Stand nach der nativen Huelle in AGENTS.md und Plan nachziehen

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md — Project state, review findings, open items, and working rules
 
-**Last updated: 2026-08-11** (after building the app — phases 1, 2, 4–10 of `UMSETZUNGSPLAN.md`). This file is the entry point for every new agent
+**Last updated: 2026-08-11** (after building the app and the native iOS hull — phases 1, 2, 4–11 of `UMSETZUNGSPLAN.md`). This file is the entry point for every new agent
 session: what this repo is, what is finished, what is missing, and how to work here. Detail lives in
 the linked documents — this file points, it does not duplicate.
 
@@ -80,7 +80,7 @@ assets. Never mix these the other way around.
 | `homeassistant/` | HA panel (`panel_custom`): pyscript backend + vanilla-JS frontend | ✅ **finished, in use** — to be replaced by the app |
 | `testumgebung/` | Script that rebuilds a throwaway Home Assistant with the real backend | ✅ new, reproducible |
 | `design-system/` | React component library `@audi-dash/ui`, brand-free, feeds Claude Design | ✅ done as a kit (20 components, 1,690 lines) |
-| `companion-app/` | **DataMetric360** — successor app (PWA today, Capacitor iOS/Android later, HA iframe); will **replace** the panel | ✅ **all 21 screens built and tested**; PWA works; Capacitor hull pending |
+| `companion-app/` | **DataMetric360** — successor app (web, PWA, native iOS/Android via Capacitor, HA iframe); will **replace** the panel | ✅ **all 21 screens built and tested**; runs natively on iOS with real data |
 | `design/` | Export of the Claude Design draft for DataMetric360 | 🚧 interim and now behind the code — screens were derived from the old panel instead (owner's decision) |
 
 Root files: `dashboard-muster*.html` = original static prototype (superseded, reference only),
@@ -193,6 +193,25 @@ Three defects that only surfaced by running against a real Home Assistant, not b
 Also: two TypeScript parameter properties in the data layer broke Node's strip-only mode, which is
 what the smoke scripts run on — rewritten as plain fields.
 
+Three more that only screenshots revealed — nothing failed, the pixels were simply wrong:
+
+4. **The vehicle block on the home screen was invisible.** `overflow: hidden` sets a flex item's
+   automatic minimum size to 0, so once the page was taller than the screen, flex-shrink squashed
+   the block to zero height and took model name, badge and plate with it. Fixed with
+   `.dm-inhalt > * { flex: none }`.
+5. **The model name appeared twice** — once as the badge image, once as text beside it.
+6. **Filenames overflowed the gallery thumbnails.**
+
+And one in the backend, found by watching the log against a current Home Assistant: the odometer
+screening called `urlopen` directly, which HA aborts as a blocking call since 2026.8. Every trip
+stayed without a distance, visible only as a warning. Now runs through `task.executor`.
+
+**CORS is a real constraint for this app.** `cors_allowed_origins` did not take effect on HA
+2026.8 (preflight 403 even same-origin). Two consequences, both handled: the web build is served
+from Home Assistant itself (`/local/dm360/`, same origin — the planned deployment anyway), and the
+native hull enables `CapacitorHttp`, which routes fetch through native HTTP where CORS does not
+apply. Verify this again at commissioning if the app ever moves to a separate hostname.
+
 **A self-written QR encoder was discarded.** It disagreed with a reference implementation on 1239
 of 3249 modules — the code would have been unreadable. `homeassistant/www/dm360-qr.html` now uses a
 vendored MIT library served from Home Assistant itself, which satisfies the actual requirement