From f69b971f2d68ca0d757261cd207ca384eab9d0a2 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Sun, 11 Oct 2026 20:40:26 +1030
Subject: [PATCH 01/35] Add editable map notes with sharp multiline text

---
 js/editor.js                                  |  92 ++++++++++++
 lib/WeatherMap.class.php                      |  38 ++++-
 lib/WeatherMap.notes.php                      |  89 ++++++++++++
 lib/WeatherMapNode.class.php                  |  26 ++++
 lib/editor.actions.php                        |  24 +++
 lib/editor.inc.php                            |   5 +
 lib/editor.notes.php                          | 117 +++++++++++++++
 locales/po/cacti.pot                          |  91 ++++++++++--
 tests/Support/EditorNotesEngineRegression.php | 137 ++++++++++++++++++
 tests/Unit/EditorNotesEngineTest.php          |  19 +++
 weathermap-cacti-plugin-editor.php            |  36 ++++-
 11 files changed, 660 insertions(+), 14 deletions(-)
 create mode 100644 lib/WeatherMap.notes.php
 create mode 100644 lib/editor.notes.php
 create mode 100644 tests/Support/EditorNotesEngineRegression.php
 create mode 100644 tests/Unit/EditorNotesEngineTest.php

diff --git a/js/editor.js b/js/editor.js
index dad82c1a..fa3a9c47 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -540,6 +540,9 @@ function wmEditorReturnUrl(target) {
 }
 
 function attach_click_events() {
+	$('#xycapture').off('click.wmnote').on('click.wmnote', function(event) {
+		if ($('#action').val() === 'place_note' || ($('#action').val() === 'move_node' && typeof WMNotes !== 'undefined' && WMNotes[$('#param').val()])) coord_update(event);
+	});
 	$("area[id^='LINK:']").attr('href', '#').off('click').on('click', click_handler);
 	$("area[id^='NODE:']").attr('href', '#').off('click').on('click', click_handler);
 	$("area[id^='TIMES']").attr('href', '#').off('click').on('click', position_timestamp);
@@ -554,6 +557,38 @@ function attach_click_events() {
 	$('#tb_mapstyle').off('click').on('click', map_style);
 
 	$('#tb_addlink').off('click').on('click', add_link);
+	$('#tb_addnote').off('click').on('click', add_note);
+	$('.wm-note-colour').off('click').on('click', function() {
+		$('#note_colour').val($(this).attr('data-colour'));
+		wmNoteRefreshPalette();
+	});
+	$('#note_colour').off('input change').on('input change', wmNoteRefreshPalette);
+	$('#note_advanced_toggle').off('click').on('click', function() {
+		var open = $(this).attr('aria-expanded') !== 'true';
+		$(this).attr('aria-expanded', String(open)).text(open ? wmEditorText.hideAdvanced : wmEditorText.advanced);
+		$('#note_advanced').toggle(open);
+	});
+	$('#note_clone').off('click').on('click', function() {
+		$('#note_name').val('');
+		$('#note_x').val(Math.min(parseInt($('#note_x').attr('max'), 10), parseInt($('#note_x').val(), 10) + 20));
+		$('#note_y').val(Math.min(parseInt($('#note_y').attr('max'), 10), parseInt($('#note_y').val(), 10) + 20));
+		$('#note_delete,#note_move,#note_clone').hide();
+		$('#note_text').trigger('focus');
+	});
+	$('#note_move').off('click').on('click', function() {
+		$('#param').val($('#note_name').val());
+		$('#node_name').val($('#note_name').val());
+		hide_dialog('dlgNoteProperties');
+		move_node();
+	});
+	$('#note_delete').off('click').on('click', function() {
+		if (window.confirm(wmEditorText.noteDelete.replace('%s', function() { return $('#note_text').val(); }))) {
+			$('#param').val($('#note_name').val());
+		$('#node_name').val($('#note_name').val());
+			$('#action').val('delete_node');
+			form_submit();
+		}
+	});
 	$('#tb_poslegend').off('click').on('click', position_first_legend);
 	$('#tb_postime').off('click').on('click', position_timestamp);
 	$('#tb_colours').off('click').on('click', manage_colours);
@@ -871,12 +906,20 @@ function delete_link() {
 }
 
 function form_submit() {
+	if ($('#action').val() === 'place_note') {
+		show_note('', $('#x').val(), $('#y').val());
+		return;
+	}
+	var savingNote = $('#action').val() === 'set_note_properties';
 	var data = $('input, select, textarea').serialize();
 
 	$.ajax({
 		type: 'POST',
 		url: editor_url,
 		data: data,
+		error: function() {
+			if (savingNote) $('#wm-note-error').text(wmEditorText.noteError).show();
+		},
 		success: function(html) {
 			hide_all_dialogs();
 
@@ -1041,6 +1084,10 @@ function prime_node_form(name) {
 }
 
 function show_node(name) {
+	if (typeof WMNotes !== 'undefined' && Object.prototype.hasOwnProperty.call(WMNotes, name)) {
+		show_note(name);
+		return;
+	}
 	mapmode('existing');
 
 	hide_all_dialogs();
@@ -1192,6 +1239,7 @@ function hide_all_dialogs() {
 	hide_dialog('dlgLinkProperties');
 	hide_dialog('dlgTextEdit');
 	hide_dialog('dlgNodeProperties');
+	hide_dialog('dlgNoteProperties');
 	hide_dialog('dlgColours');
 	hide_dialog('dlgImages');
 	hide_dialog('dlgEditorSettings');
@@ -1663,3 +1711,47 @@ function wmFriendlyLinkNames() {
 function wmDecodeEditorUrl(value) {
 	return String(value || '').replace(/&amp;/g, '&');
 }
+// Notes are ordinary label-only nodes, with a small editor-specific style form.
+function add_note() {
+	hide_all_dialogs();
+	$('#tb_help').addClass('wm-action-help').text(wmEditorText.addNoteHelp);
+	$('#action').val('place_note');
+	mapmode('xy');
+}
+function wmNoteRefreshPalette() {
+	var colour = String($('#note_colour').val()).toLowerCase();
+	$('.wm-note-colour').each(function() {
+		var selected = $(this).attr('data-colour') === colour;
+		$(this).attr('aria-pressed', selected ? 'true' : 'false').css('outline', selected ? '2px solid currentColor' : '');
+	});
+}
+function show_note(name, x, y) {
+	hide_all_dialogs();
+	mapmode('existing');
+	var node = name ? Nodes[name] : null;
+	var style = name ? WMNotes[name] : null;
+	$('#note_name').val(name);
+	$('#note_align').val(style && ['left', 'centre', 'right'].indexOf(style.align) !== -1 ? style.align : 'left');
+	$('#note_text').val(node ? node.label.replace(/\\n/g, '\n') : '');
+	$('#note_x').val(node ? node.x : x);
+	$('#note_y').val(node ? node.y : y);
+	$('#note_colour').val(style ? style.colour : '#000000');
+	wmNoteRefreshPalette();
+	$('#note_advanced').hide();
+	$('#note_advanced_toggle').attr('aria-expanded', 'false').text(wmEditorText.advanced);
+	if (style) {
+		if (!$('#note_font option').filter(function() { return this.value === style.font; }).length) {
+			$('<option>').val(style.font).text(style.fontLabel).appendTo('#note_font');
+		}
+		$('#note_font').val(style.font);
+	} else {
+		var defaultFont = $('#note_font option').filter(function() { return this.value === 'bundled:Vera.ttf:9' || $(this).text() === 'Vera Sans — 9 pt'; }).first();
+		$('#note_font').val(defaultFont.length ? defaultFont.val() : '3');
+	}
+	$('#note_delete,#note_move,#note_clone').toggle(!!node);
+	$('#wm-note-error').hide();
+	$('#action').val('set_note_properties');
+	show_dialog('dlgNoteProperties');
+	$('#note_font,#note_align').selectmenu('refresh');
+	$('#note_text').trigger('focus');
+}
diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index b78c8849..2495460d 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -45,6 +45,7 @@
 require_once('WeatherMap.functions.php');
 require_once('geometry.php');
 require_once('WeatherMapNode.class.php');
+require_once('WeatherMap.notes.php');
 require_once('WeatherMapLink.class.php');
 
 $weathermap_debugging  = false;
@@ -4005,6 +4006,8 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 
 			// do the node rendering stuff first, regardless of where they are actually drawn.
 			// this is so we can get the size of the nodes, which links will need if they use offsets
+			foreach ($this->nodes as $node) $node->render_note_hidpi = false;
+
 			foreach ($this->nodes as $node) {
 				// don't try and draw template nodes
 				wm_debug('Pre-rendering ' . $node->name . ' to get bounding boxes.');
@@ -4014,6 +4017,15 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 				}
 			}
 
+			$sharpNotes = ($filename !== 'null' && $withnodes && $this->context !== 'editor2') ? wm_sharp_notes($this) : [];
+			foreach ($sharpNotes as $node) {
+				$node->render_note_hidpi = true;
+				$bounds = $node->boundingboxes;
+				$node->pre_render($image, $this);
+				$node->boundingboxes = $bounds;
+			}
+
+			$noteForeground = null;
 			$all_layers = array_keys($this->seen_zlayers);
 			sort($all_layers);
 
@@ -4024,6 +4036,12 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 
 				// all the map 'furniture' is fixed at z=1000
 				if ($z == 1000) {
+					if ($sharpNotes !== []) {
+						$baseImage = $image;
+						$image = imagecreatetruecolor($this->width, $this->height);
+						imagesavealpha($image, true);
+						imagefill($image, 0, 0, imagecolorallocatealpha($image, 0, 0, 0, 127));
+					}
 					foreach ($this->colours as $scalename => $colours) {
 						wm_debug("Drawing KEY for $scalename if necessary.");
 
@@ -4060,6 +4078,12 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 					$this->DrawTitle($image, $this->titlefont, $this->colours['DEFAULT']['TITLE']['gdref1']);
 				}
 
+				if ($z == 1000 && $sharpNotes !== []) {
+					$noteForeground = $image;
+					$image = $baseImage;
+					imagecopy($image, $noteForeground, 0, 0, 0, 0, $this->width, $this->height);
+				}
+
 				if (is_array($z_items)) {
 					foreach ($z_items as $it) {
 						if (strtolower((string) get_class($it)) == 'weathermaplink') {
@@ -4144,6 +4168,18 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 			//	$this->myimagestring($image, 30, 100, 100, "Test 1\nLine 2", $overlay,0);
 			// $this->myimagestring($image, 30, 200, 200, "Test 1\nLine 2", $overlay,45);
 
+			// Compose at logical coordinates; render note glyphs at display density.
+			if ($sharpNotes !== []) {
+				$this->image = $image;
+				$image = wm_note_display_image($this, $sharpNotes);
+				if ($noteForeground !== null) {
+					imagecopyresampled($image, $noteForeground, 0, 0, 0, 0, imagesx($image), imagesy($image), $this->width, $this->height);
+					imagedestroy($noteForeground);
+				}
+				$this->image = $image;
+			}
+			foreach ($this->nodes as $node) $node->render_note_hidpi = false;
+
 			// Ready to output the results...
 
 			if ($filename == 'null') {
@@ -4209,7 +4245,7 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 					$imagethumb = imagecreatetruecolor(max(1, $this->thumb_width), max(1, $this->thumb_height));
 
 					imagecopyresampled($imagethumb, $image, 0, 0, 0, 0, $this->thumb_width, $this->thumb_height,
-						(int) round((float) $this->width), (int) round((float) $this->height)
+						imagesx($image), imagesy($image)
 					);
 
 					$result = imagepng($imagethumb, $thumbnailfile);
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
new file mode 100644
index 00000000..84bec9c4
--- /dev/null
+++ b/lib/WeatherMap.notes.php
@@ -0,0 +1,89 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Notes eligible for high-density map rendering. Restrict the allocation to
+ * bounded maps and plain TrueType annotations drawn above the other objects.
+ */
+function wm_sharp_notes($map) {
+	if ($map->width < 1 || $map->height < 1 || $map->width * $map->height > 4000000) {
+		return [];
+	}
+	$notes = [];
+	$lastLayer = 0;
+	foreach (array_merge($map->nodes, $map->links) as $item) {
+		if ($item->name !== 'DEFAULT') $lastLayer = max($lastLayer, $item->zorder);
+	}
+	// Later nodes only block annotations they overlap. Their pre-rendered
+	// rectangles preserve stacking without degrading unrelated notes.
+	foreach ($map->seen_zlayers[$lastLayer] ?? [] as $node) {
+		if ($node instanceof WeatherMapNode && $node->name !== 'DEFAULT' && $node->get_hint('editor_note', '0') === '1' && $node->labelangle == 0 && $node->iconfile === '' && $node->zorder < 1000 && $node->labelbgcolour == [-1,-1,-1] && $node->labeloutlinecolour == [-1,-1,-1] && $node->labelfontshadowcolour == [-1,-1,-1] && isset($map->fonts[$node->labelfont]) && $map->fonts[$node->labelfont]->type === 'truetype') {
+			$notes[] = $node;
+		} elseif ($node instanceof WeatherMapNode && !is_null($node->x)) {
+			$notes = array_values(array_filter($notes, function ($note) use ($node) {
+				if (!$node->image || !$note->image) return false;
+				$x = (int)($node->x - $node->centre_x);
+				$y = (int)($node->y - $node->centre_y);
+				$nx = (int)($note->x - $note->centre_x);
+				$ny = (int)($note->y - $note->centre_y);
+				return $x >= $nx + imagesx($note->image) || $nx >= $x + imagesx($node->image)
+					|| $y >= $ny + imagesy($note->image) || $ny >= $y + imagesy($node->image);
+			}));
+		} elseif (!($node instanceof WeatherMapNode) || !is_null($node->x)) {
+			$notes = [];
+		}
+	}
+	return $notes;
+}
+
+/** Render glyphs at twice the density; do not enlarge an existing text bitmap. */
+function wm_note_display_image($map, $notes) {
+	$image = imagecreatetruecolor($map->width * 2, $map->height * 2);
+	imagecopyresampled($image, $map->image, 0, 0, 0, 0, $map->width * 2, $map->height * 2, $map->width, $map->height);
+	foreach ($notes as $node) {
+		$lines = explode("\n", $node->proclabel);
+		$width = 0;
+		foreach ($lines as $line) {
+			[$lineWidth] = $map->myimagestringsize($node->labelfont, $line);
+			$width = max($width, $lineWidth);
+		}
+		[, $height] = $map->myimagestringsize($node->labelfont, 'Ag');
+		$height = max(1, ceil($height));
+		$font = $map->fonts[$node->labelfont];
+		$colour = imagecolorallocate($image, ...$node->labelfontcolour);
+		$originX = (int)($node->x - $node->centre_x);
+		$originY = (int)($node->y - $node->centre_y);
+		$lineY = $node->centre_y - count($lines) * $height / 2 + $height;
+		foreach ($lines as $line) {
+			[$lineWidth] = $map->myimagestringsize($node->labelfont, $line);
+			$align = $node->get_hint('editor_note_align', 'left');
+			$offset = $align === 'right' ? $width - $lineWidth : ($align === 'centre' ? ($width - $lineWidth) / 2 : 0);
+			$x = $originX + round($node->centre_x - $width / 2 + $offset);
+			$y = $originY + round($lineY);
+			wimagettftext($image, $font->size * 2, 0, $x * 2, $y * 2, $colour, wm_font_file($font->file), $line);
+			$lineY += $height;
+		}
+	}
+	return $image;
+}
diff --git a/lib/WeatherMapNode.class.php b/lib/WeatherMapNode.class.php
index 7abcef87..85e4202c 100644
--- a/lib/WeatherMapNode.class.php
+++ b/lib/WeatherMapNode.class.php
@@ -168,6 +168,7 @@ class WeatherMapNode extends WeatherMapItem {
 	var $relative_to;
 	/** @var mixed */
 	var $zorder;
+	var $render_note_hidpi = false;
 	/** @var mixed */
 	var $template;
 	/** @var mixed */
@@ -357,6 +358,18 @@ function pre_render($image, &$map) {
 			}
 
 			[$strwidth, $strheight] = $map->myimagestringsize($this->labelfont, $this->proclabel);
+			$noteLines = null;
+			if ($this->get_hint('editor_note', '0') === '1' && $this->labelangle == 0) {
+				$noteLines = explode("\n", $this->proclabel);
+				$strwidth = 0;
+				foreach ($noteLines as $line) {
+					[$lineWidth] = $map->myimagestringsize($this->labelfont, $line);
+					$strwidth = max($strwidth, $lineWidth);
+				}
+				[, $noteLineHeight] = $map->myimagestringsize($this->labelfont, 'Ag');
+				$noteLineHeight = max(1, ceil($noteLineHeight));
+				$strheight = count($noteLines) * $noteLineHeight;
+			}
 
 			if ($this->labelangle == 90 || $this->labelangle == 270) {
 				$boxwidth  = ($strheight * $padfactor) + $padding;
@@ -775,7 +788,20 @@ function pre_render($image, &$map) {
 				}
 			}
 
+			if ($noteLines !== null && $this->render_note_hidpi && isset($map->fonts[$this->labelfont]) && $map->fonts[$this->labelfont]->type === 'truetype') {
+				// The editor draws this text at display resolution after composing the map.
+			} elseif ($noteLines !== null) {
+				$lineY = $txt_y - $strheight + $noteLineHeight;
+				foreach ($noteLines as $line) {
+					[$lineWidth] = $map->myimagestringsize($this->labelfont, $line);
+					$alignment = $this->get_hint('editor_note_align', 'left');
+					$lineX = $txt_x + ($alignment === 'right' ? $strwidth - $lineWidth : ($alignment === 'centre' ? ($strwidth - $lineWidth) / 2 : 0));
+					$map->myimagestring($node_im, $this->labelfont, (int)round($lineX), $lineY, $line, $txcol->gdallocate($node_im));
+					$lineY += $noteLineHeight;
+				}
+			} else {
 			$map->myimagestring($node_im, $this->labelfont, $txt_x, $txt_y, $this->proclabel, $txcol->gdallocate($node_im),$this->labelangle);
+			}
 			// $map->myimagestring($node_im, $this->labelfont, $txt_x, $txt_y, $this->proclabel, $txcol->gdallocate($node_im),90);
 		}
 
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index bf976588..277d8568 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -103,6 +103,7 @@ function getMapJavaScript($mapfile) {
 	$map->ReadConfig($mapfile);
 
 	print $map->asJS();
+	print 'var WMNotes = ' . json_encode(wm_editor_note_data($map), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
 }
 
 /**
@@ -1135,3 +1136,26 @@ function getImageURL($mapname, $selected) {
 
 	return $imageurl;
 }
+
+/**
+ * Save a note through the authenticated editor request path.
+ *
+ * @param string $mapfile Validated configuration path.
+ * @param int $grid_snap_value Placement grid spacing.
+ *
+ * @return void
+ */
+function setNoteProperties($mapfile, $grid_snap_value) {
+	$map = new WeatherMap;
+	$map->context = 'editor';
+	$map->ReadConfig($mapfile);
+	$values = [];
+	foreach (['name', 'text', 'font', 'colour', 'x', 'y', 'align'] as $field) {
+		$values[$field] = get_nfilter_request_var('note_' . $field);
+	}
+	if (!wm_editor_save_note($map, $values, $grid_snap_value)) {
+		http_response_code(400);
+		return;
+	}
+	if (!$map->WriteConfig($mapfile)) http_response_code(500);
+}
diff --git a/lib/editor.inc.php b/lib/editor.inc.php
index ba03d20b..cbd8fd21 100644
--- a/lib/editor.inc.php
+++ b/lib/editor.inc.php
@@ -41,6 +41,7 @@
 */
 
 require_once __DIR__ . '/editor.comment-style.php';
+require_once __DIR__ . '/editor.notes.php';
 
 /** editor.inc.php
  *
@@ -1019,6 +1020,10 @@ function getEditorJs() {
 		'changeInterface'      => __('Change interface', 'weathermap'),
 		'searchInterface'      => __('Search device or interface', 'weathermap'),
 		'noInterface'          => __('No interface selected', 'weathermap'),
+		'addNoteHelp' => __('Click on the map where you would like to add a note.', 'weathermap'),
+		'noteTitle' => __('Note', 'weathermap'),
+		'noteDelete' => __('Delete note "%s"?', '%s', 'weathermap'),
+		'noteError' => __('The note could not be saved. Check its text, font and position, then try again.', 'weathermap'),
 		'currentGraph'         => __('Current graph: %s', '%s', 'weathermap'),
 		'customConfig'         => __('Custom configuration — details under Advanced', 'weathermap'),
 		'chooseInterface'      => __('Choose an interface below', 'weathermap'),
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
new file mode 100644
index 00000000..0e34058f
--- /dev/null
+++ b/lib/editor.notes.php
@@ -0,0 +1,117 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Create or update a label-only note using existing map node directives.
+ *
+ * @param WeatherMap $map Map being edited.
+ * @param array<string, mixed> $values Submitted note fields.
+ * @param int $grid_snap_value Placement grid spacing.
+ *
+ * @return bool Whether the note was changed.
+ */
+function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
+	$name = $values['name'] ?? '';
+	$text = $values['text'] ?? '';
+	$colour = $values['colour'] ?? '';
+	$alignment = $values['align'] ?? 'left';
+	if (!in_array($alignment, ['left', 'centre', 'right'], true)) {
+		return false;
+	}
+	if (!is_string($name) || !is_string($text) || trim($text) === '' || strlen($text) > 2000
+		|| preg_match('/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/', $text)
+		|| !is_string($colour) || !preg_match('/^#[0-9a-f]{6}$/iD', $colour)) {
+		return false;
+	}
+	foreach (['x', 'y'] as $axis) {
+		if (!isset($values[$axis]) || !is_scalar($values[$axis]) || !preg_match('/^\d{1,6}$/D', (string)$values[$axis])) {
+			return false;
+		}
+	}
+	$x = (int)$values['x'];
+	$y = (int)$values['y'];
+	if ($x > $map->width || $y > $map->height) {
+		return false;
+	}
+	if ($name !== '' && (!isset($map->nodes[$name]) || $map->nodes[$name]->get_hint('editor_note', '0') !== '1')) {
+		return false;
+	}
+	$font = wm_comment_resolve_font($map, $values['font'] ?? null);
+	if ($font === null) {
+		return false;
+	}
+	if ($name === '') {
+		do {
+			$name = 'note_' . bin2hex(random_bytes(6));
+		} while (isset($map->nodes[$name]));
+		$node = new WeatherMapNode;
+		$node->name = $name;
+		$node->template = 'DEFAULT';
+		$node->Reset($map);
+		$node->defined_in = $map->configfile;
+		$node->iconfile = '';
+		$node->targets = [];
+		$node->infourl = [IN => '', OUT => ''];
+		$node->overliburl = [IN => [], OUT => []];
+		$node->notestext = [IN => '', OUT => ''];
+		$node->labelbgcolour = [-1, -1, -1];
+		$node->labeloutlinecolour = [-1, -1, -1];
+		$node->labelfontshadowcolour = [-1, -1, -1];
+		$node->labeloffset = '';
+		$node->labeloffsetx = 0;
+		$node->labeloffsety = 0;
+		$node->labelangle = 0;
+		$node->relative_to = '';
+		$node->add_hint('editor_note', '1');
+		$map->nodes[$name] = $node;
+	}
+	$node = $map->nodes[$name];
+	$node->label = str_replace(["\r\n", "\r", "\n"], '\n', trim($text));
+	$node->labelfont = $font;
+	$node->add_hint('editor_note_align', $alignment);
+	$node->labelfontcolour = [hexdec(substr($colour, 1, 2)), hexdec(substr($colour, 3, 2)), hexdec(substr($colour, 5, 2))];
+	$node->x = min($map->width, snap($x, $grid_snap_value));
+	$node->y = min($map->height, snap($y, $grid_snap_value));
+	return true;
+}
+/**
+ * Expose note style data alongside the editor's existing node data.
+ *
+ * @param WeatherMap $map Map being edited.
+ *
+ * @return array<string, array<string, mixed>> Notes indexed by node name.
+ */
+function wm_editor_note_data($map) {
+	$notes = [];
+	foreach ($map->nodes as $name => $node) {
+		if ($node->get_hint('editor_note', '0') !== '1' || $name === 'DEFAULT') {
+			continue;
+		}
+		$font = $map->fonts[$node->labelfont];
+		$rgb = $node->labelfontcolour;
+		$notes[$name] = ['align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$node->labelfont, 'fontLabel' => wm_editor_font_label($node->labelfont, $font),
+			'colour' => sprintf('#%02x%02x%02x', max(0, $rgb[0]), max(0, $rgb[1]), max(0, $rgb[2]))];
+	}
+	return $notes;
+}
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 6963759a..01e70932 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Cacti\n"
+"Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-11 10:30+1030\n"
+"POT-Creation-Date: 2026-10-11 20:34+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -89,6 +89,16 @@ msgstr ""
 msgid "Link Comment Colour"
 msgstr ""
 
+#: lib/editor.config-delete.php
+#, php-format
+msgid "Delete configuration file %s"
+msgstr ""
+
+#: lib/editor.config-delete.php
+#, php-format
+msgid "Are you sure you want to permanently delete the configuration file \"%s\"?"
+msgstr ""
+
 #: lib/editor.inc.php
 msgid "Next results"
 msgstr ""
@@ -194,6 +204,23 @@ msgstr ""
 msgid "No interface selected"
 msgstr ""
 
+#: lib/editor.inc.php
+msgid "Click on the map where you would like to add a note."
+msgstr ""
+
+#: lib/editor.inc.php weathermap-cacti-plugin-editor.php
+msgid "Note"
+msgstr ""
+
+#: lib/editor.inc.php
+#, php-format
+msgid "Delete note \"%s\"?"
+msgstr ""
+
+#: lib/editor.inc.php
+msgid "The note could not be saved. Check its text, font and position, then try again."
+msgstr ""
+
 #: lib/editor.inc.php
 #, php-format
 msgid "Current graph: %s"
@@ -930,6 +957,10 @@ msgstr ""
 msgid "Add<br>Link"
 msgstr ""
 
+#: weathermap-cacti-plugin-editor.php
+msgid "Add<br>Note"
+msgstr ""
+
 #: weathermap-cacti-plugin-editor.php
 msgid "Position<br>Legend"
 msgstr ""
@@ -1010,6 +1041,50 @@ msgstr ""
 msgid "See config"
 msgstr ""
 
+#: weathermap-cacti-plugin-editor.php
+msgid "Delete Note"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Text"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Centre"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Left"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Right"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Text alignment"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Font"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Colour"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Note colour"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Custom colour"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Save"
+msgstr ""
+
 #: weathermap-cacti-plugin-editor.php
 msgid "Node Properties"
 msgstr ""
@@ -1046,10 +1121,6 @@ msgstr ""
 msgid "Graph Selector"
 msgstr ""
 
-#: weathermap-cacti-plugin-editor.php
-msgid "Save"
-msgstr ""
-
 #: weathermap-cacti-plugin-editor.php
 msgid "You can modify the Weathermap Node from here.  The Position columns are the X,Y position on the Map.  The Internal Name is the unique ID given to the Node.  The Label is the external name of the Node that you provide to users.  The Icon Filename is the Graphic that you want to represent the Node Object.  The INFO URL is a link that you can provide when clicking on the active Map Node.  The Hover Graph URL's are Cacti or other Graphs URL's that can will appear when hovering over the Node.  The Graph Selector is a helper for selecting Cacti Graphs for the Graph URL's.   There are several other Node properties possible.  However, today we are only supporting those included above."
 msgstr ""
@@ -2009,6 +2080,10 @@ msgstr ""
 msgid "Unable to delete the last remaining Map Group."
 msgstr ""
 
+#: weathermap-cacti-plugin-mgmt.php
+msgid "Map title is too long. Use at most 4088 bytes after escaping."
+msgstr ""
+
 #: weathermap-cacti-plugin-mgmt.php
 #, php-format
 msgid "The New Map File name %s already exists!"
@@ -2142,7 +2217,3 @@ msgstr ""
 #: weathermap-cacti-plugin.php
 msgid "Paused"
 msgstr ""
-
-#: weathermap-cacti-plugin-mgmt.php
-msgid "Map title is too long. Use at most 4088 bytes after escaping."
-msgstr ""
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
new file mode 100644
index 00000000..e7654fc6
--- /dev/null
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -0,0 +1,137 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+require dirname(__DIR__) . '/bootstrap-unit.php';
+$plugin = dirname(__DIR__, 2);
+chdir($plugin);
+require $plugin . '/setup.php';
+require $plugin . '/lib/WeatherMap.class.php';
+require $plugin . '/lib/editor.inc.php';
+require $plugin . '/lib/editor.actions.php';
+function note_assert($value, $message) {
+	if (!$value) throw new RuntimeException($message);
+}
+$directory = sys_get_temp_dir() . '/wm-note-' . bin2hex(random_bytes(6));
+mkdir($directory);
+try {
+	$map = new WeatherMap;
+	$map->width = 600;
+	$map->height = 300;
+	$file = $directory . '/note.conf';
+	$map->WriteConfig($file);
+	$map->ReadConfig($file);
+	$values = ['name' => '', 'text' => "Main site\n10.0.0.0/24", 'font' => 'bundled:Vera.ttf:11', 'colour' => '#0000ff', 'x' => '155', 'y' => '80'];
+	note_assert(wm_editor_save_note($map, $values), 'create');
+	$name = array_keys(wm_editor_note_data($map))[0];
+	$map->WriteConfig($file);
+	$saved = new WeatherMap;
+	$saved->ReadConfig($file);
+	$node = $saved->nodes[$name];
+	note_assert($node->label === 'Main site\\n10.0.0.0/24', 'multiline config roundtrip');
+	note_assert($node->get_hint('editor_note', '0') === '1', 'marker');
+	note_assert($node->labelfontcolour == [0,0,255] && $node->iconfile === '', 'style');
+	note_assert($node->labelbgcolour == [-1,-1,-1] && $node->labeloutlinecolour == [-1,-1,-1], 'plain text');
+	$saved->DrawMap($directory . '/note.png');
+	note_assert(is_file($directory . '/note.png'), 'render');
+
+	$size = getimagesize($directory . '/note.png');
+	note_assert($size[0] === 1200 && $size[1] === 600, 'generated viewer image double density');
+	note_assert(!$node->render_note_hidpi, 'render flag reset');
+	$saved->DrawMap($directory . '/note.png', $directory . '/thumb.png', 250);
+	$thumbSize = getimagesize($directory . '/thumb.png');
+	note_assert($thumbSize[0] === 250 && $thumbSize[1] === 125, 'thumbnail logical aspect ratio');
+	$sharpBounds = $node->boundingboxes;
+	$saved->DrawMap('null');
+	note_assert(end($node->boundingboxes) == end($sharpBounds), 'clickable note bounds remain logical');
+	note_assert(imagesx($saved->image) === 600, 'HTML-only rendering keeps logical dimensions');
+	$saved->imageuri = 'note.png';
+	note_assert(str_contains($saved->MakeHTML(), "width='600' height='300'"), 'viewer display size remains logical');
+	$oldWidth = $saved->width;
+	$saved->width = 50000;
+	note_assert(wm_sharp_notes($saved) === [], 'large map allocation bounded');
+	$saved->width = $oldWidth;
+	$node->zorder = 1001;
+	note_assert(wm_sharp_notes($saved) === [], 'non-front annotation keeps original layering');
+	$node->zorder = 600;
+
+
+	$later = clone $node;
+	$later->name = 'later_node';
+	$later->label = 'Ordinary node';
+	$later->add_hint('editor_note', '0');
+	$later->x = 500;
+	$later->y = 250;
+	$saved->nodes[$later->name] = $later;
+	$saved->seen_zlayers[600][] = $later;
+	$saved->DrawMap($directory . '/later.png');
+	note_assert(getimagesize($directory . '/later.png')[0] === 1200, 'unrelated later node keeps note sharp');
+	$later->x = $node->x;
+	$later->y = $node->y;
+	$saved->DrawMap($directory . '/overlap.png');
+	note_assert(getimagesize($directory . '/overlap.png')[0] === 600, 'overlapping later node preserves stacking');
+	array_pop($saved->seen_zlayers[600]);
+	unset($saved->nodes[$later->name]);
+
+	$hashes = [];
+	foreach (['left', 'centre', 'right'] as $alignment) {
+		$aligned = $values;
+		$aligned['name'] = $name;
+		$aligned['align'] = $alignment;
+		note_assert(wm_editor_save_note($saved, $aligned), 'save ' . $alignment);
+		$saved->WriteConfig($file);
+		$rendered = new WeatherMap;
+		$rendered->ReadConfig($file);
+		note_assert(wm_editor_note_data($rendered)[$name]['align'] === $alignment, 'alignment roundtrip');
+		$png = $directory . '/' . $alignment . '.png';
+		$rendered->DrawMap($png);
+		$hashes[] = hash_file('sha256', $png);
+	}
+	note_assert(count(array_unique($hashes)) === 3, 'alignments change rendered pixels');
+	$values['name'] = $name;
+	$values['text'] = 'Edited note';
+	$values['colour'] = '#c00000';
+	$values['x'] = '205';
+	note_assert(wm_editor_save_note($saved, $values), 'edit');
+	$saved->WriteConfig($file);
+	$again = new WeatherMap;
+	$again->ReadConfig($file);
+	note_assert($again->nodes[$name]->label === 'Edited note' && $again->nodes[$name]->x == 205, 'edit persists');
+	foreach (['text' => "bad\nNODE injected", 'name' => 'DEFAULT', 'font' => '../../bad.ttf', 'colour' => '#nope', 'x' => '-1', 'y' => '301', 'align' => 'invalid'] as $key => $value) {
+		$bad = $values; $bad[$key] = $value;
+		if ($key === 'text') {
+			note_assert(wm_editor_save_note($again, $bad), 'newline stays text');
+			$again->WriteConfig($file);
+			note_assert(strpos(file_get_contents($file), "\nNODE injected") === false, 'no config injection');
+		} else note_assert(!wm_editor_save_note($again, $bad), 'reject ' . $key);
+	}
+	$GLOBALS['__test_nfilter_request'] = ['param' => $name];
+	deleteNode($file);
+	$deleted = new WeatherMap;
+	$deleted->ReadConfig($file);
+	note_assert(!isset($deleted->nodes[$name]), 'delete persists');
+	print "PASS: note create, render, edit, styles, multiline, validation and delete\n";
+} finally {
+	foreach (glob($directory . '/*') as $file) unlink($file);
+	rmdir($directory);
+}
diff --git a/tests/Unit/EditorNotesEngineTest.php b/tests/Unit/EditorNotesEngineTest.php
new file mode 100644
index 00000000..102679c7
--- /dev/null
+++ b/tests/Unit/EditorNotesEngineTest.php
@@ -0,0 +1,19 @@
+<?php
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\TestCase;
+
+final class EditorNotesEngineTest extends TestCase {
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testRealEngineRegression(): void {
+        ob_start();
+        try {
+            require dirname(__DIR__) . '/Support/EditorNotesEngineRegression.php';
+            $result = ob_get_contents();
+        } finally {
+            ob_end_clean();
+        }
+        self::assertSame("PASS: note create, render, edit, styles, multiline, validation and delete\n", $result);
+    }
+}
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index a3ee49bc..c7292ca2 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -94,7 +94,7 @@
 	$action = wm_editor_sanitize_action(get_nfilter_request_var('action'), [
 		'graphs', 'datasources', 'newmap', 'newmapcopy', 'font_samples', 'draw',
 		'show_config', 'fetch_config', 'set_link_config', 'set_node_config',
-		'set_node_properties', 'set_link_properties', 'set_map_properties',
+		'set_note_properties', 'set_node_properties', 'set_link_properties', 'set_map_properties',
 		'set_map_style', 'add_link2', 'place_legend', 'place_stamp', 'via_link',
 		'move_node', 'link_tidy', 'retidy', 'retidy_all', 'untidy',
 		'delete_link', 'add_node', 'editor_settings', 'delete_node',
@@ -168,6 +168,9 @@
 		setNodeConfig($mapfile);
 
 		break;
+	case 'set_note_properties':
+		setNoteProperties($mapfile, $grid_snap_value);
+		exit;
 	case 'set_node_properties':
 		setNodeProperties($mapfile);
 		exit;
@@ -311,6 +314,7 @@
 			<li class='tb_active' id='tb_newfile'><?php print __('Change<br>File', 'weathermap'); ?></li>
 			<li class='tb_active' id='tb_addnode'><?php print __('Add<br>Node', 'weathermap'); ?></li>
 			<li class='tb_active' id='tb_addlink'><?php print __('Add<br>Link', 'weathermap'); ?></li>
+			<li class='tb_active' id='tb_addnote'><?php print __('Add<br>Note', 'weathermap'); ?></li>
 			<li class='tb_active' id='tb_poslegend'><?php print __('Position<br>Legend', 'weathermap'); ?></li>
 			<li class='tb_active' id='tb_postime'><?php print __('Position<br>Timestamp', 'weathermap'); ?></li>
 			<li class='tb_active' id='tb_mapprops'><?php print __('Map<br>Properties', 'weathermap'); ?></li>
@@ -326,8 +330,8 @@
 	</div>
 	<form id='frmMain' action='<?php print $editor_name ?>' method='post'>
 		<div class='mainArea'>
-			<input id='xycapture' name='xycapture' data-width='<?php print html_escape($map->width); ?>' data-height='<?php print html_escape($map->height); ?>' style='display:none' type='image' src='<?php print html_escape($imageurl); ?>' />
-			<img id='existingdata' name='existingdata' data-width='<?php print html_escape($map->width); ?>' data-height='<?php print html_escape($map->height); ?>' src='<?php print html_escape($imageurl); ?>' usemap='#weathermap_imap' />
+			<input id='xycapture' name='xycapture' width='<?php print html_escape($map->width); ?>' height='<?php print html_escape($map->height); ?>' data-width='<?php print html_escape($map->width); ?>' data-height='<?php print html_escape($map->height); ?>' style='display:none' type='image' src='<?php print html_escape($imageurl); ?>' />
+			<img id='existingdata' name='existingdata' width='<?php print html_escape($map->width); ?>' height='<?php print html_escape($map->height); ?>' data-width='<?php print html_escape($map->width); ?>' data-height='<?php print html_escape($map->height); ?>' src='<?php print html_escape($imageurl); ?>' usemap='#weathermap_imap' />
 			<input id='x' name='x' type='hidden' />
 			<input id='y' name='y' type='hidden' />
 			<div class='debug' style='display:none'><p><strong><?php print __('Debug', 'weathermap'); ?></strong>
@@ -372,6 +376,32 @@
 		</div>
 		<!-- End Data for overlay and selection -->
 
+
+		<div id='dlgNoteProperties' class='dlgProperties' title='<?php print __esc('Note', 'weathermap'); ?>'>
+			<div class='dlgBody'>
+				<div id='wm-note-delete-bar' style='text-align:right;margin-bottom:8px'><button type='button' id='note_delete' class='ui-button ui-corner-all' style='color:#9b2525'><?php print __esc('Delete Note', 'weathermap'); ?></button></div>
+				<input type='hidden' id='note_name' name='note_name' value='' />
+				<table class='cactiTable'>
+					<tr><td><label for='note_text'><?php print __esc('Text', 'weathermap'); ?></label></td><td><textarea id='note_text' name='note_text' rows='3' maxlength='2000' style='width:100%'></textarea></td></tr>
+					<tr><td><label for='note_align'><?php print __esc('Text alignment', 'weathermap'); ?></label></td><td><select id='note_align' name='note_align'><option value='left'><?php print __esc('Left', 'weathermap'); ?></option><option value='centre'><?php print __esc('Centre', 'weathermap'); ?></option><option value='right'><?php print __esc('Right', 'weathermap'); ?></option></select></td></tr>
+					<tr><td><label for='note_font'><?php print __esc('Font', 'weathermap'); ?></label></td><td><select id='note_font' name='note_font'><?php print wm_style_font_options($map, $map->nodes['DEFAULT']->labelfont); ?></select></td></tr>
+					<tr><td><?php print __esc('Colour', 'weathermap'); ?></td><td><div id='note_palette' role='group' aria-label='<?php print __esc('Note colour', 'weathermap'); ?>' style='display:flex;flex-wrap:wrap;gap:6px'>
+					<?php foreach (['#000000' => 'Black', '#0000ff' => 'Blue', '#cc0000' => 'Red', '#008000' => 'Green', '#800080' => 'Purple', '#b35900' => 'Orange', '#666666' => 'Grey', '#ffffff' => 'White'] as $colour => $label) { ?>
+						<button type='button' class='wm-note-colour ui-button ui-corner-all' data-colour='<?php print $colour; ?>' aria-pressed='false'><span aria-hidden='true' style='display:inline-block;width:12px;height:12px;background:<?php print $colour; ?>;border:1px solid #888;margin-right:5px'></span><?php print __esc($label, 'weathermap'); ?></button>
+					<?php } ?></div></td></tr>
+					<tr><td><?php print __esc('Position', 'weathermap'); ?></td><td><input type='text' aria-label='X' size='4' class='ui-state-default ui-corner-all' id='note_x' name='note_x' min='0' max='<?php print (int)$map->width; ?>' />,<input type='text' aria-label='Y' size='4' class='ui-state-default ui-corner-all' id='note_y' name='note_y' min='0' max='<?php print (int)$map->height; ?>' /></td></tr>
+				</table>
+				<button type='button' id='note_advanced_toggle' class='ui-button ui-corner-all' aria-expanded='false' aria-controls='note_advanced'><?php print __esc('Advanced settings', 'weathermap'); ?></button><div id='note_advanced' style='display:none'><p><label for='note_colour'><?php print __esc('Custom colour', 'weathermap'); ?></label> <input type='color' id='note_colour' name='note_colour' value='#000000' /></p></div>
+				<p id='wm-note-error' role='alert' style='display:none'></p>
+			</div>
+			<div class='dlgButtons'>
+				<div class='dlgSubButtons'><button type='button' id='note_move' class='ui-button ui-corner-all'><?php print __esc('Move', 'weathermap'); ?></button><button type='button' id='note_clone' class='ui-button ui-corner-all' style='margin-right:24px'><?php print __esc('Clone', 'weathermap'); ?></button>
+				<button type='button' class='wm_submit ui-button ui-corner-all' style='font-weight:bold'><?php print __esc('Save', 'weathermap'); ?></button>
+				<button type='button' class='wm_cancel ui-button ui-corner-all'><?php print __esc('Cancel', 'weathermap'); ?></button>
+				</div>
+			</div>
+		</div>
+
 		<!-- Node Properties -->
 		<div id='dlgNodeProperties' class='dlgProperties' title='<?php print __('Node Properties', 'weathermap'); ?>'>
 			<div class='cactiTable'>

From 609418a8366373ae55ceff7adaa38eaa856e8df4 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:52:56 +1030
Subject: [PATCH 02/35] Guard note deletion and propagate configuration write
 failures

---
 js/editor.js                                  |  7 +--
 lib/WeatherMap.class.php                      | 42 +++++++++++------
 lib/editor.notes.php                          |  1 +
 locales/po/cacti.pot                          |  2 +-
 tests/Browser/EditorNotesTest.cjs             | 29 ++++++++++++
 tests/Support/EditorNotesEngineRegression.php |  3 ++
 tests/Unit/EditorNotesEngineTest.php          | 46 ++++++++++++++-----
 7 files changed, 97 insertions(+), 33 deletions(-)
 create mode 100644 tests/Browser/EditorNotesTest.cjs

diff --git a/js/editor.js b/js/editor.js
index fa3a9c47..924d3dc4 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -582,12 +582,9 @@ function attach_click_events() {
 		move_node();
 	});
 	$('#note_delete').off('click').on('click', function() {
-		if (window.confirm(wmEditorText.noteDelete.replace('%s', function() { return $('#note_text').val(); }))) {
-			$('#param').val($('#note_name').val());
+		$('#param').val($('#note_name').val());
 		$('#node_name').val($('#note_name').val());
-			$('#action').val('delete_node');
-			form_submit();
-		}
+		delete_node();
 	});
 	$('#tb_poslegend').off('click').on('click', position_first_legend);
 	$('#tb_postime').off('click').on('click', position_timestamp);
diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 2495460d..7f79f838 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -3620,6 +3620,17 @@ function WriteConfig($filename) {
 		$weathermap_version = plugin_weathermap_numeric_version();
 
 		if ($fd) {
+			$write_ok = true;
+			$write = function($data) use ($fd, &$write_ok) {
+				if (!$write_ok) return;
+				$length = strlen($data);
+				$offset = 0;
+				while ($offset < $length) {
+					$count = @fwrite($fd, substr($data, $offset));
+					if ($count === false || $count === 0) { $write_ok = false; return; }
+					$offset += $count;
+				}
+			};
 			$output .= "# Automatically generated by php-weathermap v$weathermap_version\n\n";
 
 			if (count($this->fonts) > 0) {
@@ -3783,18 +3794,18 @@ function WriteConfig($filename) {
 
 			$output .= "\n# End of global section\n\n";
 
-			fwrite($fd, $output);
+			$write($output);
 
 			// # fwrite($fd,$this->nodes['DEFAULT']->WriteConfig());
 			// # fwrite($fd,$this->links['DEFAULT']->WriteConfig());
 
-			// fwrite($fd, "\n\n# Node definitions:\n");
+			// $write("\n\n# Node definitions:\n");
 
 			foreach (['template', 'normal'] as $which) {
 				if ($which == 'template') {
-					fwrite($fd, "\n# TEMPLATE-only NODEs:\n");
+					$write("\n# TEMPLATE-only NODEs:\n");
 				} elseif ($which == 'normal') {
-					fwrite($fd, "\n# regular NODEs:\n");
+					$write("\n# regular NODEs:\n");
 				}
 
 				foreach ($this->nodes as $node_name => $node) {
@@ -3802,21 +3813,21 @@ function WriteConfig($filename) {
 						if ($node->defined_in == $this->configfile || $node_name == 'DEFAULT') {
 							if ($which == 'template' && $node_name == 'DEFAULT') {
 								wm_debug('TEMPLATE Node DEFAULT');
-								fwrite($fd, $node->WriteConfig());
+								$write($node->WriteConfig());
 							} elseif ($which == 'template' && $node->x === null) {
 								wm_debug('TEMPLATE Node NON-DEFAULT');
-								fwrite($fd, $node->WriteConfig());
+								$write($node->WriteConfig());
 							} elseif ($which == 'normal' && $node->x !== null) {
-								fwrite($fd, $node->WriteConfig());
+								$write($node->WriteConfig());
 							}
 						}
 					}
 				}
 
 				if ($which == 'template') {
-					fwrite($fd, "\n# TEMPLATE-only LINKs:\n");
+					$write("\n# TEMPLATE-only LINKs:\n");
 				} elseif ($which == 'normal') {
-					fwrite($fd, "\n# regular LINKs:\n");
+					$write("\n# regular LINKs:\n");
 				}
 
 				foreach ($this->links as $link_name => $link) {
@@ -3824,22 +3835,23 @@ function WriteConfig($filename) {
 						if ($link->defined_in == $this->configfile || $link_name == 'DEFAULT') {
 							if ($which == 'template' && $link_name == 'DEFAULT') {
 								wm_debug('TEMPLATE Link DEFAULT');
-								fwrite($fd, $link->WriteConfig());
+								$write($link->WriteConfig());
 							} elseif ($which == 'template' && $link->a === null) {
 								wm_debug('TEMPLATE Link NON-DEFAULT');
-								fwrite($fd, $link->WriteConfig());
+								$write($link->WriteConfig());
 							} elseif ($which == 'normal' && $link->a !== null) {
-								fwrite($fd, $link->WriteConfig());
+								$write($link->WriteConfig());
 							}
 						}
 					}
 				}
 			}
 
-			fwrite($fd, "\n\n# That's All Folks!\n");
-			fclose($fd);
+			$write("\n\n# That's All Folks!\n");
+			$flushed = @fflush($fd);
+			$closed = @fclose($fd);
 
-			return (true);
+			return $write_ok && $flushed && $closed;
 		} else {
 			wm_warn("Couldn't open config file $filename for writing");
 
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index 0e34058f..5bcbd530 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -85,6 +85,7 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 		$node->relative_to = '';
 		$node->add_hint('editor_note', '1');
 		$map->nodes[$name] = $node;
+		$map->seen_zlayers[$node->zorder][] = $node;
 	}
 	$node = $map->nodes[$name];
 	$node->label = str_replace(["\r\n", "\r", "\n"], '\n', trim($text));
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 01e70932..7d01cd92 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-11 20:34+1030\n"
+"POT-Creation-Date: 2026-10-12 00:46+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
diff --git a/tests/Browser/EditorNotesTest.cjs b/tests/Browser/EditorNotesTest.cjs
new file mode 100644
index 00000000..35bc4fb3
--- /dev/null
+++ b/tests/Browser/EditorNotesTest.cjs
@@ -0,0 +1,29 @@
+// Exercise note placement, default/edit values and actual save/error handlers.
+const {JSDOM}=require('jsdom');
+const jquery=require('jquery');
+const fs=require('node:fs');
+const path=require('node:path');
+const assert=require('node:assert/strict');
+const fields=['action','param','node_name','note_name','note_text','note_x','note_y','note_colour','x','y','mapname'];
+const dom=new JSDOM('<body>'+fields.map(id=>id==='note_text'?`<textarea id="${id}" name="${id}"></textarea>`:`<input id="${id}" name="${id}">`).join('')+'<select id="note_font"><option value="bundled:Vera.ttf:9">Vera Sans — 9 pt</option></select><select id="note_align"><option>left</option><option>centre</option><option>right</option></select><div id="tb_help"></div><div id="note_advanced"></div><div id="wm-note-error"></div>'+['tb_addnote','note_clone','note_move','note_delete','note_advanced_toggle'].map(id=>`<button id="${id}"></button>`).join('')+'<button class="wm-note-colour" data-colour="#000000"></button></body>',{runScripts:'outside-only',pretendToBeVisual:true});
+const w=dom.window,$=jquery(w);w.$=w.jQuery=$;
+let mode,shown,moved,deleted,request;
+Object.assign(w,{Nodes:{note1:{label:'Core\\nMaintenance',x:50,y:60}},WMNotes:{note1:{align:'centre',font:'bundled:Vera.ttf:9',colour:'#cc0000'}},wmEditorText:{advanced:'Advanced',hideAdvanced:'Hide',addNoteHelp:'Place a note',noteError:'Save failed'},editor_url:'/editor',hide_all_dialogs:()=>$('#action').val(''),mapmode:m=>mode=m,show_dialog:id=>shown=id,hide_dialog:()=>{},move_node:()=>moved=$('#node_name').val(),delete_node:()=>deleted=$('#node_name').val()});
+$.fn.selectmenu=function(){return this;};
+const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');
+w.eval(source.slice(source.indexOf('// Notes are ordinary'),source.length));
+w.eval(source.slice(source.indexOf('function form_submit('),source.indexOf('function map_properties(')));
+w.eval(source.slice(source.indexOf("\t$('#tb_addnote')"),source.indexOf("\t$('#tb_poslegend')")));
+$('#tb_addnote').trigger('click');assert.equal($('#action').val(),'place_note');assert.equal(mode,'xy');
+$('#x').val('100');$('#y').val('120');w.form_submit();
+assert.equal(shown,'dlgNoteProperties');assert.equal($('#note_font').val(),'bundled:Vera.ttf:9');assert.equal($('#note_colour').val(),'#000000');assert.equal($('#note_align').val(),'left');assert.equal($('#note_x').val(),'100');
+w.show_note('note1');assert.equal($('#note_text').val(),'Core\nMaintenance');assert.equal($('#note_align').val(),'centre');
+$('#note_x,#note_y').attr('max',600);$('#note_clone').trigger('click');assert.equal($('#note_name').val(),'');assert.equal($('#note_x').val(),'70');
+w.show_note('note1');$('#note_move').trigger('click');assert.equal(moved,'note1');
+w.show_note('note1');$('#note_delete').trigger('click');assert.equal(deleted,'note1');assert.equal($('#param').val(),'note1');
+$.ajax=opts=>request=opts;w.show_note('note1');w.form_submit();
+assert.equal(request.type,'POST');assert.match(request.data,/action=set_note_properties/);assert.match(request.data,/note_name=note1/);
+request.error();assert.equal($('#wm-note-error').text(),'Save failed');assert.notEqual($('#wm-note-error').css('display'),'none');assert.equal($('#note_name').val(),'note1');
+let refreshed=false;$.get=(url,cb)=>{assert.match(url,/load_area_data/);cb('');};$.getScript=(url,cb)=>{assert.match(url,/load_map_javascript/);cb('');};w.initJS=()=>refreshed=true;
+request.success('');assert.ok(refreshed);assert.equal($('#action').val(),'');
+dom.window.close();console.log('PASS: note placement, defaults, edit, clone, move, guarded delete, save/error and refresh');
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index e7654fc6..fb0d1bc7 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -44,6 +44,9 @@ function note_assert($value, $message) {
 	$values = ['name' => '', 'text' => "Main site\n10.0.0.0/24", 'font' => 'bundled:Vera.ttf:11', 'colour' => '#0000ff', 'x' => '155', 'y' => '80'];
 	note_assert(wm_editor_save_note($map, $values), 'create');
 	$name = array_keys(wm_editor_note_data($map))[0];
+	note_assert(in_array($map->nodes[$name], $map->seen_zlayers[$map->nodes[$name]->zorder], true), 'new note indexed immediately');
+	$map->DrawMap($directory . '/immediate.png');
+	note_assert(getimagesize($directory . '/immediate.png')[0] === 1200, 'new note renders sharply without rereading');
 	$map->WriteConfig($file);
 	$saved = new WeatherMap;
 	$saved->ReadConfig($file);
diff --git a/tests/Unit/EditorNotesEngineTest.php b/tests/Unit/EditorNotesEngineTest.php
index 102679c7..e7133522 100644
--- a/tests/Unit/EditorNotesEngineTest.php
+++ b/tests/Unit/EditorNotesEngineTest.php
@@ -1,19 +1,41 @@
 <?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
 use PHPUnit\Framework\Attributes\RunInSeparateProcess;
 use PHPUnit\Framework\Attributes\PreserveGlobalState;
 use PHPUnit\Framework\TestCase;
 
 final class EditorNotesEngineTest extends TestCase {
-    #[RunInSeparateProcess]
-    #[PreserveGlobalState(false)]
-    public function testRealEngineRegression(): void {
-        ob_start();
-        try {
-            require dirname(__DIR__) . '/Support/EditorNotesEngineRegression.php';
-            $result = ob_get_contents();
-        } finally {
-            ob_end_clean();
-        }
-        self::assertSame("PASS: note create, render, edit, styles, multiline, validation and delete\n", $result);
-    }
+	#[RunInSeparateProcess]
+	#[PreserveGlobalState(false)]
+	public function testRealEngineRegression(): void {
+		ob_start();
+		try {
+			require dirname(__DIR__) . '/Support/EditorNotesEngineRegression.php';
+			$result = ob_get_contents();
+		} finally {
+			ob_end_clean();
+		}
+		self::assertSame("PASS: note create, render, edit, styles, multiline, validation and delete\n", $result);
+	}
 }

From 3f5f48a255957aa50e6d4f50fbe99c9e35719efa Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:56:04 +1030
Subject: [PATCH 03/35] Exercise template saves and failing configuration
 streams

---
 tests/Support/EditorNotesEngineRegression.php | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index fb0d1bc7..a54529f2 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -133,6 +133,25 @@ function note_assert($value, $message) {
 	$deleted = new WeatherMap;
 	$deleted->ReadConfig($file);
 	note_assert(!isset($deleted->nodes[$name]), 'delete persists');
+	$templateFile = $directory . '/templates.conf';
+	file_put_contents($templateFile, "NODE templateNode\n LABEL Template\nNODE A\n POSITION 10 10\nNODE B\n POSITION 50 50\nLINK templateLink\n WIDTH 8\nLINK trafficLink\n NODES A B\n");
+	$templateMap = new WeatherMap;
+	note_assert($templateMap->ReadConfig($templateFile), 'read templates and real link');
+	note_assert($templateMap->WriteConfig($templateFile), 'write templates and real link');
+	$reloadedTemplates = new WeatherMap;
+	$reloadedTemplates->ReadConfig($templateFile);
+	note_assert(isset($reloadedTemplates->nodes['templateNode'], $reloadedTemplates->links['templateLink'], $reloadedTemplates->links['trafficLink']), 'write retains template nodes and template/real links');
+	class NoteFailingWriteStream {
+		public $context;
+		public function url_stat($path, $flags) { return ['mode' => 0100777]; }
+		public function stream_open($path, $mode, $options, &$opened) { return true; }
+		public function stream_write($data) { return 0; }
+		public function stream_flush() { return false; }
+		public function stream_close() {}
+	}
+	stream_wrapper_register('notewritefail', NoteFailingWriteStream::class);
+	try { note_assert($map->WriteConfig('notewritefail://map/config') === false, 'write and flush failures propagate'); }
+	finally { stream_wrapper_unregister('notewritefail'); }
 	print "PASS: note create, render, edit, styles, multiline, validation and delete\n";
 } finally {
 	foreach (glob($directory . '/*') as $file) unlink($file);

From d90c70e7e8a5e18cc6401b1abbaa61e7eaf9da26 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:30:27 +1030
Subject: [PATCH 04/35] Keep sharp notes at logical live-view size and extract
 palette translations

---
 CHANGELOG.md                                  |  2 ++
 lib/WeatherMap.notes.php                      | 23 ++++++++++++-
 lib/WeatherMapNode.class.php                  |  2 +-
 locales/po/cacti.pot                          | 34 ++++++++++++++++++-
 tests/Support/EditorNotesEngineRegression.php |  5 +++
 weathermap-cacti-plugin-editor.php            |  4 +--
 weathermap-cacti-plugin.php                   |  2 +-
 7 files changed, 66 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d13427ee..4bdde3cc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ IMPORTANT NOTE: This version only works on CACTI 1.x++!
 
