Harden TimePrism project showcase

[Air000000]

Scope

Hardens the public TimePrism repository without another broad architecture rewrite, adds explicit first-run tracking consent / persisted pause semantics, and closes the Idle attribution data-quality gap exposed during installer smoke.

Implemented

• cleaned Tauri starter metadata in src-tauri/Cargo.toml;
• added real temporary-file SQLite lifecycle coverage for fresh initialization, reopen persistence, idempotent initialization, legacy schema migration, and legacy DB-path migration;
• corrected fresh root-category seeds to 学习 / 休息 and repairs only the two known mojibake values on existing databases, preserving user-customized names;
• added persisted tracking state with safe migration semantics: fresh databases default to onboarding incomplete + capture disabled, while recognizable legacy databases migrate to onboarded + capture enabled without overwriting later explicit choices;
• made onboarding completion atomically enable tracking and reject capture enablement before onboarding;
• moved automatic-capture policy out of the sampler: useTrackingState + the App runtime gate own start/stop decisions, while the sampler only performs periodic foreground sampling;
• added first-run privacy/tracking disclosure, immediate activation without restart, and persisted Pause/Resume behavior;
• made the desktop pet read persisted tracking state so its mood distinguishes active tracking from paused tracking while 学 / 休 counters remain classification-based;
• added compare-and-clear error ownership so Home polling recovery cannot erase a newer tracking write error;
• fixed first-run DB readiness by requiring configured product windows to be created only after backend initialization is ready;
• improved Idle correction semantics: the candidate app is anchored to the foreground app at the last real user input, never the app visible when the user returns; app attribution is always user-confirmed and preserves the app's existing LEARN / REST / IGNORE rule;
• simplified Idle choices to a compact primary surface, with Decide later demoted to a secondary text action in both the inline prompt and Focus Guard queue;
• added explicit usage provenance in app_usage_logs: FOREGROUND for observed foreground sampling and IDLE_CONFIRMED for user-confirmed idle correction; foreground coalescing now preserves this evidence boundary;
• legacy provenance migration is one-shot: known historical Idle rows are backfilled only when the source column is first added, and later startup does not rescan/reclassify already-migrated history;
• upgraded Windows CI to Node 24, current checkout/setup-node actions, explicit stable Rust, Rust build caching, concurrency cancellation, cargo check --all-targets, and cargo test;
• added a Windows release workflow with synchronized-version checks, PR/manual NSIS + MSI packaging validation, artifact upload, and draft tag releases;
• fixed Windows/pnpm bundle argument forwarding so Tauri receives --bundles nsis msi as two targets rather than one invalid token;
• updated README/distribution/validation docs, added privacy-safe media guidance, and added explicit fresh-install + legacy-upgrade acceptance gates to docs/SMOKE_TESTS.md and docs/RELEASE_CHECKLIST.md.

Verification

Current hardening branch HEAD: 19320df14c3e36b977f3abc6e87715303bb722de

Windows CI

Run #138: https://github.com/Air000000/timeprism/actions/runs/34607323895

Passed on the current PR HEAD:

• pnpm install --frozen-lockfile
• pnpm run typecheck
• pnpm run build:check
• cargo check --all-targets
• cargo test

Rust result: 52 passed, 0 failed. Coverage now includes fresh/legacy DB lifecycle, tracking onboarding and pause/resume, Idle candidate integrity, privacy boundaries, app-attributed Idle behavior, provenance migration/idempotency, and foreground-vs-user-confirmed coalescing boundaries.

Known pre-existing warnings remain for unused ForegroundSnapshot in a foreground test import and unused Manager in lib.rs; this PR does not claim a warning-free build.

Windows installer packaging

Run #83: https://github.com/Air000000/timeprism/actions/runs/34607323926

Passed on the current PR HEAD:

• synchronized Cargo / Node / Tauri version validation;
• frontend typecheck;
• Rust tests;
• NSIS + MSI installer build;
• installer artifact upload.

Generated artifact:

• name: TimePrism-0.1.0-windows-installers-pull_request
• artifact id: 10266048507
• archived size: 15,949,243 bytes
• artifact digest: sha256:67f1afff827199184e35b84cd5f6e307741134800778ba94cc94fde35fcc13c5
• NSIS: nsis/TimePrism_0.1.0_x64-setup.exe, 7,450,023 bytes, SHA-256 e9a1959c2f5505dbc632604c2e7dce9df4d180e5eb2b42e8deb373591c604821
• MSI: msi/TimePrism_0.1.0_x64_en-US.msi, 8,794,112 bytes, SHA-256 06297438a6469f9c8cbae8cc05832151ca058b49a19607db9e6cf1cbd288dca5

Automated evidence proves that this PR tree compiles, passes the Rust suite, and produces both Windows installer formats. It does not substitute for real desktop interaction testing.

Remaining manual gates

This PR intentionally remains Draft until the claims that require a real Windows product surface are evidenced rather than inferred:

1. Fresh-install acceptance (S-050): use a clean/sandboxed app-data directory; verify no pre-init SQLite error, no capture before onboarding, disclosure copy, immediate post-consent capture, classification-based pet counters, persisted Pause/Resume, paused pet mood, and existing close/background/pet/quit behavior.
2. Idle correction acceptance: create a real idle interval; verify the suggested app matches the app active at the last real user input, Continue <App> attributes the interval only after explicit confirmation, generic Learn/Break/Away fallback remains available, and Decide later is secondary rather than a fourth primary choice.
3. Legacy-upgrade acceptance (S-060): launch the same candidate against a backed-up pre-tracking-state database; verify existing data survives, onboarding does not reappear, legacy tracking starts enabled, provenance migration preserves history, and a later explicit pause persists across restart.
4. Interactive installer smoke: exercise the generated NSIS or MSI build on a real Windows desktop, including startup, Home, Insights, Focus Guard, reminders/privacy, desktop pet, restart/data persistence, and uninstall.
5. Product media: capture sanitized screenshots/GIF from the accepted Windows build and wire only those real product captures into README.
6. Public release: after the interactive gates succeed, synchronize/bump the intended public version if needed, create the matching v<version> tag, inspect the draft Release assets/notes, and publish it.

The app is currently unsigned, so Windows SmartScreen may report an unknown publisher; README/checklist state this explicitly.