Serialise time zone adoption with the missed-sweep scheduler

The wake flag compared an adoption only against the plan the loop last
recorded, so New York -> UTC -> New York during the re-plan read left
the scheduler sleeping on UTC midnight; and an adoption committing
between the pre-sweep check and the sweep still let the stale sweep run.

`MissedSweepScheduler.settings_lock` now serialises the panel's adoption
(write plus `settings_changed`) with the loop's plan read and with its
pre-sweep re-read plus sweep.  It is never held across the wait, and the
loop holds nothing else while acquiring it, so a panel request is at
most delayed by one settings read or one sweep.

`_sleep_unless_woken` now cancels and awaits both child tasks, and
re-raises a failed sleep inside the loop's retry block, so the backoff
runs instead of a sweep and nothing outlives `stop()`.

Tests (all four fail on bcf387d): the successive-zone race, an adoption
issued during the pre-sweep check, a failing sleep, and stop() waiting
for the sleep's cancellation cleanup.

Task: 6351b36d-0eef-4e7d-bf5a-96b754cbc883

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RELEASE_NOTES.md

@@ -1,5 +1,217 @@
 # NestQuest Release Notes
 
+## Version 0.9.5 — 2026-09-27
+
+### Scope
+
+Patch release carrying the kids' panel Return button onto `main`.
+
+- **Return button:** the Quest Log header now shows an explicit Return control —
+  a left chevron plus "The Party", 72px high and sized to its label, sitting left
+  of the crest — so a child
+  can go straight back to the main Party board instead of waiting out the 40 s
+  idle return. It calls the same navigation the idle return uses
+  (`board_path` + `location-changed`), so there is exactly one navigation path.
+  It is hidden when no board path is configured, appears on every header-bearing
+  Quest Log screen (normal, away, and "no quests today"), and does not appear on
+  the Quest-complete screen, which keeps its 12 s auto-return. The control meets
+  the panel's hard rules (72px tap target, 26px label, `:active` feedback only,
+  clear of the window columns and the dock), and the 40 s idle return and
+  crest-tap navigation are unchanged. (PR #272.)
+
+### Upgrade note
+
+The database schema is unchanged at version **9**; no migration or backup step is
+needed. No runtime dependency is added — only the bundled panel card changed.
+
+### Requirements
+
+Home Assistant 2024.6.0 or newer. Install through HACS from the
+`Maniacs-Mansion/NestQuest` GitHub mirror (kept current by the Gitea push
+mirror).
+
+## Version 0.9.4 — 2026-09-26
+
+### Scope
+
+Patch release fixing the admin timezone control that shipped in 0.9.3.
+
+- **Clearing the timezone now persists:** in 0.9.3 the Settings screen
+  re-detected the browser zone whenever the timezone field was empty, so an admin
+  could not leave it empty ("use the API host's local time") — closing and
+  reopening the screen set it again. A new persisted, API-only
+  `timezone_configured` marker (default `false`) now distinguishes "never set"
+  from "admin chose empty": the one-time auto-set runs only when the timezone is
+  empty AND the marker is false, and any saved timezone change — including
+  clearing it — sets the marker, so an explicit empty choice survives. (PRs #266,
+  #268.)
+- Nothing else changes: the `timezone` setting, its auto-set from the browser zone
+  on a fresh install, the Add/Save flow, and the rest of the Settings screen are
+  as in 0.9.3.
+
+### Upgrade note
+
+The database schema is unchanged at version **9**; no migration or backup step is
+needed. Settings stored before this release have no `timezone_configured` value
+and read it as `false`, so an install whose timezone is empty will auto-set the
+browser zone once on the next open — after which the choice persists.
+
+### Requirements
+
+Home Assistant 2024.6.0 or newer. Install through HACS from the
+`Maniacs-Mansion/NestQuest` GitHub mirror (kept current by the Gitea push
+mirror).
+
+## Version 0.9.3 — 2026-09-26
+
+### Scope
+
+Patch release carrying the admin timezone control onto `main`.
+
+- **Admins set the system timezone from the PWA:** the Preferences screen gains a
+  Timezone field (a text input with a local datalist of common IANA zones;
+  `UTC` or `Area/Location`). On a fresh install the value is set AUTOMATICALLY
+  from the browser's IANA zone when the setting is empty on first load — no
+  geolocation prompt and no network lookup — and an admin can change or clear it
+  at any time. Only a changed value is sent, and the API's 422 for an unknown zone
+  is shown by the form. (PR #266.)
+- This makes the household-local clock (overdue, daily rollover) configurable
+  from the UI, replacing the manual
+  `PATCH /api/v1/admin/settings {"timezone": ...}` step noted in 0.9.1. The
+  setting still defaults to the API host's local time when left empty.
+
+### Upgrade note
+
+The database schema is unchanged at version **9**; no migration or backup step is
+needed. No runtime dependency is added.
+
+### Requirements
+
+Home Assistant 2024.6.0 or newer. Install through HACS from the
+`Maniacs-Mansion/NestQuest` GitHub mirror (kept current by the Gitea push
+mirror).
+
+## Version 0.9.2 — 2026-09-26
+
+### Scope
+
+Patch release carrying the admin "Delete task" capability onto `main`.
+
+- **Delete a task in the admin PWA:** the definition edit sheet gains an
+  admin-only Delete action with hybrid semantics (D-017, owner decision "delete
+  if there's no history, retire/deactivate if there is"). If the definition has
+  **no completion history**, it is hard-deleted together with its instances,
+  assignees, windows and its schedule rule (when unreferenced), all in one
+  transaction under the connection lock. If it has **any completion history** (a
+  completion or an un-completion), nothing is deleted: it is retired by
+  deactivation instead, preserving the definition, rule, assignees, windows and
+  all history, with future uncompleted instances cleared as with any
+  deactivation. (PR #262.)
+- **API:** `DELETE /api/v1/admin/quest-definitions/{id}` lives on the admin plane
+  (`require_admin`; a non-admin is refused and an unknown id is 404). The response
+  reports `deleted`/`retired` and carries the retired definition (`null` when
+  deleted). The kids' panel gains no control, and `QuestDefinitionsDao` now has
+  exactly one, history-guarded, delete method.
+
+### Upgrade note
+
+The database schema is unchanged at version **9**; no migration or backup step is
+needed beyond the 0.8.0 note. No runtime dependency is added.
+
+### Requirements
+
+Home Assistant 2024.6.0 or newer. Install through HACS from the
+`Maniacs-Mansion/NestQuest` GitHub mirror (kept current by the Gitea push
+mirror).
+
+## Version 0.9.1 — 2026-09-26
+
+### Scope
+
+Patch release carrying the owner-reported UI-bug fixes for the kids' panel, plus a
+household-timezone correction, onto `main`.
+
+- **Household-local time:** a new `timezone` setting (an IANA name such as
+  `America/New_York`; empty keeps the API host's local time) is threaded into the
+  API's clock reads, so overdue and the daily rollover use the household's day
+  rather than a UTC host's. **Set it once after upgrading** (see the Upgrade
+  note); the admin UI has no field for it yet. (PR #254.)
+- **Overdue and rollover correctness:** quests are no longer marked overdue
+  before their due time, and the missed-sweep scheduler fires at the configured
+  rollover across DST transitions — its delay is now a true elapsed-time
+  difference, with documented handling of nonexistent/ambiguous local times.
+  (PRs #254, #257.)
+- **Complete works on the panel:** a TypeScript ES2022 `useDefineForClassFields`
+  default emitted native class fields that shadowed Lit's reactive accessors, so
+  the confirm dialog never re-rendered and a tap appeared to do nothing; the
+  panel now opens the confirm and completes. (PR #254.)
+- **Panel polish:** the party-board hint line no longer hides behind the dock
+  (#244); the Quest Log header crest renders with its shield classes (#252); the
+  party-board wordmark is the new compass-rose monogram plus Cinzel Decorative
+  text, replacing the d20 dice (#253); and the quest meta line keeps its `meta`
+  class when not late (#255).
+
+### Upgrade note
+
+The database schema is unchanged at version **9**. After upgrading, set the
+household timezone once so date, overdue and rollover behaviour match the house
+(otherwise it falls back to the API host's local time, which may be UTC):
+
+```
+PATCH /api/v1/admin/settings {"timezone": "America/New_York"}
+```
+
+No runtime dependency is added.
+
+### Requirements
+
+Home Assistant 2024.6.0 or newer. Install through HACS from the
+`Maniacs-Mansion/NestQuest` GitHub mirror (kept current by the Gitea push
+mirror).
+
+## Version 0.9.0 — 2026-09-26
+
+### Scope
+
+Minor release carrying expanded, customisable task icons — Lucide, Font Awesome
+Free and emoji — onto `main`.
+
+- **Namespaced icon keys:** a quest definition's `icon` now accepts
+  `lucide:<kebab-name>`, `fa:<kebab-name>` and `emoji:<grapheme>`. A legacy bare
+  name (e.g. `dog`) is read as `lucide:dog`, so existing rows keep working with
+  no stored-data migration. The strict write validator rejects an unknown
+  namespace, a malformed name, an over-cap or markup-bearing emoji payload, and
+  `javascript:`. (PRs #241, #249.)
+- **Shared icon registry:** one canonical set — the curated Lucide set plus a
+  curated Font Awesome Free solid subset — generates identical,
+  framework-agnostic registry modules for the admin and panel bundles, guarded by
+  a drift test. There is no CDN and no runtime fetch, and only the curated Font
+  Awesome glyphs are shipped. (PR #242.)
+- **Admin PWA picker:** the definition edit sheet offers the Lucide set, the
+  Font Awesome subset and an emoji input; a selection stores the namespaced key
+  and an existing namespaced or legacy icon pre-fills correctly. The definition
+  list renders all three forms with a fallback glyph. Editing a definition whose
+  stored icon is a legacy value no longer resubmits the unchanged icon.
+  (PRs #243, #250.)
+- **Kids' panel:** open quest cards render the definition's icon (Lucide stroked,
+  Font Awesome filled, emoji as text) with the existing star fallback; the sealed
+  card keeps its star/seal glyph. (PR #245.)
+- **Docs and attribution:** ADMIN-SPEC and PANEL-SPEC describe the namespaced
+  model; `THIRD-PARTY-NOTICES.md` records Font Awesome Free (icons CC BY 4.0,
+  fonts SIL OFL 1.1, code MIT) and Lucide (ISC). (PR #246.)
+
+### Upgrade note
+
+The database schema is unchanged at version **9**; no migration or backup step
+is needed beyond the 0.8.0 note. This release adds no runtime dependency — the
+icon path data is embedded in the shipped bundles at build time.
+
+### Requirements
+
+Home Assistant 2024.6.0 or newer. Install through HACS from the
+`Maniacs-Mansion/NestQuest` GitHub mirror (kept current by the Gitea push
+mirror).
+
 ## Version 0.8.0 — 2026-09-25
 
 ### Scope

admin/src/api/definitions.ts

@@ -147,10 +147,36 @@ export async function updateDefinition(
   return readJson<QuestDefinition>(await sendJson(`${DEFINITIONS_PATH}/${id}`, "PATCH", body));
 }
 
+/** `DELETE /quest-definitions/{id}`: exactly one of `deleted` / `retired` is true. */
+export interface DefinitionDeleteResult {
+  definition_id: number;
+  deleted: boolean;
+  retired: boolean;
+  /** The retired (now inactive) definition; null when it was deleted. */
+  definition: QuestDefinition | null;
+}
+
+/**
+ * Delete a task if it has no completion history; otherwise the API retires
+ * (deactivates) it. Retirement preserves the definition row, schedule rule,
+ * assignees, windows and ALL durable completion history. Like any
+ * deactivation it regenerates, so future UNCOMPLETED instances are cleared
+ * (rolling, regenerable rows) and not recreated while inactive; durable
+ * history lives only in the append-only `completion_events`.
+ */
+export async function deleteDefinition(id: number): Promise<DefinitionDeleteResult> {
+  return readJson<DefinitionDeleteResult>(
+    await apiFetch(`${DEFINITIONS_PATH}/${id}`, { method: "DELETE" }),
+  );
+}
+
 export const OCCURRENCES_PREVIEW_PATH = `${DEFINITIONS_PATH}/occurrences-preview`;
 
 export interface OccurrencesPreviewOptions {
-  /** "YYYY-MM-DD"; the API defaults to its host's today. */
+  /**
+   * "YYYY-MM-DD"; the API defaults to the household-local today in the
+   * configured `timezone` (the API host's local time when that is empty).
+   */
   startDate?: string;
   /** 1..50; the API defaults to 10. */
   count?: number;

admin/src/api/settings.ts

@@ -17,6 +17,14 @@ export interface HouseholdSettings {
   afternoon_reminder_enabled: boolean;
   end_of_day_report_enabled: boolean;
   celebration_enabled: boolean;
+  /** IANA zone name (e.g. "America/New_York"); "" means the API host's local time. */
+  timezone: string;
+  /**
+   * True once the admin explicitly chose `timezone` (even ""); false on a
+   * fresh install, where the screen auto-sets the browser's zone. API-only:
+   * never shown in the form.
+   */
+  timezone_configured: boolean;
 }
 
 /** Only the supplied fields are updated; the API answers with all of them. */

admin/src/definitions/DefinitionsTab.css

@@ -569,6 +569,26 @@
   color: #fff;
 }
 
+.defs-save--danger {
+  background: var(--nq-a-danger);
+}
+
+.defs-delete {
+  display: block;
+  width: 100%;
+  margin-top: 10px;
+  padding: 11px 0;
+  border: 1px solid var(--nq-a-danger-bg);
+  border-radius: var(--nq-a-density-radius);
+  background: var(--nq-a-surface);
+  color: var(--nq-a-danger-strong);
+  font-family: inherit;
+  font-size: 13px;
+  font-weight: 700;
+  cursor: pointer;
+}
+
+.defs-delete:disabled,
 .defs-cancel:disabled,
 .defs-save:disabled {
   opacity: 0.6;

admin/src/definitions/DefinitionsTab.test.tsx

@@ -121,6 +121,8 @@ function fakeApi(initial: QuestDefinition[]) {
   const calls: Call[] = [];
   let nextWrite: Response | null = null;
   let preview: PreviewHandler = async () => jsonResponse({ dates: [] });
+  // Definitions with completion history: the API retires these on DELETE.
+  const withHistory = new Set<number>();
   const fetchMock = vi.fn(async (input: RequestInfo | URL, init: RequestInit = {}) => {
     const path = new URL(String(input), "http://localhost").pathname;
     const method = init.method ?? "GET";
@@ -187,6 +189,16 @@ function fakeApi(initial: QuestDefinition[]) {
       );
       return jsonResponse(definitions.find((d) => d.id === id));
     }
+    if (method === "DELETE" && match) {
+      const id = Number(match[1]);
+      if (withHistory.has(id)) {
+        definitions = definitions.map((d) => (d.id === id ? { ...d, is_active: false } : d));
+        const retired = definitions.find((d) => d.id === id);
+        return jsonResponse({ definition_id: id, deleted: false, retired: true, definition: retired });
+      }
+      definitions = definitions.filter((d) => d.id !== id);
+      return jsonResponse({ definition_id: id, deleted: true, retired: false, definition: null });
+    }
     return jsonResponse({ detail: "unexpected" }, 500);
   });
   return {
@@ -203,6 +215,9 @@ function fakeApi(initial: QuestDefinition[]) {
     failNextWrite: (response: Response) => {
       nextWrite = response;
     },
+    markHistory: (id: number) => {
+      withHistory.add(id);
+    },
   };
 }
 
@@ -578,14 +593,15 @@ describe("DefinitionsTab", () => {
     fireEvent.click(screen.getByTestId("definition-10"));
     const s = sheet();
     const title = within(s).getByRole("textbox", { name: "Title" });
-    const save = within(s).getByRole("button", { name: "Save changes" });
+    // The edit sheet's last focusable control is its Delete button.
+    const last = within(s).getByRole("button", { name: "Delete task" });
 
-    save.focus();
+    last.focus();
     fireEvent.keyDown(s, { key: "Tab" });
     expect(document.activeElement).toBe(title);
 
     fireEvent.keyDown(s, { key: "Tab", shiftKey: true });
-    expect(document.activeElement).toBe(save);
+    expect(document.activeElement).toBe(last);
   });
 
   it("Escape does not close the sheet while saving", async () => {
@@ -694,6 +710,73 @@ describe("DefinitionsTab", () => {
     );
   });
 
+  it("the Delete control is only offered for an existing task", async () => {
+    await renderReady();
+    fireEvent.click(screen.getByRole("button", { name: "New" }));
+    expect(within(sheet()).queryByRole("button", { name: "Delete task" })).toBeNull();
+    fireEvent.click(within(sheet()).getByRole("button", { name: "Cancel" }));
+    fireEvent.click(screen.getByTestId("definition-10"));
+    expect(within(sheet()).getByRole("button", { name: "Delete task" })).toBeTruthy();
+  });
+
+  it("Delete asks first, explaining delete-vs-retire; Go back writes nothing", async () => {
+    await renderReady();
+    fireEvent.click(screen.getByTestId("definition-10"));
+    fireEvent.click(within(sheet()).getByRole("button", { name: "Delete task" }));
+    const confirm = screen.getByTestId("delete-confirm");
+    expect(confirm.textContent).toContain("If it has no completion history it is deleted");
+    expect(confirm.textContent).toContain("otherwise it is retired");
+    expect(api.writes()).toHaveLength(0);
+    fireEvent.click(within(confirm).getByRole("button", { name: "Go back" }));
+    expect(screen.queryByTestId("delete-confirm")).toBeNull();
+    expect(api.writes()).toHaveLength(0);
+  });
+
+  it("confirming Delete on a task without history removes its row", async () => {
+    await renderReady();
+    fireEvent.click(screen.getByTestId("definition-10"));
+    fireEvent.click(within(sheet()).getByRole("button", { name: "Delete task" }));
+    fireEvent.click(
+      within(screen.getByTestId("delete-confirm")).getByRole("button", { name: "Delete task" }),
+    );
+    await waitFor(() => expect(screen.queryByTestId("definition-10")).toBeNull());
+    expect(screen.queryByRole("dialog")).toBeNull();
+    expect(api.writes()).toEqual([
+      { method: "DELETE", path: "/api/v1/admin/quest-definitions/10", body: null },
+    ]);
+    expect(screen.getByTestId("definition-11")).toBeTruthy();
+  });
+
+  it("confirming Delete on a task with history shows it retired (inactive)", async () => {
+    await renderReady();
+    api.markHistory(10);
+    fireEvent.click(screen.getByTestId("definition-10"));
+    fireEvent.click(within(sheet()).getByRole("button", { name: "Delete task" }));
+    fireEvent.click(
+      within(screen.getByTestId("delete-confirm")).getByRole("button", { name: "Delete task" }),
+    );
+    await waitFor(() => expect(screen.queryByRole("dialog")).toBeNull());
+    const row = screen.getByTestId("definition-10");
+    expect(row.className).toContain("defs-row--inactive");
+    expect(meta(row)).toContain("· inactive");
+    expect(api.writes().map((c) => c.method)).toEqual(["DELETE"]);
+  });
+
+  it("a failed Delete shows the API's detail and keeps the sheet open", async () => {
+    await renderReady();
+    api.failNextWrite(jsonResponse({ detail: "Quest definition not found" }, 404));
+    fireEvent.click(screen.getByTestId("definition-10"));
+    fireEvent.click(within(sheet()).getByRole("button", { name: "Delete task" }));
+    fireEvent.click(
+      within(screen.getByTestId("delete-confirm")).getByRole("button", { name: "Delete task" }),
+    );
+    expect((await screen.findByTestId("sheet-error")).textContent).toBe(
+      "Quest definition not found",
+    );
+    expect(screen.getByRole("dialog")).toBeTruthy();
+    expect(screen.getByTestId("definition-10")).toBeTruthy();
+  });
+
   it("scroll column carries the 92px bottom padding", async () => {
     await renderReady();
     expect(screen.getByTestId("definitions-scroll").style.paddingBottom).toBe("92px");

admin/src/definitions/DefinitionsTab.tsx

@@ -13,12 +13,14 @@ import { ApiForbiddenError } from "../api/client";
 import {
   ApiRequestError,
   createDefinition,
+  deleteDefinition,
   fetchChildren,
   fetchDefinitions,
   previewOccurrences,
   updateDefinition,
   type AdminChild,
   type DefinitionCreateBody,
+  type DefinitionDeleteResult,
   type DefinitionEditBody,
   type DefinitionRule,
   type QuestDefinition,
@@ -273,6 +275,12 @@ function saveErrorMessage(error: unknown): string {
   return "The task could not be saved. Check your connection and try again.";
 }
 
+function deleteErrorMessage(error: unknown): string {
+  if (error instanceof ApiForbiddenError) return error.message;
+  if (error instanceof ApiRequestError && error.detail) return error.detail;
+  return "The task could not be deleted. Check your connection and try again.";
+}
+
 function toggle<T>(list: T[], value: T): T[] {
   return list.includes(value) ? list.filter((item) => item !== value) : [...list, value];
 }
@@ -449,11 +457,13 @@ function EditSheet({
   activeChildren,
   onCancel,
   onSaved,
+  onDeleted,
 }: {
   target: "new" | QuestDefinition;
   activeChildren: AdminChild[];
   onCancel: () => void;
   onSaved: () => void;
+  onDeleted: (result: DefinitionDeleteResult) => void;
 }) {
   const [draft, setDraft] = useState<Draft>(() =>
     target === "new" ? newDraft(activeChildren) : draftFrom(target, activeChildren),
@@ -473,6 +483,7 @@ function EditSheet({
   const [pickerOpen, setPickerOpen] = useState(false);
   const [saving, setSaving] = useState(false);
   const [confirming, setConfirming] = useState(false);
+  const [confirmingDelete, setConfirmingDelete] = useState(false);
   const [error, setError] = useState<string | null>(null);
   // A ref, not state: two taps in one frame must not both see `saving === false`.
   const inFlight = useRef(false);
@@ -490,8 +501,8 @@ function EditSheet({
   }, []);
 
   useEffect(() => {
-    if (confirming) confirmRef.current?.focus();
-  }, [confirming]);
+    if (confirming || confirmingDelete) confirmRef.current?.focus();
+  }, [confirming, confirmingDelete]);
 
   function onKeyDown(event: ReactKeyboardEvent<HTMLDivElement>) {
     if (event.key === "Escape") {
@@ -559,6 +570,21 @@ function EditSheet({
     }
   }
 
