From 1247614eebd4f3b1005efe552de593fbfb0b019f Mon Sep 17 00:00:00 2001
From: Bryan Gin-ge Chen <bryangingechen@gmail.com>
Date: Thu, 22 Oct 2026 11:55:25 -0400
Subject: [PATCH] fix(console): show prefs-page times in the browser's timezone

A reviewer on CEST saw the prefs page's "Preferences saved at" time two
hours behind. The view resolved a zone on the server (Zulip's zone, then
core.User.timezone, then UTC) and validated the form inside
timezone.override(), but rendered the template after leaving it. Django
converts aware datetimes to the zone active at render time, so the page
showed UTC times under the reviewer's zone name. away_until was shown in
UTC but read back in the reviewer's zone, so saving the form unchanged
moved it earlier by that zone's UTC offset.

The prefs page was also the only reviewer-facing surface that picked a
zone on the server; the rest of the console and the bot's Zulip messages
show times in the reader's own zone. So instead of only moving the render,
use the browser's zone here too. The server renders times in its default
zone, and the form posts back the zone they are in, in a hidden `timezone`
field. prefs_form.js rewrites each away_until from its stored instant
(data-utc) into the browser's zone and sets that field to match, so the
server always reads a time in the zone it was shown in. Rendering stays
inside the override. A posted zone the server cannot load saves nothing
rather than misreading the times. The "saved at" time is a <time> element,
localized by console/base.html like the rest of the console.

Removes zulip_bot.services.user_timezone, which has no other caller, and
with it a Zulip API call per render. Updates design doc 022 and the
console/zulip_bot AGENTS.md files. core.User.timezone is now unread;
dropping it is left as a follow-up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../022-zulip-prefs-form-design.md            | 48 +++++++---
 qb_site/console/AGENTS.md                     | 36 ++++---
 qb_site/console/static/console/prefs_form.js  | 68 ++++++++++++-
 qb_site/console/tests/test_prefs.py           | 96 ++++++++++++++++---
 qb_site/console/views.py                      | 68 +++++++------
 qb_site/core/forms.py                         |  9 +-
 qb_site/core/services/reviewer_prefs.py       |  2 +-
 qb_site/templates/console/prefs.html          | 16 +++-
 qb_site/zulip_bot/AGENTS.md                   |  7 +-
 .../frontend/tests/prefs_form.test.js         | 64 ++++++++++++-
 qb_site/zulip_bot/services/user_timezone.py   | 76 ---------------
 qb_site/zulip_bot/tests/test_user_timezone.py | 75 ---------------
 12 files changed, 330 insertions(+), 235 deletions(-)
 delete mode 100644 qb_site/zulip_bot/services/user_timezone.py
 delete mode 100644 qb_site/zulip_bot/tests/test_user_timezone.py

diff --git a/docs/design-decisions/022-zulip-prefs-form-design.md b/docs/design-decisions/022-zulip-prefs-form-design.md
index cc91442d..dab050c5 100644
--- a/docs/design-decisions/022-zulip-prefs-form-design.md
+++ b/docs/design-decisions/022-zulip-prefs-form-design.md
@@ -44,14 +44,12 @@ Admission to being a reviewer is unchanged; only authentication moved.
 | Editable field set + validation | `core.forms.ReviewerPreferenceForm` |
 | Formset assembly, ownership scoping, label catalog | `core.services.reviewer_prefs` |
 | Field markup | `templates/shared/_reviewer_prefs_fields.html` |
-| Timezone for local times | `zulip_bot.services.user_timezone` |
+| Timezone for local times | The browser, via `prefs_form.js` and the posted `timezone` field |
 | The page itself | `console.views.prefs` + `templates/console/prefs.html` |
 
 `core.services.reviewer_prefs` reads `syncer.models.LabelDef` at module scope, matching the existing
-`core/admin.py` precedent. Timezone resolution lives in `zulip_bot` because its authoritative source
-is Zulip's own user record and `core/services` otherwise carries no app dependencies; console access
-stays independent of Zulip *reachability* — an unlinked or unreachable Zulip falls through to
-`core.User.timezone`, then the Django default.
+`core/admin.py` precedent. The page needs nothing from Zulip: times are shown and read in the
+browser's zone (see "Times are in the browser's zone" below).
 
 ### Invariants
 
@@ -99,10 +97,30 @@ Nothing about the page expires. The Django session bounds an editing window inst
 `SESSION_SAVE_EVERY_REQUEST = True` slides the two-week `SESSION_COOKIE_AGE` on activity so a long
 edit cannot POST into a lapsed cookie; the `beforeunload` dirty guard is the backstop.
 
+### Times are in the browser's zone
+
+- The server renders every time in its default zone (`TIME_ZONE`), and the form posts back, in a
+  hidden `timezone` field, the zone its times are in. `prefs_form.js` rewrites each `away_until` from
+  the stored instant in its `data-utc` into the browser's zone
+  (`Intl.DateTimeFormat().resolvedOptions().timeZone`), and that field with it. So the server reads a
+  naive `away_until` in exactly the zone it was shown in, whichever that was.
+- The "saved at" time is a `<time datetime>`, localized by `console/base.html` like every other
+  console timestamp. Zulip messages already show times in each reader's zone (`<time:…>` tags), so
+  no reviewer-facing surface picks a zone on the server.
+- A posted zone this server cannot load saves nothing, with a banner saying why, rather than reading
+  the times in some other zone.
+- Without JS the page stays in the server's zone and names it.
+- This replaced a server-side resolver, `zulip_bot.services.user_timezone` (Zulip's zone →
+  `core.User.timezone` → the default). It cost a Zulip API call per render and fell back to UTC for
+  anyone without a Zulip zone. It also rendered the page outside the zone it validated in, so times
+  showed in UTC under the reviewer's zone name, and every save moved `away_until` by that zone's UTC
+  offset (#219).
+
 ### Front-end assets
 
