v0.9.4

src/engine/commands.rs

@@ -1,8 +1,3 @@
-pub async fn send_command(state: &AppState, device_id: &str, command: DeviceCommand) -> Result<Device, AppError> {
-    let _device_guard = state.lock_device_operation(device_id).await;
-    send_command_locked(state, device_id, command).await
-}
-
 async fn send_command_locked(state: &AppState, device_id: &str, command: DeviceCommand) -> Result<Device, AppError> {
     send_command_locked_inner(state, device_id, command, true, true).await
 }

src/engine/groups.rs

@@ -70,8 +70,13 @@ pub async fn control_group(state: &AppState, group_id: &str, patch: GroupControl
     // releases group ownership: members are represented as individually OFF, not as
     // "blocked by a disabled group". ON clears that scoped OFF and lets group arbitration
     // take ownership again. The whole-house master remains independent.
-    let explicit_group_power = patch.power.is_some() && source != "automation.group";
     let manual_group_control = source != "automation.group";
+    let explicit_group_power = patch.power.is_some() && manual_group_control;
+    // Applying a manual mode/profile/custom target to an already-enabled group is itself an
+    // explicit scoped takeover. It must wake members that were left locally OFF by a previous
+    // group/whole-house OFF; otherwise the UI says "group control" while every unit stays OFF.
+    let manual_group_activation = manual_group_control && group.power_enabled && climate_change;
+    let explicit_group_takeover = explicit_group_power || manual_group_activation;
 
     let mut zones = Vec::new();
     let mut failed = Vec::new();
@@ -89,7 +94,7 @@ pub async fn control_group(state: &AppState, group_id: &str, patch: GroupControl
         // or temporary ownership so all members react consistently to the bulk command.
         // Scheduled automations deliberately do not do this: manual/local ownership keeps
         // its higher priority and the automation can only affect currently free members.
-        if explicit_group_power {
+        if explicit_group_takeover {
             if zone.temporary_quick_thermostat.is_some() {
                 if temporary_owns_zone {
                     finish_temporary_quick_thermostat(&mut zone, &schedules, &state.settings.read().await.house_mode);
@@ -161,7 +166,8 @@ pub async fn control_group(state: &AppState, group_id: &str, patch: GroupControl
         // Power ON clears this scoped OFF and returns the member to group arbitration.
         let mut force_power_off_after_save = false;
         let mut applied_group_power: Option<bool> = None;
-        if let Some(power) = patch.power {
+        let requested_member_power = patch.power.or(manual_group_activation.then_some(true));
+        if let Some(power) = requested_member_power {
             let automatic_power_blocked = source == "automation.group"
                 && (zone.device_manual_override || zone.local_thermostat_power.is_some() || temporary_owns_zone);
             if automatic_power_blocked {

src/engine/local_thermostat.rs

@@ -1,5 +1,32 @@
 pub const LOCAL_THERMOSTAT_RESUME_DELAY_MINUTES: i64 = 15;
 
+/// Apply the whole-house bulk power state to a thermostat without creating a persistent
+/// global gate. OFF leaves the zone explicitly/indefinitely off; ON releases that local OFF
+/// so the zone can immediately return to its group/manual/automatic controller.
+pub fn set_house_bulk_thermostat_power(zone: &mut Zone, power: bool) -> bool {
+    if power {
+        if zone.local_thermostat_power != Some(false) { return false; }
+        zone.local_thermostat_power = None;
+        zone.local_thermostat_resume_at = None;
+        zone.local_thermostat_restore_zone_enabled = None;
+        true
+    } else {
+        let changed = zone.local_thermostat_power != Some(false)
+            || zone.local_thermostat_resume_at.is_some()
+            || zone.local_thermostat_restore_zone_enabled.is_some()
+            || zone.demand
+            || zone.demand_since.is_some();
+        zone.local_thermostat_power = Some(false);
+        zone.local_thermostat_resume_at = None;
+        zone.local_thermostat_restore_zone_enabled = None;
+        zone.demand = false;
+        zone.demand_since = None;
+        zone.effective_mode = "off".into();
+        zone.device_setpoint = None;
+        changed
+    }
+}
+
 /// Apply local quick-thermostat power ownership and keep the automatic hand-back
 /// deadline in one backend-owned place. Every fresh OFF action receives a fresh
 /// deadline; ON cancels any pending hand-back.

src/engine/ownership.rs

@@ -155,7 +155,7 @@ fn set_device_manual_override(state: &AppState, zone: &mut Zone, fields: Vec<Str
     zone.control_source = normalized_direct_source(source).into();
     zone.control_reason = "Direct/manual device control has priority".into();
     // Direct/pilot control is an explicit ownership takeover, not a temporary preset.
-    // Keep it manual until the user explicitly chooses Resume automation. A one-shot global
+    // Keep it manual until the user explicitly chooses Resume automation. A global
     // ON/OFF command changes physical power only and must never erase manual ownership.
     // A schedule boundary must never silently take the unit back from the person controlling it.
     zone.device_manual_override_until = None;
@@ -262,9 +262,8 @@ pub async fn send_manual_command(state: &AppState, device_id: &str, command: Dev
 }
 
 pub async fn force_house_power_off_device(state: &AppState, device_id: &str, _source: &str) -> Result<Device, AppError> {
-    // Whole-house OFF is a one-shot physical action. Preserve every zone/manual/group owner,
-    // while still taking zone -> device locks so a concurrent local/manual action cannot race
-    // the forced OFF frame. Controllers are free to make a later independent decision.
+    // Whole-house OFF physically forces the unit down after the API has persisted per-zone local OFF.
+    // Keep zone -> device ordering so a concurrent local/manual action cannot race the frame.
     let mut zone_ids: Vec<String> = state.db.list_zones()?.into_iter()
         .filter(|zone| zone.device_id == device_id)
         .map(|zone| zone.id)
@@ -280,7 +279,7 @@ pub async fn force_house_power_off_device(state: &AppState, device_id: &str, _so
 }
 