+  async function remove() {
+    if (target === "new" || inFlight.current) return;
+    setConfirmingDelete(false);
+    inFlight.current = true;
+    setSaving(true);
+    setError(null);
+    try {
+      onDeleted(await deleteDefinition(target.id));
+    } catch (err) {
+      setError(deleteErrorMessage(err));
+      inFlight.current = false;
+      setSaving(false);
+    }
+  }
+
   return (
     <div className="defs-sheet-layer">
       <div
@@ -906,15 +932,56 @@ function EditSheet({
               </button>
             </div>
           </div>
-        ) : (
-          <div className="defs-sheet-footer">
-            <button type="button" className="defs-cancel" onClick={onCancel} disabled={saving}>
-              Cancel
-            </button>
-            <button type="button" className="defs-save" onClick={() => save()} disabled={saving}>
-              {saving ? "Saving…" : "Save changes"}
-            </button>
+        ) : confirmingDelete ? (
+          <div
+            className="defs-confirm"
+            role="group"
+            aria-labelledby="defs-delete-confirm-text"
+            data-testid="delete-confirm"
+            ref={confirmRef}
+            tabIndex={-1}
+          >
+            <p id="defs-delete-confirm-text">
+              Delete this task? If it has no completion history it is deleted; otherwise it is
+              retired (deactivated) and its history is kept.
+            </p>
+            <div className="defs-sheet-footer">
+              <button
+                type="button"
+                className="defs-cancel"
+                onClick={() => setConfirmingDelete(false)}
+              >
+                Go back
+              </button>
+              <button type="button" className="defs-save defs-save--danger" onClick={remove}>
+                Delete task
+              </button>
+            </div>
           </div>
+        ) : (
+          <>
+            <div className="defs-sheet-footer">
+              <button type="button" className="defs-cancel" onClick={onCancel} disabled={saving}>
+                Cancel
+              </button>
+              <button type="button" className="defs-save" onClick={() => save()} disabled={saving}>
+                {saving ? "Saving…" : "Save changes"}
+              </button>
+            </div>
+            {target !== "new" ? (
+              <button
+                type="button"
+                className="defs-delete"
+                disabled={saving}
+                onClick={() => {
+                  setError(null);
+                  setConfirmingDelete(true);
+                }}
+              >
+                Delete task
+              </button>
+            ) : null}
+          </>
         )}
       </div>
     </div>
@@ -1038,6 +1105,21 @@ export default function DefinitionsTab() {
             setSheet(null);
             setAttempt((n) => n + 1);
           }}
+          onDeleted={(result) => {
+            setSheet(null);
+            setState((current) =>
+              current.kind !== "ready"
+                ? current
+                : {
+                    ...current,
+                    definitions: result.definition
+                      ? current.definitions.map((d) =>
+                          d.id === result.definition_id ? result.definition! : d,
+                        )
+                      : current.definitions.filter((d) => d.id !== result.definition_id),
+                  },
+            );
+          }}
         />
       ) : null}
     </div>

admin/src/settings/SettingsScreen.test.tsx

@@ -1,3 +1,4 @@
+import { StrictMode } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import App from "../App";
@@ -21,6 +22,8 @@ const DEFAULT_SETTINGS: HouseholdSettings = {
   afternoon_reminder_enabled: false,
   end_of_day_report_enabled: true,
   celebration_enabled: false,
+  timezone: "America/Chicago",
+  timezone_configured: true,
 };
 
 function child(
@@ -370,10 +373,11 @@ describe("SettingsScreen — preferences", () => {
     fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
   }
 
-  it("renders the current value of all ten fields", async () => {
+  it("renders the current value of all eleven settings form fields", async () => {
     const { form } = await renderPreferences();
     expect(field(form, "Planning horizon (days)").value).toBe("14");
     expect(field(form, "Day rollover").value).toBe("03:00");
+    expect(field(form, "Timezone").value).toBe("America/Chicago");
     expect(field(form, "Notify target").value).toBe("notify.family");
     expect(field(form, "Morning summary time").value).toBe("07:00");
     expect(field(form, "Afternoon reminder time").value).toBe("15:30");
@@ -496,6 +500,48 @@ describe("SettingsScreen — preferences", () => {
     expect(writes()).toHaveLength(1);
   });
 
+  it("a changed timezone patches exactly the timezone", async () => {
+    const { form } = await renderPreferences();
+    const input = field(form, "Timezone");
+    expect(input.getAttribute("list")).toBe("settings-timezones");
+    fireEvent.change(input, { target: { value: " Europe/London " } });
+    save(form);
+    await screen.findByText("Preferences saved.");
+    expect(writes()).toEqual([
+      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "Europe/London", timezone_configured: true } },
+    ]);
+    const reloaded = screen.getByRole("form", { name: "Preferences" });
+    expect(field(reloaded, "Timezone").value).toBe("Europe/London");
+  });
+
+  it.each(["New York", "America/New York", "EST5EDT?", "/Chicago"])(
+    "an invalid timezone %j is rejected before any request",
+    async (value) => {
+      const { form } = await renderPreferences();
+      fireEvent.change(field(form, "Timezone"), { target: { value } });
+      save(form);
+      expect(screen.getByTestId("preferences-message").textContent).toBe(
+        "Timezone must be an IANA zone like America/New_York, or UTC.",
+      );
+      expect(field(form, "Timezone").value).toBe(value);
+      expect(writes()).toEqual([]);
+    },
+  );
+
+  it("a 422 on an unknown timezone shows the API detail and keeps the edit", async () => {
+    const { form } = await renderPreferences();
+    fireEvent.change(field(form, "Timezone"), { target: { value: "Mars/Olympus_Mons" } });
+    writeResponse = () =>
+      jsonResponse({ detail: "timezone must be an IANA time zone name such as 'America/New_York'" }, 422);
+    save(form);
+    const message = await screen.findByTestId("preferences-message");
+    expect(message.textContent).toBe(
+      "The preferences could not be saved: timezone must be an IANA time zone name such as 'America/New_York'",
+    );
+    expect(field(form, "Timezone").value).toBe("Mars/Olympus_Mons");
+    expect(field(form, "Timezone").disabled).toBe(false);
+  });
+
   it("a failed load shows the reason and Try again refetches", async () => {
     let fail = true;
     fetchMock.mockImplementation(async (url: string, init?: RequestInit) => {
@@ -512,3 +558,133 @@ describe("SettingsScreen — preferences", () => {
     await screen.findByRole("form", { name: "Preferences" });
   });
 });
+
+describe("SettingsScreen — timezone auto-set", () => {
+  let zoneSpy: ReturnType<typeof vi.spyOn> | null;
+
+  function mockBrowserZone(timeZone: string | undefined) {
+    const real = Intl.DateTimeFormat.prototype.resolvedOptions;
+    zoneSpy = vi
+      .spyOn(Intl.DateTimeFormat.prototype, "resolvedOptions")
+      .mockImplementation(function (this: Intl.DateTimeFormat) {
+        return { ...real.call(this), timeZone } as Intl.ResolvedDateTimeFormatOptions;
+      });
+  }
+
+  beforeEach(() => {
+    sessionStorage.clear();
+    storeTokens({ access_token: "at-123", expires_in: 600 });
+    children = [child(1, "Declan", 1)];
+    // A fresh install: no zone, and the admin never chose one.
+    settings = { ...DEFAULT_SETTINGS, timezone: "", timezone_configured: false };
+    writeResponse = null;
+    zoneSpy = null;
+    fetchMock = vi.fn(async (url: string, init?: RequestInit) => routeFetch(url, init));
+    vi.stubGlobal("fetch", fetchMock);
+  });
+
+  afterEach(() => {
+    cleanup();
+    zoneSpy?.mockRestore();
+    vi.unstubAllGlobals();
+  });
+
+  async function renderForm() {
+    render(<SettingsScreen onClose={vi.fn()} />);
+    await screen.findByTestId("settings-child-1");
+    return screen.findByRole("form", { name: "Preferences" });
+  }
+
+  it("an unset timezone is set once, on load, to the browser's zone and shown", async () => {
+    mockBrowserZone("America/New_York");
+    const form = await renderForm();
+    expect(field(form, "Timezone").value).toBe("America/New_York");
+    expect(writes()).toEqual([
+      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/New_York", timezone_configured: true } },
+    ]);
+    expect(settings.timezone).toBe("America/New_York");
+    expect(settings.timezone_configured).toBe(true);
+
+    // A later save of another field does not re-send the timezone.
+    fireEvent.change(field(form, "Planning horizon (days)"), { target: { value: "21" } });
+    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
+    await screen.findByText("Preferences saved.");
+    expect(writes()).toHaveLength(2);
+    expect(writes()[1].body).toEqual({ horizon_days: 21 });
+  });
+
+  it("StrictMode's doubled effects still auto-set exactly once", async () => {
+    mockBrowserZone("America/New_York");
+    render(
+      <StrictMode>
+        <SettingsScreen onClose={vi.fn()} />
+      </StrictMode>,
+    );
+    const form = await screen.findByRole("form", { name: "Preferences" });
+    expect(field(form, "Timezone").value).toBe("America/New_York");
+    expect(writes()).toEqual([
+      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/New_York", timezone_configured: true } },
+    ]);
+  });
+
+  it("an admin clearing the timezone is not re-set by the browser zone, even after a reopen", async () => {
+    mockBrowserZone("America/New_York");
+    const form = await renderForm();
+    fireEvent.change(field(form, "Timezone"), { target: { value: "" } });
+    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
+    await screen.findByText("Preferences saved.");
+    expect(writes().map((w) => w.body)).toEqual([
+      { timezone: "America/New_York", timezone_configured: true },
+      { timezone: "", timezone_configured: true },
+    ]);
+    const reloaded = screen.getByRole("form", { name: "Preferences" });
+    expect(field(reloaded, "Timezone").value).toBe("");
+
+    // Close and reopen: the screen re-fetches "" but the choice persisted.
+    cleanup();
+    const reopened = await renderForm();
+    expect(field(reopened, "Timezone").value).toBe("");
+    expect(writes()).toHaveLength(2);
+  });
+
+  it("an empty timezone the admin chose is never auto-set", async () => {
+    mockBrowserZone("America/New_York");
+    settings = { ...settings, timezone_configured: true };
+    const form = await renderForm();
+    expect(field(form, "Timezone").value).toBe("");
+    expect(writes()).toEqual([]);
+  });
+
+  it("a set timezone is shown and never overwritten by the browser zone", async () => {
+    mockBrowserZone("America/New_York");
+    settings = { ...DEFAULT_SETTINGS, timezone: "Europe/Dublin", timezone_configured: false };
+    const form = await renderForm();
+    expect(field(form, "Timezone").value).toBe("Europe/Dublin");
+    expect(writes()).toEqual([]);
+  });
+
+  it.each([
+    ["nothing", undefined],
+    ["an empty zone", ""],
+    ["an unknown zone", "Etc/Unknown"],
+    ["a non-IANA zone", "not a zone"],
+  ])("detection returning %s leaves the field empty and sends nothing", async (_case, zone) => {
+    mockBrowserZone(zone);
+    const form = await renderForm();
+    expect(field(form, "Timezone").value).toBe("");
+    expect(screen.queryByTestId("preferences-message")).toBeNull();
+    expect(writes()).toEqual([]);
+  });
+
+  it("a rejected auto-set shows why and leaves the field empty for manual entry", async () => {
+    mockBrowserZone("America/New_York");
+    writeResponse = () => jsonResponse({ detail: "timezone is not known" }, 422);
+    const form = await renderForm();
+    expect(field(form, "Timezone").value).toBe("");
+    expect(field(form, "Timezone").disabled).toBe(false);
+    expect(screen.getByTestId("preferences-message").textContent).toBe(
+      "The timezone could not be set to America/New_York: timezone is not known",
+    );
+    expect(writes()).toHaveLength(1);
+  });
+});

admin/src/settings/SettingsScreen.tsx

@@ -5,7 +5,9 @@
  * household's child profiles. Every write refetches the list.
  *
  * Preferences: the household settings (planning horizon, day rollover,
- * notifications). Save patches only the changed fields.
+ * timezone, notifications). Save patches only the changed fields. A timezone
+ * the admin never chose is set once, on load, to the browser's own zone;
+ * saving the timezone (even clearing it) marks it chosen, so it sticks.
  *
  * One write at a time across both sections.
  */
@@ -252,6 +254,56 @@ const NOTIFICATIONS: { label: string; time: TimeField; toggle: ToggleField }[] =
 
 const HH_MM = /^([01]\d|2[0-3]):[0-5]\d$/;
 
+/** "UTC" or an IANA-looking "Area/Location" (the API checks it resolves). */
+const IANA_ZONE = /^(UTC|[A-Za-z]+(\/[A-Za-z0-9_+-]+)+)$/;
+
+/** The Timezone field's suggestions; any other IANA zone can be typed. */
+export const COMMON_TIMEZONES = [
+  "UTC",
+  "America/New_York",
+  "America/Chicago",
+  "America/Denver",
+  "America/Phoenix",
+  "America/Los_Angeles",
+  "America/Anchorage",
+  "Pacific/Honolulu",
+  "America/Halifax",
+  "America/St_Johns",
+  "America/Toronto",
+  "America/Vancouver",
+  "America/Mexico_City",
+  "America/Sao_Paulo",
+  "Europe/London",
+  "Europe/Dublin",
+  "Europe/Paris",
+  "Europe/Berlin",
+  "Europe/Madrid",
+  "Europe/Rome",
+  "Europe/Athens",
+  "Africa/Johannesburg",
+  "Asia/Dubai",
+  "Asia/Kolkata",
+  "Asia/Singapore",
+  "Asia/Shanghai",
+  "Asia/Tokyo",
+  "Australia/Perth",
+  "Australia/Sydney",
+  "Pacific/Auckland",
+];
+
+/**
+ * The browser's own IANA zone — the location-derived default for an unset
+ * household timezone — or "" when it is missing or not a usable zone name.
+ */
+export function detectTimezone(): string {
+  try {
+    const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    return typeof zone === "string" && zone !== "Etc/Unknown" && IANA_ZONE.test(zone) ? zone : "";
+  } catch {
+    return "";
+  }
+}
+
 /** The form's working copy: the number is text so it can be mid-edit. */
 type PreferencesDraft = Omit<HouseholdSettings, "horizon_days"> & { horizon_days: string };
 
@@ -275,16 +327,24 @@ function buildChanges(draft: PreferencesDraft, loaded: HouseholdSettings): Setti
   for (const [key, label] of times) {
     if (!HH_MM.test(draft[key])) return `${label} must be a time like 07:30.`;
   }
+  const timezone = draft.timezone.trim();
+  if (timezone && !IANA_ZONE.test(timezone)) {
+    return "Timezone must be an IANA zone like America/New_York, or UTC.";
+  }
 
   const next: HouseholdSettings = {
     ...draft,
     horizon_days: horizonDays,
     notify_target: draft.notify_target.trim(),
+    timezone,
   };
   const changes: SettingsChanges = {};
   for (const key of Object.keys(loaded) as (keyof HouseholdSettings)[]) {
     if (next[key] !== loaded[key]) (changes as Record<string, unknown>)[key] = next[key];
   }
+  // An explicit choice — including "" (the API host's local time) — must
+  // persist, or the next load would auto-set the browser's zone over it.
+  if ("timezone" in changes) changes.timezone_configured = true;
   if (Object.keys(changes).length === 0) return "No changes to save.";
   return changes;
 }
@@ -357,6 +417,25 @@ function PreferencesForm({
         />
       </label>
       {timeInput("day_rollover_time", "Day rollover")}
+      <label className="settings-field">
+        <span className="settings-label">Timezone</span>
+        <input
+          className="settings-input"
+          type="text"
+          list="settings-timezones"
+          placeholder="Host local time"
+          autoComplete="off"
+          spellCheck={false}
+          value={draft.timezone}
+          disabled={disabled}
+          onChange={(event) => update({ timezone: event.target.value })}
+        />
+      </label>
+      <datalist id="settings-timezones">
+        {COMMON_TIMEZONES.map((zone) => (
+          <option key={zone} value={zone} />
+        ))}
+      </datalist>
       <label className="settings-field">
         <span className="settings-label">Notify target</span>
         <input
@@ -495,6 +574,8 @@ export default function SettingsScreen({ onClose }: { onClose: () => void }) {
   } | null>(null);
   // A ref, not state: two taps in one frame must not both see `busy === null`.
   const inFlight = useRef(false);
+  // The never-chosen-timezone auto-set fires at most once per screen.
+  const timezoneAutoSet = useRef(false);
   const screenRef = useRef<HTMLDivElement>(null);
   const titleRef = useRef<HTMLHeadingElement>(null);
   const addRef = useRef<HTMLButtonElement>(null);
@@ -539,8 +620,29 @@ export default function SettingsScreen({ onClose }: { onClose: () => void }) {
     let cancelled = false;
     setPreferences({ kind: "loading" });
     fetchSettings()
-      .then((settings) => {
-        if (!cancelled) setPreferences({ kind: "ready", settings });
+      .then(async (settings) => {
+        if (cancelled) return;
+        // Never chosen: adopt the browser's zone before the form shows, so
+        // nothing the admin enters can be overwritten by it. An empty zone the
+        // admin chose (timezone_configured) is left alone.
+        const unchosen = settings.timezone === "" && !settings.timezone_configured;
+        const detected = unchosen ? detectTimezone() : "";
+        if (!detected || timezoneAutoSet.current) {
+          setPreferences({ kind: "ready", settings });
+          return;
+        }
+        timezoneAutoSet.current = true;
+        try {
+          const saved = await updateSettings({ timezone: detected, timezone_configured: true });
+          if (!cancelled) setPreferences({ kind: "ready", settings: saved });
+        } catch (error) {
+          if (cancelled) return;
+          setPreferences({ kind: "ready", settings });
+          setPreferencesMessage({
+            kind: "error",
+            text: errorMessage(error, `The timezone could not be set to ${detected}`),
+          });
+        }
       })
       .catch((error: unknown) => {
         if (cancelled) return;

api/routes_admin.py

@@ -165,10 +165,13 @@ integration's Home-Assistant config-entry options remain a temporary,
 SEPARATE source until Feature 18 wires the client to the API — the two
 are deliberately not unified here:
 
-- ``GET /settings`` returns the current effective settings: all ten
+- ``GET /settings`` returns the current effective settings: all twelve
   documented fields (the rolling horizon, the day rollover time, the
-  notify target, the three notification times and the four enable
-  toggles) — the defaults on a fresh database.
+  notify target, the three notification times, the four enable
+  toggles, the ``timezone`` — the IANA household zone the
+  household-local dates derive from, empty meaning host local — and
+  ``timezone_configured``, whether the admin explicitly chose that
+  zone) — the defaults on a fresh database.
 - ``PATCH /settings`` updates ONLY the supplied fields: the body is a
   JSON object of settings field names to new values, passed STRAIGHT
   to :func:`nestquest_core.settings_store.update_settings` — the
@@ -184,18 +187,38 @@ The missed-sweep trigger (task 058c7b69) follows the same pattern over
 :mod:`nestquest_core.sweep` — the HA-free sweep policy the
 integration's rollover listener shares:
 
-- ``POST /missed-sweep`` runs the sweep for the API host's local
-  ``today`` (ONE :func:`_local_now` clock read threaded into the core
-  call) and publishes each returned ``(event_type, payload)`` pair
-  DIRECTLY on the app's ONE transition publisher — the sweep-built
-  payload, never re-fetched (the core commits its watermark before
-  returning, so a failed re-fetch after it would lose the missed event
-  forever), the same publish-what-the-core-built shape
-  api/scheduler.py uses.  The watermark rule
-  (a same-day rerun announces nothing, a post-downtime run sweeps the
-  accumulated window once), the no-completion-event rule and the
-  read-only-over-the-domain-tables guarantee all live in the core; the
-  response reports how many transitions were published.
+- ``POST /missed-sweep`` runs the sweep for the household-local
+  ``today`` (ONE :func:`_local_now` clock read re-expressed in the
+  configured household ``timezone`` — empty falls back to host local —
+  threaded into the core call) and publishes each returned
+  ``(event_type, payload)`` pair DIRECTLY on the app's ONE transition
+  publisher — the sweep-built payload, never re-fetched (the core
+  commits its watermark before returning, so a failed re-fetch after it
+  would lose the missed event forever), the same
+  publish-what-the-core-built shape api/scheduler.py uses.  The
+  watermark rule (a same-day rerun announces nothing, a post-downtime
+  run sweeps the accumulated window once), the no-completion-event rule
+  and the read-only-over-the-domain-tables guarantee all live in the
+  core; the response reports how many transitions were published.
+
+The quest-definition DELETE route (task 3efb07b4) is the hybrid admin
+delete (owner decision 2026-09-26: "delete if there's no history,
+retire/deactivate if there is"):
+
+- ``DELETE /quest-definitions/{definition_id}`` is a thin adapter over
+  :func:`nestquest_core.quest_definitions.delete_quest_definition`.  A
+  definition with NO completion event on any instance is hard-deleted
+  (instances, assignees, windows, the row and its unreferenced rule, in
+  one core transaction); one WITH history is retired by deactivation.
+  Retirement preserves the definition row, schedule rule, assignees,
+  windows and ALL durable completion history; like any deactivation it
+  regenerates, so future UNCOMPLETED instances are cleared (rolling,
+  regenerable rows) and none are recreated while the definition is
+  inactive — the retired task stops generating and shows no open work.
+  Durable instance history lives only in the append-only
+  ``completion_events``.  The response reports which happened
+  (``deleted`` / ``retired``) and carries the retired definition, or
+  ``null`` when deleted.  An unknown id is 404.
 