 --- develop ---
 
+* Add editable map notes with alignment and sharp text at logical map dimensions
+
 * issue#299: Keep editor picker results open when browsing and allow changing an existing selection
 
 * feature#298: Fit or stretch background images within the map canvas
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 84bec9c4..1f805cff 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -25,6 +25,9 @@
 /**
  * Notes eligible for high-density map rendering. Restrict the allocation to
  * bounded maps and plain TrueType annotations drawn above the other objects.
+ *
+ * @param WeatherMap $map The rendered map and its object layers.
+ * @return WeatherMapNode[] Notes eligible for high-density rendering.
  */
 function wm_sharp_notes($map) {
 	if ($map->width < 1 || $map->height < 1 || $map->width * $map->height > 4000000) {
@@ -57,7 +60,13 @@ function wm_sharp_notes($map) {
 	return $notes;
 }
 
-/** Render glyphs at twice the density; do not enlarge an existing text bitmap. */
+/**
+ * Render glyphs at twice the density; do not enlarge an existing text bitmap.
+ *
+ * @param WeatherMap $map The composed logical-resolution map.
+ * @param WeatherMapNode[] $notes Notes to draw over the composed image.
+ * @return GdImage The high-density display image.
+ */
 function wm_note_display_image($map, $notes) {
 	$image = imagecreatetruecolor($map->width * 2, $map->height * 2);
 	imagecopyresampled($image, $map->image, 0, 0, 0, 0, $map->width * 2, $map->height * 2, $map->width, $map->height);
@@ -87,3 +96,15 @@ function wm_note_display_image($map, $notes) {
 	}
 	return $image;
 }
+
+/**
+ * Size the live-view bitmap in logical map coordinates, including high-density output.
+ *
+ * @param WeatherMap $map The map supplying logical display dimensions.
+ * @param string|int $id The registered map identifier.
+ * @return string Escaped live-view image markup.
+ */
+function wm_liveview_image_html($map, $id) {
+	$url = htmlspecialchars('?action=liveviewimage&id=' . rawurlencode((string)$id), ENT_QUOTES, 'UTF-8');
+	return '<img src="' . $url . '" width="' . (int)$map->width . '" height="' . (int)$map->height . '" />' . "\n";
+}
diff --git a/lib/WeatherMapNode.class.php b/lib/WeatherMapNode.class.php
index 85e4202c..7526245c 100644
--- a/lib/WeatherMapNode.class.php
+++ b/lib/WeatherMapNode.class.php
@@ -800,7 +800,7 @@ function pre_render($image, &$map) {
 					$lineY += $noteLineHeight;
 				}
 			} else {
-			$map->myimagestring($node_im, $this->labelfont, $txt_x, $txt_y, $this->proclabel, $txcol->gdallocate($node_im),$this->labelangle);
+				$map->myimagestring($node_im, $this->labelfont, $txt_x, $txt_y, $this->proclabel, $txcol->gdallocate($node_im),$this->labelangle);
 			}
 			// $map->myimagestring($node_im, $this->labelfont, $txt_x, $txt_y, $this->proclabel, $txcol->gdallocate($node_im),90);
 		}
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 7d01cd92..79d655a8 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 00:46+1030\n"
+"POT-Creation-Date: 2026-10-12 01:26+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -1077,6 +1077,38 @@ msgstr ""
 msgid "Note colour"
 msgstr ""
 
+#: weathermap-cacti-plugin-editor.php
+msgid "Black"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Blue"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Green"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Grey"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Orange"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Purple"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "Red"
+msgstr ""
+
+#: weathermap-cacti-plugin-editor.php
+msgid "White"
+msgstr ""
+
 #: weathermap-cacti-plugin-editor.php
 msgid "Custom colour"
 msgstr ""
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index a54529f2..2df2bb81 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -47,6 +47,11 @@ function note_assert($value, $message) {
 	note_assert(in_array($map->nodes[$name], $map->seen_zlayers[$map->nodes[$name]->zorder], true), 'new note indexed immediately');
 	$map->DrawMap($directory . '/immediate.png');
 	note_assert(getimagesize($directory . '/immediate.png')[0] === 1200, 'new note renders sharply without rereading');
+	$live = new DOMDocument;
+	$live->loadHTML(wm_liveview_image_html($map, '123'));
+	$liveImage = $live->getElementsByTagName('img')->item(0);
+	note_assert($liveImage->getAttribute('width') === '600' && $liveImage->getAttribute('height') === '300', 'live view constrains high-density image to logical dimensions');
+	note_assert($liveImage->getAttribute('src') === '?action=liveviewimage&id=123', 'live-view image endpoint retained');
 	$map->WriteConfig($file);
 	$saved = new WeatherMap;
 	$saved->ReadConfig($file);
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index c7292ca2..c381c5b1 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -386,8 +386,8 @@
 					<tr><td><label for='note_align'><?php print __esc('Text alignment', 'weathermap'); ?></label></td><td><select id='note_align' name='note_align'><option value='left'><?php print __esc('Left', 'weathermap'); ?></option><option value='centre'><?php print __esc('Centre', 'weathermap'); ?></option><option value='right'><?php print __esc('Right', 'weathermap'); ?></option></select></td></tr>
 					<tr><td><label for='note_font'><?php print __esc('Font', 'weathermap'); ?></label></td><td><select id='note_font' name='note_font'><?php print wm_style_font_options($map, $map->nodes['DEFAULT']->labelfont); ?></select></td></tr>
 					<tr><td><?php print __esc('Colour', 'weathermap'); ?></td><td><div id='note_palette' role='group' aria-label='<?php print __esc('Note colour', 'weathermap'); ?>' style='display:flex;flex-wrap:wrap;gap:6px'>
-					<?php foreach (['#000000' => 'Black', '#0000ff' => 'Blue', '#cc0000' => 'Red', '#008000' => 'Green', '#800080' => 'Purple', '#b35900' => 'Orange', '#666666' => 'Grey', '#ffffff' => 'White'] as $colour => $label) { ?>
-						<button type='button' class='wm-note-colour ui-button ui-corner-all' data-colour='<?php print $colour; ?>' aria-pressed='false'><span aria-hidden='true' style='display:inline-block;width:12px;height:12px;background:<?php print $colour; ?>;border:1px solid #888;margin-right:5px'></span><?php print __esc($label, 'weathermap'); ?></button>
+					<?php foreach (['#000000' => __esc('Black', 'weathermap'), '#0000ff' => __esc('Blue', 'weathermap'), '#cc0000' => __esc('Red', 'weathermap'), '#008000' => __esc('Green', 'weathermap'), '#800080' => __esc('Purple', 'weathermap'), '#b35900' => __esc('Orange', 'weathermap'), '#666666' => __esc('Grey', 'weathermap'), '#ffffff' => __esc('White', 'weathermap')] as $colour => $label) { ?>
+						<button type='button' class='wm-note-colour ui-button ui-corner-all' data-colour='<?php print $colour; ?>' aria-pressed='false'><span aria-hidden='true' style='display:inline-block;width:12px;height:12px;background:<?php print $colour; ?>;border:1px solid #888;margin-right:5px'></span><?php print $label; ?></button>
 					<?php } ?></div></td></tr>
 					<tr><td><?php print __esc('Position', 'weathermap'); ?></td><td><input type='text' aria-label='X' size='4' class='ui-state-default ui-corner-all' id='note_x' name='note_x' min='0' max='<?php print (int)$map->width; ?>' />,<input type='text' aria-label='Y' size='4' class='ui-state-default ui-corner-all' id='note_y' name='note_y' min='0' max='<?php print (int)$map->height; ?>' /></td></tr>
 				</table>
diff --git a/weathermap-cacti-plugin.php b/weathermap-cacti-plugin.php
index e905e0ee..a6ec5735 100644
--- a/weathermap-cacti-plugin.php
+++ b/weathermap-cacti-plugin.php
@@ -203,7 +203,7 @@
 
 					print '';
 
-					print "<img src='?action=liveviewimage&id=$id' />\n";
+					print wm_liveview_image_html($map, $id);
 					print $map->imap->subHTML('LEGEND:');
 					print $map->imap->subHTML('TIMESTAMP');
 					print $map->imap->subHTML('NODE:');

From 9ccb9cf5edce2f9f940160849fb05c6fbe81565c Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 09:08:27 +1030
Subject: [PATCH 05/35] Preserve sharp notes across layers and clarify note
 deletion

---
 js/editor.js                                  | 12 +++---
 lib/WeatherMap.notes.php                      | 41 +++++++++----------
 lib/editor.inc.php                            |  2 +
 locales/po/cacti.pot                          | 14 ++++---
 tests/Browser/EditorNotesTest.cjs             | 12 ++++++
 tests/Support/EditorNotesEngineRegression.php |  5 ++-
 6 files changed, 53 insertions(+), 33 deletions(-)

diff --git a/js/editor.js b/js/editor.js
index 924d3dc4..940217e8 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -783,20 +783,21 @@ function delete_node() {
 
 	var name = $('#node_name').val();
 	var connected = Object.keys(Links).filter(function(key) { return Links[key].a === name || Links[key].b === name; }).length;
-	var message = delNodePrompt.replace('%s', function() { return wmNodeDisplayName(name); });
+	var isNote = typeof WMNotes !== 'undefined' && Object.prototype.hasOwnProperty.call(WMNotes, name);
+	var message = (isNote ? wmEditorText.noteDelete : delNodePrompt).replace('%s', function() { return wmNodeDisplayName(name); });
 	if (connected) {
 		message += ' ' + delNodeConnected.replace('%s', String(connected));
 	}
-	$('.dlgConfirm').text(message + ' ' + delNodeKeepDevice);
+	$('.dlgConfirm').text(message + (isNote ? '' : ' ' + delNodeKeepDevice));
 
 	mapmode('xy');
 
 	$('.dlgConfirm').dialog({
 		resizable: false,
-		title: delNodeTitle,
+		title: isNote ? wmEditorText.noteDeleteTitle : delNodeTitle,
 		height: 'auto',
 		width: 400,
-		modal: false,
+		modal: true,
 		buttons: [
 			{
 				text: txtCancel,
@@ -806,10 +807,11 @@ function delete_node() {
 				}
 			},
 			{
-				text: txtDelNode,
+				text: isNote ? wmEditorText.noteDeleteAction : txtDelNode,
 				click: function() {
 					$(this).dialog('close');
 					hide_all_dialogs();
+					$('#param').val(name);
 					$('#action').val('delete_node');
 					form_submit();
 				}
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 1f805cff..acec0c53 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -34,27 +34,26 @@ function wm_sharp_notes($map) {
 		return [];
 	}
 	$notes = [];
-	$lastLayer = 0;
-	foreach (array_merge($map->nodes, $map->links) as $item) {
-		if ($item->name !== 'DEFAULT') $lastLayer = max($lastLayer, $item->zorder);
-	}
-	// Later nodes only block annotations they overlap. Their pre-rendered
-	// rectangles preserve stacking without degrading unrelated notes.
-	foreach ($map->seen_zlayers[$lastLayer] ?? [] as $node) {
-		if ($node instanceof WeatherMapNode && $node->name !== 'DEFAULT' && $node->get_hint('editor_note', '0') === '1' && $node->labelangle == 0 && $node->iconfile === '' && $node->zorder < 1000 && $node->labelbgcolour == [-1,-1,-1] && $node->labeloutlinecolour == [-1,-1,-1] && $node->labelfontshadowcolour == [-1,-1,-1] && isset($map->fonts[$node->labelfont]) && $map->fonts[$node->labelfont]->type === 'truetype') {
-			$notes[] = $node;
-		} elseif ($node instanceof WeatherMapNode && !is_null($node->x)) {
-			$notes = array_values(array_filter($notes, function ($note) use ($node) {
-				if (!$node->image || !$note->image) return false;
-				$x = (int)($node->x - $node->centre_x);
-				$y = (int)($node->y - $node->centre_y);
-				$nx = (int)($note->x - $note->centre_x);
-				$ny = (int)($note->y - $note->centre_y);
-				return $x >= $nx + imagesx($note->image) || $nx >= $x + imagesx($node->image)
-					|| $y >= $ny + imagesy($note->image) || $ny >= $y + imagesy($node->image);
-			}));
-		} elseif (!($node instanceof WeatherMapNode) || !is_null($node->x)) {
-			$notes = [];
+	$layers = $map->seen_zlayers;
+	ksort($layers, SORT_NUMERIC);
+	// Follow draw order; later nodes only block annotations they overlap.
+	foreach ($layers as $items) {
+		foreach ($items ?? [] as $node) {
+			if ($node instanceof WeatherMapNode && $node->name !== 'DEFAULT' && $node->get_hint('editor_note', '0') === '1' && $node->labelangle == 0 && $node->iconfile === '' && $node->zorder < 1000 && $node->labelbgcolour == [-1,-1,-1] && $node->labeloutlinecolour == [-1,-1,-1] && $node->labelfontshadowcolour == [-1,-1,-1] && isset($map->fonts[$node->labelfont]) && $map->fonts[$node->labelfont]->type === 'truetype') {
+				$notes[] = $node;
+			} elseif ($node instanceof WeatherMapNode && !is_null($node->x)) {
+				$notes = array_values(array_filter($notes, function ($note) use ($node) {
+					if (!$node->image || !$note->image) return false;
+					$x = (int)($node->x - $node->centre_x);
+					$y = (int)($node->y - $node->centre_y);
+					$nx = (int)($note->x - $note->centre_x);
+					$ny = (int)($note->y - $note->centre_y);
+					return $x >= $nx + imagesx($note->image) || $nx >= $x + imagesx($node->image)
+						|| $y >= $ny + imagesy($note->image) || $ny >= $y + imagesy($node->image);
+				}));
+			} elseif (!($node instanceof WeatherMapNode) || !is_null($node->x)) {
+				$notes = [];
+			}
 		}
 	}
 	return $notes;
diff --git a/lib/editor.inc.php b/lib/editor.inc.php
index cbd8fd21..903333e2 100644
--- a/lib/editor.inc.php
+++ b/lib/editor.inc.php
@@ -1022,6 +1022,8 @@ function getEditorJs() {
 		'noInterface'          => __('No interface selected', 'weathermap'),
 		'addNoteHelp' => __('Click on the map where you would like to add a note.', 'weathermap'),
 		'noteTitle' => __('Note', 'weathermap'),
+		'noteDeleteTitle' => __('Delete Note Confirmation', 'weathermap'),
+		'noteDeleteAction' => __('Delete Note', 'weathermap'),
 		'noteDelete' => __('Delete note "%s"?', '%s', 'weathermap'),
 		'noteError' => __('The note could not be saved. Check its text, font and position, then try again.', 'weathermap'),
 		'currentGraph'         => __('Current graph: %s', '%s', 'weathermap'),
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 79d655a8..7736beda 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 01:26+1030\n"
+"POT-Creation-Date: 2026-10-12 09:02+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -212,6 +212,14 @@ msgstr ""
 msgid "Note"
 msgstr ""
 
+#: lib/editor.inc.php
+msgid "Delete Note Confirmation"
+msgstr ""
+
+#: lib/editor.inc.php weathermap-cacti-plugin-editor.php
+msgid "Delete Note"
+msgstr ""
+
 #: lib/editor.inc.php
 #, php-format
 msgid "Delete note \"%s\"?"
@@ -1041,10 +1049,6 @@ msgstr ""
 msgid "See config"
 msgstr ""
 
-#: weathermap-cacti-plugin-editor.php
-msgid "Delete Note"
-msgstr ""
-
 #: weathermap-cacti-plugin-editor.php
 msgid "Text"
 msgstr ""
diff --git a/tests/Browser/EditorNotesTest.cjs b/tests/Browser/EditorNotesTest.cjs
index 35bc4fb3..1f6151dc 100644
--- a/tests/Browser/EditorNotesTest.cjs
+++ b/tests/Browser/EditorNotesTest.cjs
@@ -26,4 +26,16 @@ assert.equal(request.type,'POST');assert.match(request.data,/action=set_note_pro
 request.error();assert.equal($('#wm-note-error').text(),'Save failed');assert.notEqual($('#wm-note-error').css('display'),'none');assert.equal($('#note_name').val(),'note1');
 let refreshed=false;$.get=(url,cb)=>{assert.match(url,/load_area_data/);cb('');};$.getScript=(url,cb)=>{assert.match(url,/load_map_javascript/);cb('');};w.initJS=()=>refreshed=true;
 request.success('');assert.ok(refreshed);assert.equal($('#action').val(),'');
+// Exercise the real note-aware confirmation, including attached-link warning and target capture.
+w.eval(fs.readFileSync(path.join(process.env.CACTI_JS_DIR,'jquery-ui.js'),'utf8'));
+Object.assign(w,{Links:{attached:{a:'note1',b:'other'}},delNodePrompt:'Delete %s from this map?',delNodeConnected:'Connected links to remove: %s.',delNodeKeepDevice:'The Cacti device and graphs will remain.',delNodeTitle:'Delete Node',txtCancel:'Cancel',txtDelNode:'Delete Node',wmNodeDisplayName:()=> 'Core maintenance',form_submit:()=>{deleted=$('#param').val();}});
+Object.assign(w.wmEditorText,{noteDelete:'Delete note "%s"?',noteDeleteTitle:'Delete Note Confirmation',noteDeleteAction:'Delete Note'});
+w.eval(source.slice(source.indexOf('function delete_node()'),source.indexOf('function clone_node()')));
+$('#node_name').val('note1');w.delete_node();
+assert.equal($('.dlgConfirm').dialog('option','modal'),true);
+assert.equal($('.dlgConfirm').dialog('option','title'),'Delete Note Confirmation');
+assert.match($('.dlgConfirm').text(),/Delete note "Core maintenance"/);
+assert.match($('.dlgConfirm').text(),/Connected links to remove: 1/);
+assert.doesNotMatch($('.dlgConfirm').text(),/Cacti device/);
+$('#param').val('other_node');$('.dlgConfirm').dialog('option','buttons')[1].click.call($('.dlgConfirm')[0]);assert.equal(deleted,'note1');
 dom.window.close();console.log('PASS: note placement, defaults, edit, clone, move, guarded delete, save/error and refresh');
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index 2df2bb81..f101cd44 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -91,14 +91,15 @@ function note_assert($value, $message) {
 	$later->x = 500;
 	$later->y = 250;
 	$saved->nodes[$later->name] = $later;
-	$saved->seen_zlayers[600][] = $later;
+	$later->zorder = 700;
+	$saved->seen_zlayers[700][] = $later;
 	$saved->DrawMap($directory . '/later.png');
 	note_assert(getimagesize($directory . '/later.png')[0] === 1200, 'unrelated later node keeps note sharp');
 	$later->x = $node->x;
 	$later->y = $node->y;
 	$saved->DrawMap($directory . '/overlap.png');
 	note_assert(getimagesize($directory . '/overlap.png')[0] === 600, 'overlapping later node preserves stacking');
-	array_pop($saved->seen_zlayers[600]);
+	array_pop($saved->seen_zlayers[700]);
 	unset($saved->nodes[$later->name]);
 
 	$hashes = [];

From 22f266f1155db6c8e65ae4f6adca7bfd1663ccdb Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:09:58 +1030
Subject: [PATCH 06/35] Preserve note rendering, defaults and failed
 configuration writes

---
 js/editor.js                                  |  13 +-
 lib/WeatherMap.class.php                      |  26 +--
 lib/WeatherMap.config.php                     | 107 ++++++++++
 lib/WeatherMap.notes.php                      |   2 +-
 lib/WeatherMapNode.class.php                  |   2 +-
 lib/editor.actions.php                        |   4 +-
 lib/editor.comment-style.php                  |   2 +-
 locales/po/cacti.pot                          |   2 +-
 tests/Browser/EditorNotesTest.cjs             |  10 +-
 tests/Support/ConfigWriteAtomicRegression.php | 193 ++++++++++++++++++
 tests/Support/EditorNotesEngineRegression.php |  29 ++-
 tests/Unit/ConfigWriteAtomicTest.php          |  41 ++++
 12 files changed, 404 insertions(+), 27 deletions(-)
 create mode 100644 lib/WeatherMap.config.php
 create mode 100644 tests/Support/ConfigWriteAtomicRegression.php
 create mode 100644 tests/Unit/ConfigWriteAtomicTest.php

diff --git a/js/editor.js b/js/editor.js
index 940217e8..6cdb4e32 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -909,7 +909,9 @@ function form_submit() {
 		show_note('', $('#x').val(), $('#y').val());
 		return;
 	}
-	var savingNote = $('#action').val() === 'set_note_properties';
+	var noteAction = $('#action').val();
+	var noteTarget = noteAction === 'set_note_properties' ? $('#note_name').val() : noteAction === 'move_node' ? $('#node_name').val() : $('#param').val();
+	var savingNote = noteAction === 'set_note_properties' || (['move_node', 'delete_node'].indexOf(noteAction) !== -1 && typeof WMNotes !== 'undefined' && WMNotes[noteTarget]);
 	var data = $('input, select, textarea').serialize();
 
 	$.ajax({
@@ -917,7 +919,10 @@ function form_submit() {
 		url: editor_url,
 		data: data,
 		error: function() {
-			if (savingNote) $('#wm-note-error').text(wmEditorText.noteError).show();
+			if (savingNote) {
+				if (noteAction !== 'set_note_properties') show_note(noteTarget);
+				$('#wm-note-error').text(wmEditorText.noteError).show();
+			}
 		},
 		success: function(html) {
 			hide_all_dialogs();
@@ -1744,13 +1749,13 @@ function show_note(name, x, y) {
 		}
 		$('#note_font').val(style.font);
 	} else {
-		var defaultFont = $('#note_font option').filter(function() { return this.value === 'bundled:Vera.ttf:9' || $(this).text() === 'Vera Sans — 9 pt'; }).first();
+		var defaultFont = $('#note_font option').filter(function() { return this.value === 'bundled:Vera.ttf:9' || $(this).attr('data-wm-note-default') === '1'; }).first();
 		$('#note_font').val(defaultFont.length ? defaultFont.val() : '3');
 	}
 	$('#note_delete,#note_move,#note_clone').toggle(!!node);
 	$('#wm-note-error').hide();
 	$('#action').val('set_note_properties');
 	show_dialog('dlgNoteProperties');
-	$('#note_font,#note_align').selectmenu('refresh');
+	$('#note_font,#note_align').each(function() { if ($(this).data('ui-selectmenu')) $(this).selectmenu('refresh'); });
 	$('#note_text').trigger('focus');
 }
diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 7f79f838..71fc1d2f 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -3608,12 +3608,8 @@ function WriteDataFile($filename) {
 	 * @return bool
 	 */
 	function WriteConfig($filename) {
-		$fd = false;
-
-		if (is_writable(dirname($filename)) || (file_exists($filename) && is_writable($filename))) {
-			$fd = fopen($filename, 'w');
-			assert($fd !== false);
-		}
+		require_once __DIR__ . '/WeatherMap.config.php';
+		$fd = fopen('php://temp', 'w+b');
 
 		$output = '';
 
@@ -3633,7 +3629,7 @@ function WriteConfig($filename) {
 			};
 			$output .= "# Automatically generated by php-weathermap v$weathermap_version\n\n";
 
-			if (count($this->fonts) > 0) {
+			if (cacti_count($this->fonts) > 0) {
 				foreach ($this->fonts as $fontnumber => $font) {
 					if ($font->type == 'truetype') {
 						$output .= sprintf("FONTDEFINE %d %s %d\n", $fontnumber, $font->file, $font->size);
@@ -3848,10 +3844,11 @@ function WriteConfig($filename) {
 			}
 
 			$write("\n\n# That's All Folks!\n");
-			$flushed = @fflush($fd);
-			$closed = @fclose($fd);
+			rewind($fd);
+			$contents = stream_get_contents($fd);
+			$closed = fclose($fd);
 
-			return $write_ok && $flushed && $closed;
+			return $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents);
 		} else {
 			wm_warn("Couldn't open config file $filename for writing");
 
@@ -4052,7 +4049,10 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 						$baseImage = $image;
 						$image = imagecreatetruecolor($this->width, $this->height);
 						imagesavealpha($image, true);
+						imagealphablending($image, false);
 						imagefill($image, 0, 0, imagecolorallocatealpha($image, 0, 0, 0, 127));
+						imagealphablending($image, true);
+						$noteForeground = $image;
 					}
 					foreach ($this->colours as $scalename => $colours) {
 						wm_debug("Drawing KEY for $scalename if necessary.");
@@ -4090,11 +4090,6 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 					$this->DrawTitle($image, $this->titlefont, $this->colours['DEFAULT']['TITLE']['gdref1']);
 				}
 
-				if ($z == 1000 && $sharpNotes !== []) {
-					$noteForeground = $image;
-					$image = $baseImage;
-					imagecopy($image, $noteForeground, 0, 0, 0, 0, $this->width, $this->height);
-				}
 
 				if (is_array($z_items)) {
 					foreach ($z_items as $it) {
@@ -4182,6 +4177,7 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 
 			// Compose at logical coordinates; render note glyphs at display density.
 			if ($sharpNotes !== []) {
+				if ($noteForeground !== null) $image = $baseImage;
 				$this->image = $image;
 				$image = wm_note_display_image($this, $sharpNotes);
 				if ($noteForeground !== null) {
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
new file mode 100644
index 00000000..543d3240
--- /dev/null
+++ b/lib/WeatherMap.config.php
@@ -0,0 +1,107 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+namespace WeathermapConfig;
+
+/**
+ * Acquire the lock shared by configuration writers and image deletion.
+ *
+ * @return resource|false The exclusive lock handle, or false on failure.
+ */
+function acquire() {
+	$path = dirname(__DIR__) . '/configs/.weathermap-config.lock';
+	$handle = @fopen($path, 'c+b');
+	if (!$handle) $handle = @fopen($path, 'rb');
+	if ($handle && flock($handle, LOCK_EX)) return $handle;
+	if ($handle) fclose($handle);
+	return false;
+}
+
+/**
+ * Release a configuration lock.
+ *
+ * @param resource $handle The acquired lock.
+ *
+ * @return void
+ */
+function release($handle) {
+	flock($handle, LOCK_UN);
+	fclose($handle);
+}
+
+/**
+ * Write all bytes, including when the stream accepts only a partial chunk.
+ *
+ * @param resource $stream The writable stream.
+ * @param string $contents The bytes to write.
+ *
+ * @return bool Whether every byte was written.
+ */
+function writeAll($stream, $contents) {
+	$offset = 0;
+	$length = strlen($contents);
+	while ($offset < $length) {
+		$written = @fwrite($stream, substr($contents, $offset));
+		if ($written === false || $written === 0) return false;
+		$offset += $written;
+	}
+	return true;
+}
+
+/**
+ * Replace a configuration only after a complete, flushed and closed local write.
+ *
+ * @param string $filename The destination configuration path.
+ * @param string $contents The complete new configuration.
+ *
+ * @return bool Success; failures preserve the existing configuration.
+ */
+function atomicWrite($filename, $contents) {
+	if (strpos($filename, '://') !== false) return false;
+	if (is_link($filename)) $filename = realpath($filename);
+	if ($filename === false || !is_dir(dirname($filename)) || !is_writable(dirname($filename))) return false;
+	if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
+	$lock = acquire();
+	if (!$lock) return false;
+	$temp = false;
+	$stream = false;
+	try {
+		$temp = @tempnam(dirname($filename), '.wm-config-');
+		if ($temp === false) return false;
+		$stream = @fopen($temp, 'wb');
+		if (!$stream) return false;
+		$complete = writeAll($stream, $contents) && fflush($stream);
+		$closed = fclose($stream);
+		$stream = false;
+		if (!$complete || !$closed) return false;
+		$mode = file_exists($filename) ? fileperms($filename) & 0777 : 0666 & ~umask();
+		if (PHP_OS_FAMILY !== 'Windows' && file_exists($filename) && !chgrp($temp, filegroup($filename))) return false;
+		if (!chmod($temp, $mode)) return false;
+		return @rename($temp, $filename);
+	} finally {
+		if (is_resource($stream)) fclose($stream);
+		if ($temp !== false && file_exists($temp)) unlink($temp);
+		release($lock);
+	}
+}
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index acec0c53..572966f7 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -82,7 +82,7 @@ function wm_note_display_image($map, $notes) {
 		$colour = imagecolorallocate($image, ...$node->labelfontcolour);
 		$originX = (int)($node->x - $node->centre_x);
 		$originY = (int)($node->y - $node->centre_y);
-		$lineY = $node->centre_y - count($lines) * $height / 2 + $height;
+		$lineY = $node->centre_y - cacti_count($lines) * $height / 2 + $height;
 		foreach ($lines as $line) {
 			[$lineWidth] = $map->myimagestringsize($node->labelfont, $line);
 			$align = $node->get_hint('editor_note_align', 'left');
diff --git a/lib/WeatherMapNode.class.php b/lib/WeatherMapNode.class.php
index 7526245c..75fa240a 100644
--- a/lib/WeatherMapNode.class.php
+++ b/lib/WeatherMapNode.class.php
@@ -368,7 +368,7 @@ function pre_render($image, &$map) {
 				}
 				[, $noteLineHeight] = $map->myimagestringsize($this->labelfont, 'Ag');
 				$noteLineHeight = max(1, ceil($noteLineHeight));
-				$strheight = count($noteLines) * $noteLineHeight;
+				$strheight = cacti_count($noteLines) * $noteLineHeight;
 			}
 
 			if ($this->labelangle == 90 || $this->labelangle == 270) {
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 277d8568..e897f0c0 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -789,7 +789,7 @@ function moveNode($mapfile, $grid_snap_value) {
 		$map->nodes[$node_name]->x = $x;
 		$map->nodes[$node_name]->y = $y;
 
-		$map->WriteConfig($mapfile);
+		if (!$map->WriteConfig($mapfile)) http_response_code(500);
 	}
 }
 
@@ -981,7 +981,7 @@ function deleteNode($mapfile) {
 
 		unset($map->nodes[$target]);
 
-		$map->WriteConfig($mapfile);
+		if (!$map->WriteConfig($mapfile)) http_response_code(500);
 	}
 }
 
diff --git a/lib/editor.comment-style.php b/lib/editor.comment-style.php
index 10fe830a..702c963e 100644
--- a/lib/editor.comment-style.php
+++ b/lib/editor.comment-style.php
@@ -117,7 +117,7 @@ function wm_style_font_options($map, $current) {
 		foreach ($bundled as $key => $choice) {
 			$value    = $matches[$key] ?? $choice['value'];
 			$selected = isset($matches[$key]) && $current == $matches[$key];
-			$out .= '<option value="' . html_escape((string)$value) . '"' . ($selected ? ' selected' : '') . '>' . html_escape($choice['label']) . '</option>';
+			$out .= '<option value="' . html_escape((string)$value) . '"' . ($selected ? ' selected' : '') . ($choice['value'] === 'bundled:Vera.ttf:9' ? ' data-wm-note-default="1"' : '') . '>' . html_escape($choice['label']) . '</option>';
 		}
 		$out .= '</optgroup>';
 	}
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 7736beda..01709de5 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 09:02+1030\n"
+"POT-Creation-Date: 2026-10-12 11:05+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
diff --git a/tests/Browser/EditorNotesTest.cjs b/tests/Browser/EditorNotesTest.cjs
index 1f6151dc..83ddacb2 100644
--- a/tests/Browser/EditorNotesTest.cjs
+++ b/tests/Browser/EditorNotesTest.cjs
@@ -9,7 +9,8 @@ const dom=new JSDOM('<body>'+fields.map(id=>id==='note_text'?`<textarea id="${id
 const w=dom.window,$=jquery(w);w.$=w.jQuery=$;
 let mode,shown,moved,deleted,request;
 Object.assign(w,{Nodes:{note1:{label:'Core\\nMaintenance',x:50,y:60}},WMNotes:{note1:{align:'centre',font:'bundled:Vera.ttf:9',colour:'#cc0000'}},wmEditorText:{advanced:'Advanced',hideAdvanced:'Hide',addNoteHelp:'Place a note',noteError:'Save failed'},editor_url:'/editor',hide_all_dialogs:()=>$('#action').val(''),mapmode:m=>mode=m,show_dialog:id=>shown=id,hide_dialog:()=>{},move_node:()=>moved=$('#node_name').val(),delete_node:()=>deleted=$('#node_name').val()});
-$.fn.selectmenu=function(){return this;};
+$.fn.selectmenu=function(command){if(command==='refresh' && this.hasClass('select2-hidden-accessible'))throw Error('uninitialized selectmenu');return this;};
+$('#note_align').addClass('select2-hidden-accessible');
 const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');
 w.eval(source.slice(source.indexOf('// Notes are ordinary'),source.length));
 w.eval(source.slice(source.indexOf('function form_submit('),source.indexOf('function map_properties(')));
@@ -17,6 +18,8 @@ w.eval(source.slice(source.indexOf("\t$('#tb_addnote')"),source.indexOf("\t$('#t
 $('#tb_addnote').trigger('click');assert.equal($('#action').val(),'place_note');assert.equal(mode,'xy');
 $('#x').val('100');$('#y').val('120');w.form_submit();
 assert.equal(shown,'dlgNoteProperties');assert.equal($('#note_font').val(),'bundled:Vera.ttf:9');assert.equal($('#note_colour').val(),'#000000');assert.equal($('#note_align').val(),'left');assert.equal($('#note_x').val(),'100');
+$('#note_font').empty().append('<option value="10" data-wm-note-default="1">Translated Vera label (font 10)</option><option value="3">Builtin</option>');
+w.show_note('',10,20);assert.equal($('#note_font').val(),'10');
 w.show_note('note1');assert.equal($('#note_text').val(),'Core\nMaintenance');assert.equal($('#note_align').val(),'centre');
 $('#note_x,#note_y').attr('max',600);$('#note_clone').trigger('click');assert.equal($('#note_name').val(),'');assert.equal($('#note_x').val(),'70');
 w.show_note('note1');$('#note_move').trigger('click');assert.equal(moved,'note1');
@@ -24,6 +27,11 @@ w.show_note('note1');$('#note_delete').trigger('click');assert.equal(deleted,'no
 $.ajax=opts=>request=opts;w.show_note('note1');w.form_submit();
 assert.equal(request.type,'POST');assert.match(request.data,/action=set_note_properties/);assert.match(request.data,/note_name=note1/);
 request.error();assert.equal($('#wm-note-error').text(),'Save failed');assert.notEqual($('#wm-note-error').css('display'),'none');assert.equal($('#note_name').val(),'note1');
+for(const action of ['move_node','delete_node']) {
+ w.show_note('note1');$('#node_name,#param').val('note1');$('#action').val(action);w.form_submit();request.error();
+ assert.equal(shown,'dlgNoteProperties');assert.equal($('#note_name').val(),'note1');assert.equal($('#wm-note-error').text(),'Save failed');
+}
+w.show_note('note1');w.form_submit();
 let refreshed=false;$.get=(url,cb)=>{assert.match(url,/load_area_data/);cb('');};$.getScript=(url,cb)=>{assert.match(url,/load_map_javascript/);cb('');};w.initJS=()=>refreshed=true;
 request.success('');assert.ok(refreshed);assert.equal($('#action').val(),'');
 // Exercise the real note-aware confirmation, including attached-link warning and target capture.
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
new file mode 100644
index 00000000..91c3a38b
--- /dev/null
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -0,0 +1,193 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+namespace WeathermapConfig {
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param string $path
+	 * @param string $mode
+	 * @return resource|false
+	 */
+	function fopen($path, $mode) {
+		$fault = $GLOBALS['config_fault'] ?? '';
+		if (($fault === 'lock-open' && str_ends_with($path, '.lock')) || ($fault === 'lock-read' && $mode === 'c+b') || ($fault === 'temp-open' && $mode === 'wb')) return false;
+		return \fopen($path, $mode);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param resource $stream
+	 * @param int $mode
+	 * @return bool
+	 */
+	function flock($stream, $mode) {
+		if (($GLOBALS['config_fault'] ?? '') === 'lock' && $mode === LOCK_EX) return false;
+		return \flock($stream, $mode);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param string $dir
+	 * @param string $prefix
+	 * @return string|false
+	 */
+	function tempnam($dir, $prefix) {
+		return ($GLOBALS['config_fault'] ?? '') === 'temp-name' ? false : \tempnam($dir, $prefix);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param resource $stream
+	 * @param string $bytes
+	 * @return int|false
+	 */
+	function fwrite($stream, $bytes) {
+		$fault = $GLOBALS['config_fault'] ?? '';
+		if ($fault === 'write-false') return false;
+		if ($fault === 'write-zero') return 0;
+		return \fwrite($stream, $fault === 'short-write' ? substr($bytes, 0, 2) : $bytes);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param resource $stream
+	 * @return bool
+	 */
+	function fflush($stream) {
+		return ($GLOBALS['config_fault'] ?? '') !== 'flush' && \fflush($stream);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param resource $stream
+	 * @return bool
+	 */
+	function fclose($stream) {
+		$temp = strpos(stream_get_meta_data($stream)['uri'], '.wm-config-') !== false;
+		$closed = \fclose($stream);
+		return !(($GLOBALS['config_fault'] ?? '') === 'close' && $temp) && $closed;
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param string $path
+	 * @param int $group
+	 * @return bool
+	 */
+	function chgrp($path, $group) {
+		return ($GLOBALS['config_fault'] ?? '') !== 'group' && \chgrp($path, $group);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param string $path
+	 * @param int $mode
+	 * @return bool
+	 */
+	function chmod($path, $mode) {
+		return ($GLOBALS['config_fault'] ?? '') !== 'mode' && \chmod($path, $mode);
+	}
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param string $source
+	 * @param string $target
+	 * @return bool
+	 */
+	function rename($source, $target) {
+		return ($GLOBALS['config_fault'] ?? '') !== 'rename' && \rename($source, $target);
+	}
+}
+namespace {
+	require dirname(__DIR__) . '/bootstrap-unit.php';
+	chdir(dirname(__DIR__, 2));
+	require dirname(__DIR__, 2) . '/setup.php';
+	require dirname(__DIR__, 2) . '/lib/WeatherMap.class.php';
+	require dirname(__DIR__, 2) . '/lib/WeatherMap.config.php';
+	require dirname(__DIR__, 2) . '/lib/editor.inc.php';
+	require dirname(__DIR__, 2) . '/lib/editor.actions.php';
+	/**
+	 * Simulate filesystem faults for an isolated atomic-write regression.
+	 *
+	 * @param bool $condition
+	 * @param string $message
+	 * @return void
+	 */
+	function atomic_assert($condition, $message) {
+		if (!$condition) throw new \RuntimeException($message);
+	}
+	$dir = sys_get_temp_dir() . '/wm-atomic-' . bin2hex(random_bytes(5));
+	mkdir($dir);
+	$file = $dir . '/map.conf';
+	$original = "WIDTH 600\nHEIGHT 300\nNODE note1\n LABEL Original\n POSITION 50 50\n SET editor_note 1\n";
+	file_put_contents($file, $original);
+	try {
+		foreach (['lock-open', 'lock', 'temp-name', 'temp-open', 'write-false', 'write-zero', 'flush', 'close', 'group', 'mode', 'rename'] as $fault) {
+			$GLOBALS['config_fault'] = $fault;
+			atomic_assert(\WeathermapConfig\atomicWrite($file, 'Replacement') === false, 'failure propagated: ' . $fault);
+			atomic_assert(file_get_contents($file) === $original, 'original retained: ' . $fault);
+			atomic_assert(glob($dir . '/.wm-config-*') === [], 'temporary removed: ' . $fault);
+		}
+		$GLOBALS['config_fault'] = 'short-write';
+		atomic_assert(\WeathermapConfig\atomicWrite($file, 'Complete replacement'), 'short writes completed');
+		atomic_assert(file_get_contents($file) === 'Complete replacement', 'complete bytes retained');
+		$GLOBALS['config_fault'] = 'lock-read';
+		atomic_assert(\WeathermapConfig\atomicWrite($file, $original), 'readable lock supports another writer account');
+		$GLOBALS['config_fault'] = '';
+		atomic_assert(!\WeathermapConfig\atomicWrite('notewritefail://map/config', 'Replacement'), 'unsupported stream rejected');
+		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/missing/map.conf', 'Replacement'), 'missing directory rejected');
+		atomic_assert(!\WeathermapConfig\atomicWrite($dir, 'Replacement'), 'directory target rejected');
+		$link = $dir . '/link.conf'; symlink($file, $link);
+		atomic_assert(\WeathermapConfig\atomicWrite($link, $original), 'configuration symlink target preserved');
+		atomic_assert(is_link($link), 'link itself retained'); unlink($link);
+		if (function_exists('pcntl_fork')) {
+			$lock = \WeathermapConfig\acquire();
+			$child = pcntl_fork();
+			if ($child === 0) {
+				$probe = \fopen(dirname(__DIR__, 2) . '/configs/.weathermap-config.lock', 'rb');
+				$blocked = !\flock($probe, LOCK_EX | LOCK_NB); \fclose($probe);
+				exit($blocked ? 0 : 1);
+			}
+			pcntl_waitpid($child, $status); \WeathermapConfig\release($lock);
+			atomic_assert(pcntl_wexitstatus($status) === 0, 'shared lock excludes concurrent configuration writers');
+		}
+		$GLOBALS['config_fault'] = 'rename';
+		$map = new \WeatherMap; $map->ReadConfig($file); $map->title = 'Changed';
+		atomic_assert(!$map->WriteConfig($file) && file_get_contents($file) === $original, 'engine failure preserves original');
+		$GLOBALS['__test_nfilter_request'] = ['node_name' => 'note1', 'param' => 'note1', 'x' => '70', 'y' => '80'];
+		if (function_exists('wm_editor_save_note')) {
+			http_response_code(200); moveNode($file, 0);
+			atomic_assert(http_response_code() === 500 && file_get_contents($file) === $original, 'failed move surfaces error without changing file');
+			http_response_code(200); deleteNode($file);
+			atomic_assert(http_response_code() === 500 && file_get_contents($file) === $original, 'failed delete surfaces error without changing file');
+		}
+		echo "Atomic configuration write and locking regression PASS\n";
+	} finally {
+		$GLOBALS['config_fault'] = '';
+		foreach (glob($dir . '/*') as $path) unlink($path);
+		foreach (glob($dir . '/.wm-config-*') as $path) unlink($path);
+		rmdir($dir);
+	}
+}
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index f101cd44..feb53e73 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -102,6 +102,33 @@ function note_assert($value, $message) {
 	array_pop($saved->seen_zlayers[700]);
 	unset($saved->nodes[$later->name]);
 
+	// Furniture is composed once, and a node above it must retain its z-order.
+	$previousTitle = $saved->title;
+	$saved->title = 'MMMMMMMMMMMMMMMM'; $saved->titlex = 450; $saved->titley = 225;
+	$saved->titlefont = $node->labelfont;
+	$node->add_hint('editor_note', '0'); $saved->DrawMap($directory . '/furniture-reference.png');
+	$node->add_hint('editor_note', '1'); $saved->DrawMap($directory . '/furniture-sharp.png');
+	$reference = imagecreatefrompng($directory . '/furniture-reference.png');
+	$expected = imagecreatetruecolor(1200, 600); imagecopyresampled($expected, $reference, 0, 0, 0, 0, 1200, 600, 600, 300);
+	$actual = imagecreatefrompng($directory . '/furniture-sharp.png');
+	$maxDifference = 0;
+	for ($x = 900; $x < 1180; $x++) for ($y = 405; $y < 455; $y++) {
+		$left = imagecolorat($expected, $x, $y); $right = imagecolorat($actual, $x, $y);
+		foreach ([0,8,16] as $shift) $maxDifference = max($maxDifference, abs((($left >> $shift) & 255) - (($right >> $shift) & 255)));
+	}
+	note_assert($maxDifference <= 2, 'furniture antialiasing is not composited twice');
+	imagedestroy($reference); imagedestroy($expected); imagedestroy($actual);
+	$foreground = clone $node; $foreground->name = 'foreground'; $foreground->label = 'Foreground';
+	$foreground->x = 500; $foreground->y = 225; $foreground->zorder = 1001; $foreground->add_hint('editor_note', '0');
+	$foreground->labelfont = 5; $foreground->labelfontcolour = [255,0,0]; $foreground->labelbgcolour = [255,0,0]; $foreground->labeloutlinecolour = [255,0,0];
+	$saved->nodes['foreground'] = $foreground; $saved->seen_zlayers[1001][] = $foreground;
+	$saved->DrawMap($directory . '/foreground.png'); $actual = imagecreatefrompng($directory . '/foreground.png');
+	for ($x = 990; $x <= 1010; $x++) for ($y = 442; $y <= 450; $y++) note_assert((imagecolorat($actual, $x, $y) & 0xffffff) === 0xff0000, 'higher node stays above title furniture');
+	imagedestroy($actual); unset($saved->nodes['foreground'], $saved->seen_zlayers[1001]); $saved->title = $previousTitle;
+	wm_comment_resolve_font($saved, 'bundled:Vera.ttf:9');
+	$fontOptions = wm_style_font_options($saved, 3);
+	note_assert(preg_match('/<option value="[0-9]+" data-wm-note-default="1"/', $fontOptions) === 1, 'registered Vera 9 exposes a stable default marker');
+
 	$hashes = [];
 	foreach (['left', 'centre', 'right'] as $alignment) {
 		$aligned = $values;
@@ -116,7 +143,7 @@ function note_assert($value, $message) {
 		$rendered->DrawMap($png);
 		$hashes[] = hash_file('sha256', $png);
 	}
-	note_assert(count(array_unique($hashes)) === 3, 'alignments change rendered pixels');
+	note_assert(cacti_count(array_unique($hashes)) === 3, 'alignments change rendered pixels');
 	$values['name'] = $name;
 	$values['text'] = 'Edited note';
 	$values['colour'] = '#c00000';
diff --git a/tests/Unit/ConfigWriteAtomicTest.php b/tests/Unit/ConfigWriteAtomicTest.php
new file mode 100644
index 00000000..48736556
--- /dev/null
+++ b/tests/Unit/ConfigWriteAtomicTest.php
@@ -0,0 +1,41 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\TestCase;
+
+final class ConfigWriteAtomicTest extends TestCase {
+	#[RunInSeparateProcess]
+	#[PreserveGlobalState(false)]
+	public function testRealEngineRegression(): void {
+		ob_start();
+		try {
+			require dirname(__DIR__) . '/Support/ConfigWriteAtomicRegression.php';
+			$result = ob_get_contents();
+		} finally {
+			ob_end_clean();
+		}
+		self::assertSame("Atomic configuration write and locking regression PASS\n", $result);
+	}
+}

From b56c171fec7aac5770f3abf825b392e58333b8ec Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:12:16 +1030
Subject: [PATCH 07/35] Verify atomic saves preserve template and traffic
 objects

