complete_quest proxies to the API so the panel tap is one write

WHY: Feature 18 makes the integration a client of the NestQuest API
service — every database write must go through the API.  The
complete_quest service still wrote the local database and fired the
completed event itself, which would double-fire once the SSE
subscription re-fires the API's transition (and stops being true the
moment the local database is dropped).  The service now proxies to the
entry's ONE shared API client (complete_instance: the panel complete
route) and keeps only the old immediate-update behaviour: a successful
call refreshes the coordinator so the sensors reflect the completion
at once; the bus event comes solely from the SSE stream.  Typed API
failures (and an unconfigured client, and a non-panel actor) surface
as HomeAssistantError with token-free messages instead of being
swallowed; the payload contract (instance_id, actor=panel,
actor_child_id) is unchanged for the panel cards.

Tests: new tests/test_complete_quest_proxy.py asserts the call reaches
the shared client with the right arguments, that no local write or
local event happens on the API path, that a non-2xx/transport failure
raises a service error chained to the typed error (never containing
the token), and that the unconfigured stub fails clearly.  Existing
tests that drove complete_quest through the local database move to the
API path via the harness stand-in client (which performs the same core
completion and publishes the same SSE frames the API route does) and
assert their bus events after the frames are delivered through the
real SSE subscription; the shim-level tests drive the events shim
directly, the way its remaining callers invoke it.

Task 47c7c90e (complete_quest proxies to the API, Feature 18).

README.md

@@ -159,50 +159,9 @@ Sensors the automations read: `sensor.nestquest_<child>_quests_due_today`
 
 Run these steps in order to display the NestQuest panel on a TouchHub
 wall device. The panel is an HA Lovelace dashboard, so the kiosk browser
-is simply a Home Assistant client. The path below is zero-config: the
-integration registers its panel dashboard itself on setup, so no YAML
-and no hand-built views are involved.
+is simply a Home Assistant client.
 
-1. **Install the integration and add the config entry.** Install
-   NestQuest via HACS or manually (see Installation above) and restart
-   Home Assistant. Then, in *Settings → Devices & Services*, click
-   **Add Integration**, search for **NestQuest**, and submit the flow —
-   it has no fields; it just creates the single config entry. Then open
-   the entry, click **Configure**, and fill the panel-plane API
-   connection in the options flow:
-
-   - **NestQuest API base URL** — the full `http://host:port` URL of
-     your NestQuest API service (default `http://127.0.0.1:8000`).
-   - **Panel service token** — the token the panel presents to the API
-     service as its Bearer credential. It may stay empty until you have
-     one; a pasted token must be unpadded.
-
-   The form's remaining fields (panel idle timeout, coordinator update
-   interval, last-good snapshot staleness) have defaults that serve the
-   panel and need no change here.
-
-2. **The panel dashboard appears automatically.** On setup the
-   integration registers one storage-mode Lovelace dashboard: a sidebar
-   entry titled **NestQuest** at the URL path `/nestquest`, whose stored
-   config is nothing but the **`custom:nestquest-party` strategy**
-   (`strategy: { type: custom:nestquest-party }`). The strategy
-   generates the views at render time from the household roster:
-
-   - **The Party** — the party-board view at `/nestquest/party`; the
-     dashboard root `/nestquest` shows it as the first view.
-   - one quest-log view per child at `/nestquest/<child-slug>`
-     ("Ada's Quest Log", …), in roster order.
-
-   Nothing is hand-configured: no YAML, no manual views, no
-   `child_order`, no `quest_log_path`/`board_path` — the board and the
-   quest logs compute their navigation paths from the dashboard's own
-   URL — and every generated view is already in **Panel** layout (see
-   the two constraints below). If the Lovelace surfaces are unavailable
-   (for example when Lovelace runs in YAML mode), setup logs a warning
-   and skips the registration; create the dashboard manually with the
-   same strategy as described in the manual alternative below.
-
-3. **Create a dedicated kiosk user.** In *Settings → People → Users*, add
+1. **Create a dedicated kiosk user.** In *Settings → People → Users*, add
    a new user for the wall device. Make it **non-admin**, and ensure it is
    not in the NestQuest admin allowlist. The allowlist blocks the NestQuest
    **admin** operations — `uncomplete_quest`, `create_quest_definition`,
@@ -215,101 +174,66 @@ and no hand-built views are involved.
    Assistant user it may also reach other permitted Home Assistant entities
    and services.
 
-4. **Open the dashboard and point TouchHub at it.** Open
-   `http://<home-assistant>/nestquest` in a browser first and check the
-   party board renders with your children's crests. Then, in the
-   TouchHub launcher, add the **Home Assistant Lovelace** app to the
-   dock and paste the dashboard URL from step 2 — the dashboard root,
-   `/nestquest` (TouchHub loads that URL directly as the kiosk landing
-   page). Set TouchHub **Auto-Return** to a value GREATER than the
-   quest log's `idle_return_seconds` (default 40s) — recommend **60s or
-   higher**. If Auto-Return is at or below 40s, TouchHub returns to its
-   launcher before the quest log's idle return can navigate back to the
-   party board.
+2. **Build a dashboard with only the NestQuest panel cards.** Create a
+   Lovelace dashboard whose **URL slug is `nestquest`** (Settings →
+   Dashboards → Edit → URL slug). A functional panel needs **two** views
+   in that dashboard, each with its own card config from
+   `design/ENTITIES-AND-SERVICES.md` §4. Give the views these exact URL
+   paths (the path segment after the dashboard slug):
 
-5. **Log the kiosk session in.** Sign in on the device as the dedicated
-   kiosk user from step 3, and leave that session logged in.
+   - **View 1 path `board`** (URL `/nestquest/board`) — party board
+     (`type: custom:nestquest-party-board-card`): the household quest
+     board. Set `weather_entity` (optional; the dock falls back to
+     date/time), `quest_log_path: /nestquest/log` (the view the crest tap
+     navigates to), and `child_order: [slug1, slug2, slug3]` listing each
+     child's slug in display order.
+
+   - **View 2 path `log`** (URL `/nestquest/log`) — quest log
+     (`type: custom:nestquest-quest-log-card`): the per-child quest screen
+     the party board hops to. Set `board_path: /nestquest/board` (the
+     party-board view to return to), `weather_entity`,
+     `idle_return_seconds` (must be shorter than TouchHub Auto-Return),
+     `confirm_timeout_seconds`, and `complete_screen_seconds`. The quest
+     log reads the selected child's slug from the view's URL path, so the
+     board → log hop is a plain Lovelace navigation.
+
+    Each view's layout MUST be set to **Panel** (Edit Dashboard → pencil on the
+    view → View type: Panel). Home Assistant's default Masonry layout constrains
+    the 1080px-tall NestQuest card to a narrow column; Panel (single-card)
+    layout is what renders the card full-screen at 1920×1080.
+
+    The dashboard contains only the NestQuest panel card for each view —
+    no other cards, no admin controls.
+
+   The `quest_log_path` and `board_path` values must match the dashboard
+   slug and view paths above: `/<slug>/<view>`. If you chose `nestquest`
+   as the dashboard slug with view paths `board` and `log`, the card
+   configs are already correct. If you pick different names, substitute
+   your actual paths in **both** card configs — e.g. a dashboard slug
+   `chores` with view paths `main` and `history` needs
+   `quest_log_path: /chores/history` and `board_path: /chores/main`.
+   Navigation between the two views fails (the crest tap or back button
+   lands on a 404) if the card config paths do not match the dashboard
+   slug and view paths exactly.
+
+   See `design/ENTITIES-AND-SERVICES.md` §4 for the full card YAML.
+
+3. **Point TouchHub at it.** In the TouchHub launcher, add the **Home
+   Assistant Lovelace** app to the dock and paste the dashboard URL from
+   step 2 — the party-board view URL, e.g. `/nestquest/board` (TouchHub
+   loads that URL directly as the kiosk landing page). Set TouchHub
+   **Auto-Return** to a value GREATER than the quest log's
+   `idle_return_seconds` (default 40s) — recommend **60s or higher**. If
+   Auto-Return is at or below 40s, TouchHub returns to its launcher before
+   the quest log's idle return can navigate back to the party board.
+
+4. **Log the kiosk session in.** Sign in on the device as the dedicated
+   kiosk user from step 1, and leave that session logged in.
 
 TouchHub loads the dashboard URL directly. The NestQuest cards are normal
 Lovelace cards, not an iframe, so no Home Assistant framing setting is
 needed.
 
-### The two constraints
-
-- **Panel layout.** Every view must be in **Panel** (single-card)
-  layout: Home Assistant's default Masonry layout constrains the
-  1080px-tall NestQuest card to a narrow column, while Panel renders the
-  card full-screen at 1920×1080. The zero-config path already satisfies
-  the requirement — the strategy generates every view as
-  `type: panel` — while the manual alternative below requires setting
-  the layout by hand on each view (Edit Dashboard → pencil on the view
-  → View type: Panel).
-
-- **TouchHub Auto-Return.** TouchHub's **Auto-Return** must be greater
-  than the quest log's `idle_return_seconds` (default 40s) — recommend
-  **60s or higher** — so the launcher does not reclaim the wall device
-  before the quest log's own idle return navigates back to the party
-  board.
-
-### Manual alternative: build the dashboard by hand
-
-If you prefer not to use the zero-config dashboard above — or its
-registration was skipped — configure a Lovelace dashboard whose **URL
-slug is `nestquest`** (Settings → Dashboards → Edit → URL slug)
-yourself. Two options, in decreasing order of convenience:
-
-- **Use the strategy.** Give the dashboard
-
-  ```yaml
-  strategy:
-    type: custom:nestquest-party
-  ```
-
-  and no views of your own — the strategy generates the party-board and
-  quest-log views (each already in Panel layout) from the household
-  roster at render time. Optional `url_path` and `weather_entity` keys
-  may sit beside `strategy:`.
-
-- **Build the two views by hand.** A functional panel needs **two**
-  views in that dashboard, each with its own card config from
-  `design/ENTITIES-AND-SERVICES.md` §4. Give the views these exact URL
-  paths (the path segment after the dashboard slug):
-
-  - **View 1 path `board`** (URL `/nestquest/board`) — party board
-    (`type: custom:nestquest-party-board-card`): the household quest
-    board. Set `weather_entity` (optional; the dock falls back to
-    date/time), `quest_log_path: /nestquest/log` (the view the crest tap
-    navigates to), and `child_order: [slug1, slug2, slug3]` listing each
-    child's slug in display order.
-
-  - **View 2 path `log`** (URL `/nestquest/log`) — quest log
-    (`type: custom:nestquest-quest-log-card`): the per-child quest screen
-    the party board hops to. Set `board_path: /nestquest/board` (the
-    party-board view to return to), `weather_entity`,
-    `idle_return_seconds` (must be shorter than TouchHub Auto-Return —
-    see the two constraints above), `confirm_timeout_seconds`, and
-    `complete_screen_seconds`. The quest log reads the selected child's
-    slug from the view's URL path, so the board → log hop is a plain
-    Lovelace navigation.
-
-  The dashboard contains only the NestQuest panel card for each view —
-  no other cards, no admin controls. Each view's layout MUST be set to
-  **Panel** — see the two constraints above for why; the strategy
-  generates it for you, hand-built views do not get it for free.
-
-  The `quest_log_path` and `board_path` values must match the dashboard
-  slug and view paths above: `/<slug>/<view>`. If you chose `nestquest`
-  as the dashboard slug with view paths `board` and `log`, the card
-  configs are already correct. If you pick different names, substitute
-  your actual paths in **both** card configs — e.g. a dashboard slug
-  `chores` with view paths `main` and `history` needs
-  `quest_log_path: /chores/history` and `board_path: /chores/main`.
-  Navigation between the two views fails (the crest tap or back button
-  lands on a 404) if the card config paths do not match the dashboard
-  slug and view paths exactly.
-
-  See `design/ENTITIES-AND-SERVICES.md` §4 for the full card YAML.
-
 ## Developer Setup and Testing
 
 This project uses [`uv`](https://github.com/astral-sh/uv) for fast Python package and dependency management.

RELEASE_NOTES.md

@@ -1,135 +1,27 @@
 # NestQuest Release Notes
 
-## Version 0.6.0 — 2026-09-23
+## Unreleased
 
-### Scope
-
-Sixth release of NestQuest, promoting the re-imagined architecture
-(Features 15, 16, 18 and 20) and the foreground development-orchestration
-tooling from `dev` onto 0.5.0. This is a major architectural change: the
-Home Assistant integration becomes a thin client of a standalone NestQuest
-API service that owns the database.
-
-- **Feature 15 — Domain Core Extraction:** all domain code (schema,
-  migrations, database access, the DAOs, the pure recurrence/presence
-  engines, materialization, completion, the SSE-free event payload
-  builders, the panel snapshot builder, the children/definitions/allowlist
-  business layers, and an explicit settings object) now lives in a
-  Home-Assistant-free package bundled inside the integration at
-  `custom_components/nestquest/core/`. The SQLite schema and migration
-  versions are unchanged, so an existing `nestquest.db` opens without
-  migration. Covered by a no-Home-Assistant end-to-end smoke test.
-  (Tasks d0b691d8, 510c1f78, 4dd8f870, 628473ad.)
-- **Feature 16 — NestQuest API Service:** a standalone FastAPI service
-  (`api/`) that imports `core/` and is the only writer of the database.
-  Panel plane (`/api/v1/panel/*`) is authenticated by a static service
-  token: household snapshot and an idempotent complete route. Admin plane
-  (`/api/v1/admin/*`): children, quest definitions, presence
-  schedule/override, uncomplete, regenerate, history query + CSV export,
-  and settings — authenticated by an Authentik OIDC JWT (issuer, audience,
-  JWKS signature and expiry) plus membership in `nestquest-admins`, with
-  the panel service token rejected outright. A server-sent-events stream
-  publishes the quest-completed, quest-uncompleted, quest-missed and
-  child-day-complete transitions; the missed sweep runs in the API with a
-  cross-process-safe watermark. `/health` and the OpenAPI document are
-  served. (Tasks 042dfc5c, ae7e90ae, 1860ef76, 4d7bae00, 44c93cfd,
-  e70e6bfb, 0f2afb29, e4845baa, b586a2f1, e4a9d31b, da0226b3, 2d2dda53,
-  2b3de7e5, 9047a97b, 9a118da9, 058c7b69, a232c4f5.)
-- **Feature 18 — HA Integration as API Client:** the integration no longer
-  owns a database. It polls `GET /api/v1/panel/snapshot` and builds the
-  existing sensors (entity ids and per-child instance payload shape
-  unchanged), subscribes to the SSE stream and re-fires the four HA bus
-  events, proxies `nestquest.complete_quest` to the panel complete route,
-  and caches the last-good snapshot so a brief API outage does not blank
-  the panel. The HA admin services and the service permission gate are
-  removed; only the panel completion path remains. (Tasks 37d5e806,
-  6e70d166, b1ed9c45, 47c7c90e, d25b875f, d04f5bf3, ad67fc44.)
-- **Feature 20 — Zero-Config Panel Dashboard:** the panel installs with no
-  hand-written card YAML and no manual dashboard creation. The cards
-  auto-discover children from a household entity attribute (ordered by the
-  API's `sort_order`), a Lovelace dashboard strategy generates the
-  party-board view and one quest-log view per child at render time with
-  computed navigation paths, and the integration registers the dashboard
-  on first setup. Navigation and the panel transitions match the design
-  mockups. (Tasks 1b6d91d2, c859af23, c2d4dd8e, 107b8fbe, 50067c1f,
-  fc69c940, 67775be9.)
-- **Development orchestration tooling:** durable OpenCode controller and
-  role launchers, the foreground terminal orchestrator, the independent
-  review/approval gates, and the automatic release-preparation policy.
-
-### Requirements
-
-- Minimum Home Assistant version: **2024.6.0**.
-- A running NestQuest API service, reachable at the base URL and panel
-  service token configured in the integration options. The API service
-  source ships in `api/`; there is no container image, compose file or
-  deployment runbook in this release, and Feature 17 — the deployment
-  (TLS reverse proxy, Authentik, network separation, backups) — is **not**
-  part of this release and must be completed before the integration is
-  functional. See `docs/ARCHITECTURE.md` for the target design.
-
-### Breaking changes
-
-- **The HA integration no longer owns a database.** It reads exclusively
-  from the NestQuest API. The local `nestquest.db` is no longer opened,
-  migrated or written by the integration (the file is left untouched on
-  disk). Without a reachable API the entities become unavailable after the
-  configured staleness threshold; the panel serves the last-good snapshot
-  in the meantime.
-- **HA admin services are removed** (`uncomplete`, quest-definition
-  create/update/set-active, presence pattern/override, CSV export,
-  `manage_child`, `regenerate`) and the HA-side permission gate is gone.
-  Admin operations move to the API, and — once Feature 19 lands — the
-  admin PWA. Any automation that called an admin service must be
-  repointed at the API.
-- **Logger namespaces moved** under `custom_components.nestquest.core.*`:
-  the migrations runner now logs under
-  `custom_components.nestquest.core.migrations` (previously
-  `custom_components.nestquest.migrations`), and the children registry and
-  admin allowlist log under `custom_components.nestquest.core.children` and
-  `custom_components.nestquest.core.admin_allowlist`. The parent
-  `custom_components.nestquest` logger still catches all three; only users
-  who pinned a leaf logger name by its old spelling must update.
-- **The panel installs with no configuration.** `child_order`,
-  `quest_log_path` and `board_path` are no longer required (an explicit
-  value still wins). The integration registers a `custom:nestquest-party`
-  dashboard on setup; point TouchHub at it.
-- **Schema is unchanged at version 7** — no migration runs on upgrade.
-
-### Known Limitations
-
-- **Feature 17 (API deployment and identity) is not in this release.** The
-  API service source ships in `api/`, but no container image, compose
-  file, TLS reverse proxy, Authentik application/provider/`nestquest-admins`
-  group, proven network separation of the panel routes, or backup/restore
-  is included. Feature 17's containerization groundwork was completed on
-  its own feature branch, which is **not** merged into `dev` and therefore
-  is not part of this release. Until that deployment is completed the
-  integration has nothing to talk to.
-- **Feature 19 (admin PWA) is not in this release.** There is no admin UI
-  in 0.6.0; admin operations are reachable only through the API directly.
-- Moving the household database from Home Assistant to the API box is a
-  manual file copy (the schema is unchanged).
-- Single household; single API service.
-
-### Rollback
-
-Schema version is unchanged (7), so no migration is involved in either
-direction. Nevertheless **back up `nestquest.db` (plus `-wal`/`-shm`)
-before upgrading**: 0.6.0 never touches it, and a downgrade to 0.5.0
-resumes using exactly that file.
-
-**HACS installs:**
-
-1. Downgrade via HACS (HACS > Integrations > NestQuest > Redownload > 0.5.0).
-2. Restart Home Assistant.
-
-**Manual installs:**
-
-1. Replace `custom_components/nestquest/` with the 0.5.0 tree.
-2. Restart Home Assistant.
-
-**Repository operators:** git-revert the 0.6.0 release merge on `main`.
+- **Storage layer extraction (task d0b691d8):** the SQLite storage layer
+  (schema, migrations, db, store, const, recurrence, DAOs) is bundled
+  under `custom_components/nestquest/core/`, with the integration's
+  original module names preserved as re-export shims.
+- **Logger namespace change (breaking for logging configuration):** the
+  migrations runner now logs under
+  `custom_components.nestquest.core.migrations` instead of
+  `custom_components.nestquest.migrations`. Users who tuned the old
+  logger name (e.g. in `logger.yaml` or `configuration.yaml`) must
+  update the entry to keep that level, as the old name no longer
+  receives migration log output.
+- **Additional logger namespace moves:** the children registry and the
+  admin allowlist business layers now log under
+  `custom_components.nestquest.core.children` and
+  `custom_components.nestquest.core.admin_allowlist` respectively
+  (moved with the engines/business-layer extraction, task 510c1f78).
+  The parent `custom_components.nestquest` logger still catches both,
+  so users who tune the parent rather than the leaf names are
+  unaffected; only users who pinned a leaf logger name by its old
+  spelling need to update.
 
 ## Version 0.5.0 — 2026-09-18
 

admin/.env.example

@@ -1,13 +0,0 @@
-# NestQuest Admin PWA — runtime configuration (Vite env).
-# Copy to .env (or .env.local) and fill in real values. NEVER commit .env.
-
-# Authentik OIDC provider. Defaults to the issuer below when unset.
-VITE_AUTHENTIK_ISSUER=https://auth.cubecraftlabs.com/application/o/nestquest/
-
-# REQUIRED. OAuth2/OIDC client id of the PUBLIC (PKCE) Authentik application.
-# No default: the app shows a configuration error screen when this is missing.
-# Never set a client_secret — this is a browser SPA using PKCE only.
-VITE_AUTHENTIK_CLIENT_ID=
-
-# NestQuest API base URL.
-VITE_API_BASE_URL=https://nestquest.cubecraftlabs.com

admin/.gitignore

@@ -1,2 +0,0 @@
-node_modules/
-dist/

admin/index.html

@@ -1,15 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
-    <meta name="theme-color" content="#3b3ab8" />
-    <link rel="manifest" href="/manifest.webmanifest" />
-    <link rel="apple-touch-icon" href="/icons/icon-192.png" />
-    <title>NestQuest Admin</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>

admin/package.json

@@ -1,27 +0,0 @@
-{
-  "name": "nestquest-admin",
-  "private": true,
-  "version": "0.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "preview": "vite preview",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0"
-  },
-  "devDependencies": {
-    "@testing-library/dom": "^10.4.1",
-    "@testing-library/react": "^16.3.0",
-    "@types/react": "^19.2.0",
-    "@types/react-dom": "^19.2.0",
-    "@vitejs/plugin-react": "^5.0.0",
-    "jsdom": "^30.1.1",
-    "typescript": "^5.9.2",
-    "vite": "^7.1.5",
-    "vitest": "^3.2.4"
-  }
-}

admin/public/manifest.webmanifest

@@ -1,14 +0,0 @@
-{
-  "name": "NestQuest Admin",
-  "short_name": "NestQuest",
-  "start_url": "/",
-  "scope": "/",
-  "display": "standalone",
-  "background_color": "#f4f4f6",
-  "theme_color": "#3b3ab8",
-  "icons": [
-    { "src": "/icons/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
-    { "src": "/icons/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
-    { "src": "/icons/icon-maskable-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
-  ]
-}

admin/public/sw.js

@@ -1,88 +0,0 @@
-/* NestQuest Admin service worker — hand-written, served from the site root.
-   Precaches the app shell, serves static assets cache-first, and falls back
-   to the cached shell for navigations when offline. Only same-origin GET
-   requests are handled; cross-origin requests (Authentik, the API host) are
-   never intercepted or cached.
-   The build (vite-sw-plugin.ts) replaces PRECACHE_ASSETS with the hashed
-   bundles referenced by index.html and the revision marker with a content
-   hash, so each release installs a new worker with fresh caches. */
-
-const REVISION = "__NQ_BUILD_REVISION__";
-const CACHE_PREFIX = "nestquest-admin-";
-const SHELL_CACHE = `${CACHE_PREFIX}shell-${REVISION}`;
-const RUNTIME_CACHE = `${CACHE_PREFIX}runtime-${REVISION}`;
-const CURRENT_CACHES = [SHELL_CACHE, RUNTIME_CACHE];
-
-const PRECACHE_ASSETS = [];
-
-const SHELL_URLS = [
-  ...new Set([
-    "/",
-    "/index.html",
-    "/manifest.webmanifest",
-    "/icons/icon-192.png",
-    "/icons/icon-512.png",
-    "/icons/icon-maskable-512.png",
-    ...PRECACHE_ASSETS,
-  ]),
-];
-
-// Request destinations treated as static assets (cache-first). Anything else
-// same-origin (e.g. API calls) goes straight to the network.
-const STATIC_DESTINATIONS = ["script", "style", "image", "font", "manifest"];
-
-self.addEventListener("install", (event) => {
-  event.waitUntil(
-    caches
-      .open(SHELL_CACHE)
-      .then((cache) => cache.addAll(SHELL_URLS))
-      .then(() => self.skipWaiting()),
-  );
-});
-
-self.addEventListener("activate", (event) => {
-  event.waitUntil(
-    caches
-      .keys()
-      .then((keys) =>
-        Promise.all(
-          keys
-            .filter((key) => key.startsWith(CACHE_PREFIX) && !CURRENT_CACHES.includes(key))
-            .map((key) => caches.delete(key)),
-        ),
-      )
-      .then(() => self.clients.claim()),
-  );
-});
-
-self.addEventListener("fetch", (event) => {
-  const request = event.request;
-  if (request.method !== "GET") return;
-  if (new URL(request.url).origin !== self.location.origin) return;
-
-  if (request.mode === "navigate") {
-    event.respondWith(
-      fetch(request).catch(() =>
-        caches.match("/index.html", { cacheName: SHELL_CACHE }).then(
-          (cached) => cached || Response.error(),
-        ),
-      ),
-    );
-    return;
-  }
-
-  if (STATIC_DESTINATIONS.includes(request.destination)) {
-    event.respondWith(cacheFirst(request));
-  }
-});
-
-async function cacheFirst(request) {
-  const cached = await caches.match(request);
-  if (cached) return cached;
-  const response = await fetch(request);
-  if (response.ok && response.type === "basic") {
-    const cache = await caches.open(RUNTIME_CACHE);
-    await cache.put(request, response.clone());
-  }
-  return response;
-}

admin/scripts/generate-icons.mjs

@@ -1,80 +0,0 @@
-// Generates the committed PWA icons under public/icons/ as genuine PNGs.
-// Pure Node (zlib only) — no network, no image dependencies.
-// Run: node scripts/generate-icons.mjs
-import { writeFileSync } from "node:fs";
-import { deflateSync } from "node:zlib";
-import { fileURLToPath } from "node:url";
-
-// Brand tokens (design/tokens/nestquest-admin-tokens.css).
-const BLUE = [0x3b, 0x3a, 0xb8];
-const PURPLE = [0xa0, 0x35, 0xcc];
-const WHITE = [0xff, 0xff, 0xff];
-
-const CRC_TABLE = Array.from({ length: 256 }, (_, n) => {
-  let c = n;
-  for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-  return c >>> 0;
-});
-
-function crc32(buf) {
-  let c = 0xffffffff;
-  for (const b of buf) c = CRC_TABLE[(c ^ b) & 0xff] ^ (c >>> 8);
-  return (c ^ 0xffffffff) >>> 0;
-}
-
-function chunk(type, data) {
-  const len = Buffer.alloc(4);
-  len.writeUInt32BE(data.length);
-  const body = Buffer.concat([Buffer.from(type, "ascii"), data]);
-  const crc = Buffer.alloc(4);
-  crc.writeUInt32BE(crc32(body));
-  return Buffer.concat([len, body, crc]);
-}
-
-function encodePng(size, pixel) {
-  const ihdr = Buffer.alloc(13);
-  ihdr.writeUInt32BE(size, 0);
-  ihdr.writeUInt32BE(size, 4);
-  ihdr[8] = 8; // bit depth
-  ihdr[9] = 2; // colour type: RGB
-  const raw = Buffer.alloc(size * (size * 3 + 1));
-  for (let y = 0; y < size; y++) {
-    const row = y * (size * 3 + 1);
-    raw[row] = 0; // filter: none
-    for (let x = 0; x < size; x++) raw.set(pixel(x, y), row + 1 + x * 3);
-  }
-  return Buffer.concat([
-    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-    chunk("IHDR", ihdr),
-    chunk("IDAT", deflateSync(raw, { level: 9 })),
-    chunk("IEND", Buffer.alloc(0)),
-  ]);
-}
-
-// Flat brand mark: diagonal blue→purple gradient with a white ring ("nest")
-// around a white dot ("quest"). `scale` shrinks the mark for the maskable
-// safe zone (inner 80% circle).
-function brandMark(size, scale) {
-  const c = size / 2;
-  const outer = size * 0.34 * scale;
-  const inner = size * 0.24 * scale;
-  const dot = size * 0.1 * scale;
-  return (x, y) => {
-    const d = Math.hypot(x + 0.5 - c, y + 0.5 - c);
-    if ((d <= outer && d >= inner) || d <= dot) return WHITE;
-    const t = (x + y) / (2 * (size - 1));
-    return BLUE.map((b, i) => Math.round(b + (PURPLE[i] - b) * t));
-  };
-}
-
-const outDir = new URL("../public/icons/", import.meta.url);
-const icons = [
-  ["icon-192.png", 192, 1],
-  ["icon-512.png", 512, 1],
-  ["icon-maskable-512.png", 512, 0.75],
-];
-for (const [name, size, scale] of icons) {
-  const path = fileURLToPath(new URL(name, outDir));
-  writeFileSync(path, encodePng(size, brandMark(size, scale)));
-  console.log(`wrote ${path}`);
-}

admin/src/App.css

@@ -1,117 +0,0 @@
-/* Shell layout — mobile-first (390x844 reference), plain CubeCraft styling. */
-
-.admin-shell {
-  display: flex;
-  flex-direction: column;
-  min-height: 100%;
-}
-
-.admin-header {
-  background: var(--nq-a-surface);
-  border-bottom: 1px solid var(--nq-a-border);
-  padding: 14px 16px;
-}
-
-.admin-title {
-  margin: 0;
-  font-size: 24px;
-  font-weight: 800;
-  letter-spacing: -0.02em;
-}
-
-.admin-subline {
-  margin: 2px 0 0;
-  font-size: 12px;
-  font-weight: 600;
-  color: var(--nq-a-ink-secondary);
-}
-
-.admin-panel {
-  flex: 1;
-  padding: 14px 16px 92px; /* bottom padding clears the 70px tab bar */
-}
-
-.admin-placeholder {
-  margin: 0;
-  padding: 13px;
-  background: var(--nq-a-surface);
-  border: 1px solid var(--nq-a-border);
-  border-radius: 8px;
-  font-size: 13.5px;
-  font-weight: 600;
-  color: var(--nq-a-ink-secondary);
-}
-
-.admin-tabbar {
-  position: fixed;
-  inset: auto 0 0;
-  display: flex;
-  min-height: calc(var(--nq-a-tabbar-height) + 12px);
-  padding: 8px 4px calc(12px + env(safe-area-inset-bottom));
-  background: var(--nq-a-surface);
-  border-top: 1px solid var(--nq-a-border);
-}
-
-.admin-tab {
-  flex: 1;
-  border: 0;
-  background: none;
-  font-family: inherit;
-  font-size: 12px;
-  font-weight: 600;
-  color: var(--nq-a-ink-secondary);
-  cursor: pointer;
-  padding: 6px 4px;
-}
-
-.admin-tab.active {
-  font-weight: 700;
-  color: var(--nq-brand-blue);
-}
-/* Auth screens (login, errors, refusal). */
-
-.admin-login,
-.admin-error,
-.admin-refusal,
-.admin-loading {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  gap: 10px;
-  min-height: 100%;
-  padding: 32px 16px;
-  text-align: center;
-}
-
-.admin-login-button {
-  margin-top: 8px;
-  padding: 12px 24px;
-  border: none;
-  border-radius: 8px;
-  background: var(--nq-a-accent, #2563eb);
-  color: #fff;
-  font-size: 15px;
-  font-weight: 700;
-  cursor: pointer;
-}
-
-.admin-error,
-.admin-refusal {
-  color: var(--nq-a-ink, inherit);
-}
-
-.admin-refusal h1,
-.admin-error h1 {
-  margin: 0;
-  font-size: 20px;
-}
-
-.admin-refusal p,
-.admin-error p {
-  margin: 0;
-  max-width: 34em;
-  font-size: 14px;
-  font-weight: 600;
-  color: var(--nq-a-ink-secondary);
-}

admin/src/App.test.tsx

@@ -1,33 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import { cleanup, fireEvent, render, screen } from "@testing-library/react";
-import App from "./App";
-
-describe("NestQuest Admin shell", () => {
-  afterEach(cleanup);
-
-  it("renders the title and all four tab labels", () => {
-    render(<App />);
-
-    expect(screen.getByRole("heading", { name: "NestQuest Admin" })).toBeTruthy();
-    for (const label of ["Today", "Tasks", "Schedule", "History"]) {
-      expect(screen.getByRole("tab", { name: label })).toBeTruthy();
-    }
-  });
-
-  it("starts on the Today placeholder and switches on tab click", () => {
-    render(<App />);
-
-    expect(screen.getByRole("tabpanel").textContent).toContain(
-      "Today placeholder",
-    );
-
-    fireEvent.click(screen.getByRole("tab", { name: "History" }));
-
-    expect(screen.getByRole("tabpanel").textContent).toContain(
-      "History placeholder",
-    );
-    expect(screen.getByRole("tab", { name: "History" }).getAttribute("aria-selected")).toBe(
-      "true",
-    );
-  });
-});

admin/src/App.tsx

@@ -1,49 +0,0 @@
-import { useState } from "react";
-import "./App.css";
-
-const TABS = [
-  { id: "today", label: "Today" },
-  { id: "tasks", label: "Tasks" },
-  { id: "schedule", label: "Schedule" },
-  { id: "history", label: "History" },
-] as const;
-
-type TabId = (typeof TABS)[number]["id"];
-
-export default function App() {
-  const [active, setActive] = useState<TabId>("today");
-
-  return (
-    <div className="admin-shell">
-      <header className="admin-header">
-        <h1 className="admin-title">NestQuest Admin</h1>
-        <p className="admin-subline">Admin console</p>
-      </header>
-      <main
-        className="admin-panel"
-        role="tabpanel"
-        aria-labelledby={`tab-${active}`}
-      >
-        <p className="admin-placeholder">
-          {TABS.find((tab) => tab.id === active)?.label} placeholder — screens
-          arrive in later tasks.
-        </p>
-      </main>
-      <nav className="admin-tabbar" aria-label="Admin sections">
-        {TABS.map((tab) => (
-          <button
-            key={tab.id}
-            id={`tab-${tab.id}`}
-            type="button"
-            role="tab"
-            aria-selected={tab.id === active}
-            className={tab.id === active ? "admin-tab active" : "admin-tab"}
-            onClick={() => setActive(tab.id)}
-          >
-            {tab.label}
-          </button>
-        ))}
-      </nav>
-    </div>
-  );
-}

admin/src/AppRoutes.test.tsx

@@ -1,73 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { cleanup, render, screen, waitFor } from "@testing-library/react";
-import AppRoutes from "./AppRoutes";
-import { storeTokens } from "./auth/oidc";
-import { config } from "./config";
-
-// The bundled config reads real env at import time; seed the shared module's
-// clientId directly so AppRoutes sees a configured app in these tests.
-(config as { clientId: string | undefined }).clientId = "test-client-id";
-
-function jsonResponse(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-describe("AppRoutes auth gating", () => {
-  afterEach(() => {
-    cleanup();
-    sessionStorage.clear();
-    vi.restoreAllMocks();
-    vi.unstubAllGlobals();
-    window.history.replaceState({}, "", "/");
-  });
-
-  it("renders the login screen when unauthenticated at /", () => {
-    render(<AppRoutes />);
-    expect(screen.getByTestId("login-screen")).toBeTruthy();
-    expect(
-      screen.getByRole("button", { name: /sign in with authentik/i }),
-    ).toBeTruthy();
-  });
-
-  it("renders the four-tab shell after a successful authenticated probe", async () => {
-    storeTokens({ access_token: "at-123", expires_in: 600 });
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse([]));
-    vi.stubGlobal("fetch", fetchMock);
-
-    render(<AppRoutes />);
-
-    await waitFor(() => {
-      expect(screen.getByRole("heading", { name: "NestQuest Admin" })).toBeTruthy();
-    });
-    for (const label of ["Today", "Tasks", "Schedule", "History"]) {
-      expect(screen.getByRole("tab", { name: label })).toBeTruthy();
-    }
-  });
-
-  it("renders the explicit refusal when the API answers 403", async () => {
-    storeTokens({ access_token: "at-123", expires_in: 600 });
-    const fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 403 }));
-    vi.stubGlobal("fetch", fetchMock);
-
-    render(<AppRoutes />);
-
-    await waitFor(() => {
-      expect(screen.getByTestId("refusal-screen")).toBeTruthy();
-    });
-    expect(screen.getByText(/not in the nestquest-admins group/i)).toBeTruthy();
-  });
-
-  it("shows the configuration error screen when the client id is missing", () => {
-    const original = config.clientId;
-    (config as { clientId: string | undefined }).clientId = undefined;
-    try {
-      render(<AppRoutes />);
-      expect(screen.getByTestId("config-error-screen")).toBeTruthy();
-    } finally {
-      (config as { clientId: string | undefined }).clientId = original;
-    }
-  });
-});

admin/src/AppRoutes.tsx

@@ -1,176 +0,0 @@
-/**
- * Minimal path-based routing without react-router-dom: the app only needs two
- * paths (`/` shell and `/auth/callback`), so a tiny window.location switch is
- * enough and keeps the bundle small. Change screens listen to popstate.
- */
-import { useEffect, useState } from "react";
-import { ConfigError, config } from "./config";
-import {
-  AuthError,
-  buildAuthorizeUrl,
-  clearAuth,
-  handleCallback,
-  isAuthenticated,
-} from "./auth/oidc";
-import { ApiForbiddenError, apiFetch } from "./api/client";
-import AdminShell from "./App";
-
-type Screen =
-  | { kind: "loading" }
-  | { kind: "login" }
-  | { kind: "config-error"; message: string }
-  | { kind: "auth-error"; message: string }
-  | { kind: "refusal"; message: string }
-  | { kind: "app" };
-
-function currentPath(): string {
-  return window.location.pathname.replace(/\/+$/, "") || "/";
-}
-
-async function probeApi(setScreen: (screen: Screen) => void) {
-  // A cheap authenticated probe so a 403 surfaces as an explicit refusal
-  // right after login instead of a silent empty shell.
-  try {
-    await apiFetch("/api/v1/children", {}, config);
-    setScreen({ kind: "app" });
-  } catch (error) {
-    if (error instanceof ConfigError) {
-      setScreen({ kind: "config-error", message: error.message });
-      return;
-    }
-    if (error instanceof ApiForbiddenError) {
-      setScreen({ kind: "refusal", message: error.message });
-      return;
-    }
-    // Network or other failures still allow the shell to render; API screens
-    // handle their own errors in later tasks.
-    setScreen({ kind: "app" });
-  }
-}
-
-function LoginScreen({ onLogin }: { onLogin: () => void }) {
-  return (
-    <div className="admin-login" data-testid="login-screen">
-      <h1 className="admin-title">NestQuest Admin</h1>
-      <p className="admin-subline">Sign in to continue</p>
-      <button type="button" className="admin-login-button" onClick={onLogin}>
-        Sign in with Authentik
-      </button>
-    </div>
-  );
-}
-
-export default function AppRoutes() {
-  const [screen, setScreen] = useState<Screen>({ kind: "loading" });
-
-  useEffect(() => {
-    // Re-evaluate on navigation (popstate) — routing is path based.
-    const onPop = () => setScreen({ kind: "loading" });
-    window.addEventListener("popstate", onPop);
-    return () => window.removeEventListener("popstate", onPop);
-  }, []);
-
-  useEffect(() => {
-    let cancelled = false;
-    const path = currentPath();
-
-    if (!config.clientId) {
-      setScreen({
-        kind: "config-error",
-        message:
-          "Missing VITE_AUTHENTIK_CLIENT_ID configuration. Set it in your .env before building the admin PWA.",
-      });
-      return;
-    }
-
-    if (path === "/auth/callback") {
-      (async () => {
-        try {
-          await handleCallback(window.location.search, config);
-          if (cancelled) return;
-          window.history.replaceState({}, "", "/");
-          await probeApi((next) => !cancelled && setScreen(next));
-        } catch (error) {
-          if (cancelled) return;
-          const message =
-            error instanceof AuthError || error instanceof Error
-              ? error.message
-              : "Authentication failed.";
-          setScreen({ kind: "auth-error", message });
-        }
-      })();
-      return () => {
-        cancelled = true;
-      };
-    }
-
-    if (isAuthenticated()) {
-      void probeApi((next) => !cancelled && setScreen(next));
-    } else {
-      setScreen({ kind: "login" });
-    }
-    return () => {
-      cancelled = true;
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  const startLogin = async () => {
-    try {
-      const url = await buildAuthorizeUrl(config);
-      window.location.assign(url);
-    } catch (error) {
-      setScreen({
-        kind: "config-error",
-        message: error instanceof Error ? error.message : "Login failed.",
-      });
-    }
-  };
-
-  switch (screen.kind) {
-    case "loading":
-      return (
-        <div className="admin-loading" role="status" data-testid="loading-screen">
-          Loading…
-        </div>
-      );
-    case "login":
-      return <LoginScreen onLogin={startLogin} />;
-    case "config-error":
-      return (
-        <div className="admin-error" role="alert" data-testid="config-error-screen">
-          <h1>Configuration error</h1>
-          <p>{screen.message}</p>
-        </div>
-      );
-    case "auth-error":
-      return (
-        <div className="admin-error" role="alert" data-testid="auth-error-screen">
-          <h1>Sign-in failed</h1>
-          <p>{screen.message}</p>
-          <button
-            type="button"
-            onClick={() => {
-              clearAuth();
-              window.history.replaceState({}, "", "/");
-              setScreen({ kind: "loading" });
-            }}
-          >
-            Try again
-          </button>
-        </div>
-      );
-    case "refusal":
-      return (
-        <div className="admin-refusal" role="alert" data-testid="refusal-screen">
-          <h1>Access refused</h1>
-          <p>{screen.message}</p>
-          <button type="button" onClick={() => { clearAuth(); window.history.replaceState({}, "", "/"); setScreen({ kind: "login" }); }}>
-            Sign out
-          </button>
-        </div>
-      );
-    case "app":
-      return <AdminShell />;
-  }
-}

admin/src/api/client.test.ts

@@ -1,94 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import {
-  ApiForbiddenError,
-  ApiUnauthorizedError,
-  apiFetch,
-} from "./client";
-import { storeTokens } from "../auth/oidc";
-import type { AppConfig } from "../config";
-
-const app: AppConfig = {
-  issuer: "https://auth.example.com/application/o/nestquest",
-  clientId: "test-client-id",
-  apiBaseUrl: "https://api.example.com",
-  authorizeEndpoint: "https://auth.example.com/application/o/authorize/",
-  tokenEndpoint: "https://auth.example.com/application/o/token/",
-  userinfoEndpoint: "https://auth.example.com/application/o/userinfo/",
-  endSessionEndpoint: "https://auth.example.com/application/o/nestquest/end-session/",
-  redirectUri: "http://localhost:5173/auth/callback",
-};
-
-function jsonResponse(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-describe("API client", () => {
-  beforeEach(() => {
-    sessionStorage.clear();
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-    vi.unstubAllGlobals();
-  });
-
-  it("attaches the Bearer token to API calls", async () => {
-    storeTokens({ access_token: "at-123", expires_in: 600 });
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse([]));
-
-    await apiFetch("/api/v1/children", {}, app, fetchMock as any);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe("https://api.example.com/api/v1/children");
-    expect(init.headers.Authorization).toBe("Bearer at-123");
-  });
-
-  it("throws ApiForbiddenError on 403 (authenticated but refused)", async () => {
-    storeTokens({ access_token: "at-123", expires_in: 600 });
-    const fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 403 }));
-
-    await expect(
-      apiFetch("/api/v1/children", {}, app, fetchMock as any),
-    ).rejects.toBeInstanceOf(ApiForbiddenError);
-  });
-
-  it("triggers a login redirect on 401 with no refresh token", async () => {
-    storeTokens({ access_token: "stale", expires_in: 600 });
-    const assign = vi.fn();
-    vi.stubGlobal("location", { ...window.location, assign });
-    const fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 401 }));
-
-    await expect(
-      apiFetch("/api/v1/children", {}, app, fetchMock as any),
-    ).rejects.toBeInstanceOf(ApiUnauthorizedError);
-    expect(assign).toHaveBeenCalledTimes(1);
-    const url = new URL(assign.mock.calls[0][0] as string);
-    expect(url.origin + url.pathname).toBe(
-      "https://auth.example.com/application/o/authorize/",
-    );
-    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
-  });
-
-  it("preserves non-401/403 statuses on the post-refresh retry (500 is not mislabeled)", async () => {
-    storeTokens({ access_token: "stale", refresh_token: "rt-1", expires_in: 600 });
-    const fetchMock = vi
-      .fn()
-      .mockResolvedValueOnce(new Response("", { status: 401 })) // initial API call
-      .mockResolvedValueOnce(
-        jsonResponse({ access_token: "fresh", expires_in: 600 }), // refresh grant
-      )
-      .mockResolvedValueOnce(new Response("", { status: 500 })); // retry
-
-    const response = await apiFetch("/api/v1/children", {}, app, fetchMock as any);
-
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-    expect(fetchMock.mock.calls[1][0]).toBe(app.tokenEndpoint);
-    expect(fetchMock.mock.calls[2][1].headers.Authorization).toBe("Bearer fresh");
-    // A server failure must surface as the real status, not ApiUnauthorizedError.
-    expect(response.status).toBe(500);
-  });
-});

admin/src/api/client.ts

@@ -1,93 +0,0 @@
-/**
- * Minimal fetch wrapper for the NestQuest API.
- *
- * - Attaches `Authorization: Bearer <access_token>` when a token is stored.
- * - 401: not authenticated (or token expired) -> trigger a new login.
- * - 403: authenticated but refused -> throws ApiForbiddenError so the UI can
- *   render an explicit refusal message.
- */
-import { config, type AppConfig } from "../config";
-import {
-  buildAuthorizeUrl,
-  getToken,
-  isExpired,
-  refreshAccessToken,
-} from "../auth/oidc";
-
-export class ApiForbiddenError extends Error {
-  constructor(message = "Your account is not in the nestquest-admins group.") {
-    super(message);
-    this.name = "ApiForbiddenError";
-  }
-}
-
-export class ApiUnauthorizedError extends Error {
-  constructor(message = "Not authenticated.") {
-    super(message);
-    this.name = "ApiUnauthorizedError";
-  }
-}
-
-export interface ApiRequestOptions extends Omit<RequestInit, "headers"> {
-  headers?: Record<string, string>;
-}
-
-/**
- * Redirect the browser to Authentik to start a new login.
- * Exported for testing injection.
- */
-export async function triggerLogin(app: AppConfig = config): Promise<void> {
-  const url = await buildAuthorizeUrl(app);
-  window.location.assign(url);
-}
-
-export async function apiFetch(
-  path: string,
-  options: ApiRequestOptions = {},
-  app: AppConfig = config,
-  fetchImpl: typeof fetch = fetch,
-): Promise<Response> {
-  if (isExpired() && (await refreshAccessToken(app, fetchImpl))) {
-    // token renewed; fall through and use the fresh one
-  }
-
-  const token = getToken();
-  const headers = {
-    ...(options.headers ?? {}),
-    ...(token ? { Authorization: `Bearer ${token}` } : {}),
-  };
-
-  const response = await fetchImpl(`${app.apiBaseUrl}${path}`, {
-    ...options,
-    headers,
-  });
-
-  if (response.status === 401) {
-    // Not authenticated: either no token or an unusable one.
-    if (await refreshAccessToken(app, fetchImpl)) {
-      const retryToken = getToken();
-      const retryResponse = await fetchImpl(`${app.apiBaseUrl}${path}`, {
-        ...options,
-        headers: {
-          ...(options.headers ?? {}),
-          ...(retryToken ? { Authorization: `Bearer ${retryToken}` } : {}),
-        },
-      });
-      if (retryResponse.status === 403) throw new ApiForbiddenError();
-      if (retryResponse.ok) return retryResponse;
-      // Only 401 means "unauthorized"; preserve every other status (e.g. a
-      // 500 from the API) so callers can react to the real response.
-      if (retryResponse.status === 401) throw new ApiUnauthorizedError();
-      return retryResponse;
-    }
-    await triggerLogin(app);
-    throw new ApiUnauthorizedError();
-  }
-
-  if (response.status === 403) {
-    // Authenticated, but Authentik's token does not belong to nestquest-admins.
-    throw new ApiForbiddenError();
-  }
-
-  return response;
-}

