rate ≈180/mo; realistic ETA 1–3 months (checked 2026-07-24) |
-| Home instance | ha.jbstudio.pro (SSH port 323, key `ha_jb`), deployed **v1.44.8** via direct copy (HACS custom repo also installed) |
+| Home instance | ha.jbstudio.pro (SSH port 323, key `ha_jb`), deployed **v1.46.3** via direct copy (HACS custom repo also installed) |
 | Localization | UI en/ru (src/i18n/*.json), everything user-visible localized incl. kiosk popover |
-| Tests | 121 frontend (node:test) + 12 pure backend + 12 HA-harness (CI, py3.13); ~30 demo smoke suites (headless chromium) |
+| Tests | Four layers: frontend unit (`npm test`, node:test over `test-build/`), pure backend (`pytest tests_backend`, runs anywhere), HA-harness backend (same folder, CI only — needs py3.13 + pytest-homeassistant-custom-component), and browser smokes (`demo/smoke_*.mjs`, headless chromium). **Counts are not written down here** — they went stale within two releases while the version line beside them was kept current, which reads as less coverage than exists (review R5-2). Run `npm run inventory` for the current numbers, or read them off the last CI run |
 | Community | **Telegram chat: https://t.me/ha_houseplan** (created 2026-07-27) — the primary user-facing support channel; GitHub issues stay for bugs/features. Link it from any new release notes and posts |
 | Product scope | docs/SCOPE.md (2026-07-22) is the feature guard rail — check before accepting any feature |
 

docs/TESTING.md

@@ -234,6 +234,108 @@ Run the *core flows* (marked ★ below) in each environment at least once per mi
       are only reachable through /api/houseplan/content/… with a session; the
       old /houseplan_files/plans|files paths return 404 after a restart; old
       stored URLs keep working (rewritten on read) [auto+manual]
+- [ ] Every editor option is storable (v1.45.3, issue #3): set a sensor to
+      "value instead of an icon" and save — no validation error, the value shows
+      on the plan after a reload. Same for each tap action and each fill mode
+      [auto: backend test_every_display_mode_the_editor_offers_is_accepted and
+      neighbours, test_a_marker_showing_its_value_can_be_saved]
+- [ ] Nothing accumulates on an idle instance (v1.46.2/v1.46.3, HP-1461-01,
+      HP-1462-01): attach a file, cancel the dialog, and do not save anything
+      else — the file is gone after a restart AND after the daily pass, while
+      every file the configuration still references is untouched. Seed the
+      strays AFTER the last save, or `config/set` collects them and the check
+      proves nothing
+      [auto: backend test_startup_sweep_collects_what_no_commit_will,
+      test_daily_sweep_callback_collects_too, test_sweep_and_a_config_write_do_not_race]
+- [ ] A drag wins over a concurrent remote move (v1.46.2, HP-1461-02): drag an
+      icon and, while the save is still in flight, have another window move a
+      different icon — your icon stays where you put it and the other one
+      updates [auto: smoke_layout_sync]
+- [ ] Concurrent uploads of one name (v1.46.1, HP-1460-01): attach the same
+      file from two browser tabs at once — two attachments, two sets of bytes,
+      neither lost. A file whose name is at the length limit still downloads
+      [auto: unit: test_reserve_filename_is_safe_under_concurrency and neighbours]
+- [ ] No temporary files survive (v1.46.1, HP-1460-02): abort a large upload
+      mid-transfer, send two files in one request, make promotion fail — in each
+      case the files folder holds no `.upload-*`. An old one is swept at startup
+      [auto: backend test_upload_leaves_no_temporary_behind + unit: sweep_upload_temps]
+- [ ] Two full cards agree on positions (v1.46.1, HP-1460-03): open the plan in
+      two windows, drag an icon in one — it moves in the other without a reload;
+      a drag in progress in the second window is not thrown away
+      [auto: smoke_layout_sync]
+- [ ] Uploaded SVG is inert as a document (v1.46.0, HP-1454-01): open a plan's
+      signed url directly in a tab — a `<script>` inside it must not run and must
+      not reach the HA session's localStorage; the same plan still renders in the
+      card. PDFs still open in the browser viewer
+      [auto: smoke_svg_sandbox + backend test_uploaded_svg_is_sandboxed_and_a_pdf_is_not]
+- [ ] An attachment never overwrites another (v1.46.0, HP-1454-02): attach a file,
+      cancel the dialog — the previously stored file is byte-identical. Attach
+      `manual.pdf` to two NEW icons — two independent files. A cancelled upload is
+      gone an hour later
+      [auto: backend test_upload_never_overwrites_an_existing_attachment + unit: collect_attachments]
+- [ ] Two quick edits both survive (v1.46.0, HP-1454-03): with a slow connection,
+      make an edit and another one before the first save answers — both are in the
+      stored config, only one write is ever in flight, and no conflict toast fires
+      [auto: smoke_config_writer]
+- [ ] Open boundaries follow geometry (v1.46.0, HP-1454-04): change a space's
+      aspect or drag a room vertex — the open boundary and the light through it
+      move with the walls, without a reload [auto: smoke via model-identity key]
+- [ ] Inner limits (v1.46.0, HP-1454-05): max and max+1 for polygon points,
+      open_to, controls, pdfs, text and url lengths; an oversized config as a
+      whole is refused with `too_large`
+      [auto: unit: test_inner_collection_limits + backend test_config_write_is_capped_by_total_size]
+- [ ] Big files stream (v1.46.0, HP-1454-06): upload a ~50 MB manual and download
+      it twice in parallel — HA's memory does not grow by a file per transfer
+      [manual]
+- [ ] Static card parity (v1.46.0, HP-1454-07): a room whose fill is set to "none"
+      under a space filled by light is transparent on BOTH cards
+      [auto: smoke_render_parity]
+- [ ] Layout reaches the static card (v1.46.0, HP-1454-08): drag an icon on the
+      full card — a static card on the same dashboard moves it too, with no
+      config write and no reload
+      [auto: backend test_layout_keeps_its_revision_and_announces_changes + manual]
+- [ ] Repair issues are not immortal (v1.46.0, HP-1454-09): create a missing-plan
+      warning, then delete the space — the warning disappears [manual]
+- [ ] A path the backend cannot sign does not become a request loop (v1.45.4,
+      review R5-1): when `content/sign` answers successfully but omits a path,
+      the card backs that path off individually and keeps the urls it did get;
+      a re-render asks only for what is still missing, and only after the wait
+      [auto: unit: signing.test + backend test_signing_one_path_may_fail_without_failing_the_request]
+- [ ] Signing does not amplify on a bad connection (v1.45.2, review R4-2): with
+      the WebSocket slow or refusing, the card issues ONE sign request per url
+      and backs off after a failure instead of asking again on every render; a
+      request that never answers stops blocking retries after 15 s
+      [auto: unit: signing.test + smoke_space_card_bg]
+- [ ] A broken plans directory does not fail a save (v1.45.2, review R4-1): make
+      the plans folder unreadable and save the configuration — the save
+      succeeds, the revision is usable, and the next save does not conflict
+      [auto: backend test_a_failing_collector_does_not_undo_an_accepted_save]
+- [ ] Two editors, one plan (v1.45.1, review R3-1): with the same space open in
+      two tabs, attach a background in each in turn — the plan last saved is the
+      one served, and neither commit deletes the other's file. A rejected upload
+      disappears on a later save, not immediately
+      [auto: backend test_late_commit_of_one_client_never_deletes_another_client_s_plan,
+      test_commit_does_not_collect_another_client_s_uncommitted_upload,
+      test_abandoned_uploads_are_collected_once_old]
+- [ ] Static card background (v1.45.1, review R3-2): a houseplan-space-card on a
+      dashboard shows the plan image, not an empty stage; the browser never
+      requests the unsigned path and Home Assistant logs no failed login. A
+      failed signing request is retried on the next render
+      [auto: smoke_space_card_bg]
+- [ ] Rejected save leaves the plan intact (v1.45.0, review R2-1): attach a new
+      background, make the config write fail (a second tab saving first is
+      enough) — the previously stored plan is still served, with the same or a
+      different extension; after a successful save the old files are gone
+      [auto: smoke_plan_upload_reject + backend test_plan_upload_does_not_touch_the_previous_file]
+- [ ] Signature cache on a wall tablet (v1.45.0, review R2-2): with more than
+      200 signed urls every one of them is refreshed (batched), entries for
+      files no longer in the config are dropped, an expired signature is never
+      served and an aging one keeps working while its replacement arrives
+      [auto: smoke_sign_cap]
+- [ ] Climate cost does not grow with rooms (v1.45.0, review R2-3): on a plan
+      with dozens of rooms an unrelated HA state update triggers ONE registry
+      pass, repeated renders on the same snapshot trigger none, and a changed
+      sensor value is still visible immediately [auto: smoke_climate_once]
 - [ ] Plan upload survives a concurrent config revision (v1.44.8): with a second
       tab open on the same plan, attach a background image in space settings —
       the plan shows immediately, `plan_url` is in `.storage/houseplan.config`,

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "houseplan-card",
-  "version": "1.41.2",
+  "version": "1.45.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "houseplan-card",
-      "version": "1.41.2",
+      "version": "1.45.4",
       "license": "MIT",
       "dependencies": {
         "lit": "^3.1.3",
@@ -817,16 +817,6 @@
         "splaytree-ts": "^1.0.2"
       }
     },
-    "node_modules/randombytes": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
-      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "^5.1.0"
-      }
-    },
     "node_modules/resolve": {
       "version": "1.22.12",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
@@ -894,35 +884,14 @@
         "fsevents": "~2.3.2"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/serialize-javascript": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
-      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
+      "version": "7.0.7",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.7.tgz",
+      "integrity": "sha512-YAy8Od6KV+uuwUuU50np8fGB/Aues6Y0nAhA9y/hId74PlKUcme4pXcBD46NWKr1Q4osN/iseZ17YqO1XfmI8g==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "dependencies": {
-        "randombytes": "^2.1.0"
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/smob": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "houseplan-card",
-  "version": "1.44.8",
+  "version": "1.46.3",
   "description": "Interactive house plan Lovelace card for Home Assistant",
   "license": "MIT",
   "type": "module",
@@ -8,7 +8,8 @@
     "build": "tsc --noEmit && rollup -c",
     "watch": "rollup -c --watch",
     "typecheck": "tsc --noEmit",
-    "test": "tsc -p tsconfig.test.json && node scripts/fix-test-build.mjs && node --test test/*.test.mjs"
+    "test": "tsc -p tsconfig.test.json && node scripts/fix-test-build.mjs && node --test test/*.test.mjs",
+    "inventory": "node scripts/inventory.mjs"
   },
   "devDependencies": {
     "@mdi/js": "^7.4.47",
@@ -24,5 +25,8 @@
   "dependencies": {
     "lit": "^3.1.3",
     "polyclip-ts": "^0.16.8"
+  },
+  "overrides": {
+    "serialize-javascript": "^7.0.5"
   }
 }

scripts/inventory.mjs

@@ -0,0 +1,24 @@
+// Current test inventory, printed on demand.
+//
+// docs/STATUS.md used to carry these numbers inline; they went stale within a
+// couple of releases while the version line next to them was kept current,
+// which is worse than no number at all — a maintainer reading the snapshot
+// underestimates the coverage that exists (review R5-2). The counts live here
+// now, one command away, and STATUS.md describes the layers instead.
+import { readdirSync, readFileSync } from 'node:fs';
+
+const count = (dir, match, re) =>
+  readdirSync(dir)
+    .filter((f) => match.test(f))
+    .reduce((n, f) => n + (readFileSync(`${dir}/${f}`, 'utf8').match(re) || []).length, 0);
+
+const files = (dir, match) => readdirSync(dir).filter((f) => match.test(f)).length;
+
+const rows = [
+  ['frontend unit (node:test)', count('test', /\.test\.mjs$/, /^test\(/gm)],
+  ['pure backend (pytest, no HA)', count('tests_backend', /^test_validation\.py$/, /^def test_/gm)],
+  ['HA-harness backend (CI, py3.13)', count('tests_backend', /^test_ha_.*\.py$/, /^async def test_|^def test_/gm)],
+  ['browser smokes (headless chromium)', files('demo', /^smoke_.*\.mjs$/)],
+];
+const w = Math.max(...rows.map(([n]) => n.length));
+for (const [name, n] of rows) console.log(`${name.padEnd(w)}  ${n}`);

src/config-store.ts

@@ -47,11 +47,17 @@ async function fetchFresh(hass: any): Promise<HpConfigSnapshot> {
   };
   if (!subscribed && hass.connection?.subscribeEvents) {
     subscribed = true;
+    const invalidate = () => {
+      cache = null; // invalidate; listeners reload
+      listeners.forEach((l) => l());
+    };
     try {
-      await hass.connection.subscribeEvents(() => {
-        cache = null; // invalidate; listeners reload
-        listeners.forEach((l) => l());
-      }, 'houseplan_config_updated');
+      await hass.connection.subscribeEvents(invalidate, 'houseplan_config_updated');
+      // Layout is separate state: dragging an icon on the full card writes only
+      // the layout, so a static card on the same dashboard kept showing the old
+      // position until the config changed or the page was reloaded — possibly
+      // forever on a wall tablet (HP-1454-08).
+      await hass.connection.subscribeEvents(invalidate, 'houseplan_layout_updated');
     } catch {
       subscribed = false;
     }

src/devices.ts

@@ -425,15 +425,27 @@ const NON_AIR_RE = new RegExp(
  * The AUTO icon is used on purpose — a custom marker icon must not change what
  * a device measures.
  */
-export function areaClimate(
-  hass: any, area: string, kind: 'temp' | 'hum', rules?: CompiledIconRule[],
-): number | null {
-  if (!area || !hass?.entities) return null;
-  const groups = new Map<string, { name: string; model?: string; ents: string[] }>();
+export interface AreaClimate { temp: number | null; hum: number | null }
+
+/**
+ * Climate for EVERY area in one registry pass (review R2-3).
+ *
+ * The per-area version below rescanned the whole registry for each room and
+ * each measurement: with 60 rooms and 2000 entities that is 120 traversals per
+ * render — an entire frame spent re-reading metadata that did not change. The
+ * caller computes this map once per `hass` snapshot and looks rooms up in O(1).
+ */
+export function areaClimateMap(
+  hass: any, rules?: CompiledIconRule[],
+): Map<string, AreaClimate> {
+  const out = new Map<string, AreaClimate>();
+  if (!hass?.entities) return out;
+  // area -> device (or lone entity) -> the entities that belong to it
+  const byArea = new Map<string, Map<string, { name: string; model?: string; ents: string[] }>>();
   for (const [eid, reg] of Object.entries<any>(hass.entities)) {
     const dev = reg.device_id ? hass.devices?.[reg.device_id] : null;
-    const entArea = reg.area_id || dev?.area_id || null;
-    if (entArea !== area) continue;
+    const area = reg.area_id || dev?.area_id || null;
+    if (!area) continue;
     // Not every "temperature" is room air. Real finds on a live install: the
     // NAS processor temperature, the water in a smart kettle, a sauna heater at
     // 90 C and a virtual better_thermostat duplicating the real sensor (field
@@ -441,30 +453,51 @@ export function areaClimate(
     if (reg.entity_category) continue;              // diagnostic/config readings
     if (EXCLUDED_DOMAINS.has(reg.platform)) continue; // curated-out integrations
     if (NON_AIR_RE.test(eid)) continue;             // water/chip/flow/target/...
+    let groups = byArea.get(area);
+    if (!groups) { groups = new Map(); byArea.set(area, groups); }
     const key = reg.device_id || eid;
-    if (!groups.has(key)) {
+    let g = groups.get(key);
+    if (!g) {
       const st = hass.states?.[eid];
-      groups.set(key, {
+      g = {
         name: (dev ? dev.name_by_user || dev.name : reg.name || st?.attributes?.friendly_name || eid) || eid,
         model: dev?.model,
         ents: [],
-      });
+      };
+      groups.set(key, g);
     }
-    groups.get(key)!.ents.push(eid);
+    g.ents.push(eid);
   }
-  const vals: number[] = [];
-  for (const g of groups.values()) {
-    const icon = resolveIcon(hass, g.name, g.model, g.ents, rules);
-    const ok = kind === 'temp'
-      ? icon === 'mdi:thermometer' || icon === 'mdi:air-filter'
-      : icon === 'mdi:thermometer' || icon === 'mdi:air-filter' || icon === 'mdi:water-percent';
-    if (!ok) continue;
-    const v = kind === 'temp' ? tempFor(hass, g.ents) : humFor(hass, g.ents);
-    if (v != null) vals.push(v);
+  for (const [area, groups] of byArea) {
+    const temps: number[] = [];
+    const hums: number[] = [];
+    for (const g of groups.values()) {
+      const icon = resolveIcon(hass, g.name, g.model, g.ents, rules);
+      const air = icon === 'mdi:thermometer' || icon === 'mdi:air-filter';
+      if (air) {
+        const t = tempFor(hass, g.ents);
+        if (t != null) temps.push(t);
+      }
+      if (air || icon === 'mdi:water-percent') {
+        const h = humFor(hass, g.ents);
+        if (h != null) hums.push(h);
+      }
+    }
+    if (!temps.length && !hums.length) continue;
+    out.set(area, {
+      temp: temps.length ? Math.round((temps.reduce((a, b) => a + b, 0) / temps.length) * 10) / 10 : null,
+      hum: hums.length ? Math.round(hums.reduce((a, b) => a + b, 0) / hums.length) : null,
+    });
   }
-  if (!vals.length) return null;
-  const avg = vals.reduce((a, b) => a + b, 0) / vals.length;
-  return kind === 'temp' ? Math.round(avg * 10) / 10 : Math.round(avg);
+  return out;
+}
+
+/** One area's reading. Convenience wrapper — prefer the map for many areas. */
+export function areaClimate(
+  hass: any, area: string, kind: 'temp' | 'hum', rules?: CompiledIconRule[],
+): number | null {
+  if (!area) return null;
+  return areaClimateMap(hass, rules).get(area)?.[kind] ?? null;
 }
 
