houseplan-card/docs/WALL-THICKNESS.md

Wall thickness — the spec

Visual reference: docs/assets/wall-thickness-reference.png (look at wall bodies only).

Owner intent: thick walls form one continuous hatched body (seamless L and T), grow both ways from the room centreline, fills/light stay inside the inner contour, displayed area is the clean floor, and sun wedges start at the two corners of the globally selected inner or outer opening face.

Code: src/wall-thickness.ts, render in src/houseplan-card.ts / src/space-render.ts. Sun: src/sun.ts. Tests: test/wall-thickness.test.mjs, demo/smoke_wall_thickness.mjs.

1. Model

Stable stored identity and zero walls (model v10, #282/#306/#478)

The decision record behind the stored representation — what the code calls «ADR 282» — is docs/adr/282-wall-geometry-representation.md; the migration matrix is in CONFIG-COMPATIBILITY.md (model v8–v10).

From model v8 every atomic room-wall interval has a stable record in space.wall_segments[]. Its id, endpoints and cm are authoritative; rooms[].wall_ids[] references the ordered atoms that form each contour. space.walls[] remains a generated compatibility projection for older readers and must not be used as the identity of a wall. A door, window, gate or passage on a room wall stores a tagged {kind:'wall', id, t} host. Independent partitions keep their existing stable IDs. Each accepted segment of an active Walls chain is already an ordinary partition; only the chain ordering is session-local.

Existing legacy plans are not rewritten on read. The model is materialised atomically before the first structural edit, by Optimize plans, or when a legacy plan is imported into a current target. Ambiguous or conflicting geometry blocks the operation and leaves the stored plan unchanged. Ordinary settings and presentation writes do not trigger the migration. Model v9 made cm:0 a public, canonical wall value; model v10 removes persisted room drafts and keeps that value for contour atoms and independent walls. There is no separate virtual-boundary entity or editor tool.

Every structural writer passes through the same wall-model barrier. A split keeps the parent ID on the child containing the old midpoint (then the old first endpoint on a tie), while the other child receives a new UUID. Merge, Resize, room deletion, opening edits, Undo/Redo/recovery, Optimize and import/export apply the same lineage and validation rules before one atomic persistence write. Initial legacy IDs are deterministic, so frontend, backend and repeated migrations converge; only genuinely new segments get UUIDs. src/wall-segment-model.ts and custom_components/houseplan/wall_segment_model.py share test/fixtures/282-wall-identity-parity.json. Writer-bypass mutants in scripts/mutation-registry.mjs guard every structural writer entrance. A cm:0 atom or partition keeps its structural axis and stable identity but contributes no masonry body, floor subtraction, paper, opening tunnel or opening host; one resolver, src/zero-walls.ts, applies space.zero_wall_style to flat, static, 2.5D and light.

Per space: walls: [{ key, cm, a?, b? }]. key remains the quantised midpoint and direction (modulo 180°) compatibility lookup; new or rewritten entries also carry exact endpoints a / b in normalised plan coordinates. Config always stores centimetres. Old {key, cm} data remains readable and is upgraded when the affected boundary is edited. One physical stretch has one thickness (atomic collinear spans when neighbours overlap only partially). For valid plan geometry, the key is computed from lattice-stable endpoints, never from a storage-rounded approximation of the same node. wallKey first replaces only a coordinate already within max(pitch · 10⁻⁶, 10⁻⁹) of its nearest node; arbitrary off-grid geometry is not silently snapped. It then quantises the midpoint with Math.round. A wall whose length is an odd number of grid steps has its midpoint exactly on a rounding tie, and the two representations of one vertex — the exact node 83/240 and a stored 0.345833333 — otherwise fall on opposite sides of it. That is how #258 lost two records whose keys had drifted by one step.

Lookup order is exact key, strict same-span a/b (both endpoints, either direction, within the same storage-noise epsilon), then the legacy midpoint/direction fallback. The exact-span step repairs an already affected plan immediately without writing it; it never treats a containing parent as the same stretch. Parent-to-atomic inheritance remains the separate exactCoveringWall() / cmsForPoly() contract. Explicit Optimize rewrites the entry to the stable key and is idempotent after the nine-decimal storage round-trip. scripts/model-invariants.mjs (checkWallKeys, #259) independently grades a different stored key as an observation, not a violation: valid exact endpoints now prove that the record is resolvable even when its compatibility key is old or unparsable. Exact endpoints make a thickness boundary independent of whichever room topology later happens to split the same straight line. Normalisation merges consecutive pieces only inside a maximal run of equal thickness with the same physical ownership: one outer room or the same sorted pair of shared rooms. A different thickness, outer/shared transition or change of shared-room pair remains a real break. Adjacent zero atoms follow the same role-aware compaction; the canonical current model never writes compatibility open_spans or open_to. normalizeWallIntervals() is the single implementation, shared by explicit Optimize and the room-deletion transaction; ambiguous multi-owner geometry is a hard breakpoint and fails closed per atom (#299). When a maximal wall run crosses a collinear vertex belonging to another room, its exact endpoints cover that room's shorter child side too; lookup does not depend on the compacted run's midpoint remaining inside every room.