 The occurrence-preview route (task 5f843564) lets the admin PWA's
 Definitions edit sheet show the next dates a rule fires on WITHOUT
@@ -205,9 +228,10 @@ reimplementing the recurrence rules client-side:
   ``rule`` object create/edit take (:class:`AdminRuleRequest`, built
   through the SAME :func:`_rule_from_request` / core ``from_dict``
   validation, so a rejected rule is 422 exactly as on create), an
-  optional ``start_date`` (default: the API host's local ``today``,
-  ONE :func:`_local_now` clock read) and an optional ``count`` (1..50,
-  default 10).  The dates come from ONE
+  optional ``start_date`` (default: the household-local ``today`` —
+  ONE :func:`_local_now` clock read re-expressed in the configured
+  household ``timezone``, empty falling back to host local) and an
+  optional ``count`` (1..50, default 10).  The dates come from ONE
   :func:`nestquest_core.recurrence.occurrences_between` call — the
   same engine the materializer walks — so the preview can only agree
   with what would be generated.  The scan is BOUNDED server-side: the
@@ -449,6 +473,19 @@ class AdminQuestDefinitionListResponse(BaseModel):
     definitions: list[AdminQuestDefinitionResponse]
 
 
+class AdminQuestDefinitionDeleteResponse(BaseModel):
+    """The body ``DELETE /api/v1/admin/quest-definitions/{id}`` answers.
+
+    Exactly one of ``deleted`` / ``retired`` is true.  ``definition`` is
+    the retired (now inactive) definition, or null when it was deleted.
+    """
+
+    definition_id: int
+    deleted: bool
+    retired: bool
+    definition: AdminQuestDefinitionResponse | None
+
+
 class AdminChildCreateRequest(BaseModel):
     """The body of ``POST /api/v1/admin/children``.
 
@@ -532,9 +569,10 @@ class AdminOccurrencesPreviewRequest(BaseModel):
 
     ``rule`` is the SAME object create/edit take.  ``start_date`` is an
     optional strict ``YYYY-MM-DD`` (validated by the core; default the
-    API host's today).  ``count`` is a strict JSON integer in
-    1..``_PREVIEW_MAX_COUNT`` — anything else is 422 before any handler
-    code runs.
+    household-local today in the configured ``timezone``, empty falling
+    back to the API host's local time).  ``count`` is a strict JSON
+    integer in 1..``_PREVIEW_MAX_COUNT`` — anything else is 422 before
+    any handler code runs.
     """
 
     rule: AdminRuleRequest
@@ -868,7 +906,7 @@ class AdminSettingsResponse(BaseModel):
     """The effective settings as the admin plane serializes them.
 
     Mirrors the core :class:`~nestquest_core.settings.NestQuestSettings`
-    — all TEN documented fields, resolved (every absent stored field
+    — all TWELVE documented fields, resolved (every absent stored field
     already fell back to its default in the core).  The same shape both
     the GET and the PATCH route answer with.
     """
@@ -883,6 +921,12 @@ class AdminSettingsResponse(BaseModel):
     afternoon_reminder_enabled: bool
     end_of_day_report_enabled: bool
     celebration_enabled: bool
+    #: The household IANA time zone the API reads its clock in; ``""``
+    #: means the API host's local time.
+    timezone: str
+    #: Whether the admin explicitly chose ``timezone`` (even ``""``);
+    #: ``False`` lets the admin UI auto-set the browser's zone once.
+    timezone_configured: bool
 
 
 class AdminMissedSweepResponse(BaseModel):
@@ -1179,6 +1223,26 @@ def _local_now() -> datetime.datetime:
     return datetime.datetime.now().astimezone()
 
 
+async def _household_clock(
+    database: object,
+) -> tuple[object, datetime.datetime]:
+    """Return the stored settings and ONE household-local clock read.
+
+    The API host may run UTC while the household does not, so the one
+    :func:`_local_now` read is re-expressed in the stored settings'
+    ``timezone`` (:meth:`NestQuestSettings.household_now`); an unset
+    zone keeps the host's local time.
+    """
+    settings = await core_settings_store.load_settings(database)
+    return settings, settings.household_now(_local_now())
+
+
+async def _household_today(database: object) -> datetime.date:
+    """Return the household-local date of ONE :func:`_household_clock` read."""
+    _settings, now = await _household_clock(database)
+    return now.date()
+
+
 def _rule_from_request(rule: AdminRuleRequest) -> core_recurrence.ScheduleRule:
     """Build the core ScheduleRule from the request's ``rule`` object.
 
@@ -1497,7 +1561,7 @@ async def admin_create_quest_definition(
     response_model=AdminOccurrencesPreviewResponse,
 )
 async def admin_preview_occurrences(
-    body: AdminOccurrencesPreviewRequest,
+    body: AdminOccurrencesPreviewRequest, request: Request
 ) -> AdminOccurrencesPreviewResponse:
     """Return the first ``count`` dates the supplied rule fires on.
 
@@ -1510,12 +1574,15 @@ async def admin_preview_occurrences(
     call over the bounded window ``[start_date, start_date + 366
     days]`` — ``start_date`` defaulting to ONE :func:`_local_now` clock
     read — truncated to ``count``.  Every core ``ValueError`` is 422
-    (:func:`_raise_preview_error`).  No database access.
+    (:func:`_raise_preview_error`).  The only database access is the
+    settings read behind the household clock.
     """
     start_date = (
         body.start_date
         if body.start_date is not None
-        else _local_now().date().isoformat()
+        else (
+            await _household_today(request.app.state.db.database)
+        ).isoformat()
     )
     try:
         rule = _rule_from_request(body.rule)
@@ -1580,16 +1647,16 @@ async def admin_set_quest_definition_active(
     body: AdminQuestDefinitionActiveRequest,
     request: Request,
 ) -> AdminQuestDefinitionResponse:
-    """Deactivate (or reactivate) a definition; it is NEVER deleted.
+    """Deactivate (or reactivate) a definition; it is never deleted here.
 
     Requires a valid admin JWT (the router's shared
     :func:`~api.auth.require_admin` dependency — the ONE check; this
     handler performs NO auth of its own).  Thin adapter: ``is_active``
     goes straight to
     :func:`nestquest_core.quest_definitions.set_quest_definition_active`
-    — deactivation is the only removal path (the row, rule, assignees
-    and windows all survive, so completion history keeps its
-    references).  An unknown definition id is mapped to 404
+    — the row, rule, assignees and windows all survive, so completion
+    history keeps its references (the hybrid DELETE route is the only
+    hard-delete path, and only for a definition without history).  An unknown definition id is mapped to 404
     (:func:`_raise_quest_definition_error`); the body model already
     makes the core's real-bool check unreachable from this route.
     """
@@ -1603,6 +1670,44 @@ async def admin_set_quest_definition_active(
     return _quest_definition_response(bundle)
 
 
+@router.delete(
+    "/quest-definitions/{definition_id}",
+    summary="Delete a quest definition, or retire it if it has history",
+    response_model=AdminQuestDefinitionDeleteResponse,
+)
+async def admin_delete_quest_definition(
+    definition_id: int, request: Request
+) -> AdminQuestDefinitionDeleteResponse:
+    """Hard-delete a history-free definition; retire one with history.
+
+    Requires a valid admin JWT (the router's shared
+    :func:`~api.auth.require_admin` dependency — the ONE check; this
+    handler performs NO auth of its own).  Thin adapter: the id goes
+    straight to
+    :func:`nestquest_core.quest_definitions.delete_quest_definition`,
+    which decides delete-vs-retire atomically in the core.  An unknown
+    definition id is mapped to 404
+    (:func:`_raise_quest_definition_error`).
+    """
+    state: DatabaseState = request.app.state.db
+    try:
+        result = await core_quest_definitions.delete_quest_definition(
+            state.database, definition_id
+        )
+    except ValueError as error:
+        _raise_quest_definition_error(error)
+    return AdminQuestDefinitionDeleteResponse(
+        definition_id=result.definition_id,
+        deleted=result.deleted,
+        retired=result.retired,
+        definition=(
+            None
+            if result.definition is None
+            else _quest_definition_response(result.definition)
+        ),
+    )
+
+
 @router.get(
     "/children/{child_id}/presence-patterns",
     summary="List a child's repeating presence patterns",
@@ -1840,7 +1945,7 @@ async def admin_presence_override_consequence(
                 body.start_date,
                 body.end_date,
                 body.is_present,
-                today=_local_now().date(),
+                today=await _household_today(state.database),
             )
         )
     except ValueError as error:
@@ -1927,7 +2032,7 @@ async def admin_uncomplete_instance(
     """
     state: DatabaseState = request.app.state.db
     database = state.database
-    now = _local_now()
+    _settings, now = await _household_clock(database)
     sub = claims.get("sub")
     try:
         result = await core_completion.uncomplete_instance(
@@ -1993,7 +2098,7 @@ async def admin_regenerate(
     """
     state: DatabaseState = request.app.state.db
     database = state.database
-    today = _local_now().date()
+    today = await _household_today(state.database)
 
     if body.scope == "household":
         end_date = today + datetime.timedelta(
@@ -2078,7 +2183,7 @@ def _settings_response(
     """Serialize one core NestQuestSettings into the documented payload.
 
     Explicit field-by-field (not ``dataclasses.asdict``) so the payload
-    stays pinned to the ten documented fields even if the core
+    stays pinned to the twelve documented fields even if the core
     dataclass later grows another one.
     """
     return AdminSettingsResponse(
@@ -2092,6 +2197,8 @@ def _settings_response(
         afternoon_reminder_enabled=settings.afternoon_reminder_enabled,
         end_of_day_report_enabled=settings.end_of_day_report_enabled,
         celebration_enabled=settings.celebration_enabled,
+        timezone=settings.timezone,
+        timezone_configured=settings.timezone_configured,
     )
 
 
@@ -2123,7 +2230,7 @@ async def admin_history_query(
     ``ValueError`` is 422 (:func:`_raise_history_error`).
     """
     state: DatabaseState = request.app.state.db
-    today = _local_now().date()
+    today = await _household_today(state.database)
     try:
         rows = await core_history.query_history(
             state.database, filter, start, end, today=today
@@ -2166,7 +2273,7 @@ async def admin_history_csv(
     JSON route's (:func:`_raise_history_error`).
     """
     state: DatabaseState = request.app.state.db
-    today = _local_now().date()
+    today = await _household_today(state.database)
     try:
         csv_text = await core_history.export_history_csv(
             state.database, filter, start, end, today=today
@@ -2189,7 +2296,7 @@ async def admin_history_csv(
     response_model=AdminSettingsResponse,
 )
 async def admin_get_settings(request: Request) -> AdminSettingsResponse:
-    """Return the current effective settings (all ten documented fields).
+    """Return the current effective settings (all twelve documented fields).
 
     Requires a valid admin JWT (the router's shared
     :func:`~api.auth.require_admin` dependency — the ONE check; this
@@ -2254,7 +2361,9 @@ async def admin_run_missed_sweep(
     handler performs NO auth of its own).  Thin adapter over the SAME
     HA-free sweep policy the integration's rollover listener runs
     (:mod:`nestquest_core.sweep`): ONE timezone-aware clock read
-    (:func:`_local_now`) pins the API host's local ``today``, and ONE
+    (:func:`_local_now`, re-expressed in the configured household
+    ``timezone``; empty falls back to host local) pins the
+    household-local ``today``, and ONE
     :func:`nestquest_core.sweep.run_missed_sweep` call does everything
     else — the past-due open-instance query, the documented payload
     build and the watermark update (a same-day rerun is an empty
@@ -2281,7 +2390,7 @@ async def admin_run_missed_sweep(
     """
     state: DatabaseState = request.app.state.db
     database = state.database
-    today = _local_now().date()
+    today = await _household_today(state.database)
     try:
         events = await core_sweep.run_missed_sweep(database, today=today)
     except ValueError as error:
@@ -2310,8 +2419,9 @@ async def admin_snapshot(request: Request) -> AdminSnapshotResponse:
     :class:`AdminSnapshotResponse`.
     """
     state: DatabaseState = request.app.state.db
+    settings, now = await _household_clock(state.database)
     snapshot = await core_snapshot.build_snapshot(
-        state.database, core_settings.NestQuestSettings(), _local_now()
+        state.database, settings, now
     )
     return AdminSnapshotResponse(
         today_iso=snapshot.today_iso,

api/routes_panel.py

@@ -8,9 +8,10 @@ this router inherits the check).
 
 The snapshot route is a thin adapter over the bundled core: it performs
 NO business logic.  It reads the live database off ``app.state.db``,
-resolves ONE timezone-aware ``now`` (the API host's local time — the
-API is the household's "local" host now that the domain no longer lives
-inside Home Assistant), calls the pure
+resolves ONE timezone-aware ``now`` (the host clock re-expressed in the
+household ``timezone`` — the API host may run UTC while the household
+does not; until the admin chooses a zone it is the Home Assistant zone
+the integration reports in :data:`PANEL_TIMEZONE_HEADER`), calls the pure
 :func:`nestquest_core.snapshot.build_snapshot`, shapes each child's
 instances through :func:`nestquest_core.snapshot.instance_payload` with
 ``include_missed=False`` (D-009: missed instances are OMITTED from the
@@ -53,6 +54,7 @@ from __future__ import annotations
 
 import datetime
 import importlib
+import logging
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import StreamingResponse
@@ -62,13 +64,20 @@ from api.database import DatabaseState
 from api.dependencies import require_panel_token
 from api.nestquest_core import (
     core_completion,
+    core_const,
     core_events,
-    core_settings,
+    core_settings_store,
     core_snapshot,
 )
 from api import transitions as api_transitions
 from api.sse import transition_event_stream
 
+LOGGER = logging.getLogger(__name__)
+
+#: The request header the integration reports Home Assistant's
+#: configured IANA ``time_zone`` in.
+PANEL_TIMEZONE_HEADER = core_const.PANEL_TIMEZONE_HEADER
+
 #: The instance DAO, imported on the app's core copy for the
 #: child-mismatch guard on the complete route.
 _dao_instances = importlib.import_module("nestquest_core.dao_instances")
@@ -178,6 +187,46 @@ def _local_now() -> datetime.datetime:
     return datetime.datetime.now().astimezone()
 
 
+async def _household_clock(
+    database: object, request: Request
+) -> tuple[object, datetime.datetime]:
+    """Return the settings and ONE household-local clock read.
+
+    The API host may run UTC while the household does not, so the one
+    :func:`_local_now` read is re-expressed in the settings' ``timezone``
+    (:meth:`NestQuestSettings.household_now`).  The integration reports
+    Home Assistant's ``time_zone`` in :data:`PANEL_TIMEZONE_HEADER`;
+    until the admin chooses a zone it is adopted and persisted
+    (:func:`nestquest_core.settings_store.adopt_reported_timezone`), so
+    the admin plane follows it too, and the already-sleeping missed-sweep
+    scheduler is told (:meth:`MissedSweepScheduler.settings_changed`) so
+    it re-plans for the household rollover — under the scheduler's
+    ``settings_lock``, so the adoption never lands between its settings
+    check and its sweep.  An invalid
+    reported zone is logged and ignored — the panel keeps serving on
+    the stored settings.
+    """
+    reported = request.headers.get(PANEL_TIMEZONE_HEADER, "").strip()
+    if reported:
+        scheduler = request.app.state.sweep_scheduler
+        try:
+            async with scheduler.settings_lock:
+                settings = await core_settings_store.adopt_reported_timezone(
+                    database, reported
+                )
+                scheduler.settings_changed(settings)
+        except ValueError:
+            LOGGER.warning(
+                "Ignoring invalid %s header value %r",
+                PANEL_TIMEZONE_HEADER,
+                reported,
+            )
+            settings = await core_settings_store.load_settings(database)
+    else:
+        settings = await core_settings_store.load_settings(database)
+    return settings, settings.household_now(_local_now())
+
+
 @router.get(
     "/snapshot",
     summary="Today's household snapshot",
@@ -196,8 +245,9 @@ async def panel_snapshot(request: Request) -> PanelSnapshotResponse:
     :class:`PanelSnapshotResponse`.
     """
     state: DatabaseState = request.app.state.db
+    settings, now = await _household_clock(state.database, request)
     snapshot = await core_snapshot.build_snapshot(
-        state.database, core_settings.NestQuestSettings(), _local_now()
+        state.database, settings, now
     )
     return PanelSnapshotResponse(
         today_iso=snapshot.today_iso,
@@ -282,7 +332,7 @@ async def panel_complete_instance(
             detail="Quest instance not found for this child",
         )
 
-    now = _local_now()
+    _settings, now = await _household_clock(database, request)
     try:
         result = await core_completion.complete_instance(
             database,

api/scheduler.py

@@ -8,10 +8,32 @@ configured ``day_rollover_time`` — read fresh from the settings store
 at the top of EVERY cycle, so an admin's settings change applies on
 the next scheduling decision without a restart — then runs the
 HA-free core's :func:`nestquest_core.sweep.run_missed_sweep` for the
-API host's local date and publishes each returned
+household-local date (the stored ``timezone`` setting; the API host's
+local date when unset) and publishes each returned
 ``nestquest_quest_missed`` event on the app's ONE transition publisher
 (the same SSE stream every route publishes through).
 
+A household zone adopted from Home Assistant while the loop is asleep
+must not leave it waiting for the OLD zone's rollover (a UTC host would
+otherwise sweep at UTC midnight — 20:00 in New York — marking quests
+missed hours early).  :meth:`MissedSweepScheduler.settings_changed`
+wakes the sleeping loop to re-plan whenever the zone or rollover time
+it planned with has moved, and the loop re-reads the settings before
+sweeping and re-plans instead if they no longer match its plan.
+
+Guarantee: no sweep runs for a plan a committed adoption has replaced.
+An adopting writer holds :attr:`MissedSweepScheduler.settings_lock`
+across its write AND its :meth:`~MissedSweepScheduler.settings_changed`
+call; the loop holds the same lock across its plan read (read, record
+the plan, clear the wake flag) and across the pre-sweep re-read plus
+the sweep itself.  So an adoption commits either before a plan read
+(which then sees it), after one (``settings_changed`` compares against
+that exact plan and wakes the wait), or after the sweep — never between
+a read and what the loop does with it.  The lock is never held across
+the wait, and the loop takes nothing else before it, so a waiting
+panel request cannot deadlock: it is delayed at most by one settings
+read or one sweep.
+
 All sweep policy lives in the core (the watermark, the
 ``[watermark, today)`` window, the no-completion-event rule): this
 scheduler only decides WHEN.  A same-night rerun — e.g. two workers,
@@ -43,19 +65,56 @@ LOGGER = logging.getLogger(__name__)
 _RETRY_BACKOFF_SECONDS = 60.0
 
 
-def _delay_seconds(target: datetime.time, now: datetime.datetime) -> float:
-    """Seconds from ``now`` until the next occurrence of ``target``.
+#: Upper bound on the minute-by-minute search past a nonexistent wall
+#: time; real DST gaps are an hour, the largest ever skipped a day.
+_MAX_GAP_MINUTES = 2 * 24 * 60
 
-    ``target`` is a plain ``HH:MM`` time of day: the next wall-clock
-    occurrence strictly AFTER ``now`` (an equal time schedules for
-    tomorrow, so the just-run sweep is never instantly re-run).
+
+def _resolve_wall_time(
+    day: datetime.date, target: datetime.time, zone: datetime.tzinfo
+) -> datetime.datetime:
+    """The aware instant ``target`` (``HH:MM``) names on ``day`` in ``zone``.
+
+    A nonexistent wall time (inside a spring-forward gap) resolves to
+    the first valid wall minute at/after it — the gap's end, e.g. 02:30
+    on a 02:00→03:00 day becomes 03:00.  An ambiguous wall time (the
+    repeated fall-back hour) resolves to its FIRST occurrence
+    (``fold=0``).
     """
-    scheduled = now.replace(
-        hour=target.hour, minute=target.minute, second=0, microsecond=0
+    wall = datetime.datetime.combine(
+        day, datetime.time(target.hour, target.minute)
     )
-    if scheduled <= now:
-        scheduled += datetime.timedelta(days=1)
-    return (scheduled - now).total_seconds()
+    for _ in range(_MAX_GAP_MINUTES):
+        candidate = wall.replace(tzinfo=zone)
+        round_trip = candidate.astimezone(datetime.timezone.utc).astimezone(
+            zone
+        )
+        if round_trip.replace(tzinfo=None) == wall:
+            return candidate
+        wall += datetime.timedelta(minutes=1)
+    raise ValueError(f"no valid wall time at/after {target} on {day}")
+
+
+def _delay_seconds(target: datetime.time, now: datetime.datetime) -> float:
+    """Real seconds from ``now`` until the next occurrence of ``target``.
+
+    ``target`` is a plain ``HH:MM`` household time of day, resolved in
+    ``now``'s zone by :func:`_resolve_wall_time` (nonexistent → first
+    valid instant after the gap; ambiguous → first occurrence).  The
+    result is the next such instant strictly AFTER ``now`` (an equal
+    time schedules for tomorrow, so the just-run sweep is never
+    instantly re-run).  Both instants are compared and subtracted in
+    UTC: same-``tzinfo`` aware arithmetic is wall-clock arithmetic and
+    would be an hour off across a DST transition.
+    """
+    now_utc = now.astimezone(datetime.timezone.utc)
+    day = now.date()
+    while True:
+        scheduled = _resolve_wall_time(day, target, now.tzinfo)
+        scheduled_utc = scheduled.astimezone(datetime.timezone.utc)
+        if scheduled_utc > now_utc:
+            return (scheduled_utc - now_utc).total_seconds()
+        day += datetime.timedelta(days=1)
 
 
 class MissedSweepScheduler:
@@ -86,6 +145,14 @@ class MissedSweepScheduler:
         )
         self._sleep = sleep if sleep is not None else asyncio.sleep
         self._task: asyncio.Task | None = None
+        #: ``(timezone, day_rollover_time)`` the pending sweep was
+        #: planned with; ``None`` until the first plan.
+        self._planned: tuple[str, str] | None = None
+        #: Set by :meth:`settings_changed` to cut the current wait short.
+        self._wake = asyncio.Event()
+        #: Serialises settings adoption with planning and sweeping (see
+        #: the module docstring's guarantee).
+        self.settings_lock = asyncio.Lock()
 
     def start(self) -> None:
         """Start the background loop (idempotent: a running one stays)."""
@@ -104,6 +171,20 @@ class MissedSweepScheduler:
                 pass
             self._task = None
 