 /** How many of the area's lights are on: {on, total}, or null without lights. */

src/houseplan-card.ts

@@ -21,8 +21,11 @@ import {
   spaceDisplayOf, roomFillStyle, fillColorsOf, DEFAULT_FILL_COLORS, type FillColors,
   isActiveState, DEFAULT_ROOM_COLOR, DEFAULT_ROOM_OPACITY,
   DEFAULT_TEMP_MIN, DEFAULT_TEMP_MAX, type SpaceDisplay,
+  referencedContentUrls,
+  DISPLAY_MODES, TAP_ACTIONS, SPACE_FILL_MODES, ROOM_FILL_MODES,
 } from './logic';
-import { buildDevices, lqiFor, tempFor, humFor, isHumEntity, areaLights, areaTemp, areaHum, areaLightStats, sourceValue, areaClimate } from './devices';
+import { ContentSigner } from './signing';
+import { buildDevices, lqiFor, tempFor, humFor, isHumEntity, areaLights, areaTemp, areaHum, areaLightStats, sourceValue, areaClimateMap, type AreaClimate } from './devices';
 import type {
   OpeningCfg,
   RoomCfg, SpaceModel, PdfRef, Marker, ServerConfig, DevItem, CardConfig,
@@ -32,7 +35,7 @@ import './space-card';
 import { cardStyles } from './styles';
 import { langOf, t, type I18nKey } from './i18n';
 
-const CARD_VERSION = '1.44.8';
+const CARD_VERSION = '1.46.3';
 const LS_KEY = 'houseplan_card_layout_v1';
 const LS_CFG = 'houseplan_card_cfg_v1'; // cache of the server config+layout for instant rendering
 const LS_ZOOM = 'houseplan_card_zoom_v1';
@@ -119,6 +122,8 @@ class HouseplanCard extends LitElement {
   private _serverCfg: ServerConfig | null = null;
   private _cfgRev = 0;
   private _unsubCfg: (() => void) | null = null;
+  private _unsubLayout: (() => void) | null = null;
+  private _layoutRev = 0;
   private _devices: DevItem[] = [];
   private _regSignature = '';
   private _defPos: Record<string, { x: number; y: number }> = {};
@@ -231,6 +236,15 @@ class HouseplanCard extends LitElement {
   private _infoCard: DevItem | null = null;
   private _markerDialog: {
     devId?: string;      // the icon being edited (if any)
+    /**
+     * Folder attachments are uploaded into while this dialog is open. For a NEW
+     * icon there is no marker id yet; every one of them used to upload into a
+     * shared `files/new/`, so two markers attaching `manual.pdf` ended up
+     * pointing at the same bytes (HP-1454-02). A per-dialog id keeps them
+     * apart, and the files are moved to the real marker id once the config
+     * write is accepted — the same copy→save→cleanup order as a rebind.
+     */
+    uploadId?: string;
     name: string;
     binding: string;     // 'device:<id>' | 'entity:<eid>' | 'virtual' | '' (not chosen yet)
     bindingMode: 'virtual' | 'ha';
@@ -365,8 +379,7 @@ class HouseplanCard extends LitElement {
     super.connectedCallback();
     window.addEventListener('keydown', this._keyHandler);
     // signatures expire (24 h); refresh well before that on long-lived screens
-    clearInterval(this._resignTimer);
-    this._resignTimer = window.setInterval(() => this._resign(), 12 * 3600 * 1000);
+    this._signer.start(() => this.hass, () => referencedContentUrls(this._serverCfg));
     if (this._config?.kiosk && Number(this._config?.cycle) > 0) {
       clearInterval(this._cycleTimer);
       this._cycleTimer = window.setInterval(() => this._cycleTick(), Number(this._config.cycle) * 1000);
@@ -380,8 +393,7 @@ class HouseplanCard extends LitElement {
     clearTimeout(this._kioskDotsTimer);
     clearTimeout(this._kioskHoldTimer);
     clearTimeout(this._reloadRetry);
-    clearTimeout(this._signTimer);
-    clearInterval(this._resignTimer);
+    this._signer.dispose();
     clearTimeout(this._toastTimer);
     this._saveConfigDebounced.flush(); // never leave an edit unsent on teardown
     window.removeEventListener('hashchange', this._onHashChange);
@@ -392,6 +404,11 @@ class HouseplanCard extends LitElement {
       this._unsubCfg();
       this._unsubCfg = null;
     }
+    if (this._unsubLayout) {
+      this._unsubLayout();
+      this._unsubLayout = null;
+    }
+    clearTimeout(this._layoutSyncTimer);
     super.disconnectedCallback();
   }
 
@@ -555,9 +572,17 @@ class HouseplanCard extends LitElement {
     for (const x of sp as any[]) {
       s += (x.id || '') + ',' + (x.aspect || '') + ',' + (x.plan_url || '').length + ','
         + (x.rooms?.length || 0) + ',' + (x.openings?.length || 0) + ',' + (x.decor?.length || 0) + ';';
-      for (const r of x.rooms || [])
+      for (const r of x.rooms || []) {
+        // O(1) geometry roll-up per room: the count alone said nothing about
+        // where the room actually is, so a moved rectangle or a dragged first/
+        // last vertex looked identical (HP-1454-04). The epoch remains the
+        // primary signal — this is the belt for a mutation that forgot to bump it.
+        const p0 = r.poly?.[0], pn = r.poly?.[r.poly.length - 1];
         s += (r.poly?.length || 0) + '.' + (r.id || '') + '.' + (r.open_to || []).join('+') + '.'
-          + (r.area || '') + '.' + JSON.stringify(r.settings || 0) + ';';
+          + (r.area || '') + '.' + JSON.stringify(r.settings || 0) + '.'
+          + (r.x ?? '') + ',' + (r.y ?? '') + ',' + (r.w ?? '') + ',' + (r.h ?? '') + ','
+          + (p0 ? p0[0] + '/' + p0[1] : '') + ',' + (pn ? pn[0] + '/' + pn[1] : '') + ';';
+      }
     }
     return s;
   }
@@ -705,6 +730,7 @@ class HouseplanCard extends LitElement {
       this._cfgEpoch++;
       this._cfgRev = cfgResp?.rev || 0;
       this._layout = layResp?.layout || {};
+      this._layoutRev = layResp?.rev ?? 0;
       // live sync: the config was changed in another window → re-read it
       if (!this._unsubCfg) {
         this._unsubCfg = await this.hass.connection.subscribeEvents((ev: any) => {
@@ -714,6 +740,15 @@ class HouseplanCard extends LitElement {
           if ((ev?.data?.rev ?? -1) !== this._cfgRev) this._reloadConfigOnly();
         }, 'houseplan_config_updated');
       }
+      if (!this._unsubLayout) {
+        // Positions are separate state. The static card learned to follow them
+        // in v1.46.0 and the full one did not, so two full cards side by side
+        // stayed out of sync until a reload (HP-1460-03).
+        this._unsubLayout = await this.hass.connection.subscribeEvents(
+          (ev: any) => this._onLayoutEvent(Number(ev?.data?.rev ?? -1)),
+          'houseplan_layout_updated',
+        );
+      }
       const hs = this._hashSpace();
       const nav = this._savedNav();
       if (!this._hashApplied && hs && this._model.find((s) => s.id === hs)) {
@@ -788,61 +823,85 @@ class HouseplanCard extends LitElement {
    * Bearer header or an `authSig` signed path, and an element sends neither.
    * So the card asks the backend to sign what it is about to display.
    */
-  private _signed: Record<string, string> = {};
-  private _signPending = new Set<string>();
-  private _signTimer?: number;
+  private _signer = new ContentSigner(() => this.requestUpdate());
 
-  /** Display url: the signed variant when we have one, else the plain path. */
+  /** Display url: a signature we hold and still trust, else nothing. */
   private _display(url: string | null | undefined): string {
-    const u = contentUrl(url);
-    if (!u.startsWith('/api/houseplan/content/')) return u;
-    if (this._signed[u]) return this._signed[u];
-    this._requestSignature(u);
-    // Empty, NOT the plain path: an unsigned request to a `requires_auth` view
-    // returns 401 and Home Assistant raises a "failed login attempt" for the
-    // viewer's own IP. Callers skip rendering until the signature lands.
-    return '';
+    return this._signer.display(this.hass, url);
   }
 
-  private _requestSignature(url: string): void {
-    if (this._signPending.has(url) || !this.hass?.callWS) return;
-    this._signPending.add(url);
-    clearTimeout(this._signTimer);
-    // batch: a plan switch asks for several urls in the same tick
-    this._signTimer = window.setTimeout(() => {
-      const paths = [...this._signPending];
-      this._signPending.clear();
-      this.hass
-        .callWS({ type: 'houseplan/content/sign', paths })
-        .then((r: any) => {
-          if (!r?.urls) return;
-          this._signed = { ...this._signed, ...r.urls };
-          this.requestUpdate();
-        })
-        .catch(() => undefined); // unsigned urls simply keep failing; no loop
-    }, 30);
+  /** Re-sign what the live config still references (wall tablets outlive one). */
+  private _resign(): void {
+    this._signer.resign(this.hass, referencedContentUrls(this._serverCfg));
+  }
+
+  private _layoutSyncTimer?: number;
+
+  /**
+   * A layout revision appeared. It may well be ours: the event travels over the
+   * same socket as the reply to our own write and can arrive first, so
+   * reacting immediately means re-reading what we just sent — and, worse,
+   * racing a drag that has not been flushed yet. Wait a beat; if our own reply
+   * lands in the meantime, `_layoutRev` catches up and there is nothing to do.
+   */
+  private _onLayoutEvent(rev: number): void {
+    if (rev <= this._layoutRev) return;
+    clearTimeout(this._layoutSyncTimer);
+    this._layoutSyncTimer = window.setTimeout(() => {
+      if (rev <= this._layoutRev) return; // it was ours after all
+      this._reloadLayoutOnly();
+    }, 200);
   }
 
   /**
-   * Re-sign everything periodically: a wall tablet outlives a signature.
-   * The old urls are kept until the new ones arrive — dropping them first would
-   * blank the plan for a round trip (and, if the socket is down, until it heals).
+   * Remember a revision this card produced, so its own `layout_updated` event
+   * is not mistaken for someone else's and does not trigger a pointless
+   * re-read of what we just wrote.
    */
-  private _resignTimer?: number;
-
-  private _resign(): void {
-    const paths = Object.keys(this._signed);
-    if (!paths.length || !this.hass?.callWS) return;
-    this.hass
-      .callWS({ type: 'houseplan/content/sign', paths })
-      .then((r: any) => {
-        if (!r?.urls) return;
-        this._signed = { ...this._signed, ...r.urls };
-        this.requestUpdate();
-      })
-      .catch(() => undefined);
+  private _noteLayoutRev(r: any): void {
+    const rev = r?.rev;
+    if (typeof rev === 'number' && rev > this._layoutRev) this._layoutRev = rev;
   }
+
+  /**
+   * Adopt positions written elsewhere, without dropping our own (HP-1460-03).
+   *
+   * Only the layout is re-read — the config is untouched, so this cannot
+   * disturb an edit in progress. Positions this card has moved but not yet
+   * sent are flushed first and then kept on top of the server's answer: a fix
+   * for a stale UI must not turn into a lost drag.
+   */
+  private async _reloadLayoutOnly(): Promise<void> {
+    if (!this._serverStorage || !this.hass?.callWS) return;
+    // Snapshot BEFORE flushing. `flush()` runs the debounced writer
+    // synchronously, and the first thing that does is empty `_dirtyPos` — so
+    // reading the dirty set afterwards found nothing to protect and the server's
+    // older position was painted over the drag the user had just made
+    // (HP-1461-02). Positions are captured by value for the same reason.
+    const mine = new Map<string, any>();
+    for (const id of this._dirtyPos) if (this._layout[id]) mine.set(id, this._layout[id]);
+    if (this._persistLayout.pending()) this._persistLayout.flush();
+    // …and again after the flush: what was dirty is now in flight, and a write
+    // sent before this reload was even scheduled is in there too. Until the
+    // server acknowledges a position, this card is the authority on it.
+    for (const [id, pos] of this._sentPos) mine.set(id, pos);
+    try {
+      const resp = await this.hass.callWS({ type: 'houseplan/layout/get' });
+      const remote = resp?.layout || {};
+      const merged: Record<string, any> = { ...remote };
+      for (const [id, pos] of mine) merged[id] = pos;
+      this._layout = merged;
+      this._layoutRev = resp?.rev ?? this._layoutRev;
+      this._cacheSnapshot();
+      this.requestUpdate();
+    } catch {
+      /* a failed refresh just leaves the positions we already had */
+    }
+  }
+
   private _dirtyPos = new Set<string>();
+  /** Positions sent to the server and not acknowledged yet (HP-1461-02). */
+  private _sentPos = new Map<string, { s?: string; x: number; y: number }>();
 
   private _persistLayout = debounce(() => {
     if (this._serverStorage) {
@@ -852,9 +911,14 @@ class HouseplanCard extends LitElement {
       for (const id of ids) {
         const pos = this._layout[id];
         if (!pos) continue;
+        // in flight until the server answers: a layout reload triggered in the
+        // meantime must keep this position, not the one the server still has
+        this._sentPos.set(id, pos);
         this.hass
           .callWS({ type: 'houseplan/layout/update', device_id: id, pos })
-          .catch((e: any) => this._showToast(this._t('toast.pos_save_failed', { err: this._errText(e) })));
+          .then((r: any) => this._noteLayoutRev(r))
+          .catch((e: any) => this._showToast(this._t('toast.pos_save_failed', { err: this._errText(e) })))
+          .finally(() => { if (this._sentPos.get(id) === pos) this._sentPos.delete(id); });
       }
       this._cacheSnapshot();
     } else {
@@ -1571,8 +1635,44 @@ class HouseplanCard extends LitElement {
     for (const sp of this._serverCfg?.spaces || []) delete (sp as any).segments;
   }
 
+  /**
+   * Config writes are serialized (HP-1454-03).
+   *
+   * The debounce only spaced out the *starts*. If a write took longer than
+   * 500 ms — a busy instance, a slow link — the next edit went out with the
+   * same `expected_rev`, the server accepted the first and rejected the second
+   * as a conflict, and the conflict handler reloaded the server copy over the
+   * local one. The user's second edit was gone, with a toast that blamed
+   * another window when there was none.
+   *
+   * One chain, one write in flight. A write always reads `_serverCfg` at the
+   * moment it runs, so edits made while another write was out are carried by
+   * the next one, with the revision that write returned.
+   */
+  private _writesPending = 0;
+  private _writeChain: Promise<void> = Promise.resolve();
+
   /** A config write is in flight — the card must not adopt a server revision. */
-  private _cfgWriting = false;
+  private get _cfgWriting(): boolean {
+    return this._writesPending > 0;
+  }
+
+  private _writeConfig(): Promise<void> {
+    this._writesPending++;
+    this._writeChain = this._writeChain
+      .catch(() => undefined) // a failed write must not poison the queue
+      .then(async () => {
+        if (!this._serverCfg) return;
+        this._dropLegacySegments();
+        const r = await this.hass.callWS({
+          type: 'houseplan/config/set', config: this._serverCfg, expected_rev: this._cfgRev,
+        });
+        this._cfgRev = r?.rev ?? this._cfgRev + 1;
+      });
+    const mine = this._writeChain.finally(() => { this._writesPending--; });
+    // keep the chain itself unadorned so the next link waits for the write only
+    return mine;
+  }
 
