docs: draft TUI polish companion spec

release: prepare v0.3.4
docs(release): point consumers to release notes
2026-09-14 02:13:34 +05:30 · 2026-09-10 21:07:10 +05:30 · 2026-09-10 20:05:37 +05:30 · 2026-09-10 20:04:29 +05:30 · 2026-09-10 20:02:19 +05:30 · 2026-09-10 19:43:32 +05:30
25 changed files with 1763 additions and 55 deletions
@@ -21,6 +21,25 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: Validate release tag and notes
        run: |
          set -euo pipefail
          VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)"
          if [ -z "${VERSION}" ]; then
            echo "::error::could not determine the project version"
            exit 1
          fi
          if [ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]; then
            EXPECTED_TAG="v${VERSION}"
            ACTUAL_TAG="${GITHUB_REF#refs/tags/}"
            if [ "${ACTUAL_TAG}" != "${EXPECTED_TAG}" ]; then
              echo "::error::tag ${ACTUAL_TAG} does not match ${EXPECTED_TAG}"
              exit 1
            fi
          fi
          python3 scripts/extract_changelog.py CHANGELOG.md "${VERSION}" \
            --footer packaging/release-footer.md > "${RUNNER_TEMP}/release-body.md"
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
@@ -144,20 +163,44 @@ jobs:
        env:
          GITEA_PUBLISH_TOKEN: ${{ secrets.GITEAPACKAGETOKEN }}
        run: |
-          VERSION=${{ steps.version.outputs.version }}
+          set -euo pipefail
-          # Check if release already exists (idempotent re-runs)
+          if [ -z "${GITEA_PUBLISH_TOKEN}" ]; then
-          EXISTING=$(curl -s -o /dev/null -w '%{http_code}' \
+            echo "::error::GITEAPACKAGETOKEN repository secret is not configured"
-            -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+            exit 1
            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}")
          if [ "$EXISTING" = "200" ]; then
            echo "Release v${VERSION} already exists, skipping creation"
          else
            curl --fail -X POST \
              -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
              -H "Content-Type: application/json" \
              -d "{\"tag_name\":\"v${VERSION}\",\"name\":\"v${VERSION}\"}" \
              "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases"
          fi
          VERSION=${{ steps.version.outputs.version }}
          RELEASE_BODY="${RUNNER_TEMP}/release-body.md"
          if [ ! -s "${RELEASE_BODY}" ]; then
            echo "::error::validated release body is missing or empty"
            exit 1
          fi
          EXISTING_RELEASE="${RUNNER_TEMP}/existing-release.json"
          EXISTING=$(curl --silent --show-error -o "${EXISTING_RELEASE}" -w '%{http_code}' \
            -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}" || true)
          case "${EXISTING}" in
            200)
              echo "Release v${VERSION} exists; resynchronizing its notes"
              REQUEST="$(python3 scripts/release_request.py --version "${VERSION}" \
                --body-file "${RELEASE_BODY}" --existing-release "${EXISTING_RELEASE}")"
              ;;
            404)
              REQUEST="$(python3 scripts/release_request.py --version "${VERSION}" \
                --body-file "${RELEASE_BODY}")"
              ;;
            *)
              echo "::error::release lookup failed with HTTP ${EXISTING}"
              exit 1
              ;;
          esac
          METHOD="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['method'])")"
          RELEASE_PATH="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['path'])")"
          PAYLOAD="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.dumps(json.load(sys.stdin)['payload']))")"
          curl --fail --silent --show-error -X "${METHOD}" \
            -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
            -H "Content-Type: application/json" \
            -d "${PAYLOAD}" \
            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris${RELEASE_PATH}"
      - name: Attach artifacts to release
        env:
@@ -0,0 +1,18 @@
 # Changelog
 <!--
 Maintainers add one user-facing entry to Unreleased with each change. A release
 commit bumps pyproject.toml, renames Unreleased to that bare-semver version and
 an ISO date, then restores an empty Unreleased section; tag that commit. Do not
 backfill releases from before this changelog.
 -->
 ## [Unreleased]
 ## [0.3.4] - 2026-09-10
 ### Added
 - Add Fenris identity and a polkit authentication notice to the dashboard.
 - Clarify monitoring continuity, deliberate pauses, and quitting in the dashboard and status output.
 - Add per-release notes with installation, verification, and rollback guidance.
@@ -32,13 +32,25 @@ _Avoid_: Data directory, history.jsonl, the database (generic)
 The condition where the observation store is present but cannot be read or trusted — unreadable, corrupt, or written by a newer Fenris — degrading every view that depends on it rather than crashing or guessing.
 _Avoid_: Database error, corruption, broken data
 **Usage interval**:
 The elapsed span between two compatible counter observations, with a measured usage total whose distribution within that span may be unknown.
 _Avoid_: Estimated hourly usage, interpolated sample
 **Unallocated usage**:
 Measured usage whose share in a particular hour, calendar day, or monitoring period cannot be established from the available evidence.
 _Avoid_: Zero usage, evenly distributed writes
 **Hour observation**:
-One row per UTC hour in the observation store, recording that hour's usage-habit split into active, idle, powered-off, and unknown seconds, plus write/read deltas, thermal evidence, and coverage.
+The usage-habit evidence for a UTC hour's represented elapsed span: active, idle, powered-off, and unknown time, measured usage, thermal evidence, and coverage. A partial hour does not describe future time.
 _Avoid_: Hourly record, hourly.jsonl entry
 **Day aggregate**:
-One row per UTC day derived from hour observations; the grain at which usage-habit evidence is judged.
+The UTC-day summary at which usage-habit evidence is judged; distinct from a local display day.
-_Avoid_: Daily summary, daily stats
+_Avoid_: Local daily total, daily stats
 **Local display day**:
 A calendar day in the user's current system timezone, used to browse observation history; its elapsed length can vary with timezone transitions.
 _Avoid_: UTC evidence day, fixed 24-hour day
 **Controller segment**:
 A span of observation history within which the drive's controller identity is unchanged and counters are monotonic; write deltas are never computed across a segment boundary.
@@ -76,6 +88,14 @@ _Avoid_: Confidence interval, error bar
 The share of wall-clock seconds inside monitoring periods whose usage-habit classification is known rather than unknown.
 _Avoid_: Uptime, sample count
 **Byte-allocation completeness**:
 Whether the available evidence establishes all monitored writes attributable to a specified span, without missing counter evidence or unknown boundary shares; distinct from usage-habit classification coverage.
 _Avoid_: Coverage, estimated allocation
 **Qualifying day**:
 A UTC date whose represented monitored time meets the coverage requirement for projection evidence. Qualification is provisional while the date is in progress and does not establish byte-allocation completeness.
 _Avoid_: Completed day, supported day, calibration day
 **Collection run**:
 One scheduled or on-demand execution of the collector that interrogates the drive and extends the observation history.
 _Avoid_: Poll, daemon tick
@@ -189,6 +189,16 @@ No interval key exists in `/etc/fenris/fenris.conf`. Cadence is a systemd concer
 | `fenris start` / `stop` / `run` | Rejected with a one-line migration pointer — never aliased. |
 | `fenris --device` | Rejected with a pointer to the configuration file. |
 ## Reading the dashboard
 `fenris` opens the TUI dashboard.
 - **Continuity** — the service strip's continuity line (and `fenris status`) reports whether monitoring survives reboots: `monitoring: active in background · persists across reboots`, or `monitoring: does not start on next boot`.
 - **Paused vs. quit** — a full-width `monitoring: paused — deliberate disable` block means collection is stopped (`fenris monitor pause`); resume with `fenris monitor resume`. Pressing `q` only leaves the screen — monitoring keeps running in the background.
 - **Auth banner** — at launch, `privileged actions will prompt for authentication (polkit)` shows once and clears on the first refresh. Privileged actions elevate via polkit; Fenris never asks for sudo.
 Per-release notes live on the [releases page](https://git.bongbetic.com/xavierk/Fenris/releases): each entry is the version's `CHANGELOG.md` section — what was added, changed, and fixed — plus standing install and verification instructions.
 ## Retired menu options
 The legacy `fenris.sh` menu script and the `fenris.py` monolith have been removed. Here's where the old options went:
@@ -91,7 +91,7 @@ Status: Accepted — resolves [Define cross-cutting acceptance criteria](https:/
 - **TUI-1** (A) Variant A "Panes": one dense keyboard-first screen; confidence rendered as evidence (state + contributing facts); boot enablement, runtime activity, last collect outcome, and freshness displayed as four separate facts.
 - **TUI-2** (M) Pause/resume asymmetry and polkit tty passthrough work in a live terminal: pause confirms, resume does not, and the platform agent prompts without breaking the TUI.
 - **TUI-3** (P) Textual runs on Python 3.9+, gated at install time, never a runtime crash.
- **TUI-4** (A) The Panes screen layout is normative: a full-width headline band (lifespan headline or its no-projection wording, confidence state with contributing facts, scenario range); a usage-history pane on the left (write-history sparkline with ▲ habit-change and ? unexplained-gap markers plus legend, habit-split bar with active/idle/powered-off/unknown shares); a drive-health and settings pane on the right (health facts, vendor-wear context line, read-only settings with the endurance baseline and its provenance label); a full-width service strip at the bottom (the four separate service facts, the monitoring-period line, the action legend). Production bindings are `p` pause (asks), `r` resume (does not), `c` collect now, `d` disclosures, `q` quit ([Prototype the TUI information architecture](https://git.bongbetic.com/xavierk/Fenris/issues/3)); the prototype branch is visual reference only.
+- **TUI-4** (A) The Panes screen layout is normative: a full-width headline band (lifespan headline or its no-projection wording, confidence state with contributing facts, scenario range); a usage-history pane on the left (write-history sparkline with ▲ habit-change and ? unexplained-gap markers plus legend, habit-split bar with active/idle/powered-off/unknown shares); a drive-health and settings pane on the right (health facts, vendor-wear context line, read-only settings with the endurance baseline and its provenance label); a full-width service strip at the bottom (the four separate service facts, the monitoring-period line, the action legend). Production bindings are the footer `p pause · r resume · c collect · d disclosures` — pause asks, resume does not — plus a bordered quit rail `q QUIT TUI` visually separate from monitoring state; the rail owns quit and the footer carries no quit entry (bindings amended by [Lock the dashboard wording strings](https://git.bongbetic.com/xavierk/Fenris/issues/57); original [Prototype the TUI information architecture](https://git.bongbetic.com/xavierk/Fenris/issues/3)); the prototype branch is visual reference only.
 ## Failure and recovery (ADR 0005)
@@ -131,3 +131,32 @@ Status: Accepted — resolves [Define cross-cutting acceptance criteria](https:/
 - **AC-3** (A) Any acquisition failure — missing binary, nonzero exit, malformed JSON, unreadable sysfs attribute — fails the whole collection run; no partial sample (identity without counters, or counters without identity) is ever written; the miss surfaces through ADR 0005 freshness, never as degraded identity.
 - **AC-4** (P) `vid`/`ssvid` are read from the PCI sysfs node when present and stored null otherwise; they are segment metadata only, never key components.
 - **AC-5** (P) `make install` verifies `smartctl` and fails cleanly otherwise; the acquisition path adds no Python dependency and no OS package beyond smartmontools (ADR 0004 §9).
 ## Dashboard clarity and release notes ([Chart Fenris dashboard clarity](https://git.bongbetic.com/xavierk/Fenris/issues/55))
 Decided in [Write the dashboard clarity acceptance criteria](https://git.bongbetic.com/xavierk/Fenris/issues/59), from [Prototype the dashboard clarity additions](https://git.bongbetic.com/xavierk/Fenris/issues/56), [Lock the dashboard wording strings](https://git.bongbetic.com/xavierk/Fenris/issues/57), and [Specify the changelog and release-notes mechanism](https://git.bongbetic.com/xavierk/Fenris/issues/58).
 - **DC-1** (A) TUI branding: the header bar renders `Fenris — NVMe endurance monitor`; a dimmed `by Bongbetic` sits inline with service facts in the bottom service strip; neither string appears in `fenris status` (TUI-only identity surfaces).
 - **DC-2** (A) Continuity parity, keyed to the boot fact as-is: active + boot-enabled renders `monitoring: active in background · persists across reboots`; boot-disabled renders `monitoring: does not start on next boot` — identical lowercase source strings in the TUI service strip and `fenris status`, including while paused (paused implies boot-disabled; the row still reports the fact). Test impact: feeds the CI-2 sweep (lowercase source-string comparison).
 - **DC-3** (A) Paused presentation (Deliberate disable): the TUI shows a strong state block titled `monitoring: paused — deliberate disable` with subline `paused time is excluded from your usage habit · resume: fenris monitor resume`; `fenris status` prints the same two lines with identical wording. Test impact: feeds the CI-2 sweep (lowercase source-string comparison).
 - **DC-4** (A) Quit affordance distinct from monitoring state: a bordered labelled rail `q QUIT TUI` visually separate from the paused state block; the footer reads `p pause · r resume · c collect · d disclosures` with no quit entry (the rail owns quit); quitting the TUI never alters monitoring state. Amends TUI-4's binding parenthetical.
 - **DC-5** (A) Launch auth banner: `privileged actions will prompt for authentication (polkit)` renders full-width under the header at TUI launch, clears on the first refresh tick, and never reappears in the session; no user-facing string uses "sudo" (polkit-accurate elevation wording only).