+    def settings_changed(self, settings: object) -> None:
+        """Re-plan the pending sweep if ``settings`` moved its rollover.
+
+        Called with freshly stored settings (e.g. a zone adopted from
+        Home Assistant), with :attr:`settings_lock` held across the write
+        and this call so the comparison is against the loop's current
+        plan, never a read still in flight.  A differing ``timezone`` or
+        ``day_rollover_time`` wakes the sleeping loop, which reloads the
+        settings and schedules the next sweep for the new household
+        rollover; an unchanged plan is left sleeping.
+        """
+        if (settings.timezone, settings.day_rollover_time) != self._planned:
+            self._wake.set()
+
     @property
     def running(self) -> bool:
         """Whether the background loop task is alive."""
@@ -113,12 +194,18 @@ class MissedSweepScheduler:
         """Schedule → sweep → repeat, forever (until cancelled)."""
         while True:
             try:
-                settings = await core_settings_store.load_settings(
-                    self._database
-                )
-                rollover = datetime.time.fromisoformat(
-                    settings.day_rollover_time
-                )
+                # Under the lock no adoption can commit between this read
+                # and the recorded plan, so any later one wakes the wait.
+                async with self.settings_lock:
+                    self._wake.clear()
+                    settings = await core_settings_store.load_settings(
+                        self._database
+                    )
+                    rollover = datetime.time.fromisoformat(
+                        settings.day_rollover_time
+                    )
+                    plan = (settings.timezone, settings.day_rollover_time)
+                    self._planned = plan
             except Exception:
                 # Not silent: the failure is logged and retried after
                 # the backoff, so one bad settings document or a
@@ -130,19 +217,40 @@ class MissedSweepScheduler:
                 )
                 await self._sleep(_RETRY_BACKOFF_SECONDS)
                 continue
-            delay = _delay_seconds(rollover, self._clock())
+            # The host may run UTC: the rollover is a household wall-clock
+            # time, so the clock read is re-expressed in the stored zone.
+            delay = _delay_seconds(
+                rollover, settings.household_now(self._clock())
+            )
             LOGGER.info(
                 "NestQuest missed sweep scheduled for %s (%.0fs from now)",
                 settings.day_rollover_time,
                 delay,
             )
-            await self._sleep(delay)
             try:
-                await self._run_once(self._clock().date())
+                if not await self._sleep_unless_woken(delay):
+                    continue
+                # Re-read before sweeping: a zone or rollover change the
+                # wake-up missed means this is not the household's
+                # rollover any more, so re-plan instead of sweeping.  The
+                # lock keeps an adoption from committing between this
+                # check and the sweep.
+                async with self.settings_lock:
+                    settings = await core_settings_store.load_settings(
+                        self._database
+                    )
+                    if (
+                        settings.timezone,
+                        settings.day_rollover_time,
+                    ) != plan:
+                        continue
+                    await self._run_once(
+                        settings.household_now(self._clock()).date()
+                    )
             except Exception:
-                # Not silent either: the sweep error is logged and the
-                # loop backs off before the next cycle, whose watermark
-                # re-read makes an already-swept day a no-op.
+                # Not silent either: a failed wait or sweep is logged and
+                # the loop backs off before the next cycle, whose
+                # watermark re-read makes an already-swept day a no-op.
                 LOGGER.exception(
                     "NestQuest scheduled missed sweep failed; retrying in "
                     "%gs",
@@ -150,6 +258,29 @@ class MissedSweepScheduler:
                 )
                 await self._sleep(_RETRY_BACKOFF_SECONDS)
 
+    async def _sleep_unless_woken(self, delay: float) -> bool:
+        """Wait ``delay``; ``False`` if :meth:`settings_changed` woke it.
+
+        Both children are cancelled AND awaited before returning (or
+        before a cancellation propagates), so none outlives :meth:`stop`;
+        a sleep that failed re-raises its exception here for the loop's
+        retry policy.
+        """
+        sleeper = asyncio.ensure_future(self._sleep(delay))
+        waker = asyncio.ensure_future(self._wake.wait())
+        try:
+            await asyncio.wait(
+                {sleeper, waker}, return_when=asyncio.FIRST_COMPLETED
+            )
+        finally:
+            slept = sleeper.done()
+            sleeper.cancel()
+            waker.cancel()
+            await asyncio.gather(sleeper, waker, return_exceptions=True)
+        if slept:
+            sleeper.result()
+        return slept
+
     async def _run_once(self, today: datetime.date) -> None:
         """Run ONE sweep for ``today`` and publish what it built.
 

custom_components/nestquest/api_client.py

@@ -6,6 +6,9 @@ speaks the API's panel plane — ``GET /api/v1/panel/snapshot`` (today's
 household snapshot) and ``POST /api/v1/panel/instances/{id}/complete``
 (completion as the tapped child profile) — authenticated with the
 static panel service token as a Bearer credential on every request.
+Every request also reports Home Assistant's configured ``time_zone`` in
+the ``X-NestQuest-Timezone`` header, so the API (which may run UTC)
+reads the household's clock until the admin chooses a zone there.
 
 Transport-injected by construction: the constructor takes the base URL,
 the panel token, and the HTTP session to use.  The session speaks the
@@ -54,6 +57,7 @@ from .const import (
     CONF_PANEL_TOKEN,
     DEFAULT_API_BASE_URL,
     DEFAULT_PANEL_TOKEN,
+    PANEL_TIMEZONE_HEADER,
 )
 
 if TYPE_CHECKING:
@@ -156,7 +160,8 @@ def client_from_entry(hass: Any, entry: Any) -> NestQuestApiClient:
     """Build the production client for a config entry.
 
     Reads the configured base URL and panel token off the entry
-    (:func:`resolve_api_config`) and hands the client Home Assistant's
+    (:func:`resolve_api_config`), reports ``hass.config.time_zone`` as
+    the household zone, and hands the client Home Assistant's
     SHARED aiohttp session (``homeassistant.helpers.aiohttp_client
     .async_get_clientsession``) so panel calls ride HA's one connection
     pool.  The helper import is deferred into this function on purpose:
@@ -168,7 +173,10 @@ def client_from_entry(hass: Any, entry: Any) -> NestQuestApiClient:
 
     base_url, panel_token = resolve_api_config(entry)
     return NestQuestApiClient(
-        base_url, panel_token, async_get_clientsession(hass)
+        base_url,
+        panel_token,
+        async_get_clientsession(hass),
+        household_timezone=hass.config.time_zone,
     )
 
 
@@ -189,9 +197,14 @@ class NestQuestApiClient:
         session: aiohttp.ClientSession,
         *,
         timeout_seconds: float = DEFAULT_TIMEOUT_SECONDS,
+        household_timezone: str | None = None,
     ) -> None:
         """Store the connection settings; the session is injected.
 
+        ``household_timezone`` is Home Assistant's configured IANA
+        ``time_zone``; when given it rides every request in the
+        ``X-NestQuest-Timezone`` header.
+
         ``session`` is an aiohttp ``ClientSession`` in production and a
         stub transport in tests.  ``base_url`` must be a full http(s)
         URL and ``panel_token`` must be non-empty — a client built
@@ -216,6 +229,14 @@ class NestQuestApiClient:
         self._panel_token = panel_token
         self._session = session
         self._timeout_seconds = float(timeout_seconds)
+        self._household_timezone = household_timezone
+
+    def _headers(self) -> dict[str, str]:
+        """The Bearer credential plus the reported household zone."""
+        headers = {"Authorization": f"Bearer {self._panel_token}"}
+        if self._household_timezone:
+            headers[PANEL_TIMEZONE_HEADER] = self._household_timezone
+        return headers
 
     async def get_snapshot(self) -> dict[str, Any]:
         """Fetch and parse today's household snapshot.
@@ -275,7 +296,7 @@ class NestQuestApiClient:
         cleanly and closes the underlying response in every path.
         """
         url = f"{self._base_url}{EVENTS_PATH}"
-        headers = {"Authorization": f"Bearer {self._panel_token}"}
+        headers = self._headers()
         # Opening the response gets ONE request timeout, exactly like
         # ``_request_json``; the read loop below runs WITHOUT one — a
         # body-wide timeout would kill a healthy long-lived stream.
@@ -379,7 +400,7 @@ class NestQuestApiClient:
         raises typed too, carrying the status it arrived with.
         """
         url = f"{self._base_url}{path}"
-        headers = {"Authorization": f"Bearer {self._panel_token}"}
+        headers = self._headers()
         try:
             async with asyncio.timeout(self._timeout_seconds):
                 async with self._session.request(

custom_components/nestquest/coordinator.py

@@ -372,7 +372,10 @@ def coordinator_client_from_entry(
         return _UnconfiguredApiClient()
     if session_factory is not None:
         return NestQuestApiClient(
-            base_url, panel_token, session_factory(hass)
+            base_url,
+            panel_token,
+            session_factory(hass),
+            household_timezone=hass.config.time_zone,
         )
     from custom_components.nestquest.api_client import client_from_entry
 

custom_components/nestquest/core/const.py

@@ -112,6 +112,26 @@ CONF_AFTERNOON_REMINDER_ENABLED = "afternoon_reminder_enabled"
 CONF_END_OF_DAY_REPORT_ENABLED = "end_of_day_report_enabled"
 CONF_CELEBRATION_ENABLED = "celebration_enabled"
 DEFAULT_AUTOMATION_ENABLED = True
+# The household's IANA time zone (e.g. ``America/New_York``) the API
+# service reads its clock in.  The empty string is the API host's own
+# local time.  While the admin has not chosen a zone
+# (``timezone_configured`` is ``False``) the API adopts the zone the
+# integration reports from Home Assistant's configured ``time_zone``
+# (:data:`PANEL_TIMEZONE_HEADER`), so the default is the household's
+# zone without any manual setup.  The integration itself always uses
+# Home Assistant's ``time_zone`` and ignores this field.
+CONF_TIMEZONE = "timezone"
+DEFAULT_TIMEZONE = ""
+# Whether the admin has made an explicit ``timezone`` choice.  ``False``
+# (a fresh install) lets the API follow Home Assistant's reported zone
+# and the admin UI auto-set the browser's zone once while none is
+# stored; ``True`` pins the stored value — including an explicitly-chosen
+# empty ``timezone`` (the API host's local time) — so neither changes it.
+CONF_TIMEZONE_CONFIGURED = "timezone_configured"
+DEFAULT_TIMEZONE_CONFIGURED = False
+# The panel-plane request header carrying Home Assistant's configured
+# IANA ``time_zone`` from the integration to the API service.
+PANEL_TIMEZONE_HEADER = "X-NestQuest-Timezone"
 
 # Panel-plane API client (Feature 18): the integration reaches the
 # NestQuest API service (Feature 16) over HTTP instead of the database.

custom_components/nestquest/core/dao_rules.py

@@ -13,8 +13,12 @@ Guardrail mapping:
 - ``schedule_rules`` deletion is delete-if-unreferenced: a rule still
   referenced by any quest definition is rejected (the done-condition),
   not cascaded.
-- ``quest_definitions`` has no delete path at all: definitions are
-  deactivated, never hard-deleted, and history must survive.
+- ``quest_definitions`` has exactly one delete path,
+  :meth:`QuestDefinitionsDao.delete_if_no_history` (owner decision
+  2026-09-26): a definition with NO completion event on any of its
+  instances is hard-deleted with its instances, assignees, windows and
+  (if unreferenced) rule; a definition WITH history is never deleted —
+  it is retired by deactivation, so history always survives.
 - Assignment is multi-assignee (D-008): :meth:`add_assignee` and
   :meth:`remove_assignee` change future instances only — the DAO writes
   the assignee table and nothing else; assignment edits never rewrite
@@ -25,8 +29,8 @@ Guardrail mapping:
   :meth:`QuestDefinitionsDao.add_assignee` (active child); no
   permission checks here, that is the Feature 09 gate's job.
 
-Concurrency: ``delete_rule_if_unreferenced`` and the assignee
-mutations perform their checks and writes inside one transaction under
+Concurrency: ``delete_rule_if_unreferenced``,
+``delete_if_no_history`` and the assignee mutations perform their checks and writes inside one transaction under
 the connection-scoped lock shared with :mod:`.dao_children`, so a
 definition referencing the rule (or an assignee appearing) cannot slip
 in between check and write on this connection.
@@ -608,26 +612,42 @@ class ScheduleRulesDao:
         """
         async with _connection_lock(self._database):
             async with self._database.transaction():
-                row = await self._database.fetch_one(
-                    "SELECT 1 FROM quest_definitions "
-                    "WHERE schedule_rule_id = ? LIMIT 1",
-                    (rule_id,),
+                return await _delete_rule_if_unreferenced_in_transaction(
+                    self._database, rule_id
                 )
-                if row is not None:
-                    return False
-                result = await self._database.execute(
-                    "DELETE FROM schedule_rules WHERE id = ?",
-                    (rule_id,),
-                )
-                return result.rowcount > 0
+
+
+async def _delete_rule_if_unreferenced_in_transaction(
+    database: NestQuestDatabase, rule_id: int
+) -> bool:
+    """Delete-if-unreferenced body; the CALLER holds lock + transaction.
+
+    Shared by :meth:`ScheduleRulesDao.delete_if_unreferenced` and
+    :meth:`QuestDefinitionsDao.delete_if_no_history`, so the rule's
+    reference check runs in whichever transaction removed the last
+    definition that could reference it.
+    """
+    row = await database.fetch_one(
+        "SELECT 1 FROM quest_definitions "
+        "WHERE schedule_rule_id = ? LIMIT 1",
+        (rule_id,),
+    )
+    if row is not None:
+        return False
+    result = await database.execute(
+        "DELETE FROM schedule_rules WHERE id = ?",
+        (rule_id,),
+    )
+    return result.rowcount > 0
 
 
 class QuestDefinitionsDao:
     """Typed async access to ``quest_definitions`` and its assignees.
 
-    No delete method exists: definitions are deactivated via
-    :meth:`set_active`, never hard-deleted, so completion history keeps
-    its references (feature guardrail).  Assignment is multi-assignee
+    The only delete method is :meth:`delete_if_no_history`: a
+    definition with completion history is never hard-deleted (it is
+    deactivated via :meth:`set_active` instead), so completion history
+    always keeps its references (feature guardrail, D-005).  Assignment is multi-assignee
     (D-008): the definition row carries no child; assignees live in
     ``quest_definition_assignees`` and are managed explicitly so the
     operations stay separately loggable and permission-gateable.
@@ -1140,6 +1160,54 @@ class QuestDefinitionsDao:
         )
         return result.rowcount
 
+    async def delete_if_no_history(self, definition_id: int) -> bool | None:
+        """Hard-delete a definition that has NO completion history.
+
+        Returns None when the definition does not exist, False when any
+        of its instances has a completion event (nothing is touched —
+        the caller retires it by deactivation instead), and True when it
+        was deleted: its ``quest_instances``, assignee and window rows,
+        the definition row, and its schedule rule if no other definition
+        references it.
+
+        The history check and every DELETE run inside ONE transaction
+        under the connection lock, so a completion recorded concurrently
+        cannot land between the check and the delete (D-005: an instance
+        with a completion event is never deleted).
+        """
+        async with _connection_lock(self._database):
+            async with self._database.transaction():
+                row = await self._database.fetch_one(
+                    "SELECT schedule_rule_id FROM quest_definitions "
+                    "WHERE id = ?",
+                    (definition_id,),
+                )
+                if row is None:
+                    return None
+                schedule_rule_id = row[0]
+                history = await self._database.fetch_one(
+                    "SELECT 1 FROM completion_events "
+                    "JOIN quest_instances "
+                    "ON quest_instances.id = completion_events.instance_id "
+                    "WHERE quest_instances.definition_id = ? LIMIT 1",
+                    (definition_id,),
+                )
+                if history is not None:
+                    return False
+                for statement in (
+                    "DELETE FROM quest_instances WHERE definition_id = ?",
+                    "DELETE FROM quest_definition_assignees "
+                    "WHERE definition_id = ?",
+                    "DELETE FROM quest_definition_windows "
+                    "WHERE definition_id = ?",
+                    "DELETE FROM quest_definitions WHERE id = ?",
+                ):
+                    await self._database.execute(statement, (definition_id,))
+                await _delete_rule_if_unreferenced_in_transaction(
+                    self._database, schedule_rule_id
+                )
+                return True
+
     async def add_assignee(
         self, definition_id: int, child_id: int
     ) -> list[ChildRecord]:

custom_components/nestquest/core/quest_definitions.py

@@ -7,7 +7,9 @@ all-or-nothing create/edit here, and never touch the DAO SQL directly.
 :func:`edit_quest_definition` the edit path (which may also replace the
 whole assignee set), :func:`assign_child` and
 :func:`unassign_child` the single-child assignment paths, and
-:func:`set_quest_definition_active` the deactivate/reactivate path.
+:func:`set_quest_definition_active` the deactivate/reactivate path,
+and :func:`delete_quest_definition` the hybrid admin delete (hard-delete
+when there is no completion history, retire by deactivation otherwise).
 There is no permission check here (that is Feature 09).
 
 Validation policy mirrors :mod:`.children`:
@@ -80,6 +82,21 @@ class CreatedQuestDefinition:
     windows: list[QuestDefinitionWindowRecord]
 
 
+@dataclass(frozen=True)
+class DeletedQuestDefinition:
+    """What :func:`delete_quest_definition` actually did.
+
+    Exactly one of ``deleted`` / ``retired`` is True.  ``definition`` is
+    the retired (deactivated) definition's updated view, or None when
+    the definition was hard-deleted and no longer exists.
+    """
+
+    definition_id: int
+    deleted: bool
+    retired: bool
+    definition: CreatedQuestDefinition | None
+
+
 def _now_stamp() -> str:
     """Return the module's strict UTC second-precision stamp."""
     return datetime.datetime.now(datetime.timezone.utc).isoformat(
@@ -504,12 +521,19 @@ async def set_quest_definition_active(
 ) -> CreatedQuestDefinition:
     """Deactivate or reactivate a definition; returns the updated view.
 
-    Flipping the flag is the only removal path (Feature 06 guardrail):
+    Flipping the flag is the only removal path for a definition with
+    completion history (Feature 06 guardrail; a history-free definition
+    may instead be hard-deleted by :func:`delete_quest_definition`):
     a deactivated definition stops future instance generation but its
-    row, schedule rule, assignees and windows all survive, and existing
-    instances plus completion history are never touched.  Reactivation
-    re-enables future generation; generating or removing instances is
-    Feature 07 and does not happen here.
+    row, schedule rule, assignees and windows all survive, and its
+    durable completion history (the append-only ``completion_events``)
+    is never touched.  Like every Feature 06 config change, the flip is
+    followed by :func:`~.materialize.regenerate_for_definition`: the
+    definition's future (today onward) UNCOMPLETED instances are cleared
+    — they are rolling, regenerable rows — and, while the definition is
+    inactive, none are re-materialized.  Completed and past instances
+    are kept.  Reactivation re-enables generation, and the same
+    regeneration re-materializes the rolling horizon.
 
     ``definition_id`` must be a plain int (bools and floats rejected,
     since SQLite would bind ``True`` onto definition 1) and
@@ -562,6 +586,68 @@ async def set_quest_definition_active(
     )
 
 
+async def delete_quest_definition(
+    database: NestQuestDatabase,
+    definition_id: int,
+    *,
+    today: datetime.date | None = None,
+    horizon_days: int | None = None,
+) -> DeletedQuestDefinition:
+    """Delete a definition if it has no history; otherwise retire it.
+
+    Owner decision (2026-09-26): "delete if there's no history,
+    retire/deactivate if there is".  When NO instance of the definition
+    has a completion event, the definition, its instances, assignees,
+    windows and (if no other definition references it) its schedule
+    rule are hard-deleted in ONE transaction by
+    :meth:`~.dao_rules.QuestDefinitionsDao.delete_if_no_history` — the
+    history check is inside that transaction, so a completion recorded
+    concurrently can never be deleted (D-005).  When history exists,
+    the definition is retired through :func:`set_quest_definition_active`
+    (``False``).  Retirement preserves the definition row, schedule
+    rule, assignees, windows and ALL durable completion history.  Like
+    any deactivation it regenerates, so future UNCOMPLETED instances are
+    cleared (they are rolling, regenerable rows) and none are recreated
+    while the definition is inactive — the retired task stops generating
+    and no longer shows open work.  Durable instance history lives only
+    in the append-only ``completion_events``.
+
+    ``definition_id`` must be a plain int (bools and floats rejected).
+    Raises ValueError naming the field when the id is malformed or the
+    definition does not exist.  ``today`` / ``horizon_days`` are threaded
+    into the retire path's regeneration, as in
+    :func:`set_quest_definition_active`.
+    """
+    _validate_definition_id(definition_id)
+    deleted = await QuestDefinitionsDao(database).delete_if_no_history(
+        definition_id
+    )
+    if deleted is None:
+        raise ValueError(
+            f"definition_id: quest definition {definition_id} does not exist"
+        )
+    if deleted:
+        return DeletedQuestDefinition(
+            definition_id=definition_id,
+            deleted=True,
+            retired=False,
+            definition=None,
+        )
+    retired = await set_quest_definition_active(
+        database,
+        definition_id,
+        False,
+        today=today,
+        horizon_days=horizon_days,
+    )
+    return DeletedQuestDefinition(
+        definition_id=definition_id,
+        deleted=False,
+        retired=True,
+        definition=retired,
+    )
+
+
 def _bundle_snapshot(
     snapshot: QuestDefinitionSnapshot,
 ) -> CreatedQuestDefinition:

custom_components/nestquest/core/settings.py

@@ -35,6 +35,7 @@ from collections.abc import Callable
 from dataclasses import dataclass
 from types import MappingProxyType
 from typing import Any, Mapping
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from .const import (
     CONF_AFTERNOON_REMINDER_ENABLED,
@@ -47,12 +48,16 @@ from .const import (
     CONF_MORNING_SUMMARY_ENABLED,
     CONF_MORNING_SUMMARY_TIME,
     CONF_NOTIFY_TARGET,
+    CONF_TIMEZONE,
+    CONF_TIMEZONE_CONFIGURED,
     DEFAULT_AFTERNOON_REMINDER_TIME,
     DEFAULT_AUTOMATION_ENABLED,
     DEFAULT_DAY_ROLLOVER_TIME,
     DEFAULT_END_OF_DAY_REPORT_TIME,
     DEFAULT_HORIZON_DAYS,
     DEFAULT_MORNING_SUMMARY_TIME,
+    DEFAULT_TIMEZONE,
+    DEFAULT_TIMEZONE_CONFIGURED,
     LOGGER,
     TIME_PATTERN,
 )
@@ -153,6 +158,29 @@ def _resolve_optional_str(value: Any) -> str:
     return value.strip()
 