admin/src/auth/oidc.test.ts

@@ -1,173 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import {
-  buildAuthorizeUrl,
-  clearAuth,
-  getToken,
-  handleCallback,
-  logout,
-  storeTokens,
-} from "./oidc";
-import type { AppConfig } from "../config";
-
-function testApp(): AppConfig {
-  return {
-    issuer: "https://auth.example.com/application/o/nestquest",
-    clientId: "test-client-id",
-    apiBaseUrl: "https://api.example.com",
-    authorizeEndpoint: "https://auth.example.com/application/o/authorize/",
-    tokenEndpoint: "https://auth.example.com/application/o/token/",
-    userinfoEndpoint: "https://auth.example.com/application/o/userinfo/",
-    endSessionEndpoint: "https://auth.example.com/application/o/nestquest/end-session/",
-    redirectUri: "http://localhost:5173/auth/callback",
-  };
-}
-
-function jsonResponse(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-describe("OIDC flow", () => {
-  beforeEach(() => {
-    sessionStorage.clear();
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it("buildAuthorizeUrl carries all required params and stores state/verifier", async () => {
-    const app = testApp();
-    const url = new URL(await buildAuthorizeUrl(app));
-
-    expect(url.origin + url.pathname).toBe(app.authorizeEndpoint);
-    expect(url.searchParams.get("response_type")).toBe("code");
-    expect(url.searchParams.get("client_id")).toBe("test-client-id");
-    expect(url.searchParams.get("redirect_uri")).toBe(app.redirectUri);
-    expect(url.searchParams.get("scope")).toBe("openid email profile");
-    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
-    expect(url.searchParams.get("code_challenge")).toMatch(/^[A-Za-z0-9_-]{43}$/);
-    expect(url.searchParams.get("state")).toMatch(/^[A-Za-z0-9_-]+$/);
-
-    expect(sessionStorage.getItem("nestquest.oidc_state")).toBe(
-      url.searchParams.get("state"),
-    );
-    expect(sessionStorage.getItem("nestquest.code_verifier")).toMatch(/^[A-Za-z0-9-._~]{43,128}$/);
-  });
-
-  it("handleCallback rejects a mismatched state", async () => {
-    await buildAuthorizeUrl(testApp());
-    sessionStorage.setItem("nestquest.oidc_state", "different-state");
-
-    const fetchMock = vi.fn();
-    await expect(
-      handleCallback("?code=abc&state=tampered", testApp(), fetchMock as any),
-    ).rejects.toThrow(/state mismatch/i);
-    expect(fetchMock).not.toHaveBeenCalled();
-    expect(getToken()).toBeUndefined();
-  });
-
-  it("handleCallback exchanges the code with the correct form body and stores the token", async () => {
-    await buildAuthorizeUrl(testApp());
-    const verifier = sessionStorage.getItem("nestquest.code_verifier")!;
-    const state = sessionStorage.getItem("nestquest.oidc_state")!;
-
-    const fetchMock = vi.fn().mockResolvedValue(
-      jsonResponse({
-        access_token: "at-123",
-        refresh_token: "rt-456",
-        id_token: "id-789",
-        expires_in: 300,
-      }),
-    );
-    await handleCallback(`?code=abc&state=${state}`, testApp(), fetchMock as any);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe("https://auth.example.com/application/o/token/");
-    expect(init.method).toBe("POST");
-    expect(init.headers["Content-Type"]).toBe("application/x-www-form-urlencoded");
-
-    const body = new URLSearchParams(init.body);
-    expect(body.get("grant_type")).toBe("authorization_code");
-    expect(body.get("code")).toBe("abc");
-    expect(body.get("redirect_uri")).toBe(testApp().redirectUri);
-    expect(body.get("client_id")).toBe("test-client-id");
-    expect(body.get("code_verifier")).toBe(verifier);
-    expect(body.has("client_secret")).toBe(false);
-
-    expect(getToken()).toBe("at-123");
-    // one-time values consumed
-    expect(sessionStorage.getItem("nestquest.oidc_state")).toBeNull();
-    expect(sessionStorage.getItem("nestquest.code_verifier")).toBeNull();
-  });
-
-  it("handleCallback surfaces provider errors", async () => {
-    await expect(
-      handleCallback("?error=access_denied&error_description=nope", testApp(), vi.fn() as any),
-    ).rejects.toThrow(/nope|access_denied/);
-  });
-
-  it("clearAuth removes all stored auth data", () => {
-    storeTokens({ access_token: "a", refresh_token: "r", expires_in: 60 });
-    clearAuth();
-    expect(getToken()).toBeUndefined();
-    expect(sessionStorage.length).toBe(0);
-  });
-
-  it("logout clears auth and redirects to the end-session endpoint", async () => {
-    storeTokens({ access_token: "a", id_token: "idt", expires_in: 60 });
-    const assign = vi.fn();
-    const original = window.location;
-    vi.stubGlobal("location", { ...original, assign, origin: "http://localhost:5173" });
-
-    await logout(testApp());
-
-    expect(assign).toHaveBeenCalledTimes(1);
-    const url = new URL(assign.mock.calls[0][0] as string);
-    expect(url.toString()).toBe(
-      "https://auth.example.com/application/o/nestquest/end-session/?id_token_hint=idt&client_id=test-client-id&post_logout_redirect_uri=http%3A%2F%2Flocalhost%3A5173",
-    );
-    expect(getToken()).toBeUndefined();
-    vi.unstubAllGlobals();
-  });
-
-  it("buildAuthorizeUrl resolves the authorize endpoint via discovery for a non-default issuer", async () => {
-    const issuer = "https://sso.discovery.example/application/o/discovered";
-    const discoveryDoc = {
-      issuer,
-      authorization_endpoint: "https://sso.discovery.example/application/o/authorize/",
-      token_endpoint: "https://sso.discovery.example/application/o/token/",
-      userinfo_endpoint: "https://sso.discovery.example/application/o/userinfo/",
-      end_session_endpoint: `${issuer}/end-session/`,
-      jwks_uri: `${issuer}/jwks/`,
-    };
-    const fetchMock = vi.fn().mockImplementation((url: string) =>
-      Promise.resolve(
-        String(url).endsWith("/.well-known/openid-configuration")
-          ? jsonResponse(discoveryDoc)
-          : jsonResponse({}),
-      ),
-    );
-    const app: AppConfig = {
-      issuer,
-      clientId: "test-client-id",
-      apiBaseUrl: "https://api.example.com",
-      redirectUri: "http://localhost:5173/auth/callback",
-    };
-
-    const url = new URL(await buildAuthorizeUrl(app, fetchMock as any));
-
-    // The authorize endpoint comes from the discovery document — Authentik
-    // serves it outside the app-specific issuer path, so it is NOT
-    // `${issuer}/authorize/` and must never be a hardcoded production host.
-    expect(url.origin + url.pathname).toBe(discoveryDoc.authorization_endpoint);
-    expect(url.searchParams.get("client_id")).toBe("test-client-id");
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(String(fetchMock.mock.calls[0][0])).toBe(
-      `${issuer}/.well-known/openid-configuration`,
-    );
-  });
-});

admin/src/auth/oidc.ts

@@ -1,225 +0,0 @@
-/**
- * OIDC authorization-code + PKCE flow for a PUBLIC client.
- *
- * Never sends a client_secret anywhere. Tokens are stored in sessionStorage
- * (per-tab, cleared on tab close) — never localStorage.
- */
-import { config, resolveEndpoints, type AppConfig, type ResolvedAppConfig } from "../config";
-import {
-  computeCodeChallenge,
-  generateCodeVerifier,
-  generateState,
-} from "./pkce";
-
-const STORAGE_KEYS = {
-  accessToken: "nestquest.access_token",
-  refreshToken: "nestquest.refresh_token",
-  expiresAt: "nestquest.expires_at",
-  idToken: "nestquest.id_token",
-  state: "nestquest.oidc_state",
-  codeVerifier: "nestquest.code_verifier",
-} as const;
-
-export class AuthError extends Error {}
-
-export interface TokenResponse {
-  access_token?: string;
-  refresh_token?: string;
-  id_token?: string;
-  expires_in?: number;
-  token_type?: string;
-}
-
-function makeScopes(): string {
-  return "openid email profile";
-}
-
-/**
- * Build the Authentik authorization redirect URL, storing state + verifier in
- * sessionStorage so the callback can validate them. Endpoints are resolved
- * from the issuer's OIDC discovery document when not set on the config.
- */
-export async function buildAuthorizeUrl(
-  app: AppConfig = config,
-  fetchImpl: typeof fetch = fetch,
-): Promise<string> {
-  if (!app.clientId) {
-    throw new AuthError(
-      "Missing VITE_AUTHENTIK_CLIENT_ID configuration. Set it in your .env before building the admin PWA.",
-    );
-  }
-  const resolved = await resolveEndpoints(app, fetchImpl);
-  const state = generateState();
-  const codeVerifier = generateCodeVerifier();
-  const codeChallenge = await computeCodeChallenge(codeVerifier);
-
-  sessionStorage.setItem(STORAGE_KEYS.state, state);
-  sessionStorage.setItem(STORAGE_KEYS.codeVerifier, codeVerifier);
-
-  const url = new URL(resolved.authorizeEndpoint);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", app.clientId);
-  url.searchParams.set("redirect_uri", app.redirectUri);
-  url.searchParams.set("scope", makeScopes());
-  url.searchParams.set("state", state);
-  url.searchParams.set("code_challenge", codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url.toString();
-}
-
-/**
- * Handle the OAuth callback: validate state, exchange the code at the token
- * endpoint (PKCE, form-urlencoded, no client_secret), store tokens.
- */
-export async function handleCallback(
-  query: URLSearchParams | string = window.location.search,
-  app: AppConfig = config,
-  fetchImpl: typeof fetch = fetch,
-): Promise<void> {
-  const params =
-    typeof query === "string" ? new URLSearchParams(query) : query;
-
-  const providerError = params.get("error");
-  if (providerError) {
-    throw new AuthError(
-      params.get("error_description") || `Provider returned error: ${providerError}`,
-    );
-  }
-
-  const code = params.get("code");
-  const state = params.get("state");
-  if (!code || !state) {
-    throw new AuthError("Callback is missing the code or state parameter.");
-  }
-
-  const storedState = sessionStorage.getItem(STORAGE_KEYS.state);
-  const codeVerifier = sessionStorage.getItem(STORAGE_KEYS.codeVerifier);
-  if (!storedState || storedState !== state || !codeVerifier) {
-    throw new AuthError("State mismatch — possible CSRF; refusing to log in.");
-  }
-
-  if (!app.clientId) {
-    throw new AuthError(
-      "Missing VITE_AUTHENTIK_CLIENT_ID configuration. Set it in your .env before building the admin PWA.",
-    );
-  }
-
-  const resolved: ResolvedAppConfig = await resolveEndpoints(app, fetchImpl);
-
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: app.redirectUri,
-    client_id: app.clientId,
-    code_verifier: codeVerifier,
-  });
-
-  const response = await fetchImpl(resolved.tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString(),
-  });
-  if (!response.ok) {
-    throw new AuthError(`Token exchange failed with HTTP ${response.status}`);
-  }
-  const tokens = (await response.json()) as TokenResponse;
-  if (!tokens.access_token) {
-    throw new AuthError("Token response did not include an access token.");
-  }
-
-  storeTokens(tokens);
-  // One-time use values are consumed on success.
-  sessionStorage.removeItem(STORAGE_KEYS.state);
-  sessionStorage.removeItem(STORAGE_KEYS.codeVerifier);
-}
-
-export function storeTokens(tokens: TokenResponse): void {
-  sessionStorage.setItem(STORAGE_KEYS.accessToken, tokens.access_token!);
-  if (tokens.refresh_token) {
-    sessionStorage.setItem(STORAGE_KEYS.refreshToken, tokens.refresh_token);
-  }
-  if (tokens.id_token) {
-    sessionStorage.setItem(STORAGE_KEYS.idToken, tokens.id_token);
-  }
-  if (typeof tokens.expires_in === "number") {
-    sessionStorage.setItem(
-      STORAGE_KEYS.expiresAt,
-      String(Date.now() + tokens.expires_in * 1000),
-    );
-  }
-}
-
-export function getToken(): string | undefined {
-  return sessionStorage.getItem(STORAGE_KEYS.accessToken) ?? undefined;
-}
-
-export function getRefreshToken(): string | undefined {
-  return sessionStorage.getItem(STORAGE_KEYS.refreshToken) ?? undefined;
-}
-
-export function getIdToken(): string | undefined {
-  return sessionStorage.getItem(STORAGE_KEYS.idToken) ?? undefined;
-}
-
-export function isAuthenticated(): boolean {
-  return Boolean(getToken());
-}
-
-/** True once the stored access token has passed its (approximate) expiry. */
-export function isExpired(): boolean {
-  const expiresAt = sessionStorage.getItem(STORAGE_KEYS.expiresAt);
-  if (!expiresAt) return false;
-  return Date.now() >= Number(expiresAt);
-}
-
-/**
- * Refresh the access token with the refresh token grant. Returns false when
- * no refresh token is stored or the grant fails (caller should re-login).
- */
-export async function refreshAccessToken(
-  app: AppConfig = config,
-  fetchImpl: typeof fetch = fetch,
-): Promise<boolean> {
-  const refreshToken = getRefreshToken();
-  if (!refreshToken || !app.clientId) return false;
-
-  const resolved = await resolveEndpoints(app, fetchImpl);
-
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: refreshToken,
-    client_id: app.clientId,
-  });
-
-  const response = await fetchImpl(resolved.tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: body.toString(),
-  });
-  if (!response.ok) return false;
-  const tokens = (await response.json()) as TokenResponse;
-  if (!tokens.access_token) return false;
-  storeTokens(tokens);
-  return true;
-}
-
-export function clearAuth(): void {
-  for (const key of Object.values(STORAGE_KEYS)) {
-    sessionStorage.removeItem(key);
-  }
-}
-
-/** Sign out: clear local auth, then send the browser to the end-session endpoint. */
-export async function logout(
-  app: AppConfig = config,
-  fetchImpl: typeof fetch = fetch,
-): Promise<void> {
-  const resolved = await resolveEndpoints(app, fetchImpl);
-  const idTokenHint = getIdToken();
-  clearAuth();
-  const params = new URLSearchParams();
-  if (idTokenHint) params.set("id_token_hint", idTokenHint);
-  if (app.clientId) params.set("client_id", app.clientId);
-  params.set("post_logout_redirect_uri", window.location.origin);
-  window.location.assign(`${resolved.endSessionEndpoint}?${params.toString()}`);
-}

admin/src/auth/pkce.test.ts

@@ -1,41 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import {
-  base64UrlEncode,
-  computeCodeChallenge,
-  generateCodeVerifier,
-  generateState,
-  isLikelyValidVerifier,
-} from "./pkce";
-
-describe("PKCE helpers", () => {
-  it("base64UrlEncode has no padding and url-safe characters", () => {
-    // bytes chosen to force "+" and "/" and padding in plain base64
-    const bytes = new Uint8Array([0xfb, 0xff, 0xbf, 0xff]);
-    const encoded = base64UrlEncode(bytes);
-    expect(encoded).not.toMatch(/[+/=]/);
-  });
-
-  it("computes the RFC 7636 appendix-B S256 vector", async () => {
-    const verifier =
-      "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
-    const challenge = await computeCodeChallenge(verifier);
-    expect(challenge).toBe("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
-  });
-
-  it("generates verifiers with valid charset and length", () => {
-    for (let i = 0; i < 20; i++) {
-      const verifier = generateCodeVerifier();
-      expect(isLikelyValidVerifier(verifier)).toBe(true);
-    }
-  });
-
-  it("rejects verifiers outside 43-128 chars or with reserved chars", () => {
-    expect(isLikelyValidVerifier("short")).toBe(false);
-    expect(isLikelyValidVerifier("a".repeat(129))).toBe(false);
-    expect(isLikelyValidVerifier("a".repeat(43) + "+")).toBe(false);
-  });
-
-  it("generates distinct random states", () => {
-    expect(generateState()).not.toBe(generateState());
-  });
-});

admin/src/auth/pkce.ts

@@ -1,55 +0,0 @@
-/**
- * PKCE (RFC 7636) helpers for a public SPA client.
- *
- * Uses the Web Crypto API, which requires a SECURE CONTEXT: the app must be
- * served over https or http://localhost, otherwise crypto.subtle is
- * unavailable and login cannot work.
- */
-
-const VERIFIER_CHARSET =
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
-
-/** base64url-encode bytes with NO padding. */
-export function base64UrlEncode(bytes: Uint8Array): string {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-function randomBase64Url(byteLength: number): string {
-  const bytes = new Uint8Array(byteLength);
-  crypto.getRandomValues(bytes);
-  return base64UrlEncode(bytes);
-}
-
-/**
- * Random code_verifier: 43-128 chars, unreserved charset only.
- * 32 random bytes -> 43 base64url chars, which is the minimum allowed length.
- */
-export function generateCodeVerifier(): string {
-  return randomBase64Url(32);
-}
-
-/** S256 code_challenge = base64url(SHA-256(verifier)), no padding. */
-export async function computeCodeChallenge(verifier: string): Promise<string> {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(verifier),
-  );
-  return base64UrlEncode(new Uint8Array(digest));
-}
-
-/** Random opaque state value for CSRF protection. */
-export function generateState(): string {
-  return randomBase64Url(16);
-}
-
-export function isLikelyValidVerifier(verifier: string): boolean {
-  return (
-    verifier.length >= 43 &&
-    verifier.length <= 128 &&
-    [...verifier].every((char) => VERIFIER_CHARSET.includes(char))
-  );
-}

admin/src/config.test.ts

@@ -1,215 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-  ConfigError,
-  discoveryUrlForIssuer,
-  readConfig,
-  resolveEndpoints,
-  resolveEndpointsFromDiscovery,
-  type AppConfig,
-} from "./config";
-
-function jsonResponse(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-// Mirrors Authentik's layout: authorize/token/userinfo live OUTSIDE the
-// application-specific issuer path, end-session/jwks under it.
-function discoveryDocument(issuer: string) {
-  const normalized = issuer.replace(/\/+$/, "");
-  const origin = new URL(normalized).origin;
-  return {
-    issuer,
-    authorization_endpoint: `${origin}/application/o/authorize/`,
-    token_endpoint: `${origin}/application/o/token/`,
-    userinfo_endpoint: `${origin}/application/o/userinfo/`,
-    end_session_endpoint: `${normalized}/end-session/`,
-    jwks_uri: `${normalized}/jwks/`,
-  };
-}
-
-describe("config", () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it("readConfig keeps the production issuer as the default", () => {
-    const cfg = readConfig({});
-    expect(cfg.issuer).toBe("https://auth.cubecraftlabs.com/application/o/nestquest");
-    expect(cfg.clientId).toBeUndefined();
-  });
-
-  it("readConfig normalizes a trailing slash off a custom issuer", () => {
-    expect(
-      readConfig({ VITE_AUTHENTIK_ISSUER: "https://sso.custom.example/application/o/custom/" })
-        .issuer,
-    ).toBe("https://sso.custom.example/application/o/custom");
-  });
-
-  it("readConfig hardcodes no OIDC endpoints — they come from discovery", () => {
-    const cfg = readConfig({});
-    expect(cfg.authorizeEndpoint).toBeUndefined();
-    expect(cfg.tokenEndpoint).toBeUndefined();
-    expect(cfg.userinfoEndpoint).toBeUndefined();
-    expect(cfg.endSessionEndpoint).toBeUndefined();
-    expect(cfg.jwksUri).toBeUndefined();
-  });
-
-  it("builds the discovery URL for issuers with and without a trailing slash", () => {
-    expect(discoveryUrlForIssuer("https://sso.example.com/application/o/app/")).toBe(
-      "https://sso.example.com/application/o/app/.well-known/openid-configuration",
-    );
-    expect(discoveryUrlForIssuer("https://sso.example.com/application/o/app")).toBe(
-      "https://sso.example.com/application/o/app/.well-known/openid-configuration",
-    );
-  });
-
-  it("resolves every endpoint from the discovery document of a non-default issuer", async () => {
-    const issuer = "https://sso.other-host.example/application/o/other-app";
-    const doc = discoveryDocument(issuer);
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(doc));
-    const app: AppConfig = {
-      issuer,
-      clientId: "client-id",
-      apiBaseUrl: "https://api.example.com",
-      redirectUri: "http://localhost:5173/auth/callback",
-    };
-
-    const resolved = await resolveEndpoints(app, fetchMock as unknown as typeof fetch);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(fetchMock).toHaveBeenCalledWith(
-      "https://sso.other-host.example/application/o/other-app/.well-known/openid-configuration",
-    );
-    // Every endpoint comes verbatim from the (non-default) discovery document.
-    expect(resolved.authorizeEndpoint).toBe(doc.authorization_endpoint);
-    expect(resolved.tokenEndpoint).toBe(doc.token_endpoint);
-    expect(resolved.userinfoEndpoint).toBe(doc.userinfo_endpoint);
-    expect(resolved.endSessionEndpoint).toBe(doc.end_session_endpoint);
-    expect(resolved.jwksUri).toBe(doc.jwks_uri);
-    // Proves no hardcoded production host leaked into the resolved endpoints.
-    for (const endpoint of [
-      resolved.authorizeEndpoint,
-      resolved.tokenEndpoint,
-      resolved.userinfoEndpoint,
-      resolved.endSessionEndpoint,
-      resolved.jwksUri,
-    ]) {
-      expect(endpoint).not.toMatch(/cubecraftlabs/);
-    }
-  });
-
-  it("resolves discovery for an issuer configured with a trailing slash", async () => {
-    const issuer = "https://sso.slashy.example/application/o/slashy/";
-    const doc = discoveryDocument(issuer);
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(doc));
-
-    const resolved = await resolveEndpointsFromDiscovery(issuer, fetchMock as any);
-
-    expect(fetchMock).toHaveBeenCalledWith(
-      "https://sso.slashy.example/application/o/slashy/.well-known/openid-configuration",
-    );
-    expect(resolved.authorizeEndpoint).toBe(doc.authorization_endpoint);
-    expect(resolved.endSessionEndpoint).toBe(doc.end_session_endpoint);
-  });
-
-  it("caches discovery per issuer for the session", async () => {
-    const issuer = "https://sso.cached.example/application/o/cached";
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(discoveryDocument(issuer)));
-
-    const first = await resolveEndpointsFromDiscovery(issuer, fetchMock as any);
-    const second = await resolveEndpointsFromDiscovery(issuer, fetchMock as any);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(second).toBe(first);
-  });
-
-  it("surfaces a clear configuration error when discovery returns an HTTP error", async () => {
-    const issuer = "https://sso.http-error.example/application/o/broken";
-    const fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 500 }));
-
-    const error = await resolveEndpointsFromDiscovery(issuer, fetchMock as any).then(
-      () => null,
-      (error: unknown) => error,
-    );
-
-    expect(error).toBeInstanceOf(ConfigError);
-    expect((error as Error).message).toContain(issuer);
-    expect((error as Error).message).toContain("HTTP 500");
-  });
-
-  it("surfaces a clear configuration error when discovery is unreachable", async () => {
-    const issuer = "https://sso.unreachable.example/application/o/unreachable";
-    const fetchMock = vi.fn().mockRejectedValue(new TypeError("network down"));
-
-    await expect(
-      resolveEndpointsFromDiscovery(issuer, fetchMock as any),
-    ).rejects.toBeInstanceOf(ConfigError);
-  });
-
-  it("surfaces a clear configuration error when the discovery document is incomplete", async () => {
-    const issuer = "https://sso.incomplete.example/application/o/incomplete";
-    const doc = discoveryDocument(issuer) as Record<string, string>;
-    delete doc.end_session_endpoint;
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(doc));
-
-    await expect(
-      resolveEndpointsFromDiscovery(issuer, fetchMock as any),
-    ).rejects.toThrow(/end_session_endpoint/);
-  });
-
-  it("rejects a discovery document advertising a different issuer", async () => {
-    const issuer = "https://sso.mismatch.example/application/o/mismatch";
-    const doc = {
-      ...discoveryDocument(issuer),
-      issuer: "https://sso.elsewhere.example/application/o/elsewhere",
-    };
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(doc));
-
-    await expect(
-      resolveEndpointsFromDiscovery(issuer, fetchMock as any),
-    ).rejects.toThrow(/issuer mismatch/i);
-  });
-
-  it("the bundled config resolves its endpoints from discovery at runtime", async () => {
-    const issuer = "https://sso.bundled.example/application/o/bundled";
-    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(discoveryDocument(issuer)));
-    const bundled = readConfig({ VITE_AUTHENTIK_ISSUER: `${issuer}/`, VITE_AUTHENTIK_CLIENT_ID: "bundled-client" });
-    expect(bundled.authorizeEndpoint).toBeUndefined();
-
-    const resolved = await resolveEndpoints(bundled, fetchMock as any);
-
-    expect(resolved.authorizeEndpoint).toBe(
-      "https://sso.bundled.example/application/o/authorize/",
-    );
-    expect(resolved.tokenEndpoint).toBe("https://sso.bundled.example/application/o/token/");
-    expect(resolved.userinfoEndpoint).toBe(
-      "https://sso.bundled.example/application/o/userinfo/",
-    );
-    expect(resolved.endSessionEndpoint).toBe(
-      "https://sso.bundled.example/application/o/bundled/end-session/",
-    );
-    expect(resolved.jwksUri).toBe("https://sso.bundled.example/application/o/bundled/jwks/");
-  });
-
-  it("does not re-fetch discovery when the config already carries endpoints", async () => {
-    const app: AppConfig = {
-      issuer: "https://auth.example.com/application/o/nestquest",
-      clientId: "client-id",
-      apiBaseUrl: "https://api.example.com",
-      authorizeEndpoint: "https://auth.example.com/application/o/authorize/",
-      tokenEndpoint: "https://auth.example.com/application/o/token/",
-      userinfoEndpoint: "https://auth.example.com/application/o/userinfo/",
-      endSessionEndpoint: "https://auth.example.com/application/o/nestquest/end-session/",
-      redirectUri: "http://localhost:5173/auth/callback",
-    };
-    const fetchMock = vi.fn();
-
-    const resolved = await resolveEndpoints(app, fetchMock as any);
-
-    expect(fetchMock).not.toHaveBeenCalled();
-    expect(resolved).toBe(app);
-  });
-});

admin/src/config.ts

@@ -1,221 +0,0 @@
-/**
- * Runtime configuration, read from Vite env (import.meta.env).
- * See .env.example for the variables and their defaults.
- *
- * OIDC endpoints are NOT hardcoded here. They are resolved lazily from the
- * issuer's OIDC discovery document (see resolveEndpoints), because Authentik
- * serves authorize/token/userinfo OUTSIDE the application-specific issuer
- * path (issuer is /application/o/<slug>/, authorize is /application/o/authorize/).
- * Both hardcoding the production host and naively concatenating onto the
- * issuer would break non-default issuers; discovery is the only correct way.
- */
-
-export interface AppConfig {
-  issuer: string;
-  clientId: string | undefined;
-  apiBaseUrl: string;
-  /** Resolved from the issuer's OIDC discovery document — see resolveEndpoints(). */
-  authorizeEndpoint?: string;
-  tokenEndpoint?: string;
-  userinfoEndpoint?: string;
-  endSessionEndpoint?: string;
-  jwksUri?: string;
-  redirectUri: string;
-}
-
-/** AppConfig whose OIDC endpoints have been filled in by resolveEndpoints(). */
-export type ResolvedAppConfig = AppConfig &
-  Required<
-    Pick<
-      AppConfig,
-      "authorizeEndpoint" | "tokenEndpoint" | "userinfoEndpoint" | "endSessionEndpoint"
-    >
-  >;
-
-export interface DiscoveredEndpoints {
-  issuer: string;
-  authorizeEndpoint: string;
-  tokenEndpoint: string;
-  userinfoEndpoint: string;
-  endSessionEndpoint: string;
-  jwksUri: string;
-}
-
-/** Raised when OIDC discovery fails or the configuration is unusable. */
-export class ConfigError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "ConfigError";
-  }
-}
-
-const REQUIRED_ENDPOINT_NAMES = [
-  "authorizeEndpoint",
-  "tokenEndpoint",
-  "userinfoEndpoint",
-  "endSessionEndpoint",
-] as const;
-
-export function readConfig(env: Record<string, string | undefined> = import.meta.env as any): AppConfig {
-  const issuer = (
-    env.VITE_AUTHENTIK_ISSUER || "https://auth.cubecraftlabs.com/application/o/nestquest/"
-  ).replace(/\/$/, "");
-  const clientId = env.VITE_AUTHENTIK_CLIENT_ID;
-  const apiBaseUrl = env.VITE_API_BASE_URL || "https://nestquest.cubecraftlabs.com";
-
-  return {
-    issuer,
-    // No default: a missing client id must surface as a configuration error
-    // screen, not a broken redirect to Authentik.
-    clientId: clientId || undefined,
-    apiBaseUrl,
-    // authorize/token/userinfo/end-session endpoints are resolved from the
-    // issuer's discovery document at runtime — never hardcoded here.
-    redirectUri: `${window.location.origin}/auth/callback`,
-  };
-}
-
-export const config: AppConfig = readConfig();
-
-interface DiscoveryDocument {
-  issuer?: unknown;
-  authorization_endpoint?: unknown;
-  token_endpoint?: unknown;
-  userinfo_endpoint?: unknown;
-  end_session_endpoint?: unknown;
-  jwks_uri?: unknown;
-}
-
-function normalizeIssuer(issuer: string): string {
-  return issuer.replace(/\/+$/, "");
-}
-
-function nonEmptyString(value: unknown): string | undefined {
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-
-/** Discovery document location for an issuer, tolerant of a trailing slash. */
-export function discoveryUrlForIssuer(issuer: string): string {
-  return `${normalizeIssuer(issuer)}/.well-known/openid-configuration`;
-}
-
-async function fetchDiscoveredEndpoints(
-  issuer: string,
-  fetchImpl: typeof fetch,
-): Promise<DiscoveredEndpoints> {
-  const normalizedIssuer = normalizeIssuer(issuer);
-  const discoveryUrl = `${normalizedIssuer}/.well-known/openid-configuration`;
-
-  let response: Response;
-  try {
-    response = await fetchImpl(discoveryUrl);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new ConfigError(
-      `OIDC discovery request to ${discoveryUrl} failed (${reason}). ` +
-        "Check VITE_AUTHENTIK_ISSUER and network reachability.",
-    );
-  }
-  if (!response.ok) {
-    throw new ConfigError(
-      `OIDC discovery failed: ${discoveryUrl} returned HTTP ${response.status}. ` +
-        "Check VITE_AUTHENTIK_ISSUER.",
-    );
-  }
-
-  let doc: DiscoveryDocument;
-  try {
-    doc = (await response.json()) as DiscoveryDocument;
-  } catch {
-    throw new ConfigError(
-      `OIDC discovery document at ${discoveryUrl} is not valid JSON. Check VITE_AUTHENTIK_ISSUER.`,
-    );
-  }
-
-  const authorizationEndpoint = nonEmptyString(doc.authorization_endpoint);
-  const tokenEndpoint = nonEmptyString(doc.token_endpoint);
-  const userinfoEndpoint = nonEmptyString(doc.userinfo_endpoint);
-  const endSessionEndpoint = nonEmptyString(doc.end_session_endpoint);
-  const jwksUri = nonEmptyString(doc.jwks_uri);
-  const discoveredIssuer = nonEmptyString(doc.issuer);
-
-  const endpointFields: Array<[string, string | undefined]> = [
-    ["authorization_endpoint", authorizationEndpoint],
-    ["token_endpoint", tokenEndpoint],
-    ["userinfo_endpoint", userinfoEndpoint],
-    ["end_session_endpoint", endSessionEndpoint],
-    ["jwks_uri", jwksUri],
-  ];
-  const missing = endpointFields.filter(([, value]) => !value).map(([name]) => name);
-  if (missing.length > 0) {
-    throw new ConfigError(
-      `OIDC discovery document at ${discoveryUrl} is missing: ${missing.join(", ")}. ` +
-        "The issuer must point at an OIDC provider that publishes these endpoints.",
-    );
-  }
-
-  if (discoveredIssuer && normalizeIssuer(discoveredIssuer) !== normalizedIssuer) {
-    throw new ConfigError(
-      `OIDC discovery issuer mismatch: ${discoveryUrl} advertises "${discoveredIssuer}" ` +
-        `but VITE_AUTHENTIK_ISSUER is "${normalizedIssuer}".`,
-    );
-  }
-
-  return {
-    issuer: normalizedIssuer,
-    authorizeEndpoint: authorizationEndpoint!,
-    tokenEndpoint: tokenEndpoint!,
-    userinfoEndpoint: userinfoEndpoint!,
-    endSessionEndpoint: endSessionEndpoint!,
-    jwksUri: jwksUri!,
-  };
-}
-
-/**
- * Session cache: one discovery fetch per issuer per SPA session. Failed
- * lookups are evicted so a transient network error can be retried instead of
- * poisoning the whole session.
- */
-const discoveryCache = new Map<string, Promise<DiscoveredEndpoints>>();
-
-export function resolveEndpointsFromDiscovery(
-  issuer: string,
-  fetchImpl: typeof fetch = fetch,
-): Promise<DiscoveredEndpoints> {
-  const normalizedIssuer = normalizeIssuer(issuer);
-  const cached = discoveryCache.get(normalizedIssuer);
-  if (cached) return cached;
-
-  const pending = fetchDiscoveredEndpoints(normalizedIssuer, fetchImpl);
-  discoveryCache.set(normalizedIssuer, pending);
-  pending.catch(() => {
-    discoveryCache.delete(normalizedIssuer);
-  });
-  return pending;
-}
-
-/**
- * Return `app` with all OIDC endpoints filled in. When the config already
- * carries them (pre-resolved config, tests) this is a no-op; otherwise the
- * issuer's discovery document is fetched (cached for the session) and its
- * authorization/token/userinfo/end-session/jwks endpoints are used.
- */
-export async function resolveEndpoints(
-  app: AppConfig,
-  fetchImpl: typeof fetch = fetch,
-): Promise<ResolvedAppConfig> {
-  const missing = REQUIRED_ENDPOINT_NAMES.filter((name) => !app[name]);
-  if (missing.length === 0) {
-    return app as ResolvedAppConfig;
-  }
-
-  const discovered = await resolveEndpointsFromDiscovery(app.issuer, fetchImpl);
-  return {
-    ...app,
-    authorizeEndpoint: discovered.authorizeEndpoint,
-    tokenEndpoint: discovered.tokenEndpoint,
-    userinfoEndpoint: discovered.userinfoEndpoint,
-    endSessionEndpoint: discovered.endSessionEndpoint,
-    jwksUri: discovered.jwksUri,
-  };
-}

admin/src/index.css

@@ -1,39 +0,0 @@
-/* NestQuest Admin — global tokens + base.
-   Plain CubeCraft styling, mobile-first, 390x844 reference
-   (design/ADMIN-SPEC.md). Values mirror design/tokens/nestquest-admin-tokens.css,
-   re-scoped to :root for the standalone PWA. */
-
-:root {
-  --nq-brand-blue: #3b3ab8;
-  --nq-brand-purple: #a035cc;
-
-  --nq-a-page: #f4f4f6;
-  --nq-a-surface: #ffffff;
-  --nq-a-border: #e4e4ea;
-  --nq-a-divider: #ededf1;
-
-  --nq-a-ink: #18181d;
-  --nq-a-ink-secondary: #52525e;
-  --nq-a-ink-tertiary: #70707e;
-
-  --nq-a-font: Nunito, system-ui, sans-serif;
-  --nq-a-tabbar-height: 70px;
-}
-
-* {
-  box-sizing: border-box;
-}
-
-html,
-body,
-#root {
-  margin: 0;
-  height: 100%;
-}
-
-body {
-  font-family: var(--nq-a-font);
-  background: var(--nq-a-page);
-  color: var(--nq-a-ink);
-  -webkit-font-smoothing: antialiased;
-}

admin/src/main.tsx

@@ -1,13 +0,0 @@
-import { StrictMode } from "react";
-import { createRoot } from "react-dom/client";
-import AppRoutes from "./AppRoutes";
-import "./index.css";
-import { registerServiceWorker } from "./pwa/register";
-
-createRoot(document.getElementById("root")!).render(
-  <StrictMode>
-    <AppRoutes />
-  </StrictMode>,
-);
-
-void registerServiceWorker();

admin/src/pwa/pwa.test.ts

@@ -1,396 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-  REVISION_MARKER,
-  STATIC_PRECACHE_FILES,
-  injectServiceWorker,
-} from "../../vite-sw-plugin";
-import { registerServiceWorker } from "./register";
-
-const adminRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
-const adminPath = (rel: string) => resolve(adminRoot, rel);
-const publicPath = (urlPath: string) => adminPath(`public${urlPath}`);
-
-interface ManifestIcon {
-  src: string;
-  sizes: string;
-  type: string;
-  purpose?: string;
-}
-
-const manifest = JSON.parse(readFileSync(publicPath("/manifest.webmanifest"), "utf8"));
-const icons: ManifestIcon[] = manifest.icons;
-const swSource = readFileSync(publicPath("/sw.js"), "utf8");
-
-const sizeOf = (icon: ManifestIcon) => Number(icon.sizes.split("x")[0]);
-const purposes = (icon: ManifestIcon) => (icon.purpose ?? "any").split(/\s+/);
-
-describe("web app manifest", () => {
-  it("meets the installability criteria", () => {
-    expect(manifest.name).toBe("NestQuest Admin");
-    expect(manifest.short_name).toBe("NestQuest");
-    expect(manifest.start_url).toBe("/");
-    expect(manifest.scope).toBe("/");
-    expect(manifest.display).toBe("standalone");
-    expect(manifest.background_color).toMatch(/^#[0-9a-f]{6}$/i);
-    expect(manifest.theme_color).toMatch(/^#[0-9a-f]{6}$/i);
-
-    const any = icons.filter((i) => purposes(i).includes("any"));
-    expect(any.some((i) => sizeOf(i) >= 192)).toBe(true);
-    expect(any.some((i) => sizeOf(i) >= 512)).toBe(true);
-    expect(icons.some((i) => purposes(i).includes("maskable"))).toBe(true);
-  });
-
-  it("uses the admin design token colours", () => {
-    const css = readFileSync(adminPath("src/index.css"), "utf8");
-    expect(css).toContain(`--nq-brand-blue: ${manifest.theme_color};`);
-    expect(css).toContain(`--nq-a-page: ${manifest.background_color};`);
-  });
-
-  it.each(icons.map((i) => [i.src, i] as const))(
-    "icon %s is a real PNG of its declared size",
-    (_src, icon) => {
-      const path = publicPath(icon.src);
-      expect(existsSync(path)).toBe(true);
-      const png = readFileSync(path);
-      expect([...png.subarray(0, 8)]).toEqual([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
-      expect(png.toString("ascii", 12, 16)).toBe("IHDR");
-      const [w, h] = icon.sizes.split("x").map(Number);
-      expect(png.readUInt32BE(16)).toBe(w);
-      expect(png.readUInt32BE(20)).toBe(h);
-      expect(icon.type).toBe("image/png");
-    },
-  );
-});
-
-describe("index.html and entry point", () => {
-  const html = readFileSync(adminPath("index.html"), "utf8");
-
-  it("links the manifest, theme colour and apple touch icon", () => {
-    expect(html).toContain('<link rel="manifest" href="/manifest.webmanifest" />');
-    expect(html).toContain(`<meta name="theme-color" content="${manifest.theme_color}" />`);
-    expect(html).toContain('<link rel="apple-touch-icon" href="/icons/icon-192.png" />');
-  });
-
-  it("main.tsx registers the service worker", () => {
-    const main = readFileSync(adminPath("src/main.tsx"), "utf8");
-    expect(main).toMatch(/import \{ registerServiceWorker \} from "\.\/pwa\/register"/);
-    expect(main).toMatch(/registerServiceWorker\(\)/);
-  });
-});
-
-// Minimal service-worker global scope: runs public/sw.js against in-memory
-// caches and a stubbed network, so handler behaviour is checked without I/O.
-function loadServiceWorker(
-  network: (url: string) => Promise<FakeResponse>,
-  source: string = swSource,
-) {
-  const listeners: Record<string, (event: any) => void> = {};
-  const stores = new Map<string, Map<string, FakeResponse>>();
-  const openStore = (name: string) => {
-    if (!stores.has(name)) stores.set(name, new Map());
-    return stores.get(name)!;
-  };
-  const keyOf = (req: string | { url: string }) =>
-    new URL(typeof req === "string" ? req : req.url, "https://admin.test").href;
-  const fetchFn = vi.fn((req: string | { url: string }) => network(keyOf(req)));
-
-  const caches = {
-    open: async (name: string) => {
-      const store = openStore(name);
-      return {
-        addAll: async (urls: string[]) => {
-          for (const u of urls) store.set(keyOf(u), await network(keyOf(u)));
-        },
-        put: async (req: { url: string }, res: FakeResponse) => void store.set(keyOf(req), res),
-      };
-    },
-    keys: async () => [...stores.keys()],
-    delete: async (name: string) => stores.delete(name),
-    match: async (req: string | { url: string }, opts?: { cacheName?: string }) => {
-      const names = opts?.cacheName ? [opts.cacheName] : [...stores.keys()];
-      for (const n of names) {
-        const hit = stores.get(n)?.get(keyOf(req));
-        if (hit) return hit;
-      }
-      return undefined;
-    },
-  };
-  const self = {
-    location: new URL("https://admin.test/"),
-    addEventListener: (type: string, fn: (event: any) => void) => (listeners[type] = fn),
-    skipWaiting: vi.fn(async () => undefined),
-    clients: { claim: vi.fn(async () => undefined) },
-  };
-  const ResponseStub = { error: () => new FakeResponse("", false, "error") };
-  new Function("self", "caches", "fetch", "Response", source)(self, caches, fetchFn, ResponseStub);
-
-  const dispatch = async (type: string, init: object = {}) => {
-    let pending: Promise<unknown> | undefined;
-    const event = {
-      ...init,
-      waitUntil: (p: Promise<unknown>) => (pending = p),
-      respondWith: (p: Promise<unknown>) => (pending = p),
-    };
-    listeners[type](event);
-    return { responded: pending !== undefined, result: await pending };
-  };
-  return { listeners, stores, self, fetchFn, dispatch, openStore };
-}
-
-class FakeResponse {
-  constructor(
-    readonly body: string,
-    readonly ok = true,
-    readonly type = "basic",
-  ) {}
-  clone() {
-    return new FakeResponse(this.body, this.ok, this.type);
-  }
-}
-
-const request = (url: string, extra: object = {}) => ({
-  url: new URL(url, "https://admin.test").href,
-  method: "GET",
-  mode: "cors",
-  destination: "",
-  ...extra,
-});
-
-describe("service worker (public/sw.js)", () => {
-  it("is a static asset served from the site root", () => {
-    expect(existsSync(publicPath("/sw.js"))).toBe(true);
-    expect(swSource).toMatch(/const SHELL_CACHE = /);
-    expect(swSource).toMatch(/addEventListener\("install"/);
-    expect(swSource).toMatch(/addEventListener\("activate"/);
-    expect(swSource).toMatch(/addEventListener\("fetch"/);
-  });
-
-  it("precaches the shell on install, prunes stale caches on activate", async () => {
-    const sw = loadServiceWorker(async (url) => new FakeResponse(`net:${url}`));
-    sw.openStore("nestquest-admin-shell-v0");
-
-    await sw.dispatch("install");
-    expect(sw.self.skipWaiting).toHaveBeenCalled();
-    const precached = [...sw.stores.values()].flatMap((s) => [...s.keys()]);
-    for (const path of ["/", "/index.html", "/manifest.webmanifest", ...icons.map((i) => i.src)]) {
-      expect(precached).toContain(`https://admin.test${path}`);
-    }
-
-    await sw.dispatch("activate");
-    expect(sw.stores.has("nestquest-admin-shell-v0")).toBe(false);
-    expect(sw.self.clients.claim).toHaveBeenCalled();
-  });
-
-  it("serves the cached shell for navigations when offline", async () => {
-    let online = true;
-    const sw = loadServiceWorker(async (url) => {
-      if (!online) throw new TypeError("Failed to fetch");
-      return new FakeResponse(`net:${url}`);
-    });
-    await sw.dispatch("install");
-    online = false;
-
-    const { result } = await sw.dispatch("fetch", {
-      request: request("/children/42", { mode: "navigate", destination: "document" }),
-    });
-    expect((result as FakeResponse).body).toBe("net:https://admin.test/index.html");
-  });
-
-  it("serves static assets cache-first and fills the runtime cache", async () => {
-    const sw = loadServiceWorker(async (url) => new FakeResponse(`net:${url}`));
-    const asset = request("/assets/index-abc123.js", { destination: "script" });
-
-    const first = await sw.dispatch("fetch", { request: asset });
-    expect((first.result as FakeResponse).body).toBe("net:https://admin.test/assets/index-abc123.js");
-    expect(sw.fetchFn).toHaveBeenCalledTimes(1);
-
-    const second = await sw.dispatch("fetch", { request: asset });
-    expect((second.result as FakeResponse).body).toBe("net:https://admin.test/assets/index-abc123.js");
-    expect(sw.fetchFn).toHaveBeenCalledTimes(1);
-  });
-
-  it("never handles cross-origin, non-GET or non-static requests", async () => {
-    const sw = loadServiceWorker(async (url) => new FakeResponse(`net:${url}`));
-    const cases = [
-      request("https://auth.example.com/logo.png", { destination: "image" }),
-      request("/assets/app.js", { destination: "script", method: "POST" }),
-      request("/api/admin/children"),
-    ];
-    for (const req of cases) {
-      const { responded } = await sw.dispatch("fetch", { request: req });
-      expect(responded).toBe(false);
-    }
-    expect(sw.fetchFn).not.toHaveBeenCalled();
-  });
-});
-
-// A Vite-style built index.html referencing hashed bundles.
-const builtIndexHtml = (hash: string) => `<!doctype html>
-<html lang="en">
-  <head>
-    <link rel="manifest" href="/manifest.webmanifest" />
-    <link rel="apple-touch-icon" href="/icons/icon-192.png" />
-    <script type="module" crossorigin src="/assets/index-${hash}.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/vendor-${hash}.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-${hash}.css">
-    <link rel="preconnect" href="https://auth.example.com" />
-  </head>
-  <body><div id="root"></div></body>
-</html>`;
-
-// Same-origin script/link URLs of an HTML document, parsed independently of
-// the build plugin so the regression check does not trust its own extractor.
-const referencedAssets = (html: string) =>
-  [...new DOMParser().parseFromString(html, "text/html").querySelectorAll("script[src], link[href]")]
-    .map((el) => new URL(el.getAttribute("src") ?? el.getAttribute("href")!, "https://admin.test/"))
-    .filter((url) => url.origin === "https://admin.test")
-    .map((url) => url.href);
-
-// The unhashed files the build hashes into the revision, read from public/.
-const staticFiles = STATIC_PRECACHE_FILES.map((path) => ({
-  path,
-  bytes: readFileSync(publicPath(`/${path}`)),
-}));
-const revisionOf = (src: string) => /const REVISION = "([0-9a-f]+)";/.exec(src)?.[1];
-
-describe("build-time service worker injection", () => {
-  it("precaches every asset the cached index.html references on install (PWA-001)", async () => {
-    const html = builtIndexHtml("Ab12Cd34");
-    const built = injectServiceWorker(html, swSource, staticFiles);
-    const sw = loadServiceWorker(async (url) =>
-      new FakeResponse(url.endsWith("/index.html") ? html : `net:${url}`),
-    built);
-
-    await sw.dispatch("install");
-    const shell = [...sw.stores.entries()].find(([name]) => name.startsWith("nestquest-admin-shell-"));
-    expect(shell).toBeDefined();
-    const [, shellStore] = shell!;
-
-    const cachedHtml = shellStore.get("https://admin.test/index.html")!.body;
-    const assets = referencedAssets(cachedHtml);
-    expect(assets).toEqual(
-      expect.arrayContaining([
-        "https://admin.test/assets/index-Ab12Cd34.js",
-        "https://admin.test/assets/vendor-Ab12Cd34.js",
-        "https://admin.test/assets/index-Ab12Cd34.css",
-      ]),
-    );
-    for (const asset of assets) expect([...shellStore.keys()]).toContain(asset);
-    expect([...shellStore.keys()]).not.toContain("https://auth.example.com/");
-  });
-
-  it("derives a new revision for different index.html content (PWA-002)", () => {
-    const a = injectServiceWorker(builtIndexHtml("aaaa1111"), swSource, staticFiles);
-    const b = injectServiceWorker(builtIndexHtml("bbbb2222"), swSource, staticFiles);
-
-    expect(a).not.toContain(REVISION_MARKER);
-    expect(b).not.toContain(REVISION_MARKER);
-    expect(revisionOf(a)).toMatch(/^[0-9a-f]{12}$/);
-    expect(revisionOf(b)).toMatch(/^[0-9a-f]{12}$/);
-    expect(revisionOf(a)).not.toBe(revisionOf(b));
-    expect(injectServiceWorker(builtIndexHtml("aaaa1111"), swSource, staticFiles)).toBe(a);
-  });
-
-  it("derives a new revision when only a precached static file changes (PWA-002)", () => {
-    const html = builtIndexHtml("aaaa1111");
-    const base = revisionOf(injectServiceWorker(html, swSource, staticFiles));
-    const withChanged = (path: string) =>
-      staticFiles.map((f) =>
-        f.path === path ? { path, bytes: Buffer.concat([f.bytes, Buffer.from([0])]) } : f,
-      );
-
-    expect(revisionOf(injectServiceWorker(html, swSource, [...staticFiles].reverse()))).toBe(base);
-    for (const path of STATIC_PRECACHE_FILES) {
-      const changed = revisionOf(injectServiceWorker(html, swSource, withChanged(path)));
-      expect(changed, path).toMatch(/^[0-9a-f]{12}$/);
-      expect(changed, path).not.toBe(base);
-    }
-  });
-
-  it("hashes every unhashed URL sw.js precaches (PWA-002)", () => {
-    const shellUrls = [...swSource.matchAll(/^\s*"(\/[^"]*)",$/gm)].map((m) => m[1]);
-    const fixed = shellUrls.filter((url) => url !== "/" && url !== "/index.html");
-    expect(fixed.map((url) => url.slice(1)).sort()).toEqual([...STATIC_PRECACHE_FILES].sort());
-  });
-
-  it("names both caches after the build revision (PWA-002)", async () => {
-    const built = injectServiceWorker(builtIndexHtml("aaaa1111"), swSource, staticFiles);
-    const revision = /const REVISION = "([0-9a-f]+)";/.exec(built)![1];
-    const sw = loadServiceWorker(async (url) => new FakeResponse(`net:${url}`), built);
-
-    await sw.dispatch("install");
-    await sw.dispatch("fetch", { request: request("/assets/late.js", { destination: "script" }) });
-    expect([...sw.stores.keys()].sort()).toEqual([
-      `nestquest-admin-runtime-${revision}`,
-      `nestquest-admin-shell-${revision}`,
-    ]);
-  });
-
-  it("fails fast when sw.js lacks the placeholders", () => {
-    expect(() => injectServiceWorker(builtIndexHtml("x"), "const SHELL_URLS = [];", staticFiles)).toThrow();
-  });
-
-  it("activation deletes only stale nestquest-admin caches (PWA-003)", async () => {
-    const built = injectServiceWorker(builtIndexHtml("aaaa1111"), swSource, staticFiles);
-    const sw = loadServiceWorker(async (url) => new FakeResponse(`net:${url}`), built);
-    for (const name of [
-      "nestquest-admin-shell-old",
-      "nestquest-admin-runtime-old",
-      "some-other-app-cache",
-    ]) {
-      sw.openStore(name);
-    }
-
-    await sw.dispatch("install");
-    await sw.dispatch("activate");
-    const names = [...sw.stores.keys()];
-    expect(names).not.toContain("nestquest-admin-shell-old");
-    expect(names).not.toContain("nestquest-admin-runtime-old");
-    expect(names).toContain("some-other-app-cache");
-    expect(names.some((n) => n.startsWith("nestquest-admin-shell-") && n !== "nestquest-admin-shell-old")).toBe(true);
-  });
-});
-
-describe("registerServiceWorker", () => {
-  afterEach(() => {
-    vi.unstubAllEnvs();
-    vi.unstubAllGlobals();
-    vi.restoreAllMocks();
-  });
-
-  const stubServiceWorker = (register: ReturnType<typeof vi.fn>) =>
-    vi.stubGlobal("navigator", { ...navigator, serviceWorker: { register } });
-
-  it("does not register outside production builds", async () => {
-    const register = vi.fn();
-    stubServiceWorker(register);
-    expect(import.meta.env.PROD).toBe(false);
-    await registerServiceWorker();
-    expect(register).not.toHaveBeenCalled();
-  });
-
-  it("registers /sw.js in production", async () => {
-    vi.stubEnv("PROD", true);
-    const register = vi.fn().mockResolvedValue({});
-    stubServiceWorker(register);
-    await registerServiceWorker();
-    expect(register).toHaveBeenCalledWith("/sw.js", { scope: "/" });
-  });
-
-  it("logs instead of throwing when registration fails", async () => {
-    vi.stubEnv("PROD", true);
-    stubServiceWorker(vi.fn().mockRejectedValue(new Error("boom")));
-    const error = vi.spyOn(console, "error").mockImplementation(() => {});
-    await expect(registerServiceWorker()).resolves.toBeUndefined();
-    expect(error).toHaveBeenCalled();
-  });
-
-  it("does nothing when the browser lacks service workers", async () => {
-    vi.stubEnv("PROD", true);
-    vi.stubGlobal("navigator", {});
-    await expect(registerServiceWorker()).resolves.toBeUndefined();
-  });
-});

