FallbackForm.cs

using System.Diagnostics;
using System.Drawing;
using System.Runtime.InteropServices;
using System.Text;
using System.Text.RegularExpressions;
using CUIckScan.Models;
using CUIckScan.Services;
using Microsoft.Data.Sqlite;

namespace CUIckScan;

/// <summary>
/// Pure WinForms fallback UI — used when Edge WebView2 runtime is not installed.
/// Calls ScanService / ScanStateStore directly (no web server involved).
/// </summary>
public sealed class FallbackForm : Form
{
    [DllImport("user32.dll", CharSet = CharSet.Auto)]
    private static extern IntPtr SendMessage(IntPtr hWnd, int msg, IntPtr wParam, IntPtr lParam);
    private const int WM_SETREDRAW = 0x000B;

    private const int ToastDurationMs = 3500;
    private const int MaxSnippetFindings = 40;
    private const int GripSize = 6;

    // Severity level thresholds — keep in sync with App.jsx getSeverityLevel() and ReportGenerator.SL()
    private const int CriticalSeverityThreshold = 40;
    private const int HighSeverityThreshold = 25;
    private const int MediumSeverityThreshold = 13;

    // Score color thresholds — keep in sync with App.jsx scoreColor()
    private const int DangerScoreThreshold = 15;
    private const int WarningScoreThreshold = 10;
    private const int InfoScoreThreshold = 7;

    private enum UiScanState { Idle, Running, Paused, Completed, Canceled }

    private sealed record ThemePalette(
        Color PrimaryBg, Color SecondaryBg, Color TertiaryBg, Color CardBg,
        Color Border, Color BorderHover, Color TextPrimary, Color TextSecondary, Color TextMuted,
        Color Accent, Color AccentHover, Color Success, Color Warning, Color Danger, Color Info,
        Color TagCUI, Color TagCTI, Color TagITAR, Color TagDFARS, Color TagHeuristic);

    // Theme colors aligned with React UI (App.jsx themes object)
    private static readonly ThemePalette Dark = new(
        ColorTranslator.FromHtml("#13141a"), ColorTranslator.FromHtml("#1c1d25"),
        ColorTranslator.FromHtml("#24252e"), ColorTranslator.FromHtml("#2a2b35"),
        ColorTranslator.FromHtml("#33343e"), ColorTranslator.FromHtml("#4a4b55"),
        ColorTranslator.FromHtml("#e8eaed"), ColorTranslator.FromHtml("#8b8d97"),
        ColorTranslator.FromHtml("#5c5e68"),  // textMuted
        ColorTranslator.FromHtml("#4a90e2"), ColorTranslator.FromHtml("#3a7bd5"),
        ColorTranslator.FromHtml("#4caf50"), ColorTranslator.FromHtml("#f5a623"),
        ColorTranslator.FromHtml("#e74c3c"), ColorTranslator.FromHtml("#4a90e2"),
        ColorTranslator.FromHtml("#4a90e2"), ColorTranslator.FromHtml("#9b59b6"),
        ColorTranslator.FromHtml("#e74c3c"), ColorTranslator.FromHtml("#1abc9c"),
        ColorTranslator.FromHtml("#f5a623"));

    private static readonly ThemePalette Light = new(
        ColorTranslator.FromHtml("#f0f1f5"), ColorTranslator.FromHtml("#ffffff"),
        ColorTranslator.FromHtml("#f8f9fb"), ColorTranslator.FromHtml("#ffffff"),
        ColorTranslator.FromHtml("#dde0e6"), ColorTranslator.FromHtml("#b8bcc5"),
        ColorTranslator.FromHtml("#1a1c24"), ColorTranslator.FromHtml("#6b6e78"),
        ColorTranslator.FromHtml("#9a9da7"),  // textMuted
        ColorTranslator.FromHtml("#0066cc"), ColorTranslator.FromHtml("#0055aa"),
        ColorTranslator.FromHtml("#2e7d32"), ColorTranslator.FromHtml("#e6960b"),
        ColorTranslator.FromHtml("#c0392b"), ColorTranslator.FromHtml("#0066cc"),
        ColorTranslator.FromHtml("#0066cc"), ColorTranslator.FromHtml("#7b1fa2"),
        ColorTranslator.FromHtml("#c0392b"), ColorTranslator.FromHtml("#00897b"),
        ColorTranslator.FromHtml("#e6960b"));

    private ThemePalette _theme = Dark;
    private bool _darkMode = !IsOsLightTheme();
    private volatile UiScanState _scanState = UiScanState.Idle;
    private readonly string _version;

    // ─── Title bar ───
    private readonly Panel _titleBar = new() { Height = 36, Dock = DockStyle.Top };
    private readonly Label _titleLabel = new() { AutoSize = true };
    private Button? _switchUiBtn;  // debug-only: switch to React UI
    private readonly Button _themeToggle = new() { Text = "☀", Width = 28, Height = 24, FlatStyle = FlatStyle.Flat };
    private readonly Button _minBtn = new() { Text = "—", Width = 32, Height = 24, FlatStyle = FlatStyle.Flat };
    private readonly Button _maxBtn = new() { Text = "□", Width = 32, Height = 24, FlatStyle = FlatStyle.Flat };
    private readonly Button _closeBtn = new() { Text = "✕", Width = 32, Height = 24, FlatStyle = FlatStyle.Flat };

    // ─── Control bar Row 1 ───
    private readonly TextBox _pathBox = new() { Width = 420 };
    private readonly Button _fileExtButton = new() { Text = "File Extensions", Width = 120, Height = 32, Margin = new Padding(3, 0, 3, 0) };
    private Panel? _fileExtPopover;
    private readonly NumericUpDown _threadsBox = new()
    {
        Minimum = 1, Maximum = 32,
        Value = 2, Width = 60,
        TextAlign = HorizontalAlignment.Center
    };
    private readonly NumericUpDown _maxFileSizeBox = new()
    {
        Minimum = 1, Maximum = 500,
        Value = 10, Width = 60,
        TextAlign = HorizontalAlignment.Center
    };

    // ─── Control bar Row 2 ───
    private readonly Button _rulesButton = new() { Width = 280, Height = 32, TextAlign = ContentAlignment.MiddleLeft, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _scanButton = new() { Text = "Start Scan", Width = 100, Height = 32, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _cancelButton = new() { Text = "Stop Scan", Width = 100, Height = 32, Enabled = false, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _pauseButton = new() { Text = "Pause Scan", Width = 100, Height = 32, Enabled = false, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _resumeButton = new() { Text = "Resume Scan", Width = 110, Height = 32, Enabled = false, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _clearResultsButton = new() { Text = "Clear Results", Width = 110, Height = 32, Visible = false, Margin = new Padding(3, 0, 3, 0) };
    private readonly Label _settingsWarningLabel = new()
    {
        Text = "⚠ Settings changed — stop and restart scan to apply",
        AutoSize = true, Visible = false, Padding = new Padding(6, 8, 6, 0)
    };

    // ─── Rule selection popover ───
    private Panel? _rulePopover;
    private readonly HashSet<string> _enabledRuleLabels = [];
    private IReadOnlyList<PatternLibrary.RuleMetadata> _allRuleMeta = [];

    // ─── Rule JSON editor ───
    private readonly Button _editRulesButton = new() { Text = "Edit Rules", Width = 90, Height = 32, Margin = new Padding(3, 0, 3, 0) };
    private Form? _ruleEditorForm;
    private RichTextBox? _ruleEditorRtb;
    private Panel? _lineNumberGutter;
    private Label? _ruleEditorStatus;
    private Label? _ruleEditorFooter;
    private Button? _ruleEditorSaveBtn;
    private bool _ruleEditorDirty;
    private bool _suppressEditorEvents; // guard flag to ignore TextChanged during RTF/highlighting updates
    private System.Windows.Forms.Timer? _highlightTimer;

    // ─── Rule JSON editor search ───
    private TextBox? _ruleEditorSearchBox;
    private Label? _ruleEditorSearchCount;
    private List<int> _searchMatches = [];
    private int _searchIndex = -1;

    // ─── Results split ───
    private SplitContainer? _resultsSplit;

    // ─── False Positive reason (inline overlay on ListBox) ───
    private TextBox? _fpReasonOverlay;
    private string? _fpReasonTrackedPath; // tracks which file's reason is currently displayed

    // ─── Results filter bar ───
    private readonly TextBox _filterBox = new() { Width = 180, Height = 24 };
    private readonly ComboBox _categoryFilterBox = new() { DropDownStyle = ComboBoxStyle.DropDownList, Width = 140 };
    private readonly ComboBox _scoreFilterBox = new() { DropDownStyle = ComboBoxStyle.DropDownList, Width = 140 };
    private readonly CheckBox _showFalsePositives = new() { Text = "Show False Positives", AutoSize = true, Checked = false, Margin = new Padding(12, 5, 3, 0) };
    private readonly Button _clearFiltersButton = new() { Text = "✕ Clear Filters", Width = 100, Height = 24, Visible = false };

    // ─── Results ───
    private readonly ProgressBar _progressBar = new() { Width = 340, Height = 8, Style = ProgressBarStyle.Continuous };
    private readonly Label _statusLabel = new() { AutoSize = true, Text = "Ready" };
    private readonly ListBox _resultsList = new() { Dock = DockStyle.Fill, DrawMode = DrawMode.OwnerDrawVariable };
    private readonly RichTextBox _snippetBox = new()
    {
        Dock = DockStyle.Fill, ReadOnly = true,
        ScrollBars = RichTextBoxScrollBars.Both,
        Font = new Font("Cascadia Code", 10f),
        BorderStyle = BorderStyle.None,
        DetectUrls = false,
        WordWrap = false,
        ShortcutsEnabled = true
    };
    // Cached font variants for snippet formatting (avoids creating Font objects per-append)
    private Font? _snippetFontRegular;
    private Font? _snippetFontBold;
    private Font? _snippetFontItalic;
    private Font? _snippetFontBoldItalic;

    // ─── Action buttons ───
    private readonly Button _exportButton = new() { Text = "Export Paths", Width = 100, Height = 28, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _copyButton = new() { Text = "Copy Files", Width = 95, Height = 28, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _moveButton = new() { Text = "Move Files", Width = 95, Height = 28, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _reportButton = new() { Text = "Generate Report", Width = 130, Height = 32, Margin = new Padding(3, 0, 3, 0) };
    private readonly CheckBox _preserveCopyStructure = new() { Text = "Preserve folders", Checked = true, AutoSize = true, Margin = new Padding(0, 4, 6, 0) };
    private readonly CheckBox _preserveMoveStructure = new() { Text = "Preserve folders", Checked = true, AutoSize = true, Margin = new Padding(0, 4, 6, 0) };
    private readonly Button _openDbButton = new() { Text = "Open Scan DB", Width = 105, Height = 28, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _saveDbButton = new() { Text = "Save Scan DB", Width = 105, Height = 28, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _newScanDbButton = new() { Text = "New Scan DB", Width = 105, Height = 28, Margin = new Padding(3, 0, 3, 0) };
    private readonly Button _changePassphraseButton = new() { Text = "Change DB Passphrase", Width = 155, Height = 28, Margin = new Padding(3, 0, 3, 0), Visible = false };
    private readonly Label _encryptedIndicator = new() { Text = "🔒 Encrypted", AutoSize = true, Visible = false, Padding = new Padding(6, 6, 6, 0) };
    private readonly Panel _actionDivider = new() { Width = 1, Height = 22, Margin = new Padding(16, 3, 16, 0) };

    // ─── Toast ───
    private readonly Panel _toastHost = new()
    {
        Width = 320, Height = 200,
        Anchor = AnchorStyles.Right | AnchorStyles.Bottom,
        BackColor = Color.Transparent
    };

    // ─── Banner (WebView2 not found) ───
    private readonly Panel _bannerPanel = new() { Height = 28, Dock = DockStyle.Top };

    // ─── Services ───
    private readonly ScanStateStore _stateStore = new();
    private readonly ScanService _scanner;
    private readonly BindingSource _binding = new();

    private IReadOnlyList<ScanResult> _results = [];
    private IReadOnlyList<ScanResult> _filteredResults = [];
    private CancellationTokenSource? _scanCts;
    private string _activeDbPath;
    private string? _openedSourcePath;

    private readonly bool _debug;
    private bool _switchingUi;
    private bool _dragging;
    private Point _dragOrigin;
    private Font? _titleFont;
    private ToolTip? _threadsTooltip;

    // ─── Cached fonts for owner-draw (avoid per-paint allocation) ───
    private readonly Font _drawNameFont = new("Segoe UI", 9f, FontStyle.Bold);
    private readonly Font _drawDirFont = new("Cascadia Code", 7.5f);
    private readonly Font _drawTagFont = new("Segoe UI", 7.5f, FontStyle.Bold);
    private readonly Font _drawInfoFont = new("Segoe UI", 7.5f);
    private readonly Font _drawReasonFont = new("Segoe UI", 8.5f);
    private readonly Font _drawLabelFont = new("Segoe UI", 6.5f, FontStyle.Bold);

    // ─── Session settings debounce persistence ───
    private System.Windows.Forms.Timer? _settingsPersistTimer;

    // ─── Encryption state ───
    private FieldCipher? _activeCipher;
    private int _passphraseFailures;
    private DateTime _lastFailureUtc = DateTime.MinValue;

    // Pending encryption setup — stores passphrase material from startup prompt
    // so it can be applied when the actual scan DB is created.
    private byte[]? _pendingSalt;
    private string? _pendingVerifier;

    protected override void Dispose(bool disposing)
    {
        if (disposing)
        {
            _scanCts?.Cancel();
            _scanCts?.Dispose();
            DisposeActiveCipher();
            _stateStore.Dispose();
            _titleFont?.Dispose();
            _threadsTooltip?.Dispose();
            _binding?.Dispose();
            _drawNameFont.Dispose();
            _drawDirFont.Dispose();
            _drawTagFont.Dispose();
            _drawInfoFont.Dispose();
            _drawReasonFont.Dispose();
            _drawLabelFont.Dispose();
            _drawReviewFont.Dispose();
            _settingsPersistTimer?.Dispose();
            _ruleEditorForm?.Dispose();
            _highlightTimer?.Dispose();
            // Dispose cached snippet fonts
            _snippetFontRegular?.Dispose();
            _snippetFontBold?.Dispose();
            _snippetFontItalic?.Dispose();
            _snippetFontBoldItalic?.Dispose();
        }
        base.Dispose(disposing);
    }

    public FallbackForm(string version, bool debug = false)
    {
        _version = version;
        _debug = debug;
        _scanner = new ScanService(_stateStore);
        _scanner.Patterns.LoadFromConfig(PatternLibrary.LoadRulesFromDisk());
        _activeDbPath = _stateStore.DefaultDatabasePath;

        Text = "CUIck Scan";
        Width = 1500;
        Height = 860;
        MinimumSize = new Size(900, 600);
        FormBorderStyle = FormBorderStyle.None;
        DoubleBuffered = true;
        Padding = new Padding(GripSize);
        LoadAppIcon();

        // Load rule metadata and enable all by default
        _allRuleMeta = _scanner.Patterns.GetAllRuleMetadata();
        foreach (var r in _allRuleMeta) _enabledRuleLabels.Add(r.Label);
        UpdateRulesButtonText();

        // Category filter
        _categoryFilterBox.Items.AddRange(["All Categories", "CUI", "CTI", "ITAR", "DFARS", "Heuristic"]);
        _categoryFilterBox.SelectedIndex = 0;
        _categoryFilterBox.SelectedIndexChanged += (_, _) => ApplyResultFilters();

        // Score filter
        _scoreFilterBox.Items.AddRange(["All Scores", $"Critical ({CriticalSeverityThreshold}+)", $"High ({HighSeverityThreshold}+)", $"Medium ({MediumSeverityThreshold}+)", $"Low (<{MediumSeverityThreshold})"]);
        _scoreFilterBox.SelectedIndex = 0;
        _scoreFilterBox.SelectedIndexChanged += (_, _) => ApplyResultFilters();

        _filterBox.PlaceholderText = "Filter by file name or path…";
        _filterBox.TextChanged += (_, _) => ApplyResultFilters();
        _showFalsePositives.CheckedChanged += (_, _) => ApplyResultFilters();

        _clearFiltersButton.Click += (_, _) =>
        {
            _filterBox.Text = "";
            _categoryFilterBox.SelectedIndex = 0;
            _scoreFilterBox.SelectedIndex = 0;
            _showFalsePositives.Checked = false;
        };

        _resultsList.DataSource = _binding;
        _resultsList.SelectedIndexChanged += (_, _) => ShowSnippet();
        _resultsList.MeasureItem += (_, e) =>
        {
            var item = e.Index >= 0 && e.Index < _resultsList.Items.Count ? _resultsList.Items[e.Index] as ScanResult : null;
            e.ItemHeight = (item?.ReviewStatus == ReviewStatus.FalsePositive) ? 110 : 82;
        };
        _resultsList.DrawItem += DrawResultItem;
        _resultsList.MouseClick += OnResultsListMouseClick;

        _rulesButton.Click += (_, _) => ToggleRulePopover();
        _editRulesButton.Click += (_, _) => ShowRuleEditor();
        _fileExtButton.Click += (_, _) => ToggleFileExtPopover();
        _scanButton.Click += (_, _) => _ = RunUiActionAsync(StartScanFlowAsync, "Unable to start scan");
        _cancelButton.Click += (_, _) => _scanCts?.Cancel();
        _pauseButton.Click += (_, _) => PauseScan();
        _resumeButton.Click += (_, _) => ResumeScan();
        _clearResultsButton.Click += (_, _) => ClearResults();
        _openDbButton.Click += (_, _) => OpenDatabaseForReview();
        _saveDbButton.Click += (_, _) => SaveDatabaseAs();
        _newScanDbButton.Click += (_, _) => HandleNewScanDb();
        _changePassphraseButton.Click += (_, _) => HandleChangePassphrase();
        _exportButton.Click += (_, _) => ExportPaths();
        _copyButton.Click += (_, _) => CopyOrMoveFiles(move: false);
        _moveButton.Click += (_, _) => CopyOrMoveFiles(move: true);
        _reportButton.Click += (_, _) => GenerateReport();