   /**
    * Every mutation path ends here, so this is the one place that can invalidate
@@ -1587,24 +1687,16 @@ class HouseplanCard extends LitElement {
 
   private _saveConfigDebounced = debounce(() => {
     if (!this._serverCfg) return;
-    this._dropLegacySegments();
-    this._cfgWriting = true;
-    this.hass
-      .callWS({ type: 'houseplan/config/set', config: this._serverCfg, expected_rev: this._cfgRev })
-      .then((r: any) => {
-        this._cfgRev = r?.rev ?? this._cfgRev + 1;
-        this._cfgWriting = false;
-      })
-      .catch((e: any) => {
-        this._cfgWriting = false;
-        if (e?.code === 'conflict') {
-          this._showToast(this._t('toast.conflict'));
-          this._cancelPath();
-          this._reloadConfigOnly(true);
-        } else {
-          this._showToast(this._t('toast.cfg_save_failed', { err: this._errText(e) }));
-        }
-      });
+    this._writeConfig().catch((e: any) => {
+      if (e?.code === 'conflict') {
+        // a real one now: another window wrote between our read and our write
+        this._showToast(this._t('toast.conflict'));
+        this._cancelPath();
+        this._reloadConfigOnly(true);
+      } else {
+        this._showToast(this._t('toast.cfg_save_failed', { err: this._errText(e) }));
+      }
+    });
   }, 500);
 
   /**
@@ -2002,21 +2094,24 @@ class HouseplanCard extends LitElement {
   }
 
   /** All open-boundary pairs of the current space with their shared segments. */
-  private _openPairsCache: { key: string; pairs: { a: RoomCfg; b: RoomCfg; segs: number[][] }[] } | null = null;
+  private _openPairsCache: { model: SpaceModel; pairs: { a: RoomCfg; b: RoomCfg; segs: number[][] }[] } | null = null;
 
   private _openPairs(): { a: RoomCfg; b: RoomCfg; segs: number[][] }[] {
     // audit L1: this used to run once PER ROOM on every render (O(rooms^3)
-    // collinear-overlap math on every HA state push). Memoized on the config
-    // epoch + current space.
-    // The key includes the open_to links themselves: _serverCfg is mutated in
-    // place in ~22 places (audit L7), so an epoch counter alone is not a
-    // trustworthy cache key — a missed bump would render a stale plan, which is
-    // far worse than recomputing a short string here.
+    // collinear-overlap math on every HA state push), so it is memoized.
+    //
+    // The key is the SPACE MODEL OBJECT ITSELF (HP-1454-04). It used to be a
+    // string of room ids and open_to links, which said nothing about geometry:
+    // change the space's aspect, or drag a vertex, and the shared segments were
+    // recomputed for the outlines but the open boundaries — and the glow cuts
+    // that follow them — kept their old coordinates until a full reload.
+    // `_model` is already rebuilt whenever the epoch or the config fingerprint
+    // moves, and everything below derives from it, so its identity is an exact
+    // and cheaper key. One cache invalidation strategy, not two.
     const sp = this._spaceModel();
-    const key = this._space + '|' + sp.rooms.map((r) => r.id + ':' + ((r as any).open_to || []).join(',')).join(';');
-    if (this._openPairsCache && this._openPairsCache.key === key) return this._openPairsCache.pairs;
+    if (this._openPairsCache && this._openPairsCache.model === sp) return this._openPairsCache.pairs;
     const pairs = this._computeOpenPairs();
-    this._openPairsCache = { key, pairs };
+    this._openPairsCache = { model: sp, pairs };
     return pairs;
   }
 
@@ -2549,6 +2644,7 @@ class HouseplanCard extends LitElement {
         tapAction: '', defaultTap: 'info', controls: [], controlsFilter: '', isLight: false,
         glowRadius: '', model: '',
         link: '', description: '', pdfs: [], room: '', busy: false,
+        uploadId: 'up_' + Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
       };
     }
   }
@@ -2660,7 +2756,7 @@ class HouseplanCard extends LitElement {
     const files = input.files ? [...input.files] : [];
     input.value = '';
     if (!files.length || !this._markerDialog) return;
-    const mid = this._markerDialog.devId || 'new';
+    const mid = this._markerDialog.uploadId || this._markerDialog.devId || 'new';
     const uploaded: PdfRef[] = [];
     for (const file of files) {
       try {
@@ -2769,13 +2865,16 @@ class HouseplanCard extends LitElement {
       // stored config still resolve — the files never left. A failed copy
       // leaves the urls untouched and tells the user (review CR-3).
       let cleanupOldFiles = false;
-      if (oldId && oldId !== id && marker.pdfs?.length) {
+      // a new icon uploaded into its own staging folder; an edited one into its
+      // own id. Either way the files move to the final id here.
+      const fileSrc = dlg.uploadId || oldId;
+      if (fileSrc && fileSrc !== id && marker.pdfs?.length) {
         try {
           const res: any = await this.hass.callWS({
-            type: 'houseplan/files/migrate', from_id: oldId, to_id: id,
+            type: 'houseplan/files/migrate', from_id: fileSrc, to_id: id,
           });
           const mapping = res?.mapping || {};
-          marker.pdfs = migratePdfUrls(marker.pdfs, oldId, id, mapping);
+          marker.pdfs = migratePdfUrls(marker.pdfs, fileSrc, id, mapping);
           cleanupOldFiles = Object.keys(mapping).length > 0;
         } catch (e: any) {
           this._showToast(this._t('toast.files_migrate_failed', { err: this._errText(e) }));
@@ -2820,16 +2919,17 @@ class HouseplanCard extends LitElement {
         this._layout = { ...this._layout, [id]: newPos };
       }
       await this._saveConfigNow();
-      if (newPos) await this.hass.callWS({ type: 'houseplan/layout/update', device_id: id, pos: newPos });
+      if (newPos) this._noteLayoutRev(await this.hass.callWS({ type: 'houseplan/layout/update', device_id: id, pos: newPos }));
       if (oldId && oldId !== id) {
         // rebinding changed the icon id — clean up the old position
         delete this._layout[oldId];
-        await this.hass.callWS({ type: 'houseplan/layout/delete', device_id: oldId }).catch(() => undefined);
+        await this.hass.callWS({ type: 'houseplan/layout/delete', device_id: oldId })
+          .then((r: any) => this._noteLayoutRev(r)).catch(() => undefined);
       }
       // the config is committed — now it is safe to drop the old folder
-      if (cleanupOldFiles && oldId) {
+      if (cleanupOldFiles && fileSrc) {
         await this.hass
-          .callWS({ type: 'houseplan/files/cleanup', marker_id: oldId })
+          .callWS({ type: 'houseplan/files/cleanup', marker_id: fileSrc })
           .catch(() => undefined); // leftovers are harmless; broken links are not
       }
       this._markerDialog = null;
@@ -2874,7 +2974,8 @@ class HouseplanCard extends LitElement {
       if (d && d.bindingKind === 'virtual' && this._layout[d.id]) {
         // the virtual one is deleted for good → its position is no longer needed
         delete this._layout[d.id];
-        await this.hass.callWS({ type: 'houseplan/layout/delete', device_id: d.id }).catch(() => undefined);
+        await this.hass.callWS({ type: 'houseplan/layout/delete', device_id: d.id })
+          .then((r: any) => this._noteLayoutRev(r)).catch(() => undefined);
       }
       this._markerDialog = null;
       this._regSignature = '';
@@ -3031,6 +3132,10 @@ class HouseplanCard extends LitElement {
         label_light: d.labelLight,
       };
       sp.cell_cm = Number.isFinite(d.cellCm) && d.cellCm > 0 ? d.cellCm : 5;
+      // Nothing to clean up from here: the backend collects the superseded
+      // file inside the same locked transaction that accepted this config
+      // (review R3-1). A cleanup driven from the client could not be ordered
+      // against another client's commit and deleted its freshly saved plan.
       await this._saveConfigNow();
       this._spaceDialog = null;
       if (d.mode === 'create') this._space = sp.id;
@@ -3085,25 +3190,14 @@ class HouseplanCard extends LitElement {
   user's retry starts from the fresh config instead of hitting the same
   conflict again. */
   private async _saveConfigNow(): Promise<void> {
-    this._dropLegacySegments();
     this._cfgEpoch++;
-    // same flag the debounced writer uses: while it is set, an incoming
-    // `houseplan_config_updated` defers its reload instead of replacing the
-    // config under an unfinished write (audit L2, extended to this path)
-    this._cfgWriting = true;
     try {
-      const r = await this.hass.callWS({
-        type: 'houseplan/config/set', config: this._serverCfg, expected_rev: this._cfgRev,
-      });
-      this._cfgRev = r?.rev ?? this._cfgRev + 1;
+      // same queue as the debounced writer: a dialog saving while a background
+      // write is still out must not race it into a self-inflicted conflict
+      await this._writeConfig();
     } catch (e: any) {
-      if (e?.code === 'conflict') {
-        this._cfgWriting = false;
-        await this._reloadConfigOnly();
-      }
+      if (e?.code === 'conflict') await this._reloadConfigOnly();
       throw e;
-    } finally {
-      this._cfgWriting = false;
     }
   }
 
@@ -3881,14 +3975,31 @@ class HouseplanCard extends LitElement {
     const src = r.settings?.temp_source;
     if (src) return sourceValue(this.hass, src, 'temp');
     // every sensor of the area, placed on the plan or not (field report)
-    return r.area ? areaClimate(this.hass, r.area, 'temp', this._iconRules) : null;
+    return r.area ? this._climate().get(r.area)?.temp ?? null : null;
   }
 
   /** Room humidity honouring the tier-3 source override. */
   private _roomHum(r: RoomCfg): number | null {
     const src = r.settings?.hum_source;
     if (src) return sourceValue(this.hass, src, 'hum');
-    return r.area ? areaClimate(this.hass, r.area, 'hum', this._iconRules) : null;
+    return r.area ? this._climate().get(r.area)?.hum ?? null : null;
+  }
+
+  private _climateCache: { h: any; r: any; m: Map<string, AreaClimate> } | null = null;
+
+  /**
+   * Climate for every area, computed ONCE per hass snapshot (review R2-3).
+   * Home Assistant hands out a new `hass` object on every state change, so
+   * identity is exactly the right cache key: fresh states always recompute,
+   * and the 60 rooms of one render share a single registry pass instead of
+   * triggering one each (two, with humidity on).
+   */
+  private _climate(): Map<string, AreaClimate> {
+    const c = this._climateCache;
+    if (c && c.h === this.hass && c.r === this._iconRules) return c.m;
+    const m = areaClimateMap(this.hass, this._iconRules);
+    this._climateCache = { h: this.hass, r: this._iconRules, m };
+    return m;
   }
 
   private _resetRoomDialogFields(): void {
@@ -4845,7 +4956,7 @@ class HouseplanCard extends LitElement {
           <label>${this._t('marker.tap_label')}</label>
           <select class="areasel"
             @change=${(e: Event) => (this._markerDialog = { ...d, tapAction: (e.target as HTMLSelectElement).value })}>
-            ${[['info', 'tap.info'], ['more-info', 'tap.more_info'], ['toggle', 'tap.toggle']].map(
+            ${TAP_ACTIONS.map((v) => [v, 'tap.' + v.replace('-', '_')] as const).map(
               ([v, k]) => html`<option value=${v} ?selected=${(d.tapAction || d.defaultTap) === v}>${this._t(k as any)}</option>`,
             )}
           </select>
@@ -4916,7 +5027,7 @@ class HouseplanCard extends LitElement {
           <label>${this._t('marker.display_label')}</label>
           <select class="areasel"
             @change=${(e: Event) => (this._markerDialog = { ...d, display: (e.target as HTMLSelectElement).value as any })}>
-            ${[['badge', 'display.badge'], ['ripple', 'display.ripple'], ['icon_ripple', 'display.icon_ripple'], ['value', 'display.value']].map(
+            ${DISPLAY_MODES.map((v) => [v, 'display.' + v] as const).map(
               ([v, k]) => html`<option value=${v} ?selected=${d.display === v}>${this._t(k as any)}</option>`,
             )}
           </select>
@@ -5093,7 +5204,7 @@ class HouseplanCard extends LitElement {
             <span class="opv">${Math.round(d.roomOpacity * 100)}%</span>
           </div>
           <label>${this._t('space.fill_label')}</label>
-          ${[['none', 'fill.none'], ['lqi', 'fill.lqi'], ['light', 'fill.light'], ['temp', 'fill.temp'], ['glow', 'fill.glow']].map(
+          ${SPACE_FILL_MODES.map((v) => [v, 'fill.' + v] as const).map(
             ([v, k]) => html`<label class="srcrow">
               <input type="radio" name="fillmode" .checked=${d.fillMode === v}
                 @change=${() => (this._spaceDialog = { ...d, fillMode: v as any })} />
@@ -5264,7 +5375,7 @@ class HouseplanCard extends LitElement {
 
           <label class="dispsection">${this._t('room.settings_section')}</label>
           <label>${this._t('room.fill_label')}</label>
-          ${([['', 'fill.inherit'], ['none', 'fill.none'], ['lqi', 'fill.lqi'], ['light', 'fill.light'], ['temp', 'fill.temp']] as const).map(
+          ${([['', 'fill.inherit'], ...ROOM_FILL_MODES.map((v) => [v, 'fill.' + v])] as const).map(
             ([v, k]) => html`<label class="srcrow inline">
               <input type="radio" name="rfill" .checked=${this._roomFill === v}
                 @change=${() => { this._roomFill = v as any; this.requestUpdate(); }} />

src/logic.ts

@@ -531,6 +531,27 @@ export function safeUrl(url: string | null | undefined): string | null {
 export type TapAction = 'info' | 'more-info' | 'toggle';
 
 /** Domains a card-wide `tap_action: toggle` may toggle (accidental-tap safe). */
+/**
+ * The option lists the editors offer, in one place — and the reason they are
+ * here rather than inline in the templates.
+ *
+ * `display` gained 'value' in v1.26.0 ("show the measurement instead of the
+ * icon") but the backend schema still only accepted badge/ripple/icon_ripple,
+ * so saving any marker configured that way was rejected outright — and since
+ * one bad marker fails the whole config write, the plan could not be saved at
+ * all. Shipped 2026-07-21, found by a user on 2026-07-27: six days, and only
+ * because they pasted the error text. Nothing in the suite could have caught
+ * it, because the option list and the schema that stores it were written in
+ * two languages and never compared. They are exported here so a backend test
+ * can read them and assert the schema accepts every value a user can pick.
+ * Adding an option here and forgetting the schema now fails the test suite.
+ */
+export const DISPLAY_MODES = ['badge', 'ripple', 'icon_ripple', 'value'] as const;
+export const TAP_ACTIONS = ['info', 'more-info', 'toggle'] as const;
+/** Space-level fill: 'glow' is a whole-space light model, not a per-room one. */
+export const SPACE_FILL_MODES = ['none', 'lqi', 'light', 'temp', 'glow'] as const;
+export const ROOM_FILL_MODES = ['none', 'lqi', 'light', 'temp'] as const;
+
 export const TOGGLE_SAFE_DOMAINS = new Set(['light', 'switch', 'fan', 'humidifier']);
 