admin/src/pwa/register.ts

@@ -1,13 +0,0 @@
-/**
- * Service worker registration for the installable admin PWA.
- * Registers /sw.js only in production builds, so dev servers and tests never
- * run a worker. Failures are logged, never thrown — the app works without it.
- */
-export async function registerServiceWorker(): Promise<void> {
-  if (!import.meta.env.PROD || !("serviceWorker" in navigator)) return;
-  try {
-    await navigator.serviceWorker.register("/sw.js", { scope: "/" });
-  } catch (error) {
-    console.error("Service worker registration failed:", error);
-  }
-}

admin/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "jsx": "react-jsx",
-    "types": ["vite/client"],
-    "strict": true,
-    "skipLibCheck": true,
-    "noEmit": true,
-    "isolatedModules": true,
-    "useDefineForClassFields": true
-  },
-  "include": ["src"]
-}

admin/vite-sw-plugin.ts

@@ -1,93 +0,0 @@
-/* Build-time service worker injection. After Vite writes the bundle, the
-   hashed asset URLs referenced by dist/index.html and a content-derived
-   revision are written into dist/sw.js, so the offline shell is complete right
-   after install and every release ships a new worker with fresh caches.
-   Build tooling only — never imported by the app bundle. */
-import { createHash } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-import type { Plugin } from "vite";
-
-export const REVISION_MARKER = "__NQ_BUILD_REVISION__";
-const PRECACHE_PLACEHOLDER = "const PRECACHE_ASSETS = [];";
-// Unhashed files sw.js precaches by fixed URL, relative to the build output.
-export const STATIC_PRECACHE_FILES = [
-  "manifest.webmanifest",
-  "icons/icon-192.png",
-  "icons/icon-512.png",
-  "icons/icon-maskable-512.png",
-];
-
-export interface PrecacheFile {
-  path: string;
-  bytes: string | Uint8Array;
-}
-
-// Every same-origin URL an index.html loads via <script src> or <link href>,
-// normalised to an absolute path, in document order and without duplicates.
-export function extractShellAssets(indexHtml: string): string[] {
-  const tags = indexHtml.match(/<(?:script|link)\b[^>]*>/gi) ?? [];
-  const urls = tags.flatMap((tag) => {
-    const attr = /\b(?:src|href)\s*=\s*["']([^"']+)["']/i.exec(tag);
-    if (!attr) return [];
-    const url = new URL(attr[1], "https://same-origin.invalid/");
-    return url.origin === "https://same-origin.invalid" ? [url.pathname] : [];
-  });
-  return [...new Set(urls)];
-}
-
-// Hash of every precached file, sorted by path; each entry is length-prefixed
-// so no two different file sets hash the same concatenation.
-export function computeRevision(files: PrecacheFile[]): string {
-  const hash = createHash("sha256");
-  for (const { path, bytes } of [...files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))) {
-    const data = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
-    hash.update(`${path}\0${data.byteLength}\0`).update(data);
-  }
-  return hash.digest("hex").slice(0, 12);
-}
-
-// Returns swSource with the precache list and the build revision filled in.
-// The revision covers index.html (and so the hashed bundles it names), the
-// sw.js source and the bytes of every unhashed static file it precaches.
-export function injectServiceWorker(
-  indexHtml: string,
-  swSource: string,
-  staticFiles: PrecacheFile[],
-): string {
-  if (!swSource.includes(PRECACHE_PLACEHOLDER) || !swSource.includes(REVISION_MARKER)) {
-    throw new Error("sw.js is missing the PRECACHE_ASSETS placeholder or revision marker");
-  }
-  const assets = extractShellAssets(indexHtml);
-  const revision = computeRevision([
-    { path: "index.html", bytes: indexHtml },
-    { path: "sw.js", bytes: swSource },
-    ...staticFiles,
-  ]);
-  return swSource
-    .replace(PRECACHE_PLACEHOLDER, `const PRECACHE_ASSETS = ${JSON.stringify(assets)};`)
-    .replaceAll(REVISION_MARKER, revision);
-}
-
-export function serviceWorkerInjectPlugin(): Plugin {
-  let outDir = "";
-  return {
-    name: "nestquest-sw-inject",
-    apply: "build",
-    configResolved(config) {
-      outDir = resolve(config.root, config.build.outDir);
-    },
-    writeBundle() {
-      const swPath = resolve(outDir, "sw.js");
-      const indexHtml = readFileSync(resolve(outDir, "index.html"), "utf8");
-      const staticFiles = STATIC_PRECACHE_FILES.map((path) => ({
-        path,
-        bytes: readFileSync(resolve(outDir, path)),
-      }));
-      writeFileSync(
-        swPath,
-        injectServiceWorker(indexHtml, readFileSync(swPath, "utf8"), staticFiles),
-      );
-    },
-  };
-}

admin/vite.config.ts

@@ -1,10 +0,0 @@
-import { defineConfig } from "vitest/config";
-import react from "@vitejs/plugin-react";
-import { serviceWorkerInjectPlugin } from "./vite-sw-plugin";
-
-export default defineConfig({
-  plugins: [react(), serviceWorkerInjectPlugin()],
-  test: {
-    environment: "jsdom",
-  },
-});

custom_components/nestquest/__init__.py

@@ -1,78 +1,377 @@
-"""The NestQuest integration (Feature 18: a thin client of the NestQuest API service).
-
-The integration owns NO database: the API service (Feature 16) owns the
-SQLite file, the migrations, and every business rule.  Setup builds the
-entry's ONE shared API client, the coordinator that polls the panel
-snapshot through it, and the SSE subscription that re-fires the API's
-transition frames on the HA bus, registers the single
-``nestquest.complete_quest`` proxy service, registers the zero-config
-panel dashboard (Feature 20), and forwards the sensor and
-binary_sensor platforms.
-"""
+"""The NestQuest integration."""
 from __future__ import annotations
 
+import asyncio
+import datetime
 import inspect
+import sqlite3
 from collections.abc import Callable
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Any
+from zoneinfo import ZoneInfo
 
 from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.exceptions import ConfigEntryNotReady
+from homeassistant.helpers.event import async_track_time_change
 
 from .const import (
-    CONF_SNAPSHOT_STALENESS,
+    CONF_ADMIN_USER_IDS,
     CONF_UPDATE_INTERVAL,
-    DEFAULT_SNAPSHOT_STALENESS,
     DEFAULT_UPDATE_INTERVAL,
     DOMAIN,
     LOGGER,
     PLATFORMS,
 )
-from .coordinator import NestQuestCoordinator, coordinator_client_from_entry
-from .dashboard import async_register_dashboard
+from .core.settings import NestQuestSettings
 from .frontend import async_register_frontend
+from .coordinator import NestQuestCoordinator, coordinator_client_from_entry
+from .db import NestQuestDatabase, make_database
+from .materialize import materialize as _materialize_run
+from .migrations import apply_migrations
 from .services import async_deregister_services, async_register_services
 from .sse import NestQuestEventStream
+from .store import async_get_db_path
+from .admin_allowlist import seed_setup_admin
+from .sweep import run_missed_sweep
 
 _LOGGER = LOGGER
 
+#: SQLite reports "file is not a database" for corruption in every
+#: sqlite3 version this integration targets; the version-specific
+#: "encrypted or malformed" spelling (3.41+) maps to the same failure.
+_CORRUPTION_MARKERS = (
+    "file is not a database",
+    "database disk image is malformed",
+    "encrypted or malformed",
+    "is not a database",
+)
+
+#: Primary sqlite error codes that mean "the file is corrupt" (SQLite
+#: result codes, https://www.sqlite.org/c3ref/c_abort.html).  Extended
+#: codes carry the primary code in their low byte, so the match is on
+#: errcode & 0xff.
+_CORRUPT_PRIMARY_CODES = frozenset({11, 26})  # SQLITE_CORRUPT, SQLITE_NOTADB
+
+
+def _is_corruption_error(error: BaseException) -> bool:
+    """Return True when ``error`` indicates a corrupt database file.
+
+    Classification order: sqlite_errorcode (Python 3.11+) is primary
+    and locale-independent — SQLITE_CORRUPT and SQLITE_NOTADB, matched
+    on the primary byte so extended codes (SQLITE_CORRUPT_VTAB etc.)
+    classify correctly too.  Message matching is the fallback for
+    older Pythons: the corruption spellings are the documented English
+    texts; a non-English locale could evade them, but the code check
+    already covers every locale on supported Pythons.
+    """
+    if not isinstance(error, sqlite3.DatabaseError):
+        return False
+    errorcode = getattr(error, "sqlite_errorcode", None)
+    if errorcode is not None and (errorcode & 0xFF) in _CORRUPT_PRIMARY_CODES:
+        return True
+    message = str(error).lower()
+    return any(marker in message for marker in _CORRUPTION_MARKERS)
+
+
+async def _preflight_existing_file(
+    hass: HomeAssistant, db_path: Path
+) -> None:
+    """Detect corruption in an EXISTING file before it is opened read-write.
+
+    Opening read-write persists WAL mode — for a rollback-journal file
+    that rewrites the header byte 18/19 and can create -wal/-shm
+    sidecars — which would modify a corrupt file before detection and
+    break the leave-untouched guarantee.  This preflight therefore
+    validates the WHOLE file with a READ-ONLY connection (mode=ro +
+    immutable=1 URI, PRAGMA integrity_check, run on the executor like
+    every other DB call): corruption anywhere fails there, before
+    anything is written.  ``immutable=1`` is SQLite's documented
+    guarantee that the connection performs NO writes and creates NO
+    sidecars — even a WAL-header file gets its -wal/-shm reads served
+    without creating the shared-memory file.  Missing/empty files skip
+    the preflight (they are created fresh by the real open).  All
+    filesystem stat/URI work runs inside the executor job with the
+    probe so the event loop never touches disk.
+    """
+    def _probe() -> None:
+        # The file-state check and URI construction live inside the
+        # executor job: exists/stat/resolve are disk I/O.
+        if not db_path.exists():
+            return
+        # A zero-byte file is neither missing nor a valid database: it
+        # is a corrupt (truncated-to-nothing) existing file, likely an
+        # interrupted first write.  The leave-untouched contract applies
+        # to it too: refuse rather than silently initialize over it.
+        if db_path.stat().st_size == 0:
+            raise sqlite3.DatabaseError(
+                "existing database file is empty (zero bytes): file is "
+                "not a database"
+            )
+        # Properly escape the path: '#'/'?'/'%' in a directory or file
+        # name would otherwise be parsed as URI fragments/parameters/
+        # escapes.  immutable=1: SQLite guarantees no writes and no
+        # sidecar creation from this connection.
+        uri = db_path.resolve().as_uri() + "?mode=ro&immutable=1"
+        conn = sqlite3.connect(uri, uri=True)
+        try:
+            row = conn.execute("PRAGMA integrity_check").fetchone()
+        finally:
+            conn.close()
+        verdict = row[0] if row else "missing"
+        if verdict != "ok":
+            # A non-ok integrity verdict IS corruption: raise with the
+            # verdict text (which matches the corruption markers) and
+            # the NOTADB code so classification is code-based.
+            raise sqlite3.DatabaseError(
+                f"integrity_check verdict {verdict!r} on read-only "
+                f"probe: file is not a database"
+            )
+
+    try:
+        # Every DB-touching call goes through the executor (the mock
+        # harness's async_add_executor_job is awaitable too).
+        await hass.async_add_executor_job(_probe)
+    except sqlite3.DatabaseError as err:
+        # Non-ok integrity verdicts are corruption, full stop: there is
+        # no benign reading of a failed whole-file integrity check, so
+        # ANY DatabaseError out of the probe that carries a corruption
+        # marker or code propagates as corruption.  Only exotic probe
+        # failures that classify as non-corruption (e.g. a transient
+        # 'database is locked' on the read) are downgraded to a debug
+        # log, letting the real open path surface them.
+        if _is_corruption_error(err):
+            raise
+        raise sqlite3.DatabaseError(
+            f"read-only corruption probe of {db_path} failed: {err}"
+        ) from err
+
+async def _async_open_database(
+    hass: HomeAssistant, db_path: Path
+) -> NestQuestDatabase:
+    """Open the NestQuest database, mapping failure modes for setup.
+
+    Three startup cases (Feature 02 done-condition):
+
+    - file missing: SQLite creates it fresh on open — no special path,
+      migrations stamp version 1 on the next step.
+    - file present and valid: opens normally.
+    - file present but corrupt: log an ERROR with the path, close
+      anything opened, and raise ConfigEntryNotReady so HA retries —
+      the file is left byte-for-byte untouched so the owner can
+      restore a backup.  No code path here deletes or overwrites an
+      existing database file.
+
+    Corruption can surface at EITHER stage: a truncated header fails
+    in the read-only preflight (before the file is ever opened
+    read-write), while damaged later pages fail during migrations —
+    the preflight guarantees no WAL sidecar or header write happens
+    on a corrupt file before it is detected.  Both are classified the
+    same way.
+    """
+    try:
+        await _preflight_existing_file(hass, db_path)
+        database = await make_database(hass).open(db_path)
+    except asyncio.CancelledError:
+        raise
+    except sqlite3.DatabaseError as err:
+        if _is_corruption_error(err):
+            _LOGGER.error(
+                "NestQuest database at %s is corrupt: %s. Refusing to "
+                "start with a corrupt database; the file was left "
+                "untouched so a backup can be restored. Home Assistant "
+                "will retry setup.",
+                db_path,
+                err,
+            )
+            raise ConfigEntryNotReady(
+                f"NestQuest database corrupt: {db_path}"
+            ) from err
+        # open() failed for a non-corruption reason (locked file,
+        # permission problem): retryable, but nothing was opened.
+        _LOGGER.error(
+            "NestQuest database at %s failed to open: %s. Home "
+            "Assistant will retry setup.",
+            db_path,
+            err,
+        )
+        raise ConfigEntryNotReady(
+            f"NestQuest database unavailable: {db_path}"
+        ) from err
+    try:
+        await apply_migrations(database)
+    except (sqlite3.DatabaseError, RuntimeError) as err:
+        await database.close()
+        if _is_corruption_error(err):
+            _LOGGER.error(
+                "NestQuest database at %s is corrupt: %s. Refusing to "
+                "start with a corrupt database; the file was left "
+                "untouched so a backup can be restored. Home Assistant "
+                "will retry setup.",
+                db_path,
+                err,
+            )
+            raise ConfigEntryNotReady(
+                f"NestQuest database corrupt: {db_path}"
+            ) from err
+        # A non-corruption failure (e.g. a locked file, a future schema
+        # version) is also a retryable setup problem, but without the
+        # corruption framing.
+        _LOGGER.error(
+            "NestQuest database at %s failed to open: %s. Home "
+            "Assistant will retry setup.",
+            db_path,
+            err,
+        )
+        raise ConfigEntryNotReady(
+            f"NestQuest database unavailable: {db_path}"
+        ) from err
+    except asyncio.CancelledError:
+        await database.close()
+        raise
+    return database
+
 
 @dataclass
 class NestQuestRuntimeData:
     """Runtime data stored on a NestQuest config entry."""
 
     entry_id: str
+    settings: NestQuestSettings
+    database: NestQuestDatabase
     remove_update_listener: Callable[[], Any]
+    remove_time_change_listener: Callable[[], Any]
     coordinator: Any = None
     event_stream: NestQuestEventStream | None = None
 
 
-def _find_live_runtime_data(hass: HomeAssistant) -> NestQuestRuntimeData | None:
-    """Return a live runtime record with a coordinator, or None.
+async def _async_owner_user_ids(hass: HomeAssistant) -> list[str]:
+    """Return every Home Assistant owner-account user id.
 
-    The domain-global service (the panel completion proxy) has no
-    database of its own; it resolves whichever config entry's runtime
-    data is currently live at call time, so it cannot hold a stale
-    handle to an unloaded entry's coordinator.
+    The last-resort admin seed: when no persisted allowlist copy and no
+    flow-context user survive to first setup, the HA owner accounts are
+    seeded so the household is never left with zero admins (an empty
+    allowlist fails closed, which would lock the household out of its
+    own integration).  Owner accounts can already do everything in HA,
+    so granting NestQuest admin is not a privilege escalation.
+    """
+    auth = getattr(hass, "auth", None)
+    if auth is None:
+        return []
+    users = await auth.async_get_users()
+    owners = [
+        user.id
+        for user in users
+        if getattr(user, "is_owner", False) and getattr(user, "id", None)
+    ]
+    return owners
+
+
+async def _run_horizon_materialization(
+    hass: HomeAssistant,
+    database: NestQuestDatabase,
+    settings: NestQuestSettings,
+) -> None:
+    """Materialize the rolling horizon ``[today, today + horizon_days]``.
+
+    "today" is computed in HA local time (``hass.config.time_zone``) rather
+    than the system clock, so the horizon tracks the household's own day.
+    The walk itself runs through :func:`~.materialize.materialize`, whose DB
+    access is executor-only.
+
+    This is the ONE generation path: the startup backfill, the daily rollover
+    listener and the ``regenerate`` service all funnel through it, so there is
+    no duplicated materialization logic.  ``settings`` (REQUIRED — there is no
+    silent default; every caller already passes the entry's validated
+    :class:`NestQuestSettings`) carries the configured ``horizon_days``.  The
+    window itself comes from :meth:`settings.horizon_window` so the helper is
+    real and shared (not recomputed inline here).
+    """
+    time_zone = ZoneInfo(hass.config.time_zone)
+    today = datetime.datetime.now(time_zone).date()
+    start, end = settings.horizon_window(today)
+    await _materialize_run(database, start.isoformat(), end.isoformat(), today=today)
+
+
+def _register_day_rollover_listener(
+    hass: HomeAssistant,
+    database: NestQuestDatabase,
+    settings: NestQuestSettings,
+) -> Callable[[], Any]:
+    """Register the daily rollover listener and return its remover.
+
+    Fires once per day at the configured local ``day_rollover_time``:
+    first re-materializes the rolling horizon
+    ``[today, today + horizon_days]`` through the shared
+    :func:`_run_horizon_materialization` path (the entry's configured,
+    validated ``horizon_days`` carried on ``settings``), then runs the
+    Feature 11 missed sweep — announcing yesterday's still-open quests
+    as missed AFTER today's instances exist, watermark-guarded so a
+    re-fire of the listener the same night announces nothing twice.
+    """
+    hour, minute = settings.day_rollover_hour_minute
+
+    async def _run_materialization(_now: datetime.datetime) -> None:
+        await _run_horizon_materialization(hass, database, settings)
+        await run_missed_sweep(hass, database)
+
+    return async_track_time_change(
+        hass, _run_materialization, hour=hour, minute=minute
+    )
+
+
+def _find_live_runtime_data(hass: HomeAssistant) -> NestQuestRuntimeData | None:
+    """Return a live runtime record with a connected database, or None.
+
+    The domain-global services (e.g. ``regenerate``) have no database of
+    their own; they resolve whichever config entry's runtime data is
+    currently live at call time, so none of them can hold a stale handle
+    to a closed connection after another entry unloads.  The record also
+    carries that entry's validated ``settings`` (e.g. the configured
+    horizon) so service handlers read horizon days off it rather than
+    re-reading HA config.
     """
     for runtime_data in hass.data.get(DOMAIN, {}).values():
-        if getattr(runtime_data, "coordinator", None) is not None:
+        database = getattr(runtime_data, "database", None)
+        if database is not None and database.connected:
             return runtime_data
     return None
 
 
-def _register_services(hass: HomeAssistant) -> None:
-    """Register the domain-global NestQuest service once.
+def _make_regenerate_handler(hass: HomeAssistant):
+    """Return the Feature 07 ``regenerate`` handler closed over ``hass``."""
 
-    The service is DOMAIN-global — registered exactly once (guarded by
-    ``has_service``) and NOT bound to any config entry — so the panel
-    completion proxy resolves the currently-live runtime at call time
+    async def _regenerate(_call: Any) -> None:
+        runtime_data = _find_live_runtime_data(hass)
+        if runtime_data is None:
+            _LOGGER.warning(
+                "NestQuest regenerate requested but no config entry has a "
+                "live database; ignoring"
+            )
+            return
+        await _run_horizon_materialization(
+            hass, runtime_data.database, runtime_data.settings
+        )
+
+    return _regenerate
+
+
+def _register_services(hass: HomeAssistant) -> None:
+    """Register domain-global NestQuest services once.
+
+    Services are DOMAIN-global — registered exactly once (guarded by
+    ``has_service`` on regenerate) and NOT bound to any config entry —
+    so each handler resolves the currently-live database at call time
     and a name collision or duplicate setup is impossible.  Removal is
     handled by the unload path only once the LAST entry is removed
     (see :func:`_deregister_services`).
     """
-    async_register_services(hass, find_runtime=_find_live_runtime_data)
+    async_register_services(
+        hass,
+        find_runtime=_find_live_runtime_data,
+        regenerate_handler=_make_regenerate_handler(hass),
+    )
 
 
 def _deregister_services(hass: HomeAssistant) -> None:
@@ -89,14 +388,48 @@ async def async_setup(hass: HomeAssistant, config: dict[str, Any]) -> bool:
 async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
     """Set up NestQuest from a config entry."""
     await async_register_frontend(hass)
-    # The zero-config panel dashboard (Feature 20): register the
-    # storage-mode strategy dashboard if no dashboard under the stable
-    # url_path exists yet.  Unavailability of the Lovelace dashboards
-    # collection (YAML mode, lovelace not loaded) logs a warning and
-    # NEVER fails setup; an existing dashboard — ours or the user's —
-    # is left untouched, so a reload cannot duplicate it.
-    await async_register_dashboard(hass)
     hass.data.setdefault(DOMAIN, {})
+    existing = hass.data[DOMAIN].get(entry.entry_id)
+    if existing is not None:
+        db = getattr(existing, "database", None)
+        if db is None or not db.connected:
+            # Reopen through the SAME safety path as first setup: a
+            # record without a live connection (a previous setup's
+            # close-on-failure, or a hand-replaced file) must get the
+            # missing/valid/corrupt classification too, never a raw
+            # sqlite3 error and never skipped migrations — and the
+            # same allowlist seeding, so a reopened fresh file is
+            # never ownerless.
+            db = await _async_open_database(
+                hass, await async_get_db_path(hass)
+            )
+            try:
+                stored_admin_ids = (
+                    entry.options.get(CONF_ADMIN_USER_IDS)
+                    or entry.data.get(CONF_ADMIN_USER_IDS)
+                )
+                context = getattr(entry, "context", None)
+                context_user_id = (
+                    context.get("user_id")
+                    if isinstance(context, dict)
+                    else None
+                )
+                await seed_setup_admin(
+                    db,
+                    stored_admin_ids=stored_admin_ids,
+                    context_user_id=context_user_id,
+                    owner_ids=await _async_owner_user_ids(hass),
+                )
+            except BaseException:
+                # A seeding failure must not leak the just-opened
+                # connection: close it before the error propagates, so
+                # HA's setup retry starts from a clean handle (the
+                # first-setup path closes symmetrically).
+                await db.close()
+                raise
+            existing.database = db
+        entry.runtime_data = existing
+        return True
 
     async def _async_update_listener(
         listener_hass: HomeAssistant, listener_entry: ConfigEntry
@@ -104,23 +437,80 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
         """Reload the entry when its options change."""
         await listener_hass.config_entries.async_reload(listener_entry.entry_id)
 
+    database = await _async_open_database(hass, await async_get_db_path(hass))
     remove_update_listener: Callable[[], Any] | None = None
+    remove_time_change_listener: Callable[[], Any] | None = None
     coordinator: Any = None
     event_stream: NestQuestEventStream | None = None
     try:
+        # Seed the admin allowlist on first setup so the owner is never
+        # locked out: an empty database takes the persisted admin copy
+        # — the options flow's saved list first (it is the current
+        # one), else the config flow's user from entry data — and only
+        # then the HA user still present on the entry context.  No-op
+        # on a non-empty list (fail-closed narrowing is deliberate).
+        stored_admin_ids = (
+            entry.options.get(CONF_ADMIN_USER_IDS)
+            or entry.data.get(CONF_ADMIN_USER_IDS)
+        )
+        context = getattr(entry, "context", None)
+        context_user_id = (
+            context.get("user_id")
+            if isinstance(context, dict)
+            else None
+        )
+        owner_ids = await _async_owner_user_ids(hass)
+        await seed_setup_admin(
+            database,
+            stored_admin_ids=stored_admin_ids,
+            context_user_id=context_user_id,
+            owner_ids=owner_ids,
+        )
+        # Build the explicit settings object from entry.options ONCE: the
+        # horizon materialization and the daily-rollover listener both
+        # consume it, so core never reads HA config itself.  A malformed
+        # stored option falls back PER FIELD (via from_options_resilient)
+        # so a single bad sibling option cannot reset the user's
+        # horizon_days or day_rollover_time — the two fields core
+        # consumes — to their defaults.
+        settings = NestQuestSettings.from_options_resilient(entry.options)
         remove_update_listener = entry.add_update_listener(_async_update_listener)
+        remove_time_change_listener = _register_day_rollover_listener(
+            hass, database, settings
+        )
+        # Backfill any days the daily listener missed while the integration
+        # was off (or freshly installed): run the one idempotent walk over
+        # [today, today + horizon_days] once at setup, using the entry's
+        # configured horizon.  This runs through the SAME path as the daily
+        # listener and regenerate service.
+        await _run_horizon_materialization(hass, database, settings)
+        # The missed sweep runs at startup too (Feature 11): if HA was
+        # down at the rollover time, the previous night's still-open
+        # quests are announced as missed now instead of waiting for
+        # the next midnight.  Watermark-guarded, so this is a no-op
+        # when the night's sweep already ran.
+        await run_missed_sweep(hass, database)
         _register_services(hass)
+        # The shared Feature 10 coordinator: one refresh cycle every
+        # entity reads from (CONF_UPDATE_INTERVAL seconds, default
+        # five minutes).  Since Feature 18 it polls the API service's
+        # panel snapshot instead of reading the local database; an
+        # entry with no panel token yet gets the typed-error stub
+        # (unavailable entities, never a setup crash).  Created AFTER
+        # services so a failure below unwinds them through the except
+        # path's listener handling.
         # ONE API client for the entry, shared by the coordinator's
-        # snapshot polling, the SSE subscription, and the completion
-        # proxy (the client is stateless — one session, one connection
-        # pool).  An entry with no panel token yet gets the
-        # typed-error stub (unavailable entities, never a setup crash).
+        # snapshot polling and the SSE subscription below (the client
+        # is stateless — one session, one connection pool).
         api_client = coordinator_client_from_entry(hass, entry)
-        # The shared coordinator: one refresh cycle every entity reads
-        # from (CONF_UPDATE_INTERVAL seconds, default five minutes).
-        # It polls the API service's panel snapshot; a failed poll
-        # keeps the entities rendering the last-good snapshot within
-        # CONF_SNAPSHOT_STALENESS, unavailable past it.
+        # The shared Feature 10 coordinator: one refresh cycle every
+        # entity reads from (CONF_UPDATE_INTERVAL seconds, default
+        # five minutes).  Since Feature 18 it polls the API service's
+        # panel snapshot instead of reading the local database; an
+        # entry with no panel token yet gets the typed-error stub
+        # (unavailable entities, never a setup crash).  Created AFTER
+        # services so a failure below unwinds them through the except
+        # path's listener handling.
         coordinator = NestQuestCoordinator(
             hass,
             entry_id=entry.entry_id,
@@ -128,9 +518,6 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
             update_interval_seconds=entry.options.get(
                 CONF_UPDATE_INTERVAL, DEFAULT_UPDATE_INTERVAL
             ),
-            staleness_seconds=entry.options.get(
-                CONF_SNAPSHOT_STALENESS, DEFAULT_SNAPSHOT_STALENESS
-            ),
         )
         # The panel event subscription (the SSE task): a background
         # task consumes the API service's transition-event stream and
@@ -145,16 +532,20 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
             event_stream.start()
         runtime_data = NestQuestRuntimeData(
             entry_id=entry.entry_id,
+            settings=settings,
+            database=database,
             remove_update_listener=remove_update_listener,
+            remove_time_change_listener=remove_time_change_listener,
             coordinator=coordinator,
             event_stream=event_stream,
         )
         # The runtime record is registered BEFORE the first refresh:
-        # the service proxy resolves the entry's runtime state through
-        # hass.data, and it must find the live coordinator there —
-        # never a half-set-up entry.  The platforms forward below reads
-        # the coordinator off the entry (the HA runtime-data contract);
-        # a forward failure below unwinds it through the except path.
+        # the refresh path (and anything it calls) resolves the entry's
+        # runtime state through hass.data, and it must find the live
+        # database there — never a half-set-up entry.  The platforms
+        # forward below reads the coordinator off the entry
+        # (the HA runtime-data contract); a forward failure below
+        # unwinds it through the except path.
         hass.data[DOMAIN][entry.entry_id] = runtime_data
         entry.runtime_data = runtime_data
         # The first refresh polls the API snapshot; an API failure
@@ -174,24 +565,35 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
             pass
         await hass.config_entries.async_forward_entry_setups(entry, PLATFORMS)
     except BaseException:
-        # A failure anywhere after the listener was registered must not
-        # leak it (or the SSE task): unwind EVERYTHING acquired before
-        # the failure, keeping the original error as the one raised.
-        # Removal is best-effort — a failing step must not mask the
-        # setup error that triggered it.
+        # A failure anywhere after the database is open must not leak the
+        # listeners already registered against that (now-closed) database:
+        # unwind EVERY remover we acquired before the failure, keeping the
+        # original error as the one raised.  Removal is best-effort — a
+        # failing remover must not mask the setup error that triggered it.
+        # The SSE subscription (started just before the runtime record)
+        # is stopped first: like the coordinator it must never outlive
+        # the database being closed below.
         if event_stream is not None:
             try:
                 await event_stream.stop()
             except BaseException:
                 pass
-        if remove_update_listener is not None:
+        for remove_listener in (
+            remove_time_change_listener,
+            remove_update_listener,
+        ):
+            if remove_listener is None:
+                continue
             try:
-                remove_update_listener()
+                result = remove_listener()
+                if inspect.isawaitable(result):
+                    await result
             except BaseException:
                 pass
         # A coordinator created before the failure holds entity
-        # listeners pointed at the never-registered runtime — shut it
-        # down so no scheduled refresh outlives the failed setup.
+        # listeners pointed at the database being closed below —
+        # shut it down FIRST so no scheduled refresh can ever run
+        # against a closed connection.
         if coordinator is not None:
             try:
                 await coordinator.async_shutdown()
@@ -199,8 +601,7 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
                 pass
         # A platform-forward failure reached this unwind AFTER
         # runtime_data was assigned: clear it so no later unload path
-        # re-invokes the already-consumed update-listener remover
-        # through the stale record.
+        # closes the already-closed database through the stale record.
         if getattr(entry, "runtime_data", None) is not None:
             entry.runtime_data = None
         # The runtime record was ALSO registered in hass.data before
@@ -209,7 +610,10 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
         # (hass.data wins over entry.runtime_data there) and
         # re-invokes the already-consumed update-listener remover.
         hass.data.get(DOMAIN, {}).pop(entry.entry_id, None)
+        await database.close()
         raise
+    assert remove_update_listener is not None
+    assert remove_time_change_listener is not None
     # The runtime record was already registered before the first
     # refresh; re-assert the (unchanged) record so the return path
     # stays readable as one registration site.
@@ -227,17 +631,17 @@ async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
     if runtime_data is None:
         runtime_data = getattr(entry, "runtime_data", None)
     # Platforms unload FIRST (mirroring HA conventions): entity
-    # listeners must not outlive the coordinator the teardown below
-    # shuts down.
+    # listeners must not outlive the database and coordinator the
+    # teardown below closes.
     platforms_unloaded = await hass.config_entries.async_unload_platforms(
         entry, PLATFORMS
     )
     if platforms_unloaded is False and runtime_data is not None:
         # Home Assistant KEPT one or more platforms loaded — their
-        # entities still live and must keep their coordinator.  Restore
+        # entities still live and must keep their database.  Restore
         # the runtime record popped above and report failure so HA
         # retries the unload later instead of leaving live entities
-        # backed by a torn-down coordinator.
+        # backed by a closed database.
         hass.data.setdefault(DOMAIN, {})[entry.entry_id] = runtime_data
         return False
     unload_error: BaseException | None = None
@@ -249,28 +653,43 @@ async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
             stop_stream = getattr(event_stream, "stop", None)
             if stop_stream is not None:
                 await stop_stream()
-        remove_update_listener = getattr(
-            runtime_data, "remove_update_listener", None
+        remove_update_listener = getattr(runtime_data, "remove_update_listener", None)
+        remove_time_change_listener = getattr(
+            runtime_data, "remove_time_change_listener", None
         )
         try:
-            if remove_update_listener is not None:
-                result = remove_update_listener()
-                if inspect.isawaitable(result):
-                    await result
-        except BaseException as err:
-            # A failing remover must not skip the coordinator shutdown
-            # below; the first error is retained and re-raised only
-            # after the teardown ran.
-            if unload_error is None:
-                unload_error = err
+            for remove_listener in (
+                remove_update_listener,
+                remove_time_change_listener,
+            ):
+                if remove_listener is None:
+                    continue
+                try:
+                    result = remove_listener()
+                    if inspect.isawaitable(result):
+                        await result
+                except BaseException as err:
+                    # Cancel EVERY listener even when an earlier remover
+                    # raises: a skipped remover would leave a daily
+                    # callback firing against a closed database after
+                    # unload.  The first error is retained and re-raised
+                    # only after both removers (and the DB close) ran.
+                    if unload_error is None:
+                        unload_error = err
         finally:
-            # The coordinator's entity listeners must stop here: a
-            # scheduled refresh must never outlive the unload.
+            # The coordinator's entity listeners must stop BEFORE the
+            # database closes: a scheduled refresh starting during the
+            # close await would touch a cleared connection.  (The
+            # platform unload above already removed the entities; this
+            # clears the coordinator's own remaining listeners.)
             coordinator = getattr(runtime_data, "coordinator", None)
             if coordinator is not None:
                 shutdown = getattr(coordinator, "async_shutdown", None)
                 if shutdown is not None:
                     await shutdown()
+            database = getattr(runtime_data, "database", None)
+            if database is not None:
+                await database.close()
     # Domain-global services are torn down only once the FINAL entry
     # unloads (``hass.data[DOMAIN]`` is now empty), never when a sibling
     # entry is still loaded.

custom_components/nestquest/admin_allowlist.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.admin_allowlist` for the integration package.
+
+The admin allowlist business layer lives in
+:mod:`custom_components.nestquest.core.admin_allowlist` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .admin_allowlist import ...`` references inside the integration
+keep working.
+"""
+from __future__ import annotations
+
+from .core.admin_allowlist import *  # noqa: F401,F403

custom_components/nestquest/children.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.children` for the integration package.
+
+The children registry business layer lives in
+:mod:`custom_components.nestquest.core.children` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .children import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.children import *  # noqa: F401,F403

custom_components/nestquest/completion.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.completion` for the integration package.
+
+The completion business layer lives in
+:mod:`custom_components.nestquest.core.completion` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .completion import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.completion import *  # noqa: F401,F403

custom_components/nestquest/config_flow.py

@@ -7,7 +7,7 @@ from homeassistant import config_entries
 from homeassistant.core import callback
 from homeassistant.data_entry_flow import FlowResult
 
-from .const import DOMAIN
+from .const import CONF_ADMIN_USER_IDS, DOMAIN
 
 
 class NestQuestConfigFlow(config_entries.ConfigFlow, domain=DOMAIN):
@@ -30,11 +30,11 @@ class NestQuestConfigFlow(config_entries.ConfigFlow, domain=DOMAIN):
     ) -> FlowResult:
         """Handle the user step of the config flow.
 
-        The integration needs no configuration to start (the API
-        connection is set in the options flow), so the user input is
-        stored as-is.  The former admin-allowlist copy is gone: with
-        the database removed the allowlist lives in the API service's
-        own store, not on the entry.
+        The HA user completing the flow is persisted into the entry
+        data as the initial admin allowlist copy: real HA does not
+        guarantee the flow context survives to setup, and entry data is
+        the persisted record first setup seeds from — the owner is
+        never locked out.
         """
         await self.async_set_unique_id(DOMAIN, raise_on_progress=False)
         if self._async_in_progress() or self._async_current_entries():
@@ -43,4 +43,12 @@ class NestQuestConfigFlow(config_entries.ConfigFlow, domain=DOMAIN):
         if user_input is None:
             return self.async_show_form(step_id="user")
 
-        return self.async_create_entry(title="NestQuest", data=dict(user_input))
+        data = dict(user_input)
+        flow_user_id = (
+            self.context.get("user_id")
+            if isinstance(self.context, dict)
+            else None
+        )
+        if flow_user_id:
+            data[CONF_ADMIN_USER_IDS] = [flow_user_id]
+        return self.async_create_entry(title="NestQuest", data=data)

custom_components/nestquest/coordinator.py

@@ -43,24 +43,11 @@ conversion matters at setup: HA's real
 ``async_config_entry_first_refresh`` wraps any failed pass in
 ``ConfigEntryNotReady``, so a setup that keys on the original
 exception type would never match it.)
-
-Last-good cache and staleness: every successful pass refreshes a cache
-of the rebuilt snapshot stamped with the :func:`time.monotonic`
-instant of the success.  A typed failure is checked against that stamp
-BEFORE the pass is declared failed: within the configured staleness
-threshold (``CONF_SNAPSHOT_STALENESS``, seconds, default three update
-intervals) the pass SUCCEEDS with the cached snapshot — the panel
-keeps rendering last-good data and the entities stay available — and
-the outage is logged as a warning.  Entities go unavailable only once
-the cache is older than the threshold (or before the first success);
-a later successful fetch refreshes the cache and the entities recover
-on their own, without a config-entry reload.
 """
 from __future__ import annotations
 
 import asyncio
 import datetime
-import time
 from typing import Any
 
 from homeassistant.core import HomeAssistant
@@ -72,7 +59,6 @@ from homeassistant.helpers.update_coordinator import (
 from .api_client import NestQuestApiClient, NestQuestApiError, resolve_api_config
 from .const import (
     CONF_UPDATE_INTERVAL,
-    DEFAULT_SNAPSHOT_STALENESS,
     DEFAULT_UPDATE_INTERVAL,
     DOMAIN,
     LOGGER,
@@ -190,17 +176,6 @@ class _UnconfiguredApiClient:
         )
 
 
-def _monotonic() -> float:
-    """The monotonic clock the staleness math reads.
-
-    A one-line indirection over :func:`time.monotonic` so the staleness
-    tests can drive the clock deterministically (patch THIS function,
-    never the stdlib clock).  Monotonic is deliberate: wall-clock jumps
-    (NTP corrections, suspends) must not shorten or extend the window.
-    """
-    return time.monotonic()
-
-
 class NestQuestCoordinator(DataUpdateCoordinator):
     """Shared refresh cycle for every NestQuest entity.
 
