docs: add Gitea workflows, issue/PR templates, README and licence notice

ci.yml calls `scripts/ci.sh` rather than restating the checks: a workflow that reimplements them becomes a second definition of "done", and the two drift. Android runs as a separate job. It fails when the SDK is absent while ci.sh skips it — a developer should not be blocked by a missing toolchain, but a silently skipped Android build in CI means regressions ship unnoticed. Every action is pinned to an exact version. LICENSE.md records that no licence is chosen yet, and why it is not a formality: the choice is upstream of the UI toolkit decision, since Slint is GPL-3.0. Co-Authored-By: Claude Code <noreply@anthropic.com>
docs: add ADR log, architecture, limitations, permissions, perf, testing
2026-10-01 15:56:13 +03:00 · 2026-10-01 15:22:24 +03:00 · 2026-10-01 15:16:58 +03:00 · 2026-10-01 15:02:20 +03:00 · 2026-10-01 14:04:39 +03:00
14 changed files with 37 additions and 1788 deletions
@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 [[package]]
 name = "bitflags"
 version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 [[package]]
 name = "blocker-core"
 version = "0.1.0"
@@ -17,7 +11,6 @@ name = "blocker-daemon"
 version = "0.1.0"
 dependencies = [
 "blocker-core",
 "blocker-storage",
 ]
 [[package]]
@@ -34,14 +27,6 @@ dependencies = [
 "blocker-core",
 ]
 [[package]]
 name = "blocker-storage"
 version = "0.1.0"
 dependencies = [
 "blocker-core",
 "rusqlite",
 ]
 [[package]]
 name = "blocker-tests"
 version = "0.1.0"
@@ -52,104 +37,3 @@ dependencies = [
 [[package]]
 name = "blocker-ui"
 version = "0.1.0"
 [[package]]
 name = "cc"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f360145194ee8e21db5ee7f3fcd4fe52210864c75c985dae33218202c8bbe040"
 dependencies = [
 "find-msvc-tools",
 "shlex",
 ]
 [[package]]
 name = "fallible-iterator"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
 [[package]]
 name = "fallible-streaming-iterator"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 [[package]]
 name = "foldhash"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
 "foldhash",
 ]
 [[package]]
 name = "hashlink"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
 dependencies = [
 "hashbrown",
 ]
 [[package]]
 name = "libsqlite3-sys"
 version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
 dependencies = [
 "cc",
 "pkg-config",
 "vcpkg",
 ]
 [[package]]
 name = "pkg-config"
 version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 [[package]]
 name = "rusqlite"
 version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
 dependencies = [
 "bitflags",
 "fallible-iterator",
 "fallible-streaming-iterator",
 "hashlink",
 "libsqlite3-sys",
 "smallvec",
 ]
 [[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 [[package]]
 name = "smallvec"
 version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
@@ -2,7 +2,6 @@
 resolver = "2"
 members = [
    "core",
    "storage",
    "tests",
    "desktop/daemon",
    "desktop/ui",
@@ -16,7 +16,7 @@ enforces anything yet. No platform has a working build.
 | Milestone | State |
 |---|---|
 | M0 repo bootstrap | in progress |
-| M1 core engine | engine, lock timers and safety guarantees written and tested; SQLite persistence landed in `storage/` |
+| M1 core engine | engine, lock timers and safety guarantees written and tested; storage has no I/O yet |
 | M2-Linux | not started — daemon is a placeholder |
 | M3-Android | not started |
 | M4 conditions | not started |
@@ -74,7 +74,6 @@ summary as not-passes. A skip is never reported as a pass.
 ```
 core/                 the decision engine — pure, no OS calls, no dependencies
 storage/              SQLite persistence (rusqlite, bundled), fail-open recovery
 tests/                golden decision tables, and the engine purity check
 desktop/daemon/       long-lived observer and enforcer (5 MB budget)
 desktop/ui/           block-screen window, launched on demand
@@ -107,10 +106,9 @@ scripts/              ci.sh, size-check.sh
 | Daemon binary | ≤ 5 MB stripped |
 | APK size | ≤ 10 MB |
-Currently measured: **1.364 MB** stripped daemon, which includes bundled SQLite.
+Currently measured: **0.279 MB** stripped daemon — a placeholder that prints two
-Of the 5 MB budget that leaves 3.8 MB for D-Bus, X11 and a UI toolkit — a real
+lines. The meaningful number comes in M2-Linux. Enforced in CI from the first
-margin rather than a comfortable one. Enforced in CI from the first commit by
+commit by `scripts/size-check.sh`.
 `scripts/size-check.sh`.
 ## Licence
@@ -17,4 +17,3 @@ path = "src/main.rs"
 # (zbus for D-Bus, x11rb for X11) arrive in M2-Linux, each with an ADR entry.
 [dependencies]
 blocker-core = { path = "../../core" }
 blocker-storage = { path = "../../storage" }
@@ -2,16 +2,16 @@
 //!
 //! The daemon observes the OS and enforces the decisions `blocker-core` makes.
 //! It contains **no decision logic of its own** (CLAUDE.md section 2): if the
-//! daemon ever decides that something should be blocked, the Android and desktop
+//! daemon ever decides that something should be blocked, the Android and
-//! builds will drift and the golden tables stop being a parity contract.
+//! desktop builds will drift and the golden tables stop being a parity contract.
 //!
 //! # Shape
 //!
 //! Two processes, deliberately:
 //!
-//! - the **daemon** — small, long-lived, holds the block window machinery and
+//! - the **daemon** — small, long-lived, stays resident, holds the block window
-//!   the engine connection. This is the binary with the 5 MB stripped budget
+//!   machinery and the engine connection. This is the binary with the 5 MB
-//!   (section 5).
+//!   stripped budget (section 5).
 //! - the **UI** (`blocker-ui`) — a separate process launched to show a block
 //!   screen, which exits when the block lifts.
 //!
@@ -20,74 +20,14 @@
 //!
 //! # Event loop
 //!
-//! M2-Linux replaces the startup path below with a loop that blocks on exactly
+//! M2-Linux replaces this placeholder with a loop that blocks on exactly three
-//! three things: a focus-change event from the active
+//! things: a focus-change event from the active
-//! [`ForegroundWatcher`](../../blocker_platform_linux/index.html) backend, the
+//! [`ForegroundWatcher`](../../blocker_core/index.html) backend, the
 //! `next_wakeup` instant from the engine, and IPC from the UI. There is no
 //! polling tick anywhere — an idle daemon takes zero wakeups, which is how the
 //! section 5 idle-CPU budget is met.
 //!
 //! # Where the database lives
 //!
 //! Under the XDG data directory, never beside the binary. The binary may be
 //! installed read-only in `/usr/bin`, while the database must be writable and
 //! must survive an upgrade.
-use std::path::PathBuf;
+fn main() {
-use std::process::ExitCode;
+    println!("blocker-daemon {} (M0 placeholder)", env!("CARGO_PKG_VERSION"));
 /// `~/.local/share/blocker/blocker.db`, honouring `XDG_DATA_HOME`.
 fn database_path() -> PathBuf {
    let base = std::env::var_os("XDG_DATA_HOME")
        .map(PathBuf::from)
        .filter(|p| p.is_absolute())
        .unwrap_or_else(|| {
            let home =
                std::env::var_os("HOME").map(PathBuf::from).unwrap_or_else(|| PathBuf::from("."));
            home.join(".local/share")
        });
    base.join("blocker").join("blocker.db")
 }
 fn main() -> ExitCode {
    let path = database_path();
    // Section 1.5.4: a corrupt or unusable database must never leave the device
    // unusable. `Store::open` handles corruption by moving the damaged file
    // aside and starting clean, so what reaches the `Err` arm is genuinely fatal
    // — an unwritable directory, say. Even then we exit with a message rather
    // than panicking: a daemon that crashes on startup is worse than one that
    // reports the problem and stops.
    let store = match blocker_storage::Store::open(&path) {
        Ok(store) => store,
        Err(e) => {
            eprintln!("blocker-daemon: cannot open storage at {}: {e}", path.display());
            eprintln!("blocking is disabled until this is fixed; see docs/LIMITATIONS.md");
            return ExitCode::FAILURE;
        }
    };
    if store.recovered_from_corruption() {
        // Logged, not swallowed: section 1.5.4 wants the recovery recorded.
        eprintln!(
            "blocker-daemon: database was corrupt and has been moved to {}.corrupt; \
             starting clean, so no schedules are active until you re-add them",
            path.display()
        );
    }
    let schedules = match store.load_schedules() {
        Ok(s) => s,
        Err(e) => {
            eprintln!("blocker-daemon: cannot read schedules: {e}");
            return ExitCode::FAILURE;
        }
    };
    println!("blocker-daemon {} (M0/M1)", env!("CARGO_PKG_VERSION"));
    println!("database: {}", path.display());
    println!("schedules: {}", schedules.len());
    println!("enforcement lands in M2-Linux; see docs/DECISIONS.md for the ADR log");
    ExitCode::SUCCESS
 }
@@ -182,17 +182,10 @@ APK size cost is unacceptable, which is a measurement before it is a decision.
 | `usage` | foreground-time and launch-count accumulation into daily and hourly buckets |
 | `lock` | lock levels, the friction ladder's timing, monotonic anti-tamper |
 | `never_block` | the section 1.5.4 safety list |
-| `storage` | *(separate crate: `blocker-storage`)* the SQLite schema and its fail-open recovery policy |
+| `storage` | the SQLite schema and its fail-open recovery policy |
-`blocker-storage` is a sibling crate, not a submodule. It depends on
+`storage` has no I/O behind it yet — see `LIMITATIONS.md`. The schema is written
-`blocker-core`; `blocker-core` does not depend on it, and depends on nothing at
+and reviewed as text so it can be reviewed before it is compiled.
 all. That direction is what lets `tests/purity.rs` keep checking "blocker-core has
 zero dependencies" — an automatic proof that the engine cannot do I/O — instead of
 the weaker and easily-routed-around alternative of grepping the source for
 `rusqlite`.
 Both crates occupy the same layer of the diagram above: storage is shared by every
 platform and contains no platform code.