 /**
@@ -1036,6 +1057,48 @@ export function outlineWithout(poly: number[][], cuts: number[][], eps = 1e-6):
  * authenticated content endpoint (audit B1). Applied on READ, so stored
  * configs keep working without a migration.
  */
+/**
+ * How many paths one `houseplan/content/sign` call may carry. The backend caps
+ * the request at the same number and silently ignores the rest, so a client
+ * that sends more gets a partial answer with no way to tell which paths were
+ * dropped — on a wall tablet those entries then expire for good (review R2-2).
+ * Keep in sync with MAX_SIGN_PATHS in custom_components/houseplan/const.py.
+ */
+export const MAX_SIGN_PATHS = 200;
+
+/** A signature is valid for 24 h; refresh once two thirds of it is gone. */
+export const SIGN_TTL_MS = 24 * 3600 * 1000;
+export const SIGN_REFRESH_MS = 16 * 3600 * 1000;
+
+/** Split a list into chunks of at most `size` (used for signing batches). */
+export function chunk<T>(items: T[], size: number): T[][] {
+  const n = Math.max(1, Math.floor(size));
+  const out: T[][] = [];
+  for (let i = 0; i < items.length; i += n) out.push(items.slice(i, i + n));
+  return out;
+}
+
+/**
+ * Every content url the given config still refers to, normalised through
+ * `contentUrl`. The signature cache is pruned to this set: without it the cache
+ * only grows — replaced plans and deleted attachments keep their entries, and
+ * the total can cross the per-request cap even when the live config is small.
+ */
+export function referencedContentUrls(cfg: any): Set<string> {
+  const out = new Set<string>();
+  const add = (u: unknown) => {
+    if (typeof u !== 'string' || !u) return;
+    const c = contentUrl(u);
+    if (c.startsWith('/api/houseplan/content/')) out.add(c);
+  };
+  for (const sp of cfg?.spaces || []) {
+    add(sp?.plan_url);
+    for (const m of sp?.markers || []) for (const p of m?.pdfs || []) add(p?.url);
+  }
+  for (const m of cfg?.markers || []) for (const p of m?.pdfs || []) add(p?.url);
+  return out;
+}
+
 export function contentUrl(url: string | null | undefined): string {
   if (!url) return '';
   if (url.startsWith('/houseplan_files/plans/')) {

src/signing.ts

@@ -0,0 +1,184 @@
+import { contentUrl, chunk, MAX_SIGN_PATHS, SIGN_TTL_MS, SIGN_REFRESH_MS } from './logic';
+
+/** A request older than this is presumed lost, and the url may be asked again. */
+export const SIGN_INFLIGHT_MS = 15000;
+/** After a failure, wait before retrying; doubles up to the cap. */
+export const SIGN_BACKOFF_MIN_MS = 2000;
+export const SIGN_BACKOFF_MAX_MS = 60000;
+
+/**
+ * Signed urls for the authenticated content endpoint, shared by both cards.
+ *
+ * A browser cannot authenticate an `<image href>` or an `<a href>`: Home
+ * Assistant takes a Bearer header or an `authSig` signed path, and an element
+ * sends neither. So whatever is about to be displayed has to be signed first.
+ *
+ * This used to be implemented twice — and the second copy (houseplan-space-card)
+ * signed correctly but never handed the result to its renderer, so the plan
+ * background asked for the raw protected url and got a 401 on every render
+ * (review R3-2). One implementation, one set of rules:
+ *
+ * - requests are chunked to MAX_SIGN_PATHS, the cap the backend silently
+ *   applies (an oversized call comes back partial with no way to tell what was
+ *   dropped, and those entries then expire for good);
+ * - every entry carries the time it was issued: past SIGN_REFRESH_MS a
+ *   replacement is fetched while the old url keeps rendering, past SIGN_TTL_MS
+ *   the entry is dropped rather than served (it would 401 and raise a
+ *   failed-login warning for the viewer's own IP);
+ * - a url that is queued or already in flight is not asked for again: renders
+ *   are frequent and a slow socket used to turn every one of them into another
+ *   `content/sign` call (review R4-2). An in-flight entry expires after
+ *   SIGN_INFLIGHT_MS so a promise that never settles cannot block retries
+ *   forever, and a failure backs off instead of retrying on the next frame.
+ */
+export class ContentSigner {
+  private signed: Record<string, { url: string; at: number }> = {};
+  /** Waiting for the batch timer to fire. */
+  private queued = new Set<string>();
+  /** Sent and not settled yet: url -> when the request went out. */
+  private inFlight = new Map<string, number>();
+  /** After a failure: when this url may be asked again, and the current delay. */
+  private retry = new Map<string, { notBefore: number; delay: number }>();
+  private batchTimer?: ReturnType<typeof setTimeout>;
+  private resignTimer?: ReturnType<typeof setInterval>;
+  private disposed = false;
+
+  /**
+   * @param onUpdate schedule a re-render (a signature arriving changes the DOM)
+   * @param now      injectable clock — the tests need to age a signature
+   */
+  constructor(private onUpdate: () => void, private now: () => number = () => Date.now()) {}
+
+  /** Start the periodic re-sign. `referenced` prunes the cache on each tick. */
+  start(hass: () => any, referenced: () => Set<string>): void {
+    this.disposed = false; // an element can be reconnected after a disconnect
+    this.stopTimer();
+    this.resignTimer = setInterval(() => this.resign(hass(), referenced()), SIGN_REFRESH_MS / 2);
+  }
+
+  /** Release every timer; the cache survives a reconnect, the timers must not. */
+  dispose(): void {
+    this.disposed = true;
+    this.stopTimer();
+    clearTimeout(this.batchTimer);
+    this.queued.clear();
+    this.inFlight.clear();
+  }
+
+  private stopTimer(): void {
+    if (this.resignTimer !== undefined) clearInterval(this.resignTimer);
+    this.resignTimer = undefined;
+  }
+
+  /** The url to put in the DOM: a signature we hold and still trust, else ''. */
+  display(hass: any, url: string | null | undefined): string {
+    const u = contentUrl(url);
+    if (!u.startsWith('/api/houseplan/content/')) return u;
+    const hit = this.signed[u];
+    const age = hit ? this.now() - hit.at : Infinity;
+    if (age < SIGN_REFRESH_MS) return hit.url;
+    if (age < SIGN_TTL_MS) {
+      // aging but still valid: keep showing it while a fresh one is fetched
+      this.request(hass, u);
+      return hit.url;
+    }
+    if (hit) delete this.signed[u];
+    this.request(hass, u);
+    // Empty, NOT the plain path: an unsigned request to a `requires_auth` view
+    // returns 401 and Home Assistant raises a "failed login attempt".
+    return '';
+  }
+
+  private request(hass: any, url: string): void {
+    if (!hass?.callWS || this.queued.has(url)) return;
+    const now = this.now();
+    const sent = this.inFlight.get(url);
+    if (sent !== undefined && now - sent < SIGN_INFLIGHT_MS) return; // already asking
+    const back = this.retry.get(url);
+    if (back && now < back.notBefore) return;                        // still backing off
+    this.queued.add(url);
+    clearTimeout(this.batchTimer);
+    // batch: switching space asks for several urls in the same tick
+    this.batchTimer = setTimeout(() => {
+      const paths = [...this.queued];
+      this.queued.clear();
+      this.sign(hass, paths);
+    }, 30);
+  }
+
+  private sign(hass: any, paths: string[]): void {
+    if (!paths.length || !hass?.callWS) return;
+    for (const batch of chunk(paths, MAX_SIGN_PATHS)) {
+      const sentAt = this.now();
+      for (const p of batch) this.inFlight.set(p, sentAt);
+      hass
+        .callWS({ type: 'houseplan/content/sign', paths: batch })
+        .then((r: any) => {
+          if (this.disposed) return;
+          // A successful call does NOT mean every path was signed: the backend
+          // skips a path it cannot sign, logs it and still answers `{urls: …}`
+          // with the rest. Treating the whole batch as done then cleared the
+          // backoff for the missing ones, so every later render asked again —
+          // the very amplification the backoff exists to stop (review R5-1).
+          const at = this.now();
+          const next = { ...this.signed };
+          let accepted = 0;
+          for (const p of batch) {
+            const url = r?.urls?.[p];              // only keys we asked for
+            if (typeof url === 'string' && url) {
+              next[p] = { url, at };
+              this.retry.delete(p);
+              accepted++;
+            } else {
+              this.backOff(p);
+            }
+          }
+          if (!accepted) return;
+          this.signed = next;
+          this.onUpdate();
+        })
+        .catch(() => {
+          // back off rather than retry on the very next frame: a socket that
+          // is refusing sign requests would otherwise be hammered per render
+          for (const p of batch) this.backOff(p);
+        })
+        .finally(() => {
+          // release only our own attempt: a later one may have superseded it
+          for (const p of batch) if (this.inFlight.get(p) === sentAt) this.inFlight.delete(p);
+        });
+    }
+  }
+
+  /** Next attempt for this url waits, and each failure waits twice as long. */
+  private backOff(url: string): void {
+    const prev = this.retry.get(url)?.delay || 0;
+    const delay = Math.min(SIGN_BACKOFF_MAX_MS, prev ? prev * 2 : SIGN_BACKOFF_MIN_MS);
+    this.retry.set(url, { notBefore: this.now() + delay, delay });
+  }
+
+  /**
+   * Re-sign what is still in use. A wall tablet outlives a signature, and an
+   * entry for a plan replaced months ago must not consume a slot in the capped
+   * request — so prune to the urls the live config still references.
+   */
+  resign(hass: any, referenced: Set<string>): void {
+    const now = this.now();
+    const kept: Record<string, { url: string; at: number }> = {};
+    for (const [k, v] of Object.entries(this.signed)) {
+      if (referenced.has(k) && now - v.at < SIGN_TTL_MS) kept[k] = v;
+    }
+    this.signed = kept;
+    this.retry.clear(); // a scheduled refresh is a fresh chance for everything
+    this.sign(hass, Object.keys(kept));
+  }
+
+  /** Test/debug view of the cache. */
+  get entries(): Record<string, { url: string; at: number }> {
+    return this.signed;
+  }
+
+  /** Test/debug view of what is currently being asked for. */
+  get inFlightUrls(): string[] {
+    return [...this.inFlight.keys()];
+  }
+}

src/space-card.ts

@@ -10,6 +10,8 @@ import { cardStyles } from './styles';
 import { renderSpaceStatic, spaceModels } from './space-render';
 import { getConfig, onConfigChange, cachedSnapshot, type HpConfigSnapshot } from './config-store';
 import { t, langOf, type Lang } from './i18n';
+import { ContentSigner } from './signing';
+import { referencedContentUrls } from './logic';
 import './space-editor';
 
 const fireEvent = (node: EventTarget, type: string, detail?: unknown) => {
@@ -73,11 +75,14 @@ class HouseplanSpaceCard extends LitElement {
       this._snap = null;
       this.requestUpdate();
     });
+    // a dashboard on a wall tablet outlives a 24 h signature
+    this._signer.start(() => this.hass, () => this._referenced());
   }
 
   public disconnectedCallback(): void {
     this._unsub?.();
     this._unsub = undefined;
+    this._signer.dispose();
     super.disconnectedCallback();
   }
 
@@ -109,8 +114,6 @@ class HouseplanSpaceCard extends LitElement {
 
   public getCardSize(): number {
     const models = spaceModels(this._snap?.config || null);
-    // B1 follow-up: the plan <image> needs a signed url in a browser session
-    for (const m of models) if (m.bg?.href) this._signBg(m.bg);
     const sp = models.find((s) => s.id === this._config?.space);
     if (sp) {
       const ratio = sp.vb[3] / sp.vb[2]; // h/w
@@ -123,25 +126,16 @@ class HouseplanSpaceCard extends LitElement {
     return html`<ha-card><div class="hp-static-error">${msg}</div></ha-card>`;
   }
 
-  private _signedBg: Record<string, string> = {};
-  private _signBgPending = new Set<string>();
+  /**
+   * Same signer as the main card (review R3-2). The previous copy here signed
+   * the url and then threw it away: `getCardSize()` mutated a throwaway model
+   * while `render()` rebuilt its own from the config, so the <image> kept
+   * asking for the raw protected path and got a 401 on every render.
+   */
+  private _signer = new ContentSigner(() => this.requestUpdate());
 
-  /** Ask the backend for a signed content url and swap it in when it arrives. */
-  private _signBg(bg: { href: string }): void {
-    const raw = bg.href.split('?authSig=')[0];
-    if (!raw.startsWith('/api/houseplan/content/')) return;
-    if (this._signedBg[raw]) { bg.href = this._signedBg[raw]; return; }
-    if (this._signBgPending.has(raw) || !this.hass?.callWS) return;
-    this._signBgPending.add(raw);
-    this.hass
-      .callWS({ type: 'houseplan/content/sign', paths: [raw] })
-      .then((r: any) => {
-        const url = r?.urls?.[raw];
-        if (!url) return;
-        this._signedBg = { ...this._signedBg, [raw]: url };
-        this.requestUpdate();
-      })
-      .catch(() => undefined);
+  private _referenced(): Set<string> {
+    return referencedContentUrls(this._snap?.config);
   }
 
   protected render(): TemplateResult | typeof nothing {
@@ -159,6 +153,8 @@ class HouseplanSpaceCard extends LitElement {
       spaceId,
       iconSize: this._config.icon_size,
       lang: this._lang,
+      // resolved at render time: a url baked in earlier would be the unsigned one
+      displayUrl: (raw) => this._signer.display(this.hass, raw),
     });
     if (!stage) {
       return this._errorCard(t(this._lang, 'space_card.not_found', { id: spaceId }));

src/space-geometry.ts

@@ -20,6 +20,11 @@ export function spaceModels(cfg: ServerConfig | null): SpaceModel[] {
       id: r.id,
       name: r.name,
       area: r.area ?? null,
+      // carried, not dropped: the static card renders from this model too, and
+      // without them it ignored the room-level fill override and drew a room the
+      // full card leaves transparent (HP-1454-07)
+      open_to: r.open_to || undefined,
+      settings: r.settings || undefined,
       x: r.x != null ? r.x * NORM_W : undefined,
       y: r.y != null ? r.y * H : undefined,
       w: r.w != null ? r.w * NORM_W : undefined,

src/space-render.ts

@@ -8,7 +8,7 @@
  */
 import { html, svg, nothing, type TemplateResult } from 'lit';
 import { buildDevices, areaLqi, areaLights, areaTemp } from './devices';
-import { spaceDisplayOf, roomFillStyle, fillColorsOf } from './logic';
+import { spaceDisplayOf, roomFillStyle, fillColorsOf, roomFillModeOf } from './logic';
 import { DEFAULT_ICON_RULES, compileIconRules, EXCLUDED_DOMAINS } from './rules';
 import { t, type Lang } from './i18n';
 import type { ServerConfig } from './types';
@@ -25,6 +25,13 @@ export interface StaticRenderOpts {
   spaceId: string;
   iconSize?: number;
   lang: Lang;
+  /**
+   * Resolve a stored content url to what the DOM may actually request — the
+   * plan lives behind `requires_auth`, so it needs an `authSig` signature.
+   * Returning '' means "not signed yet": the caller must render no <image>
+   * rather than an unsigned one, which would 401 (review R3-2).
+   */
+  displayUrl?: (raw: string) => string;
 }
 
 /**
@@ -66,16 +73,18 @@ export function renderSpaceStatic(o: StaticRenderOpts): TemplateResult | null {
     .map((r) => {
       let cls = 'room ' + (space.bg ? 'overlay' : 'yard');
       let style = '';
-      if (disp.showBorders || disp.fill !== 'none') {
+      // tier 3 wins over the space, exactly as on the full card (HP-1454-07)
+      const fill = roomFillModeOf(disp.fill, r);
+      if (disp.showBorders || fill !== 'none') {
         cls += ' styled';
         const parts = [`--room-stroke:${disp.color}`, `--room-stroke-op:${disp.showBorders ? disp.opacity : 0}`];
         // fill rendered exactly as configured on the full card (snapshot of current states)
         const fillC = r.area
           ? roomFillStyle(
-              disp.fill,
-              disp.fill === 'lqi' ? areaLqi(o.hass, devs, r.area) : null,
-              disp.fill === 'light' ? areaLights(o.hass, devs, r.area) : 'none',
-              disp.fill === 'temp' ? areaTemp(o.hass, devs, r.area) : null,
+              fill,
+              fill === 'lqi' ? areaLqi(o.hass, devs, r.area) : null,
+              fill === 'light' ? areaLights(o.hass, devs, r.area) : 'none',
+              fill === 'temp' ? areaTemp(o.hass, devs, r.area) : null,
               disp.tempMin,
               disp.tempMax,
               fillColorsOf(o.cfg?.settings),
@@ -118,11 +127,13 @@ export function renderSpaceStatic(o: StaticRenderOpts): TemplateResult | null {
         })
     : [];
 
+  const bgHref = space.bg ? (o.displayUrl ? o.displayUrl(space.bg.href) : space.bg.href) : '';
+
   return html`
     <div class="hp-static-stage" style="aspect-ratio:${vb[2]}/${vb[3]}">
       <svg viewBox="${vb[0]} ${vb[1]} ${vb[2]} ${vb[3]}" preserveAspectRatio="xMidYMid meet">
-        ${space.bg
-          ? svg`<image href="${space.bg.href}" x="${space.bg.x}" y="${space.bg.y}" width="${space.bg.w}" height="${space.bg.h}" preserveAspectRatio="none" />`
+        ${bgHref
+          ? svg`<image href="${bgHref}" x="${space.bg!.x}" y="${space.bg!.y}" width="${space.bg!.w}" height="${space.bg!.h}" preserveAspectRatio="none" />`
           : nothing}
         ${roomShapes}
       </svg>

test/devices.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { buildDevices, lightGroups, primaryEntity, lqiFor, tempFor, humFor, areaLights, areaTemp, areaHum, areaLightStats, sourceValue , areaClimate } from '../test-build/devices.js';
+import { buildDevices, lightGroups, primaryEntity, lqiFor, tempFor, humFor, areaLights, areaTemp, areaHum, areaLightStats, sourceValue , areaClimate, areaClimateMap } from '../test-build/devices.js';
 import { compileIconRules, iconFor } from '../test-build/rules.js';
 
