prototype: graph encoding variants for hourly history decision (wayfinder #68)

- open_store_readonly(): stat() PermissionError (non-group user on the
  2750 store dir) now maps to StoreFault so status/TUI degrade instead
  of crashing with a traceback.
- init_store(): chmod db + -wal/-shm group rw after WAL setup — SQLite
  WAL readers need write access to sidecars even for mode=ro opens.
- Store dir 2750 → 2770 (tmpfiles + make install) and UMask=002 on the
  collect unit so root-created files stay group-accessible.
- rpm %post upgrade path re-runs systemd-tmpfiles --create to correct
  placement modes on existing machines.
Bump to 0.3.3.

.gitea/workflows/release.yml

@@ -21,6 +21,25 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Validate release tag and notes
+        run: |
+          set -euo pipefail
+          VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)"
+          if [ -z "${VERSION}" ]; then
+            echo "::error::could not determine the project version"
+            exit 1
+          fi
+          if [ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]; then
+            EXPECTED_TAG="v${VERSION}"
+            ACTUAL_TAG="${GITHUB_REF#refs/tags/}"
+            if [ "${ACTUAL_TAG}" != "${EXPECTED_TAG}" ]; then
+              echo "::error::tag ${ACTUAL_TAG} does not match ${EXPECTED_TAG}"
+              exit 1
+            fi
+          fi
+          python3 scripts/extract_changelog.py CHANGELOG.md "${VERSION}" \
+            --footer packaging/release-footer.md > "${RUNNER_TEMP}/release-body.md"
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -144,20 +163,44 @@ jobs:
         env:
           GITEA_PUBLISH_TOKEN: ${{ secrets.GITEAPACKAGETOKEN }}
         run: |
-          VERSION=${{ steps.version.outputs.version }}
-          # Check if release already exists (idempotent re-runs)
-          EXISTING=$(curl -s -o /dev/null -w '%{http_code}' \
-            -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
-            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}")
-          if [ "$EXISTING" = "200" ]; then
-            echo "Release v${VERSION} already exists, skipping creation"
-          else
-            curl --fail -X POST \
-              -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\":\"v${VERSION}\",\"name\":\"v${VERSION}\"}" \
-              "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases"
+          set -euo pipefail
+          if [ -z "${GITEA_PUBLISH_TOKEN}" ]; then
+            echo "::error::GITEAPACKAGETOKEN repository secret is not configured"
+            exit 1
           fi
+          VERSION=${{ steps.version.outputs.version }}
+          RELEASE_BODY="${RUNNER_TEMP}/release-body.md"
+          if [ ! -s "${RELEASE_BODY}" ]; then
+            echo "::error::validated release body is missing or empty"
+            exit 1
+          fi
+          EXISTING_RELEASE="${RUNNER_TEMP}/existing-release.json"
+          EXISTING=$(curl --silent --show-error -o "${EXISTING_RELEASE}" -w '%{http_code}' \
+            -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}" || true)
+          case "${EXISTING}" in
+            200)
+              echo "Release v${VERSION} exists; resynchronizing its notes"
+              REQUEST="$(python3 scripts/release_request.py --version "${VERSION}" \
+                --body-file "${RELEASE_BODY}" --existing-release "${EXISTING_RELEASE}")"
+              ;;
+            404)
+              REQUEST="$(python3 scripts/release_request.py --version "${VERSION}" \
+                --body-file "${RELEASE_BODY}")"
+              ;;
+            *)
+              echo "::error::release lookup failed with HTTP ${EXISTING}"
+              exit 1
+              ;;
+          esac
+          METHOD="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['method'])")"
+          RELEASE_PATH="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['path'])")"
+          PAYLOAD="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.dumps(json.load(sys.stdin)['payload']))")"
+          curl --fail --silent --show-error -X "${METHOD}" \
+            -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "${PAYLOAD}" \
+            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris${RELEASE_PATH}"
 
       - name: Attach artifacts to release
         env:

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+<!--
+Maintainers add one user-facing entry to Unreleased with each change. A release
+commit bumps pyproject.toml, renames Unreleased to that bare-semver version and
+an ISO date, then restores an empty Unreleased section; tag that commit. Do not
+backfill releases from before this changelog.
+-->
+
+## [Unreleased]
+
+## [0.3.4] - 2026-09-10
+
+### Added
+
+- Add Fenris identity and a polkit authentication notice to the dashboard.
+- Clarify monitoring continuity, deliberate pauses, and quitting in the dashboard and status output.
+- Add per-release notes with installation, verification, and rollback guidance.

README.md

@@ -189,6 +189,16 @@ No interval key exists in `/etc/fenris/fenris.conf`. Cadence is a systemd concer
 | `fenris start` / `stop` / `run` | Rejected with a one-line migration pointer — never aliased. |
 | `fenris --device` | Rejected with a pointer to the configuration file. |
 
+## Reading the dashboard
+
+`fenris` opens the TUI dashboard.
+
+- **Continuity** — the service strip's continuity line (and `fenris status`) reports whether monitoring survives reboots: `monitoring: active in background · persists across reboots`, or `monitoring: does not start on next boot`.
+- **Paused vs. quit** — a full-width `monitoring: paused — deliberate disable` block means collection is stopped (`fenris monitor pause`); resume with `fenris monitor resume`. Pressing `q` only leaves the screen — monitoring keeps running in the background.
+- **Auth banner** — at launch, `privileged actions will prompt for authentication (polkit)` shows once and clears on the first refresh. Privileged actions elevate via polkit; Fenris never asks for sudo.
+
+Per-release notes live on the [releases page](https://git.bongbetic.com/xavierk/Fenris/releases): each entry is the version's `CHANGELOG.md` section — what was added, changed, and fixed — plus standing install and verification instructions.
+
 ## Retired menu options
 
 The legacy `fenris.sh` menu script and the `fenris.py` monolith have been removed. Here's where the old options went:

docs/spec/acceptance-criteria.md

@@ -91,7 +91,7 @@ Status: Accepted — resolves [Define cross-cutting acceptance criteria](https:/
 - **TUI-1** (A) Variant A "Panes": one dense keyboard-first screen; confidence rendered as evidence (state + contributing facts); boot enablement, runtime activity, last collect outcome, and freshness displayed as four separate facts.
 - **TUI-2** (M) Pause/resume asymmetry and polkit tty passthrough work in a live terminal: pause confirms, resume does not, and the platform agent prompts without breaking the TUI.
 - **TUI-3** (P) Textual runs on Python 3.9+, gated at install time, never a runtime crash.
-- **TUI-4** (A) The Panes screen layout is normative: a full-width headline band (lifespan headline or its no-projection wording, confidence state with contributing facts, scenario range); a usage-history pane on the left (write-history sparkline with ▲ habit-change and ? unexplained-gap markers plus legend, habit-split bar with active/idle/powered-off/unknown shares); a drive-health and settings pane on the right (health facts, vendor-wear context line, read-only settings with the endurance baseline and its provenance label); a full-width service strip at the bottom (the four separate service facts, the monitoring-period line, the action legend). Production bindings are `p` pause (asks), `r` resume (does not), `c` collect now, `d` disclosures, `q` quit ([Prototype the TUI information architecture](https://git.bongbetic.com/xavierk/Fenris/issues/3)); the prototype branch is visual reference only.
+- **TUI-4** (A) The Panes screen layout is normative: a full-width headline band (lifespan headline or its no-projection wording, confidence state with contributing facts, scenario range); a usage-history pane on the left (write-history sparkline with ▲ habit-change and ? unexplained-gap markers plus legend, habit-split bar with active/idle/powered-off/unknown shares); a drive-health and settings pane on the right (health facts, vendor-wear context line, read-only settings with the endurance baseline and its provenance label); a full-width service strip at the bottom (the four separate service facts, the monitoring-period line, the action legend). Production bindings are the footer `p pause · r resume · c collect · d disclosures` — pause asks, resume does not — plus a bordered quit rail `q QUIT TUI` visually separate from monitoring state; the rail owns quit and the footer carries no quit entry (bindings amended by [Lock the dashboard wording strings](https://git.bongbetic.com/xavierk/Fenris/issues/57); original [Prototype the TUI information architecture](https://git.bongbetic.com/xavierk/Fenris/issues/3)); the prototype branch is visual reference only.
 
 ## Failure and recovery (ADR 0005)
 
@@ -131,3 +131,16 @@ Status: Accepted — resolves [Define cross-cutting acceptance criteria](https:/
 - **AC-3** (A) Any acquisition failure — missing binary, nonzero exit, malformed JSON, unreadable sysfs attribute — fails the whole collection run; no partial sample (identity without counters, or counters without identity) is ever written; the miss surfaces through ADR 0005 freshness, never as degraded identity.
 - **AC-4** (P) `vid`/`ssvid` are read from the PCI sysfs node when present and stored null otherwise; they are segment metadata only, never key components.
 - **AC-5** (P) `make install` verifies `smartctl` and fails cleanly otherwise; the acquisition path adds no Python dependency and no OS package beyond smartmontools (ADR 0004 §9).
+
+## Dashboard clarity and release notes ([Chart Fenris dashboard clarity](https://git.bongbetic.com/xavierk/Fenris/issues/55))
+
+Decided in [Write the dashboard clarity acceptance criteria](https://git.bongbetic.com/xavierk/Fenris/issues/59), from [Prototype the dashboard clarity additions](https://git.bongbetic.com/xavierk/Fenris/issues/56), [Lock the dashboard wording strings](https://git.bongbetic.com/xavierk/Fenris/issues/57), and [Specify the changelog and release-notes mechanism](https://git.bongbetic.com/xavierk/Fenris/issues/58).
+
+- **DC-1** (A) TUI branding: the header bar renders `Fenris — NVMe endurance monitor`; a dimmed `by Bongbetic` sits inline with service facts in the bottom service strip; neither string appears in `fenris status` (TUI-only identity surfaces).
+- **DC-2** (A) Continuity parity, keyed to the boot fact as-is: active + boot-enabled renders `monitoring: active in background · persists across reboots`; boot-disabled renders `monitoring: does not start on next boot` — identical lowercase source strings in the TUI service strip and `fenris status`, including while paused (paused implies boot-disabled; the row still reports the fact). Test impact: feeds the CI-2 sweep (lowercase source-string comparison).
+- **DC-3** (A) Paused presentation (Deliberate disable): the TUI shows a strong state block titled `monitoring: paused — deliberate disable` with subline `paused time is excluded from your usage habit · resume: fenris monitor resume`; `fenris status` prints the same two lines with identical wording. Test impact: feeds the CI-2 sweep (lowercase source-string comparison).
+- **DC-4** (A) Quit affordance distinct from monitoring state: a bordered labelled rail `q QUIT TUI` visually separate from the paused state block; the footer reads `p pause · r resume · c collect · d disclosures` with no quit entry (the rail owns quit); quitting the TUI never alters monitoring state. Amends TUI-4's binding parenthetical.
+- **DC-5** (A) Launch auth banner: `privileged actions will prompt for authentication (polkit)` renders full-width under the header at TUI launch, clears on the first refresh tick, and never reappears in the session; no user-facing string uses "sudo" (polkit-accurate elevation wording only).
+- **DC-6** (A) CHANGELOG.md shape (Keep a Changelog 1.1): `## [Unreleased]` always present at top, even empty; version headings `## [X.Y.Z] - YYYY-MM-DD` with strict ISO date; categories Added/Changed/Fixed only, security folding into Fixed; entries are single `- ` bullets, imperative mood, user-facing, no commit hashes or issue numbers.
+- **DC-7** (A) Extraction fails closed: `scripts/extract_changelog.py` slices the requested version's section verbatim and never reads `[Unreleased]`; a missing or empty section or a malformed date produces `::error::` and a nonzero exit; the release workflow fails when the pushed tag ≠ `v{version from pyproject.toml}` (guard skipped on `workflow_dispatch`).
+- **DC-8** (A/P) Release body: the body is the extracted section verbatim plus the standing footer from `packaging/release-footer.md`; a re-run against an existing release PATCHes the body (re-sync is a feature) while uploaded assets skip idempotently. A covers assembly/PATCH-logic unit tests; P is one scripted `workflow_dispatch` verification of body assembly.