Degrade unmatched keys silently on write. Resize / undo / scale transform exact endpoints and re-key all touched spans in the same transaction. A moved room edge may cover only part of a longer exact wall entry: Resize partitions that entry at every collinear overlap boundary, transforms only the covered atoms from the immutable pre-drag snapshot and leaves every uncovered remainder on its old carrier. Equivalent transforms from two owners collapse to one; a conflicting pair fails closed by retaining the source atom. Results deduplicate only when canonical exact endpoints and centimetres match — the quantised compatibility key alone may never erase a record. Generic affine transforms retain the historical key-only midpoint fallback and never invent a legacy length. Production fixed-topology Resize is stricter: only one whole-edge key with one destination can move; an affected partial or ambiguous key rejects the candidate before preview/commit. walls stays in the resize snapshot. If lossless partitioning takes a valid 500-record input above the backend limit, the frontend keeps every result so persistence rejects the transaction atomically; it does not truncate masonry to make the write fit.

The production fixed-topology Resize path does not use the generic affine projection for side walls. A rigidly translated moving edge carries every breakpoint by the same vector; a side edge that only changes length moves its paired topology endpoint and leaves interior thickness boundaries fixed. A continuous carrier-coverage and lattice proof runs before preview/commit. It compares exact historical debt by record identity and endpoint identity, so an old off-grid endpoint is not silently migrated even when its record's other end moves, while a new or changed violation rejects the whole candidate. This is distinct from the retained generic scale/rotation helper used only by isolated historical pure tests.

2. Growth (centreline ±½)

Every thick wall grows half outward and half inward from the polygon edge (outer and shared alike). Silhouette is wider than the polygon by cm/2 on outer walls. Paper and the content frame grow under that outer half.

The exterior silhouette is generated from the boolean union of room centrelines and its surviving outer atomic intervals. A shared Split edge therefore disappears before exterior mitres are built. When Split ends at an existing corner, its divider is clipped to the interior side of this envelope: the real exterior mitre/bevel and unequal arm depths stay unchanged, while any divider thickness remains inside the facade. The same computed geometry is used for the full/static/hidden-isometric renderers and light occlusion. The paper and masonry paths come from one cached structural pass in flat renderers; live HA state ticks do not repeat the boolean topology. Saved room and wall data is not migrated or rewritten.

Every endpoint of an exterior atomic interval is materialised on a collinear boolean-union edge before offsetting. Unequal neighbouring half-depths form a hard butt step at that exact endpoint on both the inner and outer faces; the larger depth is never tapered or extended over the smaller/zero interval. Geometry tolerances are render-space distances and are converted to a local dimensionless edge fraction before breakpoint comparison or de-duplication. This preserves the same 0 ↔ h and h1 ↔ h2 transition at normalized and production (coordScale = 1000) scales.

Per-room rings remain the interior-join and nested-room representation; when an acute child ring cannot be subtracted, its atomic interval quads provide the safe physical fallback. The full card keeps the structural result in _wallUnionCache; static cards use a weak server-snapshot cache guarded by a structural geometry fingerprint, and cursor or HA state updates never repeat the O(N²) physicalBodySet() node search.

3. Body render

Production body is the ring outset(poly, half) − inset(poly, half) per room, unioned across rooms so shared and T junctions show one continuous body with no internal seams (as in the reference plan). The body is painted in two layers: a solid fill from global settings.fill_colors.wall_fill (default opaque white, with its own opacity) under the diagonal hatch whose stroke matches the wall outline. Normally neither replaces the other. When the body is thinner than 3 CSS px on screen, the shared full/static render policy suppresses only the hatch so it does not collapse into noise; the solid fill remains. Mitre joins; bevel when the mitre spike exceeds MITRE_LIMIT × thickness.