 `console/static/console/prefs_form.{css,js}` are console-owned. The JS is progressive enhancement
-only — an unsaved-changes guard and the per-row "clear away time" buttons — with **no countdown**,
+only — showing times in the browser's zone, an unsaved-changes guard and the per-row "clear away
+time" buttons — with **no countdown**,
 which is what let the expiry helpers stay behind in `zulip_bot/static/zulip_bot/expiry.js` for the
 close-pr / label-pr token pages that still need them. (Those pages import them as a *sibling* module,
 and a relative ES import must resolve both as a served path in the browser and an on-disk path under
@@ -120,8 +138,8 @@ and cover both apps' modules; CI runs them (`.github/workflows/ci.yml`).
   reviewers". Intended (invariant 2), but user-visible.
 - Editing scope widened from a token snapshot to all current rows, which is why ownership filtering
   must be applied on POST as well as GET.
-- `core.User.timezone` is still only ever set by hand in the Django admin, so in practice the
-  timezone comes from Zulip's user record per render, or the project default. See Follow-Ups.
+- `core.User.timezone` is read by nothing since the browser supplies the zone; it was only ever set
+  by hand in the Django admin. See Follow-Ups.
 
 ## Operational Notes
 
@@ -136,20 +154,20 @@ and cover both apps' modules; CI runs them (`.github/workflows/ci.yml`).
   `templates/zulip_bot/prefs_form.html`, `templates/zulip_bot/prefs_invalid.html`, and the token test
   module (its form-behavior coverage moved to `console/tests/test_prefs_form_fields.py`, its
   field-accounting guard to `core/tests/test_reviewer_preference_form.py`, and its timezone-chain
-  coverage to `zulip_bot/tests/test_user_timezone.py`).
+  coverage to `zulip_bot/tests/test_user_timezone.py`, since removed with that chain).
 - **Pre-flight for the retirement:** every `ReviewerPreference` row's user must have a usable
   `github_login` — under GitHub OAuth that, not `zulip_user_id`, is what would lock someone out.
   Registration always sets it (it goes through GitHub OAuth), as does `import_reviewer_topics`.
 - **Tests.** `console/tests/test_prefs.py` (auth, admission gate, no-row-creation, cross-reviewer POST,
-  timezone), `console/tests/test_prefs_form_fields.py` (fields, validation, label catalog),
-  `zulip_bot/tests/test_user_timezone.py`, `core/tests/test_reviewer_preference_form.py`, and the
-  vitest specs above.
+  posted-timezone handling), `console/tests/test_prefs_form_fields.py` (fields, validation, label
+  catalog), `core/tests/test_reviewer_preference_form.py`, and the vitest specs above (which cover
+  the browser's half of the timezone round trip).
 
 ## Follow-Ups
 
-- **Persist a browser-reported timezone.** `core.User.timezone` is admin-only today; storing
-  `Intl.DateTimeFormat().resolvedOptions().timeZone` on first visit would make the fallback real and
-  let us drop the per-render Zulip API round-trip.
+- **Drop `core.User.timezone`.** Nothing reads it now that the page uses the browser's zone (which
+  closed the earlier follow-up, "persist a browser-reported timezone"). Removing the column needs a
+  migration and a `scripts/backup_policy.py` check.
 - Optional confirmation DM after a successful preferences change (stage C3 of the original plan).
 - Structured logging for saves/rejections (stage C1) — never token or form contents.
 
diff --git a/qb_site/console/AGENTS.md b/qb_site/console/AGENTS.md
index 79fcfa67..7b1f55e2 100644
--- a/qb_site/console/AGENTS.md
+++ b/qb_site/console/AGENTS.md
@@ -90,17 +90,24 @@
 - Ownership scoping lives in the shared builder: the queryset is narrowed to the supplied rows *and*
   their owner on GET and POST alike, so a posted `form-<n>-id` naming someone else's row fails
   validation. Never widen that queryset at a call site.
-- Timezone comes from `zulip_bot.services.user_timezone.resolve_user_timezone_name` (Zulip's zone →
-  `core.User.timezone` → Django default) and is what naive `away_until` input means. The page renders
-  no countdown: the session bounds it, and `SESSION_SAVE_EVERY_REQUEST` slides that window.
+- Times are in the browser's zone (design doc 022). The server renders them in its default zone and
+  the form posts back, in the hidden `timezone` field, the zone they are in; `prefs_form.js` rewrites
+  each `away_until` (from the stored instant in its `data-utc`) and that field into the browser's
+  zone. A POST's naive `away_until` is read in the posted zone, so it is always the zone it was shown
+  in. A posted zone the server cannot load (`_zone_or_none`) saves nothing rather than misreading the
+  times. Rendering stays inside `timezone.override`: the `date` filter and the widget convert at
+  render time. There is no Zulip lookup.
+- The page renders no countdown: the session bounds it, and `SESSION_SAVE_EVERY_REQUEST` slides that
+  window.
 - Styling/JS: `templates/console/prefs.html` extends `console/base.html` and uses its `extra_css` /
   `extra_js` blocks to load `console/prefs_form.css|js`, both console-owned. The JS is progressive
-  enhancement only (unsaved-changes guard, "clear away time" buttons, and the excluded-labels picker:
-  a filterable checkbox list over the label catalog the template emits with `json_script`, writing
-  one label per line into the hidden textarea that is still the submitted field; design doc 057)
-  with **no countdown** — the session bounds this page, not a link TTL — which is why the expiry
-  helpers stayed behind in `zulip_bot/static/zulip_bot/expiry.js` for the close-pr / label-pr token
-  pages. Its vitest spec lives with those, in `qb_site/zulip_bot/frontend/tests/`.
+  enhancement only (times in the browser's zone, unsaved-changes guard, "clear away time" buttons,
+  and the excluded-labels picker: a filterable checkbox list over the label catalog the template
+  emits with `json_script`, writing one label per line into the hidden textarea that is still the
+  submitted field; design doc 057) with **no countdown** — the session bounds this page, not a link
+  TTL — which is why the expiry helpers stayed behind in `zulip_bot/static/zulip_bot/expiry.js` for
+  the close-pr / label-pr token pages. Its vitest spec lives with those, in
+  `qb_site/zulip_bot/frontend/tests/`.
 