docs/spec/dashboard-clarity.md

@@ -0,0 +1,122 @@
+# Fenris dashboard clarity specification
+
+**Status: decision-complete.** Assembled by [Assemble the dashboard clarity specification and close the map](https://git.bongbetic.com/xavierk/Fenris/issues/60) from the closed tickets of the Wayfinder map [Chart Fenris dashboard clarity](https://git.bongbetic.com/xavierk/Fenris/issues/55). This document is normative for the follow-up **execution effort**; nothing here is implemented by the map.
+
+**Canonical roles.** The [redesign specification](fenris-redesign.md) (frozen) and [ADRs 0001–0007](../adr/) remain authoritative and untouched — this is a companion spec covering five dashboard clarity additions plus the changelog-driven release-notes mechanism. The [criteria register](acceptance-criteria.md) carries the testable statements: **DC-1–DC-8**, appended by this assembly, with **TUI-4's binding list amended** (§4). Terminology follows the glossary in [`CONTEXT.md`](../../CONTEXT.md), including *Deliberate disable* and *Release*.
+
+**Binding language.** *Must*, *exactly*, and *never* are normative.
+
+## How to read this document
+
+Five screen additions (§1–§5), one release-notes mechanism (§6), the verbatim string register (§7), and the README section to add at execution (§8). Each section cites its criteria. Source strings are lowercase; the TUI may render uppercase via styling only. Typography, governing every string: em-dash `—` separates a title from its qualifier; middle dot `·` joins facts within a line; UTF-8 is assumed. CI parity sweeps compare lowercase source strings — rendering case is styling, not wording.
+
+## 1. Header bar and Bongbetic credit — DC-1
+
+Visual base is treatment A, quiet integration: the existing Panes information architecture is preserved.
+
+- The header bar reads `Fenris — NVMe endurance monitor`.
+- The credit `by Bongbetic` renders dimmed, inline with service facts in the bottom service strip — never in the action row.
+- Both are TUI-only identity surfaces: `fenris status` never renders them.
+
+## 2. Continuity line — DC-2
+
+A labelled `CONTINUITY` row in the service strip (treatment B), mirrored by `fenris status` — the TUI/CLI parity anchor. The row is keyed to the boot fact as-is, independently of run state (Deliberate disable runs `systemctl disable --now`, so paused implies boot-disabled; the row still reports the fact):
+
+- Active + boot enabled: `monitoring: active in background · persists across reboots`
+- Boot disabled: `monitoring: does not start on next boot`
+
+Identical lowercase source strings in the TUI service strip and `fenris status`, including while paused.
+
+## 3. Paused state block — DC-3
+
+Treatment C, strong state blocks: when monitoring is paused, a full-width, high-contrast banner clearly identifying Deliberate disable:
+
+- Title: `monitoring: paused — deliberate disable`
+- Subline: `paused time is excluded from your usage habit · resume: fenris monitor resume`
+
+`fenris status` prints the same two lines with identical wording (state line + consequence line). The resume hint uses the CLI form only; the footer owns key hints — no duplication.
+
+## 4. Quit rail — DC-4 (amends TUI-4)
+
+Treatment B, labelled rails: a prominent bordered `q QUIT TUI` rail, visually separate from the monitoring-state block and the paused banner. The footer becomes `p pause · r resume · c collect · d disclosures` — the rail owns quit; the footer carries no quit entry. Quitting the TUI never alters monitoring state. The register's TUI-4 binding parenthetical is amended accordingly by this assembly.
+
+## 5. Launch auth banner — DC-5
+
+A quiet informational line (treatment A) that never competes with drive state:
+
+- Text: `privileged actions will prompt for authentication (polkit)`
+- Full-width under the header at TUI launch; clears on the first refresh tick; never reappears in the session.
+- TUI-only; `fenris status` never shows it.
+- Elevation wording is polkit-accurate everywhere: no user-facing string uses "sudo" (sudo belongs to install/upgrade docs).
+- Evidence class A: a Textual pilot drives refresh ticks headlessly.
+
+## 6. Changelog and release notes — DC-6, DC-7, DC-8
+
+Implements the existing glossary term *Release* (tag + packages + change notes together). No new glossary terms; no ADR (reversible mechanism).
+
+### 6.1 CHANGELOG.md (source of truth, repo root)
+
+- Keep a Changelog 1.1 shape. `## [Unreleased]` is always present at top, even empty. Version headings are `## [X.Y.Z] - YYYY-MM-DD` — bracketed bare semver, strict ISO date.
+- Categories are `### Added`, `### Changed`, `### Fixed` only; security fixes fold into Fixed.
+- Entries are single `- ` bullets, imperative mood, user-facing phrasing; no commit hashes or issue numbers.
+
+### 6.2 Extraction (release.yml, tag time)
+
+- `scripts/extract_changelog.py` (checked in, unit-tested): takes the changelog path and a version; slices that version's section verbatim; never reads `[Unreleased]`. Fails closed — `::error::` plus nonzero exit — when the section is missing or empty or the date is malformed.
+- Guard: the workflow fails when the pushed tag ≠ `v{version from pyproject.toml}` (guard skipped on `workflow_dispatch`).
+
+### 6.3 Release body
+
+- Body = extracted version section verbatim + standing footer from `packaging/release-footer.md` (channel install one-liners, `sha256sum -c SHA256SUMS.asc` verify, rollback pointer). The footer is standing text; only the changelog section varies.
+- Re-run against an existing release: PATCH the body (changelog re-sync is a feature); uploaded assets/packages keep their current idempotent-skip.
+
+### 6.4 Discipline
+
+- All entries land in `[Unreleased]` as part of the fixing change — no notes-later step.
+- One release commit bumps the pyproject version, renames `[Unreleased]` → the version heading, and restores an empty `[Unreleased]`; the tag points at that commit (tag ↔ pyproject ↔ changelog triple-match, enforced fail-closed by DC-7).
+- No backfill: per-release notes begin with the release shipping this mechanism; `CHANGELOG.md` starts with empty `[Unreleased]`.
+
+## 7. String register (verbatim)
+
+### TUI-only strings (launch/identity surfaces)
+
+| Surface | String |
+|---|---|
+| Header bar | `Fenris — NVMe endurance monitor` |
+| Credit (dimmed, inline with service facts) | `by Bongbetic` |
+| Auth banner (full-width under header at launch, clears on first refresh tick, never reappears) | `privileged actions will prompt for authentication (polkit)` |
+| Quit rail (bordered, labelled) | `q QUIT TUI` |
+| Footer (owns key hints; no quit entry) | `p pause · r resume · c collect · d disclosures` |
+
+### Parity strings (TUI and `fenris status` identical — CI-2)
+
+| Surface | String |
+|---|---|
+| Continuity, active + boot enabled | `monitoring: active in background · persists across reboots` |
+| Continuity, boot disabled | `monitoring: does not start on next boot` |
+| Paused state line | `monitoring: paused — deliberate disable` |
+| Paused consequence line | `paused time is excluded from your usage habit · resume: fenris monitor resume` |
+
+`fenris status` prints the paused state line + consequence line when paused, identical wording to the banner title + subline.
+
+## 8. README section (add at execution)
+
+The README gains a "Reading the dashboard" section after the CLI reference. Verbatim text:
+
+```markdown
+## Reading the dashboard
+
+`fenris` opens the TUI dashboard. Three things it tells you:
+
+- **Continuity** — the service strip's continuity line (and `fenris status`) reports whether monitoring survives reboots: `monitoring: active in background · persists across reboots`, or `monitoring: does not start on next boot`.
+- **Paused vs. quit** — a full-width `monitoring: paused — deliberate disable` block means collection is stopped (`fenris monitor pause`); resume with `fenris monitor resume`. Pressing `q` only leaves the screen — monitoring keeps running in the background.
+- **Auth banner** — at launch, `privileged actions will prompt for authentication (polkit)` shows once and clears on the first refresh. Privileged actions elevate via polkit; Fenris never asks for sudo.
+
+Per-release notes live on the [releases page](https://git.bongbetic.com/xavierk/Fenris/releases): each entry is the version's `CHANGELOG.md` section — what was added, changed, and fixed — plus standing install and verification instructions.
+```
+
+This resolves the map's README-wording fog: the wording is decided here; the actual README edit is execution.
+
+## 9. Out of scope
+
+Executing any of this — code, tests, releases — and any TUI layout or information-architecture redesign beyond the five additions named above. Execution is a fresh effort after handoff.

packaging/release-footer.md

@@ -0,0 +1,20 @@
+## Install
+
+Install Fenris from its package channel after following the [package setup instructions](https://git.bongbetic.com/xavierk/Fenris/src/branch/main/README.md#install-from-package-recommended):
+
+```bash
+sudo apt update && sudo apt install fenris       # Debian / Ubuntu
+sudo dnf install fenris                          # Fedora
+sudo zypper install fenris                       # openSUSE Tumbleweed
+```
+
+## Verify downloads
+
+```bash
+gpg --output SHA256SUMS --decrypt SHA256SUMS.asc
+sha256sum -c SHA256SUMS
+```
+
+## Rollback
+
+Installing an older package over a newer observation store is unsupported. Restore the observation-store snapshot, then install the earlier Release; see the [upgrade and rollback guidance](https://git.bongbetic.com/xavierk/Fenris/src/branch/main/README.md#upgrade).