At a physical node with three or more distinct incident rays, the stricter multi-wall rule applies (#249). Shared room ownership and reversed interval direction do not create extra rays. One structural node map records the largest incident half-depth H and the finite (half-depth, endpoint distance) supports of every co-directional ray. A longer thin support never extends a shorter thick support, and no repair may continue either one beyond its saved endpoint (#271). Every excessive join is cut back with a straight local bevel and may not extend beyond R = 1.25 × H. Inside the room union, a bounded mask replaces the legacy ring with the complete finite ray strips, retains their overlap through R, and removes only the remaining excessive pairwise wedge. The same bounded rule applies to the exterior half-wall and paper envelope: local ray strips are clipped to that physical envelope rather than the room centre, so a valid T-junction cannot become a white wedge. This keeps the node centre and every arm area-connected without allowing overlap beyond R or an interior child mitre to change a concave facade. Ordinary two-ray corners retain the exact historical MITRE_LIMIT = 4 contract. This is computed geometry only: saved room outlines and wall entries are not rewritten (#261).

Every excessive pairwise cut also has a finite-width corridor through its offset-line tip into the already empty angular sector (#272). Ending the cut at the exact intersection is not sufficient: it creates a polygon hole that SVG renders as an enclosed white triangle even though one mathematical point touches the exterior. The corridor is bounded by the excess beyond R, is scale-relative, and is applied to room masonry, final masonry and paper. It therefore opens the legal discarded bevel to the exterior without filling it, moving the R endpoints or shaving an incident wall centreline.

Exterior connectivity alone is not sufficient (#275). At a degree-3+ node, every finite ray that has a perpendicular partner owns its complete physical strip through the local repair window. The effective bevel cut excludes the union of those protected strips, then the reconstruction unions them back as a boolean fail-safe. A pair remains physically near-orthogonal when its angular deviation from 90° is at most 0.25° (#279); this small drafting tolerance is independent of cell_cm and does not rewrite the saved axes. Rays are classified pair by pair: a diagonal ray in a mixed orthogonal/diagonal node remains subject to the bounded #249 bevel unless it has its own perpendicular partner. The non-orthogonal #249 fixture therefore keeps its approved empty wedge. Protected strips are unioned once for the complete node map, because neighbouring repair masks can overlap; a later node must not erase a strip restored by an earlier one. The result is still clipped to the canonical physical paper envelope and explicit opening slots are cut afterwards, so no wall is extended and no real doorway is filled.

A short incident ray may end inside the bounded replacement mask, with a different shared wall attached at that real far endpoint (#288). The node map records that attached strip separately from the incident ray, including its own direction, finite length and half-depth. Local reconstruction restores only the part of this finite shared strip inside the mask. It never projects the short ray to the global radius and never treats an unrelated outer continuation as node-owned material. This closes the real 349 / 120 / 5-step gaps while preserving the finite-ray and opening contracts from #271.

NEAR_AXIS_MAX_DEGREES in src/near-axis.ts is the single 0.25° product constant (#290). The masonry pair classifier derives its sine tolerance from that source; Walls authoring and explicit Optimize use the corresponding minor/major slope. Rendering may tolerate a legacy saved slope, but new Walls segments are exact-axis and Optimize changes legacy geometry only after its lossy preview is confirmed.

Clean-floor consumers subtract the cached, repaired canonical room masonry from their source room and take its outer component. The result is clipped to the source room on fallback. Openings and independent partitions are deliberately excluded from this shared roomGeom, so a door does not change the room fill and a detached body cannot punch it. Full and Static render paths reuse the same structural cache instead of rebuilding wall booleans once per room.

Junction nodes (#302, owner decision #5). A degree-3+ node closes with a FULL mitre, like an ordinary wall intersection on a drawing — the #249 chamfer is retired. For every pair of angularly adjacent rays junctionNodeGeometry builds one additive fan: the mitre is accepted when it sits IN the sector (forward along the rays for an ordinary pair, backward for a reflex outer corner), within the classic MITRE_LIMIT and never past a ray's thick support (#271); a reflex pair without a valid mitre closes with the plain chord, an ordinary one with a local bevel bounded by the support, the limit and twice the pair's depth. The node also gets the exact support quads of its rays. All pieces are clipped by the plain-corner facade bound (junctionNodeBound), so a node cannot grow new facade at a concave vertex. bevelMultiWallBody survives only as a TARGETED lateral trim for nodes with a degenerately short thick support (#271); every other node is purely additive. The objective invariant «body ⊇ support strips ∪ fans, inside the facade bound» is machine-checked by junctionContractHoles in tests and the smoke_junction_holes wiring probe. Degenerate zero-area rings left by coincident chords are dropped.