---
 tests/Support/ConfigWriteAtomicRegression.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 91c3a38b..056c2c09 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -173,6 +173,12 @@ function atomic_assert($condition, $message) {
 			pcntl_waitpid($child, $status); \WeathermapConfig\release($lock);
 			atomic_assert(pcntl_wexitstatus($status) === 0, 'shared lock excludes concurrent configuration writers');
 		}
+		$templateFile = $dir . '/templates.conf';
+		file_put_contents($templateFile, "NODE templateNode\n LABEL Template\nNODE A\n POSITION 10 10\nNODE B\n POSITION 50 50\nLINK templateLink\n WIDTH 8\nLINK trafficLink\n NODES A B\n");
+		$templateMap = new \WeatherMap; $templateMap->ReadConfig($templateFile);
+		atomic_assert($templateMap->WriteConfig($templateFile), 'atomic save supports templates and traffic links');
+		$reloaded = new \WeatherMap; $reloaded->ReadConfig($templateFile);
+		atomic_assert(isset($reloaded->nodes['templateNode'], $reloaded->links['templateLink'], $reloaded->links['trafficLink']), 'template and real objects survive atomic roundtrip');
 		$GLOBALS['config_fault'] = 'rename';
 		$map = new \WeatherMap; $map->ReadConfig($file); $map->title = 'Changed';
 		atomic_assert(!$map->WriteConfig($file) && file_get_contents($file) === $original, 'engine failure preserves original');

From 2c9f1d63109e280759e5308913db86e6b86768ac Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:21:32 +1030
Subject: [PATCH 08/35] Keep atomic-save regression checks portable across
 platforms

---
 tests/Support/ConfigWriteAtomicRegression.php | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 056c2c09..6090fa12 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -144,7 +144,7 @@ function atomic_assert($condition, $message) {
 	$original = "WIDTH 600\nHEIGHT 300\nNODE note1\n LABEL Original\n POSITION 50 50\n SET editor_note 1\n";
 	file_put_contents($file, $original);
 	try {
-		foreach (['lock-open', 'lock', 'temp-name', 'temp-open', 'write-false', 'write-zero', 'flush', 'close', 'group', 'mode', 'rename'] as $fault) {
+		foreach (array_filter(['lock-open', 'lock', 'temp-name', 'temp-open', 'write-false', 'write-zero', 'flush', 'close', 'group', 'mode', 'rename'], function($fault) { return PHP_OS_FAMILY !== 'Windows' || $fault !== 'group'; }) as $fault) {
 			$GLOBALS['config_fault'] = $fault;
 			atomic_assert(\WeathermapConfig\atomicWrite($file, 'Replacement') === false, 'failure propagated: ' . $fault);
 			atomic_assert(file_get_contents($file) === $original, 'original retained: ' . $fault);
@@ -153,15 +153,17 @@ function atomic_assert($condition, $message) {
 		$GLOBALS['config_fault'] = 'short-write';
 		atomic_assert(\WeathermapConfig\atomicWrite($file, 'Complete replacement'), 'short writes completed');
 		atomic_assert(file_get_contents($file) === 'Complete replacement', 'complete bytes retained');
-		$GLOBALS['config_fault'] = 'lock-read';
+		$GLOBALS['config_fault'] = PHP_OS_FAMILY === 'Windows' ? '' : 'lock-read';
 		atomic_assert(\WeathermapConfig\atomicWrite($file, $original), 'readable lock supports another writer account');
 		$GLOBALS['config_fault'] = '';
 		atomic_assert(!\WeathermapConfig\atomicWrite('notewritefail://map/config', 'Replacement'), 'unsupported stream rejected');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/missing/map.conf', 'Replacement'), 'missing directory rejected');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir, 'Replacement'), 'directory target rejected');
-		$link = $dir . '/link.conf'; symlink($file, $link);
-		atomic_assert(\WeathermapConfig\atomicWrite($link, $original), 'configuration symlink target preserved');
-		atomic_assert(is_link($link), 'link itself retained'); unlink($link);
+		$link = $dir . '/link.conf';
+		if (@symlink($file, $link)) {
+			atomic_assert(\WeathermapConfig\atomicWrite($link, $original), 'configuration symlink target preserved');
+			atomic_assert(is_link($link), 'link itself retained'); unlink($link);
+		}
 		if (function_exists('pcntl_fork')) {
 			$lock = \WeathermapConfig\acquire();
 			$child = pcntl_fork();

From 9a63dea21c44cdb70ee26bc23bbfe4dc81ef0b7c Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:40:28 +1030
Subject: [PATCH 09/35] Fall back safely when a note font is unavailable

---
 lib/editor.notes.php                          | 5 +++--
 tests/Support/EditorNotesEngineRegression.php | 7 +++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index 5bcbd530..1be57318 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -109,9 +109,10 @@ function wm_editor_note_data($map) {
 		if ($node->get_hint('editor_note', '0') !== '1' || $name === 'DEFAULT') {
 			continue;
 		}
-		$font = $map->fonts[$node->labelfont];
+		$fontId = isset($map->fonts[$node->labelfont]) ? $node->labelfont : 3;
+		$font = $map->fonts[$fontId];
 		$rgb = $node->labelfontcolour;
-		$notes[$name] = ['align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$node->labelfont, 'fontLabel' => wm_editor_font_label($node->labelfont, $font),
+		$notes[$name] = ['align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$fontId, 'fontLabel' => wm_editor_font_label($fontId, $font),
 			'colour' => sprintf('#%02x%02x%02x', max(0, $rgb[0]), max(0, $rgb[1]), max(0, $rgb[2]))];
 	}
 	return $notes;
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index feb53e73..50c5b4e8 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -44,6 +44,13 @@ function note_assert($value, $message) {
 	$values = ['name' => '', 'text' => "Main site\n10.0.0.0/24", 'font' => 'bundled:Vera.ttf:11', 'colour' => '#0000ff', 'x' => '155', 'y' => '80'];
 	note_assert(wm_editor_save_note($map, $values), 'create');
 	$name = array_keys(wm_editor_note_data($map))[0];
+	$validFont = $map->nodes[$name]->labelfont;
+	$map->nodes[$name]->labelfont = 999999;
+	set_error_handler(function($severity, $message) { throw new RuntimeException($message); });
+	try {
+		note_assert(wm_editor_note_data($map)[$name]['font'] === '3', 'missing note font falls back to a built-in');
+	} finally { restore_error_handler(); }
+	$map->nodes[$name]->labelfont = $validFont;
 	note_assert(in_array($map->nodes[$name], $map->seen_zlayers[$map->nodes[$name]->zorder], true), 'new note indexed immediately');
 	$map->DrawMap($directory . '/immediate.png');
 	note_assert(getimagesize($directory . '/immediate.png')[0] === 1200, 'new note renders sharply without rereading');

From 2978a41055aec6f3816ca54f827c4d7bece8e9be Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 12:23:08 +1030
Subject: [PATCH 10/35] Coordinate configuration writes, deletion and
 registration by directory

---
 lib/WeatherMap.class.php                      |  2 +-
 lib/WeatherMap.config.php                     | 22 +++++--
 lib/editor.config-delete.php                  | 65 ++++++++++---------
 lib/poller-common.php                         |  5 +-
 .../BackgroundSizingEngineRegression.php      |  4 +-
 tests/Support/ConfigWriteAtomicRegression.php | 61 ++++++++++++++++-
 tests/Support/EditorNotesEngineRegression.php |  1 +
 tests/Support/GalleryPreviewRender.php        |  1 +
 .../Support/NewMapPresetEngineRegression.php  |  4 +-
 tests/Support/NewMapTitleEngineRegression.php |  4 +-
 .../Support/SavedPresetFallbackRegression.php |  1 +
 tests/Unit/ConfigFileDeleteTest.php           |  8 ++-
 tests/Unit/ConfigRegistrationLockTest.php     |  1 +
 tests/Unit/WeathermapUpgradeTest.php          |  5 ++
 tests/bootstrap-unit.php                      |  9 +--
 weathermap-cacti-plugin-mgmt.php              | 64 ++++++++++--------
 16 files changed, 179 insertions(+), 78 deletions(-)

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 71fc1d2f..f1e7d598 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -3848,7 +3848,7 @@ function WriteConfig($filename) {
 			$contents = stream_get_contents($fd);
 			$closed = fclose($fd);
 
-			return $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents);
+			return $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $this->configfile !== '' && $filename === $this->configfile);
 		} else {
 			wm_warn("Couldn't open config file $filename for writing");
 
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 543d3240..7d104001 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -25,15 +25,20 @@
 namespace WeathermapConfig;
 
 /**
- * Acquire the lock shared by configuration writers and image deletion.
+ * Acquire a persistent directory lock shared by config writers and deletion.
+ *
+ * @param string|null $directory Destination directory; null selects plugin configs.
+ * @param bool $blocking Wait for the lock, or return false when it is busy.
  *
  * @return resource|false The exclusive lock handle, or false on failure.
  */
-function acquire() {
-	$path = dirname(__DIR__) . '/configs/.weathermap-config.lock';
+function acquire($directory = null, $blocking = true) {
+	$directory = realpath($directory ?? dirname(__DIR__) . '/configs');
+	if ($directory === false) return false;
+	$path = $directory . '/.weathermap-config.lock';
 	$handle = @fopen($path, 'c+b');
 	if (!$handle) $handle = @fopen($path, 'rb');
-	if ($handle && flock($handle, LOCK_EX)) return $handle;
+	if ($handle && flock($handle, LOCK_EX | ($blocking ? 0 : LOCK_NB))) return $handle;
 	if ($handle) fclose($handle);
 	return false;
 }
@@ -74,19 +79,24 @@ function writeAll($stream, $contents) {
  *
  * @param string $filename The destination configuration path.
  * @param string $contents The complete new configuration.
+ * @param bool $mustExist Refuse to recreate an existing map deleted during editing.
  *
  * @return bool Success; failures preserve the existing configuration.
  */
-function atomicWrite($filename, $contents) {
+function atomicWrite($filename, $contents, $mustExist = false) {
 	if (strpos($filename, '://') !== false) return false;
 	if (is_link($filename)) $filename = realpath($filename);
 	if ($filename === false || !is_dir(dirname($filename)) || !is_writable(dirname($filename))) return false;
 	if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
-	$lock = acquire();
+	$mustExist = $mustExist || file_exists($filename);
+	$lock = acquire(dirname($filename));
 	if (!$lock) return false;
 	$temp = false;
 	$stream = false;
 	try {
+		clearstatcache(true, $filename);
+		if ($mustExist && !is_file($filename)) return false;
+		if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
 		$temp = @tempnam(dirname($filename), '.wm-config-');
 		if ($temp === false) return false;
 		$stream = @fopen($temp, 'wb');
diff --git a/lib/editor.config-delete.php b/lib/editor.config-delete.php
index b438f7e1..9b3b529a 100644
--- a/lib/editor.config-delete.php
+++ b/lib/editor.config-delete.php
@@ -90,45 +90,52 @@ function wm_config_delete($directory, $file) {
 		strpos($file, chr(92)) !== false || preg_match('/[\x00-\x1f\x7f]/', $file) || substr($file, -5) !== '.conf' || !$directory) {
 		return 'invalid';
 	}
-	$path     = $directory . '/' . $file;
-	$resolved = realpath($path);
-
-	if (is_link($path) || !is_file($path) || $resolved === false || dirname($resolved) !== $directory) {
-		return 'invalid';
-	}
-
-	$lock = wm_config_lock($path);
-	if ($lock === false) {
-		return 'failed';
-	}
+	require_once __DIR__ . '/WeatherMap.config.php';
+	$directory_lock = \WeathermapConfig\acquire($directory);
+	if (!$directory_lock) return 'failed';
 	try {
-		$usage = db_fetch_cell_prepared('SELECT COUNT(*) FROM weathermap_maps WHERE configfile IN (?, ?)', [$file, $path]);
-
-		if ($usage === false || $usage === null) {
-			return 'failed';
-		}
+		$path     = $directory . '/' . $file;
+		$resolved = realpath($path);
 
-		if ($usage) {
-			return 'used';
+		if (is_link($path) || !is_file($path) || $resolved === false || dirname($resolved) !== $directory) {
+			return 'invalid';
 		}
 
-		// Existing registrations may use ./, absolute paths or other aliases.
-		$maps = db_fetch_assoc_prepared('SELECT configfile FROM weathermap_maps', []);
-		if (!is_array($maps)) {
+		$lock = wm_config_lock($path);
+		if ($lock === false) {
 			return 'failed';
 		}
-		foreach ($maps as $map) {
-			$registered = $map['configfile'];
-			$registered_path = realpath(wm_config_registered_path($directory, $registered));
-			if ($registered_path === $resolved) {
+		try {
+			$usage = db_fetch_cell_prepared('SELECT COUNT(*) FROM weathermap_maps WHERE configfile IN (?, ?)', [$file, $path]);
+
+			if ($usage === false || $usage === null) {
+				return 'failed';
+			}
+
+			if ($usage) {
 				return 'used';
 			}
-		}
 
-		return @unlink($path) ? 'deleted' : 'failed';
+			// Existing registrations may use ./, absolute paths or other aliases.
+			$maps = db_fetch_assoc_prepared('SELECT configfile FROM weathermap_maps', []);
+			if (!is_array($maps)) {
+				return 'failed';
+			}
+			foreach ($maps as $map) {
+				$registered = $map['configfile'];
+				$registered_path = realpath(wm_config_registered_path($directory, $registered));
+				if ($registered_path === $resolved) {
+					return 'used';
+				}
+			}
+
+			return @unlink($path) ? 'deleted' : 'failed';
+		} finally {
+			flock($lock, LOCK_UN);
+			fclose($lock);
+		}
 	} finally {
-		flock($lock, LOCK_UN);
-		fclose($lock);
+		\WeathermapConfig\release($directory_lock);
 	}
 }
 /**
diff --git a/lib/poller-common.php b/lib/poller-common.php
index f5f75103..ca63f097 100644
--- a/lib/poller-common.php
+++ b/lib/poller-common.php
@@ -271,7 +271,10 @@ function weathermap_repair_maps() {
 
 			if ($changes) {
 				wm_debug('Writing updated file to: ' . $configfile);
-				file_put_contents($configfile, implode("\n", $outcontents), LOCK_EX);
+				require_once __DIR__ . '/WeatherMap.config.php';
+				if (!\WeathermapConfig\atomicWrite($configfile, implode("\n", $outcontents), true)) {
+					wm_warn('Unable to save repaired configuration: ' . $configfile . ' [WMPOLL13]');
+				}
 			} else {
 				wm_debug('File has correct BACKGROUND and ICON paths: ' . $configfile);
 			}
diff --git a/tests/Support/BackgroundSizingEngineRegression.php b/tests/Support/BackgroundSizingEngineRegression.php
index 98ad1a20..00b8457b 100644
--- a/tests/Support/BackgroundSizingEngineRegression.php
+++ b/tests/Support/BackgroundSizingEngineRegression.php
@@ -100,5 +100,7 @@ public function run($map) {
 } finally {
 	foreach (glob($directory . '/*') as $file) {
 		unlink($file);
-	}rmdir($directory);
+	}
+	if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
+	rmdir($directory);
 }
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 6090fa12..75b7989b 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -121,6 +121,7 @@ function rename($source, $target) {
 	}
 }
 namespace {
+	require dirname(__DIR__, 2) . '/lib/poller-common.php';
 	require dirname(__DIR__) . '/bootstrap-unit.php';
 	chdir(dirname(__DIR__, 2));
 	require dirname(__DIR__, 2) . '/setup.php';
@@ -165,22 +166,77 @@ function atomic_assert($condition, $message) {
 			atomic_assert(is_link($link), 'link itself retained'); unlink($link);
 		}
 		if (function_exists('pcntl_fork')) {
-			$lock = \WeathermapConfig\acquire();
+			$lock = \WeathermapConfig\acquire($dir);
 			$child = pcntl_fork();
 			if ($child === 0) {
-				$probe = \fopen(dirname(__DIR__, 2) . '/configs/.weathermap-config.lock', 'rb');
+				$probe = \fopen($dir . '/.weathermap-config.lock', 'rb');
 				$blocked = !\flock($probe, LOCK_EX | LOCK_NB); \fclose($probe);
 				exit($blocked ? 0 : 1);
 			}
 			pcntl_waitpid($child, $status); \WeathermapConfig\release($lock);
 			atomic_assert(pcntl_wexitstatus($status) === 0, 'shared lock excludes concurrent configuration writers');
 		}
+		// Deletion waits for the same stable directory mutex used by atomic replacement.
+		if (function_exists('pcntl_fork')) {
+			require_once dirname(__DIR__, 2) . '/lib/editor.config-delete.php';
+			$GLOBALS['__test_db_fetch_cell_prepared'] = fn () => 0;
+			$GLOBALS['__test_db_fetch_assoc_prepared'] = fn () => [];
+			$lock = \WeathermapConfig\acquire($dir);
+			$ready = $dir . '/ready'; $done = $dir . '/done';
+			$child = pcntl_fork();
+			if ($child === 0) {
+				\fclose($lock);
+				file_put_contents($ready, 'ready');
+				$result = wm_config_delete($dir, 'map.conf');
+				file_put_contents($done, $result);
+				exit($result === 'deleted' ? 0 : 1);
+			}
+			for ($wait = 0; $wait < 100 && !is_file($ready); $wait++) usleep(10000);
+			usleep(50000);
+			$blocked = !is_file($done) && is_file($file);
+			\WeathermapConfig\release($lock);
+			pcntl_waitpid($child, $status);
+			atomic_assert($blocked && pcntl_wexitstatus($status) === 0, 'config deletion cannot unlink during a directory-locked write');
+			unlink($ready); unlink($done);
+			unset($GLOBALS['__test_db_fetch_cell_prepared'], $GLOBALS['__test_db_fetch_assoc_prepared']);
+			file_put_contents($file, $original);
+		}
+		atomic_assert(!\WeathermapConfig\acquire($dir . '/missing'), 'missing lock directory rejected');
+		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/deleted.conf', 'Replacement', true), 'deleted existing maps are not recreated');
+		atomic_assert(is_file($dir . '/.weathermap-config.lock'), 'arbitrary output uses its destination directory lock');
 		$templateFile = $dir . '/templates.conf';
 		file_put_contents($templateFile, "NODE templateNode\n LABEL Template\nNODE A\n POSITION 10 10\nNODE B\n POSITION 50 50\nLINK templateLink\n WIDTH 8\nLINK trafficLink\n NODES A B\n");
 		$templateMap = new \WeatherMap; $templateMap->ReadConfig($templateFile);
 		atomic_assert($templateMap->WriteConfig($templateFile), 'atomic save supports templates and traffic links');
 		$reloaded = new \WeatherMap; $reloaded->ReadConfig($templateFile);
 		atomic_assert(isset($reloaded->nodes['templateNode'], $reloaded->links['templateLink'], $reloaded->links['trafficLink']), 'template and real objects survive atomic roundtrip');
+		$plugin = dirname(__DIR__, 2);
+		$repairName = 'atomic-repair-' . bin2hex(random_bytes(4)) . '.conf';
+		$repairFile = $plugin . '/configs/' . $repairName;
+		$repairImage = $plugin . '/images/backgrounds/' . $repairName . '.png';
+		$legacy = 'BACKGROUND ' . basename($repairImage) . "\n";
+		file_put_contents($repairFile, $legacy); file_put_contents($repairImage, 'fixture');
+		$oldConfig = $GLOBALS['config'];
+		$GLOBALS['config']['base_path'] = dirname($plugin, 2);
+		$GLOBALS['__test_db_fetch_assoc'] = fn ($sql) => [['configfile' => $repairName]];
+		try {
+			$GLOBALS['config_fault'] = 'rename';
+			$oldSuppress = $GLOBALS['weathermap_error_suppress'] ?? [];
+			$GLOBALS['weathermap_error_suppress'] = ['WMPOLL13'];
+			try { weathermap_repair_maps(); } finally { $GLOBALS['weathermap_error_suppress'] = $oldSuppress; }
+			atomic_assert(file_get_contents($repairFile) === $legacy, 'failed repair preserves original config');
+			$GLOBALS['config_fault'] = '';
+			weathermap_repair_maps();
+			atomic_assert(file_get_contents($repairFile) === 'BACKGROUND images/backgrounds/' . basename($repairImage), 'repair uses complete atomic replacement');
+		} finally {
+			$GLOBALS['config'] = $oldConfig;
+			unset($GLOBALS['__test_db_fetch_assoc']);
+			unlink($repairFile); unlink($repairImage);
+		}
+		$deletedMap = new \WeatherMap; $deletedMap->ReadConfig($file);
+		unlink($file);
+		atomic_assert(!$deletedMap->WriteConfig($file) && !file_exists($file), 'saving a previously loaded deleted map fails without resurrection');
+		file_put_contents($file, $original);
 		$GLOBALS['config_fault'] = 'rename';
 		$map = new \WeatherMap; $map->ReadConfig($file); $map->title = 'Changed';
 		atomic_assert(!$map->WriteConfig($file) && file_get_contents($file) === $original, 'engine failure preserves original');
@@ -196,6 +252,7 @@ function atomic_assert($condition, $message) {
 		$GLOBALS['config_fault'] = '';
 		foreach (glob($dir . '/*') as $path) unlink($path);
 		foreach (glob($dir . '/.wm-config-*') as $path) unlink($path);
+		if (is_file($dir . '/.weathermap-config.lock')) unlink($dir . '/.weathermap-config.lock');
 		rmdir($dir);
 	}
 }
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index 50c5b4e8..240d2cb4 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -195,5 +195,6 @@ public function stream_close() {}
 	print "PASS: note create, render, edit, styles, multiline, validation and delete\n";
 } finally {
 	foreach (glob($directory . '/*') as $file) unlink($file);
+	if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
 	rmdir($directory);
 }
diff --git a/tests/Support/GalleryPreviewRender.php b/tests/Support/GalleryPreviewRender.php
index 467a2084..553e8a91 100644
--- a/tests/Support/GalleryPreviewRender.php
+++ b/tests/Support/GalleryPreviewRender.php
@@ -143,5 +143,6 @@ function weathermap_tabs($group) {
 		unlink($file);
 	}
 	rmdir($directory . '/output');
+	if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
 	rmdir($directory);
 }
diff --git a/tests/Support/NewMapPresetEngineRegression.php b/tests/Support/NewMapPresetEngineRegression.php
index 6323b6e1..d738d431 100644
--- a/tests/Support/NewMapPresetEngineRegression.php
+++ b/tests/Support/NewMapPresetEngineRegression.php
@@ -86,5 +86,7 @@ function wm_engine_assert($value,$message) {
 } finally {
 	foreach (glob($directory . '/*') as $file) {
 		unlink($file);
-	}rmdir($directory);
+	}
+	if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
+	rmdir($directory);
 }
diff --git a/tests/Support/NewMapTitleEngineRegression.php b/tests/Support/NewMapTitleEngineRegression.php
index 636f6d7c..3410b656 100644
--- a/tests/Support/NewMapTitleEngineRegression.php
+++ b/tests/Support/NewMapTitleEngineRegression.php
@@ -112,5 +112,7 @@ function wm_engine_assert($value,$message) {
 } finally {
 	foreach (glob($directory . '/*') as $file) {
 		unlink($file);
-	}rmdir($directory);
+	}
+	if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
+	rmdir($directory);
 }
diff --git a/tests/Support/SavedPresetFallbackRegression.php b/tests/Support/SavedPresetFallbackRegression.php
index a0738740..993321d6 100644
--- a/tests/Support/SavedPresetFallbackRegression.php
+++ b/tests/Support/SavedPresetFallbackRegression.php
@@ -70,5 +70,6 @@ function clean_up_name($value) {
 	foreach (glob($directory . '/*') as $file) {
 		unlink($file);
 	}
+	if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
 	rmdir($directory);
 }
diff --git a/tests/Unit/ConfigFileDeleteTest.php b/tests/Unit/ConfigFileDeleteTest.php
index 57ab72b7..e4a2a249 100644
--- a/tests/Unit/ConfigFileDeleteTest.php
+++ b/tests/Unit/ConfigFileDeleteTest.php
@@ -54,7 +54,9 @@
 
 		foreach (glob($dir . '/*') as $p) {
 			unlink($p);
-		}rmdir($dir);
+		}
+		if (is_file($dir . '/.weathermap-config.lock')) unlink($dir . '/.weathermap-config.lock');
+		rmdir($dir);
 	}
 });
 it('ReportsADeletionFailureWithoutClaimingSuccess', function () {
@@ -79,6 +81,7 @@
 		restore_error_handler();
 		chmod($dir,0700);
 		unlink($dir . '/test.conf');
+		if (is_file($dir . '/.weathermap-config.lock')) unlink($dir . '/.weathermap-config.lock');
 		rmdir($dir);
 		unset($GLOBALS['__test_db_fetch_cell_prepared']);
 	}
@@ -120,6 +123,7 @@
 		foreach (glob($weathermap_confdir . '/*') as $path) {
 			unlink($path);
 		}
+		if (is_file($weathermap_confdir . '/.weathermap-config.lock')) unlink($weathermap_confdir . '/.weathermap-config.lock');
 		rmdir($weathermap_confdir);
 		unset($GLOBALS['__test_nfilter_request']['file'], $GLOBALS['__test_raise_message'], $GLOBALS['__test_delete_message'], $GLOBALS['__test_db_fetch_cell_prepared']);
 
@@ -153,7 +157,9 @@
 		unset($GLOBALS['__test_db_fetch_cell_prepared'], $GLOBALS['__test_db_fetch_assoc_prepared']);
 		unlink($directory . '/Other.conf');
 		if (file_exists($directory . '/Map.conf')) { unlink($directory . '/Map.conf'); }
+		if (is_file($directory . '/sub' . '/.weathermap-config.lock')) unlink($directory . '/sub' . '/.weathermap-config.lock');
 		rmdir($directory . '/sub');
+		if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
 		rmdir($directory);
 	}
 });
diff --git a/tests/Unit/ConfigRegistrationLockTest.php b/tests/Unit/ConfigRegistrationLockTest.php
index 6c5b9464..7a15701a 100644
--- a/tests/Unit/ConfigRegistrationLockTest.php
+++ b/tests/Unit/ConfigRegistrationLockTest.php
@@ -101,6 +101,7 @@ function map_resort() {}
 		$weathermap_confdir = $old_directory;
 		unset($GLOBALS['__test_db_execute_prepared'], $GLOBALS['__test_db_fetch_cell_prepared']);
 		foreach (glob($directory . '/*') as $entry) { unlink($entry); }
+		if (is_file($directory . '/.weathermap-config.lock')) unlink($directory . '/.weathermap-config.lock');
 		rmdir($directory);
 	}
 });
diff --git a/tests/Unit/WeathermapUpgradeTest.php b/tests/Unit/WeathermapUpgradeTest.php
index 6800e6ae..24ca2c17 100644
--- a/tests/Unit/WeathermapUpgradeTest.php
+++ b/tests/Unit/WeathermapUpgradeTest.php
@@ -21,6 +21,11 @@
  * suite stubs.
  */
 
+// Only upgrade tests stub the filesystem repair; isolated engine tests load it.
+if (!function_exists('weathermap_repair_maps')) {
+	function weathermap_repair_maps() {}
+}
+
 beforeAll(function () {
 	require_once __DIR__ . '/../../setup.php';
 });
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 5e4a2190..de6f6e41 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -67,6 +67,7 @@ function db_execute_prepared($sql, $params = []) {
 
 if (!function_exists('db_fetch_assoc')) {
 	function db_fetch_assoc($sql) {
+		if (isset($GLOBALS['__test_db_fetch_assoc'])) return ($GLOBALS['__test_db_fetch_assoc'])($sql);
 		return [];
 	}
 }
@@ -184,14 +185,6 @@ function test_set_current_page($page) {
 	}
 }
 
-// Real implementation lives in lib/poller-common.php, which is never included
-// at runtime by the test suites (it pulls in WeatherMap.class.php); stub it so
-// the upgrade-path test can drive plugin_weathermap_upgrade() safely.
-if (!function_exists('weathermap_repair_maps')) {
-	function weathermap_repair_maps() {
-	}
-}
-
 if (!function_exists('isset_request_var')) {
 	function isset_request_var($n) {
 		return isset($GLOBALS['__test_request'][$n]);
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index 1d92750a..2293776e 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -1752,38 +1752,48 @@ function add_config($file) {
 		print '<h3>' . __('Path mismatch', 'weathermap') . '</h3>';
 	} else {
 		require_once __DIR__ . '/lib/editor.config-delete.php';
-		$file = basename($file);
-		$realfile = $weathermap_confdir . '/' . $file;
-		$lock = wm_config_lock($realfile);
-		if ($lock === false) {
+		require_once __DIR__ . '/lib/WeatherMap.config.php';
+		$directory_lock = \WeathermapConfig\acquire($weathermap_confdir, false);
+		if (!$directory_lock) {
 			raise_message('path_missing', __esc('The configuration file is unavailable. Please retry.', 'weathermap'), MESSAGE_LEVEL_ERROR);
 			return;
 		}
 		try {
-			$title    = wmap_get_title($realfile);
-
-			db_execute_prepared("INSERT INTO weathermap_maps
-				(configfile, titlecache, active, imagefile, htmlfile, filehash, config)
-				VALUES (?, ?, 'on', '', '', '', '')",
-				[$file, $title]);
-
-			$last_id = db_fetch_insert_id();
-			$myuid   = (isset($_SESSION['sess_user_id']) ? intval($_SESSION['sess_user_id']) : 1);
-
-			db_execute_prepared('INSERT INTO weathermap_auth
-				(mapid, userid)
-				VALUES (?, ?)',
-				[$last_id, $myuid]);
-
-			db_execute_prepared('UPDATE weathermap_maps
-				SET filehash = LEFT(MD5(CONCAT(id, configfile, rand())), 20)
-				WHERE id = ?',
-				[$last_id]);
-
-			map_resort();
+			$file = basename($file);
+			$realfile = $weathermap_confdir . '/' . $file;
+			$lock = wm_config_lock($realfile);
+			if ($lock === false) {
+				raise_message('path_missing', __esc('The configuration file is unavailable. Please retry.', 'weathermap'), MESSAGE_LEVEL_ERROR);
+				return;
+			}
+			try {
+				$title    = wmap_get_title($realfile);
+
+				db_execute_prepared("INSERT INTO weathermap_maps
+					(configfile, titlecache, active, imagefile, htmlfile, filehash, config)
+					VALUES (?, ?, 'on', '', '', '', '')",
+					[$file, $title]);
+
+				$last_id = db_fetch_insert_id();
+				$myuid   = (isset($_SESSION['sess_user_id']) ? intval($_SESSION['sess_user_id']) : 1);
+
+				db_execute_prepared('INSERT INTO weathermap_auth
+					(mapid, userid)
+					VALUES (?, ?)',
+					[$last_id, $myuid]);
+
+				db_execute_prepared('UPDATE weathermap_maps
+					SET filehash = LEFT(MD5(CONCAT(id, configfile, rand())), 20)
+					WHERE id = ?',
+					[$last_id]);
+
+				map_resort();
+			} finally {
+				flock($lock, LOCK_UN);
+				fclose($lock);
+			}
 		} finally {
-			flock($lock, LOCK_UN);
-			fclose($lock);
+			\WeathermapConfig\release($directory_lock);
 		}
 	}
 }

From 20feb14e774cd0a6a338e4f2ebb8934ffa08cff4 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 12:25:40 +1030
Subject: [PATCH 11/35] Return a retry when configuration deletion encounters a
 busy directory

---
 lib/editor.config-delete.php                  |  2 +-
 tests/Support/ConfigWriteAtomicRegression.php | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/editor.config-delete.php b/lib/editor.config-delete.php
index 9b3b529a..9d445604 100644
--- a/lib/editor.config-delete.php
+++ b/lib/editor.config-delete.php
@@ -91,7 +91,7 @@ function wm_config_delete($directory, $file) {
 		return 'invalid';
 	}
 	require_once __DIR__ . '/WeatherMap.config.php';
-	$directory_lock = \WeathermapConfig\acquire($directory);
+	$directory_lock = \WeathermapConfig\acquire($directory, false);
 	if (!$directory_lock) return 'failed';
 	try {
 		$path     = $directory . '/' . $file;
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 75b7989b..0fe0d0e2 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -176,7 +176,7 @@ function atomic_assert($condition, $message) {
 			pcntl_waitpid($child, $status); \WeathermapConfig\release($lock);
 			atomic_assert(pcntl_wexitstatus($status) === 0, 'shared lock excludes concurrent configuration writers');
 		}
-		// Deletion waits for the same stable directory mutex used by atomic replacement.
+		// Deletion refuses a busy stable directory mutex rather than blocking the UI.
 		if (function_exists('pcntl_fork')) {
 			require_once dirname(__DIR__, 2) . '/lib/editor.config-delete.php';
 			$GLOBALS['__test_db_fetch_cell_prepared'] = fn () => 0;
@@ -189,14 +189,14 @@ function atomic_assert($condition, $message) {
 				file_put_contents($ready, 'ready');
 				$result = wm_config_delete($dir, 'map.conf');
 				file_put_contents($done, $result);
-				exit($result === 'deleted' ? 0 : 1);
+				exit($result === 'failed' ? 0 : 1);
 			}
-			for ($wait = 0; $wait < 100 && !is_file($ready); $wait++) usleep(10000);
-			usleep(50000);
-			$blocked = !is_file($done) && is_file($file);
+			for ($wait = 0; $wait < 100 && !is_file($done); $wait++) usleep(10000);
+			$blocked = is_file($done) && file_get_contents($done) === 'failed' && is_file($file);
 			\WeathermapConfig\release($lock);
 			pcntl_waitpid($child, $status);
 			atomic_assert($blocked && pcntl_wexitstatus($status) === 0, 'config deletion cannot unlink during a directory-locked write');
+			atomic_assert(wm_config_delete($dir, 'map.conf') === 'deleted', 'deletion succeeds after the writer releases its lock');
 			unlink($ready); unlink($done);
 			unset($GLOBALS['__test_db_fetch_cell_prepared'], $GLOBALS['__test_db_fetch_assoc_prepared']);
 			file_put_contents($file, $original);

From f55a0be73540ae3a8e5802d4bf2c70607c4b8635 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:06:27 +1030
Subject: [PATCH 12/35] Report stale edits and failed saves; fall back from
 unreadable fonts

---
 CHANGELOG.md                                  |   2 +
 js/editor.js                                  |   2 +
 lib/editor.actions.php                        | 142 ++++++++++++------
 lib/editor.inc.php                            |   3 +-
 lib/editor.notes.php                          |   4 +
 locales/po/cacti.pot                          |  10 +-
 tests/Browser/EditorSaveFailureTest.cjs       |   6 +
 tests/Support/ConfigWriteAtomicRegression.php |  10 +-
 tests/Support/EditorNotesEngineRegression.php |   4 +
 tests/Unit/WeathermapUpgradeTest.php          | 115 +++++++-------
 10 files changed, 182 insertions(+), 116 deletions(-)
 create mode 100644 tests/Browser/EditorSaveFailureTest.cjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb4fbb3b..1f852770 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ IMPORTANT NOTE: This version only works on CACTI 1.x++!
 
 --- develop ---
 
+* Make configuration saves and repairs atomic; coordinate writes, registration and deletion with destination-directory locks and report failed editor saves
+
 * Add editable map notes with alignment and sharp text at logical map dimensions
 * Reduce gallery preview cards by 20% while preserving generated thumbnail resolution
 * Add a searchable node icon picker and bundled enterprise site icons
diff --git a/js/editor.js b/js/editor.js
index 8d89c4e7..b61aeae4 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -922,6 +922,8 @@ function form_submit() {
 			if (savingNote) {
 				if (noteAction !== 'set_note_properties') show_note(noteTarget);
 				$('#wm-note-error').text(wmEditorText.noteError).show();
+			} else {
+				window.alert(wmEditorText.saveError);
 			}
 		},
 		success: function(html) {
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index e897f0c0..457cf7ce 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -48,6 +48,40 @@
  * @param mixed $mapfile
  */
 
+/**
+ * Read an existing editor map and reject stale or unreadable targets.
+ *
+ * @param WeatherMap $map Engine receiving the configuration.
+ * @param string $mapfile Configuration path.
+ * @return bool Whether the map was loaded.
+ */
+function wm_editor_read_config($map, $mapfile) {
+	if (!is_file($mapfile) || !is_readable($mapfile)) {
+		http_response_code(404);
+		return false;
+	}
+	if (!$map->ReadConfig($mapfile)) {
+		http_response_code(422);
+		return false;
+	}
+	return true;
+}
+
+/**
+ * Propagate failed editor configuration saves to the AJAX caller.
+ *
+ * @param WeatherMap $map Engine containing the edited configuration.
+ * @param string $mapfile Configuration path.
+ * @return bool Whether the complete configuration was saved.
+ */
+function wm_editor_write_config($map, $mapfile) {
+	if (!$map->WriteConfig($mapfile)) {
+		http_response_code(500);
+		return false;
+	}
+	return true;
+}
+
 /**
  * @return void
  * @param  mixed $mapfile
@@ -59,7 +93,7 @@ function newMap($mapfile) {
 
 	require_once __DIR__ . '/editor.new-map-preset.php';
 	wm_new_map_preset($map);
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -86,7 +120,7 @@ function newMapCopy($mapfile) {
 
 		if (file_exists($sourcemap) && is_readable($sourcemap)) {
 			$map->ReadConfig($sourcemap);
-			$map->WriteConfig($mapfile);
+			wm_editor_write_config($map, $mapfile);
 		}
 	}
 }
@@ -100,7 +134,7 @@ function getMapJavaScript($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	print $map->asJS();
 	print 'var WMNotes = ' . json_encode(wm_editor_note_data($map), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
@@ -115,7 +149,7 @@ function getMapAreaData($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	// we need to draw and throw away a map, to get the
 	// dimensions for the imagemap.
@@ -142,7 +176,7 @@ function drawMap($mapfile, $selected, $use_overlay, $use_relative_overlay) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	if ($selected != '') {
 		if (substr($selected, 0, 5) == 'NODE:') {
@@ -187,7 +221,7 @@ function fetchConfig($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	header('Content-type: text/plain');
 
@@ -224,7 +258,7 @@ function setNodeConfig($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$node_name   = get_nfilter_request_var('node_name');
 	$node_config = get_nfilter_request_var('item_configtext');
@@ -232,7 +266,7 @@ function setNodeConfig($mapfile) {
 	if (isset($map->nodes[$node_name])) {
 		$map->nodes[$node_name]->config_override = $node_config;
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 
 		// now clear and reload the map object, because the in-memory one is out of sync
 		// - we don't know what changes the user made here, so we just have to reload.
@@ -242,7 +276,7 @@ function setNodeConfig($mapfile) {
 
 		$map->context = 'editor';
 
-		$map->ReadConfig($mapfile);
+		if (!wm_editor_read_config($map, $mapfile)) return;
 	}
 }
 
@@ -255,7 +289,7 @@ function setLinkConfig($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$link_name   = get_nfilter_request_var('link_name');
 	$link_config = get_nfilter_request_var('item_configtext');
@@ -263,7 +297,7 @@ function setLinkConfig($mapfile) {
 	if (isset($map->links[$link_name])) {
 		$map->links[$link_name]->config_override = $link_config;
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 
 		// now clear and reload the map object, because the in-memory one is out of sync
 		// - we don't know what changes the user made here, so we just have to reload.
@@ -273,7 +307,7 @@ function setLinkConfig($mapfile) {
 
 		$map->context = 'editor';
 
-		$map->ReadConfig($mapfile);
+		if (!wm_editor_read_config($map, $mapfile)) return;
 	}
 }
 
@@ -286,7 +320,7 @@ function setNodeProperties($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$node_name     = get_nfilter_request_var('node_name');
 	$new_node_name = get_nfilter_request_var('node_new_name');
@@ -363,7 +397,7 @@ function setNodeProperties($mapfile) {
 		$map->nodes[$new_node_name]->iconfile = $iconfile;
 	}
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -375,7 +409,7 @@ function setLinkProperties($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$link_name = get_nfilter_request_var('link_name');
 
@@ -443,7 +477,7 @@ function setLinkProperties($mapfile) {
 
 		// $map->links[$link_name]->SetBandwidth($bwin,$bwout);
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -456,7 +490,7 @@ function setMapProperties($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$map->title              = wm_editor_sanitize_string(get_nfilter_request_var('map_title'));
 	$map->keytext['DEFAULT'] = wm_editor_sanitize_string(get_nfilter_request_var('map_legend'));
@@ -529,7 +563,7 @@ function setMapProperties($mapfile) {
 		}
 	}
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -541,7 +575,7 @@ function setMapStyle($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	if (wm_editor_validate_one_of(get_nfilter_request_var('mapstyle_htmlstyle'), ['static', 'overlib'], false)) {
 		$map->htmlstyle = strtolower(get_nfilter_request_var('mapstyle_htmlstyle'));
@@ -566,7 +600,7 @@ function setMapStyle($mapfile) {
 	wm_comment_update_default($map, 'bwfont', wm_comment_resolve_font($map, get_nfilter_request_var('mapstyle_linkfont')));
 	wm_comment_apply_style($map, get_nfilter_request_var('mapstyle_commentfont'), get_nfilter_request_var('mapstyle_commentcolour'));
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -578,7 +612,7 @@ function addLink($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$a = get_nfilter_request_var('param');
 	$b = get_nfilter_request_var('param2');
@@ -610,7 +644,7 @@ function addLink($mapfile) {
 		$map->links[$newlinkname] = $newlink;
 		array_push($map->seen_zlayers[$newlink->zorder], $newlink);
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -629,12 +663,12 @@ function placeLegend($mapfile, $grid_snap_value) {
 
 	$scalename = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$map->keyx[$scalename] = $x;
 	$map->keyy[$scalename] = $y;
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -650,12 +684,12 @@ function placeStamp($mapfile, $grid_snap_value) {
 	$x = snap(intval(get_nfilter_request_var('x')), $grid_snap_value);
 	$y = snap(intval(get_nfilter_request_var('y')), $grid_snap_value);
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$map->timex = $x;
 	$map->timey = $y;
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -672,11 +706,11 @@ function viaLink($mapfile) {
 
 	$link_name = wm_editor_sanitize_name(get_nfilter_request_var('link_name'));
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	if (isset($map->links[$link_name])) {
 		$map->links[$link_name]->vialist = [[0 =>$x, 1=>$y]];
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -695,8 +729,12 @@ function moveNode($mapfile, $grid_snap_value) {
 
 	$node_name = wm_editor_sanitize_name(get_nfilter_request_var('node_name'));
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
+	if (!isset($map->nodes[$node_name])) {
+		http_response_code(404);
+		return;
+	}
 	if (isset($map->nodes[$node_name])) {
 		// This is a complicated bit. Find out if this node is involved in any
 		// links that have VIAs. If it is, we want to rotate those VIA points
@@ -789,7 +827,7 @@ function moveNode($mapfile, $grid_snap_value) {
 		$map->nodes[$node_name]->x = $x;
 		$map->nodes[$node_name]->y = $y;
 
-		if (!$map->WriteConfig($mapfile)) http_response_code(500);
+		if (!wm_editor_write_config($map, $mapfile)) http_response_code(500);
 	}
 }
 
@@ -802,7 +840,7 @@ function linkTidy($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
@@ -812,7 +850,7 @@ function linkTidy($mapfile) {
 
 		tidy_link($map, $target);
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -825,13 +863,13 @@ function reTidy($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	// draw a map and throw it away, to calculate all the bounding boxes
 	$map->DrawMap('null');
 	retidy_links($map);
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -843,13 +881,13 @@ function reTidyAll($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	// draw a map and throw it away, to calculate all the bounding boxes
 	$map->DrawMap('null');
 	retidy_links($map,true);
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -861,13 +899,13 @@ function unTidy($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	// draw a map and throw it away, to calculate all the bounding boxes
 	$map->DrawMap('null');
 	untidy_links($map);
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -879,7 +917,7 @@ function deleteLink($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 	$log    = 'delete link ' . $target;
@@ -887,7 +925,7 @@ function deleteLink($mapfile) {
 	if (isset($map->links[$target])) {
 		unset($map->links[$target]);
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -904,7 +942,7 @@ function addNode($mapfile, $grid_snap_value) {
 	$x = snap(intval(get_nfilter_request_var('x')), $grid_snap_value);
 	$y = snap(intval(get_nfilter_request_var('y')), $grid_snap_value);
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$newnodename = sprintf('node%05d', time() % 10000);
 
@@ -933,7 +971,7 @@ function addNode($mapfile, $grid_snap_value) {
 	$map->nodes[$node->name] = $node;
 	$log                     = "added a node called $newnodename at $x,$y to $mapfile";
 
-	$map->WriteConfig($mapfile);
+	wm_editor_write_config($map, $mapfile);
 }
 
 /**
@@ -948,7 +986,7 @@ function editorSettings($mapfile) {
 	$map->context = 'editor';
 
 	// have to do this, otherwise the editor will be unresponsive afterwards - not actually going to change anything!
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$use_overlay          = (isset_request_var('editorsettings_showvias') ? intval(get_nfilter_request_var('editorsettings_showvias')) : false);
 	$use_relative_overlay = (isset_request_var('editorsettings_showrelative') ? intval(get_nfilter_request_var('editorsettings_showrelative')) : false);
@@ -964,10 +1002,14 @@ function deleteNode($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
+	if (!isset($map->nodes[$target])) {
+		http_response_code(404);
+		return;
+	}
 	if (isset($map->nodes[$target])) {
 		$log = 'delete node ' . $target;
 
@@ -981,7 +1023,7 @@ function deleteNode($mapfile) {
 
 		unset($map->nodes[$target]);
 
-		if (!$map->WriteConfig($mapfile)) http_response_code(500);
+		if (!wm_editor_write_config($map, $mapfile)) http_response_code(500);
 	}
 }
 
@@ -994,7 +1036,7 @@ function cloneNode($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
@@ -1025,7 +1067,7 @@ function cloneNode($mapfile) {
 
 		array_push($map->seen_zlayers[$node->zorder], $node);
 
-		$map->WriteConfig($mapfile);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -1038,7 +1080,7 @@ function displayFontSamples($mapfile) {
 
 	$map->context = 'editor';
 
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	ksort($map->fonts);
 	header('Content-type: image/png');
@@ -1148,7 +1190,7 @@ function getImageURL($mapname, $selected) {
 function setNoteProperties($mapfile, $grid_snap_value) {
 	$map = new WeatherMap;
 	$map->context = 'editor';
-	$map->ReadConfig($mapfile);
+	if (!wm_editor_read_config($map, $mapfile)) return;
 	$values = [];
 	foreach (['name', 'text', 'font', 'colour', 'x', 'y', 'align'] as $field) {
 		$values[$field] = get_nfilter_request_var('note_' . $field);
@@ -1157,5 +1199,5 @@ function setNoteProperties($mapfile, $grid_snap_value) {
 		http_response_code(400);
 		return;
 	}
-	if (!$map->WriteConfig($mapfile)) http_response_code(500);
+	if (!wm_editor_write_config($map, $mapfile)) http_response_code(500);
 }
diff --git a/lib/editor.inc.php b/lib/editor.inc.php
index 65e4cc87..1c9da63b 100644
--- a/lib/editor.inc.php
+++ b/lib/editor.inc.php
@@ -1020,6 +1020,7 @@ function getEditorJs() {
 		'iconMatchCount' => __('Matching icons: %s', '%s', 'weathermap'),
 		'iconNoMatches' => __('No matching icons', 'weathermap'),
 
+		'saveError' => __('Unable to save changes. Please try again.', 'weathermap'),
 		'currentInterface'     => __('Current interface', 'weathermap'),
 		'advanced'             => __('Advanced settings', 'weathermap'),
 		'hideAdvanced'         => __('Hide advanced settings', 'weathermap'),
@@ -1032,7 +1033,7 @@ function getEditorJs() {
 		'noteDeleteTitle' => __('Delete Note Confirmation', 'weathermap'),
 		'noteDeleteAction' => __('Delete Note', 'weathermap'),
 		'noteDelete' => __('Delete note "%s"?', '%s', 'weathermap'),
-		'noteError' => __('The note could not be saved. Check its text, font and position, then try again.', 'weathermap'),
+		'noteError' => __('Unable to save changes. Please try again.', 'weathermap'),
 		'currentGraph'         => __('Current graph: %s', '%s', 'weathermap'),
 		'customConfig'         => __('Custom configuration — details under Advanced', 'weathermap'),
 		'chooseInterface'      => __('Choose an interface below', 'weathermap'),
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index 1be57318..a5e0bea3 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -111,6 +111,10 @@ function wm_editor_note_data($map) {
 		}
 		$fontId = isset($map->fonts[$node->labelfont]) ? $node->labelfont : 3;
 		$font = $map->fonts[$fontId];
+		if ($font->type === 'truetype' && !is_readable(wm_font_file($font->file))) {
+			$fontId = 3;
+			$font = $map->fonts[$fontId];
+		}
 		$rgb = $node->labelfontcolour;
 		$notes[$name] = ['align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$fontId, 'fontLabel' => wm_editor_font_label($fontId, $font),
 			'colour' => sprintf('#%02x%02x%02x', max(0, $rgb[0]), max(0, $rgb[1]), max(0, $rgb[2]))];
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index af686fb8..ca89b5d3 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 12:29+1030\n"
+"POT-Creation-Date: 2026-10-12 13:03+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -201,6 +201,10 @@ msgstr ""
 msgid "No matching icons"
 msgstr ""
 
+#: lib/editor.inc.php
+msgid "Unable to save changes. Please try again."
+msgstr ""
+
 #: lib/editor.inc.php
 msgid "Current interface"
 msgstr ""
@@ -250,10 +254,6 @@ msgstr ""
 msgid "Delete note \"%s\"?"
 msgstr ""
 
-#: lib/editor.inc.php
-msgid "The note could not be saved. Check its text, font and position, then try again."
-msgstr ""
-
 #: lib/editor.inc.php
 #, php-format
 msgid "Current graph: %s"
diff --git a/tests/Browser/EditorSaveFailureTest.cjs b/tests/Browser/EditorSaveFailureTest.cjs
new file mode 100644
index 00000000..447a1c29
--- /dev/null
+++ b/tests/Browser/EditorSaveFailureTest.cjs
@@ -0,0 +1,6 @@
+const {JSDOM}=require('jsdom'),jquery=require('jquery'),fs=require('node:fs'),path=require('node:path'),assert=require('node:assert/strict');
+const dom=new JSDOM('<input id="action" value="set_map_properties"><input id="mapname" value="map.conf">',{runScripts:'outside-only'}),w=dom.window,$=jquery(w);w.$=w.jQuery=$;w.editor_url='/editor';w.wmEditorText={saveError:'Unable to save changes'};
+let request,message,closed=0,refreshed=0;$.ajax=opts=>request=opts;w.alert=text=>message=text;w.hide_all_dialogs=()=>closed++;$.get=()=>refreshed++;
+const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');w.eval(source.slice(source.indexOf('function form_submit()'),source.indexOf('function map_properties()')));
+w.form_submit();request.error();assert.equal(message,'Unable to save changes');assert.equal(closed,0);assert.equal(refreshed,0);assert.equal($('#action').val(),'set_map_properties');
+w.close();console.log('PASS: save failure reports retry and preserves the form');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 0fe0d0e2..df55f377 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -241,12 +241,20 @@ function atomic_assert($condition, $message) {
 		$map = new \WeatherMap; $map->ReadConfig($file); $map->title = 'Changed';
 		atomic_assert(!$map->WriteConfig($file) && file_get_contents($file) === $original, 'engine failure preserves original');
 		$GLOBALS['__test_nfilter_request'] = ['node_name' => 'note1', 'param' => 'note1', 'x' => '70', 'y' => '80'];
-		if (function_exists('wm_editor_save_note')) {
+		{
 			http_response_code(200); moveNode($file, 0);
 			atomic_assert(http_response_code() === 500 && file_get_contents($file) === $original, 'failed move surfaces error without changing file');
 			http_response_code(200); deleteNode($file);
 			atomic_assert(http_response_code() === 500 && file_get_contents($file) === $original, 'failed delete surfaces error without changing file');
 		}
+		$GLOBALS['config_fault'] = '';
+		$GLOBALS['__test_nfilter_request'] = ['node_name' => 'missing', 'param' => 'missing', 'x' => '70', 'y' => '80'];
+		http_response_code(200); moveNode($file, 0);
+		atomic_assert(http_response_code() === 404 && file_get_contents($file) === $original, 'missing move target is an error');
+		http_response_code(200); deleteNode($file);
+		atomic_assert(http_response_code() === 404 && file_get_contents($file) === $original, 'missing delete target is an error');
+		unlink($file); http_response_code(200); moveNode($file, 0);
+		atomic_assert(http_response_code() === 404 && !file_exists($file), 'deleted map cannot report a successful edit');
 		echo "Atomic configuration write and locking regression PASS\n";
 	} finally {
 		$GLOBALS['config_fault'] = '';
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index 240d2cb4..65ee20ad 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -51,6 +51,10 @@ function note_assert($value, $message) {
 		note_assert(wm_editor_note_data($map)[$name]['font'] === '3', 'missing note font falls back to a built-in');
 	} finally { restore_error_handler(); }
 	$map->nodes[$name]->labelfont = $validFont;
+	$validFile = $map->fonts[$validFont]->file;
+	$map->fonts[$validFont]->file = '/nonexistent/note-font.ttf';
+	note_assert(wm_editor_note_data($map)[$name]['font'] === '3', 'unreadable TrueType font falls back');
+	$map->fonts[$validFont]->file = $validFile;
 	note_assert(in_array($map->nodes[$name], $map->seen_zlayers[$map->nodes[$name]->zorder], true), 'new note indexed immediately');
 	$map->DrawMap($directory . '/immediate.png');
 	note_assert(getimagesize($directory . '/immediate.png')[0] === 1200, 'new note renders sharply without rereading');
diff --git a/tests/Unit/WeathermapUpgradeTest.php b/tests/Unit/WeathermapUpgradeTest.php
index 24ca2c17..9a3bdad8 100644
--- a/tests/Unit/WeathermapUpgradeTest.php
+++ b/tests/Unit/WeathermapUpgradeTest.php
@@ -5,66 +5,63 @@
  +-------------------------------------------------------------------------+
 */
 