 ## Where the platform crates start and stop
@@ -25,7 +25,7 @@ which parts to trust.
 | [1](#adr-1) | Rust for core and desktop, Kotlin for the Android shell | Accepted |
 | [2](#adr-2) | One shared core; the engine is a pure function | Accepted |
 | [3](#adr-3) | Event-driven with `next_wakeup`, never polling | Accepted |
-| [4](#adr-4) | SQLite via rusqlite, in its own crate | Accepted, one trade-off open |
+| [4](#adr-4) | SQLite via rusqlite, bundled | Proposed |
 | [5](#adr-5) | uniffi for core-to-Kotlin bindings | Proposed |
 | [6](#adr-6) | Desktop UI toolkit — Slint vs egui | **Proposed, needs owner** |
 | [7](#adr-7) | Desktop website blocking mechanism | **Accepted — owner chose extension** |
@@ -108,46 +108,24 @@ it is supposed to start blocking.
 ---
 <a id="adr-4"></a>
-## ADR-4: SQLite via rusqlite
+## ADR-4: SQLite via rusqlite, bundled
-**Status:** Accepted and implemented, with one trade-off still open
+**Status:** Proposed — dependency not yet added
 **Context.** Section 3 specifies `rusqlite` with bundled SQLite. Section 1.5.3
 requires lock and Strict state to live in the core database rather than in
 editable plaintext config.
-**Decision.** `rusqlite` with `bundled`, in a **separate `blocker-storage` crate**
+**Decision.** `rusqlite` with `bundled`, storing schedules, lock state, and usage
-that depends on `blocker-core`, never the reverse.
+counters in one file.
-**Why the separate crate.** The purity contract says the engine does no I/O, and
+**Consequences.** The schema is written and reviewed in
-`tests/purity.rs` enforces that mechanically by failing if `blocker-core` has any
+`core/src/storage.rs` before the crate is added, so it can be reviewed as text.
-dependency at all. Putting `rusqlite` in `blocker-core` would have forced that
+Bundling compiles SQLite from source, which costs build time and binary size but
-check to degrade into a source-text grep — something a careful developer can route
+removes a system dependency — a real consideration on the machines this ships to.
 around, and something nobody reads in six months. Splitting keeps the check
 automatic.
-Both crates sit in the same layer of the section 2 diagram: storage is shared by
+The binary-size cost has not yet been measured against the 5 MB budget. That is
-every platform and contains no platform code. This is a refinement that makes the
+an open item, not a settled fact.
 guarantee checkable, not an architectural departure.
 **Measured consequences.**
 - Bundled SQLite costs **~1.1 MB** of the 5 MB stripped daemon budget (1.364 MB
  total, from 0.279 MB without it). That leaves 3.8 MB for D-Bus, X11 and a UI
  toolkit — a real margin, not a comfortable one.
 - The build compiles SQLite from C source, which is a noticeable first-build cost.
 - System-linking would reclaim most of the 1.1 MB at the price of a runtime
  dependency on the host's libsqlite3, and a schema-format mismatch that only
  appears on a user's machine.
 **Still open:** bundled vs system-linked. Measured cost is now known; the decision
 is the owner's.
 **Schema notes.** Relational (`schedule_target`, `schedule_condition`) rather than
 JSON blobs in a text column, because target rows are queried by target and an
 index on a JSON string is not a plan. Serialisation is hand-written in
 `storage/src/codec.rs` — `serde` is not a section 3 dependency, and section 0 rule
 3 requires asking before adding one (ADR-13).
 ---
@@ -177,9 +177,9 @@ not mistaken for platform facts.
 - **`ProcessBackend` is not implemented.** ADR-14 lists three backends; the KWin
  and X11 paths land in M2-Linux, and the process fallback is weaker than the
  spec assumes because of the `/proc/connectors` gap above.
- **`rusqlite` vs system-linked SQLite is unresolved** (ADR-4). Bundled is built
+- **`rusqlite` has not been added.** The schema is written and reviewed in
-  and costs ~1.1 MB of the 5 MB daemon budget. System-linking would reclaim most
+  `core/src/storage.rs` (ADR-4) but storage has no I/O behind it yet, so nothing
-  of that but adds a runtime dependency on the host's libsqlite3.
+  persists. A restart loses all state.
 - **Lock state is not yet persisted or enforced.** `core/src/lock.rs` has the
  timers, the escalation, and the wall-clock correction, all tested. The state
  machine is not yet driven from a UI, and `LockState::evaluate` currently returns
@@ -188,8 +188,6 @@ not mistaken for platform facts.
  `tests/src/golden.rs`; parsing needs serde, which is a dependency decision
  awaiting sign-off (ADR-13, ADR-16). The behavioural coverage that exists today
  is hand-written unit tests in the same spirit.
 - **`LockState` still always evaluates to `Normal`** — persistence works, but no
  UI drives the lock state machine yet.
 - **`Condition::UsageLimit` and `LaunchCount` sum across all targets** rather
  than the schedule's own target set, until targets carry usage keys.
 - **Windows is entirely unimplemented** and cannot be compiled or tested on the
@@ -29,26 +29,17 @@ Measured on: Ubuntu 26.04 LTS, KDE Plasma 6.6.6, 6 CPUs. Toolchain: rustc 1.98.1
 | Metric | Target | Measured | When |
 |---|---|---|---|
-| Daemon binary (stripped, release) | ≤ 5 MB | **1.364 MB** | 2026-10-01, M1 |
+| Daemon binary (stripped, release) | ≤ 5 MB | **0.279 MB** | 2026-10-01, M0 |
 | Block latency | ≤ 150 ms | not measured | — |
 | Idle CPU | ~0% | not measured | — |
 | Idle RAM (daemon) | ≤ 15 MB RSS | not measured | — |
 | Idle wakeups | ≤ 1/min | not measured | — |
 | APK size | ≤ 10 MB | not measured | — |
-**What the 1.364 MB contains, and why it matters.** That figure is with bundled
+The binary figure is real but nearly meaningless right now: the daemon is two
-SQLite linked in and the daemon actually opening a database — not the 0.279 MB
+`println!` lines. The meaningful measurement comes in M2-Linux once enforcement
-placeholder from M0, which was two `println!` lines and excluded SQLite entirely
+exists, and the real risk is at that point — D-Bus, X11, and a UI toolkit are
-through dead-code elimination.
+where 5 MB would actually be threatened.
 So the honest read is: **bundled SQLite costs roughly 1.1 MB of a 5 MB budget.**
 That leaves 3.8 MB for D-Bus, X11, and the UI toolkit. It is a real constraint
 rather than a comfortable margin, and it is the first number that makes the
 section 5 budget feel like a budget instead of a formality.
 It also makes ADR-4 (rusqlite bundled vs system-linked) a genuine trade-off rather
 than a settled one: system-linking would recover most of that 1.1 MB at the cost
 of a runtime dependency on the host's libsqlite3. Recorded as an open question.
 ## How to measure
@@ -1,35 +0,0 @@
 [package]
 name = "blocker-storage"
 version = "0.1.0"
 edition = "2021"
 description = "SQLite persistence for Blocker: schedules, lock state, and usage counters."
 license = "UNLICENSED"
 [dependencies]
 blocker-core = { path = "../core" }
 # rusqlite with bundled SQLite, per CLAUDE.md section 3. Bundled rather than
 # system-linked because the app ships to machines where libsqlite3 may be absent
 # or a different major version, and a storage-format mismatch that only shows up
 # on a user's machine is not a failure mode worth carrying.
 #
 # THIS CRATE IS NOT DEPENDENT ON BY blocker-core.
 #
 # That is the entire reason this crate exists separately. CLAUDE.md section 2
 # requires the engine to be a pure function with no I/O, and the strongest
 # mechanical check for that is "blocker-core has zero dependencies" — a test
 # that reads Cargo.lock and fails on any entry. Keeping storage in its own crate
 # lets that test stay strict and automatic, instead of degrading into a source
 # grep that someone can route around.
 #
 # Both crates sit in the same layer: storage is shared by every platform and
 # contains no platform code, so this is a refinement of the section 2 diagram,
 # not a departure from it.
 rusqlite = { version = "0.37", features = ["bundled"] }
 [lints]
 workspace = true
 [lib]
 name = "blocker_storage"
 path = "src/lib.rs"
@@ -1,347 +0,0 @@
 //! Encoding between model types and their database representation.
 //!
 //! Split out from the SQL so the tricky part — turning a `Condition` into
 //! nullable columns and back without silently losing a field — is testable
 //! without a database, and so a decode failure has somewhere precise to point.
 //!
 //! # Why this is hand-written rather than serde
 //!
 //! `serde` is not a CLAUDE.md section 3 dependency, and section 0 rule 3 requires
 //! stopping to ask before adding one. The encoding is a few hundred lines of
 //! mechanical match arms, which is a real cost — and it is the cost of not adding
 //! a dependency without permission. If serde is approved later, this module is the
 //! only thing that changes.
 //!
 //! # Decoding never panics
 //!
 //! Every decode failure returns [`DecodeError`]. A database written by a newer
 //! version, or corrupted by hand, must produce a diagnosable error rather than a
 //! panic: this is enforcement code, and section 1.5.4 requires failing open.
 use blocker_core::model::{
    Condition, DayOfWeek, MinuteOfDay, Schedule, ScheduleMode, Target, TimeWindow, UsageWindow,
 };
 /// Why stored bytes could not become a model value.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum DecodeError {
    /// A `mode` column held something other than the two known values.
    UnknownMode(String),
    /// A `level` column held something other than the three known values.
    UnknownLevel(String),
    /// A `kind` column held something unrecognised.
    UnknownKind(String),
    /// A target string was empty.
    EmptyTarget,
    /// A `start`/`end` time was not `HH:MM`, or was outside 0..1440.
    BadTime(String),
    /// A time of day fell outside 0..1440 minutes.
    MinuteOutOfRange(i64),
    /// A `days` list was malformed, or held a value outside 0..=6.
    BadDays(String),
    /// A boolean column was neither 0 nor 1.
    BadFlag(i64),
    /// A numeric column was negative where only a count is meaningful.
