Make the admin timezone an explicit manual picker (task ade35bd5)

Replace the free-text Timezone box with a select of curated IANA zones,
an "API host local time" choice that clears the zone, and an "Other IANA
zone…" choice that opens a text entry for any other zone. A saved zone
outside the list opens in that entry on load. Helper text states this is
the application timezone and the source of local time for the panel,
scheduler and admin app. Saving still patches only changed fields, so a
timezone change sends exactly {"timezone": ...}; nothing is written on
load and the browser zone is never read.

API tests add invalid-zone 422 cases, a non-admin timezone PATCH refusal,
and a lone timezone PATCH sticking on a fresh database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RELEASE_NOTES.md

@@ -1,5 +1,113 @@
 # NestQuest Release Notes
 
+## Version 0.9.7 — 2026-09-29
+
+### Scope
+
+Patch release carrying the panel-local overdue correction onto `main` (PR #279,
+task fd1093b5 "Tasks are still showing over due when the local time has not
+passed").
+
+### Behaviour
+
+- The kids' Quest Log card now decides whether an open quest is OVERDUE from
+  the panel's OWN local clock (the wall time where the panel physically is)
+  compared with the quest's due time, instead of trusting the API snapshot's
+  `overdue` flag. A quest therefore cannot read OVERDUE before its due time has
+  passed on the panel, regardless of the API host's timezone, Home Assistant's
+  configured `time_zone`, or whether the 0.9.6 timezone changes have been
+  deployed. A quest is overdue at the due minute and after (`>=`); a quest with
+  no due time is never overdue.
+- The API's `overdue` field is unchanged; it still serves the admin plane and
+  automations. This is a panel display correction only.
+
+### Requirements
+
+- Home Assistant floor 2024.6.0 (unchanged).
+
+### Breaking changes
+
+- None. The database schema is unchanged at version 9: no migration and no
+  database backup is required for this release.
+
+### Known limitations
+
+- The comparison uses only wall-clock time. If the API is unreachable across
+  local midnight and the coordinator serves its last-good snapshot, a quest
+  from the previous day with a later due time can briefly read as not overdue
+  until that time passes again. On the normal path the API rolls the household
+  day over and the missed sweep removes the previous day's open quests.
+- The Quest Log header clock still formats in Home Assistant's configured
+  `time_zone`; if HA is set to a zone other than the household's, that header
+  remains wrong. Set Home Assistant's own `time_zone` correctly — the admin/API
+  timezone setting does not affect the header clock.
+
+### Rollback
+
+- No schema change: rolling back to 0.9.6 requires no database restore.
+
+## Version 0.9.6 — 2026-09-28
+
+### Scope
+
+Patch release carrying the household time-zone fix onto `main` (PR #275, task
+6351b36d "Time zone errors"), plus its release-review correction (PR #277, task
+45243478).
+
+### Behaviour
+
+- The Home Assistant integration now reports `hass.config.time_zone` to the API
+  in an `X-NestQuest-Timezone` header on every panel request.
+- While the API's `timezone` setting has never been explicitly chosen
+  (`timezone_configured` false), the API adopts and persists the reported zone
+  (under the settings lock), so the panel's overdue/today calculation, the
+  admin plane and the missed-sweep scheduler are all household-local even when
+  the API host runs UTC. No manual setup is required.
+- The missed-sweep scheduler re-plans immediately when the adopted zone changes
+  while it is sleeping, and re-reads the stored zone before sweeping, so it no
+  longer fires at the old (UTC) rollover.
+- An admin-chosen zone — including an explicit choice of empty (API-host local)
+  — still wins over the reported zone. A timezone-only admin update is recorded
+  as an explicit choice (`timezone_configured` true); an explicitly supplied
+  `timezone_configured` value in the same update is honored as given. An invalid
+  reported zone is logged and ignored; the panel keeps serving on the stored
+  settings.
+
+### Requirements
+
+- Home Assistant floor 2024.6.0 (unchanged).
+
+### Breaking changes
+
+- None. The database schema is unchanged at version 9: no migration and no
+  database backup is required for this release.
+- Deployment note: this fix needs BOTH the API service and the HA integration
+  upgraded. The integration supplies the zone and the API adopts it; upgrading
+  only one side leaves the previous behaviour. An install that sets or clears
+  its zone on 0.9.6 or later keeps that choice; see Known limitations for a zone
+  stored by an older release.
+
+### Known limitations
+
+- A zone stored by a release before 0.9.6 without the explicit-choice marker
+  (for example through the previously documented
+  `PATCH /api/v1/admin/settings {"timezone": ...}`) is not distinguishable from
+  an automatically adopted value, so 0.9.6 adopts Home Assistant's reported zone
+  over it once. If a zone different from Home Assistant's is intended, re-save
+  it in the admin Preferences, which now records the explicit choice.
+- If `timezone` is empty and `timezone_configured` is true (an explicit
+  "host local" choice), that choice is respected and the API host's zone (UTC
+  on the standard deployment) still applies until an admin selects a zone in
+  the admin Preferences.
+- A change to Home Assistant's own `time_zone` takes effect after the
+  integration reloads or Home Assistant restarts.
+
+### Rollback
+
+- No schema change: rolling back to 0.9.5 requires no database restore. The API
+  and the integration may be rolled back independently; rolling back only the
+  integration restores the previous stored-setting-only behaviour.
+
 ## Version 0.9.5 — 2026-09-27
 
 ### Scope

admin/src/api/settings.ts

@@ -19,12 +19,6 @@ export interface HouseholdSettings {
   celebration_enabled: boolean;
   /** IANA zone name (e.g. "America/New_York"); "" means the API host's local time. */
   timezone: string;
-  /**
-   * True once the admin explicitly chose `timezone` (even ""); false on a
-   * fresh install, where the screen auto-sets the browser's zone. API-only:
-   * never shown in the form.
-   */
-  timezone_configured: boolean;
 }
 
 /** Only the supplied fields are updated; the API answers with all of them. */

admin/src/settings/SettingsScreen.css

@@ -258,6 +258,12 @@
   color: var(--nq-a-ink-secondary);
 }
 
+.settings-hint {
+  margin: 0;
+  font-size: 12.5px;
+  color: var(--nq-a-ink-secondary);
+}
+
 .settings-input {
   width: 100%;
   min-height: var(--nq-a-tap-min);

admin/src/settings/SettingsScreen.test.tsx

@@ -23,7 +23,6 @@ const DEFAULT_SETTINGS: HouseholdSettings = {
   end_of_day_report_enabled: true,
   celebration_enabled: false,
   timezone: "America/Chicago",
-  timezone_configured: true,
 };
 
 function child(
@@ -500,37 +499,37 @@ describe("SettingsScreen — preferences", () => {
     expect(writes()).toHaveLength(1);
   });
 
-  it("a changed timezone patches exactly the timezone", async () => {
+  it("a timezone picked from the list patches exactly the timezone", async () => {
     const { form } = await renderPreferences();
-    const input = field(form, "Timezone");
-    expect(input.getAttribute("list")).toBe("settings-timezones");
-    fireEvent.change(input, { target: { value: " Europe/London " } });
+    fireEvent.change(field(form, "Timezone"), { target: { value: "America/New_York" } });
     save(form);
     await screen.findByText("Preferences saved.");
     expect(writes()).toEqual([
-      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "Europe/London", timezone_configured: true } },
+      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/New_York" } },
     ]);
     const reloaded = screen.getByRole("form", { name: "Preferences" });
-    expect(field(reloaded, "Timezone").value).toBe("Europe/London");
+    expect(field(reloaded, "Timezone").value).toBe("America/New_York");
   });
 
   it.each(["New York", "America/New York", "EST5EDT?", "/Chicago"])(
-    "an invalid timezone %j is rejected before any request",
+    "an invalid other timezone %j is rejected before any request",
     async (value) => {
       const { form } = await renderPreferences();
-      fireEvent.change(field(form, "Timezone"), { target: { value } });
+      fireEvent.change(field(form, "Timezone"), { target: { value: "__other__" } });
+      fireEvent.change(field(form, "Other timezone"), { target: { value } });
       save(form);
       expect(screen.getByTestId("preferences-message").textContent).toBe(
         "Timezone must be an IANA zone like America/New_York, or UTC.",
       );
-      expect(field(form, "Timezone").value).toBe(value);
+      expect(field(form, "Other timezone").value).toBe(value);
       expect(writes()).toEqual([]);
     },
   );
 
   it("a 422 on an unknown timezone shows the API detail and keeps the edit", async () => {
     const { form } = await renderPreferences();
-    fireEvent.change(field(form, "Timezone"), { target: { value: "Mars/Olympus_Mons" } });
+    fireEvent.change(field(form, "Timezone"), { target: { value: "__other__" } });
+    fireEvent.change(field(form, "Other timezone"), { target: { value: "Mars/Olympus_Mons" } });
     writeResponse = () =>
       jsonResponse({ detail: "timezone must be an IANA time zone name such as 'America/New_York'" }, 422);
     save(form);
@@ -538,8 +537,9 @@ describe("SettingsScreen — preferences", () => {
     expect(message.textContent).toBe(
       "The preferences could not be saved: timezone must be an IANA time zone name such as 'America/New_York'",
     );
-    expect(field(form, "Timezone").value).toBe("Mars/Olympus_Mons");
-    expect(field(form, "Timezone").disabled).toBe(false);
+    expect(field(form, "Other timezone").value).toBe("Mars/Olympus_Mons");
+    expect(field(form, "Other timezone").disabled).toBe(false);
+    expect(settings.timezone).toBe("America/Chicago");
   });
 
   it("a failed load shows the reason and Try again refetches", async () => {
@@ -559,7 +559,7 @@ describe("SettingsScreen — preferences", () => {
   });
 });
 
-describe("SettingsScreen — timezone auto-set", () => {
+describe("SettingsScreen — no timezone auto-set", () => {
   let zoneSpy: ReturnType<typeof vi.spyOn> | null;
 
   function mockBrowserZone(timeZone: string | undefined) {
@@ -575,8 +575,8 @@ describe("SettingsScreen — timezone auto-set", () => {
     sessionStorage.clear();
     storeTokens({ access_token: "at-123", expires_in: 600 });
     children = [child(1, "Declan", 1)];
-    // A fresh install: no zone, and the admin never chose one.
-    settings = { ...DEFAULT_SETTINGS, timezone: "", timezone_configured: false };
+    // A fresh install: no zone stored.
+    settings = { ...DEFAULT_SETTINGS, timezone: "" };
     writeResponse = null;
     zoneSpy = null;
     fetchMock = vi.fn(async (url: string, init?: RequestInit) => routeFetch(url, init));
@@ -595,25 +595,15 @@ describe("SettingsScreen — timezone auto-set", () => {
     return screen.findByRole("form", { name: "Preferences" });
   }
 