-/*
- * Unit coverage for plugin_weathermap_upgrade() in setup.php: the
- * page-guard.
- *
- * The rest of the function (reached on any allowed page) is intentionally
- * NOT covered here: it include_once()s lib/poller-common.php, which itself
- * include_once()s lib/WeatherMap.class.php - a file this plugin's own
- * other test suites (e.g. tests/Handoff) already load directly by a
- * different path, and loading it a second time via a different resolved
- * path fatals with "Cannot declare class WeatherMapDataSource, because
- * the name is already in use". The version-drift branch also calls
- * weathermap_repair_maps(), which does a real chdir() and reads/writes
- * map config files on disk - a much larger and riskier surface than this
- * suite stubs.
- */
-
-// Only upgrade tests stub the filesystem repair; isolated engine tests load it.
-if (!function_exists('weathermap_repair_maps')) {
-	function weathermap_repair_maps() {}
-}
-
-beforeAll(function () {
-	require_once __DIR__ . '/../../setup.php';
-});
-
-beforeEach(function () {
-	$GLOBALS['__test_db_calls']     = [];
-	$GLOBALS['__test_current_page'] = '';
-});
+use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\TestCase;
 
-it('does nothing on a page that does not need the version check', function () {
-	test_set_current_page('graphs.php');
+/** Exercise upgrade dispatch without sharing production-function stubs. */
+#[RunTestsInSeparateProcesses]
+#[PreserveGlobalState(false)]
+final class WeathermapUpgradeTest extends TestCase {
+	/**
+	 * Install the upgrade-only repair stub in this isolated process.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		require_once __DIR__ . '/../../setup.php';
+		if (!function_exists('weathermap_repair_maps')) {
+			function weathermap_repair_maps() {}
+		}
+		$GLOBALS['__test_db_calls'] = [];
+		$GLOBALS['__test_current_page'] = '';
+	}
 
-	plugin_weathermap_upgrade();
+	/**
+	 * Verify unrelated pages do not trigger upgrade queries.
+	 *
+	 * @return void
+	 */
+	public function testUnrelatedPageSkipsUpgrade(): void {
+		test_set_current_page('graphs.php');
+		plugin_weathermap_upgrade();
+		self::assertEmpty($GLOBALS['__test_db_calls']);
+	}
 
-	expect($GLOBALS['__test_db_calls'])->toBeEmpty();
-});
-
-it('runs the realm/version updates and prune on a version drift', function () {
-test_set_current_page('plugins.php');
-
-// Sandbox base_path with an empty poller-common stub + minimal INFO so the
-// upgrade-time prune runs against a throwaway tree, never the real checkout,
-// and the heavy lib include is a no-op.
-$restore = $GLOBALS['config']['base_path'];
-$base    = sys_get_temp_dir() . '/weathermap-upg-' . uniqid();
-mkdir($base . '/plugins/weathermap/lib', 0777, true);
-file_put_contents($base . '/plugins/weathermap/lib/poller-common.php', "<?php\n");
-file_put_contents($base . '/plugins/weathermap/INFO', "[info]\nversion = 9.9.9\nname = weathermap\nlongname = Weathermap\nauthor = x\nhomepage = x\n");
-$GLOBALS['config']['base_path'] = $base;
-
-try {
-plugin_weathermap_upgrade();
-} finally {
-$GLOBALS['config']['base_path'] = $restore;
+	/**
+	 * Verify a version drift updates the realm and version metadata.
+	 *
+	 * @return void
+	 */
+	public function testVersionDriftUpdatesRealmAndVersion(): void {
+		test_set_current_page('plugins.php');
+		$restore = $GLOBALS['config']['base_path'];
+		$base = sys_get_temp_dir() . '/weathermap-upg-' . bin2hex(random_bytes(6));
+		$plugin = $base . '/plugins/weathermap';
+		mkdir($plugin . '/lib', 0777, true);
+		file_put_contents($plugin . '/lib/poller-common.php', "<?php\n");
+		file_put_contents($plugin . '/INFO', "[info]\nversion = 9.9.9\nname = weathermap\nlongname = Weathermap\nauthor = x\nhomepage = x\n");
+		$GLOBALS['config']['base_path'] = $base;
+		try {
+			plugin_weathermap_upgrade();
+			$updates = array_filter($GLOBALS['__test_db_calls'], function ($call) {
+				return $call['fn'] === 'db_execute_prepared' && stripos($call['sql'], 'UPDATE plugin_config') !== false;
+			});
+			self::assertNotEmpty($updates);
+		} finally {
+			$GLOBALS['config']['base_path'] = $restore;
+			unlink($plugin . '/INFO'); unlink($plugin . '/lib/poller-common.php');
+			rmdir($plugin . '/lib'); rmdir($plugin); rmdir($base . '/plugins'); rmdir($base);
+		}
+	}
 }
-
-$updates = array_values(array_filter($GLOBALS['__test_db_calls'], function ($call) {
-return $call['fn'] === 'db_execute_prepared' && stripos($call['sql'], 'UPDATE plugin_config') !== false;
-}));
-
-expect($updates)->not->toBeEmpty();
-});

From 1c37cae37d95634cc2d932a4ceb044c16e37969c Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 21:54:11 +1030
Subject: [PATCH 13/35] Reject stale saves and competing creates; retain text
 on allocation failure

---
 lib/WeatherMap.class.php                      | 25 +++++--
 lib/WeatherMap.config.php                     |  9 ++-
 lib/WeatherMap.notes.php                      | 45 +++++++++++-
 lib/editor.actions.php                        | 10 +--
 lib/poller-common.php                         |  3 +-
 locales/po/cacti.pot                          | 10 +--
 tests/Support/ConfigWriteAtomicRegression.php | 48 +++++++++++++
 tests/Support/NoteAllocationRegression.php    | 69 +++++++++++++++++++
 tests/Unit/ConfigWriteAtomicTest.php          |  5 ++
 tests/Unit/NoteAllocationTest.php             | 46 +++++++++++++
 tests/Unit/WeathermapUpgradeTest.php          |  5 ++
 weathermap-cacti-plugin-mgmt.php              | 21 ++----
 12 files changed, 259 insertions(+), 37 deletions(-)
 create mode 100644 tests/Support/NoteAllocationRegression.php
 create mode 100644 tests/Unit/NoteAllocationTest.php

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index f1e7d598..3275932b 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -342,6 +342,8 @@ class WeatherMap extends WeatherMapBase {
 	var $colours;
 	/** @var mixed */
 	var $configfile;
+	var $config_revision = null;
+	var $editor_config_revision = null;
 	/** @var mixed */
 	var $imagefile;
 	/** @var mixed */
@@ -2446,6 +2448,7 @@ function DrawTitle($image, $font, $colour) {
 	 */
 	function ReadConfig($input, $is_include = false) {
 		global $config, $weathermap_error_suppress;
+		if (!$is_include) $this->config_revision = null;
 
 		$curnode    = null;
 		$curlink    = null;
@@ -2492,16 +2495,19 @@ function ReadConfig($input, $is_include = false) {
 			}
 
 			if (is_file($filename)) {
-				$fd = fopen($filename, 'r');
+				$fd = fopen($filename, 'rb');
 
 				if ($fd) {
+					$revision = hash_init('sha256');
 					while (($buffer = fgets($fd, 4096)) !== false) {
+						hash_update($revision, $buffer);
 						// strip out any Windows line-endings that have gotten in here
 						$buffer  = str_replace("\r", '', $buffer);
 						$lines[] = $buffer;
 					}
 
 					fclose($fd);
+					if (!$is_include) $this->config_revision = hash_final($revision);
 				}
 			}
 		}
@@ -3605,9 +3611,11 @@ function WriteDataFile($filename) {
 
 	/**
 	 * @param string $filename
+	 * @param bool $createOnly Require a new destination.
+	 * @param string|null $expectedRevision Optional request snapshot revision.
 	 * @return bool
 	 */
-	function WriteConfig($filename) {
+	function WriteConfig($filename, $createOnly = false, $expectedRevision = null) {
 		require_once __DIR__ . '/WeatherMap.config.php';
 		$fd = fopen('php://temp', 'w+b');
 
@@ -3848,7 +3856,10 @@ function WriteConfig($filename) {
 			$contents = stream_get_contents($fd);
 			$closed = fclose($fd);
 
-			return $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $this->configfile !== '' && $filename === $this->configfile);
+			$sameFile = $this->configfile !== '' && $filename === $this->configfile;
+			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly);
+			if ($saved && $sameFile) $this->config_revision = hash('sha256', $contents);
+			return $saved;
 		} else {
 			wm_warn("Couldn't open config file $filename for writing");
 
@@ -4027,6 +4038,8 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 			}
 
 			$sharpNotes = ($filename !== 'null' && $withnodes && $this->context !== 'editor2') ? wm_sharp_notes($this) : [];
+			$noteImages = $sharpNotes !== [] ? wm_note_prepare_images($this) : false;
+			if ($noteImages === false) $sharpNotes = [];
 			foreach ($sharpNotes as $node) {
 				$node->render_note_hidpi = true;
 				$bounds = $node->boundingboxes;
@@ -4047,7 +4060,7 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 				if ($z == 1000) {
 					if ($sharpNotes !== []) {
 						$baseImage = $image;
-						$image = imagecreatetruecolor($this->width, $this->height);
+						$image = $noteImages[1];
 						imagesavealpha($image, true);
 						imagealphablending($image, false);
 						imagefill($image, 0, 0, imagecolorallocatealpha($image, 0, 0, 0, 127));
@@ -4179,10 +4192,12 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 			if ($sharpNotes !== []) {
 				if ($noteForeground !== null) $image = $baseImage;
 				$this->image = $image;
-				$image = wm_note_display_image($this, $sharpNotes);
+				$image = wm_note_display_image($this, $sharpNotes, $noteImages[0]);
 				if ($noteForeground !== null) {
 					imagecopyresampled($image, $noteForeground, 0, 0, 0, 0, imagesx($image), imagesy($image), $this->width, $this->height);
 					imagedestroy($noteForeground);
+				} else {
+					imagedestroy($noteImages[1]);
 				}
 				$this->image = $image;
 			}
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 7d104001..b89db55e 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -80,22 +80,27 @@ function writeAll($stream, $contents) {
  * @param string $filename The destination configuration path.
  * @param string $contents The complete new configuration.
  * @param bool $mustExist Refuse to recreate an existing map deleted during editing.
+ * @param string|null $expectedRevision SHA-256 of the snapshot being edited.
+ * @param bool $createOnly Refuse to replace an existing destination.
  *
  * @return bool Success; failures preserve the existing configuration.
  */
-function atomicWrite($filename, $contents, $mustExist = false) {
+function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision = null, $createOnly = false) {
 	if (strpos($filename, '://') !== false) return false;
 	if (is_link($filename)) $filename = realpath($filename);
 	if ($filename === false || !is_dir(dirname($filename)) || !is_writable(dirname($filename))) return false;
 	if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
-	$mustExist = $mustExist || file_exists($filename);
+	$existed = file_exists($filename);
+	$mustExist = $mustExist || $existed;
 	$lock = acquire(dirname($filename));
 	if (!$lock) return false;
 	$temp = false;
 	$stream = false;
 	try {
 		clearstatcache(true, $filename);
+		if (($createOnly || !$existed) && file_exists($filename)) return false;
 		if ($mustExist && !is_file($filename)) return false;
+		if ($expectedRevision !== null && @hash_file('sha256', $filename) !== $expectedRevision) return false;
 		if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
 		$temp = @tempnam(dirname($filename), '.wm-config-');
 		if ($temp === false) return false;
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 572966f7..063a3bd9 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -22,6 +22,24 @@
  +-------------------------------------------------------------------------+
 */
 
+namespace WeathermapNotes {
+	/**
+	 * Allocate a note canvas without propagating GD allocation failures.
+	 *
+	 * @param int $width Canvas width.
+	 * @param int $height Canvas height.
+	 * @return \GdImage|false Allocated canvas, or false when unavailable.
+	 */
+	function allocate($width, $height) {
+		try {
+			return @imagecreatetruecolor($width, $height);
+		} catch (\Throwable $error) {
+			return false;
+		}
+	}
+}
+
+namespace {
 /**
  * Notes eligible for high-density map rendering. Restrict the allocation to
  * bounded maps and plain TrueType annotations drawn above the other objects.
@@ -59,15 +77,34 @@ function wm_sharp_notes($map) {
 	return $notes;
 }
 
+/**
+ * Reserve both note canvases before suppressing logical-resolution glyphs.
+ *
+ * @param WeatherMap $map Map being rendered.
+ * @return array{GdImage, GdImage}|false Display and foreground canvases.
+ */
+function wm_note_prepare_images($map) {
+	$display = \WeathermapNotes\allocate($map->width * 2, $map->height * 2);
+	if ($display === false) return false;
+	$foreground = \WeathermapNotes\allocate($map->width, $map->height);
+	if ($foreground === false) {
+		imagedestroy($display);
+		return false;
+	}
+	return [$display, $foreground];
+}
+
 /**
  * Render glyphs at twice the density; do not enlarge an existing text bitmap.
  *
  * @param WeatherMap $map The composed logical-resolution map.
  * @param WeatherMapNode[] $notes Notes to draw over the composed image.
- * @return GdImage The high-density display image.
+ * @param GdImage|null $image Optional preallocated display canvas.
+ * @return GdImage|false The display image, or false on allocation failure.
  */
-function wm_note_display_image($map, $notes) {
-	$image = imagecreatetruecolor($map->width * 2, $map->height * 2);
+function wm_note_display_image($map, $notes, $image = null) {
+	$image = $image ?? \WeathermapNotes\allocate($map->width * 2, $map->height * 2);
+	if ($image === false) return false;
 	imagecopyresampled($image, $map->image, 0, 0, 0, 0, $map->width * 2, $map->height * 2, $map->width, $map->height);
 	foreach ($notes as $node) {
 		$lines = explode("\n", $node->proclabel);
@@ -107,3 +144,5 @@ function wm_liveview_image_html($map, $id) {
 	$url = htmlspecialchars('?action=liveviewimage&id=' . rawurlencode((string)$id), ENT_QUOTES, 'UTF-8');
 	return '<img src="' . $url . '" width="' . (int)$map->width . '" height="' . (int)$map->height . '" />' . "\n";
 }
+
+}
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 457cf7ce..ff1210d6 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -64,6 +64,7 @@ function wm_editor_read_config($map, $mapfile) {
 		http_response_code(422);
 		return false;
 	}
+	$map->editor_config_revision = $map->config_revision;
 	return true;
 }
 
@@ -72,10 +73,11 @@ function wm_editor_read_config($map, $mapfile) {
  *
  * @param WeatherMap $map Engine containing the edited configuration.
  * @param string $mapfile Configuration path.
+ * @param bool $createOnly Require a new destination for map creation.
  * @return bool Whether the complete configuration was saved.
  */
-function wm_editor_write_config($map, $mapfile) {
-	if (!$map->WriteConfig($mapfile)) {
+function wm_editor_write_config($map, $mapfile, $createOnly = false) {
+	if (!$map->WriteConfig($mapfile, $createOnly, $map->editor_config_revision)) {
 		http_response_code(500);
 		return false;
 	}
@@ -93,7 +95,7 @@ function newMap($mapfile) {
 
 	require_once __DIR__ . '/editor.new-map-preset.php';
 	wm_new_map_preset($map);
-	wm_editor_write_config($map, $mapfile);
+	wm_editor_write_config($map, $mapfile, true);
 }
 
 /**
@@ -120,7 +122,7 @@ function newMapCopy($mapfile) {
 
 		if (file_exists($sourcemap) && is_readable($sourcemap)) {
 			$map->ReadConfig($sourcemap);
-			wm_editor_write_config($map, $mapfile);
+			wm_editor_write_config($map, $mapfile, true);
 		}
 	}
 }
diff --git a/lib/poller-common.php b/lib/poller-common.php
index ca63f097..362516f3 100644
--- a/lib/poller-common.php
+++ b/lib/poller-common.php
@@ -144,6 +144,7 @@ function weathermap_repair_maps() {
 
 			if (file_exists($configfile) && is_writable($configfile)) {
 				$contents    = file($configfile) ?: [];
+				$revision = hash('sha256', implode('', $contents));
 
 				foreach ($contents as $line) {
 					if (strpos($line, 'BACKGROUND') !== false) {
@@ -272,7 +273,7 @@ function weathermap_repair_maps() {
 			if ($changes) {
 				wm_debug('Writing updated file to: ' . $configfile);
 				require_once __DIR__ . '/WeatherMap.config.php';
-				if (!\WeathermapConfig\atomicWrite($configfile, implode("\n", $outcontents), true)) {
+				if (!\WeathermapConfig\atomicWrite($configfile, implode("\n", $outcontents), true, $revision)) {
 					wm_warn('Unable to save repaired configuration: ' . $configfile . ' [WMPOLL13]');
 				}
 			} else {
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index ca89b5d3..2151bf89 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 13:03+1030\n"
+"POT-Creation-Date: 2026-10-12 21:53+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -1859,13 +1859,7 @@ msgid "The new Map with the name %s was created using config file %s"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
-#, php-format
-msgid "The new Map %s was copied, but its title could not be updated in the config file %s"
-msgstr ""
-
-#: weathermap-cacti-plugin-mgmt.php
-#, php-format
-msgid "The new Map with the name %s was unable to create the config file %s"
+msgid "Could not save the map configuration."
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index df55f377..2f4fb4cf 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -44,6 +44,7 @@ function fopen($path, $mode) {
 	 */
 	function flock($stream, $mode) {
 		if (($GLOBALS['config_fault'] ?? '') === 'lock' && $mode === LOCK_EX) return false;
+		if (($mode & LOCK_EX) && isset($GLOBALS['config_before_lock'])) ($GLOBALS['config_before_lock'])();
 		return \flock($stream, $mode);
 	}
 	/**
@@ -204,6 +205,44 @@ function atomic_assert($condition, $message) {
 		atomic_assert(!\WeathermapConfig\acquire($dir . '/missing'), 'missing lock directory rejected');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/deleted.conf', 'Replacement', true), 'deleted existing maps are not recreated');
 		atomic_assert(is_file($dir . '/.weathermap-config.lock'), 'arbitrary output uses its destination directory lock');
+		atomic_assert(!\WeathermapConfig\atomicWrite($file, 'Overwrite', false, null, true), 'create-only destination refuses existing files');
+		$first = new \WeatherMap; $second = new \WeatherMap;
+		$first->ReadConfig($file); $second->ReadConfig($file);
+		$first->title = 'First edit'; $second->title = 'Stale edit';
+		atomic_assert($first->WriteConfig($file), 'first revision saves');
+		$current = file_get_contents($file);
+		atomic_assert(!$second->WriteConfig($file) && file_get_contents($file) === $current, 'stale reader cannot overwrite the first edit');
+		$first->title = 'Next edit';
+		atomic_assert($first->WriteConfig($file), 'successful save updates its revision for subsequent writes');
+		$raw = new \WeatherMap; wm_editor_read_config($raw, $file);
+		$raw->ReadConfig("TITLE Fragment edit\n");
+		file_put_contents($file, $original);
+		http_response_code(200);
+		atomic_assert(!wm_editor_write_config($raw, $file) && http_response_code() === 500 && file_get_contents($file) === $original, 'raw fragment edits retain the original request revision');
+		if (function_exists('pcntl_fork')) {
+			$createFile = $dir . '/create.conf';
+			$lock = \WeathermapConfig\acquire($dir); $children = [];
+			for ($index = 0; $index < 2; $index++) {
+				$child = pcntl_fork();
+				if ($child === 0) {
+					\fclose($lock);
+					$GLOBALS['config_before_lock'] = function() use ($dir, $index) { file_put_contents($dir . '/create-ready-' . $index, 'ready'); };
+					$saved = \WeathermapConfig\atomicWrite($createFile, 'Creator ' . $index, false, null, true);
+					file_put_contents($dir . '/create-result-' . $index, $saved ? '1' : '0');
+					exit(0);
+				}
+				$children[] = $child;
+			}
+			for ($wait = 0; $wait < 100 && cacti_count(glob($dir . '/create-ready-*')) < 2; $wait++) usleep(10000);
+			\WeathermapConfig\release($lock);
+			foreach ($children as $child) pcntl_waitpid($child, $status);
+			atomic_assert((int)file_get_contents($dir . '/create-result-0') + (int)file_get_contents($dir . '/create-result-1') === 1, 'exactly one concurrent creator commits');
+			atomic_assert(in_array(file_get_contents($createFile), ['Creator 0', 'Creator 1'], true), 'winning creator content remains intact');
+		}
+		$crlfFile = $dir . '/crlf.conf';
+		$crlf = "WIDTH 600\r\nHEIGHT 300\r\n"; file_put_contents($crlfFile, $crlf);
+		$crlfMap = new \WeatherMap; $crlfMap->ReadConfig($crlfFile);
+		atomic_assert($crlfMap->config_revision === hash('sha256', $crlf) && $crlfMap->WriteConfig($crlfFile), 'revision hashes preserve raw CRLF bytes');
 		$templateFile = $dir . '/templates.conf';
 		file_put_contents($templateFile, "NODE templateNode\n LABEL Template\nNODE A\n POSITION 10 10\nNODE B\n POSITION 50 50\nLINK templateLink\n WIDTH 8\nLINK trafficLink\n NODES A B\n");
 		$templateMap = new \WeatherMap; $templateMap->ReadConfig($templateFile);
@@ -228,6 +267,15 @@ function atomic_assert($condition, $message) {
 			$GLOBALS['config_fault'] = '';
 			weathermap_repair_maps();
 			atomic_assert(file_get_contents($repairFile) === 'BACKGROUND images/backgrounds/' . basename($repairImage), 'repair uses complete atomic replacement');
+			file_put_contents($repairFile, $legacy);
+			$newerRepair = 'TITLE Concurrent editor save' . "\n" . $legacy;
+			$GLOBALS['config_before_lock'] = function() use ($repairFile, $newerRepair) {
+				unset($GLOBALS['config_before_lock']);
+				file_put_contents($repairFile, $newerRepair);
+			};
+			$GLOBALS['weathermap_error_suppress'] = ['WMPOLL13'];
+			try { weathermap_repair_maps(); } finally { $GLOBALS['weathermap_error_suppress'] = $oldSuppress; }
+			atomic_assert(file_get_contents($repairFile) === $newerRepair, 'repair CAS preserves a concurrent editor save');
 		} finally {
 			$GLOBALS['config'] = $oldConfig;
 			unset($GLOBALS['__test_db_fetch_assoc']);
diff --git a/tests/Support/NoteAllocationRegression.php b/tests/Support/NoteAllocationRegression.php
new file mode 100644
index 00000000..dd2c689f
--- /dev/null
+++ b/tests/Support/NoteAllocationRegression.php
@@ -0,0 +1,69 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+namespace WeathermapNotes {
+	/**
+	 * Simulate an unavailable note canvas in an isolated rendering process.
+	 *
+	 * @param int $width Canvas width.
+	 * @param int $height Canvas height.
+	 * @return \GdImage|false
+	 */
+	function imagecreatetruecolor($width, $height) {
+		$GLOBALS['note_allocations']++;
+		if ($GLOBALS['note_allocations'] === ($GLOBALS['note_fail_at'] ?? 0)) return false;
+		if (($GLOBALS['note_fail_at'] ?? 0) === -1) throw new \ValueError('allocation unavailable');
+		return \imagecreatetruecolor($width, $height);
+	}
+}
+namespace {
+	require dirname(__DIR__) . '/bootstrap-unit.php';
+	chdir(dirname(__DIR__, 2));
+	require 'setup.php'; require 'lib/WeatherMap.class.php';
+	$dir = sys_get_temp_dir() . '/wm-note-allocation-' . bin2hex(random_bytes(4)); mkdir($dir);
+	try {
+		$file = $dir . '/map.conf';
+		file_put_contents($file, "WIDTH 400\nHEIGHT 200\nFONTDEFINE 100 docs/example/Vera.ttf 9\nNODE label\n LABEL Readable note\n LABELFONT 100\n LABELBGCOLOR none\n LABELOUTLINECOLOR none\n LABELFONTSHADOWCOLOR none\n POSITION 150 100\n SET editor_note 1\n");
+		foreach ([1, 2, 0] as $failure) {
+			$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = $failure;
+			$map = new \WeatherMap; $map->ReadConfig($file); $map->stamptext = '';
+			$output = $dir . '/render-' . $failure . '.png'; $map->DrawMap($output);
+			if (getimagesize($output)[0] !== ($failure ? 400 : 800)) throw new \RuntimeException('allocation fallback dimensions');
+			$image = imagecreatefrompng($output); $ink = 0; $scale = $failure ? 1 : 2;
+			for ($x = 110 * $scale; $x < 190 * $scale; $x++) {
+				for ($y = 90 * $scale; $y < 110 * $scale; $y++) if ((imagecolorat($image, $x, $y) & 0xffffff) === 0) $ink++;
+			}
+			if (!$ink) throw new \RuntimeException('fallback must retain readable note glyphs');
+			imagedestroy($image);
+		}
+		$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = 1;
+		if (wm_note_display_image($map, []) !== false) throw new \RuntimeException('direct display allocation failure');
+		$GLOBALS['note_fail_at'] = -1;
+		if (\WeathermapNotes\allocate(1, 1) !== false) throw new \RuntimeException('allocator exception fallback');
+		echo "Note canvas allocation fallback PASS\n";
+	} finally {
+		foreach (glob($dir . '/*') as $path) unlink($path);
+		rmdir($dir);
+	}
+}
diff --git a/tests/Unit/ConfigWriteAtomicTest.php b/tests/Unit/ConfigWriteAtomicTest.php
index 48736556..913fe485 100644
--- a/tests/Unit/ConfigWriteAtomicTest.php
+++ b/tests/Unit/ConfigWriteAtomicTest.php
@@ -26,6 +26,11 @@
 use PHPUnit\Framework\TestCase;
 
 final class ConfigWriteAtomicTest extends TestCase {
+	/**
+	 * Verify real engine persistence and coordinated filesystem failures.
+	 *
+	 * @return void
+	 */
 	#[RunInSeparateProcess]
 	#[PreserveGlobalState(false)]
 	public function testRealEngineRegression(): void {
diff --git a/tests/Unit/NoteAllocationTest.php b/tests/Unit/NoteAllocationTest.php
new file mode 100644
index 00000000..1f3734bd
--- /dev/null
+++ b/tests/Unit/NoteAllocationTest.php
@@ -0,0 +1,46 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\TestCase;
+
+final class NoteAllocationTest extends TestCase {
+	/**
+	 * Verify both note canvas failures retain logical rendering and glyphs.
+	 *
+	 * @return void
+	 */
+	#[RunInSeparateProcess]
+	#[PreserveGlobalState(false)]
+	public function testRealEngineRegression(): void {
+		ob_start();
+		try {
+			require dirname(__DIR__) . '/Support/NoteAllocationRegression.php';
+			$result = ob_get_contents();
+		} finally {
+			ob_end_clean();
+		}
+		self::assertSame("Note canvas allocation fallback PASS\n", $result);
+	}
+}
diff --git a/tests/Unit/WeathermapUpgradeTest.php b/tests/Unit/WeathermapUpgradeTest.php
index 9a3bdad8..fd63cdbd 100644
--- a/tests/Unit/WeathermapUpgradeTest.php
+++ b/tests/Unit/WeathermapUpgradeTest.php
@@ -21,6 +21,11 @@ final class WeathermapUpgradeTest extends TestCase {
 	protected function setUp(): void {
 		require_once __DIR__ . '/../../setup.php';
 		if (!function_exists('weathermap_repair_maps')) {
+			/**
+			 * Stub filesystem repair only within an isolated upgrade test.
+			 *
+			 * @return void
+			 */
 			function weathermap_repair_maps() {}
 		}
 		$GLOBALS['__test_db_calls'] = [];
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index 2293776e..28d68cde 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -2022,22 +2022,15 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 			$oldfile = $confdir . '/' . $map['configfile'];
 			$newfile = $confdir . '/' . $save['configfile'];
 
-			if (file_exists($oldfile)) {
-				if (copy($oldfile, $newfile)) {
-					$contents = file_get_contents($newfile);
-
-					if ($contents !== false) {
-						$contents = str_replace("TITLE {$map['titlecache']}", "TITLE {$save['titlecache']}", $contents);
-
-						file_put_contents($newfile, $contents);
-					} else {
-						raise_message('title_fail_' . $newid, __('The new Map %s was copied, but its title could not be updated in the config file %s', $save['titlecache'], $save['configfile'], 'weathermap'), MESSAGE_LEVEL_WARN);
-					}
-				} else {
-					raise_message('copy_fail_' . $newid, __('The new Map with the name %s was unable to create the config file %s', $save['titlecache'], $save['configfile'], 'weathermap'), MESSAGE_LEVEL_ERROR);
+			$contents = is_file($oldfile) ? file_get_contents($oldfile) : false;
+			if ($contents !== false) {
+				$contents = str_replace("TITLE {$map['titlecache']}", "TITLE {$save['titlecache']}", $contents);
+				require_once __DIR__ . '/lib/WeatherMap.config.php';
+				if (!\WeathermapConfig\atomicWrite($newfile, $contents, false, null, true)) {
+					raise_message('new_map_' . $newid, __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
 				}
 			} else {
-				raise_message('missing_fail_' . $newid, __('The new Map with the name %s was unable to locate the config file %s to copy', $save['titlecache'], $map['configfile'], 'weathermap'), MESSAGE_LEVEL_ERROR);
+				raise_message('new_map_' . $newid, __('The new Map with the name %s was unable to locate the config file %s to copy', $save['titlecache'], $map['configfile'], 'weathermap'), MESSAGE_LEVEL_ERROR);
 			}
 
 			weathermap_run_maps(__DIR__, true, [$newid]);

From f4b5fda864c55985b67118bb97cb79fc236eee63 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 21:57:07 +1030
Subject: [PATCH 14/35] Let unused note canvases release with the rendering
 scope

---
 lib/WeatherMap.class.php | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 3275932b..9377cb94 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -4196,8 +4196,6 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 				if ($noteForeground !== null) {
 					imagecopyresampled($image, $noteForeground, 0, 0, 0, 0, imagesx($image), imagesy($image), $this->width, $this->height);
 					imagedestroy($noteForeground);
-				} else {
-					imagedestroy($noteImages[1]);
 				}
 				$this->image = $image;
 			}

From 9f701fc186b4b866018e8bdce32535c48cd142dd Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Mon, 12 Oct 2026 23:21:49 +1030
Subject: [PATCH 15/35] Reject stale editor pages and reserve new maps before
 registration

---
 js/editor.js                                  |  7 ++-
 lib/editor.actions.php                        | 16 ++++--
 lib/editor.inc.php                            |  1 +
 locales/po/cacti.pot                          | 20 +++++---
 tests/Browser/EditorNotesTest.cjs             |  3 +-
 tests/Browser/EditorSaveFailureTest.cjs       |  3 +-
 tests/Support/ConfigWriteAtomicRegression.php | 39 +++++++++++++++
 tests/Support/MapDuplicatePayload.php         | 16 ++++--
 tests/bootstrap-unit.php                      |  2 +
 weathermap-cacti-plugin-mgmt.php              | 49 ++++++++++++-------
 10 files changed, 118 insertions(+), 38 deletions(-)

diff --git a/js/editor.js b/js/editor.js
index b61aeae4..da6ce624 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -913,12 +913,17 @@ function form_submit() {
 	var noteTarget = noteAction === 'set_note_properties' ? $('#note_name').val() : noteAction === 'move_node' ? $('#node_name').val() : $('#param').val();
 	var savingNote = noteAction === 'set_note_properties' || (['move_node', 'delete_node'].indexOf(noteAction) !== -1 && typeof WMNotes !== 'undefined' && WMNotes[noteTarget]);
 	var data = $('input, select, textarea').serialize();
+	if (typeof WMConfigRevision !== 'undefined') data += '&config_revision=' + encodeURIComponent(WMConfigRevision);
 
 	$.ajax({
 		type: 'POST',
 		url: editor_url,
 		data: data,
-		error: function() {
+		error: function(xhr) {
+			if (xhr && xhr.status === 409) {
+				window.alert(wmEditorText.staleError);
+				return;
+			}
 			if (savingNote) {
 				if (noteAction !== 'set_note_properties') show_note(noteTarget);
 				$('#wm-note-error').text(wmEditorText.noteError).show();
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index ff1210d6..63d5f6e1 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -64,6 +64,11 @@ function wm_editor_read_config($map, $mapfile) {
 		http_response_code(422);
 		return false;
 	}
+	$revision = get_nfilter_request_var('config_revision');
+	if ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals($map->config_revision, $revision))) {
+		http_response_code(409);
+		return false;
+	}
 	$map->editor_config_revision = $map->config_revision;
 	return true;
 }
@@ -139,6 +144,7 @@ function getMapJavaScript($mapfile) {
 	if (!wm_editor_read_config($map, $mapfile)) return;
 
 	print $map->asJS();
+	print 'var WMConfigRevision = ' . json_encode($map->config_revision) . ';';
 	print 'var WMNotes = ' . json_encode(wm_editor_note_data($map), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
 }
 
@@ -516,10 +522,6 @@ function setMapProperties($mapfile) {
 		$map->add_hint('background_sizing', $background_sizing);
 	}
 
-	db_execute_prepared('UPDATE weathermap_maps
-		SET titlecache = ?
-		WHERE configfile = ?',
-		[$map->title, basename($mapfile)]);
 
 	$inheritables = [
 		['link', 'width', 'map_linkdefaultwidth', 'float']
@@ -565,7 +567,11 @@ function setMapProperties($mapfile) {
 		}
 	}
 
-	wm_editor_write_config($map, $mapfile);
+	if (!wm_editor_write_config($map, $mapfile)) return;
+	db_execute_prepared('UPDATE weathermap_maps
+		SET titlecache = ?
+		WHERE configfile = ?',
+		[$map->title, basename($mapfile)]);
 }
 
 /**
diff --git a/lib/editor.inc.php b/lib/editor.inc.php
index 1c9da63b..80c5e87e 100644
--- a/lib/editor.inc.php
+++ b/lib/editor.inc.php
@@ -1020,6 +1020,7 @@ function getEditorJs() {
 		'iconMatchCount' => __('Matching icons: %s', '%s', 'weathermap'),
 		'iconNoMatches' => __('No matching icons', 'weathermap'),
 
+		'staleError' => __('This map has changed since you opened it. Reload the editor before saving your changes.', 'weathermap'),
 		'saveError' => __('Unable to save changes. Please try again.', 'weathermap'),
 		'currentInterface'     => __('Current interface', 'weathermap'),
 		'advanced'             => __('Advanced settings', 'weathermap'),
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 2151bf89..11c6a052 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 21:53+1030\n"
+"POT-Creation-Date: 2026-10-12 23:20+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -201,6 +201,10 @@ msgstr ""
 msgid "No matching icons"
 msgstr ""
 
+#: lib/editor.inc.php
+msgid "This map has changed since you opened it. Reload the editor before saving your changes."
+msgstr ""
+
 #: lib/editor.inc.php
 msgid "Unable to save changes. Please try again."
 msgstr ""
@@ -1854,17 +1858,17 @@ msgid "(No Title)"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
-#, php-format
-msgid "The new Map with the name %s was created using config file %s"
+msgid "Could not save the map configuration."
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
-msgid "Could not save the map configuration."
+#, php-format
+msgid "The new Map with the name %s was unable to locate the config file %s to copy"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
 #, php-format
-msgid "The new Map with the name %s was unable to locate the config file %s to copy"
+msgid "The new Map with the name %s was created using config file %s"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
@@ -2145,12 +2149,12 @@ msgid "The New Map File name %s already exists!"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
-#, php-format
-msgid "New Map file %s created from %s"
+msgid "The Source Map File name is not readable or does not exist!"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
-msgid "The Source Map File name is not readable or does not exist!"
+#, php-format
+msgid "New Map file %s created from %s"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
diff --git a/tests/Browser/EditorNotesTest.cjs b/tests/Browser/EditorNotesTest.cjs
index 83ddacb2..f5b47514 100644
--- a/tests/Browser/EditorNotesTest.cjs
+++ b/tests/Browser/EditorNotesTest.cjs
@@ -24,8 +24,9 @@ w.show_note('note1');assert.equal($('#note_text').val(),'Core\nMaintenance');ass
 $('#note_x,#note_y').attr('max',600);$('#note_clone').trigger('click');assert.equal($('#note_name').val(),'');assert.equal($('#note_x').val(),'70');
 w.show_note('note1');$('#note_move').trigger('click');assert.equal(moved,'note1');
 w.show_note('note1');$('#note_delete').trigger('click');assert.equal(deleted,'note1');assert.equal($('#param').val(),'note1');
+w.WMConfigRevision='a'.repeat(64);
 $.ajax=opts=>request=opts;w.show_note('note1');w.form_submit();
-assert.equal(request.type,'POST');assert.match(request.data,/action=set_note_properties/);assert.match(request.data,/note_name=note1/);
+assert.match(request.data,/config_revision=a{64}/);assert.equal(request.type,'POST');assert.match(request.data,/action=set_note_properties/);assert.match(request.data,/note_name=note1/);
 request.error();assert.equal($('#wm-note-error').text(),'Save failed');assert.notEqual($('#wm-note-error').css('display'),'none');assert.equal($('#note_name').val(),'note1');
 for(const action of ['move_node','delete_node']) {
  w.show_note('note1');$('#node_name,#param').val('note1');$('#action').val(action);w.form_submit();request.error();
diff --git a/tests/Browser/EditorSaveFailureTest.cjs b/tests/Browser/EditorSaveFailureTest.cjs
index 447a1c29..108b9acf 100644
--- a/tests/Browser/EditorSaveFailureTest.cjs
+++ b/tests/Browser/EditorSaveFailureTest.cjs
@@ -1,6 +1,7 @@
 const {JSDOM}=require('jsdom'),jquery=require('jquery'),fs=require('node:fs'),path=require('node:path'),assert=require('node:assert/strict');
-const dom=new JSDOM('<input id="action" value="set_map_properties"><input id="mapname" value="map.conf">',{runScripts:'outside-only'}),w=dom.window,$=jquery(w);w.$=w.jQuery=$;w.editor_url='/editor';w.wmEditorText={saveError:'Unable to save changes'};
+const dom=new JSDOM('<input id="action" value="set_map_properties"><input id="mapname" value="map.conf">',{runScripts:'outside-only'}),w=dom.window,$=jquery(w);w.$=w.jQuery=$;w.editor_url='/editor';w.wmEditorText={staleError:'Reload the editor',saveError:'Unable to save changes'};
 let request,message,closed=0,refreshed=0;$.ajax=opts=>request=opts;w.alert=text=>message=text;w.hide_all_dialogs=()=>closed++;$.get=()=>refreshed++;
 const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');w.eval(source.slice(source.indexOf('function form_submit()'),source.indexOf('function map_properties()')));
 w.form_submit();request.error();assert.equal(message,'Unable to save changes');assert.equal(closed,0);assert.equal(refreshed,0);assert.equal($('#action').val(),'set_map_properties');
+w.WMConfigRevision='b'.repeat(64);w.form_submit();assert.match(request.data,/config_revision=b{64}/);request.error({status:409});assert.equal(message,'Reload the editor');assert.equal(closed,0);assert.equal(refreshed,0);
 w.close();console.log('PASS: save failure reports retry and preserves the form');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 2f4fb4cf..aecd9104 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -214,6 +214,13 @@ function atomic_assert($condition, $message) {
 		atomic_assert(!$second->WriteConfig($file) && file_get_contents($file) === $current, 'stale reader cannot overwrite the first edit');
 		$first->title = 'Next edit';
 		atomic_assert($first->WriteConfig($file), 'successful save updates its revision for subsequent writes');
+		$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash('sha256', $original), 'node_name' => 'note1', 'x' => 90, 'y' => 90];
+		http_response_code(200); moveNode($file, 0);
+		atomic_assert(http_response_code() === 409 && file_get_contents($file) !== $original, 'stale loaded page cannot overwrite another user save');
+		$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash_file('sha256', $file)];
+		$matching = new \WeatherMap;
+		atomic_assert(wm_editor_read_config($matching, $file), 'matching loaded page revision accepted');
+		$GLOBALS['__test_nfilter_request'] = [];
 		$raw = new \WeatherMap; wm_editor_read_config($raw, $file);
 		$raw->ReadConfig("TITLE Fragment edit\n");
 		file_put_contents($file, $original);
@@ -281,6 +288,31 @@ function atomic_assert($condition, $message) {
 			unset($GLOBALS['__test_db_fetch_assoc']);
 			unlink($repairFile); unlink($repairImage);
 		}
+		$management = file_get_contents($plugin . '/weathermap-cacti-plugin-mgmt.php');
+		$start = strpos($management, 'function newMap(');
+		eval(str_replace(['__DIR__', 'function newMap('], [var_export($plugin, true), 'function wm_management_newMap('], substr($management, $start)));
+		$GLOBALS['weathermap_confdir'] = $dir;
+		foreach (['', 'map.conf'] as $source) {
+			$destination = $dir . '/management-create.conf';
+			$GLOBALS['config_before_lock'] = function() use ($destination) { file_put_contents($destination, 'Concurrent creator'); unset($GLOBALS['config_before_lock']); };
+			wm_management_newMap('management-create.conf', $source);
+			atomic_assert(file_get_contents($destination) === 'Concurrent creator', 'management create-only preserves concurrent destination');
+			unlink($destination);
+		}
+		$start = strpos($management, 'function map_get_next_name('); $end = strpos($management, "\n/**", $start);
+		eval(str_replace('__DIR__', var_export($plugin, true), substr($management, $start, $end - $start)));
+		$start = strpos($management, 'function map_duplicate('); $end = strpos($management, "\n/**", $start);
+		eval(str_replace('__DIR__', var_export($plugin, true), substr($management, $start, $end - $start)));
+		$duplicateSource = 'atomic-duplicate-' . bin2hex(random_bytes(4)) . '.conf';
+		file_put_contents($plugin . '/configs/' . $duplicateSource, "TITLE Source\n");
+		$GLOBALS['__test_db_fetch_row_prepared'] = fn () => ['configfile' => $duplicateSource, 'titlecache' => 'Source', 'group_id' => 1, 'active' => 'on', 'thumb_height' => 10, 'thumb_width' => 10, 'schedule' => '', 'archiving' => '',];
+		$GLOBALS['__test_db_calls'] = []; $GLOBALS['atomic_sql_saves'] = [];
+		$GLOBALS['__test_db_fetch_cell'] = fn () => 0;
+		$GLOBALS['__test_sql_save'] = function($record) { $GLOBALS['atomic_sql_saves'][] = $record; return 1; }; $GLOBALS['config_fault'] = 'rename';
+		try {
+			map_duplicate(1, 'Clone', 'clone');
+			atomic_assert($GLOBALS['__test_db_calls'] === [] && $GLOBALS['atomic_sql_saves'] === [], 'failed clone never registers auth or settings or invokes runner');
+		} finally { unset($GLOBALS['__test_db_fetch_row_prepared'], $GLOBALS['__test_sql_save'], $GLOBALS['__test_db_fetch_cell']); unlink($plugin . '/configs/' . $duplicateSource); $GLOBALS['config_fault'] = ''; }
 		$deletedMap = new \WeatherMap; $deletedMap->ReadConfig($file);
 		unlink($file);
 		atomic_assert(!$deletedMap->WriteConfig($file) && !file_exists($file), 'saving a previously loaded deleted map fails without resurrection');
@@ -288,6 +320,13 @@ function atomic_assert($condition, $message) {
 		$GLOBALS['config_fault'] = 'rename';
 		$map = new \WeatherMap; $map->ReadConfig($file); $map->title = 'Changed';
 		atomic_assert(!$map->WriteConfig($file) && file_get_contents($file) === $original, 'engine failure preserves original');
+		$GLOBALS['__test_nfilter_request'] = ['map_title' => 'Failed title', 'map_legend' => 'Traffic', 'map_stamp' => 'Created', 'map_width' => 600, 'map_height' => 300, 'map_bgfile' => '--NONE--', 'map_linkdefaultwidth' => 7, 'map_linkdefaultbwin' => '100M', 'map_linkdefaultbwout' => '100M'];
+		$GLOBALS['__test_db_calls'] = [];
+		http_response_code(200); setMapProperties($file);
+		atomic_assert(http_response_code() === 500 && $GLOBALS['__test_db_calls'] === [], 'failed properties save cannot change titlecache');
+		$GLOBALS['config_fault'] = ''; http_response_code(200); setMapProperties($file);
+		atomic_assert(http_response_code() === 200 && cacti_count($GLOBALS['__test_db_calls']) === 1, 'successful properties save updates titlecache');
+		file_put_contents($file, $original); $GLOBALS['config_fault'] = 'rename';
 		$GLOBALS['__test_nfilter_request'] = ['node_name' => 'note1', 'param' => 'note1', 'x' => '70', 'y' => '80'];
 		{
 			http_response_code(200); moveNode($file, 0);
diff --git a/tests/Support/MapDuplicatePayload.php b/tests/Support/MapDuplicatePayload.php
index ad558dd5..64da377e 100644
--- a/tests/Support/MapDuplicatePayload.php
+++ b/tests/Support/MapDuplicatePayload.php
@@ -14,7 +14,11 @@
 if ($start === false || $end === false) {
 	throw new RuntimeException('Unable to locate the map duplication function.');
 }
-eval(substr($source, $start, $end - $start));
+$fixture = sys_get_temp_dir() . '/wm-duplicate-' . bin2hex(random_bytes(5));
+mkdir($fixture); mkdir($fixture . '/configs');
+symlink(dirname(__DIR__, 2) . '/lib', $fixture . '/lib');
+file_put_contents($fixture . '/configs/Original.conf', "TITLE Original Map\n");
+eval(str_replace('__DIR__', var_export($fixture, true), substr($source, $start, $end - $start)));
 
 /**
  * Return the source map fixture.
@@ -92,5 +96,11 @@ function sql_save($payload, $table) {
 	return 0;
 }
 
-map_duplicate(5, '<map_title> Copy');
-print json_encode($GLOBALS['duplicate_save'], JSON_THROW_ON_ERROR);
+try {
+	map_duplicate(5, '<map_title> Copy');
+	print json_encode($GLOBALS['duplicate_save'], JSON_THROW_ON_ERROR);
+} finally {
+	foreach (glob($fixture . '/configs/*') as $file) unlink($file);
+	if (is_file($fixture . '/configs/.weathermap-config.lock')) unlink($fixture . '/configs/.weathermap-config.lock');
+	unlink($fixture . '/lib'); rmdir($fixture . '/configs'); rmdir($fixture);
+}
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index de6f6e41..7cebba05 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -104,6 +104,7 @@ function db_fetch_row_prepared($sql, $p = []) {
 
 if (!function_exists('db_fetch_cell')) {
 	function db_fetch_cell($sql) {
+		if (isset($GLOBALS['__test_db_fetch_cell'])) return ($GLOBALS['__test_db_fetch_cell'])($sql);
 		return '';
 	}
 }
@@ -339,6 +340,7 @@ function is_error_message() {
 
 if (!function_exists('sql_save')) {
 	function sql_save($a, $t, $k = 'id') {
+		if (isset($GLOBALS['__test_sql_save'])) return ($GLOBALS['__test_sql_save'])($a, $t, $k);
 		return isset($a['id']) ? $a['id'] : 1;
 	}
 }
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index 28d68cde..0edff281 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -1998,6 +1998,24 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 		$save['duration']     = 0;
 		$save['last_runtime'] = 0;
 
+		$confdir = __DIR__ . '/configs';
+
+		$oldfile = $confdir . '/' . $map['configfile'];
+		$newfile = $confdir . '/' . $save['configfile'];
+
+		$contents = is_file($oldfile) ? file_get_contents($oldfile) : false;
+		if ($contents !== false) {
+			$contents = str_replace("TITLE {$map['titlecache']}", "TITLE {$save['titlecache']}", $contents);
+			require_once __DIR__ . '/lib/WeatherMap.config.php';
+			if (!\WeathermapConfig\atomicWrite($newfile, $contents, false, null, true)) {
+				raise_message('map_message', __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
+				return;
+			}
+		} else {
+			raise_message('map_message', __('The new Map with the name %s was unable to locate the config file %s to copy', $save['titlecache'], $map['configfile'], 'weathermap'), MESSAGE_LEVEL_ERROR);
+			return;
+		}
+
 		$newid = sql_save($save, 'weathermap_maps');
 
 		if ($newid) {
@@ -2017,22 +2035,6 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 
 			raise_message('new_map_' . $newid, __('The new Map with the name %s was created using config file %s', $save['titlecache'], $save['configfile'], 'weathermap'), MESSAGE_LEVEL_INFO);
 
-			$confdir = __DIR__ . '/configs';
-
-			$oldfile = $confdir . '/' . $map['configfile'];
-			$newfile = $confdir . '/' . $save['configfile'];
-
-			$contents = is_file($oldfile) ? file_get_contents($oldfile) : false;
-			if ($contents !== false) {
-				$contents = str_replace("TITLE {$map['titlecache']}", "TITLE {$save['titlecache']}", $contents);
-				require_once __DIR__ . '/lib/WeatherMap.config.php';
-				if (!\WeathermapConfig\atomicWrite($newfile, $contents, false, null, true)) {
-					raise_message('new_map_' . $newid, __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
-				}
-			} else {
-				raise_message('new_map_' . $newid, __('The new Map with the name %s was unable to locate the config file %s to copy', $save['titlecache'], $map['configfile'], 'weathermap'), MESSAGE_LEVEL_ERROR);
-			}
-
 			weathermap_run_maps(__DIR__, true, [$newid]);
 		}
 	}
@@ -3432,11 +3434,17 @@ function newMap($mapfile, $sourcemapfile = '', $title = '') {
 		if ($mapfile != '') {
 			if ($sourcemapfile != '') {
 				if (file_exists($sourcemapfile) && is_readable($sourcemapfile)) {
-					$map->ReadConfig($sourcemapfile);
+					if (!$map->ReadConfig($sourcemapfile)) {
+					raise_message('map_message', __('The Source Map File name is not readable or does not exist!', 'weathermap'), MESSAGE_LEVEL_ERROR);
+					return;
+				}
 					if ($title !== '') {
 						$map->title = $title;
 					}
-					$map->WriteConfig($mapfile);
+					if (!$map->WriteConfig($mapfile, true)) {
+					raise_message('map_message', __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
+					return;
+				}
 					raise_message('map_message', __('New Map file %s created from %s', basename($mapfile), basename($sourcemapfile), 'weathermap'), MESSAGE_LEVEL_INFO);
 				} else {
 					raise_message('map_message', __('The Source Map File name is not readable or does not exist!', 'weathermap'), MESSAGE_LEVEL_ERROR);
@@ -3445,7 +3453,10 @@ function newMap($mapfile, $sourcemapfile = '', $title = '') {
 				if ($title !== '') {
 					$map->title = $title;
 				}
-				$map->WriteConfig($mapfile);
+				if (!$map->WriteConfig($mapfile, true)) {
+					raise_message('map_message', __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
+					return;
+				}
 				raise_message('map_message', __('New Map file %s created.', basename($mapfile), 'weathermap'), MESSAGE_LEVEL_INFO);
 			}
 		} else {