 /** Minimal fake hass around the pieces buildDevices reads. */
@@ -436,3 +436,50 @@ test('areaClimate: only ROOM AIR counts (field question, 2026-07-27)', () => {
   // остаётся ровно один настоящий датчик воздуха
   assert.equal(areaClimate(hass, 'bed', 'temp'), 22);
 });
+
+test('areaClimateMap: one registry pass for all areas (review R2-3)', () => {
+  // 60 зон × 2000 сущностей — размер боевой установки из отчёта
+  const devices = {}; const entities = {}; const states = {};
+  for (let a = 0; a < 60; a++) {
+    for (let i = 0; i < 33; i++) {
+      const dev = `d${a}_${i}`;
+      const eid = `sensor.d${a}_${i}_temperature`;
+      devices[dev] = { id: dev, name: `Датчик температуры ${a}.${i}`, area_id: `area${a}` };
+      entities[eid] = { device_id: dev, platform: 'mqtt' };
+      states[eid] = { state: String(20 + a * 0.1), attributes: { device_class: 'temperature', unit_of_measurement: '°C' } };
+    }
+  }
+  // считаем ОБХОДЫ реестра: Object.entries дёргает ownKeys ровно один раз
+  let scans = 0;
+  const traced = new Proxy(entities, { ownKeys(t) { scans++; return Reflect.ownKeys(t); } });
+  const hass = { devices, states, entities: traced };
+
+
+  const map = areaClimateMap(hass);
+  assert.equal(scans, 1, 'реестр обходится один раз на снимок hass');
+  assert.equal(map.size, 60);
+  assert.equal(map.get('area0').temp, 20);
+  assert.equal(map.get('area59').temp, 25.9);
+  assert.equal(map.get('area0').hum, null);
+  assert.equal(map.get('nope'), undefined);
+
+  // старый путь: отдельный обход на каждую комнату и каждую величину
+  scans = 0;
+  for (let a = 0; a < 60; a++) { areaClimate(hass, `area${a}`, 'temp'); areaClimate(hass, `area${a}`, 'hum'); }
+  assert.equal(scans, 120, 'wrapper считает по одной зоне — им нельзя пользоваться в рендере');
+});
+
+test('areaClimateMap: температура и влажность живут в одной записи', () => {
+  const hass = {
+    devices: { q: { id: 'q', name: 'Qingping Air Monitor', area_id: 'hall' } },
+    entities: {
+      'sensor.q_t': { device_id: 'q', platform: 'xiaomi' },
+      'sensor.q_h': { device_id: 'q', platform: 'xiaomi' },
+    },
+    states: {
+      'sensor.q_t': { state: '21.4', attributes: { device_class: 'temperature', unit_of_measurement: '°C' } },
+      'sensor.q_h': { state: '48', attributes: { device_class: 'humidity', unit_of_measurement: '%' } },
+    },
+  };
+  assert.deepEqual(areaClimateMap(hass).get('hall'), { temp: 21.4, hum: 48 });
+});

test/logic.test.mjs

@@ -12,7 +12,7 @@ import {
   swipeTarget, clampScale,
   migratePdfUrls,
   roomFillModeOf,
-  contentUrl,
+  contentUrl, chunk, referencedContentUrls, MAX_SIGN_PATHS,
   interiorPoint,
   segmentCm, formatLength, roomEdges, roomPoly, pointOnBoundary, pointStrictlyInside, roomsOverlap,
   mergeRooms, splitRoom, polygonArea, closestPointOnBoundary, isActiveState, snapToWall, openingAmount, fillColorsOf, lerpColor, roomFillStyle, stateIcon, lightColorOf, isAlarmState, parseRoomRef, diffNewDevices,
@@ -798,8 +798,10 @@ test('migratePdfUrls: only confirmed copies are rewritten (review CR-3)', () =>
     { name: 'b.pdf', url: '/houseplan_files/files/v_old1/b.pdf?v=2' },
   ];
   // сервер скопировал только a.pdf, причём переименовал из-за коллизии
-  const out = migratePdfUrls(pdfs, 'v_old1', 'dev99', { 'a.pdf': 'a (2).pdf' });
-  assert.equal(out[0].url, '/houseplan_files/files/dev99/a%20(2).pdf?v=1');
+  // collision names use only characters the content view accepts back in a
+  // request: ' (2)' was sanitised to '_2_' server-side and 404'd (v1.46.0)
+  const out = migratePdfUrls(pdfs, 'v_old1', 'dev99', { 'a.pdf': 'a-2.pdf' });
+  assert.equal(out[0].url, '/houseplan_files/files/dev99/a-2.pdf?v=1');
   assert.equal(out[1].url, pdfs[1].url, 'нескопированный файл ссылается на старую папку');
   // пустой маппинг = ничего не переносим
   assert.deepEqual(migratePdfUrls(pdfs, 'v_old1', 'dev99', {}).map((p) => p.url),
@@ -881,3 +883,30 @@ test('segKey: one wall, one key at any precision (audit G3)', () => {
   // разные стены — разные ключи
   assert.notEqual(segKey([0, 0], [1, 1]), segKey([0, 0], [2, 2]));
 });
+
+test('chunk / referencedContentUrls: signing batches and cache pruning (review R2-2)', () => {
+  assert.deepEqual(chunk([1, 2, 3, 4, 5], 2), [[1, 2], [3, 4], [5]]);
+  assert.deepEqual(chunk([], 200), []);
+  assert.equal(chunk(new Array(201).fill(0), MAX_SIGN_PATHS).length, 2);
+  assert.deepEqual(chunk([1, 2, 3], 0), [[1], [2], [3]]); // never an infinite loop
+
+  const cfg = {
+    spaces: [
+      { id: 'f1', plan_url: '/houseplan_files/plans/f1.svg' },   // legacy, rewritten on read
+      { id: 'f2', plan_url: '/api/houseplan/content/plans/_/f2.abc.png' },
+      { id: 'f3', plan_url: null },
+      { id: 'f4', plan_url: '/local/not-ours.png' },             // not our endpoint
+    ],
+    markers: [
+      { id: 'm1', pdfs: [{ url: '/houseplan_files/files/m1/manual.pdf' }, { url: '' }] },
+      { id: 'm2' },
+    ],
+  };
+  assert.deepEqual([...referencedContentUrls(cfg)].sort(), [
+    '/api/houseplan/content/files/m1/manual.pdf',
+    '/api/houseplan/content/plans/_/f1.svg',
+    '/api/houseplan/content/plans/_/f2.abc.png',
+  ]);
+  assert.equal(referencedContentUrls(null).size, 0);
+  assert.equal(referencedContentUrls({}).size, 0);
+});

test/signing.test.mjs

@@ -0,0 +1,245 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ContentSigner, SIGN_INFLIGHT_MS, SIGN_BACKOFF_MIN_MS } from '../test-build/signing.js';
+import { SIGN_TTL_MS, SIGN_REFRESH_MS } from '../test-build/logic.js';
+
+const URL_A = '/api/houseplan/content/plans/_/f1.tok.svg';
+const URL_B = '/api/houseplan/content/files/m1/manual.pdf';
+const tick = () => new Promise((r) => setTimeout(r, 45)); // > the 30 ms batch timer
+
+/** hass whose sign call is resolved/rejected by hand. */
+function makeHass() {
+  const calls = [];
+  const hass = {
+    callWS(m) {
+      let settle;
+      const p = new Promise((res, rej) => { settle = { res, rej }; });
+      calls.push({ paths: m.paths, ...settle });
+      return p;
+    },
+  };
+  return { hass, calls };
+}
+
+function signer(now = () => Date.now()) {
+  let updates = 0;
+  const s = new ContentSigner(() => { updates++; }, now);
+  return { s, updates: () => updates };
+}
+
+test('R4-2: renders during one unresolved request do not multiply it', async () => {
+  const { hass, calls } = makeHass();
+  const { s } = signer();
+  for (let i = 0; i < 6; i++) assert.equal(s.display(hass, URL_A), '');
+  await tick();
+  assert.equal(calls.length, 1, 'one batched request');
+  // more renders while it is still in flight
+  for (let i = 0; i < 5; i++) s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 1, 'still one: the url is in flight');
+  assert.deepEqual(s.inFlightUrls, [URL_A]);
+
+  calls[0].res({ urls: { [URL_A]: URL_A + '?authSig=OK' } });
+  await tick();
+  assert.equal(s.display(hass, URL_A), URL_A + '?authSig=OK');
+  assert.equal(calls.length, 1, 'a resolved signature starts no extra request');
+  assert.deepEqual(s.inFlightUrls, []);
+});
+
+test('R4-2: a rejection frees the url but backs off before retrying', async () => {
+  let t = 1_000_000;
+  const { hass, calls } = makeHass();
+  const { s } = signer(() => t);
+  s.display(hass, URL_A);
+  await tick();
+  calls[0].rej(new Error('socket'));
+  await tick();
+  assert.deepEqual(s.inFlightUrls, [], 'released, not wedged');
+
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 1, 'the very next render must not retry');
+
+  t += SIGN_BACKOFF_MIN_MS + 1;
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 2, 'retried once the backoff has passed');
+
+  // the second failure waits longer than the first
+  calls[1].rej(new Error('socket'));
+  await tick();
+  t += SIGN_BACKOFF_MIN_MS + 1;
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 2, 'backoff doubled');
+  t += SIGN_BACKOFF_MIN_MS * 2;
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 3);
+
+  calls[2].res({ urls: { [URL_A]: URL_A + '?authSig=OK' } });
+  await tick();
+  assert.equal(s.display(hass, URL_A), URL_A + '?authSig=OK');
+});
+
+test('R4-2: a request that never settles stops blocking after the timeout', async () => {
+  let t = 1_000_000;
+  const { hass, calls } = makeHass();
+  const { s } = signer(() => t);
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 1);
+
+  t += SIGN_INFLIGHT_MS - 1;
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 1, 'still presumed in flight');
+
+  t += 2;
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 2, 'presumed lost — asked again');
+
+  // the FIRST promise finally answers: it must not resurrect a stale in-flight
+  calls[0].res({ urls: { [URL_A]: URL_A + '?authSig=LATE' } });
+  await tick();
+  assert.deepEqual(s.inFlightUrls, [URL_A], 'only the second attempt is in flight');
+});
+
+test('signatures age: fresh, aging, expired', async () => {
+  let t = 1_000_000;
+  const { hass, calls } = makeHass();
+  const { s } = signer(() => t);
+  s.display(hass, URL_A);
+  await tick();
+  calls[0].res({ urls: { [URL_A]: URL_A + '?authSig=ONE' } });
+  await tick();
+
+  assert.equal(s.display(hass, URL_A), URL_A + '?authSig=ONE');
+  assert.equal(calls.length, 1, 'a fresh signature asks for nothing');
+
+  t += SIGN_REFRESH_MS + 1; // aging: keep rendering, fetch a replacement
+  assert.equal(s.display(hass, URL_A), URL_A + '?authSig=ONE');
+  await tick();
+  assert.equal(calls.length, 2);
+
+  t += SIGN_TTL_MS; // expired: rendering it would 401
+  assert.equal(s.display(hass, URL_A), '');
+  assert.equal(s.entries[URL_A], undefined, 'the dead entry is dropped');
+});
+
+test('a non-content url is passed straight through, nothing is signed', async () => {
+  const { hass, calls } = makeHass();
+  const { s } = signer();
+  assert.equal(s.display(hass, '/local/plan.png'), '/local/plan.png');
+  assert.equal(s.display(hass, ''), '');
+  assert.equal(s.display(hass, null), '');
+  await tick();
+  assert.equal(calls.length, 0);
+});
+
+test('legacy urls are normalised before signing', async () => {
+  const { hass, calls } = makeHass();
+  const { s } = signer();
+  s.display(hass, '/houseplan_files/plans/f1.svg');
+  await tick();
+  assert.deepEqual(calls[0].paths, ['/api/houseplan/content/plans/_/f1.svg']);
+});
+
+test('resign prunes to the referenced set and gives everything a fresh chance', async () => {
+  let t = 1_000_000;
+  const { hass, calls } = makeHass();
+  const { s } = signer(() => t);
+  s.display(hass, URL_A);
+  s.display(hass, URL_B);
+  await tick();
+  calls[0].res({ urls: { [URL_A]: URL_A + '?s=1', [URL_B]: URL_B + '?s=1' } });
+  await tick();
+  assert.equal(Object.keys(s.entries).length, 2);
+
+  s.resign(hass, new Set([URL_A]));
+  await tick();
+  assert.deepEqual(Object.keys(s.entries), [URL_A], 'the unreferenced url is dropped');
+  assert.deepEqual(calls[1].paths, [URL_A]);
+});
+
+test('dispose(): a late answer neither renders nor throws, start() revives it', async () => {
+  const { hass, calls } = makeHass();
+  const { s, updates } = signer();
+  s.display(hass, URL_A);
+  await tick();
+  s.dispose();
+  calls[0].res({ urls: { [URL_A]: URL_A + '?authSig=LATE' } });
+  await tick();
+  assert.equal(updates(), 0, 'no re-render after teardown');
+
+  s.start(() => hass, () => new Set([URL_A]));
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 2, 'a reconnected card asks again');
+  calls[1].res({ urls: { [URL_A]: URL_A + '?authSig=NEW' } });
+  await tick();
+  assert.equal(updates(), 1);
+  assert.equal(s.display(hass, URL_A), URL_A + '?authSig=NEW');
+  s.dispose();
+});
+
+test('R5-1: an empty but successful answer still backs off', async () => {
+  let t = 1_000_000;
+  const { hass, calls } = makeHass();
+  const { s, updates } = signer(() => t);
+  s.display(hass, URL_A);
+  await tick();
+  calls[0].res({ urls: {} }); // the backend skipped the path it could not sign
+  await tick();
+  assert.equal(updates(), 0, 'nothing was signed, so nothing to re-render for');
+
+  for (let i = 0; i < 5; i++) { s.display(hass, URL_A); await tick(); }
+  assert.equal(calls.length, 1, 'five renders, still one request');
+
+  t += SIGN_BACKOFF_MIN_MS + 1;
+  s.display(hass, URL_A);
+  await tick();
+  assert.equal(calls.length, 2, 'retried after the backoff');
+});
+
+test('R5-1: a partial answer backs off only the path that is missing', async () => {
+  let t = 1_000_000;
+  const { hass, calls } = makeHass();
+  const { s } = signer(() => t);
+  s.display(hass, URL_A);
+  s.display(hass, URL_B);
+  await tick();
+  assert.deepEqual(calls[0].paths.sort(), [URL_B, URL_A].sort());
+
+  calls[0].res({ urls: { [URL_A]: URL_A + '?authSig=OK' } }); // B was skipped
+  await tick();
+  assert.equal(s.display(hass, URL_A), URL_A + '?authSig=OK');
+  assert.equal(s.display(hass, URL_B), '');
+  await tick();
+  assert.equal(calls.length, 1, 'the missing path is in backoff, not re-asked');
+
+  t += SIGN_BACKOFF_MIN_MS + 1;
+  s.display(hass, URL_A);
+  s.display(hass, URL_B);
+  await tick();
+  assert.deepEqual(calls[1].paths, [URL_B], 'only the missing path is retried');
+
+  calls[1].res({ urls: { [URL_B]: URL_B + '?authSig=OK' } });
+  await tick();
+  assert.equal(s.display(hass, URL_B), URL_B + '?authSig=OK');
+  t += SIGN_BACKOFF_MIN_MS * 8;
+  s.display(hass, URL_B);
+  await tick();
+  assert.equal(calls.length, 2, 'a success clears the backoff state, no stray retry');
+});
+
+test('R5-1: a key we never asked for is ignored', async () => {
+  const { hass, calls } = makeHass();
+  const { s } = signer();
+  s.display(hass, URL_A);
+  await tick();
+  calls[0].res({ urls: { [URL_A]: URL_A + '?authSig=OK', '/api/houseplan/content/files/x/evil.pdf': 'nope' } });
+  await tick();
+  assert.deepEqual(Object.keys(s.entries), [URL_A]);
+});

tests_backend/test_ha_upload.py

@@ -32,7 +32,10 @@ async def test_upload_ok(hass: HomeAssistant, hass_client: ClientSessionGenerato
     assert resp.status == 200
     body = await resp.json()
     # audit B1: uploads now return the AUTHENTICATED content URL
-    assert body["ok"] and body["url"].startswith("/api/houseplan/content/files/m1/manual.pdf?v=")
+    # HP-1454-02: uploads take a FREE name and never overwrite, so the url is
+    # the name that was actually used — no cache-busting query needed any more
+    assert body["ok"] and body["url"].startswith("/api/houseplan/content/files/m1/manual")
+    assert body["url"].endswith(".pdf") and "?" not in body["url"]
 
 
 async def test_upload_bad_ext(hass: HomeAssistant, hass_client: ClientSessionGenerator) -> None:

tests_backend/test_ha_websocket.py

@@ -99,7 +99,11 @@ async def test_plan_set_validates(hass: HomeAssistant, hass_ws_client: WebSocket
         {"type": "houseplan/plan/set", "space_id": "s1", "ext": "png", "data": "aGVsbG8="}
     )
     resp = await client.receive_json()
-    assert resp["success"] and resp["result"]["url"].startswith("/api/houseplan/content/plans/_/s1.png?v=")
+    url = resp["result"]["url"]
+    assert resp["success"]
+    # versioned name: "<space>.<token>.<ext>" (review R2-1)
+    name = url.rsplit("/", 1)[-1]
+    assert name.startswith("s1.") and name.endswith(".png") and len(name.split(".")) == 3
 
 
 async def test_admin_check_fails_closed(hass, hass_ws_client):
@@ -179,6 +183,285 @@ async def test_files_migrate_copies_and_reports_mapping(
     assert not await hass.async_add_executor_job(lambda: os.path.isdir(src))
 