-  it("an unset timezone is set once, on load, to the browser's zone and shown", async () => {
+  it("an empty timezone stays empty on load and nothing is written", async () => {
     mockBrowserZone("America/New_York");
     const form = await renderForm();
-    expect(field(form, "Timezone").value).toBe("America/New_York");
-    expect(writes()).toEqual([
-      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/New_York", timezone_configured: true } },
-    ]);
-    expect(settings.timezone).toBe("America/New_York");
-    expect(settings.timezone_configured).toBe(true);
-
-    // A later save of another field does not re-send the timezone.
-    fireEvent.change(field(form, "Planning horizon (days)"), { target: { value: "21" } });
-    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
-    await screen.findByText("Preferences saved.");
-    expect(writes()).toHaveLength(2);
-    expect(writes()[1].body).toEqual({ horizon_days: 21 });
+    expect(field(form, "Timezone").value).toBe("");
+    expect(writes()).toEqual([]);
+    expect(settings.timezone).toBe("");
   });
 
-  it("StrictMode's doubled effects still auto-set exactly once", async () => {
+  it("StrictMode's doubled effects write nothing either", async () => {
     mockBrowserZone("America/New_York");
     render(
       <StrictMode>
@@ -621,70 +611,183 @@ describe("SettingsScreen — timezone auto-set", () => {
       </StrictMode>,
     );
     const form = await screen.findByRole("form", { name: "Preferences" });
-    expect(field(form, "Timezone").value).toBe("America/New_York");
-    expect(writes()).toEqual([
-      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/New_York", timezone_configured: true } },
-    ]);
-  });
-
-  it("an admin clearing the timezone is not re-set by the browser zone, even after a reopen", async () => {
-    mockBrowserZone("America/New_York");
-    const form = await renderForm();
-    fireEvent.change(field(form, "Timezone"), { target: { value: "" } });
-    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
-    await screen.findByText("Preferences saved.");
-    expect(writes().map((w) => w.body)).toEqual([
-      { timezone: "America/New_York", timezone_configured: true },
-      { timezone: "", timezone_configured: true },
-    ]);
-    const reloaded = screen.getByRole("form", { name: "Preferences" });
-    expect(field(reloaded, "Timezone").value).toBe("");
-
-    // Close and reopen: the screen re-fetches "" but the choice persisted.
-    cleanup();
-    const reopened = await renderForm();
-    expect(field(reopened, "Timezone").value).toBe("");
-    expect(writes()).toHaveLength(2);
-  });
-
-  it("an empty timezone the admin chose is never auto-set", async () => {
-    mockBrowserZone("America/New_York");
-    settings = { ...settings, timezone_configured: true };
-    const form = await renderForm();
     expect(field(form, "Timezone").value).toBe("");
     expect(writes()).toEqual([]);
   });
 
-  it("a set timezone is shown and never overwritten by the browser zone", async () => {
+  it("a stored timezone is shown as stored, never replaced by the browser zone", async () => {
     mockBrowserZone("America/New_York");
-    settings = { ...DEFAULT_SETTINGS, timezone: "Europe/Dublin", timezone_configured: false };
+    settings = { ...DEFAULT_SETTINGS, timezone: "Europe/Dublin" };
     const form = await renderForm();
     expect(field(form, "Timezone").value).toBe("Europe/Dublin");
     expect(writes()).toEqual([]);
   });
 
-  it.each([
-    ["nothing", undefined],
-    ["an empty zone", ""],
-    ["an unknown zone", "Etc/Unknown"],
-    ["a non-IANA zone", "not a zone"],
-  ])("detection returning %s leaves the field empty and sends nothing", async (_case, zone) => {
-    mockBrowserZone(zone);
+  it("saving another field sends only that field, never a timezone", async () => {
+    mockBrowserZone("America/New_York");
     const form = await renderForm();
-    expect(field(form, "Timezone").value).toBe("");
-    expect(screen.queryByTestId("preferences-message")).toBeNull();
+    fireEvent.change(field(form, "Planning horizon (days)"), { target: { value: "21" } });
+    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
+    await screen.findByText("Preferences saved.");
+    expect(writes().map((w) => w.body)).toEqual([{ horizon_days: 21 }]);
+    expect(settings.timezone).toBe("");
+  });
+
+  it("an admin clearing the timezone saves exactly the empty zone", async () => {
+    mockBrowserZone("America/New_York");
+    settings = { ...DEFAULT_SETTINGS, timezone: "Europe/Dublin" };
+    const form = await renderForm();
+    fireEvent.change(field(form, "Timezone"), { target: { value: "" } });
+    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
+    await screen.findByText("Preferences saved.");
+    expect(writes().map((w) => w.body)).toEqual([{ timezone: "" }]);
+    expect(field(screen.getByRole("form", { name: "Preferences" }), "Timezone").value).toBe("");
+  });
+});
+
+describe("SettingsScreen — manual timezone control", () => {
+  beforeEach(() => {
+    sessionStorage.clear();
+    storeTokens({ access_token: "at-123", expires_in: 600 });
+    children = [child(1, "Declan", 1)];
+    settings = { ...DEFAULT_SETTINGS, timezone: "" };
+    writeResponse = null;
+    fetchMock = vi.fn(async (url: string, init?: RequestInit) => routeFetch(url, init));
+    vi.stubGlobal("fetch", fetchMock);
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.unstubAllGlobals();
+  });
+
+  async function renderForm() {
+    render(<SettingsScreen onClose={vi.fn()} />);
+    await screen.findByTestId("settings-child-1");
+    return screen.findByRole("form", { name: "Preferences" });
+  }
+
+  function save(form: HTMLElement) {
+    fireEvent.click(within(form).getByRole("button", { name: "Save preferences" }));
+  }
+
+  /** The Timezone control, which must be a real select, not a free-text box. */
+  function picker(form: HTMLElement): HTMLSelectElement {
+    const control = within(form).getByRole("combobox", { name: "Timezone" });
+    expect(control).toBeInstanceOf(HTMLSelectElement);
+    return control as HTMLSelectElement;
+  }
+
+  it("is a picker of curated zones with host-local and other-zone choices", async () => {
+    const form = await renderForm();
+    const select = picker(form);
+    const values = Array.from(select.options).map((o) => o.value);
+    expect(values[0]).toBe("");
+    expect(select.options[0].textContent).toBe("API host local time (no zone set)");
+    for (const zone of [
+      "UTC",
+      "America/New_York",
+      "America/Chicago",
+      "America/Denver",
+      "America/Phoenix",
+      "America/Los_Angeles",
+      "America/Anchorage",
+      "Pacific/Honolulu",
+    ]) {
+      expect(values).toContain(zone);
+    }
+    expect(select.options[select.options.length - 1].textContent).toBe("Other IANA zone…");
+    expect(select.value).toBe("");
+    expect(within(form).queryByLabelText("Other timezone")).toBeNull();
+  });
+
+  it("explains that it is the application timezone for every surface", async () => {
+    const form = await renderForm();
+    const help = document.getElementById(picker(form).getAttribute("aria-describedby") ?? "");
+    expect(help?.textContent).toMatch(/application timezone/);
+    expect(help?.textContent).toMatch(/panel, the scheduler and this admin app/);
+    expect(help?.textContent).toMatch(/API host's local time/);
+  });
+
+  it("a picked zone saves via PATCH and is shown after a reload", async () => {
+    const form = await renderForm();
+    expect(writes()).toEqual([]);
+    fireEvent.change(picker(form), { target: { value: "America/New_York" } });
+    save(form);
+    await screen.findByText("Preferences saved.");
+    expect(writes()).toEqual([
+      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/New_York" } },
+    ]);
+    cleanup();
+    const reloaded = await renderForm();
+    expect(picker(reloaded).value).toBe("America/New_York");
+    expect(writes()).toHaveLength(1);
+  });
+
+  it("an other zone typed by hand saves via PATCH and is shown after a reload", async () => {
+    const form = await renderForm();
+    fireEvent.change(picker(form), { target: { value: "__other__" } });
+    const entry = within(form).getByLabelText("Other timezone") as HTMLInputElement;
+    expect(entry.value).toBe("");
+    fireEvent.change(entry, { target: { value: " America/Boise " } });
+    save(form);
+    await screen.findByText("Preferences saved.");
+    expect(writes()).toEqual([
+      { method: "PATCH", path: SETTINGS_PATH, body: { timezone: "America/Boise" } },
+    ]);
+    cleanup();
+    const reloaded = await renderForm();
+    expect(picker(reloaded).value).toBe("__other__");
+    expect((within(reloaded).getByLabelText("Other timezone") as HTMLInputElement).value).toBe(
+      "America/Boise",
+    );
+  });
+
+  it("a saved zone outside the list is shown in the other-zone entry on load", async () => {
+    settings = { ...DEFAULT_SETTINGS, timezone: "Asia/Kathmandu" };
+    const form = await renderForm();
+    expect(picker(form).value).toBe("__other__");
+    expect((within(form).getByLabelText("Other timezone") as HTMLInputElement).value).toBe(
+      "Asia/Kathmandu",
+    );
     expect(writes()).toEqual([]);
   });
 
-  it("a rejected auto-set shows why and leaves the field empty for manual entry", async () => {
-    mockBrowserZone("America/New_York");
-    writeResponse = () => jsonResponse({ detail: "timezone is not known" }, 422);
+  it("choosing API host local time clears the zone and persists after a reload", async () => {
+    settings = { ...DEFAULT_SETTINGS, timezone: "America/Denver" };
     const form = await renderForm();
-    expect(field(form, "Timezone").value).toBe("");
-    expect(field(form, "Timezone").disabled).toBe(false);
-    expect(screen.getByTestId("preferences-message").textContent).toBe(
-      "The timezone could not be set to America/New_York: timezone is not known",
-    );
-    expect(writes()).toHaveLength(1);
+    expect(picker(form).value).toBe("America/Denver");
+    fireEvent.change(picker(form), { target: { value: "" } });
+    save(form);
+    await screen.findByText("Preferences saved.");
+    expect(writes().map((w) => w.body)).toEqual([{ timezone: "" }]);
+    cleanup();
+    const reloaded = await renderForm();
+    expect(picker(reloaded).value).toBe("");
+  });
+
+  it("picking a zone and then the saved one again sends nothing", async () => {
+    settings = { ...DEFAULT_SETTINGS, timezone: "UTC" };
+    const form = await renderForm();
+    fireEvent.change(picker(form), { target: { value: "Europe/Paris" } });
+    fireEvent.change(picker(form), { target: { value: "UTC" } });
+    save(form);
+    expect(screen.getByTestId("preferences-message").textContent).toBe("No changes to save.");
+    expect(writes()).toEqual([]);
+  });
+
+  it("never sends a timezone_configured field", async () => {
+    const form = await renderForm();
+    fireEvent.change(picker(form), { target: { value: "America/Los_Angeles" } });
+    save(form);
+    await screen.findByText("Preferences saved.");
+    const again = screen.getByRole("form", { name: "Preferences" });
+    fireEvent.change(picker(again), { target: { value: "" } });
+    save(again);
+    await waitFor(() => expect(writes()).toHaveLength(2));
+    for (const write of writes()) {
+      expect(Object.keys(write.body as object)).toEqual(["timezone"]);
+      expect(write.body).not.toHaveProperty("timezone_configured");
+    }
   });
 });

admin/src/settings/SettingsScreen.tsx

@@ -5,9 +5,9 @@
  * household's child profiles. Every write refetches the list.
  *
  * Preferences: the household settings (planning horizon, day rollover,
- * timezone, notifications). Save patches only the changed fields. A timezone
- * the admin never chose is set once, on load, to the browser's own zone;
- * saving the timezone (even clearing it) marks it chosen, so it sticks.
+ * timezone, notifications). Save patches only the changed fields. The
+ * timezone — the application's source of local time — is only ever set by
+ * the admin picking or typing a zone here and saving it.
  *
  * One write at a time across both sections.
  */
@@ -257,7 +257,7 @@ const HH_MM = /^([01]\d|2[0-3]):[0-5]\d$/;
 /** "UTC" or an IANA-looking "Area/Location" (the API checks it resolves). */
 const IANA_ZONE = /^(UTC|[A-Za-z]+(\/[A-Za-z0-9_+-]+)+)$/;
 