 - **DC-6** (A) CHANGELOG.md shape (Keep a Changelog 1.1): `## [Unreleased]` always present at top, even empty; version headings `## [X.Y.Z] - YYYY-MM-DD` with strict ISO date; categories Added/Changed/Fixed only, security folding into Fixed; entries are single `- ` bullets, imperative mood, user-facing, no commit hashes or issue numbers.
 - **DC-7** (A) Extraction fails closed: `scripts/extract_changelog.py` slices the requested version's section verbatim and never reads `[Unreleased]`; a missing or empty section or a malformed date produces `::error::` and a nonzero exit; the release workflow fails when the pushed tag ≠ `v{version from pyproject.toml}` (guard skipped on `workflow_dispatch`).
 - **DC-8** (A/P) Release body: the body is the extracted section verbatim plus the standing footer from `packaging/release-footer.md`; a re-run against an existing release PATCHes the body (re-sync is a feature) while uploaded assets skip idempotently. A covers assembly/PATCH-logic unit tests; P is one scripted `workflow_dispatch` verification of body assembly.
 ## TUI polish and hourly history ([Fenris TUI polish and hourly history](https://git.bongbetic.com/xavierk/Fenris/issues/65))
 Proposed by [Approve the Fenris TUI polish specification and handoff](https://git.bongbetic.com/xavierk/Fenris/issues/70), from the companion specification [`fenris-tui-polish-hourly-history.md`](fenris-tui-polish-hourly-history.md). This section amends the frozen redesign and prior dashboard-clarity criteria without editing their historical source specs. Where these criteria conflict with older TUI/header/history criteria, these newer criteria win. In particular, **TPH-1** supersedes **DC-1**'s header/credit placement; **TPH-2** and **TPH-3** refine **CI-2**, **LC-10**, and **TUI-4** status rendering; **TPH-4** through **TPH-7** refine **ST-5**, **PR-2** through **PR-9**, and **FL-1** through **FL-4** with the approved hourly-history and UTC-accounting contracts.
 - **TPH-1** (A) *Titlebox and maker credit*: the TUI renders a top titlebox exactly `🐺 Fenris by Bongbetic`, falling back exactly to `Fenris by Bongbetic` when the wolf glyph is unsupported or width-unstable; no replacement-box glyph is shown; the old service-strip `by Bongbetic` credit is absent; `fenris status` renders no titlebox. Continuity, paused, quit, auth, parity, and release-notes behavior from **DC-2** through **DC-8** remains unchanged.
 - **TPH-2** (A) *Status lattice and precedence*: fixture-driven TUI status rendering covers Monitoring, Collecting, Paused, Waiting, Interrupted, Error, Stale, and Unknown with the approved glyphs/text, semantic colours, and reason lines; only Monitoring's dot blinks, never text; reduced motion makes it steady; precedence is Error > Interrupted > Paused > Stale > Waiting > Monitoring > Unknown, with Collecting as an overlay except over store fault.
 - **TPH-3** (A/P) *CLI/status parity and timing*: `fenris status` renders the same status vocabulary, glyphs, precedence, and reason lines statically; freshness, last outcome, boot enablement, and collection activity remain separate facts; a lightweight 5 s unit-state poll can move cached freshness boundaries without a store read, while new samples appear only after the normal store refresh; store faults render `observation store unreadable — see journal` and suppress store-dependent views.
 - **TPH-4** (A) *Warm-up and withheld estimates*: projection warm-up shows `Building evidence — N of 14 days observed · Q qualifying` plus `First lifespan estimate after 12 qualifying days`; the gate is 14 represented UTC dates in the current controller segment with at least 12 qualifying, while Supported separately requires 14 qualifying dates and all existing prerequisites. Missing baseline, unsupported write counters, warm-up, stale evidence, paused days, and unavailable numerators render explicit reason lines, never blank or misleading zero; first graph-data availability is independent of lifespan-estimate availability.
 - **TPH-5** (A) *Collector-owned history publication and first data*: collection publishes validated sample → usage interval → hour observation/day aggregate results consistently before reporting success; the TUI remains read-only. Zero samples show awaiting-first-sample; one sample shows `Awaiting another sample`; the first compatible sample pair can show measured partial-hour `so far`; measured zero is `0 B`; missing, unsupported, invalid, or unavailable evidence is never converted to zero.
 - **TPH-6** (A) *Local display days, attribution, gaps, pauses, and repair*: history browsing groups retained evidence by the current system timezone with the timezone label visible, including DST and fractional-offset cases; timestamped usage intervals are retained indefinitely alongside hour/day summaries, while raw samples keep the 14-day policy except needed boundary anchors. Measured interval totals are preserved once; cross-boundary shares render as unallocated usage rather than interpolation or endpoint assignment; gaps remain distinct from zero; future time is not counted; deliberate-disable time is excluded; pause-crossing bytes are not counted as monitored totals; repair is transactional/idempotent and cannot overwrite valid older history with incomplete reconstruction.
 - **TPH-7** (A) *UTC projection accounting and evaluability*: 7/28/90-day scenario windows end at the latest published usage-evidence endpoint `T` and start exactly 7/28/90 × 86,400 seconds earlier; denominators are monitored wall-clock seconds in the same span; rates are withheld when the monitored numerator cannot be established. Byte-allocation completeness and coverage are independent. Current partial UTC dates can qualify provisionally using elapsed monitored time; habit changes require completed consecutive UTC days with evaluable totals; unknown daily totals block burst/habit checks and Supported confidence; resets/replacements and legacy summaries obey the approved segment and actual-precision rules without changing lifespan math or numeric thresholds.
 - **TPH-8** (A/M) *Writes-only graph and drill-down*: the TUI renders a writes-only daily bar graph, default 14 days, selectable 7/14/28/90 days, labelled `usage history · Local · UTC±HH:MM · <tz name>`; graph focus supports `←`/`→`, `Enter`, `Esc`/`Backspace`, and `1`/`2`/`3`/`4`, with mouse equivalents for select/drill/back where Textual support is available. Daily bars drill into hourly bars and back. The legend distinguishes allocated `█`, unallocated `▒`, gap `░`, measured zero `·`, partial `┄`, and selection `▼`; selected readout states totals, evidenced hours, unallocated usage, coverage, and partial elapsed facts. Reads graphing is out of scope.
 - **TPH-9** (A) *Terminal size and graph implementation*: at 80×24 the default range graph and hourly drill-down fit; below 80×24 the graph region hides and shows a one-line textual history summary plus exactly `graph needs ≥80×24`, while titlebox, status reason, drive health, service facts, quit rail/action affordances, and selected-day context survive. The graph uses a custom block-glyph renderable; no new plotting dependency is added for this graph.
 - **TPH-10** (A/M) *Colour presets, persistence, and reduced motion*: Amber, Nord, and High Contrast presets are available; Amber is the default and keeps the graph amber by default; status semantic colours/glyphs/text outrank theme styling. Preset and reduced-motion choices persist per unprivileged user at `${XDG_CONFIG_HOME:-~/.config}/fenris/tui.json`, not in `/etc/fenris/fenris.conf`, the observation store, helper state, package config, or collector/device configuration; missing preferences default to Amber and normal motion; `t preset` and `m motion` controls plus accessible clickable equivalents are available; preferences never affect collection, projection, history evidence, or `fenris status`.
 - **TPH-11** (A) *Drive health and settings grouping*: vendor wear renders under Drive health with temperature, spare, media errors, unsafe shutdowns, power-on hours, cycles, capacity, and written-total context, and remains context rather than a second projection. Settings is read-only and limited to device selector, endurance baseline/provenance, retention facts, and TUI display preferences; no custom colour editor exists.
@@ -0,0 +1,122 @@
 # Fenris dashboard clarity specification
 **Status: decision-complete.** Assembled by [Assemble the dashboard clarity specification and close the map](https://git.bongbetic.com/xavierk/Fenris/issues/60) from the closed tickets of the Wayfinder map [Chart Fenris dashboard clarity](https://git.bongbetic.com/xavierk/Fenris/issues/55). This document is normative for the follow-up **execution effort**; nothing here is implemented by the map.
 **Canonical roles.** The [redesign specification](fenris-redesign.md) (frozen) and [ADRs 0001–0007](../adr/) remain authoritative and untouched — this is a companion spec covering five dashboard clarity additions plus the changelog-driven release-notes mechanism. The [criteria register](acceptance-criteria.md) carries the testable statements: **DC-1–DC-8**, appended by this assembly, with **TUI-4's binding list amended** (§4). Terminology follows the glossary in [`CONTEXT.md`](../../CONTEXT.md), including *Deliberate disable* and *Release*.
 **Binding language.** *Must*, *exactly*, and *never* are normative.
 ## How to read this document
 Five screen additions (§1–§5), one release-notes mechanism (§6), the verbatim string register (§7), and the README section to add at execution (§8). Each section cites its criteria. Source strings are lowercase; the TUI may render uppercase via styling only. Typography, governing every string: em-dash `—` separates a title from its qualifier; middle dot `·` joins facts within a line; UTF-8 is assumed. CI parity sweeps compare lowercase source strings — rendering case is styling, not wording.
 ## 1. Header bar and Bongbetic credit — DC-1
 Visual base is treatment A, quiet integration: the existing Panes information architecture is preserved.
 - The header bar reads `Fenris — NVMe endurance monitor`.
 - The credit `by Bongbetic` renders dimmed, inline with service facts in the bottom service strip — never in the action row.
 - Both are TUI-only identity surfaces: `fenris status` never renders them.
 ## 2. Continuity line — DC-2
 A labelled `CONTINUITY` row in the service strip (treatment B), mirrored by `fenris status` — the TUI/CLI parity anchor. The row is keyed to the boot fact as-is, independently of run state (Deliberate disable runs `systemctl disable --now`, so paused implies boot-disabled; the row still reports the fact):
 - Active + boot enabled: `monitoring: active in background · persists across reboots`
 - Boot disabled: `monitoring: does not start on next boot`
 Identical lowercase source strings in the TUI service strip and `fenris status`, including while paused.
 ## 3. Paused state block — DC-3
 Treatment C, strong state blocks: when monitoring is paused, a full-width, high-contrast banner clearly identifying Deliberate disable:
 - Title: `monitoring: paused — deliberate disable`
 - Subline: `paused time is excluded from your usage habit · resume: fenris monitor resume`
 `fenris status` prints the same two lines with identical wording (state line + consequence line). The resume hint uses the CLI form only; the footer owns key hints — no duplication.
 ## 4. Quit rail — DC-4 (amends TUI-4)
 Treatment B, labelled rails: a prominent bordered `q QUIT TUI` rail, visually separate from the monitoring-state block and the paused banner. The footer becomes `p pause · r resume · c collect · d disclosures` — the rail owns quit; the footer carries no quit entry. Quitting the TUI never alters monitoring state. The register's TUI-4 binding parenthetical is amended accordingly by this assembly.
 ## 5. Launch auth banner — DC-5
 A quiet informational line (treatment A) that never competes with drive state:
 - Text: `privileged actions will prompt for authentication (polkit)`
 - Full-width under the header at TUI launch; clears on the first refresh tick; never reappears in the session.
 - TUI-only; `fenris status` never shows it.
 - Elevation wording is polkit-accurate everywhere: no user-facing string uses "sudo" (sudo belongs to install/upgrade docs).
 - Evidence class A: a Textual pilot drives refresh ticks headlessly.
 ## 6. Changelog and release notes — DC-6, DC-7, DC-8
 Implements the existing glossary term *Release* (tag + packages + change notes together). No new glossary terms; no ADR (reversible mechanism).
 ### 6.1 CHANGELOG.md (source of truth, repo root)
 - Keep a Changelog 1.1 shape. `## [Unreleased]` is always present at top, even empty. Version headings are `## [X.Y.Z] - YYYY-MM-DD` — bracketed bare semver, strict ISO date.
 - Categories are `### Added`, `### Changed`, `### Fixed` only; security fixes fold into Fixed.
 - Entries are single `- ` bullets, imperative mood, user-facing phrasing; no commit hashes or issue numbers.
 ### 6.2 Extraction (release.yml, tag time)
 - `scripts/extract_changelog.py` (checked in, unit-tested): takes the changelog path and a version; slices that version's section verbatim; never reads `[Unreleased]`. Fails closed — `::error::` plus nonzero exit — when the section is missing or empty or the date is malformed.
 - Guard: the workflow fails when the pushed tag ≠ `v{version from pyproject.toml}` (guard skipped on `workflow_dispatch`).
 ### 6.3 Release body
 - Body = extracted version section verbatim + standing footer from `packaging/release-footer.md` (channel install one-liners, `sha256sum -c SHA256SUMS.asc` verify, rollback pointer). The footer is standing text; only the changelog section varies.
 - Re-run against an existing release: PATCH the body (changelog re-sync is a feature); uploaded assets/packages keep their current idempotent-skip.
 ### 6.4 Discipline
 - All entries land in `[Unreleased]` as part of the fixing change — no notes-later step.
 - One release commit bumps the pyproject version, renames `[Unreleased]` → the version heading, and restores an empty `[Unreleased]`; the tag points at that commit (tag ↔ pyproject ↔ changelog triple-match, enforced fail-closed by DC-7).