    NegativeCount(i64),
 }
 impl std::fmt::Display for DecodeError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::UnknownMode(m) => write!(f, "unknown schedule mode {m:?}"),
            Self::UnknownLevel(l) => write!(f, "unknown lock level {l:?}"),
            Self::UnknownKind(k) => write!(f, "unknown condition kind {k:?}"),
            Self::EmptyTarget => write!(f, "target value is empty"),
            Self::BadTime(t) => write!(f, "time {t:?} is not HH:MM"),
            Self::MinuteOutOfRange(m) => write!(f, "minute {m} is outside 0..1440"),
            Self::BadDays(d) => write!(f, "day list {d:?} is malformed"),
            Self::BadFlag(v) => write!(f, "expected 0 or 1, found {v}"),
            Self::NegativeCount(v) => write!(f, "expected a non-negative count, found {v}"),
        }
    }
 }
 impl std::error::Error for DecodeError {}
 /// `ScheduleMode` as stored.
 pub fn mode_to_str(mode: ScheduleMode) -> &'static str {
    match mode {
        ScheduleMode::Blocklist => "Blocklist",
        ScheduleMode::Allowlist => "Allowlist",
    }
 }
 pub fn mode_from_str(raw: &str) -> Result<ScheduleMode, DecodeError> {
    match raw {
        "Blocklist" => Ok(ScheduleMode::Blocklist),
        "Allowlist" => Ok(ScheduleMode::Allowlist),
        other => Err(DecodeError::UnknownMode(other.to_owned())),
    }
 }
 /// `LockLevel` as stored.
 pub fn level_to_str(level: blocker_core::lock::LockLevel) -> &'static str {
    match level {
        blocker_core::lock::LockLevel::Normal => "Normal",
        blocker_core::lock::LockLevel::Strict => "Strict",
        blocker_core::lock::LockLevel::Stubborn => "Stubborn",
    }
 }
 pub fn level_from_str(raw: &str) -> Result<blocker_core::lock::LockLevel, DecodeError> {
    use blocker_core::lock::LockLevel;
    match raw {
        "Normal" => Ok(LockLevel::Normal),
        "Strict" => Ok(LockLevel::Strict),
        "Stubborn" => Ok(LockLevel::Stubborn),
        other => Err(DecodeError::UnknownLevel(other.to_owned())),
    }
 }
 /// A decoded target.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct TargetRow {
    /// Position within the schedule, preserving the user's ordering.
    pub ordinal: i64,
    /// Discriminator: `app`, `website`, or `keyword`.
    pub kind: String,
    /// The identifier itself.
    pub value: String,
 }
 /// Targets in database form.
 pub fn encode_targets(targets: &[Target]) -> Vec<TargetRow> {
    targets
        .iter()
        .enumerate()
        .map(|(ordinal, t)| {
            let (kind, value) = match t {
                Target::App(v) => ("app", v.clone()),
                Target::Website(v) => ("website", v.clone()),
                Target::Keyword(v) => ("keyword", v.clone()),
            };
            TargetRow {
                ordinal: i64::try_from(ordinal).unwrap_or(i64::MAX),
                kind: kind.to_owned(),
                value,
            }
        })
        .collect()
 }
 pub fn decode_targets(rows: &[TargetRow]) -> Result<Vec<Target>, DecodeError> {
    let mut out: Vec<(i64, Target)> = Vec::with_capacity(rows.len());
    for row in rows {
        if row.value.is_empty() {
            return Err(DecodeError::EmptyTarget);
        }
        let target = match row.kind.as_str() {
            "app" => Target::App(row.value.clone()),
            "website" => Target::Website(row.value.clone()),
            "keyword" => Target::Keyword(row.value.clone()),
            other => return Err(DecodeError::UnknownKind(other.to_owned())),
        };
        out.push((row.ordinal, target));
    }
    // Ordinals come from the database unordered; sorting restores user order,
    // which matters for a list the user arranged deliberately.
    out.sort_by_key(|(ordinal, _)| *ordinal);
    Ok(out.into_iter().map(|(_, t)| t).collect())
 }
 /// A decoded condition. Column-shaped rather than model-shaped, so a NULL in the
 /// wrong place is caught here rather than becoming a silently defaulted
 /// condition.
 #[derive(Debug, Clone, PartialEq)]
 pub struct ConditionRow {
    pub ordinal: i64,
    pub kind: String,
    /// Comma-separated weekdays, Monday = 0.
    pub days: Option<String>,
    pub start_min: Option<i64>,
    pub end_min: Option<i64>,
    pub limit_value: Option<i64>,
    pub window: Option<String>,
    pub ssid: Option<String>,
    pub latitude: Option<f64>,
    pub longitude: Option<f64>,
    pub radius_m: Option<i64>,
    pub outside: Option<i64>,
 }
 pub fn encode_conditions(conditions: &[Condition]) -> Vec<ConditionRow> {
    conditions
        .iter()
        .enumerate()
        .map(|(ordinal, c)| {
            let mut row = ConditionRow {
                ordinal: i64::try_from(ordinal).unwrap_or(i64::MAX),
                kind: String::new(),
                days: None,
                start_min: None,
                end_min: None,
                limit_value: None,
                window: None,
                ssid: None,
                latitude: None,
                longitude: None,
                radius_m: None,
                outside: None,
            };
            match c {
                Condition::Time(w) => {
                    row.kind = "Time".to_owned();
                    row.days = Some(w.days.iter().map(u8::to_string).collect::<Vec<_>>().join(","));
                    row.start_min = Some(i64::from(w.start));
                    row.end_min = Some(i64::from(w.end));
                }
                Condition::UsageLimit { limit_minutes, window } => {
                    row.kind = "UsageLimit".to_owned();
                    row.limit_value = Some(i64::from(*limit_minutes));
                    row.window = Some(window_to_str(*window).to_owned());
                }
                Condition::LaunchCount { limit, window } => {
                    row.kind = "LaunchCount".to_owned();
                    row.limit_value = Some(i64::from(*limit));
                    row.window = Some(window_to_str(*window).to_owned());
                }
                Condition::WifiSsid(ssid) => {
                    row.kind = "WifiSsid".to_owned();
                    row.ssid = Some(ssid.clone());
                }
                Condition::Location { latitude, longitude, radius_meters, block_when_outside } => {
                    row.kind = "Location".to_owned();
                    row.latitude = Some(*latitude);
                    row.longitude = Some(*longitude);
                    row.radius_m = Some(i64::from(*radius_meters));
                    row.outside = Some(i64::from(*block_when_outside));
                }
            }
            row
        })
        .collect()
 }
 pub fn decode_conditions(rows: &[ConditionRow]) -> Result<Vec<Condition>, DecodeError> {
    let mut out: Vec<(i64, Condition)> = Vec::with_capacity(rows.len());
    for row in rows {
        out.push((row.ordinal, decode_condition(row)?));
    }
    out.sort_by_key(|(ordinal, _)| *ordinal);
    Ok(out.into_iter().map(|(_, c)| c).collect())
 }
 fn decode_condition(row: &ConditionRow) -> Result<Condition, DecodeError> {
    match row.kind.as_str() {
        "Time" => {
            let days = row.days.as_deref().ok_or(DecodeError::BadDays("<null>".into()))?;
            let start = require_minute(row.start_min)?;
            let end = require_minute(row.end_min)?;
            Ok(Condition::Time(TimeWindow { days: decode_days(days)?, start, end }))
        }
        "UsageLimit" => Ok(Condition::UsageLimit {
            limit_minutes: require_count(row.limit_value)?,
            window: window_from_str(row.window.as_deref())?,
        }),
        "LaunchCount" => Ok(Condition::LaunchCount {
            limit: require_count(row.limit_value)?,
            window: window_from_str(row.window.as_deref())?,
        }),
        "WifiSsid" => Ok(Condition::WifiSsid(row.ssid.clone().ok_or(DecodeError::EmptyTarget)?)),
        "Location" => Ok(Condition::Location {
            latitude: row.latitude.ok_or(DecodeError::NegativeCount(-1))?,
            longitude: row.longitude.ok_or(DecodeError::NegativeCount(-1))?,
            radius_meters: require_count(row.radius_m)?,
            block_when_outside: decode_flag(row.outside.unwrap_or(0))?,
        }),
        other => Err(DecodeError::UnknownKind(other.to_owned())),
    }
 }
 fn require_minute(value: Option<i64>) -> Result<MinuteOfDay, DecodeError> {
    let v = value.ok_or(DecodeError::MinuteOutOfRange(-1))?;
    u16::try_from(v).ok().filter(|m| *m < 1440).ok_or(DecodeError::MinuteOutOfRange(v))
 }
 fn require_count(value: Option<i64>) -> Result<u32, DecodeError> {
    let v = value.ok_or(DecodeError::NegativeCount(-1))?;
    u32::try_from(v).map_err(|_| DecodeError::NegativeCount(v))
 }
 fn decode_flag(value: i64) -> Result<bool, DecodeError> {
    match value {
        0 => Ok(false),
        1 => Ok(true),
        other => Err(DecodeError::BadFlag(other)),
    }
 }
 fn window_to_str(window: UsageWindow) -> &'static str {
    match window {
        UsageWindow::Daily => "Daily",
        UsageWindow::Hourly => "Hourly",
    }
 }
 fn window_from_str(raw: Option<&str>) -> Result<UsageWindow, DecodeError> {
    match raw {
        Some("Daily") => Ok(UsageWindow::Daily),
        Some("Hourly") => Ok(UsageWindow::Hourly),
        _ => Err(DecodeError::UnknownKind(format!("usage window {raw:?}"))),
    }
 }
 fn decode_days(raw: &str) -> Result<Vec<DayOfWeek>, DecodeError> {
    if raw.is_empty() {
        return Ok(Vec::new());
    }
    raw.split(',')
        .map(|part| {
            let trimmed = part.trim();
            trimmed
                .parse::<u8>()
                .ok()
                .filter(|d| *d < 7)
                .ok_or_else(|| DecodeError::BadDays(raw.to_owned()))
        })
        .collect()
 }
 /// `HH:MM` to minutes since midnight. Used by the golden-table loader, which
 /// reads times as strings.
 pub fn parse_hhmm(raw: &str) -> Result<MinuteOfDay, DecodeError> {
    let (h, m) = raw.split_once(':').ok_or_else(|| DecodeError::BadTime(raw.to_owned()))?;
    let h: u16 = h.trim().parse().map_err(|_| DecodeError::BadTime(raw.to_owned()))?;
    let m: u16 = m.trim().parse().map_err(|_| DecodeError::BadTime(raw.to_owned()))?;
    if m >= 60 || h >= 24 {
        return Err(DecodeError::BadTime(raw.to_owned()));
    }
    Ok(h * 60 + m)
 }
 /// Reassemble a schedule from its header and its decoded children.