        _themeToggle.Click += (_, _) => ToggleTheme();
        _minBtn.Click += (_, _) => WindowState = FormWindowState.Minimized;
        _maxBtn.Click += (_, _) => WindowState = WindowState == FormWindowState.Maximized
            ? FormWindowState.Normal : FormWindowState.Maximized;
        _closeBtn.Click += (_, _) => Close();

        KeyPreview = true;
        KeyDown += OnHotkeys;

        BuildBanner();
        BuildTitleBar();
        Controls.Add(BuildLayout());
        Controls.Add(_bannerPanel);
        Controls.Add(_titleBar);
        Controls.Add(_toastHost);

        Resize += (_, _) =>
        {
            Padding = WindowState == FormWindowState.Maximized ? new Padding(0) : new Padding(GripSize);
            PositionToastHost();
        };
        PositionToastHost();
        SetScanState(UiScanState.Idle); // Set initial button visibility before ApplyTheme
        ApplyTheme();

        Shown += (_, _) =>
        {
            // Set 50/50 default split once the layout has computed actual widths
            if (_resultsSplit is { Width: > 0 })
                _resultsSplit.SplitterDistance = _resultsSplit.Width / 2;
            OnStartupSessionCheck();
        };
    }

    // ═══════════════════════════════════════════════════════════
    //  UI construction
    // ═══════════════════════════════════════════════════════════

    private void BuildBanner()
    {
        _bannerPanel.BackColor = ColorTranslator.FromHtml("#5865F2");
        var lbl = new Label
        {
            Text = "  ℹ  Edge WebView2 runtime not found — running in compatibility mode. Install WebView2 for the full experience.",
            Dock = DockStyle.Fill,
            ForeColor = Color.White,
            Font = new Font("Segoe UI", 8.5f),
            TextAlign = ContentAlignment.MiddleLeft,
        };
        var dismissBtn = new Button
        {
            Text = "✕", Width = 28, Height = 22, Dock = DockStyle.Right,
            FlatStyle = FlatStyle.Flat, ForeColor = Color.White,
        };
        dismissBtn.FlatAppearance.BorderSize = 0;
        dismissBtn.Click += (_, _) =>
        {
            _bannerPanel.Visible = false;
            PerformLayout();
        };
        _bannerPanel.Controls.Add(lbl);
        _bannerPanel.Controls.Add(dismissBtn);
    }

    private void BuildTitleBar()
    {
        _titleBar.Padding = new Padding(8, 4, 8, 4);
        _titleLabel.Text = $"CUIck Scan — CUI / CTI / ITAR Discovery Scanner  v{_version}";
        _titleFont = new Font("Segoe UI", 9f, FontStyle.Bold);
        _titleLabel.Font = _titleFont;

        var icon = new Label { Text = "🛡", AutoSize = true, Padding = new Padding(2, 3, 6, 0) };

        var left = new FlowLayoutPanel { Dock = DockStyle.Left, AutoSize = true, WrapContents = false };
        left.Controls.Add(icon);
        left.Controls.Add(_titleLabel);

        var right = new FlowLayoutPanel { Dock = DockStyle.Right, AutoSize = true, WrapContents = false };

        // Debug mode: add "Switch to React UI" button
        if (_debug)
        {
            _switchUiBtn = new Button
            {
                Text = "⇄ React UI",
                Width = 80,
                Height = 24,
                FlatStyle = FlatStyle.Flat,
                Font = new Font("Segoe UI", 7.5f),
                Margin = new Padding(0, 0, 6, 0),
            };
            _switchUiBtn.FlatAppearance.BorderSize = 1;
            _switchUiBtn.Click += SwitchToReactUI_Click;
            right.Controls.Add(_switchUiBtn);
        }

        foreach (var b in new[] { _themeToggle, _minBtn, _maxBtn, _closeBtn })
        {
            b.FlatAppearance.BorderSize = 0;
            right.Controls.Add(b);
        }

        _titleBar.Controls.Add(right);
        _titleBar.Controls.Add(left);
        _titleBar.MouseDown += (_, e) => { _dragging = true; _dragOrigin = e.Location; };
        _titleBar.MouseMove += (_, e) =>
        {
            if (_dragging) Location = new Point(Location.X + e.X - _dragOrigin.X, Location.Y + e.Y - _dragOrigin.Y);
        };
        _titleBar.MouseUp += (_, _) => _dragging = false;
        _titleBar.MouseDoubleClick += (_, _) =>
            WindowState = WindowState == FormWindowState.Maximized ? FormWindowState.Normal : FormWindowState.Maximized;
    }

    private Control BuildLayout()
    {
        var root = new TableLayoutPanel
        {
            Dock = DockStyle.Fill, RowCount = 4, ColumnCount = 1,
            Padding = new Padding(0, 4, 0, 0) // small gap below docked title bar + banner
        };
        root.RowStyles.Add(new RowStyle(SizeType.Absolute, 48));  // Row 1: path/browse/threads
        root.RowStyles.Add(new RowStyle(SizeType.Absolute, 48));  // Row 2: rules/scan buttons/threads
        root.RowStyles.Add(new RowStyle(SizeType.Percent, 100));  // Row 3: results
        root.RowStyles.Add(new RowStyle(SizeType.Absolute, 76));  // Row 4: status/actions

        var browseButton = new Button { Text = "Browse", Width = 74, Height = 32, Margin = new Padding(3, 0, 3, 0) };
        browseButton.Click += (_, _) => BrowsePath();

        // Row 1: Scan Root, Browse, File Extensions, Generate Report
        var row1 = new FlowLayoutPanel
        {
            Dock = DockStyle.Fill, Padding = new Padding(16, 6, 16, 0), WrapContents = false
        };
        row1.Controls.AddRange([
            LabelCaption("SCAN ROOT"), _pathBox, browseButton, _fileExtButton, _reportButton
        ]);

        // Row 2: Select Scan Rules, Scan Threads, Max File Size, Scan/Pause/Resume/Cancel
        var threadsLabel = LabelCaption("SCAN THREADS");
        var maxFileSizeLabel = LabelCaption("MAX FILE SIZE");
        var maxFileSizeUnitLabel = new Label
        {
            Text = "MB", AutoSize = true,
            Font = new Font("Segoe UI", 8f),
            Padding = new Padding(0, 8, 0, 0)
        };
        _threadsTooltip = new ToolTip();
        _threadsTooltip.SetToolTip(_threadsBox, "More scanning threads completes the scan faster but adds significant load to the system");
        _threadsTooltip.SetToolTip(threadsLabel, "More scanning threads completes the scan faster but adds significant load to the system");
        _threadsTooltip.SetToolTip(_maxFileSizeBox, "Maximum file size for structured document parsing (DOCX, XLSX, PPTX, PDF). Larger files fall back to binary text extraction.");
        _threadsTooltip.SetToolTip(maxFileSizeLabel, "Maximum file size for structured document parsing (DOCX, XLSX, PPTX, PDF). Larger files fall back to binary text extraction.");

        var row2 = new FlowLayoutPanel
        {
            Dock = DockStyle.Fill, Padding = new Padding(16, 6, 16, 0), WrapContents = false
        };
        row2.Controls.AddRange([
            LabelCaption("SELECT SCAN RULES"), _rulesButton, _editRulesButton,
            threadsLabel, _threadsBox,
            maxFileSizeLabel, _maxFileSizeBox, maxFileSizeUnitLabel,
            _scanButton, _pauseButton, _resumeButton, _cancelButton, _clearResultsButton,
            _settingsWarningLabel
        ]);

        // Results area: filter bar + split panel
        var resultsContainer = new Panel { Dock = DockStyle.Fill };

        // Filter bar above results
        var filterBar = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, Height = 32, Padding = new Padding(16, 4, 16, 4), WrapContents = false
        };
        filterBar.Controls.AddRange([
            _filterBox,
            LabelCaption("CATEGORY"), _categoryFilterBox,
            LabelCaption("SCORE"), _scoreFilterBox,
            _showFalsePositives,
            _clearFiltersButton
        ]);

        _resultsSplit = new SplitContainer
        {
            Dock = DockStyle.Fill, SplitterDistance = 600, Panel1MinSize = 200
        };
        // FP reason inline overlay — a TextBox positioned over the FP reason area of the selected card
        _fpReasonOverlay = new TextBox
        {
            Visible = false, BorderStyle = BorderStyle.FixedSingle,
            Font = new Font("Segoe UI", 8.5f),
            PlaceholderText = "Reason for false positive...",
        };
        _fpReasonOverlay.Leave += OnFpReasonBoxLeave;
        _fpReasonOverlay.KeyDown += (_, e) => { if (e.KeyCode == Keys.Enter) { e.SuppressKeyPress = true; _snippetBox.Focus(); } };
        _resultsList.Controls.Add(_fpReasonOverlay); // overlay on ListBox

        _resultsSplit.Panel1.Controls.Add(_resultsList);
        _resultsSplit.Panel2.Controls.Add(_snippetBox);

        resultsContainer.Controls.Add(_resultsSplit);
        resultsContainer.Controls.Add(filterBar);

        // Status area
        var statusArea = new TableLayoutPanel
        {
            Dock = DockStyle.Fill, RowCount = 2, ColumnCount = 1, Padding = new Padding(10, 4, 10, 2)
        };
        statusArea.RowStyles.Add(new RowStyle(SizeType.Absolute, 36));
        statusArea.RowStyles.Add(new RowStyle(SizeType.Absolute, 30));

        // Actions row: left-aligned file/DB ops, right-aligned passphrase button
        var actionsLeft = new FlowLayoutPanel { Dock = DockStyle.Fill, WrapContents = false, Padding = new Padding(4, 0, 4, 0) };
        actionsLeft.Controls.AddRange([
            _exportButton, _copyButton, _preserveCopyStructure,
            _moveButton, _preserveMoveStructure,
            _actionDivider,
            _openDbButton, _saveDbButton, _newScanDbButton
        ]);
        _changePassphraseButton.Dock = DockStyle.Right;
        _changePassphraseButton.Margin = new Padding(6, 0, 0, 0);
        var actionsRow = new Panel { Dock = DockStyle.Fill };
        actionsRow.Controls.Add(actionsLeft);      // Fill — takes remaining space
        actionsRow.Controls.Add(_changePassphraseButton); // Right — docked to right edge

        // Progress row: left progress+status, right-aligned encrypted indicator
        var progressLeft = new FlowLayoutPanel { Dock = DockStyle.Fill, WrapContents = false };
        progressLeft.Controls.Add(_progressBar);
        progressLeft.Controls.Add(_statusLabel);
        _encryptedIndicator.Dock = DockStyle.Right;
        _encryptedIndicator.Padding = new Padding(6, 4, 0, 0);
        var progressRow = new Panel { Dock = DockStyle.Fill };
        progressRow.Controls.Add(progressLeft);       // Fill
        progressRow.Controls.Add(_encryptedIndicator); // Right

        statusArea.Controls.Add(actionsRow, 0, 0);
        statusArea.Controls.Add(progressRow, 0, 1);

        root.Controls.Add(row1, 0, 0);
        root.Controls.Add(row2, 0, 1);
        root.Controls.Add(resultsContainer, 0, 2);
        root.Controls.Add(statusArea, 0, 3);

        return root;
    }

    private static Label LabelCaption(string text) => new()
    {
        Text = text, AutoSize = true,
        Font = new Font("Segoe UI", 8f, FontStyle.Bold),
        Padding = new Padding(10, 8, 0, 0)
    };

    // ═══════════════════════════════════════════════════════════
    //  Rule selection popover
    // ═══════════════════════════════════════════════════════════

    private void UpdateRulesButtonText()
    {
        _rulesButton.Text = _enabledRuleLabels.Count == _allRuleMeta.Count
            ? $"  All rules ({_allRuleMeta.Count})  ▾"
            : _enabledRuleLabels.Count == 0
            ? "  No rules selected  ▾"
            : $"  {_enabledRuleLabels.Count} of {_allRuleMeta.Count} rules  ▾";
        DebouncePersistSessionSettings();
    }

    private void MarkSettingsChangedIfPaused()
    {
        if (_scanState != UiScanState.Paused) return;
        _settingsWarningLabel.Visible = true;
    }

    /// <summary>
    /// Debounce-persist enabled rules to session database (500ms delay).
    /// Matches React UI's useEffect debounce on enabledRules/fileExtensions.
    /// </summary>
    private void DebouncePersistSessionSettings()
    {
        _settingsPersistTimer?.Stop();
        _settingsPersistTimer?.Dispose();
        _settingsPersistTimer = new System.Windows.Forms.Timer { Interval = 500 };
        _settingsPersistTimer.Tick += (_, _) =>
        {
            _settingsPersistTimer?.Stop();
            try
            {
                if (_stateStore.Exists(_activeDbPath))
                    _stateStore.UpdateSessionMeta(_activeDbPath, enabledRules: _enabledRuleLabels);
            }
            catch (Exception ex) { CrashLog.Warn("Failed to persist session settings", ex); }
        };
        _settingsPersistTimer.Start();
    }

    private Color GetTagColor(string type) => type switch
    {
        "CUI" => _theme.TagCUI,
        "CTI" => _theme.TagCTI,
        "ITAR" => _theme.TagITAR,
        "DFARS" => _theme.TagDFARS,
        "Heuristic" => _theme.TagHeuristic,
        _ => _theme.TextSecondary
    };

    private Color GetScoreColor(int score) =>
        score >= DangerScoreThreshold ? _theme.Danger : score >= WarningScoreThreshold ? _theme.Warning : score >= InfoScoreThreshold ? _theme.Info : _theme.TextSecondary;

    /// <summary>Blends foreground over background at given opacity (0..1). Simulates alpha tints for RichTextBox.</summary>
    private static Color BlendColor(Color fg, Color bg, double opacity) => Color.FromArgb(
        Math.Clamp((int)(fg.R * opacity + bg.R * (1 - opacity)), 0, 255),
        Math.Clamp((int)(fg.G * opacity + bg.G * (1 - opacity)), 0, 255),
        Math.Clamp((int)(fg.B * opacity + bg.B * (1 - opacity)), 0, 255));

    /// <summary>Returns a cached Font for the given style, derived from _snippetBox.Font.</summary>
    private Font GetSnippetFont(FontStyle style) => style switch
    {
        FontStyle.Regular => _snippetFontRegular ??= new Font(_snippetBox.Font, FontStyle.Regular),
        FontStyle.Bold => _snippetFontBold ??= new Font(_snippetBox.Font, FontStyle.Bold),
        FontStyle.Italic => _snippetFontItalic ??= new Font(_snippetBox.Font, FontStyle.Italic),
        FontStyle.Bold | FontStyle.Italic => _snippetFontBoldItalic ??= new Font(_snippetBox.Font, FontStyle.Bold | FontStyle.Italic),
        _ => _snippetFontRegular ??= new Font(_snippetBox.Font, FontStyle.Regular) // Fall back to cached Regular to avoid per-call GDI leak
    };

    private void ToggleRulePopover()
    {
        if (_rulePopover != null)
        {
            CloseRulePopover();
            return;
        }
        CloseFileExtPopover(); // close file ext popover if open

        _rulePopover = new Panel
        {
            Width = 440, Height = 480,
            BorderStyle = BorderStyle.FixedSingle,
            BackColor = _theme.SecondaryBg,
        };

        // Position below the rules button
        var loc = _rulesButton.PointToScreen(new Point(0, _rulesButton.Height + 2));
        _rulePopover.Location = PointToClient(loc);

        // Header: count + Select All / Select None
        var header = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, Height = 32, Padding = new Padding(8, 6, 8, 2), WrapContents = false,
            BackColor = _theme.TertiaryBg
        };
        var countLabel = new Label
        {
            Text = $"{_enabledRuleLabels.Count}/{_allRuleMeta.Count} rules enabled",
            AutoSize = true, Font = new Font("Segoe UI", 9f, FontStyle.Bold),
            ForeColor = _theme.TextPrimary
        };
        var selectAllBtn = new LinkLabel
        {
            Text = "Select All", AutoSize = true, LinkColor = _theme.Accent,
            Padding = new Padding(12, 0, 0, 0)
        };
        var selectNoneBtn = new LinkLabel
        {
            Text = "Select None", AutoSize = true, LinkColor = _theme.TextSecondary,
            Padding = new Padding(6, 0, 0, 0)
        };
        header.Controls.AddRange([countLabel, selectAllBtn, selectNoneBtn]);

        // ── Quick-select: Aggressiveness tier ──
        var tierBar = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, Height = 32, Padding = new Padding(8, 4, 8, 4),
            WrapContents = false, BackColor = _theme.SecondaryBg
        };
        var tierLabel = new Label
        {
            Text = "AGGRESSIVENESS:", AutoSize = true,
            Font = new Font("Segoe UI", 7.5f, FontStyle.Bold),
            ForeColor = _theme.TextMuted, Padding = new Padding(0, 4, 6, 0)
        };
        tierBar.Controls.Add(tierLabel);
        var tierColors = new Dictionary<string, Color>
        {
            ["low"] = ColorTranslator.FromHtml("#22c55e"),
            ["medium"] = ColorTranslator.FromHtml("#eab308"),
            ["high"] = ColorTranslator.FromHtml("#ef4444")
        };
        var tierEmojis = new Dictionary<string, string>
        {
            ["low"] = "Low",
            ["medium"] = "Medium",
            ["high"] = "High"
        };
        var tierButtons = new List<(Button Btn, string Tier)>();
        foreach (var tier in new[] { "low", "medium", "high" })
        {
            var btn = new Button
            {
                Text = tierEmojis[tier], Height = 24, AutoSize = true,
                FlatStyle = FlatStyle.Flat, Cursor = Cursors.Hand,
                Font = new Font("Segoe UI", 8.5f, FontStyle.Bold),
                Margin = new Padding(2, 0, 2, 0), Padding = new Padding(6, 0, 6, 0)
            };
            btn.FlatAppearance.BorderSize = 1;
            tierButtons.Add((btn, tier));
            tierBar.Controls.Add(btn);
        }

