Make sickdays (in kuhyx/utils) text-free (textgat…

Todo: 2d0704cd

.github/workflows/holds-precommit.yml

@@ -0,0 +1,73 @@
+name: holds pre-commit
+
+on:
+  push:
+    branches: [main]
+    # The workflow's own file counts as holds: editing only this file would
+    # otherwise trigger nothing, so a fix to the job itself could never prove
+    # itself.
+    paths: ['holds/**', '.github/workflows/holds-precommit.yml']
+  pull_request:
+    branches: [main]
+    paths: ['holds/**', '.github/workflows/holds-precommit.yml']
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+      # Only pre-commit itself. Every linting hook runs in its own isolated
+      # env -- ruff, mypy, pylint, bandit and codespell each come from their
+      # own repo+rev, and the local hooks need nothing beyond bash and
+      # python3 -- so installing the full requirements.txt spent 9s a run on
+      # packages no pre-commit-stage hook imports. Verified by running all
+      # three configs green in a venv holding pre-commit and nothing else.
+      # The pin is read out of requirements.txt rather than repeated here, so
+      # it cannot drift from what the dependency-freshness gate governs.
+      - name: Install pre-commit
+        run: |
+          pip install "$(grep '^pre-commit==' holds/requirements.txt)"
+
+      # Keyed on THIS package's config. pre-commit/action@v3.0.1 caches on
+      # hashFiles('.pre-commit-config.yaml') -- the repo ROOT's -- so all three
+      # package jobs shared one key, raced to overwrite it with hook sets built
+      # from four different configs, and editing a per-package config did not
+      # invalidate it. The cache was therefore silently wrong rather than
+      # missing, and the hooks reinstalled from scratch on every run (38-49s).
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: >-
+            pre-commit-holds-${{ env.pythonLocation }}-${{
+            hashFiles('holds/.pre-commit-config.yaml') }}
+          # Prefix fallback, or this fix would evaporate on the very
+          # event that motivated it: bumping a hook rev changes the
+          # exact key, and a total miss means reinstalling every hook
+          # again. pre-commit's store is keyed internally by hook
+          # repo+rev, so a superseded entry is ignored disk rather
+          # than a wrong hook, and cache still re-saves under the new
+          # exact key after a prefix-only hit.
+          restore-keys: pre-commit-holds-${{ env.pythonLocation }}-
+      # mypy re-analyses the stdlib and every third-party stub from scratch
+      # without this, which measured 10s of the hook step in CI against 0.25s
+      # warm locally -- a 19MB cache dir does the whole difference. Keyed on
+      # the config, not the sources: mypy's own cache metadata records the
+      # interpreter, the flag set and a hash per source file, so it re-checks
+      # what changed and cannot pass stale code. Deliberately NOT keyed on
+      # github.sha -- that re-saves 19MB x3 every commit and would evict the
+      # 68MB hook caches under the repo's 10GB LRU budget. A fixed key keeps
+      # the expensive part, the dependency analysis, which is what costs 10s.
+      - uses: actions/cache@v4
+        with:
+          path: .mypy_cache
+          key: >-
+            mypy-holds-${{ env.pythonLocation }}-${{
+            hashFiles('holds/.pre-commit-config.yaml') }}
+          restore-keys: mypy-holds-${{ env.pythonLocation }}-
+      - name: Run the hooks
+        run: >-
+          pre-commit run --config holds/.pre-commit-config.yaml
+          --all-files --show-diff-on-failure

.github/workflows/holds-tests.yml

@@ -0,0 +1,34 @@
+name: holds tests
+
+on:
+  push:
+    branches: [main]
+    # The workflow's own file counts as holds: editing only this file would
+    # otherwise trigger nothing, so a fix to the job itself could never prove
+    # itself.
+    paths: ['holds/**', '.github/workflows/holds-tests.yml']
+  pull_request:
+    branches: [main]
+    paths: ['holds/**', '.github/workflows/holds-tests.yml']
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: holds
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+          cache: pip
+          cache-dependency-path: holds/requirements.txt
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt && pip install --no-deps -e .
+
+      - name: Run tests with coverage
+        run: python -m pytest -v

.github/workflows/leetcode-coach-precommit.yml

@@ -0,0 +1,73 @@
+name: leetcode-coach pre-commit
+
+on:
+  push:
+    branches: [main]
+    # The workflow's own file counts as leetcode_coach: editing only this file would
+    # otherwise trigger nothing, so a fix to the job itself could never prove
+    # itself.
+    paths: ['leetcode_coach/**', '.github/workflows/leetcode-coach-precommit.yml']
+  pull_request:
+    branches: [main]
+    paths: ['leetcode_coach/**', '.github/workflows/leetcode-coach-precommit.yml']
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+      # Only pre-commit itself. Every linting hook runs in its own isolated
+      # env -- ruff, mypy, pylint, bandit and codespell each come from their
+      # own repo+rev, and the local hooks need nothing beyond bash and
+      # python3 -- so installing the full requirements.txt spent 9s a run on
+      # packages no pre-commit-stage hook imports. Verified by running all
+      # three configs green in a venv holding pre-commit and nothing else.
+      # The pin is read out of requirements.txt rather than repeated here, so
+      # it cannot drift from what the dependency-freshness gate governs.
+      - name: Install pre-commit
+        run: |
+          pip install "$(grep '^pre-commit==' leetcode_coach/requirements.txt)"
+
+      # Keyed on THIS package's config. pre-commit/action@v3.0.1 caches on
+      # hashFiles('.pre-commit-config.yaml') -- the repo ROOT's -- so all three
+      # package jobs shared one key, raced to overwrite it with hook sets built
+      # from four different configs, and editing a per-package config did not
+      # invalidate it. The cache was therefore silently wrong rather than
+      # missing, and the hooks reinstalled from scratch on every run (38-49s).
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: >-
+            pre-commit-leetcode-coach-${{ env.pythonLocation }}-${{
+            hashFiles('leetcode_coach/.pre-commit-config.yaml') }}
+          # Prefix fallback, or this fix would evaporate on the very
+          # event that motivated it: bumping a hook rev changes the
+          # exact key, and a total miss means reinstalling every hook
+          # again. pre-commit's store is keyed internally by hook
+          # repo+rev, so a superseded entry is ignored disk rather
+          # than a wrong hook, and cache still re-saves under the new
+          # exact key after a prefix-only hit.
+          restore-keys: pre-commit-leetcode-coach-${{ env.pythonLocation }}-
+      # mypy re-analyses the stdlib and every third-party stub from scratch
+      # without this, which measured 10s of the hook step in CI against 0.25s
+      # warm locally -- a 19MB cache dir does the whole difference. Keyed on
+      # the config, not the sources: mypy's own cache metadata records the
+      # interpreter, the flag set and a hash per source file, so it re-checks
+      # what changed and cannot pass stale code. Deliberately NOT keyed on
+      # github.sha -- that re-saves 19MB x3 every commit and would evict the
+      # 68MB hook caches under the repo's 10GB LRU budget. A fixed key keeps
+      # the expensive part, the dependency analysis, which is what costs 10s.
+      - uses: actions/cache@v4
+        with:
+          path: .mypy_cache
+          key: >-
+            mypy-leetcode-coach-${{ env.pythonLocation }}-${{
+            hashFiles('leetcode_coach/.pre-commit-config.yaml') }}
+          restore-keys: mypy-leetcode-coach-${{ env.pythonLocation }}-
+      - name: Run the hooks
+        run: >-
+          pre-commit run --config leetcode_coach/.pre-commit-config.yaml
+          --all-files --show-diff-on-failure

.github/workflows/leetcode-coach-tests.yml

@@ -0,0 +1,34 @@
+name: leetcode-coach tests
+
+on:
+  push:
+    branches: [main]
+    # The workflow's own file counts as leetcode_coach: editing only this file would
+    # otherwise trigger nothing, so a fix to the job itself could never prove
+    # itself.
+    paths: ['leetcode_coach/**', '.github/workflows/leetcode-coach-tests.yml']
+  pull_request:
+    branches: [main]
+    paths: ['leetcode_coach/**', '.github/workflows/leetcode-coach-tests.yml']
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: leetcode_coach
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+          cache: pip
+          cache-dependency-path: leetcode_coach/requirements.txt
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt && pip install --no-deps -e .
+
+      - name: Run tests with coverage
+        run: python -m pytest -v

.github/workflows/music-theory-tests.yml

@@ -28,4 +28,4 @@ jobs:
         run: pip install -r requirements.txt
 
       - name: Run tests with coverage
-        run: python -m pytest -v
+        run: python -m pytest -v --cov=music_theory

.github/workflows/omniroute_offload-precommit.yml

@@ -0,0 +1,73 @@
+name: omniroute_offload pre-commit
+
+on:
+  push:
+    branches: [main]
+    # The workflow's own file counts as omniroute_offload: editing only this file would
+    # otherwise trigger nothing, so a fix to the job itself could never prove
+    # itself.
+    paths: ['omniroute_offload/**', '.github/workflows/omniroute_offload-precommit.yml']
+  pull_request:
+    branches: [main]
+    paths: ['omniroute_offload/**', '.github/workflows/omniroute_offload-precommit.yml']
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+      # Only pre-commit itself. Every linting hook runs in its own isolated
+      # env -- ruff, mypy, pylint, bandit and codespell each come from their
+      # own repo+rev, and the local hooks need nothing beyond bash and
+      # python3 -- so installing the full requirements.txt spent 9s a run on
+      # packages no pre-commit-stage hook imports. Verified by running all
+      # three configs green in a venv holding pre-commit and nothing else.
+      # The pin is read out of requirements.txt rather than repeated here, so
+      # it cannot drift from what the dependency-freshness gate governs.
+      - name: Install pre-commit
+        run: |
+          pip install "$(grep '^pre-commit==' omniroute_offload/requirements.txt)"
+
+      # Keyed on THIS package's config. pre-commit/action@v3.0.1 caches on
+      # hashFiles('.pre-commit-config.yaml') -- the repo ROOT's -- so all three
+      # package jobs shared one key, raced to overwrite it with hook sets built
+      # from four different configs, and editing a per-package config did not
+      # invalidate it. The cache was therefore silently wrong rather than
+      # missing, and the hooks reinstalled from scratch on every run (38-49s).
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: >-
+            pre-commit-omniroute_offload-${{ env.pythonLocation }}-${{
+            hashFiles('omniroute_offload/.pre-commit-config.yaml') }}
+          # Prefix fallback, or this fix would evaporate on the very
+          # event that motivated it: bumping a hook rev changes the
+          # exact key, and a total miss means reinstalling every hook
+          # again. pre-commit's store is keyed internally by hook
+          # repo+rev, so a superseded entry is ignored disk rather
+          # than a wrong hook, and cache still re-saves under the new
+          # exact key after a prefix-only hit.
+          restore-keys: pre-commit-omniroute_offload-${{ env.pythonLocation }}-
+      # mypy re-analyses the stdlib and every third-party stub from scratch
+      # without this, which measured 10s of the hook step in CI against 0.25s
+      # warm locally -- a 19MB cache dir does the whole difference. Keyed on
+      # the config, not the sources: mypy's own cache metadata records the
+      # interpreter, the flag set and a hash per source file, so it re-checks
+      # what changed and cannot pass stale code. Deliberately NOT keyed on
+      # github.sha -- that re-saves 19MB x3 every commit and would evict the
+      # 68MB hook caches under the repo's 10GB LRU budget. A fixed key keeps
+      # the expensive part, the dependency analysis, which is what costs 10s.
+      - uses: actions/cache@v4
+        with:
+          path: .mypy_cache
+          key: >-
+            mypy-omniroute_offload-${{ env.pythonLocation }}-${{
+            hashFiles('omniroute_offload/.pre-commit-config.yaml') }}
+          restore-keys: mypy-omniroute_offload-${{ env.pythonLocation }}-
+      - name: Run the hooks
+        run: >-
+          pre-commit run --config omniroute_offload/.pre-commit-config.yaml
+          --all-files --show-diff-on-failure

.pre-commit-config.yaml

@@ -13,7 +13,7 @@
 # linters, and carry this same hook so committing with one of those configs is
 # gated too. This root config is what `pre-commit install` wires up, and it is
 # the only one that covers the subprojects without a config of their own
-# (aur-publish/, guard-lib/, crdt_sync_dart/, file_length/, ...).
+# (guard-lib/, crdt_sync_dart/, file_length/, ...).
 #
 # The path is repo-relative on purpose. pre-commit always runs hooks from the
 # git root, so this resolves the same locally and on a CI runner -- an absolute
@@ -66,9 +66,14 @@ repos:
       # answer and passes with a loud banner; `--no-verify` is banned here, so
       # a hook that hard-failed on a flaky connection would leave no way to
       # commit at all. CI, always online, is the strict authority.
+      #
+      # Scoped to manifests this branch changed (vs merge-base with main), so
+      # `--all-files` asks "did THIS change leave a stale pin?" and not "is
+      # every project in the monorepo current?". CI `--all --strict` keeps
+      # the repo-wide answer. See scripts/dep_freshness_changed.sh.
       - id: dependency-freshness
         name: dependencies on newest stable
-        entry: bash scripts/check_dependency_freshness.sh
+        entry: bash scripts/dep_freshness_changed.sh
         language: system
         pass_filenames: true
         files: >-

aur-publish/README.md

@@ -1,45 +0,0 @@
-# aur-publish
-
-Hands-off publishing of kuhy's Flutter apps to the AUR.
-
-```bash
-~/src/utils/aur-publish/publish.sh              # wait for registration, then publish
-~/src/utils/aur-publish/publish.sh --dry-run    # everything except the push
-~/src/utils/aur-publish/publish.sh --skip-wait  # account already works
-~/src/utils/aur-publish/publish.sh --only habit-stack
-```
-
-## What it does
-
-1. Polls `/register` until AUR signup reopens, opens it in a browser and
-   prints the SSH key to paste. **Signup is the only manual step** — it
-   requires email confirmation.
-2. Waits for `ssh aur@aur.archlinux.org` to authenticate.
-3. Then, unattended, per package: resolve the newest `vX.Y.Z` tag → set
-   `pkgver` → `updpkgsums` → `makepkg -C` → `namcap` → AUR rule check →
-   `pacman -U` → launch check → `.SRCINFO` → commit → push.
-
-Every package is built, installed and **launched** before it is pushed, so a
-broken package cannot reach the AUR. A package failing any gate is skipped and
-reported; the others still publish. Safe to re-run.
-
-## anubis_gate.py
-
-The AUR sits behind [Anubis](https://anubis.techaro.lol/), which answers HTML
-requests with a proof-of-work challenge page carrying **HTTP 200**. A plain
-`curl` therefore reports 200 for a page that is actually unreachable — which is
-exactly how "is registration back?" gets answered wrong. This module solves the
-challenge and reports the status of the *real* page behind it.
-
-```bash
-python3 anubis_gate.py /register     # prints the true status code
-```
-
-## AUR rules enforced before pushing
-
-The AUR does not review uploads, but per the submission guidelines "packages
-that violate the rules may be deleted without warning". `check_aur_rules()`
-blocks a push on the mechanically checkable ones: `# Maintainer:` line,
-`x86_64` in `arch`, no `replaces=` (reserved for renames — use `conflicts`),
-not already in an official repo, `pkgdesc`/`url`/`license` present, and
-`.SRCINFO` matching the PKGBUILD.

aur-publish/anubis_gate.py

@@ -1,138 +0,0 @@
-"""Fetch an AUR URL from behind the Anubis anti-bot gate.
-
-The AUR sits behind Anubis (https://anubis.techaro.lol/), which answers every
-HTML request with a proof-of-work challenge page carrying HTTP **200**. A bare
-`curl` therefore reports 200 for a page that is actually unreachable, which is
-exactly how "is /register back up?" gets answered wrong.
-
-This module solves the challenge and reports the status of the *real* page
-behind it, so the caller can distinguish:
-
-  * 200  -> genuinely available
-  * 503  -> reached the site; that endpoint is disabled server-side
-  * other-> whatever the app actually said
-
-Exit codes mirror the HTTP status so shell callers can branch on them:
-0 for 200, 1 for anything else, 2 for a local/transport failure.
-"""
-
-from __future__ import annotations
-
-import argparse
-import hashlib
-import http.cookiejar
-import json
-import re
-import sys
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-
-BASE = "https://aur.archlinux.org"
-UA = "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
-CHALLENGE_RE = re.compile(
-    r'<script id="anubis_challenge" type="application/json">(.*?)</script>',
-    re.S,
-)
-PASS_PATH = "/.within.website/x/cmd/anubis/api/pass-challenge"
-# A solve at difficulty 4 takes ~0.01s; this ceiling only guards a server-side
-# difficulty spike, so the poller degrades instead of spinning forever.
-MAX_NONCE = 50_000_000
-
-
-class _NoRedirect(urllib.request.HTTPRedirectHandler):
-    """Keep redirects visible instead of silently following them."""
-
-    def redirect_request(self, *_args, **_kwargs):  # noqa: D102 - see class doc
-        return None
-
-
-def _opener() -> urllib.request.OpenerDirector:
-    jar = http.cookiejar.CookieJar()
-    opener = urllib.request.build_opener(
-        urllib.request.HTTPCookieProcessor(jar), _NoRedirect
-    )
-    opener.addheaders = [
-        ("User-Agent", UA),
-        ("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"),
-    ]
-    return opener
-
-
-def _solve(random_data: str, difficulty: int) -> tuple[int, str, float]:
-    """Find a nonce whose sha256 digest starts with `difficulty` zero hex chars."""
-    prefix = "0" * difficulty
-    started = time.time()
-    for nonce in range(MAX_NONCE):
-        digest = hashlib.sha256(f"{random_data}{nonce}".encode()).hexdigest()
-        if digest.startswith(prefix):
-            return nonce, digest, time.time() - started
-    raise RuntimeError(f"no nonce found below {MAX_NONCE} at difficulty {difficulty}")
-
-
-def fetch(path: str, timeout: int = 30) -> tuple[int, str]:
-    """Return (status, body) for `path`, clearing Anubis first if challenged."""
-    opener = _opener()
-    url = f"{BASE}{path}"
-
-    try:
-        with opener.open(url, timeout=timeout) as resp:
-            body = resp.read().decode("utf-8", "replace")
-            status = resp.status
-    except urllib.error.HTTPError as exc:
-        return exc.code, exc.read().decode("utf-8", "replace")
-
-    match = CHALLENGE_RE.search(body)
-    if not match:
-        return status, body
-
-    challenge = json.loads(match.group(1))["challenge"]
-    nonce, digest, elapsed = _solve(
-        challenge["randomData"], int(challenge["difficulty"])
-    )
-    query = urllib.parse.urlencode(
-        {
-            "id": challenge["id"],
-            "response": digest,
-            "nonce": str(nonce),
-            "redir": path,
-            "elapsedTime": str(int(elapsed * 1000)),
-        }
-    )
-    try:
-        opener.open(f"{BASE}{PASS_PATH}?{query}", timeout=timeout)
-    except urllib.error.HTTPError:
-        # A redirect or non-2xx here is fine; what matters is the cookie the
-        # opener's jar just captured.
-        pass
-
-    try:
-        with opener.open(url, timeout=timeout) as resp:
-            return resp.status, resp.read().decode("utf-8", "replace")
-    except urllib.error.HTTPError as exc:
-        return exc.code, exc.read().decode("utf-8", "replace")
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("path", help="AUR path, e.g. /register")
-    parser.add_argument(
-        "--print-body", action="store_true", help="write the page body to stdout"
-    )
-    args = parser.parse_args()
-
-    try:
-        status, body = fetch(args.path)
-    except (urllib.error.URLError, RuntimeError, TimeoutError) as exc:
-        print(f"transport error: {exc}", file=sys.stderr)
-        return 2
-
-    print(status)
-    if args.print_body:
-        sys.stdout.write(body)
-    return 0 if status == 200 else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

aur-publish/lib/aur_publish_one.sh

@@ -1,107 +0,0 @@
-#!/bin/bash
-
-# ============================================================================
-# Building, verifying and pushing one package to the AUR.
-#
-# Sourced by publish.sh, never executed: these functions read the readonly
-# config (AUR_HOST, AUR_ROOT, DRY_RUN, PUBLISHED, FAILED) that the entry script declares, and
-# a `readonly` re-run inside a twice-sourced lib would abort under `set -e`.
-# ============================================================================
-
-set -euo pipefail
-
-publish_one() {
-    local pkg="$1" repo="$2" wrapper="$3" binary="$4" expected="$5"
-    local dir="$AUR_ROOT/$pkg"
-    local version
-
-    log "$pkg"
-
-    [[ -d "$repo" ]] || { warn "$pkg: no repo at $repo"; return 1; }
-    [[ -f "$dir/PKGBUILD" ]] || { warn "$pkg: no PKGBUILD at $dir"; return 1; }
-
-    version="$(newest_tag "$repo")"
-    [[ -n "$version" ]] || { warn "$pkg: no vX.Y.Z tag on the remote"; return 1; }
-    info "newest release tag: v$version"
-
-    cd "$dir"
-    sed -i -E "s/^pkgver=.*/pkgver=$version/" PKGBUILD
-    # The tarball for a tag contains the PKGBUILD, so the checksum can only be
-    # computed after the tag exists — never committed ahead of time.
-    updpkgsums >/dev/null 2>&1 || { warn "$pkg: updpkgsums failed (tag missing?)"; return 1; }
-
-    info "building"
-    if ! env PATH=/usr/bin:/bin:/usr/local/bin makepkg -Cf --noconfirm >/dev/null 2>&1; then
-        warn "$pkg: makepkg failed"
-        return 1
-    fi
-
-    local built
-    built="$(find . -maxdepth 1 -name "$pkg-$version-*.pkg.tar.zst" | head -1)"
-    [[ -n "$built" ]] || { warn "$pkg: no package produced"; return 1; }
-
-    # namcap's "ELF files outside of a valid path ('opt/')" is a false positive
-    # for /opt-installed apps, so only genuinely new errors are worth failing on.
-    local findings
-    findings="$(namcap "$built" 2>&1 | grep -E ' E: ' | grep -v "outside of a valid path" || true)"
-    if [[ -n "$findings" ]]; then
-        warn "$pkg: namcap errors:"
-        printf '      %s\n' "$findings"
-        return 1
-    fi
-
-    info "installing and launching"
-    sudo pacman -U --noconfirm "$built" >/dev/null 2>&1 \
-        || { warn "$pkg: pacman -U failed"; return 1; }
-    verify_installed "$binary" "$expected" "$wrapper" || { warn "$pkg: launch check failed"; return 1; }
-
-    # Generated before the rule check, which verifies it matches the PKGBUILD.
-    makepkg --printsrcinfo > .SRCINFO
-    check_aur_rules "$pkg" || return 1
-
-    # The AUR repo is a separate remote living alongside the build dir; adding
-    # it here (rather than cloning into a fresh path) keeps the verified
-    # PKGBUILD and the thing being pushed byte-identical.
-    if [[ ! -d .git ]]; then
-        git init -q -b master .
-        git remote add origin "ssh://aur@$AUR_HOST/$pkg.git"
-    fi
-    git remote get-url origin >/dev/null 2>&1 \
-        || git remote add origin "ssh://aur@$AUR_HOST/$pkg.git"
-
-    # Fetch first: an existing AUR package must be built on, not overwritten.
-    if git fetch -q origin master 2>/dev/null; then
-        git reset -q --soft FETCH_HEAD 2>/dev/null || true
-    fi
-
-    cat > .gitignore <<'EOF'
-# Build products; the AUR tracks only the recipe.
-*.pkg.tar.zst
-*.tar.gz
-src/
-pkg/
-EOF
-
-    git add PKGBUILD .SRCINFO .gitignore
-    if git diff --cached --quiet; then
-        info "already up to date on the AUR; nothing to push"
-        PUBLISHED+=("$pkg v$version (unchanged)")
-        return 0
-    fi
-
-    git -c user.name='Krzysztof Rudnicki' \
-        -c user.email='krzysztofrudnicki0@gmail.com' \
-        commit -q -m "$pkg $version-1"
-
-    if ((DRY_RUN)); then
-        info "DRY RUN — not pushing"
-        PUBLISHED+=("$pkg v$version (dry run)")
-        return 0
-    fi
-
-    info "pushing to the AUR"
-    git push -q origin master 2>&1 | tail -3 || { warn "$pkg: push failed"; return 1; }
-    PUBLISHED+=("$pkg v$version")
-    return 0
-}
-

aur-publish/lib/aur_registration.sh

@@ -1,107 +0,0 @@
-#!/bin/bash
-
-# ============================================================================
-# Waiting for AUR registration and SSH access to come up.
-#
-# Sourced by publish.sh, never executed: these functions read the readonly
-# config (AUR_HOST, SSH_KEY, GATE, POLL_SECONDS) that the entry script declares, and
-# a `readonly` re-run inside a twice-sourced lib would abort under `set -e`.
-# ============================================================================
-
-set -euo pipefail
-
-register_status() {
-    python3 "$GATE" /register 2>/dev/null | head -1
-}
-
-open_browser() {
-    local url="$1"
-    local browser
-    for browser in xdg-open thorium-browser chromium google-chrome-stable firefox librewolf; do
-        if command -v "$browser" >/dev/null 2>&1; then
-            "$browser" "$url" >/dev/null 2>&1 &
-            info "Opened $url in $browser"
-            return 0
-        fi
-    done
-    warn "No browser found; open this yourself: $url"
-}
-
-ensure_key() {
-    if [[ ! -f "$SSH_KEY" ]]; then
-        log "Generating an AUR SSH key (none at $SSH_KEY)"
-        ssh-keygen -t ed25519 -f "$SSH_KEY" -N '' -C 'kuhy@aur'
-    fi
-    if ! grep -q "Host $AUR_HOST" "$HOME/.ssh/config" 2>/dev/null; then
-        log "Adding $AUR_HOST to ~/.ssh/config"
-        mkdir -p "$HOME/.ssh"
-        cat >> "$HOME/.ssh/config" <<EOF
-
-# AUR uses a dedicated key so it stays separate from the GitHub identity.
-Host $AUR_HOST
-    User aur
-    IdentityFile $SSH_KEY
-    IdentitiesOnly yes
-EOF
-        chmod 600 "$HOME/.ssh/config"
-    fi
-}
-
-ssh_works() {
-    # The AUR refuses interactive shells; "Interactive shell is disabled" on a
-    # successful key auth is the success signal, not an error.
-    ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
-        -o ConnectTimeout=15 "aur@$AUR_HOST" help 2>&1 |
-        grep -qiE 'interactive shell is disabled|Welcome to AUR'
-}
-
-wait_for_registration() {
-    local status
-    status="$(register_status)"
-    if [[ "$status" == "200" ]]; then
-        log "AUR registration is OPEN"
-    else
-        log "AUR registration is closed (HTTP $status). Polling every ${POLL_SECONDS}s."
-        info "Ctrl-C to stop; re-run any time, nothing is lost."
-        while :; do
-            sleep "$POLL_SECONDS"
-            status="$(register_status)"
-            if [[ "$status" == "200" ]]; then
-                log "Registration is BACK (HTTP 200)"
-                break
-            fi
-            printf '    %s still HTTP %s\n' "$(date +%H:%M)" "$status"
-        done
-    fi
-
-    open_browser "https://$AUR_HOST/register"
-    cat <<EOF
-
-    ------------------------------------------------------------------
-    Sign up, and paste this into the "SSH Public Key" field:
-
-$(sed 's/^/      /' "$SSH_KEY.pub")
-
-    You will need to confirm the address from your email before the
-    account works. This script waits for that automatically.
-    ------------------------------------------------------------------
-EOF
-}
-
-wait_for_ssh() {
-    log "Waiting for the SSH key to authenticate against the AUR"
-    local waited=0
-    until ssh_works; do
-        sleep 30
-        waited=$((waited + 30))
-        if ((waited % 300 == 0)); then
-            info "still waiting ($((waited / 60)) min) — key not accepted yet"
-        fi
-    done
-    log "SSH authentication OK"
-}
-
-# ---------------------------------------------------------------------------
-# Phase 2: build, verify and publish one package
-# ---------------------------------------------------------------------------
-

aur-publish/lib/aur_verify.sh

@@ -1,122 +0,0 @@
-#!/bin/bash
-
-# ============================================================================
-# Gates a package must pass before it is allowed near the AUR.
-#
-# Sourced by publish.sh, never executed: these functions read the readonly
-# config (AUR_ROOT, DRY_RUN) that the entry script declares, and
-# a `readonly` re-run inside a twice-sourced lib would abort under `set -e`.
-# ============================================================================
-
-set -euo pipefail
-
-newest_tag() {
-    # Newest clean vX.Y.Z on the remote. Build tags (vX.Y.Z-build.N) and the
-    # grafted upstream Flutter SDK tags in diet-guard are excluded on purpose.
-    git -C "$1" ls-remote --tags origin 2>/dev/null |
-        awk '{print $2}' |
-        sed 's|refs/tags/||' |
-        grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
-        sed 's/^v//' |
-        sort -V |
-        tail -1
-}
-
-verify_installed() {
-    local binary="$1" expected="$2" wrapper="$3" output
-
-    # An instance left over from a previous run would make the wrapper print
-    # "already running" and hand off, which passes trivially and turns the
-    # strongest gate in this script into the weakest. Clear it first so the
-    # check always exercises a real cold start.
-    #
-    # Resolved through /proc/<pid>/exe rather than any form of name or
-    # command-line matching. Every argv-based approach selects the wrong
-    # processes here:
-    #   * `pkill -x` compares against the kernel's 15-character comm field, and
-    #     two of these wrappers are longer (habit_stack_desktop is 19), so a
-    #     name match would silently never fire.
-    #   * `pkill -f`, and equally `ps -eo args` piped through a pattern, match
-    #     any process whose command line merely *mentions* the path — this
-    #     script, the shell running it, and the matching tool itself all
-    #     qualify, so the run kills its own shell instead of the app. A
-    #     $$/$PPID guard does not cover it, because the offending shell is
-    #     often a more distant ancestor.
-    # /proc/<pid>/exe is a kernel-maintained symlink to the binary actually
-    # being executed, so it cannot collide with an incidental mention.
-    # The wrapper name is unique per app, so the /opt/<pkg>/ segment is left as
-    # a glob instead of threading the package name through another parameter.
-    #
-    # The link is read without `-f`: it is already fully resolved, and by the
-    # time this runs `pacman -U` has replaced the binary, so a leftover process
-    # points at an unlinked inode that the kernel reports with a " (deleted)"
-    # suffix. That suffix has to be stripped or the match silently misses the
-    # one process this exists to kill.
-    local pid exe killed=()
-    for pid in /proc/[0-9]*; do
-        pid="${pid#/proc/}"
-        exe="$(readlink "/proc/$pid/exe" 2>/dev/null)" || continue
-        exe="${exe% (deleted)}"
-        [[ "$exe" == /opt/*/bin/"$wrapper" ]] || continue
-        kill -TERM "$pid" 2>/dev/null && killed+=("$pid")
-    done
-    if ((${#killed[@]})); then
-        info "stopped a running instance so the launch check is meaningful"
-        # `kill` only reports that the signal was sent. Waiting for the process
-        # to actually go keeps a slow exit from failing the cold start below on
-        # a port that is still bound.
-        local waited=0
-        while ((waited < 100)) && kill -0 "${killed[@]}" 2>/dev/null; do
-            sleep 0.1
-            ((waited++))
-        done
-    fi
-
-    output="$(timeout 15 "/usr/bin/$binary" 2>&1 | head -3 || true)"
-    if grep -qF "$expected" <<<"$output"; then
-        return 0
-    fi
-    warn "unexpected startup output: $output"
-    return 1
-}
-
-# The AUR does not review uploads, but "packages that violate the rules may be
-# deleted without warning" (AUR submission guidelines). These are the rules that
-# are mechanically checkable, enforced here so a violation blocks the push
-# rather than surfacing later as a deletion request.
-check_aur_rules() {
-    local pkg="$1" problems=()
-
-    grep -q '^# Maintainer:' PKGBUILD \
-        || problems+=("missing '# Maintainer:' comment on line 1")
-
-    grep -qE "^arch=\(.*x86_64" PKGBUILD \
-        || problems+=("x86_64 not in arch=() — packages without it are not allowed")
-
-    # `replaces` makes pacman rip out the named package on the next -Sy, which
-    # is only correct for a genuine rename. `conflicts` is the right tool.
-    grep -q '^replaces=' PKGBUILD \
-        && problems+=("uses replaces=; AUR rules reserve it for renames — use conflicts=")
-
-    # A package already in an official repo must never be duplicated.
-    if pacman -Si "$pkg" >/dev/null 2>&1; then
-        problems+=("$pkg exists in an official repo — must not be submitted")
-    fi
-
-    grep -qE '^(pkgdesc|url|license)=' PKGBUILD \
-        || problems+=("missing pkgdesc/url/license")
-
-    # A stale .SRCINFO is the single most common upload rejection.
-    if ! diff -q <(makepkg --printsrcinfo) .SRCINFO >/dev/null 2>&1; then
-        problems+=(".SRCINFO does not match PKGBUILD")
-    fi
-
-    if ((${#problems[@]})); then
-        warn "$pkg: AUR rule violations:"
-        printf '      - %s\n' "${problems[@]}"
-        return 1
-    fi
-    info "AUR rule checks passed"
-    return 0
-}
-

aur-publish/publish.sh

@@ -1,148 +0,0 @@
-#!/bin/bash
-
-# ============================================================================
-# Publish kuhy's three Flutter apps to the AUR, hands-off.
-#
-# Run this once AUR registration is back. It:
-#   1. Waits for https://aur.archlinux.org/register to stop returning 503,
-#      then opens it in a browser and prints the SSH key to paste.
-#      (Signup is the ONLY manual step: it needs an email confirmation, and
-#      creating accounts is not something this script will do for you.)
-#   2. Waits for `ssh aur@aur.archlinux.org` to authenticate.
-#   3. From there, fully unattended, for each package:
-#        newest release tag -> pkgver -> updpkgsums -> makepkg -C -> namcap
-#        -> pacman -U -> launch check -> .SRCINFO -> clone AUR repo
-#        -> commit -> push.
-#
-# Every package is BUILT, INSTALLED and LAUNCHED before it is pushed, so a
-# broken package cannot reach the AUR. A package that fails any gate is
-# skipped and reported; the others still publish.
-#
-# Idempotent and resumable: re-running skips work that is already done, and
-# an already-published package is updated rather than duplicated.
-# ============================================================================
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-readonly SCRIPT_DIR
-readonly GATE="$SCRIPT_DIR/anubis_gate.py"
-readonly AUR_HOST="aur.archlinux.org"
-readonly SSH_KEY="$HOME/.ssh/aur"
-readonly AUR_ROOT="$HOME/sdk/aur"
-
-# package:repo:wrapper-process:cli-name:expected-startup-string
-# The wrapper process name is NOT derivable from the package name
-# (diet-guard-app runs diet_guard_desktop), so it is listed explicitly.
-readonly PACKAGES=(
-    "todo-flutter:$HOME/src/todo:todo_desktop:todo:serving on http://localhost:8730"
-    "habit-stack:$HOME/src/habit_stack:habit_stack_desktop:habit-stack:serving on http://localhost:8731"
-    "diet-guard-app:$HOME/src/diet-guard:diet_guard_desktop:diet-guard-app:serving on http://localhost:8732"
-)
-
-POLL_SECONDS=300
-SKIP_WAIT=0
-DRY_RUN=0
-ONLY=""
-FAILED=()
-PUBLISHED=()
-
-usage() {
-    cat <<EOF
-Usage: $(basename "$0") [OPTIONS]
-
-Options:
-  --skip-wait        Assume the account + SSH key already work; go straight
-                     to building and publishing.
-  --dry-run          Do everything except the final 'git push' to the AUR.
-  --only NAME        Publish just one package (todo-flutter, habit-stack,
-                     diet-guard-app).
-  --poll SECONDS     How often to re-check /register (default: $POLL_SECONDS).
-  -h, --help         Show this help.
-EOF
-    exit 0
-}
-
-log()  { printf '\n\033[1;34m==>\033[0m %s\n' "$*"; }
-info() { printf '    %s\n' "$*"; }
-warn() { printf '\033[1;33m  ! %s\033[0m\n' "$*" >&2; }
-die()  { printf '\033[1;31m==> ERROR: %s\033[0m\n' "$*" >&2; exit 1; }
-
-require_tools() {
-    local missing=()
-    local tool
-    for tool in git makepkg updpkgsums namcap ssh python3 curl; do
-        command -v "$tool" >/dev/null 2>&1 || missing+=("$tool")
-    done
-    if ((${#missing[@]})); then
-        info "Installing missing tools: ${missing[*]}"
-        # namcap/updpkgsums come from namcap + pacman-contrib; the rest are base.
-        sudo pacman -S --needed --noconfirm namcap pacman-contrib git openssh python \
-            || die "could not install: ${missing[*]}"
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# Phase 1: wait for registration, then for the key to work
-# ---------------------------------------------------------------------------
-
-# The rest lives in lib/, sourced (not executed) so every function sees the
-# readonly config above and the mutable FAILED/PUBLISHED arrays main() reads.
-# shellcheck source=lib/aur_registration.sh
-source "$SCRIPT_DIR/lib/aur_registration.sh"
-# shellcheck source=lib/aur_verify.sh
-source "$SCRIPT_DIR/lib/aur_verify.sh"
-# shellcheck source=lib/aur_publish_one.sh
-source "$SCRIPT_DIR/lib/aur_publish_one.sh"
-
-main() {
-    require_tools
-    [[ -f "$GATE" ]] || die "missing $GATE"
-    mkdir -p "$AUR_ROOT"
-
-    ensure_key
-    if ((SKIP_WAIT)); then
-        ssh_works || die "SSH key is not accepted yet; drop --skip-wait to wait for it"
-    else
-        wait_for_registration
-        wait_for_ssh
-    fi
-
-    local entry pkg repo wrapper binary expected
-    for entry in "${PACKAGES[@]}"; do
-        IFS=: read -r pkg repo wrapper binary expected <<<"$entry"
-        [[ -z "$ONLY" || "$ONLY" == "$pkg" ]] || continue
-        if ! publish_one "$pkg" "$repo" "$wrapper" "$binary" "$expected"; then
-            FAILED+=("$pkg")
-        fi
-    done
-
-    log "Summary"
-    if ((${#PUBLISHED[@]})); then
-        printf '    published: %s\n' "${PUBLISHED[@]}"
-    fi
-    if ((${#FAILED[@]})); then
-        printf '\033[1;31m    FAILED:    %s\033[0m\n' "${FAILED[@]}"
-        info "Nothing broken was pushed; fix and re-run (safe to repeat)."
-        return 1
-    fi
-    if ((${#PUBLISHED[@]} == 0)); then
-        warn "nothing to do"
-        return 1
-    fi
-    printf '\n    Check: https://aur.archlinux.org/packages/todo-flutter\n'
-    return 0
-}
-
-while [[ $# -gt 0 ]]; do
-    case $1 in
-        --skip-wait) SKIP_WAIT=1; shift ;;
-        --dry-run)   DRY_RUN=1; shift ;;
-        --only)      ONLY="$2"; shift 2 ;;
-        --poll)      POLL_SECONDS="$2"; shift 2 ;;
-        -h|--help)   usage ;;
-        *)           die "Unknown option: $1" ;;
-    esac
-done
-
-main "$@"

crdt_sync_dart/README.md

@@ -118,6 +118,16 @@ The public/private split is not cosmetic: every repo in this fleet is public.
 APK — the security rules, not secrecy, protect the data. The account email and
 password identify *a person* and are entered once per device.
 