 ## Accept / decline / assign-anyway / unassign (the load-bearing handlers)
 - All `POST`. Accept and decline re-validate live state via the single
@@ -169,9 +176,8 @@
 - This app is step `[12/13]` of `scripts/repo_check_compose.sh`. It was missing from that script until
   the prefs work added it, so console tests had never run in CI — if you add an app, add its step.
 - View tests mock `console.views.GitHubOAuthClient`, `console.views.assign_reviewer_and_record`,
-  `console.views.GitHubAssignmentClient` (unassign), `console.views._enqueue_pr_sync`, and
-  `console.views.resolve_user_timezone_name` (prefs), and seed the session directly; no real GitHub
-  or Zulip calls. `tests/test_prefs.py` pins the prefs invariants (no row creation, admission gate at
-  sign-in *and* per view, cross-reviewer POST rejection, timezone interpretation) and
-  `tests/test_prefs_form_fields.py` covers fields, validation and the label catalog. Canonical full run
-  stays `bash scripts/repo_check_compose.sh`.
+  `console.views.GitHubAssignmentClient` (unassign) and `console.views._enqueue_pr_sync`, and seed
+  the session directly; no real GitHub or Zulip calls. `tests/test_prefs.py` pins the prefs invariants
+  (no row creation, admission gate at sign-in *and* per view, cross-reviewer POST rejection, reading
+  times in the posted zone) and `tests/test_prefs_form_fields.py` covers fields, validation and the
+  label catalog. Canonical full run stays `bash scripts/repo_check_compose.sh`.
diff --git a/qb_site/console/static/console/prefs_form.js b/qb_site/console/static/console/prefs_form.js
index b901e7b4..fa257c86 100644
--- a/qb_site/console/static/console/prefs_form.js
+++ b/qb_site/console/static/console/prefs_form.js
@@ -1,7 +1,7 @@
 // Reviewer preferences form behavior for /console/preferences/ (design doc 022).
 //
-// Progressive enhancement only: an unsaved-changes guard, the per-row "clear away time" buttons and
-// the excluded-labels picker. There is deliberately no countdown — the console session bounds this
+// Progressive enhancement only: showing times in the browser's zone, an unsaved-changes guard, the
+// per-row "clear away time" buttons and the excluded-labels picker. There is deliberately no countdown — the console session bounds this
 // page, not a link TTL — which is why the expiry helpers stayed behind in
 // `zulip_bot/static/zulip_bot/expiry.js` with the close-pr / label-pr token pages.
 
@@ -11,6 +11,64 @@ function serializeForm(form) {
 
 const fold = (name) => name.toLowerCase();
 
+// The browser's IANA zone, or "" when it will not say.
+function browserTimeZone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || "";
+  } catch {
+    return "";
+  }
+}
+
+// `date` as a `datetime-local` value ("YYYY-MM-DDTHH:MM") on the wall clock of `timeZone`.
+export function toDatetimeLocalValue(date, timeZone) {
+  const format = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    hourCycle: "h23", // midnight is 00, never 24
+  });
+  const parts = {};
+  for (const { type, value } of format.formatToParts(date)) {
+    parts[type] = value;
+  }
+  return `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}`;
+}
+
+// The page's times are in the zone its `timezone` field names: the server's default, as rendered.
+// Rewrite each `away_until` from the stored instant in its `data-utc` into the browser's zone, and
+// post that zone back, so the server reads the times in the zone they were shown in (design doc
+// 022). A page already in the browser's zone (a re-render after a failed save) keeps what was typed.
+// All or nothing: if any time cannot be converted, the page stays in the server's zone, which still
+// agrees with every time on it.
+export function localizeTimes(root = document, browserZone = browserTimeZone()) {
+  const field = root.getElementById("prefs-timezone");
+  if (!(field instanceof HTMLInputElement) || !browserZone) {
+    return;
+  }
+  if (field.value !== browserZone) {
+    let rewrites;
+    try {
+      rewrites = [...root.querySelectorAll("input[data-utc]")].map((input) => [
+        input,
+        toDatetimeLocalValue(new Date(input.dataset.utc), browserZone),
+      ]);
+    } catch {
+      return;
+    }
+    for (const [input, value] of rewrites) {
+      input.value = value;
+    }
+    field.value = browserZone;
+  }
+  for (const name of root.querySelectorAll(".js-timezone-name")) {
+    name.textContent = browserZone;
+  }
+}
+
 // Excluded-labels picker (design doc 057): a filter box over a short scrolling list of checkboxes,
 // one per repository label (the JSON block the template renders), plus a removable chip per chosen
 // label. Real checkboxes rather than a pop-up suggestion list: the browsers' own <datalist> shows
@@ -215,7 +273,7 @@ export function mountLabelPicker(container, root = document) {
   };
 }
 
-export function mountPrefsForm(root = document) {
+export function mountPrefsForm(root = document, browserZone = browserTimeZone()) {
   const container = root.getElementById("prefs-root");
   if (!container) {
     return () => undefined;
@@ -226,7 +284,9 @@ export function mountPrefsForm(root = document) {
     return () => undefined;
   }
 
-  // Before the snapshot below. Mounting never rewrites the textarea, so the page starts clean.
+  // Both before the snapshot below, so neither counts as an unsaved change. Mounting never rewrites
+  // the textarea, so the page starts clean.
+  localizeTimes(root, browserZone);
   const unmountPickers = [...root.querySelectorAll(".js-label-picker")].map((picker) => mountLabelPicker(picker, root));
 
   let dirty = false;
diff --git a/qb_site/console/tests/test_prefs.py b/qb_site/console/tests/test_prefs.py
index 45383e3b..00afeb40 100644
--- a/qb_site/console/tests/test_prefs.py
+++ b/qb_site/console/tests/test_prefs.py
@@ -7,10 +7,11 @@
 
 from __future__ import annotations
 
+import re
 from datetime import datetime, timedelta, timezone as dt_timezone
 from unittest.mock import MagicMock, patch
 