Visual mitre limit (#309, owner decision 2026-08-25). A mitre apex may protrude at most VISUAL_MITRE_LIMIT = 1.5 maximal half-depths from the node (a square corner of equal depths peaks at ~1.41·h, so right and obtuse corners are byte-identical); a longer apex is closed with a flat chamfer perpendicular to the apex direction at the limit (chamferApex). The rule applies to the junction fans; MITRE_LIMIT = 4 survives only as the sanity bound for candidate construction. At a node of three or more canonical rays the pair patches are not built at all: a pair patch lives in the sector OPPOSITE its pair and painted a step over the thinner strips owning that sector (the 15/15/30/30 cross of the owner report) — such nodes are closed with the same sector fans via a local multi-wall node map inside linearWallJoinPatches. The #249 machinery (MULTI_WALL_JOIN_LIMIT = 1.25, multiWallBevelCutsAt, room-contour mitres) is untouched.

Pair apex and butt-end trim (#310, owner decision 2026-08-25). A node of exactly two rays keeps the FULL mitre at any length: two walls meet in a drawing point, the #309 chamfer does not apply there. What does get removed is the butt-end tooth: the deeper wall's rectangular end may poke sideways past the outer face of its thinner partner right at the node — pairButtEndTrimWedges returns, per wall, the addressed wedge (outside the partner's apex-side outer face, within 2·halfDepth of the node along the axis) which consumers subtract from the owning body before opening cuts. This is the SECOND addressed subtraction of the junction pipeline, next to the lateral trim of #271; both are strictly local to their node. Two-ray nodes are invisible to junctionContractHoles (the node map requires 3+ canonical rays), so their no-holes contract is a grid probe in the unit suite: masonry inside the node neighbourhood equals (strips ∪ patch) − wedges.

Hatch density is physical (#230). The pattern step is a distance on the plan, not a count of coordinate units: wallHatchStepUnits(cellCm) returns 8 × (5 / cell_cm), which is 9.6 cm at every grid scale and exactly the historical 8 units at the reference cell_cm: 5. The stroke width follows the same factor, so the stripe-to-gap ratio is scale-invariant too. The step is NOT compensated for zoom — a wall that re-hatches itself as you zoom is the defect this rule replaced — and both renderers, interactive and static, read it from the same function. Two independent guards fall back to the solid fill: the body thinner than WALL_HATCH_MIN_PX = 3 on screen, and the step itself thinner than HATCH_MIN_STEP_PX = 2 (wallHatchNeedsSolid). The step is clamped to [0.5, 80] units so a pathological cell_cm cannot degenerate the pattern.

A variable-offset join where exactly one adjacent edge has zero depth is a local flat cap, not a mitre. Both inset and outset retain the physical edge's offset point followed by the untouched zero-edge vertex (or the reverse order when entering the physical edge). This keeps a zero-depth Split free of masonry even when it meets a thick wall at a slightly non-collinear angle; the cap cannot stretch into a taper along the divider. Joins between two positive depths keep the bounded mitre/bevel contract above.

Independent partition segments keep flat raw quads for editor identity, but exact endpoint↔endpoint and endpoint↔line nodes add computed join patches before the presentation union. Each incident ray keeps its own half-depth; ordinary corners use the same bounded MITRE_LIMIT = 4 rule and excessive spikes become bevels. A degree-one endpoint receives no patch and therefore keeps its flat cap. This topology is render-only: a T does not split or rewrite the saved target segment. The live open-outline/rubber-band preview calls the same primitive with saved per-segment thicknesses plus the current field value.

Openings cut the body full-depth and jambs cap the whole cut. By default the complete visible door/window/gate group is always centred on the wall axis, including window glass. flip_v changes only the direction of door/window geometry or the gate's 10° turn; it never translates the symbol toward a wall face. Association uses wall direction ≈ opening angle (mod 180°), then nearest span — never a perpendicular neighbour at a T. One atomic OpeningWallIndex is authoritative for physical depth/direction, wall cut and coloured tunnel, while the shared symbol-placement helper turns that result into the user-visible translation. Candidates must be effectively collinear with the opening axis (not merely parallel within one grid cell); ties use complete opening coverage, signed distance to the inner face, smaller room area and stable room id. The index and batch tunnel geometry are cached by space, configuration epoch and complete geometry, so HA state ticks change only the resolved fill colours. Overlapping openings reserve each physical interval once and cannot stack room-fill alpha. "Effectively collinear" is deliberately strict: the perpendicular distance to the candidate axis may not exceed max(4% × grid pitch, 1e-9). A detached parallel room beyond that tolerance is not an opening side; when only one real owner remains, its fill continues through the full wall depth. Legacy openings outside the same angle/distance contract no longer cut or offset a nearby wall and must be re-snapped in the Plan editor. At a zero-thickness endpoint, positive arms owned by different room contours receive the same bounded mitre patch as arms from one contour; the junction has one clean outer corner rather than two butt caps forming a step. The zero wall itself remains centreline-based. View paints it before the wall body, which masks the part inside each adjoining thick jamb; editors paint it after the body so its full stored extent stays visible.