 ///
 /// Kept here rather than in `lib.rs` so the ordering contract — children sorted
 /// by ordinal, attached to the right parent — is tested in one place.
 pub fn decode_schedule(
    id: &str,
    name: &str,
    icon: Option<&str>,
    mode: &str,
    targets: &[TargetRow],
    conditions: &[ConditionRow],
    paused: bool,
 ) -> Result<Schedule, DecodeError> {
    Ok(Schedule {
        id: id.to_owned(),
        name: name.to_owned(),
        icon: icon.map(str::to_owned),
        mode: mode_from_str(mode)?,
        targets: decode_targets(targets)?,
        conditions: decode_conditions(conditions)?,
        paused,
    })
 }
 #[cfg(test)]
 mod tests;
@@ -1,201 +0,0 @@
 //! Tests for the storage encoding layer.
 //!
 //! These need no database: the codec is where a silently-dropped field would
 //! live, and a round-trip test here is far cheaper to run and to read than the
 //! same assertion through SQLite.
 #![allow(
    clippy::unwrap_used,
    clippy::expect_used,
    clippy::panic,
    reason = "test fixtures: a failing assertion or a broken test is not a runtime \
 condition to handle gracefully"
 )]
 use super::*;
 use blocker_core::model::{Condition, Schedule, ScheduleMode, Target, TimeWindow, UsageWindow};
 /// Every condition shape must survive encode -> decode unchanged.
 ///
 /// A field that is written but not read back is invisible in production and
 /// catastrophic here: the schedule quietly stops working the next time the app
 /// restarts.
 #[test]
 fn every_condition_round_trips() {
    let cases = vec![
        Condition::Time(TimeWindow { days: vec![0, 1, 2, 3, 4], start: 9 * 60, end: 17 * 60 }),
        // Overnight: start > end must not be normalised or dropped on the way
        // through the database. This is the representation the whole overnight
        // rule depends on.
        Condition::Time(TimeWindow { days: vec![6], start: 22 * 60, end: 6 * 60 }),
        Condition::UsageLimit { limit_minutes: 90, window: UsageWindow::Daily },
        Condition::LaunchCount { limit: 5, window: UsageWindow::Hourly },
        Condition::WifiSsid("CoffeeShop".into()),
        Condition::Location {
            latitude: 52.52,
            longitude: 13.405,
            radius_meters: 500,
            block_when_outside: true,
        },
    ];
    for original in cases {
        let rows = encode_conditions(std::slice::from_ref(&original));
        let decoded = decode_conditions(&rows).expect("decode must succeed");
        assert_eq!(decoded, vec![original], "round trip changed the condition");
    }
 }
 /// A schedule's ordinal order must survive, since the user arranges targets
 /// deliberately and the block screen shows them in that order.
 #[test]
 fn target_order_is_preserved() {
    let targets = vec![
        Target::App("b.app".into()),
        Target::Website("example.com".into()),
        Target::Keyword("casino".into()),
        Target::App("a.app".into()),
    ];
    let mut rows = encode_targets(&targets);
    // Simulate the database returning rows in an arbitrary order.
    rows.reverse();
    assert_eq!(decode_targets(&rows).unwrap(), targets);
 }
 /// Unknown discriminators must error, not default.
 ///
 /// Defaulting here would turn a typo or a newer-version row into a schedule
 /// that silently blocks the wrong thing.
 #[test]
 fn unknown_kinds_are_errors_not_defaults() {
    let bad_target =
        vec![TargetRow { ordinal: 0, kind: "applicaton".into(), value: "com.example".into() }];
    assert_eq!(decode_targets(&bad_target), Err(DecodeError::UnknownKind("applicaton".into())));
    let bad_condition = vec![ConditionRow {
        ordinal: 0,
        kind: "Timey".into(),
        days: None,
        start_min: None,
        end_min: None,
        limit_value: None,
        window: None,
        ssid: None,
        latitude: None,
        longitude: None,
        radius_m: None,
        outside: None,
    }];
    assert_eq!(decode_conditions(&bad_condition), Err(DecodeError::UnknownKind("Timey".into())));
 }
 /// A time of day outside 0..1440 must be rejected rather than wrapping.
 ///
 /// A wrapped minute would produce a window that never matches, or one that
 /// always matches — both look like "the app ignores my schedule".
 #[test]
 fn out_of_range_minutes_are_rejected() {
    let bad = ConditionRow {
        ordinal: 0,
        kind: "Time".into(),
        days: Some("0".into()),
        start_min: Some(-60),
        end_min: Some(1020),
        limit_value: None,
        window: None,
        ssid: None,
        latitude: None,
        longitude: None,
        radius_m: None,
        outside: None,
    };
    assert_eq!(decode_conditions(&[bad]), Err(DecodeError::MinuteOutOfRange(-60)));
 }
 /// Weekday values outside 0..=6 must be rejected.
 #[test]
 fn out_of_range_weekdays_are_rejected() {
    assert_eq!(decode_days("0,1,9"), Err(DecodeError::BadDays("0,1,9".into())));
    assert_eq!(decode_days("monday"), Err(DecodeError::BadDays("monday".into())));
    assert_eq!(decode_days(""), Ok(vec![]));
    assert_eq!(decode_days("0,6"), Ok(vec![0, 6]));
 }
 /// A flag column holding something other than 0 or 1 must be rejected.
 #[test]
 fn bad_flags_are_rejected() {
    assert_eq!(decode_flag(0), Ok(false));
    assert_eq!(decode_flag(1), Ok(true));
    assert_eq!(decode_flag(2), Err(DecodeError::BadFlag(2)));
    assert_eq!(decode_flag(-1), Err(DecodeError::BadFlag(-1)));
 }
 /// Negative counts must be rejected — a negative usage limit would mean
 /// "block immediately", which is not what a corrupted row should do.
 #[test]
 fn negative_counts_are_rejected() {
    assert_eq!(require_count(Some(-5)), Err(DecodeError::NegativeCount(-5)));
    assert_eq!(require_count(Some(0)), Ok(0));
    assert_eq!(require_count(None), Err(DecodeError::NegativeCount(-1)));
 }
 /// `HH:MM` parsing, as the golden tables use it.
 #[test]
 fn hhmm_parsing() {
    assert_eq!(parse_hhmm("09:00"), Ok(540));
    assert_eq!(parse_hhmm("22:30"), Ok(1350));
    assert_eq!(parse_hhmm("00:00"), Ok(0));
    assert_eq!(parse_hhmm("9:5"), Ok(545));
    assert_eq!(parse_hhmm("24:00"), Err(DecodeError::BadTime("24:00".into())));
    assert_eq!(parse_hhmm("12:60"), Err(DecodeError::BadTime("12:60".into())));
    assert_eq!(parse_hhmm("nine"), Err(DecodeError::BadTime("nine".into())));
    assert_eq!(parse_hhmm("0900"), Err(DecodeError::BadTime("0900".into())));
 }
 /// Lock level and mode round-trip through their string forms.
 #[test]
 fn level_and_mode_round_trip() {
    for level in [
        blocker_core::lock::LockLevel::Normal,
        blocker_core::lock::LockLevel::Strict,
        blocker_core::lock::LockLevel::Stubborn,
    ] {
        assert_eq!(level_from_str(level_to_str(level)).unwrap(), level);
    }
    assert!(level_from_str("Paranoid").is_err());
    for mode in [ScheduleMode::Blocklist, ScheduleMode::Allowlist] {
        assert_eq!(mode_from_str(mode_to_str(mode)).unwrap(), mode);
    }
    assert!(mode_from_str("Whitelist").is_err());
 }
 /// A full schedule round-trips through its parts.
 #[test]
 fn schedule_round_trips_through_parts() {
    let original = Schedule {
        id: "s1".into(),
        name: "Evening Focus".into(),
        icon: Some("/icons/focus.png".into()),
        mode: ScheduleMode::Blocklist,
        targets: vec![Target::App("com.example.social".into())],
        conditions: vec![Condition::Time(TimeWindow {
            days: vec![0, 1, 2, 3, 4],
            start: 22 * 60,
            end: 6 * 60,
        })],
        paused: false,
    };
    let decoded = decode_schedule(
        &original.id,
        &original.name,
        original.icon.as_deref(),
        mode_to_str(original.mode),
        &encode_targets(&original.targets),
        &encode_conditions(&original.conditions),
        original.paused,
    )
    .unwrap();
    assert_eq!(decoded, original);
 }
@@ -1,644 +0,0 @@
 //! SQLite persistence for Blocker (CLAUDE.md section 3, `rusqlite` bundled).
 //!
 //! # Why this is a separate crate from `blocker-core`
 //!
 //! Section 2 requires the engine to be a pure function with no I/O, and this
 //! project's `tests/purity.rs` enforces that mechanically: it reads the resolved
 //! dependency graph and fails if `blocker-core` has any dependency at all. That
 //! check is only meaningful while storage lives elsewhere.
 //!
 //! Both crates occupy the same layer of the section 2 diagram — storage is shared
 //! by every platform and contains no platform code — so this is a refinement that
 //! makes the purity guarantee mechanically checkable, not an architectural
 //! departure.
 //!
 //! # Fail open (section 1.5.4)
 //!
 //! A corrupt database must never leave a device unusable. [`Store::open`] moves a
 //! damaged file aside and starts clean rather than returning an error the caller
 //! might respond to by disabling enforcement. The damaged file is kept for
 //! diagnosis; blocking is then re-applied from defaults on the next start.
 //!
 //! Losing a schedule list is a far smaller harm than a phone that cannot make
 //! calls, and section 1.5.4 makes that trade explicit.
 use std::path::{Path, PathBuf};
 use blocker_core::engine::{BootId, CivilTime, Monotonic};
 use rusqlite::{Connection, OpenFlags};
 use crate::codec::DecodeError;
 /// Current schema version, applied with `PRAGMA user_version`.
 pub const SCHEMA_VERSION: i64 = 1;
 /// Everything that can go wrong opening or preparing a store.