 
+def _resolve_timezone(value: Any) -> str:
+    """Validate a household time zone and return it.
+
+    The empty string means "the API host's local time" (the historical
+    behaviour); anything else must be an IANA key :class:`ZoneInfo`
+    resolves (e.g. ``America/New_York``).  A non-str (including
+    ``None``) is rejected; the ``None``-as-absent mapping lives ONLY in
+    :meth:`NestQuestSettings.from_options` (via :func:`_option_value`).
+    """
+    if not isinstance(value, str):
+        raise ValueError(f"timezone must be a string, got {value!r}")
+    if value == "":
+        return value
+    try:
+        ZoneInfo(value)
+    except (ZoneInfoNotFoundError, ValueError) as error:
+        raise ValueError(
+            f"timezone must be an IANA time zone name such as "
+            f"'America/New_York', got {value!r}"
+        ) from error
+    return value
+
+
 #: The single field table the two builders share.  Each row is
 #: ``(field_name, CONF_* key, default, validator)``.  ``from_options``
 #: applies every validator (raising on the first invalid value) while
@@ -214,6 +242,13 @@ _FIELDS: tuple[tuple[str, str, Any, Callable[[Any], Any]], ...] = (
         DEFAULT_AUTOMATION_ENABLED,
         _resolve_bool,
     ),
+    ("timezone", CONF_TIMEZONE, DEFAULT_TIMEZONE, _resolve_timezone),
+    (
+        "timezone_configured",
+        CONF_TIMEZONE_CONFIGURED,
+        DEFAULT_TIMEZONE_CONFIGURED,
+        _resolve_bool,
+    ),
 )
 
 
@@ -243,6 +278,11 @@ class NestQuestSettings:
     afternoon_reminder_enabled: bool = DEFAULT_AUTOMATION_ENABLED
     end_of_day_report_enabled: bool = DEFAULT_AUTOMATION_ENABLED
     celebration_enabled: bool = DEFAULT_AUTOMATION_ENABLED
+    timezone: str = DEFAULT_TIMEZONE
+    #: ``True`` once the admin explicitly chose :attr:`timezone` (even
+    #: the empty host-local value); ``False`` on a fresh install, where
+    #: the admin UI may auto-set the browser's zone.
+    timezone_configured: bool = DEFAULT_TIMEZONE_CONFIGURED
 
     def __post_init__(self) -> None:
         # Validate STRICTLY at construction so a hand-built instance
@@ -275,12 +315,30 @@ class NestQuestSettings:
             "afternoon_reminder_enabled",
             "end_of_day_report_enabled",
             "celebration_enabled",
+            "timezone_configured",
         ):
             value = getattr(self, name)
             if not isinstance(value, bool):
                 raise ValueError(
                     f"{name} must be a boolean, got {value!r}"
                 )
+        _resolve_timezone(self.timezone)
+
+    def household_now(self, instant: datetime.datetime) -> datetime.datetime:
+        """Return the aware ``instant`` expressed in the household's zone.
+
+        The API service does not run inside Home Assistant, so its one
+        clock read (an aware host-local ``now``) is converted here: with
+        :attr:`timezone` set — the admin's choice, or else the zone the
+        integration reports from Home Assistant — the SAME instant is
+        re-expressed in that zone, so ``.date()`` and ``.time()`` are the
+        household's wall clock even when the host runs UTC.  With
+        :attr:`timezone` empty the instant is returned unchanged (the
+        host's local time).
+        """
+        if not self.timezone:
+            return instant
+        return instant.astimezone(ZoneInfo(self.timezone))
 
     @property
     def day_rollover_hour_minute(self) -> tuple[int, int]:

custom_components/nestquest/core/settings_store.py

@@ -18,7 +18,7 @@ API client; the two are deliberately NOT unified here, and neither
 side reads the other's values.
 
 STORED SERIALIZATION — the document at ``SETTINGS_META_KEY`` is a JSON
-object holding exactly the TEN settings fields, keyed by field name
+object holding exactly the TWELVE settings fields, keyed by field name
 (which equals the ``CONF_*`` option key for every field), complete
 after the first update:
 
@@ -30,7 +30,15 @@ after the first update:
   core's normalizer),
 - ``morning_summary_enabled``, ``afternoon_reminder_enabled``,
   ``end_of_day_report_enabled``, ``celebration_enabled`` — real
-  booleans.
+  booleans,
+- ``timezone`` — ``""`` (the API host's local time) or an IANA time
+  zone name such as ``America/New_York``.  A document stored before
+  this field existed simply lacks it and resolves to ``""``,
+- ``timezone_configured`` — a real boolean: ``True`` once the admin
+  explicitly chose ``timezone`` (including the empty host-local value),
+  so neither Home Assistant's reported zone
+  (:func:`adopt_reported_timezone`) nor the admin UI changes it again.  A document stored before
+  this field existed lacks it and resolves to ``False``.
 
 Only values whose core validators ACCEPTED are ever written, so a
 stored document always round-trips through the core's option builders.
@@ -172,7 +180,7 @@ async def update_settings(
     update can never leave a half-applied document behind.
 
     The validated changes are merged onto the current effective
-    settings and the merged (complete, ten-field) document is persisted
+    settings and the merged (complete, twelve-field) document is persisted
     in one atomic upsert; the updated settings are returned.  The whole
     read → merge → write span runs inside the per-database settings
     lock, so concurrent updates queue instead of interleaving.
@@ -193,18 +201,49 @@ async def update_settings(
         )
     async with _settings_lock(database):
         current = await load_settings(database)
-        document: dict[str, Any] = {
-            field: getattr(current, field) for field in _FIELD_NAMES
-        }
-        for name, raw_value in changes.items():
-            default, validator = _RESOLUTIONS[name]
-            try:
-                document[name] = validator(
-                    default if raw_value is None else raw_value
-                )
-            except ValueError as error:
-                raise ValueError(_named(name, error)) from error
-        await MetaStateDao(database).set(
-            SETTINGS_META_KEY, json.dumps(document, sort_keys=True)
-        )
+        return await _write_merged(database, current, changes)
+
+
+async def adopt_reported_timezone(
+    database: NestQuestDatabase, zone: str
+) -> NestQuestSettings:
+    """Adopt Home Assistant's reported ``zone`` unless the admin chose one.
+
+    While ``timezone_configured`` is ``False`` the stored ``timezone``
+    follows the zone the integration reports, so the API's clock is the
+    household's without any manual setup; ``timezone_configured`` stays
+    ``False`` (the value is automatic, not an admin choice).  Once the
+    admin has chosen — including an explicitly-chosen empty zone — the
+    stored settings are returned untouched.  The check and the write
+    share the settings lock, so a concurrent admin choice is never
+    overwritten.  An invalid ``zone`` raises a ``ValueError`` naming
+    ``timezone`` and writes nothing.
+    """
+    async with _settings_lock(database):
+        current = await load_settings(database)
+        if current.timezone_configured or current.timezone == zone:
+            return current
+        return await _write_merged(database, current, {"timezone": zone})
+
+
+async def _write_merged(
+    database: NestQuestDatabase,
+    current: NestQuestSettings,
+    changes: Mapping[str, Any],
+) -> NestQuestSettings:
+    """Validate ``changes``, merge onto ``current``, persist; lock held."""
+    document: dict[str, Any] = {
+        field: getattr(current, field) for field in _FIELD_NAMES
+    }
+    for name, raw_value in changes.items():
+        default, validator = _RESOLUTIONS[name]
+        try:
+            document[name] = validator(
+                default if raw_value is None else raw_value
+            )
+        except ValueError as error:
+            raise ValueError(_named(name, error)) from error
+    await MetaStateDao(database).set(
+        SETTINGS_META_KEY, json.dumps(document, sort_keys=True)
+    )
     return NestQuestSettings(**document)

custom_components/nestquest/core/sweep.py

@@ -40,8 +40,8 @@ announces nothing.
 
 The caller supplies ``today`` as a plain :class:`datetime.date`: the
 household-local calendar date, read from ``hass.config.time_zone`` by
-the integration or from the API host's local clock by the API.  This
-module never reads a timezone database or config of its own.
+the integration or from the configured household timezone by the API.
+This module never reads a timezone database or config of its own.
 """
 from __future__ import annotations
 
@@ -98,7 +98,8 @@ async def run_missed_sweep(
 
     ``today`` is the household-local calendar date the sweep runs for
     (the caller owns the clock: the integration reads it from
-    ``hass.config.time_zone``, the API from its host's local time).
+    ``hass.config.time_zone``, the API from the configured household
+    timezone, falling back to its host's local time when unset).
     Returns the ``(event_type, payload)`` tuples to announce, EMPTY
     when the watermark already covers ``today`` (a same-night rerun) —
     the caller decides how to publish them and announces nothing on

custom_components/nestquest/manifest.json

@@ -15,5 +15,5 @@
   "iot_class": "local_polling",
   "issue_tracker": "https://github.com/Maniacs-Mansion/NestQuest/issues",
   "requirements": [],
-  "version": "0.8.0"
+  "version": "0.9.5"
 }

design/ADMIN-SPEC.md

@@ -64,7 +64,8 @@ Header `Tasks` / `7 definitions · 3 children` + gradient `New` button. Filter c
 (All / one per child): active `#18181D` fill white text, inactive white with border.
 Rows: glyph 17px · title 13.5px/700 · meta 11px/600 `<assignees> · <recurrence> · <windows>`
 · `chevron-right`. An inactive definition renders the whole row at
-`--nq-a-ink-tertiary` with `· inactive` in the meta — never hard-deleted (glossary).
+`--nq-a-ink-tertiary` with `· inactive` in the meta. A definition with completion
+history is never hard-deleted (glossary, D-017): Delete retires it to this inactive state.
 The row being edited takes `--nq-a-selected` with brand-blue glyph, `Editing` meta and
 `chevron-down`.
 
@@ -83,6 +84,22 @@ Bottom sheet, `--nq-a-radius-sheet`, `--nq-a-sheet-shadow`, 38×4px grabber, pad
 Footer: `Cancel` (flex 1, bordered) + `Save changes` (flex 2, gradient), both 13px vertical
 padding. Sheet enters over the dimmed list in `--nq-dur-modal`.
 
+Delete (editing an existing definition only, never on `New`): a full-width bordered
+`Delete task` button below the footer, danger-ink text. Tapping it swaps the footer for a
+danger-tinted confirm — "Delete this task? If it has no completion history it is deleted;
+otherwise it is retired (deactivated) and its history is kept." — with `Go back` and a
+danger-filled `Delete task`. Confirming calls `DELETE /api/v1/admin/quest-definitions/{id}`
+(admin plane only; the kids' panel has no equivalent control). Hybrid outcome (D-017): no
+completion event on any instance → the definition, its instances, assignees, windows and
+unreferenced rule are hard-deleted and the row leaves the list; otherwise the definition
+is retired (deactivated) and the row stays, shown inactive. Retirement preserves the
+definition row, schedule rule, assignees, windows and all durable completion history. Like
+any deactivation it regenerates, so future uncompleted instances are cleared (they are
+rolling, regenerable rows) and none are recreated while the definition is inactive — the
+retired task stops generating and no longer shows open work. Durable instance history lives
+only in the append-only `completion_events`. An error keeps the sheet open with the API's
+detail.
+
 ### 3.3 Icon picker
 Each definition carries one optional icon, shown on both surfaces. The picker offers three
 sources:

design/PANEL-SPEC.md

@@ -22,10 +22,14 @@ Screens `1a`, `1b`, `1j`, `1c` of the mockups. Two cards:
 
 Default view on the wall. Layout top to bottom:
 
-1. **Wordmark row** at y=64. Rule · d20 hexagon · `NestQuest` (66px/900 display, brand
-   gradient via `background-clip: text`) · d20 · rule. d20 marks are 34px hexagons
-   (`clip-path: polygon(50% 0, 93% 25%, 93% 75%, 50% 100%, 7% 75%, 7% 25%)`) filled with
-   the brand gradient, numeral 15px/700 Cinzel.
+1. **Wordmark row** at y=64. Rule · monogram · `NestQuest` (66px/900 Cinzel Decorative
+   display, brand gradient via `background-clip: text`) · rule — the horizontal lockup of
+   `design/logos/NestQuest_Logo.png`. The monogram is an 80px inline SVG (no raster, no
+   remote asset): a compass rose — four long cardinal points, four short diagonal points,
+   a ring broken by the points — around a d20 hexagon with facet lines and a knocked-out
+   Cinzel Decorative "N", filled with the brand gradient (`--nq-brand-blue` →
+   `--nq-brand-purple`, 135°). Gaps are SVG masks, so the mark stays transparent over the
+   parchment.
 2. **Kicker** `The Party · <weekday>, <Month D>` — 21px/600 Cinzel, tracking .30em, uppercase.
 3. **Adventurer plates**, 3-up grid, 56px gap, page inset 110px, top y=262. One plate per
    child returned by the party sensor, in configured order.
@@ -67,6 +71,14 @@ and time only rather than removing it (the strip is part of the frame).
 
 Reached by tapping a present crest. Header at y=56, page inset 62px:
 
+- **Return control** first in the header, left of the crest: a `--nq-p-button-height`
+  72px button, radius 10px, `rgba(92,62,26,.1)` with a 2px `rgba(92,62,26,.5)` border
+  (the confirm dialog's **Not yet** treatment), `chevron-left` 34px + `The Party`
+  26px/700 Cinzel `--nq-p-ink`, 28px header gap to the crest. Tapping it takes the same
+  path as the idle return (§3.5) — navigate to `board_path` — immediately. Press
+  feedback `scale(.98)`, `--nq-dur-micro`. Not rendered when no `board_path` is
+  configured. The party board is the main display and has no return control; the
+  Quest complete screen (§5) keeps its auto-return.
 - Small crest 96×110 (initial 44px/700 display).
 - Title `<Name>'s Quest Log` 56px/700 display.
 - Sub `<weekday>, <Month D> · N of M claimed` 20px/600 Cinzel, tracking .24em, uppercase.

frontend/src/cards/party-board.ts

@@ -231,8 +231,76 @@ function conditionPhrase(condition: string, label: string): string {
 }
 
 const SHIELD_CLIP = "polygon(0 0, 100% 0, 100% 62%, 50% 100%, 0 62%)";
-const HEXAGON_CLIP =
-  "polygon(50% 0, 93% 25%, 93% 75%, 50% 100%, 7% 75%, 7% 25%)";
+// The brand monogram (design/logos/NestQuest_Logo.png): a compass rose —
+// four long cardinal points, four short diagonal points, a ring broken by
+// the points — around a d20 hexagon carrying a knocked-out "N". Drawn on
+// a 100-unit grid and filled with the brand gradient; the masks cut the
+// parchment gaps so the mark stays transparent on any backdrop.
+const MONOGRAM_POINTS =
+  "M50 3 44.5 24.1 50 26 55.5 24.1Z M100 50 75.9 44.5 74 50 75.9 55.5Z " +
+  "M50 97 55.5 75.9 50 74 44.5 75.9Z M0 50 24.1 55.5 26 50 24.1 44.5Z " +
+  "M29.1 29.1 29.7 36.3 36.3 29.7Z M70.9 29.1 63.7 29.7 70.3 36.3Z " +
+  "M70.9 70.9 70.3 63.7 63.7 70.3Z M29.1 70.9 36.3 70.3 29.7 63.7Z";
+const MONOGRAM_HEX = "M50 26.5 70.4 38.2 70.4 61.8 50 73.5 29.6 61.8 29.6 38.2Z";
+const MONOGRAM_FACETS =
+  "M29.6 38.2H70.4M29.6 61.8H70.4M50 26.5 36.5 38.2M50 26.5 63.5 38.2" +
+  "M50 73.5 36.5 61.8M50 73.5 63.5 61.8M36.5 38.2V61.8M63.5 38.2V61.8" +
+  "M29.6 38.2 36.5 61.8M36.5 38.2 29.6 61.8" +
+  "M70.4 38.2 63.5 61.8M63.5 38.2 70.4 61.8";
+const MONOGRAM = html`<svg
+  class="monogram"
+  viewBox="0 0 100 100"
+  aria-hidden="true"
+  focusable="false"
+>
+  <defs>
+    <linearGradient
+      id="nq-monogram-fill"
+      gradientUnits="userSpaceOnUse"
+      x1="0"
+      y1="0"
+      x2="100"
+      y2="100"
+    >
+      <stop offset="0" style="stop-color: var(--nq-brand-blue)" />
+      <stop offset="1" style="stop-color: var(--nq-brand-purple)" />
+    </linearGradient>
+    <mask id="nq-monogram-points-gap" maskUnits="userSpaceOnUse">
+      <rect width="100" height="100" fill="#fff" />
+      <path d=${MONOGRAM_POINTS} stroke="#000" stroke-width="3.5" />
+    </mask>
+    <mask id="nq-monogram-facets" maskUnits="userSpaceOnUse">
+      <rect width="100" height="100" fill="#fff" />
+      <path d=${MONOGRAM_FACETS} stroke="#000" stroke-width="1.6" />
+      <text
+        x="50"
+        y="59.4"
+        text-anchor="middle"
+        font-family="'Cinzel Decorative', Cinzel, serif"
+        font-weight="900"
+        font-size="25"
+        fill="#fff"
+        stroke="#000"
+        stroke-width="2"
+        paint-order="stroke"
+      >N</text>
+    </mask>
+  </defs>
+  <g fill="url(#nq-monogram-fill)">
+    <path d=${MONOGRAM_POINTS} />
+    <g mask="url(#nq-monogram-points-gap)">
+      <circle
+        cx="50"
+        cy="50"
+        r="34.25"
+        fill="none"
+        stroke="url(#nq-monogram-fill)"
+        stroke-width="6.5"
+      />
+      <path mask="url(#nq-monogram-facets)" d=${MONOGRAM_HEX} />
+    </g>
+  </g>
+</svg>`;
 
 const boardStyles = css`
   * {
@@ -299,23 +367,11 @@ const boardStyles = css`
     background: rgba(92, 62, 26, 0.35);
   }
 
-  .d20 {
+  .monogram {
     flex: none;
-    display: inline-flex;
-    align-items: center;
-    justify-content: center;
-    width: 34px;
-    height: 34px;
-    clip-path: ${unsafeCSS(HEXAGON_CLIP)};
-    background: var(--nq-brand-gradient);
-  }
-
-  .d20-numeral {
-    font-family: var(--nq-p-font-heading);
-    font-size: 15px;
-    font-weight: 700;
-    line-height: 1;
-    color: #ffffff;
+    display: block;
+    width: 80px;
+    height: 80px;
   }
 
   .wordmark {
@@ -497,11 +553,12 @@ const boardStyles = css`
 
   .hint {
     position: absolute;
-    top: 930px;
+    top: 896px;
     left: 0;
     right: 0;
+    margin: 0;
     font-family: var(--nq-p-font-body);
-    font-size: 24px;
+    font-size: 27px;
     font-weight: 600;
     line-height: 1.4;
     text-align: center;
@@ -861,13 +918,8 @@ export class NestQuestPartyBoardCard extends LitElement {
         <div class="frame frame-inner"></div>
         <div class="wordmark-row">
           <span class="rule"></span>
-          <span class="d20" aria-hidden="true">
-            <span class="d20-numeral">20</span>
-          </span>
+          ${MONOGRAM}
           <span class="wordmark">NestQuest</span>
-          <span class="d20" aria-hidden="true">
-            <span class="d20-numeral">20</span>
-          </span>
           <span class="rule"></span>
         </div>
         <p class="kicker">The Party · ${formatDay(this._now, this._timeZone())}</p>

frontend/src/cards/quest-log.ts

@@ -374,12 +374,43 @@ const logStyles = css`
     gap: 28px;
   }
 
+  button.return {
+    flex: none;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 10px;
+    height: var(--nq-p-button-height);
+    padding: 0 28px 0 20px;
+    border: 2px solid rgba(92, 62, 26, 0.5);
+    border-radius: 10px;
+    background: rgba(92, 62, 26, 0.1);
+    color: var(--nq-p-ink);
+    font-family: var(--nq-p-font-heading);
+    font-size: 26px;
+    font-weight: 700;
+    line-height: 1;
+    white-space: nowrap;
+    cursor: pointer;
+    -webkit-tap-highlight-color: transparent;
+    transition: transform var(--nq-dur-micro) var(--nq-ease-out);
+  }
+
+  button.return:active {
+    transform: scale(0.98);
+  }
+
+  button.return svg {
+    width: 34px;
+    height: 34px;
+  }
+
   .crest {
     position: relative;
     flex: none;
     width: 96px;
     height: 110px;
-    padding: 3px;
+    padding: 4px;
     clip-path: ${unsafeCSS(SHIELD_CLIP)};
     background: rgba(255, 255, 255, 0.22);
   }
@@ -1199,6 +1230,18 @@ const ICON_X = html`<svg
   <path d="m6 6 12 12"></path>
 </svg>`;
 