From d9c907a15d8f8d5e0aa17ff1b4de553736495259 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:09:43 +1030
Subject: [PATCH 16/35] Keep assets and clone reservations safe on failed saves

---
 lib/WeatherMap.config.php                     |  10 +-
 lib/editor.actions.php                        |  28 +--
 lib/poller-common.php                         | 216 ++++++++++--------
 tests/Support/ConfigWriteAtomicRegression.php |  77 ++++++-
 tests/Support/MapDuplicatePayload.php         |   5 +
 weathermap-cacti-plugin-mgmt.php              |  57 +++--
 6 files changed, 244 insertions(+), 149 deletions(-)

diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index b89db55e..0e9377a8 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -82,17 +82,21 @@ function writeAll($stream, $contents) {
  * @param bool $mustExist Refuse to recreate an existing map deleted during editing.
  * @param string|null $expectedRevision SHA-256 of the snapshot being edited.
  * @param bool $createOnly Refuse to replace an existing destination.
+ * @param resource|null $heldLock Optional caller-owned mutex for this destination directory.
  *
  * @return bool Success; failures preserve the existing configuration.
  */
-function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision = null, $createOnly = false) {
+function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision = null, $createOnly = false, $heldLock = null) {
 	if (strpos($filename, '://') !== false) return false;
 	if (is_link($filename)) $filename = realpath($filename);
 	if ($filename === false || !is_dir(dirname($filename)) || !is_writable(dirname($filename))) return false;
 	if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
 	$existed = file_exists($filename);
 	$mustExist = $mustExist || $existed;
-	$lock = acquire(dirname($filename));
+	$ownsLock = $heldLock === null;
+	$lockPath = realpath(dirname($filename) . '/.weathermap-config.lock');
+	if (!$ownsLock && ($lockPath === false || !is_resource($heldLock) || get_resource_type($heldLock) !== 'stream' || realpath(stream_get_meta_data($heldLock)['uri']) !== $lockPath)) return false;
+	$lock = $ownsLock ? acquire(dirname($filename)) : $heldLock;
 	if (!$lock) return false;
 	$temp = false;
 	$stream = false;
@@ -117,6 +121,6 @@ function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision
 	} finally {
 		if (is_resource($stream)) fclose($stream);
 		if ($temp !== false && file_exists($temp)) unlink($temp);
-		release($lock);
+		if ($ownsLock) release($lock);
 	}
 }
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 63d5f6e1..e81f2391 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -83,7 +83,9 @@ function wm_editor_read_config($map, $mapfile) {
  */
 function wm_editor_write_config($map, $mapfile, $createOnly = false) {
 	if (!$map->WriteConfig($mapfile, $createOnly, $map->editor_config_revision)) {
-		http_response_code(500);
+		$current = is_file($mapfile) ? @hash_file('sha256', $mapfile) : false;
+		$stale = $map->editor_config_revision !== null && $current !== false && $current !== $map->editor_config_revision;
+		http_response_code($stale ? 409 : 500);
 		return false;
 	}
 	return true;
@@ -274,17 +276,7 @@ function setNodeConfig($mapfile) {
 	if (isset($map->nodes[$node_name])) {
 		$map->nodes[$node_name]->config_override = $node_config;
 
-		wm_editor_write_config($map, $mapfile);
-
-		// now clear and reload the map object, because the in-memory one is out of sync
-		// - we don't know what changes the user made here, so we just have to reload.
-		unset($map);
-
-		$map = new WeatherMap;
-
-		$map->context = 'editor';
-
-		if (!wm_editor_read_config($map, $mapfile)) return;
+		if (!wm_editor_write_config($map, $mapfile)) return;
 	}
 }
 
@@ -305,17 +297,7 @@ function setLinkConfig($mapfile) {
 	if (isset($map->links[$link_name])) {
 		$map->links[$link_name]->config_override = $link_config;
 
-		wm_editor_write_config($map, $mapfile);
-
-		// now clear and reload the map object, because the in-memory one is out of sync
-		// - we don't know what changes the user made here, so we just have to reload.
-		unset($map);
-
-		$map = new WeatherMap;
-
-		$map->context = 'editor';
-
-		if (!wm_editor_read_config($map, $mapfile)) return;
+		if (!wm_editor_write_config($map, $mapfile)) return;
 	}
 }
 
diff --git a/lib/poller-common.php b/lib/poller-common.php
index 362516f3..57192986 100644
--- a/lib/poller-common.php
+++ b/lib/poller-common.php
@@ -111,6 +111,19 @@ function weathermap_check_cron($time, $string) {
 	return ($matched);
 }
 
+/**
+ * Stage a complete legacy asset copy while keeping every old map reference usable.
+ *
+ * @param string $old Source asset path.
+ * @param string $new New asset path.
+ * @return bool Whether a complete copy was reserved at the destination.
+ */
+function weathermap_stage_asset_copy($old, $new) {
+	require_once __DIR__ . '/WeatherMap.config.php';
+	$contents = @file_get_contents($old);
+	return $contents !== false && \WeathermapConfig\atomicWrite($new, $contents, false, null, true);
+}
+
 /**
  * @return void
  */
@@ -142,45 +155,54 @@ function weathermap_repair_maps() {
 			wm_debug('---------------------------------------------');
 			wm_debug("Processing Map File $configfile");
 
-			if (file_exists($configfile) && is_writable($configfile)) {
-				$contents    = file($configfile) ?: [];
-				$revision = hash('sha256', implode('', $contents));
-
-				foreach ($contents as $line) {
-					if (strpos($line, 'BACKGROUND') !== false) {
-						$parts   = explode('BACKGROUND', $line);
-						$dirgood = false;
-						$bgfile  = trim($parts[1]);
+			if (!is_file($configfile) || !is_writable($configfile)) continue;
+			$contents = file($configfile);
+			if ($contents === false) continue;
+			$revision = hash('sha256', implode('', $contents));
+			require_once __DIR__ . '/WeatherMap.config.php';
+			$repairLock = \WeathermapConfig\acquire($confdir);
+			if (!$repairLock) { wm_warn('Unable to lock repaired configuration: ' . $configfile . ' [WMPOLL13]'); continue; }
+			try {
+				if (file_exists($configfile) && is_writable($configfile)) {
 
-						if (strpos($bgfile, 'images/backgrounds/') === false) {
-							wm_debug('Found background file reference in old location: ' . $bgfile);
+					foreach ($contents as $line) {
+						if (strpos($line, 'BACKGROUND') !== false) {
+							$parts   = explode('BACKGROUND', $line);
+							$dirgood = false;
+							$bgfile  = trim($parts[1]);
 
-							if (file_exists($mydir . 'images/backgrounds/' . basename($bgfile))) {
-								wm_debug('Background file found in new location! Updating path only.');
+							if (strpos($bgfile, 'images/backgrounds/') === false) {
+								wm_debug('Found background file reference in old location: ' . $bgfile);
 
-								$line = 'BACKGROUND images/backgrounds/' . basename($bgfile);
+								if (file_exists($mydir . 'images/backgrounds/' . basename($bgfile))) {
+									wm_debug('Background file found in new location! Updating path only.');
 
-								$changes++;
-							} else {
-								wm_debug('Background file not found in new location! Attempting to move.');
+									$line = 'BACKGROUND images/backgrounds/' . basename($bgfile);
 
-								if (!is_dir($mydir . 'images/backgrounds')) {
-									$dirgood = mkdir($mydir . 'images/backgrounds');
+									$changes++;
 								} else {
-									$dirgood = true;
-								}
+									wm_debug('Background file not found in new location! Attempting to move.');
 
-								if ($dirgood && file_exists($mydir . $bgfile)) {
-									wm_debug('Found background file on disk: ' . $mydir . $bgfile . ' relocating!');
+									if (!is_dir($mydir . 'images/backgrounds')) {
+										$dirgood = mkdir($mydir . 'images/backgrounds');
+									} else {
+										$dirgood = true;
+									}
+
+									if ($dirgood && file_exists($mydir . $bgfile)) {
+										wm_debug('Found background file on disk: ' . $mydir . $bgfile . ' relocating!');
 
-									$old = $mydir . $bgfile;
-									$new = $mydir . 'images/backgrounds/' . basename($bgfile);
+										$old = $mydir . $bgfile;
+										$new = $mydir . 'images/backgrounds/' . basename($bgfile);
 
-									if (is_writable($mydir . $bgfile)) {
-										if (is_writeable($old) && is_writeable(dirname($new)) && is_writeable($new)) {
-											if (rename($old, $new)) {
-												$line = 'BACKGROUND images/backgrounds/' . basename($bgfile);
-												$changes++;
+										if (is_readable($mydir . $bgfile)) {
+											if (is_readable($old) && is_writeable(dirname($new))) {
+												if (weathermap_stage_asset_copy($old, $new)) {
+													$line = 'BACKGROUND images/backgrounds/' . basename($bgfile);
+													$changes++;
+												} else {
+													wm_warn(sprintf('Unable to move BACKGROUND %s to %s, Permission error [WMPOLL09]', $old, $new));
+												}
 											} else {
 												wm_warn(sprintf('Unable to move BACKGROUND %s to %s, Permission error [WMPOLL09]', $old, $new));
 											}
@@ -188,65 +210,65 @@ function weathermap_repair_maps() {
 											wm_warn(sprintf('Unable to move BACKGROUND %s to %s, Permission error [WMPOLL09]', $old, $new));
 										}
 									} else {
-										wm_warn(sprintf('Unable to move BACKGROUND %s to %s, Permission error [WMPOLL09]', $old, $new));
+										wm_warn(sprintf('BACKGROUND file not found on disk: %s skipping! [WMPOLL10]', $mydir . $bgfile));
 									}
-								} else {
-									wm_warn(sprintf('BACKGROUND file not found on disk: %s skipping! [WMPOLL10]', $mydir . $bgfile));
 								}
+							} elseif (strpos($bgfile, 'images/backgrounds/') !== false) {
+								wm_debug('Found background file reference in correct location: ' . $bgfile);
 							}
-						} elseif (strpos($bgfile, 'images/backgrounds/') !== false) {
-							wm_debug('Found background file reference in correct location: ' . $bgfile);
-						}
-					} elseif (strpos($line, 'ICON') !== false) {
-						/**
-						 * We are looking at the ICON parameter.  It can take two forms.  The first form is
-						 * a path to a filename, or the pattern as follows
-						 *
-						 * ICON height width type
-						 *
-						 * Types include:
-						 *
-						 * - box - a square cornered box
-						 * - rbox - a round cornered box
-						 * - round - a circle or an ellipse
-						 * - inpie & outpie to produce a pie chart of either the in or out value relative to it's maximum
-						 * - nlink - to produce a circular 'yin-yang' style symbox with each half showing the in and out values
-						 *
-						 */
-						$parts   = explode('ICON', $line);
-						$dirgood = false;
-						$attribs = explode(' ', $parts[1]);
-
-						if (cacti_sizeof($attribs) == 1) {
-							$objfile = trim($parts[1]);
-
-							if (strpos($objfile, 'images/objects/') === false) {
-								wm_debug('Found icon file reference in old location: ' . $objfile);
-
-								if (file_exists($mydir . 'images/objects/' . basename($objfile))) {
-									wm_debug('Found file already in new location! Updating path only.');
-
-									$line = "\tICON images/objects/" . basename($objfile);
-
-									$changes++;
-								} else {
-									if (!is_dir($mydir . 'images/objects')) {
-										$dirgood = mkdir($mydir . 'images/objects');
+						} elseif (strpos($line, 'ICON') !== false) {
+							/**
+							 * We are looking at the ICON parameter.  It can take two forms.  The first form is
+							 * a path to a filename, or the pattern as follows
+							 *
+							 * ICON height width type
+							 *
+							 * Types include:
+							 *
+							 * - box - a square cornered box
+							 * - rbox - a round cornered box
+							 * - round - a circle or an ellipse
+							 * - inpie & outpie to produce a pie chart of either the in or out value relative to it's maximum
+							 * - nlink - to produce a circular 'yin-yang' style symbox with each half showing the in and out values
+							 *
+							 */
+							$parts   = explode('ICON', $line);
+							$dirgood = false;
+							$attribs = preg_split('/\s+/', trim($parts[1]));
+
+							if (cacti_sizeof($attribs) == 1) {
+								$objfile = trim($parts[1]);
+
+								if (strpos($objfile, 'images/objects/') === false) {
+									wm_debug('Found icon file reference in old location: ' . $objfile);
+
+									if (file_exists($mydir . 'images/objects/' . basename($objfile))) {
+										wm_debug('Found file already in new location! Updating path only.');
+
+										$line = "\tICON images/objects/" . basename($objfile);
+
+										$changes++;
 									} else {
-										$dirgood = true;
-									}
+										if (!is_dir($mydir . 'images/objects')) {
+											$dirgood = mkdir($mydir . 'images/objects');
+										} else {
+											$dirgood = true;
+										}
 
-									if ($dirgood && file_exists($mydir . $objfile)) {
-										wm_debug('Object file found on disk: ' . $mydir . $objfile . ' relocating!');
+										if ($dirgood && file_exists($mydir . $objfile)) {
+											wm_debug('Object file found on disk: ' . $mydir . $objfile . ' relocating!');
 
-										$old = $mydir . $objfile;
-										$new = $mydir . 'images/objects/' . basename($objfile);
+											$old = $mydir . $objfile;
+											$new = $mydir . 'images/objects/' . basename($objfile);
 
-										if (is_writable($mydir . $objfile)) {
-											if (is_writeable($old) && is_writeable(dirname($new)) && is_writeable($new)) {
-												if (rename($old, $new)) {
-													$line = "\tICON images/objects/" . basename($objfile);
-													$changes++;
+											if (is_readable($mydir . $objfile)) {
+												if (is_readable($old) && is_writeable(dirname($new))) {
+													if (weathermap_stage_asset_copy($old, $new)) {
+														$line = "\tICON images/objects/" . basename($objfile);
+														$changes++;
+													} else {
+														wm_warn(sprintf('Unable to move ICONFILE %s to %s, Permission error [WMPOLL11]', $old, $new));
+													}
 												} else {
 													wm_warn(sprintf('Unable to move ICONFILE %s to %s, Permission error [WMPOLL11]', $old, $new));
 												}
@@ -254,31 +276,29 @@ function weathermap_repair_maps() {
 												wm_warn(sprintf('Unable to move ICONFILE %s to %s, Permission error [WMPOLL11]', $old, $new));
 											}
 										} else {
-											wm_warn(sprintf('Unable to move ICONFILE %s to %s, Permission error [WMPOLL11]', $old, $new));
+											wm_warn(sprintf('ICONFILE file not found on disk: %s skipping! [WMPOLL12]', $mydir . $objfile));
 										}
-									} else {
-										wm_warn(sprintf('ICONFILE file not found on disk: %s skipping! [WMPOLL12]', $mydir . $objfile));
 									}
+								} elseif (strpos($objfile, 'images/objects/') !== false) {
+									wm_debug('Found object file reference in correct location: ' . $objfile);
 								}
-							} elseif (strpos($objfile, 'images/objects/') !== false) {
-								wm_debug('Found object file reference in correct location: ' . $objfile);
 							}
 						}
-					}
 
-					$outcontents[] = rtrim($line);
+						$outcontents[] = rtrim($line);
+					}
 				}
-			}
 
-			if ($changes) {
-				wm_debug('Writing updated file to: ' . $configfile);
-				require_once __DIR__ . '/WeatherMap.config.php';
-				if (!\WeathermapConfig\atomicWrite($configfile, implode("\n", $outcontents), true, $revision)) {
-					wm_warn('Unable to save repaired configuration: ' . $configfile . ' [WMPOLL13]');
+				if ($changes) {
+					wm_debug('Writing updated file to: ' . $configfile);
+					require_once __DIR__ . '/WeatherMap.config.php';
+					if (!\WeathermapConfig\atomicWrite($configfile, implode("\n", $outcontents), true, $revision, false, $repairLock)) {
+						wm_warn('Unable to save repaired configuration: ' . $configfile . ' [WMPOLL13]');
+					}
+				} else {
+					wm_debug('File has correct BACKGROUND and ICON paths: ' . $configfile);
 				}
-			} else {
-				wm_debug('File has correct BACKGROUND and ICON paths: ' . $configfile);
-			}
+			} finally { \WeathermapConfig\release($repairLock); }
 		}
 	}
 }
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index aecd9104..6ddd100a 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -225,7 +225,7 @@ function atomic_assert($condition, $message) {
 		$raw->ReadConfig("TITLE Fragment edit\n");
 		file_put_contents($file, $original);
 		http_response_code(200);
-		atomic_assert(!wm_editor_write_config($raw, $file) && http_response_code() === 500 && file_get_contents($file) === $original, 'raw fragment edits retain the original request revision');
+		atomic_assert(!wm_editor_write_config($raw, $file) && http_response_code() === 409 && file_get_contents($file) === $original, 'raw fragment edits retain the original request revision');
 		if (function_exists('pcntl_fork')) {
 			$createFile = $dir . '/create.conf';
 			$lock = \WeathermapConfig\acquire($dir); $children = [];
@@ -246,6 +246,17 @@ function atomic_assert($condition, $message) {
 			atomic_assert((int)file_get_contents($dir . '/create-result-0') + (int)file_get_contents($dir . '/create-result-1') === 1, 'exactly one concurrent creator commits');
 			atomic_assert(in_array(file_get_contents($createFile), ['Creator 0', 'Creator 1'], true), 'winning creator content remains intact');
 		}
+		$held = \WeathermapConfig\acquire($dir);
+		atomic_assert(\WeathermapConfig\atomicWrite($dir . '/held.conf', 'Held write', false, null, true, $held), 'caller-owned mutex supports atomic creation');
+		if (function_exists('pcntl_fork')) {
+			$child = pcntl_fork();
+			if ($child === 0) { $probe = \fopen($dir . '/.weathermap-config.lock', 'rb'); $busy = !\flock($probe, LOCK_EX | LOCK_NB); exit($busy ? 0 : 1); }
+			pcntl_waitpid($child, $status);
+			atomic_assert(pcntl_wexitstatus($status) === 0, 'atomicWrite leaves caller mutex held');
+		}
+		\WeathermapConfig\release($held);
+		$wrong = \fopen($file, 'rb');
+		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
 		$crlfFile = $dir . '/crlf.conf';
 		$crlf = "WIDTH 600\r\nHEIGHT 300\r\n"; file_put_contents($crlfFile, $crlf);
 		$crlfMap = new \WeatherMap; $crlfMap->ReadConfig($crlfFile);
@@ -288,6 +299,33 @@ function atomic_assert($condition, $message) {
 			unset($GLOBALS['__test_db_fetch_assoc']);
 			unlink($repairFile); unlink($repairImage);
 		}
+		$stageSource = $plugin . '/legacy-stage-' . bin2hex(random_bytes(4)) . '.png';
+		$stageTarget = $plugin . '/images/backgrounds/' . basename($stageSource);
+		file_put_contents($stageSource, 'Legacy asset bytes');
+		$stageConfig = $plugin . '/configs/' . basename($stageSource) . '.conf';
+		$stageLegacy = 'BACKGROUND ' . basename($stageSource) . "\n";
+		file_put_contents($stageConfig, $stageLegacy);
+		$GLOBALS['__test_db_fetch_assoc'] = fn () => [['configfile' => basename($stageConfig)]];
+		$oldConfig = $GLOBALS['config']; $GLOBALS['config']['base_path'] = dirname($plugin, 2);
+		$oldSuppress = $GLOBALS['weathermap_error_suppress'] ?? [];
+		try {
+			// A staged copy succeeds, but the config CAS must fail after a concurrent save.
+			$staged = weathermap_stage_asset_copy($stageSource, $stageTarget);
+			atomic_assert($staged && is_file($stageSource) && file_get_contents($stageTarget) === 'Legacy asset bytes', 'staging keeps original and complete destination');
+			$stageNewer = "TITLE Concurrent repair edit\n" . $stageLegacy;
+			$GLOBALS['config_before_lock'] = function() use ($stageConfig, $stageNewer) { unset($GLOBALS['config_before_lock']); file_put_contents($stageConfig, $stageNewer); };
+			$GLOBALS['weathermap_error_suppress'] = ['WMPOLL13']; weathermap_repair_maps();
+			atomic_assert(file_get_contents($stageConfig) === $stageNewer && is_file($stageSource), 'rejected repair leaves original asset usable');
+			$GLOBALS['config_fault'] = 'rename'; weathermap_repair_maps();
+			atomic_assert(file_get_contents($stageConfig) === $stageNewer && is_file($stageSource), 'I/O failure leaves original asset usable');
+			$GLOBALS['config_fault'] = ''; unlink($stageTarget); file_put_contents($stageConfig, $stageLegacy);
+			weathermap_repair_maps();
+			atomic_assert(str_contains(file_get_contents($stageConfig), 'images/backgrounds/') && is_file($stageSource) && is_file($stageTarget), 'successful relocation copies rather than removes legacy asset');
+		} finally {
+			$GLOBALS['config'] = $oldConfig; $GLOBALS['weathermap_error_suppress'] = $oldSuppress; $GLOBALS['config_fault'] = '';
+			unset($GLOBALS['__test_db_fetch_assoc'], $GLOBALS['config_before_lock']);
+			foreach ([$stageSource, $stageTarget, $stageConfig] as $path) if (is_file($path)) unlink($path);
+		}
 		$management = file_get_contents($plugin . '/weathermap-cacti-plugin-mgmt.php');
 		$start = strpos($management, 'function newMap(');
 		eval(str_replace(['__DIR__', 'function newMap('], [var_export($plugin, true), 'function wm_management_newMap('], substr($management, $start)));
@@ -313,6 +351,43 @@ function atomic_assert($condition, $message) {
 			map_duplicate(1, 'Clone', 'clone');
 			atomic_assert($GLOBALS['__test_db_calls'] === [] && $GLOBALS['atomic_sql_saves'] === [], 'failed clone never registers auth or settings or invokes runner');
 		} finally { unset($GLOBALS['__test_db_fetch_row_prepared'], $GLOBALS['__test_sql_save'], $GLOBALS['__test_db_fetch_cell']); unlink($plugin . '/configs/' . $duplicateSource); $GLOBALS['config_fault'] = ''; }
+		// Real raw node/link saves must not re-check their own pre-save page token.
+		$rawFile = $dir . '/raw.conf';
+		$rawConfig = "WIDTH 300\nHEIGHT 200\nNODE A\n LABEL A\n POSITION 10 10\nNODE B\n LABEL B\n POSITION 50 50\nLINK AB\n NODES A B\n";
+		foreach (['node', 'link'] as $kind) {
+			file_put_contents($rawFile, $rawConfig);
+			$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash_file('sha256', $rawFile), 'node_name' => 'A', 'link_name' => 'AB', 'item_configtext' => $kind === 'node' ? "NODE A\n LABEL Updated\n POSITION 10 10\n" : "LINK AB\n NODES A B\n WIDTH 12\n"];
+			http_response_code(200); if ($kind === 'node') setNodeConfig($rawFile); else setLinkConfig($rawFile);
+			atomic_assert(http_response_code() === 200 && file_get_contents($rawFile) !== $rawConfig, 'raw ' . $kind . ' edit saves without false conflict');
+		}
+		// Registration failure must retain a mutex through the callback and remove its reservation.
+		file_put_contents($plugin . '/configs/' . $duplicateSource, "TITLE Source\n");
+		$GLOBALS['__test_db_fetch_row_prepared'] = fn () => ['configfile' => $duplicateSource, 'titlecache' => 'Source', 'group_id' => 1, 'active' => 'on', 'thumb_height' => 10, 'thumb_width' => 10, 'schedule' => '', 'archiving' => ''];
+		$GLOBALS['__test_db_fetch_cell'] = fn () => 0;
+		$GLOBALS['weathermap_confdir'] = $plugin . '/configs';
+		try {
+			foreach (['false', 'throw', 'auth-false', 'settings-false', 'auth-throw', 'settings-throw'] as $failure) {
+				$GLOBALS['__test_sql_save'] = function($record) use ($plugin, $failure) {
+					atomic_assert(is_file($plugin . '/configs/' . $record['configfile']), 'reserved file exists during registration');
+					if (function_exists('pcntl_fork')) {
+						$child = pcntl_fork();
+						if ($child === 0) { $probe = \fopen($plugin . '/configs/.weathermap-config.lock', 'rb'); exit(!\flock($probe, LOCK_EX | LOCK_NB) ? 0 : 1); }
+						pcntl_waitpid($child, $status); atomic_assert(pcntl_wexitstatus($status) === 0, 'registration retains directory mutex');
+					}
+					if ($failure === 'throw') throw new RuntimeException('registration failed');
+					return $failure === 'false' ? false : 987;
+				};
+				$GLOBALS['__test_db_calls'] = [];
+				$GLOBALS['__test_db_execute_prepared'] = function($sql, $params) use ($failure) {
+					$GLOBALS['__test_db_calls'][] = ['sql' => $sql, 'params' => $params];
+					if ((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-throw') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-throw')) throw new RuntimeException('insert failed');
+					return !((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-false') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-false'));
+				};
+				map_duplicate(1, 'Clone', 'clone');
+				atomic_assert(!is_file($plugin . '/configs/clone.conf'), 'failed registration removes its own reserved configuration');
+				if (str_ends_with($failure, '-false') || str_ends_with($failure, '-throw')) atomic_assert(cacti_count(array_filter($GLOBALS['__test_db_calls'], fn ($call) => str_starts_with($call['sql'], 'DELETE'))) === 3, 'partial registration removes map/auth/settings records');
+			}
+		} finally { unset($GLOBALS['__test_db_fetch_row_prepared'], $GLOBALS['__test_sql_save'], $GLOBALS['__test_db_fetch_cell'], $GLOBALS['__test_db_execute_prepared']); unlink($plugin . '/configs/' . $duplicateSource); }
 		$deletedMap = new \WeatherMap; $deletedMap->ReadConfig($file);
 		unlink($file);
 		atomic_assert(!$deletedMap->WriteConfig($file) && !file_exists($file), 'saving a previously loaded deleted map fails without resurrection');
diff --git a/tests/Support/MapDuplicatePayload.php b/tests/Support/MapDuplicatePayload.php
index 64da377e..3e6dce8d 100644
--- a/tests/Support/MapDuplicatePayload.php
+++ b/tests/Support/MapDuplicatePayload.php
@@ -96,6 +96,11 @@ function sql_save($payload, $table) {
 	return 0;
 }
 
+/** Ignore expected registration failure notices in this schema-only fixture. */
+function raise_message($id, $text = '', $level = 0) {}
+/** Return the untranslated fixture string. */
+function __($text, ...$args) { return $text; }
+define('MESSAGE_LEVEL_ERROR', 3);
 try {
 	map_duplicate(5, '<map_title> Copy');
 	print json_encode($GLOBALS['duplicate_save'], JSON_THROW_ON_ERROR);
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index 0edff281..f6851781 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -2003,40 +2003,49 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 		$oldfile = $confdir . '/' . $map['configfile'];
 		$newfile = $confdir . '/' . $save['configfile'];
 
-		$contents = is_file($oldfile) ? file_get_contents($oldfile) : false;
-		if ($contents !== false) {
-			$contents = str_replace("TITLE {$map['titlecache']}", "TITLE {$save['titlecache']}", $contents);
-			require_once __DIR__ . '/lib/WeatherMap.config.php';
-			if (!\WeathermapConfig\atomicWrite($newfile, $contents, false, null, true)) {
-				raise_message('map_message', __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
-				return;
-			}
-		} else {
-			raise_message('map_message', __('The new Map with the name %s was unable to locate the config file %s to copy', $save['titlecache'], $map['configfile'], 'weathermap'), MESSAGE_LEVEL_ERROR);
+		require_once __DIR__ . '/lib/WeatherMap.config.php';
+		$lock = \WeathermapConfig\acquire($confdir);
+		if (!$lock) {
+			raise_message('map_message', __('Could not lock map configurations.', 'weathermap'), MESSAGE_LEVEL_ERROR);
 			return;
 		}
+		$newid = 0;
+		$created = false;
+		try {
+			$contents = is_file($oldfile) ? file_get_contents($oldfile) : false;
+			if ($contents === false) throw new RuntimeException(__('The new Map with the name %s was unable to locate the config file %s to copy', $save['titlecache'], $map['configfile'], 'weathermap'));
+			$contents = str_replace("TITLE {$map['titlecache']}", "TITLE {$save['titlecache']}", $contents);
+			if (!\WeathermapConfig\atomicWrite($newfile, $contents, false, null, true, $lock)) throw new RuntimeException(__('Could not save the map configuration.', 'weathermap'));
+			$created = true;
+			$newid = sql_save($save, 'weathermap_maps');
+			if (!$newid) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
 
-		$newid = sql_save($save, 'weathermap_maps');
-
-		if ($newid) {
-			db_execute_prepared("INSERT INTO weathermap_auth
+			if (db_execute_prepared("INSERT INTO weathermap_auth
 				(userid, mapid)
 				SELECT userid, '$newid' AS mapid
 				FROM weathermap_auth
-				WHERE mapid = ?",
-				[$id]);
-
-			db_execute_prepared("INSERT INTO weathermap_settings
+				WHERE mapid = ?", [$id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
+			if (db_execute_prepared("INSERT INTO weathermap_settings
 				(mapid, groupid, optname, optvalue)
 				SELECT '$newid' AS mapid, groupid, optname, optvalue
 				FROM weathermap_settings
-				WHERE mapid = ?",
-				[$id]);
-
-			raise_message('new_map_' . $newid, __('The new Map with the name %s was created using config file %s', $save['titlecache'], $save['configfile'], 'weathermap'), MESSAGE_LEVEL_INFO);
-
-			weathermap_run_maps(__DIR__, true, [$newid]);
+				WHERE mapid = ?", [$id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
+		} catch (Throwable $error) {
+			// Only this attempt's records and successfully reserved file may be removed.
+			try {
+				if ($newid) {
+					db_execute_prepared('DELETE FROM weathermap_auth WHERE mapid = ?', [$newid]);
+					db_execute_prepared('DELETE FROM weathermap_settings WHERE mapid = ?', [$newid]);
+					db_execute_prepared('DELETE FROM weathermap_maps WHERE id = ?', [$newid]);
+				}
+			} finally { if ($created) unlink($newfile); }
+			raise_message('map_message', $error->getMessage(), MESSAGE_LEVEL_ERROR);
+			return;
+		} finally {
+			\WeathermapConfig\release($lock);
 		}
+		raise_message('new_map_' . $newid, __('The new Map with the name %s was created using config file %s', $save['titlecache'], $save['configfile'], 'weathermap'), MESSAGE_LEVEL_INFO);
+		weathermap_run_maps(__DIR__, true, [$newid]);
 	}
 }
 

From 3279a83d6cfb8948f93c5e7b3adb690d6170e003 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:10:17 +1030
Subject: [PATCH 17/35] Refresh translations for registration failure reporting

---
 locales/po/cacti.pot | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 11c6a052..ce4fe219 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 23:20+1030\n"
+"POT-Creation-Date: 2026-10-13 09:09+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -1858,7 +1858,7 @@ msgid "(No Title)"
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
-msgid "Could not save the map configuration."
+msgid "Could not lock map configurations."
 msgstr ""
 
 #: weathermap-cacti-plugin-mgmt.php
@@ -1866,6 +1866,14 @@ msgstr ""
 msgid "The new Map with the name %s was unable to locate the config file %s to copy"
 msgstr ""
 
+#: weathermap-cacti-plugin-mgmt.php
+msgid "Could not save the map configuration."
+msgstr ""
+
+#: weathermap-cacti-plugin-mgmt.php
+msgid "Could not register the new map."
+msgstr ""
+
 #: weathermap-cacti-plugin-mgmt.php
 #, php-format
 msgid "The new Map with the name %s was created using config file %s"

From 826118feaebd5d5f6e1b52e17ee0d8bd188ece8b Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:13:59 +1030
Subject: [PATCH 18/35] Cover legacy background and icon repair failure paths

---
 tests/Support/ConfigWriteAtomicRegression.php | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 6ddd100a..23fe13c2 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -326,6 +326,40 @@ function atomic_assert($condition, $message) {
 			unset($GLOBALS['__test_db_fetch_assoc'], $GLOBALS['config_before_lock']);
 			foreach ([$stageSource, $stageTarget, $stageConfig] as $path) if (is_file($path)) unlink($path);
 		}
+		// Exercise legacy background and icon relocation in a separate filesystem tree.
+		$repairRoot = $dir . '/repair-fixture';
+		$repairPlugin = $repairRoot . '/cacti/plugins/weathermap';
+		mkdir($repairPlugin . '/configs', 0777, true); mkdir($repairPlugin . '/images');
+		symlink($plugin . '/lib', $repairPlugin . '/lib');
+		file_put_contents($repairPlugin . '/legacy-background.png', 'Background bytes');
+		file_put_contents($repairPlugin . '/legacy-icon.png', 'Icon bytes');
+		$legacyFixture = "BACKGROUND legacy-background.png\nNODE Legacy\n ICON legacy-icon.png\n";
+		$fixtureConfig = $repairPlugin . '/configs/legacy.conf';
+		$oldConfig = $GLOBALS['config']; $oldSuppress = $GLOBALS['weathermap_error_suppress'] ?? [];
+		$GLOBALS['config']['base_path'] = $repairRoot . '/cacti';
+		$GLOBALS['__test_db_fetch_assoc'] = fn () => [['configfile' => 'legacy.conf']];
+		$GLOBALS['weathermap_error_suppress'] = ['WMPOLL09', 'WMPOLL10', 'WMPOLL11', 'WMPOLL12', 'WMPOLL13'];
+		try {
+			file_put_contents($fixtureConfig, $legacyFixture); weathermap_repair_maps();
+			$repairedFixture = file_get_contents($fixtureConfig);
+			atomic_assert(str_contains($repairedFixture, 'BACKGROUND images/backgrounds/legacy-background.png') && str_contains($repairedFixture, 'ICON images/objects/legacy-icon.png'), 'repair creates libraries and copies both legacy asset kinds');
+			atomic_assert(is_file($repairPlugin . '/legacy-background.png') && is_file($repairPlugin . '/legacy-icon.png'), 'successful repair preserves both original assets');
+			file_put_contents($fixtureConfig, $legacyFixture); weathermap_repair_maps();
+			atomic_assert(file_get_contents($fixtureConfig) === $repairedFixture, 'existing complete copies support path-only repair');
+			weathermap_repair_maps(); atomic_assert(file_get_contents($fixtureConfig) === $repairedFixture, 'correct paths require no rewrite');
+			unlink($repairPlugin . '/images/backgrounds/legacy-background.png'); unlink($repairPlugin . '/images/objects/legacy-icon.png');
+			file_put_contents($fixtureConfig, $legacyFixture); $GLOBALS['config_fault'] = 'rename'; weathermap_repair_maps();
+			atomic_assert(file_get_contents($fixtureConfig) === $legacyFixture && is_file($repairPlugin . '/legacy-background.png') && is_file($repairPlugin . '/legacy-icon.png'), 'failed background and icon staging preserves usable original references');
+			$GLOBALS['config_fault'] = ''; file_put_contents($fixtureConfig, "BACKGROUND absent-background.png\nNODE Missing\n ICON absent-icon.png\n");
+			$missingFixture = file_get_contents($fixtureConfig); weathermap_repair_maps();
+			atomic_assert(file_get_contents($fixtureConfig) === $missingFixture, 'missing assets do not change config paths');
+		} finally {
+			$GLOBALS['config'] = $oldConfig; $GLOBALS['weathermap_error_suppress'] = $oldSuppress; $GLOBALS['config_fault'] = '';
+			unset($GLOBALS['__test_db_fetch_assoc']); chdir($plugin);
+			$iterator = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($repairRoot, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST);
+			foreach ($iterator as $entry) { if ($entry->isDir() && !$entry->isLink()) rmdir($entry->getPathname()); else unlink($entry->getPathname()); }
+			rmdir($repairRoot);
+		}
 		$management = file_get_contents($plugin . '/weathermap-cacti-plugin-mgmt.php');
 		$start = strpos($management, 'function newMap(');
 		eval(str_replace(['__DIR__', 'function newMap('], [var_export($plugin, true), 'function wm_management_newMap('], substr($management, $start)));

From f27d95a79a4ede715be78708caf2630c55078f77 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:14:38 +1030
Subject: [PATCH 19/35] Preserve concurrent-edit status and bind clone
 registration IDs

---
 lib/WeatherMap.class.php                      |  5 +++--
 lib/editor.actions.php                        |  6 +++---
 tests/Support/ConfigWriteAtomicRegression.php | 11 +++++++++++
 weathermap-cacti-plugin-mgmt.php              |  8 ++++----
 4 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 9377cb94..7fbd92cb 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -3613,9 +3613,10 @@ function WriteDataFile($filename) {
 	 * @param string $filename
 	 * @param bool $createOnly Require a new destination.
 	 * @param string|null $expectedRevision Optional request snapshot revision.
+	 * @param resource|null $heldLock Caller-owned destination directory mutex.
 	 * @return bool
 	 */
-	function WriteConfig($filename, $createOnly = false, $expectedRevision = null) {
+	function WriteConfig($filename, $createOnly = false, $expectedRevision = null, $heldLock = null) {
 		require_once __DIR__ . '/WeatherMap.config.php';
 		$fd = fopen('php://temp', 'w+b');
 
@@ -3857,7 +3858,7 @@ function WriteConfig($filename, $createOnly = false, $expectedRevision = null) {
 			$closed = fclose($fd);
 
 			$sameFile = $this->configfile !== '' && $filename === $this->configfile;
-			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly);
+			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly, $heldLock);
 			if ($saved && $sameFile) $this->config_revision = hash('sha256', $contents);
 			return $saved;
 		} else {
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index e81f2391..7a901081 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -817,7 +817,7 @@ function moveNode($mapfile, $grid_snap_value) {
 		$map->nodes[$node_name]->x = $x;
 		$map->nodes[$node_name]->y = $y;
 
-		if (!wm_editor_write_config($map, $mapfile)) http_response_code(500);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -1013,7 +1013,7 @@ function deleteNode($mapfile) {
 
 		unset($map->nodes[$target]);
 
-		if (!wm_editor_write_config($map, $mapfile)) http_response_code(500);
+		wm_editor_write_config($map, $mapfile);
 	}
 }
 
@@ -1189,5 +1189,5 @@ function setNoteProperties($mapfile, $grid_snap_value) {
 		http_response_code(400);
 		return;
 	}
-	if (!wm_editor_write_config($map, $mapfile)) http_response_code(500);
+	wm_editor_write_config($map, $mapfile);
 }
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 23fe13c2..2b935eec 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -394,6 +394,16 @@ function atomic_assert($condition, $message) {
 			http_response_code(200); if ($kind === 'node') setNodeConfig($rawFile); else setLinkConfig($rawFile);
 			atomic_assert(http_response_code() === 200 && file_get_contents($rawFile) !== $rawConfig, 'raw ' . $kind . ' edit saves without false conflict');
 		}
+		// All note mutations retain the 409 chosen for a save arriving after request read.
+		foreach (['move', 'delete', 'properties'] as $operation) {
+			file_put_contents($file, $original);
+			$newer = "TITLE Concurrent writer\n" . $original;
+			$GLOBALS['config_before_lock'] = function() use ($file,$newer) { unset($GLOBALS['config_before_lock']); file_put_contents($file,$newer); };
+			$GLOBALS['__test_nfilter_request'] = ['config_revision'=>hash_file('sha256',$file),'node_name'=>'note1','param'=>'note1','x'=>70,'y'=>80,'note_name'=>'note1','note_text'=>'Changed','note_font'=>'3','note_colour'=>'#000000','note_x'=>50,'note_y'=>50,'note_align'=>'left'];
+			http_response_code(200);
+			if($operation==='move')moveNode($file,0);elseif($operation==='delete')deleteNode($file);else setNoteProperties($file,0);
+			atomic_assert(http_response_code()===409 && file_get_contents($file)===$newer,'note ' . $operation . ' preserves concurrent-edit response');
+		}
 		// Registration failure must retain a mutex through the callback and remove its reservation.
 		file_put_contents($plugin . '/configs/' . $duplicateSource, "TITLE Source\n");
 		$GLOBALS['__test_db_fetch_row_prepared'] = fn () => ['configfile' => $duplicateSource, 'titlecache' => 'Source', 'group_id' => 1, 'active' => 'on', 'thumb_height' => 10, 'thumb_width' => 10, 'schedule' => '', 'archiving' => ''];
@@ -414,6 +424,7 @@ function atomic_assert($condition, $message) {
 				$GLOBALS['__test_db_calls'] = [];
 				$GLOBALS['__test_db_execute_prepared'] = function($sql, $params) use ($failure) {
 					$GLOBALS['__test_db_calls'][] = ['sql' => $sql, 'params' => $params];
+					if (str_starts_with($sql,'INSERT')) atomic_assert(!str_contains($sql, '987') && $params === [987,1], 'clone IDs are bound as prepared parameters');
 					if ((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-throw') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-throw')) throw new RuntimeException('insert failed');
 					return !((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-false') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-false'));
 				};
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index f6851781..acabe0f4 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -2022,14 +2022,14 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 
 			if (db_execute_prepared("INSERT INTO weathermap_auth
 				(userid, mapid)
-				SELECT userid, '$newid' AS mapid
+				SELECT userid, ? AS mapid
 				FROM weathermap_auth
-				WHERE mapid = ?", [$id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
+				WHERE mapid = ?", [$newid, $id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
 			if (db_execute_prepared("INSERT INTO weathermap_settings
 				(mapid, groupid, optname, optvalue)
-				SELECT '$newid' AS mapid, groupid, optname, optvalue
+				SELECT ? AS mapid, groupid, optname, optvalue
 				FROM weathermap_settings
-				WHERE mapid = ?", [$id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
+				WHERE mapid = ?", [$newid, $id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
 		} catch (Throwable $error) {
 			// Only this attempt's records and successfully reserved file may be removed.
 			try {

From 3cae29deaeca60d487285da96e657f54442b247b Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:54:15 +1030
Subject: [PATCH 20/35] Keep editor snapshots coherent and fall back missing
 note fonts

---
 js/editor.js                                  | 33 +++++++++----------
 lib/WeatherMap.class.php                      | 10 ++++--
 lib/WeatherMap.notes.php                      | 19 +++++++++++
 lib/editor.actions.php                        | 16 +++++----
 lib/editor.notes.php                          |  7 ++--
 .../Browser/EditorFilenameNavigationTest.cjs  | 12 ++++---
 tests/Browser/EditorNotesTest.cjs             |  2 +-
 tests/Browser/EditorSaveFailureTest.cjs       |  1 +
 tests/Support/ConfigWriteAtomicRegression.php | 19 +++++++++++
 tests/Support/NoteAllocationRegression.php    | 18 ++++++++++
 weathermap-cacti-plugin-editor.php            |  5 +--
 11 files changed, 104 insertions(+), 38 deletions(-)

diff --git a/js/editor.js b/js/editor.js
index da6ce624..7533b4bf 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -904,6 +904,19 @@ function delete_link() {
 	});
 }
 
+function wmEditorReloadUrl() {
+	var url = new URL(window.location.href);
+	url.searchParams.set('mapname', $('#mapname').val());
+	url.searchParams.set('action', 'nothing');
+	url.searchParams.delete('config_revision');
+	url.searchParams.delete('__csrf_magic');
+	return url.href;
+}
+
+function wmReloadEditor() {
+	window.location.replace(wmEditorReloadUrl());
+}
+
 function form_submit() {
 	if ($('#action').val() === 'place_note') {
 		show_note('', $('#x').val(), $('#y').val());
@@ -931,28 +944,14 @@ function form_submit() {
 				window.alert(wmEditorText.saveError);
 			}
 		},
-		success: function(html) {
+		success: function() {
 			hide_all_dialogs();
-
-			$.get('?action=load_area_data&mapname=' + encodeURIComponent($('#mapname').val()), function(data) {
-				$('.mapData').empty().html(data);
-
-				$.getScript('?action=load_map_javascript&mapname=' + encodeURIComponent($('#mapname').val()), function(data) {
-					var date = new Date();
-
-					// Reload the images to update page
-					$('#existingdata').attr('src', $('#existingdata').attr('src') + '&date=' + date.getTime());
-					$('#xycapture').attr('src', $('#xycapture').attr('src') + '&date=' + date.getTime());
-
-					$('#action').val('');
-
-					initJS();
-				});
-			});
+			wmReloadEditor();
 		}
 	});
 }
 
+
 function map_properties() {
 	mapmode('existing');
 
diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 7fbd92cb..fc611c5e 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -4027,7 +4027,10 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 
 			// do the node rendering stuff first, regardless of where they are actually drawn.
 			// this is so we can get the size of the nodes, which links will need if they use offsets
-			foreach ($this->nodes as $node) $node->render_note_hidpi = false;
+			foreach ($this->nodes as $node) {
+				$node->render_note_hidpi = false;
+				if ($node->get_hint('editor_note', '0') === '1') $node->labelfont = wm_note_font_id($this, $node->labelfont);
+			}
 
 			foreach ($this->nodes as $node) {
 				// don't try and draw template nodes
@@ -4200,7 +4203,10 @@ function DrawMap($filename = '', $thumbnailfile = '', $thumbnailmax = 250, $with
 				}
 				$this->image = $image;
 			}
-			foreach ($this->nodes as $node) $node->render_note_hidpi = false;
+			foreach ($this->nodes as $node) {
+				$node->render_note_hidpi = false;
+				if ($node->get_hint('editor_note', '0') === '1') $node->labelfont = wm_note_font_id($this, $node->labelfont);
+			}
 
 			// Ready to output the results...
 