 ///
 /// Notably **absent**: a corruption variant that is fatal. Corruption is
 /// handled inside [`Store::open`] by starting clean, because section 1.5.4
 /// requires failing open rather than refusing to run.
 #[derive(Debug)]
 pub enum StoreError {
    /// SQLite could not be initialised at all — for example the bundled library
    /// could not be loaded. Fatal, and genuinely exceptional.
    Init(rusqlite::Error),
    /// The directory holding the database could not be created.
    Io(std::io::Error),
    /// Stored bytes could not be decoded into the model.
    Decode(DecodeError),
 }
 impl std::fmt::Display for StoreError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Init(e) => write!(f, "could not initialise storage: {e}"),
            Self::Io(e) => write!(f, "storage directory unusable: {e}"),
            Self::Decode(e) => write!(f, "stored data could not be decoded: {e}"),
        }
    }
 }
 impl std::error::Error for StoreError {}
 /// A handle to the Blocker database.
 ///
 /// Cheap to clone conceptually but deliberately not `Clone`: the daemon is the
 /// only writer, and an accidental second connection would mean two processes
 /// fighting over lock state.
 #[derive(Debug)]
 pub struct Store {
    conn: Connection,
    path: PathBuf,
    /// Set when the database was found corrupt and moved aside, so the caller can
    /// log it. Section 1.5.4 wants this recorded, not silently swallowed.
    recovered_from_corruption: bool,
 }
 impl Store {
    /// Open, creating if absent, and ensure the schema is current.
    ///
    /// Never returns an error for corruption: a damaged database is renamed
    /// aside and a fresh one created. See the module docs.
    pub fn open(path: &Path) -> Result<Self, StoreError> {
        if let Some(parent) = path.parent() {
            std::fs::create_dir_all(parent).map_err(StoreError::Io)?;
        }
        let mut recovered = false;
        // First attempt: open normally and verify it is actually usable. A
        // corrupt file often opens fine and only fails on first query, so the
        // probe below is what actually detects corruption.
        let mut attempt = Self::try_open(path)?;
        if let Err(probe) =
            attempt.conn.query_row("PRAGMA user_version", [], |r| r.get::<_, i64>(0))
        {
            recovered = true;
            Self::quarantine(path)?;
            attempt = Self::try_open(path)?;
            // Keep the probe result meaningful: if this one also fails, the
            // problem is not the file.
            if let Err(second) =
                attempt.conn.query_row("PRAGMA user_version", [], |r| r.get::<_, i64>(0))
            {
                return Err(StoreError::Init(second));
            }
            let _ = probe;
        }
        attempt.migrate()?;
        attempt.recovered_from_corruption = recovered;
        Ok(attempt)
    }
    fn try_open(path: &Path) -> Result<Self, StoreError> {
        let conn = Connection::open_with_flags(
            path,
            OpenFlags::SQLITE_OPEN_READ_WRITE
                | OpenFlags::SQLITE_OPEN_CREATE
                | OpenFlags::SQLITE_OPEN_NO_MUTEX,
        )
        .map_err(StoreError::Init)?;
        // WAL keeps a reader from blocking the daemon's writes, which matters
        // because the UI reads while the daemon writes. It also means a crash
        // cannot corrupt the main file, which is part of failing open.
        // Errors here are not fatal: a filesystem without WAL still works, just
        // with less concurrency.
        let _ = conn.pragma_update(None, "journal_mode", "WAL");
        let _ = conn.pragma_update(None, "foreign_keys", "ON");
        Ok(Self { conn, path: path.to_path_buf(), recovered_from_corruption: false })
    }
    /// Move a damaged database aside, keeping it for diagnosis.
    fn quarantine(path: &Path) -> Result<(), StoreError> {
        let backup = path.with_extension("corrupt");
        std::fs::rename(path, &backup).map_err(StoreError::Io)?;
        Ok(())
    }
    /// Whether this store was recovered from corruption on open.
    pub fn recovered_from_corruption(&self) -> bool {
        self.recovered_from_corruption
    }
    fn migrate(&mut self) -> Result<(), StoreError> {
        let current: i64 = self
            .conn
            .query_row("PRAGMA user_version", [], |r| r.get(0))
            .map_err(StoreError::Init)?;
        if current > SCHEMA_VERSION {
            // Forward-only by design (section 1.5.3: downgrading risks losing
            // lock state, which the safety rules do not permit). A newer file is
            // left alone rather than destroyed.
            return Err(StoreError::Init(rusqlite::Error::InvalidQuery));
        }
        if current == SCHEMA_VERSION {
            return Ok(());
        }
        self.conn.execute_batch(SCHEMA).map_err(StoreError::Init)?;
        self.conn.pragma_update(None, "user_version", SCHEMA_VERSION).map_err(StoreError::Init)?;
        Ok(())
    }
    /// Load every schedule, with its targets and conditions.
    ///
    /// Two queries rather than a join: a schedule's children are needed together
    /// to reassemble the model, and SQLite's JSON functions are not used here so
    /// the relational shape stays portable. Schedules without children still
    /// appear, with empty vectors — `validation` is what rejects those, not the
    /// database.
    pub fn load_schedules(&self) -> Result<Vec<blocker_core::model::Schedule>, StoreError> {
        let headers = {
            let mut stmt = self
                .conn
                .prepare(
                    "SELECT id, name, icon, mode, paused FROM schedule ORDER BY created_at, id",
                )
                .map_err(StoreError::Init)?;
            let rows = stmt
                .query_map([], |row| {
                    Ok((
                        row.get::<_, String>(0)?,
                        row.get::<_, String>(1)?,
                        row.get::<_, Option<String>>(2)?,
                        row.get::<_, String>(3)?,
                        row.get::<_, bool>(4)?,
                    ))
                })
                .map_err(StoreError::Init)?;
            let mut out = Vec::new();
            for row in rows {
                out.push(row.map_err(StoreError::Init)?);
            }
            out
        };
        let mut schedules = Vec::with_capacity(headers.len());
        for (id, name, icon, mode, paused) in headers {
            let targets = self.load_targets(&id)?;
            let conditions = self.load_conditions(&id)?;
            schedules.push(
                codec::decode_schedule(
                    &id,
                    &name,
                    icon.as_deref(),
                    &mode,
                    &targets,
                    &conditions,
                    paused,
                )
                .map_err(StoreError::Decode)?,
            );
        }
        Ok(schedules)
    }
    fn load_targets(&self, schedule_id: &str) -> Result<Vec<codec::TargetRow>, StoreError> {
        let mut stmt = self
            .conn
            .prepare(
                "SELECT ordinal, kind, value FROM schedule_target
                 WHERE schedule_id = ?1 ORDER BY ordinal",
            )
            .map_err(StoreError::Init)?;
        let rows = stmt
            .query_map([schedule_id], |row| {
                Ok(codec::TargetRow { ordinal: row.get(0)?, kind: row.get(1)?, value: row.get(2)? })
            })
            .map_err(StoreError::Init)?;
        let mut out = Vec::new();
        for row in rows {
            out.push(row.map_err(StoreError::Init)?);
        }
        Ok(out)
    }
    fn load_conditions(&self, schedule_id: &str) -> Result<Vec<codec::ConditionRow>, StoreError> {
        let mut stmt = self
            .conn
            .prepare(
                "SELECT ordinal, kind, days, start_min, end_min, limit_value, window,
                        ssid, latitude, longitude, radius_m, outside
                 FROM schedule_condition WHERE schedule_id = ?1 ORDER BY ordinal",
            )
            .map_err(StoreError::Init)?;
        let rows = stmt
            .query_map([schedule_id], |row| {
                Ok(codec::ConditionRow {
                    ordinal: row.get(0)?,
                    kind: row.get(1)?,
                    days: row.get(2)?,
                    start_min: row.get(3)?,
                    end_min: row.get(4)?,
                    limit_value: row.get(5)?,
                    window: row.get(6)?,
                    ssid: row.get(7)?,
                    latitude: row.get(8)?,
                    longitude: row.get(9)?,
                    radius_m: row.get(10)?,
                    outside: row.get(11)?,
                })
            })
            .map_err(StoreError::Init)?;
        let mut out = Vec::new();
        for row in rows {
            out.push(row.map_err(StoreError::Init)?);
        }
        Ok(out)
    }
    /// Persist the full schedule set, replacing what was there.
    ///
    /// Written as a single transaction so a crash cannot leave a half-applied
    /// schedule list — which on a blocking tool would mean some targets blocked
    /// and others not, with no way for the user to tell which.
    pub fn save_schedules(
        &mut self,
        schedules: &[blocker_core::model::Schedule],
    ) -> Result<(), StoreError> {
        let tx = self.conn.transaction().map_err(StoreError::Init)?;
        // Children cascade on delete, so clearing the parents is enough and
        // avoids a stale row outliving its schedule.
        tx.execute("DELETE FROM schedule", []).map_err(StoreError::Init)?;
        {
            let mut insert_target = tx
                .prepare(
                    "INSERT INTO schedule_target (schedule_id, ordinal, kind, value)
                     VALUES (?1, ?2, ?3, ?4)",
                )
                .map_err(StoreError::Init)?;
            let mut insert_condition = tx
                .prepare(
                    "INSERT INTO schedule_condition
                        (schedule_id, ordinal, kind, days, start_min, end_min, limit_value,
                         window, ssid, latitude, longitude, radius_m, outside)
                     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13)",
                )
                .map_err(StoreError::Init)?;
            for (index, s) in schedules.iter().enumerate() {
                tx.execute(
                    "INSERT INTO schedule (id, name, icon, mode, paused, created_at)
                     VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
                    rusqlite::params![
                        s.id,
                        s.name,
                        s.icon,
                        codec::mode_to_str(s.mode),
                        i64::from(s.paused),
                        i64::try_from(index).unwrap_or(i64::MAX),
                    ],
                )
                .map_err(StoreError::Init)?;
                for row in codec::encode_targets(&s.targets) {
                    insert_target
                        .execute(rusqlite::params![s.id, row.ordinal, row.kind, row.value])
                        .map_err(StoreError::Init)?;
                }
                for row in codec::encode_conditions(&s.conditions) {
                    insert_condition
                        .execute(rusqlite::params![
                            s.id,
                            row.ordinal,
                            row.kind,
                            row.days,
                            row.start_min,
                            row.end_min,
                            row.limit_value,
                            row.window,
                            row.ssid,
                            row.latitude,
                            row.longitude,
                            row.radius_m,
                            row.outside,
                        ])
                        .map_err(StoreError::Init)?;
                }
            }
        }
        tx.commit().map_err(StoreError::Init)
    }
    /// Persist lock state, including the monotonic deadline a pending disable
    /// request is waiting on (section 1.5.2.2).