-/** The Timezone field's suggestions; any other IANA zone can be typed. */
+/** The Timezone picker's zones; any other IANA zone can be typed via "Other". */
 export const COMMON_TIMEZONES = [
   "UTC",
   "America/New_York",
@@ -291,18 +291,8 @@ export const COMMON_TIMEZONES = [
   "Pacific/Auckland",
 ];
 
-/**
- * The browser's own IANA zone — the location-derived default for an unset
- * household timezone — or "" when it is missing or not a usable zone name.
- */
-export function detectTimezone(): string {
-  try {
-    const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
-    return typeof zone === "string" && zone !== "Etc/Unknown" && IANA_ZONE.test(zone) ? zone : "";
-  } catch {
-    return "";
-  }
-}
+/** The picker's "Other IANA zone…" option; never sent to the API. */
+const OTHER_ZONE = "__other__";
 
 /** The form's working copy: the number is text so it can be mid-edit. */
 type PreferencesDraft = Omit<HouseholdSettings, "horizon_days"> & { horizon_days: string };
@@ -342,9 +332,6 @@ function buildChanges(draft: PreferencesDraft, loaded: HouseholdSettings): Setti
   for (const key of Object.keys(loaded) as (keyof HouseholdSettings)[]) {
     if (next[key] !== loaded[key]) (changes as Record<string, unknown>)[key] = next[key];
   }
-  // An explicit choice — including "" (the API host's local time) — must
-  // persist, or the next load would auto-set the browser's zone over it.
-  if ("timezone" in changes) changes.timezone_configured = true;
   if (Object.keys(changes).length === 0) return "No changes to save.";
   return changes;
 }
@@ -365,6 +352,10 @@ function PreferencesForm({
 }) {
   const [draft, setDraft] = useState<PreferencesDraft>(() => preferencesDraft(settings));
   const update = (patch: Partial<PreferencesDraft>) => setDraft((d) => ({ ...d, ...patch }));
+  // A saved zone outside the curated list opens in the free-text entry.
+  const [otherZone, setOtherZone] = useState(
+    () => settings.timezone !== "" && !COMMON_TIMEZONES.includes(settings.timezone),
+  );
   const disabled = saving || locked;
 
   function submit(event: FormEvent) {
@@ -417,25 +408,49 @@ function PreferencesForm({
         />
       </label>
       {timeInput("day_rollover_time", "Day rollover")}
-      <label className="settings-field">
-        <span className="settings-label">Timezone</span>
-        <input
+      <div className="settings-field">
+        <label className="settings-label" htmlFor="settings-timezone">
+          Timezone
+        </label>
+        <select
+          id="settings-timezone"
           className="settings-input"
-          type="text"
-          list="settings-timezones"
-          placeholder="Host local time"
-          autoComplete="off"
-          spellCheck={false}
-          value={draft.timezone}
+          aria-describedby="settings-timezone-help"
+          value={otherZone ? OTHER_ZONE : draft.timezone}
           disabled={disabled}
-          onChange={(event) => update({ timezone: event.target.value })}
-        />
-      </label>
-      <datalist id="settings-timezones">
-        {COMMON_TIMEZONES.map((zone) => (
-          <option key={zone} value={zone} />
-        ))}
-      </datalist>
+          onChange={(event) => {
+            const choice = event.target.value;
+            setOtherZone(choice === OTHER_ZONE);
+            if (choice !== OTHER_ZONE) update({ timezone: choice });
+          }}
+        >
+          <option value="">API host local time (no zone set)</option>
+          {COMMON_TIMEZONES.map((zone) => (
+            <option key={zone} value={zone}>
+              {zone}
+            </option>
+          ))}
+          <option value={OTHER_ZONE}>Other IANA zone…</option>
+        </select>
+        {otherZone ? (
+          <input
+            className="settings-input"
+            type="text"
+            aria-label="Other timezone"
+            placeholder="Area/Location, e.g. America/Boise"
+            autoComplete="off"
+            spellCheck={false}
+            value={draft.timezone}
+            disabled={disabled}
+            onChange={(event) => update({ timezone: event.target.value })}
+          />
+        ) : null}
+        <p className="settings-hint" id="settings-timezone-help">
+          The application timezone: the source of local time for the panel, the scheduler and this
+          admin app. It changes only when you save it here; with no zone set, the API host&apos;s
+          local time is used.
+        </p>
+      </div>
       <label className="settings-field">
         <span className="settings-label">Notify target</span>
         <input
@@ -574,8 +589,6 @@ export default function SettingsScreen({ onClose }: { onClose: () => void }) {
   } | null>(null);
   // A ref, not state: two taps in one frame must not both see `busy === null`.
   const inFlight = useRef(false);
-  // The never-chosen-timezone auto-set fires at most once per screen.
-  const timezoneAutoSet = useRef(false);
   const screenRef = useRef<HTMLDivElement>(null);
   const titleRef = useRef<HTMLHeadingElement>(null);
   const addRef = useRef<HTMLButtonElement>(null);
@@ -620,29 +633,8 @@ export default function SettingsScreen({ onClose }: { onClose: () => void }) {
     let cancelled = false;
     setPreferences({ kind: "loading" });
     fetchSettings()
-      .then(async (settings) => {
-        if (cancelled) return;
-        // Never chosen: adopt the browser's zone before the form shows, so
-        // nothing the admin enters can be overwritten by it. An empty zone the
-        // admin chose (timezone_configured) is left alone.
-        const unchosen = settings.timezone === "" && !settings.timezone_configured;
-        const detected = unchosen ? detectTimezone() : "";
-        if (!detected || timezoneAutoSet.current) {
-          setPreferences({ kind: "ready", settings });
-          return;
-        }
-        timezoneAutoSet.current = true;
-        try {
-          const saved = await updateSettings({ timezone: detected, timezone_configured: true });
-          if (!cancelled) setPreferences({ kind: "ready", settings: saved });
-        } catch (error) {
-          if (cancelled) return;
-          setPreferences({ kind: "ready", settings });
-          setPreferencesMessage({
-            kind: "error",
-            text: errorMessage(error, `The timezone could not be set to ${detected}`),
-          });
-        }
+      .then((settings) => {
+        if (!cancelled) setPreferences({ kind: "ready", settings });
       })
       .catch((error: unknown) => {
         if (cancelled) return;

api/routes_admin.py

@@ -165,13 +165,12 @@ integration's Home-Assistant config-entry options remain a temporary,
 SEPARATE source until Feature 18 wires the client to the API — the two
 are deliberately not unified here:
 
-- ``GET /settings`` returns the current effective settings: all twelve
+- ``GET /settings`` returns the current effective settings: all eleven
   documented fields (the rolling horizon, the day rollover time, the
   notify target, the three notification times, the four enable
-  toggles, the ``timezone`` — the IANA household zone the
-  household-local dates derive from, empty meaning host local — and
-  ``timezone_configured``, whether the admin explicitly chose that
-  zone) — the defaults on a fresh database.
+  toggles, and the ``timezone`` — the IANA household zone the
+  household-local dates derive from, empty meaning host local; only an
+  admin's ``PATCH`` ever sets it) — the defaults on a fresh database.
 - ``PATCH /settings`` updates ONLY the supplied fields: the body is a
   JSON object of settings field names to new values, passed STRAIGHT
   to :func:`nestquest_core.settings_store.update_settings` — the
@@ -906,7 +905,7 @@ class AdminSettingsResponse(BaseModel):
     """The effective settings as the admin plane serializes them.
 
     Mirrors the core :class:`~nestquest_core.settings.NestQuestSettings`
-    — all TWELVE documented fields, resolved (every absent stored field
+    — all ELEVEN documented fields, resolved (every absent stored field
     already fell back to its default in the core).  The same shape both
     the GET and the PATCH route answer with.
     """
@@ -924,9 +923,6 @@ class AdminSettingsResponse(BaseModel):
     #: The household IANA time zone the API reads its clock in; ``""``
     #: means the API host's local time.
     timezone: str
-    #: Whether the admin explicitly chose ``timezone`` (even ``""``);
-    #: ``False`` lets the admin UI auto-set the browser's zone once.
-    timezone_configured: bool
 
 
 class AdminMissedSweepResponse(BaseModel):
@@ -2183,7 +2179,7 @@ def _settings_response(
     """Serialize one core NestQuestSettings into the documented payload.
 
     Explicit field-by-field (not ``dataclasses.asdict``) so the payload
-    stays pinned to the twelve documented fields even if the core
+    stays pinned to the eleven documented fields even if the core
     dataclass later grows another one.
     """
     return AdminSettingsResponse(
@@ -2198,7 +2194,6 @@ def _settings_response(
         end_of_day_report_enabled=settings.end_of_day_report_enabled,
         celebration_enabled=settings.celebration_enabled,
         timezone=settings.timezone,
-        timezone_configured=settings.timezone_configured,
     )
 
 
@@ -2296,7 +2291,7 @@ async def admin_history_csv(
     response_model=AdminSettingsResponse,
 )
 async def admin_get_settings(request: Request) -> AdminSettingsResponse:
-    """Return the current effective settings (all twelve documented fields).
+    """Return the current effective settings (all eleven documented fields).
 
     Requires a valid admin JWT (the router's shared
     :func:`~api.auth.require_admin` dependency — the ONE check; this

api/routes_panel.py

@@ -9,8 +9,8 @@ this router inherits the check).
 The snapshot route is a thin adapter over the bundled core: it performs
 NO business logic.  It reads the live database off ``app.state.db``,
 resolves ONE timezone-aware ``now`` (the host clock re-expressed in the
-stored household ``timezone`` setting — the API host may run UTC while
-the household does not), calls the pure
+household ``timezone`` the admin stored — the API host may run UTC
+while the household does not), calls the pure
 :func:`nestquest_core.snapshot.build_snapshot`, shapes each child's
 instances through :func:`nestquest_core.snapshot.instance_payload` with
 ``include_missed=False`` (D-009: missed instances are OMITTED from the
@@ -185,8 +185,9 @@ async def _household_clock(
 
     The API host may run UTC while the household does not, so the one
     :func:`_local_now` read is re-expressed in the stored settings'
-    ``timezone`` (:meth:`NestQuestSettings.household_now`); an unset
-    zone keeps the host's local time.
+    ``timezone`` (:meth:`NestQuestSettings.household_now`).  The zone
+    comes from the stored settings ONLY — nothing the request carries
+    can change it.
     """
     settings = await core_settings_store.load_settings(database)
     return settings, settings.household_now(_local_now())

api/scheduler.py

@@ -13,6 +13,27 @@ local date when unset) and publishes each returned
 ``nestquest_quest_missed`` event on the app's ONE transition publisher
 (the same SSE stream every route publishes through).
 