 - No backfill: per-release notes begin with the release shipping this mechanism; `CHANGELOG.md` starts with empty `[Unreleased]`.
 ## 7. String register (verbatim)
 ### TUI-only strings (launch/identity surfaces)
 | Surface | String |
 |---|---|
 | Header bar | `Fenris — NVMe endurance monitor` |
 | Credit (dimmed, inline with service facts) | `by Bongbetic` |
 | Auth banner (full-width under header at launch, clears on first refresh tick, never reappears) | `privileged actions will prompt for authentication (polkit)` |
 | Quit rail (bordered, labelled) | `q QUIT TUI` |
 | Footer (owns key hints; no quit entry) | `p pause · r resume · c collect · d disclosures` |
 ### Parity strings (TUI and `fenris status` identical — CI-2)
 | Surface | String |
 |---|---|
 | Continuity, active + boot enabled | `monitoring: active in background · persists across reboots` |
 | Continuity, boot disabled | `monitoring: does not start on next boot` |
 | Paused state line | `monitoring: paused — deliberate disable` |
 | Paused consequence line | `paused time is excluded from your usage habit · resume: fenris monitor resume` |
 `fenris status` prints the paused state line + consequence line when paused, identical wording to the banner title + subline.
 ## 8. README section (add at execution)
 The README gains a "Reading the dashboard" section after the CLI reference. Verbatim text:
 ```markdown
 ## Reading the dashboard
 `fenris` opens the TUI dashboard. Three things it tells you:
 - **Continuity** — the service strip's continuity line (and `fenris status`) reports whether monitoring survives reboots: `monitoring: active in background · persists across reboots`, or `monitoring: does not start on next boot`.
 - **Paused vs. quit** — a full-width `monitoring: paused — deliberate disable` block means collection is stopped (`fenris monitor pause`); resume with `fenris monitor resume`. Pressing `q` only leaves the screen — monitoring keeps running in the background.
 - **Auth banner** — at launch, `privileged actions will prompt for authentication (polkit)` shows once and clears on the first refresh. Privileged actions elevate via polkit; Fenris never asks for sudo.
 Per-release notes live on the [releases page](https://git.bongbetic.com/xavierk/Fenris/releases): each entry is the version's `CHANGELOG.md` section — what was added, changed, and fixed — plus standing install and verification instructions.
 ```
 This resolves the map's README-wording fog: the wording is decided here; the actual README edit is execution.
 ## 9. Out of scope
 Executing any of this — code, tests, releases — and any TUI layout or information-architecture redesign beyond the five additions named above. Execution is a fresh effort after handoff.
@@ -0,0 +1,351 @@
 # Fenris TUI polish and hourly history companion specification
 **Status:** approval-ready draft for [Approve the Fenris TUI polish specification and handoff](https://git.bongbetic.com/xavierk/Fenris/issues/70). It becomes implementation-ready only when that ticket records human approval. This is a planning asset: no production code, release gate, package, installation change, or runtime diagnosis is made here.
 **Canonical sources.** This companion integrates the closed decisions on [Fenris TUI polish and hourly history](https://git.bongbetic.com/xavierk/Fenris/issues/65): [Define trustworthy hourly history and first-data availability](https://git.bongbetic.com/xavierk/Fenris/issues/66), [Choose daily graph encoding and hourly drill-down](https://git.bongbetic.com/xavierk/Fenris/issues/68), [Reconcile unallocated usage with UTC projection evidence](https://git.bongbetic.com/xavierk/Fenris/issues/71), [Define monitoring signals and honest warm-up estimates](https://git.bongbetic.com/xavierk/Fenris/issues/67), and [Approve titlebox, health layout and colour presets](https://git.bongbetic.com/xavierk/Fenris/issues/69). Terminology follows [`CONTEXT.md`](../../CONTEXT.md), including *Usage interval*, *Unallocated usage*, *Local display day*, *Byte-allocation completeness*, and *Qualifying day*.
 **Relationship to existing specs.** [`fenris-redesign.md`](fenris-redesign.md) stays frozen. This companion amends it without editing it. [`dashboard-clarity.md`](dashboard-clarity.md) remains binding except where this document explicitly supersedes its header/credit placement. In the tracker, [Implement dashboard clarity and release notes](https://git.bongbetic.com/xavierk/Fenris/issues/61) is currently closed; this companion is a new follow-on handoff, not a rewrite or reopening of that shipped umbrella.
 **Binding language.** *Must*, *exactly*, and *never* are normative.
 ## 1. Supersession and preserved requirements
 This companion supersedes only these dashboard-clarity identity placements:
 - the old header `Fenris — NVMe endurance monitor`;
 - the old dimmed `by Bongbetic` credit in the service strip.
 The new identity contract is the top titlebox in §2. The titlebox is the sole maker-credit surface.
 Everything else from [Chart Fenris dashboard clarity](https://git.bongbetic.com/xavierk/Fenris/issues/55) remains intact unless a more specific clause below amends its placement: the continuity wording, paused block and Deliberate-disable semantics, `q QUIT TUI` rail, footer action ownership, polkit-accurate auth banner, TUI/CLI wording parity where binding, changelog-driven release notes, and the quit-versus-pause distinction. Polkit wording remains polkit-accurate; no new user-facing TUI/status string says "sudo".
 ## 2. Product identity, health layout, and settings
 ### 2.1 Titlebox
 The TUI's top titlebox must read exactly:
 ```text
 🐺 Fenris by Bongbetic
 ```
 If the wolf glyph is unsupported or would disturb titlebox width, the fallback is exactly:
 ```text
 Fenris by Bongbetic
 ```
 Do not render tofu, replacement boxes, or an unstable emoji-width layout. The lifespan headline remains a drive/projection data surface, not the application title. `fenris status` does not render this titlebox.
 ### 2.2 Maker credit
 Remove the duplicate `by Bongbetic` service-strip credit in the polished layout. The titlebox is the only maker-credit surface. This is the explicit amendment to the prior dashboard-clarity header/credit placement; it does not weaken the preserved continuity, pause, quit, auth, parity, or release-notes requirements.
 ### 2.3 Drive health and settings grouping
 Move vendor wear under **Drive health**, alongside temperature, spare, media errors, unsafe shutdowns, power-on hours, cycles, capacity, and written-total context. Vendor wear remains context, never a second projection.
 **Settings** remains read-only and limited to the device selector, endurance baseline/provenance, retention facts, and TUI display preferences. No custom colour editor is added.
 ## 3. Monitoring status, collection activity, and warm-up messaging
 ### 3.1 Status lattice
 Every status line carries a glyph and text label. Colour is never the sole carrier. Text never blinks.
 | State | Colour | Glyph | Motion | Exact status / explanation contract |
 |---|---|---|---|---|
 | Monitoring | green | `●` | blink 750 ms on / 750 ms off, status dot only | `● Monitoring` |
 | Collecting | green | `◐` | steady | `◐ Collecting` — run in flight, bounded by the 90 s collection timeout |
 | Paused | amber | `‖` | steady | `‖ Paused` — `monitoring paused — paused time excluded from your usage habit` |
 | Waiting | amber | `○` | steady | `○ Waiting` — `last sample X ago`, `awaiting first sample`, or `awaiting another sample` |
 | Interrupted | red | `⊘` | steady | `⊘ Interrupted` — `collection stopped outside Fenris — monitoring period still open` |
 | Error | red | `✖` | steady | `✖ Error` — `last run failed (exit N)` plus `last good sample X ago` when data is still fresh, or `observation store unreadable — see journal` |
 | Stale | red | `◌` | steady | `◌ Stale` — `last sample X days ago` when the timer is active and no failure is recorded |
 | Unknown | grey | `?` | steady | `? Unknown` — `service state unavailable` |
 Reduced motion, either from Textual's reduced-motion signal or the user's preference, renders Monitoring as a steady `● Monitoring`. The CLI form is always steady.
 ### 3.2 Precedence
 Base-state precedence is:
 ```text
 Error > Interrupted > Paused > Stale > Waiting > Monitoring > Unknown
 ```
 Additional rules:
 - Paused outranks Stale. A drive paused for 49 days is amber Paused with `last sample 49 days ago` as a fact line, not a stale alarm.
 - Error outranks Interrupted; the external stop rides in the explanation line when both facts exist.
 - Unknown is used only when the service query fails and no store-derived fact, such as an open monitoring period, freshness, or deliberate-pause row, places the state higher.
 - Collecting is an overlay, not a base rung. While the oneshot is in flight it overrides every base state except a store fault. While overlaying Paused, Interrupted, or retry-after-failure, the explanation line names the underlying state: for example, `run in flight — paused` or `run in flight — retry`. It reverts within the 90 s collection timeout to whatever state the outcome earns.
 ### 3.3 Separate facts
 Do not fold these facts into the status word:
 - `Last sample: X ago` freshness;
 - last outcome: ok, failed with exit code, or none;
 - `Start at boot: on/off` boot enablement;
 - collection activity, which is represented by the Collecting overlay.
 Blink means exactly "monitoring enabled and data fresh". It never means that collection just succeeded; collection activity is explicit Collecting.
 ### 3.4 Timing and refresh
 A lightweight 5 s `systemctl show` poll of the timer and service units drives the status strip. The full store refresh remains at the 5-minute cadence. Status transitions are re-evaluated every poll tick from cached newest-sample timestamp plus current clock, so freshness aging boundaries cross within roughly 5 s without a store read. A new sample requires the normal store refresh.
 The existing constants remain unchanged: fresh is newest sample within 2 × cadence + `AccuracySec` + 60 s, stale is at 48 h, collection timeout is 90 s, and default cadence is 5 min.
 ### 3.5 Canonical transitions
 The implementation must make these states directly observable:
 - failed run, data 4 min old: `✖ Error` — `last run failed (exit 3) · last good sample 4 min ago`;
 - next successful run: `● Monitoring` after the status poll/refresh clears the failure;
 - failed run with retry in flight: `◐ Collecting` — `run in flight — retry`, then Error or Monitoring;
 - suspend for 3 h, wake, timer fires: `○ Waiting` → `◐ Collecting` → `● Monitoring`;
 - external stop with fresh data: `⊘ Interrupted` — `collection stopped outside Fenris`;
 - external stop 3 days later: still `⊘ Interrupted`, with `last sample 3 days ago` visible;
 - fresh install with zero samples: `○ Waiting` — `awaiting first sample`;
 - one sample but no compatible pair: `○ Waiting` — `awaiting another sample`;
 - unreadable observation store: `✖ Error` — `observation store unreadable — see journal`, with store-dependent views suppressed.
 ### 3.6 Warm-up and withheld estimates
 Projection warm-up uses the UTC accounting rules in §5. The progress block during warm-up is:
 ```text
 Building evidence — N of 14 days observed · Q qualifying
 First lifespan estimate after 12 qualifying days
 ```
 `N` counts distinct represented UTC dates in the current controller segment, capped at 14 for the display. `Q` counts dates whose represented monitored span has at least 50% coverage. The gate for the first lifespan estimate is 14 represented UTC dates with at least 12 qualifying; Supported confidence still separately requires at least 14 qualifying dates plus every other confidence prerequisite.
 Do not promise a countdown by hours. Days are the grain, and a provisional day can still fail qualification. Graph-data availability is independent: the graph can render from first usable evidence while the lifespan estimate remains withheld.
 Withheld-estimate reason lines are explicit, never blank and never zero-filled:
 - `No endurance baseline — set a rated TBW to see an estimate`;
 - `Drive does not report write counters`;
 - the warm-up progress block above;
 - stale evidence: show the estimate frozen at the latest published usage-evidence endpoint with `estimate not updating — last sample X ago`;
 - paused days are excluded from the day count, and the Paused status carries that fact.
 Once warm-up clears, the existing lifespan line and Limited/Supported label from the frozen redesign specification render unchanged. This companion adds the progress block, reason lines, status precedence, and frozen-note behavior; it does not invent a new steady-state projection format.
 ### 3.7 CLI parity
 `fenris status` adopts the same status vocabulary, precedence, glyphs, and reason lines, rendered statically. It shows Collecting only if a run is in flight at query time. Display preferences and TUI themes never affect CLI facts.
 ## 4. History evidence, local browsing, and publication
 ### 4.1 Ownership and publication
 The collector owns sample → usage interval → hour observation/day aggregate derivation. It must publish a consistent validated result before reporting collection success. Readers must not see a new sample advertised as fully derived while dependent history is missing.
 The TUI is read-only. Its next successful refresh sees whatever the collector has durably published, regardless of whether the TUI was running during collection. There is no hourly batch wait and no projection-confidence gate on usage history. Failure preserves prior valid history and remains explicit.
 ### 4.2 First visible data
 One successful sample establishes counter, health, and freshness evidence, but not a usage delta; display `Awaiting another sample`. The first usable sample pair may display measured partial-hour usage labelled `so far` when attribution supports it. A usable pair has valid ordered timestamps and supported, nonnegative monotonic counters in the same controller segment; monitored totals additionally require an interval fully inside one monitoring period.
 A cross-hour pair is a real usage interval total, not two invented hour values. Measured zero is visible `0 B`. Missing, unsupported, invalid, or absent evidence is never converted to zero.