    pub fn save_lock(
        &mut self,
        state: &blocker_core::lock::LockState,
        boot_id: BootId,
        last_monotonic_ms: u64,
    ) -> Result<(), StoreError> {
        let pending = state.pending.as_ref();
        self.conn
            .execute(
                "INSERT INTO lock_config
                    (id, level, schedules_locked, blocks_uninstall, keyholder_code,
                     request_ready_at, request_window_closes_at, boot_id, last_monotonic_ms)
                 VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
                 ON CONFLICT(id) DO UPDATE SET
                    level = excluded.level,
                    schedules_locked = excluded.schedules_locked,
                    blocks_uninstall = excluded.blocks_uninstall,
                    keyholder_code = excluded.keyholder_code,
                    request_ready_at = excluded.request_ready_at,
                    request_window_closes_at = excluded.request_window_closes_at,
                    boot_id = excluded.boot_id,
                    last_monotonic_ms = excluded.last_monotonic_ms",
                rusqlite::params![
                    codec::level_to_str(state.level),
                    i64::from(state.schedules_locked),
                    i64::from(state.blocks_uninstall()),
                    state.keyholder_code,
                    pending.map(|p| i64::try_from(p.ready_at.0).unwrap_or(i64::MAX)),
                    pending.map(|p| i64::try_from(p.window_closes_at.0).unwrap_or(i64::MAX)),
                    i64::try_from(boot_id.0).unwrap_or(i64::MAX),
                    i64::try_from(last_monotonic_ms).unwrap_or(i64::MAX),
                ],
            )
            .map(|_| ())
            .map_err(StoreError::Init)
    }
    /// The monotonic deadline and boot id of a pending disable request.
    ///
    /// Used on resume to distinguish "the daemon restarted" from "the machine
    /// rebooted" (section 1.5.3), so a lock is resumed conservatively rather
    /// than assumed to have continued.
    pub fn load_pending_request(&self) -> Result<Option<(Monotonic, BootId)>, StoreError> {
        let mut stmt = self
            .conn
            .prepare("SELECT request_ready_at, boot_id FROM lock_config WHERE id = 1")
            .map_err(StoreError::Init)?;
        let mut rows = stmt.query([]).map_err(StoreError::Init)?;
        match rows.next().map_err(StoreError::Init)? {
            None => Ok(None),
            Some(row) => {
                let ready: Option<i64> = row.get(0).map_err(StoreError::Init)?;
                let boot: i64 = row.get(1).map_err(StoreError::Init)?;
                Ok(ready.map(|r| {
                    (
                        Monotonic(u64::try_from(r.max(0)).unwrap_or(0)),
                        BootId(u64::try_from(boot.max(0)).unwrap_or(0)),
                    )
                }))
            }
        }
    }
    /// Record one attempt to disable (section 1.5.2.5). Local only.
    pub fn record_attempt(
        &mut self,
        at: Monotonic,
        boot_id: BootId,
        day_index: i64,
    ) -> Result<(), StoreError> {
        self.conn
            .execute(
                "INSERT INTO disable_attempt (at_monotonic, boot_id, day_index) VALUES (?1, ?2, ?3)",
                rusqlite::params![
                    i64::try_from(at.0).unwrap_or(i64::MAX),
                    i64::try_from(boot_id.0).unwrap_or(i64::MAX),
                    day_index,
                ],
            )
            .map(|_| ())
            .map_err(StoreError::Init)?;
        Ok(())
    }
    /// How many disable attempts were made on a given local day.
    ///
    /// The block screen shows this as plain text — "You tried to turn this off 4
    /// times today" — never as a shaming counter (section 1.5.2.5).
    pub fn attempt_count(&self, day_index: i64) -> Result<u32, StoreError> {
        let count: i64 = self
            .conn
            .query_row(
                "SELECT COUNT(*) FROM disable_attempt WHERE day_index = ?1",
                [day_index],
                |r| r.get(0),
            )
            .map_err(StoreError::Init)?;
        Ok(u32::try_from(count.max(0)).unwrap_or(u32::MAX))
    }
    /// Add foreground minutes to a daily bucket (section 1.2).
    pub fn add_daily_usage(
        &mut self,
        day_index: i64,
        target: &str,
        minutes: u32,
    ) -> Result<(), StoreError> {
        self.conn
            .execute(
                "INSERT INTO usage_daily (day_index, target, minutes) VALUES (?1, ?2, ?3)
                 ON CONFLICT(day_index, target) DO UPDATE SET
                    minutes = minutes + excluded.minutes",
                rusqlite::params![day_index, target, i64::from(minutes)],
            )
            .map(|_| ())
            .map_err(StoreError::Init)?;
        Ok(())
    }
    /// Add a launch to a daily bucket (section 1.2).
    pub fn add_daily_launch(&mut self, day_index: i64, target: &str) -> Result<(), StoreError> {
        self.conn
            .execute(
                "INSERT INTO usage_daily (day_index, target, minutes, launches) VALUES (?1, ?2, 0, 1)
                 ON CONFLICT(day_index, target) DO UPDATE SET
                    launches = launches + 1",
                rusqlite::params![day_index, target],
            )
            .map(|_| ())
            .map_err(StoreError::Init)?;
        Ok(())
    }
    /// Read a daily usage bucket.
    pub fn load_daily_usage(&self, day_index: i64) -> Result<UsageRow, StoreError> {
        let mut stmt = self
            .conn
            .prepare("SELECT target, minutes, launches FROM usage_daily WHERE day_index = ?1")
            .map_err(StoreError::Init)?;
        let mut rows = stmt.query([day_index]).map_err(StoreError::Init)?;
        let mut out = UsageRow::default();
        while let Some(row) = rows.next().map_err(StoreError::Init)? {
            let target: String = row.get(0).map_err(StoreError::Init)?;
            let minutes: i64 = row.get(1).map_err(StoreError::Init)?;
            let launches: i64 = row.get(2).map_err(StoreError::Init)?;
            out.minutes.insert(target.clone(), u32::try_from(minutes.max(0)).unwrap_or(u32::MAX));
            out.launches.insert(target, u32::try_from(launches.max(0)).unwrap_or(u32::MAX));
        }
        Ok(out)
    }
    /// Local day index for a civil time, for bucketing usage.
    pub fn day_index(now: CivilTime) -> i64 {
        now.epoch_minutes.div_euclid(24 * 60)
    }
    /// Path this store was opened from.
    pub fn path(&self) -> &Path {
        &self.path
    }
    /// Run a maintenance step: drop usage rows older than `keep_days`.
    ///
    /// Pruning is deliberate rather than unbounded — an app-blocker's usage
    /// history is genuinely useful for statistics (section 1.6) but a table
    /// that grows forever is a slow disk leak on a machine with 9.6 GB free.
    pub fn prune_usage(&mut self, keep_days: i64) -> Result<u64, StoreError> {
        // Relative to the NEWEST day, not the oldest.
        //
        // Anchoring on MIN(day_index) is the obvious version and it never prunes
        // anything: the oldest row is by definition the one being tested, so the
        // cutoff sits before it and the delete matches zero rows. The table then
        // grows forever, which on a machine with 9.6 GB free is exactly the slow
        // leak this is meant to prevent. Caught by old_usage_is_pruned.
        let newest: i64 = self
            .conn
            .query_row("SELECT COALESCE(MAX(day_index), 0) FROM usage_daily", [], |r| {
                r.get::<_, i64>(0)
            })
            .map_err(StoreError::Init)?;
        // +1 so exactly `keep_days` rows survive: with cutoff = newest - keep_days
        // and a strict `<`, the boundary day is kept as well, giving keep_days + 1.
        let cutoff = newest - keep_days + 1;
        let n = self
            .conn
            .execute("DELETE FROM usage_daily WHERE day_index < ?1", [cutoff])
            .map_err(StoreError::Init)?;
        Ok(n as u64)
    }
 }
 /// One bucket of accumulated usage.
 #[derive(Debug, Default, Clone, PartialEq, Eq)]
 pub struct UsageRow {
    /// Foreground minutes per target.
    pub minutes: std::collections::BTreeMap<String, u32>,
    /// Launch counts per target.
    pub launches: std::collections::BTreeMap<String, u32>,
 }
 /// Schema, version 1.
 ///
 /// Forward-only migrations. `user_version` gates them; downgrading would risk
 /// losing lock state, which section 1.5.3 forbids and section 1.5.4 makes a
 /// safety property.
 ///
 /// The normalised shape of `schedule_target` and `schedule_condition` is
 /// deliberate over storing JSON blobs: usage and target rows are queried by
 /// target, and an index on a text column that happens to contain JSON is not a
 /// plan. Encoding is handled in [`crate::codec`].
 pub const SCHEMA: &str = r#"
 CREATE TABLE IF NOT EXISTS schedule (
    id          TEXT PRIMARY KEY,
    name        TEXT NOT NULL,
    icon        TEXT,
    mode        TEXT NOT NULL CHECK (mode IN ('Blocklist', 'Allowlist')),
    paused      INTEGER NOT NULL DEFAULT 0,
    created_at  INTEGER NOT NULL DEFAULT 0
 );
 CREATE TABLE IF NOT EXISTS schedule_target (
    schedule_id TEXT NOT NULL REFERENCES schedule(id) ON DELETE CASCADE,
    ordinal     INTEGER NOT NULL,
    kind        TEXT NOT NULL CHECK (kind IN ('app', 'website', 'keyword')),
    value       TEXT NOT NULL,
    PRIMARY KEY (schedule_id, ordinal)
 );
 CREATE TABLE IF NOT EXISTS schedule_condition (
    schedule_id TEXT NOT NULL REFERENCES schedule(id) ON DELETE CASCADE,
    ordinal     INTEGER NOT NULL,
    kind        TEXT NOT NULL,
    days        TEXT,          -- comma-separated, Monday = 0
    start_min   INTEGER,
    end_min     INTEGER,
    limit_value INTEGER,
    window      TEXT,
    ssid        TEXT,
    latitude    REAL,
    longitude   REAL,
    radius_m    INTEGER,
    outside     INTEGER,
    PRIMARY KEY (schedule_id, ordinal)
 );
 -- Section 1.5.3: lock state lives in the database, not in an editable plaintext
 -- config file, so editing a file is not enough to defeat a lock.