        // ── Quick-select: Category ──
        var catBar = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, Height = 32, Padding = new Padding(8, 4, 8, 4),
            WrapContents = false, BackColor = _theme.SecondaryBg
        };
        var catLabel = new Label
        {
            Text = "CATEGORY:", AutoSize = true,
            Font = new Font("Segoe UI", 7.5f, FontStyle.Bold),
            ForeColor = _theme.TextMuted, Padding = new Padding(0, 4, 6, 0)
        };
        catBar.Controls.Add(catLabel);
        var catButtons = new List<(Button Btn, string Cat)>();
        foreach (var cat in new[] { "CUI", "CTI", "ITAR", "DFARS" })
        {
            var btn = new Button
            {
                Text = cat, Height = 24, AutoSize = true,
                FlatStyle = FlatStyle.Flat, Cursor = Cursors.Hand,
                Font = new Font("Segoe UI", 8.5f, FontStyle.Bold),
                Margin = new Padding(2, 0, 2, 0), Padding = new Padding(6, 0, 6, 0)
            };
            btn.FlatAppearance.BorderSize = 1;
            catButtons.Add((btn, cat));
            catBar.Controls.Add(btn);
        }

        // Scrollable body
        var body = new Panel { Dock = DockStyle.Fill, AutoScroll = true };
        var list = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, AutoSize = true, FlowDirection = FlowDirection.TopDown,
            WrapContents = false, Width = 420
        };

        var typeOrder = new[] { "CUI", "CTI", "ITAR", "DFARS", "Heuristic" };
        var grouped = _allRuleMeta.GroupBy(r => r.Type)
            .ToDictionary(g => g.Key, g => g.OrderByDescending(r => r.Score).ToList());

        var ruleCheckboxes = new List<(CheckBox Cb, string Label)>();
        var typeCheckboxes = new List<(CheckBox Cb, string Type, List<string> Labels, List<CheckBox> RuleCbs)>();

        foreach (var type in typeOrder)
        {
            if (!grouped.TryGetValue(type, out var rules)) continue;
            var clr = GetTagColor(type);
            var typeLabels = rules.Select(r => r.Label).ToList();

            // Type group header
            var groupHeader = new Panel
            {
                Width = 418, Height = 28, BackColor = Color.FromArgb(20, clr), Padding = new Padding(8, 4, 8, 2)
            };
            var typeCb = new CheckBox
            {
                Checked = typeLabels.All(l => _enabledRuleLabels.Contains(l)),
                AutoSize = true, ForeColor = clr,
                Font = new Font("Segoe UI", 9f, FontStyle.Bold),
                Text = $" {type}  ({typeLabels.Count(l => _enabledRuleLabels.Contains(l))}/{rules.Count})"
            };
            groupHeader.Controls.Add(typeCb);
            list.Controls.Add(groupHeader);

            var capturedTypeLabels = typeLabels;
            var capturedRuleCbs = new List<CheckBox>();

            // Individual rule rows
            foreach (var rule in rules)
            {
                var ruleRow = new Panel { Width = 418, Height = 24, Padding = new Padding(28, 2, 8, 2) };
                var ruleCb = new CheckBox
                {
                    Checked = _enabledRuleLabels.Contains(rule.Label),
                    Text = rule.Label,
                    AutoSize = false, Width = 320, Height = 20,
                    ForeColor = _enabledRuleLabels.Contains(rule.Label) ? _theme.TextPrimary : _theme.TextSecondary,
                    Font = new Font("Segoe UI", 8.5f)
                };
                var scoreLabel = new Label
                {
                    Text = $"Score: {rule.Score}",
                    ForeColor = GetScoreColor(rule.Score),
                    Font = new Font("Cascadia Code", 9f, FontStyle.Bold),
                    AutoSize = true, Dock = DockStyle.Right,
                    TextAlign = ContentAlignment.MiddleRight,
                    Padding = new Padding(0, 2, 4, 0)
                };

                capturedRuleCbs.Add(ruleCb);
                ruleCheckboxes.Add((ruleCb, rule.Label));
                ruleRow.Controls.Add(scoreLabel);
                ruleRow.Controls.Add(ruleCb);
                list.Controls.Add(ruleRow);
            }

            typeCheckboxes.Add((typeCb, type, capturedTypeLabels, capturedRuleCbs));
        }

        // Guard flag to prevent re-entrant CheckedChanged cascades when SyncAllControls updates checkboxes
        var suppressRuleSync = false;

        // Wire up type checkbox toggling
        foreach (var (typeCb, type, labels, ruleCbs) in typeCheckboxes)
        {
            var capturedLabels = labels;
            typeCb.CheckedChanged += (_, _) =>
            {
                if (suppressRuleSync) return;
                foreach (var l in capturedLabels)
                {
                    if (typeCb.Checked) _enabledRuleLabels.Add(l);
                    else _enabledRuleLabels.Remove(l);
                }
                suppressRuleSync = true;
                try { SyncAllControls(); }
                finally { suppressRuleSync = false; }
            };
        }

        // Wire up individual rule checkboxes
        foreach (var (cb, label) in ruleCheckboxes)
        {
            var capturedLabel = label;
            cb.CheckedChanged += (_, _) =>
            {
                if (suppressRuleSync) return;
                if (cb.Checked) _enabledRuleLabels.Add(capturedLabel);
                else _enabledRuleLabels.Remove(capturedLabel);
                suppressRuleSync = true;
                try { SyncAllControls(); }
                finally { suppressRuleSync = false; }
            };
        }

        // ── Helper: sync all UI controls with current _enabledRuleLabels ──
        void SyncAllControls()
        {
            foreach (var (cb, label) in ruleCheckboxes)
            {
                cb.Checked = _enabledRuleLabels.Contains(label);
                cb.ForeColor = cb.Checked ? _theme.TextPrimary : _theme.TextSecondary;
            }
            foreach (var (typeCb, type, labels, _) in typeCheckboxes)
            {
                var enabledCount = labels.Count(l => _enabledRuleLabels.Contains(l));
                typeCb.Checked = enabledCount == labels.Count;
                typeCb.Text = $" {type}  ({enabledCount}/{labels.Count})";
            }
            countLabel.Text = $"{_enabledRuleLabels.Count}/{_allRuleMeta.Count} rules enabled";

            // Style quick-select tier buttons
            foreach (var (btn, tier) in tierButtons)
            {
                var includedTiers = tier == "low" ? new[] { "low" }
                    : tier == "medium" ? new[] { "low", "medium" }
                    : new[] { "low", "medium", "high" };
                var tierRules = _allRuleMeta.Where(r => includedTiers.Contains(r.Tier)).ToList();
                var nonTierRules = _allRuleMeta.Where(r => !includedTiers.Contains(r.Tier)).ToList();
                var isActive = tierRules.Count > 0
                    && tierRules.All(r => _enabledRuleLabels.Contains(r.Label))
                    && nonTierRules.All(r => !_enabledRuleLabels.Contains(r.Label));
                var clr = tierColors[tier];
                btn.FlatAppearance.BorderColor = isActive ? clr : _theme.Border;
                btn.FlatAppearance.BorderSize = isActive ? 2 : 1;
                btn.BackColor = isActive ? Color.FromArgb(34, clr) : Color.Transparent;
                btn.ForeColor = isActive ? clr : _theme.TextMuted;
            }

            // Style quick-select category buttons
            foreach (var (btn, cat) in catButtons)
            {
                var catRules = _allRuleMeta.Where(r => r.AppliesTo.Contains(cat)).ToList();
                var nonCatRules = _allRuleMeta.Where(r => !r.AppliesTo.Contains(cat)).ToList();
                var isActive = catRules.Count > 0
                    && catRules.All(r => _enabledRuleLabels.Contains(r.Label))
                    && nonCatRules.All(r => !_enabledRuleLabels.Contains(r.Label));
                var clr = GetTagColor(cat);
                btn.FlatAppearance.BorderColor = isActive ? clr : _theme.Border;
                btn.FlatAppearance.BorderSize = isActive ? 2 : 1;
                btn.BackColor = isActive ? Color.FromArgb(34, clr) : Color.Transparent;
                btn.ForeColor = isActive ? clr : _theme.TextMuted;
            }

            UpdateRulesButtonText();
            MarkSettingsChangedIfPaused();
        }

        // ── Wire quick-select tier buttons ──
        foreach (var (btn, tier) in tierButtons)
        {
            var capturedTier = tier;
            btn.Click += (_, _) =>
            {
                var includedTiers = capturedTier == "low" ? new[] { "low" }
                    : capturedTier == "medium" ? new[] { "low", "medium" }
                    : new[] { "low", "medium", "high" };
                _enabledRuleLabels.Clear();
                foreach (var r in _allRuleMeta)
                    if (includedTiers.Contains(r.Tier))
                        _enabledRuleLabels.Add(r.Label);
                SyncAllControls();
            };
        }

        // ── Wire quick-select category buttons ──
        foreach (var (btn, cat) in catButtons)
        {
            var capturedCat = cat;
            btn.Click += (_, _) =>
            {
                _enabledRuleLabels.Clear();
                foreach (var r in _allRuleMeta)
                    if (r.AppliesTo.Contains(capturedCat))
                        _enabledRuleLabels.Add(r.Label);
                SyncAllControls();
            };
        }

        selectAllBtn.LinkClicked += (_, _) =>
        {
            foreach (var r in _allRuleMeta) _enabledRuleLabels.Add(r.Label);
            SyncAllControls();
        };
        selectNoneBtn.LinkClicked += (_, _) =>
        {
            _enabledRuleLabels.Clear();
            SyncAllControls();
        };

        // Initial quick-select button styling
        SyncAllControls();

        body.Controls.Add(list);
        _rulePopover.Controls.Add(body);
        _rulePopover.Controls.Add(catBar);
        _rulePopover.Controls.Add(tierBar);
        _rulePopover.Controls.Add(header);

        Controls.Add(_rulePopover);
        _rulePopover.BringToFront();
    }

    private void CloseRulePopover()
    {
        if (_rulePopover == null) return;
        Controls.Remove(_rulePopover);
        _rulePopover.Dispose();
        _rulePopover = null;
    }

    // ═══════════════════════════════════════════════════════════
    //  Detection Rules JSON Editor
    // ═══════════════════════════════════════════════════════════

    private static readonly Regex JsonTokenRegex = new(
        @"(""(?:[^""\\]|\\.)*"")\s*:" +      // key: "key":
        @"|:\s*(""(?:[^""\\]|\\.)*"")" +       // string value: : "value"
        @"|:\s*(-?\d+(?:\.\d+)?)" +            // number value: : 123
        @"|:\s*(true|false|null)" +            // bool/null
        @"|([{}\[\],])" +                      // structural chars
        @"|(//[^\n]*|/\*[\s\S]*?\*/)",         // comments (rare in JSON but harmless)
        RegexOptions.Compiled);

    private void ShowRuleEditor()
    {
        // If already open, just focus it
        if (_ruleEditorForm is { IsDisposed: false })
        {
            _ruleEditorForm.Focus();
            return;
        }

        var json = File.Exists(PatternLibrary.GetRulesFilePath())
            ? File.ReadAllText(PatternLibrary.GetRulesFilePath())
            : PatternLibrary.GetDefaultConfigJson();

        // ── Build the editor Form ──
        _ruleEditorForm = new Form
        {
            Text = "Detection Rules Editor \u2014 CUIckScan",
            Size = new Size(940, 720),
            MinimumSize = new Size(600, 400),
            StartPosition = FormStartPosition.CenterParent,
            BackColor = _theme.PrimaryBg,
            ForeColor = _theme.TextPrimary,
            FormBorderStyle = FormBorderStyle.Sizable,
            ShowInTaskbar = false,
            Icon = Icon
        };

        _ruleEditorDirty = false;

        // ── Toolbar ──
        var toolbar = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, Height = 42, Padding = new Padding(8, 6, 8, 4),
            BackColor = _theme.SecondaryBg, WrapContents = false
        };

        _ruleEditorStatus = new Label
        {
            Text = "Ready", AutoSize = true, Padding = new Padding(0, 5, 12, 0),
            ForeColor = _theme.TextSecondary, Font = new Font("Segoe UI", 9f)
        };

        var verifyBtn = new Button { Text = "Verify Syntax", Width = 110, Height = 30 };
        var revertBtn = new Button { Text = "Revert to Defaults", Width = 135, Height = 30 };
        _ruleEditorSaveBtn = new Button { Text = "Save Rules", Width = 100, Height = 30, Enabled = false };
        var closeBtn = new Button { Text = "Close", Width = 70, Height = 30 };

        StyleEditorButton(verifyBtn, _theme.Info);
        StyleEditorButton(revertBtn, _theme.Warning);
        StyleEditorButton(_ruleEditorSaveBtn, _theme.Success);
        StyleEditorButton(closeBtn, _theme.Border);
        closeBtn.ForeColor = _theme.TextPrimary;

        // ── Search controls ──
        _ruleEditorSearchBox = new TextBox
        {
            Width = 160, Height = 24, Margin = new Padding(8, 4, 2, 0),
            PlaceholderText = "Search…"
        };
        StyleInput(_ruleEditorSearchBox);
        _ruleEditorSearchCount = new Label
        {
            Text = "", AutoSize = true, Padding = new Padding(0, 6, 4, 0),
            ForeColor = _theme.TextMuted, Font = new Font("Segoe UI", 8.5f)
        };
        var searchPrev = new Button { Text = "▲", Width = 28, Height = 26, Margin = new Padding(0, 2, 0, 0) };
        var searchNext = new Button { Text = "▼", Width = 28, Height = 26, Margin = new Padding(0, 2, 0, 0) };
        StyleEditorButton(searchPrev, _theme.Border);
        searchPrev.ForeColor = _theme.TextPrimary;
        StyleEditorButton(searchNext, _theme.Border);
        searchNext.ForeColor = _theme.TextPrimary;

        toolbar.Controls.AddRange([
            _ruleEditorStatus, _ruleEditorSearchBox, _ruleEditorSearchCount, searchPrev, searchNext,
            verifyBtn, revertBtn, _ruleEditorSaveBtn, closeBtn
        ]);

        // ── Footer ──
        _ruleEditorFooter = new Label
        {
            Dock = DockStyle.Bottom, Height = 26, Padding = new Padding(12, 4, 12, 4),
            BackColor = _theme.SecondaryBg, ForeColor = _theme.TextMuted,
            Font = new Font("Segoe UI", 8.5f), TextAlign = ContentAlignment.MiddleLeft
        };

        // ── Editor area ──
        var editorPanel = new Panel { Dock = DockStyle.Fill };

        _lineNumberGutter = new Panel
        {
            Dock = DockStyle.Left, Width = 52, BackColor = _theme.TertiaryBg
        };

        _ruleEditorRtb = new RichTextBox
        {
            Dock = DockStyle.Fill,
            Font = new Font("Cascadia Code", 11f),
            WordWrap = false,
            AcceptsTab = true,
            DetectUrls = false,
            ScrollBars = RichTextBoxScrollBars.Both,
            BorderStyle = BorderStyle.None,
            BackColor = _theme.PrimaryBg,
            ForeColor = _theme.TextPrimary,
            ShortcutsEnabled = true,
            HideSelection = false // keep search selection visible while typing in search box
        };

        // Populate editor text and apply initial highlighting
        _ruleEditorRtb.Text = json;
        UpdateRuleEditorFooter();

        editorPanel.Controls.Add(_ruleEditorRtb);
        editorPanel.Controls.Add(_lineNumberGutter);

        _ruleEditorForm.Controls.Add(editorPanel);
        _ruleEditorForm.Controls.Add(_ruleEditorFooter);
        _ruleEditorForm.Controls.Add(toolbar);

        // ── Debounce timer for syntax highlighting + footer update ──
        _highlightTimer = new System.Windows.Forms.Timer { Interval = 400 };
        _highlightTimer.Tick += (_, _) =>
        {
            _highlightTimer.Stop();
            // Refresh search positions BEFORE highlighting so RTF includes search backgrounds
            if (_ruleEditorSearchBox != null && !string.IsNullOrEmpty(_ruleEditorSearchBox.Text))
                RefreshSearchMatches(preserveIndex: true);
            ApplyJsonHighlighting();
            UpdateRuleEditorFooter();
        };

        // ── Wire events (keep TextChanged lightweight — no parsing, no highlighting) ──
        _ruleEditorRtb.TextChanged += (_, _) =>
        {
            if (_suppressEditorEvents) return; // ignore TextChanged fired by RTF/highlighting updates
            if (!_ruleEditorDirty)
            {
                _ruleEditorDirty = true;
                if (_ruleEditorSaveBtn != null) _ruleEditorSaveBtn.Enabled = true;
            }
            _highlightTimer?.Stop();
            _highlightTimer?.Start();
        };

        _ruleEditorRtb.VScroll += (_, _) => _lineNumberGutter?.Invalidate();
        _ruleEditorRtb.Resize += (_, _) => _lineNumberGutter?.Invalidate();