+### Sandbox namespace for test builds
+
+`--dart-define=SYNC_NAMESPACE=sandbox/slot3` moves every RTDB read and write
+under `/sandbox/slot3/...`, so a test build never touches real data. Sign-in
+is unchanged (the real account). Empty, the default, keeps the exact current
+paths. Only `^sandbox/[a-z0-9_-]+$` is accepted; anything else throws
+`ConfigException` at startup (`firebaseClientFor` / `FirebaseRestClient`), never
+falling back to production paths. The shipped rules (root-level uid pin) already
+allow these paths.
+
 ### `password: ''` is legal
 
 The Google one-tap path and the seeded-session path both store an empty

crdt_sync_dart/lib/crdt_sync.dart

@@ -20,4 +20,5 @@ export 'src/remote_store.dart';
 export 'src/secure_credential_store.dart';
 export 'src/store.dart';
 export 'src/sync.dart';
+export 'src/sync_namespace.dart';
 export 'src/sync_state.dart';

crdt_sync_dart/lib/src/firebase_client.dart

@@ -19,6 +19,7 @@ import 'firebase_auth_rest.dart';
 import 'firebase_errors.dart';
 import 'firebase_keys.dart';
 import 'remote_store.dart';
+import 'sync_namespace.dart';
 
 const _httpUnauthorized = 401;
 const _httpForbidden = 403;
@@ -33,13 +34,22 @@ class FirebaseRestClient implements RemoteStore, BulkMapReader {
     required String databaseUrl,
     required this.auth,
     http.Client? httpClient,
+    String namespace = syncNamespace,
   }) : _databaseUrl = databaseUrl.endsWith('/')
            ? databaseUrl.substring(0, databaseUrl.length - 1)
            : databaseUrl,
+       _prefix = _prefixFor(checkSyncNamespace(namespace)),
        _http = httpClient ?? http.Client();
 
   final String _databaseUrl;
 
+  /// `<namespace>/` or empty: put in front of every RTDB path. Every request
+  /// goes through [_uri], so this is the single choke point.
+  final String _prefix;
+
+  static String _prefixFor(String namespace) =>
+      namespace.isEmpty ? '' : '$namespace/';
+
   /// Mints the ID token every request carries. Public so a settings screen
   /// can drive `signIn` / `signOut` through the same instance the client uses.
   final FirebaseTokenProvider auth;
@@ -47,8 +57,12 @@ class FirebaseRestClient implements RemoteStore, BulkMapReader {
 
   Future<Uri> _uri(String path, {Map<String, String> query = const {}}) async {
     final encoded = encodePath(path);
+    // A bare namespace (the root probe) must not leave a trailing slash.
+    final full = encoded.isEmpty && _prefix.isNotEmpty
+        ? _prefix.substring(0, _prefix.length - 1)
+        : '$_prefix$encoded';
     return Uri.parse(
-      '$_databaseUrl/$encoded.json',
+      '$_databaseUrl/$full.json',
     ).replace(queryParameters: {'auth': await auth.idToken(), ...query});
   }
 

crdt_sync_dart/lib/src/firebase_config.dart

@@ -20,6 +20,7 @@ import 'firebase_credentials.dart';
 import 'firebase_client.dart';
 import 'mirror_store.dart';
 import 'remote_store.dart';
+import 'sync_namespace.dart';
 
 /// The shared config is missing a field, or still holds a scaffold placeholder.
 class ConfigException implements Exception {
@@ -121,6 +122,8 @@ Future<FirebaseRestClient> firebaseClientFor({
   String? expectedUid,
   http.Client? httpClient,
 }) async {
+  // Before any sign-in: a bad SYNC_NAMESPACE must stop the app at startup.
+  checkSyncNamespace(syncNamespace);
   final auth = FirebaseTokenProvider(
     apiKey: config.apiKey,
     store: store,

crdt_sync_dart/lib/src/io_store.dart

@@ -7,8 +7,11 @@ import 'store.dart';
 /// Writes atomically -- to a per-process temp file, then `rename`d over the
 /// real path -- so a concurrent reader (e.g. a background sync isolate writing
 /// while the foreground app also writes) never observes a half-written file.
-/// The pid in the temp name keeps two writers from colliding. This generalizes
-/// diet_guard's hand-rolled `LogStorageService` write scheme.
+/// The pid in the temp name keeps two processes from colliding; within one
+/// instance, writes are serialized in issue order (last issued wins), so
+/// overlapping calls (e.g. per-keystroke saves) never share the temp file
+/// mid-flight. This generalizes diet_guard's hand-rolled `LogStorageService`
+/// write scheme.
 ///
 /// Lives behind the `package:crdt_sync/crdt_sync_io.dart` entrypoint, not the
 /// main barrel, because it imports `dart:io` and so is unavailable on web --
@@ -20,6 +23,10 @@ class FileLogPersistence implements LogPersistence {
 
   final File _file;
 
+  /// Completes when the most recently issued write has settled. Never
+  /// rejects, so one failed write cannot block the ones queued after it.
+  Future<void> _tail = Future<void>.value();
+
   @override
   Future<String?> read() async {
     if (!_file.existsSync()) return null;
@@ -31,7 +38,14 @@ class FileLogPersistence implements LogPersistence {
   }
 
   @override
-  Future<void> write(String text) async {
+  Future<void> write(String text) {
+    final result = _tail.then((_) => _writeNow(text));
+    // The caller still sees its own error via [result]; the chain ignores it.
+    _tail = result.then((_) {}, onError: (Object _) {});
+    return result;
+  }
+
+  Future<void> _writeNow(String text) async {
     await _file.parent.create(recursive: true);
     final tmp = File('${_file.path}.$pid.tmp');
     await tmp.writeAsString(text);

crdt_sync_dart/lib/src/sync_namespace.dart

@@ -0,0 +1,26 @@
+/// Compile-time sandbox namespace for the Realtime Database.
+///
+/// Build a test app with `--dart-define=SYNC_NAMESPACE=sandbox/slot3` and every
+/// RTDB path the library reads or writes moves under `/sandbox/slot3/`, so a
+/// test build can never touch real data. Sign-in is unchanged (real account).
+/// Empty, the default, leaves every path exactly as it was.
+library;
+
+import 'firebase_config.dart';
+
+/// The `SYNC_NAMESPACE` dart-define; empty means production paths.
+const String syncNamespace = String.fromEnvironment('SYNC_NAMESPACE');
+
+final RegExp _allowed = RegExp(r'^sandbox/[a-z0-9_-]+$');
+
+/// Returns [namespace] when it is empty or `sandbox/<slot>`, else throws.
+///
+/// Fails closed: a typo must stop the app at startup, never quietly fall back
+/// to production paths. A trailing newline is rejected too.
+String checkSyncNamespace(String namespace) {
+  if (namespace.isEmpty || _allowed.hasMatch(namespace)) return namespace;
+  throw ConfigException(
+    'SYNC_NAMESPACE "$namespace" is invalid: it must be empty or match '
+    r'^sandbox/[a-z0-9_-]+$ (e.g. sandbox/slot3)',
+  );
+}

crdt_sync_dart/pubspec.yaml

@@ -2,7 +2,7 @@ name: crdt_sync
 description: >-
   Shared CRDT merge scheme + GitHub-Contents-API sync transport for
   cross-device apps. Pure Dart, no Flutter dependency.
-version: 0.11.3
+version: 0.12.1
 publish_to: 'none'
 
 environment:

crdt_sync_dart/test/default_client_and_io_test.dart

@@ -128,5 +128,32 @@ void main() {
       await store.write('{"hello":"world"}');
       expect(await store.read(), '{"hello":"world"}');
     });
+
+    test('50 overlapping writes all succeed and the last issued wins',
+        () async {
+      // Regression: every call shared one `<file>.<pid>.tmp`, so the first
+      // rename moved it away and a later rename threw PathNotFoundException.
+      final store = FileLogPersistence(File('${dir.path}/log.json'));
+      await Future.wait([
+        for (var i = 0; i < 50; i++) store.write('{"n":$i}'),
+      ]);
+      expect(await store.read(), '{"n":49}');
+      expect(dir.listSync().map((e) => e.uri.pathSegments.last),
+          ['log.json']);
+    });
+
+    test('a failed write rejects its caller but does not block later writes',
+        () async {
+      final target = File('${dir.path}/log.json');
+      // A directory at the target path makes the rename fail.
+      Directory(target.path).createSync();
+      final store = FileLogPersistence(target);
+      await expectLater(
+          store.write('{"n":0}'), throwsA(isA<FileSystemException>()));
+
+      Directory(target.path).deleteSync();
+      await store.write('{"n":1}');
+      expect(await store.read(), '{"n":1}');
+    });
   });
 }

crdt_sync_dart/test/sync_namespace_test.dart

@@ -0,0 +1,170 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:crdt_sync/crdt_sync.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart' as http_testing;
+import 'package:test/test.dart';
+
+const _databaseUrl = 'https://example-default-rtdb.firebasedatabase.app';
+
+FirebaseTokenProvider _auth() => FirebaseTokenProvider(
+  apiKey: 'fake-api-key',
+  store: InMemoryCredentialStore(
+    FirebaseCredentials(
+      idToken: 'id-token',
+      refreshToken: 'refresh-token',
+      expiresAt: DateTime.utc(2099),
+    ),
+  ),
+  httpClient: http_testing.MockClient(
+    (_) async => throw StateError('auth must not be contacted'),
+  ),
+);
+
+/// Client over an in-memory transport that records every request path.
+(FirebaseRestClient, List<http.Request>) _client(String? namespace) {
+  final requests = <http.Request>[];
+  final mock = http_testing.MockClient((request) async {
+    requests.add(request);
+    return http.Response(jsonEncode(request.method == 'GET' ? null : 'x'), 200);
+  });
+  final client = namespace == null
+      ? FirebaseRestClient(
+          databaseUrl: _databaseUrl,
+          auth: _auth(),
+          httpClient: mock,
+        )
+      : FirebaseRestClient(
+          databaseUrl: _databaseUrl,
+          auth: _auth(),
+          httpClient: mock,
+          namespace: namespace,
+        );
+  return (client, requests);
+}
+
+void main() {
+  group('compile-time default', () {
+    test('is empty when SYNC_NAMESPACE is not defined', () {
+      expect(syncNamespace, isEmpty);
+    });
+
+    test('empty namespace leaves paths byte-for-byte unchanged', () async {
+      final (client, requests) = _client(null);
+      await client.getFileText('devices/pc/log.json');
+      expect(requests.single.url.path, '/devices/pc/log~2Ejson.json');
+    });
+  });
+
+  group('prefixing', () {
+    test('every operation lands under the namespace', () async {
+      final (client, requests) = _client('sandbox/slot3');
+      await client.getFileText('devices/pc/log.json');
+      await client.putFileText('devices/pc/log.json', 't', message: 'm');
+      await client.listDirectory('devices');
+      await client.getStringMap('revs');
+      await client.patchValues('revs', {'a': 'b'});
+      await client.deleteFile('devices/pc/log.json');
+      await client.canAccessRemote();
+      expect(requests.map((r) => r.url.path), [
+        '/sandbox/slot3/devices/pc/log~2Ejson.json',
+        '/sandbox/slot3/devices/pc/log~2Ejson.json',
+        '/sandbox/slot3/devices.json',
+        '/sandbox/slot3/revs.json',
+        '/sandbox/slot3/revs.json',
+        '/sandbox/slot3/devices/pc/log~2Ejson.json',
+        '/sandbox/slot3.json',
+      ]);
+    });
+
+    test('an explicitly empty namespace is the unprefixed path', () async {
+      final (client, requests) = _client('');
+      await client.getStringMap('revs');
+      expect(requests.single.url.path, '/revs.json');
+    });
+  });
+
+  group('validation (fail closed)', () {
+    const bad = [
+      'sandbox',
+      'sandbox/',
+      'sandbox/Slot3',
+      'sandbox/slot 3',
+      'sandbox/slot3/',
+      'sandbox/a/b',
+      '/sandbox/slot3',
+      'prod/slot3',
+      'sandbox/slot3\n',
+      'Sandbox/slot3',
+      'sandbox/slot.3',
+      'sandbox/..',
+    ];
+
+    for (final value in bad) {
+      test('rejects ${jsonEncode(value)}', () {
+        expect(
+          () => checkSyncNamespace(value),
+          throwsA(isA<ConfigException>()),
+        );
+        expect(
+          () => FirebaseRestClient(
+            databaseUrl: _databaseUrl,
+            auth: _auth(),
+            namespace: value,
+          ),
+          throwsA(isA<ConfigException>()),
+        );
+      });
+    }
+
+    test('the message names the define and the required shape', () {
+      expect(
+        () => checkSyncNamespace('typo'),
+        throwsA(
+          isA<ConfigException>().having(
+            (e) => e.message,
+            'message',
+            allOf(
+              contains('SYNC_NAMESPACE'),
+              contains(r'^sandbox/[a-z0-9_-]+$'),
+            ),
+          ),
+        ),
+      );
+    });
+
+    test('accepts the allowed alphabet', () {
+      expect(() => checkSyncNamespace('sandbox/slot3'), returnsNormally);
+      expect(() => checkSyncNamespace('sandbox/a_b-c9'), returnsNormally);
+      expect(() => checkSyncNamespace(''), returnsNormally);
+    });
+
+    test(
+      'a bad compile-time define stops firebaseClientFor at startup',
+      () async {
+        // The define is compile-time, so only a fresh process can set it.
+        final result = await Process.run(Platform.resolvedExecutable, [
+          '-DSYNC_NAMESPACE=sandbox/Typo',
+          'run',
+          'tool/namespace_probe.dart',
+        ]);
+        expect(result.exitCode, isNot(0));
+        expect(
+          result.stderr,
+          contains('SYNC_NAMESPACE "sandbox/Typo" is invalid'),
+        );
+      },
+    );
+
+    test('a good compile-time define reaches the request path', () async {
+      final result = await Process.run(Platform.resolvedExecutable, [
+        '-DSYNC_NAMESPACE=sandbox/slot3',
+        'run',
+        'tool/namespace_probe.dart',
+      ]);
+      expect(result.stderr, isEmpty);
+      expect(result.stdout, '/sandbox/slot3/devices.json\n');
+    });
+  });
+}

crdt_sync_dart/tool/namespace_probe.dart

@@ -0,0 +1,31 @@
+// Helper for test/sync_namespace_test.dart: the SYNC_NAMESPACE define is
+// compile-time, so the test runs this in a fresh process with -D set. It signs
+// in from an in-memory session (no network) and prints the first request path.
+import 'package:crdt_sync/crdt_sync.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart' as http_testing;
+
+Future<void> main() async {
+  final mock = http_testing.MockClient((request) async {
+    print(request.url.path);
+    return http.Response('null', 200);
+  });
+  final client = await firebaseClientFor(
+    config: const FirebaseConfig(
+      apiKey: 'k',
+      databaseUrl: 'https://example.firebasedatabase.app',
+      projectId: 'p',
+      uid: 'u',
+      email: 'e@x.y',
+    ),
+    store: InMemoryCredentialStore(
+      FirebaseCredentials(
+        idToken: 'i',
+        refreshToken: 'r',
+        expiresAt: DateTime.utc(2099),
+      ),
+    ),
+    httpClient: mock,
+  );
+  await client.listDirectory('devices');
+}

crdt_sync_flutter/pubspec.lock

@@ -61,11 +61,11 @@ packages:
     dependency: "direct main"
     description:
       path: crdt_sync_dart
-      ref: "crdt_sync_dart-v0.11.3"
-      resolved-ref: a2e7334dfec5131170a084510d70361d53dc40bc
+      ref: "crdt_sync_dart-v0.12.0"
+      resolved-ref: "59b33949e4a130bb76c77e7434ddf4bbf8cde3a3"
       url: "https://github.com/kuhyx/utils"
     source: git
-    version: "0.11.3"
+    version: "0.12.0"
   crypto:
     dependency: "direct main"
     description:

crdt_sync_flutter/pubspec.yaml

@@ -4,7 +4,7 @@ description: >-
   persisted per-install device id, and a one-call bootstrap. Removes the
   ~150 lines of firebase_backend.dart every consuming app was copying.
 publish_to: 'none'
-version: 0.4.0
+version: 0.5.1
 
 environment:
   sdk: ^3.12.2
@@ -13,7 +13,7 @@ dependencies:
   crdt_sync:
     git:
       url: https://github.com/kuhyx/utils
-      ref: crdt_sync_dart-v0.11.3
+      ref: crdt_sync_dart-v0.12.1
       path: crdt_sync_dart
   crypto: 3.0.8
   flutter:

data_transfer_flutter/README.md

@@ -11,7 +11,7 @@ dependencies:
   data_transfer_flutter:
     git:
       url: https://github.com/kuhyx/utils
-      ref: data_transfer_flutter-v0.2.0
+      ref: data_transfer_flutter-v0.2.1
       path: data_transfer_flutter
 ```
 

data_transfer_flutter/pubspec.yaml

@@ -4,13 +4,13 @@ description: >-
   Flutter apps: system Save-as on Android/iOS (never cloud-only), a save
   dialog on desktop, a download on web, plus a versioned export envelope.
 publish_to: 'none'
-version: 0.2.0
+version: 0.2.2
 
 environment:
   sdk: ^3.12.2
 
 dependencies:
-  file_picker: 13.3.1
+  file_picker: 13.3.3
   file_selector: 1.1.0
   flutter:
     sdk: flutter

dep_freshness/_tables.py

@@ -91,6 +91,8 @@ NPM_ACCEPT: Final = "application/vnd.npm.install-v1+json"
 # --- Cache ------------------------------------------------------------------
 
 CACHE_PATH_ENV: Final = "DEP_FRESHNESS_CACHE"
+# Seconds; overrides every ecosystem TTL (a repo that wants a once-a-day gate).
+TTL_ENV: Final = "DEP_FRESHNESS_TTL_SECONDS"
 DEFAULT_CACHE_DIR: Final = "~/.cache/dep-freshness"
 CACHE_FILE: Final = "registry.json"
 TTL_SECONDS: Final = 6 * 3600

dep_freshness/cache.py

@@ -21,6 +21,7 @@ from dep_freshness._tables import (
     DEFAULT_CACHE_DIR,
     GITCOMMIT,
     GITTAG,
+    TTL_ENV,
     TTL_GITTAG_SECONDS,
     TTL_SECONDS,
 )
@@ -33,7 +34,14 @@ def cache_dir() -> Path:
 
 
 def ttl_for(ecosystem: str) -> int:
-    """Git refs move rarely and cost a subprocess, so they cache longer."""
+    """Git refs move rarely and cost a subprocess, so they cache longer.
+
+    `DEP_FRESHNESS_TTL_SECONDS` overrides both; garbage is ignored, because a
+    typo in an env var must not break a commit hook.
+    """
+    override = os.environ.get(TTL_ENV, "")
+    if override.isdigit() and int(override) > 0:
+        return int(override)
     return TTL_GITTAG_SECONDS if ecosystem in (GITTAG, GITCOMMIT) else TTL_SECONDS
 
 

dep_freshness/tests/test_resolve.py

@@ -12,6 +12,7 @@ from pathlib import Path
 
 import pytest
 
+from dep_freshness._tables import TTL_SECONDS
 from dep_freshness.cache import Cache, Entry, ttl_for
 from dep_freshness.models import Dep
 from dep_freshness.registries import http
@@ -139,3 +140,16 @@ def _offline(*_args):
 
 def _explode(*_args):
     raise RuntimeError("boom")
+
+
+def test_ttl_env_overrides_the_registry_ttl(monkeypatch) -> None:
+    """A repo can stretch the refresh window (once-a-day pre-push gates)."""
+    monkeypatch.setenv("DEP_FRESHNESS_TTL_SECONDS", "86400")
+    assert ttl_for("npm") == 86400
+    assert ttl_for("gittag") == 86400
+
+
+def test_ttl_env_garbage_falls_back_to_the_default(monkeypatch) -> None:
+    """A malformed value must never break a commit hook."""
+    monkeypatch.setenv("DEP_FRESHNESS_TTL_SECONDS", "soon")
+    assert ttl_for("npm") == TTL_SECONDS

design_system/lib/src/fit_grid.dart

@@ -8,9 +8,10 @@ import 'package:flutter/material.dart';
 ///
 /// Rows per page come from the height the parent gives it; the overflow moves
 /// to further pages in a horizontal [PageView], marked by dots once there is
-/// more than one. [itemBuilder] gets the global item index and must fill the
-/// cell it is given: a square of up to column width plus [labelHeight], the
-/// rows stretching to use up the leftover height.
+/// more than one (a "n / N" counter past 12 pages). [itemBuilder] gets the
+/// global item index and must fill the cell it is given: a square of up to
+/// column width plus [labelHeight], the rows stretching to use up the
+/// leftover height.
 class FitGrid extends StatefulWidget {
   /// Creates the grid.
   const FitGrid({
@@ -54,6 +55,10 @@ class FitGrid extends StatefulWidget {
 const double _dotSize = AppSpacing.sm;
 const double _dotsHeight = AppSpacing.md + AppSpacing.xs;
 
+// Above this many pages a row of dots outgrows a phone width, so the
+// indicator becomes a "n / N" counter instead.
+const int _maxDots = 12;
+
 class _FitGridState extends State<FitGrid> {
   final _controller = PageController();
   var _page = 0;
@@ -159,22 +164,35 @@ class _Dots extends StatelessWidget {
     return ExcludeSemantics(
       child: SizedBox(
         height: _dotsHeight,
-        child: Row(
-          mainAxisAlignment: MainAxisAlignment.center,
-          children: [
-            for (var i = 0; i < count; i++)
-              Container(
-                key: ValueKey<String>('fit-grid-dot-$i'),
-                width: _dotSize,
-                height: _dotSize,
-                margin: const EdgeInsets.symmetric(horizontal: AppSpacing.xs),
-                decoration: BoxDecoration(
-                  shape: BoxShape.circle,
-                  color: i == current ? scheme.primary : scheme.outlineVariant,
+        child: count > _maxDots
+            ? Center(
+                child: Text(
+                  '${current + 1} / $count',
+                  key: const ValueKey<String>('fit-grid-page-counter'),
+                  style: Theme.of(context).textTheme.labelSmall,
+                  textScaler: TextScaler.noScaling,
                 ),
+              )
+            : Row(
+                mainAxisAlignment: MainAxisAlignment.center,
+                children: [
+                  for (var i = 0; i < count; i++)
+                    Container(
+                      key: ValueKey<String>('fit-grid-dot-$i'),
+                      width: _dotSize,
+                      height: _dotSize,
+                      margin: const EdgeInsets.symmetric(
+                        horizontal: AppSpacing.xs,
+                      ),
+                      decoration: BoxDecoration(
+                        shape: BoxShape.circle,
+                        color: i == current
+                            ? scheme.primary
+                            : scheme.outlineVariant,
+                      ),
+                    ),
+                ],
               ),
-          ],
-        ),
       ),
     );
   }

design_system/pubspec.yaml

@@ -5,7 +5,7 @@ description: >-
   helpers that were each reimplemented in three or more repos. Owns the tokens
   -- consumers import them rather than transcribing the token table by hand.
 publish_to: 'none'
-version: 0.3.0
+version: 0.3.1
 
 environment:
   sdk: ^3.12.2

design_system/test/fit_grid_test.dart

@@ -126,6 +126,30 @@ void main() {
     expect(find.text('item $perPage').hitTestable(), findsNothing);
   });
 
+  testWidgets('more than 12 pages: "n / N" counter instead of dots', (
+    tester,
+  ) async {
+    await _pump(tester, count: 30);
+    final perPage = _onScreen(tester);
+    final count = perPage * 13;
+    await _pump(tester, count: count);
+    expect(_dot, findsNothing);
+    final counter = find.byKey(const ValueKey('fit-grid-page-counter'));
+    expect(tester.widget<Text>(counter).data, '1 / 13');
+    await tester.fling(find.byType(PageView), const Offset(-250, 0), 1000);
+    await tester.pumpAndSettle();
+    expect(tester.widget<Text>(counter).data, '2 / 13');
+    expect(tester.takeException(), isNull);
+  });
+
+  testWidgets('exactly 12 pages still shows dots', (tester) async {
+    await _pump(tester, count: 30);
+    final perPage = _onScreen(tester);
+    await _pump(tester, count: perPage * 12);
+    expect(_dot, findsNWidgets(12));
+    expect(tester.takeException(), isNull);
+  });
+
   testWidgets('swiping left shows the next page and moves the dot', (
     tester,
   ) async {

dopamine-ux/DOCS-dopamine-ux-index.md

@@ -1,165 +0,0 @@
-# Dopamine UX — session prompts
-
-Ten pasteable prompts derived from *"The Dopamine Architecture: How UX Designers
-Hold User Attention in 2026"* (london-post.co.uk), applied to kuhy's repos.
-
-Paste **one file's contents** into a fresh Claude session. Each is
-self-contained: it restates the findings it depends on, so no session needs the
-context of another.
-
-## The two tests — every change must pass both
-
-The article's four mechanics (variable rewards, micro-animations, sound design,
-near-miss) are in scope, aimed at **kuhy's own stated goals**. They are gated by
-two questions, not by an allow/deny list:
-
-1. **Is the displayed state true?** A progress ring at 93% is legitimate *iff*
-   you are actually at 93%. A streak is legitimate iff it counts real days.
-   Dopamine may come from framing, timing and salience — **never from a
-   fabricated number**.
-2. **Is the variance real?** A random pick from a real pool (next workout, next
-   task) is legitimate. Injected random bonus points to manufacture uncertainty
-   are not.
-
-### The load-bearing corollary
-
-**Reward the recording, never the number recorded.** In diet-guard the
-satisfying moment fires on *logging a meal*, not on hitting a calorie target —
-otherwise the app rewards eating less rather than recording honestly, and
-corrupts its own data. Same shape in workout_app (reward logging a workout, not
-beating a PB) and todo (reward capture, not completion count).
-
-## Running order
-
-`01` gates everything. `07` gates `08`. Everything else is independent.
-
-| # | File | Repo | Findings |
-|---|---|---|---|
-| 01 | `01-motion-tokens.md` | `~/src/utils` | 3 |
-| 02 | `02-structural-check.md` | `~/src/utils` | 2 |
-| 03 | todo note `85ca329b-9809-412c-a47f-eddf055322cf` | `~/src/diet-guard` | 4 |
-| 04 | todo note `73a20837-6480-4b31-b966-1898a4e7272e` | `~/src/screen-locker` | 3 |
-| 05 | todo note `e50d6a03-ae7d-4da5-bbd3-c33b17f6f074` | `~/src/screen-locker/stronglift_replacement/workout_app` | 4 |
-| 06 | `06-todo.md` | `~/src/todo` | 3 |
-| 07 | `07-dufs-theme.md` | `~/src/dufs-cloud` | 2 |
-| 08 | todo note `e301e090-b2ee-4e26-8387-00f356b63521` | `~/src/dufs-cloud` | 4 |
-| 09 | todo note `9e1e4922-9f29-4bad-bcf4-96826aa8ffa4` | `~/src/wake-alarm` | 2 |
-
-**27 ranked findings total.**
-
-### Dependency graph
-
-```
-01-motion-tokens ──┬─→ 03, 04, 05, 09   (transcribe tokens locally)
-                   ├─→ 06               (bump design_system-v0.2.0)
-                   └─→ 07 ─→ 08         (bump web_ui-v0.3.2)
-02-structural-check  (independent; run after 01 so it has motion tokens to check)
-```
-
-## The top three findings fleet-wide
-
-Ranked by value-over-effort from the survey data:
-
-1. **screen-locker streak render** (prompt 04) — `snapshot.streak` is already
-   populated and no renderer reads it. Zero new state, zero conftest change,
-   zero new dependency.
-2. **diet-guard `_onLogMeal` feedback** (prompt 03) — the flagship case.
-   Dependency-free via `HapticFeedback` from `flutter/services.dart`.
-3. **workout_app finish-workout cue** (prompt 05) — `audioplayers`, `vibration`,
-   the `assets:` block and the VIBRATE permission are **already present**. Only
-   the call is missing.
-
-## Distributed copies, and the completion protocol
-
-Each prompt is **also copied into the repo it acts on**, at
-`<repo>/prompts/dopamine-ux-*.md`, so you can open a repo and say
-"do dopamine-ux-<name>" without going hunting. **This directory stays the source
-of truth** — if a prompt needs correcting, fix it here and re-distribute.
-
-| Prompt | Distributed to |
-|---|---|
-| 01 | `~/src/utils/prompts/dopamine-ux-01-motion-tokens.md` — deleted (done) |
-| 02 | `~/src/utils/prompts/dopamine-ux-02-structural-check.md` |
-| 03 | `~/src/diet-guard/prompts/dopamine-ux-diet-guard.md` |
-| 04 | `~/src/screen-locker/prompts/dopamine-ux-04-screen-locker.md` — deleted (done) |
-| 05 | `~/src/screen-locker/prompts/dopamine-ux-05-workout-app.md` — deleted (done) |
-| 06 | `~/src/todo/prompts/dopamine-ux-todo.md` |
-| 07 | `~/src/dufs-cloud/prompts/dopamine-ux-07-theme.md` |
-| 08 | `~/src/dufs-cloud/prompts/dopamine-ux-08-motion.md` |
-| 09 | `~/src/wake-alarm/prompts/dopamine-ux-wake-alarm.md` |
-
-When a session finishes a prompt it **deletes its repo copy** (in the same
-commit as the implementation) and **appends a row below**. A finished prompt left
-in a repo is indistinguishable from a pending one, and the next session re-runs
-it. Partial completion is never recorded as DONE — the file is edited to state
-what remains instead.
-
-### Completion log
-
-| Prompt | Status | Impl commit | Note |
-|---|---|---|---|
-| 01-motion-tokens.md | DONE 2026-08-22 | `f741896` | `motion.md` frozen; `AppDuration`/`AppCurve` + `--duration-*`/`--ease-*` shipped. Tags: `design_system-v0.2.0`, `web_ui-v0.3.2`. |
-| 02-structural-check.md | not started | — | — |
-| todo note `85ca329b-9809-412c-a47f-eddf055322cf` | not started | — | — |
-| todo note `73a20837-6480-4b31-b966-1898a4e7272e` | DONE 2026-11-01 | `89c65bd` | Status window `_section_streak` + week-transition reward text (kept in `extra_benefits_state.json`); the dead 09:00 early-bird claim is not shown. Per kuhy: no daily-streak state, no shutdown time, no freezes. Commit is on a worktree branch, unpushed. |
-| todo note `e50d6a03-ae7d-4da5-bbd3-c33b17f6f074` | DONE 2026-11-01 | `e938201` | Set/warmup `selectionClick`, finish `mediumImpact` + generated chime (music_theory, pinned tag) + dialog arrival, `AppDuration`/`AppCurve` in theme.dart, streak counts up, reduced motion honoured, one Settings "Sound" switch for chime and break-end (foreground service too). Worktree commits, unpushed; `62c1c2c` covers old export/import gaps. |
-| 06-todo.md | PARTIAL 2026-11-02 (step 1 DONE; step 2 sound REJECTED by kuhy) | `kuhyx/todo-app 2ffae26` | haptic + checkmark on capture, appRoute motion tokens, animated wizard bar; no sound by decision |
-| 07-dufs-theme.md | not started | — | — |
-| todo note `e301e090-b2ee-4e26-8387-00f356b63521` | not started | — | — |
-| todo note `9e1e4922-9f29-4bad-bcf4-96826aa8ffa4` | not started | — | — |
-
-## Keeping these prompts honest
-
-Every path and symbol cited across these files is machine-checked:
-
-```
-python3 ~/src/utils/dopamine-ux/verify_prompts.py
-```
-
-Exit 0 means every cited path resolves and every cited symbol is still greppable
-in the file it is attributed to. **Re-run it after any refactor of the surveyed
-repos** — a prompt pointing at a renamed function is worse than no prompt, and a
-path check alone cannot catch that (which is why it greps symbols too).
-
-Verified 2026-08-16: 146 paths, 30 symbols, all passing.
-
-## Rules that apply to every prompt
-
-1. **Tag cuts and version bumps are explicit steps.** `todo` consumes
-   `design_system` at git ref `design_system-v0.1.0`; `dufs-cloud/web` consumes
-   `@kuhyx/web-ui` at `web_ui-v0.3.1`. Adding tokens to those packages does
-   nothing for consumers until a new tag is cut. Prompt 01 ends by cutting
-   `design_system-v0.2.0` and `web_ui-v0.3.2`; prompts 06 and 08 begin by
-   bumping to those literal refs.
-2. **Anchor on symbols, not line numbers.** Line numbers in these prompts are
-   "as of 2026-08-16" and will drift. The symbol name is the real anchor —
-   grep for it rather than trusting the line.
-3. **Reduce-motion is mandatory and is NOT the sound toggle.** Web:
-   `@media (prefers-reduced-motion: reduce)`. Flutter:
-   `MediaQuery.of(context).disableAnimations`. The OS motion preference is
-   honoured automatically; the sound opt-out is a separate user-facing toggle.
-4. **Motion and haptics first, sound second.** Haptics need no dependency;
-   sound needs a pubspec dep, an `assets:` block, and a settings toggle. Each
-   prompt stages them separately so a short session still lands the valuable
-   half, and sound stays independently revertable.
-5. **Sound ships on (opt-out), never in screen-locker enforcement paths.**
-6. **250-line cap** applies to code and prose alike (`~/src/utils/file_length`).
-
-## Source
-
-Article findings, verbatim from the piece:
-
-- **Variable reward schedules** — unpredictable outcomes produce stronger
-  dopaminergic activity than guaranteed ones. Duolingo streaks, feed ordering,
-  pull-to-refresh.
-- **Micro-animations** — "a button that bounces on press, a like counter that
-  ticks upward with a slight delay". Replaces latency with feedback, so waiting
-  reads as responsiveness rather than frustration.
-- **Sound design** — "operates below the threshold of conscious attention";
-  the article's judgement is that it is more powerful than visual design and
-  gets less critical attention.
-- **Near-miss effects** — a fitness ring at ninety-three per cent creates
-  discomfort that drives re-engagement, and works *even when the user is
-  explicitly told the mechanism*.
-- Core claim: **dopamine is released in anticipation of a reward, not on
-  receipt. The uncertainty is the trigger.**

dopamine-ux/verify_prompts.py

@@ -1,209 +0,0 @@
-#!/usr/bin/env python3
-"""Verify every path and symbol cited in the dopamine-ux prompt files.
-
-A copy-pasteable prompt that points at a file which does not exist is worse than
-no prompt, so this gate adjudicates with an exit code rather than by eye.
-
-Two checks:
-  1. Every cited on-disk path resolves.
-  2. Every cited symbol is greppable in the file it is attributed to. A path
-     check alone cannot catch a stale line number; a symbol grep can.
-"""
-
-from __future__ import annotations
-
-import re
-import sys
-from pathlib import Path
-
-PROMPT_DIR = Path.home() / "src/utils" / "dopamine-ux"
-HOME = Path.home()
-
-PATH_RE = re.compile(r"`(~?/[^`\s]+|[\w.\-]+/[\w./\-]+\.\w+)`")
-
-# Not on-disk paths despite matching the shape above.
-SKIP_SUBSTRINGS = (
-    "://",
-    "$",
-    "*",
-    "<",
-    ">",
-    "…",
-    "devices/",  # Firebase/crdt key path
-    "settings/advanced",  # Firebase key path
-    "android.permission",
-    "android.intent",
-    "/sdcard/",
-    "/etc/",
-    "/dev/input/",
-    "/opt/",
-    "com.kuhy",
-    "app-release.apk",
-    "build/app/outputs",  # build outputs
-    "flutter/services.dart",
-    "flutter/material.dart",  # package imports
-)
-
-# Files a prompt CREATES. Citing them forward is correct, so absence is expected
-# -- but pairing each with its creating prompt still catches a typo.
-CREATED_BY_PROMPT = {
-    "~/src/utils/unified-design-system/motion.md": "01",
-    "~/src/utils/unified-design-system/scripts/structural_check.py": "02",
-}
-
-# Cited precisely to state that they do NOT exist.
-ASSERTED_ABSENT = {
-    "~/gatelock",
-    # Distributed prompt copies are `git rm`d on completion (see the protocol in
-    # 00-INDEX.md), but 00-INDEX.md keeps citing them in its "Distributed copies"
-    # table. Asserting ABSENT rather than dropping the row keeps the check
-    # two-directional: a finished prompt reappearing in a repo is itself a
-    # failure, because the next session would re-run it. Move a row here as each
-    # prompt completes.
-    "~/src/utils/prompts/dopamine-ux-01-motion-tokens.md",
-}
-
-# Generic prose fragments rather than citations of one specific file.
-PROSE_FRAGMENTS = {"lib/ui/theme.dart", "lib/main.dart", "pubspec.yaml"}
-
-# Symbols each prompt claims exist, as (repo-relative file, symbol).
-SYMBOL_CLAIMS = [
-    ("~/src/diet-guard/app/lib/screens/log_meal_screen.dart", "_onLogMeal"),
-    ("~/src/diet-guard/app/lib/widgets/today_progress_card.dart", "TodayProgressCard"),
-    ("~/src/diet-guard/app/lib/widgets/streak_summary_row.dart", "StreakSummaryRow"),
-    ("~/src/diet-guard/app/lib/screens/log_meal_progress.dart", "buildTodayProgress"),
-    ("~/src/diet-guard/app/lib/services/app_settings_service.dart", "_writeToDisk"),
-    ("~/src/screen-locker/screen_locker/_status_types.py", "StatusSnapshot"),
-    ("~/src/screen-locker/screen_locker/_extra_benefits.py", "process_week_transition"),
-    ("~/src/screen-locker/screen_locker/_extra_benefits.py", "current_streak"),
-    ("~/src/screen-locker/screen_locker/_unlock_view.py", "unlock_screen"),
-    ("~/src/screen-locker/screen_locker/_log_mixin.py", "write_signed_entry"),
-    ("~/src/screen-locker/screen_locker/tests/conftest.py", "_ISOLATED_STATE"),
-    ("~/src/screen-locker/screen_locker/_weekly_check.py", "WEEKLY_WORKOUT_MINIMUM"),
-    (
-        "~/src/screen-locker/stronglift_replacement/workout_app/lib/screens/"
-        "workout_screen_session.dart",
-        "_playBreakEndCue",
-    ),
-    (
-        "~/src/screen-locker/stronglift_replacement/workout_app/lib/screens/"
-        "workout_screen_finish.dart",
-        "_persistFinishedWorkout",
-    ),
-    (
-        "~/src/screen-locker/stronglift_replacement/workout_app/lib/widgets/"
-        "workout_summary_dialog.dart",
-        "WorkoutSummaryDialog",
-    ),
-    (
-        "~/src/screen-locker/stronglift_replacement/workout_app/lib/services/"
-        "storage_service.dart",
-        "_getSetting",
-    ),
-    (
-        "~/src/screen-locker/stronglift_replacement/workout_app/lib/widgets/"
-        "exercise_tile_rows.dart",
-        "AnimatedContainer",
-    ),
-    ("~/src/todo/lib/data/app_settings.dart", "withAdvancedMode"),
-    ("~/src/todo/lib/ui/settings_screen.dart", "SwitchListTile"),
-    ("~/src/dufs-cloud/web/src/hooks/use-cloud-index.ts", "walkInto"),
-    ("~/src/dufs-cloud/app/lib/services/cloud_index.dart", "buildCloudIndex"),
-    ("~/src/dufs-cloud/web/src/lib/download.ts", "buildSelectionZip"),
-    ("~/src/dufs-cloud/app/lib/services/download_zip.dart", "buildSelectionZip"),
-    ("~/src/wake-alarm/phone_app/lib/screens/home_screen.dart", "_setPhoneAlarm"),
-    ("~/src/wake-alarm/wake_alarm/_audio.py", "_play_on_all_sinks"),
-    ("~/src/utils/unified-design-system/scripts/palette_check.py", "NON_COLOUR_CSS"),
-    ("~/src/utils/unified-design-system/scripts/palette_map.py", "PALETTE"),
-    ("~/src/utils/design_system/lib/src/feedback.dart", "showToast"),
-    ("~/src/utils/design_system/lib/src/tokens.dart", "AppSpacing"),
-    ("~/src/utils/gatelock/gatelock/_window.py", "LockConfig"),
-]
-
-
-def expand(raw: str) -> Path:
-    return HOME / raw[2:] if raw.startswith("~/") else Path(raw)
-
-
-def candidate_paths(text: str) -> set[str]:
-    return {
-        raw
-        for raw in PATH_RE.findall(text)
-        if not any(s in raw for s in SKIP_SUBSTRINGS)
-        and raw not in PROSE_FRAGMENTS
-        and not re.search(r"\.\w+:\d+$", raw)  # trailing :line suffix
-    }
-
-
-def prompt_roots(text: str) -> list[Path]:
-    roots = []
-    for label in ("Repo", "App", "Flutter app"):
-        for m in re.finditer(rf"{label}: `(~/[^`]+)`", text):
-            roots.append(expand(m.group(1)))
-    return roots
-
-
-def check_paths() -> list[str]:
-    failures = []
-    checked = 0
-    for prompt in sorted(PROMPT_DIR.glob("*.md")):
-        text = prompt.read_text()
-        roots = prompt_roots(text)
-        for raw in sorted(candidate_paths(text)):
-            if raw in ASSERTED_ABSENT:
-                if expand(raw).exists():
-                    failures.append(
-                        f"{prompt.name}: `{raw}` is asserted ABSENT but EXISTS"
-                    )
-                continue
-            if raw in CREATED_BY_PROMPT:
-                owner = CREATED_BY_PROMPT[raw]
-                cites_owner = re.search(rf"[Pp]rompt {owner}", text) is not None
-                if not prompt.name.startswith(owner) and not cites_owner:
-                    failures.append(
-                        f"{prompt.name}: cites `{raw}` without noting prompt "
-                        f"{owner} creates it"
-                    )
-                continue
-
-            checked += 1
-            if raw.startswith(("~/", "/")):
-                if not expand(raw).exists():
-                    failures.append(f"{prompt.name}: `{raw}` MISSING")
-            elif not any((r / raw).exists() for r in roots):
-                failures.append(
-                    f"{prompt.name}: `{raw}` not found under any of "
-                    f"{[str(r) for r in roots]}"
-                )
-    print(f"paths: checked {checked}")
-    return failures
-
-
-def check_symbols() -> list[str]:
-    failures = []
-    for raw_file, symbol in SYMBOL_CLAIMS:
-        path = expand(raw_file)
-        if not path.exists():
-            failures.append(f"symbol source MISSING: {raw_file}")
-            continue
-        if symbol not in path.read_text(errors="replace"):
-            failures.append(f"symbol `{symbol}` NOT FOUND in {raw_file}")
-    print(f"symbols: checked {len(SYMBOL_CLAIMS)}")
-    return failures
-
-
-def main() -> int:
-    n_prompts = len(list(PROMPT_DIR.glob("*.md")))
-    print(f"verifying {n_prompts} prompt files in {PROMPT_DIR}")
-    failures = check_paths() + check_symbols()
-    if failures:
-        print(f"\nFAIL -- {len(failures)} problem(s):")
-        for f in failures:
-            print(f"  {f}")
-        return 1
-    print("\nPASS -- every cited path exists and every cited symbol is present")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

earned_time/README.md

@@ -189,16 +189,17 @@ How far to trust a gate is computed from its ledger, never listed by name:
 `workout_match` counts a `runnerup_tcx` row by `completed_at`, a `rest_day` row
 on its `day` only if `detail.declared_at` predates that day (else logged, no).
 
-## The focus project (0.19.0, cut 180 since 0.20.0)
+## The focus project (0.19.0, cut 180 since 0.20.0, pays 240 since 0.21.0)
 
 While `focus_project.active(day)` returns a project, `earners_for` drops the
 gates it `replaces` (`book` = `reading`) and adds one counted `focus` earner
-(`max_units` = the day's `daily_on`) paying what they paid (shutdown by their rungs,
-gaming by `max_gaming_minutes`: 60+60+60 over 120 min = 1.5/min):
+(`max_units` = the day's `daily_on`). Shutdown pays their rungs (180/120 min); gaming
+their `max_gaming_minutes` + pure bonuses again (240/120 min = 2/min; full day = 8 h):
 `floor(summed minutes * pay / daily_minutes)`, never per row. The penalty runs
 from the start day, cutting all of it, 180 with LeetCode's formerly free hour (0.20.0); maturity never delays it. Ledger `~/.local/share/focus_project/ledger.json`:
 signed `credit` rows, `entry_id` `<project>-<YYYYMMDD>-m<n>`, `detail.minutes` (positive int),
 `detail.ended_at` (else `day`). `focus_project` unusable = no project (logged).
+Unbacked timer time pays 0 from 2026-11-08 (focus_project 0.10.0).
 
 ## Adding a gate
 

earned_time/earned_time/_focus.py

@@ -31,9 +31,13 @@ _warned: set[str] = set()
 class FocusEarner(Earner):
     """Counted; ``gaming_minutes``/``shutdown_minutes`` pay a FULL day.
 
-    The gaming base cut is all of it, LeetCode's free hour too (kuhy 2026-11-02).
+    ``cut_gaming_minutes``: the gaming base cut, all the replaced gates paid,
+    LeetCode's free hour too (0.20.0). The full-day gaming pay adds that free
+    hour once more, so a full day matches the old one (kuhy 2026-11-02, 0.21.0).
     """
 
+    cut_gaming_minutes: int = 0
+
     def gaming_for(self, units: int) -> int:
         """Gaming minutes of ``units`` focused minutes, floored."""
         return self.capped(units) * self.gaming_minutes // (self.max_units or 1)
@@ -66,11 +70,18 @@ def daily_on(project: Any, day: date) -> int:  # noqa: ANN401
 
 
 def focus_earner(project: Any, dropped: tuple[Earner, ...], day: date) -> Earner:  # noqa: ANN401
-    """The ``focus`` earner paying what ``dropped`` paid, over ``project``."""
+    """The ``focus`` earner paying what ``dropped`` paid, over ``project``.
+
+    Gaming: the cut is every dropped gate's full pay; a full day pays that plus
+    the pure bonuses (no ``penalty_from``) again: 180 + 60 = 240 at 120 min.
+    """
+    cut = sum(e.max_gaming_minutes for e in dropped)
+    free = tuple(e for e in dropped if e.penalty_from is None)
     return FocusEarner(
         name="focus",
         label="Focus",
-        gaming_minutes=sum(e.max_gaming_minutes for e in dropped),
+        gaming_minutes=cut + sum(e.max_gaming_minutes for e in free),
+        cut_gaming_minutes=cut,
         shutdown_minutes=sum(
             shutdown_units_minutes(e, e.max_units or 1, day) for e in dropped
         ),

earned_time/earned_time/_resolve.py

@@ -25,6 +25,7 @@ from datetime import UTC, date, datetime
 import logging
 from typing import TYPE_CHECKING, Final
 
+from earned_time._focus import FocusEarner
 from earned_time._ladder import on_ladder, shutdown_ceiling_for
 from earned_time._leisure import base_minutes, ceiling_minutes, is_leisure
 from earned_time._maturity import confirmed_start, penalty_start
@@ -45,6 +46,16 @@ def _today() -> date:
     return datetime.now(tz=UTC).astimezone().date()
 
 
+def _gaming_cut(item: Earner) -> int:
+    """What a penalty in force takes off the gaming base: all ``item`` can pay.
+
+    A focus earner cuts what the gates it replaced paid; it pays more (0.21.0).
+    """
+    if isinstance(item, FocusEarner):
+        return item.cut_gaming_minutes
+    return item.max_gaming_minutes
+
+
 def _penalised(
     item: Earner, day: date, first_credits: Mapping[str, date | None] | None
 ) -> bool:
@@ -117,7 +128,7 @@ def _base(
     penalised = [e for e in registry if _penalised(e, target, first_credits)]
     return Base(
         gaming_minutes=base_minutes(leisure=on)
-        - sum(e.max_gaming_minutes for e in penalised),
+        - sum(_gaming_cut(e) for e in penalised),
         shutdown_minutes=_shutdown_floor(target, registry, penalised),
     )
 

earned_time/earned_time/tests/test_focus.py

@@ -22,7 +22,7 @@ from earned_time import (
 )
 from earned_time._focus import focus_earner
 from earned_time.tests._focus_fakes import DAY, START, activate, focus, project, row
-from earned_time.tests._maturity_rows import ledger_file
+from earned_time.tests._maturity_rows import ledger_file, signed
 
 if TYPE_CHECKING:
     from pathlib import Path
@@ -61,20 +61,24 @@ def test_a_project_that_changes_nothing_leaves_the_registry(
     assert earners_for(DAY) is TUTOR_EARNERS
 
 
-def test_a_full_day_pays_what_the_replaced_gates_paid(
+def test_a_full_day_pays_the_cut_plus_the_free_leetcode_hour(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
+    """kuhy 2026-11-02 (0.21.0): 2 gaming minutes per focus minute, 240 a day."""
     item = focus(monkeypatch)
     assert item.max_units == 120
-    assert (item.gaming_for(120), item.shutdown_for(120, DAY)) == (180, 180)
-    assert (item.gaming_for(999), item.shutdown_for(999, DAY)) == (180, 180)
-    assert (item.max_gaming_minutes, item.gaming_for(-5)) == (180, 0)
+    assert (item.gaming_for(120), item.shutdown_for(120, DAY)) == (240, 180)
+    assert (item.gaming_for(999), item.shutdown_for(999, DAY)) == (240, 180)
+    assert (item.max_gaming_minutes, item.gaming_for(-5)) == (240, 0)
+    assert item.cut_gaming_minutes == 180
 
 
 def test_pay_is_floored_on_the_summed_minutes(monkeypatch: pytest.MonkeyPatch) -> None:
     item = focus(monkeypatch)
-    assert [item.gaming_for(n) for n in (1, 2, 3, 7)] == [1, 3, 4, 10]
+    assert [item.gaming_for(n) for n in (1, 2, 3, 7)] == [2, 4, 6, 14]
     assert [item.shutdown_for(n, DAY) for n in (1, 2, 3, 7)] == [1, 3, 4, 10]
+    odd = focus(monkeypatch, daily_minutes=90)
+    assert [odd.gaming_for(n) for n in (1, 2, 90)] == [2, 5, 240]
 
 
 def test_many_small_rows_pay_what_one_row_pays(
@@ -86,7 +90,21 @@ def test_many_small_rows_pay_what_one_row_pays(
     one.write_text(ledger_file(tmp_path, [row(7, 7)]).read_text(encoding="utf-8"))
     units = credit_units(item, many, key_file, DAY)
     assert units == credit_units(item, one, key_file, DAY) == 7
-    assert item.gaming_for(units or 0) == 10
+    assert item.gaming_for(units or 0) == 14
+
+
+def test_carry_rows_pay_like_own_rows(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, key_file: Path
+) -> None:
+    """focus_project 0.6.0 banks overtime as ``<project>-<YYYYMMDD>-carry`` rows."""
+    item = focus(monkeypatch)
+    carry = row(30, 0, carry=True)
+    carry["entry_id"] = f"hr-{DAY:%Y%m%d}-carry"
+    top_up = row(5, 0, carry=True)
+    top_up["entry_id"] = f"hr-{DAY:%Y%m%d}-carry-m35"
+    rows = [signed(carry), signed(top_up), row(85, 85)]
+    ledger = ledger_file(tmp_path, rows)
+    assert credit_units(item, ledger, key_file, DAY) == 120
 
 
 def test_resolve_prices_base_terms_and_ceiling(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -95,26 +113,25 @@ def test_resolve_prices_base_terms_and_ceiling(monkeypatch: pytest.MonkeyPatch)
     assert nothing.base.gaming_minutes == 300 - 180
     assert nothing.base.shutdown_minutes == 18 * 60
     half = resolve({"workout": 0, "focus": 60}, DAY, leisure=False)
-    assert half.gaming_minutes == 120 + 90
+    assert half.gaming_minutes == 120 + 120
     assert half.shutdown_minutes == 18 * 60 + 90
     full = resolve({"workout": 1, "focus": 120}, DAY, leisure=False)
     assert full.shutdown_minutes == 23 * 60
+    assert full.gaming_minutes == 300 - 180 + 240 + 120 == 8 * 60
 
 
 def test_a_full_project_day_pays_what_the_replaced_gates_paid(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """Shutdown matches the old full day; gaming loses LeetCode's free hour."""
+    """A full project day equals the old full day, LeetCode's free hour too."""
     activate(monkeypatch, project())
     done = {"workout": 1, "leetcode": 1, "reading": 1, "tutor": 60, "focus": 120}
     old = resolve(done, DAY, TUTOR_EARNERS, leisure=False)
     new = resolve(done, DAY, leisure=False)
     assert new.shutdown_minutes == old.shutdown_minutes
-    # kuhy 2026-11-02: LeetCode's bonus hour was free on top of the base; the
-    # project day cuts it and pays it back, so the full day nets 60 less.
-    assert new.gaming_minutes == old.gaming_minutes - 60
-    unsolved = resolve({**done, "leetcode": 0}, DAY, TUTOR_EARNERS, leisure=False)
-    assert new.gaming_minutes == unsolved.gaming_minutes
+    # kuhy 2026-11-02 (0.21.0): the day cuts 180 but pays 240, so a full day
+    # is the old full day (8 h); only an idle day is worse.
+    assert new.gaming_minutes == old.gaming_minutes == 8 * 60
 
 
 def test_an_idle_project_day_also_cuts_the_free_leetcode_hour(
@@ -166,4 +183,5 @@ def test_the_path_unit_watches_the_focus_ledger() -> None:
 
 def test_focus_pays_only_replaced_gates_that_exist() -> None:
     item = focus_earner(project(), (earned_time.LEETCODE,), DAY)
-    assert (item.gaming_minutes, item.shutdown_minutes) == (60, 60)
+    assert (item.gaming_minutes, item.shutdown_minutes) == (120, 60)
+    assert item.cut_gaming_minutes == 60

earned_time/earned_time/tests/test_focus_backing.py

@@ -0,0 +1,88 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Regression: a timer-only focus day after the anti-cheat cutover pays 0.
+
+Runs the REAL ``focus_project`` (the sibling package of this monorepo):
+timer rows -> harvester -> signed ledger -> ``credit_units``. earned_time
+itself does not change; this pins that the gate reaches pay.
+"""
+
+from __future__ import annotations
+
+from datetime import date, datetime
+import importlib
+import json
+from pathlib import Path
+import sys
+from typing import TYPE_CHECKING
+
+import pytest
+
+from earned_time import credit_units, earners_for
+
+if TYPE_CHECKING:
+    from types import ModuleType
+
+DAY = date(2026, 11, 9)  # after focus_project.BACKING_FROM
+_SIBLING = Path(__file__).resolve().parents[3] / "focus_project"
+
+
+def at(hour: int, minute: int) -> float:
+    return datetime(2026, 11, 9, hour, minute).astimezone().timestamp()
+
+
+@pytest.fixture
+def real_fp(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, key_file: Path
+) -> ModuleType:
+    """The real focus_project on redirected state (HOME, data dir, key)."""
+    monkeypatch.setenv("HOME", str(tmp_path / "home"))
+    monkeypatch.setenv("FOCUS_PROJECT_DATA", str(tmp_path / "data"))
+    monkeypatch.setenv("FOCUS_PROJECT_KEY", str(key_file))
+    monkeypatch.setenv("FOCUS_PROJECT_LEETCODE_LEDGER", str(tmp_path / "lc.json"))
+    monkeypatch.delitem(sys.modules, "focus_project")  # the conftest's fake
+    monkeypatch.syspath_prepend(str(_SIBLING))
+    fp = importlib.import_module("focus_project")
+    fp.create_project(
+        "hr",
+        name="HR",
+        start=DAY,
+        end=DAY,
+        replaces=["leetcode"],
+        daily_minutes=120,
+        unlock_minutes=30,
+    )
+    return fp
+
+
+def pay(fp: ModuleType, tmp_path: Path, key_file: Path, *rows: object) -> int | None:
+    log = tmp_path / "data" / "activity.jsonl"
+    log.write_text("".join(json.dumps(r) + "\n" for r in rows), encoding="utf-8")
+    harvest = importlib.import_module("focus_project.harvest")
+    assert harvest.harvest(now=at(23, 0)) == 0
+    (item,) = (e for e in earners_for(DAY) if e.name == "focus")
+    return credit_units(item, tmp_path / "data" / "ledger.json", key_file, DAY)
+
+
+def row(source: str, kind: str, ts: float) -> dict[str, object]:
+    return {"ts": ts, "source": source, "kind": kind, "project": "hr"}
+
+
+TIMER = (
+    row("timer", "start", at(9, 0)),
+    row("timer", "checkin", at(9, 5)),
+    row("timer", "stop", at(9, 10)),
+)
+
+
+def test_timer_only_day_pays_zero(
+    real_fp: ModuleType, tmp_path: Path, key_file: Path
+) -> None:
+    assert date(2026, 11, 8) == real_fp.BACKING_FROM
+    assert pay(real_fp, tmp_path, key_file, *TIMER) == 0
+
+
+def test_backed_timer_day_still_pays(
+    real_fp: ModuleType, tmp_path: Path, key_file: Path
+) -> None:
+    beat = row("tutor", "heartbeat", at(9, 5))
+    assert pay(real_fp, tmp_path, key_file, *TIMER, beat) == 10

earned_time/earned_time/tests/test_focus_edges.py

@@ -70,8 +70,8 @@ def test_a_target_edit_never_reprices_past_days(
     activate(monkeypatch, project(daily_on=edited, daily_minutes=60))
     before = earners_for(DAY)[-1]
     after = earners_for(DAY + timedelta(days=1))[-1]
-    assert (before.max_units, before.gaming_for(60)) == (120, 90)
-    assert (after.max_units, after.gaming_for(60)) == (60, 180)
+    assert (before.max_units, before.gaming_for(60)) == (120, 120)
+    assert (after.max_units, after.gaming_for(60)) == (60, 240)
     assert (before.shutdown_for(60, DAY), after.shutdown_for(30, DAY)) == (90, 90)
 
 

earned_time/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "earned-time"
-version = "0.20.0"
+version = "0.21.0"
 description = "Penalty-then-reward registry: what every gate app earns in gaming time and shutdown time"
 requires-python = ">=3.14"
 dependencies = []

focus_project/README.md

@@ -16,8 +16,38 @@ Data: `$FOCUS_PROJECT_DATA` or `~/.local/share/focus_project/` (`projects.json`,
 `activity.jsonl`). `minutes.py` is owned by the minutes/harvester agent.
 Time rules: `minutes_for` clips every interval at "now" (an event stamped ahead of
 the clock earns only once the clock reaches it); `record_activity` rejects a `ts`
-more than 120 s ahead (ValueError). `end_project(id, day)` rejects a past `day`
+more than 120 s ahead (ValueError). Timer segments (`start` -> `checkin` ... -> `stop`)
+lapse after a 600 s gap; a `tutor`/`heartbeat` is a beat too (0.8.0: a graded check-in card
+extends the open segment, never opens one). `end_project(id, day)` rejects a past `day`
 (ValueError); today or later is fine. The harvester pays every project day of the
 last 31 days, so late-synced events for older days are credited (idempotent).
+Overtime carries over: own minutes past a day's target bank (max 60) and pay on the
+next project day; the bank never crosses the project's end. `minutes_for(day)` is the
+capped pay figure, `status(day)["minutes"]` the real count (121/120) with `carried_in`,
+`carry_out`, `own_minutes`, `counted_minutes`. Carry ledger rows: `<project>-<YYYYMMDD>-carry`
+(`detail.carry`), never over `daily_minutes` together with own rows.
+Edits only ratchet (0.7.0): `update_project`/`apply_update(id, today=...)` never lowers
+today's obligation. A lower `daily_minutes`/`unlock_minutes`, or a gate added to `replaces`,
+on a started project holds from TOMORROW (a `history` row ends today with the old values,
+`replaces_on(day)`/`daily_on`/`unlock_on` read it); a mixed edit defers as a whole. Raises,
+gates removed and edits to a project that has not started hold from today.
+`apply_update(...).effective_from` says which. `end` cannot be before today, so an edit never
+uncovers today. A NEW project starting today may replace gates and set any targets: it is a
+new obligation, not a reduction (but see the floor).
+Floor (0.7.1, coordinator decision for kuhy): `daily_minutes >= 30 x replaced gates` (min 30; `book` = `reading`),
+enforced on create and update (`daily_floor(replaces)`), so a day cannot be made cheap.
+Backed timer (0.10.0, days from `BACKING_FROM` = 2026-11-08): a timer span earns only if a
+same-project `tutor`/`sql_drills`/`leetcode` beat (or accepted submission) is in it, 5 min
+before it, or bridges it (beats <= 20 min apart). `unbacked_minutes_for(day)` /
+`status()["unbacked_minutes"]` show the rest. A beat backs only the spans it touches (the tutor chain makes a graded card back the whole stretch). Known gap: any coach turn backs.
 Open the work: `python3 -m focus_project.open [--no-site]` (tutor focus screen, `work_url`).
 Install: `./install.sh` (stdlib only, editable user install for `/usr/bin/python3`).
+
+Interview prep (`kind="interview"`, 0.9): `create_project(..., kind="interview", test_at=, invite_url=, trips=, weekend_answers=)`;
+`end` must be the test day. Budget: 30 min weekdays / 120 Sat-Sun (`daily_on`), exempt from `daily_floor`, unlock clamped.
+Milestones are generated, never stored: `milestones(project, now)` -> `rules`, `trip_ask:<sat>`, `phone:<trip start>`, `mock`, `slot`
+with states pending/done/missed/late_done/unknown. `owed_lock(now)` = earliest overdue uncompleted one (never on test day; wire it
+after focus-guard's sick/free-day stand-down). `status(day)` gains `milestones` and `missed`.
+Evidence is append-only (`evidence/<id>.jsonl` + copied files): `record_evidence(id, milestone, kind, value, file=, now=)`
+(`file`, `tap`, `score`, `slot`, `slot_confirm`, tutor's `phone_check`). `add_trip` / `answer_weekend` only get stricter (ValueError).
+`run_checks(id)` runs the `phone` source (reads the latest `phone_check` row) and latches changes; `register_source` swaps it.

focus_project/focus_project/__init__.py

@@ -17,28 +17,50 @@ from __future__ import annotations
 from focus_project._api import (
     active,
     create_project,
+    daily_floor,
     end_project,
     list_projects,
     stands_down,
 )
 from focus_project._errors import RegistryError
+from focus_project._milestones import Milestone, milestones, owed_lock
 from focus_project._model import Limits, Project
-from focus_project._update import update_project
+from focus_project._mutate import add_trip, answer_weekend, record_evidence
+from focus_project._trips import Trip
+from focus_project._update import Update, apply_update, update_project
 from focus_project.activity import record_activity
-from focus_project.minutes import minutes_for
+from focus_project.checks import register_source, run_checks
+from focus_project.evidence import Evidence
+from focus_project.minutes import minutes_for, unbacked_minutes_for
+from focus_project.sources.activity import BACKING_FROM
 from focus_project.status import status
 
 __all__ = [
+    "BACKING_FROM",
+    "Evidence",
     "Limits",
+    "Milestone",
     "Project",
     "RegistryError",
+    "Trip",
+    "Update",
     "active",
+    "add_trip",
+    "answer_weekend",
+    "apply_update",
     "create_project",
+    "daily_floor",
     "end_project",
     "list_projects",
+    "milestones",
     "minutes_for",
+    "owed_lock",
     "record_activity",
+    "record_evidence",
+    "register_source",
+    "run_checks",
     "stands_down",
     "status",
+    "unbacked_minutes_for",
     "update_project",
 ]

focus_project/focus_project/_api.py

@@ -4,19 +4,26 @@
 from __future__ import annotations
 
 from dataclasses import replace
-from datetime import date  # noqa: TC003
 import logging
 import re
 import time
-from urllib.parse import urlsplit
+from typing import TYPE_CHECKING
 
-from focus_project import _clock, _store
+from focus_project import _clock, _interview, _store
 from focus_project._errors import RegistryError
+from focus_project._kind import FOCUS
 from focus_project._model import GATES, Project, normalize_gate
 
+if TYPE_CHECKING:
+    from datetime import date, datetime
+
+    from focus_project._trips import Trip
+
 _LOG = logging.getLogger(__name__)
 _ID = re.compile(r"[a-z0-9][a-z0-9-]*")
-MAX_WORK_URL = 2000
+MAX_WORK_URL = _interview.MAX_URL
+# A project must ask real work: the focus earner pays per minute of ``daily``.
+MIN_DAILY_PER_GATE = 30
 
 
 def list_projects() -> list[Project]:
@@ -46,22 +53,17 @@ def stands_down(gate: str, day: date) -> bool:
             "focus_project registry unreadable, gate %s stays on: %s", gate, exc
         )
         return False
-    return project is not None and project.replaces_gate(gate)
+    return project is not None and project.replaces_gate(gate, day)
 
 
 def _validate_work_url(url: str) -> None:
     """Empty, or a plain http(s) URL with a host: it goes to ``xdg-open``."""
-    if not url:
-        return
-    parts = urlsplit(url) if url.isprintable() and " " not in url else None
-    if (
-        parts is None
-        or len(url) > MAX_WORK_URL
-        or parts.scheme not in {"http", "https"}
-        or not parts.netloc
-    ):
-        msg = "work_url must be an http(s) URL without spaces (or empty)"
-        raise ValueError(msg)
+    _interview.check_http_url(url, "work_url")
+
+
+def daily_floor(replaces: tuple[str, ...]) -> int:
+    """The least ``daily_minutes`` a project replacing these gates may ask."""
+    return MIN_DAILY_PER_GATE * max(1, len(replaces))
 
 
 def _validate(project: Project) -> None:
@@ -78,8 +80,13 @@ def _validate(project: Project) -> None:
     if not project.replaces or not set(project.replaces) <= GATES:
         msg = f"replaces must be a non-empty subset of gates {sorted(GATES)}"
         raise ValueError(msg)
-    if project.daily_minutes <= 0:
-        msg = "daily_minutes must be positive"
+    _interview.validate(project)
+    floor = daily_floor(project.replaces)
+    if project.kind == FOCUS and project.daily_minutes < floor:
+        msg = (
+            f"daily_minutes must be at least {floor} "
+            f"({MIN_DAILY_PER_GATE} per replaced gate)"
+        )
         raise ValueError(msg)
     if not 0 <= project.unlock_minutes <= project.daily_minutes:
         msg = "unlock_minutes must be within 0..daily_minutes"
@@ -98,8 +105,19 @@ def create_project(  # noqa: PLR0913
     subjects: list[str] | None = None,
     site_patterns: list[str] | None = None,
     work_url: str = "",
+    kind: str = FOCUS,
+    test_at: datetime | None = None,
+    invite_url: str = "",
+    trips: list[Trip] | None = None,
+    weekend_answers: dict[date, bool] | None = None,
 ) -> Project:
-    """Add a project; ValueError on bad input, a duplicate id or an overlap."""
+    """Add a project; ValueError on bad input, a duplicate id or an overlap.
+
+    ``kind="interview"`` takes ``test_at`` (naive local; its date must be
+    ``end``), ``invite_url``, ``trips`` and ``weekend_answers``; an interview
+    is exempt from :func:`daily_floor` and runs the 30/120 budget.
+    """
+    created_ms = time.time_ns() // 1_000_000
     project = Project(
         id=project_id,
         name=name,
@@ -111,7 +129,15 @@ def create_project(  # noqa: PLR0913
         subjects=tuple(subjects or ()),
         site_patterns=tuple(site_patterns or ()),
         work_url=work_url,
-        created_ms=time.time_ns() // 1_000_000,
+        created_ms=created_ms,
+        kind=kind,
+        test_at=test_at,
+        invite_url=invite_url,
+        trips=tuple(
+            t if t.entered_ms else replace(t, entered_ms=created_ms)
+            for t in trips or ()
+        ),
+        weekend_answers=tuple(sorted((weekend_answers or {}).items())),
     )
     _validate(project)
     with _store.locked():

focus_project/focus_project/_interview.py

@@ -0,0 +1,89 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Validation of the interview-only fields."""
+
+from __future__ import annotations
+
+from datetime import date, timedelta
+from typing import TYPE_CHECKING
+from urllib.parse import urlsplit
+
+from focus_project._kind import FOCUS, KINDS, WEEKDAY_MINUTES
+
+if TYPE_CHECKING:
+    from focus_project._model import Project
+
+MAX_URL = 2000
+SATURDAY = 5
+
+
+def check_http_url(url: str, label: str) -> None:
+    """Empty, or a plain http(s) URL with a host: it goes to ``xdg-open``."""
+    if not url:
+        return
+    parts = urlsplit(url) if url.isprintable() and " " not in url else None
+    if (
+        parts is None
+        or len(url) > MAX_URL
+        or parts.scheme not in {"http", "https"}
+        or not parts.netloc
+    ):
+        msg = f"{label} must be an http(s) URL without spaces (or empty)"
+        raise ValueError(msg)
+
+
+def saturdays(project: Project) -> list[date]:
+    """The Saturdays whose weekend lies inside D1..T-1."""
+    if project.test_at is None:
+        return []
+    last = project.test_at.date() - timedelta(days=1)
+    day = project.start + timedelta(days=(SATURDAY - project.start.weekday()) % 7)
+    found: list[date] = []
+    while day <= last:
+        found.append(day)
+        day += timedelta(days=7)
+    return found
+
+
+def _has_interview_fields(project: Project) -> bool:
+    return bool(
+        project.test_at
+        or project.invite_url
+        or project.trips
+        or project.weekend_answers
+    )
+
+
+def _validate_interview(project: Project) -> None:
+    if project.test_at is None or project.test_at.tzinfo is not None:
+        msg = "an interview needs test_at as a naive local datetime"
+        raise ValueError(msg)
+    test_day = project.test_at.date()
+    if project.end != test_day:
+        msg = f"end must be the test day {test_day}"
+        raise ValueError(msg)
+    if project.daily_minutes < WEEKDAY_MINUTES:
+        msg = f"daily_minutes must be at least {WEEKDAY_MINUTES}"
+        raise ValueError(msg)
+    for trip in project.trips:
+        if trip.end < trip.start or trip.start > test_day:
+            msg = f"trip {trip.start}..{trip.end} must start by the test day"
+            raise ValueError(msg)
+    weekends = saturdays(project)
+    for day, _ in project.weekend_answers:
+        if day not in weekends:
+            msg = f"{day} is not a weekend inside the project before the test day"
+            raise ValueError(msg)
+
+
+def validate(project: Project) -> None:
+    """ValueError unless the kind and its interview fields are coherent."""
+    if project.kind not in KINDS:
+        msg = f"kind must be one of {sorted(KINDS)}"
+        raise ValueError(msg)
+    check_http_url(project.invite_url, "invite_url")
+    if project.kind == FOCUS:
+        if _has_interview_fields(project):
+            msg = "test_at, invite_url, trips, weekend_answers need kind='interview'"
+            raise ValueError(msg)
+        return
+    _validate_interview(project)

focus_project/focus_project/_kind.py

@@ -0,0 +1,23 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Project kinds and the interview budget (the one place the numbers live)."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from datetime import date
+
+FOCUS = "focus"
+INTERVIEW = "interview"
+KINDS = frozenset({FOCUS, INTERVIEW})
+
+# kuhy, 2026-11-10: near-zero weekday energy, weekends are for learning.
+WEEKDAY_MINUTES = 30
+WEEKEND_MINUTES = 120
+_FIRST_WEEKEND_DAY = 5  # Saturday
+
+
+def interview_minutes(day: date) -> int:
+    """The daily target of an interview project on ``day`` (Sat/Sun = 120)."""
+    return WEEKEND_MINUTES if day.weekday() >= _FIRST_WEEKEND_DAY else WEEKDAY_MINUTES

focus_project/focus_project/_milestones.py

@@ -0,0 +1,235 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Interview milestones: generated from the project, judged from evidence.
+
+Nothing here is stored or editable. ``due`` and the state are recomputed from
+the project (kind, test_at, trips, weekend answers) and the append-only
+evidence rows, so a milestone cannot be moved or ticked off by editing a row.
+
+Failure modes (R8): an unanswered trip question reads as a trip (fail
+closed); a check that could not run is ``unknown`` and counts as not done
+(fail closed); an unreadable registry or evidence file arms no lock (fail
+open, logged), matching focus-guard's "unreadable registry" rule.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import date, datetime, time, timedelta
+import logging
+from typing import TYPE_CHECKING, Any, Literal
+
+from focus_project import _api, _interview, evidence
+from focus_project._errors import RegistryError
+from focus_project._kind import INTERVIEW
+from focus_project.sources import activity
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from focus_project._model import Project
+
+_LOG = logging.getLogger(__name__)
+State = Literal["pending", "done", "missed", "late_done", "unknown"]
+PHONE_LEAD = timedelta(hours=12)
+MOCK_SESSION_S = 90 * 60
+_RED = frozenset({"missed", "unknown"})
+
+
+@dataclass(frozen=True)
+class Milestone:
+    """One generated obligation of an interview project."""
+
+    id: str
+    due: datetime
+    state: State
+    completed: bool
+
+    @property
+    def red(self) -> bool:
+        """Past due and not done (also: the check could not run)."""
+        return self.state in _RED
+
+    def to_dict(self) -> dict[str, Any]:
+        """The status() row: id, due ISO, state."""
+        return {"id": self.id, "due": self.due.isoformat(), "state": self.state}
+
+
+def _at(day: date, hour: int, minute: int = 0) -> datetime:
+    return datetime.combine(day, time(hour, minute))
+
+
+def _trip_due(trip_start: date, entered_ms: int) -> datetime:
+    """Start - 12 h, or the moment it was entered if that left < 12 h."""
+    nominal = _at(trip_start, 0) - PHONE_LEAD
+    if entered_ms > 0:
+        entered = evidence.from_ms(entered_ms)
+        if nominal - entered < PHONE_LEAD:
+            return entered
+    return nominal
+
+
+def _is_trip(
+    *,
+    answered: bool | None,
+    answer_ms: int | None,
+    ask_due: datetime,
+    phone_due: datetime,
+    now: datetime,
+) -> bool:
+    """Whether the weekend counts as a trip (fail closed).
+
+    Unanswered once the question is due = a trip. A no-trip answer given
+    only after the phone prep was already due cannot erase that overdue
+    milestone: the answer row's own timestamp decides, not a stored flag.
+    """
+    if answered is None:
+        return now >= ask_due
+    if answered:
+        return True
+    return answer_ms is not None and answer_ms >= evidence.to_ms(phone_due)
+
+
+def plan(
+    project: Project, test_day: date, now: datetime, rows: list[evidence.Evidence]
+) -> dict[str, datetime]:
+    """Milestone id -> due; ``project`` must be a validated interview."""
+    dues = {
+        "rules": _at(project.start, 23, 59),
+        "mock": _at(test_day - timedelta(days=2), 23, 59),
+        "slot": _at(test_day - timedelta(days=1), 12),
+    }
+    answers = dict(project.weekend_answers)
+    for sat in _interview.saturdays(project):
+        ask_due = _at(sat - timedelta(days=2), 23, 59)
+        phone_due = _at(sat, 0) - PHONE_LEAD
+        dues[f"trip_ask:{sat}"] = ask_due
+        covered = any(t.covers(sat) for t in project.trips)
+        row = evidence.first(rows, f"trip_ask:{sat}", "answer")
+        answer_ms = None if row is None else row.ms
+        if not covered and _is_trip(
+            answered=answers.get(sat),
+            answer_ms=answer_ms,
+            ask_due=ask_due,
+            phone_due=phone_due,
+            now=now,
+        ):
+            dues[f"phone:{sat}"] = phone_due
+    for trip_row in project.trips:
+        dues[f"phone:{trip_row.start}"] = _trip_due(trip_row.start, trip_row.entered_ms)
+    return dues
+
+
+def _when(row: evidence.Evidence | None) -> datetime | None:
+    return None if row is None else row.at
+
+
+Rows = list[evidence.Evidence]
+Completion = tuple[datetime | None, bool]
+
+
+def _by_evidence(kind: str) -> Callable[[str, Rows, Project], Completion]:
+    """Done at the first evidence row of ``kind`` (rules file, mock score)."""
+
+    def judge(mid: str, rows: Rows, _project: Project) -> Completion:
+        return _when(evidence.first(rows, mid, kind)), False
+
+    return judge
+
+
+def _mock(mid: str, rows: Rows, project: Project) -> Completion:
+    """Done at the first score row that follows a >= 90 min focus session.
+
+    The session (contiguous beats, :func:`activity.sessions`) must END at or
+    before the score row; a score with no such session completes nothing.
+    """
+    ends = [hi for lo, hi in activity.sessions(project.id) if hi - lo >= MOCK_SESSION_S]
+    for row in rows:
+        if (row.milestone, row.kind) == (mid, "score") and any(
+            end <= row.ms / 1000 for end in ends
+        ):
+            return row.at, False
+    return None, False
+
+
+def _trip_ask(mid: str, rows: Rows, project: Project) -> Completion:
+    """Done at the answer row; an answer with no row was given at creation."""
+    if date.fromisoformat(mid.partition(":")[2]) not in dict(project.weekend_answers):
+        return None, False
+    return _when(evidence.first(rows, mid, "answer")) or evidence.from_ms(0), False
+
+
+def _slot(mid: str, rows: Rows, _project: Project) -> Completion:
+    """Done once the latest slot entry has a confirm tap at or after it."""
+    slot = evidence.last(rows, mid, "slot")
+    if slot is None:
+        return None, False
+    confirm = evidence.first(rows, mid, "slot_confirm", since_ms=slot.ms)
+    return (None if confirm is None else max(slot.at, confirm.at)), False
+
+
+def _phone(mid: str, rows: Rows, _project: Project) -> Completion:
+    """Done when the offline tap and a passing auto check both exist.
+
+    A tap with no verdict at all (or a dark source) is ``unknown``.
+    """
+    tap = evidence.first(rows, mid, "tap")
+    passed, latest, _ = evidence.check_summary(rows, mid)
+    if tap is not None and passed is not None:
+        return max(tap.at, evidence.from_ms(passed)), False
+    return None, tap is not None and latest is None
+
+
+_JUDGES = {
+    "rules": _by_evidence("file"),
+    "mock": _mock,
+    "trip_ask": _trip_ask,
+    "slot": _slot,
+    "phone": _phone,
+}
+
+
+def _judge(
+    mid: str, due: datetime, rows: Rows, project: Project, now: datetime
+) -> Milestone:
+    done_at, unknown = _JUDGES[mid.partition(":")[0]](mid, rows, project)
+    if done_at is not None:
+        state: State = "done" if done_at <= due else "late_done"
+        return Milestone(mid, due, state, completed=True)
+    if now < due:
+        return Milestone(mid, due, "pending", completed=False)
+    return Milestone(mid, due, "unknown" if unknown else "missed", completed=False)
+
+
+def milestones(project: Project, now: datetime) -> list[Milestone]:
+    """The project's milestones at ``now`` (naive local), earliest due first.
+
+    Empty for a focus project. May raise OSError reading the evidence file.
+    """
+    if project.kind != INTERVIEW or project.test_at is None:
+        return []
+    rows = evidence.read(project.id)
+    dues = plan(project, project.test_at.date(), now, rows)
+    found = [_judge(mid, due, rows, project, now) for mid, due in dues.items()]
+    return sorted(found, key=lambda m: (m.due, m.id))
+
+
+def owed_lock(now: datetime) -> Milestone | None:
+    """The earliest overdue, uncompleted milestone that locks, or None.
+
+    Locks (missed or unknown) from the moment it is due, every day of the
+    project except the test day itself, where nothing locks. It does not
+    consult sickdays/freedays: focus-guard's ``_off(today)`` precondition
+    already stands the lock down on those days, so wire this after it.
+    Unreadable state arms nothing (fail open, logged).
+    """
+    try:
+        project = _api.active(now.date())
+        if project is None or project.test_at is None:
+            return None
+        if now.date() >= project.test_at.date():
+            return None
+        owed = [m for m in milestones(project, now) if not m.completed and now >= m.due]
+    except (RegistryError, OSError) as exc:
+        _LOG.warning("interview state unreadable, no milestone lock: %s", exc)
+        return None
+    return owed[0] if owed else None

focus_project/focus_project/_model.py

@@ -4,10 +4,12 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
-from datetime import date
+from datetime import date, datetime
 from typing import Any
 
 from focus_project._errors import RegistryError
+from focus_project._kind import FOCUS, INTERVIEW, interview_minutes
+from focus_project._trips import Trip
 
 GATES = frozenset({"leetcode", "reading", "tutor"})
 _ALIASES = {"book": "reading"}
@@ -18,6 +20,17 @@ def normalize_gate(gate: str) -> str:
     return _ALIASES.get(gate, gate)
 
 
+def _answers(raw: dict[str, Any] | None) -> tuple[tuple[date, bool], ...]:
+    """Parse the saturday -> bool map; a non-bool answer is a bad row."""
+    pairs = []
+    for key, value in (raw or {}).items():
+        if not isinstance(value, bool):
+            msg = f"weekend answer for {key} is not true/false"
+            raise TypeError(msg)
+        pairs.append((date.fromisoformat(key), value))
+    return tuple(sorted(pairs))
+
+
 @dataclass(frozen=True)
 class Limits:
     """The minute targets that held up to and including ``until``."""
@@ -25,22 +38,29 @@ class Limits:
     until: date
     daily_minutes: int
     unlock_minutes: int
+    # None = a row from before 0.7.0: the project's current gates apply.
+    replaces: tuple[str, ...] | None = None
 
     def to_dict(self) -> dict[str, Any]:
         """The history row in projects.json."""
-        return {
+        row: dict[str, Any] = {
             "until": self.until.isoformat(),
             "daily_minutes": self.daily_minutes,
             "unlock_minutes": self.unlock_minutes,
         }
+        if self.replaces is not None:
+            row["replaces"] = list(self.replaces)
+        return row
 
     @classmethod
     def from_dict(cls, row: Any) -> Limits:  # noqa: ANN401
         """Parse a history row (errors surface as RegistryError upstream)."""
+        gates = row.get("replaces")
         return cls(
             until=date.fromisoformat(row["until"]),
             daily_minutes=int(row["daily_minutes"]),
             unlock_minutes=int(row["unlock_minutes"]),
+            replaces=None if gates is None else tuple(gates),
         )
 
 
@@ -63,19 +83,35 @@ class Project:
     work_url: str = ""
     # Earlier targets, oldest first: an edit applies from its day, never back.
     history: tuple[Limits, ...] = ()
+    # "focus" (every pre-interview row) or "interview"; the rest is interview-only.
+    kind: str = FOCUS
+    # Local naive datetime of the test; its date is the project's last day.
+    test_at: datetime | None = None
+    invite_url: str = ""
+    trips: tuple[Trip, ...] = ()
+    # Saturday -> True (trip that weekend) / False (no trip); sorted pairs.
+    weekend_answers: tuple[tuple[date, bool], ...] = ()
 
     def _limits_on(self, day: date) -> Limits | None:
         return next((h for h in self.history if day <= h.until), None)
 
     def daily_on(self, day: date) -> int:
         """The daily target that held on ``day``."""
+        if self.kind == INTERVIEW:
+            return interview_minutes(day)
         past = self._limits_on(day)
         return self.daily_minutes if past is None else past.daily_minutes
 
     def unlock_on(self, day: date) -> int:
-        """The unlock target that held on ``day``."""
+        """The unlock target that held on ``day`` (clamped for an interview)."""
         past = self._limits_on(day)
-        return self.unlock_minutes if past is None else past.unlock_minutes
+        held = self.unlock_minutes if past is None else past.unlock_minutes
+        return min(held, interview_minutes(day)) if self.kind == INTERVIEW else held
+
+    def replaces_on(self, day: date) -> tuple[str, ...]:
+        """The gates this project switched off on ``day``."""
+        past = self._limits_on(day)
+        return self.replaces if past is None or past.replaces is None else past.replaces
 
     @property
     def last_day(self) -> date:
@@ -86,13 +122,13 @@ class Project:
         """Whether this project is active on ``day``."""
         return self.start <= day <= self.last_day
 
-    def replaces_gate(self, gate: str) -> bool:
-        """Whether this project switches ``gate`` off."""
-        return normalize_gate(gate) in self.replaces
+    def replaces_gate(self, gate: str, day: date) -> bool:
+        """Whether this project switches ``gate`` off on ``day``."""
+        return normalize_gate(gate) in self.replaces_on(day)
 
     def to_dict(self) -> dict[str, Any]:
         """The projects.json row."""
-        return {
+        row: dict[str, Any] = {
             "id": self.id,
             "name": self.name,
             "start": self.start.isoformat(),
@@ -106,13 +142,23 @@ class Project:
             "created_ms": self.created_ms,
             "work_url": self.work_url,
             "history": [h.to_dict() for h in self.history],
+            "kind": self.kind,
         }
+        if self.kind == INTERVIEW:
+            row["test_at"] = self.test_at.isoformat() if self.test_at else None
+            row["invite_url"] = self.invite_url
+            row["trips"] = [t.to_dict() for t in self.trips]
+            row["weekend_answers"] = {
+                day.isoformat(): trip for day, trip in self.weekend_answers
+            }
+        return row
 
     @classmethod
     def from_dict(cls, row: Any) -> Project:  # noqa: ANN401
         """Parse a registry row, or raise :class:`RegistryError`."""
         try:
             ended = row.get("ended_on")
+            test_at = row.get("test_at")
             return cls(
                 id=str(row["id"]),
                 name=str(row["name"]),
@@ -127,6 +173,11 @@ class Project:
                 created_ms=int(row.get("created_ms", 0)),
                 work_url=str(row.get("work_url") or ""),
                 history=tuple(Limits.from_dict(h) for h in row.get("history", ())),
+                kind=str(row.get("kind") or FOCUS),
+                test_at=datetime.fromisoformat(test_at) if test_at else None,
+                invite_url=str(row.get("invite_url") or ""),
+                trips=tuple(Trip.from_dict(t) for t in row.get("trips", ())),
+                weekend_answers=_answers(row.get("weekend_answers")),
             )
         except (KeyError, TypeError, ValueError, AttributeError) as exc:
             msg = f"bad project row {row!r}: {exc}"

focus_project/focus_project/_mutate.py

@@ -0,0 +1,178 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Interview mutations: trips, weekend answers, evidence. Stricter only."""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from datetime import date, datetime
+import math
+from typing import TYPE_CHECKING
+
+from focus_project import _interview, _milestones, _store, evidence
+from focus_project._kind import INTERVIEW
+from focus_project._trips import Trip, add
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from focus_project._model import Project
+
+# Which evidence kinds each milestone family accepts from a caller.
+# ``check`` and ``answer`` are internal: written by run_checks/answer_weekend.
+_ACCEPTS = {
+    "rules": {"file"},
+    "mock": {"score"},
+    "slot": {"slot", "slot_confirm"},
+    "phone": {"tap"},
+}
+# tutor's worker reports phone readiness under the bare id "phone".
+_PHONE_REPORT = "phone"
+
+
+def local_now(now: datetime | None) -> datetime:
+    """``now`` or the clock's local time."""
+    return evidence.clock_now() if now is None else now
+
+
+def find(existing: list[Project], project_id: str) -> tuple[int, Project]:
+    """Index and interview project; KeyError unknown, ValueError focus kind."""
+    for i, project in enumerate(existing):
+        if project.id == project_id:
+            if project.kind != INTERVIEW:
+                msg = f"{project_id!r} is not an interview project (no milestones)"
+                raise ValueError(msg)
+            return i, project
+    raise KeyError(project_id)
+
+
+def add_trip(
+    project_id: str, start: date, end: date, *, now: datetime | None = None
+) -> Project:
+    """Announce a trip; it may only grow (see :func:`focus_project._trips.add`)."""
+    stamp = local_now(now)
+    with _store.locked():
+        existing = _store.read_all()
+        i, project = find(existing, project_id)
+        trips = add(project.trips, Trip(start, end, evidence.to_ms(stamp)))
+        updated = replace(project, trips=trips)
+        _interview.validate(updated)
+        existing[i] = updated
+        _store.write_all(existing)
+    return updated
+
+
+def answer_weekend(
+    project_id: str, saturday: date, *, trip: bool, now: datetime | None = None
+) -> Project:
+    """Answer the trip question of a weekend; True never flips back to False."""
+    stamp = local_now(now)
+    with _store.locked():
+        existing = _store.read_all()
+        i, project = find(existing, project_id)
+        if saturday not in _interview.saturdays(project):
+            msg = f"{saturday} is not a weekend of {project_id!r} before its test day"
+            raise ValueError(msg)
+        answers = dict(project.weekend_answers)
+        current = answers.get(saturday)
+        if current is trip:
+            return project
+        if current is True:
+            msg = "a trip answer may only get stricter: it stays True"
+            raise ValueError(msg)
+        if not trip and any(t.covers(saturday) for t in project.trips):
+            msg = f"an announced trip covers {saturday}: it cannot be a no-trip weekend"
+            raise ValueError(msg)
+        updated = replace(
+            project, weekend_answers=tuple(sorted({**answers, saturday: trip}.items()))
+        )
+        # Evidence first: a crash between the two leaves the question open
+        # (fail closed), never an answer with no time.
+        evidence.append(project_id, f"trip_ask:{saturday}", "answer", trip, stamp)
+        existing[i] = updated
+        _store.write_all(existing)
+    return updated
+
+
+def _number(value: object) -> float:
+    if (
+        isinstance(value, bool)
+        or not isinstance(value, int | float)
+        or not math.isfinite(value)
+        or value < 0
+    ):
+        msg = "a score must be a finite, non-negative number"
+        raise ValueError(msg)
+    return value
+
+
+def _count(value: object, label: str) -> int:
+    if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+        msg = f"{label} must be a non-negative integer"
+        raise ValueError(msg)
+    return value
+
+
+def _clean(
+    project_id: str, kind: str, value: object, file: Path | None, stamp: datetime
+) -> object:
+    """The value to store for ``kind``; ValueError if it is not acceptable."""
+    if kind == "file":
+        if file is None or not file.is_file() or not file.stat().st_size:
+            msg = "a non-empty file is required"
+            raise ValueError(msg)
+        return evidence.store_file(project_id, file, stamp)
+    if kind == "score":
+        return _number(value)
+    if kind == "slot":
+        moment = datetime.fromisoformat(str(value)) if isinstance(value, str) else None
+        if moment is None or moment.tzinfo is not None:
+            msg = "slot must be a naive local ISO datetime"
+            raise ValueError(msg)
+        return moment.isoformat()
+    if kind == "phone_check":
+        if not isinstance(value, dict) or not isinstance(value.get("plan"), bool):
+            msg = "phone_check needs {plan: bool, due: int, seen_ms: int}"
+            raise ValueError(msg)
+        return {
+            "plan": value["plan"],
+            "due": _count(value.get("due"), "due"),
+            "seen_ms": _count(value.get("seen_ms"), "seen_ms"),
+        }
+    if kind == "slot_confirm" and value not in {True, None}:
+        msg = "slot_confirm is a tap: value True"
+        raise ValueError(msg)
+    return True  # tap, slot_confirm
+
+
+def record_evidence(  # noqa: PLR0913
+    project_id: str,
+    milestone: str,
+    kind: str,
+    value: object = None,
+    *,
+    file: Path | None = None,
+    now: datetime | None = None,
+) -> evidence.Evidence:
+    """Append evidence for a milestone; ValueError if it does not fit.
+
+    Kinds: ``file`` (rules, copied from ``file``), ``tap`` (phone:*),
+    ``score`` (mock), ``slot`` (ISO datetime) and ``slot_confirm`` (slot),
+    ``phone_check`` ({plan, due, seen_ms}, milestone "phone", from tutor).
+    There is no way to delete a row.
+    """
+    stamp = local_now(now)
+    _, project = find(_store.read_all(), project_id)
+    if milestone == _PHONE_REPORT:
+        accepted = {"phone_check"}
+    else:
+        known = {m.id for m in _milestones.milestones(project, stamp)}
+        accepted = _ACCEPTS.get(milestone.partition(":")[0], set())
+        if milestone not in known:
+            msg = f"{milestone!r} is not a milestone of {project_id!r}"
+            raise ValueError(msg)
+    if kind not in accepted:
+        msg = f"{milestone!r} takes evidence kinds {sorted(accepted)}, not {kind!r}"
+        raise ValueError(msg)
+    return evidence.append(
+        project_id, milestone, kind, _clean(project_id, kind, value, file, stamp), stamp
+    )

focus_project/focus_project/_own.py

@@ -0,0 +1,31 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""A project day's own worked minutes: the union of every source's intervals."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from focus_project import sources
+
+if TYPE_CHECKING:
+    from datetime import date
+
+    from focus_project._model import Project