@@ -224,15 +199,6 @@ class NestQuestCoordinator(DataUpdateCoordinator):
     newer one and leave entities wrong until the next poll.  Real
     HA's coordinator already serializes internally; the lock keeps
     the same guarantee on the stand-in and costs nothing upstream.
-
-    Last-good cache: a successful pass stamps the rebuilt snapshot
-    with the :func:`~.coordinator._monotonic` instant of the success;
-    a typed failure within the configured staleness threshold
-    (``staleness_seconds``, from ``CONF_SNAPSHOT_STALENESS``) serves
-    that cached snapshot instead of failing the pass, so a short API
-    outage keeps the board up.  Past the threshold — or before the
-    first success — the pass fails as above, and a later successful
-    pass refreshes the cache and recovers the entities on its own.
     """
 
     def __init__(
@@ -242,7 +208,6 @@ class NestQuestCoordinator(DataUpdateCoordinator):
         entry_id: str,
         api_client: NestQuestApiClient,
         update_interval_seconds: int | None = None,
-        staleness_seconds: int | None = None,
     ) -> None:
         interval = update_interval_seconds
         if (
@@ -251,19 +216,6 @@ class NestQuestCoordinator(DataUpdateCoordinator):
             or interval < MIN_UPDATE_INTERVAL
         ):
             interval = DEFAULT_UPDATE_INTERVAL
-        staleness = staleness_seconds
-        if (
-            not isinstance(staleness, int)
-            or isinstance(staleness, bool)
-            or staleness < interval
-        ):
-            # A missing or nonsensical threshold falls back to the
-            # shipped default; a configured-but-too-short one (below
-            # even one poll interval) falls back to whichever of
-            # default/interval spans at least one failed poll, so the
-            # cache is never dead on arrival.  (The options flow
-            # validates the same rule at the form.)
-            staleness = max(DEFAULT_SNAPSHOT_STALENESS, interval)
         super().__init__(
             hass,
             LOGGER,
@@ -273,14 +225,6 @@ class NestQuestCoordinator(DataUpdateCoordinator):
         self.entry_id = entry_id
         self.api_client = api_client
         self._refresh_lock = asyncio.Lock()
-        #: The configured last-good window, in SECONDS (const.py:
-        #: CONF_SNAPSHOT_STALENESS / DEFAULT_SNAPSHOT_STALENESS).
-        self._staleness_seconds = staleness
-        #: The last-good cache: the snapshot from the most recent
-        #: SUCCESSFUL fetch and the :func:`time.monotonic` instant it
-        #: landed.  Both stay None until the first success.
-        self._last_good_snapshot: NestQuestSnapshot | None = None
-        self._last_good_monotonic: float | None = None
 
     async def async_refresh(self) -> None:
         """One refresh at a time; a queued refresh runs AFTER the
@@ -292,19 +236,8 @@ class NestQuestCoordinator(DataUpdateCoordinator):
     async def _async_update_data(self) -> NestQuestSnapshot:
         """One refresh pass: fetch the panel snapshot and rebuild it.
 
-        A successful pass rebuilds the snapshot and refreshes the
-        last-good cache (the snapshot plus the
-        :func:`time.monotonic` instant of the success).
-
         A typed API failure (unconfigured token stub, transport
-        failure, non-2xx response) is first checked against that
-        stamp: WITHIN the configured staleness threshold (elapsed time
-        since the last successful fetch, inclusive of the threshold
-        itself) the pass SUCCEEDS with the cached snapshot — the panel
-        keeps rendering last-good data, the entities stay available —
-        and the outage is logged as a clear warning (never silent).
-        With no cache yet, or past the threshold, the typed error is
-        converted to
+        failure, non-2xx response) is converted to
         :class:`~homeassistant.helpers.update_coordinator.UpdateFailed`
         — the exception HA's coordinator machinery records as a failed
         pass (``last_update_success = False``, ``data`` unchanged) so
@@ -315,31 +248,11 @@ class NestQuestCoordinator(DataUpdateCoordinator):
         try:
             payload = await self.api_client.get_snapshot()
         except NestQuestApiError as err:
-            now = _monotonic()
-            cached = self._last_good_snapshot
-            fetched_at = self._last_good_monotonic
-            if (
-                cached is not None
-                and fetched_at is not None
-                and now - fetched_at <= self._staleness_seconds
-            ):
-                LOGGER.warning(
-                    "NestQuest API refresh failed (%s); serving the "
-                    "last-good snapshot fetched %.0f s ago, within the "
-                    "%d s staleness threshold",
-                    err,
-                    now - fetched_at,
-                    self._staleness_seconds,
-                )
-                return cached
             LOGGER.error(
                 "NestQuest coordinator refresh failed: %s", err
             )
             raise UpdateFailed(str(err)) from err
-        snapshot = snapshot_from_api_payload(payload)
-        self._last_good_snapshot = snapshot
-        self._last_good_monotonic = _monotonic()
-        return snapshot
+        return snapshot_from_api_payload(payload)
 
 
 def coordinator_client_from_entry(

custom_components/nestquest/core/const.py

@@ -20,41 +20,44 @@ TIME_PATTERN = re.compile(r"(?:[01]\d|2[0-3]):[0-5]\d")
 PLATFORMS: list[str] = ["sensor", "binary_sensor"]
 
 # Home Assistant bus events (design/ENTITIES-AND-SERVICES.md §3).  The
-# panel and admin cards listen for these; since Feature 18 the
-# completed/uncompleted/day-complete transitions are published by the
-# API service on its SSE stream and re-fired on the bus by the
-# integration's subscription, and Feature 11's nightly sweep fires
-# quest_missed.
+# panel and admin cards listen for these; Feature 10 fires completed,
+# uncompleted, and child_day_complete from the service paths, and
+# Feature 11's nightly sweep fires quest_missed.
 EVENT_QUEST_COMPLETED = "nestquest_quest_completed"
 EVENT_QUEST_UNCOMPLETED = "nestquest_quest_uncompleted"
 EVENT_QUEST_MISSED = "nestquest_quest_missed"
 EVENT_CHILD_DAY_COMPLETE = "nestquest_child_day_complete"
 
-#: Canonical domain-global service name (design/ENTITIES-AND-SERVICES.md §2).
-#: Since Feature 18 only the panel completion service remains: the admin
-#: surface is the PWA and the API service's admin routes, so the former
-#: HA admin services (uncomplete, quest-definition and presence
-#: management, CSV export, child management, regenerate) are gone.
+#: Canonical domain-global service names (design/ENTITIES-AND-SERVICES.md §2
+#: plus the existing Feature 07 regenerate service).
 SERVICE_COMPLETE_QUEST = "complete_quest"
+SERVICE_UNCOMPLETE_QUEST = "uncomplete_quest"
+SERVICE_CREATE_QUEST_DEFINITION = "create_quest_definition"
+SERVICE_UPDATE_QUEST_DEFINITION = "update_quest_definition"
+SERVICE_SET_QUEST_DEFINITION_ACTIVE = "set_quest_definition_active"
+SERVICE_SET_PRESENCE_PATTERN = "set_presence_pattern"
+SERVICE_CREATE_PRESENCE_OVERRIDE = "create_presence_override"
+SERVICE_DELETE_PRESENCE_OVERRIDE = "delete_presence_override"
+SERVICE_EXPORT_HISTORY_CSV = "export_history_csv"
+SERVICE_MANAGE_CHILD = "manage_child"
+SERVICE_REGENERATE = "regenerate"
 
 DOMAIN_SERVICES: tuple[str, ...] = (
     SERVICE_COMPLETE_QUEST,
+    SERVICE_UNCOMPLETE_QUEST,
+    SERVICE_CREATE_QUEST_DEFINITION,
+    SERVICE_UPDATE_QUEST_DEFINITION,
+    SERVICE_SET_QUEST_DEFINITION_ACTIVE,
+    SERVICE_SET_PRESENCE_PATTERN,
+    SERVICE_CREATE_PRESENCE_OVERRIDE,
+    SERVICE_DELETE_PRESENCE_OVERRIDE,
+    SERVICE_EXPORT_HISTORY_CSV,
+    SERVICE_MANAGE_CHILD,
+    SERVICE_REGENERATE,
 )
 
 SQLITE_DB_FILENAME = "nestquest.db"
 
-# Zero-config panel dashboard (Feature 20): ONE storage-mode Lovelace
-# dashboard registered on setup whose config carries the bundle's
-# ``custom:nestquest-party`` strategy (frontend/src/strategy.ts) — the
-# views are generated at render time from the household roster.  The
-# url_path IS the domain: the stable key idempotency is keyed on (a
-# reload or a second entry never duplicates it, and a dashboard already
-# registered under it — ours or the user's — is left untouched).
-DASHBOARD_URL_PATH = DOMAIN
-DASHBOARD_TITLE = "NestQuest"
-DASHBOARD_ICON = "mdi:party-popper"
-DASHBOARD_STRATEGY_TYPE = "custom:nestquest-party"
-
 # Configuration keys and default values
 CONF_HORIZON_DAYS = "horizon_days"
 DEFAULT_HORIZON_DAYS = 14
@@ -78,21 +81,6 @@ CONF_UPDATE_INTERVAL = "update_interval"
 DEFAULT_UPDATE_INTERVAL = 300
 MIN_UPDATE_INTERVAL = 30
 
-# Last-good snapshot staleness (Feature 18), in SECONDS: how long the
-# coordinator keeps SERVING the last good snapshot after the API stops
-# answering.  A failed poll whose elapsed time since the last successful
-# fetch is within the threshold returns the cached snapshot (the panel
-# keeps rendering last-good data, entities stay available); past it the
-# poll fails the HA way and the entities go unavailable.  The default is
-# 3x the default update interval (900 s = 15 minutes): three consecutive
-# failed five-minute polls before the board is declared stale — enough
-# to ride out an API service restart, short enough not to render a
-# days-old board all day.  Validation floor: the threshold must be at
-# least the configured update interval, or the cache could never span
-# even one failed poll.
-CONF_SNAPSHOT_STALENESS = "snapshot_staleness"
-DEFAULT_SNAPSHOT_STALENESS = 3 * DEFAULT_UPDATE_INTERVAL
-
 # Notification automations (Feature 11).  The notify target is a free-text
 # Home Assistant service name (e.g. "notify.mobile_app_dads_phone") the
 # household fills in — never a hard-coded personal target; the times are

custom_components/nestquest/core/dao_meta.py

@@ -41,38 +41,4 @@ class MetaStateDao:
                     f"INSERT INTO {_TABLE} (key, value) VALUES (?, ?) "
                     "ON CONFLICT (key) DO UPDATE SET value = excluded.value",
                     (key, value),
-                )
-
-    async def claim(self, key: str, value: str) -> bool:
-        """Atomically set ``key`` to ``value`` unless it already is.
-
-        The single upsert statement carries a ``WHERE`` guard on the
-        conflict path (``t.value IS NOT excluded.value``), so the
-        read-compare-write is ONE SQLite statement — atomic at the
-        DATABASE level, not just within one process: two connections
-        (two processes sharing one SQLite file) cannot both observe
-        "not yet set" and both write, because the second writer's
-        statement re-evaluates the guard against the first writer's
-        committed value and matches zero rows.
-
-        Returns True only when THIS call changed the row: the first
-        claimant wins and every later claimant of the same value
-        returns False.  A DIFFERENT value always wins (an advance, e.g.
-        the sweep watermark moving to a new date) and re-arms the
-        same-value loser check for the new value.
-
-        Runs under the shared connection lock and inside one
-        transaction, like :meth:`set`; ``cursor.rowcount`` (1 for a
-        matched write, 0 for a guarded no-op) is captured by the
-        wrapper on the executor thread, so no sqlite3 object crosses
-        back to the event loop.
-        """
-        async with _connection_lock(self._database):
-            async with self._database.transaction():
-                result = await self._database.execute(
-                    f"INSERT INTO {_TABLE} (key, value) VALUES (?, ?) "
-                    "ON CONFLICT (key) DO UPDATE SET value = excluded.value "
-                    f"WHERE {_TABLE}.value IS NOT excluded.value",
-                    (key, value),
-                )
-        return result.rowcount == 1
+                )

custom_components/nestquest/core/service_policy.py

@@ -0,0 +1,46 @@
+"""Explicit admin-only versus open service registry (Feature 09).
+
+One mapping, one file: every registered ``nestquest`` service name is
+either ``open`` or ``admin_only``.  The permission decorator (later
+Feature 09 tasks) reads this table; it does not take per-handler
+policy arguments.
+"""
+from __future__ import annotations
+
+from .const import (
+    DOMAIN_SERVICES,
+    SERVICE_COMPLETE_QUEST,
+    SERVICE_CREATE_PRESENCE_OVERRIDE,
+    SERVICE_CREATE_QUEST_DEFINITION,
+    SERVICE_DELETE_PRESENCE_OVERRIDE,
+    SERVICE_EXPORT_HISTORY_CSV,
+    SERVICE_MANAGE_CHILD,
+    SERVICE_REGENERATE,
+    SERVICE_SET_PRESENCE_PATTERN,
+    SERVICE_SET_QUEST_DEFINITION_ACTIVE,
+    SERVICE_UNCOMPLETE_QUEST,
+    SERVICE_UPDATE_QUEST_DEFINITION,
+)
+
+OPEN = "open"
+ADMIN_ONLY = "admin_only"
+
+SERVICE_POLICY: dict[str, str] = {
+    SERVICE_COMPLETE_QUEST: OPEN,
+    SERVICE_UNCOMPLETE_QUEST: ADMIN_ONLY,
+    SERVICE_CREATE_QUEST_DEFINITION: ADMIN_ONLY,
+    SERVICE_UPDATE_QUEST_DEFINITION: ADMIN_ONLY,
+    SERVICE_SET_QUEST_DEFINITION_ACTIVE: ADMIN_ONLY,
+    SERVICE_SET_PRESENCE_PATTERN: ADMIN_ONLY,
+    SERVICE_CREATE_PRESENCE_OVERRIDE: ADMIN_ONLY,
+    SERVICE_DELETE_PRESENCE_OVERRIDE: ADMIN_ONLY,
+    SERVICE_EXPORT_HISTORY_CSV: ADMIN_ONLY,
+    SERVICE_MANAGE_CHILD: ADMIN_ONLY,
+    SERVICE_REGENERATE: ADMIN_ONLY,
+}
+
+if frozenset(SERVICE_POLICY) != frozenset(DOMAIN_SERVICES):
+    raise RuntimeError(
+        "SERVICE_POLICY must name exactly the registered nestquest services, "
+        f"got {sorted(SERVICE_POLICY)} vs {list(DOMAIN_SERVICES)}"
+    )

custom_components/nestquest/core/sweep.py

@@ -26,17 +26,12 @@ later completed simply gains its completion event; history keeps both
 rows (append-only), and the sweep's later runs skip it via the
 no-completion-event rule.
 
-The whole watermark read → query → build span runs inside the
+The whole watermark read → query → build → write span runs inside the
 per-database sweep lock (one lock per connection wrapper and running
 loop, the settings store's pattern): an overlapping startup sweep and
-a rollover sweep of the SAME process queue instead of interleaving.
-The announce decision itself is the DATABASE-level claim
-(:meth:`MetaStateDao.claim`), so two PROCESSES sharing one SQLite file
-(the integration's rollover sweep and the API service's scheduler)
-cannot both announce the same missed batch either: both may read the
-old watermark and build the events, but the single conditional upsert
-lets exactly one of them win the claim — the loser returns [] and
-announces nothing.
+a rollover sweep queue instead of interleaving, and the loser re-reads
+the watermark INSIDE the lock — sees the winner's date — and announces
+nothing twice.
 
 The caller supplies ``today`` as a plain :class:`datetime.date`: the
 household-local calendar date, read from ``hass.config.time_zone`` by
@@ -65,11 +60,11 @@ LOGGER = logging.getLogger(__name__)
 SWEEP_WATERMARK_KEY = "missed_sweep_last_run_date"
 
 #: One asyncio.Lock per (connection wrapper, running loop), mirroring
-#: the settings store's pattern: the watermark read → query → build
-#: span is one critical section, so an overlapping startup sweep and
-#: rollover sweep of the SAME process queue instead of interleaving.
-#: Same-process callers are fully serialised by it; the cross-process
-#: case is closed by the database-level claim, not by this lock.
+#: the settings store's pattern: the whole watermark read → query →
+#: build → write span is one critical section, so an overlapping
+#: startup sweep and rollover sweep queue instead of double-announcing.
+#: The loser re-reads the watermark INSIDE the lock, sees the winner's
+#: date, and fires nothing.
 _SWEEP_LOCKS: dict[tuple[int, int], asyncio.Lock] = {}
 
 
@@ -104,24 +99,15 @@ async def run_missed_sweep(
     the caller decides how to publish them and announces nothing on
     its own.
 
-    The watermark read → query → build span runs inside the
-    per-database sweep lock, so overlapping callers of ONE process
-    queue instead of interleaving.  The announce decision is the
-    DATABASE-level claim (:meth:`MetaStateDao.claim` — a single
-    conditional upsert on the watermark, atomic across processes):
-    every caller builds the events optimistically, then only the
-    caller whose claim actually advanced the watermark returns them;
-    a loser (another process already announced for ``today``) returns
-    [] and announces nothing twice.  Every event in one run shares one
+    The whole watermark read → query → build → write span runs inside
+    the per-database sweep lock: an overlapping startup sweep and a
+    rollover sweep queue instead of interleaving, and the loser
+    re-reads the watermark inside the lock — sees the winner's date —
+    and announces nothing twice.  Every event in one run shares one
     ``occurred_at`` stamp (one run, one announcement moment), and the
     payload comes from the shared
     :func:`~.events._instance_payload` builder so the shape can never
     drift from the documented §3 contract.
-
-    Failure ordering: the watermark is advanced ONLY by the claim,
-    AFTER the events are fully built — a failure before the claim
-    leaves the watermark unadvanced, so a later run re-sweeps the same
-    window and nothing is lost.
     """
     today_iso = today.isoformat()
     dao = MetaStateDao(database)
@@ -148,23 +134,10 @@ async def run_missed_sweep(
                     ),
                 )
             )
-        # The database-level claim gates the announcement: only the
-        # caller that actually advanced the watermark may publish the
-        # built events, so two processes racing one SQLite file cannot
-        # both announce the same missed batch.  A same-value loser's
-        # claim matches zero rows and this run announces nothing.
-        claimed = await dao.claim(SWEEP_WATERMARK_KEY, today_iso)
-        if not claimed:
-            LOGGER.info(
-                "NestQuest missed sweep for %s lost the watermark claim; "
-                "announcing nothing",
-                today_iso,
-            )
-            return []
+        await dao.set(SWEEP_WATERMARK_KEY, today_iso)
     LOGGER.info(
         "NestQuest missed sweep for %s built %d event(s)",
         today_iso,
         len(events),
     )
     return events
-

custom_components/nestquest/dao_children.py

@@ -0,0 +1,12 @@
+"""Re-export of :mod:`custom_components.nestquest.core.dao_children` for the integration package.
+
+The children/admin DAO lives in
+:mod:`custom_components.nestquest.core.dao_children` (extracted in
+task d0b691d8); this module re-exports it so existing
+``from .dao_children import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.dao_children import *  # noqa: F401,F403
+from .core.dao_children import _CONNECTION_LOCKS, _connection_lock  # noqa: F401

custom_components/nestquest/dao_instances.py

@@ -0,0 +1,12 @@
+"""Re-export of :mod:`custom_components.nestquest.core.dao_instances` for the integration package.
+
+The instances/completion-events DAO lives in
+:mod:`custom_components.nestquest.core.dao_instances`
+(extracted in task d0b691d8); this module re-exports it so existing
+``from .dao_instances import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.dao_instances import *  # noqa: F401,F403
+from .core.dao_instances import _resolve_today  # noqa: F401

custom_components/nestquest/dao_meta.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.dao_meta` for the integration package.
+
+The meta-state DAO lives in
+:mod:`custom_components.nestquest.core.dao_meta` (extracted in task
+d0b691d8); this module re-exports it so existing
+``from .dao_meta import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.dao_meta import *  # noqa: F401,F403

custom_components/nestquest/dao_presence.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.dao_presence` for the integration package.
+
+The presence DAOs live in
+:mod:`custom_components.nestquest.core.dao_presence` (extracted in
+task d0b691d8); this module re-exports them so existing
+``from .dao_presence import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.dao_presence import *  # noqa: F401,F403

custom_components/nestquest/dao_rules.py

@@ -0,0 +1,17 @@
+"""Re-export of :mod:`custom_components.nestquest.core.dao_rules` for the integration package.
+
+The schedule-rules/quest-definitions DAO lives in
+:mod:`custom_components.nestquest.core.dao_rules` (extracted in task
+d0b691d8); this module re-exports it so existing
+``from .dao_rules import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.dao_rules import *  # noqa: F401,F403
+from .core.dao_rules import (  # noqa: F401
+    _UNSET,
+    _validate_date,
+    _validate_time,
+    _validate_window,
+)

custom_components/nestquest/dashboard.py

@@ -1,215 +0,0 @@
-"""Zero-config panel dashboard registration for NestQuest (Feature 20).
-
-On setup the integration registers ONE storage-mode Lovelace dashboard
-whose CONFIG uses the bundle's ``custom:nestquest-party`` strategy (see
-``frontend/src/strategy.ts``): the views themselves are GENERATED at
-render time from the household roster, so the stored dashboard config
-carries nothing but the strategy reference.
-
-Registration mirrors the REAL two-step sequence the lovelace
-integration itself uses when it creates the onboarding map dashboard
-(``homeassistant/components/lovelace/__init__.py``,
-``_create_map_dashboard``):
-
-1. create the dashboard METADATA through the ``DashboardsCollection``
-   (``hass.data["lovelace"]["dashboards_collection"]``) — url_path,
-   title, icon, sidebar visibility.  The strategy reference is NOT part
-   of the create payload: the collection's create schema allows only
-   the metadata fields, so a ``strategy`` key there fails the whole
-   create (this was the silent no-op the first implementation shipped).
-2. save the dashboard CONFIG — ``{"strategy": ...}`` — through the
-   per-url_path CONTENT manager that the collection's change listener
-   registers under ``hass.data["lovelace"]["dashboards"][url_path]``
-   (a ``LovelaceStorage``), exactly the second step HA performs.
-
-Registration is IDEMPOTENT — a dashboard already under the stable
-``url_path`` (ours or a user's) skips BOTH steps and its stored config
-is never overwritten — and the Lovelace surfaces being unavailable
-(YAML mode, lovelace not loaded) is a logged warning, never a setup
-failure.
-"""
-from __future__ import annotations
-
-import asyncio
-
-from homeassistant.core import HomeAssistant
-
-from .const import (
-    DASHBOARD_ICON,
-    DASHBOARD_STRATEGY_TYPE,
-    DASHBOARD_TITLE,
-    DASHBOARD_URL_PATH,
-    LOGGER,
-)
-
-_LOGGER = LOGGER
-
-# Single-flight guard for the check-then-create below: HA can set up
-# several config entries CONCURRENTLY, and two overlapping setups would
-# both pass the exists-check and race on the url_path create.  The lock
-# is per hass instance (kept as an attribute on the hass object, since
-# hass.data is the integrations' shared registry the unload path
-# empties) rather than one module-level asyncio.Lock — a bare
-# module-level lock binds to whichever event loop first awaits it and
-# raises RuntimeError on any other loop, while the race it must prevent
-# only exists between setups running on the SAME hass anyway.
-_REGISTRATION_LOCK_ATTR = "_nestquest_dashboard_registration_lock"
-
-
-def _registration_lock(hass: HomeAssistant) -> asyncio.Lock:
-    """Return the per-hass registration lock, creating it on first use."""
-    lock = getattr(hass, _REGISTRATION_LOCK_ATTR, None)
-    if lock is None:
-        lock = asyncio.Lock()
-        setattr(hass, _REGISTRATION_LOCK_ATTR, lock)
-    return lock
-
-
-def _lovelace_data(hass: HomeAssistant) -> dict | None:
-    """Return ``hass.data["lovelace"]`` when it is the real dict shape.
-
-    The lovelace integration stores a plain DICT of surfaces (``mode``,
-    ``dashboards``, ``dashboards_collection``, ``resources``,
-    ``yaml_dashboards``) under the ``lovelace`` key; anything else
-    (missing key, unexpected object) means the surfaces below cannot be
-    reached and registration must warn and continue.
-    """
-    lovelace_data = hass.data.get("lovelace")
-    if not isinstance(lovelace_data, dict):
-        return None
-    return lovelace_data
-
-
-def _dashboards_collection(hass: HomeAssistant):
-    """Return the Lovelace dashboards METADATA collection, or None.
-
-    The collection lives at ``hass.data["lovelace"]
-    ["dashboards_collection"]`` — NOT under ``["dashboards"]``, which
-    maps url_path to the per-dashboard CONTENT managers
-    (``LovelaceStorage``/``LovelaceYAML``).  A missing key (lovelace
-    not loaded) and a missing/None entry (YAML mode never sets the
-    collection) both mean "cannot create storage dashboards here" —
-    callers log and continue.  The presence of the surface is verified
-    by capability (``async_create_item`` callable), not by type, so no
-    lovelace import is needed.
-    """
-    lovelace_data = _lovelace_data(hass)
-    if lovelace_data is None:
-        return None
-    collection = lovelace_data.get("dashboards_collection")
-    if collection is None or not callable(
-        getattr(collection, "async_create_item", None)
-    ):
-        return None
-    return collection
-
-
-def _dashboard_store(hass: HomeAssistant, url_path: str):
-    """Return a url_path's dashboard CONTENT manager, or None.
-
-    After a metadata create, the collection's change listener registers
-    a ``LovelaceStorage`` for the new dashboard under
-    ``hass.data["lovelace"]["dashboards"][url_path]``; the dashboard
-    CONFIG (the strategy reference) is saved through THAT manager —
-    the second step of HA's own dashboard creation.
-    """
-    lovelace_data = _lovelace_data(hass)
-    if lovelace_data is None:
-        return None
-    dashboards = lovelace_data.get("dashboards")
-    if not isinstance(dashboards, dict):
-        return None
-    store = dashboards.get(url_path)
-    if store is None or not callable(getattr(store, "async_save", None)):
-        return None
-    return store
-
-
-def _item_url_path(item) -> str | None:
-    """Read a dashboard item's ``url_path`` through either access shape.
-
-    The collection hands back storage items as dicts while builtin
-    dashboards come back as config objects; the url_path is reachable
-    through ``item["url_path"]`` or ``item.url_path`` respectively.
-    """
-    url_path = getattr(item, "url_path", None)
-    if isinstance(url_path, str):
-        return url_path
-    get_url_path = getattr(item, "get", None)
-    if callable(get_url_path):
-        value = get_url_path("url_path")
-        if isinstance(value, str):
-            return value
-    return None
-
-
-def _existing_dashboard(items) -> bool:
-    """Whether a dashboard under the stable url_path already exists."""
-    return any(_item_url_path(item) == DASHBOARD_URL_PATH for item in items)
-
-
-async def async_register_dashboard(hass: HomeAssistant) -> bool:
-    """Register the NestQuest panel dashboard exactly once.
-
-    Returns True when a dashboard under the stable ``url_path`` exists
-    after the call (pre-existing or created here), False when the
-    Lovelace surfaces were unavailable or refused.  A dashboard already
-    registered under the stable ``url_path`` — whether ours from a
-    previous setup or a user's own — skips BOTH steps and is left
-    COMPLETELY alone: its stored config is never overwritten, it is
-    never deleted, never a duplicate.  The strategy config is saved
-    ONLY for the dashboard created in THIS call, whose fresh content
-    store is empty, so the save cannot clobber anything.
-    """
-    collection = _dashboards_collection(hass)
-    if collection is None:
-        _LOGGER.warning(
-            "Lovelace dashboards collection unavailable; the NestQuest "
-            "panel dashboard was not registered. Enable the Lovelace "
-            "integration in storage mode or create a dashboard with "
-            "strategy %s manually.",
-            DASHBOARD_STRATEGY_TYPE,
-        )
-        return False
-    try:
-        # Single-flight: two concurrent entry setups must not both pass
-        # the exists-check and race on the url_path create.
-        async with _registration_lock(hass):
-            # async_items() is a SYNC @callback on the real collection
-            # (helpers/collection.py ObservableCollection) — not awaited.
-            if _existing_dashboard(collection.async_items()):
-                return True
-            await collection.async_create_item(
-                {
-                    "url_path": DASHBOARD_URL_PATH,
-                    "title": DASHBOARD_TITLE,
-                    "icon": DASHBOARD_ICON,
-                    "show_in_sidebar": True,
-                    "allow_single_word": True,
-                }
-            )
-            # Step two (mirroring HA's _create_map_dashboard): the
-            # strategy CONFIG goes through the fresh dashboard's
-            # content manager, not through the metadata collection.
-            store = _dashboard_store(hass, DASHBOARD_URL_PATH)
-            if store is None:
-                _LOGGER.warning(
-                    "The NestQuest panel dashboard was registered but its "
-                    "Lovelace content manager never appeared; add the "
-                    "strategy %s to the dashboard manually.",
-                    DASHBOARD_STRATEGY_TYPE,
-                )
-                return False
-            await store.async_save(
-                {"strategy": {"type": DASHBOARD_STRATEGY_TYPE}}
-            )
-    except Exception:
-        _LOGGER.warning(
-            "Registering the NestQuest panel dashboard in the Lovelace "
-            "dashboards collection failed; set it up manually with "
-            "strategy %s.",
-            DASHBOARD_STRATEGY_TYPE,
-            exc_info=True,
-        )
-        return False
-    return True

custom_components/nestquest/db.py

@@ -0,0 +1,31 @@
+"""Re-export of :mod:`custom_components.nestquest.core.db` for the integration package.
+
+The async SQLite wrapper lives in :mod:`custom_components.nestquest.core.db` (extracted in task
+d0b691d8) and is Home-Assistant-free: :class:`NestQuestDatabase` takes
+an executor callable rather than a ``hass`` object.  This module
+re-exports it and provides :func:`make_database`, a thin adapter that
+constructs a wrapper backed by ``hass.async_add_executor_job``, so the
+integration constructs the database the same way it always did.
+"""
+from __future__ import annotations
+
+from typing import Any, TypeVar
+
+from homeassistant.core import HomeAssistant
+
+from .core.db import ExecutionResult, NestQuestDatabase
+
+__all__ = ["ExecutionResult", "NestQuestDatabase", "make_database"]
+
+T = TypeVar("T")
+
+
+def make_database(hass: HomeAssistant) -> NestQuestDatabase:
+    """Construct a :class:`NestQuestDatabase` wired to ``hass``'s executor.
+
+    Mirrors the pre-extraction ``NestQuestDatabase(hass)`` call: the
+    wrapper's executor is ``hass.async_add_executor_job``, so every
+    sqlite3 call runs on the HA executor thread and the event loop
+    never blocks.
+    """
+    return NestQuestDatabase(hass.async_add_executor_job)

custom_components/nestquest/events.py

@@ -0,0 +1,79 @@
+"""Re-export / HA wiring of :mod:`custom_components.nestquest.core.events` for the integration package.
+
+The transition-event payload construction lives in
+:mod:`custom_components.nestquest.core.events` (extracted in
+task 510c1f78) and is HA-free: it builds and RETURNS the events.  This
+shim keeps the integration's old ``fire_quest_completed`` /
+``fire_quest_uncompleted`` API (the complete/uncomplete service
+handlers call them with ``hass``), reads the HA-local timezone from
+``hass.config.time_zone`` to derive ``today``, asks the core builder
+for the events, and fires each on ``hass.bus`` with the documented
+payloads.  The four blueprints keep working with identical payloads.
+
+The completed event is fired BEFORE the day-complete rule evaluates:
+``fire_quest_completed`` asks
+:func:`build_quest_completed_event` for the completed event and fires
+it immediately, THEN reads the HA-local ``today``, asks
+:func:`build_child_day_complete_event` for the day-complete event, and
+fires it (if any) afterwards.  This restores the pre-extraction
+ordering — a failure in the day-complete DB reads or the ZoneInfo
+lookup cannot suppress the completed event.
+"""
+from __future__ import annotations
+
+import datetime
+from zoneinfo import ZoneInfo
+
+from .core.db import NestQuestDatabase
+from .core.events import (
+    build_child_day_complete_event,
+    build_quest_completed_event,
+    build_quest_uncompleted_events,
+)
+
+__all__ = ["fire_quest_completed", "fire_quest_uncompleted"]
+
+
+async def fire_quest_completed(
+    hass,
+    database: NestQuestDatabase,
+    instance_id: int,
+    *,
+    was_on_time: bool | None,
+) -> None:
+    """Fire ``nestquest_quest_completed`` and, when the completion
+    cleared the child's whole day, ``nestquest_child_day_complete``.
+
+    Thin HA wiring over the HA-free
+    :func:`custom_components.nestquest.core.events.build_quest_completed_event`
+    and
+    :func:`build_child_day_complete_event`: the completed event is
+    built and fired FIRST (so a failure in the day-complete DB reads
+    or the HA-local ``today`` lookup cannot suppress it), then the
+    HA-local ``today`` (the day-complete rule's input) is read from
+    ``hass.config.time_zone`` and the day-complete builder is asked
+    whether the child's whole day cleared.  Identical payloads and
+    day-complete rule to the pre-extraction implementation.
+    """
+    completed = await build_quest_completed_event(
+        database,
+        instance_id,
+        was_on_time=was_on_time,
+    )
+    hass.bus.async_fire(*completed)
+
+    today = datetime.datetime.now(ZoneInfo(hass.config.time_zone)).date()
+    day_complete = await build_child_day_complete_event(
+        database, completed[1], today=today
+    )
+    if day_complete is not None:
+        hass.bus.async_fire(*day_complete)
+
+
+async def fire_quest_uncompleted(
+    hass, database: NestQuestDatabase, instance_id: int
+) -> None:
+    """Fire ``nestquest_quest_uncompleted`` for an actual reversal."""
+    events = await build_quest_uncompleted_events(database, instance_id)
+    for event_type, payload in events:
+        hass.bus.async_fire(event_type, payload)

custom_components/nestquest/manifest.json

@@ -7,13 +7,12 @@
   "config_flow": true,
   "dependencies": [
     "frontend",
-    "http",
-    "lovelace"
+    "http"
   ],
   "documentation": "https://github.com/Maniacs-Mansion/NestQuest",
   "integration_type": "hub",
   "iot_class": "local_polling",
   "issue_tracker": "https://github.com/Maniacs-Mansion/NestQuest/issues",
   "requirements": [],
-  "version": "0.6.0"
+  "version": "0.5.0"
 }

custom_components/nestquest/materialize.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.materialize` for the integration package.
+
+The materialization walk lives in
+:mod:`custom_components.nestquest.core.materialize` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .materialize import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.materialize import *  # noqa: F401,F403

custom_components/nestquest/migrations.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.migrations` for the integration package.
+
+The versioned migration runner lives in
+:mod:`custom_components.nestquest.core.migrations`
+(extracted in task d0b691d8); this module re-exports it so existing
+``from .migrations import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.migrations import *  # noqa: F401,F403

custom_components/nestquest/options_flow.py

@@ -1,15 +1,4 @@
-"""Options flow for NestQuest post-setup settings.
-
-Since the DB removal (Feature 18) the integration is a thin client of
-the NestQuest API service: the settings that only served the local
-database (the generation horizon, the day rollover, the notification
-defaults, the admin allowlist) are gone — the API service owns those in
-its own settings store, and the automations take their behaviour from
-blueprint inputs.  What remains is what the CLIENT itself consumes: the
-panel-plane API connection (base URL + token), the shared coordinator's
-refresh interval, the last-good staleness threshold, and the
-panel-facing idle timeout.
-"""
+"""Options flow for NestQuest post-setup settings."""
 from __future__ import annotations
 
 from typing import Any
@@ -17,39 +6,66 @@ from typing import Any
 import voluptuous as vol
 from homeassistant import config_entries
 from homeassistant.data_entry_flow import FlowResult
+from homeassistant.helpers import config_validation as cv
 
 from .const import (
+    CONF_ADMIN_USER_IDS,
+    CONF_AFTERNOON_REMINDER_ENABLED,
+    CONF_AFTERNOON_REMINDER_TIME,
     CONF_API_BASE_URL,
+    CONF_CELEBRATION_ENABLED,
+    CONF_DAY_ROLLOVER_TIME,
+    CONF_END_OF_DAY_REPORT_ENABLED,
+    CONF_END_OF_DAY_REPORT_TIME,
+    CONF_HORIZON_DAYS,
+    CONF_MORNING_SUMMARY_ENABLED,
+    CONF_MORNING_SUMMARY_TIME,
+    CONF_NOTIFY_TARGET,
     CONF_PANEL_IDLE_TIMEOUT,
     CONF_PANEL_TOKEN,
-    CONF_SNAPSHOT_STALENESS,
     CONF_UPDATE_INTERVAL,
     DEFAULT_API_BASE_URL,
+    DEFAULT_AFTERNOON_REMINDER_TIME,
+    DEFAULT_AUTOMATION_ENABLED,
+    DEFAULT_DAY_ROLLOVER_TIME,
+    DEFAULT_END_OF_DAY_REPORT_TIME,
+    DEFAULT_HORIZON_DAYS,
+    DEFAULT_MORNING_SUMMARY_TIME,
     DEFAULT_PANEL_IDLE_TIMEOUT,
     DEFAULT_PANEL_TOKEN,
-    DEFAULT_SNAPSHOT_STALENESS,
     DEFAULT_UPDATE_INTERVAL,
+    DOMAIN,
     MIN_UPDATE_INTERVAL,
+    TIME_PATTERN,
 )
+from .admin_allowlist import list_admin_ids, set_admin_ids
 from .api_client import is_valid_base_url
 
+MIN_HORIZON_DAYS = 1
 MIN_PANEL_IDLE_TIMEOUT = 30
 
 
-def _async_validate(
-    user_input: dict[str, Any],
-    current: dict[str, Any] | None = None,
-) -> dict[str, str]:
-    """Validate user input and return field-level errors instead of raising.
+def _parse_time(value: str) -> bool:
+    """Return True when value is a valid 24-hour HH:MM string."""
+    return TIME_PATTERN.fullmatch(value) is not None
 
-    ``current`` carries the stored values (entry options → entry data →
-    defaults) so a raw submit that sets one field but omits a sibling it
-    is validated against (the staleness threshold vs. the update
-    interval) can still check the effective pair; raw submits omitting
-    BOTH keys keep their stored values untouched.
-    """
+
+def _async_validate(user_input: dict[str, Any]) -> dict[str, str]:
+    """Validate user input and return field-level errors instead of raising."""
     errors: dict[str, str] = {}
 
+    horizon_days = user_input.get(CONF_HORIZON_DAYS)
+    if (
+        isinstance(horizon_days, bool)
+        or not isinstance(horizon_days, int)
+        or horizon_days < MIN_HORIZON_DAYS
+    ):
+        errors[CONF_HORIZON_DAYS] = "invalid"
+
+    day_rollover_time = user_input.get(CONF_DAY_ROLLOVER_TIME)
+    if not isinstance(day_rollover_time, str) or not _parse_time(day_rollover_time):
+        errors[CONF_DAY_ROLLOVER_TIME] = "invalid_time"
+
     panel_idle_timeout = user_input.get(CONF_PANEL_IDLE_TIMEOUT)
     if (
         isinstance(panel_idle_timeout, bool)
@@ -70,32 +86,40 @@ def _async_validate(
     ):
         errors[CONF_UPDATE_INTERVAL] = "invalid"
 
-    # The last-good staleness threshold (Feature 18) is OPTIONAL in raw
-    # submits the same way: a missing key keeps the current value.  It
-    # must be a positive int, and at least the EFFECTIVE update interval
-    # (the one this submit carries, else the stored or default one) — a
-    # threshold shorter than the poll cadence could never serve even one
-    # cached snapshot.
-    staleness = user_input.get(CONF_SNAPSHOT_STALENESS)
-    if staleness is not None and (
-        isinstance(staleness, bool)
-        or not isinstance(staleness, int)
-        or staleness < 1
+    # The notification section (Feature 11) is OPTIONAL in raw submits
+    # the same way: a missing key keeps the current value.  The three
+    # times are strict HH:MM; the notify target is a non-empty HA
+    # service name; the toggles are real booleans.
+    for time_key in (
+        CONF_MORNING_SUMMARY_TIME,
+        CONF_AFTERNOON_REMINDER_TIME,
+        CONF_END_OF_DAY_REPORT_TIME,
     ):
-        errors[CONF_SNAPSHOT_STALENESS] = "invalid"
-    elif staleness is not None and not errors.get(CONF_UPDATE_INTERVAL):
-        stored_interval = (current or {}).get(CONF_UPDATE_INTERVAL)
-        effective_interval = update_interval
-        if effective_interval is None and (
-            isinstance(stored_interval, int)
-            and not isinstance(stored_interval, bool)
-            and stored_interval >= MIN_UPDATE_INTERVAL
+        time_value = user_input.get(time_key)
+        if time_value is not None and (
+            not isinstance(time_value, str) or not _parse_time(time_value)
         ):
-            effective_interval = stored_interval
-        if effective_interval is None:
-            effective_interval = DEFAULT_UPDATE_INTERVAL
-        if staleness < effective_interval:
-            errors[CONF_SNAPSHOT_STALENESS] = "invalid_staleness"
+            errors[time_key] = "invalid_time"
+    notify_target = user_input.get(CONF_NOTIFY_TARGET)
+    if notify_target is not None and not isinstance(notify_target, str):
+        errors[CONF_NOTIFY_TARGET] = "invalid"
+    elif isinstance(notify_target, str) and notify_target != (
+        notify_target.strip()
+    ):
+        # An EMPTY target is valid — it means "no notifications
+        # configured yet" and is the shipped default; a value that
+        # differs from its own trim (padded or whitespace-only) is
+        # malformed and rejected.
+        errors[CONF_NOTIFY_TARGET] = "invalid"
+    for toggle_key in (
+        CONF_MORNING_SUMMARY_ENABLED,
+        CONF_AFTERNOON_REMINDER_ENABLED,
+        CONF_END_OF_DAY_REPORT_ENABLED,
+        CONF_CELEBRATION_ENABLED,
+    ):
+        toggle_value = user_input.get(toggle_key)
+        if toggle_value is not None and not isinstance(toggle_value, bool):
+            errors[toggle_key] = "invalid"
 
     # The panel-plane API connection (Feature 18) is OPTIONAL in raw
     # submits the same way: a missing key keeps the current value.  The
@@ -119,78 +143,249 @@ def _async_validate(
     return errors
 
 
-def _build_schema(current: dict[str, Any]) -> vol.Schema:
+def _strict_bool(value: object) -> bool:
+    """Require a real bool; voluptuous ``bool`` would coerce strings."""
+    if not isinstance(value, bool):
+        raise vol.Invalid(f"expected a boolean, got {value!r}")
+    return value
+
+
+def _build_schema(
+    current: dict[str, Any],
+    *,
+    admin_choices: dict[str, str] | None = None,
+    admin_default: list[str] | None = None,
+) -> vol.Schema:
     """Build the form schema, pre-filled with the current values.
 
-    The API connection (Feature 18) carries the base URL the API client
-    talks to and the panel service token it presents as the Bearer
-    credential.  Schema-validated submits always carry every field (the
-    defaults pre-fill from the stored values); raw callers omitting one
-    keep its stored value (see _async_validate).
+    The admin picker is a multi-select of EXISTING Home Assistant users
+    (never a free-text field — the allowlist stores user IDs); its
+    default is the current database allowlist, so an untouched submit
+    re-saves exactly who is already allowed.  The notification section
+    (Feature 11) carries the household's notify target, the three
+    automation times, and four enable toggles — defaults from
+    :mod:`~.const`, never a hard-coded personal target.
     """
-    return vol.Schema(
-        {
-            vol.Required(
-                CONF_PANEL_IDLE_TIMEOUT,
-                default=current[CONF_PANEL_IDLE_TIMEOUT],
-            ): int,
-            vol.Required(
-                CONF_UPDATE_INTERVAL, default=current[CONF_UPDATE_INTERVAL]
-            ): int,
-            # The last-good staleness threshold (Feature 18): how long
-            # the coordinator keeps serving the cached snapshot after
-            # the API stops answering.
-            vol.Required(
-                CONF_SNAPSHOT_STALENESS,
-                default=current[CONF_SNAPSHOT_STALENESS],
-            ): int,
-            # Panel-plane API connection (Feature 18): the base URL the
-            # API client talks to and the panel service token it
-            # presents as the Bearer credential.
-            vol.Required(
-                CONF_API_BASE_URL, default=current[CONF_API_BASE_URL]
-            ): str,
-            vol.Required(
-                CONF_PANEL_TOKEN, default=current[CONF_PANEL_TOKEN]
-            ): str,
-        }
-    )
+    fields: dict[Any, Any] = {
+        vol.Required(
+            CONF_HORIZON_DAYS, default=current[CONF_HORIZON_DAYS]
+        ): int,
+        vol.Required(
+            CONF_DAY_ROLLOVER_TIME, default=current[CONF_DAY_ROLLOVER_TIME]
+        ): str,
+        vol.Required(
+            CONF_PANEL_IDLE_TIMEOUT, default=current[CONF_PANEL_IDLE_TIMEOUT]
+        ): int,
+        vol.Required(
+            CONF_UPDATE_INTERVAL, default=current[CONF_UPDATE_INTERVAL]
+        ): int,
+        vol.Required(
+            CONF_NOTIFY_TARGET, default=current[CONF_NOTIFY_TARGET]
+        ): str,
+        vol.Required(
+            CONF_MORNING_SUMMARY_TIME,
+            default=current[CONF_MORNING_SUMMARY_TIME],
+        ): str,
+        vol.Required(
+            CONF_AFTERNOON_REMINDER_TIME,
+            default=current[CONF_AFTERNOON_REMINDER_TIME],
+        ): str,
+        vol.Required(
+            CONF_END_OF_DAY_REPORT_TIME,
+            default=current[CONF_END_OF_DAY_REPORT_TIME],
+        ): str,
+        vol.Required(
+            CONF_MORNING_SUMMARY_ENABLED,
+            default=current[CONF_MORNING_SUMMARY_ENABLED],
+        ): _strict_bool,
+        vol.Required(
+            CONF_AFTERNOON_REMINDER_ENABLED,
+            default=current[CONF_AFTERNOON_REMINDER_ENABLED],
+        ): _strict_bool,
+        vol.Required(
+            CONF_END_OF_DAY_REPORT_ENABLED,
+            default=current[CONF_END_OF_DAY_REPORT_ENABLED],
+        ): _strict_bool,
+        vol.Required(
+            CONF_CELEBRATION_ENABLED,
+            default=current[CONF_CELEBRATION_ENABLED],
+        ): _strict_bool,
+        # Panel-plane API connection (Feature 18): the base URL the API
+        # client talks to and the panel service token it presents as
+        # the Bearer credential.  Schema-validated submits always carry
+        # both (the defaults pre-fill from the stored values); raw
+        # callers omitting them keep their stored values (see
+        # _async_validate).
+        vol.Required(
+            CONF_API_BASE_URL, default=current[CONF_API_BASE_URL]
+        ): str,
+        vol.Required(
+            CONF_PANEL_TOKEN, default=current[CONF_PANEL_TOKEN]
+        ): str,
+    }
+    if admin_choices is not None:
+        # HA's supported multi-select validator: the frontend can
+        # serialize the field as a real picker of the given choices.
+        fields[
+            vol.Optional(
+                CONF_ADMIN_USER_IDS, default=list(admin_default or [])
+            )
+        ] = cv.multi_select(admin_choices)
+    return vol.Schema(fields)
 
 
 class NestQuestOptionsFlow(config_entries.OptionsFlowWithConfigEntry):
     """Handle the options flow for NestQuest."""
 