        _lineNumberGutter.Paint += PaintLineNumbers;

        verifyBtn.Click += (_, _) => VerifyRulesSyntax();
        revertBtn.Click += (_, _) => RevertRulesToDefaults();
        _ruleEditorSaveBtn.Click += (_, _) => SaveRulesFromEditor();
        closeBtn.Click += (_, _) => CloseRuleEditor();

        // ── Search event wiring ──
        _ruleEditorSearchBox.TextChanged += (_, _) => UpdateEditorSearch();
        searchPrev.Click += (_, _) => NavigateEditorSearch(-1);
        searchNext.Click += (_, _) => NavigateEditorSearch(1);
        _ruleEditorSearchBox.KeyDown += (_, e) =>
        {
            if (e.KeyCode == Keys.Enter)
            {
                NavigateEditorSearch(e.Shift ? -1 : 1);
                e.SuppressKeyPress = true;
            }
            if (e.KeyCode == Keys.Escape)
            {
                _ruleEditorSearchBox.Text = "";
                _ruleEditorRtb?.Focus();
                e.SuppressKeyPress = true;
            }
        };

        // Ctrl+F focuses the search box
        _ruleEditorForm.KeyPreview = true;
        _ruleEditorForm.KeyDown += (_, e) =>
        {
            if (e.Control && e.KeyCode == Keys.F)
            {
                _ruleEditorSearchBox?.Focus();
                _ruleEditorSearchBox?.SelectAll();
                e.SuppressKeyPress = true;
            }
        };

        _ruleEditorForm.FormClosing += (_, e) =>
        {
            if (_ruleEditorDirty)
            {
                var result = MessageBox.Show("You have unsaved changes. Discard?", "Unsaved Changes",
                    MessageBoxButtons.YesNo, MessageBoxIcon.Warning);
                if (result == DialogResult.No) { e.Cancel = true; return; }
            }
            _highlightTimer?.Stop();
            _highlightTimer?.Dispose();
            _highlightTimer = null;
            _searchMatches.Clear();
            _searchIndex = -1;
        };

        // Initial syntax highlight (deferred so form paints first)
        _ruleEditorForm.Shown += (_, _) =>
        {
            ApplyJsonHighlighting();
            UpdateRuleEditorFooter();
            _ruleEditorDirty = false;
            if (_ruleEditorSaveBtn != null) _ruleEditorSaveBtn.Enabled = false;
        };

        _ruleEditorForm.Show(this);
    }

    private void StyleEditorButton(Button b, Color accentColor)
    {
        b.FlatStyle = FlatStyle.Flat;
        b.FlatAppearance.BorderSize = 0;
        b.BackColor = accentColor;
        b.ForeColor = Color.White;
        SafeSetFont(b, new Font("Segoe UI", 9f, FontStyle.Regular));
        b.Margin = new Padding(4, 0, 0, 0);
        b.Cursor = Cursors.Hand;
    }

    private void ApplyJsonHighlighting()
    {
        if (_ruleEditorRtb is null || _ruleEditorRtb.IsDisposed) return;

        var text = _ruleEditorRtb.Text;
        if (string.IsNullOrEmpty(text)) return;

        // Save caret and scroll BEFORE any changes
        var caretPos = _ruleEditorRtb.SelectionStart;
        var scrollPos = GetRtbScrollPos(_ruleEditorRtb);

        // Build RTF string directly — orders of magnitude faster than Select()+SelectionColor per token.
        // Each character gets a color via the RTF color table; we assemble the full document in memory
        // and assign it in a single Rtf setter call (one layout pass instead of hundreds).
        var keyColor = _darkMode ? ColorTranslator.FromHtml("#7dd3fc") : ColorTranslator.FromHtml("#0369a1");
        var stringColor = _darkMode ? ColorTranslator.FromHtml("#86efac") : ColorTranslator.FromHtml("#166534");
        var numberColor = _darkMode ? ColorTranslator.FromHtml("#fbbf24") : ColorTranslator.FromHtml("#b45309");
        var boolColor = _darkMode ? ColorTranslator.FromHtml("#c4b5fd") : ColorTranslator.FromHtml("#7c3aed");
        var structColor = _theme.TextMuted;
        var defaultColor = _theme.TextSecondary;
        var bgColor = _ruleEditorRtb.BackColor;

        // Build per-character color index: 0=default, 1=key, 2=string, 3=number, 4=bool, 5=struct
        var colorIndex = new byte[text.Length];
        var matches = JsonTokenRegex.Matches(text);
        foreach (Match m in matches)
        {
            byte ci; int start, length;
            if (m.Groups[1].Success) { ci = 1; start = m.Groups[1].Index; length = m.Groups[1].Length; }
            else if (m.Groups[2].Success) { ci = 2; start = m.Groups[2].Index; length = m.Groups[2].Length; }
            else if (m.Groups[3].Success) { ci = 3; start = m.Groups[3].Index; length = m.Groups[3].Length; }
            else if (m.Groups[4].Success) { ci = 4; start = m.Groups[4].Index; length = m.Groups[4].Length; }
            else if (m.Groups[5].Success) { ci = 5; start = m.Groups[5].Index; length = m.Groups[5].Length; }
            else if (m.Groups[6].Success) { ci = 5; start = m.Groups[6].Index; length = m.Groups[6].Length; }
            else continue;
            for (var i = start; i < start + length && i < colorIndex.Length; i++) colorIndex[i] = ci;
        }

        // Build per-character background index for search highlights:
        // 0=default bg, 1=match bg (amber tint), 2=current match bg (brighter amber)
        var bgIndex = new byte[text.Length];
        var searchTerm = _ruleEditorSearchBox?.Text;
        if (!string.IsNullOrEmpty(searchTerm) && _searchMatches.Count > 0)
        {
            for (var mi = 0; mi < _searchMatches.Count; mi++)
            {
                var bg = (byte)(mi == _searchIndex ? 2 : 1);
                var mStart = _searchMatches[mi];
                for (var i = mStart; i < mStart + searchTerm.Length && i < bgIndex.Length; i++)
                    bgIndex[i] = bg;
            }
        }

        // Search highlight colors
        var matchBg = BlendColor(_theme.Warning, bgColor, 0.20);
        var currentMatchBg = BlendColor(_theme.Warning, bgColor, 0.45);

        // Assemble RTF: header + color table + font table + body
        var fontName = _ruleEditorRtb.Font.FontFamily.Name;
        var fontSize = (int)(_ruleEditorRtb.Font.SizeInPoints * 2); // RTF uses half-points

        var sb = new System.Text.StringBuilder(text.Length * 3);
        sb.Append(@"{\rtf1\ansi\deff0");
        // Font table
        sb.Append(@"{\fonttbl{\f0 ").Append(fontName).Append(@";}}");
        // Color table: cf1-cf6=text, cf7=default bg, cf8=search match bg, cf9=current match bg
        sb.Append(@"{\colortbl ;");
        AppendRtfColor(sb, defaultColor);   // \cf1
        AppendRtfColor(sb, keyColor);       // \cf2
        AppendRtfColor(sb, stringColor);    // \cf3
        AppendRtfColor(sb, numberColor);    // \cf4
        AppendRtfColor(sb, boolColor);      // \cf5
        AppendRtfColor(sb, structColor);    // \cf6
        AppendRtfColor(sb, bgColor);        // \cf7 (default background)
        AppendRtfColor(sb, matchBg);        // \cf8 (search match background)
        AppendRtfColor(sb, currentMatchBg); // \cf9 (current search match background)
        sb.Append('}');
        // Default formatting
        sb.Append(@"\f0\fs").Append(fontSize);
        sb.Append(@"\cb7\cf1 "); // default text color + background

        // Body — run-length encode by foreground color AND background color to minimize RTF switches
        byte currentCi = 255; // force initial switch
        byte currentBi = 255; // force initial switch
        for (var i = 0; i < text.Length; i++)
        {
            var ci = colorIndex[i];
            var bi = bgIndex[i];
            if (ci != currentCi)
            {
                currentCi = ci;
                sb.Append(@"\cf").Append(ci + 1).Append(' '); // +1 because RTF colortbl is 1-indexed (0 = auto)
            }
            if (bi != currentBi)
            {
                currentBi = bi;
                sb.Append(@"\cb").Append(bi + 7).Append(' '); // 0→7 (default), 1→8 (match), 2→9 (current)
            }

            var ch = text[i];
            switch (ch)
            {
                case '\\': sb.Append(@"\\"); break;
                case '{': sb.Append(@"\{"); break;
                case '}': sb.Append(@"\}"); break;
                case '\n': sb.Append(@"\par "); break;
                case '\r': break; // skip CR, \par handles line breaks
                case '\t': sb.Append(@"\tab "); break;
                default:
                    if (ch > 127)
                        sb.Append(@"\u").Append((int)ch).Append('?');
                    else
                        sb.Append(ch);
                    break;
            }
        }
        sb.Append('}');

        // Suppress repaints and TextChanged events during Rtf assignment
        _suppressEditorEvents = true;
        SendMessage(_ruleEditorRtb.Handle, WM_SETREDRAW, IntPtr.Zero, IntPtr.Zero);
        try
        {
            _ruleEditorRtb.Rtf = sb.ToString();
            _ruleEditorRtb.Select(Math.Min(caretPos, _ruleEditorRtb.TextLength), 0);
        }
        finally
        {
            SendMessage(_ruleEditorRtb.Handle, WM_SETREDRAW, (IntPtr)1, IntPtr.Zero);
            _suppressEditorEvents = false;
            _ruleEditorRtb.Invalidate();
        }

        // Restore scroll position
        SetRtbScrollPos(_ruleEditorRtb, scrollPos);
        _lineNumberGutter?.Invalidate();
    }

    private static void AppendRtfColor(System.Text.StringBuilder sb, Color c)
    {
        sb.Append(@"\red").Append(c.R).Append(@"\green").Append(c.G).Append(@"\blue").Append(c.B).Append(';');
    }

    private static Point GetRtbScrollPos(RichTextBox rtb)
    {
        var pt = new POINT();
        SendMessage(rtb.Handle, 0x04DD /* EM_GETSCROLLPOS */, IntPtr.Zero, ref pt);
        return new Point(pt.X, pt.Y);
    }

    private static void SetRtbScrollPos(RichTextBox rtb, Point pos)
    {
        var pt = new POINT { X = pos.X, Y = pos.Y };
        SendMessage(rtb.Handle, 0x04DE /* EM_SETSCROLLPOS */, IntPtr.Zero, ref pt);
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct POINT { public int X; public int Y; }

    [DllImport("user32.dll", CharSet = CharSet.Auto)]
    private static extern IntPtr SendMessage(IntPtr hWnd, int msg, IntPtr wParam, ref POINT lParam);

    // Cached resources for line number painting (avoid allocation per Paint event)
    private Font? _gutterFont;
    private SolidBrush? _gutterBrush;
    private static readonly StringFormat GutterFormat = new(StringFormatFlags.NoWrap) { Alignment = StringAlignment.Far };

    private void PaintLineNumbers(object? sender, PaintEventArgs e)
    {
        if (_ruleEditorRtb is null || _lineNumberGutter is null) return;

        var g = e.Graphics;
        g.Clear(_theme.TertiaryBg);

        _gutterFont ??= new Font("Cascadia Code", 11f);
        if (_gutterBrush is null || _gutterBrush.Color != _theme.TextMuted)
        {
            _gutterBrush?.Dispose();
            _gutterBrush = new SolidBrush(_theme.TextMuted);
        }

        // Get the character index at the top of the visible area
        var firstCharIndex = _ruleEditorRtb.GetCharIndexFromPosition(new Point(0, 0));
        var firstLine = _ruleEditorRtb.GetLineFromCharIndex(firstCharIndex);

        // Get line height by measuring two consecutive line positions
        var lineHeight = _ruleEditorRtb.Font.Height;
        var pos0 = _ruleEditorRtb.GetPositionFromCharIndex(_ruleEditorRtb.GetFirstCharIndexFromLine(firstLine));
        if (firstLine + 1 < _ruleEditorRtb.Lines.Length)
        {
            var pos1 = _ruleEditorRtb.GetPositionFromCharIndex(_ruleEditorRtb.GetFirstCharIndexFromLine(firstLine + 1));
            lineHeight = Math.Max(pos1.Y - pos0.Y, lineHeight);
        }

        var totalLines = _ruleEditorRtb.Lines.Length;
        var visibleHeight = _ruleEditorRtb.ClientSize.Height;
        var gutterWidth = _lineNumberGutter.Width;
        var y = pos0.Y;

        for (var line = firstLine; line < totalLines && y < visibleHeight; line++)
        {
            var rect = new RectangleF(0, y, gutterWidth - 8, lineHeight);
            g.DrawString((line + 1).ToString(), _gutterFont, _gutterBrush, rect, GutterFormat);
            y += lineHeight;
        }
    }

    private void VerifyRulesSyntax()
    {
        if (_ruleEditorRtb is null || _ruleEditorStatus is null) return;

        var text = _ruleEditorRtb.Text;
        if (string.IsNullOrWhiteSpace(text))
        {
            _ruleEditorStatus.Text = "\u2717 No JSON content";
            _ruleEditorStatus.ForeColor = _theme.Danger;
            return;
        }

        var (valid, error) = PatternLibrary.ValidateRulesJson(text);
        if (valid)
        {
            var config = PatternLibrary.DeserializeConfig(text);
            var count = config?.EffectivePatterns.Count ?? 0;
            _ruleEditorStatus.Text = $"\u2713 Valid JSON \u2014 {count} rules";
            _ruleEditorStatus.ForeColor = _theme.Success;
        }
        else
        {
            _ruleEditorStatus.Text = $"\u2717 {error}";
            _ruleEditorStatus.ForeColor = _theme.Danger;
        }
    }

    private void RevertRulesToDefaults()
    {
        if (_ruleEditorRtb is null) return;

        var result = MessageBox.Show("Revert to built-in default rules?", "Revert Rules",
            MessageBoxButtons.YesNo, MessageBoxIcon.Question);
        if (result != DialogResult.Yes) return;

        var json = PatternLibrary.GetDefaultConfigJson();
        _ruleEditorRtb.Text = json;

        if (_ruleEditorStatus != null)
        {
            _ruleEditorStatus.Text = "Reverted to defaults (unsaved)";
            _ruleEditorStatus.ForeColor = _theme.Warning;
        }
    }

    private void SaveRulesFromEditor()
    {
        if (_ruleEditorRtb is null || _ruleEditorStatus is null) return;

        var text = _ruleEditorRtb.Text;
        var (valid, error) = PatternLibrary.ValidateRulesJson(text);
        if (!valid)
        {
            _ruleEditorStatus.Text = $"\u2717 {error}";
            _ruleEditorStatus.ForeColor = _theme.Danger;
            return;
        }

        var config = PatternLibrary.DeserializeConfig(text);
        if (config is null)
        {
            _ruleEditorStatus.Text = "\u2717 Failed to parse rules";
            _ruleEditorStatus.ForeColor = _theme.Danger;
            return;
        }

        try
        {
            var path = PatternLibrary.GetRulesFilePath();
            File.WriteAllText(path, PatternLibrary.SerializeConfig(config));

            // Hot-reload patterns into the active scanner
            _scanner.Patterns.LoadFromConfig(config);
            _allRuleMeta = _scanner.Patterns.GetAllRuleMetadata();

            // Re-enable all newly-loaded rules by default
            _enabledRuleLabels.Clear();
            foreach (var rule in _allRuleMeta) _enabledRuleLabels.Add(rule.Label);
            UpdateRulesButtonText();

            var count = config.EffectivePatterns.Count;
            _ruleEditorStatus.Text = $"\u2713 Saved and loaded {count} rules";
            _ruleEditorStatus.ForeColor = _theme.Success;
            _ruleEditorDirty = false;
            if (_ruleEditorSaveBtn != null) _ruleEditorSaveBtn.Enabled = false;

            CrashLog.Audit("RULES_SAVED", $"Saved {count} detection rules from editor");
        }
        catch (Exception ex)
        {
            CrashLog.Error("Failed to save rules from editor", ex);
            _ruleEditorStatus.Text = $"\u2717 Save failed: {ex.Message}";
            _ruleEditorStatus.ForeColor = _theme.Danger;
        }
    }

    private void CloseRuleEditor()
    {
        _ruleEditorForm?.Close();
    }

    // ─── Editor search ───

    /// <summary>Recalculates search match positions from the current editor text. Does not trigger highlighting.</summary>
    private void RefreshSearchMatches(bool preserveIndex)
    {
        var oldPos = (_searchIndex >= 0 && _searchIndex < _searchMatches.Count)
            ? _searchMatches[_searchIndex] : -1;

        _searchMatches.Clear();
        _searchIndex = -1;

        if (_ruleEditorSearchBox is null || _ruleEditorRtb is null || _ruleEditorSearchCount is null) return;

        var term = _ruleEditorSearchBox.Text;
        if (string.IsNullOrEmpty(term))
        {
            _ruleEditorSearchCount.Text = "";
            return;
        }

        var text = _ruleEditorRtb.Text;
        var pos = 0;
        while (true)
        {
            pos = text.IndexOf(term, pos, StringComparison.OrdinalIgnoreCase);
            if (pos < 0) break;
            _searchMatches.Add(pos);
            pos += term.Length;
        }

        if (_searchMatches.Count > 0)
        {
            if (preserveIndex && oldPos >= 0)
            {
                // Find closest match to previous position
                _searchIndex = 0;
                var minDist = int.MaxValue;
                for (var i = 0; i < _searchMatches.Count; i++)
                {
                    var dist = Math.Abs(_searchMatches[i] - oldPos);
                    if (dist < minDist) { minDist = dist; _searchIndex = i; }
                }
            }
            else
            {
                _searchIndex = 0;
            }
            _ruleEditorSearchCount.Text = $"{_searchIndex + 1} of {_searchMatches.Count}";
            _ruleEditorSearchCount.ForeColor = _theme.TextSecondary;
        }
        else
        {
            _ruleEditorSearchCount.Text = "No matches";
            _ruleEditorSearchCount.ForeColor = _theme.Danger;
        }
    }