+
+
+def union_seconds(spans: list[sources.Interval]) -> float:
+    """Total length of the union of ``spans``."""
+    total = 0.0
+    end = float("-inf")
+    for lo, hi in sorted(spans):
+        if hi <= end:
+            continue
+        total += hi - max(lo, end)
+        end = hi
+    return total
+
+
+def own_minutes_of(project: Project, day: date, moment: float) -> int:
+    """Whole minutes worked on ``day``, uncapped, nothing after ``moment``."""
+    spans = sources.clip(sources.collect(day, project), (float("-inf"), moment))
+    return int(union_seconds(spans) // 60)

focus_project/focus_project/_paths.py

@@ -30,3 +30,18 @@ def activity_path() -> Path:
 def lock_path() -> Path:
     """The registry's writer lock."""
     return data_dir() / "projects.lock"
+
+
+def evidence_dir() -> Path:
+    """Interview-prep evidence: one jsonl per project plus copied files."""
+    return data_dir() / "evidence"
+
+
+def evidence_path(project_id: str) -> Path:
+    """The append-only evidence rows of one project."""
+    return evidence_dir() / f"{project_id}.jsonl"
+
+
+def evidence_files_dir(project_id: str) -> Path:
+    """Where evidence files (screenshots) of one project are copied."""
+    return evidence_dir() / project_id

focus_project/focus_project/_trips.py

@@ -0,0 +1,61 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Trips: days away from the PC. They can only grow (ratchet)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, replace
+from datetime import date
+from typing import Any
+
+
+@dataclass(frozen=True)
+class Trip:
+    """An inclusive away range; ``entered_ms`` is when it was announced."""
+
+    start: date
+    end: date
+    entered_ms: int = 0
+
+    def covers(self, day: date) -> bool:
+        """Whether ``day`` is inside the trip."""
+        return self.start <= day <= self.end
+
+    def to_dict(self) -> dict[str, Any]:
+        """The projects.json row."""
+        return {
+            "start": self.start.isoformat(),
+            "end": self.end.isoformat(),
+            "entered_ms": self.entered_ms,
+        }
+
+    @classmethod
+    def from_dict(cls, row: dict[str, Any]) -> Trip:
+        """Parse a trip row (errors surface as RegistryError upstream)."""
+        return cls(
+            start=date.fromisoformat(row["start"]),
+            end=date.fromisoformat(row["end"]),
+            entered_ms=int(row.get("entered_ms", 0)),
+        )
+
+
+def add(trips: tuple[Trip, ...], new: Trip) -> tuple[Trip, ...]:
+    """``trips`` plus ``new``; ValueError if that would loosen an old trip.
+
+    A new range touching an old trip must cover it: it replaces the old one
+    (keeping its entry time when the start did not move earlier). Anything
+    that starts later or ends earlier than what is on file is refused.
+    """
+    kept: list[Trip] = []
+    for old in trips:
+        if old.start > new.end or new.start > old.end:
+            kept.append(old)
+        elif new.start <= old.start and new.end >= old.end:
+            if new.start == old.start:
+                new = replace(new, entered_ms=old.entered_ms)
+        else:
+            msg = (
+                f"a trip may only get stricter: pass a range that covers "
+                f"{old.start}..{old.end}"
+            )
+            raise ValueError(msg)
+    return tuple(sorted([*kept, new], key=lambda t: t.start))

focus_project/focus_project/_update.py

@@ -3,7 +3,7 @@
 
 from __future__ import annotations
 
-from dataclasses import replace
+from dataclasses import dataclass, replace
 from datetime import date, timedelta
 from typing import Any
 
@@ -27,7 +27,7 @@ _EDITABLE = frozenset(
 _TUPLES = ("subjects", "site_patterns")
 
 
-def _apply(project: Project, changes: dict[str, Any], today: date) -> Project:
+def _apply(project: Project, changes: dict[str, Any], today: date) -> Update:
     """The edited project; ValueError for what an edit may not touch."""
     if project.ended_on is not None:
         msg = f"project {project.id!r} ended on {project.ended_on}"
@@ -50,37 +50,81 @@ def _apply(project: Project, changes: dict[str, Any], today: date) -> Project:
     if "end" in changes and changes["end"] < today:
         msg = f"end {changes['end']} is in the past"
         raise ValueError(msg)
-    edited = replace(project, **fields)
-    return _keep_past_limits(project, edited, today)
+    return _schedule(project, replace(project, **fields), today)
 
 
-def _keep_past_limits(old: Project, new: Project, today: date) -> Project:
-    """Freeze the old targets for the days before ``today`` if they changed."""
-    changed = (old.daily_minutes, old.unlock_minutes) != (
+def _held(project: Project, day: date) -> Limits:
+    """What held on ``day``: both targets and the replaced gates."""
+    return Limits(
+        day,
+        project.daily_on(day),
+        project.unlock_on(day),
+        project.replaces_on(day),
+    )
+
+
+def _reduces(held: Limits, new: Project) -> bool:
+    """Whether ``new`` asks less than ``held``: lower target or a gate more."""
+    return (
+        new.daily_minutes < held.daily_minutes
+        or new.unlock_minutes < held.unlock_minutes
+        or not set(new.replaces) <= set(held.replaces or ())
+    )
+
+
+def _schedule(old: Project, new: Project, today: date) -> Update:
+    """Date the edit: a reduction of a started project waits for tomorrow.
+
+    A raise (or a project that has not started) applies from ``today``; the
+    days before keep what held. Anything that lowers a target or switches a
+    gate off defers the whole edit one day, so no edit can undo a lock or
+    cheapen the pay of a day already running.
+    """
+    if (old.daily_minutes, old.unlock_minutes, old.replaces) == (
         new.daily_minutes,
         new.unlock_minutes,
+        new.replaces,
+    ):
+        return Update(new, today)
+    deferred = today >= old.start and _reduces(_held(old, today), new)
+    first = today + timedelta(days=1) if deferred else today
+    last = first - timedelta(days=1)
+    history = [h for h in old.history if h.until < first]
+    held = _held(old, last)
+    same = (held.daily_minutes, held.unlock_minutes, held.replaces) == (
+        new.daily_minutes,
+        new.unlock_minutes,
+        new.replaces,
     )
-    cutoff = today - timedelta(days=1)
-    if not changed or cutoff < old.start:
-        return new
-    if old.history and old.history[-1].until == cutoff:
-        return new
-    row = Limits(cutoff, old.daily_minutes, old.unlock_minutes)
-    return replace(new, history=(*old.history, row))
+    if last >= old.start and not same and not (history and history[-1].until == last):
+        history.append(held)
+    return Update(replace(new, history=tuple(history)), first)
 
 
-def update_project(
+@dataclass(frozen=True)
+class Update:
+    """An edited project and the first day its new targets and gates hold."""
+
+    project: Project
+    effective_from: date
+
+
+def apply_update(
     project_id: str,
     *,
     today: date | None = None,
     **changes: Any,  # noqa: ANN401
-) -> Project:
+) -> Update:
     """Edit ``project_id``; ValueError on bad input, overlap or a past edit.
 
     Editable: name, start, end, replaces, daily_minutes, unlock_minutes,
-    subjects, site_patterns, work_url. A started project's start cannot move; changed
-    minute targets apply from ``today`` (default: now) on, earlier days keep
-    theirs. KeyError for an unknown id.
+    subjects, site_patterns, work_url. A started project's start cannot move.
+    An edit never lowers today's obligation (0.7.0): a lower daily or unlock
+    target, or a gate added to ``replaces``, holds from tomorrow, the earlier
+    days (today included) keep theirs. Raises, gates removed and edits to a
+    project that has not started hold from ``today`` (default: now). The
+    result says which: ``effective_from``. A mixed edit defers as a whole.
+    KeyError for an unknown id.
     """
     unknown = sorted(set(changes) - _EDITABLE)
     if unknown:
@@ -92,7 +136,8 @@ def update_project(
         for i, project in enumerate(existing):
             if project.id != project_id:
                 continue
-            edited = _apply(project, changes, today)
+            done = _apply(project, changes, today)
+            edited = done.project
             _validate(edited)
             for other in existing:
                 if other.id != project_id and (
@@ -102,5 +147,15 @@ def update_project(
                     raise ValueError(msg)
             existing[i] = edited
             _store.write_all(existing)
-            return edited
+            return done
     raise KeyError(project_id)
+
+
+def update_project(
+    project_id: str,
+    *,
+    today: date | None = None,
+    **changes: Any,  # noqa: ANN401
+) -> Project:
+    """:func:`apply_update` returning just the project."""
+    return apply_update(project_id, today=today, **changes).project

focus_project/focus_project/carry.py

@@ -0,0 +1,75 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Overtime carries over: minutes past a day's target bank for the next day.
+
+Contract (kuhy, 2026-11-02): own minutes beyond ``daily_on(day)`` are banked
+(at most :data:`BANK_CAP`) and pay on the NEXT project day. The bank never
+crosses the project's last day (what is left then expires) and a carry never
+pays on a day with no project. The balance is derived from the activity
+record, never stored, so it cannot drift; a project day's counted minutes
+are ``min(daily, own + carried_in)``. The bank is spent first, so what a day
+takes from it is fixed when the day starts and only own minutes grow.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import date, timedelta
+import logging
+from typing import Final
+
+from focus_project import _api, _clock
+from focus_project._errors import RegistryError
+from focus_project._own import own_minutes_of
+
+BANK_CAP: Final = 60
+_LOG = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class Balance:
+    """One project day: worked minutes, bank taken in, bank left for tomorrow."""
+
+    own: int
+    carried_in: int
+    carry_out: int
+
+    def paid_bank(self, daily: int) -> int:
+        """Minutes of the day paid from the bank (fixed at the day's start)."""
+        return min(self.carried_in, daily)
+
+    def paid_own(self, daily: int) -> int:
+        """Minutes of the day paid from own work, after the bank."""
+        return min(self.own, daily - self.paid_bank(daily))
+
+    def counted(self, daily: int) -> int:
+        """Minutes that count on the day: own plus carried, capped at ``daily``."""
+        return min(daily, self.own + self.carried_in)
+
+
+_NONE: Final = Balance(0, 0, 0)
+
+
+def balance(day: date, now: float | None = None) -> Balance:
+    """The balance of ``day`` (zeros with no project or an unreadable registry)."""
+    moment = _clock.now() if now is None else now
+    try:
+        project = _api.active(day)
+        if project is None:
+            return _NONE
+        bank = 0
+        cursor = project.start
+        while True:
+            own = own_minutes_of(project, cursor, moment)
+            total = own + bank
+            left = min(BANK_CAP, max(0, total - project.daily_on(cursor)))
+            if cursor >= day:
+                return Balance(own, bank, left)
+            bank, cursor = left, cursor + timedelta(days=1)
+    except (RegistryError, OSError) as exc:
+        _LOG.warning("focus_project registry unreadable, nothing banked: %s", exc)
+        return _NONE
+
+
+def own_minutes(day: date, now: float | None = None) -> int:
+    """Minutes worked on ``day``, not capped at the target (0 with no project)."""
+    return balance(day, now).own

focus_project/focus_project/checks.py

@@ -0,0 +1,106 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Pluggable check sources for the auto-checked milestones, and latching.
+
+A source is ``fn(project, now) -> True | False | None``; ``None`` means "could
+not check" (logged) and counts as not done. Only ``phone`` is auto-checked
+(the calendar slot check was dropped, 2026-11-10: ``slot`` is two taps).
+
+:func:`run_checks` is the only place sources run: status()/milestones() stay
+cheap and read the latched ``check`` rows it appends (only on a change).
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from datetime import datetime, timedelta
+import logging
+
+from focus_project import _milestones, _mutate, _store, evidence
+from focus_project._model import Project
+
+_LOG = logging.getLogger(__name__)
+CheckSource = Callable[[Project, datetime], bool | None]
+DAY_MS = 24 * 3600 * 1000
+# A phone check starts 24 h before the milestone is due.
+WINDOW = timedelta(hours=24)
+
+
+def _report_ok(value: object, report_ms: int) -> bool:
+    """A plan exists, cards are due, the phone was seen <= 24 h before the report."""
+    if not isinstance(value, dict):
+        return False
+    try:
+        return bool(
+            value["plan"] is True
+            and int(value["due"]) > 0
+            and report_ms - int(value["seen_ms"]) <= DAY_MS
+        )
+    except KeyError, TypeError, ValueError:
+        return False
+
+
+def phone_source(project: Project, now: datetime) -> bool | None:
+    """Read tutor's latest ``phone_check`` report (<= 24 h old).
+
+    No report, a stale one or one stamped ahead of the clock = ``None``
+    (the worker is not reporting). A fresh one passes only if the plan
+    exists, cards are due and the phone was seen within 24 h of the report.
+    """
+    report = evidence.last(evidence.read(project.id), "phone", "phone_check")
+    if report is None:
+        _LOG.warning("phone check: no tutor report for %s", project.id)
+        return None
+    if not 0 <= evidence.to_ms(now) - report.ms <= DAY_MS:
+        _LOG.warning("phone check: tutor report for %s is stale or ahead", project.id)
+        return None
+    return _report_ok(report.value, report.ms)
+
+
+SOURCES: dict[str, CheckSource] = {"phone": phone_source}
+
+
+def register_source(name: str, source: CheckSource) -> None:
+    """Replace the callable behind an auto check (``phone``)."""
+    if name not in SOURCES:
+        msg = f"unknown check source {name!r}; known: {sorted(SOURCES)}"
+        raise ValueError(msg)
+    SOURCES[name] = source
+
+
+def _run(project: Project, now: datetime) -> bool | None:
+    try:
+        return SOURCES["phone"](project, now)
+    except Exception as exc:  # noqa: BLE001 (pluggable code: any failure = unknown)
+        _LOG.warning("phone check source failed: %s", exc)
+        return None
+
+
+def run_checks(
+    project_id: str, *, now: datetime | None = None
+) -> dict[str, bool | None]:
+    """Run the auto checks of open phone milestones; latch what changed.
+
+    Returns milestone id -> verdict for the ones checked (inside their
+    24 h window, not yet done). KeyError for an unknown project; a focus
+    project has nothing to check.
+    """
+    stamp = _mutate.local_now(now)
+    project = next((p for p in _store.read_all() if p.id == project_id), None)
+    if project is None:
+        raise KeyError(project_id)
+    open_ids = [
+        m.id
+        for m in _milestones.milestones(project, stamp)
+        if m.id.startswith("phone:")
+        and m.state not in {"done", "late_done"}
+        and stamp >= m.due - WINDOW
+    ]
+    if not open_ids:
+        return {}
+    verdict = _run(project, stamp)
+    rows = evidence.read(project_id)
+    for mid in open_ids:
+        _, latest, seen = evidence.check_summary(rows, mid)
+        if verdict != latest and not (verdict is None and not seen):
+            evidence.append(project_id, mid, "check", verdict, stamp)
+    return dict.fromkeys(open_ids, verdict)

focus_project/focus_project/evidence.py

@@ -0,0 +1,159 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""The interview evidence store: append-only rows plus copied files.
+
+One jsonl per project (``{ms, milestone, kind, value}``) under the
+:mod:`focus_project._paths` seam. There is deliberately no delete or rewrite
+function: a milestone once evidenced stays evidenced.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import UTC, datetime
+import itertools
+import json
+import logging
+import os
+import re
+import shutil
+from typing import TYPE_CHECKING
+
+from focus_project import _clock, _paths
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+_LOG = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class Evidence:
+    """One evidence row."""
+
+    ms: int
+    milestone: str
+    kind: str
+    value: object
+
+    @property
+    def at(self) -> datetime:
+        """When it was recorded, as a naive local datetime."""
+        return from_ms(self.ms)
+
+
+def to_ms(moment: datetime) -> int:
+    """Unix milliseconds of a naive local datetime."""
+    return int(moment.timestamp() * 1000)
+
+
+def from_ms(ms: int) -> datetime:
+    """Naive local datetime of unix milliseconds."""
+    return datetime.fromtimestamp(ms / 1000, tz=UTC).astimezone().replace(tzinfo=None)
+
+
+def clock_now() -> datetime:
+    """The clock seam (:mod:`focus_project._clock`) as a naive local datetime."""
+    return from_ms(int(_clock.now() * 1000))
+
+
+def append(
+    project_id: str, milestone: str, kind: str, value: object, now: datetime
+) -> Evidence:
+    """Append one row (fsynced) and return it."""
+    row = Evidence(to_ms(now), milestone, kind, value)
+    path = _paths.evidence_path(project_id)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    line = json.dumps(
+        {"ms": row.ms, "milestone": milestone, "kind": kind, "value": value}
+    )
+    with path.open("a", encoding="utf-8") as handle:
+        handle.write(line + "\n")
+        handle.flush()
+        os.fsync(handle.fileno())
+    return row
+
+
+def store_file(project_id: str, source: Path, now: datetime) -> str:
+    """Copy ``source`` beside the rows under a name that never collides."""
+    target = _paths.evidence_files_dir(project_id)
+    target.mkdir(parents=True, exist_ok=True)
+    safe = re.sub(r"[^A-Za-z0-9._-]", "_", source.name)[:80]
+    stamp = to_ms(now)
+    for attempt in itertools.count():
+        name = f"{stamp}-{safe}" if not attempt else f"{stamp}-{attempt}-{safe}"
+        try:
+            with (target / name).open("xb") as out, source.open("rb") as src:
+                shutil.copyfileobj(src, out)
+                out.flush()
+                os.fsync(out.fileno())
+        except FileExistsError:
+            continue
+        return name
+    raise AssertionError  # pragma: no cover (itertools.count never ends)
+
+
+def _parse(line: str) -> Evidence | None:
+    try:
+        row = json.loads(line)
+        if not isinstance(row, dict) or isinstance(row["ms"], bool):
+            return None
+        return Evidence(
+            int(row["ms"]), str(row["milestone"]), str(row["kind"]), row["value"]
+        )
+    except ValueError, KeyError, TypeError:
+        return None
+
+
+def read(project_id: str) -> list[Evidence]:
+    """Every row in file order; a missing file is empty, bad lines are skipped.
+
+    A torn last line (crash mid-append) must not wipe out the whole history,
+    so malformed lines are logged and ignored; an unreadable file raises.
+    """
+    try:
+        path = _paths.evidence_path(project_id)
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except FileNotFoundError:
+        return []
+    rows: list[Evidence] = []
+    for number, line in enumerate(text.splitlines(), start=1):
+        parsed = _parse(line)
+        if parsed is None:
+            _LOG.warning(
+                "evidence %s line %d: skipping malformed row", project_id, number
+            )
+        else:
+            rows.append(parsed)
+    return rows
+
+
+def first(
+    rows: list[Evidence], milestone: str, kind: str, since_ms: int = 0
+) -> Evidence | None:
+    """The earliest matching row at or after ``since_ms``."""
+    return next(
+        (
+            r
+            for r in rows
+            if (r.milestone, r.kind) == (milestone, kind) and r.ms >= since_ms
+        ),
+        None,
+    )
+
+
+def last(rows: list[Evidence], milestone: str, kind: str) -> Evidence | None:
+    """The latest matching row."""
+    return next(
+        (r for r in reversed(rows) if (r.milestone, r.kind) == (milestone, kind)),
+        None,
+    )
+
+
+def check_summary(
+    rows: list[Evidence], milestone: str
+) -> tuple[int | None, bool | None, bool]:
+    """``(first passing ms, latest verdict, any check row)`` for a milestone."""
+    checks = [r for r in rows if (r.milestone, r.kind) == (milestone, "check")]
+    passed = next((r.ms for r in checks if r.value is True), None)
+    latest = checks[-1].value if checks else None
+    return passed, (latest if isinstance(latest, bool) else None), bool(checks)

focus_project/focus_project/harvest.py

@@ -7,6 +7,9 @@ one-minute ``.timer``). Harvests every project day of the last
 after the fact) is paid once a run sees it; ``credit_to`` is idempotent, so
 settled days cost one read and write nothing. Failure modes, by path:
 
+Overtime past a day's target banks for the next day (``carry``): that day's
+carry row pays it from the day's start, own-work rows pay the rest.
+
 * a source that errors: logged, contributes 0, the run continues (fail closed);
 * an unreadable registry, signing key or ledger: logged, exit status 1, so
   the unit shows ``failed`` instead of silently crediting nothing.
@@ -18,9 +21,8 @@ from datetime import date, timedelta
 import logging
 import sys
 
-from focus_project import _api, _clock, ledger
+from focus_project import _api, _clock, carry, ledger
 from focus_project._errors import RegistryError
-from focus_project.minutes import minutes_for
 
 BACKFILL_DAYS = 31  # bounds the per-run cost; the relay accepts events <= 48 h old
 _LOG = logging.getLogger("focus_project.harvest")
@@ -43,11 +45,18 @@ def harvest_day(day: date, now: float) -> int:
     project = _api.active(day)
     if project is None:
         return 0
-    total = minutes_for(day, now=now)
-    added = ledger.credit_to(project, day, total, now=now)
+    daily = project.daily_on(day)
+    bank = carry.balance(day, now)
+    added = ledger.credit_to(project, day, bank.paid_bank(daily), now=now, carry=True)
+    added += ledger.credit_to(project, day, bank.paid_own(daily), now=now)
     if added:
         _LOG.info(
-            "credited %d min to %s on %s (total %d)", added, project.id, day, total
+            "credited %d min to %s on %s (total %d, %d from the bank)",
+            added,
+            project.id,
+            day,
+            bank.counted(daily),
+            bank.paid_bank(daily),
         )
     return added
 

focus_project/focus_project/ledger.py

@@ -93,10 +93,19 @@ def _write_rows(path: Path, rows: list[Any]) -> None:
     Path(handle.name).replace(path)
 
 
-def paid_minutes(rows: list[Any], key: bytes, project_id: str, day: date) -> int:
+def paid_minutes(
+    rows: list[Any],
+    key: bytes,
+    project_id: str,
+    day: date,
+    *,
+    carry: bool | None = None,
+) -> int:
     """Minutes already paid for ``project_id`` on ``day`` by verified rows.
 
-    A repeated ``entry_id`` pays once, at its smallest count.
+    ``carry`` picks one class (True: banked-overtime rows, False: own-work
+    rows); None sums both. A repeated ``entry_id`` pays once, at its smallest
+    count.
     """
     by_id: dict[str, int] = {}
     for row in rows:
@@ -112,6 +121,7 @@ def paid_minutes(rows: list[Any], key: bytes, project_id: str, day: date) -> int
             or not isinstance(minutes, int)
             or isinstance(minutes, bool)
             or minutes < 1
+            or (carry is not None and bool(detail.get("carry")) != carry)
             or not earned_time.verified(row, key)
         ):
             continue
@@ -121,13 +131,31 @@ def paid_minutes(rows: list[Any], key: bytes, project_id: str, day: date) -> int
 
 
 def build_row(  # noqa: PLR0913
-    project_id: str, day: date, total: int, minutes: int, key: bytes, *, now: float
+    project_id: str,
+    day: date,
+    total: int,
+    minutes: int,
+    key: bytes,
+    *,
+    now: float,
+    carry: bool = False,
+    first_carry: bool = True,
 ) -> dict[str, Any]:
-    """The signed row paying ``minutes`` that bring the day's total to ``total``."""
+    """The signed row paying ``minutes`` that bring the day's total to ``total``.
+
+    A ``carry`` row pays banked overtime: ``<project>-<YYYYMMDD>-carry``, or
+    ``-carry-m<total>`` when it tops up an earlier carry row (late data for
+    the day before grew the bank).
+    """
     ended = min(now, day_bounds(day)[1] - 1)
+    stem = f"{project_id}-{day:%Y%m%d}"
+    if not carry:
+        entry_id = f"{stem}-m{total}"
+    else:
+        entry_id = f"{stem}-carry" if first_carry else f"{stem}-carry-m{total}"
     row: dict[str, Any] = {
         "kind": CREDIT,
-        "entry_id": f"{project_id}-{day:%Y%m%d}-m{total}",
+        "entry_id": entry_id,
         "day": day.isoformat(),
         "created_at": float(now),
         "detail": {
@@ -135,6 +163,7 @@ def build_row(  # noqa: PLR0913
             "minutes": int(minutes),
             "total": int(total),
             "ended_at": float(ended),
+            **({"carry": True} if carry else {}),
         },
     }
     row["hmac"] = str(earned_time.entry_signature(row, key))
@@ -142,10 +171,18 @@ def build_row(  # noqa: PLR0913
 
 
 def credit_to(
-    project: Project, day: date, total: int, *, now: float | None = None
+    project: Project,
+    day: date,
+    total: int,
+    *,
+    now: float | None = None,
+    carry: bool = False,
 ) -> int:
     """Pay the day up to ``total`` cumulative minutes; return minutes added.
 
+    ``carry`` pays the banked-overtime class and counts only its own rows;
+    the default pays (and counts) own work.
+
     Idempotent: nothing is written when the ledger already pays ``total`` or
     more. Raises LedgerError (unreadable ledger, unreadable key, unverifiable
     write) so the harvester can fail loudly instead of crediting nothing quietly.
@@ -159,11 +196,18 @@ def credit_to(
     with path.with_suffix(".lock").open("w") as lock:
         fcntl.flock(lock, fcntl.LOCK_EX)
         rows = read_rows(path)
-        paid = paid_minutes(rows, key, project.id, day)
+        paid = paid_minutes(rows, key, project.id, day, carry=carry)
         if total <= paid:
             return 0
         row = build_row(
-            project.id, day, total, total - paid, key, now=now or time.time()
+            project.id,
+            day,
+            total,
+            total - paid,
+            key,
+            now=now or time.time(),
+            carry=carry,
+            first_carry=paid == 0,
         )
         if any(
             isinstance(r, dict) and r.get("entry_id") == row["entry_id"] for r in rows
@@ -172,7 +216,7 @@ def credit_to(
             raise LedgerError(msg)
         _write_rows(path, [*rows, row])
         stored = read_rows(path)
-    if paid_minutes(stored, key, project.id, day) != total:
+    if paid_minutes(stored, key, project.id, day, carry=carry) != total:
         msg = f"row {row['entry_id']} not found verified on read-back"
         raise LedgerError(msg)
     return total - paid

focus_project/focus_project/minutes.py

@@ -1,12 +1,17 @@
 # Copyright (c) 2026 Krzysztof Rudnicki
 """Credited focus minutes per day: the union of every source's intervals.
 
-Contract: union of activity intervals on the local calendar day, capped at
-the active project's ``daily_minutes``; overlaps never double count; whole
+Contract: union of activity intervals on the local calendar day plus the
+overtime carried in from the day before (:mod:`focus_project.carry`), capped
+at the active project's ``daily_minutes``; overlaps never double count; whole
 minutes (floor). Time not yet lived is never credited: every interval is
 clipped at "now", so an event stamped ahead of the clock (a fast phone clock)
 earns only once the real clock reaches it. An unreadable registry reads as 0
 (logged): fail closed.
+
+Unbacked minutes (0.10.0): timer time the anti-cheat gate refused
+(:mod:`focus_project.sources.activity`) and no other source covers, on the
+local day up to "now"; carry and the cap play no part. Shown, never paid.
 """
 
 from __future__ import annotations
@@ -14,24 +19,14 @@ from __future__ import annotations
 from datetime import date  # noqa: TC003
 import logging
 
-from focus_project import _api, _clock, sources
+from focus_project import _api, _clock, carry, sources
 from focus_project._errors import RegistryError
+from focus_project._own import union_seconds
+from focus_project.sources import activity
 
 _LOG = logging.getLogger(__name__)
 
 
-def union_seconds(spans: list[sources.Interval]) -> float:
-    """Total length of the union of ``spans``."""
-    total = 0.0
-    end = float("-inf")
-    for lo, hi in sorted(spans):
-        if hi <= end:
-            continue
-        total += hi - max(lo, end)
-        end = hi
-    return total
-
-
 def minutes_for(day: date, now: float | None = None) -> int:
     """Minutes of focus work credited on ``day`` (0 with no project active).
 
@@ -45,6 +40,29 @@ def minutes_for(day: date, now: float | None = None) -> int:
     if project is None:
         return 0
     moment = _clock.now() if now is None else now
-    spans = sources.clip(sources.collect(day, project), (float("-inf"), moment))
-    seconds = union_seconds(spans)
-    return min(int(seconds // 60), project.daily_on(day))
+    return carry.balance(day, moment).counted(project.daily_on(day))
+
+
+def unbacked_minutes_for(day: date, now: float | None = None) -> int:
+    """Whole minutes of timer time on ``day`` that the gate did not count.
+
+    0 with no project, before :data:`~focus_project.sources.activity.BACKING_FROM`,
+    or with an unreadable registry (logged).
+    """
+    try:
+        project = _api.active(day)
+        if project is None:
+            return 0
+        lo, hi = sources.day_bounds(day)
+        bounds = (lo, min(hi, _clock.now() if now is None else now))
+        unbacked = sources.clip(activity.split_timer(day, project)[1], bounds)
+        counted = sources.clip(sources.collect(day, project), bounds)
+    except (RegistryError, OSError) as exc:
+        _LOG.warning("focus_project registry unreadable, 0 unbacked: %s", exc)
+        return 0
+    # |unbacked minus counted| = |unbacked union counted| - |counted|.
+    gap = union_seconds(unbacked + counted) - union_seconds(counted)
+    return int(gap // 60)
+
+
+__all__ = ["minutes_for", "unbacked_minutes_for", "union_seconds"]

focus_project/focus_project/sources/activity.py

@@ -8,23 +8,41 @@ starts a fresh one. Time after the last check-in is not credited until the
 next event vouches for it. Every other source (tutor, sql_drills, ...) is a
 heartbeat covering the five minutes before it. Only events recorded for
 ``project`` count.
+
+0.8.0: a ``tutor`` ``heartbeat`` (a graded check-in card) is also a beat of
+the open segment, like a ``checkin``: within :data:`MAX_GAP_S` of the last
+beat it extends the segment; later it ends the segment at that last beat. It
+never opens a segment. Other heartbeat sources never chain the timer.
+
+0.10.0 anti-cheat (days from :data:`BACKING_FROM`): a timer span earns only
+if real activity of the same project backs it, whole span or nothing. A
+backing event is a ``tutor``/``sql_drills``/``leetcode`` heartbeat or an
+accepted LeetCode submission (leetcode projects only); ``browser`` never
+backs. A span ``(a, b)`` is backed if a backing event lies in
+``[a - 300, b]``, or between two consecutive backing events at most
+:data:`BRIDGE_S` apart. Check-ins alone earn 0. Earlier days keep the old
+rule (every span counts), so paid days never change.
 """
 
 from __future__ import annotations
 
+from datetime import date
+import importlib
+from itertools import pairwise
 import json
 import logging
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Final
 
 from focus_project._paths import activity_path
-from focus_project.sources import Interval, heartbeat_interval
+from focus_project.sources import HEARTBEAT_WINDOW_S, Interval, heartbeat_interval
 
 if TYPE_CHECKING:
-    from datetime import date
-
     from focus_project._model import Project
 
 MAX_GAP_S = 600.0
+BACKING_FROM: Final = date(2026, 11, 8)
+BACKING_SOURCES: Final = frozenset({"tutor", "sql_drills", "leetcode"})
+BRIDGE_S: Final = 1200.0
 _LOG = logging.getLogger(__name__)
 
 
@@ -55,26 +73,92 @@ def read_events(project_id: str) -> list[dict[str, Any]]:
 
 
 def timer_intervals(events: list[dict[str, Any]]) -> list[Interval]:
-    """Credited spans of the ``timer`` events (already time-ordered)."""
+    """Credited spans of the ``timer`` events and tutor beats (time-ordered)."""
     spans: list[Interval] = []
-    last: float | None = None  # the last event of the open segment
+    last: float | None = None  # the last beat of the open segment
     for event in events:
         ts = float(event["ts"])
         kind = event.get("kind")
-        if kind not in {"start", "checkin", "stop"}:
+        beat = _is_beat(event)
+        if not beat and kind not in {"start", "checkin", "stop"}:
             continue
+        on_time = False
         if last is not None and ts - last <= MAX_GAP_S:
             spans.append((last, ts))
-        last = None if kind == "stop" else ts
+            on_time = True
+        # A beat never opens a segment; a stop closes it; start/checkin open it.
+        keep = on_time if beat else kind != "stop"
+        last = ts if keep else None
     return spans
 
 
-def intervals(day: date, project: Project) -> list[Interval]:  # noqa: ARG001
-    """Timer segments plus heartbeats of ``project`` (the registry clips)."""
+def _is_beat(event: dict[str, Any]) -> bool:
+    """A tutor heartbeat: it chains the timer segment (0.8.0)."""
+    return event.get("source") == "tutor" and event.get("kind") == "heartbeat"
+
+
+def sessions(project_id: str) -> list[Interval]:
+    """Contiguous focus sessions of ``project_id``, time-ordered, as (start, end).
+
+    Built from the same timer/tutor-beat segments (and so the same
+    :data:`MAX_GAP_S` rule) that credit minutes; spans that touch are one
+    session, which ends at its last beat.
+    """
+    events = read_events(project_id)
+    timer = [e for e in events if e.get("source") == "timer" or _is_beat(e)]
+    merged: list[Interval] = []
+    for lo, hi in timer_intervals(timer):
+        if merged and lo <= merged[-1][1]:
+            merged[-1] = (merged[-1][0], max(hi, merged[-1][1]))
+        else:
+            merged.append((lo, hi))
+    return merged
+
+
+def backing_times(events: list[dict[str, Any]], project: Project) -> list[float]:
+    """Sorted times of the events that may back a timer span.
+
+    The LeetCode ledger is read in its own guard: if it fails, only the
+    submissions are lost, never the heartbeats (fail closed, narrow).
+    """
+    times = [float(e["ts"]) for e in events if e.get("source") in BACKING_SOURCES]
+    try:
+        # Imported lazily: it pulls in earned_time, and the timer must keep
+        # working (heartbeat backing only) where that is not installed.
+        leetcode = importlib.import_module("focus_project.sources.leetcode")
+        times += leetcode.submission_times(project)
+    except Exception:  # noqa: BLE001 (lose the submissions, keep the beats)
+        _LOG.exception("leetcode backing unavailable, heartbeats only")
+    return sorted(times)
+
+
+def is_backed(span: Interval, times: list[float]) -> bool:
+    """Whether a backing event lies in or just before ``span``, or bridges it."""
+    lo, hi = span
+    if any(lo - HEARTBEAT_WINDOW_S <= t <= hi for t in times):
+        return True
+    return any(a <= lo and hi <= b and b - a <= BRIDGE_S for a, b in pairwise(times))
+
+
+def split_timer(
+    day: date, project: Project, events: list[dict[str, Any]] | None = None
+) -> tuple[list[Interval], list[Interval]]:
+    """``(backed, unbacked)`` timer spans of ``project``, judged for ``day``."""
+    found = read_events(project.id) if events is None else events
+    chain = [e for e in found if e.get("source") == "timer" or _is_beat(e)]
+    spans = timer_intervals(chain)
+    if day < BACKING_FROM:
+        return spans, []
+    times = backing_times(found, project)
+    backed = [s for s in spans if is_backed(s, times)]
+    return backed, [s for s in spans if s not in backed]
+
+
+def intervals(day: date, project: Project) -> list[Interval]:
+    """Backed timer segments plus heartbeats of ``project`` (the registry clips)."""
     events = read_events(project.id)
-    timer = [e for e in events if e.get("source") == "timer"]