 
+async def _cfg(spaces: list[dict]) -> dict:
+    """Minimal accepted configuration with the given spaces."""
+    return {
+        "spaces": [
+            {"id": sp["id"], "title": sp["id"], "plan_url": sp.get("plan_url"),
+             "aspect": 1.4, "view_box": [0, 0, 1, 1], "rooms": []}
+            for sp in spaces
+        ],
+        "markers": [],
+    }
+
+
+async def _save(client, config, expected_rev):
+    await client.send_json_auto_id(
+        {"type": "houseplan/config/set", "config": config, "expected_rev": expected_rev}
+    )
+    return await client.receive_json()
+
+
+async def _upload(client, space_id, data=b"x", ext="png"):
+    import base64 as _b64
+
+    await client.send_json_auto_id({
+        "type": "houseplan/plan/set", "space_id": space_id, "ext": ext,
+        "data": _b64.b64encode(data).decode(),
+    })
+    resp = await client.receive_json()
+    return resp["result"]["url"], resp["result"]["url"].rsplit("/", 1)[-1]
+
+
+async def test_plan_upload_does_not_touch_the_previous_file(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """review R2-1: a rejected config write must leave the stored plan intact.
+
+    The upload used to overwrite "<space>.<ext>" (and unlink the other
+    extension) BEFORE the revision-checked config write, so a conflict left the
+    live plan replaced — or, with a new extension, pointing at a deleted file.
+    """
+    from pathlib import Path
+
+    from custom_components.houseplan.const import PLANS_DIR
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    plans = Path(hass.config.path(PLANS_DIR))
+    plans.mkdir(parents=True, exist_ok=True)
+    for stale in plans.glob("s9.*"):
+        stale.unlink()
+    legacy = plans / "s9.svg"  # what an older version stored, still referenced
+    legacy.write_bytes(b"<svg>old</svg>")
+
+    url0 = "/api/houseplan/content/plans/_/s9.svg"
+    resp = await _save(client, await _cfg([{"id": "s9", "plan_url": url0}]), 0)
+    rev = resp["result"]["rev"]
+    assert legacy.is_file()
+
+    url1, first = await _upload(client, "s9", b"hello")
+    # config write rejected (stale revision): nothing on disk may change
+    bad = await _save(client, await _cfg([{"id": "s9", "plan_url": url1}]), rev - 1)
+    assert not bad["success"] and bad["error"]["code"] == "conflict"
+    assert legacy.read_bytes() == b"<svg>old</svg>"
+    assert (plans / first).read_bytes() == b"hello"
+
+    # a second attempt neither overwrites the first nor the legacy file
+    url2, second = await _upload(client, "s9", b"world")
+    assert second != first
+    assert (plans / first).read_bytes() == b"hello"
+    assert legacy.is_file()
+
+    # config accepted → the superseded file goes, the referenced one stays.
+    # `first` is a rejected upload: it is young, so it is kept for now.
+    ok = await _save(client, await _cfg([{"id": "s9", "plan_url": url2}]), rev)
+    assert ok["success"]
+    assert (plans / second).read_bytes() == b"world"
+    assert not legacy.exists(), "the superseded plan is collected"
+    assert (plans / first).is_file(), "a fresh unreferenced upload is NOT collected"
+
+
+async def test_late_commit_of_one_client_never_deletes_another_client_s_plan(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """review R3-1: collection belongs to the commit, not to a client's request.
+
+    With the previous `plan/cleanup(keep=...)` command, this interleaving left
+    the accepted configuration pointing at a file that had just been deleted:
+
+        A: upload PA, config/set(PA) accepted
+        B: upload PB, config/set(PB) accepted
+        A: cleanup(keep=PA)  ->  removes PB
+
+    Collection now runs inside config/set under the write lock, so a late
+    client cannot express an opinion about a revision it never saw.
+    """
+    from pathlib import Path
+
+    from custom_components.houseplan.const import PLANS_DIR
+
+    await _setup(hass)
+    a = await hass_ws_client(hass)
+    b = await hass_ws_client(hass)
+    plans = Path(hass.config.path(PLANS_DIR))
+    plans.mkdir(parents=True, exist_ok=True)
+    for stale in plans.glob("r1.*"):
+        stale.unlink()
+
+    url0, p0 = await _upload(a, "r1", b"zero")
+    rev = (await _save(a, await _cfg([{"id": "r1", "plan_url": url0}]), 0))["result"]["rev"]
+
+    url_a, pa = await _upload(a, "r1", b"aaa")
+    rev_a = (await _save(a, await _cfg([{"id": "r1", "plan_url": url_a}]), rev))["result"]["rev"]
+    assert not (plans / p0).exists(), "P0 was superseded by A"
+
+    url_b, pb = await _upload(b, "r1", b"bbb")
+    ok = await _save(b, await _cfg([{"id": "r1", "plan_url": url_b}]), rev_a)
+    assert ok["success"]
+
+    # the accepted configuration points at PB, and PB is on disk
+    assert (plans / pb).read_bytes() == b"bbb"
+    assert not (plans / pa).exists(), "PA was superseded by B's commit"
+
+
+async def test_commit_does_not_collect_another_client_s_uncommitted_upload(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """review R3-1, second interleaving: B uploads, A commits, then B commits.
+
+    A's commit must not remove PB — B has not written its configuration yet, so
+    PB is unreferenced but belongs to a live transaction. Age is the guard.
+    """
+    from pathlib import Path
+
+    from custom_components.houseplan.const import PLANS_DIR
+
+    await _setup(hass)
+    a = await hass_ws_client(hass)
+    b = await hass_ws_client(hass)
+    plans = Path(hass.config.path(PLANS_DIR))
+    plans.mkdir(parents=True, exist_ok=True)
+    for stale in plans.glob("r2.*"):
+        stale.unlink()
+
+    url0, _p0 = await _upload(a, "r2", b"zero")
+    rev = (await _save(a, await _cfg([{"id": "r2", "plan_url": url0}]), 0))["result"]["rev"]
+
+    _url_b, pb = await _upload(b, "r2", b"bbb")     # B uploads, does not commit
+    url_a, pa = await _upload(a, "r2", b"aaa")
+    rev_a = (await _save(a, await _cfg([{"id": "r2", "plan_url": url_a}]), rev))["result"]["rev"]
+    assert (plans / pb).is_file(), "an uncommitted upload survives someone else's commit"
+
+    # B now commits on top of A's revision — its file is still there
+    ok = await _save(b, await _cfg([{"id": "r2", "plan_url": "/api/houseplan/content/plans/_/" + pb}]), rev_a)
+    assert ok["success"]
+    assert (plans / pb).read_bytes() == b"bbb"
+    assert not (plans / pa).exists()
+
+
+async def test_abandoned_uploads_are_collected_once_old(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """A rejected upload must not accumulate forever — but only age may free it."""
+    import os
+    import time
+    from pathlib import Path
+
+    from custom_components.houseplan.const import PLANS_DIR, PLAN_ORPHAN_TTL_S
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    plans = Path(hass.config.path(PLANS_DIR))
+    plans.mkdir(parents=True, exist_ok=True)
+    for stale in plans.glob("r3.*"):
+        stale.unlink()
+
+    url0, p0 = await _upload(client, "r3", b"zero")
+    rev = (await _save(client, await _cfg([{"id": "r3", "plan_url": url0}]), 0))["result"]["rev"]
+
+    _url, orphan = await _upload(client, "r3", b"abandoned")
+    old = time.time() - PLAN_ORPHAN_TTL_S - 60
+    os.utime(plans / orphan, (old, old))
+
+    ok = await _save(client, await _cfg([{"id": "r3", "plan_url": url0}]), rev)
+    assert ok["success"]
+    assert not (plans / orphan).exists(), "an aged, unreferenced upload is collected"
+    assert (plans / p0).is_file(), "the referenced plan is never touched"
+
+
+async def test_collection_ignores_files_that_are_not_plans(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """The plans directory may hold nothing else, but be sure we only take ours."""
+    import os
+    import time
+    from pathlib import Path
+
+    from custom_components.houseplan.const import PLANS_DIR, PLAN_ORPHAN_TTL_S
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    plans = Path(hass.config.path(PLANS_DIR))
+    plans.mkdir(parents=True, exist_ok=True)
+    old = time.time() - PLAN_ORPHAN_TTL_S - 60
+    for name in ("notes.txt", "deep.name.with.dots.png", "readme"):
+        (plans / name).write_bytes(b"x")
+        os.utime(plans / name, (old, old))
+
+    rev = (await _save(client, await _cfg([{"id": "r4", "plan_url": None}]), 0))["result"]["rev"]
+    assert rev
+    assert (plans / "notes.txt").is_file()
+    assert (plans / "deep.name.with.dots.png").is_file()
+    assert (plans / "readme").is_file()
+
+
+async def test_a_marker_showing_its_value_can_be_saved(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """issue #3: display='value' was rejected, and one bad marker fails the lot.
+
+    A user could not save the configuration at all after setting any sensor to
+    "value instead of an icon" — the editor offered the option, the schema had
+    never heard of it.
+    """
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+
+    cfg = await _cfg([{"id": "f1", "plan_url": None}])
+    cfg["markers"] = [
+        {"id": "sensor.t", "binding": "entity:sensor.t", "display": "value"},
+        {"id": "sensor.h", "binding": "entity:sensor.h", "display": "badge"},
+    ]
+    ok = await _save(client, cfg, 0)
+    assert ok["success"], ok.get("error")
+
+    await client.send_json_auto_id({"type": "houseplan/config/get"})
+    got = await client.receive_json()
+    assert [m["display"] for m in got["result"]["config"]["markers"]] == ["value", "badge"]
+
+
+async def test_a_failing_collector_does_not_undo_an_accepted_save(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator, monkeypatch
+) -> None:
+    """review R4-1: garbage collection runs behind an already durable write.
+
+    If it raised, the client got an error for a revision the store had already
+    accepted — and its retry then failed with `conflict`, because the server had
+    moved on. The commit stands and the event fires regardless.
+    """
+    from custom_components.houseplan import websocket_api as wsapi
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+
+    events = []
+    hass.bus.async_listen("houseplan_config_updated", lambda ev: events.append(ev.data))
+
+    def _boom(*_a, **_k):
+        raise OSError("the plans directory is on fire")
+
+    monkeypatch.setattr(wsapi, "collect_plans", _boom)
+
+    cfg = await _cfg([{"id": "r5", "plan_url": None}])
+    ok = await _save(client, cfg, 0)
+    assert ok["success"], "an accepted revision must be reported as accepted"
+    rev = ok["result"]["rev"]
+
+    await hass.async_block_till_done()
+    assert events and events[-1]["rev"] == rev, "the update event still fires"
+
+    # the store really holds the new revision, and the reported rev is usable
+    await client.send_json_auto_id({"type": "houseplan/config/get"})
+    got = await client.receive_json()
+    assert got["result"]["rev"] == rev
+    assert [sp["id"] for sp in got["result"]["config"]["spaces"]] == ["r5"]
+
+    monkeypatch.undo()
+    again = await _save(client, cfg, rev)
+    assert again["success"], "the next CAS on the reported revision goes through"
+
+
 async def test_content_signed_path_opens_without_a_bearer_header(
     hass: HomeAssistant, hass_ws_client: WebSocketGenerator, hass_client_no_auth
 ) -> None:
@@ -221,3 +504,499 @@ async def test_content_signed_path_opens_without_a_bearer_header(
     )
     resp2 = await client.receive_json()
     assert resp2["success"] and resp2["result"]["urls"] == {}
+
+
+async def test_signing_one_path_may_fail_without_failing_the_request(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator, monkeypatch
+) -> None:
+    """review R5-1: pin the contract the card now codes against.
+
+    One unsignable path must NOT fail the whole call — a single bad url would
+    otherwise block the signatures of every other file in the batch. The answer
+    is a partial map, and the card treats a path missing from it as a failure
+    for that path (backing off) rather than as success.
+    """
+    from custom_components.houseplan import websocket_api as wsapi
+    from custom_components.houseplan.const import CONTENT_URL
+
+    await _setup(hass)
+    good = f"{CONTENT_URL}/plans/_/good.png"
+    bad = f"{CONTENT_URL}/plans/_/bad.png"
+
+    real = wsapi.async_sign_path if hasattr(wsapi, "async_sign_path") else None
+    assert real is None  # imported inside the handler, so patch the source module
+
+    import homeassistant.components.http.auth as ha_auth
+
+    original = ha_auth.async_sign_path
+
+    def _sign(hass_, *args, **kwargs):
+        path = next((a for a in args if isinstance(a, str) and a.startswith("/")), "")
+        if path == bad:
+            raise ValueError("cannot sign this one")
+        return original(hass_, *args, **kwargs)
+
+    monkeypatch.setattr(ha_auth, "async_sign_path", _sign)
+
+    client = await hass_ws_client(hass)
+    await client.send_json_auto_id({"type": "houseplan/content/sign", "paths": [good, bad]})
+    resp = await client.receive_json()
+    assert resp["success"], "one bad path must not fail the batch"
+    urls = resp["result"]["urls"]
+    assert good in urls and "authSig=" in urls[good]
+    assert bad not in urls, "an unsignable path is absent, never an unsigned url"
+
+
+async def test_config_write_is_capped_by_total_size(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """HP-1454-05: per-field limits bound each list, this bounds their product."""
+    from custom_components.houseplan.validation import MAX_CONFIG_BYTES, MAX_TEXT
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    cfg = await _cfg([{"id": "f1", "plan_url": None}])
+    # every field inside the caps, the whole thing far past them
+    blob = "d" * MAX_TEXT
+    cfg["settings"] = {"known_devices": [blob] * (MAX_CONFIG_BYTES // MAX_TEXT + 100)}
+    resp = await _save(client, cfg, 0)
+    assert not resp["success"] and resp["error"]["code"] == "too_large"
+
+    cfg["settings"] = {"known_devices": ["ok"]}
+    assert (await _save(client, cfg, 0))["success"]
+
+
+async def test_layout_keeps_its_revision_and_announces_changes(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """HP-1454-08: point-wise writes used to drop the revision and say nothing.
+
+    layout/set offered optimistic locking, but every drag wrote {"layout": …}
+    and reset the counter to 0, so the lock protected nothing; and a static card
+    on the same dashboard never learned that a marker had moved.
+    """
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    events: list[dict] = []
+    hass.bus.async_listen("houseplan_layout_updated", lambda ev: events.append(ev.data))
+
+    await client.send_json_auto_id({"type": "houseplan/layout/get"})
+    assert (await client.receive_json())["result"]["rev"] == 0
+
+    await client.send_json_auto_id(
+        {"type": "houseplan/layout/set", "layout": {"a": {"x": 1, "y": 2}}, "expected_rev": 0}
+    )
+    rev = (await client.receive_json())["result"]["rev"]
+    assert rev == 1
+
+    await client.send_json_auto_id(
+        {"type": "houseplan/layout/update", "device_id": "b", "pos": {"x": 3, "y": 4}}
+    )
+    assert (await client.receive_json())["result"]["rev"] == 2
+