packaging/rpm/post.sh

@@ -44,4 +44,6 @@ print(f'Fenris migration: {n} step(s) applied') if n else None
         fi
         rm -f "${OLD_CONTENT}"
     done
+    # Re-apply placement modes (store dir group access, issue #54)
+    systemd-tmpfiles --create  || true
 fi

packaging/tmpfiles.d/fenris.conf

@@ -1,2 +1,2 @@
 # Type  Path              Mode  User   Group  Age  Argument
-d       /var/lib/fenris   2750  root   fenris  -   -
+d       /var/lib/fenris   2770  root   fenris  -   -

prototype/graph-encoding/README.md

@@ -0,0 +1,45 @@
+# PROTOTYPE — graph encoding & hourly drill-down (throwaway)
+
+Answers wayfinder ticket **Choose daily graph encoding and hourly drill-down**
+on map **Fenris TUI polish and hourly history**.
+Not production code. Do not merge onto main.
+
+## Question
+
+Which graph encoding best communicates hourly writes and a day's usage
+without misleading: daily bars vs one candle per day vs rolling hourly strip,
+with range -> selected day -> hourly detail -> back navigation.
+
+## Run
+
+    ./run          # or: python3 tui_prototype.py
+
+## Variants (switch with [ and ])
+
+- **A — Daily bars**: one bar per local display day (bytes written), drill
+  into 24 hourly bars with Enter / click.
+- **B — Daily candles**: one candle per day derived from hourly values
+  (open = first evidenced hour, close = last, high/low = max/min hourly).
+  Same drill-down.
+- **C — Rolling hourly strip**: continuous last-72-hours columns with day
+  separators; click an hour for its readout (no day level).
+
+## Data states encoded (synthetic)
+
+measured zero (0 B) · gap / no evidence · unallocated usage (measured,
+attribution unknown) · partial day ("so far") · deliberate-disable pause band ·
+day before monitoring began.
+
+Gaps never render as zero. Unallocated is a separate visual segment, never
+spread into hours.
+
+## Framework facts verified
+
+Textual 8.2.8 (installed): no BarChart widget (roadmap-only), Sparkline is
+non-interactive. Bars/candles here are a custom Static renderable; mouse
+clicks map via widget-local x. No new dependencies.
+
+## Screenshots
+
+screenshots/ holds SVG exports at 80x24 and 140x40 per variant.
+Regenerate with: python3 capture.py

prototype/graph-encoding/capture.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+# PROTOTYPE helper — regenerate screenshots/*.svg via headless Textual run.
+import asyncio
+from tui_prototype import GraphPrototype
+
+
+async def shot(app, size, presses, path):
+    async with app.run_test(size=size) as pilot:
+        for p in presses:
+            await pilot.press(p)
+        svg = app.export_screenshot()
+    with open(path, "w") as fh:
+        fh.write(svg)
+    print("wrote", path)
+
+
+async def main():
+    for w, h in ((80, 24), (140, 40)):
+        for v in "ABC":
+            presses = ["]"] * "ABC".index(v)
+            await shot(GraphPrototype(), (w, h), presses,
+                       "screenshots/v%s_%dx%d_range.svg" % (v, w, h))
+    # drill-down detail (variant A) and a mid-range selection (variant B)
+    await shot(GraphPrototype(), (80, 24), ["left", "enter"],
+               "screenshots/vA_80x24_hourly-detail.svg")
+    await shot(GraphPrototype(), (140, 40), ["]", "left", "left"],
+               "screenshots/vB_140x40_selected-gap-day.svg")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

prototype/graph-encoding/run

@@ -0,0 +1,3 @@
+#!/bin/sh
+# PROTOTYPE launcher
+exec python3 "$(dirname "$0")/tui_prototype.py" "$@"