+A household zone changed while the loop is asleep
+must not leave it waiting for the OLD zone's rollover (a UTC host would
+otherwise sweep at UTC midnight — 20:00 in New York — marking quests
+missed hours early).  :meth:`MissedSweepScheduler.settings_changed`
+wakes the sleeping loop to re-plan whenever the zone or rollover time
+it planned with has moved, and the loop re-reads the settings before
+sweeping and re-plans instead if they no longer match its plan.
+
+Guarantee: no sweep runs for a plan a committed settings write has
+replaced.  A settings writer holds :attr:`MissedSweepScheduler.settings_lock`
+across its write AND its :meth:`~MissedSweepScheduler.settings_changed`
+call; the loop holds the same lock across its plan read (read, record
+the plan, clear the wake flag) and across the pre-sweep re-read plus
+the sweep itself.  So a write commits either before a plan read
+(which then sees it), after one (``settings_changed`` compares against
+that exact plan and wakes the wait), or after the sweep — never between
+a read and what the loop does with it.  The lock is never held across
+the wait, and the loop takes nothing else before it, so a waiting
+writer cannot deadlock: it is delayed at most by one settings
+read or one sweep.
+
 All sweep policy lives in the core (the watermark, the
 ``[watermark, today)`` window, the no-completion-event rule): this
 scheduler only decides WHEN.  A same-night rerun — e.g. two workers,
@@ -124,6 +145,14 @@ class MissedSweepScheduler:
         )
         self._sleep = sleep if sleep is not None else asyncio.sleep
         self._task: asyncio.Task | None = None
+        #: ``(timezone, day_rollover_time)`` the pending sweep was
+        #: planned with; ``None`` until the first plan.
+        self._planned: tuple[str, str] | None = None
+        #: Set by :meth:`settings_changed` to cut the current wait short.
+        self._wake = asyncio.Event()
+        #: Serialises settings writes with planning and sweeping (see
+        #: the module docstring's guarantee).
+        self.settings_lock = asyncio.Lock()
 
     def start(self) -> None:
         """Start the background loop (idempotent: a running one stays)."""
@@ -142,6 +171,20 @@ class MissedSweepScheduler:
                 pass
             self._task = None
 
+    def settings_changed(self, settings: object) -> None:
+        """Re-plan the pending sweep if ``settings`` moved its rollover.
+
+        Called with freshly stored settings (e.g. an admin's zone
+        change), with :attr:`settings_lock` held across the write
+        and this call so the comparison is against the loop's current
+        plan, never a read still in flight.  A differing ``timezone`` or
+        ``day_rollover_time`` wakes the sleeping loop, which reloads the
+        settings and schedules the next sweep for the new household
+        rollover; an unchanged plan is left sleeping.
+        """
+        if (settings.timezone, settings.day_rollover_time) != self._planned:
+            self._wake.set()
+
     @property
     def running(self) -> bool:
         """Whether the background loop task is alive."""
@@ -151,12 +194,18 @@ class MissedSweepScheduler:
         """Schedule → sweep → repeat, forever (until cancelled)."""
         while True:
             try:
-                settings = await core_settings_store.load_settings(
-                    self._database
-                )
-                rollover = datetime.time.fromisoformat(
-                    settings.day_rollover_time
-                )
+                # Under the lock no settings write can commit between this read
+                # and the recorded plan, so any later one wakes the wait.
+                async with self.settings_lock:
+                    self._wake.clear()
+                    settings = await core_settings_store.load_settings(
+                        self._database
+                    )
+                    rollover = datetime.time.fromisoformat(
+                        settings.day_rollover_time
+                    )
+                    plan = (settings.timezone, settings.day_rollover_time)
+                    self._planned = plan
             except Exception:
                 # Not silent: the failure is logged and retried after
                 # the backoff, so one bad settings document or a
@@ -178,15 +227,30 @@ class MissedSweepScheduler:
                 settings.day_rollover_time,
                 delay,
             )
-            await self._sleep(delay)
             try:
-                await self._run_once(
-                    settings.household_now(self._clock()).date()
-                )
+                if not await self._sleep_unless_woken(delay):
+                    continue
+                # Re-read before sweeping: a zone or rollover change the
+                # wake-up missed means this is not the household's
+                # rollover any more, so re-plan instead of sweeping.  The
+                # lock keeps a settings write from committing between this
+                # check and the sweep.
+                async with self.settings_lock:
+                    settings = await core_settings_store.load_settings(
+                        self._database
+                    )
+                    if (
+                        settings.timezone,
+                        settings.day_rollover_time,
+                    ) != plan:
+                        continue
+                    await self._run_once(
+                        settings.household_now(self._clock()).date()
+                    )
             except Exception:
-                # Not silent either: the sweep error is logged and the
-                # loop backs off before the next cycle, whose watermark
-                # re-read makes an already-swept day a no-op.
+                # Not silent either: a failed wait or sweep is logged and
+                # the loop backs off before the next cycle, whose
+                # watermark re-read makes an already-swept day a no-op.
                 LOGGER.exception(
                     "NestQuest scheduled missed sweep failed; retrying in "
                     "%gs",
@@ -194,6 +258,29 @@ class MissedSweepScheduler:
                 )
                 await self._sleep(_RETRY_BACKOFF_SECONDS)
 
+    async def _sleep_unless_woken(self, delay: float) -> bool:
+        """Wait ``delay``; ``False`` if :meth:`settings_changed` woke it.
+
+        Both children are cancelled AND awaited before returning (or
+        before a cancellation propagates), so none outlives :meth:`stop`;
+        a sleep that failed re-raises its exception here for the loop's
+        retry policy.
+        """
+        sleeper = asyncio.ensure_future(self._sleep(delay))
+        waker = asyncio.ensure_future(self._wake.wait())
+        try:
+            await asyncio.wait(
+                {sleeper, waker}, return_when=asyncio.FIRST_COMPLETED
+            )
+        finally:
+            slept = sleeper.done()
+            sleeper.cancel()
+            waker.cancel()
+            await asyncio.gather(sleeper, waker, return_exceptions=True)
+        if slept:
+            sleeper.result()
+        return slept
+
     async def _run_once(self, today: datetime.date) -> None:
         """Run ONE sweep for ``today`` and publish what it built.
 

custom_components/nestquest/api_client.py

@@ -217,6 +217,10 @@ class NestQuestApiClient:
         self._session = session
         self._timeout_seconds = float(timeout_seconds)
 
+    def _headers(self) -> dict[str, str]:
+        """The Bearer credential every panel-plane request carries."""
+        return {"Authorization": f"Bearer {self._panel_token}"}
+
     async def get_snapshot(self) -> dict[str, Any]:
         """Fetch and parse today's household snapshot.
 
@@ -275,7 +279,7 @@ class NestQuestApiClient:
         cleanly and closes the underlying response in every path.
         """
         url = f"{self._base_url}{EVENTS_PATH}"
-        headers = {"Authorization": f"Bearer {self._panel_token}"}
+        headers = self._headers()
         # Opening the response gets ONE request timeout, exactly like
         # ``_request_json``; the read loop below runs WITHOUT one — a
         # body-wide timeout would kill a healthy long-lived stream.
@@ -379,7 +383,7 @@ class NestQuestApiClient:
         raises typed too, carrying the status it arrived with.
         """
         url = f"{self._base_url}{path}"
-        headers = {"Authorization": f"Bearer {self._panel_token}"}
+        headers = self._headers()
         try:
             async with asyncio.timeout(self._timeout_seconds):
                 async with self._session.request(

custom_components/nestquest/core/const.py

@@ -113,18 +113,12 @@ CONF_END_OF_DAY_REPORT_ENABLED = "end_of_day_report_enabled"
 CONF_CELEBRATION_ENABLED = "celebration_enabled"
 DEFAULT_AUTOMATION_ENABLED = True
 # The household's IANA time zone (e.g. ``America/New_York``) the API
-# service reads its clock in.  The empty string keeps the historical
-# behaviour — the API host's own local time — so an existing install is
-# unchanged until the owner sets it.  The integration itself always uses
-# Home Assistant's configured ``time_zone`` and ignores this field.
+# service reads its clock in.  The empty string is the API host's own
+# local time.  Only an admin sets it (manually, from the admin app);
+# nothing sets it automatically.  The integration itself always uses
+# Home Assistant's ``time_zone`` and ignores this field.
 CONF_TIMEZONE = "timezone"
 DEFAULT_TIMEZONE = ""
-# Whether the admin has made an explicit ``timezone`` choice.  ``False``
-# (a fresh install) lets the admin UI auto-set the browser's zone once;
-# ``True`` pins the stored value — including an explicitly-chosen empty
-# ``timezone`` (the API host's local time) — so it is never auto-set again.
-CONF_TIMEZONE_CONFIGURED = "timezone_configured"
-DEFAULT_TIMEZONE_CONFIGURED = False
 
 # Panel-plane API client (Feature 18): the integration reaches the
 # NestQuest API service (Feature 16) over HTTP instead of the database.

custom_components/nestquest/core/settings.py

@@ -49,7 +49,6 @@ from .const import (
     CONF_MORNING_SUMMARY_TIME,
     CONF_NOTIFY_TARGET,
     CONF_TIMEZONE,
-    CONF_TIMEZONE_CONFIGURED,
     DEFAULT_AFTERNOON_REMINDER_TIME,
     DEFAULT_AUTOMATION_ENABLED,
     DEFAULT_DAY_ROLLOVER_TIME,
@@ -57,7 +56,6 @@ from .const import (
     DEFAULT_HORIZON_DAYS,
     DEFAULT_MORNING_SUMMARY_TIME,
     DEFAULT_TIMEZONE,
-    DEFAULT_TIMEZONE_CONFIGURED,
     LOGGER,
     TIME_PATTERN,
 )
@@ -243,12 +241,6 @@ _FIELDS: tuple[tuple[str, str, Any, Callable[[Any], Any]], ...] = (
         _resolve_bool,
     ),
     ("timezone", CONF_TIMEZONE, DEFAULT_TIMEZONE, _resolve_timezone),
-    (
-        "timezone_configured",
-        CONF_TIMEZONE_CONFIGURED,
-        DEFAULT_TIMEZONE_CONFIGURED,
-        _resolve_bool,
-    ),
 )
 
 
@@ -279,10 +271,6 @@ class NestQuestSettings:
     end_of_day_report_enabled: bool = DEFAULT_AUTOMATION_ENABLED
     celebration_enabled: bool = DEFAULT_AUTOMATION_ENABLED
     timezone: str = DEFAULT_TIMEZONE
-    #: ``True`` once the admin explicitly chose :attr:`timezone` (even
-    #: the empty host-local value); ``False`` on a fresh install, where
-    #: the admin UI may auto-set the browser's zone.
-    timezone_configured: bool = DEFAULT_TIMEZONE_CONFIGURED
 
     def __post_init__(self) -> None:
         # Validate STRICTLY at construction so a hand-built instance
@@ -315,7 +303,6 @@ class NestQuestSettings:
             "afternoon_reminder_enabled",
             "end_of_day_report_enabled",
             "celebration_enabled",
-            "timezone_configured",
         ):
             value = getattr(self, name)
             if not isinstance(value, bool):
@@ -327,12 +314,14 @@ class NestQuestSettings:
     def household_now(self, instant: datetime.datetime) -> datetime.datetime:
         """Return the aware ``instant`` expressed in the household's zone.
 