    /// <summary>Called from search box TextChanged — recalculates matches and rebuilds RTF with highlights.</summary>
    private void UpdateEditorSearch()
    {
        RefreshSearchMatches(preserveIndex: false);
        ApplyJsonHighlighting();
        ScrollToCurrentSearchMatch();
    }

    private void NavigateEditorSearch(int direction)
    {
        if (_searchMatches.Count == 0 || _ruleEditorSearchCount is null) return;
        _searchIndex = (_searchIndex + direction + _searchMatches.Count) % _searchMatches.Count;
        _ruleEditorSearchCount.Text = $"{_searchIndex + 1} of {_searchMatches.Count}";
        ApplyJsonHighlighting();
        ScrollToCurrentSearchMatch();
    }

    private void ScrollToCurrentSearchMatch()
    {
        if (_ruleEditorRtb is null || _searchIndex < 0 || _searchIndex >= _searchMatches.Count) return;
        var term = _ruleEditorSearchBox?.Text;
        if (string.IsNullOrEmpty(term)) return;

        _suppressEditorEvents = true;
        try
        {
            _ruleEditorRtb.Select(_searchMatches[_searchIndex], term.Length);
            _ruleEditorRtb.ScrollToCaret();
        }
        finally
        {
            _suppressEditorEvents = false;
        }
    }

    private void UpdateRuleEditorFooter()
    {
        if (_ruleEditorFooter is null || _ruleEditorRtb is null) return;
        var lineCount = _ruleEditorRtb.Lines.Length;

        // Try to get rule count from current text
        int ruleCount = 0;
        try
        {
            var config = PatternLibrary.DeserializeConfig(_ruleEditorRtb.Text);
            ruleCount = config?.EffectivePatterns.Count ?? 0;
        }
        catch { }

        _ruleEditorFooter.Text = $"  {lineCount} lines  |  {ruleCount} rules  |  Each rule needs: label, type, score, and terms or regex";
    }

    // ═══════════════════════════════════════════════════════════
    //  File Extension popover
    // ═══════════════════════════════════════════════════════════

    private void ToggleFileExtPopover()
    {
        if (_fileExtPopover != null) { CloseFileExtPopover(); return; }
        CloseRulePopover(); // close rules popover if open

        var config = FileTypesConfig.LoadFromDisk();

        _fileExtPopover = new Panel
        {
            Width = 360, Height = 400,
            BorderStyle = BorderStyle.FixedSingle,
            BackColor = _theme.SecondaryBg,
        };
        var loc = _fileExtButton.PointToScreen(new Point(0, _fileExtButton.Height + 2));
        _fileExtPopover.Location = PointToClient(loc);

        var enabledCount = config.Extensions.Count(e => e.Enabled);

        // Header
        var header = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, Height = 32, Padding = new Padding(8, 6, 8, 2), WrapContents = false,
            BackColor = _theme.TertiaryBg
        };
        var countLabel = new Label
        {
            Text = $"{enabledCount}/{config.Extensions.Count} enabled",
            AutoSize = true, Font = new Font("Segoe UI", 9f, FontStyle.Bold),
            ForeColor = _theme.TextPrimary
        };
        var enableAllBtn = new LinkLabel { Text = "Enable All", AutoSize = true, LinkColor = _theme.Accent, Padding = new Padding(12, 0, 0, 0) };
        var disableAllBtn = new LinkLabel { Text = "Disable All", AutoSize = true, LinkColor = _theme.TextSecondary, Padding = new Padding(6, 0, 0, 0) };
        header.Controls.AddRange([countLabel, enableAllBtn, disableAllBtn]);

        // Scrollable body
        var body = new Panel { Dock = DockStyle.Fill, AutoScroll = true };
        var list = new FlowLayoutPanel
        {
            Dock = DockStyle.Top, AutoSize = true, FlowDirection = FlowDirection.TopDown,
            WrapContents = false, Width = 340
        };

        var checkboxes = new List<(CheckBox Cb, FileTypesConfig.ExtensionEntry Entry)>();

        foreach (var ext in config.Extensions.OrderBy(e => e.Ext))
        {
            var row = new Panel { Width = 338, Height = 24, Padding = new Padding(8, 2, 8, 2) };
            var cb = new CheckBox
            {
                Checked = ext.Enabled,
                Text = ext.Ext,
                AutoSize = false, Width = 260, Height = 20,
                ForeColor = ext.Enabled ? _theme.TextPrimary : _theme.TextSecondary,
                Font = new Font("Cascadia Code", 9f)
            };
            if (ext.Custom)
            {
                var customTag = new Label
                {
                    Text = "custom", AutoSize = true, Dock = DockStyle.Right,
                    ForeColor = _theme.Accent, Font = new Font("Segoe UI", 7.5f, FontStyle.Italic),
                    Padding = new Padding(0, 3, 4, 0)
                };
                row.Controls.Add(customTag);
            }
            checkboxes.Add((cb, ext));
            row.Controls.Add(cb);
            list.Controls.Add(row);
        }

        // Wire up checkboxes
        foreach (var (cb, entry) in checkboxes)
        {
            var captured = entry;
            cb.CheckedChanged += (_, _) =>
            {
                captured.Enabled = cb.Checked;
                cb.ForeColor = cb.Checked ? _theme.TextPrimary : _theme.TextSecondary;
                countLabel.Text = $"{config.Extensions.Count(e => e.Enabled)}/{config.Extensions.Count} enabled";
            };
        }

        enableAllBtn.LinkClicked += (_, _) =>
        {
            foreach (var e in config.Extensions) e.Enabled = true;
            foreach (var (cb, _) in checkboxes) cb.Checked = true;
            countLabel.Text = $"{config.Extensions.Count}/{config.Extensions.Count} enabled";
        };
        disableAllBtn.LinkClicked += (_, _) =>
        {
            foreach (var e in config.Extensions) e.Enabled = false;
            foreach (var (cb, _) in checkboxes) cb.Checked = false;
            countLabel.Text = $"0/{config.Extensions.Count} enabled";
        };

        // Save button at bottom
        var footer = new Panel { Dock = DockStyle.Bottom, Height = 36, BackColor = _theme.TertiaryBg, Padding = new Padding(8, 4, 8, 4) };
        var saveBtn = new Button
        {
            Text = "Save", Width = 70, Height = 28, Dock = DockStyle.Right,
            FlatStyle = FlatStyle.Flat, BackColor = _theme.Accent, ForeColor = Color.White,
            Font = new Font("Segoe UI", 9f, FontStyle.Bold)
        };
        saveBtn.FlatAppearance.BorderSize = 0;
        saveBtn.Click += (_, _) =>
        {
            try
            {
                var json = FileTypesConfig.Serialize(config);
                File.WriteAllText(FileTypesConfig.GetFilePath(), json);
                Toast($"Saved {config.Extensions.Count(e => e.Enabled)} of {config.Extensions.Count} file types", _theme.Success);
                MarkSettingsChangedIfPaused();
                // Persist enabled extensions to session database
                try
                {
                    if (_stateStore.Exists(_activeDbPath))
                        _stateStore.UpdateSessionMeta(_activeDbPath, fileExtensions: config.GetEnabledExtensions());
                }
                catch (Exception ex2) { CrashLog.Warn("Failed to persist file extensions to session", ex2); }
                CloseFileExtPopover();
            }
            catch (Exception ex)
            {
                LogWarn("Failed to save file types config", ex);
                Toast("Failed to save file types. Check logs.", _theme.Danger);
            }
        };
        footer.Controls.Add(saveBtn);

        body.Controls.Add(list);
        _fileExtPopover.Controls.Add(body);
        _fileExtPopover.Controls.Add(footer);
        _fileExtPopover.Controls.Add(header);

        Controls.Add(_fileExtPopover);
        _fileExtPopover.BringToFront();
    }

    private void CloseFileExtPopover()
    {
        if (_fileExtPopover == null) return;
        Controls.Remove(_fileExtPopover);
        _fileExtPopover.Dispose();
        _fileExtPopover = null;
    }

    // ═══════════════════════════════════════════════════════════
    //  Result filtering
    // ═══════════════════════════════════════════════════════════

    private void ApplyResultFilters()
    {
        var catIdx = _categoryFilterBox.SelectedIndex;
        var scoreIdx = _scoreFilterBox.SelectedIndex;
        var textFilter = _filterBox.Text.Trim();
        var showFp = _showFalsePositives.Checked;
        var isFiltered = catIdx > 0 || scoreIdx > 0 || textFilter.Length > 0 || !showFp;
        _clearFiltersButton.Visible = isFiltered;

        var catFilter = catIdx > 0 ? _categoryFilterBox.Items[catIdx]!.ToString() : null;
        _filteredResults = _results.Where(r =>
        {
            // Hide false positives unless checkbox is checked
            if (!showFp && r.ReviewStatus == ReviewStatus.FalsePositive) return false;

            // Text filter on file path
            if (textFilter.Length > 0 && r.FilePath.IndexOf(textFilter, StringComparison.OrdinalIgnoreCase) < 0)
                return false;

            // Category filter
            if (catFilter != null && !r.Findings.Any(f =>
                f.Type.ToString().Equals(catFilter, StringComparison.OrdinalIgnoreCase)))
                return false;

            // Score filter — ranges match React UI scoreFilterMin/scoreFilterMax
            return scoreIdx switch
            {
                1 => r.Score >= CriticalSeverityThreshold,                                    // Critical (40+)
                2 => r.Score >= HighSeverityThreshold && r.Score < CriticalSeverityThreshold,  // High (25-39)
                3 => r.Score >= MediumSeverityThreshold && r.Score < HighSeverityThreshold,    // Medium (13-24)
                4 => r.Score < MediumSeverityThreshold,                                        // Low (0-12)
                _ => true
            };
        }).ToList();

        // Update status with hidden FP count
        var fpCount = _results.Count(r => r.ReviewStatus == ReviewStatus.FalsePositive);
        var fpHint = !showFp && fpCount > 0 ? $" · {fpCount} false positive{(fpCount != 1 ? "s" : "")} hidden" : "";
        _statusLabel.Text = _filteredResults.Count == _results.Count
            ? $"{_results.Count:n0} result{(_results.Count != 1 ? "s" : "")}{fpHint}"
            : $"{_filteredResults.Count:n0} of {_results.Count:n0} results (filtered){fpHint}";

        _binding.DataSource = _filteredResults.ToList();
        _snippetBox.Clear();
    }

    private void SetFilteredResults()
    {
        _filteredResults = _results;
        ApplyResultFilters();
    }

    // ═══════════════════════════════════════════════════════════
    //  Theming
    // ═══════════════════════════════════════════════════════════

    private void ApplyTheme()
    {
        _theme = _darkMode ? Dark : Light;
        BackColor = _theme.PrimaryBg;
        ForeColor = _theme.TextPrimary;

        _titleBar.BackColor = _theme.SecondaryBg;
        _titleLabel.ForeColor = _theme.TextPrimary;
        foreach (var b in new[] { _themeToggle, _minBtn, _maxBtn, _closeBtn })
        {
            b.BackColor = _theme.SecondaryBg;
            b.ForeColor = _theme.TextPrimary;
        }
        if (_switchUiBtn != null)
        {
            _switchUiBtn.BackColor = _theme.Accent;
            _switchUiBtn.ForeColor = Color.White;
            _switchUiBtn.FlatAppearance.BorderColor = _theme.Accent;
        }

        StyleInput(_pathBox);
        StyleInput(_threadsBox);
        StyleInput(_maxFileSizeBox);
        StyleInput(_snippetBox);
        StyleInput(_filterBox);
        StyleInput(_categoryFilterBox);
        StyleInput(_scoreFilterBox);
        if (_fpReasonOverlay is not null)
        {
            _fpReasonOverlay.BackColor = _theme.CardBg;
            _fpReasonOverlay.ForeColor = _theme.TextPrimary;
        }
        _showFalsePositives.ForeColor = _theme.TextSecondary;
        _resultsList.BackColor = _theme.SecondaryBg;
        _resultsList.ForeColor = _theme.TextPrimary;
        _snippetBox.BackColor = _theme.SecondaryBg;

        // Dispose cached snippet fonts before invalidating — prevents GDI handle leak
        _snippetFontRegular?.Dispose(); _snippetFontRegular = null;
        _snippetFontBold?.Dispose(); _snippetFontBold = null;
        _snippetFontItalic?.Dispose(); _snippetFontItalic = null;
        _snippetFontBoldItalic?.Dispose(); _snippetFontBoldItalic = null;
        ShowSnippet();

        StyleButton(_rulesButton);
        StyleButton(_editRulesButton);
        StyleButton(_scanButton, primary: true);
        StyleButton(_pauseButton, warning: true);
        _pauseButton.BackColor = _theme.Warning;
        _pauseButton.ForeColor = Color.White;
        _pauseButton.FlatAppearance.BorderSize = 0;
        StyleButton(_resumeButton, success: true);
        _resumeButton.BackColor = Color.FromArgb(0x22, 0xc5, 0x5e);
        _resumeButton.ForeColor = Color.White;
        _resumeButton.FlatAppearance.BorderSize = 0;
        StyleButton(_cancelButton, danger: true);
        _cancelButton.BackColor = _theme.Danger;
        _cancelButton.ForeColor = Color.White;
        _cancelButton.FlatAppearance.BorderSize = 0;
        StyleButton(_clearResultsButton, danger: true);
        _clearResultsButton.BackColor = _theme.Danger;
        _clearResultsButton.ForeColor = Color.White;
        _clearResultsButton.FlatAppearance.BorderSize = 0;

        _settingsWarningLabel.ForeColor = _theme.Warning;
        SafeSetFont(_settingsWarningLabel, new Font("Segoe UI", 8.5f, FontStyle.Bold));
        StyleButton(_fileExtButton);
        StyleButton(_reportButton);
        _reportButton.BackColor = Color.FromArgb(13, 148, 136); // teal
        _reportButton.ForeColor = Color.White;
        _reportButton.FlatStyle = FlatStyle.Flat;
        _reportButton.FlatAppearance.BorderSize = 0;
        StyleButton(_exportButton);
        StyleButton(_copyButton);
        StyleButton(_moveButton);
        StyleButton(_openDbButton);
        StyleButton(_saveDbButton, success: true);
        StyleButton(_newScanDbButton);
        _newScanDbButton.BackColor = Color.FromArgb(0x14, 0xB8, 0xA6); // teal — matches React
        _newScanDbButton.ForeColor = Color.White;
        _newScanDbButton.FlatAppearance.BorderSize = 0;
        StyleButton(_changePassphraseButton);
        _changePassphraseButton.BackColor = ColorTranslator.FromHtml("#eab308"); // yellow — matches React
        _changePassphraseButton.ForeColor = Color.Black;
        _changePassphraseButton.FlatAppearance.BorderSize = 0;
        _encryptedIndicator.ForeColor = ColorTranslator.FromHtml("#eab308");
        SafeSetFont(_encryptedIndicator, new Font("Segoe UI", 8f, FontStyle.Bold));
        StyleButton(_clearFiltersButton, danger: true);

        _preserveCopyStructure.ForeColor = _theme.TextSecondary;
        _preserveMoveStructure.ForeColor = _theme.TextSecondary;
        _actionDivider.BackColor = _theme.Border;

        _themeToggle.Text = _darkMode ? "☀" : "🌙";

        // Update open rule editor form colors if visible
        if (_ruleEditorForm is { IsDisposed: false, Visible: true })
        {
            _ruleEditorForm.BackColor = _theme.PrimaryBg;
            _ruleEditorForm.ForeColor = _theme.TextPrimary;
            if (_ruleEditorRtb != null)
            {
                _ruleEditorRtb.BackColor = _theme.PrimaryBg;
                _ruleEditorRtb.ForeColor = _theme.TextPrimary;
            }
            if (_lineNumberGutter != null) _lineNumberGutter.BackColor = _theme.TertiaryBg;
            if (_ruleEditorStatus != null) _ruleEditorStatus.ForeColor = _theme.TextSecondary;
            if (_ruleEditorSearchBox != null) StyleInput(_ruleEditorSearchBox);
            if (_ruleEditorSearchCount != null) _ruleEditorSearchCount.ForeColor = _theme.TextMuted;
            if (_ruleEditorFooter != null)
            {
                _ruleEditorFooter.BackColor = _theme.SecondaryBg;
                _ruleEditorFooter.ForeColor = _theme.TextMuted;
            }
            // Invalidate cached gutter resources so they pick up new theme colors
            _gutterBrush?.Dispose();
            _gutterBrush = null;
            // Re-apply syntax highlighting with new theme colors
            ApplyJsonHighlighting();
        }

        Invalidate(true);
    }

    private void StyleInput(Control c)
    {
        c.BackColor = _theme.SecondaryBg;
        c.ForeColor = _theme.TextPrimary;
    }