prototype/graph-encoding/tui_prototype.py

@@ -0,0 +1,488 @@
+#!/usr/bin/env python3
+# PROTOTYPE — throwaway. Wayfinder ticket "Choose daily graph encoding and
+# hourly drill-down" on map "Fenris TUI polish and hourly history".
+# Synthetic data only. Not production code; no tests by design.
+#
+# Variants (switch with [ / ]):
+#   A  daily bars        (day -> Enter -> hourly bars -> Esc back)
+#   B  daily candles     (OHLC derived from hourly values, same drill-down)
+#   C  rolling 72-hour strip with day separators (no day level)
+#
+# Encoding contract under test (accepted hourly-history decision):
+#   measured zero = 0 B, distinct from gap (no evidence), distinct from
+#   unallocated usage (measured total, hour attribution unknown).
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+
+from textual import events
+from textual.app import App, ComposeResult
+from textual.binding import Binding
+from textual.containers import Vertical
+from textual.widgets import Static
+
+# ---------------------------------------------------------------------------
+# Synthetic evidence
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class Hour:
+    gb: float = 0.0        # measured bytes written; 0.0 == measured zero
+    coverage: float = 1.0  # share of hour classified known
+
+
+@dataclass
+class Day:
+    hours: list = field(default_factory=list)  # list[Hour | None]; None = gap
+    unallocated: float = 0.0                   # GB measured, attribution unknown
+    elapsed_h: float = 24.0                    # elapsed span (partial < 24)
+    note: str = ""
+    pause: str = ""                            # deliberate-disable band
+
+    @property
+    def evidenced(self):
+        return [h for h in self.hours if h is not None]
+
+    @property
+    def allocated_gb(self):
+        return sum(h.gb for h in self.evidenced)
+
+    @property
+    def gap_hours(self):
+        return sum(1 for h in self.hours if h is None)
+
+
+def _profile(mult=1.0, zero=False):
+    shape = [0.3, 0.2, 0.1, 0.1, 0.2, 0.5, 1.4, 2.6, 3.1, 2.2,
+             1.8, 2.0, 2.4, 3.0, 3.4, 2.8, 2.1, 1.9, 2.3, 1.6,
+             1.1, 0.8, 0.5, 0.4]
+    return [Hour(0.0 if zero else round(v * mult, 2), 1.0) for v in shape]
+
+
+def synth_days(now):
+    """14 local display days ending today (partial). Every ticket state present."""
+    days = []
+    days.append(Day([None] * 24, note="no evidence — before monitoring began"))
+    days.append(Day(_profile(1.0)))
+    g = _profile(0.9)
+    for i in range(10, 16):
+        g[i] = None
+    days.append(Day(g, note="gap 10:00–16:00 (no evidence, not zero)"))
+    days.append(Day(_profile(0.0), note="measured zero day"))
+    days.append(Day(_profile(1.2), unallocated=8.5,
+                    note="8.5 GB unallocated (interval attribution unknown)"))
+    days.append(Day(_profile(4.0), note="heavy write day"))
+    days.append(Day(_profile(0.7),
+                    pause="paused 09:00–11:00 (deliberate disable — excluded)"))
+    days.append(Day(_profile(1.1)))
+    days.append(Day(_profile(0.9)))
+    m = _profile(1.0)
+    m[3] = Hour(0.0, 1.0)
+    m[17] = None
+    days.append(Day(m, note="zero hour 03:00, gap hour 17:00"))
+    days.append(Day(_profile(1.3), unallocated=1.9))
+    days.append(Day(_profile(1.0)))
+    days.append(Day(_profile(0.8)))
+    days.append(Day(_profile(1.5)[:14], elapsed_h=14,
+                    note="today — 14 h elapsed, so far"))
+    assert len(days) == 14
+    return days
+
+
+# ---------------------------------------------------------------------------
+# Rendering (Rich markup into Static)
+# ---------------------------------------------------------------------------
+
+AMBER = "#e0a458"    # default-preset graph colour (approved input)
+UNALLOC = "#8a7f70"  # measured, attribution unknown
+GAP = "#5f6b73"
+ZERO = "#9bb0bf"
+SELECT = "#f2d5a0"
+
+FILL = "█"
+EIGHTHS = " ▁▂▃▄▅▆▇█"
+
+
+def _fmt_gb(v):
+    if v >= 100:
+        return "%d GB" % v
+    return "%s GB" % ("%.1f" % v if v < 10 else "%.0f" % v)
+
+
+def render_days_bars(days, height, sel):
+    """Variant A: one bar per day. Unallocated stacked on top, visually separate."""
+    n = len(days)
+    mx = max((d.allocated_gb + d.unallocated) for d in days) or 1.0
+    grid = [[" "] * n for _ in range(height)]
+    style = [[None] * n for _ in range(height)]
+    for i, d in enumerate(days):
+        if not d.evidenced and not d.unallocated:
+            for r in range(height):
+                grid[r][i], style[r][i] = "·", GAP
+            continue
+        rows = []
+        ua_cells = d.unallocated / mx * height
+        for _ in range(int(ua_cells + 1e-9)):
+            rows.append(("▒", UNALLOC))
+        if ua_cells - int(ua_cells) > 0.12:
+            rows.append((EIGHTHS[int((ua_cells % 1) * 8)], UNALLOC))
+        cells = (d.allocated_gb + d.unallocated) / mx * height
+        for _ in range(int(cells + 1e-9)):
+            rows.append((FILL, AMBER))
+        if cells - int(cells) > 0.12:
+            rows.append((EIGHTHS[int((cells % 1) * 8)], AMBER))
+        if not rows:
+            rows = [("·", ZERO)]
+        rr = height - 1
+        for ch, st in rows:
+            if rr < 0:
+                break
+            grid[rr][i], style[rr][i] = ch, st
+            rr -= 1
+        if d.elapsed_h < 24:
+            rr = height - len(rows)
+            if 0 <= rr < height:
+                grid[rr][i], style[rr][i] = "┄", SELECT
+    lines = []
+    for r in range(height):
+        parts = []
+        for i in range(n):
+            ch, st = grid[r][i], style[r][i]
+            parts.append(ch if st is None else "[%s]%s[/]" % (st, ch))
+            parts.append(" ")
+        lines.append("".join(parts).rstrip())
+    marks = [" "] * (2 * n)
+    marks[2 * sel] = "▼"
+    lines.insert(0, "".join(marks).rstrip())
+    return lines
+
+
+def render_days_candles(days, height, sel):
+    """Variant B: one candle per day. open = first evidenced hour, close = last,
+    high/low = max/min hourly GB. Body solid when close >= open, hollow otherwise;
+    partial day renders dashed. 3-wide slot + 1 space."""
+    n = len(days)
+    stats = []
+    for d in days:
+        ev = [h.gb for h in d.evidenced]
+        stats.append(None if not ev else
+                     dict(open=ev[0], close=ev[-1], hi=max(ev), lo=min(ev)))
+    mx = max((s["hi"] for s in stats if s), default=1.0) or 1.0
+
+    def row(v):
+        return height - 1 - min(int(v / mx * (height - 1)), height - 1)
+
+    cols = []  # per day: list[height] of 3-char cell strings + styles
+    for i, s in enumerate(stats):
+        d = days[i]
+        if s is None:
+            cols.append([("╎╎╎", GAP)] * height)
+            continue
+        top, bot = row(s["hi"]), row(s["lo"])
+        body_hi, body_lo = row(max(s["open"], s["close"])), row(min(s["open"], s["close"]))
+        solid = s["close"] >= s["open"]
+        partial = d.elapsed_h < 24
+        body_fill = "▒" if partial else (FILL if solid else "░")
+        body_st = AMBER if (solid or partial) else GAP
+        col = []
+        for r in range(height):
+            if body_lo <= r <= body_hi:
+                col.append((body_fill * 3, body_st))
+            elif top <= r <= bot:
+                col.append((" │ ", AMBER if solid else GAP))
+            else:
+                col.append(("   ", None))
+        cols.append(col)
+    lines = [(" " * (4 * sel)) + "▼"]
+    for r in range(height):
+        parts = []
+        for i in range(n):
+            cells, st = cols[i][r]
+            parts.append(cells if st is None else "[%s]%s[/]" % (st, cells))
+            parts.append(" ")
+        lines.append("".join(parts).rstrip())
+    return lines
+
+
+def render_hours_bars(day, height, sel):
+    """Day detail: one bar per hour. Gaps never zero."""
+    n = len(day.hours)
+    mx = max([h.gb for h in day.evidenced] + [day.unallocated, 1e-9])
+    grid = [[" "] * n for _ in range(height)]
+    style = [[None] * n for _ in range(height)]
+    for i, h in enumerate(day.hours):
+        if h is None:
+            grid[height - 1][i], style[height - 1][i] = "░", GAP
+            continue
+        if h.gb == 0:
+            grid[height - 1][i], style[height - 1][i] = "·", ZERO
+            continue
+        cells = h.gb / mx * height
+        rr = height - 1
+        for _ in range(int(cells + 1e-9)):
+            if rr < 0:
+                break
+            grid[rr][i], style[rr][i] = FILL, AMBER
+            rr -= 1
+        if cells % 1 > 0.12 and rr >= 0:
+            grid[rr][i], style[rr][i] = EIGHTHS[int((cells % 1) * 8)], AMBER
+    lines = []
+    for r in range(height):
+        parts = []
+        for i in range(n):
+            ch, st = grid[r][i], style[r][i]
+            parts.append(ch if st is None else "[%s]%s[/]" % (st, ch))
+        lines.append("".join(parts).rstrip())
+    marks = [" "] * n
+    marks[sel % n] = "▼"
+    lines.insert(0, "".join(marks).rstrip())
+    return lines
+
+
+def render_strip(days, height, sel):
+    """Variant C: rolling hourly strip, last 72 h, day separators."""
+    flat = []  # (day_idx, hour_idx, Hour|None|'future')
+    for di, d in enumerate(days[-4:]):
+        real = len(days) - 4 + di
+        for hi in range(24):
+            h = d.hours[hi] if hi < len(d.hours) else "future"
+            flat.append((real, hi, h))
+    flat = flat[-72:]
+    mx = max([f[2].gb for f in flat if f[2] not in (None, "future")] + [1e-9])
+    cols = []
+    for _, _, h in flat:
+        col = [(" ", None)] * height
+        if h == "future":
+            col[height - 1] = ("·", None)
+        elif h is None:
+            col[height - 1] = ("░", GAP)
+        elif h.gb == 0:
+            col[height - 1] = ("·", ZERO)
+        else:
+            cells = h.gb / mx * height
+            rr = height - 1
+            for _ in range(int(cells + 1e-9)):
+                if rr < 0:
+                    break
+                col[rr] = (FILL, AMBER)
+                rr -= 1
+            if cells % 1 > 0.12 and rr >= 0:
+                col[rr] = (EIGHTHS[int((cells % 1) * 8)], AMBER)
+        cols.append(col)
+    lines = []
+    for r in range(height):
+        parts = []
+        prev = None
+        for i, f in enumerate(flat):
+            if prev is not None and f[0] != prev:
+                parts.append("[%s]│[/]" % SELECT)
+            prev = f[0]
+            ch, st = cols[i][r]
+            parts.append(ch if st is None else "[%s]%s[/]" % (st, ch))
+        lines.append("".join(parts).rstrip())
+    marks = []
+    prev = None
+    for i, f in enumerate(flat):
+        if prev is not None and f[0] != prev:
+            marks.append(" ")
+        prev = f[0]
+        marks.append("▼" if i == sel else " ")
+    lines.insert(0, "".join(marks).rstrip())
+    return lines, flat
+
+
+# ---------------------------------------------------------------------------
+# App
+# ---------------------------------------------------------------------------
+
+VARIANT_NAMES = {"A": "Daily bars", "B": "Daily candles", "C": "Rolling 72 h strip"}
+GH = 10  # graph rows
+
+
+class GraphPrototype(App):
+    TITLE = "PROTOTYPE — usage-history graph encoding"
+    CSS = """
+    #col { height: 100%; }
+    #hdr  { height: 2; color: $text-muted; }
+    #graph { height: auto; padding: 0 1; }
+    #readout { height: auto; padding: 0 1; }
+    #legend { height: 3; padding: 0 1; color: $text-muted; }
+    #footer { dock: bottom; height: 2; background: $panel; padding: 0 1; }
+    """
+    BINDINGS = [
+        Binding("[", "prev_variant", "variant ←"),
+        Binding("]", "next_variant", "variant →"),
+        Binding("left", "left", "←"),
+        Binding("right", "right", "→"),
+        Binding("enter", "drill", "open"),
+        Binding("escape,backspace", "back", "back"),
+        Binding("q", "quit", "quit"),
+    ]
+
+    def __init__(self):
+        super().__init__()
+        self.now = datetime.now().astimezone()
+        self.days = synth_days(self.now)
+        self.variant = "A"
+        self.view = "days"  # days | hours (A/B); strip (C)
+        self.sel_day = len(self.days) - 1
+        self.sel_hour = 13
+        self.sel_strip = 71
+
+    def day_label(self, i):
+        d = (self.now - timedelta(days=len(self.days) - 1 - i)).date()
+        return d, d.strftime("%a %d %b")
+
+    def tz_label(self):
+        off = self.now.strftime("%z")
+        return "Local · UTC%s · %s" % (off[:3] + ":" + off[3:], time.tzname[0])
+
+    def day_readout(self, d, i):
+        _, lab = self.day_label(i)
+        if not d.evidenced and not d.unallocated:
+            return "%s — no evidence (not zero): %s" % (lab, d.note or "")
+        bits = ["%s — %s written" % (lab, _fmt_gb(d.allocated_gb))]
+        span = 24 if d.elapsed_h == 24 else len(d.hours)
+        bits.append("%d/%d h evidenced" % (span - d.gap_hours, span))
+        if d.unallocated:
+            bits.append("+ %s unallocated" % _fmt_gb(d.unallocated))
+        if d.elapsed_h < 24:
+            bits.append("partial · %d h elapsed · so far" % int(d.elapsed_h))
+        cov = sum(h.coverage for h in d.evidenced) / max(len(d.hours), 1)
+        bits.append("coverage %.0f%%" % (100 * cov))
+        txt = " · ".join(bits)
+        if d.note:
+            txt += "  — %s" % d.note
+        if d.pause:
+            txt += "  — %s" % d.pause
+        return txt
+
+    def compose(self) -> ComposeResult:
+        with Vertical(id="col"):
+            yield Static("", id="hdr")
+            yield Static("", id="graph")
+            yield Static("", id="readout")
+            yield Static("", id="legend")
+            yield Static("", id="footer")
+
+    def on_mount(self) -> None:
+        self.refresh_all()
+
+    def refresh_all(self):
+        self.query_one("#hdr", Static).update(
+            "🐺 Fenris · usage history · %s · writes per hour" % self.tz_label())
+        g = self.query_one("#graph", Static)
+        ro = self.query_one("#readout", Static)
+        if self.view == "hours":
+            d = self.days[self.sel_day]
+            lines = render_hours_bars(d, GH, self.sel_hour)
+            lines.append("".join(("%02d" % i) if i % 3 == 0 else "  " for i in range(len(d.hours))))
+            lines.append(" midnight → 23:00 local")
+            g.update("\n".join(lines))
+            h = d.hours[self.sel_hour]
+            if h is None:
+                dtxt = "hour %02d:00 — no evidence (not zero)" % self.sel_hour
+            elif h.gb == 0:
+                dtxt = "hour %02d:00 — 0 B measured" % self.sel_hour
+            else:
+                dtxt = "hour %02d:00 — %s written · coverage %.0f%%" % (
+                    self.sel_hour, _fmt_gb(h.gb), 100 * h.coverage)
+            _, lab = self.day_label(self.sel_day)
+            extra = ""
+            if d.unallocated:
+                extra = "  · %s unallocated (shown separately, never spread into hours)" % _fmt_gb(d.unallocated)
+            ro.update("%s ▸ %s%s" % (lab, dtxt, extra))
+        elif self.variant in ("A", "B"):
+            lines = (render_days_bars(self.days, GH, self.sel_day) if self.variant == "A"
+                     else render_days_candles(self.days, GH, self.sel_day))
+            _, last = self.day_label(len(self.days) - 1)
+            lines.append(" " + " ".join(
+                self.day_label(i)[1].split()[1] for i in range(len(self.days))))
+            g.update("\n".join(lines))
+            ro.update(self.day_readout(self.days[self.sel_day], self.sel_day))
+        else:
+            lines, flat = render_strip(self.days, GH, self.sel_strip)
+            g.update("\n".join(lines))
+            txt = ""
+            if 0 <= self.sel_strip < len(flat):
+                di, hi, h = flat[self.sel_strip]
+                _, lab = self.day_label(di)
+                if h == "future":
+                    txt = "future — not counted"
+                elif h is None:
+                    txt = "no evidence (not zero)"
+                elif h.gb == 0:
+                    txt = "0 B measured"
+                else:
+                    txt = "%s written · coverage %.0f%%" % (_fmt_gb(h.gb), 100 * h.coverage)
+                ro.update("%s %02d:00 — %s" % (lab, hi, txt))
+        self.query_one("#legend", Static).update(
+            "legend:  [%(a)s]█ allocated[/]  [%(u)s]▒ unallocated (attribution unknown)[/]  "
+            "[%(g)s]░ gap · no evidence — never zero[/]  [%(z)s]· measured 0 B[/]  "
+            "[%(s)s]┄ partial day (so far)[/]" % dict(a=AMBER, u=UNALLOC, g=GAP, z=ZERO, s=SELECT))
+        v = "%s: %s" % (self.variant, VARIANT_NAMES[self.variant])
+        mode = "hourly strip" if self.variant == "C" else (
+            "day detail" if self.view == "hours" else "range view")
+        self.query_one("#footer", Static).update(
+            "PROTOTYPE ▸ %s ▸ %s    [ / ] variant · ←/→ select · Enter open · Esc back · click" % (v, mode))
+
+    def action_prev_variant(self):
+        order = "ABC"
+        self.variant = order[(order.index(self.variant) - 1) % 3]
+        self.view = "strip" if self.variant == "C" else "days"
+        self.refresh_all()
+
+    def action_next_variant(self):
+        order = "ABC"
+        self.variant = order[(order.index(self.variant) + 1) % 3]
+        self.view = "strip" if self.variant == "C" else "days"
+        self.refresh_all()
+
+    def action_left(self):
+        if self.view == "hours":
+            self.sel_hour = max(0, self.sel_hour - 1)
+        elif self.variant == "C":
+            self.sel_strip = max(0, self.sel_strip - 1)
+        else:
+            self.sel_day = max(0, self.sel_day - 1)
+        self.refresh_all()
+
+    def action_right(self):
+        if self.view == "hours":
+            self.sel_hour = min(23, self.sel_hour + 1)
+        elif self.variant == "C":
+            self.sel_strip = min(71, self.sel_strip + 1)
+        else:
+            self.sel_day = min(len(self.days) - 1, self.sel_day + 1)
+        self.refresh_all()
+
+    def action_drill(self):
+        if self.variant in ("A", "B") and self.view == "days":
+            self.view = "hours"
+            self.sel_hour = 13
+            self.refresh_all()
+
+    def action_back(self):
+        if self.view == "hours":
+            self.view = "days"
+            self.refresh_all()
+
+    def on_click(self, event: events.Click) -> None:
+        w = event.widget
+        if w is None or w.id != "graph":
+            return
+        x = event.x
+        if self.view == "hours":
+            self.sel_hour = max(0, min(23, x))
+        elif self.variant == "C":
+            self.sel_strip = max(0, min(71, x))
+        else:
+            self.sel_day = max(0, min(len(self.days) - 1, x // 2))
+        self.refresh_all()
+
+
+if __name__ == "__main__":
+    GraphPrototype().run()