-        The API service has no Home Assistant ``time_zone``, so its one
+        The API service does not run inside Home Assistant, so its one
         clock read (an aware host-local ``now``) is converted here: with
-        :attr:`timezone` set the SAME instant is re-expressed in that
-        zone, so ``.date()`` and ``.time()`` are the household's wall
-        clock even when the host runs UTC.  With :attr:`timezone` empty
-        the instant is returned unchanged (the host's local time).
+        :attr:`timezone` set — the admin's choice, or else the zone the
+        integration reports from Home Assistant — the SAME instant is
+        re-expressed in that zone, so ``.date()`` and ``.time()`` are the
+        household's wall clock even when the host runs UTC.  With
+        :attr:`timezone` empty the instant is returned unchanged (the
+        host's local time).
         """
         if not self.timezone:
             return instant

custom_components/nestquest/core/settings_store.py

@@ -33,11 +33,8 @@ after the first update:
   booleans,
 - ``timezone`` — ``""`` (the API host's local time) or an IANA time
   zone name such as ``America/New_York``.  A document stored before
-  this field existed simply lacks it and resolves to ``""``,
-- ``timezone_configured`` — a real boolean: ``True`` once the admin
-  explicitly chose ``timezone`` (including the empty host-local value),
-  so the admin UI never auto-sets it again.  A document stored before
-  this field existed lacks it and resolves to ``False``.
+  this field existed simply lacks it and resolves to ``""``.  Only an
+  admin's explicit update ever writes it; nothing sets it automatically.
 
 Only values whose core validators ACCEPTED are ever written, so a
 stored document always round-trips through the core's option builders.
@@ -179,7 +176,7 @@ async def update_settings(
     update can never leave a half-applied document behind.
 
     The validated changes are merged onto the current effective
-    settings and the merged (complete, twelve-field) document is persisted
+    settings and the merged (complete, eleven-field) document is persisted
     in one atomic upsert; the updated settings are returned.  The whole
     read → merge → write span runs inside the per-database settings
     lock, so concurrent updates queue instead of interleaving.
@@ -200,18 +197,27 @@ async def update_settings(
         )
     async with _settings_lock(database):
         current = await load_settings(database)
-        document: dict[str, Any] = {
-            field: getattr(current, field) for field in _FIELD_NAMES
-        }
-        for name, raw_value in changes.items():
-            default, validator = _RESOLUTIONS[name]
-            try:
-                document[name] = validator(
-                    default if raw_value is None else raw_value
-                )
-            except ValueError as error:
-                raise ValueError(_named(name, error)) from error
-        await MetaStateDao(database).set(
-            SETTINGS_META_KEY, json.dumps(document, sort_keys=True)
-        )
+        return await _write_merged(database, current, changes)
+
+
+async def _write_merged(
+    database: NestQuestDatabase,
+    current: NestQuestSettings,
+    changes: Mapping[str, Any],
+) -> NestQuestSettings:
+    """Validate ``changes``, merge onto ``current``, persist; lock held."""
+    document: dict[str, Any] = {
+        field: getattr(current, field) for field in _FIELD_NAMES
+    }
+    for name, raw_value in changes.items():
+        default, validator = _RESOLUTIONS[name]
+        try:
+            document[name] = validator(
+                default if raw_value is None else raw_value
+            )
+        except ValueError as error:
+            raise ValueError(_named(name, error)) from error
+    await MetaStateDao(database).set(
+        SETTINGS_META_KEY, json.dumps(document, sort_keys=True)
+    )
     return NestQuestSettings(**document)

custom_components/nestquest/manifest.json

@@ -15,5 +15,5 @@
   "iot_class": "local_polling",
   "issue_tracker": "https://github.com/Maniacs-Mansion/NestQuest/issues",
   "requirements": [],
-  "version": "0.9.5"
+  "version": "0.9.7"
 }

frontend/src/cards/quest-log.ts

@@ -36,7 +36,6 @@ type PanelInstance = {
   window: string;
   due_time: string | null;
   state: string;
-  overdue: boolean;
   completed_at: string | null;
   on_time: boolean | null;
 };
@@ -154,6 +153,17 @@ function formatWallClock(value: string | null): string | null {
   return `${hour12}:${match[2]} ${suffix}`;
 }
 
+/** Minutes past midnight of a household ``HH:MM`` wall time, or null. */
+function wallClockMinutes(value: string | null): number | null {
+  const match = value ? /^(\d{1,2}):(\d{2})$/.exec(value.trim()) : null;
+  if (!match) {
+    return null;
+  }
+  const hours = Number(match[1]);
+  const minutes = Number(match[2]);
+  return hours > 23 || minutes > 59 ? null : hours * 60 + minutes;
+}
+
 function asString(value: unknown): string {
   return typeof value === "string" ? value.trim() : "";
 }
@@ -253,7 +263,6 @@ function toPanelInstance(value: unknown): PanelInstance | null {
     window: asString(row.window).toLowerCase(),
     due_time: asString(row.due_time) || null,
     state,
-    overdue: row.overdue === true,
     completed_at: asString(row.completed_at) || null,
     on_time: row.on_time === true ? true : row.on_time === false ? false : null,
   };
@@ -1749,6 +1758,20 @@ export class NestQuestQuestLogCard extends LitElement {
     `;
   }
 
+  /** Overdue by the panel's own clock: the browser runs on the
+      household's real local time, so an open quest turns overdue once its
+      ``due_time`` wall time has arrived there — whatever zone the API or
+      Home Assistant computed the API's ``overdue`` flag in.  With no due
+      time it is never overdue (the API's rule too).  ``_now`` is reactive
+      and ticks every 60 s, so the line flips on the minute it falls due. */
+  private _isOverdue(instance: PanelInstance): boolean {
+    const due = wallClockMinutes(instance.due_time);
+    if (instance.state !== "open" || due === null) {
+      return false;
+    }
+    return this._now.getHours() * 60 + this._now.getMinutes() >= due;
+  }
+
   private _timeZone(): string | undefined {
     return hassTimeZone(this.hass);
   }
@@ -1833,7 +1856,6 @@ export class NestQuestQuestLogCard extends LitElement {
         continue;
       }
       instance.state = "completed";
-      instance.overdue = false;
       instance.completed_at = stampedAt;
     }
     if (settled) {
@@ -2130,7 +2152,7 @@ export class NestQuestQuestLogCard extends LitElement {
       `;
     }
     const dueAt = formatWallClock(instance.due_time);
-    const meta = instance.overdue
+    const meta = this._isOverdue(instance)
       ? {
           text: dueAt ? `Overdue · due ${dueAt}` : "Overdue",
           late: true,

frontend/tests/render-quest-log.mjs

@@ -16,6 +16,12 @@
  * reports every hass.callService call as tap: {dialog_opened, service_calls}.
  * With tap_return: true the harness taps the header's return control and
  * reports it as returned: {rendered, label} before the final snapshot.
+ * With now: <ISO instant> the card's clock is pinned there (argument-less
+ * new Date() and Date.now() return it; the process TZ decides its local
+ * wall time), and with advance_to: [<ISO instant>, ...] the clock moves to
+ * each instant in turn and the card's own 60 s clock-tick callbacks fire,
+ * one snapshot per instant reported as ticks (the top-level snapshot is
+ * taken before the clock moves).
  * The Python panel tests drive this harness so the
  * assertions run against the exact bundle HACS ships.
  */
@@ -47,6 +53,33 @@ globalThis.window = dom.window;
 // jsdom Event must shadow it for the return navigation to be delivered.
 globalThis.Event = dom.window.Event;
 
+// Pin the clock: argument-less construction and Date.now() read `pinned`,
+// every other Date use is the real class.
+let pinned = spec.now !== undefined ? new Date(spec.now).getTime() : null;
+if (pinned !== null) {
+  const RealDate = Date;
+  class PinnedDate extends RealDate {
+    constructor(...args) {
+      super(...(args.length === 0 ? [pinned] : args));
+    }
+    static now() {
+      return pinned;
+    }
+  }
+  globalThis.Date = PinnedDate;
+  dom.window.Date = PinnedDate;
+}
+
+// Record the card's 60 s clock ticks so advance_to can fire them on demand.
+const clockTicks = [];
+const realSetInterval = dom.window.setInterval.bind(dom.window);
+dom.window.setInterval = (callback, ms, ...rest) => {
+  if (ms === 60000) {
+    clockTicks.push(callback);
+  }
+  return realSetInterval(callback, ms, ...rest);
+};
+
 await import(pathToFileURL(spec.bundle).href);
 
 const serviceCalls = [];
@@ -123,6 +156,18 @@ if (spec.idle_ms !== undefined) {
   await new Promise((resolve) => setTimeout(resolve, spec.idle_ms));
 }
 
-const payload = JSON.stringify({ ...snapshot(), probe, tap, returned });
+const settled = snapshot();
+let ticks = null;
+if (spec.advance_to !== undefined) {
+  ticks = [];
+  for (const instant of spec.advance_to) {
+    pinned = new Date(instant).getTime();
+    clockTicks.forEach((callback) => callback());
+    await element.updateComplete;
+    ticks.push(snapshot());
+  }
+}
+
+const payload = JSON.stringify({ ...settled, probe, tap, returned, ticks });
 await new Promise((resolve) => process.stdout.write(payload, () => resolve()));
 process.exit(0);

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nestquest"
-version = "0.9.5"
+version = "0.9.7"
 description = "NestQuest Home Assistant Integration"
 readme = "README.md"
 requires-python = ">=3.11"

tests/test_api_admin_settings.py

@@ -13,7 +13,8 @@ proven against the DATABASE the routes wrote, not a parallel copy.
 Proven per the done-condition, everything read back through the API:
 
 - ``GET /api/v1/admin/settings`` returns the current effective settings
-  — the twelve documented fields at their defaults on a fresh database.
+  — the eleven documented fields at their defaults on a fresh database,
+  with no ``timezone_configured`` marker.
 - ``PATCH /api/v1/admin/settings`` PERSISTS the supplied fields and the
   NEXT read reflects them; a later partial update merges onto the
   current effective settings (omitted fields keep their stored value),
@@ -60,7 +61,7 @@ _dao_meta = importlib.import_module("nestquest_core.dao_meta")
 SETTINGS_META_KEY = "settings"
 