-from django.test import TestCase
+from django.test import TestCase, override_settings
 from django.urls import reverse
 from django.utils import timezone
 
@@ -234,27 +235,100 @@ def test_cannot_post_another_reviewers_row(self) -> None:
         self.assertEqual(other_pref.maximum_capacity, 3)
         self.assertEqual(other_pref.free_form, "carol's note")
 
-    def test_away_until_is_interpreted_in_the_resolved_timezone(self) -> None:
+    # ---- timezone ------------------------------------------------------
+    # The page renders times in the server's default zone and posts back, as `timezone`, the zone its
+    # times are in; prefs_form.js swaps both to the browser's zone. These pin the server's half.
+
+    def test_away_until_is_read_in_the_posted_timezone(self) -> None:
         self._login_session()
         data, index_by_id = self._post_data()
         i1 = index_by_id[self.pref1.id]
+        data["timezone"] = "Europe/Berlin"
         data[f"form-{i1}-away_until"] = "2026-03-01T09:00"
 
-        with patch("console.views.resolve_user_timezone_name", return_value="Europe/Berlin"):
-            resp = self.client.post(self.url, data=data)
+        resp = self.client.post(self.url, data=data)
 
         self.assertEqual(resp.status_code, 302)
         self.pref1.refresh_from_db()
-        self.assertEqual(
-            self.pref1.away_until.astimezone(dt_timezone.utc),
-            datetime(2026, 3, 1, 8, 0, tzinfo=dt_timezone.utc),
-        )
+        self.assertEqual(self.pref1.away_until, datetime(2026, 3, 1, 8, 0, tzinfo=dt_timezone.utc))
+
+    @override_settings(TIME_ZONE="UTC")
+    def test_away_until_without_a_posted_timezone_is_read_in_the_server_zone(self) -> None:
+        # A page rendered before this field existed, or a hand-rolled POST.
+        self._login_session()
+        data, index_by_id = self._post_data()
+        i1 = index_by_id[self.pref1.id]
+        data[f"form-{i1}-away_until"] = "2026-03-01T09:00"
+
+        resp = self.client.post(self.url, data=data)
+
+        self.assertEqual(resp.status_code, 302)
+        self.pref1.refresh_from_db()
+        self.assertEqual(self.pref1.away_until, datetime(2026, 3, 1, 9, 0, tzinfo=dt_timezone.utc))
+
+    def test_an_unknown_posted_timezone_saves_nothing(self) -> None:
+        # Every typed time would be misread, so the save is refused, not read in some other zone. The
+        # names cover each way ZoneInfo refuses a key: unknown, malformed, a directory, too long.
+        self._login_session()
+        for name in ("Mars/Olympus_Mons", "../etc/passwd", "Europe", "x" * 300):
+            with self.subTest(name=name[:20]):
+                data, index_by_id = self._post_data()
+                data["timezone"] = name
+                data[f"form-{index_by_id[self.pref1.id]}-maximum_capacity"] = "3"
+
+                resp = self.client.post(self.url, data=data)
+
+                self.assertContains(resp, "Nothing was saved", status_code=200)
+                self.pref1.refresh_from_db()
+                self.assertEqual(self.pref1.maximum_capacity, 10)
+
+    @override_settings(TIME_ZONE="UTC")
+    def test_away_until_round_trips_as_rendered_and_as_the_browser_rewrites_it(self) -> None:
+        # Posting the time back unchanged must leave it where it was, whichever zone it was shown in.
+        stored = datetime(2027, 7, 1, 10, 0, tzinfo=dt_timezone.utc)
+        ReviewerPreference.objects.filter(pk=self.pref1.pk).update(away_until=stored)
+        self._login_session()
+        data, index_by_id = self._post_data()
+        i1 = index_by_id[self.pref1.id]
+
+        page = self.client.get(self.url)
+        self.assertContains(page, 'name="timezone" id="prefs-timezone" value="UTC"')
+        self.assertContains(page, 'data-utc="2027-07-01T10:00:00+00:00"')
+        match = re.search(rf'name="form-{i1}-away_until" value="([^"]*)"', page.content.decode())
+        self.assertIsNotNone(match)
+        self.assertEqual(match.group(1), "2027-07-01T10:00")
+
+        for zone, shown in (("UTC", match.group(1)), ("Europe/Berlin", "2027-07-01T12:00")):
+            with self.subTest(zone=zone):
+                data["timezone"] = zone
+                data[f"form-{i1}-away_until"] = shown
+                # A change elsewhere in the row, so the row is saved and `away_until` rewritten.
+                data[f"form-{i1}-free_form"] = f"shown in {zone}"
+
+                resp = self.client.post(self.url, data=data)
+
+                self.assertEqual(resp.status_code, 302)
+                self.pref1.refresh_from_db()
+                self.assertEqual(self.pref1.away_until, stored)
+
+    @override_settings(TIME_ZONE="UTC")
+    def test_saved_time_is_a_time_element_for_the_browser_to_localize(self) -> None:
+        self._login_session()
+        # In the past on purpose: the session was issued against the real clock, so a frozen "now"
+        # after its expiry would bounce the request to sign-in.
+        frozen_now = datetime(2026, 7, 1, 10, 0, 30, 123456, tzinfo=dt_timezone.utc)
+
+        with patch("django.utils.timezone.now", return_value=frozen_now):
+            resp = self.client.get(f"{self.url}?saved=1")
+
+        self.assertContains(resp, 'Preferences saved at <time datetime="2026-07-01T10:00:30+00:00">2026-07-01 10:00 UTC</time>.')
 