+const ICON_CHEVRON_LEFT = html`<svg
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+  aria-hidden="true"
+>
+  <path d="m15 18-6-6 6-6"></path>
+</svg>`;
+
 const ICON_STAR = html`<svg
   viewBox="0 0 24 24"
   fill="none"
@@ -1944,7 +1987,19 @@ export class NestQuestQuestLogCard extends LitElement {
     const initial = (name?.charAt(0) || "?").toUpperCase();
     return html`
       <header class="header">
-        <span class="crest${away ? " away" : nothing}" aria-hidden="true">
+        ${this._boardPath()
+          ? html`
+              <button
+                class="return"
+                type="button"
+                @click=${() => this._returnToBoard()}
+              >
+                ${ICON_CHEVRON_LEFT}
+                <span>The Party</span>
+              </button>
+            `
+          : nothing}
+        <span class="crest${away ? " away" : ""}" aria-hidden="true">
           <span class="crest-face">
             <span class="initial">${initial}</span>
           </span>
@@ -2102,7 +2157,7 @@ export class NestQuestQuestLogCard extends LitElement {
         <span class="tile" aria-hidden="true">${renderQuestIcon(instance.icon, ICON_STAR)}</span>
         <div class="body">
           <span class="quest-title">${instance.title}</span>
-          <span class="meta ${meta.late ? "late" : nothing}">${meta.text}</span>
+          <span class="${meta.late ? "meta late" : "meta"}">${meta.text}</span>
         </div>
         <button
           class="complete"

frontend/tests/render-quest-log.mjs

@@ -8,9 +8,15 @@
  * pathname's last segment), after the optional probe wait one snapshot of
  * the render is taken mid-wait, then after the optional idle wait stdout
  * receives one JSON object {location, headline, countdown, html, tiles,
- * probe} — the final window pathname, the rendered title, the
+ * probe, tap} — the final window pathname, the rendered title, the
  * complete-screen countdown text, the rendered shadow DOM, each quest
- * card's icon tile, and the probe snapshot when probe_ms was given. The Python panel tests drive this harness so the
+ * card's icon tile, and the probe snapshot when probe_ms was given. With
+ * tap_complete: <instance id> the harness taps that card's Complete button,
+ * records whether the confirm dialog opened, taps the dialog's Complete, and
+ * reports every hass.callService call as tap: {dialog_opened, service_calls}.
+ * With tap_return: true the harness taps the header's return control and
+ * reports it as returned: {rendered, label} before the final snapshot.
+ * The Python panel tests drive this harness so the
  * assertions run against the exact bundle HACS ships.
  */
 import { readFileSync } from "node:fs";
@@ -43,12 +49,45 @@ globalThis.Event = dom.window.Event;
 
 await import(pathToFileURL(spec.bundle).href);
 
+const serviceCalls = [];
+const hass = {
+  ...spec.hass,
+  callService(domain, service, data) {
+    serviceCalls.push({ domain, service, data });
+    return Promise.resolve();
+  },
+};
+
 const element = document.createElement("nestquest-quest-log-card");
 element.setConfig(spec.config);
-element.hass = spec.hass;
+element.hass = hass;
 document.body.appendChild(element);
 await element.updateComplete;
 
+let tap = null;
+if (spec.tap_complete !== undefined) {
+  element.shadowRoot
+    .querySelector(`.quest[data-instance-id="${spec.tap_complete}"] button.complete`)
+    .click();
+  await element.updateComplete;
+  const confirm = element.shadowRoot.querySelector("button.do-complete");
+  confirm?.click();
+  await element.updateComplete;
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  tap = { dialog_opened: confirm !== null, service_calls: serviceCalls };
+}
+
+let returned = null;
+if (spec.tap_return) {
+  const control = element.shadowRoot.querySelector(".header button.return");
+  returned = {
+    rendered: control !== null,
+    label: control?.textContent?.trim() ?? "",
+  };
+  control?.click();
+  await element.updateComplete;
+}
+
 const snapshot = () => ({
   location: window.location.pathname,
   headline: element.shadowRoot.querySelector(".title")?.textContent?.trim() ?? "",
@@ -84,6 +123,6 @@ if (spec.idle_ms !== undefined) {
   await new Promise((resolve) => setTimeout(resolve, spec.idle_ms));
 }
 
-const payload = JSON.stringify({ ...snapshot(), probe });
+const payload = JSON.stringify({ ...snapshot(), probe, tap, returned });
 await new Promise((resolve) => process.stdout.write(payload, () => resolve()));
 process.exit(0);

frontend/tsconfig.json

@@ -1,6 +1,7 @@
 {
   "compilerOptions": {
     "target": "ES2022",
+    "useDefineForClassFields": false,
     "module": "ESNext",
     "moduleResolution": "bundler",
     "lib": ["ES2022", "DOM"],

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nestquest"
-version = "0.8.0"
+version = "0.9.5"
 description = "NestQuest Home Assistant Integration"
 readme = "README.md"
 requires-python = ">=3.11"

tests/test_api_admin_questdef.py

@@ -817,3 +817,141 @@ async def test_set_active_malformed_body_is_422(
         headers=_admin_headers(),
     )
     assert response.status_code == 422
+
+
+# --- delete: hybrid (delete if no history, retire if there is) --------------
+
+_dao_instances = importlib.import_module("nestquest_core.dao_instances")
+
+
+def test_delete_route_lives_on_the_admin_router() -> None:
+    """The DELETE route is on the admin router, which carries the ONE
+    require_admin dependency — no second auth check is added."""
+    from api.auth import require_admin
+    from api.routes_admin import router as admin_router
+
+    assert require_admin in [d.dependency for d in admin_router.dependencies]
+    matches = [
+        route
+        for route in admin_router.routes
+        if route.path == "/api/v1/admin/quest-definitions/{definition_id}"
+        and "DELETE" in route.methods
+    ]
+    assert len(matches) == 1
+
+
+async def test_delete_refuses_non_admin_and_absent(
+    admin_questdefs: SimpleNamespace,
+) -> None:
+    """A non-admin JWT is 403 and an absent credential 401: nothing is
+    deleted or retired."""
+    client = admin_questdefs.client
+    ada = (await _create_children(client, ("Ada",)))[0]
+    definition_id = (await _create_definition(client, [ada])).json()["id"]
+    non_admin = make_token(groups=("some-other-group",))
+
+    forbidden = await client.delete(
+        f"/api/v1/admin/quest-definitions/{definition_id}",
+        headers={"Authorization": f"Bearer {non_admin}"},
+    )
+    assert forbidden.status_code == 403
+    unauthenticated = await client.delete(
+        f"/api/v1/admin/quest-definitions/{definition_id}"
+    )
+    assert unauthenticated.status_code == 401
+
+    record = await _dao_rules.QuestDefinitionsDao(
+        admin_questdefs.database
+    ).get(definition_id)
+    assert record is not None
+    assert record.is_active is True
+
+
+async def test_delete_without_history_hard_deletes(
+    admin_questdefs: SimpleNamespace,
+) -> None:
+    """No completion history: 200 ``deleted`` and the row and its
+    unreferenced rule are gone."""
+    client = admin_questdefs.client
+    ada = (await _create_children(client, ("Ada",)))[0]
+    definition_id = (await _create_definition(client, [ada])).json()["id"]
+    dao = _dao_rules.QuestDefinitionsDao(admin_questdefs.database)
+    rule_id = (await dao.get(definition_id)).schedule_rule_id
+
+    response = await client.delete(
+        f"/api/v1/admin/quest-definitions/{definition_id}",
+        headers=_admin_headers(),
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "definition_id": definition_id,
+        "deleted": True,
+        "retired": False,
+        "definition": None,
+    }
+    assert await dao.get(definition_id) is None
+    assert await _dao_rules.ScheduleRulesDao(
+        admin_questdefs.database
+    ).get(rule_id) is None
+
+
+async def test_delete_with_history_retires(
+    admin_questdefs: SimpleNamespace,
+) -> None:
+    """Completion history present: 200 ``retired`` with the now-inactive
+    definition; the row, instance and history all remain."""
+    client = admin_questdefs.client
+    database = admin_questdefs.database
+    ada = (await _create_children(client, ("Ada",)))[0]
+    definition_id = (await _create_definition(client, [ada])).json()["id"]
+    instance = await _dao_instances.QuestInstancesDao(database).upsert(
+        definition_id,
+        ada,
+        datetime.date.today().isoformat(),
+        "2026-09-14T12:00:00+00:00",
+        window="morning",
+    )
+    events = _dao_instances.CompletionEventsDao(database)
+    event = await events.append(
+        instance.id,
+        ada,
+        "completed",
+        "user",
+        "2026-09-14T12:00:00+00:00",
+        True,
+        actor_user_id="admin-1",
+    )
+
+    response = await client.delete(
+        f"/api/v1/admin/quest-definitions/{definition_id}",
+        headers=_admin_headers(),
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["definition_id"] == definition_id
+    assert payload["deleted"] is False
+    assert payload["retired"] is True
+    assert payload["definition"]["id"] == definition_id
+    assert payload["definition"]["is_active"] is False
+    assert payload["definition"]["title"] == "Tidy the den"
+    record = await _dao_rules.QuestDefinitionsDao(database).get(definition_id)
+    assert record is not None
+    assert record.is_active is False
+    assert await _dao_instances.QuestInstancesDao(database).get_by_id(
+        instance.id
+    ) == instance
+    assert await events.list_by_instance(instance.id) == [event]
+
+
+async def test_delete_unknown_definition_is_404(
+    admin_questdefs: SimpleNamespace,
+) -> None:
+    """A DELETE naming a definition that does not exist is 404."""
+    response = await admin_questdefs.client.delete(
+        "/api/v1/admin/quest-definitions/999",
+        headers=_admin_headers(),
+    )
+    assert response.status_code == 404
+    assert response.json()["detail"] == "Quest definition not found"

tests/test_api_admin_settings.py

@@ -13,7 +13,7 @@ proven against the DATABASE the routes wrote, not a parallel copy.
 Proven per the done-condition, everything read back through the API:
 
 - ``GET /api/v1/admin/settings`` returns the current effective settings
-  — the ten documented fields at their defaults on a fresh database.
+  — the twelve documented fields at their defaults on a fresh database.
 - ``PATCH /api/v1/admin/settings`` PERSISTS the supplied fields and the
   NEXT read reflects them; a later partial update merges onto the
   current effective settings (omitted fields keep their stored value),
@@ -60,7 +60,7 @@ _dao_meta = importlib.import_module("nestquest_core.dao_meta")
 SETTINGS_META_KEY = "settings"
 
 #: The all-defaults effective settings a fresh database reports — the
-#: documented ten fields, asserted literally so the payload contract is
+#: documented twelve fields, asserted literally so the payload contract is
 #: pinned here, independent of the core constants.
 DEFAULT_SETTINGS = {
     "horizon_days": 14,
@@ -73,6 +73,8 @@ DEFAULT_SETTINGS = {
     "afternoon_reminder_enabled": True,
     "end_of_day_report_enabled": True,
     "celebration_enabled": True,
+    "timezone": "",
+    "timezone_configured": False,
 }
 
 
@@ -103,7 +105,7 @@ async def settings_client(temp_db_path: str) -> SimpleNamespace:
 async def test_get_settings_returns_defaults_on_a_fresh_database(
     settings_client: SimpleNamespace,
 ) -> None:
-    """GET returns the ten documented fields at their defaults."""
+    """GET returns the twelve documented fields at their defaults."""
     response = await settings_client.client.get(
         "/api/v1/admin/settings", headers=_admin_headers()
     )
@@ -139,7 +141,7 @@ async def test_update_persists_and_the_next_read_reflects_it(
     assert reread.status_code == 200
     assert reread.json() == expected
 
-    # ...and the DATABASE holds the merged document: the complete ten
+    # ...and the DATABASE holds the merged document: the complete twelve
     # fields, keyed by field name, under the well-known meta_state key.
     raw = await _dao_meta.MetaStateDao(settings_client.database).get(
         SETTINGS_META_KEY
@@ -221,6 +223,40 @@ async def test_null_resets_a_field_to_its_default(
     assert reread.json()["horizon_days"] == 14
 
 
+async def test_timezone_configured_round_trips_with_an_explicit_empty_zone(
+    settings_client: SimpleNamespace,
+) -> None:
+    """An explicit empty (host-local) zone persists as configured.
+
+    The admin clearing the zone PATCHes ``timezone: ""`` together with
+    ``timezone_configured: true``; the NEXT read — a reopened settings
+    screen — sees the marker, so the empty value is a persisted choice
+    rather than a fresh install to auto-set.
+    """
+    client = settings_client.client
+    fresh = await client.get("/api/v1/admin/settings", headers=_admin_headers())
+    assert fresh.json()["timezone_configured"] is False
+
+    patched = await client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": "", "timezone_configured": True},
+        headers=_admin_headers(),
+    )
+    assert patched.status_code == 200
+    expected = {**DEFAULT_SETTINGS, "timezone_configured": True}
+    assert patched.json() == expected
+
+    reread = await client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert reread.json() == expected
+    raw = await _dao_meta.MetaStateDao(settings_client.database).get(
+        SETTINGS_META_KEY
+    )
+    assert raw is not None
+    assert json.loads(raw)["timezone_configured"] is True
+
+
 # --- validation: rejected values never change the stored settings -------
 
 
@@ -237,6 +273,8 @@ async def test_null_resets_a_field_to_its_default(
         ({"morning_summary_enabled": "yes"}, "morning_summary_enabled"),
         ({"celebration_enabled": 1}, "celebration_enabled"),
         ({"notify_target": 5}, "notify_target"),
+        ({"timezone_configured": "true"}, "timezone_configured"),
+        ({"timezone_configured": 1}, "timezone_configured"),
     ],
 )
 async def test_invalid_value_is_rejected_and_stored_settings_unchanged(

tests/test_api_client.py

@@ -196,6 +196,27 @@ async def test_complete_instance_posts_body_and_headers() -> None:
     assert call["headers"]["Authorization"] == f"Bearer {TOKEN}"
 
 
+async def test_household_timezone_rides_every_request_header() -> None:
+    """Home Assistant's zone is reported so the API reads the household
+    clock (task 6351b36d); it is sent only when the client has one."""
+    transport = StubTransport(
+        StubResponse(200, json.dumps(SNAPSHOT_PAYLOAD)),
+        StubResponse(200, '{"status": "done"}'),
+    )
+    client = NestQuestApiClient(
+        BASE_URL, TOKEN, transport, household_timezone="America/New_York"
+    )
+
+    await client.get_snapshot()
+    await client.complete_instance(42, 3)
+
+    for call in transport.calls:
+        assert call["headers"] == {
+            "Authorization": f"Bearer {TOKEN}",
+            "X-NestQuest-Timezone": "America/New_York",
+        }
+
+
 async def test_base_url_trailing_slash_is_normalized() -> None:
     """A base URL with a trailing slash must not double the path slash."""
     transport = StubTransport(StubResponse(200, "{}"))
@@ -392,11 +413,20 @@ def test_client_from_entry_reads_config_and_shared_session(monkeypatch) -> None:
         }
     )
 
-    client = api_client.client_from_entry(object(), entry)
+    hass = types.SimpleNamespace(
+        config=types.SimpleNamespace(time_zone="America/New_York")
+    )
+
+    client = api_client.client_from_entry(hass, entry)
 
     assert client._session is shared_session
     assert client._base_url == "http://panel.lan:8443"
     assert client._panel_token == "entry-token"
+    assert client._household_timezone == "America/New_York"
+
+
+#: A minimal hass stand-in carrying the configured time zone.
+_HASS_UTC = types.SimpleNamespace(config=types.SimpleNamespace(time_zone="UTC"))
 
 
 def test_client_from_entry_unconfigured_token_raises_at_construction(
@@ -419,12 +449,12 @@ def test_client_from_entry_unconfigured_token_raises_at_construction(
     assert resolve_api_config(entry)[1] == DEFAULT_PANEL_TOKEN == ""
 
     with pytest.raises(ValueError, match="panel_token must be a non-empty"):
-        api_client.client_from_entry(object(), entry)
+        api_client.client_from_entry(_HASS_UTC, entry)
 
     # Same for a whitespace-only stored token: whitespace is not a token.
     entry_ws = make_config_entry(options={CONF_PANEL_TOKEN: "   "})
     with pytest.raises(ValueError, match="panel_token must be a non-empty"):
-        api_client.client_from_entry(object(), entry_ws)
+        api_client.client_from_entry(_HASS_UTC, entry_ws)
 
 
 async def test_client_logs_nothing() -> None:

tests/test_api_household_clock.py

@@ -0,0 +1,807 @@
+"""Household-local clock tests for the API service (task fa7475ba).
+
+The deployed API container runs UTC while the household is US Eastern,
+so reading the HOST clock marked every morning quest overdue from the
+small hours.  The API now re-expresses its ONE host clock read in the
+stored ``timezone`` setting (``NestQuestSettings.household_now``).
+
+Every test pins the host clock to a UTC instant (the deployed
+container's zone) and sets the household zone through the real admin
+``PATCH /api/v1/admin/settings`` route, then reads BOTH snapshot shapes:
+
+- one second before the 10:00 due time: NOT overdue (previously
+  flagged, because 13:59:59 UTC > 10:00);
+- exactly at 10:00:00: NOT overdue (the builder's strict
+  ``now.time() > due`` convention);
+- one second after: overdue;
+- 23:30 household time, already the next day in UTC: ``today_iso`` is
+  still the household's day.
+
+An unset zone keeps the historical host-local behaviour, and the
+missed-sweep scheduler waits for the rollover in household time.
+"""
+from __future__ import annotations
+
+import asyncio
+import datetime
+import importlib
+from types import SimpleNamespace
+from zoneinfo import ZoneInfo
+
+import pytest
+
+from api import routes_admin, routes_panel
+from api import scheduler as scheduler_module
+from api.database import _executor
+from api.scheduler import MissedSweepScheduler, _delay_seconds
+from tests.admin_jwt_harness import (
+    ADMIN_KEY,
+    KID,
+    AdminRunner,
+    jwks_for,
+    make_token,
+)
+from tests.test_api_panel import _seed_household
+
+_settings = importlib.import_module("nestquest_core.settings")
+_settings_store = importlib.import_module("nestquest_core.settings_store")
+_core_db = importlib.import_module("nestquest_core.db")
+_core_migrations = importlib.import_module("nestquest_core.migrations")
+
+#: The panel service token the admin harness app is configured with.
+HARNESS_PANEL_TOKEN = "admin-test-panel-token"
+
+UTC = ZoneInfo("UTC")
+HOUSEHOLD_ZONE = "America/New_York"
+
+#: A fixed household day on Eastern Daylight Time (UTC-4).
+TODAY = datetime.date(2026, 9, 26)
+
+
+def _utc(hour: int, minute: int, second: int = 0, *, day: int = 26):
+    """An aware UTC instant on September ``day`` 2026."""
+    return datetime.datetime(2026, 9, day, hour, minute, second, tzinfo=UTC)
+
+
+def _admin_headers() -> dict[str, str]:
+    return {"Authorization": f"Bearer {make_token()}"}
+
+
+def _panel_headers() -> dict[str, str]:
+    return {"Authorization": f"Bearer {HARNESS_PANEL_TOKEN}"}
+
+
+@pytest.fixture
+async def household(temp_db_path: str, monkeypatch) -> SimpleNamespace:
+    """The seeded household on the admin-plane app, host clock pinnable.
+
+    Ada's open "Pack bag" quest is due 10:00 on :data:`TODAY`.  Both
+    routes' host clock read returns ``clock["now"]`` (a UTC instant).
+    """
+    seed = await _seed_household(temp_db_path, TODAY, _utc(16, 0))
+    clock = {"now": _utc(12, 0)}
+    monkeypatch.setattr(routes_admin, "_local_now", lambda: clock["now"])
+    monkeypatch.setattr(routes_panel, "_local_now", lambda: clock["now"])
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner as client:
+        yield SimpleNamespace(client=client, seed=seed, clock=clock)
+
+
+async def _set_zone(household: SimpleNamespace, zone: str) -> None:
+    response = await household.client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": zone},
+        headers=_admin_headers(),
+    )
+    assert response.status_code == 200
+    assert response.json()["timezone"] == zone
+
+
+async def _pack_bag(household: SimpleNamespace, plane: str) -> tuple[str, dict]:
+    """Return ``(today_iso, Ada's Pack bag instance)`` from one snapshot."""
+    headers = _admin_headers() if plane == "admin" else _panel_headers()
+    response = await household.client.get(
+        f"/api/v1/{plane}/snapshot", headers=headers
+    )
+    assert response.status_code == 200
+    body = response.json()
+    ada = next(
+        child
+        for child in body["children"]
+        if child["child_id"] == household.seed.ada.id
+    )
+    (instance,) = ada["instances"]
+    assert instance["title"] == "Pack bag"
+    assert instance["due_time"] == "10:00"
+    return body["today_iso"], instance
+
+
+@pytest.mark.parametrize("plane", ["panel", "admin"])
+@pytest.mark.parametrize(
+    ("host_now", "overdue"),
+    [
+        # 09:59:59 EDT — the pre-fix code compared 13:59:59 (UTC) > 10:00.
+        (_utc(13, 59, 59), False),
+        # 10:00:00 EDT exactly — strict ``>``: not yet overdue.
+        (_utc(14, 0, 0), False),
+        # 10:00:01 EDT — overdue.
+        (_utc(14, 0, 1), True),
+    ],
+    ids=["before-due", "at-due", "after-due"],
+)
+async def test_overdue_boundary_uses_household_zone(
+    household: SimpleNamespace,
+    plane: str,
+    host_now: datetime.datetime,
+    overdue: bool,
+) -> None:
+    await _set_zone(household, HOUSEHOLD_ZONE)
+    household.clock["now"] = host_now
+    today_iso, instance = await _pack_bag(household, plane)
+    assert today_iso == TODAY.isoformat()
+    assert instance["state"] == "open"
+    assert instance["overdue"] is overdue
+
+
+@pytest.mark.parametrize("plane", ["panel", "admin"])
+async def test_household_day_survives_utc_midnight(
+    household: SimpleNamespace, plane: str
+) -> None:
+    """23:30 EDT is already tomorrow in UTC; the household day is today."""
+    await _set_zone(household, HOUSEHOLD_ZONE)
+    household.clock["now"] = _utc(3, 30, day=27)
+    today_iso, instance = await _pack_bag(household, plane)
+    assert today_iso == TODAY.isoformat()
+    assert instance["overdue"] is True
+
+
+@pytest.mark.parametrize("plane", ["panel", "admin"])
+async def test_unset_zone_keeps_host_local_time(
+    household: SimpleNamespace, plane: str
+) -> None:
+    """Backward compatible: no stored zone reads the host clock as-is."""
+    household.clock["now"] = _utc(13, 59, 59)
+    today_iso, instance = await _pack_bag(household, plane)
+    assert today_iso == TODAY.isoformat()
+    assert instance["overdue"] is True
+
+
+async def test_panel_completion_on_time_uses_household_zone(
+    household: SimpleNamespace,
+) -> None:
+    """A 09:30 EDT tap on a 10:00 quest is on time (13:30 UTC is not)."""
+    await _set_zone(household, HOUSEHOLD_ZONE)
+    household.clock["now"] = _utc(13, 30)
+    seed = household.seed
+    response = await household.client.post(
+        f"/api/v1/panel/instances/{seed.pack_bag_instance.id}/complete",
+        headers=_panel_headers(),
+        json={"actor_child_id": seed.ada.id},
+    )
+    assert response.status_code == 200
+    _today_iso, instance = await _pack_bag(household, "admin")
+    assert instance["state"] == "completed"
+    assert instance["on_time"] is True
+
+
+async def test_invalid_zone_is_rejected(household: SimpleNamespace) -> None:
+    response = await household.client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": "Mars/Olympus_Mons"},
+        headers=_admin_headers(),
+    )
+    assert response.status_code == 422
+    assert "timezone" in str(response.json()["detail"])
+    reread = await household.client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert reread.json()["timezone"] == ""
+
+
+# --- the settings object ---------------------------------------------------
+
+
+def test_settings_timezone_defaults_to_host_local() -> None:
+    settings = _settings.NestQuestSettings()
+    assert settings.timezone == ""
+    instant = _utc(13, 0)
+    assert settings.household_now(instant) is instant
+
+
+def test_settings_household_now_converts_the_same_instant() -> None:
+    settings = _settings.NestQuestSettings(timezone=HOUSEHOLD_ZONE)
+    local = settings.household_now(_utc(13, 0))
+    assert local == _utc(13, 0)
+    assert (local.date(), local.time()) == (TODAY, datetime.time(9, 0))
+
+
+@pytest.mark.parametrize("value", ["Mars/Olympus_Mons", "../etc/passwd", 5, None])
+def test_settings_rejects_invalid_timezone(value: object) -> None:
+    with pytest.raises(ValueError, match="timezone"):
+        _settings.NestQuestSettings(timezone=value)
+
+
+def test_from_options_reads_and_resiliently_defaults_timezone() -> None:
+    assert (
+        _settings.NestQuestSettings.from_options(
+            {"timezone": HOUSEHOLD_ZONE}
+        ).timezone
+        == HOUSEHOLD_ZONE
+    )
+    assert _settings.NestQuestSettings.from_options({}).timezone == ""
+    assert (
+        _settings.NestQuestSettings.from_options_resilient(
+            {"timezone": "Nowhere/Land", "horizon_days": 9}
+        ).timezone
+        == ""
+    )
+
+
+def test_settings_timezone_configured_defaults_false_and_is_strict() -> None:
+    assert _settings.NestQuestSettings().timezone_configured is False
+    assert _settings.NestQuestSettings.from_options({}).timezone_configured is False
+    assert (
+        _settings.NestQuestSettings.from_options(
+            {"timezone_configured": True}
+        ).timezone_configured
+        is True
+    )
+    for value in ("true", 1, None):
+        with pytest.raises(ValueError, match="timezone_configured"):
+            _settings.NestQuestSettings(timezone_configured=value)
+        if value is not None:
+            with pytest.raises(ValueError):
+                _settings.NestQuestSettings.from_options(
+                    {"timezone_configured": value}
+                )
+
+
+# --- the missed-sweep scheduler ----------------------------------------------
+
+
+async def test_scheduler_waits_for_rollover_in_household_time(
+    temp_db_path: str,
+) -> None:
+    """09:00 EDT (13:00 UTC) to a 10:05 rollover is 65 minutes away."""
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        await _settings_store.update_settings(
+            database,
+            {"day_rollover_time": "10:05", "timezone": HOUSEHOLD_ZONE},
+        )
+        delays: list[float] = []
+        first_sleep = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            first_sleep.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(first_sleep.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        assert delays == [pytest.approx(65 * 60)]
+    finally:
+        await database.close()
+
+
+# --- the rollover delay across DST (America/New_York) ------------------------
+
+NEW_YORK = ZoneInfo("America/New_York")
+
+
+def _ny(*args: int, fold: int = 0) -> datetime.datetime:
+    return datetime.datetime(*args, tzinfo=NEW_YORK, fold=fold)
+
+
+@pytest.mark.parametrize(
+    ("now", "target", "expected"),
+    [
+        # Ordinary EDT day: 09:00 -> 10:05 is 65 minutes.
+        (_ny(2026, 6, 15, 9, 0), datetime.time(10, 5), 65 * 60),
+        # An equal time schedules for tomorrow (strictly after now).
+        (_ny(2026, 6, 15, 10, 5), datetime.time(10, 5), 86400),
+        # Spring-forward: 01:00 EST -> 03:00 EDT is one real hour.
+        (_ny(2026, 3, 8, 1, 0), datetime.time(3, 0), 3600),
+        # Fall-back: 00:30 EDT -> 02:00 EST is two and a half real hours.
+        (_ny(2026, 11, 1, 0, 30), datetime.time(2, 0), 9000),
+        # Nonexistent 02:30 on spring-forward day: the first valid instant
+        # at/after it is 03:00 EDT, one real hour after 01:00 EST.
+        (_ny(2026, 3, 8, 1, 0), datetime.time(2, 30), 3600),
+        # Ambiguous 01:30 on fall-back day resolves to the FIRST (EDT)
+        # occurrence: from 00:30 EDT that is one real hour.
+        (_ny(2026, 11, 1, 0, 30), datetime.time(1, 30), 3600),
+        # Already past the first 01:30 (now is 01:15 EST, the repeated
+        # hour): not the second occurrence, but tomorrow's 01:30 EST.
+        (_ny(2026, 11, 1, 1, 15, fold=1), datetime.time(1, 30), 87300),
+    ],
+)
+def test_delay_seconds_is_true_elapsed_time_across_dst(
+    now: datetime.datetime, target: datetime.time, expected: float
+) -> None:
+    assert _delay_seconds(target, now) == expected
+
+
+# --- the Home Assistant-reported zone (task 6351b36d) ------------------------
+#
+# The deployed household never set ``timezone``, so the UTC API host marked
+# morning quests overdue.  The integration reports Home Assistant's
+# ``time_zone`` on every panel request; while the admin has not chosen a
+# zone the API adopts it (persisted, so the scheduler and the admin plane
+# follow too), and an explicit admin choice still wins.
+
+
+def _reporting_panel_headers(zone: str) -> dict[str, str]:
+    return {**_panel_headers(), "X-NestQuest-Timezone": zone}
+
+
+async def _panel_pack_bag(
+    household: SimpleNamespace, zone: str
+) -> tuple[str, dict]:
+    response = await household.client.get(
+        "/api/v1/panel/snapshot", headers=_reporting_panel_headers(zone)
+    )
+    assert response.status_code == 200
+    body = response.json()
+    ada = next(
+        child
+        for child in body["children"]
+        if child["child_id"] == household.seed.ada.id
+    )
+    (instance,) = ada["instances"]
+    return body["today_iso"], instance
+
+
+async def _stored_settings(household: SimpleNamespace) -> dict:
+    response = await household.client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert response.status_code == 200
+    return response.json()
+
+
+async def test_unset_zone_adopts_reported_zone_for_overdue(
+    household: SimpleNamespace,
+) -> None:
+    """09:59:59 EDT on a UTC host, zone never set: NOT overdue."""
+    household.clock["now"] = _utc(13, 59, 59)
+    today_iso, instance = await _panel_pack_bag(household, HOUSEHOLD_ZONE)
+    assert today_iso == TODAY.isoformat()
+    assert instance["overdue"] is False
+    # Persisted as the automatic (not admin-chosen) household zone, so
+    # the admin plane and the missed-sweep scheduler read it too.
+    stored = await _stored_settings(household)
+    assert stored["timezone"] == HOUSEHOLD_ZONE
+    assert stored["timezone_configured"] is False
+    _today, admin_instance = await _pack_bag(household, "admin")
+    assert admin_instance["overdue"] is False
+
+
+async def test_unset_zone_adopts_reported_zone_for_today(
+    household: SimpleNamespace,
+) -> None:
+    """23:30 EDT is tomorrow in UTC; the household day is still today."""
+    household.clock["now"] = _utc(3, 30, day=27)
+    today_iso, _instance = await _panel_pack_bag(household, HOUSEHOLD_ZONE)
+    assert today_iso == TODAY.isoformat()
+
+
+async def test_reported_zone_completion_is_on_time(
+    household: SimpleNamespace,
+) -> None:
+    """A 09:30 EDT tap with the zone never set is on time."""
+    household.clock["now"] = _utc(13, 30)
+    seed = household.seed
+    response = await household.client.post(
+        f"/api/v1/panel/instances/{seed.pack_bag_instance.id}/complete",
+        headers=_reporting_panel_headers(HOUSEHOLD_ZONE),
+        json={"actor_child_id": seed.ada.id},
+    )
+    assert response.status_code == 200
+    _today_iso, instance = await _pack_bag(household, "admin")
+    assert instance["on_time"] is True
+
+
+async def test_reported_zone_follows_home_assistant_changes(
+    household: SimpleNamespace,
+) -> None:
+    """An automatically adopted zone tracks a later Home Assistant change."""
+    await _panel_pack_bag(household, "America/Chicago")
+    await _panel_pack_bag(household, HOUSEHOLD_ZONE)
+    assert (await _stored_settings(household))["timezone"] == HOUSEHOLD_ZONE
+
+
+async def _adopt_new_york(household: SimpleNamespace) -> None:
+    """Prove automatic adoption first, so later assertions can't pass
+    on code that ignores the reported zone altogether."""
+    await _panel_pack_bag(household, HOUSEHOLD_ZONE)
+    stored = await _stored_settings(household)
+    assert stored["timezone"] == HOUSEHOLD_ZONE
+    assert stored["timezone_configured"] is False
+
+
+@pytest.mark.parametrize("chosen", ["America/Los_Angeles", ""])
+async def test_admin_chosen_zone_wins_over_reported_zone(
+    household: SimpleNamespace, chosen: str
+) -> None:
+    await _adopt_new_york(household)
+    response = await household.client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": chosen, "timezone_configured": True},
+        headers=_admin_headers(),
+    )
+    assert response.status_code == 200
+    # A conflicting report is no longer adopted.
+    await _panel_pack_bag(household, "America/Chicago")
+    stored = await _stored_settings(household)
+    assert stored["timezone"] == chosen
+    assert stored["timezone_configured"] is True
+
+
+async def test_invalid_reported_zone_is_ignored(
+    household: SimpleNamespace,
+) -> None:
+    await _adopt_new_york(household)
+    household.clock["now"] = _utc(13, 59, 59)
+    _today_iso, instance = await _panel_pack_bag(household, "Mars/Olympus_Mons")
+    # Still read in the adopted zone: 09:59:59 EDT is not overdue.
+    assert instance["overdue"] is False
+    assert (await _stored_settings(household))["timezone"] == HOUSEHOLD_ZONE
+
+
+# --- the scheduler follows an adopted zone (task 6351b36d) -------------------
+#
+# On a UTC host with no stored zone the scheduler first plans for UTC
+# midnight; a zone adopted while it sleeps must move the sweep to the
+# household's midnight rather than sweep at 20:00 EDT.
+
+#: 13:00 UTC (09:00 EDT) to UTC midnight.
+_UTC_MIDNIGHT_DELAY = 11 * 3600
+#: 13:00 UTC (09:00 EDT) to New York midnight (04:00 UTC).
+_NEW_YORK_MIDNIGHT_DELAY = 15 * 3600
+
+
+async def test_scheduler_replans_when_panel_adopts_zone_while_sleeping(
+    temp_db_path: str,
+) -> None:
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner as client:
+        app_state = runner.app.state
+        await app_state.sweep_scheduler.stop()
+        delays: list[float] = []
+        slept = asyncio.Condition()
+
+        async def sleep_stub(seconds: float) -> None:
+            async with slept:
+                delays.append(seconds)
+                slept.notify_all()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            app_state.db.database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        app_state.sweep_scheduler = scheduler
+        scheduler.start()
+        try:
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 1), timeout=5
+                )
+            response = await client.get(
+                "/api/v1/panel/snapshot",
+                headers=_reporting_panel_headers(HOUSEHOLD_ZONE),
+            )
+            assert response.status_code == 200
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 2), timeout=5
+                )
+        finally:
+            await scheduler.stop()
+    assert delays == [
+        pytest.approx(_UTC_MIDNIGHT_DELAY),
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+    ]
+
+
+async def test_scheduler_rechecks_settings_before_sweeping(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """A zone stored without a wake-up still stops the stale sweep."""
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        sweeps: list[datetime.date] = []
+
+        async def sweep_stub(_database, *, today):
+            sweeps.append(today)
+            return []
+
+        monkeypatch.setattr(
+            scheduler_module.core_sweep, "run_missed_sweep", sweep_stub
+        )
+        delays: list[float] = []
+        replanned = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            if len(delays) == 1:
+                # The UTC rollover "arrives" after the zone was stored
+                # behind the scheduler's back.
+                await _settings_store.adopt_reported_timezone(
+                    database, HOUSEHOLD_ZONE
+                )
+                return
+            replanned.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(replanned.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        assert sweeps == []
+        assert delays == [
+            pytest.approx(_UTC_MIDNIGHT_DELAY),
+            pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+        ]
+    finally:
+        await database.close()
+
+
+# --- adoption is serialised with planning and sweeping (TZ-003) --------------
+#
+# An adoption racing the loop's own settings reads must never leave a
+# stale plan behind.  Each test holds the loop at one of its reads and
+# issues a real panel adoption there; when the scheduler's settings lock
+# is held at that point the adoption provably cannot commit until the
+# loop moves on, otherwise it is awaited to commit inside the window.
+
+
+def _hold_scheduler_read(monkeypatch, scheduler, nth: int, during):
+    """Run ``during(settings)`` inside the scheduler task's ``nth`` read."""
+    real_load = _settings_store.load_settings
+    reads = {"count": 0}
+
+    async def load_settings(database):
+        settings = await real_load(database)
+        if asyncio.current_task() is scheduler._task:
+            reads["count"] += 1
+            if reads["count"] == nth:
+                await during(settings)
+        return settings
+
+    monkeypatch.setattr(
+        scheduler_module.core_settings_store, "load_settings", load_settings
+    )
+    return real_load
+
+
+async def _adopt_via(client, zone: str) -> None:
+    response = await client.get(
+        "/api/v1/panel/snapshot", headers=_reporting_panel_headers(zone)
+    )
+    assert response.status_code == 200
+
+
+async def _adopt_inside_read(client, scheduler, zone: str) -> asyncio.Task:
+    """Start a panel adoption of ``zone``; let it commit unless serialised."""
+    adoption = asyncio.create_task(
+        client.get(
+            "/api/v1/panel/snapshot", headers=_reporting_panel_headers(zone)
+        )
+    )
+    lock = getattr(scheduler, "settings_lock", None)
+    if lock is None or not lock.locked():
+        await adoption
+    return adoption
+
+
+async def test_scheduler_follows_successive_zone_changes(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """New York -> UTC -> New York while the re-plan read is in flight."""
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner as client:
+        app_state = runner.app.state
+        await app_state.sweep_scheduler.stop()
+        delays: list[float] = []
+        slept = asyncio.Condition()
+
+        async def sleep_stub(seconds: float) -> None:
+            async with slept:
+                delays.append(seconds)
+                slept.notify_all()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            app_state.db.database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        app_state.sweep_scheduler = scheduler
+        await _adopt_via(client, HOUSEHOLD_ZONE)
+        adoptions: list[asyncio.Task] = []
+
+        async def back_to_new_york(_settings) -> None:
+            adoptions.append(
+                await _adopt_inside_read(client, scheduler, HOUSEHOLD_ZONE)
+            )
+
+        # Read 1 plans New York; read 2 is the re-plan after UTC.
+        _hold_scheduler_read(monkeypatch, scheduler, 2, back_to_new_york)
+        scheduler.start()
+        try:
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 1), timeout=5
+                )
+            await _adopt_via(client, "UTC")
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 3), timeout=5
+                )
+            (adoption,) = adoptions
+            assert (await adoption).status_code == 200
+        finally:
+            await scheduler.stop()
+    # The in-flight read planned UTC; the New York adoption that followed
+    # it woke the wait, so the scheduler sleeps on New York midnight.
+    assert delays == [
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+        pytest.approx(_UTC_MIDNIGHT_DELAY),
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+    ]
+
+
+async def test_adoption_after_presweep_check_cannot_precede_the_sweep(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """No sweep runs once an adoption has replaced its plan."""
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner as client:
+        app_state = runner.app.state
+        await app_state.sweep_scheduler.stop()
+        delays: list[float] = []
+        replanned = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            if len(delays) == 1:
+                return  # the UTC rollover arrives
+            replanned.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            app_state.db.database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        app_state.sweep_scheduler = scheduler
+        adoptions: list[asyncio.Task] = []
+
+        async def adopt_new_york(_settings) -> None:
+            adoptions.append(
+                await _adopt_inside_read(client, scheduler, HOUSEHOLD_ZONE)
+            )
+
+        # Read 1 plans UTC; read 2 is the pre-sweep re-check.
+        real_load = _hold_scheduler_read(
+            monkeypatch, scheduler, 2, adopt_new_york
+        )
+        swept_under: list[str] = []
+
+        async def sweep_stub(database, *, today):
+            swept_under.append((await real_load(database)).timezone)
+            return []
+
+        monkeypatch.setattr(
+            scheduler_module.core_sweep, "run_missed_sweep", sweep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(replanned.wait(), timeout=5)
+            (adoption,) = adoptions
+            assert (await adoption).status_code == 200
+        finally:
+            await scheduler.stop()
+    # The sweep ran for the UTC plan with UTC still stored, never after
+    # New York had been adopted; the next plan is New York midnight.
+    assert swept_under == [""]
+    assert delays == [
+        pytest.approx(_UTC_MIDNIGHT_DELAY),
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+    ]
+
+
+# --- the wait's child tasks (TZ-004) ------------------------------------------
+
+
+async def test_failed_sleep_is_retried_not_swept(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """A sleep that raises backs off and re-plans; nothing is swept."""
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        sweeps: list[datetime.date] = []
+
+        async def sweep_stub(_database, *, today):
+            sweeps.append(today)
+            return []
+
+        monkeypatch.setattr(
+            scheduler_module.core_sweep, "run_missed_sweep", sweep_stub
+        )
+        delays: list[float] = []
+        replanned = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            if len(delays) == 1:
+                raise RuntimeError("timer failed")
+            if len(delays) == 2:
+                return  # the retry backoff
+            replanned.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(replanned.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        assert sweeps == []
+        assert delays == [
+            pytest.approx(_UTC_MIDNIGHT_DELAY),
+            scheduler_module._RETRY_BACKOFF_SECONDS,
+            pytest.approx(_UTC_MIDNIGHT_DELAY),
+        ]
+    finally:
+        await database.close()
+
+
+async def test_stop_waits_for_the_sleep_to_finish_cancelling(
+    temp_db_path: str,
+) -> None:
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        sleeping = asyncio.Event()
+        sleepers: list[asyncio.Task] = []
+        cleaned_up: list[bool] = []
+
+        async def sleep_stub(_seconds: float) -> None:
+            sleepers.append(asyncio.current_task())
+            sleeping.set()
+            try:
+                await asyncio.Event().wait()
+            finally:
+                # Cancellation cleanup that takes a loop turn.
+                await asyncio.sleep(0)
+                cleaned_up.append(True)
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(sleeping.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        (sleeper,) = sleepers
+        assert sleeper.done()
+        assert cleaned_up == [True]
+    finally:
+        await database.close()

tests/test_coordinator.py

@@ -686,6 +686,8 @@ async def test_coordinator_configured_token_builds_real_client(
         hass, entry, session_factory=_session_factory
     )
     assert isinstance(real_client, NestQuestApiClient)
+    # Home Assistant's zone is reported to the API (task 6351b36d).
+    assert real_client._household_timezone == hass.config.time_zone
 
     set_coordinator_client(entry, real_client)
     assert await async_setup_entry(hass, entry) is True

tests/test_dao_rules.py

@@ -996,8 +996,9 @@ def test_definition_set_active_missing_returns_zero(tmp_path) -> None:
     assert _with_db(tmp_path, "definition-set-active-missing.db")(_body) == 0
 
 
-def test_definition_no_delete_method_exists(tmp_path) -> None:
-    """Guardrail: definitions are deactivated, never hard-deleted."""
+def test_definition_only_delete_method_is_history_guarded(tmp_path) -> None:
+    """Guardrail: the ONLY definition delete path is the history-guarded
+    one (owner decision 2026-09-26); there is no unconditional delete."""
     async def _body(database, rules, definitions, children, child):
         import inspect
 
@@ -1008,7 +1009,9 @@ def test_definition_no_delete_method_exists(tmp_path) -> None:
             )
         }
         assert "delete" not in methods
-        assert not any(name.startswith("delete") for name in methods)
+        assert {
+            name for name in methods if name.startswith("delete")
+        } == {"delete_if_no_history"}
         return methods
 
     _with_db(tmp_path, "definition-no-delete.db")(_body)

tests/test_panel_cards.py

@@ -302,14 +302,15 @@ def test_quest_log_entrances_use_the_design_timing_and_easing() -> None:
         ".quest.tappable:active",
         "button.complete:active",
         "button.confirm-button:active",
+        "button.return:active",
     ):
         start = style.index(selector)
         block = style[start : style.index("}", start)]
         assert "transform: scale(0.98);" in block, selector
     assert (
         style.count("transition: transform var(--nq-dur-micro) var(--nq-ease-out);")
-        == 3
-    )  # quest card, Complete button, confirm buttons
+        == 4
+    )  # quest card, Complete button, confirm buttons, header return control
     board_style = _style_literal(_read(PARTY_BOARD), STYLE_CONSTANTS[PARTY_BOARD])
     start = board_style.index("button.plate:active")
     block = board_style[start : board_style.index("}", start)]
@@ -411,6 +412,36 @@ def test_panel_hard_rules_hold_in_the_card_sources() -> None:
     assert "@click" not in sealed_template
 