 #: The all-defaults effective settings a fresh database reports — the
-#: documented twelve fields, asserted literally so the payload contract is
+#: documented eleven fields, asserted literally so the payload contract is
 #: pinned here, independent of the core constants.
 DEFAULT_SETTINGS = {
     "horizon_days": 14,
@@ -74,7 +75,6 @@ DEFAULT_SETTINGS = {
     "end_of_day_report_enabled": True,
     "celebration_enabled": True,
     "timezone": "",
-    "timezone_configured": False,
 }
 
 
@@ -105,7 +105,7 @@ async def settings_client(temp_db_path: str) -> SimpleNamespace:
 async def test_get_settings_returns_defaults_on_a_fresh_database(
     settings_client: SimpleNamespace,
 ) -> None:
-    """GET returns the twelve documented fields at their defaults."""
+    """GET returns the eleven documented fields at their defaults."""
     response = await settings_client.client.get(
         "/api/v1/admin/settings", headers=_admin_headers()
     )
@@ -223,27 +223,38 @@ async def test_null_resets_a_field_to_its_default(
     assert reread.json()["horizon_days"] == 14
 
 
-async def test_timezone_configured_round_trips_with_an_explicit_empty_zone(
+async def test_default_settings_carry_no_timezone_configured_marker(
     settings_client: SimpleNamespace,
 ) -> None:
-    """An explicit empty (host-local) zone persists as configured.
+    """The removed auto-set marker is absent from the default response."""
+    response = await settings_client.client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert response.status_code == 200
+    assert "timezone_configured" not in response.json()
+    assert response.json()["timezone"] == ""
 
-    The admin clearing the zone PATCHes ``timezone: ""`` together with
-    ``timezone_configured: true``; the NEXT read — a reopened settings
-    screen — sees the marker, so the empty value is a persisted choice
-    rather than a fresh install to auto-set.
-    """
+
+@pytest.mark.parametrize("zone", ["America/New_York", ""])
+async def test_manual_timezone_patch_persists_and_is_returned(
+    settings_client: SimpleNamespace, zone: str
+) -> None:
+    """An admin's timezone PATCH is stored exactly as given and read back."""
     client = settings_client.client
-    fresh = await client.get("/api/v1/admin/settings", headers=_admin_headers())
-    assert fresh.json()["timezone_configured"] is False
+    seeded = await client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": "Europe/Dublin"},
+        headers=_admin_headers(),
+    )
+    assert seeded.status_code == 200
 
     patched = await client.patch(
         "/api/v1/admin/settings",
-        json={"timezone": "", "timezone_configured": True},
+        json={"timezone": zone},
         headers=_admin_headers(),
     )
     assert patched.status_code == 200
-    expected = {**DEFAULT_SETTINGS, "timezone_configured": True}
+    expected = {**DEFAULT_SETTINGS, "timezone": zone}
     assert patched.json() == expected
 
     reread = await client.get(
@@ -254,7 +265,61 @@ async def test_timezone_configured_round_trips_with_an_explicit_empty_zone(
         SETTINGS_META_KEY
     )
     assert raw is not None
-    assert json.loads(raw)["timezone_configured"] is True
+    stored = json.loads(raw)
+    assert stored["timezone"] == zone
+    assert "timezone_configured" not in stored
+
+
+@pytest.mark.parametrize("zone", ["America/Los_Angeles", ""])
+async def test_timezone_alone_sticks_on_a_fresh_database(
+    settings_client: SimpleNamespace, zone: str
+) -> None:
+    """A lone ``timezone`` PATCH needs no other field to persist."""
+    client = settings_client.client
+    patched = await client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": zone},
+        headers=_admin_headers(),
+    )
+    assert patched.status_code == 200
+    reread = await client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert reread.json() == {**DEFAULT_SETTINGS, "timezone": zone}
+
+
+async def test_timezone_configured_is_an_unknown_field(
+    settings_client: SimpleNamespace,
+) -> None:
+    """The removed marker is rejected like any unknown field; nothing is written."""
+    response = await settings_client.client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone_configured": True},
+        headers=_admin_headers(),
+    )
+    assert response.status_code == 422
+    assert "timezone_configured" in str(response.json()["detail"])
+    raw = await _dao_meta.MetaStateDao(settings_client.database).get(
+        SETTINGS_META_KEY
+    )
+    assert raw is None
+
+
+async def test_stored_legacy_timezone_configured_key_is_ignored(
+    settings_client: SimpleNamespace,
+) -> None:
+    """A document written before the marker was removed still loads."""
+    await _dao_meta.MetaStateDao(settings_client.database).set(
+        SETTINGS_META_KEY,
+        json.dumps(
+            {"timezone": "America/Chicago", "timezone_configured": True}
+        ),
+    )
+    response = await settings_client.client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert response.status_code == 200
+    assert response.json() == {**DEFAULT_SETTINGS, "timezone": "America/Chicago"}
 
 
 # --- validation: rejected values never change the stored settings -------
@@ -273,8 +338,9 @@ async def test_timezone_configured_round_trips_with_an_explicit_empty_zone(
         ({"morning_summary_enabled": "yes"}, "morning_summary_enabled"),
         ({"celebration_enabled": 1}, "celebration_enabled"),
         ({"notify_target": 5}, "notify_target"),
-        ({"timezone_configured": "true"}, "timezone_configured"),
-        ({"timezone_configured": 1}, "timezone_configured"),
+        ({"timezone": "Mars/Olympus_Mons"}, "timezone"),
+        ({"timezone": "America/New York"}, "timezone"),
+        ({"timezone": 5}, "timezone"),
     ],
 )
 async def test_invalid_value_is_rejected_and_stored_settings_unchanged(
@@ -429,6 +495,13 @@ async def test_settings_routes_refuse_non_admin_and_absent_credentials(
     )
     assert absent_patch.status_code == 401
 
+    forbidden_zone = await client.patch(
+        "/api/v1/admin/settings",
+        json={"timezone": "America/New_York"},
+        headers={"Authorization": f"Bearer {non_admin}"},
+    )
+    assert forbidden_zone.status_code == 403
+
     # No refused request changed anything: the settings are untouched.
     after = await client.get(
         "/api/v1/admin/settings", headers=_admin_headers()

tests/test_api_client.py

@@ -196,6 +196,29 @@ async def test_complete_instance_posts_body_and_headers() -> None:
     assert call["headers"]["Authorization"] == f"Bearer {TOKEN}"
 
 
+async def test_requests_carry_only_the_bearer_header() -> None:
+    """No timezone is reported to the API (task 7f685179): the Bearer
+    credential is the only header on every request."""
+    transport = StubTransport(
+        StubResponse(200, json.dumps(SNAPSHOT_PAYLOAD)),
+        StubResponse(200, '{"status": "done"}'),
+    )
+    client = make_client(transport)
+
+    await client.get_snapshot()
+    await client.complete_instance(42, 3)
+
+    for call in transport.calls:
+        assert call["headers"] == {"Authorization": f"Bearer {TOKEN}"}
+
+
+def test_client_takes_no_household_timezone() -> None:
+    with pytest.raises(TypeError):
+        NestQuestApiClient(
+            BASE_URL, TOKEN, StubTransport(), household_timezone="UTC"
+        )
+
+
 async def test_base_url_trailing_slash_is_normalized() -> None:
     """A base URL with a trailing slash must not double the path slash."""
     transport = StubTransport(StubResponse(200, "{}"))
@@ -392,11 +415,13 @@ def test_client_from_entry_reads_config_and_shared_session(monkeypatch) -> None:
         }
     )
 
+    # A bare object: building the client must not read hass.config.
     client = api_client.client_from_entry(object(), entry)
 
     assert client._session is shared_session
     assert client._base_url == "http://panel.lan:8443"
     assert client._panel_token == "entry-token"
+    assert client._headers() == {"Authorization": "Bearer entry-token"}
 
 
 def test_client_from_entry_unconfigured_token_raises_at_construction(

tests/test_api_household_clock.py

@@ -19,6 +19,8 @@ container's zone) and sets the household zone through the real admin
 
 An unset zone keeps the historical host-local behaviour, and the
 missed-sweep scheduler waits for the rollover in household time.
+Nothing sets the zone automatically: a timezone header on a panel
+request never changes the stored settings (task 7f685179).
 """
 from __future__ import annotations
 
@@ -31,6 +33,7 @@ from zoneinfo import ZoneInfo
 import pytest
 
 from api import routes_admin, routes_panel
+from api import scheduler as scheduler_module
 from api.database import _executor
 from api.scheduler import MissedSweepScheduler, _delay_seconds
 from tests.admin_jwt_harness import (
@@ -46,6 +49,7 @@ _settings = importlib.import_module("nestquest_core.settings")
 _settings_store = importlib.import_module("nestquest_core.settings_store")
 _core_db = importlib.import_module("nestquest_core.db")
 _core_migrations = importlib.import_module("nestquest_core.migrations")
+_dao_meta = importlib.import_module("nestquest_core.dao_meta")
 
 #: The panel service token the admin harness app is configured with.
 HARNESS_PANEL_TOKEN = "admin-test-panel-token"
@@ -83,7 +87,12 @@ async def household(temp_db_path: str, monkeypatch) -> SimpleNamespace:
     monkeypatch.setattr(routes_panel, "_local_now", lambda: clock["now"])
     runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
     async with runner as client:
-        yield SimpleNamespace(client=client, seed=seed, clock=clock)
+        yield SimpleNamespace(
+            client=client,
+            seed=seed,
+            clock=clock,
+            database=runner.app.state.db.database,
+        )
 
 
 async def _set_zone(household: SimpleNamespace, zone: str) -> None:
@@ -236,23 +245,14 @@ def test_from_options_reads_and_resiliently_defaults_timezone() -> None:
     )
 
 
-def test_settings_timezone_configured_defaults_false_and_is_strict() -> None:
-    assert _settings.NestQuestSettings().timezone_configured is False
-    assert _settings.NestQuestSettings.from_options({}).timezone_configured is False
-    assert (
-        _settings.NestQuestSettings.from_options(
-            {"timezone_configured": True}
-        ).timezone_configured
-        is True
-    )
-    for value in ("true", 1, None):
-        with pytest.raises(ValueError, match="timezone_configured"):
-            _settings.NestQuestSettings(timezone_configured=value)
-        if value is not None:
-            with pytest.raises(ValueError):
-                _settings.NestQuestSettings.from_options(
-                    {"timezone_configured": value}
-                )
+def test_settings_have_no_timezone_configured_marker() -> None:
+    assert not hasattr(_settings.NestQuestSettings(), "timezone_configured")
+    with pytest.raises(TypeError):
+        _settings.NestQuestSettings(timezone_configured=True)
+    # A stored document still carrying the removed key loads harmlessly.
+    assert _settings.NestQuestSettings.from_options_resilient(
+        {"timezone": HOUSEHOLD_ZONE, "timezone_configured": True}
+    ) == _settings.NestQuestSettings(timezone=HOUSEHOLD_ZONE)
 
