v1.7.11

This release focuses on the Find My push (FCM) lifecycle and on how a
device's location is reported to Home Assistant. It stops a token-transition
edge case from silently breaking pushes, cleans up orphaned push
registrations, and makes stale-versus-fresh location reporting strictly
correct so a map never shows an outdated position as current. It also
preserves a valid master login through a scoped-token error, so a transient
failure no longer forces a needless re-authentication. The config schema is
unchanged and nothing is removed for existing working installs.

What's Changed

Bug Fixes

• A scoped-token error no longer discards the master login. A failure on a
  narrow, scoped token previously nulled the shared AAS master token, which
  could trigger a re-authentication storm; the master token is now preserved
  and only the scoped token is refreshed.
• Foreign-subtype pushes are dropped and a stuck reconnect is cancelled on
  re-registration. During a token transition the old push client could keep
  delivering pushes for a foreign subtype and spin a zombie reconnect; both are
  now handled cleanly.
• Orphaned web-push subscriptions are actually unregistered. When the
  integration re-registers its push endpoint, the previous (now orphaned)
  subscription is deregistered at Google instead of being left behind to keep
  receiving traffic.
• Orphan cleanup can no longer block the critical path. The best-effort
  orphan unregister is bounded by a short timeout, so a slow network call
  cannot stall the push lifecycle.
• A dropped push is no longer counted as delivered. The first-locate
  delivery proof was split from the receipt list, so a message that was dropped
  is not falsely recorded as received.
• Stale detection is tuned to the home polling cadence, and accuracy-less
  rows are handled. The stale threshold was retuned so a device that reports
  on your configured cadence is not prematurely marked stale, and a location
  row that arrives without an accuracy value is handled instead of being
  discarded.
• A device's freshness metadata always matches its published position. Age,
  status and the extra attributes are tied to the exact row used for the
  coordinates, so a moving device can no longer be shown at a cached position
  with a fresh-looking age.
• Stale coordinates are never published as the live position. Live entity
  coordinates and recorder-facing history keys are now strictly separated: when
  a fix is stale the built-in GPS attributes are withheld (so maps and
  templates such as closest() cannot treat an old position as current), while
  the recorder keys and last_seen are preserved and correctly restored after
  a restart. The map history also parses last_seen_utc for restored
  recorder-only rows, so an old fix is plotted at its real report time rather
  than the restart time.

Maintenance & Tooling

• Toolchain refresh: adopted the pip-audit lock refresh for the ruff 0.15 /
  mypy 2 strict toolchain, and added explicit set annotations for mypy 2 strict
  compliance.
• A benign foreign-subtype drop is now logged at DEBUG instead of WARNING,
  so a normal token transition no longer surfaces a scary warning.

Tests

• Async test hygiene: the re-register test now awaits its coroutine instead
  of using asyncio.run().
• Follow-up hardening: six P3 findings from the integration audit were
  addressed with additional guards, tests and documentation.

Full Changelog: v1.7.10...v1.7.11

---

A full restart of Home Assistant is required after updating. Reloading the
integration alone is not enough: a version update changes the integration's
Python code, which Home Assistant only picks up on a full restart. After
updating, restart Home Assistant and confirm that manifest.json shows
1.7.11 under Settings -> Devices & Services -> Google Find My.