 
+def test_party_board_hint_clears_the_dock() -> None:
+    """PANEL-SPEC §2/§2.3: the hint line reads fully above the dock at
+    1920x1080. The hint's line box (top + font-size x line-height) must
+    end above the dock's top edge (1080 - bottom inset - dock height)
+    with a visible gap, at the 27px/600 design size. The hint is a <p>,
+    so its user-agent 1em top margin must be reset or it shifts the box
+    down by a whole font-size."""
+    style = _style_literal(_read(PARTY_BOARD), STYLE_CONSTANTS[PARTY_BOARD])
+    rules = {selector.strip(): body for selector, body in _css_rules(style)}
+    sizes = _size_tokens(_read(REWARD_TOKENS))
+
+    def px(body: str, prop: str) -> float:
+        declared = re.search(rf"(?<![-\w]){prop}:\s*([^;]+);", body)
+        assert declared is not None, prop
+        value = _font_size_px(declared.group(1), sizes)
+        assert value is not None, f"{prop}: {declared.group(1)}"
+        return value
+
+    board, hint, dock = rules[".board"], rules[".hint"], rules[".dock"]
+    assert "margin: 0;" in hint
+    line_height = float(re.search(r"line-height:\s*([\d.]+);", hint).group(1))
+    hint_bottom = px(hint, "top") + px(hint, "font-size") * line_height
+    dock_top = px(board, "height") - px(dock, "bottom") - px(dock, "height")
+    assert px(dock, "height") == 84
+    assert px(dock, "bottom") == 46
+    assert hint_bottom + 12 <= dock_top, (hint_bottom, dock_top)
+    assert px(hint, "font-size") == 27
+    assert "font-weight: 600;" in hint
+
+
 def test_panel_text_sizes_respect_the_22px_floor() -> None:
     """PANEL-SPEC §1: no body text below 22px. Every font-size in the
     panel styles resolves against the panel size tokens or an explicit
@@ -570,6 +601,40 @@ def _render_party_board(
     return json.loads(completed.stdout)
 
 
+def test_party_board_wordmark_row_is_the_monogram_lockup() -> None:
+    """PANEL-SPEC §2 item 1: the wordmark row is rule · compass-rose
+    monogram · NestQuest · rule. The monogram is an inline SVG filled
+    with the brand gradient — the old d20 hexagon pair and its "20"
+    numerals are gone, and nothing is fetched from a remote URL or
+    embedded as a raster logo."""
+    source = _read(PARTY_BOARD)
+    assert "d20" not in _style_literal(source, STYLE_CONSTANTS[PARTY_BOARD])
+    assert 'class="d20' not in source
+    assert "HEXAGON_CLIP" not in source
+
+    html = _render_party_board(
+        {"type": "custom:nestquest-party-board-card"},
+        _three_child_states(),
+    )["html"]
+    row = re.search(r'<div class="wordmark-row">(.*?)</div>', html, re.DOTALL)
+    assert row is not None
+    row_html = row.group(1)
+    classes = re.findall(r'<(?:span|svg) class="([^"]+)"', row_html)
+    assert classes == ["rule", "monogram", "wordmark", "rule"]
+    assert '<svg class="monogram" viewBox="0 0 100 100" aria-hidden="true"' in row_html
+    assert "var(--nq-brand-blue)" in row_html
+    assert "var(--nq-brand-purple)" in row_html
+    assert ">N</text>" in row_html
+    assert ">NestQuest</span>" in row_html
+    assert "d20" not in row_html
+    assert "<img" not in row_html
+
+    bundle = _read(BUNDLE_PATH)
+    assert "d20-numeral\">20<" not in bundle
+    assert "data:image/png" not in bundle
+    assert not re.search(r"https?://", bundle)
+
+
 def test_party_board_renders_discovered_children_in_sort_order() -> None:
     """No child_order key: three plates render in the roster's sort
     order (the coordinator snapshot's order), one per child."""
@@ -764,6 +829,8 @@ def _render_quest_log(
     url: str,
     idle_ms: int | None = None,
     probe_ms: int | None = None,
+    tap_complete: int | None = None,
+    tap_return: bool = False,
 ) -> dict:
     """Render the built bundle's quest log and report its location.
 
@@ -787,6 +854,10 @@ def _render_quest_log(
         spec["idle_ms"] = idle_ms
     if probe_ms is not None:
         spec["probe_ms"] = probe_ms
+    if tap_complete is not None:
+        spec["tap_complete"] = tap_complete
+    if tap_return:
+        spec["tap_return"] = True
     completed = subprocess.run(
         ["node", str(QUEST_LOG_HARNESS)],
         input=json.dumps(spec),
@@ -856,6 +927,40 @@ def test_quest_log_idle_return_navigates_to_the_board() -> None:
     assert result["location"] == "/nestquest"
 
 
+def test_quest_log_return_control_navigates_to_the_board() -> None:
+    """PANEL-SPEC §3: the Quest Log header carries an explicit return
+    control labelled for a child. Tapping it takes the same path as the
+    idle return — the strategy-computed board_path (the dashboard root) —
+    without waiting out the idle window."""
+    generated = _generate_dashboard(
+        {}, _three_child_states(), url="http://homeassistant.local/nestquest"
+    )
+    result = _render_quest_log(
+        generated["views"][1]["cards"][0],
+        _three_child_states(),
+        url="http://homeassistant.local/nestquest/ada",
+        tap_return=True,
+    )
+    assert result["headline"] == "Ada's Quest Log"
+    assert result["returned"] == {"rendered": True, "label": "The Party"}
+    assert result["location"] == "/nestquest"
+
+
+def test_quest_log_return_control_follows_the_panel_hard_rules() -> None:
+    """The return control is a 72px button with :active feedback only,
+    lives in the header (never the dock), and reuses the idle return's
+    _returnToBoard navigation rather than a second mechanism."""
+    log = _read(QUEST_LOG)
+    style = _style_literal(log, STYLE_CONSTANTS[QUEST_LOG])
+    rules = {selector.strip(): body for selector, body in _css_rules(style)}
+    assert "height: var(--nq-p-button-height);" in rules["button.return"]
+    assert "transform: scale(0.98);" in rules["button.return:active"]
+    header = log[log.index("private _renderHeader") : log.index("private _renderColumn")]
+    assert 'class="return"' in header
+    assert "@click=${() => this._returnToBoard()}" in header
+    assert log.count("this._returnToBoard()") == 4
+
+
 def test_quest_complete_screen_returns_to_the_board_after_the_countdown() -> None:
     """The 1c screen renders with its countdown line and auto-returns to
     the strategy-computed board path when it reaches zero. The design
@@ -888,6 +993,196 @@ def test_quest_complete_screen_returns_to_the_board_after_the_countdown() -> Non
     assert result["location"] == "/nestquest"
 
 
+def test_tapping_complete_confirms_and_calls_the_service() -> None:
+    """Tapping an open quest's Complete opens the confirm dialog, and the
+    dialog's Complete calls nestquest.complete_quest with the panel actor.
+    With ``useDefineForClassFields`` on (the ES2022 default) the card's
+    reactive fields were emitted as native class fields that shadowed
+    Lit's accessors: ``_confirm`` changed but no re-render was scheduled,
+    so the dialog never opened and the tap did nothing."""
+    generated = _generate_dashboard(
+        {}, _three_child_states(), url="http://homeassistant.local/nestquest"
+    )
+    open_quest = {
+        "id": 42,
+        "definition_id": 7,
+        "child_id": 1,
+        "title": "Brush Teeth",
+        "icon": None,
+        "window": "morning",
+        "due_time": "08:15",
+        "state": "open",
+        "overdue": True,
+        "completed_at": None,
+        "on_time": None,
+    }
+    states = {
+        **_three_child_states(),
+        "sensor.nestquest_ada_quests_due_today": _state(
+            "1",
+            child_name="Ada",
+            child_id=1,
+            present=True,
+            instances=[open_quest],
+        ),
+    }
+    result = _render_quest_log(
+        generated["views"][1]["cards"][0],
+        states,
+        url="http://homeassistant.local/nestquest/ada",
+        tap_complete=open_quest["id"],
+    )
+    assert result["tap"]["dialog_opened"] is True
+    assert result["tap"]["service_calls"] == [
+        {
+            "domain": "nestquest",
+            "service": "complete_quest",
+            "data": {
+                "instance_id": open_quest["id"],
+                "actor": "panel",
+                "actor_child_id": open_quest["child_id"],
+            },
+        }
+    ]
+
+
+def test_card_build_keeps_lit_reactive_accessors() -> None:
+    """The frontend build must not emit class fields that shadow Lit's
+    reactive property accessors (Lit's documented TypeScript setting)."""
+    tsconfig = json.loads((FRONTEND_DIR / "tsconfig.json").read_text())
+    assert tsconfig["compilerOptions"]["useDefineForClassFields"] is False
+
+
+def test_quest_log_crest_keeps_its_shield_classes() -> None:
+    """PANEL-SPEC §3 header crest: a present child's crest renders as the
+    styled shield, not a bare span. Lit removes an attribute outright when
+    any interpolated part of it is ``nothing``, so a class written as
+    ``crest${away ? " away" : nothing}`` lost ``crest`` for every present
+    child and the header showed an unstyled sliver. The rendered markup
+    must carry ``class="crest"`` (present) and ``class="crest away"``
+    (away), each wrapping the face and initial."""
+    generated = _generate_dashboard(
+        {}, _three_child_states(), url="http://homeassistant.local/nestquest"
+    )
+    log_config = generated["views"][1]["cards"][0]
+    for slug, crest_class in (("ada", "crest"), ("bo", "crest away")):
+        result = _render_quest_log(
+            log_config,
+            _three_child_states(),
+            url=f"http://homeassistant.local/nestquest/{slug}",
+        )
+        header = result["html"][result["html"].index('<header class="header">') :]
+        crest = re.match(
+            r'<header class="header">\s*(?:<!--[^>]*-->\s*)*'
+            r'(?:<button class="return"[^>]*>.*?</button>\s*(?:<!--[^>]*-->\s*)*)?'
+            r'<span ([^>]*)>\s*'
+            r'<span class="crest-face">\s*<span class="initial">',
+            header,
+            re.DOTALL,
+        )
+        assert crest is not None, header[:600]
+        assert f'class="{crest_class}"' in crest.group(1), crest.group(1)
+
+
+def test_quest_log_meta_line_keeps_its_meta_class() -> None:
+    """An open quest's meta line is styled by ``.quest .meta`` (and
+    ``.quest .meta.late`` when overdue). Written as
+    ``meta ${late ? "late" : nothing}``, Lit dropped the whole class
+    attribute for every quest that was not late, leaving the due line
+    unstyled. The rendered markup must carry ``class="meta"`` on time and
+    ``class="meta late"`` overdue."""
+    generated = _generate_dashboard(
+        {}, _three_child_states(), url="http://homeassistant.local/nestquest"
+    )
+
+    def quest(instance_id: int, title: str, overdue: bool) -> dict:
+        return {
+            "id": instance_id,
+            "definition_id": instance_id,
+            "child_id": 1,
+            "title": title,
+            "icon": None,
+            "window": "morning",
+            "due_time": "08:15",
+            "state": "open",
+            "overdue": overdue,
+            "completed_at": None,
+            "on_time": None,
+        }
+
+    states = {
+        **_three_child_states(),
+        "sensor.nestquest_ada_quests_due_today": _state(
+            "2",
+            child_name="Ada",
+            child_id=1,
+            present=True,
+            instances=[
+                quest(41, "Make Bed", overdue=False),
+                quest(42, "Brush Teeth", overdue=True),
+            ],
+        ),
+    }
+    result = _render_quest_log(
+        generated["views"][1]["cards"][0],
+        states,
+        url="http://homeassistant.local/nestquest/ada",
+    )
+    metas = {}
+    for card in result["html"].split('data-instance-id="')[1:]:
+        meta = re.search(
+            r'<span class="quest-title">.*?</span>'
+            r"\s*(?:<!--[^>]*-->\s*)*<span([^>]*)>",
+            card,
+            re.S,
+        )
+        assert meta is not None, card[:800]
+        metas[card[: card.index('"')]] = meta.group(1)
+    assert set(metas) == {"41", "42"}, metas
+    assert metas["41"].strip() == 'class="meta"', metas["41"]
+    assert metas["42"].strip() == 'class="meta late"', metas["42"]
+
+
+def test_quest_log_crest_matches_the_spec_geometry() -> None:
+    """PANEL-SPEC §3 header crest: 96x110 shield, 4px ring of
+    rgba(255,255,255,.22) around the --nq-p-crest face, 44px/700 display
+    initial in full-opacity white; away swaps only the face gradient.
+    jsdom cannot lay out, so this pins the stylesheet the rendered test
+    above shows is applied."""
+    source = QUEST_LOG.read_text(encoding="utf-8")
+
+    def rule(selector: str) -> str:
+        found = re.search(
+            r"\n  " + re.escape(selector) + r" \{(.*?)\n  \}", source, re.DOTALL
+        )
+        assert found is not None, selector
+        return found.group(1)
+
+    crest = rule(".crest")
+    for decl in (
+        "width: 96px;",
+        "height: 110px;",
+        "padding: 4px;",
+        "clip-path: ${unsafeCSS(SHIELD_CLIP)};",
+        "background: rgba(255, 255, 255, 0.22);",
+    ):
+        assert decl in crest, decl
+    face = rule(".crest-face")
+    assert "background: var(--nq-p-crest);" in face
+    assert "clip-path: ${unsafeCSS(SHIELD_CLIP)};" in face
+    initial = rule(".crest .initial")
+    for decl in (
+        "font-family: var(--nq-p-font-display);",
+        "font-size: 44px;",
+        "font-weight: 700;",
+        "color: #ffffff;",
+    ):
+        assert decl in initial, decl
+    assert "opacity" not in initial
+    away = rule(".crest.away .crest-face")
+    assert away.strip() == "background: var(--nq-p-crest-away);"
+
+
 # --- Quest card icons (definition icon on the open tile) ---------------------
 
 

tests/test_quest_definitions.py

@@ -22,8 +22,10 @@ from custom_components.nestquest.core.db import NestQuestDatabase
 from custom_components.nestquest.core.migrations import apply_migrations
 from custom_components.nestquest.core.quest_definitions import (
     CreatedQuestDefinition,
+    DeletedQuestDefinition,
     assign_child,
     create_quest_definition,
+    delete_quest_definition,
     edit_quest_definition,
     list_active_definitions,
     list_definitions_firing_on,
@@ -2126,3 +2128,188 @@ def test_wrappers_forward_horizon_days(tmp_path, mode) -> None:
         return None
 
     _with_db(tmp_path, f"wrapper-horizon-{mode}.db")(_body)
+
+
+# ---------------------------------------------------------------------------
+# delete_quest_definition: hybrid delete (owner decision 2026-09-26)
+# ---------------------------------------------------------------------------
+
+
+async def _count(database, sql, definition_id) -> int:
+    row = await database.fetch_one(sql, (definition_id,))
+    return row[0]
+
+
+def test_delete_without_history_hard_deletes_everything(tmp_path) -> None:
+    """No completion event on any instance: the definition, its
+    instances, assignees, windows and unreferenced rule are all gone."""
+    async def _body(database, children, rules, definitions, child):
+        created = await create_quest_definition(
+            database,
+            "Brush teeth",
+            _daily_rule(),
+            [child.id],
+            ["morning", "evening"],
+        )
+        definition_id = created.definition.id
+        rule_id = created.definition.schedule_rule_id
+        instances_sql = (
+            "SELECT COUNT(*) FROM quest_instances WHERE definition_id = ?"
+        )
+        # Create materialized future instances, so the delete has
+        # instance rows to remove (not just an empty table).
+        assert await _count(database, instances_sql, definition_id) > 0
+
+        result = await delete_quest_definition(database, definition_id)
+
+        assert result == DeletedQuestDefinition(
+            definition_id=definition_id,
+            deleted=True,
+            retired=False,
+            definition=None,
+        )
+        assert await definitions.get(definition_id) is None
+        assert await rules.get(rule_id) is None
+        assert await _count(database, instances_sql, definition_id) == 0
+        for table in (
+            "quest_definition_assignees",
+            "quest_definition_windows",
+        ):
+            assert await _count(
+                database,
+                f"SELECT COUNT(*) FROM {table} WHERE definition_id = ?",
+                definition_id,
+            ) == 0
+        # The child itself is untouched.
+        assert (await children.get(child.id)) is not None
+        return None
+
+    _with_db(tmp_path, "delete-no-history.db")(_body)
+
+
+def test_delete_without_history_keeps_a_shared_rule(tmp_path) -> None:
+    """The rule is deleted only when no other definition references it."""
+    async def _body(database, children, rules, definitions, child):
+        rule = await rules.create("daily", "2026-09-14")
+        first = await definitions.create(
+            "First", rule.id, NOW, assignee_child_ids=[child.id]
+        )
+        second = await definitions.create(
+            "Second", rule.id, NOW, assignee_child_ids=[child.id]
+        )
+
+        result = await delete_quest_definition(database, first.id)
+
+        assert result.deleted is True
+        assert await definitions.get(first.id) is None
+        assert await definitions.get(second.id) is not None
+        assert await rules.get(rule.id) is not None
+        return None
+
+    _with_db(tmp_path, "delete-shared-rule.db")(_body)
+
+
+def test_delete_with_history_retires_and_preserves_everything(
+    tmp_path,
+) -> None:
+    """A completion event on ANY instance: the definition is retired
+    (deactivated) and its row, rule, assignees, windows and completion
+    history all remain.  The completed instance survives; only future
+    UNCOMPLETED instances are cleared by the deactivation's regeneration."""
+    async def _body(database, children, rules, definitions, child):
+        created = await create_quest_definition(
+            database, "Brush teeth", _daily_rule(), [child.id], ["morning"]
+        )
+        definition_id = created.definition.id
+        rule_id = created.definition.schedule_rule_id
+        instances = QuestInstancesDao(database)
+        events = CompletionEventsDao(database)
+        instance = await instances.upsert(
+            definition_id, child.id, _today_iso(), NOW, window="morning"
+        )
+        event = await events.append(
+            instance.id,
+            child.id,
+            "completed",
+            "user",
+            NOW,
+            True,
+            actor_user_id="admin-1",
+        )
+
+        result = await delete_quest_definition(database, definition_id)
+
+        assert result.deleted is False
+        assert result.retired is True
+        assert result.definition_id == definition_id
+        assert isinstance(result.definition, CreatedQuestDefinition)
+        assert result.definition.definition.is_active is False
+        stored = await definitions.get(definition_id)
+        assert stored is not None
+        assert stored.is_active is False
+        assert await rules.get(rule_id) is not None
+        assert [c.id for c in await definitions.list_assignees(
+            definition_id
+        )] == [child.id]
+        assert [w.window for w in await definitions.list_windows(
+            definition_id
+        )] == ["morning"]
+        assert await instances.get_by_id(instance.id) == instance
+        assert await events.list_by_instance(instance.id) == [event]
+        return None
+
+    _with_db(tmp_path, "delete-with-history.db")(_body)
+
+
+def test_delete_with_uncompleted_history_still_retires(tmp_path) -> None:
+    """ANY completion event counts as history — even when the latest
+    event is an un-completion, the definition is retired, not deleted."""
+    async def _body(database, children, rules, definitions, child):
+        created = await create_quest_definition(
+            database, "Brush teeth", _daily_rule(), [child.id], ["morning"]
+        )
+        definition_id = created.definition.id
+        instances = QuestInstancesDao(database)
+        events = CompletionEventsDao(database)
+        instance = await instances.upsert(
+            definition_id, child.id, _today_iso(), NOW, window="morning"
+        )
+        await events.append(
+            instance.id, child.id, "completed", "user", NOW, True,
+            actor_user_id="admin-1",
+        )
+        await events.append(
+            instance.id, child.id, "uncompleted", "user", NOW, None,
+            actor_user_id="admin-1",
+        )
+
+        result = await delete_quest_definition(database, definition_id)
+
+        assert result.retired is True
+        assert await instances.get_by_id(instance.id) == instance
+        return None
+
+    _with_db(tmp_path, "delete-uncompleted-history.db")(_body)
+
+
+def test_delete_nonexistent_definition_names_field(tmp_path) -> None:
+    async def _body(database, children, rules, definitions, child):
+        with pytest.raises(ValueError, match=r"^definition_id:"):
+            await delete_quest_definition(database, 999)
+        return None
+
+    _with_db(tmp_path, "delete-missing.db")(_body)
+
+
+@pytest.mark.parametrize("bad", [True, 1.0, "1", None])
+def test_delete_rejects_non_int_definition_id(tmp_path, bad) -> None:
+    async def _body(database, children, rules, definitions, child):
+        created = await create_quest_definition(
+            database, "Brush teeth", _daily_rule(), [child.id], ["morning"]
+        )
+        with pytest.raises(ValueError, match="definition_id"):
+            await delete_quest_definition(database, bad)
+        assert await definitions.get(created.definition.id) is not None
+        return None
+
+    _with_db(tmp_path, "delete-bad-id.db")(_body)

tests/test_sse_subscription.py

@@ -351,6 +351,24 @@ async def test_stream_events_yields_documented_frames_and_sends_bearer() -> None
     assert call["json"] is None
 
 
+async def test_stream_events_reports_household_timezone() -> None:
+    """The SSE GET carries Home Assistant's zone beside the Bearer token
+    (task 6351b36d), like the snapshot and completion requests."""
+    frame = _frame_text(*DOCUMENTED_FRAMES[0])
+    transport = _StreamTransport(_StreamingResponse(200, [frame]))
+    client = NestQuestApiClient(
+        BASE_URL, TOKEN, transport, household_timezone="America/New_York"
+    )
+
+    frames = [frame async for frame in client.stream_events()]
+
+    assert frames == [DOCUMENTED_FRAMES[0]]
+    assert transport.calls[0]["headers"] == {
+        "Authorization": f"Bearer {TOKEN}",
+        "X-NestQuest-Timezone": "America/New_York",
+    }
+
+
 async def test_stream_events_buffers_lines_across_chunks_and_joins_data() -> None:
     """Chunk-split lines parse, and multi-line data joins per SSE rules."""
     first_type, first_payload = DOCUMENTED_FRAMES[0]

uv.lock

@@ -373,7 +373,7 @@ wheels = [
 
 [[package]]
 name = "nestquest"
-version = "0.8.0"
+version = "0.9.5"
 source = { virtual = "." }
 
 [package.dev-dependencies]