 
 # --- the missed-sweep scheduler ----------------------------------------------
@@ -326,3 +326,445 @@ def test_delay_seconds_is_true_elapsed_time_across_dst(
     now: datetime.datetime, target: datetime.time, expected: float
 ) -> None:
     assert _delay_seconds(target, now) == expected
+
+
+# --- nothing sets the zone automatically (task 7f685179) --------------------
+#
+# The zone is only ever set by an admin's explicit settings update.  A
+# timezone header on a panel request — the one Home Assistant used to
+# report, or any look-alike — is ignored, and no read writes settings.
+
+#: Timezone-looking request headers a panel request might carry.
+_TIMEZONE_HEADERS = [
+    {"X-NestQuest-Timezone": HOUSEHOLD_ZONE},
+    {"X-NestQuest-Time-Zone": HOUSEHOLD_ZONE},
+    {"X-Timezone": HOUSEHOLD_ZONE},
+    {"Time-Zone": HOUSEHOLD_ZONE},
+]
+
+
+async def _stored_document(household: SimpleNamespace) -> str | None:
+    """The raw stored settings document (``None`` when never written)."""
+    return await _dao_meta.MetaStateDao(household.database).get(
+        _settings_store.SETTINGS_META_KEY
+    )
+
+
+async def _admin_settings(household: SimpleNamespace) -> dict:
+    response = await household.client.get(
+        "/api/v1/admin/settings", headers=_admin_headers()
+    )
+    assert response.status_code == 200
+    return response.json()
+
+
+@pytest.mark.parametrize("extra", _TIMEZONE_HEADERS)
+async def test_panel_timezone_header_never_changes_settings(
+    household: SimpleNamespace, extra: dict[str, str]
+) -> None:
+    """09:59:59 EDT on a UTC host, zone unset: the header is ignored."""
+    household.clock["now"] = _utc(13, 59, 59)
+    headers = {**_panel_headers(), **extra}
+    snapshot = await household.client.get(
+        "/api/v1/panel/snapshot", headers=headers
+    )
+    assert snapshot.status_code == 200
+    seed = household.seed
+    completed = await household.client.post(
+        f"/api/v1/panel/instances/{seed.pack_bag_instance.id}/complete",
+        headers=headers,
+        json={"actor_child_id": seed.ada.id},
+    )
+    assert completed.status_code == 200
+    # Nothing was written, and the clock stayed host local (UTC): the
+    # 10:00 quest was overdue and the 13:59 UTC completion was late.
+    assert await _stored_document(household) is None
+    assert (await _admin_settings(household))["timezone"] == ""
+    _today_iso, instance = await _pack_bag(household, "admin")
+    assert instance["on_time"] is False
+
+
+@pytest.mark.parametrize("extra", _TIMEZONE_HEADERS)
+async def test_panel_timezone_header_never_replaces_the_stored_zone(
+    household: SimpleNamespace, extra: dict[str, str]
+) -> None:
+    """A stored zone stays exactly as the admin saved it."""
+    await _set_zone(household, "America/Los_Angeles")
+    before = await _stored_document(household)
+    household.clock["now"] = _utc(16, 59, 59)  # 09:59:59 PDT, 12:59:59 EDT
+    response = await household.client.get(
+        "/api/v1/panel/snapshot",
+        headers={**_panel_headers(), **extra},
+    )
+    assert response.status_code == 200
+    assert await _stored_document(household) == before
+    _today_iso, instance = await _pack_bag(household, "panel")
+    assert instance["overdue"] is False
+
+
+async def test_fresh_install_zone_stays_empty_across_reads(
+    household: SimpleNamespace,
+) -> None:
+    """Repeated panel and admin reads never write the settings document."""
+    for hour in (3, 13, 23):
+        household.clock["now"] = _utc(hour, 0)
+        for extra in _TIMEZONE_HEADERS:
+            response = await household.client.get(
+                "/api/v1/panel/snapshot",
+                headers={**_panel_headers(), **extra},
+            )
+            assert response.status_code == 200
+        await _pack_bag(household, "admin")
+        settings = await _admin_settings(household)
+        assert settings["timezone"] == ""
+        assert "timezone_configured" not in settings
+    assert await _stored_document(household) is None
+
+
+# --- the scheduler follows a changed zone (task 6351b36d) --------------------
+#
+# On a UTC host with no stored zone the scheduler first plans for UTC
+# midnight; a zone stored while it sleeps must move the sweep to the
+# household's midnight rather than sweep at 20:00 EDT.
+
+#: 13:00 UTC (09:00 EDT) to UTC midnight.
+_UTC_MIDNIGHT_DELAY = 11 * 3600
+#: 13:00 UTC (09:00 EDT) to New York midnight (04:00 UTC).
+_NEW_YORK_MIDNIGHT_DELAY = 15 * 3600
+
+
+async def _store_zone(scheduler, database, zone: str) -> None:
+    """Store ``zone`` the way a settings writer must: under the lock."""
+    async with scheduler.settings_lock:
+        settings = await _settings_store.update_settings(
+            database, {"timezone": zone}
+        )
+        scheduler.settings_changed(settings)
+
+
+async def test_scheduler_replans_when_zone_changes_while_sleeping(
+    temp_db_path: str,
+) -> None:
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner:
+        app_state = runner.app.state
+        await app_state.sweep_scheduler.stop()
+        delays: list[float] = []
+        slept = asyncio.Condition()
+
+        async def sleep_stub(seconds: float) -> None:
+            async with slept:
+                delays.append(seconds)
+                slept.notify_all()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            app_state.db.database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        app_state.sweep_scheduler = scheduler
+        scheduler.start()
+        try:
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 1), timeout=5
+                )
+            await _store_zone(
+                scheduler, app_state.db.database, HOUSEHOLD_ZONE
+            )
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 2), timeout=5
+                )
+        finally:
+            await scheduler.stop()
+    assert delays == [
+        pytest.approx(_UTC_MIDNIGHT_DELAY),
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+    ]
+
+
+async def test_scheduler_rechecks_settings_before_sweeping(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """A zone stored without a wake-up still stops the stale sweep."""
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        sweeps: list[datetime.date] = []
+
+        async def sweep_stub(_database, *, today):
+            sweeps.append(today)
+            return []
+
+        monkeypatch.setattr(
+            scheduler_module.core_sweep, "run_missed_sweep", sweep_stub
+        )
+        delays: list[float] = []
+        replanned = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            if len(delays) == 1:
+                # The UTC rollover "arrives" after the zone was stored
+                # behind the scheduler's back.
+                await _settings_store.update_settings(
+                    database, {"timezone": HOUSEHOLD_ZONE}
+                )
+                return
+            replanned.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(replanned.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        assert sweeps == []
+        assert delays == [
+            pytest.approx(_UTC_MIDNIGHT_DELAY),
+            pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+        ]
+    finally:
+        await database.close()
+
+
+# --- settings writes are serialised with planning and sweeping (TZ-003) ------
+#
+# A zone write racing the loop's own settings reads must never leave a
+# stale plan behind.  Each test holds the loop at one of its reads and
+# issues a locked zone write there; when the scheduler's settings lock
+# is held at that point the write provably cannot commit until the
+# loop moves on, otherwise it is awaited to commit inside the window.
+
+
+def _hold_scheduler_read(monkeypatch, scheduler, nth: int, during):
+    """Run ``during(settings)`` inside the scheduler task's ``nth`` read."""
+    real_load = _settings_store.load_settings
+    reads = {"count": 0}
+
+    async def load_settings(database):
+        settings = await real_load(database)
+        if asyncio.current_task() is scheduler._task:
+            reads["count"] += 1
+            if reads["count"] == nth:
+                await during(settings)
+        return settings
+
+    monkeypatch.setattr(
+        scheduler_module.core_settings_store, "load_settings", load_settings
+    )
+    return real_load
+
+
+async def _store_inside_read(scheduler, database, zone: str) -> asyncio.Task:
+    """Start a locked write of ``zone``; let it commit unless serialised."""
+    write = asyncio.create_task(_store_zone(scheduler, database, zone))
+    if not scheduler.settings_lock.locked():
+        await write
+    return write
+
+
+async def test_scheduler_follows_successive_zone_changes(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """New York -> UTC -> New York while the re-plan read is in flight."""
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner:
+        app_state = runner.app.state
+        database = app_state.db.database
+        await app_state.sweep_scheduler.stop()
+        delays: list[float] = []
+        slept = asyncio.Condition()
+
+        async def sleep_stub(seconds: float) -> None:
+            async with slept:
+                delays.append(seconds)
+                slept.notify_all()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        app_state.sweep_scheduler = scheduler
+        await _store_zone(scheduler, database, HOUSEHOLD_ZONE)
+        writes: list[asyncio.Task] = []
+
+        async def back_to_new_york(_settings) -> None:
+            writes.append(
+                await _store_inside_read(scheduler, database, HOUSEHOLD_ZONE)
+            )
+
+        # Read 1 plans New York; read 2 is the re-plan after UTC.
+        _hold_scheduler_read(monkeypatch, scheduler, 2, back_to_new_york)
+        scheduler.start()
+        try:
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 1), timeout=5
+                )
+            await _store_zone(scheduler, database, "UTC")
+            async with slept:
+                await asyncio.wait_for(
+                    slept.wait_for(lambda: len(delays) == 3), timeout=5
+                )
+            (write,) = writes
+            await write
+        finally:
+            await scheduler.stop()
+    # The in-flight read planned UTC; the New York write that followed
+    # it woke the wait, so the scheduler sleeps on New York midnight.
+    assert delays == [
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+        pytest.approx(_UTC_MIDNIGHT_DELAY),
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+    ]
+
+
+async def test_zone_write_after_presweep_check_cannot_precede_the_sweep(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """No sweep runs once a zone write has replaced its plan."""
+    runner = AdminRunner(temp_db_path, jwks_for(ADMIN_KEY, KID))
+    async with runner:
+        app_state = runner.app.state
+        await app_state.sweep_scheduler.stop()
+        delays: list[float] = []
+        replanned = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            if len(delays) == 1:
+                return  # the UTC rollover arrives
+            replanned.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            app_state.db.database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        app_state.sweep_scheduler = scheduler
+        writes: list[asyncio.Task] = []
+
+        async def store_new_york(_settings) -> None:
+            writes.append(
+                await _store_inside_read(
+                    scheduler, app_state.db.database, HOUSEHOLD_ZONE
+                )
+            )
+
+        # Read 1 plans UTC; read 2 is the pre-sweep re-check.
+        real_load = _hold_scheduler_read(
+            monkeypatch, scheduler, 2, store_new_york
+        )
+        swept_under: list[str] = []
+
+        async def sweep_stub(database, *, today):
+            swept_under.append((await real_load(database)).timezone)
+            return []
+
+        monkeypatch.setattr(
+            scheduler_module.core_sweep, "run_missed_sweep", sweep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(replanned.wait(), timeout=5)
+            (write,) = writes
+            await write
+        finally:
+            await scheduler.stop()
+    # The sweep ran for the UTC plan with UTC still stored, never after
+    # New York had been stored; the next plan is New York midnight.
+    assert swept_under == [""]
+    assert delays == [
+        pytest.approx(_UTC_MIDNIGHT_DELAY),
+        pytest.approx(_NEW_YORK_MIDNIGHT_DELAY),
+    ]
+
+
+# --- the wait's child tasks (TZ-004) ------------------------------------------
+
+
+async def test_failed_sleep_is_retried_not_swept(
+    temp_db_path: str, monkeypatch
+) -> None:
+    """A sleep that raises backs off and re-plans; nothing is swept."""
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        sweeps: list[datetime.date] = []
+
+        async def sweep_stub(_database, *, today):
+            sweeps.append(today)
+            return []
+
+        monkeypatch.setattr(
+            scheduler_module.core_sweep, "run_missed_sweep", sweep_stub
+        )
+        delays: list[float] = []
+        replanned = asyncio.Event()
+
+        async def sleep_stub(seconds: float) -> None:
+            delays.append(seconds)
+            if len(delays) == 1:
+                raise RuntimeError("timer failed")
+            if len(delays) == 2:
+                return  # the retry backoff
+            replanned.set()
+            await asyncio.Event().wait()
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(replanned.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        assert sweeps == []
+        assert delays == [
+            pytest.approx(_UTC_MIDNIGHT_DELAY),
+            scheduler_module._RETRY_BACKOFF_SECONDS,
+            pytest.approx(_UTC_MIDNIGHT_DELAY),
+        ]
+    finally:
+        await database.close()
+
+
+async def test_stop_waits_for_the_sleep_to_finish_cancelling(
+    temp_db_path: str,
+) -> None:
+    database = _core_db.NestQuestDatabase(_executor)
+    await database.open(temp_db_path)
+    try:
+        await _core_migrations.apply_migrations(database)
+        sleeping = asyncio.Event()
+        sleepers: list[asyncio.Task] = []
+        cleaned_up: list[bool] = []
+
+        async def sleep_stub(_seconds: float) -> None:
+            sleepers.append(asyncio.current_task())
+            sleeping.set()
+            try:
+                await asyncio.Event().wait()
+            finally:
+                # Cancellation cleanup that takes a loop turn.
+                await asyncio.sleep(0)
+                cleaned_up.append(True)
+
+        scheduler = MissedSweepScheduler(
+            database, clock=lambda: _utc(13, 0), sleep=sleep_stub
+        )
+        scheduler.start()
+        try:
+            await asyncio.wait_for(sleeping.wait(), timeout=5)
+        finally:
+            await scheduler.stop()
+        (sleeper,) = sleepers
+        assert sleeper.done()
+        assert cleaned_up == [True]
+    finally:
+        await database.close()

