v0.8.19

src/engine/ownership.rs

@@ -233,7 +233,9 @@ async fn detect_external_device_control(state: &AppState, before: &Device, after
 pub async fn send_manual_command(state: &AppState, device_id: &str, command: DeviceCommand, source: &str) -> Result<Device, AppError> {
     // Keep zone -> device lock ordering consistent with Quick Thermostat/full-zone edits.
     // A device belongs to at most one thermostat zone, but keep this generic for legacy data.
-    let zone_ids: Vec<String> = state.db.list_zones()?.into_iter().filter(|zone| zone.device_id == device_id).map(|zone| zone.id).collect();
+    let mut zone_ids: Vec<String> = state.db.list_zones()?.into_iter().filter(|zone| zone.device_id == device_id).map(|zone| zone.id).collect();
+    zone_ids.sort();
+    zone_ids.dedup();
     let mut _zone_guards = Vec::new();
     for zone_id in &zone_ids { _zone_guards.push(state.lock_zone_operation(zone_id).await); }
     // Keep the device lock until the zone takeover marker is persisted. Otherwise a poll
@@ -282,6 +284,12 @@ pub async fn force_power_off_device(state: &AppState, device_id: &str) -> Result
     send_command_locked_forced(state, device_id, DeviceCommand { power: Some(false), ..Default::default() }).await
 }
 
+/// Same safety transition for callers that already hold the per-device operation lock.
+/// Keeping this separate avoids recursive lock acquisition during atomic configuration import.
+pub async fn force_power_off_device_locked(state: &AppState, device_id: &str) -> Result<Device, AppError> {
+    send_command_locked_forced(state, device_id, DeviceCommand { power: Some(false), ..Default::default() }).await
+}
+
 /// Technical device disable is a safety transition, not just a database flag. The unit is
 /// explicitly powered off while it is still commandable, then removed from controller polling.
 pub async fn disable_device_safely(state: &AppState, device_id: &str) -> Result<Device, AppError> {