 ### 4.3 Local display days
 Storage timestamps and projection evidence days remain UTC. History browsing uses the user's current system timezone, visibly labelled. If the system timezone changes, the same retained evidence regroups into the new local display days. Use real calendar boundaries: DST days may be 23 or 25 hours, repeated local hours have distinct offsets, and fractional UTC offsets must work without synthetic splitting.
 ### 4.4 Retention and repair
 Retain timestamped usage intervals indefinitely alongside hour observations and day aggregates. Full raw samples retain the 14-day policy, with a boundary-anchor exception: do not prune a raw sample that is still needed to durably derive an unfinished interval/hour/day representation.
 Repair derives only what surviving raw evidence supports, transactionally and idempotently. It preserves original evidence and valid historical summaries. Incomplete reconstruction must not overwrite valid older history. Unsupported historical precision stays unavailable; it is not repaired by interpolation or waiting. A failed repair remains visible and retryable.
 ### 4.5 Attribution and gaps
 Preserve measured usage interval totals. Never divide them proportionally across hours or calendar days, never assign them to an endpoint as if timing were observed, and never double-count interval totals and summaries derived from the same evidence.
 An interval entirely inside a local display day and one monitoring period may contribute its total to that local-day total even if individual hour shares are unknown. Otherwise the total is shown separately as unallocated usage. An incomplete allocated subtotal must not be presented as a complete total.
 Missing samples reduce usage-habit coverage where classification is unknown, but they do not erase a compatible measured gap total. Byte-allocation completeness and usage-habit classification coverage are distinct. Do not infer zero writes from missing samples.
 Partial summaries represent elapsed time only. Future time is neither zero nor unknown. Deliberately disabled time is excluded, not an hour state. Intervals crossing a deliberate pause cannot distinguish monitored from paused writes: preserve the original evidence, exclude ambiguous bytes from monitored totals, and explain why. External service stops remain unexplained in-period gaps, not Deliberate disables.
 ### 4.6 Controller segments in browsing
 The default history view is the current controller segment. Older segments remain browsable with explicit reset/replacement boundaries. Never form a delta across a controller-segment boundary or silently combine different drives.
 ## 5. UTC projection accounting and confidence amendments
 This section amends the projection contract without changing lifespan mathematics, numeric thresholds, or confidence categories.
 ### 5.1 Measured totals and requested spans
 For any requested span, count a compatible interval's total exactly once when its complete span is inside the requested span, inside one monitoring period, and has eligible controller provenance. It may supply a complete window total even when individual UTC-hour/day shares are unknown.
 A positive interval crossing a requested boundary cannot supply that window's unknown share. Preserve its measured total separately as unallocated usage. Do not split proportionally, assign to the ending day, silently omit possible bytes, or label an incomplete subtotal as complete.
 Withhold a rate whenever its monitored numerator cannot be established: unresolved boundary shares, missing initial/resume/reset counter support, and legacy eligibility ambiguity are not zero. Do not shorten the requested window or remove unknown monitored seconds merely to obtain a number. A compatible monotonic interval with zero counter delta proves zero writes throughout its represented span, including a requested subspan; that is direct counter evidence, not interpolation.
 ### 5.2 Projection endpoints and denominator
 Let `T` be the latest published usage-evidence endpoint. The 7/28/90-day scenario windows end at `T` and start exactly 7/28/90 × 86,400 seconds earlier. Do not round starts to UTC midnight, and do not dilute rates as the TUI read clock advances without new published usage evidence. Evidence age remains a separate fact.
 The default sustained regime is eligible observation history capped at 90 days, ending at `T`. A detected habit-change regime starts at the first divergence day's UTC midnight. Any unresolved share at those boundaries invokes the unavailable-rate rule; there is no silent fallback to a more convenient start.
 For the chosen span, the rate denominator is wall-clock seconds inside monitoring periods, including powered-off and unknown time, excluding deliberate-disable time. Numerator and denominator describe the same requested span. Pause-crossing intervals cannot establish which writes were monitored and therefore cannot supply affected monitored totals. No bridge crosses controller-segment boundaries.
 ### 5.3 UTC evidence dates, warm-up, and confidence
 Projection evidence remains UTC; local graph regrouping never changes projection eligibility. Coverage uses known-classified seconds divided by represented elapsed monitored seconds, excluding deliberately disabled and future time.
 A qualifying day is a distinct UTC date whose represented monitored span has coverage at least 50%. A current partial date counts provisionally and can lose qualification as unknown time accumulates. Count a date once, not once per hour, interval, or controller fragment. Entirely paused dates have no represented monitored span and do not count.
 Warm-up clears when the current controller segment has at least 14 distinct represented UTC dates, at least 12 of which qualify. Supported confidence still requires at least 14 qualifying dates plus every other existing condition. Thus 12 qualifying plus 2 poor dates clears warm-up but remains Limited. Same-day segment breaks use only the current segment's eligible portion for its new-segment warm-up; a shared UTC date does not import old-segment qualification.
 Habit-change comparisons require completed, consecutive UTC days with evaluable daily write totals. Do not compress missing calendar dates into adjacent-row windows or treat missing/disabled time as zero. Unknown daily totals cannot establish habit change and cannot pass the burst/concentration guard.
 An affected scenario rate is withheld while other independently computable rates remain visible. If the headline regime lacks a complete monitored numerator, no lifespan number renders; show the specific evidence-unavailable reason. If a complete positive headline rate exists while daily shares remain unknown, the lifespan may render as Limited, but Supported is blocked wherever a required confidence check cannot be established.
 ### 5.4 Segment and legacy evidence
 Never compute a delta across a reset or replacement boundary, even within one UTC hour/day. Same-identity reset preserves prior eligible habit evidence, subject to the existing current-segment re-warm gate before a lifespan number can render. Re-warming does not reconstruct missing counter support.
 A controller-identity change, including to or from a blank key, quarantines previous identity from every projection horizon. Returning to a previously seen key does not undo the intervening quarantine. History browsing may still show older segments explicitly.
 Trusted legacy day-only summaries remain usable at their actual represented precision: only in a window fully containing their represented span and only when monitoring-period/controller eligibility is known. They cannot supply subday detail, local-midnight splits, or partial rolling-window totals. Mixed legacy summaries that cannot separate eligible from ineligible writes remain browsable but cannot supply affected projection totals.
 ### 5.5 Projection acceptance examples
 Future implementation must make these cases observable without using fabricated history:
 1. 100 MB from 23:55 to 00:05 UTC in one period/segment: retain 100 MB once. Neither UTC-day share is known. A containing window can consume 100 MB; a window starting at midnight cannot claim an exact share or rate.
 2. Sparse three-day recovery interval with compatible counters: a measured 900 MB total remains real and can supply a containing window. There is no 300 MB/day allocation.
 3. A 7-day boundary cuts a positive interval and the 28-day boundary does not: withhold the 7-day rate, preserve the independently computable 28-day rate, and do not omit the unresolved old-enough horizon to manufacture Supported confidence.
 4. The same boundary with zero measured delta: exact zero contribution is permitted for the represented subspan; missing time outside it remains unknown.
 5. `T` at UTC noon: a 7-day window spans exactly 604,800 wall-clock seconds before subtracting deliberate-disable time. Refreshing the TUI without new evidence does not change the endpoint.
 6. First sample arrives after monitoring starts: preceding monitored time lacks a write total. Keep its time, do not invent zero bytes, and withhold affected rates.
 7. Pause/resume crossed by one counter interval: preserve total as original evidence, but do not count ambiguous paused writes as monitored.
 8. 12 qualifying dates plus 2 poor dates: warm-up clears, Supported still fails the 14-qualifying-date requirement.
 9. Good coverage with unknown daily shares: day progress can qualify; burst and habit checks remain unknown, not passed or zero-filled.
 10. Only 14 days of eligible history: do not require 28/90-day horizons yet, but evaluate the burst guard over observed eligible history and keep unknown daily totals blocking.
 11. Reset/replacement at 10:30 UTC: no cross-break delta or whole-date shortcut. Same-key reset preserves eligible prior habit evidence but requires new-segment re-warm; replacement excludes prior identity from scenarios too.
 12. Trusted old UTC-day summary with raw samples gone: usable only in a window fully containing its represented span and known eligibility, once only; no partial local-day/hour split.
 ## 6. Usage history graph and interaction
 ### 6.1 Encoding
 Adopt a writes-only daily bar graph with hourly drill-down. Reads are out of scope. Candles are rejected: they bury the daily total, import price-chart semantics that usage data does not have, and distort gap/partial evidence. A rolling hourly strip is rejected as the default because it lacks day totals without reintroducing the day level.
 The graph's value is bytes written. The daily range view shows one bar per local display day. Activating a day drills into hourly bars for that selected local display day. Back returns to the range view.
 ### 6.2 Ranges, labels, and readout
 Default range: 14 days. Selectable ranges: 7, 14, 28, and 90 days. Ranges limit the viewport only; they never delete retained history or hide older controller segments from browsing.
 The header line is:
 ```text
 usage history · Local · UTC±HH:MM · <tz name>
 ```
 The day row uses day-of-month labels. The selected-day readout uses `Wed 09 Sep` style. Hourly detail labels every third hour `00…21` plus `midnight → 23:00 local`. DST and repeated local hours follow the Local display day contract.
 The selected-item readout states totals, evidenced hours, unallocated usage separately, coverage, and partial-state text such as `partial · N h elapsed · so far`.
 ### 6.3 Controls
 The graph pane is focusable. Keyboard controls:
 - `←` / `→` select day or hour;
 - `Enter` drills into the selected day;
 - `Esc` / `Backspace` returns from hourly detail;
 - `1` / `2` / `3` / `4` switch 7 / 14 / 28 / 90 days.
 Mouse controls use widget-local coordinates to select bars. Where Textual mouse support is available, clickable equivalents must cover select, drill, and back. Global `p` / `r` / `c` / `d` / `q` remain unchanged, and the footer shows graph keys while the graph is focused.
 ### 6.4 State rendering
 The legend is always visible when the graph is visible. Distinct glyphs:
 | Glyph | Meaning |
 |---|---|
 | `█` | allocated measured writes |
 | `▒` | unallocated measured writes, stacked separately |
 | `░` | gap / no evidence, never zero |
 | `·` | measured zero bytes |
 | `┄` | partial-day cap |
 | `▼` | selection marker |
 Unallocated usage is measured, not fabricated; it is never spread into hours to make the graph look complete. Gaps remain distinct from measured zero. Deliberate-disable annotations remain visible.
 ### 6.5 Minimum terminal
 At 80×24, the range view must fit the default 14-day graph using 4 columns per day, and hourly drill-down must fit 24 single-column hourly bars. Below 80×24, hide the graph region and show a one-line textual history summary plus exactly:
 ```text
 graph needs ≥80×24
 ```
 This is not an error. The titlebox, status label/reason, drive health, service facts, quit rail/action affordances, and selected-day readout or equivalent textual context must survive. Resizing must not leave stale graph state visible.
 ### 6.6 Framework obligation
 Current Textual facts verified during charting: Textual 8.2.8 has no BarChart widget, Sparkline is non-interactive, and `textual-plotext` is not an installed dependency. Implement the graph as a custom block-glyph renderable in the usage-history pane, with click mapping from widget-local coordinates. Do not add a plotting dependency for the adopted graph.
 ## 7. Colour presets, persistence, and accessibility
 ### 7.1 Presets
 Approved presets: Amber, Nord, and High Contrast. Amber is the default and keeps the graph amber by default. Other presets may use theme-appropriate graph/accent colours.
 Themes style chrome, graph, borders, accents, and muted text. They do not override status semantics. The status lattice keeps semantic colours: green Monitoring/Collecting, amber Paused/Waiting, red Interrupted/Error/Stale, grey Unknown, always with glyph and text.
 Preset palettes must maintain readable contrast in normal and focused states. High Contrast is a first-class preset, not merely a lightened Amber.
 ### 7.2 Persistence scope
 Preset and reduced-motion choices are user-scoped TUI display preferences. Persist them at:
 ```text
 ${XDG_CONFIG_HOME:-~/.config}/fenris/tui.json
 ```
 Do not store these preferences in `/etc/fenris/fenris.conf`, the observation store, helper state, package config, or collector/device configuration. Missing preferences default to Amber and normal motion. This preference file never affects collection, projection, history evidence, or CLI `status` facts.
 ### 7.3 Controls and reduced motion
 Add accessible TUI controls for `t preset` and `m motion`, with clickable equivalents where Textual mouse support is available. Focusable graph/settings panes are acceptable as long as status text and global actions remain reachable.
 Normal motion: only the Monitoring status dot blinks at the approved 750 ms on / 750 ms off cadence. Text never blinks, and no other state animates. Reduced motion: Monitoring renders steady as `● Monitoring`. No animation may imply successful collection.
 Long reasons, paused states, degraded/error states, missing data, and warm-up/withheld-estimate lines must remain text-visible. Do not collapse them into colour, blank space, or a misleading zero.
 ### 7.4 Framework facts
 The charting prototype verified current Textual documentation: `App.register_theme(theme)` and `App.theme` support theme registration/activation; Textual theme variables plus `$text` / `color: auto` support legibility; mouse events provide screen/widget-relative coordinates and focusable widgets can be resolved/clicked for keyboard+mouse proof paths. The existing lockfile still pins Textual 8.2.8; prototype branches remain throwaway assets and add no runtime dependency.
 ## 8. Future implementation proof paths
 These are direct observable probes the execution effort can derive tests from; they are not a build-only checklist.