    /// <summary>
    /// Safely replace a control's font, disposing only fonts that were explicitly set
    /// by us (not inherited from the parent — disposing inherited fonts corrupts sibling controls).
    /// </summary>
    private static void SafeSetFont(Control c, Font newFont)
    {
        var old = c.Font;
        c.Font = newFont;
        if (old is not null && !ReferenceEquals(old, newFont) &&
            (c.Parent is null || !ReferenceEquals(old, c.Parent.Font)))
            old.Dispose();
    }

    private void StyleButton(Button b, bool primary = false, bool warning = false, bool danger = false, bool success = false)
    {
        b.FlatStyle = FlatStyle.Flat;
        b.FlatAppearance.BorderColor = danger ? _theme.Danger : warning ? _theme.Warning : success ? _theme.Success : _theme.Border;
        b.FlatAppearance.BorderSize = 1;
        SafeSetFont(b, new Font("Segoe UI", b.Height >= 30 ? 9f : 8.5f, FontStyle.Regular));
        b.TextAlign = ContentAlignment.MiddleCenter;
        b.Padding = Padding.Empty;
        b.BackColor = primary ? _theme.Accent : warning ? _theme.Warning : success ? _theme.Success : _theme.SecondaryBg;
        b.ForeColor = primary ? Color.White : warning ? Color.Black : success ? Color.White : danger ? _theme.Danger : _theme.TextPrimary;
    }

    private void ToggleTheme()
    {
        _darkMode = !_darkMode;
        ApplyTheme();
        Toast("Theme changed", _theme.Info);
    }

    // ═══════════════════════════════════════════════════════════
    //  Keyboard shortcuts
    // ═══════════════════════════════════════════════════════════

    private void OnHotkeys(object? sender, KeyEventArgs e)
    {
        if (e.Control && e.KeyCode == Keys.T) { ToggleTheme(); e.SuppressKeyPress = true; }
        if (e.Control && e.KeyCode == Keys.O) { OpenDatabaseForReview(); e.SuppressKeyPress = true; }
        if (e.KeyCode == Keys.F5)
        {
            if (_scanState is UiScanState.Running) PauseScan();
            else if (_scanState is UiScanState.Paused) ResumeScan();
            else _ = RunUiActionAsync(StartScanFlowAsync, "Unable to start scan");
            e.SuppressKeyPress = true;
        }
        if (e.KeyCode == Keys.Escape) { CloseRulePopover(); CloseFileExtPopover(); }
    }

    // ═══════════════════════════════════════════════════════════
    //  Borderless window resize grips
    // ═══════════════════════════════════════════════════════════

    protected override void WndProc(ref Message m)
    {
        if (m.Msg == 0x0084 && WindowState != FormWindowState.Maximized) // WM_NCHITTEST
        {
            // Use nint to avoid OverflowException on 64-bit multi-monitor setups
            var lp = (nint)m.LParam;
            var screenPt = new Point(unchecked((short)(lp & 0xFFFF)), unchecked((short)((lp >> 16) & 0xFFFF)));
            var pt = PointToClient(screenPt);
            var w = ClientSize.Width;
            var h = ClientSize.Height;

            if (pt.Y < GripSize)
            {
                if (pt.X < GripSize)     { m.Result = (IntPtr)13; return; } // HTTOPLEFT
                if (pt.X >= w - GripSize) { m.Result = (IntPtr)14; return; } // HTTOPRIGHT
                m.Result = (IntPtr)12; return;                                // HTTOP
            }
            if (pt.Y >= h - GripSize)
            {
                if (pt.X < GripSize)     { m.Result = (IntPtr)16; return; } // HTBOTTOMLEFT
                if (pt.X >= w - GripSize) { m.Result = (IntPtr)17; return; } // HTBOTTOMRIGHT
                m.Result = (IntPtr)15; return;                                // HTBOTTOM
            }
            if (pt.X < GripSize)          { m.Result = (IntPtr)10; return; } // HTLEFT
            if (pt.X >= w - GripSize)     { m.Result = (IntPtr)11; return; } // HTRIGHT
        }

        base.WndProc(ref m);
    }

    // ═══════════════════════════════════════════════════════════
    //  Scan state management
    // ═══════════════════════════════════════════════════════════

    private void SetScanState(UiScanState state)
    {
        _scanState = state;
        var canConfigure = state is UiScanState.Idle or UiScanState.Completed or UiScanState.Canceled;
        var canEditSettings = canConfigure || state == UiScanState.Paused;

        _scanButton.Enabled = canConfigure;
        _scanButton.Visible = canConfigure;
        _pauseButton.Enabled = state == UiScanState.Running;
        _pauseButton.Visible = state == UiScanState.Running;
        _resumeButton.Enabled = state == UiScanState.Paused;
        _resumeButton.Visible = state == UiScanState.Paused;
        _cancelButton.Enabled = state is UiScanState.Running or UiScanState.Paused;
        _cancelButton.Visible = state is UiScanState.Running or UiScanState.Paused;
        _clearResultsButton.Visible = state is UiScanState.Completed or UiScanState.Canceled;
        _pathBox.Enabled = _threadsBox.Enabled = _maxFileSizeBox.Enabled = canConfigure;
        _rulesButton.Enabled = canEditSettings;
        _editRulesButton.Enabled = canConfigure;
        _fileExtButton.Enabled = canEditSettings;
        _reportButton.Visible = state is UiScanState.Completed or UiScanState.Canceled;

        // Clear settings warning when scan restarts or completes
        if (state is not UiScanState.Paused)
        {
            _settingsWarningLabel.Visible = false;
        }

        _statusLabel.ForeColor = state switch
        {
            UiScanState.Completed => _theme.Success,
            UiScanState.Canceled => _theme.Danger,
            UiScanState.Paused => _theme.Warning,
            _ => _theme.TextSecondary,
        };
    }

    // ═══════════════════════════════════════════════════════════
    //  Scan execution
    // ═══════════════════════════════════════════════════════════

    private async Task StartScanFlowAsync()
    {
        try
        {
            var rootPath = _pathBox.Text.Trim();
            if (!Directory.Exists(rootPath))
            {
                MessageBox.Show(this, "Select a valid root folder.", "Missing path",
                    MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }

            if (_enabledRuleLabels.Count == 0)
            {
                MessageBox.Show(this, "No scan rules selected. Open 'Select Scan Rules' and enable at least one rule.",
                    "No Rules Selected", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }

            _activeDbPath = _stateStore.DefaultDatabasePath;
            if (_stateStore.Exists(_activeDbPath))
            {
                var info = _stateStore.TryGetSessionInfo(_activeDbPath);

                // Blank session (TotalFiles == 0) — just reuse/overwrite silently
                // This happens when PromptInitialPassphraseSetup was called at startup
                // but no scan was ever run. Skip the overwrite dialog.
                var isBlankSession = info == null || info.TotalFiles == 0;

                if (!isBlankSession)
                {
                    var isCompletedSameRoot = info!.CompletedFiles >= info.TotalFiles
                        && info.RootPath.Equals(rootPath, StringComparison.OrdinalIgnoreCase);

                    if (isCompletedSameRoot)
                    {
                        // ── Detect rules/extensions changes (matches React UI flow) ──
                        var sessionRules = info.EnabledRules != null
                            ? new HashSet<string>(info.EnabledRules) : new HashSet<string>();
                        var rulesChanged = !sessionRules.SetEquals(_enabledRuleLabels);

                        if (rulesChanged)
                        {
                            // Rules changed → automatically do full rescan (preserves review statuses)
                            await RunScanWithRulesChanged(rootPath);
                            return;
                        }

                        // Same rules → check for new file extensions
                        var sessionExts = info.FileExtensions != null
                            ? new HashSet<string>(info.FileExtensions, StringComparer.OrdinalIgnoreCase)
                            : new HashSet<string>(StringComparer.OrdinalIgnoreCase);
                        var currentExts = FileTypesConfig.LoadFromDisk().GetEnabledExtensions();
                        var newExts = currentExts.Where(e => !sessionExts.Contains(e)).ToList();

                        if (newExts.Count > 0)
                        {
                            // New extensions added → offer choice
                            var extList = string.Join(", ", newExts.Take(10));
                            if (newExts.Count > 10) extList += $" … and {newExts.Count - 10} more";
                            var decision = ShowChoiceDialog(
                                $"You've added {newExts.Count} new extension type(s) since the last scan:\n{extList}\n\n"
                                + "Would you like to scan only the new extensions, or rescan all files?",
                                "New File Extensions Detected", TaskDialogIcon.Information,
                                "Scan New Only", "Rescan All", "Cancel");

                            if (decision == 2) return;
                            if (decision == 0)
                            {
                                await RunScanNewExtensionsOnly(rootPath, newExts);
                                return;
                            }
                            // No → fall through to rescan all
                            await RunScanAsync(resumeExisting: false, rescan: true);
                            return;
                        }

                        // Same rules + same extensions → standard rescan dialog
                        var rescanDecision = ShowChoiceDialog(
                            "A completed scan database exists for this folder.\n\n"
                            + "Would you like to rescan (skip unchanged files) or start a completely fresh scan?",
                            "Previous Scan Data Exists", TaskDialogIcon.Information,
                            "Rescan", "Fresh Scan", "Cancel");

                        if (rescanDecision == 2) return;
                        if (rescanDecision == 0)
                        {
                            await RunScanAsync(resumeExisting: false, rescan: true);
                            return;
                        }
                    }
                    else
                    {
                        var decision = ShowChoiceDialog(
                            "An existing scan database was found.\n\n"
                            + "Would you like to overwrite it, or archive it and create a new one?",
                            "Existing Scan Database", TaskDialogIcon.Warning,
                            "Overwrite", "Archive", "Cancel");

                        if (decision == 2) return;
                        if (decision == 1)
                        {
                            using var save = new SaveFileDialog
                            {
                                Filter = "Scan DB (*.db)|*.db",
                                FileName = $"scan-state-{DateTime.Now:yyyyMMdd-HHmmss}.db"
                            };
                            if (save.ShowDialog(this) != DialogResult.OK) return;
                            if (!TryArchiveDatabase(_activeDbPath, save.FileName))
                            {
                                _activeDbPath = BuildAlternateDatabasePath();
                                Toast("Could not archive active DB. Continuing with a new database.", _theme.Warning);
                            }
                        }
                    }
                } // end !isBlankSession

                // Don't dispose cipher if we have a pending passphrase — it'll be applied to the new DB
                if (_pendingSalt == null)
                    DisposeActiveCipher();

                if (_stateStore.Exists(_activeDbPath) && !TryDeleteDatabase(_activeDbPath))
                {
                    _activeDbPath = BuildAlternateDatabasePath();
                    Toast("Could not overwrite active DB. Continuing with a new database.", _theme.Warning);
                }
            }

            await RunScanAsync(resumeExisting: false);
        }
        catch (UnauthorizedAccessException ex)
        {
            LogWarn("Access denied while starting scan.", ex);
            Toast("Access denied while preparing scan.", _theme.Warning);
        }
        catch (IOException ex)
        {
            LogWarn("I/O error while starting scan.", ex);
            Toast("File in use while preparing scan.", _theme.Warning);
        }
    }

    private void UpdateTitle()
    {
        var title = _openedSourcePath != null
            ? $"CUIck Scan \u2014 {Path.GetFileName(_openedSourcePath)}  v{_version}"
            : $"CUIck Scan \u2014 CUI / CTI / ITAR Discovery Scanner  v{_version}";
        _titleLabel.Text = title;
        Text = _openedSourcePath != null
            ? $"CUIck Scan \u2014 {Path.GetFileName(_openedSourcePath)}"
            : "CUIck Scan";
    }

    private void ClearResults()
    {
        if (!PromptSaveBeforeDestructiveAction(
            "Clearing results will purge all scan data. Your selected File Types and Scan Rules will be preserved."))
            return;

        _results = [];
        _filteredResults = [];
        _binding.DataSource = new List<ScanResult>();
        _snippetBox.Clear();
        _progressBar.Value = 0;
        _settingsWarningLabel.Visible = false;
        _statusLabel.Text = "Results cleared";

        CrashLog.Audit("RESULTS_CLEAR", "Results cleared via WinForms UI"); // M24: Audit parity with React UI

        DisposeActiveCipher();
        if (_stateStore.Exists(_activeDbPath))
        {
            _stateStore.CloseConnection(_activeDbPath);
            TryDeleteDatabase(_activeDbPath);
        }

        _openedSourcePath = null;
        UpdateTitle();
        SetScanState(UiScanState.Idle);
        UpdateEncryptionIndicator();
    }

    private async Task RunScanAsync(bool resumeExisting, bool rescan = false)
    {
        CrashLog.Audit("SCAN_START", $"Path={_pathBox.Text.Trim()} Resume={resumeExisting} Rescan={rescan}");

        // Starting a fresh scan clears opened-db tracking
        if (!resumeExisting)
        {
            _openedSourcePath = null;
            UpdateTitle();
        }

        _results = [];
        _filteredResults = [];
        _binding.DataSource = new List<ScanResult>();
        _snippetBox.Clear();
        _progressBar.Value = 0;
        SetScanState(UiScanState.Running);
        _statusLabel.Text = resumeExisting ? "Scanning… resuming" : rescan ? "Preparing rescan… computing checksums" : "Scanning… preparing";
        _scanCts = new CancellationTokenSource();
        var liveResults = new List<ScanResult>();

        try
        {
            var enabledLabels = new HashSet<string>(_enabledRuleLabels);
            var threads = (int)_threadsBox.Value;
            var root = _pathBox.Text.Trim();
            var mode = ScanMode.SensitiveData;

            // Apply max file size setting
            _scanner.Extractor.MaxStructuredFileSizeMB = (int)_maxFileSizeBox.Value;

            if (!resumeExisting)
            {
                var allowedExtensions = FileTypesConfig.LoadFromDisk().GetEnabledExtensions();
                var files = await Task.Run(
                    () => _scanner.EnumerateCandidates(root, allowedExtensions, LogPathAccessIssue), _scanCts.Token);

                if (rescan)
                {
                    if (IsDbEncrypted(_activeDbPath) && !_stateStore.IsCipherActive)
                    {
                        if (!TryUnlockEncryptedDb(_activeDbPath))
                        {
                            SetScanState(UiScanState.Idle);
                            _statusLabel.Text = "Encrypted database — passphrase required to rescan";
                            return;
                        }
                    }

                    SafeBeginInvoke(() => _statusLabel.Text = $"Computing checksums for {files.Count:n0} files…");

                    var seedResult = await Task.Run(() =>
                        _stateStore.SeedFilesForRescan(_activeDbPath, files), _scanCts.Token);

                    var existingResults = await Task.Run(() =>
                        _stateStore.LoadResults(_activeDbPath), _scanCts.Token);
                    lock (liveResults)
                    {
                        liveResults.AddRange(existingResults);
                    }
                    SafeBeginInvoke(() => _binding.DataSource = liveResults.ToList());

                    var pending = seedResult.Total - seedResult.Skipped;
                    if (pending == 0)
                    {
                        _results = existingResults;
                        SetFilteredResults();
                        SetScanState(UiScanState.Completed);
                        _statusLabel.Text = $"Done — all {seedResult.Skipped:n0} files unchanged, {_results.Count:n0} matches (skipped rescan)";
                        Toast("All files unchanged — nothing to rescan", _theme.Success);
                        return;
                    }

                    SafeBeginInvoke(() => _statusLabel.Text =
                        $"Rescan: {seedResult.Skipped:n0} unchanged skipped, scanning {pending:n0} changed/new files…");
                }
                else
                {
                    await Task.Run(() =>
                    {
                        _stateStore.InitializeNew(_activeDbPath, root, mode, enabledLabels, allowedExtensions);
                        _stateStore.SeedFiles(_activeDbPath, files);
                    }, _scanCts.Token);

                    // Apply pending encryption from startup prompt, or prompt now if needed
                    if (_pendingSalt != null && _pendingVerifier != null && _activeCipher != null)
                    {
                        _stateStore.SetEncryptionMetadata(_activeDbPath,
                            Convert.ToBase64String(_pendingSalt), _pendingVerifier);
                        _pendingSalt = null;
                        _pendingVerifier = null;
                        UpdateEncryptionIndicator();
                    }
                    else if (!IsDbEncrypted(_activeDbPath))
                    {
                        // Encryption is mandatory on fresh scan
                        if (!TrySetPassphraseOnDb(_activeDbPath))
                        {
                            SetScanState(UiScanState.Idle);
                            _statusLabel.Text = "Scan canceled — encryption passphrase required";
                            return;
                        }
                    }
                }
            }

            // Clear the clean shutdown flag — scan session is now active
            try { _stateStore.ClearCleanShutdown(_activeDbPath); }
            catch (Exception ex) { CrashLog.Warn("Failed to clear clean shutdown flag", ex); }

            long lastUiUpdate = 0;
            var minTicks = Stopwatch.Frequency / 10;
            var flagged = 0;

            var scanResults = await _scanner.ScanAsync(_activeDbPath, mode, threads, (done, total) =>
            {
                var now = Stopwatch.GetTimestamp();
                var last = Interlocked.Read(ref lastUiUpdate);
                if (done < total && now - last < minTicks) return;
                if (Interlocked.CompareExchange(ref lastUiUpdate, now, last) != last) return;

                var f = Volatile.Read(ref flagged);
                SafeBeginInvoke(() =>
                {
                    _progressBar.Maximum = Math.Max(1, total);
                    _progressBar.Value = Math.Min(done, _progressBar.Maximum);
                    _statusLabel.Text = _scanState == UiScanState.Paused
                        ? $"Paused — {done:n0} / {total:n0} files · {f:n0} detected"
                        : $"Scanning… {done:n0} / {total:n0} files · {f:n0} detected";
                });
            },
            (result) =>
            {
                lock (liveResults)
                {
                    liveResults.Add(result);
                    Interlocked.Exchange(ref flagged, liveResults.Count);
                }
                SafeBeginInvoke(() =>
                {
                    _binding.DataSource = liveResults.ToList();
                });
            },
            _scanCts.Token,
            enabledLabels);