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fenris"
-version = "0.3.2"
+version = "0.3.4"
 description = "NVMe wear monitor with persistent TUI"
 requires-python = ">=3.9"
 dependencies = [

scripts/extract_changelog.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Extract one validated Keep a Changelog version section."""
+from __future__ import annotations
+
+import argparse
+from datetime import date
+from pathlib import Path
+import re
+import sys
+
+
+class ChangelogError(ValueError):
+    """A release cannot safely use the supplied changelog."""
+
+
+_SEMVER = r"(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)"
+_VERSION_HEADING = re.compile(
+    rf"^## \[(?P<version>{_SEMVER})\] - (?P<date>.+)$", re.MULTILINE
+)
+
+
+def extract_version_section(changelog: str, version: str) -> str:
+    """Return *version*'s changelog section without altering its bytes.
+
+    The section ends immediately before the next level-two heading.  A release
+    cannot use an absent, empty, or malformed version section.
+    """
+    if not re.fullmatch(_SEMVER, version):
+        raise ChangelogError(f"requested version is not bare semver: {version!r}")
+
+    heading = next(
+        (match for match in _VERSION_HEADING.finditer(changelog)
+         if match.group("version") == version),
+        None,
+    )
+    if heading is None:
+        if re.search(rf"^## \[{re.escape(version)}\].*$", changelog, re.MULTILINE):
+            raise ChangelogError(f"version {version} has a malformed heading or date")
+        raise ChangelogError(f"version {version} is missing from the changelog")
+
+    heading_date = heading.group("date")
+    if not re.fullmatch(r"\d{4}-\d{2}-\d{2}", heading_date):
+        raise ChangelogError(f"version {version} has a malformed release date")
+    try:
+        date.fromisoformat(heading_date)
+    except ValueError as error:
+        raise ChangelogError(f"version {version} has a malformed release date") from error
+
+    next_heading = re.search(r"^## ", changelog[heading.end():], re.MULTILINE)
+    section_end = heading.end() + next_heading.start() if next_heading else len(changelog)
+    section = changelog[heading.start():section_end]
+    if not re.search(r"^- \S", section[heading.end() - heading.start():], re.MULTILINE):
+        raise ChangelogError(f"version {version} has an empty changelog section")
+    return section
+
+
+def extract_changelog(path: Path, version: str) -> str:
+    """Read and extract a requested version from a changelog file."""
+    try:
+        return extract_version_section(path.read_text(encoding="utf-8"), version)
+    except OSError as error:
+        raise ChangelogError(f"cannot read changelog {path}: {error.strerror}") from error
+
+
+def assemble_release_body(section: str, footer: str) -> str:
+    """Append standing guidance while preserving the extracted section verbatim."""
+    separator = "\n" if section.endswith("\n") else "\n\n"
+    return f"{section}{separator}{footer}"
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("changelog", type=Path)
+    parser.add_argument("version")
+    parser.add_argument(
+        "--footer",
+        type=Path,
+        help="append this standing release guidance after the extracted section",
+    )
+    args = parser.parse_args(argv)
+    try:
+        section = extract_changelog(args.changelog, args.version)
+        if args.footer:
+            try:
+                footer = args.footer.read_text(encoding="utf-8")
+            except OSError as error:
+                raise ChangelogError(
+                    f"cannot read release footer {args.footer}: {error.strerror}"
+                ) from error
+            section = assemble_release_body(section, footer)
+        sys.stdout.write(section)
+    except ChangelogError as error:
+        print(f"::error::{error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/release_request.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Describe the Gitea request that creates or resynchronizes a release."""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import re
+import sys
+from typing import Any
+
+
+_SEMVER = r"(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)"
+
+
+class ReleaseRequestError(ValueError):
+    """A release request could not be prepared safely."""
+
+
+def build_release_request(
+    version: str, body: str, existing_release: dict[str, Any] | None
+) -> dict[str, Any]:
+    """Return the observable POST or PATCH request for a Gitea release."""
+    if not re.fullmatch(_SEMVER, version):
+        raise ReleaseRequestError(f"version is not bare semver: {version!r}")
+    if existing_release is None:
+        return {
+            "method": "POST",
+            "path": "/releases",
+            "payload": {"tag_name": f"v{version}", "name": f"v{version}", "body": body},
+        }
+
+    release_id = existing_release.get("id")
+    if not isinstance(release_id, int):
+        raise ReleaseRequestError("existing release does not contain an integer id")
+    return {
+        "method": "PATCH",
+        "path": f"/releases/{release_id}",
+        "payload": {"body": body},
+    }
+
+
+def _read_json(path: Path) -> dict[str, Any]:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as error:
+        raise ReleaseRequestError(f"cannot read existing release {path}: {error}") from error
+    if not isinstance(value, dict):
+        raise ReleaseRequestError("existing release must be a JSON object")
+    return value
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--version", required=True)
+    parser.add_argument("--body-file", type=Path, required=True)
+    parser.add_argument("--existing-release", type=Path)
+    args = parser.parse_args(argv)
+    try:
+        body = args.body_file.read_text(encoding="utf-8")
+        existing = _read_json(args.existing_release) if args.existing_release else None
+        print(json.dumps(build_release_request(args.version, body, existing)))
+    except (OSError, ReleaseRequestError) as error:
+        print(f"::error::{error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

src/fenris/status.py

@@ -88,7 +88,13 @@ def open_store_readonly(store_path: Path) -> sqlite3.Connection:
 
     Raises StoreFault if unreadable, NewerSchema if user_version > SCHEMA_VERSION.
     """
-    if not store_path.exists():
+    try:
+        exists = store_path.exists()
+    except OSError as e:
+        # A non-group user stat()ing a 2750 store directory gets
+        # PermissionError before any StoreFault can be raised (issue #54).
+        raise StoreFault("observation store not readable: %s" % e)
+    if not exists:
         raise StoreFault("observation store not found at %s" % store_path)
 
     try:
@@ -443,7 +449,7 @@ def _format_headline(proj) -> str:
 
 
 def _append_service_facts(lines: List[str], service: Dict[str, Any]) -> None:
-    """Append the four separate service facts (§7.3, LC-9)."""
+    """Append service facts and dashboard-clarity monitoring state."""
     boot = "enabled" if service.get("boot_enabled") else "disabled"
     activity = "active" if service.get("timer_active") else "inactive"
 
@@ -467,6 +473,55 @@ def _append_service_facts(lines: List[str], service: Dict[str, Any]) -> None:
 
     lines.append("boot: %s · timer: %s · last collect: %s%s · freshness: %s%s"
                  % (boot, activity, collect, collect_age, freshness_str, freshness_age))
+    lines.append("CONTINUITY: %s" % monitoring_continuity(service))
+    if service.get("deliberately_paused"):
+        lines.extend(deliberate_pause_lines())
+
+
+# ---------------------------------------------------------------------------
+# Dashboard clarity parity wording (DC-2, DC-3)
+# ---------------------------------------------------------------------------
+
+_CONTINUITY_ACTIVE = "monitoring: active in background · persists across reboots"
+_CONTINUITY_DISABLED = "monitoring: does not start on next boot"
+_PAUSED_TITLE = "monitoring: paused — deliberate disable"
+_PAUSED_CONSEQUENCE = (
+    "paused time is excluded from your usage habit · resume: fenris monitor resume"
+)
+
+
+def monitoring_continuity(service: Dict[str, Any]) -> str:
+    """Return the boot-persistence wording, independent of timer runtime."""
+    return _CONTINUITY_ACTIVE if service.get("boot_enabled") else _CONTINUITY_DISABLED
+
+
+def deliberate_pause_lines() -> List[str]:
+    """Return the exact CLI/TUI presentation for a sanctioned pause."""
+    return [_PAUSED_TITLE, _PAUSED_CONSEQUENCE]
+
+
+def is_deliberately_paused(conn: sqlite3.Connection, service: Dict[str, Any]) -> bool:
+    """Whether the latest closed period was ended by Fenris's own pause path.
+
+    Raw systemd operations have no `user_disabled` row, so they must never be
+    presented as a Deliberate disable. A live enabled timer also wins over a
+    stale period marker, keeping the presentation consistent with service facts.
+    """
+    if service.get("boot_enabled") or service.get("timer_active"):
+        return False
+
+    open_period = conn.execute(
+        "SELECT 1 FROM monitoring_periods WHERE ended_at IS NULL LIMIT 1"
+    ).fetchone()
+    if open_period is not None:
+        return False
+
+    row = conn.execute(
+        "SELECT end_cause FROM monitoring_periods "
+        "WHERE ended_at IS NOT NULL "
+        "ORDER BY ended_at DESC, id DESC LIMIT 1"
+    ).fetchone()
+    return row is not None and row[0] == "user_disabled"
 
 
 def format_disclosures() -> str:
@@ -556,6 +611,10 @@ def get_status(store_path: Optional[Path] = None, clock_now: Optional[datetime]
 
     service["freshness"] = freshness
     service["freshness_age_s"] = freshness_age_s
+    try:
+        service["deliberately_paused"] = is_deliberately_paused(conn, service)
+    except sqlite3.Error:
+        service["deliberately_paused"] = False
 
     # --- Drive anomalies (§9.7, FL-7) ---
     drive_facts = []

src/fenris/store.py

@@ -37,10 +37,24 @@ def init_store(store_path: Path) -> sqlite3.Connection:
     Returns a connection to the store.
     """
     conn = sqlite3.connect(str(store_path))
-    
+
     # Enable WAL mode for concurrent reads during writes
     conn.execute("PRAGMA journal_mode=WAL")
-    
+
+    # Group members (fenris group) read the live store read-only, but SQLite
+    # in WAL mode needs write access to the db and its -wal/-shm sidecars even
+    # for readers. Best effort: root-created stores stay group-accessible
+    # without relying on the creating process's umask (issue #54).
+    import os as _os
+    for sidecar in (store_path,
+                    store_path.with_name(store_path.name + "-wal"),
+                    store_path.with_name(store_path.name + "-shm")):
+        try:
+            mode = _os.stat(sidecar).st_mode & 0o777
+            _os.chmod(sidecar, mode | 0o060)
+        except OSError:
+            pass
+
     # Check if this is a new database
     cursor = conn.execute("PRAGMA user_version")
     current_version = cursor.fetchone()[0]

src/fenris/tui.py

@@ -23,7 +23,7 @@ from typing import Any, Dict, List, Optional
 
 from textual.app import App, ComposeResult
 from textual.binding import Binding
-from textual.containers import Horizontal, Vertical
+from textual.containers import Container, Horizontal, VerticalScroll
 from textual.screen import ModalScreen
 from textual.widgets import Static
 
@@ -43,6 +43,9 @@ from .status import (
     format_disclosures,
     freshness_age_human,
     grade_freshness,
+    deliberate_pause_lines,
+    is_deliberately_paused,
+    monitoring_continuity,
     open_store_readonly,
     query_service_state,
     read_config,
@@ -229,6 +232,7 @@ def _query_service_facts(conn: sqlite3.Connection, clock_now: datetime) -> Dict[
         "freshness": freshness,
         "freshness_age_s": None,
         "period": period_info,
+        "deliberately_paused": is_deliberately_paused(conn, svc),
         **svc,
     }
 
@@ -286,20 +290,38 @@ class DisclosuresScreen(ModalScreen[None]):
 class FenrisTuiApp(App):
     """Fenris Panes TUI — keyboard-first, one dense screen (spec §7)."""
 