tests/test_coordinator.py

@@ -686,6 +686,8 @@ async def test_coordinator_configured_token_builds_real_client(
         hass, entry, session_factory=_session_factory
     )
     assert isinstance(real_client, NestQuestApiClient)
+    # Home Assistant's zone is not reported to the API (task 7f685179).
+    assert real_client._headers() == {"Authorization": "Bearer tok"}
 
     set_coordinator_client(entry, real_client)
     assert await async_setup_entry(hass, entry) is True

tests/test_panel_cards.py

@@ -21,6 +21,7 @@ end-to-end through the quest-log harness.
 from __future__ import annotations
 
 import json
+import os
 import re
 import subprocess
 from pathlib import Path
@@ -831,6 +832,9 @@ def _render_quest_log(
     probe_ms: int | None = None,
     tap_complete: int | None = None,
     tap_return: bool = False,
+    now: str | None = None,
+    advance_to: list[str] | None = None,
+    tz: str | None = None,
 ) -> dict:
     """Render the built bundle's quest log and report its location.
 
@@ -840,7 +844,10 @@ def _render_quest_log(
     segment — waits the optional probe window and captures one snapshot
     of the render mid-wait, then the optional idle window, and prints
     the final pathname and rendered title (plus the probe snapshot when
-    ``probe_ms`` was given).
+    ``probe_ms`` was given).  ``now`` pins the card's clock to an ISO
+    instant, ``advance_to`` moves it through further instants firing the
+    card's clock tick (one snapshot each, under ``ticks``), and ``tz``
+    sets the node process's ``TZ`` — the panel browser's local zone.
     """
     assert BUNDLE_PATH.is_file(), "bundle missing: run cd frontend && npm run build"
     assert QUEST_LOG_HARNESS.is_file()
@@ -858,12 +865,17 @@ def _render_quest_log(
         spec["tap_complete"] = tap_complete
     if tap_return:
         spec["tap_return"] = True
+    if now is not None:
+        spec["now"] = now
+    if advance_to is not None:
+        spec["advance_to"] = advance_to
     completed = subprocess.run(
         ["node", str(QUEST_LOG_HARNESS)],
         input=json.dumps(spec),
         capture_output=True,
         text=True,
         timeout=120,
+        env={**os.environ, "TZ": tz} if tz is not None else None,
     )
     assert completed.returncode == 0, (
         f"quest-log harness failed: {completed.stderr}"
@@ -1090,12 +1102,13 @@ def test_quest_log_meta_line_keeps_its_meta_class() -> None:
     ``meta ${late ? "late" : nothing}``, Lit dropped the whole class
     attribute for every quest that was not late, leaving the due line
     unstyled. The rendered markup must carry ``class="meta"`` on time and
-    ``class="meta late"`` overdue."""
+    ``class="meta late"`` overdue — overdue by the panel's pinned clock
+    (07:15 local: the 07:00 quest is late, the 08:15 one is not)."""
     generated = _generate_dashboard(
         {}, _three_child_states(), url="http://homeassistant.local/nestquest"
     )
 
-    def quest(instance_id: int, title: str, overdue: bool) -> dict:
+    def quest(instance_id: int, title: str, due_time: str) -> dict:
         return {
             "id": instance_id,
             "definition_id": instance_id,
@@ -1103,9 +1116,9 @@ def test_quest_log_meta_line_keeps_its_meta_class() -> None:
             "title": title,
             "icon": None,
             "window": "morning",
-            "due_time": "08:15",
+            "due_time": due_time,
             "state": "open",
-            "overdue": overdue,
+            "overdue": False,
             "completed_at": None,
             "on_time": None,
         }
@@ -1118,8 +1131,8 @@ def test_quest_log_meta_line_keeps_its_meta_class() -> None:
             child_id=1,
             present=True,
             instances=[
-                quest(41, "Make Bed", overdue=False),
-                quest(42, "Brush Teeth", overdue=True),
+                quest(41, "Make Bed", "08:15"),
+                quest(42, "Brush Teeth", "07:00"),
             ],
         ),
     }
@@ -1127,6 +1140,8 @@ def test_quest_log_meta_line_keeps_its_meta_class() -> None:
         generated["views"][1]["cards"][0],
         states,
         url="http://homeassistant.local/nestquest/ada",
+        now="2026-09-29T11:15:00Z",
+        tz="America/New_York",
     )
     metas = {}
     for card in result["html"].split('data-instance-id="')[1:]:
@@ -1143,6 +1158,83 @@ def test_quest_log_meta_line_keeps_its_meta_class() -> None:
     assert metas["42"].strip() == 'class="meta late"', metas["42"]
 
 
+def _quest_metas(html: str) -> dict[str, tuple[str, str]]:
+    """Map each rendered open quest's instance id to its meta line's
+    attributes and text."""
+    metas = {}
+    for card in html.split('data-instance-id="')[1:]:
+        meta = re.search(
+            r'<span class="quest-title">.*?</span>'
+            r"\s*(?:<!--[^>]*-->\s*)*<span([^>]*)>(.*?)</span>",
+            card,
+            re.S,
+        )
+        assert meta is not None, card[:800]
+        text = " ".join(re.sub(r"<!--[^>]*-->", "", meta.group(2)).split())
+        metas[card[: card.index('"')]] = (meta.group(1).strip(), text)
+    return metas
+
+
+def test_quest_log_overdue_follows_the_panel_local_clock() -> None:
+    """Overdue is decided by the panel's own local clock, not the API's
+    ``overdue`` flag.  The owner saw 8:15 AM quests read OVERDUE at 7:15 AM
+    America/New_York: the API's flag had been computed on a UTC wall clock
+    (11:15).  Here the API still says ``overdue: true`` and Home
+    Assistant reports ``time_zone`` UTC, yet at 07:15 local the 08:15 quest
+    is due, at 08:15 (and 08:16, via the card's own clock tick) it is
+    overdue, and a quest with no due time is never overdue."""
+    generated = _generate_dashboard(
+        {}, _three_child_states(), url="http://homeassistant.local/nestquest"
+    )
+
+    def quest(instance_id: int, title: str, due_time: str | None) -> dict:
+        return {
+            "id": instance_id,
+            "definition_id": instance_id,
+            "child_id": 1,
+            "title": title,
+            "icon": None,
+            "window": "morning",
+            "due_time": due_time,
+            "state": "open",
+            "overdue": True,
+            "completed_at": None,
+            "on_time": None,
+        }
+
+    states = {
+        **_three_child_states(),
+        "sensor.nestquest_ada_quests_due_today": _state(
+            "2",
+            child_name="Ada",
+            child_id=1,
+            present=True,
+            instances=[
+                quest(42, "Brush Teeth", "08:15"),
+                quest(43, "Feed Fish", None),
+            ],
+        ),
+    }
+    result = _render_quest_log(
+        generated["views"][1]["cards"][0],
+        states,
+        url="http://homeassistant.local/nestquest/ada",
+        now="2026-09-29T11:15:00Z",
+        advance_to=["2026-09-29T12:15:00Z", "2026-09-29T12:16:00Z"],
+        tz="America/New_York",
+    )
+    due_by = ('class="meta"', "Due by 8:15 AM")
+    overdue = ('class="meta late"', "Overdue · due 8:15 AM")
+    not_due = ('class="meta"', "Due today")
+    at_0715, at_0815, at_0816 = (
+        _quest_metas(result["html"]),
+        *(_quest_metas(tick["html"]) for tick in result["ticks"]),
+    )
+    assert at_0715 == {"42": due_by, "43": not_due}, at_0715
+    assert at_0815 == {"42": overdue, "43": not_due}, at_0815
+    assert at_0816 == {"42": overdue, "43": not_due}, at_0816
+
+
 def test_quest_log_crest_matches_the_spec_geometry() -> None:
     """PANEL-SPEC §3 header crest: 96x110 shield, 4px ring of
     rgba(255,255,255,.22) around the --nq-p-crest face, 44px/700 display

uv.lock

@@ -373,7 +373,7 @@ wheels = [
 
 [[package]]
 name = "nestquest"
-version = "0.9.5"
+version = "0.9.7"
 source = { virtual = "." }
 
 [package.dev-dependencies]