Computed zero-wall junction patches cross the polygon-boolean boundary only after scale-relative sub-epsilon coordinate stabilisation. They are optional local additions: each patch union is transactional, so an invalid, zero-area or numerically rejected patch keeps the last valid body and does not prevent later patches. This fallback never rounds persisted rooms, walls or open spans to the grid and never turns a failure of the mandatory exterior/body/opening passes into a successful result. One noisy junction therefore cannot remove otherwise valid masonry, paper, floor faces or light barriers for the whole space (#197). The same failure isolation covers degree-3+ repair: every node is rebuilt and committed independently inside its bounded mask. A malformed local candidate therefore keeps that node's previous body without reverting successful repairs at unrelated nodes. The exterior paper uses the same R-bounded overlap as the masonry; it never restarts the cut at the offset origins (#261). Pairwise cuts cannot end in point contact: a small local connector crosses the offset-line tip so every removed bevel sector is exterior-connected and never an enclosed polygon hole (#272). Orthogonal finite strips are additionally protected across the complete node map, so overlapping local masks cannot turn that exterior-connected sector into an open notch inside a real wall (#275).

Runtime normalisation remains lossless for every positive exact thickness interval, regardless of its length. The explicit Optimize plans maintenance action has one deliberately lossy exception (#198): an isolated interval strictly shorter than half a grid step inherits two equal collinear neighbours when neither endpoint is a room vertex or resolved opening endpoint. End fragments, unequal neighbours, chains of short changes and exact half-step intervals remain untouched. Candidates come from one pre-change effective profile, so cleanup cannot cascade; ordinary rendering and editor Save never invoke it.

4. Floor, fills, light, area

• Inner contour = inset(poly, half[]).
• Room fills and glow are clipped to the inner contour (not painted into the wall hatch).
• The free tunnel cut by a door, window or gate continues the effective room fill through the wall body instead of exposing the neutral paper below the plan. On an outer wall the one adjacent room owns the complete depth. On a shared wall each room owns its half, with a hard colour change exactly on the wall centreline. This is a base-fill layer only: Glow and sun remain above it with their existing aperture, clipping, colour and opacity.
• A zero-thickness wall or orphan opening has no coloured tunnel. Mixed-thickness legacy spans are clipped to their actual atomic wall bodies.
• Glow leaving through a door uses the clear rectangular opening tunnel: its sector is the intersection of the doorway spans at the near and far inner faces. The two jamb returns therefore clip off-axis light. Zero-thickness walls cannot host openings.
• Displayed m² = area of the inner contour (clean floor). Wall-length rulers and opening anchors stay on the centreline.
• With no thickness, inner = poly (parity with pre-thickness behaviour).
• View room hover is a late plain-SVG wash plus wide/narrow accent strokes over the clean-floor geometry; the room information window shows the room's average LQI and the formatted clean-floor area. The hover deliberately uses no CSS/SVG filters: promoting a filtered sibling makes Chromium briefly recompose and brighten the isolated screen-blended Glow layer.
• Opening-tunnel faces are one simple union contour per connected physical span: thickness steps are vertices on the outer envelope, never touching translucent rectangles, and both halves use the same nonzero winding across their tiny centre overlap, so fractional rasterisation can neither cancel the fill into a seam nor stack its opacity. render/opening-tunnels.ts only projects these immutable inputs.
• A fully nested room is legal (polyContainsPoly): the parent's floor, data fill and Glow base are evenodd paths with the island rings as holes (islandsOf).

5. Sun

Wedges do not draw through wall bodies. The global settings.sun_ray_origin selects their source face. inner (default and legacy fallback) translates the full span from the centreline by +d/2 along the receiving room's inward normal, so both sides begin at the room-side corners. outer translates it by -d/2 and includes only the rectangular physical window tunnel before the receiving room's inner contour; adjacent wall and exterior space stay clipped. The nominal length and gradient begin at the selected span. d = 0 makes both modes identical. hide_openings hides the symbol only.

6. Tool / hooks / i18n

Plan-editor tool «Thickness»; hover whole wall; cm/in from HA; exact 0..100 is valid for room walls and partitions, while empty/invalid input is rejected; apply-to-room. Hooks: data-hp="wall". i18n en/ru. Changing a positive wall to 0 is rejected atomically while any opening uses it. Hit widths and junction ambiguity are measured in CSS pixels through the live viewBox, so a zero wall stays editable although it paints as a one-pixel line.