-    TITLE = "Fenris"
-    SUB_TITLE = "NVMe endurance monitor"
+    TITLE = "Fenris — NVMe endurance monitor"
+    SUB_TITLE = ""
 
     CSS = """
     #main-grid {
         layout: grid;
-        grid-size: 2 3;
+        grid-size: 2 4;
         grid-columns: 3fr 2fr;
-        grid-rows: 8 1fr 7;
-        height: 1fr;
+        grid-rows: 8 10 7 3;
+        height: auto;
     }
+    #main-grid.paused {
+        grid-size: 2 5;
+        grid-rows: 8 5 10 7 3;
+    }
+    #dashboard-scroll { height: 1fr; }
     #headline-band { column-span: 2; }
-    #service-strip { column-span: 2; }
-    .pane { border: round #555555; padding: 0 1; }
+    #paused-banner {
+        column-span: 2;
+        display: none;
+        background: $error 20%;
+        color: $text;
+        height: 100%;
+    }
+    #service-strip { column-span: 2; height: 100%; }
+    #quit-rail {
+        column-span: 2;
+        border: heavy $accent;
+        content-align: center middle;
+        height: 100%;
+    }
+    .pane { border: round #555555; padding: 0 1; height: 100%; }
     #confirm-text { padding: 1 2; }
     #disc-text { padding: 1 2; }
     """
@@ -317,21 +339,27 @@ class FenrisTuiApp(App):
         store_path: Optional[Path] = None,
         config_path: Optional[Path] = None,
         helper_path: Optional[str] = None,
+        refresh_interval_s: float = CADENCE_DEFAULT_S,
         **kwargs,
     ) -> None:
         super().__init__(**kwargs)
         self.store_path = store_path or Path("/var/lib/fenris/observations.db")
         self.config_path = config_path
         self.helper_path = helper_path or "/usr/libexec/fenris/fenris-monitor"
+        self.refresh_interval_s = refresh_interval_s
+        self._show_auth_notice = True
         self._conn: Optional[sqlite3.Connection] = None
         self._clock_now = datetime.now(timezone.utc)
 
     def compose(self) -> ComposeResult:
-        with Vertical(id="main-grid"):
-            yield Static("", id="headline-band", classes="pane")
-            yield Static("", id="usage-history", classes="pane")
-            yield Static("", id="drive-health", classes="pane")
-            yield Static("", id="service-strip", classes="pane")
+        with VerticalScroll(id="dashboard-scroll"):
+            with Container(id="main-grid"):
+                yield Static("", id="headline-band", classes="pane")
+                yield Static("", id="paused-banner")
+                yield Static("", id="usage-history", classes="pane")
+                yield Static("", id="drive-health", classes="pane")
+                yield Static("", id="service-strip", classes="pane")
+                yield Static("q QUIT TUI", id="quit-rail")
 
     def on_mount(self) -> None:
         """Set border titles and render initial state."""
@@ -339,8 +367,30 @@ class FenrisTuiApp(App):
         self.query_one("#usage-history").border_title = "usage history"
         self.query_one("#drive-health").border_title = "drive"
         self.query_one("#service-strip").border_title = "service + actions"
+        self._refresh_timer = self.set_interval(
+            self.refresh_interval_s, self.on_refresh_tick
+        )
         self._refresh()
 
+    def on_refresh_tick(self) -> None:
+        """Refresh dashboard and dismiss launch-only authentication guidance."""
+        self._show_auth_notice = False
+        self._refresh()
+
+    def _headline_prefix(self) -> str:
+        """Render identity and any launch-only guidance above drive state."""
+        lines = ["[bold]Fenris — NVMe endurance monitor[/bold]"]
+        if self._show_auth_notice:
+            lines.append("[dim]privileged actions will prompt for authentication (polkit)[/dim]")
+        return "\n".join(lines)
+
+    def _render_headline(self, body: str = "") -> None:
+        """Render full-width identity, guidance, and current drive state."""
+        text = self._headline_prefix()
+        if body:
+            text += "\n\n" + body
+        self.query_one("#headline-band").update(text)
+
     def _open_store(self) -> Optional[sqlite3.Connection]:
         """Open store read-only, handling faults."""
         try:
@@ -366,28 +416,33 @@ class FenrisTuiApp(App):
 
     def _render_empty_or_fault(self) -> None:
         """Render empty store greeting or store fault."""
+        self._hide_paused_banner()
         if not self.store_path.exists():
             # Empty store — greeting with enable hint (IN-3)
-            self.query_one("#headline-band").update(
+            self._render_headline(
                 "[bold]No observations yet[/bold]\n\n"
                 "Enable monitoring: fenris monitor resume"
             )
             self.query_one("#usage-history").update("")
             self.query_one("#drive-health").update("")
             self.query_one("#service-strip").update(
-                "boot: disabled · timer: inactive · last collect: unknown · freshness: empty\n"
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "boot: disabled · timer: inactive · last collect: unknown · freshness: empty · "
+                "[dim]by Bongbetic[/dim]\n"
+                "[bold]CONTINUITY[/bold]  %s\n"
+                "p pause · r resume · c collect · d disclosures"
+                % monitoring_continuity({"boot_enabled": False})
             )
         else:
             # Store fault (FL-4)
-            self.query_one("#headline-band").update(
+            self._render_headline(
                 "[bold red]Observation store unreadable[/bold red]\n"
                 "Check journalctl -u fenris-collect.service"
             )
             self.query_one("#usage-history").update("")
             self.query_one("#drive-health").update("")
             self.query_one("#service-strip").update(
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "[dim]by Bongbetic[/dim]\n"
+                "p pause · r resume · c collect · d disclosures"
             )
 
     def _render_all_regions(self, conn: sqlite3.Connection) -> None:
@@ -398,13 +453,9 @@ class FenrisTuiApp(App):
             headline = self._format_headline(proj)
             confidence = self._format_confidence(proj)
             scenario = self._format_scenario(proj)
-            self.query_one("#headline-band").update(
-                headline + "\n" + confidence + "\n" + scenario
-            )
+            self._render_headline(headline + "\n" + confidence + "\n" + scenario)
         except Exception:
-            self.query_one("#headline-band").update(
-                "[bold]No projection available[/bold]"
-            )
+            self._render_headline("[bold]No projection available[/bold]")
 
         # --- Usage-history pane (§7.2 left) ---
         history = _query_usage_history(conn)
@@ -448,17 +499,47 @@ class FenrisTuiApp(App):
             collect = "ok" if svc.get("last_collect_ok") else "FAILED"
             freshness = svc.get("freshness", "unknown")
             self.query_one("#service-strip").update(
-                "boot: %s · timer: %s · last collect: %s · freshness: %s\n"
+                "boot: %s · timer: %s · last collect: %s · freshness: %s · "
+                "[dim]by Bongbetic[/dim]\n"
+                "[bold]CONTINUITY[/bold]  %s\n"
                 "%s\n"
-                "p pause · r resume · c collect · d disclosures · q quit"
-                % (boot, activity, collect, freshness, svc.get("period", ""))
+                "p pause · r resume · c collect · d disclosures"
+                % (
+                    boot, activity, collect, freshness,
+                    monitoring_continuity(svc), svc.get("period", ""),
+                )
             )
+            self._render_paused_banner(svc)
         except Exception:
+            self._hide_paused_banner()
             self.query_one("#service-strip").update(
-                "boot: unknown · timer: unknown · last collect: unknown · freshness: unknown\n"
-                "p pause · r resume · c collect · d disclosures · q quit"
+                "boot: unknown · timer: unknown · last collect: unknown · freshness: unknown · "
+                "[dim]by Bongbetic[/dim]\n"
+                "p pause · r resume · c collect · d disclosures"
             )
 
+    def _render_paused_banner(self, service: Dict[str, Any]) -> None:
+        """Show the high-contrast Deliberate disable block only when sanctioned."""
+        banner = self.query_one("#paused-banner")
+        if service.get("deliberately_paused"):
+            banner.update(
+                "[bold black on red]%s[/bold black on red]\n%s"
+                % tuple(deliberate_pause_lines())
+            )
+            banner.styles.display = "block"
+            main_grid = self.query_one("#main-grid")
+            main_grid.add_class("paused")
+            main_grid.refresh(layout=True)
+        else:
+            self._hide_paused_banner()
+
+    def _hide_paused_banner(self) -> None:
+        """Ensure an unavailable store cannot retain a stale paused presentation."""
+        self.query_one("#paused-banner").styles.display = "none"
+        main_grid = self.query_one("#main-grid")
+        main_grid.remove_class("paused")
+        main_grid.refresh(layout=True)
+
     def _format_headline(self, proj: ProjectionResult) -> str:
         """Format the lifespan headline (spec §6.11)."""
         if proj.headline_remaining_seconds is None:

tests/test_acceptance_sweep.py

@@ -399,6 +399,89 @@ class TestCI2Parity:
         assert "last collect:" in status
         assert "freshness:" in status
 
+    def test_dashboard_clarity_parity_strings_have_one_status_source(self):
+        """DC-2/DC-3 wording originates in status and the TUI imports it."""
+        status_src = (FENRIS_PKG / "status.py").read_text()
+        tui_src = (FENRIS_PKG / "tui.py").read_text()
+        for wording in (
+            "monitoring: active in background · persists across reboots",
+            "monitoring: does not start on next boot",
+            "monitoring: paused — deliberate disable",
+            "paused time is excluded from your usage habit · resume: fenris monitor resume",
+        ):
+            assert status_src.count(wording) == 1
+            assert wording not in tui_src
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize(
+        ("state", "service", "expected_lines"),
+        [
+            (
+                "active_enabled",
+                {"boot_enabled": True, "timer_active": True},
+                ["monitoring: active in background · persists across reboots"],
+            ),
+            (
+                "boot_disabled",
+                {"boot_enabled": False, "timer_active": False},
+                ["monitoring: does not start on next boot"],
+            ),
+            (
+                "deliberately_paused",
+                {"boot_enabled": False, "timer_active": False},
+                [
+                    "monitoring: does not start on next boot",
+                    "monitoring: paused — deliberate disable",
+                    "paused time is excluded from your usage habit · resume: fenris monitor resume",
+                ],
+            ),
+        ],
+    )
+    async def test_dashboard_clarity_monitoring_lines_match_both_views(
+        self, tmp_path, state, service, expected_lines
+    ):
+        """CI-2 synthetic-store sweep covers active, disabled, and paused states."""
+        db = tmp_path / (state + ".db")
+        conn = init_store(db)
+        if state == "active_enabled":
+            ensure_period_open(conn, _clock())
+        elif state == "deliberately_paused":
+            conn.execute(
+                "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
+                "VALUES (?, ?, ?)",
+                ("2026-09-30T09:00:00+00:00", "2026-09-30T10:00:00+00:00", "user_disabled"),
+            )
+            conn.commit()
+        conn.close()
+        service_state = {
+            **service,
+            "last_collect_ok": None,
+            "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }
+
+        with patch("fenris.status.query_service_state", return_value=service_state), patch(
+            "fenris.tui.query_service_state", return_value=service_state
+        ):
+            status = get_status(
+                store_path=db, clock_now=_clock(), query_services=True, query_journal=False
+            ).lower()
+            app = FenrisTuiApp(store_path=db)
+            async with app.run_test(size=(100, 40)):
+                tui_text = "\n".join(
+                    (
+                        str(app.query_one("#service-strip").render()),
+                        str(app.query_one("#paused-banner").render()),
+                    )
+                ).lower()
+
+        for expected in expected_lines:
+            assert expected in status
+            assert expected in tui_text
+        if state != "deliberately_paused":
+            assert "monitoring: paused — deliberate disable" not in status
+            assert "monitoring: paused — deliberate disable" not in tui_text
+
     def test_pause_resume_action_names(self):
         tui_keys = {b.key for b in FenrisTuiApp.BINDINGS}
         assert "p" in tui_keys