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 063a3bd9..667a640d 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -40,6 +40,25 @@ function allocate($width, $height) {
 }
 
 namespace {
+/**
+ * Resolve a usable note font before measuring or drawing its text.
+ *
+ * @param WeatherMap $map The rendered map.
+ * @param int|string $id Registered font slot.
+ * @return int|string Usable font slot, or built-in font 3.
+ */
+function wm_note_font_id($map, $id) {
+	if (!isset($map->fonts[$id])) return 3;
+	$font = $map->fonts[$id];
+	if ($font->type === 'truetype') {
+		$file = wm_font_file($font->file);
+		if (!is_readable($file) || !function_exists('imagettfbbox') || !function_exists('imagettftext')) return 3;
+		$signature = @file_get_contents($file, false, null, 0, 4);
+		if (!in_array($signature, ["\x00\x01\x00\x00", 'OTTO', 'ttcf', 'true', 'typ1'], true)) return 3;
+	}
+	return $id;
+}
+
 /**
  * Notes eligible for high-density map rendering. Restrict the allocation to
  * bounded maps and plain TrueType annotations drawn above the other objects.
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 7a901081..3ef4d9f3 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -64,6 +64,10 @@ function wm_editor_read_config($map, $mapfile) {
 		http_response_code(422);
 		return false;
 	}
+	if (!is_string($map->config_revision)) {
+		http_response_code(404);
+		return false;
+	}
 	$revision = get_nfilter_request_var('config_revision');
 	if ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals($map->config_revision, $revision))) {
 		http_response_code(409);
@@ -138,12 +142,12 @@ function newMapCopy($mapfile) {
  * @param  mixed $mapfile
  * @return void
  */
-function getMapJavaScript($mapfile) {
-	$map = new WeatherMap;
-
-	$map->context = 'editor';
-
-	if (!wm_editor_read_config($map, $mapfile)) return;
+function getMapJavaScript($mapfile, $map = null) {
+	if ($map === null) {
+		$map = new WeatherMap;
+		$map->context = 'editor';
+		if (!wm_editor_read_config($map, $mapfile)) return;
+	}
 
 	print $map->asJS();
 	print 'var WMConfigRevision = ' . json_encode($map->config_revision) . ';';
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index a5e0bea3..046ecbfd 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -61,6 +61,7 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 	if ($font === null) {
 		return false;
 	}
+	$font = wm_note_font_id($map, $font);
 	if ($name === '') {
 		do {
 			$name = 'note_' . bin2hex(random_bytes(6));
@@ -109,12 +110,8 @@ function wm_editor_note_data($map) {
 		if ($node->get_hint('editor_note', '0') !== '1' || $name === 'DEFAULT') {
 			continue;
 		}
-		$fontId = isset($map->fonts[$node->labelfont]) ? $node->labelfont : 3;
+		$fontId = wm_note_font_id($map, $node->labelfont);
 		$font = $map->fonts[$fontId];
-		if ($font->type === 'truetype' && !is_readable(wm_font_file($font->file))) {
-			$fontId = 3;
-			$font = $map->fonts[$fontId];
-		}
 		$rgb = $node->labelfontcolour;
 		$notes[$name] = ['align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$fontId, 'fontLabel' => wm_editor_font_label($fontId, $font),
 			'colour' => sprintf('#%02x%02x%02x', max(0, $rgb[0]), max(0, $rgb[1]), max(0, $rgb[2]))];
diff --git a/tests/Browser/EditorFilenameNavigationTest.cjs b/tests/Browser/EditorFilenameNavigationTest.cjs
index b62ea983..a64ef372 100644
--- a/tests/Browser/EditorFilenameNavigationTest.cjs
+++ b/tests/Browser/EditorFilenameNavigationTest.cjs
@@ -4,7 +4,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const vm = require('node:vm');
 const assert = require('node:assert/strict');
-const dom = new JSDOM('<input id="mapname" name="mapname"><input id="link_picker" class="selectmenu-ajax" data-action="graphs" value="7"><select id="link_template"><option value="1">One</option></select><div class="mapData"></div><img id="existingdata"><img id="xycapture"><input id="action">', {runScripts: 'outside-only'});
+const dom = new JSDOM('<input id="mapname" name="mapname"><input id="link_picker" class="selectmenu-ajax" data-action="graphs" value="7"><select id="link_template"><option value="1">One</option></select><div class="mapData"></div><img id="existingdata"><img id="xycapture"><input id="action">', {runScripts: 'outside-only', url:'https://example.test/editor.php?action=edit&config_revision=old&return_to=manage'});
 const w = dom.window, $ = jquery(w);
 w.$ = $;
 let pickerOptions;
@@ -29,13 +29,15 @@ for (const filename of ['ordinary.conf', 'A&B#C? +%é.conf']) {
   assert.equal(new URLSearchParams(options.data).get('mapname'), filename);
   options.success('');
  };
- $.get = (url, callback) => { check(url); callback(''); };
- $.getScript = (url, callback) => { check(url); callback(''); };
+ $.get = $.getScript = () => { throw Error('partial snapshot reload'); };
+ let reloadUrl;w.wmReloadEditor=()=>reloadUrl=w.wmEditorReloadUrl();
  $('#existingdata, #xycapture').attr('src', '?action=draw&mapname=' + encodeURIComponent(filename));
  w.form_submit();
- assert.deepEqual(requests, ['graphs', 'load_area_data', 'load_map_javascript']);
+ assert.deepEqual(requests, ['graphs']);
+ check(reloadUrl);
+ const reloaded=new URL(reloadUrl);assert.equal(reloaded.searchParams.get('action'),'nothing');assert.equal(reloaded.searchParams.has('config_revision'),false);assert.equal(reloaded.searchParams.get('return_to'),'manage');
  check($('#existingdata').attr('src'));
  check($('#xycapture').attr('src'));
 }
 w.close();
-console.log('PASS: picker, serialized save, map reload, JavaScript reload and image refresh retain ordinary and delimiter-containing filenames.');
+console.log('PASS: picker, serialized save, complete editor reload and image identity retain ordinary and delimiter-containing filenames.');
diff --git a/tests/Browser/EditorNotesTest.cjs b/tests/Browser/EditorNotesTest.cjs
index f5b47514..8a09c060 100644
--- a/tests/Browser/EditorNotesTest.cjs
+++ b/tests/Browser/EditorNotesTest.cjs
@@ -33,7 +33,7 @@ for(const action of ['move_node','delete_node']) {
  assert.equal(shown,'dlgNoteProperties');assert.equal($('#note_name').val(),'note1');assert.equal($('#wm-note-error').text(),'Save failed');
 }
 w.show_note('note1');w.form_submit();
-let refreshed=false;$.get=(url,cb)=>{assert.match(url,/load_area_data/);cb('');};$.getScript=(url,cb)=>{assert.match(url,/load_map_javascript/);cb('');};w.initJS=()=>refreshed=true;
+let refreshed=false;$.get=()=>{throw Error('partial editor refresh');};$.getScript=()=>{throw Error('token-only refresh');};w.wmReloadEditor=()=>refreshed=true;
 request.success('');assert.ok(refreshed);assert.equal($('#action').val(),'');
 // Exercise the real note-aware confirmation, including attached-link warning and target capture.
 w.eval(fs.readFileSync(path.join(process.env.CACTI_JS_DIR,'jquery-ui.js'),'utf8'));
diff --git a/tests/Browser/EditorSaveFailureTest.cjs b/tests/Browser/EditorSaveFailureTest.cjs
index 108b9acf..4bb4e84b 100644
--- a/tests/Browser/EditorSaveFailureTest.cjs
+++ b/tests/Browser/EditorSaveFailureTest.cjs
@@ -4,4 +4,5 @@ let request,message,closed=0,refreshed=0;$.ajax=opts=>request=opts;w.alert=text=
 const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');w.eval(source.slice(source.indexOf('function form_submit()'),source.indexOf('function map_properties()')));
 w.form_submit();request.error();assert.equal(message,'Unable to save changes');assert.equal(closed,0);assert.equal(refreshed,0);assert.equal($('#action').val(),'set_map_properties');
 w.WMConfigRevision='b'.repeat(64);w.form_submit();assert.match(request.data,/config_revision=b{64}/);request.error({status:409});assert.equal(message,'Reload the editor');assert.equal(closed,0);assert.equal(refreshed,0);
+let reloads=0;w.hide_all_dialogs=()=>closed++;w.wmReloadEditor=()=>reloads++;$.get=()=>{throw Error('partial editor refresh');};request.success();assert.equal(reloads,1);
 w.close();console.log('PASS: save failure reports retry and preserves the form');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 2b935eec..2763cc46 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -257,6 +257,25 @@ function atomic_assert($condition, $message) {
 		\WeathermapConfig\release($held);
 		$wrong = \fopen($file, 'rb');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
+		// Revision metadata must describe the same map snapshot as the controls.
+		file_put_contents($file, $original); $snapshot = new \WeatherMap; $snapshot->ReadConfig($file);
+		$loadedRevision = $snapshot->config_revision;
+		$updatedSnapshot = str_replace('Original', 'NewSnapshot', $original); file_put_contents($file, $updatedSnapshot);
+		$GLOBALS['__test_nfilter_request'] = [];
+		ob_start(); getMapJavaScript($file, $snapshot); $javascript = ob_get_clean();
+		atomic_assert(str_contains($javascript, 'Original') && !str_contains($javascript, 'NewSnapshot') && str_contains($javascript, $loadedRevision), 'rendered values and revision come from one loaded snapshot');
+		$GLOBALS['__test_nfilter_request'] = ['config_revision' => $loadedRevision];
+		http_response_code(200); atomic_assert(!wm_editor_read_config(new \WeatherMap, $file) && http_response_code() === 409, 'concurrent save cannot be hidden by a refreshed token');
+		// Simulate deletion between the existence check and the engine file read.
+		class AtomicDeletedDuringReadMap extends \WeatherMap {
+			/** Simulate an engine load that loses its file before opening it. */
+			function ReadConfig($input, $is_include = false) { unlink($input); $this->config_revision = null; return true; }
+		}
+		foreach ([[], ['config_revision' => $loadedRevision]] as $request) {
+			file_put_contents($file, $original); $GLOBALS['__test_nfilter_request'] = $request;
+			http_response_code(200); atomic_assert(!wm_editor_read_config(new AtomicDeletedDuringReadMap, $file) && http_response_code() === 404, 'deletion race cannot proceed with a null revision');
+		}
+		$GLOBALS['__test_nfilter_request'] = []; file_put_contents($file, $original);
 		$crlfFile = $dir . '/crlf.conf';
 		$crlf = "WIDTH 600\r\nHEIGHT 300\r\n"; file_put_contents($crlfFile, $crlf);
 		$crlfMap = new \WeatherMap; $crlfMap->ReadConfig($crlfFile);
diff --git a/tests/Support/NoteAllocationRegression.php b/tests/Support/NoteAllocationRegression.php
index dd2c689f..4f099364 100644
--- a/tests/Support/NoteAllocationRegression.php
+++ b/tests/Support/NoteAllocationRegression.php
@@ -57,6 +57,24 @@ function imagecreatetruecolor($width, $height) {
 			if (!$ink) throw new \RuntimeException('fallback must retain readable note glyphs');
 			imagedestroy($image);
 		}
+		require_once 'lib/editor.inc.php'; require_once 'lib/editor.notes.php';
+		foreach (['missing', 'invalid', 'unreadable'] as $fontCase) {
+			$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = 0;
+			$map = new \WeatherMap; $map->ReadConfig($file); $map->stamptext = '';
+			$fontPath = $dir . '/font-' . $fontCase . '.ttf';
+			if ($fontCase === 'invalid') file_put_contents($fontPath, 'invalid font');
+			if ($fontCase === 'unreadable') { copy('docs/example/Vera.ttf', $fontPath); chmod($fontPath, 0000); if (is_readable($fontPath)) { chmod($fontPath, 0600); continue; } }
+			$map->fonts[100]->file = $fontPath;
+			$output = $dir . '/fallback-' . $fontCase . '.png'; $map->DrawMap($output);
+			if ($map->nodes['label']->labelfont !== 3 || getimagesize($output)[0] !== 400) throw new \RuntimeException('loaded invalid font must fall back before drawing');
+			$image = imagecreatefrompng($output); $ink = 0;
+			for ($x = 95; $x < 205; $x++) for ($y = 85; $y < 115; $y++) if ((imagecolorat($image, $x, $y) & 0xffffff) === 0) $ink++;
+			if (!$ink) throw new \RuntimeException('invalid loaded font must retain readable glyphs'); imagedestroy($image);
+			$values = ['name'=>'label','text'=>'Saved fallback','font'=>'100','colour'=>'#000000','x'=>150,'y'=>100,'align'=>'left'];
+			if (!wm_editor_save_note($map,$values,0) || $map->nodes['label']->labelfont !== 3) throw new \RuntimeException('submitted invalid registered font must fall back');
+			if ($fontCase === 'unreadable') chmod($fontPath,0600);
+		}
+		if (wm_note_font_id($map,99999)!==3) throw new \RuntimeException('unknown font fallback');
 		$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = 1;
 		if (wm_note_display_image($map, []) !== false) throw new \RuntimeException('direct display allocation failure');
 		$GLOBALS['note_fail_at'] = -1;
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index c381c5b1..4fc5af70 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -240,7 +240,8 @@
 }
 
 $map = new WeatherMap;
-$map->ReadConfig($mapfile);
+$map->context = 'editor';
+if (!wm_editor_read_config($map, $mapfile)) exit;
 
 // by here, there should be a valid $map - either a blank one, the existing one, or the existing one with requested changes
 wm_debug('Finished modifying');
@@ -367,7 +368,7 @@
 		<!-- Data for overlay and selection -->
 		<div class='scriptData'>
 			<script type='text/javascript' <?php print plugin_weathermap_csp_nonce(); ?>>
-			<?php getMapJavaScript($mapfile); ?>
+			<?php getMapJavaScript($mapfile, $map); ?>
 			<?php print 'var infoUrlStyle=' . intval(read_config_option('weathermap_infourl_style')) . ';'; ?>
 			</script>
 		</div>

From 99c982e2a3a6e560f13250f184ae12d4be421aed Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:58:27 +1030
Subject: [PATCH 21/35] Document the editor snapshot argument

---
 lib/editor.actions.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 3ef4d9f3..642caf02 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -139,7 +139,8 @@ function newMapCopy($mapfile) {
 }
 
 /**
- * @param  mixed $mapfile
+ * @param mixed $mapfile Configuration path.
+ * @param WeatherMap|null $map Loaded control snapshot, or null for a standalone response.
  * @return void
  */
 function getMapJavaScript($mapfile, $map = null) {

From 18e44130ec81b7ce467d98e31b7848c8b75d1b1c Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 19:33:22 +1030
Subject: [PATCH 22/35] End raw edit requests and reject lost map copy sources

---
 lib/editor.actions.php                        |  5 +++-
 tests/Support/ConfigWriteAtomicRegression.php | 25 +++++++++++++++++++
 weathermap-cacti-plugin-editor.php            |  4 +--
 weathermap-cacti-plugin-mgmt.php              |  2 +-
 4 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 642caf02..fc773180 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -132,7 +132,10 @@ function newMapCopy($mapfile) {
 		$sourcemap = $mapdir . '/' . $sourcemapname;
 
 		if (file_exists($sourcemap) && is_readable($sourcemap)) {
-			$map->ReadConfig($sourcemap);
+			if (!$map->ReadConfig($sourcemap) || !is_string($map->config_revision)) {
+				http_response_code(404);
+				return;
+			}
 			wm_editor_write_config($map, $mapfile, true);
 		}
 	}
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 2763cc46..5213026a 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -275,6 +275,21 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			file_put_contents($file, $original); $GLOBALS['__test_nfilter_request'] = $request;
 			http_response_code(200); atomic_assert(!wm_editor_read_config(new AtomicDeletedDuringReadMap, $file) && http_response_code() === 404, 'deletion race cannot proceed with a null revision');
 		}
+
+		$plugin = dirname(__DIR__, 2);
+		// Exercise both copy entry points with an engine that loses the source during loading.
+		$actions = file_get_contents($plugin . '/lib/editor.actions.php');
+		$copyStart = strpos($actions, 'function newMapCopy('); $copyEnd = strpos($actions, "\n/**", $copyStart);
+		eval(str_replace(['function newMapCopy(', 'new WeatherMap'], ['function atomicLostSourceCopy(', 'new AtomicDeletedDuringReadMap'], substr($actions, $copyStart, $copyEnd - $copyStart)));
+		$GLOBALS['mapdir'] = $dir; $GLOBALS['__test_request']['sourcemap'] = basename($file); $GLOBALS['__test_nfilter_request'] = ['sourcemap' => basename($file)];
+		file_put_contents($file, $original); http_response_code(200); atomicLostSourceCopy($dir . '/lost-copy.conf');
+		atomic_assert(http_response_code() === 404 && !is_file($dir . '/lost-copy.conf'), 'editor copy rejects source lost during load');
+		$managementCopy = file_get_contents($plugin . '/weathermap-cacti-plugin-mgmt.php');
+		eval(str_replace(['__DIR__', 'function newMap(', 'new WeatherMap'], [var_export($plugin, true), 'function atomicLostManagementCopy(', 'new AtomicDeletedDuringReadMap'], substr($managementCopy, strpos($managementCopy, 'function newMap('))));
+		$GLOBALS['weathermap_confdir'] = $dir; file_put_contents($file, $original);
+		atomicLostManagementCopy('lost-management-copy.conf', basename($file));
+		atomic_assert(!is_file($dir . '/lost-management-copy.conf'), 'management copy rejects source lost during load');
+		unset($GLOBALS['__test_request']['sourcemap']);
 		$GLOBALS['__test_nfilter_request'] = []; file_put_contents($file, $original);
 		$crlfFile = $dir . '/crlf.conf';
 		$crlf = "WIDTH 600\r\nHEIGHT 300\r\n"; file_put_contents($crlfFile, $crlf);
@@ -412,6 +427,16 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash_file('sha256', $rawFile), 'node_name' => 'A', 'link_name' => 'AB', 'item_configtext' => $kind === 'node' ? "NODE A\n LABEL Updated\n POSITION 10 10\n" : "LINK AB\n NODES A B\n WIDTH 12\n"];
 			http_response_code(200); if ($kind === 'node') setNodeConfig($rawFile); else setLinkConfig($rawFile);
 			atomic_assert(http_response_code() === 200 && file_get_contents($rawFile) !== $rawConfig, 'raw ' . $kind . ' edit saves without false conflict');
+			file_put_contents($rawFile, $rawConfig); http_response_code(200);
+			$controller = file_get_contents($plugin . '/weathermap-cacti-plugin-editor.php');
+			$caseStart = strpos($controller, "case 'set_" . $kind . "_config':");
+			$caseEnd = strpos($controller, "case '", $caseStart + 5);
+			$dispatch = substr($controller, strpos($controller, ':', $caseStart) + 1, $caseEnd - strpos($controller, ':', $caseStart) - 1);
+			$mapfile = $rawFile; $terminated = false;
+			try { eval(str_replace('exit();', 'throw new \\RuntimeException("request-finished");', $dispatch)); }
+			catch (\RuntimeException $error) { if ($error->getMessage() !== 'request-finished') throw $error; $terminated = true; }
+			atomic_assert($terminated && http_response_code() === 200 && file_get_contents($rawFile) !== $rawConfig, 'controller ends successful raw ' . $kind . ' save before rendering with old token');
+
 		}
 		// All note mutations retain the 409 chosen for a save arriving after request read.
 		foreach (['move', 'delete', 'properties'] as $operation) {
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index 4fc5af70..6aee181f 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -163,11 +163,11 @@
 	case 'set_link_config':
 		setLinkConfig($mapfile);
 
-		break;
+		exit();
 	case 'set_node_config':
 		setNodeConfig($mapfile);
 
-		break;
+		exit();
 	case 'set_note_properties':
 		setNoteProperties($mapfile, $grid_snap_value);
 		exit;
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index acabe0f4..de7bf3fc 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -3443,7 +3443,7 @@ function newMap($mapfile, $sourcemapfile = '', $title = '') {
 		if ($mapfile != '') {
 			if ($sourcemapfile != '') {
 				if (file_exists($sourcemapfile) && is_readable($sourcemapfile)) {
-					if (!$map->ReadConfig($sourcemapfile)) {
+					if (!$map->ReadConfig($sourcemapfile) || !is_string($map->config_revision)) {
 					raise_message('map_message', __('The Source Map File name is not readable or does not exist!', 'weathermap'), MESSAGE_LEVEL_ERROR);
 					return;
 				}

From cfe846895633c9aade9601a69103521bebe01224 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 19:56:07 +1030
Subject: [PATCH 23/35] Preserve literal backslashes in saved note text

---
 js/editor.js                                  |  2 +-
 lib/WeatherMap.class.php                      |  3 ++-
 lib/WeatherMap.config.php                     |  5 +++--
 lib/WeatherMap.notes.php                      | 12 ++++++++++++
 lib/editor.notes.php                          |  5 +++--
 tests/Browser/EditorNotesTest.cjs             |  1 +
 tests/Support/ConfigWriteAtomicRegression.php | 11 +++++++++++
 tests/Support/EditorNotesEngineRegression.php | 17 +++++++++++++++++
 8 files changed, 50 insertions(+), 6 deletions(-)

diff --git a/js/editor.js b/js/editor.js
index 7533b4bf..1c4338c0 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -1800,7 +1800,7 @@ function show_note(name, x, y) {
 	var style = name ? WMNotes[name] : null;
 	$('#note_name').val(name);
 	$('#note_align').val(style && ['left', 'centre', 'right'].indexOf(style.align) !== -1 ? style.align : 'left');
-	$('#note_text').val(node ? node.label.replace(/\\n/g, '\n') : '');
+	$('#note_text').val(node ? (style && typeof style.text === 'string' ? style.text : node.label.replace(/\\n/g, '\n')) : '');
 	$('#note_x').val(node ? node.x : x);
 	$('#note_y').val(node ? node.y : y);
 	$('#note_colour').val(style ? style.colour : '#000000');
diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index fc611c5e..434262a6 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -944,7 +944,8 @@ function ProcessString($input, &$context, $include_notes = true, $multiline = fa
 
 		if ($multiline == true) {
 			$i     = $input;
-			$input = str_replace('\\n', "\n", $i);
+			$input = $context instanceof WeatherMapNode && $context->get_hint('editor_note_escaped', '0') === '1'
+				? wm_note_decode_text($i) : str_replace('\\n', "\n", $i);
 		}
 
 		$output = $input;
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 0e9377a8..87c1d1a7 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -88,15 +88,16 @@ function writeAll($stream, $contents) {
  */
 function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision = null, $createOnly = false, $heldLock = null) {
 	if (strpos($filename, '://') !== false) return false;
+	$lockDirectory = dirname($filename);
 	if (is_link($filename)) $filename = realpath($filename);
 	if ($filename === false || !is_dir(dirname($filename)) || !is_writable(dirname($filename))) return false;
 	if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
 	$existed = file_exists($filename);
 	$mustExist = $mustExist || $existed;
 	$ownsLock = $heldLock === null;
-	$lockPath = realpath(dirname($filename) . '/.weathermap-config.lock');
+	$lockPath = realpath($lockDirectory . '/.weathermap-config.lock');
 	if (!$ownsLock && ($lockPath === false || !is_resource($heldLock) || get_resource_type($heldLock) !== 'stream' || realpath(stream_get_meta_data($heldLock)['uri']) !== $lockPath)) return false;
-	$lock = $ownsLock ? acquire(dirname($filename)) : $heldLock;
+	$lock = $ownsLock ? acquire($lockDirectory) : $heldLock;
 	if (!$lock) return false;
 	$temp = false;
 	$stream = false;
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 667a640d..d14c9620 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -40,6 +40,18 @@ function allocate($width, $height) {
 }
 
 namespace {
+/**
+ * Decode text from an escaped note label, preserving literal backslashes.
+ *
+ * @param string $text Encoded configuration label.
+ * @return string Display text.
+ */
+function wm_note_decode_text($text) {
+	return preg_replace_callback('/\\\\(\\\\|n)/', function ($match) {
+		return $match[1] === 'n' ? "\n" : '\\';
+	}, $text);
+}
+
 /**
  * Resolve a usable note font before measuring or drawing its text.
  *
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index 046ecbfd..a2356a22 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -89,7 +89,8 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 		$map->seen_zlayers[$node->zorder][] = $node;
 	}
 	$node = $map->nodes[$name];
-	$node->label = str_replace(["\r\n", "\r", "\n"], '\n', trim($text));
+	$node->label = str_replace(["\r\n", "\r", "\n"], '\n', str_replace('\\', '\\\\', trim($text)));
+	$node->add_hint('editor_note_escaped', '1');
 	$node->labelfont = $font;
 	$node->add_hint('editor_note_align', $alignment);
 	$node->labelfontcolour = [hexdec(substr($colour, 1, 2)), hexdec(substr($colour, 3, 2)), hexdec(substr($colour, 5, 2))];
@@ -113,7 +114,7 @@ function wm_editor_note_data($map) {
 		$fontId = wm_note_font_id($map, $node->labelfont);
 		$font = $map->fonts[$fontId];
 		$rgb = $node->labelfontcolour;
-		$notes[$name] = ['align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$fontId, 'fontLabel' => wm_editor_font_label($fontId, $font),
+		$notes[$name] = ['text' => $node->get_hint('editor_note_escaped', '0') === '1' ? wm_note_decode_text($node->label) : str_replace('\\n', "\n", $node->label), 'align' => $node->get_hint('editor_note_align', 'left'), 'font' => (string)$fontId, 'fontLabel' => wm_editor_font_label($fontId, $font),
 			'colour' => sprintf('#%02x%02x%02x', max(0, $rgb[0]), max(0, $rgb[1]), max(0, $rgb[2]))];
 	}
 	return $notes;
diff --git a/tests/Browser/EditorNotesTest.cjs b/tests/Browser/EditorNotesTest.cjs
index 8a09c060..9b03e72b 100644
--- a/tests/Browser/EditorNotesTest.cjs
+++ b/tests/Browser/EditorNotesTest.cjs
@@ -21,6 +21,7 @@ assert.equal(shown,'dlgNoteProperties');assert.equal($('#note_font').val(),'bund
 $('#note_font').empty().append('<option value="10" data-wm-note-default="1">Translated Vera label (font 10)</option><option value="3">Builtin</option>');
 w.show_note('',10,20);assert.equal($('#note_font').val(),'10');
 w.show_note('note1');assert.equal($('#note_text').val(),'Core\nMaintenance');assert.equal($('#note_align').val(),'centre');
+w.WMNotes.note1.text='C:\\new site\nSecond line';w.show_note('note1');assert.equal($('#note_text').val(),w.WMNotes.note1.text);delete w.WMNotes.note1.text;
 $('#note_x,#note_y').attr('max',600);$('#note_clone').trigger('click');assert.equal($('#note_name').val(),'');assert.equal($('#note_x').val(),'70');
 w.show_note('note1');$('#note_move').trigger('click');assert.equal(moved,'note1');
 w.show_note('note1');$('#note_delete').trigger('click');assert.equal(deleted,'note1');assert.equal($('#param').val(),'note1');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 5213026a..f7973717 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -255,6 +255,17 @@ function atomic_assert($condition, $message) {
 			atomic_assert(pcntl_wexitstatus($status) === 0, 'atomicWrite leaves caller mutex held');
 		}
 		\WeathermapConfig\release($held);
+
+		$external = sys_get_temp_dir() . '/wm-external-' . bin2hex(random_bytes(5));
+		mkdir($external); $externalFile = $external . '/map.conf'; file_put_contents($externalFile, $original);
+		$alias = $dir . '/external.conf';
+		if (@symlink($externalFile, $alias)) {
+			$logicalLock = \WeathermapConfig\acquire($dir);
+			atomic_assert(\WeathermapConfig\atomicWrite($alias, $original, true, hash('sha256', $original), false, $logicalLock), 'external symlink accepts caller-held logical configuration mutex');
+			atomic_assert(!is_file($external . '/.weathermap-config.lock'), 'symlink replacement does not choose external target mutex');
+			\WeathermapConfig\release($logicalLock); unlink($alias);
+		}
+		unlink($externalFile); rmdir($external);
 		$wrong = \fopen($file, 'rb');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
 		// Revision metadata must describe the same map snapshot as the controls.
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index 65ee20ad..6de11a38 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -86,6 +86,23 @@ function note_assert($value, $message) {
 	note_assert(imagesx($saved->image) === 600, 'HTML-only rendering keeps logical dimensions');
 	$saved->imageuri = 'note.png';
 	note_assert(str_contains($saved->MakeHTML(), "width='600' height='300'"), 'viewer display size remains logical');
+
+	$literal = "C:\\new site\nD:\\nested\\notes\\\\share";
+	$literalValues = $values;
+	$literalValues['name'] = $name;
+	$literalValues['text'] = $literal;
+	note_assert(wm_editor_save_note($saved, $literalValues), 'save literal backslashes');
+	note_assert($saved->WriteConfig($file), 'persist escaped note');
+	$literalReload = new WeatherMap;
+	$literalReload->ReadConfig($file);
+	$literalNode = $literalReload->nodes[$name];
+	note_assert(wm_editor_note_data($literalReload)[$name]['text'] === $literal, 'dialog text preserves literal backslashes and real newlines');
+	note_assert($literalReload->ProcessString($literalNode->label, $literalNode, true, true) === $literal, 'render text preserves literal backslashes and real newlines');
+	$literalReload->DrawMap($directory . '/literal.png');
+	note_assert(is_file($directory . '/literal.png'), 'escaped note renders through high-density path');
+	$legacy = new WeatherMapNode;
+	$legacy->name = 'legacy'; $legacy->Reset($literalReload); $legacy->label = 'Old\nNote';
+	note_assert($literalReload->ProcessString($legacy->label, $legacy, true, true) === "Old\nNote", 'legacy multiline semantics retained');
 	$oldWidth = $saved->width;
 	$saved->width = 50000;
 	note_assert(wm_sharp_notes($saved) === [], 'large map allocation bounded');

From 5080de3bc558d892f0ed19e5447b9ff5713e42cc Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 20:19:05 +1030
Subject: [PATCH 24/35] Dispatch node and link Save buttons independently of
 placement mode

---
 js/editor.js                            | 12 +++++++++++-
 tests/Browser/EditorSaveFailureTest.cjs |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/js/editor.js b/js/editor.js
index 1c4338c0..65b95281 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -917,7 +917,17 @@ function wmReloadEditor() {
 	window.location.replace(wmEditorReloadUrl());
 }
 
-function form_submit() {
+function form_submit(event) {
+	// Property dialogs can remain open while a toolbar placement action is active.
+	// Their own Save buttons always dispatch the properties they are showing.
+	var button = event && event.currentTarget && event.currentTarget.id;
+	if (button === 'tb_node_submit' || button === 'tb_link_submit') {
+		var node = button === 'tb_node_submit';
+		$('#action').val(node ? 'set_node_properties' : 'set_link_properties');
+		$('#param').val($(node ? '#node_name' : '#link_name').val());
+		mapmode('existing');
+	}
+
 	if ($('#action').val() === 'place_note') {
 		show_note('', $('#x').val(), $('#y').val());
 		return;
diff --git a/tests/Browser/EditorSaveFailureTest.cjs b/tests/Browser/EditorSaveFailureTest.cjs
index 4bb4e84b..0f5994da 100644
--- a/tests/Browser/EditorSaveFailureTest.cjs
+++ b/tests/Browser/EditorSaveFailureTest.cjs
@@ -1,7 +1,7 @@
 const {JSDOM}=require('jsdom'),jquery=require('jquery'),fs=require('node:fs'),path=require('node:path'),assert=require('node:assert/strict');
 const dom=new JSDOM('<input id="action" value="set_map_properties"><input id="mapname" value="map.conf">',{runScripts:'outside-only'}),w=dom.window,$=jquery(w);w.$=w.jQuery=$;w.editor_url='/editor';w.wmEditorText={staleError:'Reload the editor',saveError:'Unable to save changes'};
 let request,message,closed=0,refreshed=0;$.ajax=opts=>request=opts;w.alert=text=>message=text;w.hide_all_dialogs=()=>closed++;$.get=()=>refreshed++;
-const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');w.eval(source.slice(source.indexOf('function form_submit()'),source.indexOf('function map_properties()')));
+const source=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');w.eval(source.slice(source.indexOf('function form_submit('),source.indexOf('function map_properties()')));
 w.form_submit();request.error();assert.equal(message,'Unable to save changes');assert.equal(closed,0);assert.equal(refreshed,0);assert.equal($('#action').val(),'set_map_properties');
 w.WMConfigRevision='b'.repeat(64);w.form_submit();assert.match(request.data,/config_revision=b{64}/);request.error({status:409});assert.equal(message,'Reload the editor');assert.equal(closed,0);assert.equal(refreshed,0);
 let reloads=0;w.hide_all_dialogs=()=>closed++;w.wmReloadEditor=()=>reloads++;$.get=()=>{throw Error('partial editor refresh');};request.success();assert.equal(reloads,1);

From 727af94266fd917deeae1e9021b4e8a34df52bbc Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 20:54:41 +1030
Subject: [PATCH 25/35] Handle failed creation, unavailable fonts and read-only
 registration

---
 lib/WeatherMap.class.php                      | 11 +++--
 lib/WeatherMap.config.php                     | 42 ++++++++++++++++-
 lib/editor.actions.php                        | 16 ++++---
 lib/editor.notes.php                          |  4 +-
 tests/Support/ConfigWriteAtomicRegression.php | 45 +++++++++++++++++++
 tests/Support/NoteAllocationRegression.php    |  4 ++
 weathermap-cacti-plugin-editor.php            | 10 ++++-
 weathermap-cacti-plugin-mgmt.php              |  4 +-
 8 files changed, 121 insertions(+), 15 deletions(-)

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 434262a6..771ee3e9 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -343,6 +343,7 @@ class WeatherMap extends WeatherMapBase {
 	/** @var mixed */
 	var $configfile;
 	var $config_revision = null;
+	var $config_dependencies = [];
 	var $editor_config_revision = null;
 	/** @var mixed */
 	var $imagefile;
@@ -2449,7 +2450,7 @@ function DrawTitle($image, $font, $colour) {
 	 */
 	function ReadConfig($input, $is_include = false) {
 		global $config, $weathermap_error_suppress;
-		if (!$is_include) $this->config_revision = null;
+		if (!$is_include) { $this->config_revision = null; $this->config_dependencies = []; }
 
 		$curnode    = null;
 		$curlink    = null;
@@ -2479,6 +2480,8 @@ function ReadConfig($input, $is_include = false) {
 			$filename = $input;
 
 			if ($is_include) {
+				$dependencyPath = (realpath(dirname($filename)) ?: dirname($filename)) . '/' . basename($filename);
+				if (!array_key_exists($dependencyPath, $this->config_dependencies)) $this->config_dependencies[$dependencyPath] = null;
 				wm_debug('ReadConfig Detected that this is an INCLUDED config filename.');
 
 				if ($is_include && in_array($filename, $this->included_files, true)) {
@@ -2508,7 +2511,9 @@ function ReadConfig($input, $is_include = false) {
 					}
 
 					fclose($fd);
-					if (!$is_include) $this->config_revision = hash_final($revision);
+					$loadedRevision = hash_final($revision);
+					if (!$is_include) $this->config_revision = $loadedRevision;
+					else $this->config_dependencies[$dependencyPath] = $loadedRevision;
 				}
 			}
 		}
@@ -3859,7 +3864,7 @@ function WriteConfig($filename, $createOnly = false, $expectedRevision = null, $
 			$closed = fclose($fd);
 
 			$sameFile = $this->configfile !== '' && $filename === $this->configfile;
-			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly, $heldLock);
+			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly, $heldLock, $this->config_dependencies);
 			if ($saved && $sameFile) $this->config_revision = hash('sha256', $contents);
 			return $saved;
 		} else {
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 87c1d1a7..0881ad57 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -74,6 +74,31 @@ function writeAll($stream, $contents) {
 	return true;
 }
 
+/**
+ * Compare every included configuration against the bytes used by the snapshot.
+ * @param array<string,string> $dependencies Included filenames and hashes.
+ * @return bool Whether all dependencies still match.
+ */
+function dependenciesMatch($dependencies) {
+	foreach ($dependencies as $path => $revision) {
+		clearstatcache(true, $path);
+		if (!is_string($revision) || @hash_file('sha256', $path) !== $revision) return false;
+	}
+	return true;
+}
+
+/**
+ * Bind an editor token to its root configuration and included dependencies.
+ * @param string|null $root Root configuration hash.
+ * @param array<string,string> $dependencies Included filenames and hashes.
+ * @return string|null Snapshot token.
+ */
+function snapshotRevision($root, $dependencies) {
+	if (!$dependencies) return $root;
+	ksort($dependencies);
+	return hash('sha256', serialize([$root, $dependencies]));
+}
+
 /**
  * Replace a configuration only after a complete, flushed and closed local write.
  *
@@ -84,9 +109,11 @@ function writeAll($stream, $contents) {
  * @param bool $createOnly Refuse to replace an existing destination.
  * @param resource|null $heldLock Optional caller-owned mutex for this destination directory.
  *
+ * @param array<string,string> $dependencies Included configuration snapshots.
+ * @param callable|null $validate Additional commit-time validation.
  * @return bool Success; failures preserve the existing configuration.
  */
-function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision = null, $createOnly = false, $heldLock = null) {
+function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision = null, $createOnly = false, $heldLock = null, $dependencies = [], $validate = null) {
 	if (strpos($filename, '://') !== false) return false;
 	$lockDirectory = dirname($filename);
 	if (is_link($filename)) $filename = realpath($filename);
@@ -101,12 +128,24 @@ function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision
 	if (!$lock) return false;
 	$temp = false;
 	$stream = false;
+	$dependencyLocks = [];
 	try {
 		clearstatcache(true, $filename);
 		if (($createOnly || !$existed) && file_exists($filename)) return false;
 		if ($mustExist && !is_file($filename)) return false;
 		if ($expectedRevision !== null && @hash_file('sha256', $filename) !== $expectedRevision) return false;
 		if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
+		// Additional directories use nonblocking locks so opposing include graphs cannot deadlock.
+		$directories = array_unique(array_map('dirname', array_keys($dependencies)));
+		sort($directories);
+		foreach ($directories as $directory) {
+			if (realpath($directory) === realpath($lockDirectory)) continue;
+			$dependencyLock = acquire($directory, false);
+			if (!$dependencyLock) return false;
+			$dependencyLocks[] = $dependencyLock;
+		}
+		if (!dependenciesMatch($dependencies) || ($validate !== null && !$validate())) return false;
+
 		$temp = @tempnam(dirname($filename), '.wm-config-');
 		if ($temp === false) return false;
 		$stream = @fopen($temp, 'wb');
@@ -122,6 +161,7 @@ function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision
 	} finally {
 		if (is_resource($stream)) fclose($stream);
 		if ($temp !== false && file_exists($temp)) unlink($temp);
+		foreach ($dependencyLocks as $dependencyLock) release($dependencyLock);
 		if ($ownsLock) release($lock);
 	}
 }
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index fc773180..1c9446e4 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -40,6 +40,8 @@
  +-------------------------------------------------------------------------+
 */
 
+require_once __DIR__ . '/WeatherMap.config.php';
+
 /** editor.actions.php
  *
  * All the functions used by the that wrap in request variables
@@ -69,7 +71,7 @@ function wm_editor_read_config($map, $mapfile) {
 		return false;
 	}
 	$revision = get_nfilter_request_var('config_revision');
-	if ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals($map->config_revision, $revision))) {
+	if ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies), $revision))) {
 		http_response_code(409);
 		return false;
 	}
@@ -88,7 +90,7 @@ function wm_editor_read_config($map, $mapfile) {
 function wm_editor_write_config($map, $mapfile, $createOnly = false) {
 	if (!$map->WriteConfig($mapfile, $createOnly, $map->editor_config_revision)) {
 		$current = is_file($mapfile) ? @hash_file('sha256', $mapfile) : false;
-		$stale = $map->editor_config_revision !== null && $current !== false && $current !== $map->editor_config_revision;
+		$stale = !\WeathermapConfig\dependenciesMatch($map->config_dependencies) || $map->editor_config_revision !== null && $current !== false && $current !== $map->editor_config_revision;
 		http_response_code($stale ? 409 : 500);
 		return false;
 	}
@@ -106,7 +108,7 @@ function newMap($mapfile) {
 
 	require_once __DIR__ . '/editor.new-map-preset.php';
 	wm_new_map_preset($map);
-	wm_editor_write_config($map, $mapfile, true);
+	return wm_editor_write_config($map, $mapfile, true);
 }
 
 /**
@@ -134,11 +136,13 @@ function newMapCopy($mapfile) {
 		if (file_exists($sourcemap) && is_readable($sourcemap)) {
 			if (!$map->ReadConfig($sourcemap) || !is_string($map->config_revision)) {
 				http_response_code(404);
-				return;
+				return false;
 			}
-			wm_editor_write_config($map, $mapfile, true);
+			return wm_editor_write_config($map, $mapfile, true);
 		}
 	}
+	http_response_code(404);
+	return false;
 }
 
 /**
@@ -154,7 +158,7 @@ function getMapJavaScript($mapfile, $map = null) {
 	}
 
 	print $map->asJS();
-	print 'var WMConfigRevision = ' . json_encode($map->config_revision) . ';';
+	print 'var WMConfigRevision = ' . json_encode(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies)) . ';';
 	print 'var WMNotes = ' . json_encode(wm_editor_note_data($map), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
 }
 
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index a2356a22..5580d007 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -57,7 +57,9 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 	if ($name !== '' && (!isset($map->nodes[$name]) || $map->nodes[$name]->get_hint('editor_note', '0') !== '1')) {
 		return false;
 	}
-	$font = wm_comment_resolve_font($map, $values['font'] ?? null);
+	$selection = $values['font'] ?? null;
+	$font = is_scalar($selection) && preg_match('/^\d+$/D', (string)$selection)
+		? wm_note_font_id($map, (string)$selection) : wm_comment_resolve_font($map, $selection);
 	if ($font === null) {
 		return false;
 	}
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index f7973717..a65c19f7 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -266,6 +266,27 @@ function atomic_assert($condition, $message) {
 			\WeathermapConfig\release($logicalLock); unlink($alias);
 		}
 		unlink($externalFile); rmdir($external);
+
+		$includeFile = $dir . '/included.conf'; $includeRoot = $dir . '/include-root.conf';
+		file_put_contents($includeFile, "TITLE Included old\n");
+		$includeConfig = "WIDTH 600\nHEIGHT 300\nINCLUDE " . $includeFile . "\n";
+		file_put_contents($includeRoot, $includeConfig);
+		$dependent = new \WeatherMap; $dependent->ReadConfig($includeRoot);
+		$token = \WeathermapConfig\snapshotRevision($dependent->config_revision, $dependent->config_dependencies);
+		file_put_contents($includeFile, "TITLE Included winner\n"); $dependent->title = 'Stale edit';
+		atomic_assert(!$dependent->WriteConfig($includeRoot) && file_get_contents($includeRoot) === $includeConfig, 'included file changes reject stale root persistence');
+		$GLOBALS['__test_nfilter_request'] = ['config_revision' => $token]; http_response_code(200);
+		atomic_assert(!wm_editor_read_config(new \WeatherMap, $includeRoot) && http_response_code() === 409, 'included-file changes invalidate loaded editor page token');
+		$GLOBALS['__test_nfilter_request'] = []; $fresh = new \WeatherMap; $fresh->ReadConfig($includeRoot);
+		atomic_assert($fresh->WriteConfig($includeRoot), 'unchanged included dependency can be saved');
+		atomic_assert(!\WeathermapConfig\dependenciesMatch([$includeFile => null]), 'unread included dependency rejected');
+		$outside = $dir . '/dependency-directory'; mkdir($outside); $outsideFile = $outside . '/outside.conf'; file_put_contents($outsideFile, "TITLE Outside\n");
+		file_put_contents($includeRoot, "WIDTH 600\nHEIGHT 300\nINCLUDE " . $outsideFile . "\n");
+		$externalMap = new \WeatherMap; $externalMap->ReadConfig($includeRoot); $busy = \WeathermapConfig\acquire($outside);
+		atomic_assert(!$externalMap->WriteConfig($includeRoot), 'busy dependency directory rejects save without deadlock');
+		\WeathermapConfig\release($busy);
+		atomic_assert($externalMap->WriteConfig($includeRoot), 'external dependency save succeeds after mutex release');
+		unlink($outsideFile); unlink($outside . '/.weathermap-config.lock'); rmdir($outside);
 		$wrong = \fopen($file, 'rb');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
 		// Revision metadata must describe the same map snapshot as the controls.
@@ -416,6 +437,30 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			atomic_assert(file_get_contents($destination) === 'Concurrent creator', 'management create-only preserves concurrent destination');
 			unlink($destination);
 		}
+
+		if (!function_exists('db_fetch_insert_id')) { function db_fetch_insert_id() { return 1; } }
+		// A read-only configs directory with no provisioned mutex still permits registration.
+		foreach (['add_config', 'wmap_get_title', 'map_resort'] as $functionName) {
+			$start = strpos($management, 'function ' . $functionName . '('); $end = strpos($management, "\n/**", $start);
+			eval(str_replace('__DIR__', var_export($plugin, true), substr($management, $start, $end - $start)));
+		}
+		$readonly = $dir . '/readonly'; mkdir($readonly); file_put_contents($readonly . '/map.conf', "TITLE Readonly\n");
+		chmod($readonly, 0555); $GLOBALS['weathermap_confdir'] = realpath($readonly); $GLOBALS['__test_db_calls'] = [];
+		try {
+			add_config($readonly . '/map.conf');
+			atomic_assert(cacti_count(array_filter($GLOBALS['__test_db_calls'], fn ($call) => str_contains($call['sql'], 'INSERT INTO weathermap_maps'))) === 1, 'read-only config registered without a directory lock file');
+		} finally { chdir($plugin); chmod($readonly, 0755); unlink($readonly . '/map.conf'); if (is_file($readonly . '/.weathermap-config.lock')) unlink($readonly . '/.weathermap-config.lock'); rmdir($readonly); }
+		$GLOBALS['weathermap_confdir'] = $dir;
+		foreach (['newmap', 'newmapcopy'] as $createAction) {
+			$destination = $dir . '/failed-editor-create.conf';
+			$GLOBALS['__test_request']['sourcemap'] = basename($file); $GLOBALS['__test_nfilter_request'] = ['sourcemap' => basename($file)]; $GLOBALS['mapdir'] = $dir;
+			$GLOBALS['config_fault'] = 'rename'; http_response_code(200);
+			$controller = file_get_contents($plugin . '/weathermap-cacti-plugin-editor.php'); $start = strpos($controller, "case '" . $createAction . "':"); $colon = strpos($controller, ':', $start); $end = strpos($controller, "case '", $colon);
+			$dispatch = substr($controller, $colon + 1, $end - $colon - 1); $mapfile = $destination; $terminated = false;
+			ob_start(); try { eval('switch (true) { case true:' . str_replace('exit();', 'throw new \\RuntimeException("create-finished");', $dispatch) . '}'); } catch (\RuntimeException $error) { $terminated = $error->getMessage() === 'create-finished'; } $message = ob_get_clean();
+			atomic_assert($terminated && http_response_code() === 500 && !is_file($destination) && str_contains($message, 'Could not save'), 'failed create stops controller with save status and guidance');
+			$GLOBALS['config_fault'] = ''; unset($GLOBALS['__test_request']['sourcemap']);
+		}
 		$start = strpos($management, 'function map_get_next_name('); $end = strpos($management, "\n/**", $start);
 		eval(str_replace('__DIR__', var_export($plugin, true), substr($management, $start, $end - $start)));
 		$start = strpos($management, 'function map_duplicate('); $end = strpos($management, "\n/**", $start);
diff --git a/tests/Support/NoteAllocationRegression.php b/tests/Support/NoteAllocationRegression.php
index 4f099364..52f98710 100644
--- a/tests/Support/NoteAllocationRegression.php
+++ b/tests/Support/NoteAllocationRegression.php
@@ -74,6 +74,10 @@ function imagecreatetruecolor($width, $height) {
 			if (!wm_editor_save_note($map,$values,0) || $map->nodes['label']->labelfont !== 3) throw new \RuntimeException('submitted invalid registered font must fall back');
 			if ($fontCase === 'unreadable') chmod($fontPath,0600);
 		}
+		$values['font'] = '99999';
+		if (!wm_editor_save_note($map, $values, 0) || $map->nodes['label']->labelfont !== 3) throw new \RuntimeException('unavailable submitted numeric font falls back');
+		$values['font'] = '../bad.ttf';
+		if (wm_editor_save_note($map, $values, 0)) throw new \RuntimeException('path-like font still rejected');
 		if (wm_note_font_id($map,99999)!==3) throw new \RuntimeException('unknown font fallback');
 		$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = 1;
 		if (wm_note_display_image($map, []) !== false) throw new \RuntimeException('direct display allocation failure');
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index 6aee181f..e4c59669 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -137,11 +137,17 @@
 		display_datasources();
 		exit;
 	case 'newmap':
-		newMap($mapfile);
+		if (!newMap($mapfile)) {
+			print __esc('Could not save the map configuration.', 'weathermap');
+			exit();
+		}
 
 		break;
 	case 'newmapcopy':
-		newMapCopy($mapfile);
+		if (!newMapCopy($mapfile)) {
+			print __esc('Could not save the map configuration.', 'weathermap');
+			exit();
+		}
 
 		break;
 	case 'font_samples':
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index de7bf3fc..2e7ec450 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -1754,7 +1754,7 @@ function add_config($file) {
 		require_once __DIR__ . '/lib/editor.config-delete.php';
 		require_once __DIR__ . '/lib/WeatherMap.config.php';
 		$directory_lock = \WeathermapConfig\acquire($weathermap_confdir, false);
-		if (!$directory_lock) {
+		if (!$directory_lock && (is_writable($weathermap_confdir) || file_exists($weathermap_confdir . '/.weathermap-config.lock'))) {
 			raise_message('path_missing', __esc('The configuration file is unavailable. Please retry.', 'weathermap'), MESSAGE_LEVEL_ERROR);
 			return;
 		}
@@ -1793,7 +1793,7 @@ function add_config($file) {
 				fclose($lock);
 			}
 		} finally {
-			\WeathermapConfig\release($directory_lock);
+			if ($directory_lock) \WeathermapConfig\release($directory_lock);
 		}
 	}
 }

From 3ffca918ea3ba5c16c995600d0adcc8e40cc9a84 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 21:03:27 +1030
Subject: [PATCH 26/35] Keep read-only dependency checks and creation retry
 guidance safe

---
 lib/WeatherMap.config.php                     | 6 +++++-
 lib/editor.notes.php                          | 2 +-
 tests/Support/ConfigWriteAtomicRegression.php | 6 ++++--
 weathermap-cacti-plugin-editor.php            | 4 ++--
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 0881ad57..b56a7899 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -36,6 +36,7 @@ function acquire($directory = null, $blocking = true) {
 	$directory = realpath($directory ?? dirname(__DIR__) . '/configs');
 	if ($directory === false) return false;
 	$path = $directory . '/.weathermap-config.lock';
+	if (!is_writable($directory) && !file_exists($path) && !is_link($path)) return false;
 	$handle = @fopen($path, 'c+b');
 	if (!$handle) $handle = @fopen($path, 'rb');
 	if ($handle && flock($handle, LOCK_EX | ($blocking ? 0 : LOCK_NB))) return $handle;
@@ -141,7 +142,10 @@ function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision
 		foreach ($directories as $directory) {
 			if (realpath($directory) === realpath($lockDirectory)) continue;
 			$dependencyLock = acquire($directory, false);
-			if (!$dependencyLock) return false;
+			if (!$dependencyLock) {
+				if (!is_writable($directory) && !file_exists($directory . '/.weathermap-config.lock')) continue;
+				return false;
+			}
 			$dependencyLocks[] = $dependencyLock;
 		}
 		if (!dependenciesMatch($dependencies) || ($validate !== null && !$validate())) return false;
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index 5580d007..2e1c5b09 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -58,7 +58,7 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 		return false;
 	}
 	$selection = $values['font'] ?? null;
-	$font = is_scalar($selection) && preg_match('/^\d+$/D', (string)$selection)
+	$font = (is_string($selection) || is_int($selection)) && preg_match('/^\d+$/D', (string)$selection)
 		? wm_note_font_id($map, (string)$selection) : wm_comment_resolve_font($map, $selection);
 	if ($font === null) {
 		return false;
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index a65c19f7..4c5ff15f 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -286,7 +286,9 @@ function atomic_assert($condition, $message) {
 		atomic_assert(!$externalMap->WriteConfig($includeRoot), 'busy dependency directory rejects save without deadlock');
 		\WeathermapConfig\release($busy);
 		atomic_assert($externalMap->WriteConfig($includeRoot), 'external dependency save succeeds after mutex release');
-		unlink($outsideFile); unlink($outside . '/.weathermap-config.lock'); rmdir($outside);
+		unlink($outside . '/.weathermap-config.lock'); chmod($outside, 0555);
+		atomic_assert($externalMap->WriteConfig($includeRoot), 'read-only included dependency needs no new lock file');
+		chmod($outside, 0755); unlink($outsideFile); rmdir($outside);
 		$wrong = \fopen($file, 'rb');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
 		// Revision metadata must describe the same map snapshot as the controls.
@@ -458,7 +460,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			$controller = file_get_contents($plugin . '/weathermap-cacti-plugin-editor.php'); $start = strpos($controller, "case '" . $createAction . "':"); $colon = strpos($controller, ':', $start); $end = strpos($controller, "case '", $colon);
 			$dispatch = substr($controller, $colon + 1, $end - $colon - 1); $mapfile = $destination; $terminated = false;
 			ob_start(); try { eval('switch (true) { case true:' . str_replace('exit();', 'throw new \\RuntimeException("create-finished");', $dispatch) . '}'); } catch (\RuntimeException $error) { $terminated = $error->getMessage() === 'create-finished'; } $message = ob_get_clean();
-			atomic_assert($terminated && http_response_code() === 500 && !is_file($destination) && str_contains($message, 'Could not save'), 'failed create stops controller with save status and guidance');
+			atomic_assert($terminated && http_response_code() === 500 && !is_file($destination) && str_contains($message, 'Please try again'), 'failed create stops controller with save status and guidance');
 			$GLOBALS['config_fault'] = ''; unset($GLOBALS['__test_request']['sourcemap']);
 		}
 		$start = strpos($management, 'function map_get_next_name('); $end = strpos($management, "\n/**", $start);
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index e4c59669..434a7462 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -138,14 +138,14 @@
 		exit;
 	case 'newmap':
 		if (!newMap($mapfile)) {
-			print __esc('Could not save the map configuration.', 'weathermap');
+			print __esc('Unable to save changes. Please try again.', 'weathermap');
 			exit();
 		}
 
 		break;
 	case 'newmapcopy':
 		if (!newMapCopy($mapfile)) {
-			print __esc('Could not save the map configuration.', 'weathermap');
+			print __esc('Unable to save changes. Please try again.', 'weathermap');
 			exit();
 		}
 

From f25c24603faf8e36360af4db71e71d990c9e54ac Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 22:08:45 +1030
Subject: [PATCH 27/35] Use effective render dimensions for editor and note
 bounds

---
 lib/WeatherMap.config.php                     |  2 +-
 lib/editor.notes.php                          | 42 +++++++++++++++++--
 tests/Support/ConfigWriteAtomicRegression.php | 11 ++++-
 tests/Support/EditorNotesEngineRegression.php | 14 +++++++
 weathermap-cacti-plugin-editor.php            |  7 ++--
 5 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index b56a7899..499b7d35 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -137,7 +137,7 @@ function atomicWrite($filename, $contents, $mustExist = false, $expectedRevision
 		if ($expectedRevision !== null && @hash_file('sha256', $filename) !== $expectedRevision) return false;
 		if (file_exists($filename) && (!is_file($filename) || !is_writable($filename))) return false;
 		// Additional directories use nonblocking locks so opposing include graphs cannot deadlock.
-		$directories = array_unique(array_map('dirname', array_keys($dependencies)));
+		$directories = array_unique(array_merge([dirname($filename)], array_map('dirname', array_keys($dependencies))));
 		sort($directories);
 		foreach ($directories as $directory) {
 			if (realpath($directory) === realpath($lockDirectory)) continue;
diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index 2e1c5b09..d088ef0f 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -22,6 +22,41 @@
  +-------------------------------------------------------------------------+
 */
 
+/**
+ * Determine logical dimensions after background sizing and post-processing.
+ * @param WeatherMap $map Loaded editor snapshot.
+ * @return int[] Effective width and height without changing the saved configuration.
+ */
+function wm_note_effective_dimensions($map) {
+	$preview = clone $map;
+	$preview->image = null;
+	foreach ($preview->nodes as $name => $node) {
+		$preview->nodes[$name] = clone $node;
+		$preview->nodes[$name]->owner = $preview;
+		$preview->nodes[$name]->image = null;
+	}
+	foreach ($preview->links as $name => $link) {
+		$preview->links[$name] = clone $link;
+		$preview->links[$name]->owner = $preview;
+		foreach (['a', 'b'] as $end) if ($link->$end instanceof WeatherMapNode) $preview->links[$name]->$end = $preview->nodes[$link->$end->name];
+	}
+	foreach ($preview->seen_zlayers as $layer => $items) {
+		foreach ($items as $key => $item) {
+			if ($item instanceof WeatherMapNode) $preview->seen_zlayers[$layer][$key] = $preview->nodes[$item->name];
+			elseif ($item instanceof WeatherMapLink) $preview->seen_zlayers[$layer][$key] = $preview->links[$item->name];
+			elseif ($item === $map) $preview->seen_zlayers[$layer][$key] = $preview;
+		}
+	}
+	foreach ($preview->plugins['post'] as $name => $plugin) $preview->plugins['post'][$name] = clone $plugin;
+	try {
+		if (function_exists('fixMapBackgroundAndImages')) fixMapBackgroundAndImages($preview);
+		$preview->DrawMap('null');
+		return [(int)$preview->width, (int)$preview->height];
+	} finally {
+		$preview->CleanUp();
+	}
+}
+
 /**
  * Create or update a label-only note using existing map node directives.
  *
@@ -49,9 +84,10 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 			return false;
 		}
 	}
+	[$width, $height] = wm_note_effective_dimensions($map);
 	$x = (int)$values['x'];
 	$y = (int)$values['y'];
-	if ($x > $map->width || $y > $map->height) {
+	if ($x > $width || $y > $height) {
 		return false;
 	}
 	if ($name !== '' && (!isset($map->nodes[$name]) || $map->nodes[$name]->get_hint('editor_note', '0') !== '1')) {
@@ -96,8 +132,8 @@ function wm_editor_save_note($map, $values, $grid_snap_value = 0) {
 	$node->labelfont = $font;
 	$node->add_hint('editor_note_align', $alignment);
 	$node->labelfontcolour = [hexdec(substr($colour, 1, 2)), hexdec(substr($colour, 3, 2)), hexdec(substr($colour, 5, 2))];
-	$node->x = min($map->width, snap($x, $grid_snap_value));
-	$node->y = min($map->height, snap($y, $grid_snap_value));
+	$node->x = min($width, snap($x, $grid_snap_value));
+	$node->y = min($height, snap($y, $grid_snap_value));
 	return true;
 }
 /**
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 4c5ff15f..e0ea37d0 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -262,10 +262,10 @@ function atomic_assert($condition, $message) {
 		if (@symlink($externalFile, $alias)) {
 			$logicalLock = \WeathermapConfig\acquire($dir);
 			atomic_assert(\WeathermapConfig\atomicWrite($alias, $original, true, hash('sha256', $original), false, $logicalLock), 'external symlink accepts caller-held logical configuration mutex');
-			atomic_assert(!is_file($external . '/.weathermap-config.lock'), 'symlink replacement does not choose external target mutex');
+			atomic_assert(is_file($external . '/.weathermap-config.lock'), 'symlink writes retain logical mutex and also acquire the physical target mutex');
 			\WeathermapConfig\release($logicalLock); unlink($alias);
 		}
-		unlink($externalFile); rmdir($external);
+		unlink($externalFile); unlink($external . '/.weathermap-config.lock'); rmdir($external);
 