Draw with thickness. The Plan toolbar's Walls button carries its session thickness field immediately on the right (default 15 cm, or inches when HA is imperial). Every accepted segment is immediately persisted as an ordinary partition with the value used when it was placed. If a segment creates rooms, consumed boundary atoms receive their source value and unconsumed atoms become independent walls with the same value; existing shared masonry remains authoritative. Empty / 0 leaves the new wall at zero thickness. Live preview follows the rubber-band while drawing. Split does not use this field. The Thickness tool remains for later edits.

Deleting a room. The accessible confirmation offers two explicit physical consequences. Keep walls converts only that room's exclusive positive solid wall intervals into exact independent partitions, preserving their centimetre thickness and rehosting openings to those partitions. Shared intervals remain; exclusive zero-thickness edges become zero-thickness partitions. Delete walls removes the room without that conversion and cascades only openings owned by its exclusive walls. Shared masonry, existing partitions, partition-hosted openings and their physical thickness remain intact in both cases. The room, wall profile, partitions and openings are one Undo/Redo and persistence transaction. The remaining wall profile is normalised against its post-delete ownership, so an equal thickness cannot be compacted across an outer/shared boundary or across two different shared-room pairs. src/room-deletion.ts plans the whole operation before any mutation; confirmation is an accessible hp-dialog, never native confirm(). The same command rewrites room references in every marker: a direct room_id is deleted (remapped to the survivor for Merge) and exact values in cross-space vacuum.segment_map are deleted/remapped. History snapshots only these fields, so Undo/Redo and write rollback stay atomic with geometry while unrelated marker and vacuum fields remain live (#477).

7. Out of scope

Decor-line thickness, per-side finish, auto-from-backdrop, plan-wide default.

8. Testing

Unit: ring closed at corners; half-out; inner area; atomic partial shared; zero-wall T mitre; angle-aware opening; 45° wall; T-junction; detached parallel room; nested-room tie; partially out-of-span legacy opening; overlapping opening de-duplication; shared symbol/cut/tunnel rejection; thick-door tunnel clipping and room-side colour ownership; whole and atomic rekey after edge/scale, including a long exact record only partly covered by the moved edge, key collisions and the 500-record boundary; corner Split exterior equality across 0/1/15/100 cm, unequal arms, both windings and convex/concave endpoints; production-scale 0 ↔ 10, 10 ↔ 20 and 1 ↔ 100 collinear transitions at their exact endpoint; full 8-room/25-wall/3-cut virtual-junction resilience, ULP-equivalent patch vertices, per-patch failure isolation and record-order invariance (#197); explicit Optimize-only collapse of a sub-half-step isolated thickness island with strict threshold and ambiguity guards (#198), including the proven equal → micro → equal case beside exactly one room T-node while opening endpoints and spans between two room topology nodes stay protected (#273); exact cell_cm: 5 and cell_cm: 1 orthogonal T fixtures derived from the two #275 owner backups, including overlapping neighbouring node masks, mixed depth and the unchanged non-orthogonal #249 wedge; the real 349 / 120 / 5 short-ray handoff to a 20 cm shared wall at cell_cm: 1/5/30, reversed endpoints and permuted input (#288); exact parent-run thickness inherited by atomic children across a zero-depth neighbour, without partial-span leakage (#201/#306). Role-aware compaction tests keep shared(A,B), outer(A) and shared(A,C) as separate records even at equal thickness, while equal neighbouring atoms within one role still compact; the real first-floor fixture proves explicit Optimize is invariant-free and idempotent (#299). The edit-walk real-plan seeds 1 and 3 exercise the same Optimize and Keep-walls entry points. Browser: seamless frame; fill not in hatch; m² drops with thickness; partial shared walls and mixed-thickness shared walls keep a visible disabled Resize handle and cannot split or re-key their atomic records (demo/smoke_wall_thickness.mjs, demo/smoke_zero_walls.mjs, demo/smoke_resize_wall_thickness.mjs); an eligible uniformly thick exact wall moves through the fixed-topology safe pipeline and Undo restores its source (demo/smoke_room_resize.mjs); the zero-wall preview paints above the real body; sun starts at the selected inner/outer opening corners; nav mode restores after can_write; a 1 cm body uses solid-only in both full and static cards while a 20 cm body keeps its hatch; door/window/gate tunnels repeat outer/shared room fills without an axis seam (demo/smoke_opening_tunnel_fill.mjs); corner Split keeps the same facade in Plan/View/kiosk/static/isometric surfaces and the light barrier (demo/smoke_split_corner_wall.mjs); a Split followed by all-room thickness keeps the neighbouring zero facade clear across Plan, View, static, hidden Iso and light masonry (demo/smoke_wall_thickness_transition.mjs); the complete #197 fixture keeps the same non-empty canonical path across Plan, View, kiosk, static, hidden Iso, paper/clean-floor and light/sun consumers while theme and HA state ticks reuse the structural geometry (demo/smoke_junction_patch_resilience.mjs); Optimize Preview/Cancel/Apply/ server Undo for guarded micro-interval cleanup (demo/smoke_optimize_micro_interval.mjs); dense protected-strip sampling through Plan, View, kiosk, Static, hidden Iso, paper/clean-floor and light consumers (demo/smoke_multiwall_strip_containment.mjs); exact coincident partition reconciliation, opening rehost, reload, one-shot Undo and resulting Boundary/Thickness targets (demo/smoke_optimize_coincident_partition.mjs). The local scripts/wall-strip-containment.mjs gate accepts external backups without copying their contents into Git and checks raw, Optimize preview, applied canonical storage and reload states.