+    def _async_database(self):
+        """Return the runtime database for this entry, or None.
+
+        Real HA only opens the options flow for an existing entry, so
+        the runtime record (and its database) exists; the None branch
+        covers direct construction in tests and degraded states.
+        """
+        hass_data = getattr(self.hass, "data", None)
+        if not isinstance(hass_data, dict):
+            return None
+        record = hass_data.get(DOMAIN, {}).get(self.config_entry.entry_id)
+        database = getattr(record, "database", None)
+        return database if getattr(database, "connected", False) else None
+
+    async def _async_admin_choices(self) -> dict[str, str]:
+        """Map HA user id -> display name for the picker.
+
+        Real Home Assistant always provides ``hass.auth``; a missing
+        one (direct construction in tests, degraded harness) degrades
+        to an empty picker rather than crashing the form.
+        """
+        auth = getattr(self.hass, "auth", None)
+        if auth is None:
+            return {}
+        users = await auth.async_get_users()
+        return {
+            user.id: user.name
+            for user in users
+            if getattr(user, "id", None)
+        }
+
+    async def _async_current_admin_ids(self) -> list[str]:
+        """Return the current allowlist, or [] without a database."""
+        database = self._async_database()
+        if database is None:
+            return []
+        return await list_admin_ids(database)
+
     async def async_step_init(
         self, user_input: dict[str, Any] | None = None
     ) -> FlowResult:
         """Manage the NestQuest options."""
+        admin_choices = await self._async_admin_choices()
+        admin_default = await self._async_current_admin_ids()
         if user_input is None:
             return self.async_show_form(
                 step_id="init",
-                data_schema=_build_schema(self._current_values()),
+                data_schema=_build_schema(
+                    self._current_values(),
+                    admin_choices=admin_choices,
+                    admin_default=admin_default,
+                ),
             )
 
-        errors = _async_validate(user_input, self._current_values())
+        errors = _async_validate(user_input)
+        # The admin ids are validated only when the key is present:
+        # schema-validated submits always carry it (vol.Optional's
+        # default fills from the current allowlist), while raw callers
+        # omitting the key keep the field untouched.
+        admin_ids_present = CONF_ADMIN_USER_IDS in user_input
+        admin_ids = user_input.get(CONF_ADMIN_USER_IDS)
         if errors:
             return self.async_show_form(
                 step_id="init",
-                data_schema=_build_schema(self._current_values()),
+                data_schema=_build_schema(
+                    self._current_values(),
+                    admin_choices=admin_choices,
+                    admin_default=admin_default,
+                ),
+                errors=errors,
+            )
+        if admin_ids_present and (
+            not isinstance(admin_ids, list)
+            or any(not isinstance(value, str) for value in admin_ids)
+        ):
+            errors[CONF_ADMIN_USER_IDS] = "invalid_admin"
+        elif admin_ids_present and not admin_ids:
+            # An empty allowlist fails closed: saving zero admins is
+            # refused, never silently applied.
+            errors[CONF_ADMIN_USER_IDS] = "no_admins"
+        elif admin_ids_present and any(
+            value not in admin_choices for value in admin_ids
+        ):
+            # The schema enforces membership for real HA submits; this
+            # backs the raw-input path up so an unknown id can never
+            # reach the allowlist.
+            errors[CONF_ADMIN_USER_IDS] = "invalid_admin"
+        elif admin_ids_present and len(set(admin_ids)) != len(admin_ids):
+            # set_admin_ids refuses duplicates with ValueError; a flow
+            # submission must surface that as a field error instead of
+            # an unhandled crash.
+            errors[CONF_ADMIN_USER_IDS] = "invalid_admin"
+        if errors:
+            return self.async_show_form(
+                step_id="init",
+                data_schema=_build_schema(
+                    self._current_values(),
+                    admin_choices=admin_choices,
+                    admin_default=admin_default,
+                ),
                 errors=errors,
             )
 
-        # Every remaining key is stored the fall-back-to-current way, so
-        # raw submits that predate a section keep that section's stored
-        # values.
+        # Apply the picker's selection to the allowlist when the
+        # runtime database is reachable; the selection is always
+        # stored on the entry as the disaster-recovery copy.
+        database = self._async_database()
+        if database is not None and admin_ids_present:
+            await set_admin_ids(database, admin_ids)
+        data = {
+            CONF_HORIZON_DAYS: user_input[CONF_HORIZON_DAYS],
+            CONF_DAY_ROLLOVER_TIME: user_input[CONF_DAY_ROLLOVER_TIME],
+            CONF_PANEL_IDLE_TIMEOUT: user_input[CONF_PANEL_IDLE_TIMEOUT],
+            CONF_UPDATE_INTERVAL: user_input.get(
+                CONF_UPDATE_INTERVAL,
+                self._current_values()[CONF_UPDATE_INTERVAL],
+            ),
+        }
+        # The notification section (Feature 11) stores the household's
+        # choices the same fall-back-to-current way, so raw submits
+        # that predate the section keep their stored values.
         current = self._current_values()
-        data: dict[str, Any] = {}
-        for key in (
-            CONF_PANEL_IDLE_TIMEOUT,
-            CONF_UPDATE_INTERVAL,
-            CONF_SNAPSHOT_STALENESS,
-            CONF_API_BASE_URL,
-            CONF_PANEL_TOKEN,
+        for notification_key in (
+            CONF_NOTIFY_TARGET,
+            CONF_MORNING_SUMMARY_TIME,
+            CONF_AFTERNOON_REMINDER_TIME,
+            CONF_END_OF_DAY_REPORT_TIME,
+            CONF_MORNING_SUMMARY_ENABLED,
+            CONF_AFTERNOON_REMINDER_ENABLED,
+            CONF_END_OF_DAY_REPORT_ENABLED,
+            CONF_CELEBRATION_ENABLED,
         ):
-            data[key] = user_input.get(key, current[key])
+            data[notification_key] = user_input.get(
+                notification_key, current[notification_key]
+            )
+        # The API connection section (Feature 18) stores the base URL
+        # and panel token the same fall-back-to-current way, so raw
+        # submits that predate the section keep their stored values.
+        for api_key in (CONF_API_BASE_URL, CONF_PANEL_TOKEN):
+            data[api_key] = user_input.get(api_key, current[api_key])
+        if admin_ids_present:
+            data[CONF_ADMIN_USER_IDS] = admin_ids
+        elif admin_default:
+            # HA replaces entry.options wholesale, so an omitted picker
+            # field must carry the CURRENT allowlist forward: dropping
+            # it would leave only the stale config-flow copy in entry
+            # data, and a later database loss would resurrect admins
+            # the owner has since removed.
+            data[CONF_ADMIN_USER_IDS] = list(admin_default)
         return self.async_create_entry(title="NestQuest", data=data)
 
     def _current_values(self) -> dict[str, Any]:
@@ -199,9 +394,18 @@ class NestQuestOptionsFlow(config_entries.OptionsFlowWithConfigEntry):
         entry_data = getattr(self.config_entry, "data", None) or {}
         values: dict[str, Any] = {}
         for key, default in (
+            (CONF_HORIZON_DAYS, DEFAULT_HORIZON_DAYS),
+            (CONF_DAY_ROLLOVER_TIME, DEFAULT_DAY_ROLLOVER_TIME),
             (CONF_PANEL_IDLE_TIMEOUT, DEFAULT_PANEL_IDLE_TIMEOUT),
             (CONF_UPDATE_INTERVAL, DEFAULT_UPDATE_INTERVAL),
-            (CONF_SNAPSHOT_STALENESS, DEFAULT_SNAPSHOT_STALENESS),
+            (CONF_NOTIFY_TARGET, ""),
+            (CONF_MORNING_SUMMARY_TIME, DEFAULT_MORNING_SUMMARY_TIME),
+            (CONF_AFTERNOON_REMINDER_TIME, DEFAULT_AFTERNOON_REMINDER_TIME),
+            (CONF_END_OF_DAY_REPORT_TIME, DEFAULT_END_OF_DAY_REPORT_TIME),
+            (CONF_MORNING_SUMMARY_ENABLED, DEFAULT_AUTOMATION_ENABLED),
+            (CONF_AFTERNOON_REMINDER_ENABLED, DEFAULT_AUTOMATION_ENABLED),
+            (CONF_END_OF_DAY_REPORT_ENABLED, DEFAULT_AUTOMATION_ENABLED),
+            (CONF_CELEBRATION_ENABLED, DEFAULT_AUTOMATION_ENABLED),
             (CONF_API_BASE_URL, DEFAULT_API_BASE_URL),
             (CONF_PANEL_TOKEN, DEFAULT_PANEL_TOKEN),
         ):
@@ -211,4 +415,4 @@ class NestQuestOptionsFlow(config_entries.OptionsFlowWithConfigEntry):
                 values[key] = entry_data[key]
             else:
                 values[key] = default
-        return values
+        return values

custom_components/nestquest/permissions.py

@@ -0,0 +1,90 @@
+"""Permission gate for NestQuest services (Feature 09).
+
+A wrapper factory, applied to EVERY registered service at registration
+time (no handler is exempt), reads ``call.context.user_id``, consults
+the :data:`~.service_policy.SERVICE_POLICY` registry and
+:func:`~.admin_allowlist.is_admin`, and raises
+:class:`homeassistant.exceptions.Unauthorized` for an admin-only
+operation called by a non-admin — including a call with NO user
+context, which fails closed.  ``complete_quest`` (policy ``open``)
+proceeds regardless of the allowlist.
+
+Logging (later Feature 09 tasks): every denied admin-only call logs a
+warning and every successful one logs a debug line, both carrying the
+service, the user id (or ``none``), and a UTC timestamp.
+"""
+from __future__ import annotations
+
+import datetime
+import logging
+from collections.abc import Awaitable, Callable
+from typing import Any
+
+from homeassistant.exceptions import Unauthorized
+
+from .admin_allowlist import is_admin
+from .service_policy import ADMIN_ONLY
+
+LOGGER = logging.getLogger(__name__)
+
+ServiceHandler = Callable[[Any], Awaitable[None]]
+
+
+def _context_user_id(call: Any) -> str | None:
+    context = getattr(call, "context", None)
+    user_id = getattr(context, "user_id", None) if context is not None else None
+    if isinstance(user_id, str) and user_id:
+        return user_id
+    return None
+
+
+def _stamp() -> str:
+    return datetime.datetime.now(datetime.timezone.utc).isoformat(
+        timespec="seconds"
+    )
+
+
+def permission_gate(
+    service: str,
+    policy: str,
+    database_of: Callable[[Any], Any],
+) -> Callable[[ServiceHandler], ServiceHandler]:
+    """Wrap ``handler`` with the Feature 09 permission check.
+
+    ``database_of`` resolves the live database from the call-time
+    runtime (the same ``find_runtime`` the handler uses), so the gate
+    never opens its own connection.  The verdict is fail-closed:
+    absent allowlist row, unknown id, no user context — all not admin.
+    """
+
+    def _wrap(handler: ServiceHandler) -> ServiceHandler:
+        if policy != ADMIN_ONLY:
+            return handler
+
+        async def _gated(call: Any) -> None:
+            user_id = _context_user_id(call)
+            allowed = user_id is not None and await is_admin(
+                database_of(call), user_id
+            )
+            if not allowed:
+                LOGGER.warning(
+                    "NestQuest denied %s: caller user_id=%s at %s",
+                    service,
+                    user_id if user_id is not None else "none",
+                    _stamp(),
+                )
+                raise Unauthorized(
+                    f"User '{user_id if user_id is not None else 'none'}' "
+                    f"is not allowed to call nestquest.{service}"
+                )
+            LOGGER.debug(
+                "NestQuest allowed %s: caller user_id=%s at %s",
+                service,
+                user_id,
+                _stamp(),
+            )
+            await handler(call)
+
+        return _gated
+
+    return _wrap

custom_components/nestquest/presence.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.presence` for the integration package.
+
+The presence and custody model lives in
+:mod:`custom_components.nestquest.core.presence` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .presence import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.presence import *  # noqa: F401,F403

custom_components/nestquest/presence_management.py

@@ -0,0 +1,10 @@
+"""Re-export of :mod:`custom_components.nestquest.core.presence_management` for the integration package.
+
+The presence-write business layer lives in
+:mod:`custom_components.nestquest.core.presence_management` (added for
+task e4a9d31b); this module re-exports it so the integration's service
+handlers call the ONE implementation the API admin plane shares.
+"""
+from __future__ import annotations
+
+from .core.presence_management import *  # noqa: F401,F403

custom_components/nestquest/quest_definitions.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.quest_definitions` for the integration package.
+
+The quest definitions business layer lives in
+:mod:`custom_components.nestquest.core.quest_definitions` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .quest_definitions import ...`` references inside the integration
+keep working.
+"""
+from __future__ import annotations
+
+from .core.quest_definitions import *  # noqa: F401,F403

custom_components/nestquest/recurrence.py

@@ -0,0 +1,10 @@
+"""Re-export of :mod:`custom_components.nestquest.core.recurrence` for the integration package.
+
+The recurrence model lives in :mod:`custom_components.nestquest.core.recurrence`
+(extracted in task d0b691d8); this module re-exports it so existing
+``from .recurrence import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.recurrence import *  # noqa: F401,F403

custom_components/nestquest/schema.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.schema` for the integration package.
+
+The declarative schema DDL lives in
+:mod:`custom_components.nestquest.core.schema` (extracted in
+task d0b691d8); this module re-exports it so existing
+``from .schema import ...`` references inside the integration keep
+working.
+"""
+from __future__ import annotations
+
+from .core.schema import *  # noqa: F401,F403

custom_components/nestquest/sensor.py

@@ -32,7 +32,6 @@ from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity import DeviceInfo
 from homeassistant.helpers.update_coordinator import CoordinatorEntity
-from homeassistant.util import slugify
 
 from .const import DOMAIN
 from .coordinator import (
@@ -42,21 +41,13 @@ from .coordinator import (
 )
 from .core.snapshot import instance_payload
 
-#: HA's state machine refuses states longer than 255
+#: Home Assistant's state machine refuses states longer than 255
 #: characters (its hard recorder/state limit).  These sensors' states
 #: are numeric, but the guard is applied uniformly: a payload-bearing
 #: sensor can never crash the state write, and later string-state
 #: sensors reuse the same helper.
 MAX_STATE_LENGTH = 255
 
-#: Entity-id length cap the roster applies to HA's slugify: HA's
-#: slugifier itself does NOT truncate, but the entity registry derives
-#: entity ids as ``<domain>.<slug>`` and truncates the full entity_id at
-#: MAX_LENGTH_STATE_ENTITY_ID (64), so for this module's ``sensor.``
-#: entities the slugged object id alone may not exceed
-#: 64 - len("sensor.").
-_MAX_SLUG_LENGTH = 64 - len("sensor.")
-
 
 def _state_within_limit(state: Any) -> Any:
     """Return ``state`` unchanged, refusing strings over HA's limit.
@@ -107,51 +98,6 @@ def _next_open_quest(
     )
 
 
-def _slugify(text: str) -> str:
-    """Slugify a display name the way Home Assistant derives entity ids.
-
-    Runs ``homeassistant.util.slugify`` — the real slugifier HA runs
-    entity names through, which transliterates every script to ASCII
-    through unidecode (so non-Latin names survive: ``京子`` slugs to
-    ``jing_zi``) before folding to lowercase and turning every run of
-    non-alphanumerics into one underscore, answering HA's ``unknown``
-    sentinel when a name slugs to nothing — then caps the result at
-    the object-id length the entity registry enforces (the registry
-    truncates the full ``sensor.`` + slug entity_id at 64 characters,
-    so the slug alone is capped like this; HA's slugify does not
-    truncate by itself).
-    """
-    return slugify(text)[:_MAX_SLUG_LENGTH]
-
-
-def _child_roster(children: Iterable[ChildDaySnapshot]) -> list[dict[str, Any]]:
-    """The ordered child roster the panel cards discover children from.
-
-    One entry per ACTIVE child in the snapshot's order (the API's
-    sort_order, then id): ``child_id``, ``name``, and the ``slug`` the
-    entity-id derivation produces for the child's name — the piece the
-    cards need to build ``sensor.nestquest_<slug>_...`` ids.  Duplicate
-    display names get the registry's ``_2``/``_3`` suffix in snapshot
-    order, matching how HA resolves the collision at registration.  The
-    rollups' ``children`` attribute (per-child counts) is unchanged and
-    carries a different shape on purpose.
-    """
-    slugs: dict[str, int] = {}
-    roster: list[dict[str, Any]] = []
-    for child in children:
-        base = _slugify(child.child_name)
-        taken = slugs.get(base, 0) + 1
-        slugs[base] = taken
-        roster.append(
-            {
-                "child_id": child.child_id,
-                "name": child.child_name,
-                "slug": base if taken == 1 else f"{base}_{taken}",
-            }
-        )
-    return roster
-
-
 class _NestQuestChildDaySensor(CoordinatorEntity, SensorEntity):
     """Base for the per-child day sensors.
 
@@ -410,12 +356,7 @@ class _NestQuestHouseholdSensor(CoordinatorEntity, SensorEntity):
 
 
 class NestQuestHouseholdDueTodaySensor(_NestQuestHouseholdSensor):
-    """Total quests due today across active children.
-
-    Also publishes ``child_roster`` (see :func:`_child_roster`): the
-    ordered child identity list the panel cards read to discover the
-    board's children when the card config carries no ``child_order``.
-    """
+    """Total quests due today across active children."""
 
     _attr_name = "NestQuest household quests due today"
     _attr_state_class = SensorStateClass.MEASUREMENT
@@ -439,8 +380,7 @@ class NestQuestHouseholdDueTodaySensor(_NestQuestHouseholdSensor):
             "children": {
                 str(child.child_id): child.due_today
                 for child in data.children
-            },
-            "child_roster": _child_roster(data.children),
+            }
         }
 
 

custom_components/nestquest/service_policy.py

@@ -0,0 +1,11 @@
+"""Re-export of :mod:`custom_components.nestquest.core.service_policy` for the integration package.
+
+The service policy registry lives in
+:mod:`custom_components.nestquest.core.service_policy` (extracted in
+task 510c1f78); this module re-exports it so existing
+``from .service_policy import ...`` references inside the integration
+keep working.
+"""
+from __future__ import annotations
+
+from .core.service_policy import *  # noqa: F401,F403

custom_components/nestquest/services.py

@@ -1,36 +1,65 @@
-"""The domain-global ``nestquest.complete_quest`` service (Feature 18).
+"""Domain-global NestQuest service schemas and handlers (Feature 09).
 
 Registration is domain-scoped and happens once (see
-:func:`async_register_services`).  Since Feature 18 the integration is
-a client of the NestQuest API service, so ``complete_quest`` proxies
-to the API's panel complete route through the entry's shared API
-client instead of writing any database.  The former HA admin services
-(uncomplete, quest-definition and presence management, CSV export,
-child management, regenerate) are removed: the admin surface is the
-PWA and the API service's admin routes, so the only HA service left is
-the panel completion path.
+:func:`async_register_services`); handlers resolve a live database at
+call time through the injected ``find_runtime`` callable.  Permission
+checks are Feature 09 later tasks — this module only validates payload
+shape and forwards to the Feature 03/06/08 business layers (the
+presence writes included, through :mod:`.presence_management` — the
+ONE implementation the API admin plane shares).  Since Feature 18 the
+integration is a client of the NestQuest API service, so
+``complete_quest`` proxies to the API's panel complete route through
+the entry's shared API client instead of writing any database.
+``export_history_csv`` is registered with a schema but raises until
+Feature 13.  ``regenerate`` is supplied by the caller so
+the Feature 07 handler stays the one in ``__init__``.
 """
 from __future__ import annotations
 
+import datetime
 from collections.abc import Awaitable, Callable
 from typing import Any
+from zoneinfo import ZoneInfo
 
 import voluptuous as vol
 from homeassistant.core import HomeAssistant
 from homeassistant.exceptions import HomeAssistantError
 
+from . import children as children_layer
+from . import completion as completion_layer
+from . import presence_management as presence_management_layer
+from . import quest_definitions as quest_definitions_layer
 from .api_client import NestQuestApiError
 from .const import (
     DOMAIN,
     DOMAIN_SERVICES,
+    QUEST_WINDOWS,
     SERVICE_COMPLETE_QUEST,
+    SERVICE_CREATE_PRESENCE_OVERRIDE,
+    SERVICE_CREATE_QUEST_DEFINITION,
+    SERVICE_DELETE_PRESENCE_OVERRIDE,
+    SERVICE_EXPORT_HISTORY_CSV,
+    SERVICE_MANAGE_CHILD,
+    SERVICE_REGENERATE,
+    SERVICE_SET_PRESENCE_PATTERN,
+    SERVICE_SET_QUEST_DEFINITION_ACTIVE,
+    SERVICE_UNCOMPLETE_QUEST,
+    SERVICE_UPDATE_QUEST_DEFINITION,
 )
+from .events import fire_quest_uncompleted
+from .permissions import permission_gate
+from .recurrence import ScheduleRule
+from .service_policy import SERVICE_POLICY
 
 FindRuntime = Callable[[HomeAssistant], Any]
 ServiceHandler = Callable[[Any], Awaitable[None]]
 
 ACTOR_PANEL = "panel"
 ACTOR_USER = "user"
+MANAGE_CHILD_CREATE = "create"
+MANAGE_CHILD_EDIT = "edit"
+MANAGE_CHILD_SET_ACTIVE = "set_active"
+MANAGE_CHILD_REORDER = "reorder"
 
 
 def _strict_int(value: object) -> int:
@@ -40,6 +69,82 @@ def _strict_int(value: object) -> int:
     return value
 
 
+def _strict_bool(value: object) -> bool:
+    """Reject ints and other truthy values; require a real bool."""
+    if type(value) is not bool:
+        raise vol.Invalid(f"expected bool, got {value!r}")
+    return value
+
+
+def _weekday_list(value: object) -> list[int]:
+    if type(value) is not list:
+        raise vol.Invalid(f"expected a list of weekday ints, got {value!r}")
+    return [_strict_int(item) for item in value]
+
+
+def _presence_pattern(value: object) -> dict[int, list[int]]:
+    if not isinstance(value, dict):
+        raise vol.Invalid(f"pattern must be a mapping, got {value!r}")
+    pattern: dict[int, list[int]] = {}
+    for week, days in value.items():
+        if isinstance(week, str):
+            try:
+                week_index = int(week)
+            except ValueError as err:
+                raise vol.Invalid(
+                    f"pattern week index must be an integer, got {week!r}"
+                ) from err
+            if str(week_index) != week:
+                raise vol.Invalid(
+                    f"pattern week index must be an integer, got {week!r}"
+                )
+        else:
+            week_index = _strict_int(week)
+        pattern[week_index] = _weekday_list(days)
+    return pattern
+
+
+def _window_entry(value: object) -> str | tuple[str, str | None]:
+    if isinstance(value, str):
+        if value not in QUEST_WINDOWS:
+            raise vol.Invalid(f"unknown window {value!r}")
+        return value
+    if isinstance(value, dict):
+        parsed = vol.Schema(
+            {
+                vol.Required("window"): vol.In(QUEST_WINDOWS),
+                vol.Optional("due_time"): str,
+            }
+        )(value)
+        due_time = parsed.get("due_time")
+        if due_time is None:
+            return parsed["window"]
+        return (parsed["window"], due_time)
+    raise vol.Invalid(
+        f"windows entry must be a window name or object, got {value!r}"
+    )
+
+
+def _windows(value: object) -> list[str | tuple[str, str | None]]:
+    if type(value) is not list:
+        raise vol.Invalid(f"windows must be a list, got {value!r}")
+    if not value:
+        raise vol.Invalid("windows must not be empty")
+    return [_window_entry(entry) for entry in value]
+
+
+def _int_list(value: object) -> list[int]:
+    if type(value) is not list:
+        raise vol.Invalid(f"expected a list of ints, got {value!r}")
+    return [_strict_int(item) for item in value]
+
+
+def _rule_dict(value: object) -> dict:
+    if not isinstance(value, dict):
+        raise vol.Invalid(f"rule must be a dict, got {value!r}")
+    return value
+
+
 SCHEMA_COMPLETE_QUEST = vol.Schema(
     {
         vol.Required("instance_id"): _strict_int,
@@ -49,22 +154,102 @@ SCHEMA_COMPLETE_QUEST = vol.Schema(
     }
 )
 
+SCHEMA_UNCOMPLETE_QUEST = SCHEMA_COMPLETE_QUEST
+
+SCHEMA_CREATE_QUEST_DEFINITION = vol.Schema(
+    {
+        vol.Required("title"): str,
+        vol.Required("rule"): _rule_dict,
+        vol.Required("assignee_child_ids"): vol.All(
+            _int_list, vol.Length(min=1)
+        ),
+        vol.Required("windows"): _windows,
+        vol.Optional("description"): str,
+        vol.Optional("icon"): str,
+    }
+)
+
+SCHEMA_UPDATE_QUEST_DEFINITION = vol.Schema(
+    {
+        vol.Required("definition_id"): _strict_int,
+        vol.Optional("title"): str,
+        vol.Optional("description"): vol.Any(str, None),
+        vol.Optional("icon"): vol.Any(str, None),
+        vol.Optional("rule"): _rule_dict,
+        vol.Optional("windows"): _windows,
+    }
+)
+
+SCHEMA_SET_QUEST_DEFINITION_ACTIVE = vol.Schema(
+    {
+        vol.Required("definition_id"): _strict_int,
+        vol.Required("is_active"): _strict_bool,
+    }
+)
+
+SCHEMA_SET_PRESENCE_PATTERN = vol.Schema(
+    {
+        vol.Required("child_id"): _strict_int,
+        vol.Required("cycle_length_weeks"): _strict_int,
+        vol.Required("anchor_date"): str,
+        vol.Required("pattern"): _presence_pattern,
+    }
+)
+
+SCHEMA_CREATE_PRESENCE_OVERRIDE = vol.Schema(
+    {
+        vol.Required("child_id"): _strict_int,
+        vol.Required("start_date"): str,
+        vol.Required("end_date"): str,
+        vol.Required("is_present"): _strict_bool,
+        vol.Optional("note"): str,
+    }
+)
+
+SCHEMA_DELETE_PRESENCE_OVERRIDE = vol.Schema(
+    {
+        vol.Required("override_id"): _strict_int,
+    }
+)
+
+SCHEMA_EXPORT_HISTORY_CSV = vol.Schema({})
+
+SCHEMA_MANAGE_CHILD = vol.Schema(
+    {
+        vol.Required("action"): vol.In(
+            [
+                MANAGE_CHILD_CREATE,
+                MANAGE_CHILD_EDIT,
+                MANAGE_CHILD_SET_ACTIVE,
+                MANAGE_CHILD_REORDER,
+            ]
+        ),
+        vol.Optional("child_id"): _strict_int,
+        vol.Optional("display_name"): str,
+        vol.Optional("colour"): str,
+        vol.Optional("avatar_ref"): str,
+        vol.Optional("sort_order"): _strict_int,
+        vol.Optional("is_active"): _strict_bool,
+        vol.Optional("ordered_ids"): _int_list,
+    }
+)
+
 
 def _require_runtime(hass: HomeAssistant, find_runtime: FindRuntime):
     runtime = find_runtime(hass)
     if runtime is None:
         raise HomeAssistantError(
-            "NestQuest is not loaded; cannot run this service"
+            "NestQuest has no live database; cannot run this service"
         )
     return runtime
 
 
 async def _refresh_entities(runtime: Any) -> None:
-    """Force an immediate coordinator refresh after the service call.
+    """Force an immediate coordinator refresh after a service mutation.
 
-    Only the SERVICE path calls this — the scheduled materialize and
+    Only the SERVICE paths call this — the scheduled materialize and
     rollover internals are direct function calls and never widen this
-    gate — so the entities reflect a completion the moment the service
+    gate — so entities reflect a completion the moment the service
     call returns instead of waiting for the poll interval.
     """
     coordinator = getattr(runtime, "coordinator", None)
@@ -72,6 +257,12 @@ async def _refresh_entities(runtime: Any) -> None:
         await coordinator.async_refresh()
 
 
+def _generation_kwargs(hass: HomeAssistant, runtime: Any) -> dict[str, Any]:
+    time_zone = ZoneInfo(hass.config.time_zone)
+    today = datetime.datetime.now(time_zone).date()
+    return {"today": today, "horizon_days": runtime.settings.horizon_days}
+
+
 def _actor_kwargs(call: Any) -> dict[str, Any]:
     actor = call.data["actor"]
     if actor == ACTOR_PANEL:
@@ -162,29 +353,289 @@ def _complete_quest(
     return _with_errors(_handler)
 
 
+def _uncomplete_quest(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        runtime = _require_runtime(hass, find_runtime)
+        instance_id = call.data["instance_id"]
+        result = await completion_layer.uncomplete_instance(
+            runtime.database,
+            instance_id,
+            **_actor_kwargs(call),
+        )
+        if result.appended:
+            await fire_quest_uncompleted(
+                hass, runtime.database, instance_id
+            )
+            await _refresh_entities(runtime)
+
+    return _with_errors(_handler)
+
+
+def _create_quest_definition(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        database = _require_runtime(hass, find_runtime).database
+        data = call.data
+        await quest_definitions_layer.create_quest_definition(
+            database,
+            data["title"],
+            ScheduleRule.from_dict(data["rule"]),
+            data["assignee_child_ids"],
+            data["windows"],
+            description=data.get("description"),
+            icon=data.get("icon"),
+        )
+
+    return _with_errors(_handler)
+
+
+def _update_quest_definition(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        runtime = _require_runtime(hass, find_runtime)
+        data = call.data
+        kwargs: dict[str, Any] = _generation_kwargs(hass, runtime)
+        if "title" in data:
+            kwargs["title"] = data["title"]
+        if "description" in data:
+            kwargs["description"] = data["description"]
+        if "icon" in data:
+            kwargs["icon"] = data["icon"]
+        if "rule" in data:
+            kwargs["rule"] = ScheduleRule.from_dict(data["rule"])
+        if "windows" in data:
+            kwargs["windows"] = data["windows"]
+        await quest_definitions_layer.edit_quest_definition(
+            runtime.database, data["definition_id"], **kwargs
+        )
+
+    return _with_errors(_handler)
+
+
+def _set_quest_definition_active(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        runtime = _require_runtime(hass, find_runtime)
+        await quest_definitions_layer.set_quest_definition_active(
+            runtime.database,
+            call.data["definition_id"],
+            call.data["is_active"],
+            **_generation_kwargs(hass, runtime),
+        )
+
+    return _with_errors(_handler)
+
+
+def _set_presence_pattern(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        runtime = _require_runtime(hass, find_runtime)
+        data = call.data
+        await presence_management_layer.set_presence_schedule(
+            runtime.database,
+            data["child_id"],
+            data["cycle_length_weeks"],
+            data["anchor_date"],
+            data["pattern"],
+            **_generation_kwargs(hass, runtime),
+        )
+
+    return _with_errors(_handler)
+
+
+def _create_presence_override(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        runtime = _require_runtime(hass, find_runtime)
+        data = call.data
+        await presence_management_layer.create_presence_override(
+            runtime.database,
+            data["child_id"],
+            data["start_date"],
+            data["end_date"],
+            data["is_present"],
+            note=data.get("note"),
+            **_generation_kwargs(hass, runtime),
+        )
+
+    return _with_errors(_handler)
+
+
+def _delete_presence_override(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        runtime = _require_runtime(hass, find_runtime)
+        await presence_management_layer.delete_presence_override(
+            runtime.database,
+            call.data["override_id"],
+            **_generation_kwargs(hass, runtime),
+        )
+
+    return _with_errors(_handler)
+
+
+async def _export_history_csv(_call: Any) -> None:
+    raise HomeAssistantError(
+        "CSV history export is not implemented until Feature 13"
+    )
+
+
+def _manage_child(
+    hass: HomeAssistant, find_runtime: FindRuntime
+) -> ServiceHandler:
+    async def _handler(call: Any) -> None:
+        database = _require_runtime(hass, find_runtime).database
+        data = call.data
+        action = data["action"]
+        if action == MANAGE_CHILD_CREATE:
+            display_name = data.get("display_name")
+            if display_name is None:
+                raise HomeAssistantError(
+                    "display_name is required when action is create"
+                )
+            kwargs: dict[str, Any] = {}
+            if "colour" in data:
+                kwargs["colour"] = data["colour"]
+            if "avatar_ref" in data:
+                kwargs["avatar_ref"] = data["avatar_ref"]
+            if "sort_order" in data:
+                kwargs["sort_order"] = data["sort_order"]
+            await children_layer.create_child(
+                database, display_name, **kwargs
+            )
+            return
+        if action == MANAGE_CHILD_EDIT:
+            child_id = data.get("child_id")
+            if child_id is None:
+                raise HomeAssistantError(
+                    "child_id is required when action is edit"
+                )
+            kwargs = {}
+            if "display_name" in data:
+                kwargs["display_name"] = data["display_name"]
+            if "colour" in data:
+                kwargs["colour"] = data["colour"]
+            if "avatar_ref" in data:
+                kwargs["avatar_ref"] = data["avatar_ref"]
+            if "sort_order" in data:
+                kwargs["sort_order"] = data["sort_order"]
+            await children_layer.edit_child(database, child_id, **kwargs)
+            return
+        if action == MANAGE_CHILD_SET_ACTIVE:
+            child_id = data.get("child_id")
+            is_active = data.get("is_active")
+            if child_id is None:
+                raise HomeAssistantError(
+                    "child_id is required when action is set_active"
+                )
+            if is_active is None:
+                raise HomeAssistantError(
+                    "is_active is required when action is set_active"
+                )
+            await children_layer.set_child_active(
+                database, child_id, is_active
+            )
+            return
+        ordered_ids = data.get("ordered_ids")
+        if ordered_ids is None:
+            raise HomeAssistantError(
+                "ordered_ids is required when action is reorder"
+            )
+        await children_layer.reorder_children(database, ordered_ids)
+
+    return _with_errors(_handler)
+
+
 def async_register_services(
     hass: HomeAssistant,
     *,
     find_runtime: FindRuntime,
+    regenerate_handler: ServiceHandler,
 ) -> None:
-    """Register the panel completion service once at domain scope.
+    """Register every canonical service once at domain scope.
 
-    The one remaining HA service is the panel completion path; every
-    admin operation moved to the API service's admin routes, so there
-    is no permission gate to apply here.
+    Every service — regenerate included — passes through the Feature
+    09 permission gate before its handler runs; the gate reads
+    :data:`~.service_policy.SERVICE_POLICY`, so no service can be
+    registered exempt from the policy.
     """
-    if hass.services.has_service(DOMAIN, SERVICE_COMPLETE_QUEST):
+    if hass.services.has_service(DOMAIN, SERVICE_REGENERATE):
         return
-    hass.services.async_register(
-        DOMAIN,
-        SERVICE_COMPLETE_QUEST,
-        _complete_quest(hass, find_runtime),
-        schema=SCHEMA_COMPLETE_QUEST,
-    )
+    gate = permission_gate
+    specs: list[tuple[str, ServiceHandler, object]] = [
+        (SERVICE_REGENERATE, regenerate_handler, None),
+        (
+            SERVICE_COMPLETE_QUEST,
+            _complete_quest(hass, find_runtime),
+            SCHEMA_COMPLETE_QUEST,
+        ),
+        (
+            SERVICE_UNCOMPLETE_QUEST,
+            _uncomplete_quest(hass, find_runtime),
+            SCHEMA_UNCOMPLETE_QUEST,
+        ),
+        (
+            SERVICE_CREATE_QUEST_DEFINITION,
+            _create_quest_definition(hass, find_runtime),
+            SCHEMA_CREATE_QUEST_DEFINITION,
+        ),
+        (
+            SERVICE_UPDATE_QUEST_DEFINITION,
+            _update_quest_definition(hass, find_runtime),
+            SCHEMA_UPDATE_QUEST_DEFINITION,
+        ),
+        (
+            SERVICE_SET_QUEST_DEFINITION_ACTIVE,
+            _set_quest_definition_active(hass, find_runtime),
+            SCHEMA_SET_QUEST_DEFINITION_ACTIVE,
+        ),
+        (
+            SERVICE_SET_PRESENCE_PATTERN,
+            _set_presence_pattern(hass, find_runtime),
+            SCHEMA_SET_PRESENCE_PATTERN,
+        ),
+        (
+            SERVICE_CREATE_PRESENCE_OVERRIDE,
+            _create_presence_override(hass, find_runtime),
+            SCHEMA_CREATE_PRESENCE_OVERRIDE,
+        ),
+        (
+            SERVICE_DELETE_PRESENCE_OVERRIDE,
+            _delete_presence_override(hass, find_runtime),
+            SCHEMA_DELETE_PRESENCE_OVERRIDE,
+        ),
+        (
+            SERVICE_EXPORT_HISTORY_CSV,
+            _export_history_csv,
+            SCHEMA_EXPORT_HISTORY_CSV,
+        ),
+        (
+            SERVICE_MANAGE_CHILD,
+            _manage_child(hass, find_runtime),
+            SCHEMA_MANAGE_CHILD,
+        ),
+    ]
+
+    def _database_of(_call: Any) -> Any:
+        return _require_runtime(hass, find_runtime).database
+
+    for service, handler, schema in specs:
+        gated = gate(
+            service, SERVICE_POLICY[service], _database_of
+        )(handler)
+        hass.services.async_register(DOMAIN, service, gated, schema=schema)
 
 
 def async_deregister_services(hass: HomeAssistant) -> None:
     """Remove every canonical service when the last entry unloads."""
     for service in DOMAIN_SERVICES:
         if hass.services.has_service(DOMAIN, service):
-            hass.services.async_remove(DOMAIN, service)
+            hass.services.async_remove(DOMAIN, service)

custom_components/nestquest/services.yaml

@@ -1,8 +1,15 @@
 # Service declarations for the NestQuest integration (Home Assistant
 # services.yaml metadata). Services are domain-scoped: nested under the
-# "nestquest" domain, not repeated per config entry.  Since Feature 18
-# only the panel completion service remains — every admin operation
-# moved to the PWA and the API service's admin routes.
+# "nestquest" domain, not repeated per config entry.
+
+regenerate:
+  name: Regenerate quest instances
+  description: >-
+    Regenerate every future quest instance for the household over the rolling
+    horizon, using the same idempotent materialization as the daily rollover
+    and the startup backfill. Safe to call at any time: a re-run refreshes the
+    same rows instead of duplicating them, and completed instances are never
+    touched.
 
 complete_quest:
   name: Complete quest
@@ -36,4 +43,284 @@ complete_quest:
       description: Home Assistant user id when actor is user and no call context is present.
       required: false
       selector:
-        text:
+        text:
+
+uncomplete_quest:
+  name: Uncomplete quest
+  description: Undo a quest instance completion.
+  fields:
+    instance_id:
+      name: Instance ID
+      description: The quest instance to uncomplete.
+      required: true
+      selector:
+        number:
+          mode: box
+    actor:
+      name: Actor
+      description: Who is undoing the completion (panel or user).
+      required: true
+      selector:
+        select:
+          options:
+            - panel
+            - user
+    actor_child_id:
+      name: Actor child ID
+      description: The tapped child profile. Required when actor is panel.
+      required: false
+      selector:
+        number:
+          mode: box
+    actor_user_id:
+      name: Actor user ID
+      description: Home Assistant user id when actor is user and no call context is present.
+      required: false
+      selector:
+        text:
+
+create_quest_definition:
+  name: Create quest definition
+  description: Create a quest definition with its schedule rule, assignees and windows.
+  fields:
+    title:
+      name: Title
+      description: Display title for the quest.
+      required: true
+      selector:
+        text:
+    rule:
+      name: Rule
+      description: Recurrence rule as a mapping (rule_type plus shape fields).
+      required: true
+      selector:
+        object:
+    assignee_child_ids:
+      name: Assignee child IDs
+      description: Child ids this definition is assigned to.
+      required: true
+      selector:
+        object:
+    windows:
+      name: Windows
+      description: Day windows (morning, afternoon, evening), optionally with a due time.
+      required: true
+      selector:
+        object:
+    description:
+      name: Description
+      description: Optional longer description.
+      required: false
+      selector:
+        text:
+    icon:
+      name: Icon
+      description: Optional icon name.
+      required: false
+      selector:
+        text:
+
+update_quest_definition:
+  name: Update quest definition
+  description: Edit a quest definition's title, description, icon, rule or windows.
+  fields:
+    definition_id:
+      name: Definition ID
+      description: The quest definition to update.
+      required: true
+      selector:
+        number:
+          mode: box
+    title:
+      name: Title
+      description: Replacement display title.
+      required: false
+      selector:
+        text:
+    description:
+      name: Description
+      description: Replacement description, or null to clear.
+      required: false
+      selector:
+        text:
+    icon:
+      name: Icon
+      description: Replacement icon, or null to clear.
+      required: false
+      selector:
+        text:
+    rule:
+      name: Rule
+      description: Replacement recurrence rule as a mapping.
+      required: false
+      selector:
+        object:
+    windows:
+      name: Windows
+      description: Replacement day windows.
+      required: false
+      selector:
+        object:
+
+set_quest_definition_active:
+  name: Set quest definition active
+  description: Deactivate or reactivate a quest definition.
+  fields:
+    definition_id:
+      name: Definition ID
+      description: The quest definition to update.
+      required: true
+      selector:
+        number:
+          mode: box
+    is_active:
+      name: Active
+      description: Whether the definition should generate future instances.
+      required: true
+      selector:
+        boolean:
+
+set_presence_pattern:
+  name: Set presence pattern
+  description: Upsert a child's repeating presence schedule.
+  fields:
+    child_id:
+      name: Child ID
+      description: The child whose schedule is being set.
+      required: true
+      selector:
+        number:
+          mode: box
+    cycle_length_weeks:
+      name: Cycle length weeks
+      description: Number of weeks in the repeating cycle (1 to 4).
+      required: true
+      selector:
+        number:
+          mode: box
+          min: 1
+          max: 4
+    anchor_date:
+      name: Anchor date
+      description: Cycle anchor as a YYYY-MM-DD date.
+      required: true
+      selector:
+        date:
+    pattern:
+      name: Pattern
+      description: Mapping of week index to present weekday ints (Monday is 0).
+      required: true
+      selector:
+        object:
+
+create_presence_override:
+  name: Create presence override
+  description: Create a date-range presence override for a child.
+  fields:
+    child_id:
+      name: Child ID
+      description: The child the override applies to.
+      required: true
+      selector:
+        number:
+          mode: box
+    start_date:
+      name: Start date
+      description: Inclusive start date (YYYY-MM-DD).
+      required: true
+      selector:
+        date:
+    end_date:
+      name: End date
+      description: Inclusive end date (YYYY-MM-DD).
+      required: true
+      selector:
+        date:
+    is_present:
+      name: Present
+      description: Whether the child is present for this range.
+      required: true
+      selector:
+        boolean:
+    note:
+      name: Note
+      description: Optional note stored with the override.
+      required: false
+      selector:
+        text:
+
+delete_presence_override:
+  name: Delete presence override
+  description: Delete a presence override by id.
+  fields:
+    override_id:
+      name: Override ID
+      description: The override to delete.
+      required: true
+      selector:
+        number:
+          mode: box
+
+export_history_csv:
+  name: Export history CSV
+  description: Export completion history as CSV. Not implemented until Feature 13.
+
+manage_child:
+  name: Manage child
+  description: Create, edit, activate or reorder child profiles.
+  fields:
+    action:
+      name: Action
+      description: create, edit, set_active, or reorder.
+      required: true
+      selector:
+        select:
+          options:
+            - create
+            - edit
+            - set_active
+            - reorder
+    child_id:
+      name: Child ID
+      description: Required for edit and set_active.
+      required: false
+      selector:
+        number:
+          mode: box
+    display_name:
+      name: Display name
+      description: Required for create; optional for edit.
+      required: false
+      selector:
+        text:
+    colour:
+      name: Colour
+      description: Optional colour string.
+      required: false
+      selector:
+        text:
+    avatar_ref:
+      name: Avatar
+      description: Optional avatar reference.
+      required: false
+      selector:
+        text:
+    sort_order:
+      name: Sort order
+      description: Optional panel sort order.
+      required: false
+      selector:
+        number:
+          mode: box
+    is_active:
+      name: Active
+      description: Required for set_active.
+      required: false
+      selector:
+        boolean:
+    ordered_ids:
+      name: Ordered IDs
+      description: Complete permutation of child ids. Required for reorder.
+      required: false
+      selector:
+        object:

custom_components/nestquest/store.py

@@ -0,0 +1,32 @@
+"""Re-export of :mod:`custom_components.nestquest.core.store` for the integration package.
+
+The path resolver lives in
+:mod:`custom_components.nestquest.core.store` (extracted in task
+d0b691d8) and is Home-Assistant-free:
+:func:`custom_components.nestquest.core.store.async_get_db_path`
+takes the full database path.  This module re-exports it and provides
+the original ``async_get_db_path(hass)`` signature so the integration
+resolves the path from ``hass.config.path`` exactly as before.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+from homeassistant.core import HomeAssistant
+
+from .core.const import SQLITE_DB_FILENAME
+from .core.store import async_get_db_path as _core_async_get_db_path
+from .core.store import _ensure_dir
+
+__all__ = ["async_get_db_path", "_ensure_dir"]
+
+
+async def async_get_db_path(hass: HomeAssistant) -> Path:
+    """Return the absolute path to the NestQuest SQLite database file.
+
+    Resolves the database file from ``hass.config.path`` and delegates to
+    :func:`custom_components.nestquest.core.store.async_get_db_path`,
+    which ensures the parent directory exists off the event loop via
+    :func:`asyncio.to_thread`.
+    """
+    return await _core_async_get_db_path(hass.config.path(SQLITE_DB_FILENAME))

custom_components/nestquest/strings.json

@@ -18,19 +18,23 @@
     "step": {
       "init": {
         "title": "NestQuest Settings",
-        "description": "Adjust how the NestQuest API client polls and reaches the NestQuest API service.",
+        "description": "Adjust how NestQuest plans, rolls over days, idles its panel, and reaches the NestQuest API service.",
         "data": {
+          "horizon_days": "Generation horizon (days)",
+          "day_rollover_time": "Day rollover time (HH:MM)",
           "panel_idle_timeout": "Panel idle timeout (seconds)",
-          "snapshot_staleness": "Last-good snapshot staleness (seconds)",
           "api_base_url": "NestQuest API base URL (http://host:port)",
-          "panel_token": "Panel service token"
+          "panel_token": "Panel service token",
+          "admin_user_ids": "Admin users (parents)"
         }
       }
     },
     "errors": {
       "invalid": "Invalid value.",
+      "invalid_time": "Time must use 24-hour HH:MM format.",
       "invalid_url": "Enter the API base URL as a full http:// or https:// URL with a host.",
-      "invalid_staleness": "Last-good snapshot staleness must be at least the update interval."
+      "no_admins": "Select at least one admin user; an empty allowlist would lock everyone out.",
+      "invalid_admin": "Invalid admin selection."
     }
   }
 }