tests/test_changelog.py

@@ -0,0 +1,211 @@
+"""Release-note changelog extraction tests (DC-6, DC-7)."""
+import importlib.util
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+EXTRACTOR_PATH = REPO_ROOT / "scripts" / "extract_changelog.py"
+RELEASE_REQUEST_PATH = REPO_ROOT / "scripts" / "release_request.py"
+CHANGELOG_PATH = REPO_ROOT / "CHANGELOG.md"
+
+
+def _extractor_module():
+    spec = importlib.util.spec_from_file_location("extract_changelog", EXTRACTOR_PATH)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_extracts_the_requested_version_section_verbatim():
+    extractor = _extractor_module()
+    changelog = """# Changelog
+
+## [Unreleased]
+
+## [1.4.0] - 2026-09-10
+
+### Added
+
+- Show a release summary to consumers.
+
+## [1.3.0] - 2026-09-01
+
+### Fixed
+
+- Preserve the observation history during upgrades.
+"""
+    expected = """## [1.4.0] - 2026-09-10
+
+### Added
+
+- Show a release summary to consumers.
+
+"""
+
+    assert extractor.extract_version_section(changelog, "1.4.0") == expected
+
+
+def test_checked_in_changelog_keeps_unreleased_first_and_categories_limited():
+    lines = CHANGELOG_PATH.read_text(encoding="utf-8").splitlines()
+    unreleased = lines.index("## [Unreleased]")
+    version_headings = [
+        index for index, line in enumerate(lines)
+        if line.startswith("## [") and line != "## [Unreleased]"
+    ]
+    first_version = version_headings[0] if version_headings else len(lines)
+    categories = [
+        line.removeprefix("### ")
+        for line in lines[unreleased + 1:first_version]
+        if line.startswith("### ")
+    ]
+
+    assert unreleased < first_version
+    assert set(categories) <= {"Added", "Changed", "Fixed"}
+
+
+def test_release_footer_verifies_the_clearsigned_checksum_asset():
+    footer = (REPO_ROOT / "packaging" / "release-footer.md").read_text(
+        encoding="utf-8"
+    )
+
+    assert "gpg --output SHA256SUMS --decrypt SHA256SUMS.asc" in footer
+    assert "sha256sum -c SHA256SUMS" in footer
+
+
+@pytest.mark.parametrize(
+    ("changelog", "expected_error"),
+    [
+        ("# Changelog\n\n## [Unreleased]\n", "missing"),
+        (
+            "# Changelog\n\n## [Unreleased]\n\n## [1.4.0] - 2026-09-10\n",
+            "empty",
+        ),
+        (
+            "# Changelog\n\n## [Unreleased]\n\n## [1.4.0] - 2026-02-30\n\n- Add a note.\n",
+            "malformed release date",
+        ),
+    ],
+)
+def test_fails_closed_for_missing_empty_or_malformed_sections(
+    changelog, expected_error
+):
+    extractor = _extractor_module()
+
+    with pytest.raises(extractor.ChangelogError, match=expected_error):
+        extractor.extract_version_section(changelog, "1.4.0")
+
+
+def test_command_emits_a_workflow_error_and_nonzero_status(tmp_path):
+    changelog = tmp_path / "CHANGELOG.md"
+    changelog.write_text("# Changelog\n\n## [Unreleased]\n", encoding="utf-8")
+
+    result = subprocess.run(
+        [sys.executable, str(EXTRACTOR_PATH), str(changelog), "1.4.0"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    assert result.returncode != 0
+    assert result.stderr.startswith("::error::")
+    assert "missing" in result.stderr
+
+
+def test_assembles_a_release_body_without_changing_the_section():
+    extractor = _extractor_module()
+    section = "## [1.4.0] - 2026-09-10\n\n### Added\n\n- Show a release summary.\n"
+    footer = "## Install\n\nUse the package channel.\n"
+
+    assert extractor.assemble_release_body(section, footer) == (
+        section + "\n" + footer
+    )
+
+
+def test_command_can_write_the_complete_release_body(tmp_path):
+    changelog = tmp_path / "CHANGELOG.md"
+    changelog.write_text(
+        "# Changelog\n\n## [Unreleased]\n\n## [1.4.0] - 2026-09-10\n\n"
+        "### Added\n\n- Show a release summary.\n",
+        encoding="utf-8",
+    )
+    footer = tmp_path / "footer.md"
+    footer.write_text("## Install\n\nUse the package channel.\n", encoding="utf-8")
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(EXTRACTOR_PATH),
+            str(changelog),
+            "1.4.0",
+            "--footer",
+            str(footer),
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    assert result.returncode == 0
+    assert result.stdout == (
+        "## [1.4.0] - 2026-09-10\n\n### Added\n\n- Show a release summary.\n\n"
+        "## Install\n\nUse the package channel.\n"
+    )
+
+
+def test_release_request_command_reports_create_or_patch_decisions(tmp_path):
+    body = tmp_path / "release-body.md"
+    body.write_text("## [1.4.0] - 2026-09-10\n", encoding="utf-8")
+
+    create = subprocess.run(
+        [
+            sys.executable,
+            str(RELEASE_REQUEST_PATH),
+            "--version",
+            "1.4.0",
+            "--body-file",
+            str(body),
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    existing = tmp_path / "existing-release.json"
+    existing.write_text('{"id": 17, "assets": []}', encoding="utf-8")
+    patch = subprocess.run(
+        [
+            sys.executable,
+            str(RELEASE_REQUEST_PATH),
+            "--version",
+            "1.4.0",
+            "--body-file",
+            str(body),
+            "--existing-release",
+            str(existing),
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    assert create.returncode == patch.returncode == 0
+    assert json.loads(create.stdout) == {
+        "method": "POST",
+        "path": "/releases",
+        "payload": {
+            "tag_name": "v1.4.0",
+            "name": "v1.4.0",
+            "body": "## [1.4.0] - 2026-09-10\n",
+        },
+    }
+    assert json.loads(patch.stdout) == {
+        "method": "PATCH",
+        "path": "/releases/17",
+        "payload": {"body": "## [1.4.0] - 2026-09-10\n"},
+    }

tests/test_release.py

@@ -324,6 +324,29 @@ class TestCIWorkflow:
         assert "upload" in content.lower() or "publish" in content.lower(), \
             "Workflow must include upload/publish step"
 
+    def test_workflow_validates_notes_before_publication(self):
+        content = _read(".gitea/workflows/release.yml")
+        assert "scripts/extract_changelog.py" in content, \
+            "Workflow must fail before publication if release notes cannot be extracted"
+        assert "--footer packaging/release-footer.md" in content, \
+            "Workflow must assemble the body from the standing release footer"
+
+    def test_workflow_resynchronizes_existing_release_bodies(self):
+        content = _read(".gitea/workflows/release.yml")
+        assert "scripts/release_request.py" in content, \
+            "Workflow must make the create-versus-update decision through the request seam"
+        assert '"${METHOD}"' in content, \
+            "Workflow must execute the helper-selected create-or-update request"
+        assert 'RELEASE_PATH="$(printf' in content and '\n          PATH="$(printf' not in content, \
+            "Workflow must not overwrite the shell PATH while preparing the request URL"
+
+
+def test_readme_points_consumers_to_release_notes():
+    readme = _read("README.md")
+
+    assert "Per-release notes live on the [releases page]" in readme
+    assert "standing install and verification instructions" in readme
+
 
 # ---------------------------------------------------------------------------
 # Tests — Makefile release targets

tests/test_status.py

@@ -415,6 +415,131 @@ class TestServiceFacts:
         assert "last collect:" in result
         assert "freshness:" in result
 
+    def test_continuity_reports_boot_enabled_independently_of_runtime(self, tmp_path):
+        """Status names reboot continuity while retaining the timer fact."""
+        from fenris.status import get_status
+
+        db = tmp_path / "observations.db"
+        init_store(db)
+        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
+
+        with patch("fenris.status.query_service_state", return_value={
+            "boot_enabled": True, "timer_active": False,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }):
+            result = get_status(store_path=db, clock_now=now,
+                                query_services=True, query_journal=False)
+
+        assert "monitoring: active in background · persists across reboots" in result
+        assert "timer: inactive" in result
+
+    def test_continuity_and_deliberate_pause_are_reported_separately(self, tmp_path):
+        """Only a sanctioned user_disabled period renders the paused wording."""
+        from fenris.status import get_status
+
+        db = tmp_path / "observations.db"
+        conn = init_store(db)
+        conn.execute(
+            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
+            "VALUES (?, ?, ?)",
+            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
+        )
+        conn.commit()
+        conn.close()
+        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
+
+        with patch("fenris.status.query_service_state", return_value={
+            "boot_enabled": False, "timer_active": False,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }):
+            result = get_status(store_path=db, clock_now=now,
+                                query_services=True, query_journal=False)
+
+        assert "monitoring: does not start on next boot" in result
+        assert "monitoring: paused — deliberate disable" in result
+        assert "paused time is excluded from your usage habit · resume: fenris monitor resume" in result
+
+    def test_raw_system_state_without_user_disabled_is_not_a_deliberate_pause(self, tmp_path):
+        """A non-sanctioned stop never acquires the deliberate-disable label."""
+        from fenris.status import get_status
+
+        db = tmp_path / "observations.db"
+        conn = init_store(db)
+        conn.execute(
+            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
+            "VALUES (?, ?, ?)",
+            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "migrated"),
+        )
+        conn.commit()
+        conn.close()
+        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
+
+        with patch("fenris.status.query_service_state", return_value={
+            "boot_enabled": False, "timer_active": False,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }):
+            result = get_status(store_path=db, clock_now=now,
+                                query_services=True, query_journal=False)
+
+        assert "monitoring: paused — deliberate disable" not in result
+
+    def test_resumed_open_period_clears_a_previous_deliberate_pause(self, tmp_path):
+        """A later sanctioned resume takes precedence over an older pause."""
+        from fenris.status import get_status
+
+        db = tmp_path / "observations.db"
+        conn = init_store(db)
+        conn.execute(
+            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
+            "VALUES (?, ?, ?)",
+            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
+        )
+        conn.execute(
+            "INSERT INTO monitoring_periods (started_at) VALUES (?)",
+            ("2026-09-01T11:00:00+00:00",),
+        )
+        conn.commit()
+        conn.close()
+        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
+
+        with patch("fenris.status.query_service_state", return_value={
+            "boot_enabled": True, "timer_active": True,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }):
+            result = get_status(store_path=db, clock_now=now,
+                                query_services=True, query_journal=False)
+
+        assert "monitoring: paused — deliberate disable" not in result
+
+    def test_live_enabled_service_suppresses_a_stale_pause_marker(self, tmp_path):
+        """A raw re-enable cannot leave a contradictory paused presentation."""
+        from fenris.status import get_status
+
+        db = tmp_path / "observations.db"
+        conn = init_store(db)
+        conn.execute(
+            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
+            "VALUES (?, ?, ?)",
+            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
+        )
+        conn.commit()
+        conn.close()
+        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
+
+        with patch("fenris.status.query_service_state", return_value={
+            "boot_enabled": True, "timer_active": True,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }):
+            result = get_status(store_path=db, clock_now=now,
+                                query_services=True, query_journal=False)
+
+        assert "monitoring: paused — deliberate disable" not in result
+
 
 # ---------------------------------------------------------------------------
 # Status output structure (§8.8, LC-9)
@@ -441,6 +566,29 @@ class TestStatusOutput:
         assert isinstance(result, str)
         assert len(result) > 0
 