 - Synthetic first-run store with zero samples: TUI and `fenris status` show Waiting/awaiting-first-sample; graph has no zero-filled bars; estimate is withheld with the correct reason.
 - One sample followed by a compatible pair inside one hour: first state says `Awaiting another sample`; after the pair, graph shows a partial `so far` value. If the counter is unchanged, the evidenced interval is visible `0 B`.
 - Cross-hour and cross-local-midnight intervals: totals are retained once; hour/day shares remain unallocated unless evidence supports them; gaps and zeros use distinct glyphs.
 - Pause/resume-crossing interval: paused time is excluded, ambiguous bytes do not enter monitored totals, Paused status explains the consequence, and quitting the TUI does not pause monitoring.
 - Failed collection with fresh data, retry in flight, external stop, and store fault: status precedence matches §3 and store fault suppresses store-dependent views.
 - UTC projection horizon cut by a positive interval: affected rate is unavailable with a specific reason while independent horizons remain; refreshing without new evidence does not shift `T`.
 - Warm-up fixtures for 12 qualifying + 2 poor dates and 14 qualifying dates: the first clears the progress gate but remains Limited; the second can be Supported only if all other prerequisites pass.
 - Graph keyboard and mouse path: range switch → selected day → hourly detail → back, with focus/footer behavior and no conflict with global actions.
 - 80×24 and narrower terminal captures: 80×24 keeps the graph; below 80×24 shows the exact fallback and preserves status/health/action context.
 - Theme fixture: Amber default, switch to Nord/High Contrast, restart TUI under the same unprivileged user and see preference persist; `fenris status` and collection behavior are unchanged.
 ## 9. Out of scope
 - Production implementation, release gates, package publishing, installation changes, and closing or reopening prior implementation umbrellas.
 - Changing lifespan mathematics, evidence/confidence thresholds, collector cadence, or controller-segment semantics except for the explicit accounting/evaluability amendments in §5.
 - Fabricating, interpolating, proportionally splitting, or endpoint-assigning missing history.
 - Read-throughput graph selector, custom colour editor, web GUI, notifications, alerting, unrelated release-workflow changes, or a general application redesign beyond the named TUI requirements.
@@ -8,4 +8,9 @@
 #
 #   device = /dev/disk/by-id/nvme-Samsung_SSD_980_PRO_500GB_S5PANS0T123456
 #
 # The observation store path is optional and defaults to
 # /var/lib/fenris/observations.db when unset:
 #
 #   store_path = /var/lib/fenris/observations.db
 #
 # See https://git.bongbetic.com/xavierk/Fenris for documentation.
@@ -0,0 +1,20 @@
 ## Install
 Install Fenris from its package channel after following the [package setup instructions](https://git.bongbetic.com/xavierk/Fenris/src/branch/main/README.md#install-from-package-recommended):
 ```bash
 sudo apt update && sudo apt install fenris       # Debian / Ubuntu
 sudo dnf install fenris                          # Fedora
 sudo zypper install fenris                       # openSUSE Tumbleweed
 ```
 ## Verify downloads
 ```bash
 gpg --output SHA256SUMS --decrypt SHA256SUMS.asc
 sha256sum -c SHA256SUMS
 ```
 ## Rollback
 Installing an older package over a newer observation store is unsupported. Restore the observation-store snapshot, then install the earlier Release; see the [upgrade and rollback guidance](https://git.bongbetic.com/xavierk/Fenris/src/branch/main/README.md#upgrade).
@@ -44,4 +44,6 @@ print(f'Fenris migration: {n} step(s) applied') if n else None
        fi
        rm -f "${OLD_CONTENT}"
    done
    # Re-apply placement modes (store dir group access, issue #54)
    systemd-tmpfiles --create  || true
 fi
@@ -1,2 +1,2 @@
 # Type  Path              Mode  User   Group  Age  Argument
-d       /var/lib/fenris   2750  root   fenris  -   -
+d       /var/lib/fenris   2770  root   fenris  -   -
@@ -1,6 +1,6 @@
 [project]
 name = "fenris"
-version = "0.3.1"
+version = "0.3.4"
 description = "NVMe wear monitor with persistent TUI"
 requires-python = ">=3.9"
 dependencies = [
@@ -0,0 +1,99 @@
 #!/usr/bin/env python3
 """Extract one validated Keep a Changelog version section."""
 from __future__ import annotations
 import argparse
 from datetime import date
 from pathlib import Path
 import re
 import sys
 class ChangelogError(ValueError):
    """A release cannot safely use the supplied changelog."""
 _SEMVER = r"(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)"
 _VERSION_HEADING = re.compile(
    rf"^## \[(?P<version>{_SEMVER})\] - (?P<date>.+)$", re.MULTILINE
 )
 def extract_version_section(changelog: str, version: str) -> str:
    """Return *version*'s changelog section without altering its bytes.
    The section ends immediately before the next level-two heading.  A release
    cannot use an absent, empty, or malformed version section.
    """
    if not re.fullmatch(_SEMVER, version):
        raise ChangelogError(f"requested version is not bare semver: {version!r}")
    heading = next(
        (match for match in _VERSION_HEADING.finditer(changelog)
         if match.group("version") == version),
        None,
    )
    if heading is None:
        if re.search(rf"^## \[{re.escape(version)}\].*$", changelog, re.MULTILINE):
            raise ChangelogError(f"version {version} has a malformed heading or date")
        raise ChangelogError(f"version {version} is missing from the changelog")
    heading_date = heading.group("date")
    if not re.fullmatch(r"\d{4}-\d{2}-\d{2}", heading_date):
        raise ChangelogError(f"version {version} has a malformed release date")
    try:
        date.fromisoformat(heading_date)
    except ValueError as error:
        raise ChangelogError(f"version {version} has a malformed release date") from error
    next_heading = re.search(r"^## ", changelog[heading.end():], re.MULTILINE)
    section_end = heading.end() + next_heading.start() if next_heading else len(changelog)
    section = changelog[heading.start():section_end]
    if not re.search(r"^- \S", section[heading.end() - heading.start():], re.MULTILINE):
        raise ChangelogError(f"version {version} has an empty changelog section")
    return section
 def extract_changelog(path: Path, version: str) -> str:
    """Read and extract a requested version from a changelog file."""
    try:
        return extract_version_section(path.read_text(encoding="utf-8"), version)
    except OSError as error:
        raise ChangelogError(f"cannot read changelog {path}: {error.strerror}") from error
 def assemble_release_body(section: str, footer: str) -> str:
    """Append standing guidance while preserving the extracted section verbatim."""
    separator = "\n" if section.endswith("\n") else "\n\n"
    return f"{section}{separator}{footer}"
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("changelog", type=Path)
    parser.add_argument("version")
    parser.add_argument(
        "--footer",
        type=Path,
        help="append this standing release guidance after the extracted section",
    )
    args = parser.parse_args(argv)
    try:
        section = extract_changelog(args.changelog, args.version)
        if args.footer:
            try:
                footer = args.footer.read_text(encoding="utf-8")
            except OSError as error:
                raise ChangelogError(
                    f"cannot read release footer {args.footer}: {error.strerror}"
                ) from error
            section = assemble_release_body(section, footer)
        sys.stdout.write(section)
    except ChangelogError as error:
        print(f"::error::{error}", file=sys.stderr)
        return 1
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -0,0 +1,70 @@
 #!/usr/bin/env python3
 """Describe the Gitea request that creates or resynchronizes a release."""
 from __future__ import annotations
 import argparse
 import json
 from pathlib import Path
 import re
 import sys
 from typing import Any
 _SEMVER = r"(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)"
 class ReleaseRequestError(ValueError):
    """A release request could not be prepared safely."""
 def build_release_request(
    version: str, body: str, existing_release: dict[str, Any] | None
 ) -> dict[str, Any]:
    """Return the observable POST or PATCH request for a Gitea release."""
    if not re.fullmatch(_SEMVER, version):
        raise ReleaseRequestError(f"version is not bare semver: {version!r}")
    if existing_release is None:
        return {
            "method": "POST",
            "path": "/releases",
            "payload": {"tag_name": f"v{version}", "name": f"v{version}", "body": body},
        }
    release_id = existing_release.get("id")
    if not isinstance(release_id, int):
        raise ReleaseRequestError("existing release does not contain an integer id")
    return {
        "method": "PATCH",
        "path": f"/releases/{release_id}",
        "payload": {"body": body},
    }
 def _read_json(path: Path) -> dict[str, Any]:
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, json.JSONDecodeError) as error:
        raise ReleaseRequestError(f"cannot read existing release {path}: {error}") from error
    if not isinstance(value, dict):
        raise ReleaseRequestError("existing release must be a JSON object")
    return value
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--version", required=True)
    parser.add_argument("--body-file", type=Path, required=True)
    parser.add_argument("--existing-release", type=Path)
    args = parser.parse_args(argv)
    try:
        body = args.body_file.read_text(encoding="utf-8")
        existing = _read_json(args.existing_release) if args.existing_release else None
        print(json.dumps(build_release_request(args.version, body, existing)))
    except (OSError, ReleaseRequestError) as error:
        print(f"::error::{error}", file=sys.stderr)
        return 1
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -88,7 +88,13 @@ def open_store_readonly(store_path: Path) -> sqlite3.Connection:
    Raises StoreFault if unreadable, NewerSchema if user_version > SCHEMA_VERSION.
    """
-    if not store_path.exists():
+    try:
        exists = store_path.exists()
    except OSError as e:
        # A non-group user stat()ing a 2750 store directory gets
        # PermissionError before any StoreFault can be raised (issue #54).
        raise StoreFault("observation store not readable: %s" % e)
    if not exists:
        raise StoreFault("observation store not found at %s" % store_path)
    try:
@@ -443,7 +449,7 @@ def _format_headline(proj) -> str:
 def _append_service_facts(lines: List[str], service: Dict[str, Any]) -> None:
-    """Append the four separate service facts (§7.3, LC-9)."""
+    """Append service facts and dashboard-clarity monitoring state."""
    boot = "enabled" if service.get("boot_enabled") else "disabled"
    activity = "active" if service.get("timer_active") else "inactive"
@@ -467,6 +473,55 @@ def _append_service_facts(lines: List[str], service: Dict[str, Any]) -> None:
    lines.append("boot: %s · timer: %s · last collect: %s%s · freshness: %s%s"
                 % (boot, activity, collect, collect_age, freshness_str, freshness_age))
    lines.append("CONTINUITY: %s" % monitoring_continuity(service))
    if service.get("deliberately_paused"):
        lines.extend(deliberate_pause_lines())
 # ---------------------------------------------------------------------------
 # Dashboard clarity parity wording (DC-2, DC-3)
 # ---------------------------------------------------------------------------
 _CONTINUITY_ACTIVE = "monitoring: active in background · persists across reboots"
 _CONTINUITY_DISABLED = "monitoring: does not start on next boot"
 _PAUSED_TITLE = "monitoring: paused — deliberate disable"
 _PAUSED_CONSEQUENCE = (
    "paused time is excluded from your usage habit · resume: fenris monitor resume"
 )
 def monitoring_continuity(service: Dict[str, Any]) -> str:
    """Return the boot-persistence wording, independent of timer runtime."""
    return _CONTINUITY_ACTIVE if service.get("boot_enabled") else _CONTINUITY_DISABLED
 def deliberate_pause_lines() -> List[str]:
    """Return the exact CLI/TUI presentation for a sanctioned pause."""
    return [_PAUSED_TITLE, _PAUSED_CONSEQUENCE]
 def is_deliberately_paused(conn: sqlite3.Connection, service: Dict[str, Any]) -> bool:
    """Whether the latest closed period was ended by Fenris's own pause path.
    Raw systemd operations have no `user_disabled` row, so they must never be
    presented as a Deliberate disable. A live enabled timer also wins over a
    stale period marker, keeping the presentation consistent with service facts.
    """
    if service.get("boot_enabled") or service.get("timer_active"):
        return False
    open_period = conn.execute(
        "SELECT 1 FROM monitoring_periods WHERE ended_at IS NULL LIMIT 1"
    ).fetchone()
    if open_period is not None:
        return False
    row = conn.execute(
        "SELECT end_cause FROM monitoring_periods "
        "WHERE ended_at IS NOT NULL "
        "ORDER BY ended_at DESC, id DESC LIMIT 1"
    ).fetchone()
    return row is not None and row[0] == "user_disabled"
 def format_disclosures() -> str:
@@ -556,6 +611,10 @@ def get_status(store_path: Optional[Path] = None, clock_now: Optional[datetime]
    service["freshness"] = freshness
    service["freshness_age_s"] = freshness_age_s
    try:
        service["deliberately_paused"] = is_deliberately_paused(conn, service)
    except sqlite3.Error:
        service["deliberately_paused"] = False
    # --- Drive anomalies (§9.7, FL-7) ---
    drive_facts = []
@@ -15,9 +15,19 @@ from typing import Optional
 SCHEMA_VERSION = 1
 # Packaged default placement (spec §8.3). The config may override it, but a
 # fresh install that sets only the device selector must collect cleanly.
 DEFAULT_STORE_PATH = Path("/var/lib/fenris/observations.db")
 def get_store_path(config: dict) -> Path:
-    """Get the store path from config."""
+    """Get the store path from config.