custom_components/nestquest/sweep.py

@@ -0,0 +1,72 @@
+"""The nightly missed-quest sweep (Feature 11) — the Home Assistant shim.
+
+The sweep's policy is the HA-free core's :mod:`~.core.sweep`: the
+watermark read → ``list_missed_unswept`` query → payload build →
+watermark span, all inside the per-database sweep lock, shared with
+the API plane.  This module is the integration's thin adapter over it:
+at the configured day-rollover time (the same HA-local listener that
+re-materializes the rolling horizon) and once at setup it calls the
+core's :func:`~.core.sweep.run_missed_sweep` and fires each returned
+event on ``hass.bus`` — ONE ``nestquest_quest_missed`` per past-due
+open instance with the documented payload.  The core never touches
+Home Assistant; the firing lives here.
+
+Idempotency is the core's watermark: after a run, ``nestquest_meta_state``
+records the HA-local date the sweep ran, and the next run only sweeps
+instances due in ``[watermark, today)`` — a second run the same night
+fires nothing new, and a run after days of downtime sweeps exactly the
+accumulated window once.  An instance swept as missed that is later
+completed simply gains its completion event; the sweep is read-only
+over the domain tables (``missed`` is derived state, never an
+event_type — Feature 08's contract).
+"""
+from __future__ import annotations
+
+import datetime
+import logging
+from zoneinfo import ZoneInfo
+
+from .core.sweep import (
+    SWEEP_WATERMARK_KEY,
+    run_missed_sweep as _run_core_missed_sweep,
+)
+from .db import NestQuestDatabase
+
+LOGGER = logging.getLogger(__name__)
+
+__all__ = ["SWEEP_WATERMARK_KEY", "run_missed_sweep"]
+
+
+async def run_missed_sweep(
+    hass,
+    database: NestQuestDatabase,
+    *,
+    today: datetime.date | None = None,
+) -> int:
+    """Fire one missed event per unswept past-due open instance.
+
+    ``today`` optionally pins the HA-local date (threaded like the
+    materialization and completion layers); when omitted it is read
+    from ``hass.config.time_zone``.  Returns the number of events
+    fired.  Fires nothing and returns 0 when the watermark already
+    covers ``today`` (a same-night rerun) — the watermark read, the
+    query, the payload build and the watermark write all live in the
+    core's locked
+    :func:`~.core.sweep.run_missed_sweep`; this shim only fires each
+    returned event on the bus and counts them.
+    """
+    today_date = (
+        today
+        if today is not None
+        else datetime.datetime.now(ZoneInfo(hass.config.time_zone)).date()
+    )
+    events = await _run_core_missed_sweep(database, today=today_date)
+    for event_type, payload in events:
+        hass.bus.async_fire(event_type, payload)
+    fired = len(events)
+    LOGGER.info(
+        "NestQuest missed sweep for %s fired %d event(s)",
+        today_date.isoformat(),
+        fired,
+    )
+    return fired

custom_components/nestquest/translations/en.json

@@ -18,19 +18,23 @@
     "step": {
       "init": {
         "title": "NestQuest Settings",
-        "description": "Adjust how the NestQuest API client polls and reaches the NestQuest API service.",
+        "description": "Adjust how NestQuest plans, rolls over days, idles its panel, and reaches the NestQuest API service.",
         "data": {
+          "horizon_days": "Generation horizon (days)",
+          "day_rollover_time": "Day rollover time (HH:MM)",
           "panel_idle_timeout": "Panel idle timeout (seconds)",
-          "snapshot_staleness": "Last-good snapshot staleness (seconds)",
           "api_base_url": "NestQuest API base URL (http://host:port)",
-          "panel_token": "Panel service token"
+          "panel_token": "Panel service token",
+          "admin_user_ids": "Admin users (parents)"
         }
       }
     },
     "errors": {
       "invalid": "Invalid value.",
+      "invalid_time": "Time must use 24-hour HH:MM format.",
       "invalid_url": "Enter the API base URL as a full http:// or https:// URL with a host.",
-      "invalid_staleness": "Last-good snapshot staleness must be at least the update interval."
+      "no_admins": "Select at least one admin user; an empty allowlist would lock everyone out.",
+      "invalid_admin": "Invalid admin selection."
     }
   }
 }

docs/ARCHITECTURE.md

@@ -1,203 +0,0 @@
-# NestQuest Architecture
-
-Status: approved direction (2026-09-21). This document supersedes the
-single-process design implied by Features 01–14, in which the Home Assistant
-integration owned the database and the parent admin surface was planned as a
-Lovelace card inside Home Assistant.
-
-## 1. Why this changed
-
-The original design put everything inside the Home Assistant integration: the
-SQLite database, the business logic, the kid panel cards, and (planned) the
-parent admin card. Three problems surfaced:
-
-1. **The panel needed hand configuration.** Standing up the kid panel required
-   hand-writing card YAML (`child_order`, `quest_log_path`, `board_path`) and
-   hand-creating a Lovelace dashboard. A fresh install rendered nothing.
-2. **The admin surface fought Home Assistant.** The admin design
-   (`design/ADMIN-SPEC.md`) is drawn at 390×844 — it is a phone app. Trapping it
-   inside a Lovelace card meant fighting HA's UI constraints for a mobile-first
-   experience.
-3. **Data was locked to one process.** A standalone admin web app cannot reach a
-   SQLite file inside Home Assistant's config directory.
-
-The re-imagined design keeps the panel in Home Assistant (TouchHub loads an HA
-dashboard), moves data ownership to a standalone API service, and promotes the
-admin surface to a standalone mobile-first PWA.
-
-## 2. Target architecture
-
-```
- DAKboard TouchHub
-       │  (loads an HA dashboard URL)
-       ▼
- HA box                                        API box
- ┌───────────────────────────────┐            ┌───────────────────────────────────┐
- │ Lovelace panel dashboard      │            │ reverse proxy (TLS)               │
- │  ├ nestquest-party-board-card │  service   │  ├ /api/v1/panel/*   LAN-only     │
- │  └ nestquest-quest-log-card   │  token     │  └ /api/v1/admin/*   public       │
- │                               │ ─────────▶ │ FastAPI (imports core/)           │
- │ NestQuest integration         │            │  └ SQLite (owned here)            │
- │  (thin client, no database)   │ ◀───────── │ Authentik (OIDC)                  │
- │  sensors + HA bus events      │  SSE       └───────────────────────────────────┘
- └───────────────────────────────┘                          ▲
-                                            PWA ───────────┘
-                                  https://nestquest.cubecraftlabs.com
-```
-
-One owner of the data (the API). Two clients (the HA integration, the PWA).
-
-## 3. Data ownership
-
-**The API service is the only writer.** The HA integration never opens the
-database; it reads a snapshot and posts completions. This removes the
-two-writer problem entirely.
-
-- **Storage:** SQLite on the API box. Single household, trivial concurrency,
-  and the existing schema, migrations, and DAO tests are already SQLite. Postgres
-  buys nothing at this scale.
-- **Schema:** unchanged. The cutover from the current HA-hosted database is a
-  file copy — same schema, same migration version.
-- **Backups:** continuous replication (e.g. Litestream) plus a proven restore.
-  A configured-but-untested backup is not a backup.
-
-## 4. Authentication: two planes
-
-The kid panel and the admin PWA have opposite trust levels, so they use
-separate credentials and separate network exposure.
-
-### Panel plane (machine)
-
-- **Credential:** a static service token.
-- **Exposure:** `/api/v1/panel/*` is reachable **only from the LAN**.
-- **Grants:** read the snapshot, and the single open write — complete a quest as
-  `actor: panel` with the tapped `actor_child_id`.
-- **Refused:** admin routes reject the service token outright, not merely as a
-  non-admin. The internet cannot reach these routes at all.
-
-This preserves the original fail-closed boundary: the kiosk can complete a
-quest and nothing else.
-
-### Admin plane (human)
-
-- **Credential:** an Authentik OIDC JWT (authorization code + PKCE).
-- **Exposure:** `/api/v1/admin/*` is internet-facing behind Authentik.
-- **Grants:** everything a parent can do — definitions, assignment, presence,
-  children, un-complete, history, export, settings, regenerate.
-- **Gate:** the API validates the JWT (issuer, audience, JWKS signature, expiry)
-  and requires membership in the `nestquest-admins` group. The Authentik group
-  is the single source of truth for "who is a parent", replacing the
-  integration-side admin allowlist.
-
-## 5. Components
-
-### `core/` — domain library
-
-The extracted domain layer: schema, migrations, database access, DAOs, the pure
-recurrence and presence engines, materialization, completion, event payload
-construction, and the children/definitions/allowlist business layers. **No
-Home Assistant imports.** Consumed by both the API and (during transition) the
-integration. This is where the ~1500 existing tests live after extraction.
-
-### `api/` — NestQuest API
-
-A FastAPI service importing `core/`. Owns the database. Serves the panel and
-admin planes, validates Authentik tokens, and publishes a transition event
-stream (SSE) that the integration consumes. No business logic in route handlers.
-
-### `custom_components/nestquest/` — HA integration (client)
-
-A thin client. Polls the snapshot and builds the existing sensors; subscribes to
-the SSE stream and re-fires the four HA bus events; proxies the panel completion.
-Holds a last-good snapshot cache so a brief API outage does not blank the panel.
-Owns no database and no business logic.
-
-### `panel/` — Lovelace cards and dashboard strategy
-
-The two kid-facing Lit cards plus a dashboard strategy that generates the panel
-views at render time. Cards auto-discover children, so no `child_order` is
-required; the strategy computes navigation paths, so `quest_log_path` and
-`board_path` are not required.
-
-### `admin/` — Admin PWA
-
-A React progressive web app implementing `design/ADMIN-SPEC.md`, authenticated
-via Authentik OIDC, installable on a phone. The only admin surface.
-
-## 6. Zero-configuration panel
-
-A fresh install should show the panel with no YAML:
-
-1. **Auto-discovery.** The party-board card reads an ordered child list from a
-   household entity attribute instead of a configured `child_order`.
-2. **Dashboard strategy.** A Lovelace strategy generates a party-board view and
-   one quest-log view per child, wiring navigation between them, so paths are
-   computed rather than configured. Explicit configuration still wins if a user
-   supplies it.
-3. **Auto-registration.** The integration registers the dashboard on first
-   setup, so there is no manual dashboard step.
-
-## 7. Home Assistant surface preserved
-
-The re-imagining must not break what already works:
-
-- **Sensors:** the per-child and household sensor entity_ids and the per-child
-  instance attribute payload shape are unchanged. The panel cards and the four
-  blueprints depend on them.
-- **Events:** the four HA bus events (`nestquest_quest_completed`,
-  `nestquest_quest_uncompleted`, `nestquest_quest_missed`,
-  `nestquest_child_day_complete`) keep firing with their documented payloads.
-  They are now driven by the API's transition stream rather than by local
-  service handlers.
-- **Blueprints:** the morning summary, afternoon reminder, end-of-day report, and
-  day-complete celebration continue to work with no change.
-
-## 8. Events without an HA token on the API box
-
-The API publishes transitions on an SSE stream; the integration subscribes and
-re-fires the HA bus events locally. This deliberately avoids storing a Home
-Assistant long-lived token on the API box, which would grant full HA access.
-
-## 9. Migration phases
-
-Mapped to the Maestro features:
-
-| Phase | Feature | Outcome |
-|---|---|---|
-| 1 | 15 — Domain Core Extraction | `core/` runs with no HA imports; one implementation of the rules |
-| 2 | 16 — NestQuest API Service | Panel and admin planes served with two-plane auth |
-| 3 | 17 — API Deployment and Identity | TLS, Authentik, backups, network separation |
-| 4 | 18 — HA Integration as API Client | Integration becomes a client; entity/event surface preserved |
-| 5 | 19 — Admin PWA | Mobile-first React PWA replaces the admin card |
-| 6 | 20 — Zero-Config Panel Dashboard | Panel installs itself; navigation and animations match the mockups |
-
-Cutover: copy the existing SQLite file to the API box (same schema).
-
-## 10. Locked decisions
-
-- **API on its own box** — separate from Home Assistant.
-- **Authentik** (`https://auth.cubecraftlabs.com`) for admin identity; a
-  `nestquest-admins` group is the admin source of truth.
-- **Single household** — no tenant column, no multi-household auth.
-- **React** for the admin PWA.
-- **Drop the HA admin services** — the PWA is the only admin surface. The panel
-  completion path stays.
-- **SQLite on the API box** initially; Postgres only if multi-household ever
-  becomes real.
-
-## 11. Preserved vs. changed
-
-**Preserved:** the tested Python domain layer, the panel card designs and
-tokens, the sensor and event contract, the completion model, the append-only
-event log, the panel's fail-closed "complete only" boundary.
-
-**Changed:** data ownership moves to the API; the integration becomes a client;
-the admin card becomes a PWA; panel cards become config-free with a
-strategy-generated dashboard.
-
-**New:** the API service, Authentik-gated admin auth, the PWA, and a
-last-good-snapshot cache in the integration.
-
-**Cost:** two new deployables (the API and the PWA) and one new box. Accepted
-knowingly in exchange for a self-installing panel, an admin surface that is not
-fighting HA's UI, and a data layer with real auth in front of it.

frontend/package-lock.json

@@ -9,197 +9,10 @@
         "lit": "^3.3.0"
       },
       "devDependencies": {
-        "jsdom": "^30.1.1",
         "typescript": "^5.9.2",
         "vite": "^7.1.5"
       }
     },
-    "node_modules/@asamuzakjp/css-color": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-7.0.1.tgz",
-      "integrity": "sha512-C9duntabagkBZ1LebM7FKmphR4Q1pBclLxVbZETQV0akkFjV0ooFxo8FlvAQyKj9F6l8rEnmidgcTlpyxFYizg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/css-calc": "^3.4.0",
-        "@csstools/css-color-parser": "^4.2.3",
-        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.1",
-        "lru-cache": "^11.5.3"
-      },
-      "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
-      }
-    },
-    "node_modules/@asamuzakjp/dom-selector": {
-      "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-9.2.1.tgz",
-      "integrity": "sha512-NT4s3yZLjovPpliRpTvdsdzyPjqRqiCZj9MxnarBihbaY5MbAG7DWAJcrLlhmC7xKTNCXsTELcqB8YsqpLnUFQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bidi-js": "^1.1.0",
-        "css-tree": "^3.2.1",
-        "is-potential-custom-element-name": "^1.0.1",
-        "lru-cache": "^11.5.3"
-      },
-      "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
-      }
-    },
-    "node_modules/@bramus/specificity": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz",
-      "integrity": "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "css-tree": "^3.0.0"
-      },
-      "bin": {
-        "specificity": "bin/cli.js"
-      }
-    },
-    "node_modules/@csstools/color-helpers": {
-      "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.1.tgz",
-      "integrity": "sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "engines": {
-        "node": ">=20.19.0"
-      }
-    },
-    "node_modules/@csstools/css-calc": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-3.4.0.tgz",
-      "integrity": "sha512-XQKj5B7QiZcHiegCOCAzcAOJdhGgWOHbbu62h5e5mkHnn8lWcfiJhllkqWmxu5zWR9jucPHuo1iTB56P033hcg==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0"
-      }
-    },
-    "node_modules/@csstools/css-color-parser": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.3.tgz",
-      "integrity": "sha512-y4LpL+lmpuyKDiEFq2PnZUVFdAjsoB/qQJod79yLNokXyW7jewi+/WJ69EfItj8A2unWtxXnGjw6LYXgXu5ZjA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@csstools/color-helpers": "^6.1.1",
-        "@csstools/css-calc": "^3.4.0"
-      },
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0"
-      }
-    },
-    "node_modules/@csstools/css-parser-algorithms": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-4.0.0.tgz",
-      "integrity": "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@csstools/css-tokenizer": "^4.0.0"
-      }
-    },
-    "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.14.tgz",
-      "integrity": "sha512-HpbVXyrofRXpHpgkNIjU/3EWR4WJvOkO3emNK/L6X/mTJU7bGUI3AkkpoTNXznQLp0KRjLHELTGeKI5dIkI9JQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT-0",
-      "peerDependencies": {
-        "css-tree": "^3.2.1"
-      },
-      "peerDependenciesMeta": {
-        "css-tree": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@csstools/css-tokenizer": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.1.tgz",
-      "integrity": "sha512-bPlN9S9O1A0euCpEWE4qnvB5YDuyYVsUTrxSgmAM1Is0j4tICHoVyOVAXfWMP/kS9ZrjvyIXWV2PmomiAXXqOw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/csstools"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/csstools"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.19.0"
-      }
-    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.28.2",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
@@ -642,24 +455,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@exodus/bytes": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/@exodus/bytes/-/bytes-1.16.0.tgz",
-      "integrity": "sha512-IcpW84uEn3N7ETtNZMlxKhfl6Pec8rUNGOTBtWbK1FKhJxIFAptZyVrvVRVBimAJxJCgc3PxepxkdWWG4DVzfA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      },
-      "peerDependencies": {
-        "@noble/hashes": "^1.8.0 || ^2.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@noble/hashes": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@lit-labs/ssr-dom-shim": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/@lit-labs/ssr-dom-shim/-/ssr-dom-shim-1.6.0.tgz",
@@ -1097,79 +892,6 @@
       "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
       "license": "MIT"
     },
-    "node_modules/bidi-js": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/bidi-js/-/bidi-js-1.1.0.tgz",
-      "integrity": "sha512-fX1Onk0tdVPC7obPWB5EbJ1z7NVhLq4m2xZLq2YXBkxzMXIGRpNMU88n0EPgWseKl12J7zXs7qrDxPK4sRs2fg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "require-from-string": "^2.0.2"
-      }
-    },
-    "node_modules/css-tree": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
-      "integrity": "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mdn-data": "2.27.1",
-        "source-map-js": "^1.2.1"
-      },
-      "engines": {
-        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
-      }
-    },
-    "node_modules/data-urls": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-7.0.0.tgz",
-      "integrity": "sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "whatwg-mimetype": "^5.0.0",
-        "whatwg-url": "^16.0.0"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      }
-    },
-    "node_modules/data-urls/node_modules/whatwg-url": {
-      "version": "16.0.1",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-16.0.1.tgz",
-      "integrity": "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@exodus/bytes": "^1.11.0",
-        "tr46": "^6.0.0",
-        "webidl-conversions": "^8.0.1"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
-      }
-    },
-    "node_modules/decimal.js": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
-      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/entities": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-8.1.0.tgz",
-      "integrity": "sha512-kxL7msIffSuh9aaFAMD7rxAIuTRMAHMeBtgHW2yUdWw732ZNh4MehkF2gdjvtdmikkaIP9bFDDJOPlsvm7avrA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
     "node_modules/esbuild": {
       "version": "0.28.2",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
@@ -1245,66 +967,6 @@
         "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
-    "node_modules/html-encoding-sniffer": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-7.0.0.tgz",
-      "integrity": "sha512-UikN5yr7xsCDAq87Or5or0PAlD3HJJOKVzM05az588WnpDJ4Ux7a2A53Qi6gofGg2/EtvF/H4hCi/TXfCW4Y6w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@exodus/bytes": "^1.15.1"
-      },
-      "engines": {
-        "node": "^22.13.0 || >=24.0.0"
-      }
-    },
-    "node_modules/is-potential-custom-element-name": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/jsdom": {
-      "version": "30.1.1",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.1.1.tgz",
-      "integrity": "sha512-FahmoPK5vbPc+jxV1iErMHmAZypCZ942NHF4+qqaWAuvaKKTBZxawnmAtrbGWLU7MtlxfqIP0qw6aSI+aWGtLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@asamuzakjp/css-color": "^7.0.0",
-        "@asamuzakjp/dom-selector": "^9.2.1",
-        "@bramus/specificity": "^2.4.2",
-        "@csstools/css-syntax-patches-for-csstree": "^1.1.13",
-        "@exodus/bytes": "^1.15.1",
-        "css-tree": "^3.2.1",
-        "data-urls": "^7.0.0",
-        "decimal.js": "^10.6.0",
-        "html-encoding-sniffer": "^7.0.0",
-        "is-potential-custom-element-name": "^1.0.1",
-        "lru-cache": "^11.5.2",
-        "parse5": "^8.0.1",
-        "saxes": "^6.0.0",
-        "tough-cookie": "^6.0.2",
-        "undici": "^8.10.2",
-        "w3c-xmlserializer": "^6.0.0",
-        "webidl-conversions": "^8.0.1",
-        "whatwg-mimetype": "^5.0.0",
-        "whatwg-url": "^17.1.1",
-        "xml-name-validator": "^5.0.0"
-      },
-      "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
-      },
-      "peerDependencies": {
-        "canvas": "^3.2.3"
-      },
-      "peerDependenciesMeta": {
-        "canvas": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/lit": {
       "version": "3.3.3",
       "resolved": "https://registry.npmjs.org/lit/-/lit-3.3.3.tgz",
@@ -1336,23 +998,6 @@
         "@types/trusted-types": "^2.0.2"
       }
     },
-    "node_modules/lru-cache": {
-      "version": "11.5.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
-      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/mdn-data": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
-      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
-      "dev": true,
-      "license": "CC0-1.0"
-    },
     "node_modules/nanoid": {
       "version": "3.3.19",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
@@ -1372,19 +1017,6 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
-    "node_modules/parse5": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
-      "integrity": "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "entities": "^8.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/inikulin/parse5?sponsor=1"
-      }
-    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -1434,26 +1066,6 @@
         "node": "^10 || ^12 || >=14"
       }
     },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/rollup": {
       "version": "4.63.4",
       "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.63.4.tgz",
@@ -1500,19 +1112,6 @@
         "fsevents": "~2.3.2"
       }
     },
-    "node_modules/saxes": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
-      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "xmlchars": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=v12.22.7"
-      }
-    },
     "node_modules/source-map-js": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
@@ -1540,52 +1139,6 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tldts": {
-      "version": "7.4.14",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.14.tgz",
-      "integrity": "sha512-EahQoi+Q5oqmG3yxRHx+bwn36OaLbtw6jnTFcGjc8fcmktzTgk45xRnzAx8Ch87PFEiqRhoc3FWBmY+LBrvEGQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "tldts-core": "^7.4.14"
-      },
-      "bin": {
-        "tldts": "bin/cli.js"
-      }
-    },
-    "node_modules/tldts-core": {
-      "version": "7.4.14",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.14.tgz",
-      "integrity": "sha512-KYkjfJHnIC5t+Gy7hPrMHgJmWc/N9FfmS+fggRPSlpFckidpB9HD6OzPsSTkfDH+MpZgcu2tJPGgLfHl979N1Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/tough-cookie": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
-      "integrity": "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "tldts": "^7.0.5"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/tr46": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-6.0.0.tgz",
-      "integrity": "sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "punycode": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
@@ -1600,16 +1153,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/undici": {
-      "version": "8.11.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.0.tgz",
-      "integrity": "sha512-AdzuGcAkzhbha3GgCSoUBx2P0quwym6qdFNCQz/fDGZc8w9XJ741wHUbt2kTmfPz+ZIOMkySFkiY7RXmiDDC8w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=22.19.0"
-      }
-    },
     "node_modules/vite": {
       "version": "7.3.6",
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz",
@@ -1684,71 +1227,6 @@
           "optional": true
         }
       }
-    },
-    "node_modules/w3c-xmlserializer": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-6.0.0.tgz",
-      "integrity": "sha512-4Nsy8K5Tr6SPDH9jhKJOHf7ChDrc1zufZTVSF7x72hwuEXBqxqk9G6cK+K2NRUtB3iELRJqjXb4JPDMBjMTl2Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "xml-name-validator": "^5.0.0"
-      },
-      "engines": {
-        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
-      }
-    },
-    "node_modules/webidl-conversions": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-8.0.1.tgz",
-      "integrity": "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/whatwg-mimetype": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-5.0.0.tgz",
-      "integrity": "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/whatwg-url": {
-      "version": "17.1.2",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-17.1.2.tgz",
-      "integrity": "sha512-TEZA+Zqxin7Jjsm2cjRohCmen5awh+hT6Zi3VZdqZlNRk7zvOI/9WpBFg/DWlA56bWnzwm6DuB8NS0EsxQH9uQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@exodus/bytes": "^1.15.1",
-        "tr46": "^6.0.0",
-        "webidl-conversions": "^8.0.1"
-      },
-      "engines": {
-        "node": "^22.14.0 || >=24.0.0"
-      }
-    },
-    "node_modules/xml-name-validator": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
-      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/xmlchars": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
-      "dev": true,
-      "license": "MIT"
     }
   }
 }

frontend/package.json

@@ -9,7 +9,6 @@
     "lit": "^3.3.0"
   },
   "devDependencies": {
-    "jsdom": "^30.1.1",
     "typescript": "^5.9.2",
     "vite": "^7.1.5"
   }

frontend/src/cards/party-board.ts

@@ -143,16 +143,6 @@ function asNumber(value: unknown, fallback: number): number {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 
-/** The slug a discovered roster entry carries, or "" when the entry is
- *  not an object with a non-empty slug string. */
-function asRosterSlug(entry: unknown): string {
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-    return "";
-  }
-  const slug = (entry as Record<string, unknown>).slug;
-  return typeof slug === "string" ? slug.trim() : "";
-}
-
 function clampPercent(value: number): number {
   if (!Number.isFinite(value)) {
     return 0;
@@ -902,34 +892,15 @@ export class NestQuestPartyBoardCard extends LitElement {
       return [];
     }
     const order = this._config.child_order;
-    if (Array.isArray(order)) {
-      return order
-        .filter(
-          (entry): entry is string =>
-            typeof entry === "string" && entry.trim().length > 0
-        )
-        .map((entry) => entry.trim());
-    }
-    return this._discoveredChildSlugs();
-  }
-
-  /** Zero-config discovery (Feature 20): the ordered child roster the
-   *  integration publishes on the household rollup
-   *  (custom_components/nestquest/sensor.py — ``child_roster``, the
-   *  snapshot's sort_order, then id), each entry carrying the slug the
-   *  per-child entity ids are built from.  Consulted only when the
-   *  config has no child_order — explicit configuration wins. */
-  private _discoveredChildSlugs(): string[] {
-    const household = this._state(
-      "sensor.nestquest_household_quests_due_today"
-    );
-    const roster = household?.attributes?.child_roster;
-    if (!Array.isArray(roster)) {
+    if (!Array.isArray(order)) {
       return [];
     }
-    return roster
-      .map((entry) => asRosterSlug(entry))
-      .filter((slug) => slug.length > 0);
+    return order
+      .filter(
+        (entry): entry is string =>
+          typeof entry === "string" && entry.trim().length > 0
+      )
+      .map((entry) => entry.trim());
   }
 
   private _plates(): ChildPlate[] {

frontend/src/nestquest-cards.ts

@@ -1,7 +1,6 @@
 import "./cards/party-board";
 import "./cards/quest-log";
 import "./cards/admin";
-import "./strategy";
 
 const FONTS_HREF = "/nestquest-static/nestquest-fonts.css";
 if (!document.querySelector('link[data-nq-fonts=""]')) {

frontend/src/strategy.ts

@@ -1,161 +0,0 @@
-import type { HassLike } from "./types";
-
-type StateObject = {
-  state: unknown;
-  attributes?: Record<string, unknown> | null;
-};
-
-type RosterEntry = {
-  name: string;
-  slug: string;
-};
-
-type View = {
-  path?: string;
-  title?: string;
-  type: string;
-  cards: Record<string, unknown>[];
-};
-
-type LovelaceConfig = {
-  views: View[];
-};
-
-type StrategyConfig = Record<string, unknown>;
-
-type StrategyClass = {
-  generate: (
-    config: StrategyConfig,
-    hass: HassLike | undefined
-  ) => Promise<LovelaceConfig>;
-};
-
-declare global {
-  interface Window {
-    customStrategies?: Record<string, StrategyClass>;
-  }
-}
-
-function asString(value: unknown): string {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-/** The slug a discovered roster entry carries, or "" when the entry is
- *  not an object with a non-empty slug string — the same shape check
- *  the party board applies to the same attribute. */
-function asRosterSlug(entry: unknown): string {
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-    return "";
-  }
-  const slug = (entry as Record<string, unknown>).slug;
-  return typeof slug === "string" ? slug.trim() : "";
-}
-
-/** The dashboard's URL path segment, used to COMPUTE the card paths the
- *  navigation needs.  A dashboard lives at a single top-level segment
- *  (/<url_path>), so the first pathname segment is the dashboard root —
- *  this is where the strategy renders, and navigating back to it shows
- *  the first view (the party board).  An explicit ``url_path`` in the
- *  strategy configuration wins for setups that need to pin it. */
-function dashboardUrlPath(config: StrategyConfig): string {
-  const configured = asString(config.url_path).replace(/^\/+|\/+$/g, "");
-  if (configured) {
-    return configured;
-  }
-  const segment = window.location.pathname.split("/").filter(Boolean)[0];
-  return segment ?? "";
-}
-
-/** The display name a roster entry carries, or "" when it is not a
- *  non-empty string — the roster's ``name`` field (sensor.py
- *  ``_child_roster``), used for the quest-log view titles. */
-function asRosterName(entry: unknown): string {
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-    return "";
-  }
-  const name = (entry as Record<string, unknown>).name;
-  return typeof name === "string" ? name.trim() : "";
-}
-
-/** The ordered child roster the integration publishes on the household
- *  rollup (custom_components/nestquest/sensor.py — ``child_roster``,
- *  the snapshot's sort_order, then id).  The same source the party
- *  board's plate discovery reads, consumed here at render time so the
- *  quest-log views exist for exactly the active children. */
-function rosterEntries(hass: HassLike | undefined): RosterEntry[] {
-  const states = hass?.states as Record<string, StateObject> | undefined;
-  const household = states?.["sensor.nestquest_household_quests_due_today"];
-  const roster = household?.attributes?.child_roster;
-  if (!Array.isArray(roster)) {
-    return [];
-  }
-  return roster
-    .map((entry) => ({ slug: asRosterSlug(entry), name: asRosterName(entry) }))
-    .filter((entry) => entry.slug.length > 0);
-}
-
-/**
- * Zero-config NestQuest dashboard strategy (Feature 20).
- *
- * A dashboard configured with ``strategy: { type: custom:nestquest-party }``
- * gets its views GENERATED at render time from the household roster: one
- * party-board view (the dashboard root) and one quest-log view per child,
- * ordered by the roster's sort_order.  The paths the cards navigate by are
- * COMPUTED, not configured:
- *
- * - the board's ``quest_log_path`` is the dashboard root; tapping a crest
- *   pushes ``<root>/<slug>`` (party-board.ts ``_openQuestLog``);
- * - each log view's ``path`` IS the child's slug, so the log resolves its
- *   child from the last pathname segment (quest-log.ts
- *   ``childSlugFromPath``) and its ``board_path`` back to the dashboard
- *   root (quest-log.ts ``_returnToBoard``).
- *
- * With zero children the board view still renders — the board card shows
- * its own "not set up yet" notice for an empty roster, so no log views are
- * needed.  ``url_path`` and ``weather_entity`` may still be set explicitly
- * in the strategy configuration; everything else is derived.
- */
-export class NestQuestPartyStrategy {
-  static async generate(
-    config: StrategyConfig,
-    hass: HassLike | undefined
-  ): Promise<LovelaceConfig> {
-    const root = `/${dashboardUrlPath(config)}`;
-    const weatherEntity = asString(config.weather_entity);
-    const boardCard: Record<string, unknown> = {
-      type: "custom:nestquest-party-board-card",
-      quest_log_path: root,
-    };
-    if (weatherEntity) {
-      boardCard.weather_entity = weatherEntity;
-    }
-    const logCard: Record<string, unknown> = {
-      type: "custom:nestquest-quest-log-card",
-      board_path: root,
-    };
-    if (weatherEntity) {
-      logCard.weather_entity = weatherEntity;
-    }
-    return {
-      views: [
-        {
-          path: "party",
-          title: "The Party",
-          type: "panel",
-          cards: [boardCard],
-        },
-        ...rosterEntries(hass).map<View>((entry) => ({
-          path: entry.slug,
-          title: entry.name
-            ? `${entry.name}'s Quest Log`
-            : `${entry.slug}'s Quest Log`,
-          type: "panel",
-          cards: [{ ...logCard }],
-        })),
-      ],
-    };
-  }
-}
-
-window.customStrategies = window.customStrategies ?? {};
-window.customStrategies["nestquest-party"] = NestQuestPartyStrategy;

frontend/tests/render-party-board.mjs

@@ -1,80 +0,0 @@
-/**
- * Render the built party-board card under jsdom and print its plates.
- *
- * Usage: node render-party-board.mjs < spec.json
- *
- * The spec JSON carries {bundle, tag, config, hass, url?, click_plate?};
- * stdout receives one JSON object {plates, tappable, location, html} where
- * plates is the ordered plate list the shadow DOM renders (name +
- * present/away/unknown kind), tappable the plate names rendered as tappable
- * <button> plates, and location the window pathname after the optional plate
- * tap. The Python panel tests drive this harness so the assertions run
- * against the exact bundle HACS ships.
- */
-import { readFileSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import { JSDOM } from "jsdom";
-
-const spec = JSON.parse(readFileSync(0, "utf8"));
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: spec.url ?? "http://homeassistant.local/nestquest/board",
-  pretendToBeVisual: true,
-});
-
-// Expose the jsdom globals the Lit bundle expects. Node's own intrinsics
-// (Object, Array, ...) are kept — only what globalThis lacks is copied.
-for (const key of Object.getOwnPropertyNames(dom.window)) {
-  if (!(key in globalThis)) {
-    try {
-      globalThis[key] = dom.window[key];
-    } catch {
-      // jsdom getters may throw on access; the card does not need them.
-    }
-  }
-}
-globalThis.window = dom.window;
-// The card navigates by dispatching new Event("location-changed") on this
-// window; jsdom's EventTarget rejects Node's own global Event class, so the
-// jsdom Event must shadow it for the dispatched event to be delivered.
-globalThis.Event = dom.window.Event;
-
-await import(pathToFileURL(spec.bundle).href);
-
-const element = document.createElement(spec.tag);
-element.setConfig(spec.config);
-element.hass = spec.hass;
-document.body.appendChild(element);
-await element.updateComplete;
-
-const plateNodes = [
-  ...element.shadowRoot.querySelectorAll(".plates .plate"),
-];
-const plates = plateNodes.map((plate) => ({
-  name: plate.querySelector(".name")?.textContent?.trim() ?? "",
-  kind: plate.classList.contains("unknown")
-    ? "unknown"
-    : plate.classList.contains("away")
-      ? "away"
-      : "present",
-}));
-const tappable = plateNodes
-  .filter((plate) => plate.tagName === "BUTTON")
-  .map((plate) => plate.querySelector(".name")?.textContent?.trim() ?? "");
-
-if (spec.click_plate !== undefined) {
-  const plate = plateNodes.find(
-    (candidate) =>
-      candidate.querySelector(".name")?.textContent?.trim() === spec.click_plate
-  );
-  plate?.click();
-}
-
-const payload = JSON.stringify({
-  plates,
-  tappable,
-  location: window.location.pathname,
-  html: element.shadowRoot.innerHTML,
-});
-await new Promise((resolve) => process.stdout.write(payload, () => resolve()));
-process.exit(0);

frontend/tests/render-quest-log.mjs

@@ -1,73 +0,0 @@
-/**
- * Render the built quest-log card under jsdom and report its location.
- *
- * Usage: node render-quest-log.mjs < spec.json
- *
- * The spec JSON carries {bundle, url, config, hass, idle_ms?, probe_ms?};
- * the card is mounted at the given URL (it resolves its child from the
- * pathname's last segment), after the optional probe wait one snapshot of
- * the render is taken mid-wait, then after the optional idle wait stdout
- * receives one JSON object {location, headline, countdown, html, probe} —
- * the final window pathname, the rendered title, the complete-screen
- * countdown text, the rendered shadow DOM, and the probe snapshot when
- * probe_ms was given. The Python panel tests drive this harness so the
- * assertions run against the exact bundle HACS ships.
- */
-import { readFileSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import { JSDOM } from "jsdom";
-
-const spec = JSON.parse(readFileSync(0, "utf8"));
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: spec.url ?? "http://homeassistant.local/nestquest/ada",
-  pretendToBeVisual: true,
-});
-
-// Expose the jsdom globals the Lit bundle expects. Node's own intrinsics
-// (Object, Array, ...) are kept — only what globalThis lacks is copied.
-for (const key of Object.getOwnPropertyNames(dom.window)) {
-  if (!(key in globalThis)) {
-    try {
-      globalThis[key] = dom.window[key];
-    } catch {
-      // jsdom getters may throw on access; the card does not need them.
-    }
-  }
-}
-globalThis.window = dom.window;
-// The card navigates by dispatching new Event("location-changed") on this
-// window; jsdom's EventTarget rejects Node's own global Event class, so the
-// jsdom Event must shadow it for the return navigation to be delivered.
-globalThis.Event = dom.window.Event;
-
-await import(pathToFileURL(spec.bundle).href);
-
-const element = document.createElement("nestquest-quest-log-card");
-element.setConfig(spec.config);
-element.hass = spec.hass;
-document.body.appendChild(element);
-await element.updateComplete;
-
-const snapshot = () => ({
-  location: window.location.pathname,
-  headline: element.shadowRoot.querySelector(".title")?.textContent?.trim() ?? "",
-  countdown:
-    element.shadowRoot.querySelector(".complete-countdown")?.textContent?.trim() ??
-    "",
-  html: element.shadowRoot.innerHTML,
-});
-
-let probe = null;
-if (spec.probe_ms !== undefined) {
-  await new Promise((resolve) => setTimeout(resolve, spec.probe_ms));
-  probe = snapshot();
-}
-
-if (spec.idle_ms !== undefined) {
-  await new Promise((resolve) => setTimeout(resolve, spec.idle_ms));
-}
-
-const payload = JSON.stringify({ ...snapshot(), probe });
-await new Promise((resolve) => process.stdout.write(payload, () => resolve()));
-process.exit(0);

frontend/tests/render-strategy.mjs

@@ -1,48 +0,0 @@
-/**
- * Import the built bundle into jsdom and generate the dashboard strategy's
- * views.
- *
- * Usage: node render-strategy.mjs < spec.json
- *
- * The spec JSON carries {bundle, url, config, hass}; stdout receives one
- * JSON object {views} — the strategy output's views array with the paths
- * and card configs the generated dashboard renders.  The Python panel
- * tests drive this harness so the assertions run against the exact bundle
- * HACS ships.
- */
-import { readFileSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import { JSDOM } from "jsdom";
-
-const spec = JSON.parse(readFileSync(0, "utf8"));
-
-const dom = new JSDOM("<!doctype html><html><body></body></html>", {
-  url: spec.url ?? "http://homeassistant.local/nestquest/party",
-  pretendToBeVisual: true,
-});
-
-// Expose the jsdom globals the Lit bundle expects. Node's own intrinsics
-// (Object, Array, ...) are kept — only what globalThis lacks is copied.
-for (const key of Object.getOwnPropertyNames(dom.window)) {
-  if (!(key in globalThis)) {
-    try {
-      globalThis[key] = dom.window[key];
-    } catch {
-      // jsdom getters may throw on access; the strategy does not need them.
-    }
-  }
-}
-globalThis.window = dom.window;
-
-await import(pathToFileURL(spec.bundle).href);
-
-const strategy = window.customStrategies?.["nestquest-party"];
-if (!strategy) {
-  console.error("nestquest-party strategy is not registered on the bundle");
-  process.exit(1);
-}
-
-const lovelace = await strategy.generate(spec.config, spec.hass);
-const payload = JSON.stringify({ views: lovelace.views });
-await new Promise((resolve) => process.stdout.write(payload, () => resolve()));
-process.exit(0);

orchestration_tests/test_cycle_prompt.py

@@ -51,36 +51,6 @@ class CyclePromptTests(unittest.TestCase):
         self.assertNotIn("The persistent user service runs", output)
         self.assertNotIn("---\n\n---\n\n# 27", output)
 
-    def test_task_complete_feature_triggers_one_guarded_promotion(self):
-        output = RENDER(TEMPLATE, PROFILE)
-        self.assertIn(
-            "feature becomes task-complete and its reviewed merge into `dev` is verified",
-            output,
-        )
-        self.assertIn("Every required feature task is `done`", output)
-        self.assertIn("No task review, remediation, approval, or merge remains pending", output)
-        self.assertIn("feature acceptance criteria and integrated checks pass", output)
-        self.assertIn("Independent approval applies to the exact feature head", output)
-        self.assertIn("approver's merge of that head into `dev` is verified", output)
-        self.assertIn("reflects the completed feature and exact repository references", output)
-        self.assertIn("Task completion inside an unmerged feature branch does not trigger", output)
-        self.assertIn("Do not create a duplicate promotion", output)
-        self.assertIn("Allow only one active promotion pull request to `main`", output)
-        self.assertIn("if it was closed without merge, recalculate", output)
-        self.assertIn("sole active orchestrator for the project", output)
-        self.assertIn("including controller exclusivity, reconciliation", output)
-        self.assertIn("RELEASE_PREPARATION_POLICY = EXCLUDED", output)
-        self.assertIn("Active promotion branch and pull request", output)
-        self.assertIn("An active promotion that has not reached `RELEASE_READY`", output)
-        self.assertIn("RELEASE_PREPARATION_POLICY:\n", output)
-        self.assertIn("A ready promotion is a local checkpoint", output)
-        self.assertIn("continue that work while the ready promotion waits", output)
-        self.assertLess(
-            output.index("Begin an automatically triggered, requested, or scheduled release"),
-            output.index("Advance to the next eligible feature"),
-        )
-        self.assertIn("Only Joshua may merge into `main`", output)
-
 
 if __name__ == "__main__":
     unittest.main()

orchestration_tests/test_nq_orchestrate.py

@@ -1,5 +1,4 @@
 from pathlib import Path
-import fcntl
 import os
 import subprocess
 import tempfile
@@ -48,7 +47,6 @@ class ForegroundLauncherTests(unittest.TestCase):
                 "NQ_PROJECT_ROOT": str(project),
                 "OPENCODE_BIN": str(opencode),
                 "SYSTEMCTL_BIN": str(systemctl),
-                "NQ_STATE_DIR": str(root / "state"),
             })
             printed = subprocess.run([str(SCRIPT), "--print-prompt"], env=env,
                                      text=True, capture_output=True)
@@ -69,16 +67,6 @@ class ForegroundLauncherTests(unittest.TestCase):
                              ["--check-interactive", "--project", str(project)])
 
             output.unlink()
-            lock_path = root / "state/controller.lock"
-            with lock_path.open("w") as held_lock:
-                fcntl.flock(held_lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
-                locked = subprocess.run([str(SCRIPT)], env=env, text=True,
-                                        capture_output=True)
-                self.assertEqual(locked.returncode, 75)
-                self.assertIn("Another NestQuest orchestrator or controller",
-                              locked.stderr)
-                self.assertFalse(output.exists())
-
             open_marker.touch()
             refused = subprocess.run([str(SCRIPT)], env=env, text=True,
                                      capture_output=True)

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nestquest"
-version = "0.6.0"
+version = "0.5.0"
 description = "NestQuest Home Assistant Integration"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -21,7 +21,6 @@ dev = [
     "pytest>=8.0.0",
     "pytest-asyncio>=0.24",
     "pyyaml>=6",
-    "unidecode>=1.4.0",
     "uvicorn>=0.30",
     "voluptuous>=0.14",
 ]

scripts/nq-orchestrate

@@ -11,7 +11,6 @@ control_home=${NQ_CONTROL_HOME:-/home/overseer/.local/share/nestquest-controller
 project=${NQ_PROJECT_ROOT:-/mnt/ai-storage/projects/NestQuest}
 opencode_bin=${OPENCODE_BIN:-/home/overseer/.opencode/bin/opencode}
 systemctl_bin=${SYSTEMCTL_BIN:-systemctl}
-state_dir=${NQ_STATE_DIR:-/home/overseer/.local/state/nestquest-controller}
 renderer="$control_home/scripts/render-cycle-prompt"
 profile="$control_home/templates/nestquest.profile.json"
 
@@ -42,17 +41,6 @@ fi
 # Foreground mode owns orchestration. A dormant service must never race it.
 "$systemctl_bin" --user stop nestquest-controller.service
 
-# Share the controller's lock and hold it across the final exec. This closes
-# the launch-time race between two foreground sessions as well as the race with
-# the background controller.
-mkdir -p "$state_dir"
-chmod 700 "$state_dir"
-exec 9>"$state_dir/controller.lock"
-if ! flock -n 9; then
-  echo "Another NestQuest orchestrator or controller is running." >&2
-  exit 75
-fi
-
 session_status=$("$control_home/scripts/nq-controller" --check-interactive --project "$project")
 if [[ "$session_status" == "interactive NestQuest session open" ]]; then
   echo "Another interactive NestQuest OpenCode session is open." >&2

templates/ORCHESTRATOR-PROMPT.template.md

@@ -150,15 +150,6 @@ Possible scopes:
 - `PROJECT_QUEUE`
 - `RELEASE_PREPARATION`
 
-Also set `RELEASE_PREPARATION_POLICY` at startup:
-
-- `AUTO` by default.
-- `EXCLUDED` only when the user's launch request explicitly says not to prepare
-  a release or `{{INTEGRATION_BRANCH}}`-to-`{{RELEASE_BRANCH}}` promotion.
-
-Record both `MISSION_SCOPE` and `RELEASE_PREPARATION_POLICY` in durable run
-state. Do not infer exclusion merely from `SINGLE_TASK` or `SINGLE_FEATURE`.
-
 If the user explicitly names one task or feature, respect that scope.
 
 If the user launches the orchestrator for general/autonomous {{PROJECT_NAME}} development without limiting it to one feature, use:
@@ -180,7 +171,6 @@ Maintain a durable orchestration checkpoint using {{WORK_TRACKER}} wherever its
 Track at minimum:
 
 - `MISSION_SCOPE`
-- `RELEASE_PREPARATION_POLICY`
 - Current feature
 - Current controller phase
 - Active development agents
@@ -195,9 +185,6 @@ Track at minimum:
 - Blocked items
 - Tests/checks status
 - Last verified repository state
-- Active promotion branch and pull request
-- Triggering feature and exact `{{INTEGRATION_BRANCH}}` commit for each automatic promotion
-- Completed features pending the next promotion
 - `NEXT_ACTION`
 
 After every material state transition:
@@ -267,8 +254,8 @@ Choose the highest-priority actionable transition in this order:
 8. Remediate feature-level review findings.
 9. Obtain feature approval.
 10. Merge an approved feature into `{{INTEGRATION_BRANCH}}`.
-11. Begin an automatically triggered, requested, or scheduled release when appropriate. The automatic post-feature trigger is in scope for both `SINGLE_FEATURE` and `PROJECT_QUEUE` unless `RELEASE_PREPARATION_POLICY = EXCLUDED`.
-12. Advance to the next eligible feature when mission scope permits.
+11. Advance to the next eligible feature when mission scope permits.
+12. Begin a requested/scheduled release when appropriate.
 13. Continue unrelated work around locally blocked items.
 14. Escalate only when the defined escalation rules require it.
 