OptimizeDependencies (src/plan-optimizer.ts) is a narrow seam: the large-house benchmark substitutes a no-op and the unit contract counts per-space calls; a source-ownership assertion fails if a render/pointer module imports the reconciliation helper.

Junction tooling (#302)

Purpose-built checks for node material: junctionContractHoles (the objective «body ⊇ strips ∪ fans inside the facade bound» invariant, self-checked against a deliberately holed fixture), the smoke_junction_holes wiring probe that verifies the same contract against the rendered d path, sixteen close-up golden scenes (junction-*) plus the owner's repro scene, and the junction-* mutants in scripts/mutation-gate.mjs.

9. Independent partitions and columns

Their thickness is stored directly in centimetres: 0–100 cm for partition segments, 1–150 cm for a column's outer side/diameter. Invalid input blocks the commit and reports the valid range; no editor path silently clamps it. These bodies are unioned with room-wall bodies only after door/window/gate cuts, so an opening cannot punch a coincident independent wall. They are subtracted from the cached clean floor, and the same body set is used by Glow and sun-ray occlusion even when borders are hidden. A source inside/on a physical body is fully occluded instead of leaking around its own masonry. The same fail-dark placement rule applies to window tunnels and exterior door/gate openings; interior passages remain valid source positions (#92).

The canonical result is component-aware (#278). A valid room body remains the primary component; every optional independent body and the exterior-shell merge is added transactionally. If two individually valid operands cannot be unioned, the latter is retained as a separate SVG/occlusion component and the result is degraded-extra, so one local boolean failure cannot erase the whole floor. Plan, View, Static, hidden Iso, paper and light use the same components, while roomGeom excludes independent bodies so room area remains unchanged. This is read-only recovery: strict Optimize and every physical-geometry edit reject a degraded candidate and never silently delete or rewrite the offending object. A core room-body failure is failed-core: it sits outside the optional-union fallback and activates fail-dark rendering.

An opening with explicit host:{kind:'partition',id,t} is resolved from that partition alone and subtracted full-depth from its raw body before the joined presentation union. A precisely collinear room wall covering the same interval is cut as a composite; a crossing/nearby body is not. Host move keeps t, delete requires cascade confirmation, and malformed/orphan hosts remain opaque. Opening cuts change physical masonry, not the structural wall axes used for room-face detection (#185).

Explicit Optimize has one stricter reconciliation pass (#276/#281/#296). It atomizes an independent wall at consecutive solid room-wall and hosted-opening boundaries. Every positive section is proved independently: one outer owner or exactly two shared owners with one effective thickness, and no column, second partition or conflicting opening. Proven sections are absorbed even when several consecutive room intervals cover the source; unproven sections are recombined into deterministic residual partitions. Hosted openings are materialised at the same centre/angle on a proven room wall or rebound to the single residual that contains them. The canonical thickness is max(roomCm, partitionCm), exactly the union envelope of centred coincident bodies. The pass is immutable, idempotent and followed by the common whole-plan geometry preflight; rendering, Resize and ordinary Save never perform it implicitly.

physicalBodySet() separates raw partition/column bodies from computed junction patches and their joined geometry. Raw bodies remain authoritative for hit testing, selection, drag, properties, deletion, history and furniture magnet semantics. Flat full/static render, hidden isometric, clean floor, Glow, sun and source placement consume the joined set through the canonical masonry pass, so an old butt face cannot become a visible seam or a false light barrier. Exact near-misses remain separate, an interior↔interior X crossing keeps normal boolean-union semantics, and malformed legacy segments fall back opaque without writing configuration.

10. Architectural connection overlay (Walls tool)

When Walls is active in the Plan editor, a derived pointer-transparent SVG layer exposes the centre axes of completed room walls and independent partitions. It is painted after their physical wall bodies, but before interactive editor chrome. Columns, decor, devices, the active wall chain and its live preview are not candidates. Door, window, gate and intentionally open-span intervals are cut from presentation axes; a cut boundary does not become a new endpoint.