-    return Path(config["store_path"])
+
    Falls back to the packaged default when the config does not pin one,
    so a fresh install whose config holds only the device selector works
    instead of crashing with KeyError 'store_path' (issue #53).
    """
    return Path(config.get("store_path", DEFAULT_STORE_PATH))
 def init_store(store_path: Path) -> sqlite3.Connection:
@@ -31,6 +41,20 @@ def init_store(store_path: Path) -> sqlite3.Connection:
    # Enable WAL mode for concurrent reads during writes
    conn.execute("PRAGMA journal_mode=WAL")
    # Group members (fenris group) read the live store read-only, but SQLite
    # in WAL mode needs write access to the db and its -wal/-shm sidecars even
    # for readers. Best effort: root-created stores stay group-accessible
    # without relying on the creating process's umask (issue #54).
    import os as _os
    for sidecar in (store_path,
                    store_path.with_name(store_path.name + "-wal"),
                    store_path.with_name(store_path.name + "-shm")):
        try:
            mode = _os.stat(sidecar).st_mode & 0o777
            _os.chmod(sidecar, mode | 0o060)
        except OSError:
            pass
    # Check if this is a new database
    cursor = conn.execute("PRAGMA user_version")
    current_version = cursor.fetchone()[0]
@@ -23,7 +23,7 @@ from typing import Any, Dict, List, Optional
 from textual.app import App, ComposeResult
 from textual.binding import Binding
-from textual.containers import Horizontal, Vertical
+from textual.containers import Container, Horizontal, VerticalScroll
 from textual.screen import ModalScreen
 from textual.widgets import Static
@@ -43,6 +43,9 @@ from .status import (
    format_disclosures,
    freshness_age_human,
    grade_freshness,
    deliberate_pause_lines,
    is_deliberately_paused,
    monitoring_continuity,
    open_store_readonly,
    query_service_state,
    read_config,
@@ -229,6 +232,7 @@ def _query_service_facts(conn: sqlite3.Connection, clock_now: datetime) -> Dict[
        "freshness": freshness,
        "freshness_age_s": None,
        "period": period_info,
        "deliberately_paused": is_deliberately_paused(conn, svc),
        **svc,
    }
@@ -286,20 +290,38 @@ class DisclosuresScreen(ModalScreen[None]):
 class FenrisTuiApp(App):
    """Fenris Panes TUI — keyboard-first, one dense screen (spec §7)."""
-    TITLE = "Fenris"
+    TITLE = "Fenris — NVMe endurance monitor"
-    SUB_TITLE = "NVMe endurance monitor"
+    SUB_TITLE = ""
    CSS = """
    #main-grid {
        layout: grid;
-        grid-size: 2 3;
+        grid-size: 2 4;
        grid-columns: 3fr 2fr;
-        grid-rows: 8 1fr 7;
+        grid-rows: 8 10 7 3;
-        height: 1fr;
+        height: auto;
    }
    #main-grid.paused {
        grid-size: 2 5;
        grid-rows: 8 5 10 7 3;
    }
    #dashboard-scroll { height: 1fr; }
    #headline-band { column-span: 2; }
-    #service-strip { column-span: 2; }
+    #paused-banner {
-    .pane { border: round #555555; padding: 0 1; }
+        column-span: 2;
        display: none;
        background: $error 20%;
        color: $text;
        height: 100%;
    }
    #service-strip { column-span: 2; height: 100%; }
    #quit-rail {
        column-span: 2;
        border: heavy $accent;
        content-align: center middle;
        height: 100%;
    }
    .pane { border: round #555555; padding: 0 1; height: 100%; }
    #confirm-text { padding: 1 2; }
    #disc-text { padding: 1 2; }
    """
@@ -317,21 +339,27 @@ class FenrisTuiApp(App):
        store_path: Optional[Path] = None,
        config_path: Optional[Path] = None,
        helper_path: Optional[str] = None,
        refresh_interval_s: float = CADENCE_DEFAULT_S,
        **kwargs,
    ) -> None:
        super().__init__(**kwargs)
        self.store_path = store_path or Path("/var/lib/fenris/observations.db")
        self.config_path = config_path
        self.helper_path = helper_path or "/usr/libexec/fenris/fenris-monitor"
        self.refresh_interval_s = refresh_interval_s
        self._show_auth_notice = True
        self._conn: Optional[sqlite3.Connection] = None
        self._clock_now = datetime.now(timezone.utc)
    def compose(self) -> ComposeResult:
-        with Vertical(id="main-grid"):
+        with VerticalScroll(id="dashboard-scroll"):
-            yield Static("", id="headline-band", classes="pane")
+            with Container(id="main-grid"):
-            yield Static("", id="usage-history", classes="pane")
+                yield Static("", id="headline-band", classes="pane")
-            yield Static("", id="drive-health", classes="pane")
+                yield Static("", id="paused-banner")
-            yield Static("", id="service-strip", classes="pane")
+                yield Static("", id="usage-history", classes="pane")
                yield Static("", id="drive-health", classes="pane")
                yield Static("", id="service-strip", classes="pane")
                yield Static("q QUIT TUI", id="quit-rail")
    def on_mount(self) -> None:
        """Set border titles and render initial state."""
@@ -339,8 +367,30 @@ class FenrisTuiApp(App):
        self.query_one("#usage-history").border_title = "usage history"
        self.query_one("#drive-health").border_title = "drive"
        self.query_one("#service-strip").border_title = "service + actions"
        self._refresh_timer = self.set_interval(
            self.refresh_interval_s, self.on_refresh_tick
        )
        self._refresh()
    def on_refresh_tick(self) -> None:
        """Refresh dashboard and dismiss launch-only authentication guidance."""
        self._show_auth_notice = False
        self._refresh()
    def _headline_prefix(self) -> str:
        """Render identity and any launch-only guidance above drive state."""
        lines = ["[bold]Fenris — NVMe endurance monitor[/bold]"]
        if self._show_auth_notice:
            lines.append("[dim]privileged actions will prompt for authentication (polkit)[/dim]")
        return "\n".join(lines)
    def _render_headline(self, body: str = "") -> None:
        """Render full-width identity, guidance, and current drive state."""
        text = self._headline_prefix()
        if body:
            text += "\n\n" + body
        self.query_one("#headline-band").update(text)
    def _open_store(self) -> Optional[sqlite3.Connection]:
        """Open store read-only, handling faults."""
        try:
@@ -366,28 +416,33 @@ class FenrisTuiApp(App):
    def _render_empty_or_fault(self) -> None:
        """Render empty store greeting or store fault."""
        self._hide_paused_banner()
        if not self.store_path.exists():
            # Empty store — greeting with enable hint (IN-3)
-            self.query_one("#headline-band").update(
+            self._render_headline(
                "[bold]No observations yet[/bold]\n\n"
                "Enable monitoring: fenris monitor resume"
            )
            self.query_one("#usage-history").update("")
            self.query_one("#drive-health").update("")
            self.query_one("#service-strip").update(
-                "boot: disabled · timer: inactive · last collect: unknown · freshness: empty\n"
+                "boot: disabled · timer: inactive · last collect: unknown · freshness: empty · "
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "[dim]by Bongbetic[/dim]\n"
                "[bold]CONTINUITY[/bold]  %s\n"
                "p pause · r resume · c collect · d disclosures"
                % monitoring_continuity({"boot_enabled": False})
            )
        else:
            # Store fault (FL-4)
-            self.query_one("#headline-band").update(
+            self._render_headline(
                "[bold red]Observation store unreadable[/bold red]\n"
                "Check journalctl -u fenris-collect.service"
            )
            self.query_one("#usage-history").update("")
            self.query_one("#drive-health").update("")
            self.query_one("#service-strip").update(
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "[dim]by Bongbetic[/dim]\n"
                "p pause · r resume · c collect · d disclosures"
            )
    def _render_all_regions(self, conn: sqlite3.Connection) -> None:
@@ -398,13 +453,9 @@ class FenrisTuiApp(App):
            headline = self._format_headline(proj)
            confidence = self._format_confidence(proj)
            scenario = self._format_scenario(proj)
-            self.query_one("#headline-band").update(
+            self._render_headline(headline + "\n" + confidence + "\n" + scenario)
                headline + "\n" + confidence + "\n" + scenario
            )
        except Exception:
-            self.query_one("#headline-band").update(
+            self._render_headline("[bold]No projection available[/bold]")
                "[bold]No projection available[/bold]"
            )
        # --- Usage-history pane (§7.2 left) ---
        history = _query_usage_history(conn)
@@ -448,17 +499,47 @@ class FenrisTuiApp(App):
            collect = "ok" if svc.get("last_collect_ok") else "FAILED"
            freshness = svc.get("freshness", "unknown")
            self.query_one("#service-strip").update(
-                "boot: %s · timer: %s · last collect: %s · freshness: %s\n"
+                "boot: %s · timer: %s · last collect: %s · freshness: %s · "
                "[dim]by Bongbetic[/dim]\n"
                "[bold]CONTINUITY[/bold]  %s\n"
                "%s\n"
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "p pause · r resume · c collect · d disclosures"
-                % (boot, activity, collect, freshness, svc.get("period", ""))
+                % (
                    boot, activity, collect, freshness,
                    monitoring_continuity(svc), svc.get("period", ""),
                )
            )
            self._render_paused_banner(svc)
        except Exception:
            self._hide_paused_banner()
            self.query_one("#service-strip").update(
-                "boot: unknown · timer: unknown · last collect: unknown · freshness: unknown\n"
+                "boot: unknown · timer: unknown · last collect: unknown · freshness: unknown · "
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "[dim]by Bongbetic[/dim]\n"
                "p pause · r resume · c collect · d disclosures"
            )
    def _render_paused_banner(self, service: Dict[str, Any]) -> None:
        """Show the high-contrast Deliberate disable block only when sanctioned."""
        banner = self.query_one("#paused-banner")
        if service.get("deliberately_paused"):
            banner.update(
                "[bold black on red]%s[/bold black on red]\n%s"
                % tuple(deliberate_pause_lines())
            )
            banner.styles.display = "block"
            main_grid = self.query_one("#main-grid")
            main_grid.add_class("paused")
            main_grid.refresh(layout=True)
        else:
            self._hide_paused_banner()
    def _hide_paused_banner(self) -> None:
        """Ensure an unavailable store cannot retain a stale paused presentation."""
        self.query_one("#paused-banner").styles.display = "none"
        main_grid = self.query_one("#main-grid")
        main_grid.remove_class("paused")
        main_grid.refresh(layout=True)
    def _format_headline(self, proj: ProjectionResult) -> str:
        """Format the lifespan headline (spec §6.11)."""
        if proj.headline_remaining_seconds is None:
@@ -399,6 +399,89 @@ class TestCI2Parity:
        assert "last collect:" in status
        assert "freshness:" in status
    def test_dashboard_clarity_parity_strings_have_one_status_source(self):
        """DC-2/DC-3 wording originates in status and the TUI imports it."""
        status_src = (FENRIS_PKG / "status.py").read_text()
        tui_src = (FENRIS_PKG / "tui.py").read_text()
        for wording in (
            "monitoring: active in background · persists across reboots",
            "monitoring: does not start on next boot",
            "monitoring: paused — deliberate disable",
            "paused time is excluded from your usage habit · resume: fenris monitor resume",
        ):
            assert status_src.count(wording) == 1
            assert wording not in tui_src
    @pytest.mark.asyncio
    @pytest.mark.parametrize(
        ("state", "service", "expected_lines"),
        [
            (
                "active_enabled",
                {"boot_enabled": True, "timer_active": True},
                ["monitoring: active in background · persists across reboots"],
            ),
            (
                "boot_disabled",
                {"boot_enabled": False, "timer_active": False},
                ["monitoring: does not start on next boot"],
            ),
            (
                "deliberately_paused",
                {"boot_enabled": False, "timer_active": False},
                [
                    "monitoring: does not start on next boot",
                    "monitoring: paused — deliberate disable",
                    "paused time is excluded from your usage habit · resume: fenris monitor resume",
                ],
            ),
        ],
    )
    async def test_dashboard_clarity_monitoring_lines_match_both_views(
        self, tmp_path, state, service, expected_lines
    ):
        """CI-2 synthetic-store sweep covers active, disabled, and paused states."""
        db = tmp_path / (state + ".db")
        conn = init_store(db)
        if state == "active_enabled":
            ensure_period_open(conn, _clock())
        elif state == "deliberately_paused":
            conn.execute(
                "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
                "VALUES (?, ?, ?)",
                ("2026-09-30T09:00:00+00:00", "2026-09-30T10:00:00+00:00", "user_disabled"),
            )
            conn.commit()
        conn.close()
        service_state = {
            **service,
            "last_collect_ok": None,
            "last_collect_age_s": None,
            "last_collect_reason": None,
        }
        with patch("fenris.status.query_service_state", return_value=service_state), patch(
            "fenris.tui.query_service_state", return_value=service_state
        ):
            status = get_status(
                store_path=db, clock_now=_clock(), query_services=True, query_journal=False
            ).lower()
            app = FenrisTuiApp(store_path=db)
            async with app.run_test(size=(100, 40)):
                tui_text = "\n".join(
                    (
                        str(app.query_one("#service-strip").render()),
                        str(app.query_one("#paused-banner").render()),
                    )
                ).lower()
        for expected in expected_lines:
            assert expected in status
            assert expected in tui_text
        if state != "deliberately_paused":
            assert "monitoring: paused — deliberate disable" not in status
            assert "monitoring: paused — deliberate disable" not in tui_text
    def test_pause_resume_action_names(self):
        tui_keys = {b.key for b in FenrisTuiApp.BINDINGS}
        assert "p" in tui_keys
@@ -0,0 +1,211 @@
 """Release-note changelog extraction tests (DC-6, DC-7)."""
 import importlib.util
 import json
 import subprocess
 import sys
 from pathlib import Path
 import pytest
 REPO_ROOT = Path(__file__).resolve().parent.parent
 EXTRACTOR_PATH = REPO_ROOT / "scripts" / "extract_changelog.py"
 RELEASE_REQUEST_PATH = REPO_ROOT / "scripts" / "release_request.py"
 CHANGELOG_PATH = REPO_ROOT / "CHANGELOG.md"
 def _extractor_module():
    spec = importlib.util.spec_from_file_location("extract_changelog", EXTRACTOR_PATH)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module
 def test_extracts_the_requested_version_section_verbatim():
    extractor = _extractor_module()
    changelog = """# Changelog
 ## [Unreleased]
 ## [1.4.0] - 2026-09-10
 ### Added
 - Show a release summary to consumers.