@@ -601,10 +588,9 @@ Immediately transition to `FEATURE_INTEGRATION`.
 
 A merged feature is a transition.
 
-It is terminal only when `MISSION_SCOPE = SINGLE_FEATURE` and no authorized
-post-feature release transition is pending. Preparing the automatic promotion
-for that completed feature is part of `SINGLE_FEATURE` scope when
-`RELEASE_PREPARATION_POLICY = AUTO`.
+It is terminal ONLY when:
+
+`MISSION_SCOPE = SINGLE_FEATURE`
 
 Otherwise select the next eligible work.
 
@@ -651,19 +637,13 @@ The orchestrator itself does not perform the merge.
 When `MISSION_SCOPE = PROJECT_QUEUE` and a feature is successfully merged into `{{INTEGRATION_BRANCH}}`:
 
 1. Reconcile {{WORK_TRACKER}}.
-2. Evaluate the automatic, requested, and scheduled release triggers.
+2. Check for a requested/scheduled release.
 3. Identify remaining incomplete features.
 4. Determine which features are eligible based on dependencies and priority.
 5. Select the next eligible feature.
 6. Initialize it.
 7. Continue the development loop.
 
-If an automatic promotion becomes `RELEASE_READY` while another eligible
-feature remains, keep that promotion waiting for {{RELEASE_OWNER_NAME}} and
-continue the project queue. A ready promotion is a local checkpoint in this
-case, not a global terminal condition. Features completed while it remains open
-are recorded as pending for the next promotion under Section 18.
-
 Do not return to the user simply because one feature completed.
 
 If several features are available, choose using:
@@ -678,52 +658,27 @@ If several features are available, choose using:
 
 # 18. RELEASE RULES
 
-Completed features accumulate in `{{INTEGRATION_BRANCH}}`. With no active
-promotion, each verified feature completion starts release preparation. While
-one promotion is active, later completed features accumulate for the next
-promotion.
+Completed features accumulate in `{{INTEGRATION_BRANCH}}`.
 
-Prepare a release when any of these conditions is true:
+Prepare a release only when:
 
 - {{RELEASE_OWNER_NAME}} requests it; OR
-- {{WORK_TRACKER}} schedules it; OR
-- `RELEASE_PREPARATION_POLICY = AUTO`, and a feature becomes task-complete and its reviewed merge into `{{INTEGRATION_BRANCH}}` is verified.
-
-For the automatic trigger, a feature is task-complete only when:
-
-- Every required feature task is `done`, or deliberately `canceled` with recorded evidence.
-- No task review, remediation, approval, or merge remains pending.
-- The feature acceptance criteria and integrated checks pass.
-- Independent approval applies to the exact feature head.
-- The approver's merge of that head into `{{INTEGRATION_BRANCH}}` is verified.
-- {{WORK_TRACKER}} reflects the completed feature and exact repository references.
-
-Task completion inside an unmerged feature branch does not trigger a release.
-The verified feature-to-`{{INTEGRATION_BRANCH}}` merge is the triggering transition.
-
-Before creating a release branch or pull request:
-
-1. Verify this session is the sole active orchestrator for the project. `{{TERMINAL_LAUNCHER}}` enforces that exclusivity by holding the shared controller lock for the full foreground session. If that lock is not held by this session, do not create a release branch or pull request; escalate instead.
-2. Reconcile open release records, release branches, and promotion pull requests.
-3. Do not create a duplicate promotion for an already-covered `{{INTEGRATION_BRANCH}}` commit.
-4. Allow only one active promotion pull request to `{{RELEASE_BRANCH}}`. If an earlier promotion is still open and does not contain the newly completed feature, record the feature as pending for the next automatic promotion. Resume it after the active promotion is merged or closed; if it was closed without merge, recalculate the next promotion from the current validated `{{INTEGRATION_BRANCH}}` head.
-5. Record the triggering feature and exact `{{INTEGRATION_BRANCH}}` commit so the automatic trigger runs once for that merge.
+- {{WORK_TRACKER}} schedules it.
 
 Release process:
 
-1. Enforce every pre-creation requirement above, including controller exclusivity, reconciliation, duplicate and active-promotion checks, and trigger recording.
-2. Reconcile release scope.
-3. Confirm included features are complete.
-4. Create release branch from exact validated `{{INTEGRATION_BRANCH}}`.
-5. Run complete release checks.
-6. Open release PR → `{{RELEASE_BRANCH}}`.
-7. Obtain fresh independent {{REVIEWER_VENDOR}} review.
-8. Remediate findings through development agents.
-9. Incorporate every release correction back into `{{INTEGRATION_BRANCH}}`.
-10. Revalidate.
-11. Assign final release PR to `{{HOST_ACCOUNT}}`.
-12. Update {{WORK_TRACKER}}.
-13. Stop before {{RELEASE_BRANCH}} merge.
+1. Reconcile release scope.
+2. Confirm included features are complete.
+3. Create release branch from exact validated `{{INTEGRATION_BRANCH}}`.
+4. Run complete release checks.
+5. Open release PR → `{{RELEASE_BRANCH}}`.
+6. Obtain fresh independent {{REVIEWER_VENDOR}} review.
+7. Remediate findings through development agents.
+8. Incorporate every release correction back into `{{INTEGRATION_BRANCH}}`.
+9. Revalidate.
+10. Assign final release PR to `{{HOST_ACCOUNT}}`.
+11. Update {{WORK_TRACKER}}.
+12. Stop before {{RELEASE_BRANCH}} merge.
 
 Only {{RELEASE_OWNER_NAME}} may merge into `{{RELEASE_BRANCH}}`.
 
@@ -769,23 +724,13 @@ For `PROJECT_QUEUE`, this additionally requires:
 
 - No eligible incomplete feature remains.
 - No task/review/remediation/merge is pending.
-- No release preparation, release review, or release remediation is pending.
-- Every in-scope automatic trigger is either incorporated into the active
-  `RELEASE_READY` promotion or durably recorded for the next promotion.
 - No development agent is active.
 - No approver is active.
 
-An active promotion that has not reached `RELEASE_READY` makes
-`MISSION_COMPLETE` false.
-
 ## `RELEASE_READY`
 
 Release PR has passed required gates and is assigned to `{{HOST_ACCOUNT}}`, awaiting {{RELEASE_OWNER_NAME}}'s {{RELEASE_BRANCH}} merge.
 
-`RELEASE_READY` is globally terminal only when no other in-scope engineering
-action is executable. In `PROJECT_QUEUE`, if another eligible incomplete
-feature remains, continue that work while the ready promotion waits.
-
 ## `GLOBAL_ESCALATION`
 