-    def test_timezone_resolution_uses_the_reviewers_zulip_link(self) -> None:
+    def test_the_page_makes_no_zulip_call(self) -> None:
+        # The zone comes from the browser; the page used to ask Zulip for it on every render.
         self._login_session()
-        with patch("console.views.resolve_user_timezone_name", return_value="UTC") as resolver:
+        with patch("zulip_bot.services.zulip_client.ZulipClient.get_user_by_id") as get_user:
             self.client.get(self.url)
-        resolver.assert_called_once_with(user=self.reviewer)
+        get_user.assert_not_called()
 
     def test_home_links_to_the_prefs_page(self) -> None:
         self._login_session()
diff --git a/qb_site/console/views.py b/qb_site/console/views.py
index 5957039c..650fd0e4 100644
--- a/qb_site/console/views.py
+++ b/qb_site/console/views.py
@@ -12,7 +12,7 @@
 import logging
 import secrets
 from typing import Iterable, Sequence
-from zoneinfo import ZoneInfo
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from django.conf import settings
 from django.db import transaction
@@ -72,12 +72,6 @@
 from core.services.site_urls import build_site_url
 from syncer.models import PRLabel, PullRequest
 
-# The reviewer's timezone comes from Zulip's own user record, so the resolver lives in `zulip_bot`
-# (see `zulip_bot.services.user_timezone`). Console access itself stays independent of Zulip
-# reachability — an unlinked or unreachable Zulip only falls through to `core.User.timezone`, then the
-# project default.
-from zulip_bot.services.user_timezone import resolve_user_timezone_name
-
 log = logging.getLogger(__name__)
 
 # Shown to a GitHub account we cannot let in: unknown to us, a recycled login, or known but not a
@@ -406,6 +400,19 @@ def _recent_intake_by_repo(preferences: Sequence[ReviewerPreference]) -> dict[in
     return intake
 
 
+def _zone_or_none(name: str) -> ZoneInfo | None:
+    """The zone named ``name``, or ``None`` when this server cannot load it.
+
+    ``name`` is posted by the browser, so every way ``ZoneInfo`` refuses a key counts as unknown: no
+    such zone, a malformed key (``ValueError``), or one that trips over the filesystem, such as the
+    directory ``Europe`` or an over-long name (``OSError``).
+    """
+    try:
+        return ZoneInfo(name)
+    except (ZoneInfoNotFoundError, ValueError, OSError):
+        return None
+
+
 @require_http_methods(["GET", "POST"])
 def prefs(request: HttpRequest) -> HttpResponse:
     """Reviewer preferences at a stable, token-less URL (design doc 022).
@@ -423,38 +430,45 @@ def prefs(request: HttpRequest) -> HttpResponse:
         return redirect(_login_url(reverse("console:prefs")))
 
     preferences = preferences_for_user(reviewer)
-    user_timezone_name = resolve_user_timezone_name(user=reviewer)
-    user_timezone = ZoneInfo(user_timezone_name)
+    # The page's times are in the zone its form posts back as `timezone`: the server default as
+    # rendered, which prefs_form.js swaps for the browser's zone as it rewrites the times. Reading a
+    # POST in the zone it names stores the time the reviewer saw. A zone this server cannot load would
+    # misread every typed time, so then nothing is saved.
+    timezone_name = timezone.get_default_timezone_name()
+    if request.method == "POST":
+        timezone_name = str(request.POST.get("timezone") or "").strip() or timezone_name
+    page_timezone = _zone_or_none(timezone_name)
+    active_timezone = page_timezone or timezone.get_default_timezone()
 
     saved = request.method == "GET" and request.GET.get("saved") == "1"
-    saved_at = None
     formset = None
-    with timezone.override(user_timezone):
+    # Render inside the override too, not just validate: the `date` filter and the `away_until` widget
+    # convert aware datetimes to the zone active *at render time*.
+    with timezone.override(active_timezone):
         if preferences:
             formset = build_preferences_formset(
                 preferences=preferences,
-                user_timezone=user_timezone,
+                user_timezone=active_timezone,
                 data=request.POST if request.method == "POST" else None,
                 recent_intake_by_repo=_recent_intake_by_repo(preferences),
             )
-            if request.method == "POST" and formset.is_valid():
+            if request.method == "POST" and page_timezone is not None and formset.is_valid():
                 formset.save()
                 return redirect(f"{reverse('console:prefs')}?saved=1")
-        if saved:
-            saved_at = timezone.localtime(timezone.now(), user_timezone)
 
-    response = render(
-        request,
-        "console/prefs.html",
-        {
-            "reviewer": reviewer,
-            "formset": formset,
-            "saved": saved,
-            "saved_at": saved_at,
-            "user_timezone_name": user_timezone_name,
-            "logout_url": reverse("console:logout"),
-        },
-    )
+        response = render(
+            request,
+            "console/prefs.html",
+            {
+                "reviewer": reviewer,
+                "formset": formset,
+                "saved": saved,
+                "saved_at": timezone.now().replace(microsecond=0) if saved else None,
+                "timezone_name": timezone_name,
+                "timezone_unknown": page_timezone is None,
+                "logout_url": reverse("console:logout"),
+            },
+        )
     response["Cache-Control"] = "no-store"
     return response
 
diff --git a/qb_site/core/forms.py b/qb_site/core/forms.py
index b259e4b1..6d2d736e 100644
--- a/qb_site/core/forms.py
+++ b/qb_site/core/forms.py
@@ -247,11 +247,16 @@ def __init__(
         # The picker's list: the whole catalog, sorted the way the topic checkboxes are.
         self.excluded_label_options = sorted(self._label_catalog_by_casefold.values(), key=str.casefold)
 