 ## [1.3.0] - 2026-09-01
 ### Fixed
 - Preserve the observation history during upgrades.
 """
    expected = """## [1.4.0] - 2026-09-10
 ### Added
 - Show a release summary to consumers.
 """
    assert extractor.extract_version_section(changelog, "1.4.0") == expected
 def test_checked_in_changelog_keeps_unreleased_first_and_categories_limited():
    lines = CHANGELOG_PATH.read_text(encoding="utf-8").splitlines()
    unreleased = lines.index("## [Unreleased]")
    version_headings = [
        index for index, line in enumerate(lines)
        if line.startswith("## [") and line != "## [Unreleased]"
    ]
    first_version = version_headings[0] if version_headings else len(lines)
    categories = [
        line.removeprefix("### ")
        for line in lines[unreleased + 1:first_version]
        if line.startswith("### ")
    ]
    assert unreleased < first_version
    assert set(categories) <= {"Added", "Changed", "Fixed"}
 def test_release_footer_verifies_the_clearsigned_checksum_asset():
    footer = (REPO_ROOT / "packaging" / "release-footer.md").read_text(
        encoding="utf-8"
    )
    assert "gpg --output SHA256SUMS --decrypt SHA256SUMS.asc" in footer
    assert "sha256sum -c SHA256SUMS" in footer
@pytest.mark.parametrize(
    ("changelog", "expected_error"),
    [
        ("# Changelog\n\n## [Unreleased]\n", "missing"),
        (
            "# Changelog\n\n## [Unreleased]\n\n## [1.4.0] - 2026-09-10\n",
            "empty",
        ),
        (
            "# Changelog\n\n## [Unreleased]\n\n## [1.4.0] - 2026-02-30\n\n- Add a note.\n",
            "malformed release date",
        ),
    ],
 )
 def test_fails_closed_for_missing_empty_or_malformed_sections(
    changelog, expected_error
 ):
    extractor = _extractor_module()
    with pytest.raises(extractor.ChangelogError, match=expected_error):
        extractor.extract_version_section(changelog, "1.4.0")
 def test_command_emits_a_workflow_error_and_nonzero_status(tmp_path):
    changelog = tmp_path / "CHANGELOG.md"
    changelog.write_text("# Changelog\n\n## [Unreleased]\n", encoding="utf-8")
    result = subprocess.run(
        [sys.executable, str(EXTRACTOR_PATH), str(changelog), "1.4.0"],
        capture_output=True,
        text=True,
        check=False,
    )
    assert result.returncode != 0
    assert result.stderr.startswith("::error::")
    assert "missing" in result.stderr
 def test_assembles_a_release_body_without_changing_the_section():
    extractor = _extractor_module()
    section = "## [1.4.0] - 2026-09-10\n\n### Added\n\n- Show a release summary.\n"
    footer = "## Install\n\nUse the package channel.\n"
    assert extractor.assemble_release_body(section, footer) == (
        section + "\n" + footer
    )
 def test_command_can_write_the_complete_release_body(tmp_path):
    changelog = tmp_path / "CHANGELOG.md"
    changelog.write_text(
        "# Changelog\n\n## [Unreleased]\n\n## [1.4.0] - 2026-09-10\n\n"
        "### Added\n\n- Show a release summary.\n",
        encoding="utf-8",
    )
    footer = tmp_path / "footer.md"
    footer.write_text("## Install\n\nUse the package channel.\n", encoding="utf-8")
    result = subprocess.run(
        [
            sys.executable,
            str(EXTRACTOR_PATH),
            str(changelog),
            "1.4.0",
            "--footer",
            str(footer),
        ],
        capture_output=True,
        text=True,
        check=False,
    )
    assert result.returncode == 0
    assert result.stdout == (
        "## [1.4.0] - 2026-09-10\n\n### Added\n\n- Show a release summary.\n\n"
        "## Install\n\nUse the package channel.\n"
    )
 def test_release_request_command_reports_create_or_patch_decisions(tmp_path):
    body = tmp_path / "release-body.md"
    body.write_text("## [1.4.0] - 2026-09-10\n", encoding="utf-8")
    create = subprocess.run(
        [
            sys.executable,
            str(RELEASE_REQUEST_PATH),
            "--version",
            "1.4.0",
            "--body-file",
            str(body),
        ],
        capture_output=True,
        text=True,
        check=False,
    )
    existing = tmp_path / "existing-release.json"
    existing.write_text('{"id": 17, "assets": []}', encoding="utf-8")
    patch = subprocess.run(
        [
            sys.executable,
            str(RELEASE_REQUEST_PATH),
            "--version",
            "1.4.0",
            "--body-file",
            str(body),
            "--existing-release",
            str(existing),
        ],
        capture_output=True,
        text=True,
        check=False,
    )
    assert create.returncode == patch.returncode == 0
    assert json.loads(create.stdout) == {
        "method": "POST",
        "path": "/releases",
        "payload": {
            "tag_name": "v1.4.0",
            "name": "v1.4.0",
            "body": "## [1.4.0] - 2026-09-10\n",
        },
    }
    assert json.loads(patch.stdout) == {
        "method": "PATCH",
        "path": "/releases/17",
        "payload": {"body": "## [1.4.0] - 2026-09-10\n"},
    }
@@ -324,6 +324,29 @@ class TestCIWorkflow:
        assert "upload" in content.lower() or "publish" in content.lower(), \
            "Workflow must include upload/publish step"
    def test_workflow_validates_notes_before_publication(self):
        content = _read(".gitea/workflows/release.yml")
        assert "scripts/extract_changelog.py" in content, \
            "Workflow must fail before publication if release notes cannot be extracted"
        assert "--footer packaging/release-footer.md" in content, \
            "Workflow must assemble the body from the standing release footer"
    def test_workflow_resynchronizes_existing_release_bodies(self):
        content = _read(".gitea/workflows/release.yml")
        assert "scripts/release_request.py" in content, \
            "Workflow must make the create-versus-update decision through the request seam"
        assert '"${METHOD}"' in content, \
            "Workflow must execute the helper-selected create-or-update request"
        assert 'RELEASE_PATH="$(printf' in content and '\n          PATH="$(printf' not in content, \
            "Workflow must not overwrite the shell PATH while preparing the request URL"
 def test_readme_points_consumers_to_release_notes():
    readme = _read("README.md")
    assert "Per-release notes live on the [releases page]" in readme
    assert "standing install and verification instructions" in readme
 # ---------------------------------------------------------------------------
 # Tests — Makefile release targets
@@ -415,6 +415,131 @@ class TestServiceFacts:
        assert "last collect:" in result
        assert "freshness:" in result
    def test_continuity_reports_boot_enabled_independently_of_runtime(self, tmp_path):
        """Status names reboot continuity while retaining the timer fact."""
        from fenris.status import get_status
        db = tmp_path / "observations.db"
        init_store(db)
        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
        with patch("fenris.status.query_service_state", return_value={
            "boot_enabled": True, "timer_active": False,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }):
            result = get_status(store_path=db, clock_now=now,
                                query_services=True, query_journal=False)
        assert "monitoring: active in background · persists across reboots" in result
        assert "timer: inactive" in result
    def test_continuity_and_deliberate_pause_are_reported_separately(self, tmp_path):
        """Only a sanctioned user_disabled period renders the paused wording."""
        from fenris.status import get_status
        db = tmp_path / "observations.db"
        conn = init_store(db)
        conn.execute(
            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
            "VALUES (?, ?, ?)",
            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
        )
        conn.commit()
        conn.close()
        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
        with patch("fenris.status.query_service_state", return_value={
            "boot_enabled": False, "timer_active": False,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }):
            result = get_status(store_path=db, clock_now=now,
                                query_services=True, query_journal=False)
        assert "monitoring: does not start on next boot" in result
        assert "monitoring: paused — deliberate disable" in result
        assert "paused time is excluded from your usage habit · resume: fenris monitor resume" in result
    def test_raw_system_state_without_user_disabled_is_not_a_deliberate_pause(self, tmp_path):
        """A non-sanctioned stop never acquires the deliberate-disable label."""
        from fenris.status import get_status
        db = tmp_path / "observations.db"
        conn = init_store(db)
        conn.execute(
            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
            "VALUES (?, ?, ?)",
            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "migrated"),
        )
        conn.commit()
        conn.close()
        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
        with patch("fenris.status.query_service_state", return_value={
            "boot_enabled": False, "timer_active": False,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }):
            result = get_status(store_path=db, clock_now=now,
                                query_services=True, query_journal=False)
        assert "monitoring: paused — deliberate disable" not in result
    def test_resumed_open_period_clears_a_previous_deliberate_pause(self, tmp_path):
        """A later sanctioned resume takes precedence over an older pause."""
        from fenris.status import get_status
        db = tmp_path / "observations.db"
        conn = init_store(db)
        conn.execute(
            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
            "VALUES (?, ?, ?)",
            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
        )
        conn.execute(
            "INSERT INTO monitoring_periods (started_at) VALUES (?)",
            ("2026-09-01T11:00:00+00:00",),
        )
        conn.commit()
        conn.close()
        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
        with patch("fenris.status.query_service_state", return_value={
            "boot_enabled": True, "timer_active": True,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }):
            result = get_status(store_path=db, clock_now=now,
                                query_services=True, query_journal=False)
        assert "monitoring: paused — deliberate disable" not in result
    def test_live_enabled_service_suppresses_a_stale_pause_marker(self, tmp_path):
        """A raw re-enable cannot leave a contradictory paused presentation."""
        from fenris.status import get_status
        db = tmp_path / "observations.db"
        conn = init_store(db)
        conn.execute(
            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
            "VALUES (?, ?, ?)",
            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
        )
        conn.commit()
        conn.close()
        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
        with patch("fenris.status.query_service_state", return_value={
            "boot_enabled": True, "timer_active": True,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }):
            result = get_status(store_path=db, clock_now=now,
                                query_services=True, query_journal=False)
        assert "monitoring: paused — deliberate disable" not in result
 # ---------------------------------------------------------------------------
 # Status output structure (§8.8, LC-9)
@@ -441,6 +566,29 @@ class TestStatusOutput:
        assert isinstance(result, str)
        assert len(result) > 0
    def test_status_excludes_tui_identity_and_auth_notice(self, tmp_path):
        """CLI status never renders TUI-only identity or launch guidance."""
        from fenris.status import get_status
        db = tmp_path / "observations.db"
        init_store(db)
        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
        with patch("fenris.status.query_service_state", return_value={
            "boot_enabled": False, "timer_active": False,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }):
            result = get_status(store_path=db, clock_now=now,
                                query_services=True, query_journal=False)
        for tui_only in (
            "Fenris — NVMe endurance monitor",
            "by Bongbetic",
            "privileged actions will prompt for authentication (polkit)",
        ):
            assert tui_only not in result
    def test_status_never_writes(self, tmp_path):
        """Status never writes to the store."""
        from fenris.status import get_status
@@ -0,0 +1,56 @@
 """Store path resolution from config — regression coverage for issue #53.
 A fresh install ships a placeholder-commented config whose only required
 key is the device selector. The collector must not crash with
 KeyError 'store_path' when the key is absent.
 """
 import sys
 from pathlib import Path
 sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
 from fenris.store import DEFAULT_STORE_PATH, get_store_path
 REPO_ROOT = Path(__file__).resolve().parent.parent
 TEMPLATE = REPO_ROOT / "packaging" / "fenris.conf"
 def _parse_like_load_config(text: str) -> dict:
    """Mirror collect.load_config()'s key=value parsing rules."""
    config = {}
    for line in text.splitlines():
        line = line.strip()
        if not line or line.startswith("#"):
            continue
        if "=" in line:
            key, value = line.split("=", 1)
            config[key.strip()] = value.strip()
    return config
 def test_missing_store_path_falls_back_to_default():
    """Config with only the device selector resolves to the packaged default."""
    assert get_store_path({"device": "/dev/nvme0n1"}) == DEFAULT_STORE_PATH
 def test_explicit_store_path_wins():
    """An explicit store_path override is honored."""
    assert get_store_path({"store_path": "/tmp/other.db"}) == Path("/tmp/other.db")
 def test_packaged_template_yields_collectable_config():
    """The packaged template, once a device is set, must be collector-ready.