 All remaining in-scope work is blocked by decisions/access that require {{RELEASE_OWNER_NAME}}.
@@ -833,12 +778,9 @@ Output a machine-readable continuation checkpoint:
 ```text
 ORCHESTRATOR_STATE: CONTINUE
 MISSION_SCOPE:
-RELEASE_PREPARATION_POLICY:
 CONTROLLER_PHASE:
 CURRENT_FEATURE:
 ACTIVE_TASKS:
-ACTIVE_PROMOTION:
-PENDING_PROMOTION_FEATURES:
 BLOCKED_ITEMS:
 LAST_VERIFIED_STATE:
 NEXT_ACTION:

tests/conftest.py

@@ -22,22 +22,19 @@ pytest -q``); it is never meant to run against a real HA install.
 from __future__ import annotations
 
 import asyncio
+import datetime
 import importlib.util
 import inspect
-import re
 import sys
 import tempfile
-import unicodedata
 import weakref
 from dataclasses import dataclass
-from html.entities import name2codepoint
 from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import AsyncMock, MagicMock
 
 import httpx
 import pytest
-from unidecode import unidecode as _unidecode
 
 from tests.admin_jwt_harness import ADMIN_KEY, KID, AdminRunner, jwks_for
 
@@ -50,7 +47,6 @@ _HA_MODULES = (
     "homeassistant.config_entries",
     "homeassistant.data_entry_flow",
     "homeassistant.exceptions",
-    "homeassistant.util",
     "homeassistant.helpers",
     "homeassistant.helpers.config_validation",
     "homeassistant.helpers.entity",
@@ -99,7 +95,6 @@ for _parent, _child in (
     ("homeassistant", "data_entry_flow"),
     ("homeassistant", "core"),
     ("homeassistant", "exceptions"),
-    ("homeassistant", "util"),
     ("homeassistant", "helpers"),
     ("homeassistant.helpers", "config_validation"),
     ("homeassistant.helpers", "entity"),
@@ -224,68 +219,6 @@ _exceptions_mock.ConfigEntryNotReady = ConfigEntryNotReady
 _exceptions_mock.Unauthorized = Unauthorized
 
 
-# ---------------------------------------------------------------------------
-# homeassistant.util.slugify: a faithful stand-in for the real slugifier.
-#
-# Real HA (2024.6) wraps python-slugify's frozen legacy pipeline and answers
-# its "unknown" sentinel when a non-empty name slugs to nothing.  The stub
-# mirrors that pipeline step for step — quotes to dashes, NFKD-normalize,
-# TRANSLITERATE through unidecode (the backend python-slugify's "auto" mode
-# prefers, and a dev dependency here), decode HTML entities, NFKD again,
-# lowercase, drop quotes, fold runs of non-[a-z0-9-] to one dash, collapse
-# and strip dashes, then map dashes to the requested separator — and was
-# verified byte-for-byte against real python-slugify across Latin, Cyrillic,
-# CJK and Greek household-name shapes.  Transliteration is the point: HA
-# derives the per-child entity ids from a name like "京子" as
-# "nestquest_jing_zi_…", so the roster's slugs must transliterate too,
-# never dropping characters into "unknown".  Deliberately NOT truncating:
-# real slugify caps nothing; the entity registry truncates the full
-# entity_id instead.
-# ---------------------------------------------------------------------------
-_HA_QUOTE_PATTERN = re.compile(r"[']+")
-_HA_CHAR_ENTITY_PATTERN = re.compile(r"&(%s);" % "|".join(name2codepoint))
-_HA_DECIMAL_PATTERN = re.compile(r"&#(\d+);")
-_HA_HEX_PATTERN = re.compile(r"&#x([\da-fA-F]+);")
-_HA_NUMBERS_PATTERN = re.compile(r"(?<=\d),(?=\d)")
-_HA_DISALLOWED_CHARS_PATTERN = re.compile(r"[^-a-zA-Z0-9]+")
-_HA_DUPLICATE_DASH_PATTERN = re.compile(r"-{2,}")
-
-
-def _ha_slugify(text: str | None, *, separator: str = "_") -> str:
-    """Faithful homeassistant.util.slugify stand-in (see section above)."""
-    if text == "" or text is None:
-        return ""
-    text = str(text)
-    text = _HA_QUOTE_PATTERN.sub("-", text)
-    text = unicodedata.normalize("NFKD", text)
-    text = _unidecode(text)
-    text = _HA_CHAR_ENTITY_PATTERN.sub(
-        lambda match: chr(name2codepoint[match.group(1)]), text
-    )
-    try:
-        text = _HA_DECIMAL_PATTERN.sub(
-            lambda match: chr(int(match.group(1))), text
-        )
-    except (ValueError, OverflowError):
-        pass
-    try:
-        text = _HA_HEX_PATTERN.sub(
-            lambda match: chr(int(match.group(1), 16)), text
-        )
-    except (ValueError, OverflowError):
-        pass
-    text = unicodedata.normalize("NFKD", text)
-    text = text.lower()
-    text = _HA_QUOTE_PATTERN.sub("", text)
-    text = _HA_NUMBERS_PATTERN.sub("", text)
-    text = _HA_DISALLOWED_CHARS_PATTERN.sub("-", text)
-    text = _HA_DUPLICATE_DASH_PATTERN.sub("-", text).strip("-")
-    return "unknown" if text == "" else text.replace("-", separator)
-
-
-_ha_mock("homeassistant.util").slugify = _ha_slugify
-
-
 @dataclass
 class DeviceInfo:
     """Stand-in for homeassistant.helpers.entity.DeviceInfo.
@@ -809,92 +742,160 @@ def wire_entry_to_registry(entry, registry: ListenerRegistry):
     return entry
 
 
-class StubSnapshotClient:
-    """A no-network stand-in for the API client's snapshot surface.
+class LazyLocalSnapshotClient:
+    """A test client that serves the snapshot built LOCALLY.
 
-    Answers ``get_snapshot()`` from a scripted queue of outcomes — a
-    payload dict or an exception per call, consumed in order — and
-    records every call.  When the queue is exhausted it re-serves the
-    last outcome, so setup's first refresh and a test's explicit
-    refreshes poll the same scripted state.  Register it (or any
-    scripted client) with :func:`set_coordinator_client` BEFORE setup.
+    Feature 18 moved the coordinator's refresh onto the API service's
+    panel snapshot, but most integration tests still seed the local
+    database directly (the DB removal is a later task).  This stub
+    bridges the two: ``get_snapshot`` resolves the entry's runtime
+    record (its database and settings) and runs the SAME pure core
+    builder the API route runs
+    (:func:`~custom_components.nestquest.core.snapshot.build_snapshot`),
+    shaping the payload exactly like ``api/routes_panel.py`` —
+    instances via ``instance_payload(include_missed=False)`` — so the
+    coordinator reconstructs from a byte-identical payload without any
+    network or FastAPI machinery.
+
+    ``complete_instance`` bridges the panel complete route the same
+    way (the ``nestquest.complete_quest`` proxy calls it through the
+    API client): it resolves the entry's database and delegates to the
+    SAME core completion the API route delegates to, with the panel
+    actor shape, and answers the route's ``{"status": ...}`` body.
+    Like the real API service it publishes its transition events on
+    the SSE stream — NOT on the Home Assistant bus and NOT from the
+    service handler; tests that assert bus events drive them through
+    the SSE subscription the way production delivers them.
+
+    The resolution is LAZY on purpose: the coordinator's factory runs
+    mid-setup, before the runtime record exists, so the first refresh
+    (and any refresh while the entry is torn down) serves an EMPTY but
+    valid snapshot; every later refresh reads the seeded database.
     """
 
-    def __init__(self, *outcomes) -> None:
+    def __init__(self, hass, entry_id: str) -> None:
+        self._hass = hass
+        self._entry_id = entry_id
         self.calls = 0
-        self._outcomes = list(outcomes)
-        self._last = outcomes[-1] if outcomes else None
-        #: The SSE frames the stand-in "published" (the API service's
-        # stream content), drained by :func:`refire_api_transitions`.
+        #: Every ``(instance_id, CompletionResult)`` this stand-in
+        # produced, in call order — tests read ``appended`` /
+        # ``was_on_time`` off these to check the completion verdicts.
+        self.completions = []
+        #: The SSE frames the stand-in published for its completions
+        # (the API service's stream content), drained by
+        #: :func:`refire_api_transitions`.
         self.published_frames = []
 
+    def _live_runtime(self):
+        """The entry's runtime record, or ``None`` before/after setup."""
+        from custom_components.nestquest.const import DOMAIN as NQ_DOMAIN
+
+        runtime = self._hass.data.get(NQ_DOMAIN, {}).get(self._entry_id)
+        database = getattr(runtime, "database", None)
+        if database is None or not getattr(database, "connected", True):
+            return None
+        return runtime
+
+    def _live_database(self):
+        """The entry's open database, or ``None`` before/after setup."""
+        runtime = self._live_runtime()
+        return None if runtime is None else runtime.database
+
     async def get_snapshot(self):
+        import datetime
+        import zoneinfo
+
+        from custom_components.nestquest.const import DOMAIN as NQ_DOMAIN
+        from custom_components.nestquest.core import snapshot as core_snapshot
+
         self.calls += 1
-        if not self._outcomes:
-            # Re-serve the last outcome: setup's first refresh and the
-            # test's explicit pass both poll the same scripted state.
-            outcome = self._last
-        else:
-            outcome = self._outcomes.pop(0)
-            self._last = outcome
-        if isinstance(outcome, BaseException):
-            raise outcome
-        return outcome
+        runtime = self._live_runtime()
+        if runtime is None:
+            return {
+                "today_iso": datetime.date.today().isoformat(),
+                "cycle_day": 0,
+                "children": [],
+            }
+        database = runtime.database
+        settings = getattr(runtime, "settings", None)
+        # The HA-LOCAL now, the same single clock read the production
+        # coordinator used to hand the builder: the hass stub's
+        # configured time zone, never the host clock.
+        now = datetime.datetime.now(
+            zoneinfo.ZoneInfo(self._hass.config.time_zone)
+        )
+        snapshot = await core_snapshot.build_snapshot(database, settings, now)
+        return {
+            "today_iso": snapshot.today_iso,
+            "cycle_day": snapshot.cycle_day,
+            "children": [
+                {
+                    "child_id": child.child_id,
+                    "child_name": child.child_name,
+                    "present": child.present,
+                    "next_present": child.next_present,
+                    "due_today": child.due_today,
+                    "completed_today": child.completed_today,
+                    "remaining_today": child.remaining_today,
+                    "completion_pct": child.completion_pct,
+                    "instances": core_snapshot.instance_payload(
+                        child.instances, include_missed=False
+                    ),
+                }
+                for child in snapshot.children
+            ],
+        }
 
+    async def complete_instance(self, instance_id: int, actor_child_id: int):
+        """The panel complete route's stand-in: complete through the
+        SAME core completion the route delegates to, panel actor
+        shape, publish the route's SSE transition frames (built by the
+        same core builders, appended completions only — see
+        ``api/routes_panel.py``), and answer the route's
+        ``{"status": ...}`` body."""
+        import datetime
 
-class ScriptedPanelClient(StubSnapshotClient):
-    """Snapshot + completion stand-in for the API service's panel plane.
+        from custom_components.nestquest.completion import complete_instance
+        from custom_components.nestquest.core import events as core_events
 
-    Serves the scripted snapshot outcomes (like
-    :class:`StubSnapshotClient`), records ``complete_instance`` calls
-    the way the panel route receives them, optionally fails them the
-    way the client types the failure, and carries the SSE frames the
-    API "published" in ``published_frames`` for
-    :func:`refire_api_transitions` to deliver.  Everything the
-    integration reads over the wire, no network.
-    """
-
-    def __init__(self, *outcomes) -> None:
-        super().__init__(*outcomes)
-        self.complete_calls: list[tuple[int, int]] = []
-        self.published_frames: list[tuple[str, dict]] = []
-        #: When set, the next ``complete_instance`` raises this instead
-        # of succeeding (a typed NestQuestApiError in production).
-        self.fail_complete_with: BaseException | None = None
-
-    async def complete_instance(
-        self, instance_id: int, actor_child_id: int
-    ) -> dict:
-        self.complete_calls.append((instance_id, actor_child_id))
-        if self.fail_complete_with is not None:
-            raise self.fail_complete_with
-        return {"status": "done"}
-
-
-def set_coordinator_client(entry, client):
-    """Register a scripted client for ``entry``'s coordinator factory."""
-    import custom_components.nestquest.coordinator as coordinator_module
-
-    coordinator_module._COORDINATOR_CLIENT_OVERRIDES[entry.entry_id] = client
-    return client
+        result = await complete_instance(
+            self._live_database(),
+            instance_id,
+            actor_source="panel",
+            actor_child_id=actor_child_id,
+        )
+        self.completions.append((instance_id, result))
+        if result.appended:
+            # The route publishes the transition the moment the core
+            # write lands (appended completions only), evaluating the
+            # day-complete rule against the API host's local date —
+            # the frames queue here for the SSE stream to carry.
+            event_type, payload = await core_events.build_quest_completed_event(
+                self._live_database(),
+                instance_id,
+                was_on_time=result.was_on_time,
+            )
+            self.published_frames.append((event_type, payload))
+            now = datetime.datetime.now().astimezone()
+            day_complete = await core_events.build_child_day_complete_event(
+                self._live_database(), payload, today=now.date()
+            )
+            if day_complete is not None:
+                self.published_frames.append(day_complete)
+        return {"status": str(result)}
 
 
 @pytest.fixture(autouse=True)
-def coordinator_client_from_test_override():
-    """Resolve every entry's coordinator client through the test seam.
+def coordinator_serves_local_snapshot():
+    """Default every test entry's coordinator to the local-snapshot client.
 
     The integration's setup builds its API client through
-    ``coordinator_client_from_entry``; this fixture swaps that factory
-    for a test one handing out the client registered with
-    :func:`set_coordinator_client`, or — for an entry with no scripted
-    client — a stub serving an EMPTY but valid household snapshot (the
-    shape the API's panel route returns before any child exists; the
-    real client would need aiohttp, which this mock-only harness does
-    not provide).
+    ``coordinator_client_from_entry``; the fixture swaps that factory
+    for a test one handing out :class:`LazyLocalSnapshotClient` (so
+    DB-seeded tests exercise the coordinator's API path against local
+    data).  Tests that script their own client register it with
+    :func:`set_coordinator_client`, which the factory honours first.
     """
-    import datetime
-    import unittest.mock as mock
-
     import custom_components.nestquest as nq_mod
     import custom_components.nestquest.coordinator as coordinator_module
 
@@ -906,13 +907,9 @@ def coordinator_client_from_test_override():
         override = _COORDINATOR_CLIENT_OVERRIDES.get(entry.entry_id)
         if override is not None:
             return override
-        return StubSnapshotClient(
-            {
-                "today_iso": datetime.date.today().isoformat(),
-                "cycle_day": 0,
-                "children": [],
-            }
-        )
+        return LazyLocalSnapshotClient(hass, entry.entry_id)
+
+    import unittest.mock as mock
 
     _COORDINATOR_CLIENT_OVERRIDES.clear()
     patcher = mock.patch.object(
@@ -924,6 +921,14 @@ def coordinator_client_from_test_override():
     _COORDINATOR_CLIENT_OVERRIDES.clear()
 
 
+def set_coordinator_client(entry, client):
+    """Register a scripted client for ``entry``'s coordinator factory."""
+    import custom_components.nestquest.coordinator as coordinator_module
+
+    coordinator_module._COORDINATOR_CLIENT_OVERRIDES[entry.entry_id] = client
+    return client
+
+
 async def refire_api_transitions(hass, entry, client):
     """Deliver the SSE frames the stand-in client has published so far
     through the integration's SSE subscription — the production event
@@ -1200,6 +1205,42 @@ def make_config_flow_entry():
     return _factory
 
 
+def freeze_nestquest_clock(
+    monkeypatch, instant: datetime.datetime
+) -> tuple[datetime.datetime, list]:
+    """Freeze the integration's ``datetime`` clock to a fixed aware instant.
+
+    Only ``custom_components.nestquest``'s ``datetime`` binding is patched,
+    so the generation path's ``datetime.datetime.now`` reads this instant
+    (localized to whatever time zone it asks for) while every other module
+    and the test harness keep the real clock.  Returns ``(frozen, requested)``
+    where ``frozen`` is the instant normalized to UTC and ``requested`` is
+    the list of ``tzinfo`` objects the code under test passed to ``now`` —
+    so a caller can prove the generation path actually requested the
+    configured HA time zone rather than silently reading UTC.
+    """
+    import custom_components.nestquest as nestquest
+
+    frozen = instant.astimezone(datetime.timezone.utc)
+    requested: list = []
+
+    class _FrozenDatetime(datetime.datetime):
+        @classmethod
+        def now(cls, tz=None):
+            requested.append(tz)
+            if tz is None:
+                return frozen.replace(tzinfo=None)
+            return frozen.astimezone(tz)
+
+    fake_module = SimpleNamespace(
+        datetime=_FrozenDatetime,
+        timedelta=datetime.timedelta,
+        date=datetime.date,
+    )
+    monkeypatch.setattr(nestquest, "datetime", fake_module)
+    return frozen, requested
+
+
 # ---------------------------------------------------------------------------
 # Admin-plane API fixtures (shared by the admin-plane test modules).
 #

tests/test_admin_allowlist.py

@@ -1,18 +1,21 @@
-"""Tests for the Feature 03 admin allowlist business layer (core.admin_allowlist)."""
+"""Tests for admin_allowlist.py: the Feature 03 allowlist business layer."""
 from __future__ import annotations
 
 import asyncio
+from types import SimpleNamespace
 from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
-from custom_components.nestquest.core.admin_allowlist import (
+from custom_components.nestquest import async_setup_entry, async_unload_entry
+from custom_components.nestquest.admin_allowlist import (
     list_admin_ids,
     seed_setup_admin,
     set_admin_ids,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.dao_children import AdminUsersDao
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):
@@ -190,6 +193,165 @@ def test_seed_rejects_malformed_candidates(tmp_path) -> None:
 
 
 # ---------------------------------------------------------------------------
+# Setup wiring: async_setup_entry seeds automatically
+# ---------------------------------------------------------------------------
+
+
+async def _setup_entry(hass, entry, registry):
+    from tests.test_lifecycle import _wire
+
+    entry = _wire(entry, registry)
+    await async_setup_entry(hass, entry)
+    return entry
+
+
+async def test_setup_seeds_allowlist_from_entry_context(
+    hass, make_entry
+) -> None:
+    entry = await _setup_entry(
+        hass,
+        make_entry(context={"user_id": "ha-owner"}),
+        hass.registry,
+    )
+    database = entry.runtime_data.database
+    try:
+        assert await list_admin_ids(database) == ["ha-owner"]
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+
+async def test_setup_seeds_allowlist_from_stored_entry_data(
+    hass, make_entry
+) -> None:
+    """A lost database re-seeded from the entry's stored admin copy."""
+    from custom_components.nestquest.const import CONF_ADMIN_USER_IDS
+
+    entry = await _setup_entry(
+        hass,
+        make_entry(data={CONF_ADMIN_USER_IDS: ["user-a", "user-b"]}),
+        hass.registry,
+    )
+    database = entry.runtime_data.database
+    try:
+        assert await list_admin_ids(database) == ["user-a", "user-b"]
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+
+async def test_setup_without_context_leaves_allowlist_empty(
+    hass, make_entry
+) -> None:
+    """Fail closed: no context user and no stored copy means an empty
+    allowlist — nobody is admin until the owner configures it."""
+    entry = await _setup_entry(hass, make_entry(), hass.registry)
+    database = entry.runtime_data.database
+    try:
+        assert await list_admin_ids(database) == []
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+
+async def test_setup_does_not_reseed_narrowed_allowlist(
+    hass, make_entry
+) -> None:
+    from custom_components.nestquest import async_unload_entry
+    from custom_components.nestquest.const import CONF_ADMIN_USER_IDS
+
+    entry = await _setup_entry(
+        hass, make_entry(context={"user_id": "ha-owner"}), hass.registry
+    )
+    database = entry.runtime_data.database
+    await set_admin_ids(database, ["user-parent"])
+    await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+    # Reload with the SAME context: the narrowed list survives.
+    entry_reloaded = await _setup_entry(
+        hass, make_entry(context={"user_id": "ha-owner"}), hass.registry
+    )
+    database_b = entry_reloaded.runtime_data.database
+    try:
+        assert await list_admin_ids(database_b) == ["user-parent"]
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry_reloaded) is True
+
+
+async def test_setup_seed_prefers_options_over_entry_data(
+    hass, make_entry
+) -> None:
+    """Seed precedence on a fresh database: the options flow's saved
+    list (the current one) beats the config flow's original copy."""
+    from custom_components.nestquest.const import CONF_ADMIN_USER_IDS
+
+    entry = await _setup_entry(
+        hass,
+        make_entry(
+            options={CONF_ADMIN_USER_IDS: ["user-current"]},
+            data={CONF_ADMIN_USER_IDS: ["ha-owner"]},
+            context={"user_id": "ha-owner"},
+        ),
+        hass.registry,
+    )
+    database = entry.runtime_data.database
+    try:
+        assert await list_admin_ids(database) == ["user-current"]
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+
+async def test_setup_owner_fallback_seeds_owner_accounts(
+    hass, make_entry
+) -> None:
+    """Last-resort seed: with no persisted copy and no flow-context
+    user, HA owner accounts are seeded so first setup is never
+    ownerless (the real flow may lose the context; owners can already
+    do everything in HA)."""
+    from unittest.mock import AsyncMock
+
+    hass.auth.async_get_users = AsyncMock(
+        return_value=[
+            SimpleNamespace(id="owner-1", is_owner=True),
+            SimpleNamespace(id="member-1", is_owner=False),
+            SimpleNamespace(id="owner-2", is_owner=True),
+        ]
+    )
+    entry = await _setup_entry(hass, make_entry(), hass.registry)
+    database = entry.runtime_data.database
+    try:
+        assert sorted(await list_admin_ids(database)) == ["owner-1", "owner-2"]
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+
+async def test_setup_owner_fallback_not_used_when_context_present(
+    hass, make_entry
+) -> None:
+    """The context user (flow caller) wins over the owner fallback:
+    a non-owner parent configuring the integration becomes the admin."""
+    from unittest.mock import AsyncMock
+
+    hass.auth.async_get_users = AsyncMock(
+        return_value=[SimpleNamespace(id="owner-1", is_owner=True)]
+    )
+    entry = await _setup_entry(
+        hass,
+        make_entry(context={"user_id": "parent-configured"}),
+        hass.registry,
+    )
+    database = entry.runtime_data.database
+    try:
+        assert await list_admin_ids(database) == ["parent-configured"]
+    finally:
+        await database.close()
+    assert await async_unload_entry(hass, entry) is True
+
+
 def test_seed_owner_ids_argument(tmp_path) -> None:
     async def _body(database):
         # Malformed owner lists are rejected like any other candidate —
@@ -215,13 +377,54 @@ def test_seed_owner_ids_argument(tmp_path) -> None:
     _with_db(tmp_path, "seed-owner-arg.db")(_body)
 
 
+async def test_reopened_setup_failure_closes_database(
+    hass, make_entry, monkeypatch
+) -> None:
+    """A seeding failure on the reopened-record path closes the just-
+    opened connection before re-raising (no leaked handles across HA's
+    setup retries)."""
+    import pytest as pytest_module
+    from unittest.mock import AsyncMock
+
+    import custom_components.nestquest as nestquest_module
+    from custom_components.nestquest.db import NestQuestDatabase
+
+    # First: a successful setup to create the runtime record and file.
+    entry = await _setup_entry(hass, make_entry(), hass.registry)
+    await async_unload_entry(hass, entry)
+
+    # Now a re-setup whose seeding fails after the reopen.
+    async def _failing_seed(database, **kwargs):
+        raise RuntimeError("seed boom")
+
+    monkeypatch.setattr(
+        nestquest_module, "seed_setup_admin", _failing_seed, raising=True
+    )
+
+    close_calls: list[bool] = []
+    original_close = NestQuestDatabase.close
+
+    async def _spy_close(self):
+        close_calls.append(True)
+        return await original_close(self)
+
+    monkeypatch.setattr(NestQuestDatabase, "close", _spy_close)
+
+    with pytest_module.raises(RuntimeError, match="seed boom"):
+        await _setup_entry(hass, entry, hass.registry)
+    # The reopen path opened AND closed a connection; the failure is
+    # the last thing observed.
+    assert close_calls[-1] is True
+
+
+# ---------------------------------------------------------------------------
 # is_admin: the fail-closed resolver (Feature 09's verdict function)
 # ---------------------------------------------------------------------------
 
 
 def test_is_admin_verdict_matrix(tmp_path) -> None:
     async def _body(database):
-        from custom_components.nestquest.core.admin_allowlist import is_admin
+        from custom_components.nestquest.admin_allowlist import is_admin
 
         await set_admin_ids(database, ["user-owner"])
         assert await is_admin(database, "user-owner") is True
@@ -244,7 +447,7 @@ def test_is_admin_verdict_matrix(tmp_path) -> None:
 def test_is_admin_empty_allowlist_fails_closed(tmp_path) -> None:
     """An empty allowlist returns False for EVERYONE, not True."""
     async def _body(database):
-        from custom_components.nestquest.core.admin_allowlist import is_admin
+        from custom_components.nestquest.admin_allowlist import is_admin
 
         for candidate in ("user-owner", "", None, 1):
             assert await is_admin(database, candidate) is False
@@ -257,7 +460,7 @@ def test_is_admin_false_after_last_admin_removal_attempt(tmp_path) -> None:
     """The refusal keeps the verdict sound: a refused removal leaves
     the admin in place, so is_admin still resolves True."""
     async def _body(database):
-        from custom_components.nestquest.core.admin_allowlist import is_admin
+        from custom_components.nestquest.admin_allowlist import is_admin
 
         await set_admin_ids(database, ["user-owner"])
         with pytest.raises(ValueError, match="at least one admin"):

tests/test_binary_sensors.py

@@ -1,85 +1,50 @@
-"""Tests for the per-child binary sensors (Feature 10, task 4).
-
-The snapshot comes from the API service's panel route (the presence
-engine resolves server-side), so these tests script the route's
-payload through :class:`conftest.StubSnapshotClient` instead of
-seeding a local database.
-"""
+"""Tests for the per-child binary sensors (Feature 10, task 4)."""
 from __future__ import annotations
 
-from conftest import StubSnapshotClient, set_coordinator_client, wire_entry_to_registry
+import datetime
+
+from conftest import wire_entry_to_registry
 
 from custom_components.nestquest import async_setup_entry
+from custom_components.nestquest.children import create_child, list_children
 from custom_components.nestquest.const import DOMAIN
+from custom_components.nestquest.dao_presence import PresenceSchedulesDao
+from custom_components.nestquest.materialize import materialize
+from custom_components.nestquest.quest_definitions import (
+    create_quest_definition,
+)
+from custom_components.nestquest.recurrence import ScheduleRule
+from custom_components.nestquest.completion import complete_instance
+
+SEED_HORIZON_DAYS = 3
 
 
 def _binary(hass, child_id: int, kind: str):
     return hass.entities[f"{DOMAIN}_child_{child_id}_{kind}"]
 
 
-def _child(
-    child_id: int,
-    name: str,
-    *,
-    present=True,
-    next_present=None,
-    instances=(),
-):
-    completed = sum(1 for i in instances if i["state"] == "completed")
-    due = len(instances)
-    return {
-        "child_id": child_id,
-        "child_name": name,
-        "present": present,
-        "next_present": next_present,
-        "due_today": due,
-        "completed_today": completed,
-        "remaining_today": due - completed,
-        "completion_pct": 100 if due == 0 else round(completed / due * 100),
-        "instances": list(instances),
-    }
-
-
-def _instance(instance_id: int, child_id: int, *, state="open") -> dict:
-    return {
-        "id": instance_id,
-        "definition_id": 3,
-        "child_id": child_id,
-        "title": "Brush teeth",
-        "icon": "🦷",
-        "window": "morning",
-        "due_time": "08:00",
-        "state": state,
-        "overdue": False,
-        "completed_at": None if state == "open" else "2026-09-23T07:55:00+00:00",
-        "on_time": None if state == "open" else True,
-    }
-
-
-def _payload(children) -> dict:
-    return {
-        "today_iso": "2026-09-23",
-        "cycle_day": 0,
-        "children": list(children),
-    }
-
-
-ADA = 1
-BO = 2
-CORY = 3
-
-
-async def _setup_entry(hass, make_entry, *payloads):
-    """Set up the integration with a scripted snapshot client."""
-    entry = wire_entry_to_registry(
-        make_entry(
-            data={"api_base_url": "http://api.test:8000", "panel_token": "tok"}
-        ),
-        hass.registry,
-    )
-    set_coordinator_client(entry, StubSnapshotClient(*payloads))
+async def _setup_entry(hass, make_entry):
+    entry = wire_entry_to_registry(make_entry(), hass.registry)
     assert await async_setup_entry(hass, entry) is True
-    return entry, entry.runtime_data.coordinator
+    return entry
+
+
+async def _seed_two_children(database) -> tuple:
+    ada = await create_child(database, "Ada")
+    bo = await create_child(database, "Bo")
+    today = datetime.date.today()
+    await create_quest_definition(
+        database,
+        "Brush teeth",
+        ScheduleRule.from_dict(
+            {"rule_type": "daily", "start_date": today.isoformat()}
+        ),
+        [ada.id, bo.id],
+        ["morning"],
+    )
+    end = (today + datetime.timedelta(days=SEED_HORIZON_DAYS)).isoformat()
+    await materialize(database, today.isoformat(), end, today=today)
+    return ada, bo
 
 
 async def test_all_done_off_with_open_quests_and_zero_quests(
@@ -87,76 +52,88 @@ async def test_all_done_off_with_open_quests_and_zero_quests(
 ) -> None:
     """all_done is OFF while quests are owed AND on a zero-quest day;
     a child with no quests never fires the celebration automation."""
-    _entry, coordinator = await _setup_entry(
-        hass,
-        make_entry,
-        _payload(
-            [
-                _child(ADA, "Ada", instances=[_instance(7, ADA)]),
-                _child(BO, "Bo", instances=[_instance(8, BO)]),
-                _child(CORY, "Cory"),
-            ]
-        ),
-    )
+    entry = await _setup_entry(hass, make_entry)
+    coordinator = entry.runtime_data.coordinator
+    database = entry.runtime_data.database
+    ada, _bo = await _seed_two_children(database)
+    await create_child(database, "Cory")  # zero quests
+    await coordinator.async_refresh()
 
-    assert _binary(hass, ADA, "all_done").is_on is False
-    assert _binary(hass, BO, "all_done").is_on is False
-    assert _binary(hass, CORY, "all_done").is_on is False
+    assert _binary(hass, ada.id, "all_done").is_on is False
+    cory = [
+        child for child in coordinator.data.children
+        if child.child_name == "Cory"
+    ][0]
+    assert _binary(hass, cory.child_id, "all_done").is_on is False
 
 
 async def test_all_done_on_only_when_day_clear(hass, make_entry) -> None:
-    _entry, coordinator = await _setup_entry(
-        hass,
-        make_entry,
-        _payload([_child(ADA, "Ada", instances=[_instance(7, ADA)])]),
-        _payload(
-            [
-                _child(
-                    ADA,
-                    "Ada",
-                    instances=[_instance(7, ADA, state="completed")],
-                )
-            ]
-        ),
+    entry = await _setup_entry(hass, make_entry)
+    coordinator = entry.runtime_data.coordinator
+    database = entry.runtime_data.database
+    ada, _bo = await _seed_two_children(database)
+    await coordinator.async_refresh()
+    snapshot_ada = [
+        child for child in coordinator.data.children
+        if child.child_id == ada.id
+    ][0]
+    instance_id = snapshot_ada.instances[0].instance_id
+    await complete_instance(
+        database,
+        instance_id,
+        actor_source="panel",
+        actor_child_id=ada.id,
     )
     await coordinator.async_refresh()
-    assert _binary(hass, ADA, "all_done").is_on is True
+    assert _binary(hass, ada.id, "all_done").is_on is True
 
 
 async def test_present_today_on_without_schedule_off_when_absent(
     hass, make_entry
 ) -> None:
-    """Presence is resolved by the API's presence engine: present=True
-    renders ON, present=False renders OFF."""
-    _entry, _coordinator = await _setup_entry(
-        hass,
-        make_entry,
-        _payload([_child(ADA, "Ada"), _child(CORY, "Cory", present=False)]),
+    """No schedule means present every day; an all-absent pattern
+    today reports OFF."""
+    entry = await _setup_entry(hass, make_entry)
+    coordinator = entry.runtime_data.coordinator
+    database = entry.runtime_data.database
+    ada, _bo = await _seed_two_children(database)
+    await create_child(database, "Cory")
+    today = datetime.date.today()
+    await coordinator.async_refresh()
+    cory = [
+        child for child in coordinator.data.children
+        if child.child_name == "Cory"
+    ][0]
+    await PresenceSchedulesDao(database).upsert_by_child(
+        cory.child_id, 1, today.isoformat(), ""
     )
+    await coordinator.async_refresh()
 
-    assert _binary(hass, ADA, "present_today").is_on is True
-    assert _binary(hass, CORY, "present_today").is_on is False
+    assert _binary(hass, ada.id, "present_today").is_on is True
+    assert _binary(hass, cory.child_id, "present_today").is_on is False
 
 
 async def test_binary_sensor_identity_and_attributes(hass, make_entry) -> None:
-    _entry, _coordinator = await _setup_entry(
-        hass, make_entry, _payload([_child(ADA, "Ada")])
-    )
+    entry = await _setup_entry(hass, make_entry)
+    coordinator = entry.runtime_data.coordinator
+    database = entry.runtime_data.database
+    ada, _bo = await _seed_two_children(database)
+    await coordinator.async_refresh()
 
-    all_done = _binary(hass, ADA, "all_done")
-    present = _binary(hass, ADA, "present_today")
-    assert all_done.unique_id == f"nestquest_child_{ADA}_all_done"
-    assert present.unique_id == f"nestquest_child_{ADA}_present_today"
+    all_done = _binary(hass, ada.id, "all_done")
+    present = _binary(hass, ada.id, "present_today")
+    assert all_done.unique_id == f"nestquest_child_{ada.id}_all_done"
+    assert present.unique_id == f"nestquest_child_{ada.id}_present_today"
     assert all_done.name == "NestQuest Ada all done"
     assert present.name == "NestQuest Ada present today"
     for entity in (all_done, present):
         assert entity.device_info.name == "NestQuest Ada"
         assert all_done.extra_state_attributes == {
-            "child_id": ADA,
+            "child_id": ada.id,
             "child_name": "Ada",
         }
         assert present.extra_state_attributes == {
-            "child_id": ADA,
+            "child_id": ada.id,
             "child_name": "Ada",
             "next_present": None,
         }
@@ -168,28 +145,40 @@ async def test_present_today_carries_next_present_when_away(
     """A child away today carries the ISO date of their next present
     day (the panel's away plate renders ``Returns <weekday>, <Mon D>``
     from it); an always-absent pattern carries ``None``."""
-    _entry, _coordinator = await _setup_entry(
-        hass,
-        make_entry,
-        _payload(
-            [
-                _child(
-                    ADA,
-                    "Ada",
-                    present=False,
-                    next_present="2026-09-24",
-                ),
-                _child(CORY, "Cory", present=False, next_present=None),
-            ]
-        ),
+    entry = await _setup_entry(hass, make_entry)
+    coordinator = entry.runtime_data.coordinator
+    database = entry.runtime_data.database
+    ada, _bo = await _seed_two_children(database)
+    await create_child(database, "Cory")
+    today = datetime.date.today()
+    pattern = ",".join(
+        str(day) for day in range(7) if day != today.weekday()
     )
+    await PresenceSchedulesDao(database).upsert_by_child(
+        ada.id, 1, today.isoformat(), pattern
+    )
+    await PresenceSchedulesDao(database).upsert_by_child(
+        await _cory_id(database), 1, today.isoformat(), ""
+    )
+    await coordinator.async_refresh()
 
-    assert _binary(hass, ADA, "present_today").is_on is False
-    assert _binary(hass, ADA, "present_today").extra_state_attributes[
+    assert _binary(hass, ada.id, "present_today").is_on is False
+    assert _binary(hass, ada.id, "present_today").extra_state_attributes[
         "next_present"
-    ] == "2026-09-24"
+    ] == (today + datetime.timedelta(days=1)).isoformat()
 
-    assert _binary(hass, CORY, "present_today").is_on is False
-    assert _binary(hass, CORY, "present_today").extra_state_attributes[
+    cory = [
+        child for child in coordinator.data.children
+        if child.child_name == "Cory"
+    ][0]
+    assert _binary(hass, cory.child_id, "present_today").is_on is False
+    assert _binary(hass, cory.child_id, "present_today").extra_state_attributes[
         "next_present"
     ] is None
+
+
+async def _cory_id(database) -> int:
+    for child in await list_children(database):
+        if child.display_name == "Cory":
+            return child.id
+    raise AssertionError("Cory was not created")

tests/test_children_registry.py

@@ -8,16 +8,16 @@ from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
-from custom_components.nestquest.core.children import (
+from custom_components.nestquest.children import (
     create_child,
     edit_child,
     list_children,
     reorder_children,
     set_child_active,
 )
-from custom_components.nestquest.core.dao_children import ChildRecord, ChildrenDao
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.dao_children import ChildRecord, ChildrenDao
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):
@@ -739,12 +739,12 @@ def test_deactivating_child_preserves_definitions_instances_events(
     async def _body(database):
         from datetime import date, timedelta
 
-        from custom_components.nestquest.core.dao_children import ChildrenDao
-        from custom_components.nestquest.core.dao_instances import (
+        from custom_components.nestquest.dao_children import ChildrenDao
+        from custom_components.nestquest.dao_instances import (
             CompletionEventsDao,
             QuestInstancesDao,
         )
-        from custom_components.nestquest.core.dao_rules import (
+        from custom_components.nestquest.dao_rules import (
             QuestDefinitionsDao,
             ScheduleRulesDao,
         )
@@ -831,7 +831,7 @@ def test_no_code_path_deletes_a_child_row() -> None:
 
     import inspect
 
-    from custom_components.nestquest.core.dao_children import ChildrenDao
+    from custom_components.nestquest.dao_children import ChildrenDao
 
     methods = {
         name

tests/test_complete_quest_proxy.py

@@ -5,69 +5,117 @@ complete route through the entry's ONE shared API client (the same
 instance the coordinator polls and the SSE subscription reads), with
 exactly the payload contract the panel cards send (``instance_id``,
 ``actor=panel``, ``actor_child_id``).  The service performs NO local
-completion and fires NO local bus event — the API service emits the
-transition on its SSE stream and the integration's subscription
-re-fires it (firing it locally too would double-fire) — and it
-refreshes the coordinator after a successful call so the sensors
-reflect the completion immediately.  Every failure (a typed
-:class:`NestQuestApiError`, an unconfigured client, a non-panel actor)
-surfaces as a :class:`HomeAssistantError`, token-free.
+database completion and fires NO local bus event — the API service
+emits the transition on its SSE stream and the integration's
+subscription re-fires it (firing it locally too would double-fire) —
+and it refreshes the coordinator after a successful call so the
+sensors reflect the completion immediately.  Every failure (a typed
+:class:`NestQuestApiError`, an unconfigured client, a non-panel
+actor) surfaces as a :class:`HomeAssistantError`, token-free.
 
 The scripted clients here stand in for the API service: recording and
 failing ``complete_instance`` implementations, no network, no aiohttp.
 """
 from __future__ import annotations
 
+import datetime
+
 import pytest
 from homeassistant.exceptions import HomeAssistantError
 
-from conftest import ScriptedPanelClient, set_coordinator_client, wire_entry_to_registry
+from conftest import (
+    LazyLocalSnapshotClient,
+    set_coordinator_client,
+    wire_entry_to_registry,
+)
 
 from custom_components.nestquest import async_setup_entry
 from custom_components.nestquest.api_client import NestQuestApiError
 from custom_components.nestquest.const import (
+    CONF_ADMIN_USER_IDS,
     CONF_PANEL_TOKEN,
     DOMAIN,
     EVENT_CHILD_DAY_COMPLETE,
     EVENT_QUEST_COMPLETED,
     SERVICE_COMPLETE_QUEST,
 )
+from custom_components.nestquest.dao_instances import QuestInstancesDao
+from custom_components.nestquest.materialize import materialize
+from custom_components.nestquest.quest_definitions import (
+    create_quest_definition,
+)
+from custom_components.nestquest.recurrence import ScheduleRule
+
+ADMIN_CTX = {"user_id": "admin-1"}
 
 
-class _RecordingApiClient(ScriptedPanelClient):
+class _RecordingApiClient(LazyLocalSnapshotClient):
     """Snapshot-only stand-in that RECORDS completion calls.
 
-    ``complete_instance`` deliberately performs NO local write: the
+    ``complete_instance`` deliberately performs NO database write: the
     API service is remote, and the assertions below must be able to
     prove the service handler itself completed nothing locally.
     """
 
+    def __init__(self, hass, entry_id: str) -> None:
+        super().__init__(hass, entry_id)
+        self.complete_calls: list[tuple[int, int]] = []
+
+    async def complete_instance(
+        self, instance_id: int, actor_child_id: int
+    ) -> dict:
+        self.complete_calls.append((instance_id, actor_child_id))
+        return {"status": "done"}
+
 
 class _FailingApiClient(_RecordingApiClient):
     """A stand-in whose completion fails the way the client types it."""
 
-    def __init__(self, error: NestQuestApiError, *outcomes) -> None:
-        super().__init__(*outcomes)
-        self.fail_complete_with = error
+    def __init__(self, hass, entry_id: str, error: NestQuestApiError) -> None:
+        super().__init__(hass, entry_id)
+        self._error = error
+
+    async def complete_instance(
+        self, instance_id: int, actor_child_id: int
+    ) -> dict:
+        self.complete_calls.append((instance_id, actor_child_id))
+        raise self._error
 
 
-def _empty_snapshot() -> dict:
-    return {
-        "today_iso": "2026-09-23",
-        "cycle_day": 0,
-        "children": [],
-    }
-
-
-async def _setup_entry(hass, make_entry, client):
-    """Wire, script, and set up an entry against the scripted client."""
+async def _setup_seeded_entry(hass, make_entry, client):
+    """Wire, script, and set up an entry with one child's daily quest."""
     entry = wire_entry_to_registry(
-        make_entry(data={CONF_PANEL_TOKEN: "secret-panel-token"}),
+        make_entry(
+            data={
+                CONF_ADMIN_USER_IDS: [ADMIN_CTX["user_id"]],
+                CONF_PANEL_TOKEN: "secret-panel-token",
+            }
+        ),
         hass.registry,
     )
     set_coordinator_client(entry, client)
     assert await async_setup_entry(hass, entry) is True
-    return entry
+    database = entry.runtime_data.database
+    from custom_components.nestquest.children import create_child
+
+    child = await create_child(database, "Ada")
+    today = datetime.date.today()
+    await create_quest_definition(
+        database,
+        "Brush teeth",
+        ScheduleRule.from_dict(
+            {"rule_type": "daily", "start_date": today.isoformat()}
+        ),
+        [child.id],
+        ["morning"],
+    )
+    end = (today + datetime.timedelta(days=3)).isoformat()
+    await materialize(database, today.isoformat(), end, today=today)
+    instances = await QuestInstancesDao(database).list_by_date_range(
+        child.id, today.isoformat(), today.isoformat()
+    )
+    assert instances
+    return entry, client, child, instances[0]
 
 
 def _record_refreshes(entry) -> list[bool]:
@@ -85,10 +133,11 @@ async def test_complete_quest_reaches_the_shared_api_client(
     hass, make_entry
 ) -> None:
     """A panel tap calls ``complete_instance`` on the entry's shared
-    client with the tapped child, fires NO local event, and refreshes
-    the coordinator immediately."""
-    client = _RecordingApiClient(_empty_snapshot())
-    entry = await _setup_entry(hass, make_entry, client)
+    client with the tapped child, completes NOTHING locally, fires NO
+    local event, and refreshes the coordinator immediately."""
+    entry, client, child, instance = await _setup_seeded_entry(
+        hass, make_entry, _RecordingApiClient(hass, "test_entry")
+    )
     assert entry.runtime_data.coordinator.api_client is client, (
         "the service must proxy through the entry's ONE shared client"
     )
@@ -98,13 +147,21 @@ async def test_complete_quest_reaches_the_shared_api_client(
         DOMAIN,
         SERVICE_COMPLETE_QUEST,
         {
-            "instance_id": 7,
+            "instance_id": instance.id,
             "actor": "panel",
-            "actor_child_id": 1,
+            "actor_child_id": child.id,
         },
     )
 
-    assert client.complete_calls == [(7, 1)]
+    assert client.complete_calls == [(instance.id, child.id)]
+    # No local completion: the instance is still open in the local
+    # database — only the API service writes (through its own client).
+    from custom_components.nestquest.completion import instance_state
+
+    assert (
+        await instance_state(entry.runtime_data.database, instance.id)
+        == "open"
+    )
     # No local firing: the completed (and day-complete) events arrive
     # over the SSE stream, re-fired by the subscription — never from
     # this handler.
@@ -141,10 +198,13 @@ async def test_api_failure_surfaces_as_a_service_error(
 ) -> None:
     """A typed API failure (non-2xx or transport) raises
     ``HomeAssistantError`` carrying the typed message — which never
-    includes the panel token — with nothing fired locally, and no
-    refresh for a mutation that never happened."""
-    client = _FailingApiClient(error, _empty_snapshot())
-    entry = await _setup_entry(hass, make_entry, client)
+    includes the panel token — with nothing completed or fired
+    locally, and no refresh for a mutation that never happened."""
+    entry, client, child, instance = await _setup_seeded_entry(
+        hass,
+        make_entry,
+        _FailingApiClient(hass, "test_entry", error),
+    )
     refreshes = _record_refreshes(entry)
 
     with pytest.raises(HomeAssistantError, match=fragment) as excinfo:
@@ -152,16 +212,22 @@ async def test_api_failure_surfaces_as_a_service_error(
             DOMAIN,
             SERVICE_COMPLETE_QUEST,
             {
-                "instance_id": 7,
+                "instance_id": instance.id,
                 "actor": "panel",
-                "actor_child_id": 1,
+                "actor_child_id": child.id,
             },
         )
     # The typed error is chained, and the service error carries the
     # typed message only — never the panel token.
     assert excinfo.value.__cause__ is error
     assert "secret-panel-token" not in str(excinfo.value)
-    assert client.complete_calls == [(7, 1)]
+    assert client.complete_calls == [(instance.id, child.id)]
+    from custom_components.nestquest.completion import instance_state
+
+    assert (
+        await instance_state(entry.runtime_data.database, instance.id)
+        == "open"
+    )
     assert hass.bus.fired(EVENT_QUEST_COMPLETED) == []
     assert hass.bus.fired(EVENT_CHILD_DAY_COMPLETE) == []
     assert refreshes == []
@@ -175,7 +241,9 @@ async def test_unconfigured_api_client_surfaces_as_a_service_error(
     of reaching an attribute error."""
     from custom_components.nestquest.coordinator import _UnconfiguredApiClient
 
-    await _setup_entry(hass, make_entry, _UnconfiguredApiClient())
+    entry, _client, child, instance = await _setup_seeded_entry(
+        hass, make_entry, _UnconfiguredApiClient()
+    )
 
     with pytest.raises(
         HomeAssistantError, match="NestQuest API is not configured"
@@ -184,9 +252,9 @@ async def test_unconfigured_api_client_surfaces_as_a_service_error(
             DOMAIN,
             SERVICE_COMPLETE_QUEST,
             {
-                "instance_id": 7,
+                "instance_id": instance.id,
                 "actor": "panel",
-                "actor_child_id": 1,
+                "actor_child_id": child.id,
             },
         )
 
@@ -197,18 +265,19 @@ async def test_non_panel_actor_is_rejected_before_the_client(
     """The API's panel route completes as the tapped child only: a
     user-actor call fails fast with a clear error and never reaches
     the client."""
-    client = _RecordingApiClient(_empty_snapshot())
-    await _setup_entry(hass, make_entry, client)
+    entry, client, child, instance = await _setup_seeded_entry(
+        hass, make_entry, _RecordingApiClient(hass, "test_entry")
+    )
 
     with pytest.raises(HomeAssistantError, match="actor must be 'panel'"):
         await hass.services.call(
             DOMAIN,
             SERVICE_COMPLETE_QUEST,
             {
-                "instance_id": 7,
+                "instance_id": instance.id,
                 "actor": "user",
-                "actor_user_id": "admin-1",
+                "actor_user_id": ADMIN_CTX["user_id"],
             },
-            context={"user_id": "admin-1"},
+            context=ADMIN_CTX,
         )
     assert client.complete_calls == []

tests/test_completion.py

@@ -8,27 +8,27 @@ import re
 
 import pytest
 
-from custom_components.nestquest.core.completion import (
+from custom_components.nestquest.completion import (
     append_event,
     complete_instance,
     instance_state,
     list_missed_for_child,
     uncomplete_instance,
 )
-from custom_components.nestquest.core.dao_children import ChildrenDao
-from custom_components.nestquest.core.dao_instances import (
+from custom_components.nestquest.dao_children import ChildrenDao
+from custom_components.nestquest.dao_instances import (
     EVENT_COMPLETED,
     EVENT_UNCOMPLETED,
     CompletionEventRecord,
     CompletionEventsDao,
     QuestInstancesDao,
 )
-from custom_components.nestquest.core.dao_rules import (
+from custom_components.nestquest.dao_rules import (
     QuestDefinitionsDao,
     ScheduleRulesDao,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):
@@ -311,7 +311,7 @@ def test_now_pins_occurred_at_utc(tmp_path) -> None:
 
 
 def test_module_never_exposes_update_or_delete() -> None:
-    import custom_components.nestquest.core.completion as completion
+    import custom_components.nestquest.completion as completion
 
     public = {
         name

tests/test_config_flow.py

@@ -156,13 +156,23 @@ def test_no_hardcoded_domain_or_db_filename_in_new_modules() -> None:
                     f"Found hard-coded database filename in {py_file.name}:{node.lineno}"
                 )
 
+async def test_flow_persists_flow_user_as_initial_admin(hass, make_flow) -> None:
+    """The HA user completing the flow lands in entry data as the
+    initial admin copy: entry.context is not persisted by real HA, so
+    the durable record must carry the owner."""
+    from custom_components.nestquest.const import CONF_ADMIN_USER_IDS
+
+    flow = make_flow(hass)
+    flow.context = {"user_id": "ha-owner"}
+    result = await flow.async_step_user({})
+    assert result["type"] == "create_entry"
+    assert result["data"] == {CONF_ADMIN_USER_IDS: ["ha-owner"]}
+
+
 async def test_flow_without_context_user_keeps_data_untouched(
     hass, make_flow
 ) -> None:
-    """A submit with user input stores it as-is; no admin copy is
-    invented (the allowlist lives in the API service's own store since
-    the DB removal)."""
     flow = make_flow(hass)
-    result = await flow.async_step_user({"update_interval": 60})
+    result = await flow.async_step_user({"horizon_days": 7})
     assert result["type"] == "create_entry"
-    assert result["data"] == {"update_interval": 60}
+    assert result["data"] == {"horizon_days": 7}

tests/test_coordinator.py

@@ -12,7 +12,6 @@ cycle day, and the unconfigured / failed-fetch behaviour.
 from __future__ import annotations
 
 import datetime
-import logging
 
 import pytest
 
@@ -24,9 +23,7 @@ from custom_components.nestquest.api_client import (
     NestQuestApiError,
 )
 from custom_components.nestquest.const import (
-    CONF_SNAPSHOT_STALENESS,
     CONF_UPDATE_INTERVAL,
-    DEFAULT_SNAPSHOT_STALENESS,
     DEFAULT_UPDATE_INTERVAL,
     DOMAIN,
 )
@@ -70,23 +67,6 @@ class StubSnapshotClient:
         return outcome
 
 
-class FakeMonotonic:
-    """A deterministic stand-in for the staleness clock.
-
-    The coordinator reads elapsed time through
-    :func:`custom_components.nestquest.coordinator._monotonic`; tests
-    patch that seam with an instance of this class and advance ``now``
-    by whole seconds, so the staleness window is exercised without any
-    real waiting.
-    """
-
-    def __init__(self, start: float = 1000.0) -> None:
-        self.now = start
-
-    def __call__(self) -> float:
-        return self.now
-
-
 #: A fixture panel snapshot (the documented Feature 16 route shape):
 #: two children — Ada owes one, owes none of it yet, is away today with
 #: a returns date; Bo completed his only quest and is present.
@@ -360,20 +340,13 @@ async def test_coordinator_entities_read_the_api_snapshot(hass, make_entry) -> N
     await async_unload_entry(hass, entry)
 
 
-async def test_coordinator_failed_fetch_marks_unavailable(
-    hass, make_entry, monkeypatch
-) -> None:
-    """A failed fetch (transport failure or non-2xx — both typed) PAST
-    the staleness threshold is a FAILED refresh pass: the update pass
-    converts the typed error to UpdateFailed (the exception HA's
-    coordinator machinery records as a failed pass, chaining the typed
-    error as ``__cause__``), the refresh records the failure instead of
-    raising, and data keeps its last good value.  (Within the threshold
-    the last-good cache serves instead — the staleness tests below.)"""
-    import custom_components.nestquest.coordinator as coordinator_module
-
-    clock = FakeMonotonic()
-    monkeypatch.setattr(coordinator_module, "_monotonic", clock)
+async def test_coordinator_failed_fetch_marks_unavailable(hass, make_entry) -> None:
+    """A failed fetch (transport failure or non-2xx — both typed) is a
+    FAILED refresh pass: the update pass converts the typed error to
+    UpdateFailed (the exception HA's coordinator machinery records as a
+    failed pass, chaining the typed error as ``__cause__``), the refresh
+    records the failure instead of raising, and data keeps its last
+    good value."""
     error = NestQuestApiError(
         "NestQuest API GET /api/v1/panel/snapshot failed with HTTP 503",
         status=503,
@@ -386,11 +359,8 @@ async def test_coordinator_failed_fetch_marks_unavailable(
     assert coordinator.data is not None
     assert coordinator.last_update_success is True
 
-    # The next pass hits the scripted failure AFTER the cache went
-    # stale — one second past the shipped 900 s default threshold: the
-    # update pass converts the typed error to UpdateFailed, with the
-    # typed error chained.
-    clock.now += DEFAULT_SNAPSHOT_STALENESS + 1
+    # The next pass hits the scripted failure: the update pass converts
+    # the typed error to UpdateFailed, with the typed error chained.
     with pytest.raises(UpdateFailed, match="HTTP 503") as excinfo:
         await coordinator._async_update_data()
     assert isinstance(excinfo.value.__cause__, NestQuestApiError)
@@ -406,163 +376,6 @@ async def test_coordinator_failed_fetch_marks_unavailable(
     assert isinstance(coordinator.last_exception.__cause__, NestQuestApiError)
 
 
-async def test_coordinator_serves_cached_snapshot_within_staleness(
-    hass, make_entry, monkeypatch, caplog
-) -> None:
-    """API down WITHIN the staleness threshold: the failed fetch serves
-    the last-good cache — the pass succeeds with the SAME snapshot, so
-    ``last_update_success`` stays True (entities remain available) and
-    the outage is logged as a clear warning, never silently."""
-    import custom_components.nestquest.coordinator as coordinator_module
-
-    clock = FakeMonotonic()
-    monkeypatch.setattr(coordinator_module, "_monotonic", clock)
-    error = NestQuestApiError(
-        "NestQuest API GET /api/v1/panel/snapshot failed with HTTP 503",
-        status=503,
-    )
-    # Setup's first refresh consumes the good snapshot; the two test
-    # passes hit the scripted failure.
-    client = StubSnapshotClient(FIXTURE_SNAPSHOT, error, error)
-    _entry, coordinator = await _wire_entry(
-        hass,
-        make_entry,
-        client,
-        options={CONF_UPDATE_INTERVAL: 300, CONF_SNAPSHOT_STALENESS: 900},
-    )
-    # The successful first pass cached the snapshot (stamped at the
-    # fake clock's start).
-    first = coordinator.data
-    assert first is not None
-    assert coordinator.last_update_success is True
-
-    # The API goes down 900 s after that success — exactly the
-    # threshold, still WITHIN the inclusive window: the pass serves the
-    # cached snapshot instead of failing.
-    clock.now += 900
-    with caplog.at_level(
-        logging.WARNING, logger="custom_components.nestquest"
-    ):
-        await coordinator.async_refresh()
-    assert coordinator.last_update_success is True
-    assert coordinator.data is first
-    assert coordinator.data.children[0].child_name == "Ada"
-    # The fetch WAS attempted (and failed) — the cache is a fallback,
-    # not a replacement for polling.
-    assert client.calls == 2
-    assert any(
-        "last-good" in record.getMessage() for record in caplog.records
-    )
-
-
-async def test_coordinator_recovers_without_reload_after_outage(
-    hass, make_entry, monkeypatch
-) -> None:
-    """The full outage arc: within the threshold the cache serves, past
-    it the entities go unavailable, and when the API comes back the
-    next pass succeeds with the FRESH snapshot, re-arms the cache, and
-    the entities recover — without any config-entry reload."""
-    import custom_components.nestquest.coordinator as coordinator_module
-
-    clock = FakeMonotonic()
-    monkeypatch.setattr(coordinator_module, "_monotonic", clock)
-    outage = NestQuestApiError(
-        "NestQuest API GET /api/v1/panel/snapshot failed with HTTP 503",
-        status=503,
-    )
-    post_recovery_outage = NestQuestApiError(
-        "NestQuest API GET /api/v1/panel/snapshot failed with HTTP 502",
-        status=502,
-    )
-    fresh = {**FIXTURE_SNAPSHOT, "cycle_day": 4}
-    client = StubSnapshotClient(
-        FIXTURE_SNAPSHOT, outage, outage, fresh, post_recovery_outage
-    )
-    _entry, coordinator = await _wire_entry(
-        hass,
-        make_entry,
-        client,
-        options={CONF_UPDATE_INTERVAL: 300, CONF_SNAPSHOT_STALENESS: 900},
-    )
-    first = coordinator.data
-    assert first.cycle_day == 3
-
-    # Within the threshold: the outage serves the cache.
-    clock.now += 300
-    await coordinator.async_refresh()
-    assert coordinator.last_update_success is True
-    assert coordinator.data is first
-
-    # Past the threshold: the outage fails the pass (unavailable).
-    clock.now += 901
-    await coordinator.async_refresh()
-    assert coordinator.last_update_success is False
-
-    # The API returns: the next pass succeeds with the fresh snapshot
-    # and no reload was involved anywhere.
-    await coordinator.async_refresh()
-    assert coordinator.last_update_success is True
-    fresh_data = coordinator.data
-    assert fresh_data.cycle_day == 4
-    assert hass.registry.reloaded == []
-
-    # The success re-armed the cache with the FRESH stamp: another
-    # outage within the threshold serves the new snapshot now, not the
-    # pre-outage one.
-    clock.now += 300
-    await coordinator.async_refresh()
-    assert coordinator.last_update_success is True
-    assert coordinator.data is fresh_data
-    assert client.calls == 5
-
-
-async def test_setup_creates_coordinator_with_configured_staleness(
-    hass, make_entry
-) -> None:
-    """The staleness threshold rides the entry options into the
-    coordinator, alongside the update interval."""
-    entry = wire_entry_to_registry(
-        make_entry(
-            options={CONF_UPDATE_INTERVAL: 60, CONF_SNAPSHOT_STALENESS: 600}
-        ),
-        hass.registry,
-    )
-    assert await async_setup_entry(hass, entry) is True
-    coordinator = entry.runtime_data.coordinator
-    assert coordinator._staleness_seconds == 600
-
-
-async def test_setup_staleness_below_interval_falls_back_to_default(
-    hass, make_entry
-) -> None:
-    """A stored threshold below the update interval (a raw hand-edited
-    option) never reaches the coordinator as-is: it falls back to the
-    shipped default, which still spans the configured interval."""
-    entry = wire_entry_to_registry(
-        make_entry(
-            options={CONF_UPDATE_INTERVAL: 600, CONF_SNAPSHOT_STALENESS: 60}
-        ),
-        hass.registry,
-    )
-    assert await async_setup_entry(hass, entry) is True
-    coordinator = entry.runtime_data.coordinator
-    assert coordinator._staleness_seconds == DEFAULT_SNAPSHOT_STALENESS
-
-
-async def test_coordinator_staleness_floor_never_below_interval(hass) -> None:
-    """A threshold below the interval falls back to whichever of
-    default/interval is larger, so the cache can always span at least
-    one failed poll (here the interval exceeds the shipped default)."""
-    coordinator = NestQuestCoordinator(
-        hass,
-        entry_id="floor",
-        api_client=StubSnapshotClient(),
-        update_interval_seconds=1800,
-        staleness_seconds=60,
-    )
-    assert coordinator._staleness_seconds == 1800
-
-
 async def test_failed_first_refresh_does_not_crash_setup(
     hass, make_entry
 ) -> None:

tests/test_core_settings.py

@@ -14,9 +14,9 @@ Covers the contracts from task 4dd8f870 plus the review fixes:
   test feeds the scanner each bypass shape and asserts it flags them.
 - A settings object constructed with NON-default ``horizon_days`` and
   ``day_rollover_time`` drives a materialization whose resulting window
-  matches the non-default horizon — via the core ``materialize`` path
-  (the integration path it used to share is gone with the integration's
-  database).
+  matches the non-default horizon — via BOTH the core ``materialize``
+  path and the INTEGRATION path (``_run_horizon_materialization`` +
+  ``_register_day_rollover_listener``).
 """
 from __future__ import annotations
 
@@ -29,6 +29,7 @@ from typing import Any
 import pytest
 
 import custom_components.nestquest.core as _core_mod
+from conftest import freeze_nestquest_clock
 
 from custom_components.nestquest.const import (
     CONF_AFTERNOON_REMINDER_ENABLED,
@@ -740,7 +741,7 @@ def test_settings_module_has_no_ha_imports() -> None:
 
 
 # ---------------------------------------------------------------------------
-# Materialization over a non-default horizon (core path).
+# Materialization over a non-default horizon: core path + integration path.
 # ---------------------------------------------------------------------------
 
 
@@ -827,3 +828,85 @@ async def test_materialize_over_non_default_horizon(hass, tmp_path) -> None:
         ) == []
     finally:
         await database.close()
+
+
+async def test_integration_path_threads_settings(
+    hass, tmp_path, monkeypatch
+) -> None:
+    """The integration path threads ``settings`` through horizon_window + rollover.
+
+    ``_run_horizon_materialization`` calls
+    ``settings.horizon_window(today)`` (so the helper is real and shared,
+    not recomputed inline), and ``_register_day_rollover_listener``
+    registers at ``settings.day_rollover_hour_minute``.  This runs the
+    INTEGRATION path with ``horizon_days=3`` and
+    ``day_rollover_time='03:30'`` and asserts the resulting instance
+    window matches [today, today+3] AND the registered hour/minute are 3/30.
+    """
+    import custom_components.nestquest as nestquest
+    from custom_components.nestquest.core.dao_children import ChildrenDao
+    from custom_components.nestquest.core.dao_instances import (
+        QuestInstancesDao,
+    )
+    from custom_components.nestquest.core.quest_definitions import (
+        create_quest_definition,
+    )
+    from custom_components.nestquest.core.recurrence import (
+        RuleType,
+        ScheduleRule,
+    )
+
+    # Freeze the integration clock so "today" is deterministic (the
+    # hass fixture's config.time_zone is UTC, so 2026-03-01 12:00 UTC
+    # localizes to 2026-03-01).
+    freeze_nestquest_clock(
+        monkeypatch, datetime.datetime(2026, 3, 1, 12, 0, tzinfo=datetime.timezone.utc)
+    )
+
+    database = await _prepare(tmp_path / "nq.db", hass.async_add_executor_job)
+    try:
+        settings = NestQuestSettings(horizon_days=3, day_rollover_time="03:30")
+        today = datetime.date(2026, 3, 1)
+
+        NOW = "2026-03-01T12:00:00+00:00"
+        child = await ChildrenDao(database).create("Ada", NOW)
+        await create_quest_definition(
+            database,
+            "Daily chore",
+            ScheduleRule(
+                rule_type=RuleType.DAILY, start_date=today.isoformat()
+            ),
+            [child.id],
+            ["morning"],
+        )
+
+        # Integration path: the window comes from settings.horizon_window.
+        await nestquest._run_horizon_materialization(hass, database, settings)
+
+        end = today + datetime.timedelta(days=3)
+        records = await QuestInstancesDao(database).list_by_date_range(
+            child.id, today.isoformat(), end.isoformat()
+        )
+        dates = sorted({r.due_date for r in records})
+        assert dates == [
+            (today + datetime.timedelta(days=i)).isoformat()
+            for i in range(4)
+        ]
+        beyond = (end + datetime.timedelta(days=1)).isoformat()
+        far = (end + datetime.timedelta(days=10)).isoformat()
+        assert await QuestInstancesDao(database).list_by_date_range(
+            child.id, beyond, far
+        ) == []
+
+        # The rollover listener registers at the configured hour/minute.
+        remove = nestquest._register_day_rollover_listener(
+            hass, database, settings
+        )
+        try:
+            reg = hass.time_change.registrations[-1]
+            assert reg["hour"] == 3
+            assert reg["minute"] == 30
+        finally:
+            remove()
+    finally:
+        await database.close()

tests/test_core_snapshot.py

@@ -10,22 +10,17 @@ child's ``next_present``, a due-timed quest's ``overdue`` under a
 pinned ``now``, the custody ``cycle_day`` (> 1), and the panel payload
 dict shape (``done`` -> ``completed``, ``on_time`` passthrough, and
 ``missed`` omission) are all exercised as literals.
-
-The database is a standalone core one (the integration owns no
-database since Feature 18's DB removal); the closing round-trip pins
-that the integration's coordinator reconstructs the SAME dataclasses
-from the route's payload.
 """
 from __future__ import annotations
 
 import datetime
 from zoneinfo import ZoneInfo
 
-from conftest import set_coordinator_client, wire_entry_to_registry
+from conftest import wire_entry_to_registry
 
 from custom_components.nestquest import async_setup_entry
-from custom_components.nestquest.core.children import create_child
-from custom_components.nestquest.core.completion import complete_instance
+from custom_components.nestquest.children import create_child
+from custom_components.nestquest.completion import complete_instance
 from custom_components.nestquest.core.snapshot import (
     ChildDaySnapshot,
     NestQuestSnapshot,
@@ -33,17 +28,14 @@ from custom_components.nestquest.core.snapshot import (
     build_snapshot,
     instance_payload,
 )
-from custom_components.nestquest.core.dao_instances import QuestInstancesDao
-from custom_components.nestquest.core.dao_presence import (
+from custom_components.nestquest.dao_instances import QuestInstancesDao
+from custom_components.nestquest.dao_presence import (
     PresenceOverridesDao,
     PresenceSchedulesDao,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.materialize import materialize
-from custom_components.nestquest.core.migrations import apply_migrations
-from custom_components.nestquest.core.quest_definitions import create_quest_definition
-from custom_components.nestquest.core.recurrence import ScheduleRule
-from custom_components.nestquest.core.settings import NestQuestSettings
+from custom_components.nestquest.materialize import materialize
+from custom_components.nestquest.quest_definitions import create_quest_definition
+from custom_components.nestquest.recurrence import ScheduleRule
 
 
 async def test_instance_payload_shape_and_missed_omission() -> None:
@@ -113,7 +105,7 @@ async def test_instance_payload_shape_and_missed_omission() -> None:
     )
 
 
-async def test_build_snapshot_explicit_values(hass, make_entry, tmp_path) -> None:
+async def test_build_snapshot_explicit_values(hass, make_entry, monkeypatch) -> None:
     """The builder produces the documented shape as literals, pinned in time.
 
     Ada is AWAY today (a 2-week schedule whose absent week 0 covers today,
@@ -125,12 +117,11 @@ async def test_build_snapshot_explicit_values(hass, make_entry, tmp_path) -> Non
     scheduled active child is Ada, whose 2-week cycle anchored one day
     before today puts ``cycle_day`` at 2.
     """
-    # A standalone core database (the integration owns none): the
-    # builder and its seed run against it through the executor.
-    database = NestQuestDatabase(hass.async_add_executor_job)
-    await database.open(tmp_path / "snapshot.db")
-    await apply_migrations(database)
-    settings = NestQuestSettings()
+    entry = wire_entry_to_registry(make_entry(), hass.registry)
+    assert await async_setup_entry(hass, entry) is True
+    coordinator = entry.runtime_data.coordinator
+    database = entry.runtime_data.database
+    settings = entry.runtime_data.settings
 
     # Single clock read for the seed/snapshot anchor (no midnight skew);
     # the coordinator no longer owns a clock read (the API serves the
@@ -312,6 +303,8 @@ async def test_build_snapshot_explicit_values(hass, make_entry, tmp_path) -> Non
     # The dataclasses are frozen, so == is a full deep compare — a
     # reconstruction that dropped or reshaped a field would diverge
     # here even though the literal assertions above still pass.
+    from conftest import set_coordinator_client
+
     class _PinnedPayloadClient:
         async def get_snapshot(self):
             return {
@@ -335,12 +328,6 @@ async def test_build_snapshot_explicit_values(hass, make_entry, tmp_path) -> Non
                 ],
             }
 
-    entry = wire_entry_to_registry(
-        make_entry(data={"api_base_url": "http://api.test:8000", "panel_token": "tok"}),
-        hass.registry,
-    )
     set_coordinator_client(entry, _PinnedPayloadClient())
-    assert await async_setup_entry(hass, entry) is True
-    coordinator = entry.runtime_data.coordinator
+    await coordinator.async_refresh()
     assert coordinator.data == built
-    await database.close()

tests/test_core_sweep.py

@@ -1,295 +0,0 @@
-"""Cross-process safety of the missed-sweep watermark claim.
-
-Feature 11's sweep guards its announcement with the watermark; the
-original guard was a read-then-set inside a per-PROCESS asyncio lock,
-so two PROCESSES sharing one SQLite file (the HA integration's
-rollover sweep and the API service's scheduler) could both read the
-old watermark and both announce the same missed batch.  These tests
-pin the fix:
-
-- :meth:`MetaStateDao.claim` is the atomic, database-level primitive:
-  one conditional upsert whose ``rowcount`` says whether THIS caller
-  changed the row.  The first claimant of a value wins; a second
-  claimant of the same value — even on an INDEPENDENT connection to
-  the same file, the shape two processes produce — loses.
-- :func:`run_missed_sweep` gates the announcement on that claim: two
-  independent ``NestQuestDatabase`` wrappers (two processes' shape)
-  racing one seeded database yields exactly one announcer.
-- The documented sweep semantics are unchanged: a same-night rerun
-  announces nothing, and a run after days of downtime announces the
-  accumulated ``[watermark, today)`` window exactly once.
-
-Everything here runs against the bundled HA-free core copy
-(``custom_components.nestquest.core``) with a plain
-``asyncio.to_thread`` executor — no Home Assistant, no API server.
-"""
-from __future__ import annotations
-
-import asyncio
-import datetime
-from types import SimpleNamespace
-
-import pytest
-
-from custom_components.nestquest.core.dao_instances import (
-    QuestInstancesDao,
-)
-from custom_components.nestquest.core.dao_meta import MetaStateDao
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
-from custom_components.nestquest.core.children import create_child
-from custom_components.nestquest.core.quest_definitions import (
-    create_quest_definition,
-)
-from custom_components.nestquest.core.materialize import materialize
-from custom_components.nestquest.core.recurrence import ScheduleRule
-from custom_components.nestquest.core.sweep import (
-    SWEEP_WATERMARK_KEY,
-    run_missed_sweep,
-)
-
-#: One missed event per unswept past-due instance — the sweep's only
-#: event type.
-EVENT_QUEST_MISSED = "nestquest_quest_missed"
-
-
-async def _executor(fn, *args, **kwargs):
-    """Run a synchronous callable on a worker thread and await it.
-
-    The :class:`NestQuestDatabase` executor contract (the shape of
-    ``hass.async_add_executor_job``), so sqlite3 calls never block the
-    event loop.
-    """
-    return await asyncio.to_thread(fn, *args, **kwargs)
-
-
-async def _open_database(db_path: str) -> NestQuestDatabase:
-    """Open (without migrating) one independent connection wrapper."""
-    database = NestQuestDatabase(_executor)
-    await database.open(db_path)
-    return database
-
-
-async def _seed_missed_household(
-    db_path: str, today: datetime.date
-) -> SimpleNamespace:
-    """Seed a household with two past-due open instances on ``db_path``.
-
-    One child, two quests whose ONLY instances are due YESTERDAY
-    (materialized with ``today`` pinned to yesterday, ``end_date``
-    closing the rules so the later today-walk cannot duplicate them).
-    Seeding uses its OWN connection, opened and closed here, so the
-    connections the tests race with start fresh.
-    """
-    database = await _open_database(db_path)
-    try:
-        await apply_migrations(database)
-        today_iso = today.isoformat()
-        yesterday = today - datetime.timedelta(days=1)
-        yesterday_iso = yesterday.isoformat()
-        rule = ScheduleRule.from_dict(
-            {
-                "rule_type": "daily",
-                "start_date": yesterday_iso,
-                "end_date": yesterday_iso,
-            }
-        )
-        ada = await create_child(database, "Ada", sort_order=0)
-        await create_quest_definition(
-            database, "Stale chore", rule, [ada.id], [("morning", "09:00")]
-        )
-        await create_quest_definition(
-            database, "Old chore", rule, [ada.id], [("evening", "18:30")]
-        )
-        await materialize(database, yesterday_iso, yesterday_iso, today=yesterday)
-        # A quest due TODAY (created after the yesterday walk so it has
-        # no past-due instance): the post-downtime catch-up run's
-        # target — inside [watermark=today, later_today) but not
-        # inside the day-one sweep's window.
-        await create_quest_definition(
-            database,
-            "Recoverable chore",
-            ScheduleRule.from_dict(
-                {"rule_type": "daily", "start_date": today_iso}
-            ),
-            [ada.id],
-            [("afternoon", "17:00")],
-        )
-        await materialize(database, today_iso, today_iso, today=today)
-        instances = QuestInstancesDao(database)
-        rows = await instances.list_by_child_and_date(ada.id, yesterday_iso)
-        assert len(rows) == 2
-        today_rows = await instances.list_by_child_and_date(
-            ada.id, today_iso
-        )
-        assert len(today_rows) == 1
-        return SimpleNamespace(
-            child=ada,
-            instances=rows,
-            recoverable_instance=today_rows[0],
-            yesterday_iso=yesterday_iso,
-            today_iso=today_iso,
-        )
-    finally:
-        await database.close()
-
-
-# --- the claim primitive: atomic at the database level ------------------
-
-
-async def test_claim_first_caller_wins_and_second_same_value_loses(
-    temp_db_path: str,
-) -> None:
-    """claim() is a conditional upsert: first True, same-value second False.
-
-    A different value always wins (an advance re-arms the check), and
-    the stored value follows the winner.
-    """
-    database = await _open_database(temp_db_path)
-    try:
-        await apply_migrations(database)
-        dao = MetaStateDao(database)
-        assert await dao.get(SWEEP_WATERMARK_KEY) is None
-
-        assert await dao.claim(SWEEP_WATERMARK_KEY, "2026-09-01") is True
-        # Same value again: the row is already there — nothing changed.
-        assert await dao.claim(SWEEP_WATERMARK_KEY, "2026-09-01") is False
-        assert await dao.get(SWEEP_WATERMARK_KEY) == "2026-09-01"
-        # A DIFFERENT value is an advance, not a re-claim: it wins.
-        assert await dao.claim(SWEEP_WATERMARK_KEY, "2026-09-02") is True
-        assert await dao.get(SWEEP_WATERMARK_KEY) == "2026-09-02"
-        assert await dao.claim(SWEEP_WATERMARK_KEY, "2026-09-02") is False
-    finally:
-        await database.close()
-
-
-async def test_claim_is_atomic_across_independent_connections(
-    temp_db_path: str,
-) -> None:
-    """Two connections to one file cannot both claim the same value.
-
-    This is the two-process shape: independent sqlite3 connections (one
-    per ``NestQuestDatabase`` wrapper), racing the SAME key on the SAME
-    event loop with no shared lock.  The single conditional upsert is
-    serialized by SQLite itself, so exactly one caller's rowcount is 1.
-    """
-    first = await _open_database(temp_db_path)
-    second = await _open_database(temp_db_path)
-    try:
-        await apply_migrations(first)
-        won = await asyncio.gather(
-            MetaStateDao(first).claim(SWEEP_WATERMARK_KEY, "2026-09-01"),
-            MetaStateDao(second).claim(SWEEP_WATERMARK_KEY, "2026-09-01"),
-        )
-        assert sorted(won) == [False, True]
-        # One stored row, holding the winner's value.
-        assert await MetaStateDao(first).get(SWEEP_WATERMARK_KEY) == (
-            "2026-09-01"
-        )
-        assert await MetaStateDao(second).get(SWEEP_WATERMARK_KEY) == (
-            "2026-09-01"
-        )
-    finally:
-        await first.close()
-        await second.close()
-
-
-# --- the sweep: the announcement is gated by the atomic claim -----------
-
-
-async def test_two_process_shape_race_exactly_one_announces(
-    temp_db_path: str,
-) -> None:
-    """Two independent connections racing the sweep: ONE announcer.
-
-    Each wrapper carries its own connection AND its own per-process
-    sweep lock, so nothing in-process serialises the two runs — the
-    only guard left is the database-level claim.  Both read the unset
-    watermark and both build the events, but exactly one claim wins:
-    one run returns the missed events, the loser returns [].
-    """
-    today = datetime.datetime.now().astimezone().date()
-    seed = await _seed_missed_household(temp_db_path, today)
-    first = await _open_database(temp_db_path)
-    second = await _open_database(temp_db_path)
-    try:
-        results = await asyncio.gather(
-            run_missed_sweep(first, today=today),
-            run_missed_sweep(second, today=today),
-        )
-        announcers = [r for r in results if r]
-        assert len(announcers) == 1
-        event_type, payload = announcers[0][0]
-        assert event_type == EVENT_QUEST_MISSED
-        assert payload["due_date"] == seed.yesterday_iso
-        # Both instances of the seeded window, one event each.
-        assert len(announcers[0]) == 2
-        losers = [r for r in results if not r]
-        assert losers == [[]]
-        # The watermark holds the run's date for whoever looks next.
-        assert (
-            await MetaStateDao(first).get(SWEEP_WATERMARK_KEY)
-            == seed.today_iso
-        )
-    finally:
-        await first.close()
-        await second.close()
-
-
-async def test_same_night_rerun_announces_nothing(temp_db_path: str) -> None:
-    """A second sweep for the same date is an empty no-op (the watermark)."""
-    today = datetime.datetime.now().astimezone().date()
-    await _seed_missed_household(temp_db_path, today)
-    database = await _open_database(temp_db_path)
-    try:
-        first = await run_missed_sweep(database, today=today)
-        assert len(first) == 2
-        second = await run_missed_sweep(database, today=today)
-        assert second == []
-    finally:
-        await database.close()
-
-
-async def test_post_downtime_run_announces_accumulated_window_once(
-    temp_db_path: str,
-) -> None:
-    """After days of downtime the catch-up run sweeps the window once.
-
-    The first run sweeps yesterday's instances (watermark := today);
-    ``today`` then jumps two days and the catch-up run — on a
-    DIFFERENT connection, the two-process shape — announces the
-    accumulated ``[watermark, later_today)`` window exactly once, and
-    a rerun on the original connection is silent again.
-    """
-    today = datetime.datetime.now().astimezone().date()
-    later_today = today + datetime.timedelta(days=2)
-    seed = await _seed_missed_household(temp_db_path, today)
-    first = await _open_database(temp_db_path)
-    second = await _open_database(temp_db_path)
-    try:
-        # Day one: yesterday's two instances fire once.
-        day_one = await run_missed_sweep(first, today=today)
-        assert len(day_one) == 2
-        assert all(
-            payload["due_date"] == seed.yesterday_iso
-            for _, payload in day_one
-        )
-
-        # The downtime catch-up: the window is [watermark, later_today).
-        catchup = await run_missed_sweep(second, today=later_today)
-        assert len(catchup) == 1
-        event_type, payload = catchup[0]
-        assert event_type == EVENT_QUEST_MISSED
-        assert payload["due_date"] == seed.today_iso
-        assert payload["instance_id"] == seed.recoverable_instance.id
-        assert payload["child_id"] == seed.child.id
-
-        # A further rerun announces nothing.
-        assert await run_missed_sweep(first, today=later_today) == []
-        assert (
-            await MetaStateDao(first).get(SWEEP_WATERMARK_KEY)
-            == later_today.isoformat()
-        )
-    finally:
-        await first.close()
-        await second.close()

tests/test_dao_children.py

@@ -6,15 +6,15 @@ import sqlite3
 
 import pytest
 
-from custom_components.nestquest.core.dao_children import (
+from custom_components.nestquest.dao_children import (
     AdminUserRecord,
     AdminUsersDao,
     ChildRecord,
     ChildrenDao,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.schema import SCHEMA_V1_STATEMENTS
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.schema import SCHEMA_V1_STATEMENTS
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):
@@ -504,6 +504,9 @@ def test_children_and_admin_sql_lives_only_in_dao_module() -> None:
         "tests/test_dao_rules.py",  # rules/definitions guard, own scope
         "tests/test_dao_presence.py",  # presence guard, own scope
         "tests/test_dao_instances.py",  # instances guard, own scope
+        "tests/test_startup_db.py",  # row-count probe of the children
+        # table only (proving a fresh setup loads); guard below covers
+        # everything else
     }
     sql_pattern = re.compile(
         r"(FROM|INTO|UPDATE|DELETE\s+FROM|JOIN)\s+"
@@ -555,6 +558,32 @@ def _strip_function_spans(text: str, names: set[str]) -> str:
         for number, line in enumerate(lines, start=1)
         if number not in excluded
     )
+
+
+def test_startup_db_test_file_uses_dao_elsewhere() -> None:
+    """Compensating self-scan for the startup-test exemption: outside
+    the single sanctioned COUNT(*) probe, test_startup_db.py must go
+    through the DAO for children/admin_users data access.
+    """
+    import re
+    from pathlib import Path
+
+    startup_test = Path(__file__).parent / "test_startup_db.py"
+    stripped = _strip_function_spans(
+        startup_test.read_text(),
+        {"test_setup_with_valid_file_preserves_rows"},
+    )
+    sql_pattern = re.compile(
+        r"(SELECT\s[^\"']*?FROM|INSERT\s+INTO|UPDATE|DELETE\s+FROM|"
+        r"FROM|JOIN)\s+[`'\"]*(\[)?(children|admin_users)\b",
+        re.IGNORECASE,
+    )
+    assert sql_pattern.search(stripped) is None, (
+        "test_startup_db.py must go through the DAO for these tables "
+        "outside its sanctioned row-count probe"
+    )
+
+
 def test_dao_matrix_test_file_raw_probes_are_only_constraint_probes() -> None:
     """Compensating self-scan for the matrix-file exemption, structurally
     exact: parse the two sanctioned functions' ASTs and require that

tests/test_dao_instances.py

@@ -7,16 +7,16 @@ import sqlite3
 
 import pytest
 
-from custom_components.nestquest.core.dao_children import ChildrenDao
-from custom_components.nestquest.core.dao_instances import (
+from custom_components.nestquest.dao_children import ChildrenDao
+from custom_components.nestquest.dao_instances import (
     CompletionEventRecord,
     CompletionEventsDao,
     QuestInstanceRecord,
     QuestInstancesDao,
 )
-from custom_components.nestquest.core.dao_rules import ScheduleRulesDao, QuestDefinitionsDao
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.dao_rules import ScheduleRulesDao, QuestDefinitionsDao
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):

tests/test_dao_matrix.py

@@ -21,24 +21,24 @@ from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
-from custom_components.nestquest.core.dao_children import (
+from custom_components.nestquest.dao_children import (
     AdminUsersDao,
     ChildrenDao,
 )
-from custom_components.nestquest.core.dao_instances import (
+from custom_components.nestquest.dao_instances import (
     CompletionEventsDao,
     QuestInstancesDao,
 )
-from custom_components.nestquest.core.dao_presence import (
+from custom_components.nestquest.dao_presence import (
     PresenceOverridesDao,
     PresenceSchedulesDao,
 )
-from custom_components.nestquest.core.dao_rules import (
+from custom_components.nestquest.dao_rules import (
     ScheduleRulesDao,
     QuestDefinitionsDao,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):

tests/test_dao_presence.py

@@ -6,15 +6,15 @@ import sqlite3
 
 import pytest
 
-from custom_components.nestquest.core.dao_children import ChildrenDao
-from custom_components.nestquest.core.dao_presence import (
+from custom_components.nestquest.dao_children import ChildrenDao
+from custom_components.nestquest.dao_presence import (
     PresenceOverrideRecord,
     PresenceOverridesDao,
     PresenceScheduleRecord,
     PresenceSchedulesDao,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
 
 
 def _run(coro):
@@ -741,12 +741,12 @@ def test_override_create_racing_conflicts_serialize(tmp_path) -> None:
     from unittest.mock import MagicMock
 
     async def _main():
-        from custom_components.nestquest.core.dao_children import ChildrenDao
-        from custom_components.nestquest.core.dao_presence import (
+        from custom_components.nestquest.dao_children import ChildrenDao
+        from custom_components.nestquest.dao_presence import (
             PresenceOverridesDao,
         )
-        from custom_components.nestquest.core.db import NestQuestDatabase
-        from custom_components.nestquest.core.migrations import apply_migrations
+        from custom_components.nestquest.db import NestQuestDatabase
+        from custom_components.nestquest.migrations import apply_migrations
 
         armed = {"active": False, "gated": False}
         gate_open = asyncio_module.Event()

tests/test_dao_rules.py

@@ -6,8 +6,8 @@ import sqlite3
 
 import pytest
 
-from custom_components.nestquest.core.dao_children import ChildrenDao
-from custom_components.nestquest.core.dao_rules import (
+from custom_components.nestquest.dao_children import ChildrenDao
+from custom_components.nestquest.dao_rules import (
     ScheduleRuleRecord,
     ScheduleRuleStorage,
     ScheduleRulesDao,
@@ -17,9 +17,9 @@ from custom_components.nestquest.core.dao_rules import (
     schedule_rule_from_storage,
     schedule_rule_to_storage,
 )
-from custom_components.nestquest.core.db import NestQuestDatabase
-from custom_components.nestquest.core.migrations import apply_migrations
-from custom_components.nestquest.core.recurrence import (
+from custom_components.nestquest.db import NestQuestDatabase
+from custom_components.nestquest.migrations import apply_migrations
+from custom_components.nestquest.recurrence import (
     RuleType,
     RuleValidationError,
     ScheduleRule,
@@ -341,7 +341,7 @@ def test_rule_delete_concurrent_with_definition_create_is_safe(
                 # delete task has been scheduled, so the create holds
                 # the connection lock while the delete queues behind
                 # it — then the create proceeds and wins.
-                import custom_components.nestquest.core.dao_rules as dao_rules
+                import custom_components.nestquest.dao_rules as dao_rules
 
                 original_validate = (
                     dao_rules.QuestDefinitionsDao._validate_rule_exists