+    def test_status_excludes_tui_identity_and_auth_notice(self, tmp_path):
+        """CLI status never renders TUI-only identity or launch guidance."""
+        from fenris.status import get_status
+
+        db = tmp_path / "observations.db"
+        init_store(db)
+        now = datetime(2026, 9, 1, 12, 0, 0, tzinfo=timezone.utc)
+
+        with patch("fenris.status.query_service_state", return_value={
+            "boot_enabled": False, "timer_active": False,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }):
+            result = get_status(store_path=db, clock_now=now,
+                                query_services=True, query_journal=False)
+
+        for tui_only in (
+            "Fenris — NVMe endurance monitor",
+            "by Bongbetic",
+            "privileged actions will prompt for authentication (polkit)",
+        ):
+            assert tui_only not in result
+
     def test_status_never_writes(self, tmp_path):
         """Status never writes to the store."""
         from fenris.status import get_status

tests/test_store_group_access.py

@@ -0,0 +1,79 @@
+"""Group access to the observation store — regression coverage for issue #54.
+
+Two defects: (1) a non-group user's stat() on the store directory raised
+PermissionError straight through open_store_readonly(), crashing status/TUI
+instead of degrading to the Store fault view; (2) even group members could
+not open the WAL-mode store because root-created sidecars lacked group write
+and the store directory lacked group execute-then-write.
+"""
+import sqlite3
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
+
+from fenris.store import DEFAULT_STORE_PATH, init_store
+from fenris.status import StoreFault, open_store_readonly
+
+
+def test_stat_permission_error_becomes_store_fault(monkeypatch, tmp_path):
+    """stat() denied (non-group user on a 2750 dir) → StoreFault, not crash."""
+    store = tmp_path / "observations.db"
+    store.write_bytes(b"")
+
+    import pathlib
+
+    def denied(self, follow_symlinks=True):
+        raise PermissionError(13, "Permission denied")
+
+    monkeypatch.setattr(pathlib.Path, "exists", denied)
+    with pytest.raises(StoreFault):
+        open_store_readonly(store)
+
+
+def test_connect_failure_becomes_store_fault(tmp_path):
+    """sqlite failures stay wrapped as StoreFault (existing contract)."""
+    garbage = tmp_path / "observations.db"
+    garbage.write_bytes(b"not a database" * 100)
+    with pytest.raises(StoreFault):
+        open_store_readonly(garbage)
+
+
+def test_init_store_leaves_files_group_writable(tmp_path):
+    """Root-created stores must stay readable by WAL readers: db and sidecars
+    need group write after init_store (issue #54)."""
+    store = tmp_path / "observations.db"
+    conn = init_store(store)
+    try:
+        assert (store.stat().st_mode & 0o060) == 0o060, "db not group rw"
+        wal = store.with_name(store.name + "-wal")
+        shm = store.with_name(store.name + "-shm")
+        if wal.exists():
+            assert (wal.stat().st_mode & 0o060) == 0o060, "wal not group rw"
+        if shm.exists():
+            assert (shm.stat().st_mode & 0o060) == 0o060, "shm not group rw"
+    finally:
+        conn.close()
+
+
+def test_readonly_open_works_after_init_store(tmp_path):
+    """The shipped read path opens a store created by init_store."""
+    store = tmp_path / "observations.db"
+    writer = init_store(store)
+    writer.execute("INSERT INTO monitoring_periods (started_at) VALUES ('2026-01-01T00:00:00+00:00')")
+    writer.commit()
+    conn = open_store_readonly(store)
+    assert conn is not None
+    conn.close()
+    writer.close()
+
+
+def test_packaging_ships_group_access():
+    """tmpfiles must create the store dir group-writable; collect unit must
+    keep the umask loose so root-created sidecars stay group-accessible."""
+    repo = Path(__file__).resolve().parent.parent
+    assert "2770" in (repo / "packaging" / "tmpfiles.d" / "fenris.conf").read_text()
+    assert "2750" not in (repo / "packaging" / "tmpfiles.d" / "fenris.conf").read_text()
+    assert "UMask=002" in (repo / "units" / "fenris-collect.service").read_text()

tests/test_tui.py

@@ -10,6 +10,7 @@ Covers:
 Criteria: TUI-1, TUI-4, CI-1, CI-4, IN-3.
 """
 import sqlite3
+from xml.etree import ElementTree
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from unittest.mock import patch, MagicMock
@@ -384,6 +385,160 @@ class TestDenseScreen:
             assert "timer:" in strip
             assert "last collect:" in strip
             assert "freshness:" in strip
+            assert "by Bongbetic" in strip
+
+    @pytest.mark.asyncio
+    async def test_service_strip_shows_continuity_and_separate_quit_rail(self, tmp_path):
+        """The visible action footer excludes quit because the rail owns it."""
+        conn = init_store(tmp_path / "test.db")
+        _open_period(conn)
+        conn.close()
+        app = FenrisTuiApp(store_path=tmp_path / "test.db")
+
+        with patch("fenris.tui.query_service_state", return_value={
+            "boot_enabled": True, "timer_active": True,
+            "last_collect_ok": True, "last_collect_age_s": 60,
+            "last_collect_reason": None,
+        }):
+            async with app.run_test():
+                strip = str(app.query_one("#service-strip").render()).lower()
+                rail = str(app.query_one("#quit-rail").render())
+                usage = app.query_one("#usage-history")
+                service = app.query_one("#service-strip")
+                quit_rail = app.query_one("#quit-rail")
+                assert "continuity" in strip
+                assert "monitoring: active in background · persists across reboots" in strip
+                assert "p pause · r resume · c collect · d disclosures" in strip
+                assert "q quit" not in strip
+                assert rail == "q QUIT TUI"
+                assert usage.region.y < service.region.y < quit_rail.region.y
+                assert usage.region.bottom <= service.region.y
+                assert service.region.bottom <= quit_rail.region.y
+
+    @pytest.mark.asyncio
+    async def test_deliberate_pause_banner_is_visible_and_quit_preserves_periods(self, tmp_path):
+        """The Pilot sees the paused block; q leaves persisted monitoring state alone."""
+        db = tmp_path / "test.db"
+        conn = init_store(db)
+        conn.execute(
+            "INSERT INTO monitoring_periods (started_at, ended_at, end_cause) "
+            "VALUES (?, ?, ?)",
+            ("2026-09-01T09:00:00+00:00", "2026-09-01T10:00:00+00:00", "user_disabled"),
+        )
+        conn.commit()
+        conn.close()
+        app = FenrisTuiApp(store_path=db)
+
+        with patch("fenris.tui.query_service_state", return_value={
+            "boot_enabled": False, "timer_active": False,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }), patch("fenris.tui.subprocess.run") as subprocess_run, patch.object(
+            app, "_run_helper"
+        ) as run_helper:
+            async with app.run_test(size=(80, 24)) as pilot:
+                await pilot.pause()
+                paused_banner = app.query_one("#paused-banner")
+                main_grid = app.query_one("#main-grid")
+                assert str(main_grid.styles.layout) == "<grid>"
+                assert main_grid.has_class("paused")
+                assert len(main_grid.styles.grid_rows) == 5
+                banner = str(paused_banner.render()).lower()
+                assert "monitoring: paused — deliberate disable" in banner
+                assert "paused time is excluded from your usage habit · resume: fenris monitor resume" in banner
+                assert paused_banner.region.height >= 5
+                assert paused_banner.region.y < app.query_one("#usage-history").region.y
+                assert app.query_one("#usage-history").region.bottom <= app.query_one(
+                    "#service-strip"
+                ).region.y
+                screenshot = app.export_screenshot()
+                visible_text = " ".join(
+                    "".join(ElementTree.fromstring(screenshot).itertext()).split()
+                )
+                assert "paused time is excluded from your usage habit" in visible_text
+                assert "resume: fenris monitor resume" in visible_text
+                assert "monitoring: does not start on next boot" in str(
+                    app.query_one("#service-strip").render()
+                ).lower()
+                dashboard_scroll = app.query_one("#dashboard-scroll")
+                assert dashboard_scroll.max_scroll_y > 0
+                dashboard_scroll.focus()
+                await pilot.press("end")
+                assert dashboard_scroll.scroll_y == dashboard_scroll.max_scroll_y
+                footer_text = " ".join(
+                    "".join(
+                        ElementTree.fromstring(app.export_screenshot()).itertext()
+                    ).split()
+                )
+                assert "q QUIT TUI" in footer_text
+                await pilot.press("q")
+                assert not app.is_running
+            subprocess_run.assert_not_called()
+            run_helper.assert_not_called()
+
+        conn = sqlite3.connect(db)
+        row = conn.execute(
+            "SELECT ended_at, end_cause FROM monitoring_periods"
+        ).fetchone()
+        conn.close()
+        assert row == ("2026-09-01T10:00:00+00:00", "user_disabled")
+
+    @pytest.mark.asyncio
+    async def test_quit_preserves_an_active_monitoring_period(self, tmp_path):
+        """Quitting an active dashboard never closes or mutates its period."""
+        db = tmp_path / "test.db"
+        conn = init_store(db)
+        _open_period(conn, "2026-09-01T09:00:00+00:00")
+        conn.close()
+        app = FenrisTuiApp(store_path=db)
+
+        with patch("fenris.tui.query_service_state", return_value={
+            "boot_enabled": True, "timer_active": True,
+            "last_collect_ok": None, "last_collect_age_s": None,
+            "last_collect_reason": None,
+        }), patch("fenris.tui.subprocess.run") as subprocess_run, patch.object(
+            app, "_run_helper"
+        ) as run_helper:
+            async with app.run_test() as pilot:
+                await pilot.press("q")
+                assert not app.is_running
+            subprocess_run.assert_not_called()
+            run_helper.assert_not_called()
+
+        conn = sqlite3.connect(db)
+        row = conn.execute(
+            "SELECT started_at, ended_at, end_cause FROM monitoring_periods"
+        ).fetchone()
+        conn.close()
+        assert row == ("2026-09-01T09:00:00+00:00", None, None)
+
+    @pytest.mark.asyncio
+    async def test_branding_and_one_time_auth_banner(self, tmp_path):
+        """Identity is visible at launch; auth notice clears once per session."""
+        app = FenrisTuiApp(
+            store_path=tmp_path / "nonexistent.db",
+            refresh_interval_s=0.2,
+        )
+        auth_notice = "privileged actions will prompt for authentication (polkit)"
+
+        async with app.run_test() as pilot:
+            headline = str(app.query_one("#headline-band").render())
+            assert "Fenris — NVMe endurance monitor" in headline
+            assert auth_notice in headline
+            assert "by Bongbetic" in str(app.query_one("#service-strip").render())
+
+            await pilot.pause(0.25)
+            assert auth_notice not in str(app.query_one("#headline-band").render())
+
+            await pilot.pause(0.25)
+            assert auth_notice not in str(app.query_one("#headline-band").render())
+
+        fresh_app = FenrisTuiApp(
+            store_path=tmp_path / "nonexistent.db",
+            refresh_interval_s=0.2,
+        )
+        async with fresh_app.run_test():
+            assert auth_notice in str(fresh_app.query_one("#headline-band").render())
 
 
 # ---------------------------------------------------------------------------
@@ -524,4 +679,3 @@ class TestStateMatrixCombinations:
         # Incomplete provenance → UNVERIFIED tier
         assert proj.baseline_tier.value == "unverified_override"
         conn.close()
-

units/fenris-collect.service

@@ -7,3 +7,4 @@ After=local-fs.target
 Type=oneshot
 ExecStart=/usr/libexec/fenris/fenris-collect
 TimeoutStartSec=90
+UMask=002