-        tz_label = getattr(self._user_timezone, "key", str(self._user_timezone))
         community_team_page_warning = mark_safe(
             "<b>Publicly visible on <a href='https://leanprover-community.github.io/teams/reviewers.html'>the community team page</a>.</b>"
         )
-        self.fields["away_until"].help_text = f"Temporary break end time. Leave blank if active. Interpreted in {tz_label}."
+        self.fields[
+            "away_until"
+        ].help_text = "Temporary break end time, in the timezone named above the form. Leave blank if active."
+        # The stored instant, from which the console's prefs_form.js shows this time in the browser's zone
+        # (design doc 022). Per form: Django deep-copies each field's widget for every form instance.
+        if self.instance.away_until is not None:
+            self.fields["away_until"].widget.attrs["data-utc"] = self.instance.away_until.isoformat(timespec="seconds")
         self.fields["auto_assign"].help_text = "Turn this off to opt out of automatic reviewer assignment for this repository."
         # The two capacity gates sit side by side in the grid and are easy to confuse, so each says
         # which kind of limit it is: this one bounds the PRs held at once (stock), the next bounds
diff --git a/qb_site/core/services/reviewer_prefs.py b/qb_site/core/services/reviewer_prefs.py
index 5b50157f..80c43da2 100644
--- a/qb_site/core/services/reviewer_prefs.py
+++ b/qb_site/core/services/reviewer_prefs.py
@@ -56,7 +56,7 @@ def build_preferences_formset(
     """Build the formset over ``preferences`` (already authorized by the caller).
 
     ``data`` bound → a POST; ``None`` → a fresh render. ``user_timezone`` is what naive
-    ``away_until`` input is interpreted in (see ``zulip_bot.services.user_timezone``).
+    ``away_until`` input is interpreted in: the zone the page was shown in (see ``console.views.prefs``).
 
     ``recent_intake_by_repo`` (``repository_id -> new PRs in the rolling window``) is displayed
     beside the rate-limit field so a reviewer can pick a number against their own history rather
diff --git a/qb_site/templates/console/prefs.html b/qb_site/templates/console/prefs.html
index 605ca811..f20aa94b 100644
--- a/qb_site/templates/console/prefs.html
+++ b/qb_site/templates/console/prefs.html
@@ -19,7 +19,13 @@ <h1>Reviewer preferences</h1>
 
   {% if saved %}
     <div class="status status-ok" role="status">
-      Preferences saved{% if saved_at %} at {{ saved_at|date:"Y-m-d H:i" }} ({{ user_timezone_name }}){% endif %}.
+      Preferences saved{% if saved_at %} at <time datetime="{{ saved_at.isoformat }}">{{ saved_at|date:"Y-m-d H:i" }} {{ timezone_name }}</time>{% endif %}.
+    </div>
+  {% endif %}
+  {% if timezone_unknown %}
+    <div class="status status-error" role="alert">
+      Nothing was saved: your browser gave its timezone as “{{ timezone_name }}”, which this server does not
+      recognise, so the times on this page could not be read.
     </div>
   {% endif %}
 
@@ -32,14 +38,20 @@ <h1>Reviewer preferences</h1>
     `prefs-root` and `prefs-form` are the ids console/prefs_form.js mounts on. No countdown: the
     session bounds this page, not a link TTL. Note Django only strips {# #} comments on a single line
     — anything multi-line must use {% comment %} or it renders as page text.
+
+    Times render in `timezone_name`, which the hidden `prefs-timezone` field posts back. prefs_form.js
+    rewrites the times into the browser's zone and sets that field (and each `js-timezone-name`) to
+    it, so the server always reads a time in the zone it was shown in. `autocomplete="off"` keeps a
+    reload from restoring the browser's zone over a page rendered in the server's.
     {% endcomment %}
     <div id="prefs-root">
       {# `.meta` is hero-only (pale text for the dark gradient); this strip is the light-background idiom. #}
       <section class="form-context">
-        <span>Times are entered and shown in <strong>{{ user_timezone_name }}</strong></span>
+        <span>Times are entered and shown in <strong class="js-timezone-name">{{ timezone_name }}</strong></span>
       </section>
       <form method="post" id="prefs-form">
         {% csrf_token %}
+        <input type="hidden" name="timezone" id="prefs-timezone" value="{{ timezone_name }}" autocomplete="off">
         {% include "shared/_reviewer_prefs_fields.html" %}
 
         <div class="btn-row">
diff --git a/qb_site/zulip_bot/AGENTS.md b/qb_site/zulip_bot/AGENTS.md
index 38ace03c..5abc813f 100644
--- a/qb_site/zulip_bot/AGENTS.md
+++ b/qb_site/zulip_bot/AGENTS.md
@@ -98,16 +98,11 @@ post a reply there. `console` is the deliberate exception, an in-place reply by
     differ per action, and they stay per-action so a `label-pr` token can never validate as a
     `close-pr` one. Commands read the DM's quoted expiry from its `ttl_seconds()` rather than
     re-reading the setting, so the promise and the real `exp` cannot drift),
-  - `user_timezone.py` (the timezone a reviewer's local times are interpreted in: Zulip's reported
-    zone → `core.User.timezone` → Django default). Shared with the console prefs page so a naive
-    `away_until` means the same thing on both; it lives here because the authoritative source is
-    Zulip's user record, and `core` carries no app dependencies.
 - **This app does not own the preferences form.** It lives in the reviewer console
   (`/console/preferences/`, design doc 022): `core.forms.ReviewerPreferenceForm` owns the editable
   fields and validation, `core.services.reviewer_prefs` the formset assembly, and
   `templates/shared/_reviewer_prefs_fields.html` the markup. The expiring `prefs` token page here was
-  retired; this app's remaining role is the `prefs` command (which DMs the console URL) and the
-  timezone resolver above.
+  retired; this app's remaining role is the `prefs` command (which DMs the console URL).
 - `views.register_github_callback` **opens the console session** (`console.session.set_reviewer`) when
   the new reviewer has rows to edit, so the "Edit Preferences Now" link lands signed in instead of
   bouncing through OAuth again. That promotion is strictly stronger than a console sign-in:
diff --git a/qb_site/zulip_bot/frontend/tests/prefs_form.test.js b/qb_site/zulip_bot/frontend/tests/prefs_form.test.js
index 7924d60a..ac1d7cbf 100644
--- a/qb_site/zulip_bot/frontend/tests/prefs_form.test.js
+++ b/qb_site/zulip_bot/frontend/tests/prefs_form.test.js
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
-import { mountLabelPicker, mountPrefsForm } from "../../../console/static/console/prefs_form.js";
+import { mountLabelPicker, mountPrefsForm, toDatetimeLocalValue } from "../../../console/static/console/prefs_form.js";
 
 describe("mountPrefsForm", () => {
   it("wires the clear-away buttons and leaves submit enabled", () => {
@@ -67,6 +67,68 @@ describe("mountPrefsForm", () => {
   });
 });
 