            _results = scanResults;
            SetFilteredResults();
            SetScanState(UiScanState.Completed);
            _statusLabel.Text = $"Done — {_progressBar.Maximum:n0} files scanned, {_results.Count:n0} matches found";
            CrashLog.Audit("SCAN_COMPLETE", $"Files={_progressBar.Maximum} Flagged={_results.Count}");
            Toast("Scan completed", _theme.Success);
        }
        catch (OperationCanceledException)
        {
            lock (liveResults) { _results = liveResults.ToList(); }
            SetFilteredResults();
            SetScanState(UiScanState.Canceled);
            _statusLabel.Text = $"Canceled at {_progressBar.Value:n0} / {_progressBar.Maximum:n0} files · {_results.Count:n0} detected";
            CrashLog.Audit("SCAN_CANCEL", $"CanceledAt={_progressBar.Value}/{_progressBar.Maximum}");
            Toast("Scan canceled", _theme.Danger);
        }
        catch (Exception ex)
        {
            lock (liveResults) { _results = liveResults.ToList(); }
            SetFilteredResults();
            SetScanState(UiScanState.Canceled);
            _statusLabel.Text = "Error";
            LogWarn("Scan failed", ex);
            MessageBox.Show(this, "Scan failed. Check logs for details.", "Scan failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
        }
        finally
        {
            _scanner.Resume();
            _scanCts?.Dispose();
            _scanCts = null;
        }
    }

    /// <summary>
    /// Scan with rules changed — re-enumerates all files, clears findings, preserves review statuses.
    /// Matches React UI's rulesChanged scan flow.
    /// </summary>
    private async Task RunScanWithRulesChanged(string rootPath)
    {
        _openedSourcePath = null;
        UpdateTitle();
        _results = [];
        _filteredResults = [];
        _binding.DataSource = new List<ScanResult>();
        _snippetBox.Clear();
        _progressBar.Value = 0;
        SetScanState(UiScanState.Running);
        _statusLabel.Text = "Scanning… rules changed, rescanning all files";
        _scanCts = new CancellationTokenSource();
        var liveResults = new List<ScanResult>();

        try
        {
            var enabledLabels = new HashSet<string>(_enabledRuleLabels);
            var threads = (int)_threadsBox.Value;
            _scanner.Extractor.MaxStructuredFileSizeMB = (int)_maxFileSizeBox.Value;

            // Unlock encrypted DB if needed
            if (IsDbEncrypted(_activeDbPath) && !_stateStore.IsCipherActive)
            {
                if (!TryUnlockEncryptedDb(_activeDbPath))
                {
                    SetScanState(UiScanState.Idle);
                    _statusLabel.Text = "Encrypted database — passphrase required";
                    return;
                }
            }

            // Snapshot review statuses before wiping
            var reviewSnapshot = _stateStore.SnapshotReviewStatuses(_activeDbPath);

            var allowedExtensions = FileTypesConfig.LoadFromDisk().GetEnabledExtensions();
            var files = await Task.Run(
                () => _scanner.EnumerateCandidates(rootPath, allowedExtensions, LogPathAccessIssue), _scanCts.Token);

            // Re-initialize database preserving encryption
            await Task.Run(() =>
            {
                _stateStore.InitializeNew(_activeDbPath, rootPath, ScanMode.SensitiveData,
                    enabledLabels, allowedExtensions);
                _stateStore.SeedFiles(_activeDbPath, files);
            }, _scanCts.Token);

            // Clear the clean shutdown flag — scan session is now active
            try { _stateStore.ClearCleanShutdown(_activeDbPath); }
            catch (Exception ex) { CrashLog.Warn("Failed to clear clean shutdown flag", ex); }

            long lastUiUpdate = 0;
            var minTicks = Stopwatch.Frequency / 10;
            var flagged = 0;

            var scanResults = await _scanner.ScanAsync(_activeDbPath, ScanMode.SensitiveData, threads, (done, total) =>
            {
                var now = Stopwatch.GetTimestamp();
                var last = Interlocked.Read(ref lastUiUpdate);
                if (done < total && now - last < minTicks) return;
                if (Interlocked.CompareExchange(ref lastUiUpdate, now, last) != last) return;
                var f = Volatile.Read(ref flagged);
                SafeBeginInvoke(() =>
                {
                    _progressBar.Maximum = Math.Max(1, total);
                    _progressBar.Value = Math.Min(done, _progressBar.Maximum);
                    _statusLabel.Text = $"Scanning (rules changed)… {done:n0} / {total:n0} files · {f:n0} detected";
                });
            },
            (result) =>
            {
                lock (liveResults)
                {
                    liveResults.Add(result);
                    Interlocked.Exchange(ref flagged, liveResults.Count);
                }
                SafeBeginInvoke(() => _binding.DataSource = liveResults.ToList());
            },
            _scanCts.Token,
            enabledLabels);

            // Clean up review statuses: reset where checksums/patterns changed, keep where they match
            if (reviewSnapshot != null && reviewSnapshot.Count > 0)
            {
                _stateStore.CleanupReviewStatuses(_activeDbPath, reviewSnapshot);
                // Reload to pick up cleaned-up statuses
                scanResults = _stateStore.LoadResults(_activeDbPath);
            }

            _results = scanResults;
            SetFilteredResults();
            SetScanState(UiScanState.Completed);
            _statusLabel.Text = $"Done — {_progressBar.Maximum:n0} files scanned, {_results.Count:n0} matches (rules changed)";
            Toast("Scan completed — rules changed", _theme.Success);
        }
        catch (OperationCanceledException)
        {
            lock (liveResults) { _results = liveResults.ToList(); }
            SetFilteredResults();
            SetScanState(UiScanState.Canceled);
            _statusLabel.Text = $"Canceled at {_progressBar.Value:n0} / {_progressBar.Maximum:n0} files";
            Toast("Scan canceled", _theme.Danger);
        }
        catch (Exception ex)
        {
            lock (liveResults) { _results = liveResults.ToList(); }
            SetFilteredResults();
            SetScanState(UiScanState.Canceled);
            LogWarn("Scan failed", ex);
            MessageBox.Show(this, "Scan failed. Check logs for details.", "Scan failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
        }
        finally
        {
            _scanner.Resume();
            _scanCts?.Dispose();
            _scanCts = null;
        }
    }

    /// <summary>
    /// Scan only files with newly-added extensions. Matches React UI's newExtensionsOnly scan flow.
    /// </summary>
    private async Task RunScanNewExtensionsOnly(string rootPath, List<string> newExtensions)
    {
        _openedSourcePath = null;
        UpdateTitle();
        _binding.DataSource = new List<ScanResult>();
        _snippetBox.Clear();
        _progressBar.Value = 0;
        SetScanState(UiScanState.Running);
        _statusLabel.Text = $"Scanning {newExtensions.Count} new extension type(s)…";
        _scanCts = new CancellationTokenSource();
        var liveResults = new List<ScanResult>();

        try
        {
            var enabledLabels = new HashSet<string>(_enabledRuleLabels);
            var threads = (int)_threadsBox.Value;
            _scanner.Extractor.MaxStructuredFileSizeMB = (int)_maxFileSizeBox.Value;

            // Unlock encrypted DB if needed
            if (IsDbEncrypted(_activeDbPath) && !_stateStore.IsCipherActive)
            {
                if (!TryUnlockEncryptedDb(_activeDbPath))
                {
                    SetScanState(UiScanState.Idle);
                    _statusLabel.Text = "Encrypted database — passphrase required";
                    return;
                }
            }

            var newExtSet = new HashSet<string>(newExtensions, StringComparer.OrdinalIgnoreCase);
            var newExtFiles = await Task.Run(
                () => _scanner.EnumerateCandidates(rootPath, newExtSet, LogPathAccessIssue), _scanCts.Token);

            var allExtensions = FileTypesConfig.LoadFromDisk().GetEnabledExtensions();
            await Task.Run(() =>
                _stateStore.SeedNewExtensionFiles(_activeDbPath, newExtFiles, enabledLabels, allExtensions),
                _scanCts.Token);

            // Clear the clean shutdown flag — scan session is now active
            try { _stateStore.ClearCleanShutdown(_activeDbPath); }
            catch (Exception ex) { CrashLog.Warn("Failed to clear clean shutdown flag", ex); }

            // Load existing results immediately
            var existingResults = await Task.Run(() => _stateStore.LoadResults(_activeDbPath), _scanCts.Token);
            lock (liveResults) { liveResults.AddRange(existingResults); }
            SafeBeginInvoke(() => _binding.DataSource = liveResults.ToList());

            if (newExtFiles.Count == 0)
            {
                _results = existingResults;
                SetFilteredResults();
                SetScanState(UiScanState.Completed);
                _statusLabel.Text = $"Done — no new files found for added extensions";
                Toast("No new files found for added extensions", _theme.Info);
                return;
            }

            SafeBeginInvoke(() => _statusLabel.Text = $"Scanning {newExtFiles.Count:n0} files with new extensions…");

            long lastUiUpdate = 0;
            var minTicks = Stopwatch.Frequency / 10;
            var flagged = liveResults.Count;

            var scanResults = await _scanner.ScanAsync(_activeDbPath, ScanMode.SensitiveData, threads, (done, total) =>
            {
                var now = Stopwatch.GetTimestamp();
                var last = Interlocked.Read(ref lastUiUpdate);
                if (done < total && now - last < minTicks) return;
                if (Interlocked.CompareExchange(ref lastUiUpdate, now, last) != last) return;
                var f = Volatile.Read(ref flagged);
                SafeBeginInvoke(() =>
                {
                    _progressBar.Maximum = Math.Max(1, total);
                    _progressBar.Value = Math.Min(done, _progressBar.Maximum);
                    _statusLabel.Text = $"Scanning new extensions… {done:n0} / {total:n0} files · {f:n0} detected";
                });
            },
            (result) =>
            {
                lock (liveResults)
                {
                    liveResults.Add(result);
                    Interlocked.Exchange(ref flagged, liveResults.Count);
                }
                SafeBeginInvoke(() => _binding.DataSource = liveResults.ToList());
            },
            _scanCts.Token,
            enabledLabels);

            _results = scanResults;
            SetFilteredResults();
            SetScanState(UiScanState.Completed);
            _statusLabel.Text = $"Done — {_results.Count:n0} matches ({newExtFiles.Count:n0} new extension files scanned)";
            Toast($"Scan completed — {newExtensions.Count} new extension type(s)", _theme.Success);
        }
        catch (OperationCanceledException)
        {
            lock (liveResults) { _results = liveResults.ToList(); }
            SetFilteredResults();
            SetScanState(UiScanState.Canceled);
            _statusLabel.Text = $"Canceled at {_progressBar.Value:n0} / {_progressBar.Maximum:n0} files";
            Toast("Scan canceled", _theme.Danger);
        }
        catch (Exception ex)
        {
            lock (liveResults) { _results = liveResults.ToList(); }
            SetFilteredResults();
            SetScanState(UiScanState.Canceled);
            LogWarn("Scan failed", ex);
            MessageBox.Show(this, "Scan failed. Check logs for details.", "Scan failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
        }
        finally
        {
            _scanner.Resume();
            _scanCts?.Dispose();
            _scanCts = null;
        }
    }

    private void PauseScan()
    {
        _scanner.Pause();
        SetScanState(UiScanState.Paused);
        _statusLabel.Text = $"Paused — {_progressBar.Value:n0} / {_progressBar.Maximum:n0} files";
        Toast("Scan paused", _theme.Warning);
    }

    private void ResumeScan()
    {
        _scanner.Resume();
        SetScanState(UiScanState.Running);
        _statusLabel.Text = "Scanning… resumed";
        Toast("Scan resumed", _theme.Info);
    }

    // ═══════════════════════════════════════════════════════════
    //  Database operations
    // ═══════════════════════════════════════════════════════════

    // --- Debug: switch to React UI ---

    private void SwitchToReactUI_Click(object? sender, EventArgs e)
    {
        var exePath = Environment.ProcessPath;
        if (exePath == null) return;
        CrashLog.Log("Debug: switching to React UI...");
        Process.Start(exePath, "--debug");
        _switchingUi = true;
        Close();
    }

    // --- Close handler: prompt to save scan database ---

    protected override void OnFormClosing(FormClosingEventArgs e)
    {
        // Skip save prompt when switching UIs — session DB preserved for the other UI
        if (_switchingUi)
        {
            base.OnFormClosing(e);
            return;
        }
        if (!PromptSaveOnClose())
        {
            e.Cancel = true;
            return;
        }
        base.OnFormClosing(e);
    }

    /// <summary>
    /// Checks if the scan DB has content and offers to save it.
    /// Returns true if the close should proceed, false to cancel the close.
    /// </summary>
    private bool PromptSaveOnClose()
    {
        try
        {
            if (string.IsNullOrEmpty(_activeDbPath) || !_stateStore.Exists(_activeDbPath))
                return true;

            // Mark clean shutdown so the next startup knows it wasn't a crash
            try { _stateStore.MarkCleanShutdown(_activeDbPath); }
            catch (Exception ex) { CrashLog.Warn("Failed to mark clean shutdown", ex); }

            // Flush WAL so the .db file is self-contained before any copy
            try { _stateStore.CheckpointWal(_activeDbPath); }
            catch (Exception ex) { CrashLog.Warn("WAL checkpoint failed on close", ex); }

            var info = _stateStore.TryGetSessionInfo(_activeDbPath);
            if (info is null || info.TotalFiles == 0)
                return true; // blank session, nothing to save — clean shutdown already marked

            if (_openedSourcePath != null)
            {
                // ── Close with opened DB ──
                var sourceExists = File.Exists(_openedSourcePath);
                var sourceName = Path.GetFileName(_openedSourcePath);

                var prompt = sourceExists
                    ? $"You are working with \"{sourceName}\".\n" +
                      $"{info.CompletedFiles:n0} files scanned, {info.FlaggedFiles:n0} matches.\n\n" +
                      "Would you like to save changes to the original file?"
                    : $"You are working with \"{sourceName}\" (original file no longer exists).\n" +
                      $"{info.CompletedFiles:n0} files scanned, {info.FlaggedFiles:n0} matches.\n\n" +
                      "Would you like to save to a new location?";

                var result = ShowChoiceDialog(prompt, "Save Database Changes",
                    TaskDialogIcon.Information,
                    sourceExists ? "Save" : "Save As", "Discard", "Cancel");

                if (result == 2)
                    return false;

                if (result == 0)
                {
                    if (sourceExists)
                    {
                        try
                        {
                            _stateStore.SaveCopyTo(_activeDbPath, _openedSourcePath!);
                            CrashLog.Log($"Saved database to source: {_openedSourcePath}");
                        }
                        catch (Exception ex)
                        {
                            CrashLog.Error("Failed to save to source on close", ex);
                            var retry = ShowChoiceDialog(
                                $"Failed to save to {sourceName}.\n\nWould you like to save to a different location?",
                                "Save Error", TaskDialogIcon.Error,
                                "Save Elsewhere", "Don't Save");
                            if (retry == 0)
                            {
                                SaveToNewLocationOnClose(sourceName);
                            }
                        }
                    }
                    else
                    {
                        SaveToNewLocationOnClose(sourceName);
                    }
                }
                else // Discard
                {
                    try
                    {
                        _stateStore.CloseConnection(_activeDbPath);
                        Microsoft.Data.Sqlite.SqliteConnection.ClearAllPools();
                        _stateStore.DeleteDatabase(_activeDbPath);
                        CrashLog.Log("Discarded session database on close");
                    }
                    catch (Exception ex) { CrashLog.Warn("Failed to wipe session DB on discard", ex); }
                }
            }
            else
            {
                // ── Close without opened DB ──
                var result = ShowChoiceDialog(
                    $"You have a scan session with {info.CompletedFiles:n0} files scanned and {info.FlaggedFiles:n0} matches.\n\n" +
                    "Would you like to backup your scan session database before closing?",
                    "Backup Current Scan Database",
                    TaskDialogIcon.Information,
                    "Backup", "Don't Backup", "Cancel");

                if (result == 2)
                    return false;

                if (result == 0)
                {
                    var rootName = !string.IsNullOrWhiteSpace(info.RootPath)
                        ? Path.GetFileName(info.RootPath.TrimEnd('\\', '/'))
                        : "session";
                    var dateSuffix = DateTime.Now.ToString("yyyy-MM-dd");
                    var defaultName = $"CUIckScan-{rootName}-{dateSuffix}.db";

                    using var dialog = new SaveFileDialog
                    {
                        Title = "Backup Scan Database",
                        Filter = "SQLite Database (*.db)|*.db|All files (*.*)|*.*",
                        FileName = defaultName
                    };
                    if (dialog.ShowDialog(this) == DialogResult.OK)
                    {
                        try
                        {
                            _stateStore.SaveCopyTo(_activeDbPath, dialog.FileName);
                            CrashLog.Log($"Backup saved to: {dialog.FileName}");
                        }
                        catch (Exception ex)
                        {
                            CrashLog.Error("Failed to backup database on close", ex);
                            MessageBox.Show(this,
                                "Failed to save backup. Check logs for details.",
                                "Save Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                        }
                    }
                }
                // If No, just close — do NOT wipe current-session.db (preserves for next resume)
            }
        }
        catch (Exception ex)
        {
            CrashLog.Error("Error in PromptSaveOnClose", ex);
        }

        return true;
    }

    private void SaveToNewLocationOnClose(string defaultName)
    {
        using var dialog = new SaveFileDialog
        {
            Title = "Save Scan Database",
            Filter = "SQLite Database (*.db)|*.db|All files (*.*)|*.*",
            FileName = defaultName
        };
        if (dialog.ShowDialog(this) == DialogResult.OK)
        {
            try
            {
                _stateStore.SaveCopyTo(_activeDbPath, dialog.FileName);
                CrashLog.Audit("DB_SAVE", $"Destination={Path.GetFileName(dialog.FileName)}");
                CrashLog.Log($"Saved database to: {dialog.FileName}");
            }
            catch (Exception ex)
            {
                CrashLog.Error("Failed to save database on close", ex);
                MessageBox.Show(this,
                    "Failed to save database. Check logs for details.",
                    "Save Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
        }
    }