     beats = [e for e in events if e.get("source") != "timer"]
     return [
-        *timer_intervals(timer),
+        *split_timer(day, project, events)[0],
         *(heartbeat_interval(float(e["ts"])) for e in beats),
     ]

focus_project/focus_project/sources/leetcode.py

@@ -55,8 +55,8 @@ def _submitted_at(row: object, key: bytes) -> float | None:
         return None
 
 
-def intervals(day: date, project: Project) -> list[Interval]:  # noqa: ARG001
-    """One heartbeat per accepted submission (the registry clips to the day)."""
+def submission_times(project: Project) -> list[float]:
+    """Times of verified accepted submissions; [] for a non-leetcode project."""
     if not any("leetcode" in pattern.lower() for pattern in project.site_patterns):
         return []
     key = ledger.read_key()
@@ -64,4 +64,9 @@ def intervals(day: date, project: Project) -> list[Interval]:  # noqa: ARG001
         _LOG.warning("leetcode source: no signing key, contributes 0")
         return []
     stamps = (_submitted_at(row, key) for row in ledger.read_rows(ledger_file()))
-    return [heartbeat_interval(ts) for ts in stamps if ts is not None]
+    return [ts for ts in stamps if ts is not None]
+
+
+def intervals(day: date, project: Project) -> list[Interval]:  # noqa: ARG001
+    """One heartbeat per accepted submission (the registry clips to the day)."""
+    return [heartbeat_interval(ts) for ts in submission_times(project)]

focus_project/focus_project/status.py

@@ -3,31 +3,79 @@
 
 from __future__ import annotations
 
-from datetime import date  # noqa: TC003
-from typing import Any
+import logging
+from typing import TYPE_CHECKING, Any
 
-from focus_project import _api, minutes
+from focus_project import _api, _milestones, carry, evidence, minutes
+
+if TYPE_CHECKING:
+    from datetime import date
+
+    from focus_project._model import Project
+
+_LOG = logging.getLogger(__name__)
+
+
+def _milestone_block(project: Project) -> tuple[list[dict[str, Any]], bool]:
+    """Milestone rows and whether any is red; unreadable evidence shows none.
+
+    Display path, so it fails open (logged): the lock path, ``owed_lock``,
+    has its own handling.
+    """
+    now = evidence.clock_now()
+    try:
+        items = _milestones.milestones(project, now)
+    except OSError as exc:
+        _LOG.warning("interview evidence unreadable, no milestones shown: %s", exc)
+        return [], False
+    return [m.to_dict() for m in items], any(m.red for m in items)
 
 
 def status(day: date) -> dict[str, Any]:
-    """Progress of the project active on ``day``; ``project`` is None if none."""
+    """Progress of the project active on ``day``; ``project`` is None if none.
+
+    ``minutes`` is what was really worked plus what the day took from the
+    bank, so it may exceed ``daily_minutes`` (121/120); ``counted_minutes``
+    is the capped figure that pays. ``unbacked_minutes`` is timer time the
+    anti-cheat gate refused (shown as "not counted", never paid).
+    """
     project = _api.active(day)
     if project is None:
         return {
             "project": None,
             "name": None,
             "minutes": 0,
+            "own_minutes": 0,
+            "counted_minutes": 0,
+            "carried_in": 0,
+            "carry_out": 0,
             "daily_minutes": None,
             "unlock_minutes": None,
             "ends": None,
             "replaces": [],
+            "unbacked_minutes": 0,
+            "milestones": [],
+            "missed": False,
         }
+    daily = project.daily_on(day)
+    bank = carry.balance(day)
+    rows, missed = _milestone_block(project)
     return {
         "project": project.id,
         "name": project.name,
-        "minutes": minutes.minutes_for(day),
-        "daily_minutes": project.daily_on(day),
+        # Real minutes behind the day (own + banked in), never capped: the
+        # number to show. Pay is ``counted_minutes``; earned_time caps it.
+        "minutes": bank.own + bank.carried_in,
+        "own_minutes": bank.own,
+        "counted_minutes": bank.counted(daily),
+        "carried_in": bank.carried_in,
+        "carry_out": bank.carry_out,
+        "daily_minutes": daily,
         "unlock_minutes": project.unlock_on(day),
         "ends": project.last_day.isoformat(),
-        "replaces": list(project.replaces),
+        "replaces": list(project.replaces_on(day)),
+        "unbacked_minutes": minutes.unbacked_minutes_for(day),
+        # Interview projects: [{id, due ISO, state}] and whether any is red.
+        "milestones": rows,
+        "missed": missed,
     }

focus_project/focus_project/tests/conftest.py

@@ -11,7 +11,7 @@ from typing import TYPE_CHECKING
 
 import pytest
 
-from focus_project import _clock
+from focus_project import _clock, _paths, checks
 
 if TYPE_CHECKING:
     from pathlib import Path
@@ -40,3 +40,16 @@ def _far_future_clock(monkeypatch: pytest.MonkeyPatch) -> None:
 def data(tmp_path: Path) -> Path:
     """The redirected data directory (may not exist yet)."""
     return tmp_path / "data"
+
+
+@pytest.fixture(autouse=True)
+def _interview_isolation(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, _redirect_state: None
+) -> None:
+    """Evidence lives under the redirected data dir; sources are a private copy.
+
+    Fails closed (R3): if the path seam ever resolves outside ``tmp_path`` the
+    test errors before it can write a production evidence row.
+    """
+    assert _paths.evidence_dir().is_relative_to(tmp_path)
+    monkeypatch.setattr(checks, "SOURCES", dict(checks.SOURCES))

focus_project/focus_project/tests/helpers.py

@@ -0,0 +1,65 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Shared fixtures-as-functions for the interview-prep tests."""
+
+from __future__ import annotations
+
+from datetime import date, datetime, time, timedelta
+import json
+from typing import TYPE_CHECKING
+
+import focus_project as fp
+from focus_project._paths import activity_path
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+START = date(2026, 11, 10)  # Tuesday: D1
+TEST_DAY = date(2026, 11, 27)  # Friday: T
+TEST_AT = datetime.combine(TEST_DAY, time(10, 0))
+SAT1 = date(2026, 11, 14)
+SAT2 = date(2026, 11, 21)
+
+
+def at(day: int, hour: int = 0, minute: int = 0) -> datetime:
+    """A November 2026 local datetime."""
+    return datetime.combine(date(2026, 11, day), time(hour, minute))
+
+
+def make(pid: str = "iv", /, **kw: object) -> fp.Project:
+    """Create an interview project D1 = Nov 10, T = Nov 27."""
+    args: dict[str, object] = {
+        "name": "Interview",
+        "start": START,
+        "end": TEST_DAY,
+        "replaces": ["leetcode", "reading", "tutor"],
+        "daily_minutes": 120,
+        "unlock_minutes": 30,
+        "kind": "interview",
+        "test_at": TEST_AT,
+        "invite_url": "https://app.codility.com/c/run/abc",
+    }
+    args.update(kw)
+    return fp.create_project(pid, **args)  # type: ignore[arg-type]
+
+
+def shot(tmp_path: Path, name: str = "rules.png") -> Path:
+    """A non-empty screenshot stand-in."""
+    path = tmp_path / name
+    path.write_bytes(b"\x89PNG rules")
+    return path
+
+
+def states(project: fp.Project, now: datetime) -> dict[str, str]:
+    """Milestone id -> state."""
+    return {m.id: m.state for m in fp.milestones(project, now)}
+
+
+def session(start: datetime, minutes: int, *, step: int = 5, pid: str = "iv") -> None:
+    """A timer session start -> check-in every ``step`` min -> stop."""
+    activity_path().parent.mkdir(parents=True, exist_ok=True)
+    with activity_path().open("a", encoding="utf-8") as handle:
+        for offset in range(0, minutes + 1, step):
+            kind = "start" if offset == 0 else "checkin"
+            when = start + timedelta(minutes=offset)
+            row = {"ts": when.timestamp(), "source": "timer", "kind": kind}
+            handle.write(json.dumps({**row, "project": pid, "dev": "pc"}) + "\n")

focus_project/focus_project/tests/test_activity_status.py

@@ -3,7 +3,7 @@
 
 from __future__ import annotations
 
-from datetime import date
+from datetime import date, datetime
 import importlib
 import json
 from pathlib import Path  # noqa: TC003
@@ -13,12 +13,16 @@ import time
 import pytest
 
 import focus_project as fp
-from focus_project import _clock, minutes
+from focus_project import _clock
 from focus_project._paths import data_dir
 
 D1 = date(2026, 11, 2)
 
 
+def _at(hour: int, minute: int) -> float:
+    return datetime(2026, 11, 2, hour, minute).astimezone().timestamp()
+
+
 def _project() -> None:
     fp.create_project(
         "hr",
@@ -115,19 +119,27 @@ def test_record_activity_concurrent_appends(data: Path) -> None:
     assert all(json.loads(x)["source"] == "tutor" for x in lines)
 
 
-def test_status_active_uses_minutes_module(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_status_active_reports_the_worked_minutes() -> None:
     _project()
-    assert fp.status(D1)["minutes"] == 0  # the stub
-    monkeypatch.setattr(minutes, "minutes_for", lambda _day: 45)
+    assert fp.status(D1)["minutes"] == 0
+    for k in range(1, 10):  # nine heartbeats, five minutes each
+        fp.record_activity("tutor", "heartbeat", ts=_at(8, 5 * k))
     st = fp.status(D1)
     assert st == {
         "project": "hr",
         "name": "HackerRank prep",
         "minutes": 45,
+        "own_minutes": 45,
+        "counted_minutes": 45,
+        "carried_in": 0,
+        "carry_out": 0,
         "daily_minutes": 120,
         "unlock_minutes": 30,
         "ends": "2026-11-05",
         "replaces": ["leetcode"],
+        "unbacked_minutes": 0,
+        "milestones": [],
+        "missed": False,
     }
 
 
@@ -141,10 +153,17 @@ def test_status_inactive() -> None:
         "project",
         "name",
         "minutes",
+        "own_minutes",
+        "counted_minutes",
+        "carried_in",
+        "carry_out",
         "daily_minutes",
         "unlock_minutes",
         "ends",
         "replaces",
+        "unbacked_minutes",
+        "milestones",
+        "missed",
     }
 
 

focus_project/focus_project/tests/test_backing.py

@@ -0,0 +1,181 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""0.10.0: a timer span earns only if a same-project beat backs it."""
+
+from __future__ import annotations
+
+from datetime import date
+from typing import TYPE_CHECKING
+
+import focus_project as fp
+from focus_project import _api, minutes
+from focus_project.sources import activity
+from focus_project.tests import test_minutes as tm
+
+if TYPE_CHECKING:
+    import pytest
+
+DAY = date(2026, 11, 8)  # BACKING_FROM
+
+
+def at(hour: int, minute: int = 0) -> float:
+    return tm.at(hour, minute, day=DAY)
+
+
+def proj() -> None:
+    fp.create_project(
+        "hr",
+        name="HR prep",
+        start=DAY,
+        end=date(2026, 11, 12),
+        replaces=["leetcode"],
+        daily_minutes=120,
+        unlock_minutes=30,
+        site_patterns=["leetcode.com"],
+    )
+
+
+def rows(*items: tuple[str, str, float]) -> None:
+    tm.events(*items)
+
+
+def timer_only() -> None:
+    rows(
+        ("timer", "start", at(9)),
+        ("timer", "checkin", at(9, 5)),
+        ("timer", "stop", at(9, 10)),
+    )
+
+
+def test_timer_only_stretch_pays_zero_and_shows_unbacked() -> None:
+    proj()
+    timer_only()
+    assert minutes.minutes_for(DAY) == 0
+    assert minutes.unbacked_minutes_for(DAY) == 10
+    assert fp.status(DAY)["unbacked_minutes"] == 10
+
+
+def test_a_beat_in_the_span_backs_all_of_it() -> None:
+    proj()
+    timer_only()
+    rows(("sql_drills", "heartbeat", at(9, 5)))
+    assert minutes.unbacked_minutes_for(DAY) == 0
+    assert minutes.minutes_for(DAY) == 10
+
+
+def test_a_beat_backs_only_the_spans_it_touches() -> None:
+    proj()
+    timer_only()
+    rows(("sql_drills", "heartbeat", at(9, 7)))
+    # 9:00-9:05 stays unbacked, but the beat itself pays 9:02-9:07.
+    assert minutes.unbacked_minutes_for(DAY) == 2
+
+
+def test_a_beat_at_the_end_of_the_span_backs_it() -> None:
+    proj()
+    rows(
+        ("timer", "start", at(9)),
+        ("timer", "stop", at(9, 10)),
+        ("sql_drills", "heartbeat", at(9, 10)),
+    )
+    assert minutes.unbacked_minutes_for(DAY) == 0
+    assert minutes.minutes_for(DAY) == 10
+
+
+def test_a_beat_just_before_the_span_backs_it() -> None:
+    proj()
+    rows(
+        ("sql_drills", "heartbeat", at(8, 56)),  # within 300 s before 9:00
+        ("timer", "start", at(9)),
+        ("timer", "stop", at(9, 5)),
+    )
+    assert minutes.unbacked_minutes_for(DAY) == 0
+
+
+def test_a_late_beat_does_not_back_it() -> None:
+    proj()
+    timer_only()
+    rows(("sql_drills", "heartbeat", at(9, 40)))
+    assert minutes.unbacked_minutes_for(DAY) == 10
+
+
+def test_beats_up_to_twenty_minutes_apart_bridge_the_span() -> None:
+    proj()
+    rows(
+        ("tutor", "heartbeat", at(8, 50)),
+        ("timer", "start", at(9)),
+        ("timer", "checkin", at(9, 5)),
+        ("timer", "stop", at(9, 8)),
+        ("tutor", "heartbeat", at(9, 10)),
+    )
+    assert minutes.unbacked_minutes_for(DAY) == 0
+
+
+def test_beats_over_twenty_minutes_apart_do_not_bridge() -> None:
+    proj()
+    rows(
+        ("tutor", "heartbeat", at(8, 30)),
+        ("timer", "start", at(9)),
+        ("timer", "stop", at(9, 8)),
+        ("tutor", "heartbeat", at(9, 40)),
+    )
+    assert minutes.unbacked_minutes_for(DAY) == 8
+
+
+def test_browser_never_backs() -> None:
+    proj()
+    timer_only()
+    rows(("browser", "heartbeat", at(9, 7)))
+    # The beat pays its own 9:02-9:07 but backs no timer span.
+    assert minutes.unbacked_minutes_for(DAY) == 5
+    assert minutes.minutes_for(DAY) == 5
+
+
+def test_days_before_backing_from_keep_the_old_rule() -> None:
+    fp.create_project(
+        "hr",
+        name="Old",
+        start=date(2026, 11, 2),
+        end=date(2026, 11, 5),
+        replaces=["leetcode"],
+        daily_minutes=120,
+        unlock_minutes=30,
+        site_patterns=["leetcode.com"],
+    )
+    old = date(2026, 11, 2)
+    rows(("timer", "start", tm.at(9)), ("timer", "stop", tm.at(9, 10)))
+    assert minutes.minutes_for(old) == 10
+    assert minutes.unbacked_minutes_for(old) == 0
+
+
+def test_no_project_is_zero_unbacked() -> None:
+    assert minutes.unbacked_minutes_for(DAY) == 0
+    assert fp.status(DAY)["unbacked_minutes"] == 0
+
+
+def test_unbacked_is_clipped_at_now() -> None:
+    proj()
+    timer_only()
+    assert minutes.unbacked_minutes_for(DAY, now=at(9, 4)) == 4
+
+
+def test_split_timer_returns_backed_and_unbacked() -> None:
+    proj()
+    timer_only()
+    project = _api.active(DAY)
+    assert project is not None
+    backed, unbacked = activity.split_timer(DAY, project)
+    assert backed == []
+    assert unbacked == [(at(9), at(9, 5)), (at(9, 5), at(9, 10))]
+
+
+def test_backing_from_is_exported() -> None:
+    assert date(2026, 11, 8) == fp.BACKING_FROM
+    assert fp.unbacked_minutes_for is minutes.unbacked_minutes_for
+
+
+def test_registry_error_reads_zero(monkeypatch: pytest.MonkeyPatch) -> None:
+    def boom(_day: date) -> None:
+        raise OSError
+
+    monkeypatch.setattr("focus_project._api.active", boom)
+    assert minutes.unbacked_minutes_for(DAY) == 0

focus_project/focus_project/tests/test_backing_edges.py

@@ -0,0 +1,131 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""More 0.10.0 backing cases: sources, projects, the cutover midnight, chains.
+
+The core rule lives in ``test_backing.py``; these pin the edges the spec
+named (C5-C7) with leetcode-ledger and other-project fixtures.
+"""
+
+from __future__ import annotations
+
+from datetime import date
+import json
+from typing import TYPE_CHECKING
+
+import pytest
+
+import focus_project as fp
+from focus_project import minutes
+from focus_project._paths import activity_path
+from focus_project.tests.test_leetcode_source import ac_row, write
+from focus_project.tests.test_minutes import at
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+DAY = date(2026, 11, 9)  # after the cutover
+PRE = date(2026, 11, 7)  # before it
+
+
+@pytest.fixture(autouse=True)
+def _home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Nothing may fall back to the real home directory."""
+    monkeypatch.setenv("HOME", str(tmp_path / "home"))
+
+
+def make(pid: str = "hr", patterns: tuple[str, ...] = ("leetcode.com",)) -> None:
+    fp.create_project(
+        pid,
+        name=pid,
+        start=date(2026, 11, 6),
+        end=date(2026, 11, 12),
+        replaces=["leetcode"],
+        daily_minutes=240,
+        unlock_minutes=30,
+        site_patterns=list(patterns),
+    )
+
+
+def rows(*items: tuple[str, str, float] | tuple[str, str, float, str]) -> None:
+    """Append ``(source, kind, ts[, project])`` events (project default hr)."""
+    activity_path().parent.mkdir(parents=True, exist_ok=True)
+    with activity_path().open("a", encoding="utf-8") as handle:
+        for item in items:
+            source, kind, ts = item[:3]
+            pid = item[3] if len(item) == 4 else "hr"
+            row = {"ts": ts, "source": source, "kind": kind, "project": pid}
+            handle.write(json.dumps(row) + "\n")
+
+
+def timer(day: date, *marks: tuple[int, int]) -> None:
+    """A segment: start at the first mark, check-ins, stop at the last."""
+    kinds = ["start", *["checkin"] * (len(marks) - 2), "stop"]
+    rows(
+        *(
+            ("timer", k, at(h, m, day=day))
+            for k, (h, m) in zip(kinds, marks, strict=True)
+        )
+    )
+
+
+def beat(source: str, h: int, m: int, day: date = DAY, pid: str = "hr") -> None:
+    rows((source, "heartbeat", at(h, m, day=day), pid))
+
+
+@pytest.mark.parametrize("source", ["sql_drills", "leetcode"])
+def test_sql_drills_and_leetcode_heartbeats_back_too(source: str) -> None:
+    make()
+    timer(DAY, (9, 0), (9, 5), (9, 10))
+    beat(source, 9, 5)
+    assert minutes.minutes_for(DAY) == 10
+
+
+def test_browser_and_other_project_beats_do_not_back() -> None:
+    make()  # "other" needs no registry entry: rows are filtered by id
+    timer(DAY, (9, 0), (9, 5), (9, 10))
+    beat("browser", 9, 4)
+    beat("tutor", 9, 4, pid="other")
+    assert minutes.minutes_for(DAY) == 5  # the browser beat's own window only
+    assert minutes.unbacked_minutes_for(DAY) == 6  # 9:04-9:10
+
+
+def test_accepted_submission_backs_a_leetcode_project(tmp_path: Path) -> None:
+    make()
+    timer(DAY, (9, 0), (9, 5), (9, 10))
+    write(tmp_path, ac_row(at(9, 4, day=DAY)))
+    assert minutes.minutes_for(DAY) == 11  # 8:59-9:10
+
+
+def test_submission_does_not_back_a_non_leetcode_project(tmp_path: Path) -> None:
+    make("hr", ("sqlzoo.net",))
+    timer(DAY, (9, 0), (9, 5), (9, 10))
+    write(tmp_path, ac_row(at(9, 4, day=DAY)))
+    assert minutes.minutes_for(DAY) == 0
+
+
+def test_span_across_the_cutover_midnight_follows_the_day() -> None:
+    make()
+    rows(
+        ("timer", "start", at(23, 58, day=date(2026, 11, 7))),
+        ("timer", "checkin", at(0, 3, day=date(2026, 11, 8))),
+        ("timer", "stop", at(0, 5, day=date(2026, 11, 8))),
+    )
+    assert minutes.minutes_for(date(2026, 11, 7)) == 2
+    assert minutes.minutes_for(date(2026, 11, 8)) == 0
+    assert minutes.unbacked_minutes_for(date(2026, 11, 8)) == 5
+
+
+def test_tutor_chained_span_is_backed_but_earlier_reading_is_not() -> None:
+    """A tutor beat chains the segment (0.8.0) and backs the span it ends.
+
+    start 9:00, checkin 9:08, tutor beat 9:16: the span 9:08-9:16 ends at a
+    backing beat and earns; 9:00-9:08 has no beat in or 5 min before it and
+    nothing bridges it, so it shows as unbacked.
+    """
+    make()
+    rows(
+        ("timer", "start", at(9, 0, day=DAY)),
+        ("timer", "checkin", at(9, 8, day=DAY)),
+    )
+    beat("tutor", 9, 16)
+    assert minutes.minutes_for(DAY) == 8
+    assert minutes.unbacked_minutes_for(DAY) == 8

focus_project/focus_project/tests/test_carry.py

@@ -0,0 +1,183 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Overtime carries over: own minutes, the bank, pay and the carry ledger rows."""
+
+from __future__ import annotations
+
+from datetime import date, timedelta
+import json
+from pathlib import Path  # noqa: TC003
+from typing import Any
+
+import earned_time
+import pytest
+
+import focus_project as fp
+from focus_project import carry, harvest, ledger, minutes
+from focus_project.tests.test_minutes import D1, at, events, project
+
+KEY = b"k" * 32
+D2 = D1 + timedelta(days=1)
+D3 = D2 + timedelta(days=1)
+D4 = D3 + timedelta(days=1)  # the last day of project()
+D5 = D4 + timedelta(days=1)  # after the end
+
+
+@pytest.fixture(autouse=True)
+def _key(tmp_path: Path) -> None:
+    (tmp_path / "hmac.key").write_bytes(KEY)
+
+
+def work(day: date, mins: int) -> None:
+    """``mins`` focused minutes on ``day``: tutor heartbeats every five minutes."""
+    events(
+        *(
+            ("tutor", "heartbeat", at(8, 0, day=day) + 300 * k)
+            for k in range(1, mins // 5 + 1)
+        )
+    )
+
+
+def rows() -> list[dict[str, Any]]:
+    out: list[dict[str, Any]] = json.loads(ledger.ledger_path().read_text())["entries"]
+    return out
+
+
+def test_own_minutes_are_not_capped_but_pay_is() -> None:
+    project()
+    work(D1, 125)
+    assert carry.own_minutes(D1) == 125
+    assert minutes.minutes_for(D1) == 120
+
+
+def test_overtime_banks_into_the_next_day() -> None:
+    project()
+    work(D1, 125)
+    assert carry.balance(D1) == carry.Balance(own=125, carried_in=0, carry_out=5)
+    assert carry.balance(D2) == carry.Balance(own=0, carried_in=5, carry_out=0)
+    assert minutes.minutes_for(D2) == 5
+
+
+def test_carry_adds_to_own_minutes_on_the_next_day() -> None:
+    project()
+    work(D1, 125)
+    work(D2, 100)
+    assert minutes.minutes_for(D2) == 105
+    assert carry.balance(D2).carry_out == 0
+
+
+def test_the_bank_is_capped_at_sixty() -> None:
+    project()
+    work(D1, 200)
+    assert carry.balance(D1).carry_out == carry.BANK_CAP == 60
+
+
+def test_overtime_chains_over_days() -> None:
+    project()
+    work(D1, 130)
+    work(D2, 125)
+    assert carry.balance(D2) == carry.Balance(own=125, carried_in=10, carry_out=15)
+    assert minutes.minutes_for(D3) == 15
+
+
+def test_the_bank_never_crosses_the_project_end() -> None:
+    project()
+    work(D4, 150)
+    assert carry.balance(D4).carry_out == 30
+    assert minutes.minutes_for(D5) == 0
+    assert carry.balance(D5) == carry.Balance(0, 0, 0)
+
+
+def test_the_first_day_has_nothing_banked_in() -> None:
+    project()
+    assert carry.balance(D1 - timedelta(days=1)).carried_in == 0
+    assert carry.balance(D1).carried_in == 0
+
+
+def test_a_past_target_is_used_for_a_past_day() -> None:
+    project()
+    work(D1, 125)
+    fp.update_project("hr", today=D2, daily_minutes=100, unlock_minutes=30)
+    assert carry.balance(D1).carry_out == 5  # D1 still judged at 120
+    assert carry.balance(D2).carried_in == 5
+
+
+def test_status_reports_real_minutes_and_the_bank() -> None:
+    project()
+    work(D1, 125)
+    shown = fp.status(D1)
+    assert shown["minutes"] == 125
+    assert shown["own_minutes"] == 125
+    assert shown["counted_minutes"] == 120
+    assert (shown["carried_in"], shown["carry_out"]) == (0, 5)
+    nxt = fp.status(D2)
+    assert (nxt["minutes"], nxt["carried_in"]) == (5, 5)
+
+
+def test_status_without_a_project_has_zero_bank() -> None:
+    shown = fp.status(D1)
+    assert (shown["own_minutes"], shown["carried_in"], shown["carry_out"]) == (0, 0, 0)
+
+
+def test_unreadable_registry_banks_nothing(data: Path) -> None:
+    data.mkdir(parents=True)
+    (data / "projects.json").write_text("{")
+    assert carry.balance(D2) == carry.Balance(0, 0, 0)
+    assert carry.own_minutes(D2) == 0
+
+
+def test_harvest_pays_own_rows_then_one_carry_row() -> None:
+    project()
+    work(D1, 125)
+    work(D2, 100)
+    harvest.harvest(now=at(23, 0, day=D2))
+    got = {r["entry_id"]: r for r in rows()}
+    assert got["hr-20261102-m120"]["detail"]["minutes"] == 120
+    assert got["hr-20261103-carry"]["detail"]["minutes"] == 5
+    assert got["hr-20261103-carry"]["detail"]["carry"] is True
+    assert got["hr-20261103-m100"]["detail"]["minutes"] == 100
+    assert all(earned_time.verified(r, KEY) for r in got.values())
+    assert ledger.paid_minutes(rows(), KEY, "hr", D2) == 105
+
+
+def test_pay_never_exceeds_the_daily_target() -> None:
+    project()
+    work(D1, 125)
+    work(D2, 130)
+    harvest.harvest(now=at(23, 0, day=D2))
+    assert ledger.paid_minutes(rows(), KEY, "hr", D2) == 120
+    assert minutes.minutes_for(D2) == 120
+
+
+def test_carry_is_paid_at_the_start_of_the_day_and_not_again() -> None:
+    project()
+    work(D1, 125)
+    harvest.harvest(now=at(0, 5, day=D2))
+    before = rows()
+    assert [r["entry_id"] for r in before if r["day"] == "2026-11-03"] == [
+        "hr-20261103-carry"
+    ]
+    harvest.harvest(now=at(0, 6, day=D2))
+    assert rows() == before
+
+
+def test_late_data_for_yesterday_pays_only_the_carry_delta() -> None:
+    project()
+    work(D1, 125)
+    harvest.harvest(now=at(9, 0, day=D2))
+    work(D1, 130)  # a late phone sync: five more minutes
+    harvest.harvest(now=at(9, 5, day=D2))
+    paid = [r for r in rows() if r["detail"].get("carry")]
+    assert [r["entry_id"] for r in paid] == [
+        "hr-20261103-carry",
+        "hr-20261103-carry-m10",
+    ]
+    assert ledger.paid_minutes(rows(), KEY, "hr", D2) == 10
+
+
+def test_own_rows_leave_room_for_the_carry() -> None:
+    project()
+    work(D1, 125)
+    work(D2, 120)
+    harvest.harvest(now=at(23, 0, day=D2))
+    assert ledger.paid_minutes(rows(), KEY, "hr", D2) == 120
+    assert "hr-20261103-m115" in {r["entry_id"] for r in rows()}

focus_project/focus_project/tests/test_checks.py

@@ -0,0 +1,193 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Pluggable check sources, the phone source, and latching."""
+
+from __future__ import annotations
+
+import json
+from typing import TYPE_CHECKING
+
+import pytest
+
+import focus_project as fp
+from focus_project import _paths, checks, evidence
+from focus_project.tests.helpers import SAT1, at, make
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+    from datetime import datetime
+
+MID = "phone:2026-11-14"
+
+
+def _ms(moment: datetime) -> int:
+    return int(moment.timestamp() * 1000)
+
+
+def _report(
+    moment: datetime,
+    *,
+    plan: bool = True,
+    due: int = 5,
+    seen: datetime | None = None,
+) -> None:
+    value = {"plan": plan, "due": due, "seen_ms": _ms(seen or moment)}
+    fp.record_evidence("iv", "phone", "phone_check", value, now=moment)
+
+
+def _phone(now: datetime) -> bool | None:
+    return checks.phone_source(fp.list_projects()[0], now)
+
+
+def test_phone_source_without_a_report_is_unknown(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    make()
+    with caplog.at_level("WARNING"):
+        assert _phone(at(13, 9)) is None
+    assert "phone" in caplog.text
+
+
+def test_phone_source_passes_on_a_fresh_good_report() -> None:
+    make()
+    _report(at(13, 8), seen=at(12, 20))
+    assert _phone(at(13, 9)) is True
+
+
+@pytest.mark.parametrize(
+    "bad",
+    [{"plan": False}, {"due": 0}, {"seen": at(11, 7)}],
+)
+def test_phone_source_fails_on_any_bad_part(bad: dict[str, object]) -> None:
+    make()
+    _report(at(13, 8), **bad)  # type: ignore[arg-type]
+    assert _phone(at(13, 9)) is False
+
+
+def test_phone_source_stale_or_future_report_is_unknown() -> None:
+    make()
+    _report(at(13, 8))
+    assert _phone(at(14, 8, 1)) is None  # the worker stopped reporting
+    assert _phone(at(13, 7)) is None  # stamped ahead of the clock
+
+
+def test_phone_source_uses_the_latest_report() -> None:
+    make()
+    _report(at(13, 8), plan=False)
+    _report(at(13, 9))
+    assert _phone(at(13, 10)) is True
+
+
+def test_phone_source_hand_edited_row_is_a_failure() -> None:
+    make()
+    _report(at(13, 8))
+    path = _paths.evidence_path("iv")
+    row = {"ms": _ms(at(13, 9)), "milestone": "phone", "kind": "phone_check"}
+    path.write_text(path.read_text() + json.dumps({**row, "value": "ok"}) + "\n")
+    assert _phone(at(13, 10)) is False
+
+
+def _patch(
+    monkeypatch: pytest.MonkeyPatch, fn: Callable[[fp.Project, datetime], bool | None]
+) -> None:
+    monkeypatch.setitem(checks.SOURCES, "phone", fn)
+
+
+def _trip_project() -> None:
+    make()
+    fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 9))
+
+
+def test_run_checks_latches_a_pass(monkeypatch: pytest.MonkeyPatch) -> None:
+    _trip_project()
+    _patch(monkeypatch, lambda p, n: True)
+    assert fp.run_checks("iv", now=at(13, 9)) == {MID: True}
+    assert fp.run_checks("iv", now=at(13, 10)) == {MID: True}
+    rows = [r for r in evidence.read("iv") if r.kind == "check"]
+    assert [(r.milestone, r.value) for r in rows] == [(MID, True)]
+
+
+def test_run_checks_only_inside_the_window(monkeypatch: pytest.MonkeyPatch) -> None:
+    _trip_project()
+    _patch(monkeypatch, lambda p, n: True)
+    assert fp.run_checks("iv", now=at(12, 11, 59)) == {}  # >24 h before due
+    assert fp.run_checks("iv", now=at(12, 12)) == {MID: True}
+
+
+def test_run_checks_records_changes_not_every_tick(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _trip_project()
+    answers: list[bool | None] = [None, False, False, None, None]
+    _patch(monkeypatch, lambda p, n: answers.pop(0))
+    for minute in range(5):
+        fp.run_checks("iv", now=at(13, 9, minute))
+    rows = [r.value for r in evidence.read("iv") if r.kind == "check"]
+    assert rows == [False, None]  # leading None writes nothing
+
+
+def test_run_checks_source_crash_is_unknown_and_loud(
+    monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+) -> None:
+    _trip_project()
+
+    def boom(p: fp.Project, n: datetime) -> bool:
+        msg = "tutor down"
+        raise OSError(msg)
+
+    _patch(monkeypatch, boom)
+    with caplog.at_level("WARNING"):
+        assert fp.run_checks("iv", now=at(13, 9)) == {MID: None}
+    assert "tutor down" in caplog.text
+
+
+def test_run_checks_skips_finished_milestones(monkeypatch: pytest.MonkeyPatch) -> None:
+    _trip_project()
+    fp.record_evidence("iv", MID, "tap", value=True, now=at(12, 9))
+    evidence.append("iv", MID, "check", True, at(12, 10))
+    _patch(monkeypatch, lambda p, n: pytest.fail("already done"))
+    assert fp.run_checks("iv", now=at(13, 9)) == {}
+
+
+def test_run_checks_ignores_focus_projects() -> None:
+    fp.create_project(
+        "f",
+        name="F",
+        start=at(10).date(),
+        end=at(12).date(),
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    assert fp.run_checks("f", now=at(11, 9)) == {}
+    with pytest.raises(KeyError):
+        fp.run_checks("ghost", now=at(11, 9))
+
+
+def test_register_source_swaps_the_callable(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(checks, "SOURCES", dict(checks.SOURCES))
+
+    def fn(p: fp.Project, n: datetime) -> bool:
+        return True
+
+    fp.register_source("phone", fn)
+    assert checks.SOURCES["phone"] is fn
+    with pytest.raises(ValueError, match="source"):
+        fp.register_source("calendar", fn)
+
+
+def test_end_to_end_phone_milestone_goes_done() -> None:
+    _trip_project()
+    fp.record_evidence("iv", MID, "tap", value=True, now=at(12, 9))
+    _report(at(13, 9))
+    assert fp.run_checks("iv", now=at(13, 9, 30)) == {MID: True}
+    state = {m.id: m.state for m in fp.milestones(fp.list_projects()[0], at(13, 10))}
+    assert state[MID] == "done"
+
+
+def test_report_missing_a_field_fails() -> None:
+    make()
+    path = _paths.evidence_path("iv")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    row = {"ms": _ms(at(13, 8)), "milestone": "phone", "kind": "phone_check"}
+    path.write_text(json.dumps({**row, "value": {"plan": True}}) + "\n")
+    assert _phone(at(13, 9)) is False

focus_project/focus_project/tests/test_evidence.py

@@ -0,0 +1,126 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""The append-only evidence store and record_evidence validation."""
+
+from __future__ import annotations
+
+import json
+from typing import TYPE_CHECKING
+
+import pytest
+
+import focus_project as fp
+from focus_project import _paths, evidence
+from focus_project.tests.helpers import at, make, shot
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+def test_paths_are_isolated(tmp_path: Path) -> None:
+    assert _paths.evidence_dir().is_relative_to(tmp_path)
+    assert _paths.evidence_path("iv").name == "iv.jsonl"
+    assert _paths.evidence_files_dir("iv").name == "iv"
+
+
+def test_file_is_copied_and_row_appended(tmp_path: Path) -> None:
+    make()
+    src = shot(tmp_path)
+    row = fp.record_evidence("iv", "rules", "file", file=src, now=at(10, 9))
+    assert row.kind == "file"
+    stored = _paths.evidence_files_dir("iv") / str(row.value)
+    assert stored.read_bytes() == src.read_bytes()
+    line = json.loads(_paths.evidence_path("iv").read_text().splitlines()[0])
+    assert set(line) == {"ms", "milestone", "kind", "value"}
+    assert line["milestone"] == "rules"
+
+
+def test_rows_append_never_rewrite() -> None:
+    make()
+    fp.record_evidence("iv", "mock", "score", 71, now=at(24, 9))
+    fp.record_evidence("iv", "mock", "score", 80.5, now=at(24, 10))
+    assert [r.value for r in evidence.read("iv")] == [71, 80.5]
+    assert not hasattr(fp, "delete_evidence")
+    assert not hasattr(evidence, "delete")
+
+
+def test_same_name_files_do_not_overwrite(tmp_path: Path) -> None:
+    make()
+    one = fp.record_evidence("iv", "rules", "file", file=shot(tmp_path), now=at(10, 9))
+    two = fp.record_evidence("iv", "rules", "file", file=shot(tmp_path), now=at(10, 9))
+    assert one.value != two.value
+
+
+@pytest.mark.parametrize(
+    ("milestone", "kind", "value"),
+    [
+        ("rules", "tap", True),  # wrong kind for the milestone
+        ("rules", "check", True),  # internal kind
+        ("trip_ask:2026-11-14", "answer", True),  # use answer_weekend
+        ("nope", "tap", True),  # not a milestone of the project
+        ("mock", "score", "high"),
+        ("mock", "score", True),
+        ("mock", "score", float("nan")),
+        ("mock", "score", -1),
+        ("slot", "slot", "tomorrow"),
+        ("slot", "slot", "2026-11-26T10:00:00+02:00"),  # aware
+        ("slot", "slot_confirm", False),
+        ("phone", "phone_check", {"plan": True}),
+        ("phone", "phone_check", {"plan": "yes", "due": 1, "seen_ms": 1}),
+        ("phone", "phone_check", "ok"),
+    ],
+)
+def test_bad_evidence_refused(milestone: str, kind: str, value: object) -> None:
+    make()
+    with pytest.raises(ValueError):  # noqa: PT011
+        fp.record_evidence("iv", milestone, kind, value, now=at(12, 9))
+
+
+def test_file_kind_needs_a_real_nonempty_file(tmp_path: Path) -> None:
+    make()
+    empty = tmp_path / "e.png"
+    empty.write_bytes(b"")
+    for bad in (None, tmp_path / "missing.png", empty, tmp_path):
+        with pytest.raises(ValueError, match="file"):
+            fp.record_evidence("iv", "rules", "file", file=bad, now=at(10, 9))
+
+
+def test_unknown_project_is_keyerror() -> None:
+    with pytest.raises(KeyError):
+        fp.record_evidence("ghost", "mock", "score", 1, now=at(24, 9))
+
+
+def test_focus_project_has_no_milestones() -> None:
+    fp.create_project(
+        "f",
+        name="F",
+        start=at(10).date(),
+        end=at(12).date(),
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    with pytest.raises(ValueError, match="milestone"):
+        fp.record_evidence("f", "mock", "score", 1, now=at(10, 9))
+
+
+def test_torn_and_foreign_lines_are_skipped(caplog: pytest.LogCaptureFixture) -> None:
+    make()
+    fp.record_evidence("iv", "mock", "score", 70, now=at(24, 9))
+    path = _paths.evidence_path("iv")
+    path.write_text(path.read_text() + '{"ms": 1, "milest\n[1]\n{"ms":"x"}\n')
+    with caplog.at_level("WARNING"):
+        rows = evidence.read("iv")
+    assert [r.value for r in rows] == [70]
+    assert "skipping" in caplog.text
+
+
+def test_missing_file_reads_empty() -> None:
+    assert evidence.read("nobody") == []
+
+
+def test_garbage_bytes_are_skipped_not_fatal() -> None:
+    make()
+    fp.record_evidence("iv", "mock", "score", 70, now=at(24, 9))
+    path = _paths.evidence_path("iv")
+    path.write_bytes(path.read_bytes() + b"\xff\xfe\x80 not utf-8\n")
+    assert [r.value for r in evidence.read("iv")] == [70]

focus_project/focus_project/tests/test_interview_model.py

@@ -0,0 +1,175 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Project.kind, interview fields, validation, budget."""
+
+from __future__ import annotations
+
+from datetime import date
+import json
+from typing import TYPE_CHECKING
+
+import pytest
+
+import focus_project as fp
+from focus_project import _interview, _milestones