+// Times in the browser's zone (design doc 022). The markup mirrors `prefs.html` and the `away_until`
+// widget from `ReviewerPreferenceForm`.
+describe("browser timezone", () => {
+  const renderPage = ({ zone, away, utc }) => {
+    document.body.innerHTML = `
+      <main id="prefs-root">
+        <p>Times are entered and shown in <strong class="js-timezone-name">${zone}</strong></p>
+        <form id="prefs-form">
+          <input type="hidden" id="prefs-timezone" name="timezone" value="${zone}" />
+          <input type="datetime-local" id="away" name="form-0-away_until" value="${away}" data-utc="${utc}" />
+          <button id="submit-button" type="submit">Save</button>
+        </form>
+      </main>
+    `;
+  };
+  const shown = () => ({
+    away: document.getElementById("away").value,
+    zone: document.getElementById("prefs-timezone").value,
+    label: document.querySelector(".js-timezone-name").textContent,
+  });
+
+  it("formats an instant on another zone's wall clock", () => {
+    const instant = new Date("2027-07-01T10:00:00+00:00");
+    expect(toDatetimeLocalValue(instant, "Europe/Berlin")).toBe("2027-07-01T12:00");
+    expect(toDatetimeLocalValue(instant, "America/New_York")).toBe("2027-07-01T06:00");
+    expect(toDatetimeLocalValue(new Date("2027-01-01T23:30:00+00:00"), "Europe/Berlin")).toBe("2027-01-02T00:30");
+  });
+
+  it("rewrites the server's times into the browser's zone and posts that zone back", () => {
+    renderPage({ zone: "UTC", away: "2027-07-01T10:00", utc: "2027-07-01T10:00:00+00:00" });
+    const unmount = mountPrefsForm(document, "Europe/Berlin");
+
+    expect(shown()).toEqual({ away: "2027-07-01T12:00", zone: "Europe/Berlin", label: "Europe/Berlin" });
+    // The rewrite is not an unsaved change.
+    const event = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(event);
+    expect(event.defaultPrevented).toBe(false);
+    unmount();
+  });
+
+  it("keeps what was typed on a page already in the browser's zone", () => {
+    // A re-render after a failed save shows the posted value, in the zone it was posted in.
+    renderPage({ zone: "Europe/Berlin", away: "2027-07-02T08:00", utc: "2027-07-01T10:00:00+00:00" });
+    const unmount = mountPrefsForm(document, "Europe/Berlin");
+
+    expect(shown()).toEqual({ away: "2027-07-02T08:00", zone: "Europe/Berlin", label: "Europe/Berlin" });
+    unmount();
+  });
+
+  it("stays in the server's zone when the browser gives none or a time cannot be read", () => {
+    renderPage({ zone: "UTC", away: "2027-07-01T10:00", utc: "2027-07-01T10:00:00+00:00" });
+    let unmount = mountPrefsForm(document, "");
+    expect(shown()).toEqual({ away: "2027-07-01T10:00", zone: "UTC", label: "UTC" });
+    unmount();
+
+    renderPage({ zone: "UTC", away: "2027-07-01T10:00", utc: "not a time" });
+    unmount = mountPrefsForm(document, "Europe/Berlin");
+    expect(shown()).toEqual({ away: "2027-07-01T10:00", zone: "UTC", label: "UTC" });
+    unmount();
+  });
+});
+
 // The excluded-labels picker (design doc 057). The markup mirrors `_reviewer_prefs_fields.html`.
 const CATALOG = ["LLM-generated", "needs-review, blocked", "t-algebra", "t-algebraic-geometry", "WIP"];
 