 CREATE TABLE IF NOT EXISTS lock_config (
    id                       INTEGER PRIMARY KEY CHECK (id = 1),
    level                    TEXT NOT NULL CHECK (level IN ('Normal', 'Strict', 'Stubborn')),
    schedules_locked         INTEGER NOT NULL,
    blocks_uninstall         INTEGER NOT NULL,
    keyholder_code           TEXT,
    request_ready_at         INTEGER,
    request_window_closes_at INTEGER,
    boot_id                  INTEGER NOT NULL,
    last_monotonic_ms        INTEGER NOT NULL
 );
 CREATE TABLE IF NOT EXISTS disable_attempt (
    id            INTEGER PRIMARY KEY AUTOINCREMENT,
    at_monotonic  INTEGER NOT NULL,
    boot_id       INTEGER NOT NULL,
    day_index     INTEGER NOT NULL
 );
 CREATE TABLE IF NOT EXISTS usage_daily (
    day_index     INTEGER NOT NULL,
    target        TEXT NOT NULL,
    minutes       INTEGER NOT NULL DEFAULT 0,
    launches      INTEGER NOT NULL DEFAULT 0,
    PRIMARY KEY (day_index, target)
 );
 CREATE TABLE IF NOT EXISTS usage_hourly (
    hour_index    INTEGER NOT NULL,
    target        TEXT NOT NULL,
    minutes       INTEGER NOT NULL DEFAULT 0,
    launches      INTEGER NOT NULL DEFAULT 0,
    PRIMARY KEY (hour_index, target)
 );
 CREATE INDEX IF NOT EXISTS usage_daily_target ON usage_daily (target);
 CREATE INDEX IF NOT EXISTS usage_hourly_target ON usage_hourly (target);
 CREATE INDEX IF NOT EXISTS disable_attempt_day ON disable_attempt (day_index);
 "#;
 pub mod codec;
 #[cfg(test)]
 mod tests;
@@ -1,304 +0,0 @@
 //! Tests for the SQLite store.
 //!
 //! These use a temporary file rather than `:memory:` because WAL is enabled on
 //! the connection and an in-memory database with WAL is a subtly different thing
 //! than what ships.
 #![allow(
    clippy::unwrap_used,
    clippy::expect_used,
    clippy::panic,
    reason = "test fixtures: a failing assertion or a broken test is not a runtime \
 condition to handle gracefully"
 )]
 use super::*;
 use blocker_core::model::{Condition, Schedule, ScheduleMode, Target, TimeWindow, UsageWindow};
 /// A unique temp path per test, since tests run in parallel and a shared
 /// database would make them interfere.
 fn temp_db(name: &str) -> PathBuf {
    let mut p = std::env::temp_dir();
    p.push(format!("blocker-test-{}-{name}.db", std::process::id()));
    let _ = std::fs::remove_file(&p);
    p
 }
 fn sample_schedule() -> Schedule {
    Schedule {
        id: "s1".into(),
        name: "Evening Focus".into(),
        icon: Some("/icons/focus.png".into()),
        mode: ScheduleMode::Blocklist,
        targets: vec![
            Target::App("com.example.social".into()),
            Target::Website("example.com".into()),
            Target::Keyword("casino".into()),
        ],
        conditions: vec![
            Condition::Time(TimeWindow { days: vec![0, 1, 2, 3, 4], start: 22 * 60, end: 6 * 60 }),
            Condition::UsageLimit { limit_minutes: 90, window: UsageWindow::Daily },
        ],
        paused: false,
    }
 }
 #[test]
 fn schedules_round_trip_through_the_database() {
    let path = temp_db("schedules");
    let original = sample_schedule();
    {
        let mut store = Store::open(&path).expect("open");
        store.save_schedules(std::slice::from_ref(&original)).expect("save");
    }
    {
        let store = Store::open(&path).expect("reopen");
        let loaded = store.load_schedules().expect("load");
        assert_eq!(loaded.len(), 1);
        assert_eq!(loaded[0], original, "a schedule must survive a restart intact");
    }
    let _ = std::fs::remove_file(&path);
 }
 #[test]
 fn overnight_window_survives_a_restart() {
    // The specific case worth its own test: if the overnight flag were lost in
    // storage, the schedule would stop blocking at midnight *after a restart*,
    // while appearing correct in the UI.
    let path = temp_db("overnight");
    let mut original = sample_schedule();
    original.conditions =
        vec![Condition::Time(TimeWindow { days: vec![0], start: 22 * 60, end: 6 * 60 })];
    {
        let mut store = Store::open(&path).expect("open");
        store.save_schedules(std::slice::from_ref(&original)).expect("save");
    }
    {
        let store = Store::open(&path).expect("reopen");
        let loaded = store.load_schedules().expect("load");
        match &loaded[0].conditions[0] {
            Condition::Time(w) => {
                assert!(
                    w.is_overnight(),
                    "start={} end={} must still read as overnight after a restart",
                    w.start,
                    w.end
                );
                assert_eq!(w.start, 22 * 60);
                assert_eq!(w.end, 6 * 60);
            }
            other => panic!("condition type changed across a restart: {other:?}"),
        }
    }
    let _ = std::fs::remove_file(&path);
 }
 #[test]
 fn saving_replaces_rather_than_accumulates() {
    let path = temp_db("replace");
    let mut store = Store::open(&path).expect("open");
    store.save_schedules(&[sample_schedule(), sample_schedule_with_id("s2")]).expect("save");
    assert_eq!(store.load_schedules().unwrap().len(), 2);
    store.save_schedules(&[sample_schedule()]).expect("save");
    let loaded = store.load_schedules().expect("load");
    assert_eq!(loaded.len(), 1, "a second save must replace, not append");
    assert_eq!(loaded[0].id, "s1");
    let _ = std::fs::remove_file(&path);
 }
 fn sample_schedule_with_id(id: &str) -> Schedule {
    let mut s = sample_schedule();
    s.id = id.to_owned();
    s.name = format!("Schedule {id}");
    s
 }
 #[test]
 fn usage_accumulates_rather_than_overwrites() {
    let path = temp_db("usage");
    let mut store = Store::open(&path).expect("open");
    store.add_daily_usage(20_731, "com.example.social", 30).unwrap();
    store.add_daily_usage(20_731, "com.example.social", 25).unwrap();
    store.add_daily_launch(20_731, "com.example.social").unwrap();
    store.add_daily_launch(20_731, "com.example.social").unwrap();
    let row = store.load_daily_usage(20_731).expect("load");
    assert_eq!(row.minutes.get("com.example.social"), Some(&55));
    assert_eq!(row.launches.get("com.example.social"), Some(&2));
    // A different day is a different bucket.
    assert!(store.load_daily_usage(20_732).unwrap().minutes.is_empty());
    let _ = std::fs::remove_file(&path);
 }
 #[test]
 fn a_pending_disable_request_survives_a_restart() {
    // Section 1.5.2.2: filing a request must not lose the request on restart, or
    // a user who waits out a 12-hour delay and restarts the machine would be
    // back at square one with no explanation.
    let path = temp_db("pending");
    let state = blocker_core::lock::LockState {
        level: blocker_core::lock::LockLevel::Stubborn,
        schedules_locked: true,
        pending: Some(blocker_core::lock::PendingRequest {
            ready_at: Monotonic(12 * 3_600_000),
            window_closes_at: Monotonic(12 * 3_600_000 + 600_000),
        }),
        cooldown_remaining: None,
        attempts_today: 0,
        keyholder_code: None,
    };
    {
        let mut store = Store::open(&path).expect("open");
        store.save_lock(&state, BootId(7), 1_000).expect("save");
    }
    {
        let store = Store::open(&path).expect("reopen");
        let (ready, boot) = store
            .load_pending_request()
            .expect("load")
            .expect("a pending request must survive a restart");
        assert_eq!(ready, Monotonic(12 * 3_600_000));
        assert_eq!(boot, BootId(7), "the boot id must survive, so a reboot is detectable");
    }
    let _ = std::fs::remove_file(&path);
 }
 #[test]
 fn no_pending_request_reads_as_none() {
    let path = temp_db("nopending");
    let store = Store::open(&path).expect("open");
    assert_eq!(store.load_pending_request().unwrap(), None);
    let _ = std::fs::remove_file(&path);
 }
 #[test]
 fn disable_attempts_are_counted_per_day() {
    // Section 1.5.2.5: the block screen shows "you tried 4 times today".
    let path = temp_db("attempts");
    let mut store = Store::open(&path).expect("open");
    for _ in 0..4 {
        store.record_attempt(Monotonic(1_000), BootId(1), 20_731).unwrap();
    }
    store.record_attempt(Monotonic(2_000), BootId(1), 20_732).unwrap();
    assert_eq!(store.attempt_count(20_731).unwrap(), 4);
    assert_eq!(store.attempt_count(20_732).unwrap(), 1);
    assert_eq!(store.attempt_count(99_999).unwrap(), 0);
    let _ = std::fs::remove_file(&path);
 }
 /// Section 1.5.4: a corrupt database must never leave a device unusable.
 ///
 /// This is the single most important test in the crate. The requirement is
 /// fail *open*: blocking stops, the user keeps a working device, and the damaged
 /// file is kept for diagnosis.