 pub async fn one_shot_house_power_on_device(state: &AppState, device_id: &str) -> Result<Device, AppError> {
-    // Global ON is also one-shot and must not take thermostat ownership. For thermostat-managed
+    // Global ON releases per-zone OFF state in the API and must not create a local-ON ownership marker. For thermostat-managed
     // units it still respects compressor protection; a protected start is stored as a visible
     // queue item and executed at the protection deadline unless a newer intent cancels/replaces it.
     let mut zone_ids: Vec<String> = state.db.list_zones()?.into_iter()
@@ -330,7 +329,7 @@ pub async fn one_shot_house_power_on_device(state: &AppState, device_id: &str) -
         }
     }
 
-    // The device lock is already held. This is physical one-shot power only: no manual marker.
+    // The device lock is already held. This is physical global power only: no manual marker.
     send_command_locked(state, device_id, DeviceCommand { power: Some(true), ..Default::default() }).await
 }
 
@@ -365,18 +364,3 @@ pub async fn disable_device_safely(state: &AppState, device_id: &str) -> Result<
     Ok(device)
 }
 
-pub fn clear_all_device_manual_overrides(state: &AppState, source: &str) -> Result<usize, AppError> {
-    let mut cleared = 0usize;
-    for mut zone in state.db.list_zones()? {
-        if !reset_device_manual_override(&mut zone) { continue; }
-        zone.updated_at = Utc::now();
-        state.db.save_zone(&zone)?;
-        state.broadcast("zone.updated", serde_json::to_value(&zone)?);
-        state.log("info", "zone.device_manual_override_cleared", &format!("Automation resumed for {}", zone.name), json!({
-            "zone_id": zone.id, "device_id": zone.device_id, "source": source
-        }));
-        cleared += 1;
-    }
-    Ok(cleared)
-}
-

src/engine/tests.rs

@@ -780,4 +780,34 @@ mod tests {
         assert_eq!(outdoor_assist_offset("cool", None, 27.0, 23.0), 0.0);
     }
 
+    #[test]
+    fn whole_house_off_is_indefinite_until_explicit_reenable() {
+        let mut zone = test_zone("device");
+        zone.local_thermostat_power = Some(true);
+        zone.local_thermostat_resume_at = Some(Utc::now() + chrono::Duration::minutes(15));
+        zone.demand = true;
+        zone.demand_since = Some(Utc::now());
+
+        assert!(set_house_bulk_thermostat_power(&mut zone, false));
+        assert_eq!(zone.local_thermostat_power, Some(false));
+        assert!(zone.local_thermostat_resume_at.is_none());
+        assert!(zone.local_thermostat_restore_zone_enabled.is_none());
+        assert!(!zone.demand);
+        assert!(zone.demand_since.is_none());
+        assert_eq!(zone.effective_mode, "off");
+
+        // A normal cycle must see an indefinite local OFF. Global/local/group ON releases it.
+        assert!(set_house_bulk_thermostat_power(&mut zone, true));
+        assert!(zone.local_thermostat_power.is_none());
+        assert!(zone.local_thermostat_resume_at.is_none());
+    }
+
+    #[test]
+    fn whole_house_on_does_not_create_a_local_on_override() {
+        let mut zone = test_zone("device");
+        zone.local_thermostat_power = None;
+        assert!(!set_house_bulk_thermostat_power(&mut zone, true));
+        assert!(zone.local_thermostat_power.is_none());
+    }
+
 }

src/engine/zone_control.rs

@@ -35,7 +35,7 @@ async fn control_zones(state: &AppState) -> Result<()> {
     let schedules = state.db.list_schedules()?;
     let settings = state.settings.read().await.clone();
     let mut zone_snapshot = state.db.list_zones()?;
-    // Local/temporary thermostat ownership is independent from one-shot whole-house power
+    // Local/temporary thermostat ownership is independent from the legacy whole-house master gate
     // commands. Expire/activate sessions on their own deadlines.
     expire_local_thermostat_overrides(state, &mut zone_snapshot, &schedules, &settings.house_mode).await?;
     let temporary_restored_disabled = expire_temporary_quick_thermostats(state, &mut zone_snapshot, &schedules, &settings.house_mode).await?;
@@ -189,7 +189,7 @@ async fn control_zones(state: &AppState) -> Result<()> {
         zone.control_temperature_source = control_source;
         zone.updated_at = Utc::now();
 
-        // A queued whole-house ON is a delayed one-shot physical action, not thermostat
+        // A queued whole-house ON is a delayed bulk physical action, not thermostat
         // ownership. It must survive local/group/manual state while compressor protection is
         // active, then execute once and hand control straight back to the existing owner.
         if zone.compressor_pending_action.as_deref() == Some("global_power_on") {
@@ -216,7 +216,7 @@ async fn control_zones(state: &AppState) -> Result<()> {
                     }
                     Err(err) => {
                         // Keep the user-visible task and retry on a bounded deadline instead of
-                        // spinning immediately or silently dropping a one-shot request.
+                        // spinning immediately or silently dropping the requested global start.
                         zone.compressor_pending_until = Some(Utc::now() + chrono::Duration::seconds(10));
                         zone.lockout_until = zone.compressor_pending_until;
                         zone.lockout_reason = Some("global_start_retry".into());