    Reproduces the fresh-install path: parse packaging/fenris.conf the way
    collect.load_config() does, add the device selector, then resolve the
    store. Issue #53 made this raise KeyError.
    """
    config = _parse_like_load_config(TEMPLATE.read_text())
    config["device"] = "/dev/nvme0n1"
    assert get_store_path(config) == DEFAULT_STORE_PATH
 def test_template_documents_store_path():
    """The template must mention store_path so admins know it is overridable."""
    assert "store_path" in TEMPLATE.read_text()
@@ -0,0 +1,79 @@
 """Group access to the observation store — regression coverage for issue #54.
 Two defects: (1) a non-group user's stat() on the store directory raised
 PermissionError straight through open_store_readonly(), crashing status/TUI
 instead of degrading to the Store fault view; (2) even group members could
 not open the WAL-mode store because root-created sidecars lacked group write
 and the store directory lacked group execute-then-write.
 """
 import sqlite3
 import sys
 from pathlib import Path
 import pytest
 sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
 from fenris.store import DEFAULT_STORE_PATH, init_store
 from fenris.status import StoreFault, open_store_readonly
 def test_stat_permission_error_becomes_store_fault(monkeypatch, tmp_path):
    """stat() denied (non-group user on a 2750 dir) → StoreFault, not crash."""
    store = tmp_path / "observations.db"
    store.write_bytes(b"")
    import pathlib
    def denied(self, follow_symlinks=True):
        raise PermissionError(13, "Permission denied")
    monkeypatch.setattr(pathlib.Path, "exists", denied)
    with pytest.raises(StoreFault):
        open_store_readonly(store)
 def test_connect_failure_becomes_store_fault(tmp_path):
    """sqlite failures stay wrapped as StoreFault (existing contract)."""
    garbage = tmp_path / "observations.db"
    garbage.write_bytes(b"not a database" * 100)
    with pytest.raises(StoreFault):
        open_store_readonly(garbage)
 def test_init_store_leaves_files_group_writable(tmp_path):
    """Root-created stores must stay readable by WAL readers: db and sidecars
    need group write after init_store (issue #54)."""
    store = tmp_path / "observations.db"
    conn = init_store(store)
    try:
        assert (store.stat().st_mode & 0o060) == 0o060, "db not group rw"
        wal = store.with_name(store.name + "-wal")
        shm = store.with_name(store.name + "-shm")
        if wal.exists():
            assert (wal.stat().st_mode & 0o060) == 0o060, "wal not group rw"
        if shm.exists():
            assert (shm.stat().st_mode & 0o060) == 0o060, "shm not group rw"
    finally:
        conn.close()
 def test_readonly_open_works_after_init_store(tmp_path):
    """The shipped read path opens a store created by init_store."""
    store = tmp_path / "observations.db"
    writer = init_store(store)
    writer.execute("INSERT INTO monitoring_periods (started_at) VALUES ('2026-01-01T00:00:00+00:00')")
    writer.commit()
    conn = open_store_readonly(store)
    assert conn is not None
    conn.close()
    writer.close()
 def test_packaging_ships_group_access():
    """tmpfiles must create the store dir group-writable; collect unit must
    keep the umask loose so root-created sidecars stay group-accessible."""
    repo = Path(__file__).resolve().parent.parent
    assert "2770" in (repo / "packaging" / "tmpfiles.d" / "fenris.conf").read_text()
    assert "2750" not in (repo / "packaging" / "tmpfiles.d" / "fenris.conf").read_text()
    assert "UMask=002" in (repo / "units" / "fenris-collect.service").read_text()
@@ -10,6 +10,7 @@ Covers:
 Criteria: TUI-1, TUI-4, CI-1, CI-4, IN-3.
 """
 import sqlite3
 from xml.etree import ElementTree
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from unittest.mock import patch, MagicMock
@@ -384,6 +385,160 @@ class TestDenseScreen:
            assert "timer:" in strip
            assert "last collect:" in strip
            assert "freshness:" in strip
            assert "by Bongbetic" in strip
    @pytest.mark.asyncio
    async def test_service_strip_shows_continuity_and_separate_quit_rail(self, tmp_path):
        """The visible action footer excludes quit because the rail owns it."""
        conn = init_store(tmp_path / "test.db")
        _open_period(conn)
        conn.close()
        app = FenrisTuiApp(store_path=tmp_path / "test.db")
        with patch("fenris.tui.query_service_state", return_value={
            "boot_enabled": True, "timer_active": True,
            "last_collect_ok": True, "last_collect_age_s": 60,
            "last_collect_reason": None,
        }):
            async with app.run_test():
                strip = str(app.query_one("#service-strip").render()).lower()
                rail = str(app.query_one("#quit-rail").render())
                usage = app.query_one("#usage-history")
                service = app.query_one("#service-strip")
                quit_rail = app.query_one("#quit-rail")
                assert "continuity" in strip
                assert "monitoring: active in background · persists across reboots" in strip
                assert "p pause · r resume · c collect · d disclosures" in strip
                assert "q quit" not in strip
                assert rail == "q QUIT TUI"
                assert usage.region.y < service.region.y < quit_rail.region.y
                assert usage.region.bottom <= service.region.y
                assert service.region.bottom <= quit_rail.region.y
    @pytest.mark.asyncio
    async def test_deliberate_pause_banner_is_visible_and_quit_preserves_periods(self, tmp_path):
        """The Pilot sees the paused block; q leaves persisted monitoring state alone."""
        db = tmp_path / "test.db"
        conn = init_store(db)
        conn.execute(
            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
            "VALUES (?, ?, ?)",
            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
        )
        conn.commit()
        conn.close()
        app = FenrisTuiApp(store_path=db)
        with patch("fenris.tui.query_service_state", return_value={
            "boot_enabled": False, "timer_active": False,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }), patch("fenris.tui.subprocess.run") as subprocess_run, patch.object(
            app, "_run_helper"
        ) as run_helper:
            async with app.run_test(size=(80, 24)) as pilot:
                await pilot.pause()
                paused_banner = app.query_one("#paused-banner")
                main_grid = app.query_one("#main-grid")
                assert str(main_grid.styles.layout) == "<grid>"
                assert main_grid.has_class("paused")
                assert len(main_grid.styles.grid_rows) == 5
                banner = str(paused_banner.render()).lower()
                assert "monitoring: paused — deliberate disable" in banner
                assert "paused time is excluded from your usage habit · resume: fenris monitor resume" in banner
                assert paused_banner.region.height >= 5
                assert paused_banner.region.y < app.query_one("#usage-history").region.y
                assert app.query_one("#usage-history").region.bottom <= app.query_one(
                    "#service-strip"
                ).region.y
                screenshot = app.export_screenshot()
                visible_text = " ".join(
                    "".join(ElementTree.fromstring(screenshot).itertext()).split()
                )
                assert "paused time is excluded from your usage habit" in visible_text
                assert "resume: fenris monitor resume" in visible_text
                assert "monitoring: does not start on next boot" in str(
                    app.query_one("#service-strip").render()
                ).lower()
                dashboard_scroll = app.query_one("#dashboard-scroll")
                assert dashboard_scroll.max_scroll_y > 0
                dashboard_scroll.focus()
                await pilot.press("end")
                assert dashboard_scroll.scroll_y == dashboard_scroll.max_scroll_y
                footer_text = " ".join(
                    "".join(
                        ElementTree.fromstring(app.export_screenshot()).itertext()
                    ).split()
                )
                assert "q QUIT TUI" in footer_text
                await pilot.press("q")
                assert not app.is_running
            subprocess_run.assert_not_called()
            run_helper.assert_not_called()
        conn = sqlite3.connect(db)
        row = conn.execute(
            "SELECT ended_at, end_cause FROM monitoring_periods"
        ).fetchone()
        conn.close()
        assert row == ("2026-09-01T10:00:00+00:00", "user_disabled")
    @pytest.mark.asyncio
    async def test_quit_preserves_an_active_monitoring_period(self, tmp_path):
        """Quitting an active dashboard never closes or mutates its period."""
        db = tmp_path / "test.db"
        conn = init_store(db)
        _open_period(conn, "2026-09-01T09:00:00+00:00")
        conn.close()
        app = FenrisTuiApp(store_path=db)
        with patch("fenris.tui.query_service_state", return_value={
            "boot_enabled": True, "timer_active": True,
            "last_collect_ok": None, "last_collect_age_s": None,
            "last_collect_reason": None,
        }), patch("fenris.tui.subprocess.run") as subprocess_run, patch.object(
            app, "_run_helper"
        ) as run_helper:
            async with app.run_test() as pilot:
                await pilot.press("q")
                assert not app.is_running
            subprocess_run.assert_not_called()
            run_helper.assert_not_called()
        conn = sqlite3.connect(db)
        row = conn.execute(
            "SELECT started_at, ended_at, end_cause FROM monitoring_periods"
        ).fetchone()
        conn.close()
        assert row == ("2026-09-01T09:00:00+00:00", None, None)
    @pytest.mark.asyncio
    async def test_branding_and_one_time_auth_banner(self, tmp_path):
        """Identity is visible at launch; auth notice clears once per session."""
        app = FenrisTuiApp(
            store_path=tmp_path / "nonexistent.db",
            refresh_interval_s=0.2,
        )
        auth_notice = "privileged actions will prompt for authentication (polkit)"
        async with app.run_test() as pilot:
            headline = str(app.query_one("#headline-band").render())
            assert "Fenris — NVMe endurance monitor" in headline
            assert auth_notice in headline
            assert "by Bongbetic" in str(app.query_one("#service-strip").render())
            await pilot.pause(0.25)
            assert auth_notice not in str(app.query_one("#headline-band").render())
            await pilot.pause(0.25)
            assert auth_notice not in str(app.query_one("#headline-band").render())
        fresh_app = FenrisTuiApp(
            store_path=tmp_path / "nonexistent.db",
            refresh_interval_s=0.2,
        )
        async with fresh_app.run_test():
            assert auth_notice in str(fresh_app.query_one("#headline-band").render())
 # ---------------------------------------------------------------------------
@@ -524,4 +679,3 @@ class TestStateMatrixCombinations:
        # Incomplete provenance → UNVERIFIED tier
        assert proj.baseline_tier.value == "unverified_override"
        conn.close()
@@ -7,3 +7,4 @@ After=local-fs.target
 Type=oneshot
 ExecStart=/usr/libexec/fenris/fenris-collect
 TimeoutStartSec=90
 UMask=002
Author	SHA1	Message	Date
xavierk	d894ae290f	docs: draft TUI polish companion spec	2026-09-14 02:13:34 +05:30
xavierk	f406285a0f	release: prepare v0.3.4 Release / release (push) Successful in 1m4s Details	2026-09-10 21:07:10 +05:30
xavierk	608ad7f823	docs(release): point consumers to release notes	2026-09-10 20:05:37 +05:30
xavierk	cfdef63388	fix(release): execute publication request safely	2026-09-10 20:04:29 +05:30
xavierk	f077fa671e	feat(release): publish changelog-driven notes	2026-09-10 20:02:19 +05:30
xavierk	d01df6468f	feat(tui): clarify monitoring continuity and quitting	2026-09-10 19:43:32 +05:30
xavierk	7bbe5cede7	feat(tui): identify Fenris and explain polkit authentication	2026-09-10 13:28:05 +05:30
xavierk	bb5bc9a72e	docs(spec): assemble dashboard clarity spec, DC-1–DC-8 criteria, TUI-4 amendment (wayfinder #60 )	2026-09-10 12:03:31 +05:30
xavierk	4a7661d81c	chore: bump version to 0.3.3 (missed from #54 fix commit) Release / release (push) Successful in 55s Details	2026-09-10 10:01:28 +05:30
xavierk	fb683f52ba	fix(store): degrade on store permission errors, keep store group-readable (issue #54 ) Release / release (push) Successful in 53s Details - open_store_readonly(): stat() PermissionError (non-group user on the 2750 store dir) now maps to StoreFault so status/TUI degrade instead of crashing with a traceback. - init_store(): chmod db + -wal/-shm group rw after WAL setup — SQLite WAL readers need write access to sidecars even for mode=ro opens. - Store dir 2750 → 2770 (tmpfiles + make install) and UMask=002 on the collect unit so root-created files stay group-accessible. - rpm %post upgrade path re-runs systemd-tmpfiles --create to correct placement modes on existing machines. Bump to 0.3.3.	2026-09-10 09:58:24 +05:30
xavierk	512df2ae83	fix(store): default store_path when config omits it (issue #53 ) Release / release (push) Successful in 59s Details Fresh installs shipped a config template with no store_path key while collector.py demanded one via get_store_path() — every first collect crashed with KeyError 'store_path'. Resolve to the packaged default (/var/lib/fenris/observations.db) when absent, document the key in the template, and cover the fresh-install path with regression tests. Bump to 0.3.2.	2026-09-10 09:45:02 +05:30
`@@ -1,2 +1,2 @@`
	`# Type Path Mode User Group Age Argument`	`# Type Path Mode User Group Age Argument`
	`d /var/lib/fenris 2750 root fenris - -`	`d /var/lib/fenris 2770 root fenris - -`