 		$includeFile = $dir . '/included.conf'; $includeRoot = $dir . '/include-root.conf';
 		file_put_contents($includeFile, "TITLE Included old\n");
@@ -289,6 +289,13 @@ function atomic_assert($condition, $message) {
 		unlink($outside . '/.weathermap-config.lock'); chmod($outside, 0555);
 		atomic_assert($externalMap->WriteConfig($includeRoot), 'read-only included dependency needs no new lock file');
 		chmod($outside, 0755); unlink($outsideFile); rmdir($outside);
+
+		$targetDir = $dir . '/alias-target'; mkdir($targetDir); $targetFile = $targetDir . '/map.conf'; file_put_contents($targetFile, $original);
+		$alias = $dir . '/alias.conf'; symlink($targetFile, $alias); $targetLock = \WeathermapConfig\acquire($targetDir);
+		atomic_assert(!\WeathermapConfig\atomicWrite($alias, 'Alias change', true, hash('sha256', $original)) && file_get_contents($targetFile) === $original, 'alias cannot bypass a held physical target mutex');
+		\WeathermapConfig\release($targetLock);
+		atomic_assert(\WeathermapConfig\atomicWrite($alias, $original, true, hash('sha256', $original)), 'alias save succeeds after shared target mutex release');
+		unlink($alias); unlink($targetFile); unlink($targetDir . '/.weathermap-config.lock'); rmdir($targetDir);
 		$wrong = \fopen($file, 'rb');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
 		// Revision metadata must describe the same map snapshot as the controls.
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index 6de11a38..42cc3203 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -41,6 +41,20 @@ function note_assert($value, $message) {
 	$file = $directory . '/note.conf';
 	$map->WriteConfig($file);
 	$map->ReadConfig($file);
+
+	$background = $directory . '/large-background.png'; $bitmap = imagecreatetruecolor(200, 100); imagepng($bitmap, $background); imagedestroy($bitmap);
+	$sized = new WeatherMap; $sized->width = 120; $sized->height = 120; $sized->background = $background; $sized->add_hint('background_sizing', 'image');
+	note_assert(wm_note_effective_dimensions($sized) === [200, 100] && $sized->width === 120 && $sized->height === 120, 'background dimensions are effective while configured dimensions remain unchanged');
+	$backgroundValues = ['name' => '', 'text' => 'Inside background', 'font' => '3', 'colour' => '#000000', 'x' => 150, 'y' => 80];
+	note_assert(wm_editor_save_note($sized, $backgroundValues), 'note fits effective background beyond configured width');
+	$backgroundValues['x'] = 201; note_assert(!wm_editor_save_note($sized, $backgroundValues), 'note outside effective background is rejected');
+	class DimensionPostProcessor extends WeatherMapPostProcessor { function run(&$map) { $map->width = 240; $map->height = 90; } }
+	$sized->background = ''; $sized->plugins['post']['DimensionPostProcessor'] = new DimensionPostProcessor; $sized->postprocessclasses = ['DimensionPostProcessor'];
+	note_assert(wm_note_effective_dimensions($sized) === [240, 90] && $sized->width === 120, 'postprocessor dimensions are reflected without changing original map');
+	$controller = file_get_contents($plugin . '/weathermap-cacti-plugin-editor.php');
+	$start = strpos($controller, "<input id='xycapture'"); $end = strpos($controller, "<input id='x'", $start); $markup = substr($controller, $start, $end - $start);
+	$editor_width = 200; $editor_height = 100; $imageurl = 'fixture.png'; ob_start(); eval('?>' . $markup); $renderedElements = ob_get_clean();
+	note_assert(substr_count($renderedElements, "width='200'") === 4 && substr_count($renderedElements, "height='100'") === 4, 'editor image attributes and data coordinates use effective logical size');
 	$values = ['name' => '', 'text' => "Main site\n10.0.0.0/24", 'font' => 'bundled:Vera.ttf:11', 'colour' => '#0000ff', 'x' => '155', 'y' => '80'];
 	note_assert(wm_editor_save_note($map, $values), 'create');
 	$name = array_keys(wm_editor_note_data($map))[0];
diff --git a/weathermap-cacti-plugin-editor.php b/weathermap-cacti-plugin-editor.php
index 434a7462..0489a3a8 100644
--- a/weathermap-cacti-plugin-editor.php
+++ b/weathermap-cacti-plugin-editor.php
@@ -256,6 +256,7 @@
 // expected.  This function should re redundant as the images are relocated during upgrade, but
 // is left here just in case.
 fixMapBackgroundAndImages($map);
+[$editor_width, $editor_height] = wm_note_effective_dimensions($map);
 
 // get the list from the images/ folder too
 $image_list   = get_imagelist('objects');
@@ -337,8 +338,8 @@
 	</div>
 	<form id='frmMain' action='<?php print $editor_name ?>' method='post'>
 		<div class='mainArea'>
-			<input id='xycapture' name='xycapture' width='<?php print html_escape($map->width); ?>' height='<?php print html_escape($map->height); ?>' data-width='<?php print html_escape($map->width); ?>' data-height='<?php print html_escape($map->height); ?>' style='display:none' type='image' src='<?php print html_escape($imageurl); ?>' />
-			<img id='existingdata' name='existingdata' width='<?php print html_escape($map->width); ?>' height='<?php print html_escape($map->height); ?>' data-width='<?php print html_escape($map->width); ?>' data-height='<?php print html_escape($map->height); ?>' src='<?php print html_escape($imageurl); ?>' usemap='#weathermap_imap' />
+			<input id='xycapture' name='xycapture' width='<?php print html_escape($editor_width); ?>' height='<?php print html_escape($editor_height); ?>' data-width='<?php print html_escape($editor_width); ?>' data-height='<?php print html_escape($editor_height); ?>' style='display:none' type='image' src='<?php print html_escape($imageurl); ?>' />
+			<img id='existingdata' name='existingdata' width='<?php print html_escape($editor_width); ?>' height='<?php print html_escape($editor_height); ?>' data-width='<?php print html_escape($editor_width); ?>' data-height='<?php print html_escape($editor_height); ?>' src='<?php print html_escape($imageurl); ?>' usemap='#weathermap_imap' />
 			<input id='x' name='x' type='hidden' />
 			<input id='y' name='y' type='hidden' />
 			<div class='debug' style='display:none'><p><strong><?php print __('Debug', 'weathermap'); ?></strong>
@@ -396,7 +397,7 @@
 					<?php foreach (['#000000' => __esc('Black', 'weathermap'), '#0000ff' => __esc('Blue', 'weathermap'), '#cc0000' => __esc('Red', 'weathermap'), '#008000' => __esc('Green', 'weathermap'), '#800080' => __esc('Purple', 'weathermap'), '#b35900' => __esc('Orange', 'weathermap'), '#666666' => __esc('Grey', 'weathermap'), '#ffffff' => __esc('White', 'weathermap')] as $colour => $label) { ?>
 						<button type='button' class='wm-note-colour ui-button ui-corner-all' data-colour='<?php print $colour; ?>' aria-pressed='false'><span aria-hidden='true' style='display:inline-block;width:12px;height:12px;background:<?php print $colour; ?>;border:1px solid #888;margin-right:5px'></span><?php print $label; ?></button>
 					<?php } ?></div></td></tr>
-					<tr><td><?php print __esc('Position', 'weathermap'); ?></td><td><input type='text' aria-label='X' size='4' class='ui-state-default ui-corner-all' id='note_x' name='note_x' min='0' max='<?php print (int)$map->width; ?>' />,<input type='text' aria-label='Y' size='4' class='ui-state-default ui-corner-all' id='note_y' name='note_y' min='0' max='<?php print (int)$map->height; ?>' /></td></tr>
+					<tr><td><?php print __esc('Position', 'weathermap'); ?></td><td><input type='text' aria-label='X' size='4' class='ui-state-default ui-corner-all' id='note_x' name='note_x' min='0' max='<?php print $editor_width; ?>' />,<input type='text' aria-label='Y' size='4' class='ui-state-default ui-corner-all' id='note_y' name='note_y' min='0' max='<?php print $editor_height; ?>' /></td></tr>
 				</table>
 				<button type='button' id='note_advanced_toggle' class='ui-button ui-corner-all' aria-expanded='false' aria-controls='note_advanced'><?php print __esc('Advanced settings', 'weathermap'); ?></button><div id='note_advanced' style='display:none'><p><label for='note_colour'><?php print __esc('Custom colour', 'weathermap'); ?></label> <input type='color' id='note_colour' name='note_colour' value='#000000' /></p></div>
 				<p id='wm-note-error' role='alert' style='display:none'></p>

From d6941c1af1e601d9d2272a32852f6b68c7b9a92b Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 22:11:08 +1030
Subject: [PATCH 28/35] Limit preview layer cloning to supported node and link
 objects

---
 lib/editor.notes.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/editor.notes.php b/lib/editor.notes.php
index d088ef0f..be48507d 100644
--- a/lib/editor.notes.php
+++ b/lib/editor.notes.php
@@ -44,7 +44,6 @@ function wm_note_effective_dimensions($map) {
 		foreach ($items as $key => $item) {
 			if ($item instanceof WeatherMapNode) $preview->seen_zlayers[$layer][$key] = $preview->nodes[$item->name];
 			elseif ($item instanceof WeatherMapLink) $preview->seen_zlayers[$layer][$key] = $preview->links[$item->name];
-			elseif ($item === $map) $preview->seen_zlayers[$layer][$key] = $preview;
 		}
 	}
 	foreach ($preview->plugins['post'] as $name => $plugin) $preview->plugins['post'][$name] = clone $plugin;

From 19c1dd2eabc433962f610875598c6365107aeb53 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 22:32:54 +1030
Subject: [PATCH 29/35] Address repair, serialization and dialog submission
 review findings

---
 js/editor.js                                  | 20 ++++++++++++++-----
 lib/WeatherMap.class.php                      | 10 +++++-----
 lib/WeatherMap.notes.php                      |  3 +++
 lib/poller-common.php                         | 20 +++++++++++++++++--
 tests/Browser/EditorPropertySubmitTest.cjs    | 14 +++++++++++++
 tests/Support/ConfigWriteAtomicRegression.php | 17 +++++++++++-----
 tests/Support/NoteAllocationRegression.php    |  3 ++-
 7 files changed, 69 insertions(+), 18 deletions(-)
 create mode 100644 tests/Browser/EditorPropertySubmitTest.cjs

diff --git a/js/editor.js b/js/editor.js
index 65b95281..280f62b3 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -391,7 +391,7 @@ function initJS() {
 
 	$('#frmMain').off('submit').on('submit', function(event) {
 		event.preventDefault();
-		form_submit();
+		form_submit(event);
 	});
 
 	/* Cacti core may have already converted this select to select2; don't
@@ -921,10 +921,20 @@ function form_submit(event) {
 	// Property dialogs can remain open while a toolbar placement action is active.
 	// Their own Save buttons always dispatch the properties they are showing.
 	var button = event && event.currentTarget && event.currentTarget.id;
-	if (button === 'tb_node_submit' || button === 'tb_link_submit') {
-		var node = button === 'tb_node_submit';
-		$('#action').val(node ? 'set_node_properties' : 'set_link_properties');
-		$('#param').val($(node ? '#node_name' : '#link_name').val());
+	var sources = {
+		tb_node_submit: ['set_node_properties', '#node_name'],
+		tb_link_submit: ['set_link_properties', '#link_name'],
+		tb_map_submit: ['set_map_properties'],
+		tb_mapstyle_submit: ['set_map_style']
+	};
+	if (button === 'frmMain') {
+		var focused = $(document.activeElement).closest('.ui-dialog-content').attr('id');
+		var dialogs = {dlgNodeProperties: 'tb_node_submit', dlgLinkProperties: 'tb_link_submit', dlgMapProperties: 'tb_map_submit', dlgMapStyle: 'tb_mapstyle_submit'};
+		button = dialogs[focused];
+	}
+	if (sources[button]) {
+		$('#action').val(sources[button][0]);
+		if (sources[button][1]) $('#param').val($(sources[button][1]).val());
 		mapmode('existing');
 	}
 
diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 771ee3e9..9e8dca9d 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -3746,19 +3746,19 @@ function WriteConfig($filename, $createOnly = false, $expectedRevision = null, $
 
 				$locale = localeconv();
 
-				$decimal_point = $locale['decimal_point'];
+				$decimal_point = '.';
 
 				foreach ($colours as $k => $colour) {
 					if (!isset($colour['special']) || !$colour['special']) {
-						$top    = rtrim(rtrim(sprintf('%f', $colour['top']), '0'), $decimal_point);
-						$bottom = rtrim(rtrim(sprintf('%f', $colour['bottom']), '0'), $decimal_point);
+						$top    = rtrim(rtrim(sprintf('%F', $colour['top']), '0'), $decimal_point);
+						$bottom = rtrim(rtrim(sprintf('%F', $colour['bottom']), '0'), $decimal_point);
 
 						if ($bottom > 1000) {
-							$bottom = nice_bandwidth($colour['bottom'], $this->kilo);
+							$bottom = str_replace(localeconv()['decimal_point'], '.', nice_bandwidth($colour['bottom'], $this->kilo));
 						}
 
 						if ($top > 1000) {
-							$top = nice_bandwidth($colour['top'], $this->kilo);
+							$top = str_replace(localeconv()['decimal_point'], '.', nice_bandwidth($colour['top'], $this->kilo));
 						}
 
 						$tag = ($colour['tag'] ?? '');
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index d14c9620..1bb01ab4 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -67,6 +67,9 @@ function wm_note_font_id($map, $id) {
 		if (!is_readable($file) || !function_exists('imagettfbbox') || !function_exists('imagettftext')) return 3;
 		$signature = @file_get_contents($file, false, null, 0, 4);
 		if (!in_array($signature, ["\x00\x01\x00\x00", 'OTTO', 'ttcf', 'true', 'typ1'], true)) return 3;
+		set_error_handler(function () { return true; }, E_WARNING);
+		try { $bounds = imagettfbbox($font->size, 0, $file, 'Wm'); } catch (Throwable $error) { return 3; } finally { restore_error_handler(); }
+		if (!is_array($bounds) || count($bounds) !== 8) return 3;
 	}
 	return $id;
 }
diff --git a/lib/poller-common.php b/lib/poller-common.php
index 57192986..0af3dca7 100644
--- a/lib/poller-common.php
+++ b/lib/poller-common.php
@@ -119,9 +119,25 @@ function weathermap_check_cron($time, $string) {
  * @return bool Whether a complete copy was reserved at the destination.
  */
 function weathermap_stage_asset_copy($old, $new) {
+	global $config;
 	require_once __DIR__ . '/WeatherMap.config.php';
-	$contents = @file_get_contents($old);
-	return $contents !== false && \WeathermapConfig\atomicWrite($new, $contents, false, null, true);
+	$root = realpath($config['base_path'] . '/plugins/weathermap');
+	$source = realpath($old);
+	$destination = realpath(dirname($new));
+	if ($root === false || $source === false || $destination === false) return false;
+	$root = str_replace('\\', '/', $root); $source = str_replace('\\', '/', $source); $destination = str_replace('\\', '/', $destination);
+	if (!str_starts_with($source, $root . '/')
+		|| !in_array($destination, [$root . '/images/objects', $root . '/images/backgrounds'], true)
+		|| !in_array(strtolower(pathinfo($source, PATHINFO_EXTENSION)), ['png', 'jpg', 'jpeg', 'gif'], true)) return false;
+	$contents = @file_get_contents($source);
+	if ($contents === false) return false;
+	$info = @getimagesizefromstring($contents);
+	if ($info === false || !in_array($info[2], [IMAGETYPE_PNG, IMAGETYPE_JPEG, IMAGETYPE_GIF], true)) return false;
+	set_error_handler(function () { return true; }, E_WARNING);
+	try { $image = imagecreatefromstring($contents); } finally { restore_error_handler(); }
+	if ($image === false) return false;
+	imagedestroy($image);
+	return \WeathermapConfig\atomicWrite($new, $contents, false, null, true);
 }
 
 /**
diff --git a/tests/Browser/EditorPropertySubmitTest.cjs b/tests/Browser/EditorPropertySubmitTest.cjs
new file mode 100644
index 00000000..db135a05
--- /dev/null
+++ b/tests/Browser/EditorPropertySubmitTest.cjs
@@ -0,0 +1,14 @@
+const {JSDOM}=require('jsdom'),jquery=require('jquery'),fs=require('node:fs'),path=require('node:path'),assert=require('node:assert/strict');
+const ids=['dlgNodeProperties','dlgLinkProperties','dlgMapProperties','dlgMapStyle'];
+const dom=new JSDOM('<form id="frmMain"><input id="action" name="action"><input id="param" name="param"><input id="node_name" name="node_name" value="A"><input id="link_name" name="link_name" value="AB"><input id="map_background_colour" name="map_background_colour">'+ids.map(id=>`<div id="${id}" class="ui-dialog-content"><input class="focus-field"></div>`).join('')+'</form><div id="wm-map-background-colour"><input class="wm-colour-value" value="#ffffff"></div>',{runScripts:'outside-only'});
+const w=dom.window,$=jquery(w);w.$=w.jQuery=$;Object.assign(w,{editor_url:'/editor',wmEditorText:{},WMNotes:{},mapmode:()=>{}});let request;$.ajax=opts=>request=opts;
+const src=fs.readFileSync(path.join(__dirname,'../../js/editor.js'),'utf8');w.eval(src.slice(src.indexOf('function form_submit('),src.indexOf('function map_properties(')));
+for(const [button,action,param] of [['tb_node_submit','set_node_properties','A'],['tb_link_submit','set_link_properties','AB'],['tb_map_submit','set_map_properties'],['tb_mapstyle_submit','set_map_style']]) {
+ $('#action').val('place_stamp');w.form_submit({currentTarget:{id:button}});const data=new URLSearchParams(request.data);assert.equal(data.get('action'),action);if(param)assert.equal(data.get('param'),param);
+}
+const start=src.indexOf("$('#frmMain').off('submit')"),end=src.indexOf('\n\t});',start)+6;w.eval(src.slice(start,end));
+for(const [id,action] of ids.map((id,index)=>[id,['set_node_properties','set_link_properties','set_map_properties','set_map_style'][index]])) {
+ $('#'+id+' input')[0].focus();$('#action').val('place_legend');$('#frmMain').trigger('submit');assert.equal(new URLSearchParams(request.data).get('action'),action);
+}
+$('#action').val('move_node');w.form_submit();assert.equal(new URLSearchParams(request.data).get('action'),'move_node');
+dom.window.close();console.log('PASS: modeless dialog buttons and implicit form submission restore property actions');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index e0ea37d0..6110fa95 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -143,6 +143,7 @@ function atomic_assert($condition, $message) {
 	$dir = sys_get_temp_dir() . '/wm-atomic-' . bin2hex(random_bytes(5));
 	mkdir($dir);
 	$file = $dir . '/map.conf';
+	$bitmap = imagecreatetruecolor(2, 2); ob_start(); imagepng($bitmap); $validAsset = ob_get_clean(); imagedestroy($bitmap);
 	$original = "WIDTH 600\nHEIGHT 300\nNODE note1\n LABEL Original\n POSITION 50 50\n SET editor_note 1\n";
 	file_put_contents($file, $original);
 	try {
@@ -347,7 +348,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		$repairFile = $plugin . '/configs/' . $repairName;
 		$repairImage = $plugin . '/images/backgrounds/' . $repairName . '.png';
 		$legacy = 'BACKGROUND ' . basename($repairImage) . "\n";
-		file_put_contents($repairFile, $legacy); file_put_contents($repairImage, 'fixture');
+		file_put_contents($repairFile, $legacy); file_put_contents($repairImage, $validAsset);
 		$oldConfig = $GLOBALS['config'];
 		$GLOBALS['config']['base_path'] = dirname($plugin, 2);
 		$GLOBALS['__test_db_fetch_assoc'] = fn ($sql) => [['configfile' => $repairName]];
@@ -376,7 +377,13 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		}
 		$stageSource = $plugin . '/legacy-stage-' . bin2hex(random_bytes(4)) . '.png';
 		$stageTarget = $plugin . '/images/backgrounds/' . basename($stageSource);
-		file_put_contents($stageSource, 'Legacy asset bytes');
+		file_put_contents($stageSource, $validAsset);
+
+		$outsideAsset = $dir . '/outside.png'; file_put_contents($outsideAsset, $validAsset);
+		atomic_assert(!weathermap_stage_asset_copy($outsideAsset, $stageTarget) && !is_file($stageTarget), 'repair rejects a valid image outside the legacy root');
+		$badAsset = $plugin . '/invalid-stage-' . bin2hex(random_bytes(4)) . '.png'; file_put_contents($badAsset, 'not an image');
+		atomic_assert(!weathermap_stage_asset_copy($badAsset, $stageTarget) && !is_file($stageTarget), 'repair rejects non-image bytes within the legacy root');
+		unlink($badAsset); unlink($outsideAsset);
 		$stageConfig = $plugin . '/configs/' . basename($stageSource) . '.conf';
 		$stageLegacy = 'BACKGROUND ' . basename($stageSource) . "\n";
 		file_put_contents($stageConfig, $stageLegacy);
@@ -386,7 +393,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		try {
 			// A staged copy succeeds, but the config CAS must fail after a concurrent save.
 			$staged = weathermap_stage_asset_copy($stageSource, $stageTarget);
-			atomic_assert($staged && is_file($stageSource) && file_get_contents($stageTarget) === 'Legacy asset bytes', 'staging keeps original and complete destination');
+			atomic_assert($staged && is_file($stageSource) && file_get_contents($stageTarget) === $validAsset, 'staging keeps original and complete destination');
 			$stageNewer = "TITLE Concurrent repair edit\n" . $stageLegacy;
 			$GLOBALS['config_before_lock'] = function() use ($stageConfig, $stageNewer) { unset($GLOBALS['config_before_lock']); file_put_contents($stageConfig, $stageNewer); };
 			$GLOBALS['weathermap_error_suppress'] = ['WMPOLL13']; weathermap_repair_maps();
@@ -406,8 +413,8 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		$repairPlugin = $repairRoot . '/cacti/plugins/weathermap';
 		mkdir($repairPlugin . '/configs', 0777, true); mkdir($repairPlugin . '/images');
 		symlink($plugin . '/lib', $repairPlugin . '/lib');
-		file_put_contents($repairPlugin . '/legacy-background.png', 'Background bytes');
-		file_put_contents($repairPlugin . '/legacy-icon.png', 'Icon bytes');
+		file_put_contents($repairPlugin . '/legacy-background.png', $validAsset);
+		file_put_contents($repairPlugin . '/legacy-icon.png', $validAsset);
 		$legacyFixture = "BACKGROUND legacy-background.png\nNODE Legacy\n ICON legacy-icon.png\n";
 		$fixtureConfig = $repairPlugin . '/configs/legacy.conf';
 		$oldConfig = $GLOBALS['config']; $oldSuppress = $GLOBALS['weathermap_error_suppress'] ?? [];
diff --git a/tests/Support/NoteAllocationRegression.php b/tests/Support/NoteAllocationRegression.php
index 52f98710..f01c256e 100644
--- a/tests/Support/NoteAllocationRegression.php
+++ b/tests/Support/NoteAllocationRegression.php
@@ -58,11 +58,12 @@ function imagecreatetruecolor($width, $height) {
 			imagedestroy($image);
 		}
 		require_once 'lib/editor.inc.php'; require_once 'lib/editor.notes.php';
-		foreach (['missing', 'invalid', 'unreadable'] as $fontCase) {
+		foreach (['missing', 'invalid', 'unreadable', 'truncated'] as $fontCase) {
 			$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = 0;
 			$map = new \WeatherMap; $map->ReadConfig($file); $map->stamptext = '';
 			$fontPath = $dir . '/font-' . $fontCase . '.ttf';
 			if ($fontCase === 'invalid') file_put_contents($fontPath, 'invalid font');
+			if ($fontCase === 'truncated') file_put_contents($fontPath, "\x00\x01\x00\x00" . str_repeat("\0", 20));
 			if ($fontCase === 'unreadable') { copy('docs/example/Vera.ttf', $fontPath); chmod($fontPath, 0000); if (is_readable($fontPath)) { chmod($fontPath, 0600); continue; } }
 			$map->fonts[100]->file = $fontPath;
 			$output = $dir . '/fallback-' . $fontCase . '.png'; $map->DrawMap($output);

From ed4bfe9d3f782632ff041486266d115335c6c79f Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 22:40:05 +1030
Subject: [PATCH 30/35] Preserve every dialog submit action during placement
 and Enter saves

---
 js/editor.js                                  | 14 +++++++++-----
 tests/Browser/EditorPropertySubmitTest.cjs    |  3 +++
 tests/Support/ConfigWriteAtomicRegression.php |  7 +++++++
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/js/editor.js b/js/editor.js
index 280f62b3..551d6fe3 100644
--- a/js/editor.js
+++ b/js/editor.js
@@ -925,14 +925,17 @@ function form_submit(event) {
 		tb_node_submit: ['set_node_properties', '#node_name'],
 		tb_link_submit: ['set_link_properties', '#link_name'],
 		tb_map_submit: ['set_map_properties'],
-		tb_mapstyle_submit: ['set_map_style']
+		tb_mapstyle_submit: ['set_map_style'],
+		tb_editorsettings_submit: ['editor_settings'],
+		tb_note_submit: ['set_note_properties', '#note_name'],
+		tb_textedit_submit: [$('#dlgTextEdit').data('wm-config-action')]
 	};
-	if (button === 'frmMain') {
-		var focused = $(document.activeElement).closest('.ui-dialog-content').attr('id');
-		var dialogs = {dlgNodeProperties: 'tb_node_submit', dlgLinkProperties: 'tb_link_submit', dlgMapProperties: 'tb_map_submit', dlgMapStyle: 'tb_mapstyle_submit'};
+	if (button === 'frmMain' || !button) {
+		var focused = $(button === 'frmMain' ? document.activeElement : event && event.currentTarget).closest('.ui-dialog-content').attr('id');
+		var dialogs = {dlgNodeProperties: 'tb_node_submit', dlgLinkProperties: 'tb_link_submit', dlgMapProperties: 'tb_map_submit', dlgMapStyle: 'tb_mapstyle_submit', dlgEditorSettings: 'tb_editorsettings_submit', dlgNoteProperties: 'tb_note_submit', dlgTextEdit: 'tb_textedit_submit'};
 		button = dialogs[focused];
 	}
-	if (sources[button]) {
+	if (sources[button] && sources[button][0]) {
 		$('#action').val(sources[button][0]);
 		if (sources[button][1]) $('#param').val($(sources[button][1]).val());
 		mapmode('existing');
@@ -1055,6 +1058,7 @@ function show_itemtext(itemtype,name) {
 		$('#action').val('set_link_config');
 	}
 
+	$('#dlgTextEdit').data('wm-config-action', $('#action').val());
 	show_dialog('dlgTextEdit');
 
 	$.ajax({
diff --git a/tests/Browser/EditorPropertySubmitTest.cjs b/tests/Browser/EditorPropertySubmitTest.cjs
index db135a05..a82d83ee 100644
--- a/tests/Browser/EditorPropertySubmitTest.cjs
+++ b/tests/Browser/EditorPropertySubmitTest.cjs
@@ -11,4 +11,7 @@ for(const [id,action] of ids.map((id,index)=>[id,['set_node_properties','set_lin
  $('#'+id+' input')[0].focus();$('#action').val('place_legend');$('#frmMain').trigger('submit');assert.equal(new URLSearchParams(request.data).get('action'),action);
 }
 $('#action').val('move_node');w.form_submit();assert.equal(new URLSearchParams(request.data).get('action'),'move_node');
+for (const [id,action] of [['dlgEditorSettings','editor_settings'],['dlgNoteProperties','set_note_properties'],['dlgTextEdit','set_node_config']]) {
+ const dialog=$('<div>').attr('id',id).addClass('ui-dialog-content').appendTo('#frmMain');const button=$('<button>').appendTo(dialog);$('#dlgTextEdit').data('wm-config-action','set_node_config');$('#action').val('place_stamp');w.form_submit({currentTarget:button[0]});assert.equal(new URLSearchParams(request.data).get('action'),action);
+}
 dom.window.close();console.log('PASS: modeless dialog buttons and implicit form submission restore property actions');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 6110fa95..4c44d5dd 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -297,6 +297,13 @@ function atomic_assert($condition, $message) {
 		\WeathermapConfig\release($targetLock);
 		atomic_assert(\WeathermapConfig\atomicWrite($alias, $original, true, hash('sha256', $original)), 'alias save succeeds after shared target mutex release');
 		unlink($alias); unlink($targetFile); unlink($targetDir . '/.weathermap-config.lock'); rmdir($targetDir);
+
+		$numericLocale = setlocale(LC_NUMERIC, 0); setlocale(LC_NUMERIC, 'fr_FR.UTF-8', 'fr_FR.utf8', 'fr_FR');
+		try {
+			$largeScale = new \WeatherMap; $largeScale->ReadConfig("SCALE large 1500 2500 0 255 0\n");
+			atomic_assert($largeScale->WriteConfig($dir . '/large-scale.conf'), 'large scale saves under alternate locale');
+			$largeText = file_get_contents($dir . '/large-scale.conf'); atomic_assert(str_contains($largeText, '1.5K') && str_contains($largeText, '2.5K'), 'unit-suffixed ranges retain parser-compatible decimal points');
+		} finally { setlocale(LC_NUMERIC, $numericLocale); }
 		$wrong = \fopen($file, 'rb');
 		atomic_assert(!\WeathermapConfig\atomicWrite($dir . '/wrong-lock.conf', 'Wrong', false, null, true, $wrong), 'different lock file rejected'); \fclose($wrong);
 		// Revision metadata must describe the same map snapshot as the controls.

From 0583302e68895e2e0d268959986d6f06df1c7a8d Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 23:24:27 +1030
Subject: [PATCH 31/35] Validate existing repair assets and inherited clone
 images

---
 lib/editor.actions.php                        |  4 +--
 lib/poller-common.php                         | 30 +++++++++++++------
 tests/Support/ConfigWriteAtomicRegression.php | 11 +++++++
 3 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 45f3ff16..5b5ceb46 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -98,7 +98,7 @@ function wm_editor_write_config($map, $mapfile, $createOnly = false) {
 }
 
 /**
- * @return void
+ * @return bool
  * @param  mixed $mapfile
  */
 function newMap($mapfile) {
@@ -113,7 +113,7 @@ function newMap($mapfile) {
 
 /**
  * @param  mixed $mapfile
- * @return void
+ * @return bool
  */
 function newMapCopy($mapfile) {
 	global $mapdir;
diff --git a/lib/poller-common.php b/lib/poller-common.php
index 0af3dca7..ebdaabce 100644
--- a/lib/poller-common.php
+++ b/lib/poller-common.php
@@ -111,6 +111,24 @@ function weathermap_check_cron($time, $string) {
 	return ($matched);
 }
 
+/**
+ * Read a regular managed raster only after successful decoding.
+ * @param string $path Asset filename.
+ * @return string|false Validated image bytes, or false.
+ */
+function weathermap_read_raster($path) {
+	if (is_link($path) || !is_file($path) || !in_array(strtolower(pathinfo($path, PATHINFO_EXTENSION)), ['png', 'jpg', 'jpeg', 'gif'], true)) return false;
+	$contents = @file_get_contents($path);
+	if ($contents === false) return false;
+	$info = @getimagesizefromstring($contents);
+	if ($info === false || !in_array($info[2], [IMAGETYPE_PNG, IMAGETYPE_JPEG, IMAGETYPE_GIF], true)) return false;
+	set_error_handler(function () { return true; }, E_WARNING);
+	try { $image = imagecreatefromstring($contents); } finally { restore_error_handler(); }
+	if ($image === false) return false;
+	imagedestroy($image);
+	return $contents;
+}
+
 /**
  * Stage a complete legacy asset copy while keeping every old map reference usable.
  *
@@ -129,14 +147,8 @@ function weathermap_stage_asset_copy($old, $new) {
 	if (!str_starts_with($source, $root . '/')
 		|| !in_array($destination, [$root . '/images/objects', $root . '/images/backgrounds'], true)
 		|| !in_array(strtolower(pathinfo($source, PATHINFO_EXTENSION)), ['png', 'jpg', 'jpeg', 'gif'], true)) return false;
-	$contents = @file_get_contents($source);
+	$contents = weathermap_read_raster($source);
 	if ($contents === false) return false;
-	$info = @getimagesizefromstring($contents);
-	if ($info === false || !in_array($info[2], [IMAGETYPE_PNG, IMAGETYPE_JPEG, IMAGETYPE_GIF], true)) return false;
-	set_error_handler(function () { return true; }, E_WARNING);
-	try { $image = imagecreatefromstring($contents); } finally { restore_error_handler(); }
-	if ($image === false) return false;
-	imagedestroy($image);
 	return \WeathermapConfig\atomicWrite($new, $contents, false, null, true);
 }
 
@@ -190,7 +202,7 @@ function weathermap_repair_maps() {
 							if (strpos($bgfile, 'images/backgrounds/') === false) {
 								wm_debug('Found background file reference in old location: ' . $bgfile);
 
-								if (file_exists($mydir . 'images/backgrounds/' . basename($bgfile))) {
+								if (weathermap_read_raster($mydir . 'images/backgrounds/' . basename($bgfile)) !== false) {
 									wm_debug('Background file found in new location! Updating path only.');
 
 									$line = 'BACKGROUND images/backgrounds/' . basename($bgfile);
@@ -258,7 +270,7 @@ function weathermap_repair_maps() {
 								if (strpos($objfile, 'images/objects/') === false) {
 									wm_debug('Found icon file reference in old location: ' . $objfile);
 
-									if (file_exists($mydir . 'images/objects/' . basename($objfile))) {
+									if (weathermap_read_raster($mydir . 'images/objects/' . basename($objfile)) !== false) {
 										wm_debug('Found file already in new location! Updating path only.');
 
 										$line = "\tICON images/objects/" . basename($objfile);
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 3841a52e..c32d9117 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -384,6 +384,17 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			$GLOBALS['config_fault'] = '';
 			weathermap_repair_maps();
 			atomic_assert(file_get_contents($repairFile) === 'BACKGROUND images/backgrounds/' . basename($repairImage), 'repair uses complete atomic replacement');
+			foreach (['corrupt', 'directory', 'symlink'] as $invalidTarget) {
+				unlink($repairImage); file_put_contents($repairFile, $legacy);
+				if ($invalidTarget === 'directory') mkdir($repairImage);
+				elseif ($invalidTarget === 'symlink') symlink($repairFile, $repairImage);
+				else file_put_contents($repairImage, 'corrupt image');
+				$GLOBALS['weathermap_error_suppress'] = ['WMPOLL10'];
+				try { weathermap_repair_maps(); } finally { $GLOBALS['weathermap_error_suppress'] = $oldSuppress; }
+				atomic_assert(file_get_contents($repairFile) === $legacy, 'repair retains legacy background for invalid existing target: ' . $invalidTarget);
+				if (is_dir($repairImage)) rmdir($repairImage); else unlink($repairImage);
+				file_put_contents($repairImage, $validAsset);
+			}
 			file_put_contents($repairFile, $legacy);
 			$newerRepair = 'TITLE Concurrent editor save' . "\n" . $legacy;
 			$GLOBALS['config_before_lock'] = function() use ($repairFile, $newerRepair) {

From 6ddb0a8954bac8a91709777afb3e6da32bae4db1 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Tue, 13 Oct 2026 23:50:58 +1030
Subject: [PATCH 32/35] Repair sized legacy icons and align creation error
 branches

---
 lib/poller-common.php                         | 10 ++++++----
 tests/Support/ConfigWriteAtomicRegression.php |  6 ++++++
 weathermap-cacti-plugin-mgmt.php              | 12 ++++++------
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/lib/poller-common.php b/lib/poller-common.php
index ebdaabce..2b17a3d3 100644
--- a/lib/poller-common.php
+++ b/lib/poller-common.php
@@ -264,8 +264,10 @@ function weathermap_repair_maps() {
 							$dirgood = false;
 							$attribs = preg_split('/\s+/', trim($parts[1]));
 
-							if (cacti_sizeof($attribs) == 1) {
-								$objfile = trim($parts[1]);
+							if (cacti_sizeof($attribs) == 1 || (cacti_sizeof($attribs) == 3 && ctype_digit($attribs[0]) && ctype_digit($attribs[1]))) {
+								$objfile = end($attribs);
+								$dimensions = cacti_sizeof($attribs) == 3 ? $attribs[0] . ' ' . $attribs[1] . ' ' : '';
+								if (in_array(strtolower($objfile), ['box', 'rbox', 'round', 'inpie', 'outpie', 'gauge', 'nink', 'nlink', 'none'], true)) { $outcontents[] = rtrim($line); continue; }
 
 								if (strpos($objfile, 'images/objects/') === false) {
 									wm_debug('Found icon file reference in old location: ' . $objfile);
@@ -273,7 +275,7 @@ function weathermap_repair_maps() {
 									if (weathermap_read_raster($mydir . 'images/objects/' . basename($objfile)) !== false) {
 										wm_debug('Found file already in new location! Updating path only.');
 
-										$line = "\tICON images/objects/" . basename($objfile);
+										$line = "\tICON " . $dimensions . "images/objects/" . basename($objfile);
 
 										$changes++;
 									} else {
@@ -292,7 +294,7 @@ function weathermap_repair_maps() {
 											if (is_readable($mydir . $objfile)) {
 												if (is_readable($old) && is_writeable(dirname($new))) {
 													if (weathermap_stage_asset_copy($old, $new)) {
-														$line = "\tICON images/objects/" . basename($objfile);
+														$line = "\tICON " . $dimensions . "images/objects/" . basename($objfile);
 														$changes++;
 													} else {
 														wm_warn(sprintf('Unable to move ICONFILE %s to %s, Permission error [WMPOLL11]', $old, $new));
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index c32d9117..93a00cbe 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -463,6 +463,12 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			file_put_contents($fixtureConfig, $legacyFixture); weathermap_repair_maps();
 			atomic_assert(file_get_contents($fixtureConfig) === $repairedFixture, 'existing complete copies support path-only repair');
 			weathermap_repair_maps(); atomic_assert(file_get_contents($fixtureConfig) === $repairedFixture, 'correct paths require no rewrite');
+			$sizedLegacy = "NODE Sized\n ICON 100 80 legacy-icon.png\nNODE Shape\n ICON 30 40 box\n";
+			file_put_contents($fixtureConfig, $sizedLegacy); weathermap_repair_maps();
+			atomic_assert(str_contains(file_get_contents($fixtureConfig), 'ICON 100 80 images/objects/legacy-icon.png') && str_contains(file_get_contents($fixtureConfig), 'ICON 30 40 box'), 'sized legacy icon repair preserves dimensions and built-in shapes');
+			unlink($repairPlugin . '/images/objects/legacy-icon.png'); file_put_contents($fixtureConfig, $sizedLegacy); weathermap_repair_maps();
+			atomic_assert(str_contains(file_get_contents($fixtureConfig), 'ICON 100 80 images/objects/legacy-icon.png') && is_file($repairPlugin . '/images/objects/legacy-icon.png'), 'sized legacy icon is staged into managed library');
+
 			unlink($repairPlugin . '/images/backgrounds/legacy-background.png'); unlink($repairPlugin . '/images/objects/legacy-icon.png');
 			file_put_contents($fixtureConfig, $legacyFixture); $GLOBALS['config_fault'] = 'rename'; weathermap_repair_maps();
 			atomic_assert(file_get_contents($fixtureConfig) === $legacyFixture && is_file($repairPlugin . '/legacy-background.png') && is_file($repairPlugin . '/legacy-icon.png'), 'failed background and icon staging preserves usable original references');
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index e78652a5..de1d5052 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -3445,16 +3445,16 @@ function newMap($mapfile, $sourcemapfile = '', $title = '') {
 			if ($sourcemapfile != '') {
 				if (file_exists($sourcemapfile) && is_readable($sourcemapfile)) {
 					if (!$map->ReadConfig($sourcemapfile) || !is_string($map->config_revision)) {
-					raise_message('map_message', __('The Source Map File name is not readable or does not exist!', 'weathermap'), MESSAGE_LEVEL_ERROR);
-					return;
-				}
+						raise_message('map_message', __('The Source Map File name is not readable or does not exist!', 'weathermap'), MESSAGE_LEVEL_ERROR);
+						return;
+					}
 					if ($title !== '') {
 						$map->title = $title;
 					}
 					if (!$map->WriteConfig($mapfile, true)) {
-					raise_message('map_message', __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
-					return;
-				}
+						raise_message('map_message', __('Could not save the map configuration.', 'weathermap'), MESSAGE_LEVEL_ERROR);
+						return;
+					}
 					raise_message('map_message', __('New Map file %s created from %s', basename($mapfile), basename($sourcemapfile), 'weathermap'), MESSAGE_LEVEL_INFO);
 				} else {
 					raise_message('map_message', __('The Source Map File name is not readable or does not exist!', 'weathermap'), MESSAGE_LEVEL_ERROR);

From 25de5951b5d2d7d21af749447373b55f21728cd5 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Wed, 14 Oct 2026 23:14:35 +1030
Subject: [PATCH 33/35] Require mutation revisions and keep template notes and
 clone diagnostics private

---
 lib/WeatherMap.notes.php                      |  2 +-
 lib/editor.actions.php                        | 47 ++++++++++---------
 locales/po/cacti.pot                          |  6 ++-
 .../BackgroundSizingEngineRegression.php      | 11 ++++-
 tests/Support/ConfigWriteAtomicRegression.php | 47 +++++++++++++++----
 tests/Support/EditorNotesEngineRegression.php | 11 ++++-
 tests/Support/MapDuplicatePayload.php         |  2 +
 tests/Support/NoteAllocationRegression.php    |  6 +++
 tests/Unit/EditorSettingsCookieTest.php       |  2 +-
 weathermap-cacti-plugin-mgmt.php              |  5 +-
 10 files changed, 100 insertions(+), 39 deletions(-)

diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 1bb01ab4..0387c459 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -91,7 +91,7 @@ function wm_sharp_notes($map) {
 	// Follow draw order; later nodes only block annotations they overlap.
 	foreach ($layers as $items) {
 		foreach ($items ?? [] as $node) {
-			if ($node instanceof WeatherMapNode && $node->name !== 'DEFAULT' && $node->get_hint('editor_note', '0') === '1' && $node->labelangle == 0 && $node->iconfile === '' && $node->zorder < 1000 && $node->labelbgcolour == [-1,-1,-1] && $node->labeloutlinecolour == [-1,-1,-1] && $node->labelfontshadowcolour == [-1,-1,-1] && isset($map->fonts[$node->labelfont]) && $map->fonts[$node->labelfont]->type === 'truetype') {
+			if ($node instanceof WeatherMapNode && $node->name !== 'DEFAULT' && is_numeric($node->x) && is_numeric($node->y) && $node->get_hint('editor_note', '0') === '1' && $node->labelangle == 0 && $node->iconfile === '' && $node->zorder < 1000 && $node->labelbgcolour == [-1,-1,-1] && $node->labeloutlinecolour == [-1,-1,-1] && $node->labelfontshadowcolour == [-1,-1,-1] && isset($map->fonts[$node->labelfont]) && $map->fonts[$node->labelfont]->type === 'truetype') {
 				$notes[] = $node;
 			} elseif ($node instanceof WeatherMapNode && !is_null($node->x)) {
 				$notes = array_values(array_filter($notes, function ($note) use ($node) {
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 5b5ceb46..8ef25728 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -55,9 +55,10 @@
  *
  * @param WeatherMap $map Engine receiving the configuration.
  * @param string $mapfile Configuration path.
+ * @param bool $requireRevision Require the loaded page token for mutation paths.
  * @return bool Whether the map was loaded.
  */
-function wm_editor_read_config($map, $mapfile) {
+function wm_editor_read_config($map, $mapfile, $requireRevision = false) {
 	if (!is_file($mapfile) || !is_readable($mapfile)) {
 		http_response_code(404);
 		return false;
@@ -71,7 +72,7 @@ function wm_editor_read_config($map, $mapfile) {
 		return false;
 	}
 	$revision = get_nfilter_request_var('config_revision');
-	if ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies), $revision))) {
+	if (($requireRevision && (!is_string($revision) || $revision === '')) || ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies), $revision)))) {
 		http_response_code(409);
 		return false;
 	}
@@ -280,7 +281,7 @@ function setNodeConfig($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$node_name   = get_nfilter_request_var('node_name');
 	$node_config = get_nfilter_request_var('item_configtext');
@@ -301,7 +302,7 @@ function setLinkConfig($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$link_name   = get_nfilter_request_var('link_name');
 	$link_config = get_nfilter_request_var('item_configtext');
@@ -322,7 +323,7 @@ function setNodeProperties($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$node_name     = get_nfilter_request_var('node_name');
 	$new_node_name = get_nfilter_request_var('node_new_name');
@@ -411,7 +412,7 @@ function setLinkProperties($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$link_name = get_nfilter_request_var('link_name');
 
@@ -492,7 +493,7 @@ function setMapProperties($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$map->title              = wm_editor_sanitize_string(get_nfilter_request_var('map_title'));
 	$map->keytext['DEFAULT'] = wm_editor_sanitize_string(get_nfilter_request_var('map_legend'));
@@ -577,7 +578,7 @@ function setMapStyle($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	if (wm_editor_validate_one_of(get_nfilter_request_var('mapstyle_htmlstyle'), ['static', 'overlib'], false)) {
 		$map->htmlstyle = strtolower(get_nfilter_request_var('mapstyle_htmlstyle'));
@@ -614,7 +615,7 @@ function addLink($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$a = get_nfilter_request_var('param');
 	$b = get_nfilter_request_var('param2');
@@ -665,7 +666,7 @@ function placeLegend($mapfile, $grid_snap_value) {
 
 	$scalename = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$map->keyx[$scalename] = $x;
 	$map->keyy[$scalename] = $y;
@@ -686,7 +687,7 @@ function placeStamp($mapfile, $grid_snap_value) {
 	$x = snap(intval(get_nfilter_request_var('x')), $grid_snap_value);
 	$y = snap(intval(get_nfilter_request_var('y')), $grid_snap_value);
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$map->timex = $x;
 	$map->timey = $y;
@@ -708,7 +709,7 @@ function viaLink($mapfile) {
 
 	$link_name = wm_editor_sanitize_name(get_nfilter_request_var('link_name'));
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	if (isset($map->links[$link_name])) {
 		$map->links[$link_name]->vialist = [[0 =>$x, 1=>$y]];
@@ -731,7 +732,7 @@ function moveNode($mapfile, $grid_snap_value) {
 
 	$node_name = wm_editor_sanitize_name(get_nfilter_request_var('node_name'));
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	if (!isset($map->nodes[$node_name])) {
 		http_response_code(404);
@@ -842,7 +843,7 @@ function linkTidy($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
@@ -865,7 +866,7 @@ function reTidy($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	// draw a map and throw it away, to calculate all the bounding boxes
 	$map->DrawMap('null');
@@ -883,7 +884,7 @@ function reTidyAll($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	// draw a map and throw it away, to calculate all the bounding boxes
 	$map->DrawMap('null');
@@ -901,7 +902,7 @@ function unTidy($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	// draw a map and throw it away, to calculate all the bounding boxes
 	$map->DrawMap('null');
@@ -919,7 +920,7 @@ function deleteLink($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 	$log    = 'delete link ' . $target;
@@ -944,7 +945,7 @@ function addNode($mapfile, $grid_snap_value) {
 	$x = snap(intval(get_nfilter_request_var('x')), $grid_snap_value);
 	$y = snap(intval(get_nfilter_request_var('y')), $grid_snap_value);
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$newnodename = sprintf('node%05d', time() % 10000);
 
@@ -988,7 +989,7 @@ function editorSettings($mapfile) {
 	$map->context = 'editor';
 
 	// have to do this, otherwise the editor will be unresponsive afterwards - not actually going to change anything!
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$use_overlay          = (isset_request_var('editorsettings_showvias') ? intval(get_nfilter_request_var('editorsettings_showvias')) : false);
 	$use_relative_overlay = (isset_request_var('editorsettings_showrelative') ? intval(get_nfilter_request_var('editorsettings_showrelative')) : false);
@@ -1007,7 +1008,7 @@ function deleteNode($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
@@ -1041,7 +1042,7 @@ function cloneNode($mapfile) {
 
 	$map->context = 'editor';
 
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 
 	$target = wm_editor_sanitize_name(get_nfilter_request_var('param'));
 
@@ -1195,7 +1196,7 @@ function getImageURL($mapname, $selected) {
 function setNoteProperties($mapfile, $grid_snap_value) {
 	$map = new WeatherMap;
 	$map->context = 'editor';
-	if (!wm_editor_read_config($map, $mapfile)) return;
+	if (!wm_editor_read_config($map, $mapfile, true)) return;
 	$values = [];
 	foreach (['name', 'text', 'font', 'colour', 'x', 'y', 'align'] as $field) {
 		$values[$field] = get_nfilter_request_var('note_' . $field);
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 639626f6..fbb293fb 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-13 23:15+1030\n"
+"POT-Creation-Date: 2026-10-14 23:12+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
@@ -1897,6 +1897,10 @@ msgstr ""
 msgid "Could not register the new map."
 msgstr ""
 
+#: weathermap-cacti-plugin-mgmt.php
+msgid "Could not create the map copy. Please try again."
+msgstr ""
+
 #: weathermap-cacti-plugin-mgmt.php
 #, php-format
 msgid "The new Map with the name %s was created using config file %s"
diff --git a/tests/Support/BackgroundSizingEngineRegression.php b/tests/Support/BackgroundSizingEngineRegression.php
index 00b8457b..c7aff2b4 100644
--- a/tests/Support/BackgroundSizingEngineRegression.php
+++ b/tests/Support/BackgroundSizingEngineRegression.php
@@ -1,4 +1,13 @@
 <?php
+/** Submit the page revision expected by production mutation routes. */
+function wm_fixture_revision($file, $callback) {
+	if (!array_key_exists('config_revision', $GLOBALS['__test_nfilter_request'] ?? []) && is_file($file)) {
+		$map = new \WeatherMap; $map->ReadConfig($file);
+		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies);
+	}
+	return $callback();
+}
+
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
@@ -59,7 +68,7 @@ function wm_engine_assert($value,$message) {
 			'map_bgfile'           => $directory . '/background.png', 'map_background_sizing' => $mode,
 			'map_linkdefaultwidth' => '7', 'map_linkdefaultbwin' => '100M', 'map_linkdefaultbwout' => '100M',
 		];
-		setMapProperties($directory . '/' . $mode . '.conf');
+		wm_fixture_revision($directory . '/' . $mode . '.conf', fn () => setMapProperties($directory . '/' . $mode . '.conf'));
 		$saved = new WeatherMap();
 		$saved->ReadConfig($directory . '/' . $mode . '.conf');
 		wm_engine_assert($saved->get_hint('background_sizing') === ($mode === 'invalid' ? 'image' : $mode), $mode . ' editor persistence');
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 93a00cbe..7d872b07 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -122,6 +122,15 @@ function rename($source, $target) {
 	}
 }
 namespace {
+/** Submit the page revision expected by production mutation routes. */
+function wm_fixture_revision($file, $callback) {
+	if (!array_key_exists('config_revision', $GLOBALS['__test_nfilter_request'] ?? []) && is_file($file)) {
+		$map = new \WeatherMap; $map->ReadConfig($file);
+		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies);
+	}
+	return $callback();
+}
+
 	require dirname(__DIR__, 2) . '/lib/poller-common.php';
 	require dirname(__DIR__) . '/bootstrap-unit.php';
 	chdir(dirname(__DIR__, 2));
@@ -216,7 +225,7 @@ function atomic_assert($condition, $message) {
 		$first->title = 'Next edit';
 		atomic_assert($first->WriteConfig($file), 'successful save updates its revision for subsequent writes');
 		$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash('sha256', $original), 'node_name' => 'note1', 'x' => 90, 'y' => 90];
-		http_response_code(200); moveNode($file, 0);
+		http_response_code(200); wm_fixture_revision($file, fn () => moveNode($file, 0));
 		atomic_assert(http_response_code() === 409 && file_get_contents($file) !== $original, 'stale loaded page cannot overwrite another user save');
 		$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash_file('sha256', $file)];
 		$matching = new \WeatherMap;
@@ -314,6 +323,20 @@ function atomic_assert($condition, $message) {
 		atomic_assert($aliasMap->WriteConfig($includeRoot), 'symlink include save succeeds after dependency mutex release');
 		unlink($alias); unlink($targetFile); unlink($targetDir . '/.weathermap-config.lock'); rmdir($targetDir);
 