+    await client.send_json_auto_id({"type": "houseplan/layout/delete", "device_id": "b"})
+    assert (await client.receive_json())["result"]["rev"] == 3
+
+    await client.send_json_auto_id({"type": "houseplan/layout/get"})
+    got = await client.receive_json()
+    assert got["result"]["rev"] == 3 and got["result"]["layout"] == {"a": {"x": 1, "y": 2}}
+
+    # a stale wholesale write is refused, which it could not be before
+    await client.send_json_auto_id(
+        {"type": "houseplan/layout/set", "layout": {}, "expected_rev": 1}
+    )
+    bad = await client.receive_json()
+    assert not bad["success"] and bad["error"]["code"] == "conflict"
+
+    await hass.async_block_till_done()
+    assert [e["rev"] for e in events] == [1, 2, 3]
+
+
+async def test_uploaded_svg_is_sandboxed_and_a_pdf_is_not(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator, hass_client
+) -> None:
+    """HP-1454-01: user SVG served from HA's origin must not be a live document.
+
+    Only SVG gets the header: a CSP on a PDF response can break the browser's
+    built-in viewer, and a raster image cannot execute anything anyway.
+    """
+    import os
+
+    from custom_components.houseplan.const import CONTENT_URL, FILES_DIR, PLANS_DIR
+
+    await _setup(hass)
+    plans = hass.config.path(PLANS_DIR)
+    files = os.path.join(hass.config.path(FILES_DIR), "m1")
+
+    def _write() -> None:
+        os.makedirs(plans, exist_ok=True)
+        os.makedirs(files, exist_ok=True)
+        with open(os.path.join(plans, "x.svg"), "wb") as fh:
+            fh.write(b"<svg xmlns='http://www.w3.org/2000/svg'/>")
+        with open(os.path.join(plans, "x.png"), "wb") as fh:
+            fh.write(b"PNG")
+        with open(os.path.join(files, "m.pdf"), "wb") as fh:
+            fh.write(b"%PDF-1.4")
+
+    await hass.async_add_executor_job(_write)
+    http = await hass_client()
+
+    svg = await http.get(f"{CONTENT_URL}/plans/_/x.svg")
+    assert svg.status == 200
+    csp = svg.headers.get("Content-Security-Policy", "")
+    assert "sandbox" in csp and "script-src 'none'" in csp
+    assert svg.headers["Content-Type"].startswith("image/svg+xml")
+
+    png = await http.get(f"{CONTENT_URL}/plans/_/x.png")
+    assert png.status == 200 and "Content-Security-Policy" not in png.headers
+
+    pdf = await http.get(f"{CONTENT_URL}/files/m1/m.pdf")
+    assert pdf.status == 200 and "Content-Security-Policy" not in pdf.headers
+    assert await pdf.read() == b"%PDF-1.4"
+
+
+async def test_upload_never_overwrites_an_existing_attachment(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator, hass_client
+) -> None:
+    """HP-1454-02: an upload is not part of the config transaction.
+
+    Writing straight to `<marker>/<filename>` meant a cancelled dialog — or a
+    rejected save — left the stored url serving the new bytes. And two new
+    markers both uploading `manual.pdf` shared one physical file.
+    """
+    import os
+
+    from custom_components.houseplan.const import CONTENT_URL, FILES_DIR
+
+    await _setup(hass)
+    http = await hass_client()
+
+    async def upload(marker_id: str, name: str, data: bytes) -> str:
+        import aiohttp
+
+        writer = aiohttp.FormData()
+        writer.add_field("marker_id", marker_id)
+        writer.add_field("file", data, filename=name)
+        resp = await http.post("/api/houseplan/upload", data=writer)
+        assert resp.status == 200, await resp.text()
+        return (await resp.json())["url"]
+
+    first = await upload("m9", "manual.pdf", b"ONE")
+    second = await upload("m9", "manual.pdf", b"TWO")
+    assert first != second, "the second upload must not take the first name"
+
+    folder = os.path.join(hass.config.path(FILES_DIR), "m9")
+    # the HA test config dir is shared across the module — hence our own marker id
+    names = sorted(
+        n for n in await hass.async_add_executor_job(os.listdir, folder) if n.startswith("manual")
+    )
+    assert names == ["manual-2.pdf", "manual.pdf"]
+
+    got = await http.get(first.replace(CONTENT_URL, CONTENT_URL))
+    assert await got.read() == b"ONE", "the first file is untouched"
+    got2 = await http.get(second)
+    assert await got2.read() == b"TWO"
+
+
+async def test_upload_leaves_no_temporary_behind(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator, hass_client, monkeypatch
+) -> None:
+    """HP-1460-02: every exit path must take its temporary file with it.
+
+    The streaming rewrite kept one `tmp_path` and cleaned it in an
+    `except Exception`, which cancellation (a BaseException) walks straight
+    past — and the attachment collector only ever looks inside marker folders,
+    so a stranded `.upload-*` was never seen again.
+    """
+    import os
+
+    from custom_components.houseplan import http_api
+    from custom_components.houseplan.const import FILES_DIR
+    from custom_components.houseplan.plans import TMP_PREFIX
+
+    await _setup(hass)
+    http = await hass_client()
+    root = hass.config.path(FILES_DIR)
+
+    def temps() -> list[str]:
+        return [n for n in os.listdir(root) if n.startswith(TMP_PREFIX)]
+
+    import aiohttp
+
+    def form(*files, marker="m8"):
+        w = aiohttp.FormData()
+        w.add_field("marker_id", marker)
+        for name, data in files:
+            w.add_field("file", data, filename=name)
+        return w
+
+    # two file parts: refused, and nothing left over
+    resp = await http.post("/api/houseplan/upload", data=form(("a.pdf", b"A"), ("b.pdf", b"B")))
+    assert resp.status == 400 and (await resp.json())["error"] == "one_file_only"
+    assert temps() == []
+
+    # a rejected extension after the temporary already exists
+    resp = await http.post("/api/houseplan/upload", data=form(("evil.exe", b"X")))
+    assert resp.status == 400
+    assert temps() == []
+
+    # promotion itself blows up
+    real = http_api.reserve_filename
+
+    def _boom(*_a, **_k):
+        raise OSError("disk on fire")
+
+    monkeypatch.setattr(http_api, "reserve_filename", _boom)
+    resp = await http.post("/api/houseplan/upload", data=form(("c.pdf", b"C")))
+    assert resp.status == 500
+    assert temps() == [], "a failed promotion must not strand the upload"
+    monkeypatch.setattr(http_api, "reserve_filename", real)
+
+    # and the happy path leaves nothing either
+    resp = await http.post("/api/houseplan/upload", data=form(("d.pdf", b"D")))
+    assert resp.status == 200
+    assert temps() == []
+
+
+async def test_repair_issue_goes_when_its_space_does(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """HP-1454-09: the cleanup used to walk only spaces that still exist.
+
+    So deleting or renaming a space with a missing plan left its warning in
+    Repairs with nothing able to clear it.
+    """
+    from homeassistant.helpers import issue_registry as ir
+
+    from custom_components.houseplan.const import DOMAIN as HP_DOMAIN
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    registry = ir.async_get(hass)
+
+    gone = "/api/houseplan/content/plans/_/nosuchfile.png"
+    rev = (await _save(client, await _cfg([{"id": "r7", "plan_url": gone}]), 0))["result"]["rev"]
+    await hass.async_block_till_done()
+    assert registry.async_get_issue(HP_DOMAIN, "broken_plan_r7") is not None
+
+    # the space is deleted entirely — the warning must not outlive it
+    await _save(client, await _cfg([{"id": "other", "plan_url": None}]), rev)
+    await hass.async_block_till_done()
+    assert registry.async_get_issue(HP_DOMAIN, "broken_plan_r7") is None
+
+
+async def test_cancelling_an_upload_takes_its_temporary_with_it(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """HP-1460-02, properly this time: cancellation, not an ordinary error.
+
+    `asyncio.CancelledError` is a BaseException, so the old `except Exception`
+    never saw it and an aborted transfer stranded its `.upload-*`. The previous
+    test claimed to cover this and did not — it only exercised error paths.
+    """
+    import asyncio
+    import os
+
+    from custom_components.houseplan.const import FILES_DIR
+    from custom_components.houseplan.http_api import HouseplanUploadView
+    from custom_components.houseplan.plans import TMP_PREFIX
+
+    entry = await _setup(hass)
+    root = hass.config.path(FILES_DIR)
+    os.makedirs(root, exist_ok=True)
+
+    started = asyncio.Event()
+
+    class _Part:
+        name = "file"
+        filename = "big.pdf"
+
+        async def read_chunk(self, _size):
+            started.set()
+            await asyncio.sleep(3600)  # the client stopped sending; we wait
+
+    class _Reader:
+        def __aiter__(self):
+            return self
+
+        async def __anext__(self):
+            if getattr(self, "_done", False):
+                raise StopAsyncIteration
+            self._done = True
+            return _Part()
+
+    from custom_components.houseplan import http_api as hp_http
+
+    class _User:
+        is_admin = True
+
+    class _Request:
+        app = {hp_http.KEY_HASS: hass}
+
+        def get(self, _key, default=None):
+            return _User()
+
+        async def multipart(self):
+            return _Reader()
+
+    task = hass.async_create_task(HouseplanUploadView().post(_Request()))
+    await started.wait()
+    await asyncio.sleep(0)
+    assert [n for n in os.listdir(root) if n.startswith(TMP_PREFIX)], "temp exists mid-upload"
+
+    task.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await task
+    await hass.async_block_till_done()
+
+    assert [n for n in os.listdir(root) if n.startswith(TMP_PREFIX)] == [], (
+        "a cancelled upload must not leave its temporary behind"
+    )
+    assert entry
+
+
+async def _seed_aged(hass, names) -> None:
+    """Create the given files and backdate them past the orphan TTL."""
+    import os
+    import time
+
+    from custom_components.houseplan.const import PLAN_ORPHAN_TTL_S
+
+    old = time.time() - PLAN_ORPHAN_TTL_S - 60
+
+    def _do() -> None:
+        for path in names:
+            os.makedirs(os.path.dirname(path), exist_ok=True)
+            with open(path, "wb") as fh:
+                fh.write(b"x")
+            os.utime(path, (old, old))
+
+    await hass.async_add_executor_job(_do)
+
+
+def _paths(hass):
+    import os
+
+    from custom_components.houseplan.const import FILES_DIR, PLANS_DIR
+
+    files = hass.config.path(FILES_DIR)
+    plans = hass.config.path(PLANS_DIR)
+    return files, plans, {
+        "kept_file": os.path.join(files, "m5", "kept.pdf"),
+        "kept_plan": os.path.join(plans, "s5.tok.png"),
+        "orphan_file": os.path.join(files, "up_cancelled", "manual.pdf"),
+        "orphan_plan": os.path.join(plans, "s5.orphan.png"),
+    }
+
+
+async def _referenced_config() -> dict:
+    cfg = await _cfg([{"id": "s5", "plan_url": "/api/houseplan/content/plans/_/s5.tok.png"}])
+    cfg["markers"] = [
+        {"id": "m5", "binding": "virtual",
+         "pdfs": [{"name": "k", "url": "/api/houseplan/content/files/m5/kept.pdf"}]}
+    ]
+    return cfg
+
+
+async def _assert_swept(hass, p) -> None:
+    import os
+
+    assert await hass.async_add_executor_job(os.path.isfile, p["kept_file"]), "referenced file kept"
+    assert await hass.async_add_executor_job(os.path.isfile, p["kept_plan"]), "referenced plan kept"
+    assert not await hass.async_add_executor_job(os.path.isfile, p["orphan_file"])
+    assert not await hass.async_add_executor_job(os.path.isfile, p["orphan_plan"])
+
+
+async def test_startup_sweep_collects_what_no_commit_will(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """HP-1461-01 / HP-1462-01: collection must not depend on a future save.
+
+    The files are seeded AFTER the configuration is stored. The previous version
+    of this test seeded them before, and `config/set` collects too — so it
+    passed without the startup pass doing anything, hiding HP-1462-01: during
+    setup the entry is not "loaded" yet, so looking its runtime data up by
+    domain returned None and the pass degraded to removing streaming
+    temporaries only.
+    """
+    import os
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    files, _plans, p = _paths(hass)
+    assert (await _save(client, await _referenced_config(), 0))["success"]
+
+    await _seed_aged(hass, list(p.values()))
+
+    entry = hass.config_entries.async_entries(DOMAIN)[0]
+    assert await hass.config_entries.async_reload(entry.entry_id)
+    await hass.async_block_till_done()
+
+    await _assert_swept(hass, p)
+    assert not await hass.async_add_executor_job(
+        os.path.isdir, os.path.join(files, "up_cancelled")
+    ), "the emptied staging folder goes with its last file"
+
+
+async def test_periodic_sweep_collects_too(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """The scheduled pass, invoked directly rather than by faking a 24 h jump.
+
+    Firing a time change proves the timer fires; awaiting the callback proves it
+    does the work. This asserts the second, which is the part that regressed.
+    """
+    from custom_components.houseplan.store import get_data
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    _files, _plans, p = _paths(hass)
+    assert (await _save(client, await _referenced_config(), 0))["success"]
+
+    await _seed_aged(hass, list(p.values()))
+
+    data = get_data(hass)
+    assert data is not None and data.sweep is not None, "setup must publish the sweep"
+    await data.sweep()
+    await hass.async_block_till_done()
+
+    await _assert_swept(hass, p)
+
+
+async def test_sweep_and_a_config_write_do_not_race(
+    hass: HomeAssistant, hass_ws_client: WebSocketGenerator
+) -> None:
+    """Both take the same write lock, so an accepted config cannot lose a file.
+
+    Without it the sweep could decide a file is unreferenced, a commit could
+    start referencing it, and the file would go — leaving the accepted revision
+    pointing at nothing.
+    """
+    import asyncio
+    import os
+
+    await _setup(hass)
+    client = await hass_ws_client(hass)
+    _files, plans, p = _paths(hass)
+    rev = (await _save(client, await _referenced_config(), 0))["result"]["rev"]
+
+    # an aged, currently unreferenced plan that the commit below adopts
+    newcomer = os.path.join(plans, "s5.newcomer.png")
+    await _seed_aged(hass, [p["kept_file"], p["kept_plan"], newcomer])
+
+    cfg2 = await _referenced_config()
+    cfg2["spaces"][0]["plan_url"] = "/api/houseplan/content/plans/_/s5.newcomer.png"
+
+    entry = hass.config_entries.async_entries(DOMAIN)[0]
+    await asyncio.gather(
+        hass.config_entries.async_reload(entry.entry_id),   # runs the sweep
+        _save(client, cfg2, rev),
+    )
+    await hass.async_block_till_done()
+
+    await client.send_json_auto_id({"type": "houseplan/config/get"})
+    stored = (await client.receive_json())["result"]["config"]
+    referenced = stored["spaces"][0]["plan_url"].rsplit("/", 1)[-1]
+    assert await hass.async_add_executor_job(
+        os.path.isfile, os.path.join(plans, referenced)
+    ), f"the accepted config points at {referenced}, which must exist"