The layer and hit resolver share one immutable geometry snapshot. Original segment endpoints are deduplicated and drawn at a physical radius of 5 cm. Inside a 12 CSS px hit zone, an endpoint wins over every line and grows to 10 cm. Otherwise the nearest solid line receives one 10 cm dynamic node: the raw pointer is projected onto that line, then quantized by the grid step along the line from its stable start. This keeps diagonal connections wall-bound even when neither resulting coordinate is a global grid multiple. The same resolver runs again on click, so hover is only a preview and never authoritative.

Endpoint and line candidates override the normal grid and Shift/45° result. Outside the hit zone, the ordinary snap contract (CANVAS.md §9.3–9.4) is unchanged. A line connection adds only the new segment endpoint; it does not split or rewrite the existing wall. The current anchor is excluded to prevent zero-length segments. The static geometry is cached by structural editor state; pointer movement changes at most the single active candidate and never writes config, layout or storage.

A separate diagnostic projection is present throughout the Plan editor (#296), including tools other than Walls. For every independent wall segment with a positive exact collinear overlap against another wall, it keeps that source segment's complete axis and original endpoints visible. It is painted after every wall body and zero-thickness axis and before openings, selection chrome and transient previews. The layer is pointer-events:none, aria-hidden, absent from View and cached by structural revision; it neither deduplicates source identities nor participates in the architectural snap resolver above. The 1 CSS px non-scaling axis and physical 5 cm nodes therefore diagnose an otherwise invisible Resize blocker without changing any hit target.

11. Planar wall faces

Every completed Walls segment is persisted immediately as an ordinary partition; only its ordered chain membership remains in memory. On the click path only, an immutable planar graph is built from structural room edges and partitions both before and after the latest segment. Unlike the presentation/snap snapshot, this face graph ignores door/window/gate/passage cuts; zero-thickness wall axes remain structural graph edges even though they have no masonry body. Endpoint, T, X and collinear-overlap junctions atomize that computed graph without rewriting any saved wall. A deterministic half-edge walk extracts bounded faces; canonical identity ignores winding, cyclic start and derived collinear subdivision.

Only faces added by the latest segment and containing one of its atoms are offered. They are ordered by area and then canonical key. Existing exact or partially overlapping rooms are excluded, nested rooms remain legal, and any physical gap created by an open_span or absent wall remains a gap. A door, window, gate or passage is a property of a wall and preserves connectivity. A clean divider across one room reuses the Split contract: the larger side keeps the room identity, metadata and device binding, and only the smaller side is offered. splitRoomPath() is a strict partition: the two parts' areas must sum to the original within a relative 1e-6 epsilon, otherwise the cut is rejected.

The terminal active path remains session-local while the resulting room dialogs are open. Create/Keep-as-walls answers are buffered; Cancel/Esc discards all answers and leaves the already persisted partitions unchanged. The final answer revalidates the whole batch and applies accepted rooms while consuming only the coincident partitions used by those rooms in one history/config transaction. Graph construction never runs on pointermove, Home Assistant state updates or ordinary rendering.

Finishing a chain (#294, #477). Changing Plan tool, editor or floor, Esc, the tray's Reset, route/hash departure and a room-face batch whose every face was rejected all finish an open chain through one bounded lossless finalizer (finalizeWallChainSpace, src/writer-fixed-point.ts). It merges only the seed-connected compatible collinear run, rehosts its openings and reconciles only surviving positive seed partitions proven coincident with room masonry; the cloned candidate crosses the current-model identity barrier, one local physical/junction proof and storage canonicalization before atomic adoption. Rejection keeps the visible chain and the original config. It adds no history command and never sweeps unrelated legacy debt. Pan, pinch, pointer cancellation and suppressed clicks never finish a chain or append a segment; a finished chain is not resumed after reload or remount.

Active-chain Undo preserves the complete record of every surviving partition, including its stable id; only a genuinely new edge receives a new identity. Each segment history snapshot carries session-only chain seed ids: while the chain is active the snapshot is literal and Undo removes one point; after finish, Undo/Redo passes that seed scope through the same lossless finalizer, so hidden collinear seams cannot return as durable Optimize debt (#477).

Room from an existing face. With no active chain, a Walls click queries the smallest exact unoccupied bounded face at the raw point; boundary/snap hits and desktop Shift+click still draw. Without an exact face, src/wall-face-repair.ts may plan one endpoint→endpoint or endpoint→solid-line move of at most 2 physical cm. Room vertices and endpoints of partitions that host an opening never move, multiple valid repairs fail closed, and the immutable proposal is revalidated against current geometry before use. Move and room are one history/config transaction; cancelling or rejecting the room applies nothing.