diff --git a/qb_site/zulip_bot/services/user_timezone.py b/qb_site/zulip_bot/services/user_timezone.py
deleted file mode 100644
index f846867f..00000000
--- a/qb_site/zulip_bot/services/user_timezone.py
+++ /dev/null
@@ -1,76 +0,0 @@
-"""Resolve the timezone to interpret a reviewer's local times in.
-
-Lives in ``zulip_bot`` because the authoritative source is Zulip's own user record (which Zulip
-derives from the user's browser); ``core`` stays free of app dependencies. Consumed by the reviewer
-console's preferences page, where it decides what the naive ``datetime-local`` ``away_until`` input
-means (design doc 022).
-
-Resolution order: Zulip's reported timezone → ``core.User.timezone`` → the Django default. A missing
-Zulip link (or an unconfigured/unreachable Zulip) simply falls through; it is never an error. Note
-``core.User.timezone`` is currently only ever set by hand in the Django admin, so in practice the
-fallback is the project default until we persist a browser-reported zone (022, deferred).
-"""
-
-from __future__ import annotations
-
-import logging
-from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
-
-from django.conf import settings
-from django.utils import timezone
-
-from core.models import User
-from zulip_bot.services.zulip_client import ZulipApiError, ZulipClient
-
-logger = logging.getLogger(__name__)
-
-
-def resolve_user_timezone_name(*, user: User, zulip_user_id: int | None = None) -> str:
-    """Return an IANA timezone name for ``user``, preferring what Zulip reports.
-
-    ``zulip_user_id`` defaults to the user's own linked Zulip id; pass it explicitly when the caller
-    holds a verified id from elsewhere (the prefs token carries one).
-    """
-    lookup_id = zulip_user_id if zulip_user_id is not None else user.zulip_user_id
-    if lookup_id is not None:
-        zulip_tz_name = fetch_zulip_user_timezone_name(int(lookup_id))
-        if zulip_tz_name:
-            return zulip_tz_name
-    if user.timezone and is_valid_timezone_name(user.timezone):
-        return user.timezone
-    return timezone.get_default_timezone_name()
-
-
-def fetch_zulip_user_timezone_name(zulip_user_id: int) -> str | None:
-    base_url = getattr(settings, "ZULIP_BASE_URL", "").strip()
-    bot_email = getattr(settings, "ZULIP_BOT_EMAIL", "").strip()
-    bot_api_key = getattr(settings, "ZULIP_BOT_API_KEY", "").strip()
-    if not base_url or not bot_email or not bot_api_key:
-        return None
-    try:
-        payload = ZulipClient().get_user_by_id(zulip_user_id)
-    except ZulipApiError:
-        logger.exception("zulip_timezone_lookup_failed", extra={"zulip_user_id": zulip_user_id})
-        return None
-    user = payload.get("user")
-    if not isinstance(user, dict):
-        return None
-    timezone_name = user.get("timezone")
-    if isinstance(timezone_name, str) and is_valid_timezone_name(timezone_name):
-        return timezone_name
-    return None
-
-
-def is_valid_timezone_name(value: str) -> bool:
-    try:
-        ZoneInfo(value)
-    except ZoneInfoNotFoundError:
-        return False
-    return True
-
-
-__all__ = [
-    "resolve_user_timezone_name",
-    "fetch_zulip_user_timezone_name",
-    "is_valid_timezone_name",
-]
diff --git a/qb_site/zulip_bot/tests/test_user_timezone.py b/qb_site/zulip_bot/tests/test_user_timezone.py
deleted file mode 100644
index 3eea4f2e..00000000
--- a/qb_site/zulip_bot/tests/test_user_timezone.py
+++ /dev/null
@@ -1,75 +0,0 @@
-"""The timezone chain behind every reviewer-facing local time (design docs 022, 050).
-
-`away_until` is entered as a naive `datetime-local`, so what this resolves to decides what a
-reviewer's break time actually means. Zulip's own user record is the authority; the fallbacks exist
-for reviewers with no Zulip link (e.g. created by `import_reviewer_topics`).
-"""
-
-from __future__ import annotations
-
-from unittest.mock import patch
-
-from django.test import SimpleTestCase, TestCase, override_settings
-
-from core.models import User
-from zulip_bot.services.user_timezone import is_valid_timezone_name, resolve_user_timezone_name
-from zulip_bot.services.zulip_client import ZulipApiError
-
-
-@override_settings(
-    ZULIP_BASE_URL="https://zulip.example",
-    ZULIP_BOT_EMAIL="bot@example.com",
-    ZULIP_BOT_API_KEY="key",
-    TIME_ZONE="UTC",
-)
-class ResolveUserTimezoneNameTests(TestCase):
-    def test_prefers_the_zone_zulip_reports(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        with patch(
-            "zulip_bot.services.user_timezone.ZulipClient.get_user_by_id",
-            return_value={"user": {"timezone": "Europe/Berlin"}},
-        ):
-            self.assertEqual(resolve_user_timezone_name(user=user), "Europe/Berlin")
-
-    def test_explicit_zulip_id_overrides_the_stored_link(self) -> None:
-        # The caller may hold a verified id from elsewhere; it must win over the user's own field.
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101)
-        with patch(
-            "zulip_bot.services.user_timezone.ZulipClient.get_user_by_id",
-            return_value={"user": {"timezone": "Europe/Berlin"}},
-        ) as lookup:
-            resolve_user_timezone_name(user=user, zulip_user_id=999)
-        lookup.assert_called_once_with(999)
-
-    def test_falls_back_to_the_stored_user_timezone(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        with patch("zulip_bot.services.user_timezone.ZulipClient.get_user_by_id", side_effect=ZulipApiError("boom")):
-            self.assertEqual(resolve_user_timezone_name(user=user), "America/New_York")
-
-    def test_falls_back_to_the_project_default(self) -> None:
-        # No Zulip link at all — the importer-created reviewer case.
-        user = User.objects.create(github_login="reviewer")
-        self.assertEqual(resolve_user_timezone_name(user=user), "UTC")
-
-    def test_ignores_an_invalid_zone_from_zulip(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        with patch(
-            "zulip_bot.services.user_timezone.ZulipClient.get_user_by_id",
-            return_value={"user": {"timezone": "Mars/Olympus_Mons"}},
-        ):
-            self.assertEqual(resolve_user_timezone_name(user=user), "America/New_York")
-
-    def test_ignores_an_invalid_stored_zone(self) -> None:
-        user = User.objects.create(github_login="reviewer", timezone="Mars/Olympus_Mons")
-        self.assertEqual(resolve_user_timezone_name(user=user), "UTC")
-
-    @override_settings(ZULIP_BASE_URL="", ZULIP_BOT_EMAIL="", ZULIP_BOT_API_KEY="")
-    def test_unconfigured_zulip_is_not_an_error(self) -> None:
-        user = User.objects.create(github_login="reviewer", zulip_user_id=101, timezone="America/New_York")
-        self.assertEqual(resolve_user_timezone_name(user=user), "America/New_York")
-
-
-class IsValidTimezoneNameTests(SimpleTestCase):
-    def test_accepts_known_zones_and_rejects_junk(self) -> None:
-        self.assertTrue(is_valid_timezone_name("Europe/Berlin"))
-        self.assertFalse(is_valid_timezone_name("Mars/Olympus_Mons"))