 #[test]
 fn a_corrupt_database_fails_open() {
    let path = temp_db("corrupt");
    // Real bytes in place of the SQLite header. Enough to make the file
    // unopenable or unreadable, which is what "corrupt" means in the field.
    std::fs::write(&path, b"SQLite format 3\x00 this is not actually a database").unwrap();
    let store = Store::open(&path).expect("open must succeed despite corruption");
    assert!(store.recovered_from_corruption(), "the store must report that it recovered");
    assert!(
        store.load_schedules().unwrap().is_empty(),
        "a recovered database starts empty, which blocks nothing — fail open"
    );
    assert!(
        path.with_extension("corrupt").exists(),
        "the damaged file must be kept for diagnosis, not deleted"
    );
    let _ = std::fs::remove_file(&path);
    let _ = std::fs::remove_file(path.with_extension("corrupt"));
 }
 #[test]
 fn a_truncated_database_fails_open() {
    // A different failure mode from garbage bytes: a valid header with the
    // content cut off. Corruption in the field is often truncation, from a
    // power loss during a write.
    let path = temp_db("truncated");
    {
        let mut store = Store::open(&path).expect("open");
        store.save_schedules(&[sample_schedule()]).expect("save");
    }
    // Keep the first 200 bytes — a valid header, an unusable file.
    let full = std::fs::read(&path).unwrap();
    std::fs::write(&path, &full[..200.min(full.len())]).unwrap();
    let store = Store::open(&path);
    assert!(
        store.is_ok(),
        "a truncated database must still open, because failing to open would \
         leave the device with no enforcement and no UI"
    );
    let _ = std::fs::remove_file(&path);
    let _ = std::fs::remove_file(path.with_extension("corrupt"));
 }
 #[test]
 fn opening_creates_the_directory() {
    let mut nested = std::env::temp_dir();
    nested.push(format!("blocker-test-{}-nested/state", std::process::id()));
    let _ = std::fs::remove_dir_all(&nested);
    let path = nested.join("blocker.db");
    let store = Store::open(&path);
    assert!(store.is_ok(), "a missing parent directory must not be fatal");
    assert!(path.exists());
    let _ = std::fs::remove_dir_all(&nested);
 }
 #[test]
 fn old_usage_is_pruned() {
    // An unbounded usage table is a slow disk leak, and this machine has 9.6 GB
    // free. Statistics (section 1.6) need history, not infinite history.
    let path = temp_db("prune");
    let mut store = Store::open(&path).expect("open");
    for day in 20_000..20_100 {
        store.add_daily_usage(day, "com.example.social", 10).unwrap();
    }
    let removed = store.prune_usage(10).expect("prune");
    assert_eq!(removed, 90, "90 of 100 days are outside the 10-day window");
    let kept = store.load_daily_usage(20_099).unwrap();
    assert!(!kept.minutes.is_empty(), "recent history must be kept");
    let _ = std::fs::remove_file(&path);
 }
 #[test]
 fn reopening_is_idempotent() {
    // The migration must not run twice or clobber data.
    let path = temp_db("idempotent");
    let mut store = Store::open(&path).expect("open");
    store.save_schedules(&[sample_schedule()]).expect("save");
    drop(store);
    for _ in 0..3 {
        let store = Store::open(&path).expect("reopen");
        assert_eq!(store.load_schedules().unwrap().len(), 1, "data must survive re-migration");
    }
    let _ = std::fs::remove_file(&path);
 }
Author	SHA1	Message	Date
SellPL	af8b28f6c6	docs: add Gitea workflows, issue/PR templates, README and licence notice CI / ci (pull_request) Has been cancelled Details CI / android (pull_request) Has been cancelled Details ci.yml calls `scripts/ci.sh` rather than restating the checks: a workflow that reimplements them becomes a second definition of "done", and the two drift. Android runs as a separate job. It fails when the SDK is absent while ci.sh skips it — a developer should not be blocked by a missing toolchain, but a silently skipped Android build in CI means regressions ship unnoticed. Every action is pinned to an exact version. LICENSE.md records that no licence is chosen yet, and why it is not a formality: the choice is upstream of the UI toolkit decision, since Slint is GPL-3.0. Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-10-01 15:56:13 +03:00
SellPL	5073c7321d	docs: add ADR log, architecture, limitations, permissions, perf, testing The documentation set CLAUDE.md sections 2, 6, 8 and 10.1 call for, written as records of decisions actually made rather than as a description of intent. DECISIONS.md — 17 ADRs. Two are deliberately left open and say so: ADR-6 (the desktop UI toolkit, which section 3 requires be decided on measurement and which needs the owner's call, partly because Slint is GPL-3.0) and ADR-17 (the licence, which is a legal commitment nobody should make on the owner's behalf). Where CLAUDE.md gives a reason for a decision, that reason is recorded; where it does not, the file says the reason is unrecorded rather than inventing one. LIMITATIONS.md — all eight section 6 limits plus the section 1.5.4 safety guarantees, stated as facts about the operating systems. The words "unbypassable", "tamper-proof", "guaranteed" and "secure" appear nowhere, per sections 6.1 and 6.7. Ends with a separate list of shortfalls in the current code — storage has no I/O, the golden tables cannot yet be parsed, LockState always returns Normal — so a known gap in this implementation is never mistaken for a platform limit. ARCHITECTURE.md — the layering, the purity contract and its mechanical enforcement, why `next_wakeup` must be armed over inactive schedules too, the overnight weekday-of-start rule, and the end-to-end flow for one block event. PERF.md — targets and results as separate tables, so an aspiration is never read as a measurement. The one real number recorded (0.279 MB stripped daemon) is labelled as nearly meaningless, since the daemon is two print statements. Lists the common causes of idle-wakeup regressions. PERMISSIONS.md — per platform, what each permission is for and what degrades without it. Flags the two invasive ones (Android accessibility, extension host permissions) rather than burying them, and records that unprivileged eBPF is assumed unavailable here because the sysctls were never read. TESTING.md — the golden-table contract, the add-the-case-first rule, and why clock tampering needs code fixtures instead of data. Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-10-01 15:22:24 +03:00
SellPL	004479a032	ci: add ci.sh, size gate, and shared script helpers `scripts/ci.sh` is the source of truth for what must pass before a PR is mergeable. CLAUDE.md section 10.4 requires the Gitea workflow to run the same checks; the workflow calls this script rather than reimplementing the steps, so the two cannot drift apart. Runs: cargo fmt --check, clippy -D warnings, cargo test, the section 5 size gate, Android lint/assembleRelease, and a gitleaks scan. Verified behaviour, rather than assumed: - Failures really fail. Injected a syntax error into `core/src/lib.rs` and confirmed `ci.sh --keep-going` exits 1 and names all four dependent checks; then restored the file and confirmed a clean exit 0. `--keep-going` captures failures per step in a subshell instead of letting `set -e` abort the run, so the summary records what already passed. - Skips are never passes. Android and gitleaks both skip on this machine (no SDK, no gitleaks), and each SKIP names what was skipped and why, with the summary listing them separately from the passes. A skip that reads as a green tick is how CI quietly stops testing anything. - Runs from any CWD. `cargo` resolves a workspace from the CWD, not from the script's location, so `ci.sh` cds to the repo root. Verified by running it from `/tmp`. - `cargo` is on PATH. rustup adds `~/.cargo/bin` via `~/.bashrc`, which a non-interactive shell does not read — so a script invoked from CI or by absolute path failed with "command not found" until `lib.sh` prepends it. - Size gate resolves absolute paths. `CARGO_TARGET_DIR` is absolute by default, so joining it onto the repo root produced a doubled path; the default is now only joined when relative. Build artifacts go to `$HOME/.blocker-target`, outside the repo, so `target/` never appears in `git status` and can be deleted in one command. Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-10-01 15:16:58 +03:00
SellPL	585fd30440	feat(core): add workspace skeleton and the pure decision engine Establishes the cargo workspace and the shared `blocker-core` crate. The engine is deliberately written before any platform code, because CLAUDE.md section 2 makes it the single source of decision truth and M1 acceptance requires it to be pure. Workspace — five crates plus a test crate, zero external dependencies. Section 3 requires every crate to justify its binary-size cost, so M0 adds none. [profile.release] is workspace-only (cargo rejects it in members) and carries the section 5 settings that make the 5 MB stripped budget reachable. Purity contract — `evaluate(&EngineInput) -> Decision` reads no clock, no disk and no OS API; everything arrives in the input. `tests/purity.rs` enforces this mechanically by asserting blocker-core has zero dependencies, so a stray I/O reach-in fails the build rather than silently making the golden tables useless as a parity contract. Decisions worth calling out: - Monotonic time is a separate type from wall time. Section 1.5.3 requires a system date change never to shorten a lock. Keeping them apart makes that structural rather than a rule to remember. - `start > end` means overnight. No `crosses_midnight` flag: the comparison already encodes it and a second field is a second way to be wrong. The weekday for a window that started yesterday evening is yesterday's, which `overnight_window_survives_past_midnight` pins down. - `next_wakeup` is armed over every non-paused schedule, not only active ones. Filtering to active conditions first would let the daemon sleep straight through the moment a schedule is due to start. - Allowlist needs the installed-app inventory. `EngineInput` carries `installed_apps`; an empty slice fails open rather than guessing. - Wall-clock correction extends, never shortens, and clamps to the 24h cap. Extending unbounded would satisfy anti-tamper and violate section 1.5.4. - `cast_possible_truncation` is denied workspace-wide. Truncating a millisecond counter would corrupt a lock timer. Verified: 22 tests pass, `cargo fmt --check` clean, `cargo clippy -D warnings` clean, stripped release daemon 0.279 MB against the 5 MB budget. Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-10-01 15:02:20 +03:00
SellPL	440b4748f2	chore: add repo hygiene config and project spec Bootstrap the repository with the shared configuration every other piece depends on: - .gitignore: strict. Keeps build output, cargo caches, Android keystores, signing keys, .env files, local SQLite databases, IDE state and any credential-shaped filename out of history. CLAUDE.md 10.1 requires these never enter the repo. - .editorconfig, rustfmt.toml, clippy.toml: formatting and lint policy. clippy.toml is written in the lints-file form so lints are not duplicated into every crate manifest. CLAUDE.md is committed verbatim; it is the project spec and the parity contract for every platform layer. Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-10-01 14:04:39 +03:00