+from focus_project._errors import RegistryError
+from focus_project.tests.helpers import SAT1, START, TEST_AT, TEST_DAY, at, make
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+LIVE_ROW = {
+    "id": "hackerrank-prep",
+    "name": "HackerRank prep",
+    "start": "2026-11-02",
+    "end": "2026-11-05",
+    "replaces": ["leetcode", "reading", "tutor"],
+    "daily_minutes": 120,
+    "unlock_minutes": 30,
+    "subjects": ["a"],
+    "site_patterns": ["leetcode.com"],
+    "ended_on": None,
+    "created_ms": 1793603609345,
+    "work_url": "https://www.hackerrank.com/dashboard",
+    "history": [],
+}
+
+
+def test_live_projects_json_shape_loads(data: Path) -> None:
+    data.mkdir()
+    (data / "projects.json").write_text(json.dumps({"projects": [LIVE_ROW]}))
+    [p] = fp.list_projects()
+    assert p.kind == "focus"
+    assert p.test_at is None
+    assert p.trips == ()
+    assert p.weekend_answers == ()
+    assert p.daily_on(date(2026, 11, 3)) == 120
+    snap = fp.status(date(2026, 11, 3))
+    assert snap["milestones"] == []
+    assert snap["missed"] is False
+
+
+def test_focus_row_stays_free_of_interview_keys(data: Path) -> None:
+    fp.create_project(
+        "f",
+        name="F",
+        start=START,
+        end=TEST_DAY,
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    row = json.loads((data / "projects.json").read_text())["projects"][0]
+    assert row["kind"] == "focus"
+    assert not {"test_at", "invite_url", "trips", "weekend_answers"} & set(row)
+
+
+def test_interview_roundtrip_and_file_shape(data: Path) -> None:
+    p = make(
+        trips=[fp.Trip(date(2026, 11, 20), date(2026, 11, 22))],
+        weekend_answers={SAT1: False},
+    )
+    [back] = fp.list_projects()
+    assert back == p
+    assert back.kind == "interview"
+    assert back.test_at == TEST_AT
+    assert back.trips[0].entered_ms > 0
+    row = json.loads((data / "projects.json").read_text())["projects"][0]
+    assert row["test_at"] == "2026-11-27T10:00:00"
+    assert row["trips"][0]["start"] == "2026-11-20"
+    assert row["weekend_answers"] == {"2026-11-14": False}
+    assert row["invite_url"].startswith("https://")
+
+
+@pytest.mark.parametrize(
+    "bad",
+    [
+        {"test_at": None},
+        {"test_at": at(26, 10)},  # end != test day
+        {"test_at": at(9, 10), "end": date(2026, 11, 9)},
+        {"invite_url": "ftp://x.example/t"},
+        {"invite_url": "javascript:alert(1)"},
+        {"invite_url": "https://a b.example"},
+        {"kind": "bogus"},
+        {"trips": [fp.Trip(date(2026, 11, 28), date(2026, 11, 29))]},
+        {"trips": [fp.Trip(date(2026, 11, 20), date(2026, 11, 19))]},
+        {"weekend_answers": {date(2026, 11, 15): True}},  # a Sunday
+        {"weekend_answers": {date(2026, 11, 28): True}},  # after T
+        {"daily_minutes": 29},
+    ],
+)
+def test_interview_validation(bad: dict[str, object]) -> None:
+    with pytest.raises(ValueError):  # noqa: PT011
+        make(**bad)
+
+
+def test_focus_kind_rejects_interview_fields() -> None:
+    with pytest.raises(ValueError, match="interview"):
+        make(kind="focus")
+
+
+def test_empty_invite_url_is_allowed() -> None:
+    assert make(invite_url="").invite_url == ""
+
+
+def test_budget_30_weekdays_120_weekend() -> None:
+    p = make(unlock_minutes=60)
+    assert p.daily_on(date(2026, 11, 10)) == 30  # Tue
+    assert p.daily_on(date(2026, 11, 13)) == 30  # Fri
+    assert p.daily_on(SAT1) == 120
+    assert p.daily_on(date(2026, 11, 15)) == 120  # Sun
+    assert p.unlock_on(date(2026, 11, 10)) == 30  # clamped to the day's target
+    assert p.unlock_on(SAT1) == 60
+
+
+def test_budget_flows_through_status() -> None:
+    make()
+    assert fp.status(date(2026, 11, 10))["daily_minutes"] == 30
+    assert fp.status(SAT1)["daily_minutes"] == 120
+
+
+def test_interview_exempt_from_floor_but_focus_is_not() -> None:
+    make(daily_minutes=30, unlock_minutes=30)  # 3 gates, floor 90
+    with pytest.raises(ValueError, match="at least"):
+        fp.create_project(
+            "f",
+            name="F",
+            start=date(2026, 12, 1),
+            end=date(2026, 12, 2),
+            replaces=["leetcode", "reading"],
+            daily_minutes=30,
+            unlock_minutes=10,
+        )
+
+
+def test_non_interview_has_no_weekends() -> None:
+    focus = fp.create_project(
+        "f",
+        name="F",
+        start=START,
+        end=TEST_DAY,
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    assert _interview.saturdays(focus) == []
+
+
+def test_trip_without_entry_time_uses_the_nominal_due() -> None:
+    assert _milestones._trip_due(date(2026, 11, 13), 0) == at(12, 12)
+
+
+def test_non_boolean_weekend_answer_is_a_bad_row(data: Path) -> None:
+    make()
+    path = data / "projects.json"
+    rows = json.loads(path.read_text())
+    rows["projects"][0]["weekend_answers"] = {"2026-11-14": "false"}
+    path.write_text(json.dumps(rows))
+    with pytest.raises(RegistryError):
+        fp.list_projects()
+
+
+def test_interview_unlock_edit_keeps_the_ratchet() -> None:
+    make(unlock_minutes=60)
+    fp.update_project("iv", today=SAT1, unlock_minutes=10)
+    assert fp.list_projects()[0].unlock_on(SAT1) == 60  # lower holds from tomorrow
+    assert fp.list_projects()[0].unlock_on(date(2026, 11, 15)) == 10

focus_project/focus_project/tests/test_leetcode_source.py

@@ -14,6 +14,8 @@ import pytest
 import focus_project as fp
 from focus_project import minutes, sources
 from focus_project.sources import leetcode
+from focus_project.tests.test_backing import DAY, proj, rows
+from focus_project.tests.test_backing import at as day_at
 from focus_project.tests.test_minutes import D1, at, project
 
 KEY = b"k" * 32
@@ -127,3 +129,29 @@ def test_read_only_replay_of_real_ledger(monkeypatch: pytest.MonkeyPatch) -> Non
     assert got
     assert all(b - a == sources.HEARTBEAT_WINDOW_S for a, b in got)
     assert REAL.stat().st_mtime_ns == before
+
+
+def test_accepted_submission_backs_a_timer_span(tmp_path: Path) -> None:
+    """0.10.0: an accepted submission backs timer time on a backed day."""
+    proj()
+    rows(("timer", "start", day_at(9)), ("timer", "stop", day_at(9, 10)))
+    assert minutes.unbacked_minutes_for(DAY) == 10
+    write(tmp_path, ac_row(day_at(9, 10)))
+    assert minutes.unbacked_minutes_for(DAY) == 0
+    assert minutes.minutes_for(DAY) == 10
+
+
+def test_unreadable_ledger_leaves_heartbeat_backing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def boom(_project: object) -> list[float]:
+        raise OSError
+
+    monkeypatch.setattr(leetcode, "submission_times", boom)
+    proj()
+    rows(
+        ("timer", "start", day_at(9)),
+        ("timer", "stop", day_at(9, 10)),
+        ("tutor", "heartbeat", day_at(9, 10)),
+    )
+    assert minutes.unbacked_minutes_for(DAY) == 0

focus_project/focus_project/tests/test_milestones.py

@@ -0,0 +1,228 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Milestone generation, states and the lock that falls out of them."""
+
+from __future__ import annotations
+
+from datetime import date
+from typing import TYPE_CHECKING
+
+import focus_project as fp
+from focus_project import evidence
+from focus_project.tests.helpers import SAT1, SAT2, at, make, session, shot, states
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    import pytest
+
+
+def _due(p: fp.Project, now_day: int = 10) -> dict[str, str]:
+    return {m.id: m.due.isoformat() for m in fp.milestones(p, at(now_day, 8))}
+
+
+def test_table_of_dues() -> None:
+    assert _due(make()) == {
+        "rules": "2026-11-10T23:59:00",
+        "trip_ask:2026-11-14": "2026-11-12T23:59:00",
+        "trip_ask:2026-11-21": "2026-11-19T23:59:00",
+        "mock": "2026-11-25T23:59:00",
+        "slot": "2026-11-26T12:00:00",
+    }
+
+
+def test_sorted_by_due_and_all_pending_at_start() -> None:
+    project = make()
+    items = fp.milestones(project, at(10, 8))
+    assert [m.due for m in items] == sorted(m.due for m in items)
+    assert {m.state for m in items} == {"pending"}
+    assert items[0].to_dict() == {
+        "id": "rules",
+        "due": "2026-11-10T23:59:00",
+        "state": "pending",
+    }
+
+
+def test_focus_project_has_none() -> None:
+    p = fp.create_project(
+        "f",
+        name="F",
+        start=date(2026, 11, 10),
+        end=date(2026, 11, 12),
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    assert fp.milestones(p, at(11, 8)) == []
+
+
+def test_unanswered_weekend_is_a_trip_once_ask_is_due() -> None:
+    p = make()
+    assert "phone:2026-11-14" not in states(p, at(12, 23, 58))
+    got = states(p, at(13, 8))
+    assert got["trip_ask:2026-11-14"] == "missed"
+    assert got["phone:2026-11-14"] == "pending"  # due Fri 12:00
+    assert states(p, at(13, 12))["phone:2026-11-14"] == "missed"
+    assert _due(p, 13)["phone:2026-11-14"] == "2026-11-13T12:00:00"
+
+
+def test_answers_decide_the_phone_milestone() -> None:
+    make()
+    no = fp.answer_weekend("iv", SAT1, trip=False, now=at(11, 9))
+    assert "phone:2026-11-14" not in states(no, at(13, 13))
+    assert states(no, at(13, 13))["trip_ask:2026-11-14"] == "done"
+    yes = fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 10))
+    assert states(yes, at(11, 11))["phone:2026-11-14"] == "pending"
+
+
+def test_explicit_trip_covers_its_saturday() -> None:
+    make()
+    p = fp.add_trip("iv", date(2026, 11, 13), date(2026, 11, 15), now=at(10, 9))
+    got = states(p, at(13, 8))
+    assert "phone:2026-11-13" in got
+    assert "phone:2026-11-14" not in got
+    assert _due(p)["phone:2026-11-13"] == "2026-11-12T12:00:00"
+
+
+def test_late_trip_is_due_the_moment_it_is_entered() -> None:
+    make()
+    p = fp.add_trip("iv", date(2026, 11, 13), date(2026, 11, 14), now=at(12, 8))
+    assert _due(p, 12)["phone:2026-11-13"] == "2026-11-12T08:00:00"
+    assert states(p, at(12, 8))["phone:2026-11-13"] == "missed"
+    far = fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 22), now=at(12, 9))
+    assert _due(far, 12)["phone:2026-11-20"] == "2026-11-19T12:00:00"
+
+
+def _clean(tmp_path: Path) -> None:
+    """Everything due before the slot is done on time; weekend 2 is no trip."""
+    fp.record_evidence("iv", "rules", "file", file=shot(tmp_path), now=at(10, 9))
+    fp.answer_weekend("iv", SAT1, trip=False, now=at(11, 9))
+    fp.answer_weekend("iv", SAT2, trip=False, now=at(11, 9))
+    session(at(24, 7), 90)
+    fp.record_evidence("iv", "mock", "score", 70, now=at(24, 9))
+
+
+def test_slot_is_due_t_minus_1_at_noon_and_locks_that_evening(tmp_path: Path) -> None:
+    make()
+    _clean(tmp_path)
+    assert fp.owed_lock(at(26, 11, 59)) is None
+    owed = fp.owed_lock(at(26, 12))
+    assert owed is not None
+    assert owed.id == "slot"
+    assert owed.state == "missed"
+    assert fp.owed_lock(at(26, 20)) is not None
+
+
+def test_test_day_never_locks_but_shows_red(tmp_path: Path) -> None:
+    make()
+    assert fp.owed_lock(at(27, 9)) is None
+    assert fp.status(date(2026, 11, 27))["milestones"] is not None
+    assert {m.state for m in fp.milestones(fp.list_projects()[0], at(27, 9))} >= {
+        "missed"
+    }
+
+
+def test_owed_lock_is_the_earliest_missed() -> None:
+    make()
+    owed = fp.owed_lock(at(13, 8))
+    assert owed is not None
+    assert owed.id == "rules"
+
+
+def test_late_completion_unlocks(tmp_path: Path) -> None:
+    make()
+    fp.answer_weekend("iv", SAT1, trip=False, now=at(11, 9))
+    owed = fp.owed_lock(at(11, 10))
+    assert owed is not None
+    assert owed.id == "rules"
+    fp.record_evidence("iv", "rules", "file", file=shot(tmp_path), now=at(11, 10))
+    p = fp.list_projects()[0]
+    assert states(p, at(11, 10))["rules"] == "late_done"
+    assert fp.owed_lock(at(11, 10, 1)) is None
+
+
+def test_on_time_is_done_at_the_boundary(tmp_path: Path) -> None:
+    make()
+    fp.record_evidence("iv", "rules", "file", file=shot(tmp_path), now=at(10, 23, 58))
+    p = fp.list_projects()[0]
+    assert states(p, at(11, 8))["rules"] == "done"
+    assert states(p, at(10, 23, 59))["rules"] == "done"
+
+
+def test_slot_needs_entry_and_confirm_tap() -> None:
+    p = make()
+    fp.record_evidence("iv", "slot", "slot", "2026-11-26T20:00:00", now=at(25, 9))
+    assert states(p, at(25, 10))["slot"] == "pending"
+    assert states(p, at(26, 12))["slot"] == "missed"  # entered, never confirmed
+    fp.record_evidence("iv", "slot", "slot_confirm", value=True, now=at(25, 11))
+    assert states(p, at(25, 12))["slot"] == "done"
+    fp.record_evidence("iv", "slot", "slot", "2026-11-26T21:00:00", now=at(25, 13))
+    assert states(p, at(25, 14))["slot"] == "pending"  # moved: confirm again
+    fp.record_evidence("iv", "slot", "slot_confirm", value=True, now=at(26, 13))
+    assert states(p, at(26, 14))["slot"] == "late_done"
+    assert not [s for s in states(p, at(26, 14)).values() if s == "unknown"]
+
+
+def _phone_setup() -> None:
+    make()
+    fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 9))
+
+
+def test_phone_milestone_states() -> None:
+    _phone_setup()
+    p = fp.list_projects()[0]
+    mid = "phone:2026-11-14"
+    assert states(p, at(13, 13))[mid] == "missed"  # no tap, no check
+    fp.record_evidence("iv", mid, "tap", value=True, now=at(12, 9))
+    assert states(p, at(13, 13))[mid] == "unknown"  # tap but nothing checked
+    evidence.append("iv", mid, "check", value=False, now=at(13, 11))
+    assert states(p, at(13, 13))[mid] == "missed"  # checked and failing
+    evidence.append("iv", mid, "check", value=None, now=at(13, 11, 30))
+    assert states(p, at(13, 13))[mid] == "unknown"  # source went dark
+    evidence.append("iv", mid, "check", value=True, now=at(13, 11, 40))
+    assert states(p, at(13, 13))[mid] == "done"
+
+
+def test_phone_passed_after_due_is_late_done() -> None:
+    _phone_setup()
+    mid = "phone:2026-11-14"
+    fp.record_evidence("iv", mid, "tap", value=True, now=at(12, 9))
+    evidence.append("iv", mid, "check", value=True, now=at(13, 14))
+    assert states(fp.list_projects()[0], at(13, 15))[mid] == "late_done"
+
+
+def test_unknown_locks_like_missed(tmp_path: Path) -> None:
+    _phone_setup()
+    mid = "phone:2026-11-14"
+    fp.record_evidence("iv", "rules", "file", file=shot(tmp_path), now=at(10, 9))
+    fp.answer_weekend("iv", SAT2, trip=False, now=at(11, 9))
+    fp.record_evidence("iv", mid, "tap", value=True, now=at(12, 9))
+    owed = fp.owed_lock(at(13, 13))
+    assert owed is not None
+    assert (owed.id, owed.state) == (mid, "unknown")
+
+
+def test_unreadable_registry_fails_open_and_loud(
+    data: Path, caplog: pytest.LogCaptureFixture
+) -> None:
+    data.mkdir()
+    (data / "projects.json").write_text("{nope")
+    with caplog.at_level("WARNING"):
+        assert fp.owed_lock(at(13, 8)) is None
+    assert "unreadable" in caplog.text
+
+
+def test_no_project_no_lock() -> None:
+    assert fp.owed_lock(at(13, 8)) is None
+
+
+def test_focus_project_never_locks_on_milestones() -> None:
+    fp.create_project(
+        "f",
+        name="F",
+        start=date(2026, 11, 10),
+        end=date(2026, 11, 20),
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    assert fp.owed_lock(at(13, 8)) is None

focus_project/focus_project/tests/test_milestones_mock.py

@@ -0,0 +1,61 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""The mock milestone: a score counts only after a >= 90 min focus session."""
+
+from __future__ import annotations
+
+import focus_project as fp
+from focus_project.tests.helpers import at, make, session, states
+
+
+def test_mock_needs_a_score_after_a_long_session() -> None:
+    p = make()
+    assert states(p, at(26, 8))["mock"] == "missed"
+    session(at(25, 20), 90)
+    fp.record_evidence("iv", "mock", "score", 64, now=at(26, 8))
+    assert states(fp.list_projects()[0], at(26, 9))["mock"] == "late_done"
+
+
+def test_score_without_a_session_does_not_complete_mock() -> None:
+    p = make()
+    fp.record_evidence("iv", "mock", "score", 64, now=at(24, 9))
+    assert states(p, at(24, 10))["mock"] == "pending"
+    assert states(p, at(26, 8))["mock"] == "missed"
+    assert fp.owed_lock(at(26, 8)) is not None
+
+
+def test_short_session_does_not_complete_mock() -> None:
+    p = make()
+    session(at(24, 7), 89)
+    fp.record_evidence("iv", "mock", "score", 64, now=at(24, 9))
+    assert states(p, at(24, 10))["mock"] == "pending"
+
+
+def test_session_broken_by_a_gap_does_not_complete_mock() -> None:
+    p = make()
+    session(at(24, 6), 60)  # 06:00-07:00, then an 11 min hole (> 600 s)
+    session(at(24, 7, 11), 60)
+    fp.record_evidence("iv", "mock", "score", 64, now=at(24, 9))
+    assert states(p, at(24, 10))["mock"] == "pending"
+
+
+def test_session_must_end_before_the_score() -> None:
+    p = make()
+    session(at(24, 8), 90)  # ends 09:30
+    fp.record_evidence("iv", "mock", "score", 64, now=at(24, 9))
+    assert states(p, at(24, 10))["mock"] == "pending"
+    fp.record_evidence("iv", "mock", "score", 66, now=at(24, 9, 30))
+    assert states(p, at(24, 10))["mock"] == "done"  # ends exactly at the score
+
+
+def test_other_projects_sessions_do_not_count() -> None:
+    p = make()
+    session(at(24, 7), 90, pid="other")
+    fp.record_evidence("iv", "mock", "score", 64, now=at(24, 9))
+    assert states(p, at(24, 10))["mock"] == "pending"
+
+
+def test_session_on_time_but_score_late_is_late_done() -> None:
+    p = make()
+    session(at(25, 20), 100)
+    fp.record_evidence("iv", "mock", "score", 64, now=at(26, 0, 5))
+    assert states(p, at(26, 1))["mock"] == "late_done"

focus_project/focus_project/tests/test_minutes.py

@@ -130,13 +130,12 @@ def test_overlaps_never_double_count() -> None:
 
 
 def test_capped_at_daily_minutes() -> None:
-    project(daily=10)
+    project(daily=30)
     events(
-        ("timer", "start", at(9)),
-        ("timer", "stop", at(9, 8)),
+        *(("tutor", "heartbeat", at(9, 5 * k)) for k in range(1, 9)),
         ("tutor", "heartbeat", at(12)),
     )
-    assert minutes.minutes_for(D1) == 10
+    assert minutes.minutes_for(D1) == 30
 
 
 def test_other_day_and_other_project_events_ignored() -> None:

focus_project/focus_project/tests/test_minutes_beats.py

@@ -0,0 +1,59 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""0.8.0: a tutor heartbeat chains the timer segment like a checkin."""
+
+from __future__ import annotations
+
+from focus_project import minutes
+from focus_project.tests.test_minutes import D1, at, events, project
+
+
+def test_tutor_heartbeat_keeps_the_segment_alive() -> None:
+    """0.8.0: a tutor heartbeat is a beat of the open segment, like a checkin."""
+    project()
+    events(
+        ("timer", "start", at(9)),
+        ("tutor", "heartbeat", at(9, 7)),
+        ("timer", "stop", at(9, 12)),
+    )
+    assert minutes.minutes_for(D1) == 12
+
+
+def test_late_tutor_heartbeat_ends_the_segment_at_the_last_beat() -> None:
+    project()
+    events(
+        ("timer", "start", at(9)),
+        ("tutor", "heartbeat", at(9, 11)),  # 11 min > 600 s: segment ends at 9:00
+        ("timer", "stop", at(9, 13)),  # nothing open: ignored
+    )
+    assert minutes.minutes_for(D1) == 5  # only the heartbeat's own [9:06, 9:11]
+
+
+def test_tutor_heartbeat_never_opens_a_segment() -> None:
+    project()
+    events(
+        ("tutor", "heartbeat", at(9)),
+        ("timer", "stop", at(9, 4)),
+    )
+    assert minutes.minutes_for(D1) == 5
+
+
+def test_other_heartbeats_never_chain_the_timer() -> None:
+    project()
+    events(
+        ("timer", "start", at(9)),
+        ("sql_drills", "heartbeat", at(9, 7)),
+        ("timer", "stop", at(9, 12)),
+    )
+    assert minutes.minutes_for(D1) == 5  # [9:02, 9:07] only
+
+
+def test_tutor_heartbeats_chain_with_checkins() -> None:
+    project()
+    events(
+        ("timer", "start", at(9)),
+        ("tutor", "heartbeat", at(9, 7)),
+        ("timer", "checkin", at(9, 14)),
+        ("tutor", "heartbeat", at(9, 21)),
+        ("timer", "stop", at(9, 25)),
+    )
+    assert minutes.minutes_for(D1) == 25

focus_project/focus_project/tests/test_ratchet.py

@@ -0,0 +1,172 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""add_trip / answer_weekend only ever get stricter."""
+
+from __future__ import annotations
+
+from datetime import date
+
+import pytest
+
+import focus_project as fp
+from focus_project import evidence
+from focus_project.tests.helpers import SAT1, at, make, states
+
+
+def _ms(day: int, hour: int) -> int:
+    return int(at(day, hour).timestamp() * 1000)
+
+
+def test_add_trip_records_when_it_was_entered() -> None:
+    make()
+    p = fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 22), now=at(10, 9))
+    assert p.trips == (fp.Trip(date(2026, 11, 20), date(2026, 11, 22), _ms(10, 9)),)
+    assert fp.list_projects() == [p]
+
+
+def test_extending_keeps_entry_time_moving_earlier_resets_it() -> None:
+    make()
+    fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 21), now=at(10, 9))
+    later = fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 23), now=at(11, 9))
+    assert later.trips == (fp.Trip(date(2026, 11, 20), date(2026, 11, 23), _ms(10, 9)),)
+    earlier = fp.add_trip("iv", date(2026, 11, 19), date(2026, 11, 23), now=at(12, 9))
+    assert earlier.trips == (
+        fp.Trip(date(2026, 11, 19), date(2026, 11, 23), _ms(12, 9)),
+    )
+
+
+def test_second_disjoint_trip_and_idempotent_repeat() -> None:
+    make()
+    fp.add_trip("iv", date(2026, 11, 13), date(2026, 11, 14), now=at(10, 9))
+    fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 21), now=at(10, 10))
+    again = fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 21), now=at(11, 9))
+    assert len(again.trips) == 2
+    assert again.trips[1].entered_ms == _ms(10, 10)
+
+
+@pytest.mark.parametrize(
+    ("start", "end"),
+    [
+        (date(2026, 11, 21), date(2026, 11, 22)),  # starts later: loosens
+        (date(2026, 11, 20), date(2026, 11, 21)),  # ends earlier: shortens
+        (date(2026, 11, 21), date(2026, 11, 21)),  # strictly inside
+        (date(2026, 11, 22), date(2026, 11, 25)),  # partial overlap, later start
+    ],
+)
+def test_trip_may_not_shrink_or_start_later(start: date, end: date) -> None:
+    make()
+    before = fp.add_trip("iv", date(2026, 11, 20), date(2026, 11, 22), now=at(10, 9))
+    with pytest.raises(ValueError, match=r"stricter|cover"):
+        fp.add_trip("iv", start, end, now=at(11, 9))
+    assert fp.list_projects() == [before]
+
+
+@pytest.mark.parametrize(
+    ("start", "end"),
+    [
+        (date(2026, 11, 20), date(2026, 11, 19)),
+        (date(2026, 11, 28), date(2026, 11, 29)),
+    ],
+)
+def test_bad_trip_ranges(start: date, end: date) -> None:
+    make()
+    with pytest.raises(ValueError):  # noqa: PT011
+        fp.add_trip("iv", start, end, now=at(10, 9))
+
+
+def test_trip_on_wrong_project() -> None:
+    with pytest.raises(KeyError):
+        fp.add_trip("ghost", date(2026, 11, 20), date(2026, 11, 21), now=at(10, 9))
+    fp.create_project(
+        "f",
+        name="F",
+        start=date(2026, 12, 1),
+        end=date(2026, 12, 3),
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    with pytest.raises(ValueError, match="interview"):
+        fp.add_trip("f", date(2026, 12, 2), date(2026, 12, 3), now=at(10, 9))
+
+
+def test_answer_false_to_true_ok_true_to_false_refused() -> None:
+    make()
+    fp.answer_weekend("iv", SAT1, trip=False, now=at(11, 9))
+    yes = fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 10))
+    assert dict(yes.weekend_answers) == {SAT1: True}
+    with pytest.raises(ValueError, match="stricter"):
+        fp.answer_weekend("iv", SAT1, trip=False, now=at(11, 11))
+    assert dict(fp.list_projects()[0].weekend_answers) == {SAT1: True}
+
+
+def test_repeating_an_answer_writes_no_second_row() -> None:
+    make()
+    fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 9))
+    fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 10))
+    rows = [r for r in evidence.read("iv") if r.milestone == "trip_ask:2026-11-14"]
+    assert [(r.kind, r.value) for r in rows] == [("answer", True)]
+
+
+@pytest.mark.parametrize(
+    "day", [date(2026, 11, 15), date(2026, 11, 7), date(2026, 11, 28)]
+)
+def test_answer_only_for_a_weekend_of_the_project(day: date) -> None:
+    make()
+    with pytest.raises(ValueError, match="weekend"):
+        fp.answer_weekend("iv", day, trip=True, now=at(11, 9))
+
+
+def test_no_trip_answer_contradicting_an_explicit_trip_is_refused() -> None:
+    make()
+    fp.add_trip("iv", date(2026, 11, 13), date(2026, 11, 15), now=at(10, 9))
+    with pytest.raises(ValueError, match="trip covers"):
+        fp.answer_weekend("iv", SAT1, trip=False, now=at(11, 9))
+
+
+def test_late_answer_unlocks_but_is_late_done() -> None:
+    p = make()
+    assert states(p, at(13, 8))["trip_ask:2026-11-14"] == "missed"
+    p = fp.answer_weekend("iv", SAT1, trip=False, now=at(13, 8))
+    assert states(p, at(13, 9))["trip_ask:2026-11-14"] == "late_done"
+
+
+def test_answer_on_wrong_project() -> None:
+    with pytest.raises(KeyError):
+        fp.answer_weekend("ghost", SAT1, trip=True, now=at(11, 9))
+
+
+def test_find_skips_other_projects() -> None:
+    fp.create_project(
+        "f",
+        name="F",
+        start=date(2026, 10, 1),
+        end=date(2026, 10, 3),
+        replaces=["leetcode"],
+        daily_minutes=30,
+        unlock_minutes=10,
+    )
+    make()
+    p = fp.answer_weekend("iv", SAT1, trip=True, now=at(11, 9))
+    assert dict(p.weekend_answers) == {SAT1: True}
+
+
+def test_late_no_trip_answer_cannot_erase_an_overdue_phone_milestone() -> None:
+    make()
+    assert states(fp.list_projects()[0], at(13, 13))["phone:2026-11-14"] == "missed"
+    p = fp.answer_weekend("iv", SAT1, trip=False, now=at(13, 13))
+    got = states(p, at(13, 14))
+    assert got["trip_ask:2026-11-14"] == "late_done"
+    assert got["phone:2026-11-14"] == "missed"
+
+
+def test_no_trip_answer_before_the_phone_is_due_drops_it() -> None:
+    make()
+    p = fp.answer_weekend("iv", SAT1, trip=False, now=at(13, 11, 59))
+    assert "phone:2026-11-14" not in states(p, at(13, 14))
+
+
+def test_no_trip_answer_given_at_creation_has_no_phone() -> None:
+    p = make(weekend_answers={SAT1: False})
+    got = states(p, at(13, 14))
+    assert got["trip_ask:2026-11-14"] == "done"
+    assert "phone:2026-11-14" not in got

focus_project/focus_project/tests/test_status_interview.py

@@ -0,0 +1,72 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""status(day) carries the milestones for i3bar / daily-limits / tutor."""
+
+from __future__ import annotations
+
+from datetime import date
+from typing import TYPE_CHECKING
+
+import focus_project as fp
+from focus_project import _clock, evidence
+from focus_project.tests.helpers import at, make
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    import pytest
+
+
+def _now(monkeypatch: pytest.MonkeyPatch, day: int, hour: int) -> None:
+    stamp = at(day, hour).timestamp()
+    monkeypatch.setattr(_clock, "now", lambda: stamp)
+
+
+def test_idle_status_has_the_keys() -> None:
+    snap = fp.status(date(2026, 11, 10))
+    assert snap["milestones"] == []
+    assert snap["missed"] is False
+
+
+def test_status_lists_milestones_and_goes_red(monkeypatch: pytest.MonkeyPatch) -> None:
+    make()
+    _now(monkeypatch, 10, 9)
+    snap = fp.status(date(2026, 11, 10))
+    assert snap["missed"] is False
+    assert snap["milestones"][0]["id"] == "rules"
+    assert set(snap["milestones"][0]) == {"id", "due", "state"}
+    _now(monkeypatch, 11, 9)
+    snap = fp.status(date(2026, 11, 11))
+    assert snap["missed"] is True
+    assert snap["milestones"][0]["state"] == "missed"
+    assert snap["milestones"][0]["due"] == "2026-11-10T23:59:00"
+
+
+def test_status_stays_red_on_test_day(monkeypatch: pytest.MonkeyPatch) -> None:
+    make()
+    _now(monkeypatch, 27, 9)
+    assert fp.status(date(2026, 11, 27))["missed"] is True
+    assert fp.owed_lock(at(27, 9)) is None
+
+
+def test_status_survives_unreadable_evidence(
+    monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+) -> None:
+    make()
+    _now(monkeypatch, 11, 9)
+
+    def boom(project_id: str) -> list[evidence.Evidence]:
+        msg = "disk"
+        raise OSError(msg)
+
+    monkeypatch.setattr(evidence, "read", boom)
+    with caplog.at_level("WARNING"):
+        snap = fp.status(date(2026, 11, 11))
+    assert snap["milestones"] == []
+    assert snap["missed"] is False
+    assert "evidence unreadable" in caplog.text
+    assert fp.owed_lock(at(11, 9)) is None
+
+
+def test_isolation_canary(tmp_path: Path) -> None:
+    make()
+    assert not (tmp_path / "data" / "evidence").exists()

focus_project/focus_project/tests/test_update.py

@@ -78,8 +78,13 @@ def test_unknown_id_and_field() -> None:
         ({"replaces": ["workout"]}, "gate"),
         ({"replaces": []}, "replace"),
         ({"daily_minutes": 0}, "daily_minutes"),
+        ({"daily_minutes": 59}, "at least 60"),
+        (
+            {"daily_minutes": 89, "replaces": ["leetcode", "reading", "tutor"]},
+            "at least 90",
+        ),
         ({"unlock_minutes": 121}, "unlock_minutes"),
-        ({"daily_minutes": 20}, "unlock_minutes"),
+        ({"daily_minutes": 60, "unlock_minutes": 61}, "unlock_minutes"),
     ],
 )
 def test_update_validation(kw: dict[str, object], match: str) -> None:
@@ -124,39 +129,44 @@ def test_end_in_the_past_refused() -> None:
         fp.update_project("hr", today=D1 + 2 * DAY, end=D1 + DAY)
 
 
-def test_daily_change_applies_from_today(data: Path) -> None:
+def test_daily_cut_applies_from_tomorrow(data: Path) -> None:
     _make()
-    fp.update_project("hr", today=D1 + 2 * DAY, daily_minutes=60, unlock_minutes=10)
+    fp.update_project("hr", today=D1 + 2 * DAY, daily_minutes=100, unlock_minutes=10)
     p = fp.list_projects()[0]
-    assert (p.daily_minutes, p.unlock_minutes) == (60, 10)
+    assert (p.daily_minutes, p.unlock_minutes) == (100, 10)
     assert p.daily_on(D1 + DAY) == 120
-    assert p.unlock_on(D1 + DAY) == 30
-    assert p.daily_on(D1 + 2 * DAY) == 60
+    assert p.daily_on(D1 + 2 * DAY) == 120  # today keeps its targets
+    assert p.unlock_on(D1 + 2 * DAY) == 30
+    assert p.daily_on(D4) == 100
     assert p.unlock_on(D4) == 10
-    # a second edit the same day keeps the preserved past, a later day adds a row
-    fp.update_project("hr", today=D1 + 2 * DAY, daily_minutes=90)
+    # a deeper cut the same day keeps the one preserved row, a later day adds one
+    fp.update_project("hr", today=D1 + 2 * DAY, daily_minutes=80)
     assert len(fp.list_projects()[0].history) == 1
-    fp.update_project("hr", today=D4, daily_minutes=45, unlock_minutes=5)
+    fp.update_project("hr", today=D4, daily_minutes=65, unlock_minutes=5)
     p = fp.list_projects()[0]
-    assert [h.until for h in p.history] == [D1 + DAY, D4 - DAY]
-    assert p.daily_on(D1 + 2 * DAY) == 90
-    assert p.daily_on(D4) == 45
+    assert [h.until for h in p.history] == [D1 + 2 * DAY, D4]
+    assert p.daily_on(D4) == 80
+    assert p.daily_on(D4 + DAY) == 65
     raw = json.loads((data / "projects.json").read_text())["projects"][0]
     assert raw["history"][0] == {
-        "until": "2026-11-03",
+        "until": "2026-11-04",
         "daily_minutes": 120,
         "unlock_minutes": 30,
+        "replaces": ["leetcode", "reading"],
     }
 
 
 def test_future_project_daily_change_keeps_no_history() -> None:
     _make()
-    fp.update_project("hr", today=D1 - DAY, daily_minutes=60, unlock_minutes=10)
+    fp.update_project("hr", today=D1 - DAY, daily_minutes=100, unlock_minutes=10)
     p = fp.list_projects()[0]
     assert p.history == ()
-    assert p.daily_on(D1) == 60
-    fp.update_project("hr", today=D1, daily_minutes=50)  # first day: nothing past
-    assert fp.list_projects()[0].history == ()
+    assert p.daily_on(D1) == 100
+    # on the first day a cut waits for tomorrow, like any started project
+    fp.update_project("hr", today=D1, daily_minutes=70)
+    p = fp.list_projects()[0]
+    assert p.daily_on(D1) == 100
+    assert p.daily_on(D1 + DAY) == 70
 
 
 def test_same_value_edit_adds_no_history() -> None:
@@ -167,10 +177,11 @@ def test_same_value_edit_adds_no_history() -> None:
 
 def test_status_and_minutes_use_the_day_values(tmp_path: Path) -> None:
     _make()
-    fp.update_project("hr", today=D1 + DAY, daily_minutes=60, unlock_minutes=10)
+    fp.update_project("hr", today=D1 + DAY, daily_minutes=100, unlock_minutes=10)
     assert fp.status(D1)["daily_minutes"] == 120
     assert fp.status(D1)["unlock_minutes"] == 30
-    assert fp.status(D1 + DAY)["daily_minutes"] == 60
+    assert fp.status(D1 + DAY)["daily_minutes"] == 120
+    assert fp.status(D1 + 2 * DAY)["daily_minutes"] == 100
 
 
 def test_work_url_is_editable_kept_and_clearable() -> None:

focus_project/focus_project/tests/test_update_ratchet.py

@@ -0,0 +1,188 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""An edit never lowers today's obligation: reductions apply from tomorrow."""
+
+from __future__ import annotations
+
+from datetime import date, datetime, time, timedelta
+
+import pytest
+
+import focus_project as fp
+
+START = date(2026, 11, 2)
+TODAY = date(2026, 11, 4)
+TOMORROW = TODAY + timedelta(days=1)
+YESTERDAY = TODAY - timedelta(days=1)
+END = date(2026, 11, 20)
+
+
+def _make(start: date = START, replaces: list[str] | None = None) -> fp.Project:
+    return fp.create_project(
+        "p",
+        name="P",
+        start=start,
+        end=END,
+        replaces=replaces or ["leetcode"],
+        daily_minutes=120,
+        unlock_minutes=30,
+    )
+
+
+def _noon(day: date) -> float:
+    return datetime.combine(day, time(12)).timestamp()
+
+
+def _limits(day: date) -> tuple[int, int, tuple[str, ...]]:
+    p = fp.list_projects()[0]
+    return p.daily_on(day), p.unlock_on(day), p.replaces_on(day)
+
+
+def test_red_team_unlock_zero_waits_for_tomorrow() -> None:
+    _make()
+    got = fp.apply_update("p", today=TODAY, unlock_minutes=0)
+    assert got.effective_from == TOMORROW
+    assert _limits(TODAY)[1] == 30
+    assert _limits(YESTERDAY)[1] == 30
+    assert _limits(TOMORROW)[1] == 0
+    assert fp.status(TODAY)["unlock_minutes"] == 30
+
+
+def test_cut_to_the_floor_does_not_change_today() -> None:
+    _make()
+    fp.record_activity("tutor", "heartbeat", ts=_noon(TODAY), project="p")
+    before = fp.status(TODAY)
+    fp.update_project("p", today=TODAY, daily_minutes=30, unlock_minutes=0)
+    after = fp.status(TODAY)
+    assert after == before
+    assert after["daily_minutes"] == 120
+    assert fp.minutes_for(TODAY) == before["counted_minutes"]
+    assert fp.status(TOMORROW)["daily_minutes"] == 30
+
+
+def test_raises_apply_today() -> None:
+    _make()
+    got = fp.apply_update("p", today=TODAY, daily_minutes=180, unlock_minutes=40)
+    assert got.effective_from == TODAY
+    assert _limits(TODAY)[:2] == (180, 40)
+    assert _limits(YESTERDAY)[:2] == (120, 30)
+
+
+def test_mixed_edit_defers_whole_edit() -> None:
+    _make()
+    got = fp.apply_update("p", today=TODAY, daily_minutes=180, unlock_minutes=10)
+    assert got.effective_from == TOMORROW
+    assert _limits(TODAY)[:2] == (120, 30)
+    assert _limits(TOMORROW)[:2] == (180, 10)
+
+
+def test_added_gate_waits_removed_gate_is_immediate() -> None:
+    _make(replaces=["leetcode", "reading"])
+    got = fp.apply_update("p", today=TODAY, replaces=["leetcode", "reading", "tutor"])
+    assert got.effective_from == TOMORROW
+    assert not fp.stands_down("tutor", TODAY)
+    assert fp.stands_down("tutor", TOMORROW)
+    assert fp.status(TODAY)["replaces"] == ["leetcode", "reading"]
+    got = fp.apply_update("p", today=TODAY, replaces=["leetcode"])
+    assert got.effective_from == TODAY
+    assert not fp.stands_down("reading", TODAY)
+    assert not fp.stands_down("reading", TOMORROW)
+    assert fp.stands_down("reading", YESTERDAY)
+
+
+def test_pending_cut_then_second_edits_the_same_day() -> None:
+    _make()
+    fp.update_project("p", today=TODAY, daily_minutes=60, unlock_minutes=10)
+    assert _limits(TODAY)[:2] == (120, 30)
+    # a smaller cut than E is still a cut; a deeper cut still waits
+    fp.update_project("p", today=TODAY, daily_minutes=50)
+    assert _limits(TODAY)[:2] == (120, 30)
+    assert _limits(TOMORROW)[:2] == (50, 10)
+    assert len(fp.list_projects()[0].history) == 1
+    # a name-only edit leaves the pending cut alone
+    assert fp.apply_update("p", today=TODAY, name="Q").effective_from == TODAY
+    assert _limits(TOMORROW)[:2] == (50, 10)
+    # back up to (or over) today's targets cancels the pending cut, applies now
+    got = fp.apply_update("p", today=TODAY, daily_minutes=120, unlock_minutes=30)
+    assert got.effective_from == TODAY
+    assert fp.list_projects()[0].history == ()