+		$GLOBALS['__test_nfilter_request'] = [];
+		atomic_assert(wm_editor_read_config(new \WeatherMap, $file), 'read/render paths accept absent page revisions');
+		foreach ([null, '', [], 'invalid'] as $missingRevision) {
+			$GLOBALS['__test_nfilter_request'] = ['config_revision' => $missingRevision]; http_response_code(200);
+			atomic_assert(!wm_editor_read_config(new \WeatherMap, $file, true) && http_response_code() === 409, 'mutation requires valid nonempty loaded revision');
+		}
+		$GLOBALS['__test_nfilter_request'] = []; $beforeMissingRevision = file_get_contents($file); http_response_code(200);
+		moveNode($file, 0);
+		atomic_assert(http_response_code() === 409 && file_get_contents($file) === $beforeMissingRevision, 'missing mutation token cannot alter configuration');
+		$revisionMap = new \WeatherMap; $revisionMap->ReadConfig($file);
+		$GLOBALS['__test_nfilter_request'] = ['config_revision' => \WeathermapConfig\snapshotRevision($revisionMap->config_revision, $revisionMap->config_dependencies)];
+		atomic_assert(wm_editor_read_config(new \WeatherMap, $file, true), 'matching mutation revision remains accepted');
+		$GLOBALS['__test_nfilter_request'] = [];
+
 		$numericLocale = setlocale(LC_NUMERIC, 0); setlocale(LC_NUMERIC, 'fr_FR.UTF-8', 'fr_FR.utf8', 'fr_FR');
 		try {
 			$largeScale = new \WeatherMap; $largeScale->ReadConfig("SCALE large 1500 2500 0 255 0\n");
@@ -537,7 +560,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		foreach (['node', 'link'] as $kind) {
 			file_put_contents($rawFile, $rawConfig);
 			$GLOBALS['__test_nfilter_request'] = ['config_revision' => hash_file('sha256', $rawFile), 'node_name' => 'A', 'link_name' => 'AB', 'item_configtext' => $kind === 'node' ? "NODE A\n LABEL Updated\n POSITION 10 10\n" : "LINK AB\n NODES A B\n WIDTH 12\n"];
-			http_response_code(200); if ($kind === 'node') setNodeConfig($rawFile); else setLinkConfig($rawFile);
+			http_response_code(200); if ($kind === 'node') wm_fixture_revision($rawFile, fn () => setNodeConfig($rawFile)); else wm_fixture_revision($rawFile, fn () => setLinkConfig($rawFile));
 			atomic_assert(http_response_code() === 200 && file_get_contents($rawFile) !== $rawConfig, 'raw ' . $kind . ' edit saves without false conflict');
 			file_put_contents($rawFile, $rawConfig); http_response_code(200);
 			$controller = file_get_contents($plugin . '/weathermap-cacti-plugin-editor.php');
@@ -557,7 +580,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 			$GLOBALS['config_before_lock'] = function() use ($file,$newer) { unset($GLOBALS['config_before_lock']); file_put_contents($file,$newer); };
 			$GLOBALS['__test_nfilter_request'] = ['config_revision'=>hash_file('sha256',$file),'node_name'=>'note1','param'=>'note1','x'=>70,'y'=>80,'note_name'=>'note1','note_text'=>'Changed','note_font'=>'3','note_colour'=>'#000000','note_x'=>50,'note_y'=>50,'note_align'=>'left'];
 			http_response_code(200);
-			if($operation==='move')moveNode($file,0);elseif($operation==='delete')deleteNode($file);else setNoteProperties($file,0);
+			if($operation==='move')wm_fixture_revision($file, fn () => moveNode($file,0));elseif($operation==='delete')wm_fixture_revision($file, fn () => deleteNode($file));else wm_fixture_revision($file, fn () => setNoteProperties($file,0));
 			atomic_assert(http_response_code()===409 && file_get_contents($file)===$newer,'note ' . $operation . ' preserves concurrent-edit response');
 		}
 		// Registration failure must retain a mutex through the callback and remove its reservation.
@@ -584,7 +607,11 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 					if ((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-throw') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-throw')) throw new RuntimeException('insert failed');
 					return !((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-false') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-false'));
 				};
+				$cloneMessages = []; $GLOBALS['__test_raise_message'] = function ($id, $text) use (&$cloneMessages) { $cloneMessages[] = $text; };
+				$GLOBALS['__test_cacti_log'] = [];
 				map_duplicate(1, 'Clone', 'clone');
+				unset($GLOBALS['__test_raise_message']);
+				atomic_assert($cloneMessages === ['Could not create the map copy. Please try again.'] && $GLOBALS['__test_cacti_log'] !== [], 'clone failures show only generic guidance and log original diagnostics');
 				atomic_assert(!is_file($plugin . '/configs/clone.conf'), 'failed registration removes its own reserved configuration');
 				if (str_ends_with($failure, '-false') || str_ends_with($failure, '-throw')) atomic_assert(cacti_count(array_filter($GLOBALS['__test_db_calls'], fn ($call) => str_starts_with($call['sql'], 'DELETE'))) === 3, 'partial registration removes map/auth/settings records');
 			}
@@ -598,25 +625,25 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		atomic_assert(!$map->WriteConfig($file) && file_get_contents($file) === $original, 'engine failure preserves original');
 		$GLOBALS['__test_nfilter_request'] = ['map_title' => 'Failed title', 'map_legend' => 'Traffic', 'map_stamp' => 'Created', 'map_width' => 600, 'map_height' => 300, 'map_bgfile' => '--NONE--', 'map_linkdefaultwidth' => 7, 'map_linkdefaultbwin' => '100M', 'map_linkdefaultbwout' => '100M'];
 		$GLOBALS['__test_db_calls'] = [];
-		http_response_code(200); setMapProperties($file);
+		http_response_code(200); wm_fixture_revision($file, fn () => setMapProperties($file));
 		atomic_assert(http_response_code() === 500 && $GLOBALS['__test_db_calls'] === [], 'failed properties save cannot change titlecache');
-		$GLOBALS['config_fault'] = ''; http_response_code(200); setMapProperties($file);
+		$GLOBALS['config_fault'] = ''; http_response_code(200); wm_fixture_revision($file, fn () => setMapProperties($file));
 		atomic_assert(http_response_code() === 200 && cacti_count($GLOBALS['__test_db_calls']) === 1, 'successful properties save updates titlecache');
 		file_put_contents($file, $original); $GLOBALS['config_fault'] = 'rename';
 		$GLOBALS['__test_nfilter_request'] = ['node_name' => 'note1', 'param' => 'note1', 'x' => '70', 'y' => '80'];
 		{
-			http_response_code(200); moveNode($file, 0);
+			http_response_code(200); wm_fixture_revision($file, fn () => moveNode($file, 0));
 			atomic_assert(http_response_code() === 500 && file_get_contents($file) === $original, 'failed move surfaces error without changing file');
-			http_response_code(200); deleteNode($file);
+			http_response_code(200); wm_fixture_revision($file, fn () => deleteNode($file));
 			atomic_assert(http_response_code() === 500 && file_get_contents($file) === $original, 'failed delete surfaces error without changing file');
 		}
 		$GLOBALS['config_fault'] = '';
 		$GLOBALS['__test_nfilter_request'] = ['node_name' => 'missing', 'param' => 'missing', 'x' => '70', 'y' => '80'];
-		http_response_code(200); moveNode($file, 0);
+		http_response_code(200); wm_fixture_revision($file, fn () => moveNode($file, 0));
 		atomic_assert(http_response_code() === 404 && file_get_contents($file) === $original, 'missing move target is an error');
-		http_response_code(200); deleteNode($file);
+		http_response_code(200); wm_fixture_revision($file, fn () => deleteNode($file));
 		atomic_assert(http_response_code() === 404 && file_get_contents($file) === $original, 'missing delete target is an error');
-		unlink($file); http_response_code(200); moveNode($file, 0);
+		unlink($file); http_response_code(200); wm_fixture_revision($file, fn () => moveNode($file, 0));
 		atomic_assert(http_response_code() === 404 && !file_exists($file), 'deleted map cannot report a successful edit');
 		echo "Atomic configuration write and locking regression PASS\n";
 	} finally {
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index 31e2a836..d7a361f0 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -1,4 +1,13 @@
 <?php
+/** Submit the page revision expected by production mutation routes. */
+function wm_fixture_revision($file, $callback) {
+	if (!array_key_exists('config_revision', $GLOBALS['__test_nfilter_request'] ?? []) && is_file($file)) {
+		$map = new \WeatherMap; $map->ReadConfig($file);
+		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies);
+	}
+	return $callback();
+}
+
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group, Howard Jones                   |
@@ -207,7 +216,7 @@ class DimensionPostProcessor extends WeatherMapPostProcessor { function run(&$ma
 		} else note_assert(!wm_editor_save_note($again, $bad), 'reject ' . $key);
 	}
 	$GLOBALS['__test_nfilter_request'] = ['param' => $name];
-	deleteNode($file);
+	wm_fixture_revision($file, fn () => deleteNode($file));
 	$deleted = new WeatherMap;
 	$deleted->ReadConfig($file);
 	note_assert(!isset($deleted->nodes[$name]), 'delete persists');
diff --git a/tests/Support/MapDuplicatePayload.php b/tests/Support/MapDuplicatePayload.php
index 3e6dce8d..2ff1fa05 100644
--- a/tests/Support/MapDuplicatePayload.php
+++ b/tests/Support/MapDuplicatePayload.php
@@ -98,6 +98,8 @@ function sql_save($payload, $table) {
 
 /** Ignore expected registration failure notices in this schema-only fixture. */
 function raise_message($id, $text = '', $level = 0) {}
+/** Capture server-only clone diagnostics in this fixture. */
+function cacti_log($text, ...$args) { $GLOBALS['clone_log'][] = $text; }
 /** Return the untranslated fixture string. */
 function __($text, ...$args) { return $text; }
 define('MESSAGE_LEVEL_ERROR', 3);
diff --git a/tests/Support/NoteAllocationRegression.php b/tests/Support/NoteAllocationRegression.php
index f01c256e..9de28177 100644
--- a/tests/Support/NoteAllocationRegression.php
+++ b/tests/Support/NoteAllocationRegression.php
@@ -45,6 +45,12 @@ function imagecreatetruecolor($width, $height) {
 	try {
 		$file = $dir . '/map.conf';
 		file_put_contents($file, "WIDTH 400\nHEIGHT 200\nFONTDEFINE 100 docs/example/Vera.ttf 9\nNODE label\n LABEL Readable note\n LABELFONT 100\n LABELBGCOLOR none\n LABELOUTLINECOLOR none\n LABELFONTSHADOWCOLOR none\n POSITION 150 100\n SET editor_note 1\n");
+		$template = $dir . '/template.conf';
+		file_put_contents($template, "WIDTH 400\nHEIGHT 200\nFONTDEFINE 100 docs/example/Vera.ttf 9\nNODE noteTemplate\n LABEL Never rendered\n LABELFONT 100\n LABELBGCOLOR none\n LABELOUTLINECOLOR none\n LABELFONTSHADOWCOLOR none\n SET editor_note 1\n");
+		$templateMap = new \WeatherMap; $templateMap->ReadConfig($template); $templateMap->stamptext = ''; $templateMap->title = '';
+		$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = 0;
+		$templateOutput = $dir . '/template.png'; $templateMap->DrawMap($templateOutput);
+		if (getimagesize($templateOutput)[0] !== 400 || wm_sharp_notes($templateMap) !== []) throw new \RuntimeException('unpositioned marked template must not render or allocate doubled map');
 		foreach ([1, 2, 0] as $failure) {
 			$GLOBALS['note_allocations'] = 0; $GLOBALS['note_fail_at'] = $failure;
 			$map = new \WeatherMap; $map->ReadConfig($file); $map->stamptext = '';
diff --git a/tests/Unit/EditorSettingsCookieTest.php b/tests/Unit/EditorSettingsCookieTest.php
index 77298149..b8f9d685 100644
--- a/tests/Unit/EditorSettingsCookieTest.php
+++ b/tests/Unit/EditorSettingsCookieTest.php
@@ -41,7 +41,7 @@ function cacti_cookie_set($name, $value) { $GLOBALS['wm_test_cookies'][$name] =
 		file_put_contents($file, "WIDTH 100\nHEIGHT 100\n");
 		try {
 			foreach ([[1,1,10,'1:1:10'], [0,1,5,'0:1:5'], [0,0,'NO','0:0:0']] as [$via,$relative,$grid,$expected]) {
-				$GLOBALS['__test_nfilter_request'] = ['editorsettings_showvias'=>$via, 'editorsettings_showrelative'=>$relative, 'editorsettings_gridsnap'=>$grid];
+				$GLOBALS['__test_nfilter_request'] = ['config_revision'=>hash_file('sha256', $file), 'editorsettings_showvias'=>$via, 'editorsettings_showrelative'=>$relative, 'editorsettings_gridsnap'=>$grid];
 				$GLOBALS['__test_request'] = $GLOBALS['__test_nfilter_request'];
 				editorSettings($file);
 				self::assertSame($expected, $GLOBALS['wm_test_cookies']['wmeditor']);
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index de1d5052..1900050f 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -2039,8 +2039,11 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 					db_execute_prepared('DELETE FROM weathermap_settings WHERE mapid = ?', [$newid]);
 					db_execute_prepared('DELETE FROM weathermap_maps WHERE id = ?', [$newid]);
 				}
+			} catch (Throwable $cleanupError) {
+				cacti_log('Weathermap clone cleanup failed: ' . $cleanupError->getMessage(), false, 'WEATHERMAP');
 			} finally { if ($created) unlink($newfile); }
-			raise_message('map_message', $error->getMessage(), MESSAGE_LEVEL_ERROR);
+			cacti_log('Weathermap map clone failed: ' . $error->getMessage(), false, 'WEATHERMAP');
+			raise_message('map_message', __('Could not create the map copy. Please try again.', 'weathermap'), MESSAGE_LEVEL_ERROR);
 			return;
 		} finally {
 			\WeathermapConfig\release($lock);

From 72b3bf6f579c6cf16918fa409fa39bcf3e58b75e Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Wed, 14 Oct 2026 23:41:36 +1030
Subject: [PATCH 34/35] Preserve CAS across aliases and report incomplete clone
 cleanup

---
 lib/WeatherMap.class.php                      | 19 +++++++++++---
 lib/WeatherMap.config.php                     | 25 ++++++++++++++++---
 lib/WeatherMap.notes.php                      |  2 +-
 locales/po/cacti.pot                          |  2 +-
 tests/Support/ConfigWriteAtomicRegression.php | 25 ++++++++++++++++++-
 weathermap-cacti-plugin-mgmt.php              |  6 ++---
 6 files changed, 66 insertions(+), 13 deletions(-)

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 8be3076e..0bda530c 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -2480,7 +2480,8 @@ function ReadConfig($input, $is_include = false) {
 			$filename = $input;
 
 			if ($is_include) {
-				$dependencyPath = realpath($filename) ?: (realpath(dirname($filename)) ?: dirname($filename)) . '/' . basename($filename);
+				$dependencyLogicalPath = (realpath(dirname($filename)) ?: dirname($filename)) . '/' . basename($filename);
+				$dependencyPath = realpath($filename) ?: $dependencyLogicalPath;
 				if (!array_key_exists($dependencyPath, $this->config_dependencies)) $this->config_dependencies[$dependencyPath] = null;
 				wm_debug('ReadConfig Detected that this is an INCLUDED config filename.');
 
@@ -2513,7 +2514,10 @@ function ReadConfig($input, $is_include = false) {
 					fclose($fd);
 					$loadedRevision = hash_final($revision);
 					if (!$is_include) $this->config_revision = $loadedRevision;
-					else $this->config_dependencies[$dependencyPath] = $loadedRevision;
+					else {
+						$this->config_dependencies[$dependencyPath] = $loadedRevision;
+						if ($dependencyLogicalPath !== $dependencyPath) $this->config_dependencies[$dependencyLogicalPath] = ['target' => $dependencyPath, 'revision' => $loadedRevision];
+					}
 				}
 			}
 		}
@@ -3863,8 +3867,15 @@ function WriteConfig($filename, $createOnly = false, $expectedRevision = null, $
 			$contents = stream_get_contents($fd);
 			$closed = fclose($fd);
 
-			$sameFile = $this->configfile !== '' && $filename === $this->configfile;
-			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly, $heldLock, $this->config_dependencies);
+			$sameFile = \WeathermapConfig\sameFile($filename, $this->configfile);
+			$dependencies = $this->config_dependencies;
+			if (!$sameFile && $this->configfile !== '' && is_string($this->config_revision)) {
+				$logicalSource = (realpath(dirname($this->configfile)) ?: dirname($this->configfile)) . '/' . basename($this->configfile);
+				$physicalSource = realpath($this->configfile) ?: $logicalSource;
+				$dependencies[$physicalSource] = $this->config_revision;
+				if ($logicalSource !== $physicalSource) $dependencies[$logicalSource] = ['target' => $physicalSource, 'revision' => $this->config_revision];
+			}
+			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly, $heldLock, $dependencies);
 			if ($saved && $sameFile) $this->config_revision = hash('sha256', $contents);
 			return $saved;
 		} else {
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 9a0fa861..854dff04 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -77,12 +77,31 @@ function writeAll($stream, $contents) {
 
 /**
  * Compare every included configuration against the bytes used by the snapshot.
- * @param array<string,string> $dependencies Included filenames and hashes.
+ * @param array<string,string|array> $dependencies Included filenames and hashes.
  * @return bool Whether all dependencies still match.
  */
+
+/**
+ * Compare filesystem destinations as well as identical path strings.
+ * @param string $left First filename.
+ * @param string $right Second filename.
+ * @return bool Whether both names identify the same file.
+ */
+function sameFile($left, $right) {
+	if ($left === '' || $right === '') return false;
+	if ($left === $right) return true;
+	$resolved = realpath($left);
+	return $resolved !== false && $resolved === realpath($right);
+}
+
 function dependenciesMatch($dependencies) {
 	foreach ($dependencies as $path => $revision) {
 		clearstatcache(true, $path);
+		if (is_array($revision)) {
+			if (realpath($path) !== $revision['target']) return false;
+			$revision = $revision['revision'];
+		}
+		if (!is_file($path)) return false;
 		if (!is_string($revision) || @hash_file('sha256', $path) !== $revision) return false;
 	}
 	return true;
@@ -91,7 +110,7 @@ function dependenciesMatch($dependencies) {
 /**
  * Bind an editor token to its root configuration and included dependencies.
  * @param string|null $root Root configuration hash.
- * @param array<string,string> $dependencies Included filenames and hashes.
+ * @param array<string,string|array> $dependencies Included filenames and hashes.
  * @return string|null Snapshot token.
  */
 function snapshotRevision($root, $dependencies) {
@@ -110,7 +129,7 @@ function snapshotRevision($root, $dependencies) {
  * @param bool $createOnly Refuse to replace an existing destination.
  * @param resource|null $heldLock Optional caller-owned mutex for this destination directory.
  *
- * @param array<string,string> $dependencies Included configuration snapshots.
+ * @param array<string,string|array> $dependencies Included configuration snapshots.
  * @param callable|null $validate Additional commit-time validation.
  * @return bool Success; failures preserve the existing configuration.
  */
diff --git a/lib/WeatherMap.notes.php b/lib/WeatherMap.notes.php
index 0387c459..2c1a499b 100644
--- a/lib/WeatherMap.notes.php
+++ b/lib/WeatherMap.notes.php
@@ -69,7 +69,7 @@ function wm_note_font_id($map, $id) {
 		if (!in_array($signature, ["\x00\x01\x00\x00", 'OTTO', 'ttcf', 'true', 'typ1'], true)) return 3;
 		set_error_handler(function () { return true; }, E_WARNING);
 		try { $bounds = imagettfbbox($font->size, 0, $file, 'Wm'); } catch (Throwable $error) { return 3; } finally { restore_error_handler(); }
-		if (!is_array($bounds) || count($bounds) !== 8) return 3;
+		if (!is_array($bounds) || cacti_count($bounds) !== 8) return 3;
 	}
 	return $id;
 }
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index fbb293fb..25aef5d0 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-14 23:12+1030\n"
+"POT-Creation-Date: 2026-10-14 23:40+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 7d872b07..9996541d 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -337,6 +337,27 @@ function atomic_assert($condition, $message) {
 		atomic_assert(wm_editor_read_config(new \WeatherMap, $file, true), 'matching mutation revision remains accepted');
 		$GLOBALS['__test_nfilter_request'] = [];
 
+		$aliasSource = $dir . '/source-alias.conf'; symlink($file, $aliasSource);
+		$aliasLoaded = new \WeatherMap; $aliasLoaded->ReadConfig($aliasSource);
+		file_put_contents($file, "TITLE New direct winner\n");
+		atomic_assert(!$aliasLoaded->WriteConfig($file) && file_get_contents($file) === "TITLE New direct winner\n", 'canonical destination identity preserves CAS across source alias');
+		file_put_contents($file, $original);
+		$copySource = new \WeatherMap; $copySource->ReadConfig($file);
+		file_put_contents($file, "TITLE New copy source winner\n");
+		atomic_assert(!$copySource->WriteConfig($dir . '/stale-source-copy.conf', true) && !is_file($dir . '/stale-source-copy.conf'), 'create-only copy validates source root revision');
+		file_put_contents($file, $original); $copySource = new \WeatherMap; $copySource->ReadConfig($file); unlink($file);
+		atomic_assert(!$copySource->WriteConfig($dir . '/deleted-source-copy.conf', true), 'deleted source cannot be copied from stale memory');
+		file_put_contents($file, $original); $copySource = new \WeatherMap; $copySource->ReadConfig($aliasSource);
+		atomic_assert($copySource->WriteConfig($dir . '/fresh-alias-copy.conf', true), 'unchanged alias source copies with logical and physical dependencies');
+		unlink($aliasSource);
+		$retargetA = $dir . '/retarget-a.conf'; $retargetB = $dir . '/retarget-b.conf'; $retargetAlias = $dir . '/retarget-alias.conf';
+		file_put_contents($retargetA, "TITLE Same include bytes\n"); file_put_contents($retargetB, "TITLE Same include bytes\n"); symlink($retargetA, $retargetAlias);
+		file_put_contents($includeRoot, "WIDTH 600\nHEIGHT 300\nINCLUDE " . $retargetAlias . "\n");
+		$retargetMap = new \WeatherMap; $retargetMap->ReadConfig($includeRoot); unlink($retargetAlias); symlink($retargetB, $retargetAlias); clearstatcache();
+		atomic_assert(!$retargetMap->WriteConfig($includeRoot), 'retargeted INCLUDE is rejected even when replacement bytes are identical');
+		$retargetMap = new \WeatherMap; $retargetMap->ReadConfig($includeRoot); atomic_assert($retargetMap->WriteConfig($includeRoot), 'freshly loaded retargeted INCLUDE succeeds');
+		unlink($retargetAlias); unlink($retargetA); unlink($retargetB);
+
 		$numericLocale = setlocale(LC_NUMERIC, 0); setlocale(LC_NUMERIC, 'fr_FR.UTF-8', 'fr_FR.utf8', 'fr_FR');
 		try {
 			$largeScale = new \WeatherMap; $largeScale->ReadConfig("SCALE large 1500 2500 0 255 0\n");
@@ -589,7 +610,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		$GLOBALS['__test_db_fetch_cell'] = fn () => 0;
 		$GLOBALS['weathermap_confdir'] = $plugin . '/configs';
 		try {
-			foreach (['false', 'throw', 'auth-false', 'settings-false', 'auth-throw', 'settings-throw'] as $failure) {
+			foreach (['false', 'throw', 'auth-false', 'settings-false', 'auth-throw', 'settings-throw', 'cleanup-false'] as $failure) {
 				$GLOBALS['__test_sql_save'] = function($record) use ($plugin, $failure) {
 					atomic_assert(is_file($plugin . '/configs/' . $record['configfile']), 'reserved file exists during registration');
 					if (function_exists('pcntl_fork')) {
@@ -605,11 +626,13 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 					$GLOBALS['__test_db_calls'][] = ['sql' => $sql, 'params' => $params];
 					if (str_starts_with($sql,'INSERT')) atomic_assert(!str_contains($sql, '987') && $params === [987,1], 'clone IDs are bound as prepared parameters');
 					if ((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-throw') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-throw')) throw new RuntimeException('insert failed');
+					if ($failure === 'cleanup-false') return false;
 					return !((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-false') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-false'));
 				};
 				$cloneMessages = []; $GLOBALS['__test_raise_message'] = function ($id, $text) use (&$cloneMessages) { $cloneMessages[] = $text; };
 				$GLOBALS['__test_cacti_log'] = [];
 				map_duplicate(1, 'Clone', 'clone');
+				if ($failure === 'cleanup-false') atomic_assert(cacti_count(array_filter($GLOBALS['__test_cacti_log'], fn ($message) => str_contains($message, 'cleanup incomplete'))) === 3, 'all failed cleanup DELETE results are logged');
 				unset($GLOBALS['__test_raise_message']);
 				atomic_assert($cloneMessages === ['Could not create the map copy. Please try again.'] && $GLOBALS['__test_cacti_log'] !== [], 'clone failures show only generic guidance and log original diagnostics');
 				atomic_assert(!is_file($plugin . '/configs/clone.conf'), 'failed registration removes its own reserved configuration');
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index 1900050f..5ef0f225 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -2035,9 +2035,9 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 			// Only this attempt's records and successfully reserved file may be removed.
 			try {
 				if ($newid) {
-					db_execute_prepared('DELETE FROM weathermap_auth WHERE mapid = ?', [$newid]);
-					db_execute_prepared('DELETE FROM weathermap_settings WHERE mapid = ?', [$newid]);
-					db_execute_prepared('DELETE FROM weathermap_maps WHERE id = ?', [$newid]);
+					if (db_execute_prepared('DELETE FROM weathermap_auth WHERE mapid = ?', [$newid]) === false) cacti_log('Weathermap clone cleanup incomplete: weathermap_auth record removal failed for map ' . $newid, false, 'WEATHERMAP');
+					if (db_execute_prepared('DELETE FROM weathermap_settings WHERE mapid = ?', [$newid]) === false) cacti_log('Weathermap clone cleanup incomplete: weathermap_settings record removal failed for map ' . $newid, false, 'WEATHERMAP');
+					if (db_execute_prepared('DELETE FROM weathermap_maps WHERE id = ?', [$newid]) === false) cacti_log('Weathermap clone cleanup incomplete: weathermap_maps record removal failed for map ' . $newid, false, 'WEATHERMAP');
 				}
 			} catch (Throwable $cleanupError) {
 				cacti_log('Weathermap clone cleanup failed: ' . $cleanupError->getMessage(), false, 'WEATHERMAP');

From 7ade91b0a97c67fbfce0ccea947e28adb64e19f6 Mon Sep 17 00:00:00 2001
From: alcatron <27321443+alcatron@users.noreply.github.com>
Date: Thu, 15 Oct 2026 00:04:23 +1030
Subject: [PATCH 35/35] Bind root snapshots and preserve configurations on
 incomplete cleanup

---
 lib/WeatherMap.class.php                      | 22 +++++++--
 lib/WeatherMap.config.php                     | 15 +++---
 lib/editor.actions.php                        |  6 +--
 locales/po/cacti.pot                          |  2 +-
 .../BackgroundSizingEngineRegression.php      |  2 +-
 tests/Support/ConfigWriteAtomicRegression.php | 48 ++++++++++++++++---
 tests/Support/EditorNotesEngineRegression.php |  2 +-
 weathermap-cacti-plugin-mgmt.php              | 22 +++++----
 8 files changed, 87 insertions(+), 32 deletions(-)

diff --git a/lib/WeatherMap.class.php b/lib/WeatherMap.class.php
index 0bda530c..5cfa41c9 100644
--- a/lib/WeatherMap.class.php
+++ b/lib/WeatherMap.class.php
@@ -344,6 +344,8 @@ class WeatherMap extends WeatherMapBase {
 	var $configfile;
 	var $config_revision = null;
 	var $config_dependencies = [];
+	/** @var array Loaded root paths, physical targets and revisions. */
+	var $config_root_identity = [];
 	var $editor_config_revision = null;
 	/** @var mixed */
 	var $imagefile;
@@ -2450,7 +2452,7 @@ function DrawTitle($image, $font, $colour) {
 	 */
 	function ReadConfig($input, $is_include = false) {
 		global $config, $weathermap_error_suppress;
-		if (!$is_include) { $this->config_revision = null; $this->config_dependencies = []; }
+		if (!$is_include) { $this->config_revision = null; if (strpos($input, "\n") === false && strpos($input, "\r") === false) { $this->config_dependencies = []; $this->config_root_identity = []; } }
 
 		$curnode    = null;
 		$curlink    = null;
@@ -2478,6 +2480,8 @@ function ReadConfig($input, $is_include = false) {
 			wm_debug('ReadConfig Detected that this is a config filename.');
 
 			$filename = $input;
+			$rootLogicalPath = (realpath(dirname($filename)) ?: dirname($filename)) . '/' . basename($filename);
+			$rootPhysicalPath = realpath($filename);
 
 			if ($is_include) {
 				$dependencyLogicalPath = (realpath(dirname($filename)) ?: dirname($filename)) . '/' . basename($filename);
@@ -2513,7 +2517,10 @@ function ReadConfig($input, $is_include = false) {
 
 					fclose($fd);
 					$loadedRevision = hash_final($revision);
-					if (!$is_include) $this->config_revision = $loadedRevision;
+					if (!$is_include) {
+						$this->config_revision = $loadedRevision;
+						$this->config_root_identity[$rootLogicalPath] = ['target' => $rootPhysicalPath, 'revision' => $loadedRevision];
+					}
 					else {
 						$this->config_dependencies[$dependencyPath] = $loadedRevision;
 						if ($dependencyLogicalPath !== $dependencyPath) $this->config_dependencies[$dependencyLogicalPath] = ['target' => $dependencyPath, 'revision' => $loadedRevision];
@@ -3869,14 +3876,21 @@ function WriteConfig($filename, $createOnly = false, $expectedRevision = null, $
 
 			$sameFile = \WeathermapConfig\sameFile($filename, $this->configfile);
 			$dependencies = $this->config_dependencies;
+			foreach ($this->config_root_identity as $logical => $state) {
+				$dependencies[$logical] = $state;
+				if ($logical !== $state['target']) $dependencies[$state['target']] = $state['revision'];
+			}
 			if (!$sameFile && $this->configfile !== '' && is_string($this->config_revision)) {
 				$logicalSource = (realpath(dirname($this->configfile)) ?: dirname($this->configfile)) . '/' . basename($this->configfile);
 				$physicalSource = realpath($this->configfile) ?: $logicalSource;
-				$dependencies[$physicalSource] = $this->config_revision;
-				if ($logicalSource !== $physicalSource) $dependencies[$logicalSource] = ['target' => $physicalSource, 'revision' => $this->config_revision];
+				if (!isset($dependencies[$physicalSource])) $dependencies[$physicalSource] = $this->config_revision;
+				if ($logicalSource !== $physicalSource && !isset($dependencies[$logicalSource])) $dependencies[$logicalSource] = ['target' => $physicalSource, 'revision' => $this->config_revision];
 			}
 			$saved = $write_ok && $contents !== false && $closed && \WeathermapConfig\atomicWrite($filename, $contents, $sameFile, $expectedRevision ?? ($sameFile ? $this->config_revision : null), $createOnly, $heldLock, $dependencies);
 			if ($saved && $sameFile) $this->config_revision = hash('sha256', $contents);
+			if ($saved) foreach ($this->config_root_identity as $logical => $state) {
+				if (realpath($filename) === $state['target']) $this->config_root_identity[$logical]['revision'] = hash('sha256', $contents);
+			}
 			return $saved;
 		} else {
 			wm_warn("Couldn't open config file $filename for writing");
diff --git a/lib/WeatherMap.config.php b/lib/WeatherMap.config.php
index 854dff04..cdf190f4 100644
--- a/lib/WeatherMap.config.php
+++ b/lib/WeatherMap.config.php
@@ -75,12 +75,6 @@ function writeAll($stream, $contents) {
 	return true;
 }
 
-/**
- * Compare every included configuration against the bytes used by the snapshot.
- * @param array<string,string|array> $dependencies Included filenames and hashes.
- * @return bool Whether all dependencies still match.
- */
-
 /**
  * Compare filesystem destinations as well as identical path strings.
  * @param string $left First filename.
@@ -94,6 +88,11 @@ function sameFile($left, $right) {
 	return $resolved !== false && $resolved === realpath($right);
 }
 
+/**
+ * Compare every included configuration against the bytes used by the snapshot.
+ * @param array<string,string|array> $dependencies Included filenames and hashes.
+ * @return bool Whether all dependencies still match.
+ */
 function dependenciesMatch($dependencies) {
 	foreach ($dependencies as $path => $revision) {
 		clearstatcache(true, $path);
@@ -111,9 +110,11 @@ function dependenciesMatch($dependencies) {
  * Bind an editor token to its root configuration and included dependencies.
  * @param string|null $root Root configuration hash.
  * @param array<string,string|array> $dependencies Included filenames and hashes.
+ * @param array $rootIdentity Loaded root path identities.
  * @return string|null Snapshot token.
  */
-function snapshotRevision($root, $dependencies) {
+function snapshotRevision($root, $dependencies, $rootIdentity = []) {
+	foreach ($rootIdentity as $logical => $state) if ($logical !== $state['target']) $dependencies[$logical] = $state;
 	if (!$dependencies) return $root;
 	ksort($dependencies);
 	return hash('sha256', serialize([$root, $dependencies]));
diff --git a/lib/editor.actions.php b/lib/editor.actions.php
index 8ef25728..2a98f5f4 100644
--- a/lib/editor.actions.php
+++ b/lib/editor.actions.php
@@ -72,7 +72,7 @@ function wm_editor_read_config($map, $mapfile, $requireRevision = false) {
 		return false;
 	}
 	$revision = get_nfilter_request_var('config_revision');
-	if (($requireRevision && (!is_string($revision) || $revision === '')) || ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies), $revision)))) {
+	if (($requireRevision && (!is_string($revision) || $revision === '')) || ($revision !== null && $revision !== '' && (!is_string($revision) || !hash_equals(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies, $map->config_root_identity), $revision)))) {
 		http_response_code(409);
 		return false;
 	}
@@ -91,7 +91,7 @@ function wm_editor_read_config($map, $mapfile, $requireRevision = false) {
 function wm_editor_write_config($map, $mapfile, $createOnly = false) {
 	if (!$map->WriteConfig($mapfile, $createOnly, $map->editor_config_revision)) {
 		$current = is_file($mapfile) ? @hash_file('sha256', $mapfile) : false;
-		$stale = !\WeathermapConfig\dependenciesMatch($map->config_dependencies) || $map->editor_config_revision !== null && $current !== false && $current !== $map->editor_config_revision;
+		$stale = !\WeathermapConfig\dependenciesMatch(array_merge($map->config_dependencies, $map->config_root_identity)) || $map->editor_config_revision !== null && $current !== false && $current !== $map->editor_config_revision;
 		http_response_code($stale ? 409 : 500);
 		return false;
 	}
@@ -159,7 +159,7 @@ function getMapJavaScript($mapfile, $map = null) {
 	}
 
 	print $map->asJS();
-	print 'var WMConfigRevision = ' . json_encode(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies)) . ';';
+	print 'var WMConfigRevision = ' . json_encode(\WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies, $map->config_root_identity)) . ';';
 	print 'var WMNotes = ' . json_encode(wm_editor_note_data($map), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';';
 }
 
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 25aef5d0..7767eaed 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.7\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-14 23:40+1030\n"
+"POT-Creation-Date: 2026-10-15 00:01+1030\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
diff --git a/tests/Support/BackgroundSizingEngineRegression.php b/tests/Support/BackgroundSizingEngineRegression.php
index c7aff2b4..515e077f 100644
--- a/tests/Support/BackgroundSizingEngineRegression.php
+++ b/tests/Support/BackgroundSizingEngineRegression.php
@@ -3,7 +3,7 @@
 function wm_fixture_revision($file, $callback) {
 	if (!array_key_exists('config_revision', $GLOBALS['__test_nfilter_request'] ?? []) && is_file($file)) {
 		$map = new \WeatherMap; $map->ReadConfig($file);
-		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies);
+		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies, $map->config_root_identity);
 	}
 	return $callback();
 }
diff --git a/tests/Support/ConfigWriteAtomicRegression.php b/tests/Support/ConfigWriteAtomicRegression.php
index 9996541d..5b1f2a5c 100644
--- a/tests/Support/ConfigWriteAtomicRegression.php
+++ b/tests/Support/ConfigWriteAtomicRegression.php
@@ -122,11 +122,16 @@ function rename($source, $target) {
 	}
 }
 namespace {
+/** Simulate failed configuration cleanup without changing production code. */
+function atomic_clone_unlink($path) {
+	return !($GLOBALS['atomic_clone_unlink_fail'] ?? false) && unlink($path);
+}
+
 /** Submit the page revision expected by production mutation routes. */
 function wm_fixture_revision($file, $callback) {
 	if (!array_key_exists('config_revision', $GLOBALS['__test_nfilter_request'] ?? []) && is_file($file)) {
 		$map = new \WeatherMap; $map->ReadConfig($file);
-		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies);
+		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies, $map->config_root_identity);
 	}
 	return $callback();
 }
@@ -282,7 +287,7 @@ function atomic_assert($condition, $message) {
 		$includeConfig = "WIDTH 600\nHEIGHT 300\nINCLUDE " . $includeFile . "\n";
 		file_put_contents($includeRoot, $includeConfig);
 		$dependent = new \WeatherMap; $dependent->ReadConfig($includeRoot);
-		$token = \WeathermapConfig\snapshotRevision($dependent->config_revision, $dependent->config_dependencies);
+		$token = \WeathermapConfig\snapshotRevision($dependent->config_revision, $dependent->config_dependencies, $dependent->config_root_identity);
 		file_put_contents($includeFile, "TITLE Included winner\n"); $dependent->title = 'Stale edit';
 		atomic_assert(!$dependent->WriteConfig($includeRoot) && file_get_contents($includeRoot) === $includeConfig, 'included file changes reject stale root persistence');
 		$GLOBALS['__test_nfilter_request'] = ['config_revision' => $token]; http_response_code(200);
@@ -333,7 +338,7 @@ function atomic_assert($condition, $message) {
 		moveNode($file, 0);
 		atomic_assert(http_response_code() === 409 && file_get_contents($file) === $beforeMissingRevision, 'missing mutation token cannot alter configuration');
 		$revisionMap = new \WeatherMap; $revisionMap->ReadConfig($file);
-		$GLOBALS['__test_nfilter_request'] = ['config_revision' => \WeathermapConfig\snapshotRevision($revisionMap->config_revision, $revisionMap->config_dependencies)];
+		$GLOBALS['__test_nfilter_request'] = ['config_revision' => \WeathermapConfig\snapshotRevision($revisionMap->config_revision, $revisionMap->config_dependencies, $revisionMap->config_root_identity)];
 		atomic_assert(wm_editor_read_config(new \WeatherMap, $file, true), 'matching mutation revision remains accepted');
 		$GLOBALS['__test_nfilter_request'] = [];
 
@@ -358,6 +363,26 @@ function atomic_assert($condition, $message) {
 		$retargetMap = new \WeatherMap; $retargetMap->ReadConfig($includeRoot); atomic_assert($retargetMap->WriteConfig($includeRoot), 'freshly loaded retargeted INCLUDE succeeds');
 		unlink($retargetAlias); unlink($retargetA); unlink($retargetB);
 
+		$rootA = $dir . '/root-a.conf'; $rootB = $dir . '/root-b.conf'; $rootAlias = $dir . '/root-alias.conf';
+		$rootBytes = "WIDTH 100\nHEIGHT 100\nTITLE Identical roots\n";
+		file_put_contents($rootA, $rootBytes); file_put_contents($rootB, $rootBytes); symlink($rootA, $rootAlias);
+		$rootMap = new \WeatherMap; $rootMap->ReadConfig($rootAlias);
+		$rootToken = \WeathermapConfig\snapshotRevision($rootMap->config_revision, $rootMap->config_dependencies, $rootMap->config_root_identity);
+		unlink($rootAlias); symlink($rootB, $rootAlias); clearstatcache(true, $rootAlias);
+		$rootMap->title = 'Unexpected write';
+		atomic_assert(!$rootMap->WriteConfig($rootAlias) && file_get_contents($rootA) === $rootBytes && file_get_contents($rootB) === $rootBytes, 'root retargeting cannot overwrite another identical-content file');
+		http_response_code(200);
+		atomic_assert(!wm_editor_write_config($rootMap, $rootAlias) && http_response_code() === 409, 'commit-time root retarget conflicts return HTTP 409');
+		$GLOBALS['__test_nfilter_request'] = ['config_revision'=>$rootToken]; http_response_code(200);
+		atomic_assert(!wm_editor_read_config(new \WeatherMap, $rootAlias, true) && http_response_code() === 409, 'rendered page revision binds root alias identity before mutation dispatch');
+		$GLOBALS['__test_nfilter_request'] = [];
+		$freshRoot = new \WeatherMap; $freshRoot->ReadConfig($rootAlias); $freshRoot->title = 'Fresh root save';
+		atomic_assert($freshRoot->WriteConfig($rootAlias), 'freshly loaded root alias saves');
+		$freshRoot->title = 'Second root save'; atomic_assert($freshRoot->WriteConfig($rootAlias), 'successful saves refresh root identity revisions');
+		$freshRoot->ReadConfig("TITLE Fragment save\n");
+		atomic_assert($freshRoot->config_root_identity !== [], 'raw fragments retain captured root identity');
+		unlink($rootAlias); unlink($rootA); unlink($rootB);
+
 		$numericLocale = setlocale(LC_NUMERIC, 0); setlocale(LC_NUMERIC, 'fr_FR.UTF-8', 'fr_FR.utf8', 'fr_FR');
 		try {
 			$largeScale = new \WeatherMap; $largeScale->ReadConfig("SCALE large 1500 2500 0 255 0\n");
@@ -564,7 +589,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		$start = strpos($management, 'function map_get_next_name('); $end = strpos($management, "\n/**", $start);
 		eval(str_replace('__DIR__', var_export($plugin, true), substr($management, $start, $end - $start)));
 		$start = strpos($management, 'function map_duplicate('); $end = strpos($management, "\n/**", $start);
-		eval(str_replace('__DIR__', var_export($plugin, true), substr($management, $start, $end - $start)));
+		eval(str_replace(['__DIR__', 'unlink('], [var_export($plugin, true), 'atomic_clone_unlink('], substr($management, $start, $end - $start)));
 		$duplicateSource = 'atomic-duplicate-' . bin2hex(random_bytes(4)) . '.conf';
 		file_put_contents($plugin . '/configs/' . $duplicateSource, "TITLE Source\n");
 		$GLOBALS['__test_db_fetch_row_prepared'] = fn () => ['configfile' => $duplicateSource, 'titlecache' => 'Source', 'group_id' => 1, 'active' => 'on', 'thumb_height' => 10, 'thumb_width' => 10, 'schedule' => '', 'archiving' => '',];
@@ -610,7 +635,7 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 		$GLOBALS['__test_db_fetch_cell'] = fn () => 0;
 		$GLOBALS['weathermap_confdir'] = $plugin . '/configs';
 		try {
-			foreach (['false', 'throw', 'auth-false', 'settings-false', 'auth-throw', 'settings-throw', 'cleanup-false'] as $failure) {
+			foreach (['false', 'throw', 'auth-false', 'settings-false', 'auth-throw', 'settings-throw', 'cleanup-false', 'cleanup-auth-throw', 'cleanup-map-throw', 'unlink-failed'] as $failure) {
 				$GLOBALS['__test_sql_save'] = function($record) use ($plugin, $failure) {
 					atomic_assert(is_file($plugin . '/configs/' . $record['configfile']), 'reserved file exists during registration');
 					if (function_exists('pcntl_fork')) {
@@ -627,15 +652,26 @@ function ReadConfig($input, $is_include = false) { unlink($input); $this->config
 					if (str_starts_with($sql,'INSERT')) atomic_assert(!str_contains($sql, '987') && $params === [987,1], 'clone IDs are bound as prepared parameters');
 					if ((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-throw') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-throw')) throw new RuntimeException('insert failed');
 					if ($failure === 'cleanup-false') return false;
+					if (str_starts_with($failure, 'cleanup-') || $failure === 'unlink-failed') {
+						if (str_starts_with($sql, 'INSERT')) return false;
+						if (($failure === 'cleanup-auth-throw' && str_contains($sql, 'DELETE FROM weathermap_auth')) || ($failure === 'cleanup-map-throw' && str_contains($sql, 'DELETE FROM weathermap_maps'))) throw new RuntimeException('cleanup database details');
+					}
+
 					return !((str_contains($sql, 'INSERT INTO weathermap_auth') && $failure === 'auth-false') || (str_contains($sql, 'INSERT INTO weathermap_settings') && $failure === 'settings-false'));
 				};
 				$cloneMessages = []; $GLOBALS['__test_raise_message'] = function ($id, $text) use (&$cloneMessages) { $cloneMessages[] = $text; };
 				$GLOBALS['__test_cacti_log'] = [];
+				$GLOBALS['atomic_clone_unlink_fail'] = $failure === 'unlink-failed';
 				map_duplicate(1, 'Clone', 'clone');
+				unset($GLOBALS['atomic_clone_unlink_fail']);
 				if ($failure === 'cleanup-false') atomic_assert(cacti_count(array_filter($GLOBALS['__test_cacti_log'], fn ($message) => str_contains($message, 'cleanup incomplete'))) === 3, 'all failed cleanup DELETE results are logged');
 				unset($GLOBALS['__test_raise_message']);
 				atomic_assert($cloneMessages === ['Could not create the map copy. Please try again.'] && $GLOBALS['__test_cacti_log'] !== [], 'clone failures show only generic guidance and log original diagnostics');
-				atomic_assert(!is_file($plugin . '/configs/clone.conf'), 'failed registration removes its own reserved configuration');
+				$retained = in_array($failure, ['cleanup-false', 'cleanup-map-throw', 'unlink-failed'], true);
+				atomic_assert(is_file($plugin . '/configs/clone.conf') === $retained, 'failed cleanup retains recoverable config until map row removal and file unlink both succeed');
+				if ($failure === 'unlink-failed') atomic_assert(cacti_count(array_filter($GLOBALS['__test_cacti_log'], fn ($message) => str_contains($message, 'config removal failed'))) === 1, 'failed unlink is explicitly logged');
+				if ($retained) unlink($plugin . '/configs/clone.conf');
+
 				if (str_ends_with($failure, '-false') || str_ends_with($failure, '-throw')) atomic_assert(cacti_count(array_filter($GLOBALS['__test_db_calls'], fn ($call) => str_starts_with($call['sql'], 'DELETE'))) === 3, 'partial registration removes map/auth/settings records');
 			}
 		} finally { unset($GLOBALS['__test_db_fetch_row_prepared'], $GLOBALS['__test_sql_save'], $GLOBALS['__test_db_fetch_cell'], $GLOBALS['__test_db_execute_prepared']); unlink($plugin . '/configs/' . $duplicateSource); }
diff --git a/tests/Support/EditorNotesEngineRegression.php b/tests/Support/EditorNotesEngineRegression.php
index d7a361f0..f4421927 100644
--- a/tests/Support/EditorNotesEngineRegression.php
+++ b/tests/Support/EditorNotesEngineRegression.php
@@ -3,7 +3,7 @@
 function wm_fixture_revision($file, $callback) {
 	if (!array_key_exists('config_revision', $GLOBALS['__test_nfilter_request'] ?? []) && is_file($file)) {
 		$map = new \WeatherMap; $map->ReadConfig($file);
-		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies);
+		$GLOBALS['__test_nfilter_request']['config_revision'] = \WeathermapConfig\snapshotRevision($map->config_revision, $map->config_dependencies, $map->config_root_identity);
 	}
 	return $callback();
 }
diff --git a/weathermap-cacti-plugin-mgmt.php b/weathermap-cacti-plugin-mgmt.php
index 5ef0f225..34e4f1b7 100644
--- a/weathermap-cacti-plugin-mgmt.php
+++ b/weathermap-cacti-plugin-mgmt.php
@@ -2032,16 +2032,20 @@ function map_duplicate($id, $titlecache, $configfile = null) {
 				FROM weathermap_settings
 				WHERE mapid = ?", [$newid, $id]) === false) throw new RuntimeException(__('Could not register the new map.', 'weathermap'));
 		} catch (Throwable $error) {
-			// Only this attempt's records and successfully reserved file may be removed.
-			try {
-				if ($newid) {
-					if (db_execute_prepared('DELETE FROM weathermap_auth WHERE mapid = ?', [$newid]) === false) cacti_log('Weathermap clone cleanup incomplete: weathermap_auth record removal failed for map ' . $newid, false, 'WEATHERMAP');
-					if (db_execute_prepared('DELETE FROM weathermap_settings WHERE mapid = ?', [$newid]) === false) cacti_log('Weathermap clone cleanup incomplete: weathermap_settings record removal failed for map ' . $newid, false, 'WEATHERMAP');
-					if (db_execute_prepared('DELETE FROM weathermap_maps WHERE id = ?', [$newid]) === false) cacti_log('Weathermap clone cleanup incomplete: weathermap_maps record removal failed for map ' . $newid, false, 'WEATHERMAP');
+			// Keep a recoverable config whenever removal of its registration is uncertain.
+			$mapRowRemoved = !$newid;
+			if ($newid) {
+				foreach (['weathermap_auth' => 'mapid', 'weathermap_settings' => 'mapid', 'weathermap_maps' => 'id'] as $table => $column) {
+					try {
+						$removed = db_execute_prepared("DELETE FROM $table WHERE $column = ?", [$newid]) !== false;
+						if ($table === 'weathermap_maps') $mapRowRemoved = $removed;
+						if (!$removed) cacti_log('Weathermap clone cleanup incomplete: ' . $table . ' record removal failed for map ' . $newid, false, 'WEATHERMAP');
+					} catch (Throwable $cleanupError) {
+						cacti_log('Weathermap clone cleanup incomplete: ' . $table . ': ' . $cleanupError->getMessage(), false, 'WEATHERMAP');
+					}
 				}
-			} catch (Throwable $cleanupError) {
-				cacti_log('Weathermap clone cleanup failed: ' . $cleanupError->getMessage(), false, 'WEATHERMAP');
-			} finally { if ($created) unlink($newfile); }
+			}
+			if ($created && $mapRowRemoved && !@unlink($newfile)) cacti_log('Weathermap clone cleanup incomplete: config removal failed: ' . $newfile, false, 'WEATHERMAP');
 			cacti_log('Weathermap map clone failed: ' . $error->getMessage(), false, 'WEATHERMAP');
 			raise_message('map_message', __('Could not create the map copy. Please try again.', 'weathermap'), MESSAGE_LEVEL_ERROR);
 			return;