tests_backend/test_validation.py

@@ -15,6 +15,44 @@ v = importlib.util.module_from_spec(_spec)
 _spec.loader.exec_module(v)
 
 
+def _load_pure(name):
+    """Load one pure module of the integration without importing the package.
+
+    custom_components/houseplan/__init__.py pulls in Home Assistant, which the
+    local sandbox does not have; but plans.py is deliberately pure, so a tiny
+    stub package lets it keep its normal relative imports.
+    """
+    import sys
+    import types
+
+    pkg_dir = os.path.join(
+        os.path.dirname(os.path.dirname(__file__)), "custom_components", "houseplan"
+    )
+    pkg = sys.modules.get("hp_pure")
+    if pkg is None:
+        pkg = types.ModuleType("hp_pure")
+        pkg.__path__ = [pkg_dir]
+        sys.modules["hp_pure"] = pkg
+        for dep in ("const", "validation"):
+            sp = importlib.util.spec_from_file_location(
+                f"hp_pure.{dep}", os.path.join(pkg_dir, f"{dep}.py")
+            )
+            mod = importlib.util.module_from_spec(sp)
+            sys.modules[f"hp_pure.{dep}"] = mod
+            sp.loader.exec_module(mod)
+    sp = importlib.util.spec_from_file_location(
+        f"hp_pure.{name}", os.path.join(pkg_dir, f"{name}.py")
+    )
+    mod = importlib.util.module_from_spec(sp)
+    sys.modules[f"hp_pure.{name}"] = mod
+    sp.loader.exec_module(mod)
+    return mod
+
+
+plans = _load_pure("plans")
+const = importlib.import_module("hp_pure.const")
+
+
 def test_sanitize_marker_id():
     assert v.sanitize_marker_id("../etc/passwd") == "_etc_passwd"
     assert v.sanitize_marker_id("..") == "misc"       # pure traversal → misc
@@ -173,3 +211,344 @@ def test_openings_cap_enforced():
         v.CONFIG_SCHEMA({"spaces": [{"id": "s1", "title": "S", "aspect": 1.0,
                                      "view_box": [0, 0, 100, 100], "rooms": [],
                                      "openings": many}]})
+
+
+# ---------- plan-file collection (review R3-1) ----------
+
+
+def _plans(tmp_path, names, age=0.0):
+    import os, time
+    d = tmp_path / "plans"
+    d.mkdir(exist_ok=True)
+    for n in names:
+        (d / n).write_bytes(b"x")
+        if age:
+            t = time.time() - age
+            os.utime(d / n, (t, t))
+    return d
+
+
+def _cfg(*urls):
+    return {"spaces": [{"id": f"s{i}", "plan_url": u} for i, u in enumerate(urls)]}
+
+
+def test_plan_basename_and_refs():
+    plan_basename, plan_refs, is_plan_file = plans.plan_basename, plans.plan_refs, plans.is_plan_file
+
+    assert plan_basename("/api/houseplan/content/plans/_/f1.abc.png?v=7") == "f1.abc.png"
+    assert plan_basename("/houseplan_files/plans/f1.svg") == "f1.svg"
+    assert plan_basename(None) == "" and plan_basename("") == "" and plan_basename(7) == ""
+    assert plan_refs(None) == set() and plan_refs({}) == set()
+    assert plan_refs(_cfg("/p/a.png", None, "/p/b.svg")) == {"a.png", "b.svg"}
+    assert is_plan_file("f1.svg") and is_plan_file("f1.tok.png")
+    assert not is_plan_file("notes.txt") and not is_plan_file("readme")
+    assert not is_plan_file("deep.name.with.dots.png")  # 4 parts: not ours
+
+
+def test_collect_plans_removes_only_the_superseded_file(tmp_path):
+    collect_plans = plans.collect_plans
+
+    d = _plans(tmp_path, ["f1.old.png", "f1.new.png", "f2.png"])
+    removed = collect_plans(d, _cfg("/p/f1.old.png", "/p/f2.png"), _cfg("/p/f1.new.png", "/p/f2.png"))
+    assert removed == 1
+    assert not (d / "f1.old.png").exists()
+    assert (d / "f1.new.png").is_file() and (d / "f2.png").is_file()
+
+
+def test_collect_plans_keeps_a_fresh_unreferenced_upload(tmp_path):
+    """Another client may be mid-transaction: its file is unreferenced but young."""
+    collect_plans = plans.collect_plans
+
+    d = _plans(tmp_path, ["f1.committed.png", "f1.inflight.png"])
+    removed = collect_plans(d, _cfg("/p/f1.committed.png"), _cfg("/p/f1.committed.png"))
+    assert removed == 0
+    assert (d / "f1.inflight.png").is_file()
+
+
+def test_collect_plans_takes_an_aged_orphan(tmp_path):
+    PLAN_ORPHAN_TTL_S = const.PLAN_ORPHAN_TTL_S
+    collect_plans = plans.collect_plans
+
+    d = _plans(tmp_path, ["f1.keep.png"])
+    _plans(tmp_path, ["f1.abandoned.png"], age=PLAN_ORPHAN_TTL_S + 60)
+    removed = collect_plans(d, _cfg("/p/f1.keep.png"), _cfg("/p/f1.keep.png"))
+    assert removed == 1
+    assert (d / "f1.keep.png").is_file() and not (d / "f1.abandoned.png").exists()
+
+
+def test_collect_plans_never_touches_a_referenced_or_foreign_file(tmp_path):
+    PLAN_ORPHAN_TTL_S = const.PLAN_ORPHAN_TTL_S
+    collect_plans = plans.collect_plans
+
+    old = PLAN_ORPHAN_TTL_S + 60
+    d = _plans(tmp_path, ["f1.png", "notes.txt", "readme", "deep.name.with.dots.png"], age=old)
+    removed = collect_plans(d, _cfg("/p/f1.png"), _cfg("/p/f1.png"))
+    assert removed == 0
+    for n in ("f1.png", "notes.txt", "readme", "deep.name.with.dots.png"):
+        assert (d / n).is_file()
+
+
+def test_collect_plans_survives_a_missing_directory(tmp_path):
+    collect_plans = plans.collect_plans
+
+    assert collect_plans(tmp_path / "nope", _cfg(), _cfg()) == 0
+
+
+def test_collect_plans_never_raises_when_the_directory_disappears(tmp_path, monkeypatch):
+    """review R4-1: it runs behind a durable commit, so it may only report 0."""
+    collect_plans = plans.collect_plans
+    d = tmp_path / "plans"
+    d.mkdir()
+
+    def _boom(self):
+        raise OSError("gone")
+
+    monkeypatch.setattr(type(d), "iterdir", _boom, raising=False)
+    assert collect_plans(d, _cfg("/p/a.png"), _cfg("/p/b.png")) == 0
+
+
+# ---------- the editor's options must be storable (issue #3) ----------
+
+
+def _ts_list(name):
+    """Read one `export const NAME = [...] as const;` list out of src/logic.ts.
+
+    Deliberately reads the TypeScript source rather than duplicating the values:
+    a list that lives in two places drifts, which is exactly what happened here.
+    """
+    import re
+
+    src = os.path.join(os.path.dirname(os.path.dirname(__file__)), "src", "logic.ts")
+    with open(src, encoding="utf-8") as fh:
+        text = fh.read()
+    m = re.search(rf"export const {name} = \[(.*?)\] as const;", text, re.S)
+    assert m, f"{name} not found in src/logic.ts"
+    return re.findall(r"'([^']+)'", m.group(1))
+
+
+def _marker(**extra):
+    return {"id": "m1", "binding": "entity:sensor.x", **extra}
+
+
+def test_every_display_mode_the_editor_offers_is_accepted():
+    """issue #3: 'value' was added to the card in v1.26.0 and never to the schema.
+
+    Saving a sensor set to "value instead of an icon" failed with
+    "not a valid value for dictionary value @ data['config']['markers'][n]['display']",
+    and because one bad marker rejects the whole config, the user could not save
+    at all. Reported 2026-07-27.
+    """
+    modes = _ts_list("DISPLAY_MODES")
+    assert "value" in modes, "the regression this test exists for"
+    for mode in modes:
+        v.MARKER_SCHEMA(_marker(display=mode))
+    v.MARKER_SCHEMA(_marker(display=None))
+    with pytest.raises(vol.Invalid):
+        v.MARKER_SCHEMA(_marker(display="wat"))
+
+
+def test_every_tap_action_the_editor_offers_is_accepted():
+    for action in _ts_list("TAP_ACTIONS"):
+        v.MARKER_SCHEMA(_marker(tap_action=action))
+    with pytest.raises(vol.Invalid):
+        v.MARKER_SCHEMA(_marker(tap_action="launch-missiles"))
+
+
+def _space(**settings):
+    return {
+        "id": "f1", "title": "F1", "aspect": 1.4, "view_box": [0, 0, 1, 1],
+        "rooms": [], "settings": settings,
+    }
+
+
+def test_every_fill_mode_the_editor_offers_is_accepted():
+    for mode in _ts_list("SPACE_FILL_MODES"):
+        v.SPACE_SCHEMA(_space(fill_mode=mode))
+    with pytest.raises(vol.Invalid):
+        v.SPACE_SCHEMA(_space(fill_mode="rainbow"))
+
+
+def test_every_room_fill_mode_the_editor_offers_is_accepted():
+    def room(mode):
+        return {
+            "id": "f1", "title": "F1", "aspect": 1.4, "view_box": [0, 0, 1, 1],
+            "rooms": [{"id": "r1", "name": "R", "x": 0.1, "y": 0.1, "w": 0.2, "h": 0.2,
+                       "settings": {"fill_mode": mode}}],
+        }
+
+    for mode in _ts_list("ROOM_FILL_MODES"):
+        v.SPACE_SCHEMA(room(mode))
+    v.SPACE_SCHEMA(room(None))  # inherit from the space
+    with pytest.raises(vol.Invalid):
+        v.SPACE_SCHEMA(room("rainbow"))
+
+
+# ---------- attachments & inner limits (HP-1454-02, -05) ----------
+
+
+def test_reserve_filename_claims_the_name_atomically(tmp_path):
+    """HP-1460-01: choosing a name and taking it must be one operation.
+
+    The old helper asked `exists()` and returned a string; two uploads racing
+    between the check and the write agreed on the same name and one overwrote
+    the other, both reporting success.
+    """
+    reserve = plans.reserve_filename
+    d = tmp_path / "m1"
+
+    first = reserve(d, "manual.pdf")
+    assert first == "manual.pdf"
+    assert (d / first).is_file(), "the name is taken, not merely picked"
+    second = reserve(d, "manual.pdf")
+    assert second == "manual-2.pdf" and (d / second).is_file()
+    assert reserve(d, "manual.pdf") == "manual-3.pdf"
+
+    assert reserve(d, "readme") == "readme"
+    assert reserve(d, "readme") == "readme-2"
+    assert reserve(d, "../../etc/passwd") == "passwd"
+
+
+def test_reserve_filename_result_survives_the_content_sanitizer(tmp_path):
+    """A name the view would rewrite is a file written and then never served."""
+    reserve = plans.reserve_filename
+    d = tmp_path / "m2"
+    long_stem = "x" * 200                      # far past the limit
+    names = [reserve(d, f"{long_stem}.pdf") for _ in range(12)]
+    assert len(set(names)) == 12, "each call takes its own name"
+    for n in names:
+        assert len(n) <= v.MAX_FILENAME
+        assert v.sanitize_filename(n) == n, n
+        assert n.endswith(".pdf")
+
+    # a name already exactly at the limit still leaves room for the tag
+    exact = "y" * (v.MAX_FILENAME - 4) + ".pdf"
+    assert len(exact) == v.MAX_FILENAME
+    a = reserve(d, exact)
+    b = reserve(d, exact)
+    assert a != b and len(b) <= v.MAX_FILENAME and v.sanitize_filename(b) == b
+
+
+def test_reserve_filename_is_safe_under_concurrency(tmp_path):
+    """Twenty threads, one filename: twenty distinct files, nothing overwritten."""
+    from concurrent.futures import ThreadPoolExecutor
+
+    reserve = plans.reserve_filename
+    d = tmp_path / "m3"
+    d.mkdir(parents=True)
+    with ThreadPoolExecutor(max_workers=20) as pool:
+        names = list(pool.map(lambda _: reserve(d, "manual.pdf"), range(20)))
+    assert len(set(names)) == 20
+    assert sorted(p.name for p in d.iterdir()) == sorted(names)
+
+
+def test_sweep_upload_temps(tmp_path):
+    """HP-1460-02: a crashed transfer leaves a temp no other collector sees."""
+    import os
+    import time
+
+    files = tmp_path / "files"
+    files.mkdir()
+    fresh = files / f"{plans.TMP_PREFIX}fresh"
+    old = files / f"{plans.TMP_PREFIX}old"
+    keep = files / "notes.txt"
+    for f in (fresh, old, keep):
+        f.write_bytes(b"x")
+    t = time.time() - const.PLAN_ORPHAN_TTL_S - 60
+    os.utime(old, (t, t))
+
+    assert plans.sweep_upload_temps(files) == 1
+    assert not old.exists(), "an aged temporary goes"
+    assert fresh.is_file(), "a fresh one may belong to a request in flight"
+    assert keep.is_file(), "nothing else is touched"
+    assert plans.sweep_upload_temps(tmp_path / "nope") == 0
+
+
+def _acfg(*pairs):
+    return {"markers": [{"id": f"m{i}", "pdfs": [{"url": f"/api/houseplan/content/files/{p}"}]}
+                        for i, p in enumerate(pairs)]}
+
+
+def test_attachment_refs_reads_marker_urls():
+    attachment_refs = plans.attachment_refs
+    assert attachment_refs(None) == set()
+    assert attachment_refs(_acfg("m1/a.pdf", "m2/b.pdf")) == {"m1/a.pdf", "m2/b.pdf"}
+    # legacy and foreign urls are not ours to collect against
+    cfg = {"markers": [{"id": "m", "pdfs": [{"url": "/local/x.pdf"}, {"url": "/api/houseplan/content/files/deep/a/b.pdf"}]}]}
+    assert plans.attachment_refs(cfg) == set()
+
+
+def test_collect_attachments_supersedes_and_ages(tmp_path):
+    import os
+    import time
+
+    collect_attachments = plans.collect_attachments
+    files = tmp_path / "files"
+    (files / "m1").mkdir(parents=True)
+    for n in ("old.pdf", "new.pdf", "cancelled.pdf"):
+        (files / "m1" / n).write_bytes(b"x")
+
+    # the commit swapped old.pdf for new.pdf; cancelled.pdf is a fresh upload
+    # nobody saved — it may belong to a dialog that is still open
+    removed = collect_attachments(files, _acfg("m1/old.pdf"), _acfg("m1/new.pdf"))
+    assert removed == 1
+    assert not (files / "m1" / "old.pdf").exists()
+    assert (files / "m1" / "new.pdf").is_file()
+    assert (files / "m1" / "cancelled.pdf").is_file()
+
+    old = time.time() - const.PLAN_ORPHAN_TTL_S - 60
+    os.utime(files / "m1" / "cancelled.pdf", (old, old))
+    assert collect_attachments(files, _acfg("m1/new.pdf"), _acfg("m1/new.pdf")) == 1
+    assert not (files / "m1" / "cancelled.pdf").exists()
+    assert (files / "m1" / "new.pdf").is_file()
+
+
+def test_collect_attachments_removes_the_empty_folder_and_never_raises(tmp_path):
+    import os
+    import time
+
+    files = tmp_path / "files"
+    (files / "up_x").mkdir(parents=True)
+    f = files / "up_x" / "orphan.pdf"
+    f.write_bytes(b"x")
+    old = time.time() - const.PLAN_ORPHAN_TTL_S - 60
+    os.utime(f, (old, old))
+    assert plans.collect_attachments(files, {}, {}) == 1
+    assert not (files / "up_x").exists(), "the staging folder goes with its last file"
+    assert plans.collect_attachments(tmp_path / "nope", {}, {}) == 0
+
+
+def test_inner_collection_limits():
+    room = {"id": "r", "name": "R", "poly": [[0.1, 0.1]] * v.MAX_POLY_POINTS}
+    v.ROOM_SCHEMA(room)
+    with pytest.raises(vol.Invalid):
+        v.ROOM_SCHEMA({**room, "poly": [[0.1, 0.1]] * (v.MAX_POLY_POINTS + 1)})
+
+    rect = {"id": "r", "name": "R", "x": 0.1, "y": 0.1, "w": 0.2, "h": 0.2}
+    v.ROOM_SCHEMA({**rect, "open_to": ["x"] * v.MAX_OPEN_TO})
+    with pytest.raises(vol.Invalid):
+        v.ROOM_SCHEMA({**rect, "open_to": ["x"] * (v.MAX_OPEN_TO + 1)})
+
+    m = {"id": "m", "binding": "virtual"}
+    v.MARKER_SCHEMA({**m, "controls": ["light.x"] * v.MAX_CONTROLS})
+    with pytest.raises(vol.Invalid):
+        v.MARKER_SCHEMA({**m, "controls": ["light.x"] * (v.MAX_CONTROLS + 1)})
+
+    pdf = {"name": "n", "url": "/api/houseplan/content/files/m/a.pdf"}
+    v.MARKER_SCHEMA({**m, "pdfs": [pdf] * v.MAX_PDFS})
+    with pytest.raises(vol.Invalid):
+        v.MARKER_SCHEMA({**m, "pdfs": [pdf] * (v.MAX_PDFS + 1)})
+
+    v.MARKER_SCHEMA({**m, "name": "n" * v.MAX_TEXT})
+    with pytest.raises(vol.Invalid):
+        v.MARKER_SCHEMA({**m, "name": "n" * (v.MAX_TEXT + 1)})
+    with pytest.raises(vol.Invalid):
+        v.MARKER_SCHEMA({**m, "link": "u" * (v.MAX_URL + 1)})
+
+
+def test_legacy_segments_are_dropped_by_the_server():
+    """A limit that depends on the client stripping the field is not a limit."""
+    out = v.SPACE_SCHEMA({
+        "id": "f1", "title": "F", "aspect": 1.4, "view_box": [0, 0, 1, 1], "rooms": [],
+        "segments": [[1, 2, 3, 4]] * 100000,
+    })
+    assert "segments" not in out

tsconfig.test.json

@@ -12,6 +12,7 @@
     "src/rules.ts",
     "src/devices.ts",
     "src/types.ts",
-    "src/space-geometry.ts"
+    "src/space-geometry.ts",
+    "src/signing.ts"
   ]
 }