+    got = fp.apply_update("p", today=TODAY, daily_minutes=60)
+    got = fp.apply_update("p", today=TODAY, daily_minutes=200)
+    assert got.effective_from == TODAY
+    assert _limits(TODAY)[:2] == (200, 30)
+    assert _limits(YESTERDAY)[:2] == (120, 30)
+
+
+def test_not_yet_started_project_is_a_new_obligation() -> None:
+    _make(start=TOMORROW)
+    got = fp.apply_update("p", today=TODAY, daily_minutes=30, unlock_minutes=0)
+    assert got.effective_from == TODAY
+    assert fp.list_projects()[0].history == ()
+    assert _limits(TOMORROW)[:2] == (30, 0)
+
+
+def test_project_starting_today_defers_a_cut() -> None:
+    _make(start=TODAY)
+    got = fp.apply_update("p", today=TODAY, daily_minutes=30, unlock_minutes=0)
+    assert got.effective_from == TOMORROW
+    assert _limits(TODAY)[:2] == (120, 30)
+
+
+def test_early_end_keeps_today_covered() -> None:
+    _make()
+    fp.update_project("p", today=TODAY, end=TODAY)
+    assert fp.active(TODAY) is not None
+    assert fp.active(TOMORROW) is None
+    with pytest.raises(ValueError, match="past"):
+        fp.update_project("p", today=TODAY, end=YESTERDAY)
+
+
+def test_legacy_history_row_without_replaces_round_trips() -> None:
+    old = {"until": "2026-11-03", "daily_minutes": 5, "unlock_minutes": 1}
+    row = fp.Limits.from_dict(old)
+    assert row.replaces is None
+    assert "replaces" not in row.to_dict()
+    with_r = fp.Limits(YESTERDAY, 5, 1, ("tutor",))
+    assert fp.Limits.from_dict(with_r.to_dict()) == with_r
+
+
+@pytest.mark.parametrize(
+    ("gates", "daily", "ok"),
+    [
+        (["leetcode"], 29, False),
+        (["leetcode"], 30, True),
+        (["leetcode", "reading"], 59, False),
+        (["leetcode", "reading", "tutor"], 89, False),
+        (["leetcode", "reading", "tutor"], 90, True),
+        (["leetcode", "book"], 60, True),  # book = reading: still two gates
+        (["leetcode", "book", "reading"], 60, True),  # one gate named twice
+    ],
+)
+def test_daily_floor_is_30_per_replaced_gate(
+    gates: list[str], daily: int, *, ok: bool
+) -> None:
+    def make() -> fp.Project:
+        return fp.create_project(
+            "f",
+            name="F",
+            start=TODAY,
+            end=END,
+            replaces=gates,
+            daily_minutes=daily,
+            unlock_minutes=0,
+        )
+
+    if ok:
+        assert make().daily_minutes == daily
+    else:
+        with pytest.raises(ValueError, match="at least"):
+            make()
+
+
+def test_edit_cannot_cut_below_the_floor_or_add_a_gate_it_cannot_pay() -> None:
+    _make(replaces=["leetcode", "reading", "tutor"])
+    for bad in ({"daily_minutes": 89}, {"daily_minutes": 1, "unlock_minutes": 0}):
+        with pytest.raises(ValueError, match="at least 90"):
+            fp.update_project("p", today=TODAY, **bad)
+    assert fp.update_project("p", today=TODAY, daily_minutes=90).daily_minutes == 90
+    assert fp.daily_floor(("a", "b")) == 60
+    assert fp.daily_floor(()) == 30

focus_project/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "focus_project"
-version = "0.5.0"
+version = "0.10.0"
 description = "Time-boxed focus projects: replace chosen gates, pay a daily-minutes gate"
 requires-python = ">=3.14"
 # Stdlib only on purpose: guards import it from the system python.

focus_project/requirements.txt

@@ -7,4 +7,4 @@ pre-commit==4.7.0
 pylint==4.1.3
 pytest==9.2.0
 pytest-cov==7.1.0
-ruff==0.17.3
+ruff==0.17.4

gatelock/README.md

@@ -69,8 +69,14 @@ unchanged so existing signed history keeps verifying.
 signed `morning_session.json` (the wake-early carrot: no lock until the signed
 `exempt_until`, 11:00 for a morning completed in time). screen-locker,
 leetcode-guard and book-guard all call it; the policy itself stays in
-wake-alarm. Path and retry budget are arguments so each consumer's tests keep
-redirecting their own constant.
+wake-alarm. The arming run waits up to 180 s for a freshly booted PC's
+refresher (status paths never wait). Path and retry budget are arguments so
+each consumer's tests keep redirecting their own constant.
+
+`gatelock.corner_strip` is the top-right always-on-top status strip for a gate
+that is stood down but not done (`build_corner_strip`, `CornerStrip`,
+`StripContent`, `corner_rect`, `corner_geometry`). It never grabs input; its
+tick ends when the owner's `supply` returns `None`.
 
 `gatelock.night_lockdown.evening_lockdown_today` answers "has tonight's
 evening night-lockdown already happened?" from night-lockdown's

gatelock/gatelock/corner_strip.py

@@ -0,0 +1,195 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""A small always-on-top strip in the top-right corner of the primary output.
+
+For the time a gate is *stood down but not done*: the lock is not up, yet the
+user still owes something (a morning session to finish, solves to submit).
+Without it the screen just clears and the lock returns out of nowhere.
+
+Top-right because the centre is where the user's actual work sits and the
+bottom-right is where desktop notifications land. Lifted from leetcode-guard's
+study strip so every gate shows the same thing in the same place.
+
+The strip never grabs input and never re-asserts a grab; its tick only
+refreshes the text and re-lifts the window. ``supply`` returning ``None`` is
+the one way it ends on its own, so the owner decides when the debt is gone.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import logging
+import tkinter as tk
+from typing import TYPE_CHECKING, Final
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Sequence
+
+    from gatelock._config import LockConfig
+    from gatelock._output_types import OutputRect, OutputScan
+
+_logger: Final = logging.getLogger(__name__)
+
+_TOPMOST_ON: Final = 1
+CORNER_STRIP_WIDTH_PX: Final = 420
+CORNER_STRIP_TICK_MS: Final = 1_000
+
+
+@dataclass(frozen=True)
+class StripContent:
+    """What the strip says: one bold title and a few plain lines."""
+
+    title: str
+    lines: tuple[str, ...]
+
+
+def corner_rect(scan: OutputScan) -> OutputRect | None:
+    """The rectangle to sit on: the primary live output, else the first live.
+
+    The whole X screen spans every monitor on a multi-head desk and would park
+    the strip on the far one, so it is always one output's rectangle.
+    """
+    live = scan.live
+    for output in live:
+        if output.primary:
+            return output.rect
+    return live[0].rect if live else None
+
+
+def corner_geometry(rect: OutputRect, *, width: int, height: int, inset: int) -> str:
+    """Tk geometry for a ``width`` x ``height`` window in ``rect``'s top-right."""
+    x = rect.x + rect.width - width - inset
+    y = rect.y + inset
+    return f"{width}x{height}+{x}+{y}"
+
+
+class CornerStrip:
+    """Handle on a built strip: refresh it, tick it, tear it down."""
+
+    def __init__(
+        self,
+        window: tk.Toplevel,
+        title_label: tk.Label,
+        line_labels: Sequence[tk.Label],
+        *,
+        tick_ms: int = CORNER_STRIP_TICK_MS,
+    ) -> None:
+        """Wrap an already-built strip window."""
+        self.window = window
+        self._title = title_label
+        self._lines = tuple(line_labels)
+        self._tick_ms = tick_ms
+        self._job: str | None = None
+        self._destroyed = False
+
+    @property
+    def closed(self) -> bool:
+        """Whether the strip is gone (destroyed, or broke on a refresh)."""
+        return self._destroyed
+
+    def show(self, content: StripContent) -> None:
+        """Write ``content`` and re-lift; lines past the content are blanked."""
+        if self._destroyed:
+            return
+        try:
+            self._title.configure(text=content.title)
+            for index, label in enumerate(self._lines):
+                text = content.lines[index] if index < len(content.lines) else ""
+                label.configure(text=text)
+            self.window.lift()
+        except tk.TclError:
+            # A fullscreen window over us is cosmetic; an exception escaping a
+            # Tk callback is not. Stop ticking and say so.
+            _logger.warning("the corner strip could not refresh", exc_info=True)
+            self._destroyed = True
+
+    def schedule(
+        self,
+        supply: Callable[[], StripContent | None],
+        *,
+        on_close: Callable[[], None],
+    ) -> None:
+        """Tick: show ``supply()`` until it returns None, then close."""
+        if self._destroyed:
+            return
+
+        def run() -> None:
+            content = supply()
+            if content is None:
+                self.destroy()
+                on_close()
+                return
+            self.show(content)
+            if not self._destroyed:
+                self._job = self.window.after(self._tick_ms, run)
+
+        self._job = self.window.after(self._tick_ms, run)
+
+    def destroy(self) -> None:
+        """Cancel the tick and tear the window down. Idempotent."""
+        if self._destroyed:
+            return
+        self._destroyed = True
+        try:
+            if self._job is not None:
+                self.window.after_cancel(self._job)
+            self.window.destroy()
+        except tk.TclError:
+            _logger.warning("the corner strip could not be destroyed", exc_info=True)
+
+
+def build_corner_strip(
+    root: tk.Misc,
+    config: LockConfig,
+    content: StripContent,
+    *,
+    rect: OutputRect,
+    max_lines: int = 3,
+) -> CornerStrip:
+    """Create the strip in ``rect``'s top-right corner, showing ``content``.
+
+    ``max_lines`` labels are built up front so later content can grow into
+    them without re-layout; the height is whatever those labels ask for.
+    """
+    width = CORNER_STRIP_WIDTH_PX
+    window = tk.Toplevel(root)
+    # Override-redirect must be set while withdrawn or the geometry is ignored.
+    window.withdraw()
+    window.overrideredirect(boolean=True)
+    window.configure(bg=config.palette.field_bg)
+    wrap = width - 2 * config.space("md")
+
+    title = tk.Label(
+        window,
+        text=content.title,
+        font=config.font("label", bold=True),
+        fg=config.palette.fg,
+        bg=config.palette.field_bg,
+        wraplength=wrap,
+    )
+    title.pack(pady=(config.space("sm"), 0), padx=config.space("md"))
+    lines = []
+    for index in range(max_lines):
+        label = tk.Label(
+            window,
+            text=content.lines[index] if index < len(content.lines) else "",
+            font=config.font("body" if index == 0 else "caption"),
+            fg=config.palette.accent if index == 0 else config.palette.muted,
+            bg=config.palette.field_bg,
+            wraplength=wrap,
+            justify="left",
+        )
+        label.pack(padx=config.space("md"))
+        lines.append(label)
+    if lines:
+        lines[-1].pack_configure(pady=(0, config.space("sm")))
+
+    window.update_idletasks()
+    height = int(window.winfo_reqheight())
+    window.geometry(
+        corner_geometry(rect, width=width, height=height, inset=config.space("md"))
+    )
+    window.deiconify()
+    window.lift()
+    # A hint most window managers honour even for override-redirect windows.
+    window.attributes("-topmost", _TOPMOST_ON)
+    return CornerStrip(window, title, lines)

gatelock/gatelock/morning_session.py

@@ -14,7 +14,8 @@ cannot mint an unlocked day.
 
 The one wrinkle is a PC booted mid-morning: the file is missing or yesterday's
 until wake-alarm's ``Persistent=true`` timer catches up, which needs the
-network. The arming run waits for that, bounded; status paths never do.
+network. The arming run waits for that, bounded (180 s, covering wake-alarm's
+150 s in-process retry); status paths never do.
 
 The path and the retry budget are parameters, not module state, so each
 consumer's test suite keeps redirecting its own constant.
@@ -45,7 +46,10 @@ MORNING_SESSION_FILE: Final = (
 # Only inside this local window is a non-today file worth waiting for: the
 # refresher runs 05:00-11:00, so outside it "not today's" is simply the truth.
 MORNING_WINDOW: Final = ((5, 0), (11, 0))
-MORNING_RETRY_SECONDS: Final = 30.0
+# Covers wake-alarm's own in-process retry (150 s) plus a margin: on
+# 2026-11-07 DNS came up seconds after boot, the refresher's one try had
+# already failed, and a 30 s wait locked a morning that was being earned.
+MORNING_RETRY_SECONDS: Final = 180.0
 MORNING_POLL_SECONDS: Final = 5.0
 
 

gatelock/gatelock/tests/test_corner_strip.py

@@ -0,0 +1,211 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Tests for the top-right status strip shown while a gate stands down."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from unittest.mock import MagicMock, patch
+
+from gatelock import corner_strip
+from gatelock._config import LockConfig
+from gatelock._outputs import Output, OutputRect, OutputScan
+from gatelock.corner_strip import (
+    CornerStrip,
+    StripContent,
+    build_corner_strip,
+    corner_geometry,
+    corner_rect,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    import pytest
+
+_LEFT = Output("DP-0", connected=True, rect=OutputRect(0, 0, 3840, 2160))
+_RIGHT = Output(
+    "HDMI-0", connected=True, rect=OutputRect(3840, 0, 2560, 1440), primary=True
+)
+_DARK = Output("DP-1", connected=False, rect=None)
+
+
+def test_corner_rect_prefers_the_primary_output() -> None:
+    scan = OutputScan((_LEFT, _RIGHT), source="randr", ok=True)
+    assert corner_rect(scan) == _RIGHT.rect
+
+
+def test_corner_rect_falls_back_to_the_first_live_output() -> None:
+    left = Output("DP-0", connected=True, rect=OutputRect(0, 0, 100, 100))
+    scan = OutputScan((_DARK, left), source="randr", ok=True)
+    assert corner_rect(scan) == left.rect
+
+
+def test_corner_rect_is_none_when_nothing_is_live() -> None:
+    assert corner_rect(OutputScan((_DARK,), source="randr", ok=True)) is None
+
+
+def test_geometry_hugs_the_top_right_corner_of_the_rect() -> None:
+    rect = OutputRect(3840, 0, 2560, 1440)
+    assert corner_geometry(rect, width=400, height=120, inset=16) == ("400x120+5984+16")
+
+
+def _after_into(jobs: list[Callable[[], None]]) -> Callable[..., str]:
+    """A ``window.after`` stand-in that queues the callback instead of timing it."""
+
+    def after(_ms: int, fn: Callable[[], None]) -> str:
+        jobs.append(fn)
+        return f"job{len(jobs)}"
+
+    return after
+
+
+def _strip() -> tuple[CornerStrip, MagicMock, MagicMock, list[MagicMock]]:
+    window, title = MagicMock(), MagicMock()
+    lines = [MagicMock(), MagicMock()]
+    return CornerStrip(window, title, lines, tick_ms=50), window, title, lines
+
+
+def test_show_writes_title_and_lines_and_relifts() -> None:
+    strip, window, title, lines = _strip()
+    strip.show(StripContent("Morning session", ("Next: shower", "Locks at 09:13")))
+    title.configure.assert_called_with(text="Morning session")
+    lines[0].configure.assert_called_with(text="Next: shower")
+    lines[1].configure.assert_called_with(text="Locks at 09:13")
+    window.lift.assert_called()
+
+
+def test_show_blanks_lines_the_content_does_not_fill() -> None:
+    strip, _window, _title, lines = _strip()
+    strip.show(StripContent("t", ("only one",)))
+    lines[1].configure.assert_called_with(text="")
+
+
+def test_schedule_ticks_until_the_supply_says_none_then_closes() -> None:
+    strip, window, _title, _lines = _strip()
+    jobs: list[Callable[[], None]] = []
+    window.after.side_effect = _after_into(jobs)
+    supplies = iter([StripContent("a", ()), None])
+    closed: list[bool] = []
+    strip.schedule(lambda: next(supplies), on_close=lambda: closed.append(True))
+    jobs.pop(0)()  # first tick: content -> shown, rescheduled
+    assert jobs, "the tick must reschedule itself while there is content"
+    jobs.pop(0)()  # second tick: None -> closed, not rescheduled
+    assert not jobs
+    assert closed == [True]
+    window.destroy.assert_called_once()
+
+
+def test_destroy_is_idempotent_and_cancels_the_tick() -> None:
+    strip, window, _title, _lines = _strip()
+    window.after.return_value = "job1"
+    strip.schedule(lambda: StripContent("a", ()), on_close=lambda: None)
+    strip.destroy()
+    strip.destroy()
+    window.after_cancel.assert_called_once_with("job1")
+    window.destroy.assert_called_once()
+
+
+def test_a_tcl_error_on_refresh_stops_the_strip_loudly(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    import tkinter as tk
+
+    strip, window, title, _lines = _strip()
+    title.configure.side_effect = tk.TclError("gone")
+    strip.show(StripContent("a", ()))
+    assert "could not refresh" in caplog.text
+    strip.destroy()
+    window.destroy.assert_not_called()
+
+
+def test_build_places_an_override_redirect_topmost_window() -> None:
+    window = MagicMock()
+    window.winfo_reqheight.return_value = 90
+    with (
+        patch.object(corner_strip.tk, "Toplevel", return_value=window),
+        patch.object(corner_strip.tk, "Label", side_effect=lambda *a, **k: MagicMock()),
+    ):
+        strip = build_corner_strip(
+            MagicMock(),
+            LockConfig(),
+            StripContent("Morning session", ("Next: shower",)),
+            rect=OutputRect(0, 0, 1920, 1080),
+            max_lines=2,
+        )
+    window.overrideredirect.assert_called_once_with(boolean=True)
+    window.attributes.assert_called_with("-topmost", 1)
+    spec = window.geometry.call_args.args[0]
+    assert spec.startswith("420x90+")
+    assert isinstance(strip, CornerStrip)
+
+
+def test_closed_reports_destroyed_state() -> None:
+    strip, _window, _title, _lines = _strip()
+    assert strip.closed is False
+    strip.destroy()
+    assert strip.closed is True
+
+
+def test_show_after_destroy_does_nothing() -> None:
+    strip, window, title, _lines = _strip()
+    strip.destroy()
+    strip.show(StripContent("late", ()))
+    title.configure.assert_not_called()
+    window.lift.assert_not_called()
+
+
+def test_schedule_after_destroy_does_not_tick() -> None:
+    strip, window, _title, _lines = _strip()
+    strip.destroy()
+    strip.schedule(lambda: StripContent("a", ()), on_close=lambda: None)
+    window.after.assert_not_called()
+
+
+def test_a_tick_that_breaks_the_strip_does_not_reschedule() -> None:
+    import tkinter as tk
+
+    strip, window, title, _lines = _strip()
+    jobs: list[Callable[[], None]] = []
+    window.after.side_effect = _after_into(jobs)
+    title.configure.side_effect = tk.TclError("gone")
+    strip.schedule(lambda: StripContent("a", ()), on_close=lambda: None)
+    jobs.pop(0)()
+    assert strip.closed
+    assert not jobs
+
+
+def test_destroy_without_a_tick_skips_the_cancel() -> None:
+    strip, window, _title, _lines = _strip()
+    strip.destroy()
+    window.after_cancel.assert_not_called()
+    window.destroy.assert_called_once()
+
+
+def test_destroy_logs_a_tcl_error_instead_of_raising(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    import tkinter as tk
+
+    strip, window, _title, _lines = _strip()
+    window.destroy.side_effect = tk.TclError("already gone")
+    strip.destroy()
+    assert "could not be destroyed" in caplog.text
+    assert strip.closed
+
+
+def test_build_with_zero_lines_builds_only_the_title() -> None:
+    window = MagicMock()
+    window.winfo_reqheight.return_value = 40
+    with (
+        patch.object(corner_strip.tk, "Toplevel", return_value=window),
+        patch.object(corner_strip.tk, "Label", side_effect=lambda *a, **k: MagicMock()),
+    ):
+        strip = build_corner_strip(
+            MagicMock(),
+            LockConfig(),
+            StripContent("Just a title", ()),
+            rect=OutputRect(0, 0, 1920, 1080),
+            max_lines=0,
+        )
+    assert isinstance(strip, CornerStrip)
+    window.deiconify.assert_called_once()

gatelock/gatelock/tests/test_morning_session.py

@@ -153,3 +153,12 @@ class TestBootRetry:
             is None
         )
         assert naps == []
+
+
+def test_the_arming_wait_outlasts_a_slow_boot_network() -> None:
+    """2026-11-07: DNS came up ~5 s after boot and the refresher's next try was
+    the 2-minute tick, so a 30 s wait locked kuhy mid-session. The budget must
+    cover the refresher's own 150 s in-process retry."""
+    from gatelock import morning_session
+
+    assert morning_session.MORNING_RETRY_SECONDS >= 180

gatelock/gatelock/tests/test_widgets.py

@@ -16,6 +16,7 @@ from typing import TYPE_CHECKING
 
 import pytest
 
+from gatelock import _density
 from gatelock._config import LockConfig
 from gatelock.widgets import (
     DEFAULT_WRAP,
@@ -50,6 +51,18 @@ def _font_px(widget: tk.Misc) -> int:
     return abs(int(tkfont.Font(font=widget.cget("font")).actual("size")))
 
 
+@pytest.fixture(autouse=True)
+def _full_size_type_scale() -> Iterator[None]:
+    """Pin the density to 1.0 so type-size comparisons ignore the display.
+
+    ``xvfb-run`` defaults to a 640x480 screen, which compacts the scale to 0.7
+    and clamps both the body and label roles to the same 11px floor -- so
+    "primary reads larger" and "caption is smaller" became 8 vs 8.
+    """
+    with _density.forced(1.0):
+        yield
+
+
 @pytest.fixture
 def root() -> Iterator[tk.Tk]:
     """A focused toplevel; Xvfb has no WM to assign X focus for us."""

gatelock/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gatelock"
-version = "0.11.0"
+version = "0.12.0"
 description = "Shared per-output lock-window + HMAC log-integrity backend for blocking-overlay apps"
 requires-python = ">=3.14"
 dependencies = []  # pure stdlib — tkinter is bundled with Python

holds/.pre-commit-config.yaml

@@ -0,0 +1,146 @@
+# Pre-commit Configuration for holds
+# Install:  pre-commit install && pre-commit install --hook-type pre-push
+# Run:      pre-commit run --all-files
+# Update:   pre-commit autoupdate
+
+# NOTE: this subproject lives inside the ~/src/utils monorepo, whose git root is
+# one level up. pre-commit always runs hooks from the git root, so every path
+# below is written relative to THAT, not to this directory, and the top-level
+# `files` key keeps these hooks off the sibling subprojects. CI invokes this
+# config exactly the same way:
+#   pre-commit run --config holds/.pre-commit-config.yaml --all-files
+files: ^holds/
+
+default_language_version:
+  python: python3
+default_stages: [pre-commit]
+fail_fast: false
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+      - id: check-toml
+      - id: check-added-large-files
+        args: [--maxkb=2000]
+      - id: check-merge-conflict
+      - id: detect-private-key
+      - id: debug-statements
+      - id: name-tests-test
+        args: [--pytest-test-first]
+      - id: check-ast
+      - id: mixed-line-ending
+        args: [--fix=lf]
+      - id: requirements-txt-fixer
+
+  - repo: local
+    hooks:
+      - id: file-length-cap
+        name: file length <= 250 lines
+        entry: bash scripts/check_file_length.sh
+        language: system
+        pass_filenames: true
+      - id: subproject-scope
+        name: subproject scope regex still matches
+        entry: scripts/check_subproject_scope.sh holds
+        language: script
+        # always_run so the top-level `files` filter cannot skip the one hook
+        # whose job is to notice that filter has stopped matching anything.
+        always_run: true
+        pass_filenames: false
+      - id: no-noqa
+        name: Block noqa comments
+        entry: '(?i)#\s*(noqa|type:\s*ignore)'
+        language: pygrep
+        types: [python]
+      - id: no-ruff-noqa
+        name: Block ruff noqa file-level comments
+        entry: '(?i)#\s*ruff:\s*noqa'
+        language: pygrep
+        types: [python]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.17.2
+    hooks:
+      - id: ruff
+        args: [--fix, --unsafe-fixes, --exit-non-zero-on-fix, --show-fixes]
+        types_or: [python, pyi]
+      - id: ruff-format
+        types_or: [python, pyi]
+
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.13.0
+    hooks:
+      - id: mypy
+        args:
+          - --ignore-missing-imports
+          - --no-error-summary
+          - --disable-error-code=no-untyped-def
+          - --disable-error-code=no-untyped-call
+          - --disable-error-code=var-annotated
+          - --disable-error-code=no-any-unimported
+          - --disable-error-code=type-arg
+          - --disable-error-code=no-any-return
+          - --disable-error-code=misc
+          - --disable-error-code=unused-ignore
+          - --disable-error-code=unreachable
+          - --disable-error-code=assignment
+          - --disable-error-code=no-redef
+          - --disable-error-code=attr-defined
+          - --disable-error-code=arg-type
+          - --disable-error-code=union-attr
+          - --disable-error-code=call-overload
+          - --disable-error-code=return-value
+          - --disable-error-code=redundant-cast
+          - --disable-error-code=empty-body
+          - --disable-error-code=list-item
+
+  - repo: https://github.com/pylint-dev/pylint
+    rev: v4.0.8
+    hooks:
+      - id: pylint
+        args:
+          - --rcfile=holds/pyproject.toml
+          - --fail-under=10
+          - --jobs=4
+        additional_dependencies:
+          - pytest
+          # Kept in step with pyproject.toml, so pylint resolves the crdt_sync
+          # imports instead of scoring every one of them as import-error.
+          - crdt-sync @ git+https://github.com/kuhyx/utils@crdt-sync-v0.9.2#subdirectory=crdt-sync
+
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.9.4
+    hooks:
+      - id: bandit
+        args:
+          - -c
+          - holds/pyproject.toml
+          - --severity-level=high
+          - --confidence-level=medium
+          - --skip=B113
+        additional_dependencies: ["bandit[toml]"]
+        exclude: ^(holds/holds/tests/|.*test.*\.py$)
+
+  - repo: local
+    hooks:
+      - id: pytest-coverage
+        name: pytest with coverage enforcement
+        entry: scripts/run_subproject_tests.sh holds
+        language: script
+        types: [python]
+        pass_filenames: false
+        require_serial: true
+        stages: [pre-push]
+
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.3.0
+    hooks:
+      - id: codespell
+        args:
+          - --skip=*.json,*.lock,.git,__pycache__,.venv

holds/README.md

@@ -0,0 +1,20 @@
+# holds
+
+Declared time-boxed holds (contract v1): while a hold is active every gate
+(focus-guard, diet-guard, screen-locker prompts) stands down so the PC stays
+usable, e.g. for a proctored test. Stdlib only; gates import it from the system python.
+
+```python
+import holds
+
+holds.active(now=None)        # Hold | None  (corrupt file -> None, logged: fail closed)
+holds.covers("diet-guard")    # bool; v1: every gate
+holds.next_change(now=None)   # datetime | None: active hold's end, else next start
+holds.add(start, end, "reason of 10+ chars")   # raises HoldsError on a ratchet breach
+holds.remove(hold_id)         # only before it starts
+```
+
+Ratchet (R11): each hold <= 15 h, <= 3 per ISO week (by start), start >= now + 30 min,
+reason >= 10 chars, no overlaps, whole-minute times, existing holds are never edited.
+Data: `$HOLDS_DATA` or `~/.local/share/holds/holds.json`, local naive times.
+Install: `./install.sh` (editable, `/usr/bin/python3`). Tests: `python3 -m pytest`.

holds/holds/__init__.py

@@ -0,0 +1,12 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Declared time-boxed holds: while one is active every gate stands down.
+
+Stdlib only; gates import it from the system python. Contract v1.
+"""
+
+from __future__ import annotations
+
+from holds._api import active, add, covers, next_change, remove
+from holds._model import Hold, HoldsError
+
+__all__ = ["Hold", "HoldsError", "active", "add", "covers", "next_change", "remove"]

holds/holds/_api.py

@@ -0,0 +1,76 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Public API: query (fails closed) and mutate (ratchet-checked) holds."""
+
+from __future__ import annotations
+
+from datetime import datetime
+import logging
+
+from holds import _store
+from holds._model import Hold, HoldsError, naive
+from holds._rules import make_id, validate
+
+_LOG = logging.getLogger("holds")
+
+
+def _now(now: datetime | None) -> datetime:
+    return naive(now) if now is not None else datetime.now()
+
+
+def _safe_load() -> list[Hold]:
+    """Fail CLOSED: an untrustworthy file means no hold (gates act normally)."""
+    try:
+        return _store.load()
+    except HoldsError:
+        _LOG.exception("ignoring hold file; gates behave as normal")
+        return []
+
+
+def active(now: datetime | None = None) -> Hold | None:
+    """The hold covering ``now`` (earliest start if hand-edits overlap), or None."""
+    moment = _now(now)
+    hits = [h for h in _safe_load() if h.contains(moment)]
+    return min(hits, key=lambda h: h.start) if hits else None
+
+
+def covers(gate: str, now: datetime | None = None) -> bool:
+    """Whether ``gate`` stands down at ``now``. v1: every gate does."""
+    del gate  # kept for future per-gate holds
+    return active(now) is not None
+
+
+def next_change(now: datetime | None = None) -> datetime | None:
+    """When the active hold ends, else when the next one starts, else None."""
+    moment = _now(now)
+    current = active(moment)
+    if current is not None:
+        return current.end
+    upcoming = [h.start for h in _safe_load() if h.start > moment]
+    return min(upcoming) if upcoming else None
+
+
+def add(
+    start: datetime, end: datetime, reason: str, now: datetime | None = None
+) -> Hold:
+    """Declare a hold. Raises HoldsError on any ratchet violation."""
+    moment = _now(now)
+    begin, finish = naive(start), naive(end)
+    existing = _store.load()
+    clean = validate(existing, begin, finish, reason, moment)
+    hold = Hold(make_id(existing, begin, clean), begin, finish, clean, moment)
+    _store.save([*existing, hold])
+    return hold
+
+
+def remove(hold_id: str, now: datetime | None = None) -> None:
+    """Delete a hold that has not started yet."""
+    moment = _now(now)
+    existing = _store.load()
+    target = next((h for h in existing if h.id == hold_id), None)
+    if target is None:
+        msg = f"unknown hold: {hold_id}"
+        raise HoldsError(msg)
+    if target.start <= moment:
+        msg = "hold already started; it cannot be removed"
+        raise HoldsError(msg)
+    _store.save([h for h in existing if h.id != hold_id])

holds/holds/_model.py

@@ -0,0 +1,54 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""The ``Hold`` record and its JSON row form (local, naive timestamps)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime
+
+
+class HoldsError(Exception):
+    """A hold was refused by the ratchet rules, or the file cannot be trusted."""
+
+
+def naive(moment: datetime) -> datetime:
+    """Return ``moment`` as local wall-clock time without a tzinfo."""
+    if moment.tzinfo is not None:
+        return moment.astimezone().replace(tzinfo=None)
+    return moment
+
+
+@dataclass(frozen=True)
+class Hold:
+    """One declared window during which every gate stands down."""
+
+    id: str
+    start: datetime
+    end: datetime
+    reason: str
+    created: datetime
+
+    def contains(self, now: datetime) -> bool:
+        """Half-open: active from ``start`` up to, not including, ``end``."""
+        return self.start <= now < self.end
+
+    def to_row(self) -> dict[str, str]:
+        """Serialise as the contract row (start/end are whole minutes)."""
+        return {
+            "id": self.id,
+            "start": self.start.isoformat(timespec="minutes"),
+            "end": self.end.isoformat(timespec="minutes"),
+            "reason": self.reason,
+            "created": self.created.isoformat(timespec="seconds"),
+        }
+
+    @classmethod
+    def from_row(cls, row: dict[str, str]) -> Hold:
+        """Parse a row; raises KeyError/TypeError/ValueError when malformed."""
+        return cls(
+            id=str(row["id"]),
+            start=naive(datetime.fromisoformat(row["start"])),
+            end=naive(datetime.fromisoformat(row["end"])),
+            reason=str(row["reason"]),
+            created=naive(datetime.fromisoformat(row["created"])),
+        )

holds/holds/_rules.py

@@ -0,0 +1,60 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Ratchet rules for new holds (R11): only ever stricter, never an escape hatch."""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta
+import re
+
+from holds._model import Hold, HoldsError
+
+MAX_DURATION = timedelta(hours=15)
+MAX_PER_WEEK = 3
+MIN_LEAD = timedelta(minutes=30)
+MIN_REASON = 10
+
+
+def _week(moment: datetime) -> tuple[int, int]:
+    iso = moment.isocalendar()
+    return iso.year, iso.week
+
+
+def validate(
+    existing: list[Hold], start: datetime, end: datetime, reason: str, now: datetime
+) -> str:
+    """Raise HoldsError on any violation; return the stripped reason."""
+    if start.second or start.microsecond or end.second or end.microsecond:
+        msg = "start and end must be whole minutes"
+        raise HoldsError(msg)
+    if end <= start:
+        msg = "end must be after start"
+        raise HoldsError(msg)
+    if end - start > MAX_DURATION:
+        msg = "a hold may last at most 15 h"
+        raise HoldsError(msg)
+    if start < now + MIN_LEAD:
+        msg = "a hold must start at least 30 min from now"
+        raise HoldsError(msg)
+    clean = reason.strip()
+    if len(clean) < MIN_REASON:
+        msg = f"reason must be at least {MIN_REASON} chars"
+        raise HoldsError(msg)
+    if any(h.start < end and start < h.end for h in existing):
+        msg = "hold would overlap an existing hold"
+        raise HoldsError(msg)
+    if sum(_week(h.start) == _week(start) for h in existing) >= MAX_PER_WEEK:
+        msg = f"at most {MAX_PER_WEEK} holds per ISO week"
+        raise HoldsError(msg)
+    return clean
+
+
+def make_id(existing: list[Hold], start: datetime, reason: str) -> str:
+    """``YYYYMMDDTHHMM-<slug>``; unique because holds never overlap."""
+    slug = re.sub(r"[^a-z0-9]+", "-", reason.lower()).strip("-")[:40].strip("-")
+    base = f"{start:%Y%m%dT%H%M}-{slug or 'hold'}"
+    taken = {h.id for h in existing}
+    candidate, n = base, 2
+    while candidate in taken:
+        candidate = f"{base}-{n}"
+        n += 1
+    return candidate

holds/holds/_store.py

@@ -0,0 +1,55 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Read and write the hold file. The path is resolved on every call."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+from holds._model import Hold, HoldsError
+
+_ENV = "HOLDS_DATA"
+
+
+def data_path() -> Path:
+    """``$HOLDS_DATA`` or ``~/.local/share/holds/holds.json``."""
+    override = os.environ.get(_ENV)
+    if override:
+        return Path(override)
+    return Path.home() / ".local" / "share" / "holds" / "holds.json"
+
+
+def load() -> list[Hold]:
+    """All holds; a missing file is empty, anything unreadable raises."""
+    path = data_path()
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return []
+    except OSError as exc:
+        msg = f"hold file unreadable: {path}: {exc}"
+        raise HoldsError(msg) from exc
+    try:
+        rows = json.loads(raw)["holds"]
+    except (KeyError, TypeError, ValueError) as exc:
+        msg = f"hold file unreadable: {path}: {exc!r}"
+        raise HoldsError(msg) from exc
+    if not isinstance(rows, list):
+        msg = f"hold file unreadable: {path}: 'holds' is not a list"
+        raise HoldsError(msg)
+    try:
+        return [Hold.from_row(row) for row in rows]
+    except (KeyError, TypeError, ValueError) as exc:
+        msg = f"hold file unreadable: {path}: {exc!r}"
+        raise HoldsError(msg) from exc
+
+
+def save(items: list[Hold]) -> None:
+    """Atomically replace the file with ``items`` sorted by start."""
+    path = data_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    rows = [h.to_row() for h in sorted(items, key=lambda h: h.start)]
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(json.dumps({"holds": rows}, indent=2) + "\n", encoding="utf-8")
+    tmp.replace(path)

holds/holds/tests/__init__.py

@@ -0,0 +1,2 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Tests for the holds package."""

holds/holds/tests/conftest.py

@@ -0,0 +1,19 @@
+# Copyright (c) 2026 Krzysztof Rudnicki
+"""Point the hold file at ``tmp_path`` for every test, so none can touch live state."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+@pytest.fixture(autouse=True)
+def data_file(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> Path:
+    """Redirect the data file; the path is resolved per call, so this is enough."""
+    path = tmp_path / "state" / "holds.json"
+    monkeypatch.setenv("HOLDS_DATA", str(path))
+    return path