    /// <summary>
    /// Startup session check:
    /// 1. If a Session row exists (regardless of TotalFiles) → show "open this database?" prompt
    ///    - After user accepts: check version/upgrade → handle encryption → load results
    ///    - If not a clean shutdown, show recovery warnings matching React UI
    /// 2. If no session exists → prompt passphrase setup immediately
    /// </summary>
    private void OnStartupSessionCheck()
    {
        // Migrate legacy database name (scan-state.db → current-session.db)
        _stateStore.MigrateLegacyDatabaseName();
        _activeDbPath = _stateStore.DefaultDatabasePath;

        CrashLog.Log($"Startup session check: dbPath={_activeDbPath}, exists={File.Exists(_activeDbPath)}");

        ScanSessionInfo? info = null;
        try
        {
            info = _stateStore.TryGetSessionInfo(_activeDbPath);
            CrashLog.Log($"Startup session info: {(info == null ? "null" : $"TotalFiles={info.TotalFiles}, CompletedFiles={info.CompletedFiles}, CleanShutdown={info.CleanShutdown}")}");
        }
        catch (Exception ex)
        {
            CrashLog.Error("TryGetSessionInfo failed during startup check", ex);
            // Database exists but can't read session info — still offer to load/recover
            if (File.Exists(_activeDbPath))
            {
                var fi = new FileInfo(_activeDbPath);
                CrashLog.Log($"Database file exists ({fi.Length:n0} bytes) but session info unreadable — showing recovery prompt");
                ShowFallbackRecoveryPrompt();
                return;
            }
        }

        if (info != null)
        {
            // ── Session row exists → always ask the user what to do with it ──
            var hasContent = info.TotalFiles > 0;
            var canResume = hasContent && info.CompletedFiles < info.TotalFiles;
            var isDirtyShutdown = !info.CleanShutdown;
            var isEncrypted = IsDbEncrypted(info.DatabasePath);

            // Build prompt text — adapt based on content and shutdown state
            string title;
            string prompt;
            TaskDialogIcon tdIcon;
            string openLabel;

            if (isDirtyShutdown && hasContent)
            {
                // Recovery mode — matches React UI's recovery warnings
                title = "Recover Previous Scan Session";
                tdIcon = TaskDialogIcon.Warning;
                var warning = "⚠ The application was not shut down cleanly. " +
                              "The scan database may need recovery.\n\n";
                var dbInfo = $"Database: {Path.GetFileName(info.DatabasePath)}\n" +
                             (canResume
                                 ? $"Progress: {info.CompletedFiles:n0}/{info.TotalFiles:n0}\n\n"
                                 : $"Progress: complete ({info.TotalFiles:n0}/{info.TotalFiles:n0})\n\n");
                prompt = warning + dbInfo +
                    (canResume
                        ? "The previous scan was interrupted by an unexpected shutdown. " +
                          "Would you like to attempt recovery and resume scanning, or start a new session?"
                        : "The previous session was not closed cleanly. " +
                          "Would you like to attempt recovery and load the results, or start a new session?");
                openLabel = canResume ? "Recover && Resume" : "Recover";
            }
            else if (hasContent)
            {
                // Normal mode with content
                title = "Previous Scan Session Found";
                tdIcon = TaskDialogIcon.Information;
                prompt = $"Previous scan database found:\n{Path.GetFileName(info.DatabasePath)}\n" +
                    (canResume
                        ? $"Progress: {info.CompletedFiles:n0}/{info.TotalFiles:n0}\n\n" +
                          "Would you like to resume scanning from where it left off, or start a new session?"
                        : $"Progress: complete ({info.TotalFiles:n0}/{info.TotalFiles:n0})\n\n" +
                          "Would you like to open this scan session, or start a new one?");
                openLabel = canResume ? "Resume" : "Open";
            }
            else
            {
                // Session row exists but no files scanned yet (e.g. database from older version)
                title = isDirtyShutdown ? "Recover Previous Scan Database" : "Previous Scan Database Found";
                tdIcon = isDirtyShutdown ? TaskDialogIcon.Warning : TaskDialogIcon.Information;
                prompt = $"An existing scan database was found:\n{Path.GetFileName(info.DatabasePath)}\n\n" +
                         (isDirtyShutdown
                             ? "⚠ The application was not shut down cleanly.\n\n"
                             : "") +
                         "Would you like to open this database, or start a new scan?";
                openLabel = isDirtyShutdown ? "Recover" : "Open";
            }

            var choice = ShowChoiceDialog(prompt, title, tdIcon,
                openLabel, "New Scan", "Ignore");

            if (choice == 0)
            {
                // If dirty shutdown, run integrity check before loading (matches ScanApiHost load-session)
                if (isDirtyShutdown)
                {
                    try
                    {
                        var integrityError = _stateStore.IntegrityCheck(info.DatabasePath);
                        if (integrityError != null)
                        {
                            CrashLog.Warn($"Database integrity issue on recovery: {integrityError}");
                            if (_stateStore.TryRepairDatabase(info.DatabasePath))
                            {
                                CrashLog.Log("Database repaired successfully on recovery");
                                Toast("Database repaired successfully", _theme.Success);
                            }
                            else
                            {
                                CrashLog.Error("Database repair failed on recovery");
                                MessageBox.Show(this,
                                    "The database is corrupted and could not be repaired.\n" +
                                    "You may need to start a new scan session.",
                                    "Recovery Failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
                                return;
                            }
                        }
                    }
                    catch (Exception ex)
                    {
                        CrashLog.Error("Integrity check failed during recovery", ex);
                    }
                }

                _activeDbPath = info.DatabasePath;

                // Step 1: Check database version and offer upgrade if outdated
                if (!CheckDatabaseVersion(_activeDbPath))
                    return; // User canceled upgrade — don't load this database

                // Step 2: Handle encryption — unlock if encrypted, set up if not
                if (isEncrypted)
                {
                    if (!TryUnlockEncryptedDb(info.DatabasePath))
                        return; // User canceled passphrase — skip resume
                    // Re-fetch session info now that cipher is active (so RootPath is decrypted)
                    info = _stateStore.TryGetSessionInfo(info.DatabasePath);
                    if (info is null) return;
                }
                else
                {
                    // Database is not encrypted — encryption is mandatory, set it up now
                    if (!TrySetPassphraseOnDb(_activeDbPath))
                    {
                        Toast("Encryption is required to continue", _theme.Warning);
                        return;
                    }
                    // Re-fetch session info with cipher active
                    info = _stateStore.TryGetSessionInfo(_activeDbPath);
                    if (info is null) return;
                }

                // Step 3: Restore state and load results
                if (!string.IsNullOrEmpty(info.OpenedFromPath))
                {
                    _openedSourcePath = info.OpenedFromPath;
                    UpdateTitle();
                }

                _pathBox.Text = info.RootPath;
                LoadResultsFromDatabase(_activeDbPath);

                if (canResume)
                    _ = RunUiActionAsync(() => RunScanAsync(resumeExisting: true), "Unable to resume scan");
                else if (hasContent)
                    Toast(isDirtyShutdown ? "Session recovered successfully" : "Opened existing completed scan", _theme.Info);
                else
                    Toast("Opened existing database", _theme.Info);
            }
            else if (choice == 1)
            {
                // "New Scan" — equivalent to React's handleStartFresh / newScanDb
                HandleNewScanDb();
            }
            // Ignore = do nothing
        }
        else
        {
            // ── No session at all → fresh database → prompt passphrase setup ──
            CrashLog.Log($"No session found (file exists={File.Exists(_activeDbPath)}) — prompting initial passphrase setup");
            PromptInitialPassphraseSetup();
        }
    }

    /// <summary>
    /// Fallback recovery prompt when TryGetSessionInfo fails but the database file exists.
    /// This handles cases where the database schema is outdated, corrupted, or unreadable.
    /// </summary>
    private void ShowFallbackRecoveryPrompt()
    {
        var dbName = Path.GetFileName(_activeDbPath);
        var isEncrypted = IsDbEncrypted(_activeDbPath);

        var choice = ShowChoiceDialog(
            $"⚠ An existing scan database was found but could not be read:\n{dbName}\n\n" +
            "The database may be from an older version or may need recovery.\n\n" +
            "Would you like to attempt to recover it, or start a new scan?",
            "Recover Previous Scan Session",
            TaskDialogIcon.Warning,
            "Recover", "New Scan", "Ignore");

        if (choice == 0)
        {
            // Run integrity check and attempt repair
            try
            {
                var integrityError = _stateStore.IntegrityCheck(_activeDbPath);
                if (integrityError != null)
                {
                    CrashLog.Warn($"Database integrity issue on fallback recovery: {integrityError}");
                    if (!_stateStore.TryRepairDatabase(_activeDbPath))
                    {
                        CrashLog.Error("Database repair failed on fallback recovery");
                        MessageBox.Show(this,
                            "The database is corrupted and could not be repaired.\n" +
                            "You may need to start a new scan session.",
                            "Recovery Failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
                        PromptInitialPassphraseSetup();
                        return;
                    }
                    CrashLog.Log("Database repaired successfully on fallback recovery");
                }
            }
            catch (Exception ex)
            {
                CrashLog.Error("Integrity check failed during fallback recovery", ex);
            }

            // Re-try reading session info after repair
            try
            {
                var info = _stateStore.TryGetSessionInfo(_activeDbPath);
                if (info != null && info.TotalFiles > 0)
                {
                    if (isEncrypted)
                    {
                        if (!TryUnlockEncryptedDb(_activeDbPath))
                            return;
                        info = _stateStore.TryGetSessionInfo(_activeDbPath);
                        if (info is null) return;
                    }

                    if (!CheckDatabaseVersion(_activeDbPath))
                        return; // User canceled upgrade — don't load this database

                    _pathBox.Text = info.RootPath;
                    LoadResultsFromDatabase(_activeDbPath);

                    if (info.CompletedFiles < info.TotalFiles)
                        _ = RunUiActionAsync(() => RunScanAsync(resumeExisting: true), "Unable to resume scan");
                    else
                        Toast("Session recovered successfully", _theme.Info);
                    return;
                }
            }
            catch (Exception ex)
            {
                CrashLog.Error("Re-read after repair also failed", ex);
            }

            // If we still can't read it, just set up encryption
            PromptInitialPassphraseSetup();
        }
        else if (choice == 1)
        {
            HandleNewScanDb();
        }
        // Ignore = do nothing
    }

    /// <summary>
    /// Require encryption passphrase on a fresh or unencrypted database.
    /// Encryption is mandatory — the user must set a passphrase.
    /// Stores passphrase in memory so it can be applied when the scan DB is actually created.
    /// </summary>
    private void PromptInitialPassphraseSetup()
    {
        // If a real DB already exists, set passphrase directly on it
        if (_stateStore.Exists(_activeDbPath))
        {
            TrySetPassphraseOnDb(_activeDbPath);
            return;
        }

        // No DB yet — prompt for passphrase and store in memory.
        // The passphrase will be applied when RunScanAsync creates the actual DB.
        using var dlg = new PassphraseDialog(PassphraseDialog.PassphraseMode.Set, _theme);
        if (dlg.ShowDialog(this) != DialogResult.OK)
            return;

        var passphrase = dlg.EnteredPassphrase;
        var salt = FieldCipher.GenerateSalt();
        var cipher = FieldCipher.FromPassphrase(passphrase, salt);

        // Dispose any previous cipher BEFORE setting pending state
        // (DisposeActiveCipher clears _pendingSalt/_pendingVerifier)
        DisposeActiveCipher();
        _pendingSalt = salt;
        _pendingVerifier = cipher.CreateVerifier();
        _activeCipher = cipher;
        _stateStore.SetCipher(cipher);
        UpdateEncryptionIndicator();
        Toast("Encryption passphrase set", _theme.Success);
    }

    private void OpenDatabaseForReview()
    {
        if (!PromptSaveBeforeDestructiveAction(
            "Opening a database will replace your current scan session."))
            return;

        var scansFolder = ScanStateStore.ScansFolder;
        if (!Directory.Exists(scansFolder)) Directory.CreateDirectory(scansFolder);

        using var dialog = new OpenFileDialog
        {
            Filter = "Scan DB (*.db)|*.db|All files (*.*)|*.*",
            InitialDirectory = scansFolder
        };
        if (dialog.ShowDialog(this) != DialogResult.OK) return;

        // Copy the source DB to a working path so the original is never modified
        var sourcePath = dialog.FileName;
        var workingPath = _stateStore.DefaultDatabasePath;
        DisposeActiveCipher();
        if (_stateStore.Exists(workingPath))
        {
            _stateStore.CloseConnection(workingPath);
            TryDeleteDatabase(workingPath);
        }
        try
        {
            // Validate SQLite magic number before copying — reject non-SQLite files early
            var header = new byte[16];
            using (var fs = File.OpenRead(sourcePath))
            {
                if (fs.Read(header, 0, 16) < 16 ||
                    System.Text.Encoding.ASCII.GetString(header) != "SQLite format 3\0")
                {
                    Toast("Not a valid SQLite database", _theme.Danger);
                    return;
                }
            }

            var dir = Path.GetDirectoryName(workingPath);
            if (dir != null && !Directory.Exists(dir)) Directory.CreateDirectory(dir);
            File.Copy(sourcePath, workingPath, overwrite: true);
        }
        catch (Exception ex)
        {
            LogWarn("Failed to load database", ex);
            Toast("Failed to load database. Check logs for details.", _theme.Danger);
            return;
        }

        _activeDbPath = workingPath;
        _openedSourcePath = sourcePath;
        _stateStore.SetOpenedFromPath(workingPath, sourcePath);
        CrashLog.Audit("DB_OPEN", $"Source={Path.GetFileName(sourcePath)}");
        UpdateTitle();

        if (!CheckDatabaseVersion(_activeDbPath))
        {
            // User canceled upgrade — undo the open
            _activeDbPath = string.Empty;
            _openedSourcePath = null;
            UpdateTitle();
            return;
        }

        LoadResultsFromDatabase(_activeDbPath);
        Toast($"Opened DB: {Path.GetFileName(sourcePath)}", _theme.Info);
    }

    private void LoadResultsFromDatabase(string dbPath)
    {
        var info = _stateStore.TryGetSessionInfo(dbPath);
        if (info is null)
        {
            MessageBox.Show(this, "Selected database did not contain a scan session.",
                "Invalid DB", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            return;
        }

        if (IsDbEncrypted(dbPath) && !_stateStore.IsCipherActive)
        {
            if (!TryUnlockEncryptedDb(dbPath))
            {
                _statusLabel.Text = "Encrypted database — passphrase required";
                return;
            }
            // Re-fetch session info now that cipher is active (so RootPath is decrypted)
            info = _stateStore.TryGetSessionInfo(dbPath);
            if (info is null) return;
        }

        // Clear the clean shutdown flag — session is now active
        try { _stateStore.ClearCleanShutdown(dbPath); }
        catch (Exception ex) { CrashLog.Warn("Failed to clear clean shutdown flag", ex); }

        _pathBox.Text = info.RootPath;
        _results = _stateStore.LoadResults(dbPath);
        SetFilteredResults();
        _progressBar.Maximum = Math.Max(1, info.TotalFiles);
        _progressBar.Value = Math.Min(info.CompletedFiles, _progressBar.Maximum);
        SetScanState(info.CompletedFiles >= info.TotalFiles ? UiScanState.Completed : UiScanState.Idle);
        _statusLabel.Text = $"Loaded DB: {info.CompletedFiles:n0}/{info.TotalFiles:n0} scanned; {_results.Count:n0} flagged.";

        // Restore enabled rules from saved session
        if (info.EnabledRules is { Count: > 0 })
        {
            _enabledRuleLabels.Clear();
            foreach (var label in info.EnabledRules)
            {
                if (_allRuleMeta.Any(r => r.Label == label))
                    _enabledRuleLabels.Add(label);
            }
            UpdateRulesButtonText();
        }

        // Check if scan root directory exists — offer path rebase if not
        if (!string.IsNullOrEmpty(info.RootPath) && !Directory.Exists(info.RootPath))
        {
            OfferPathRebase(dbPath, info.RootPath);
        }
    }

    /// <summary>
    /// Offers to remap file paths when the original scan root directory doesn't exist
    /// on this machine (e.g. DB was created on another computer). Matches React UI's RebaseModalContent.
    /// </summary>
    private void OfferPathRebase(string dbPath, string oldRoot)
    {
        var decision = ShowChoiceDialog(
            $"The original scan directory does not exist on this machine:\n\n{oldRoot}\n\n" +
            "Would you like to remap file paths to a local directory?\n" +
            "This enables Open File, Reveal in Explorer, Copy, and Move features.",
            "Remap File Paths",
            TaskDialogIcon.Information,
            "Remap Paths", "Skip");

        if (decision != 0) return;

        using var dialog = new FolderBrowserDialog
        {
            Description = "Select the new root directory for scanned files",
            UseDescriptionForTitle = true
        };
        if (dialog.ShowDialog(this) != DialogResult.OK) return;

        var newRoot = dialog.SelectedPath;
        try
        {
            _stateStore.RebasePaths(dbPath, oldRoot, newRoot);
            _pathBox.Text = newRoot;
            _results = _stateStore.LoadResults(dbPath);
            SetFilteredResults();
            Toast($"Paths remapped to {newRoot}", _theme.Success);
        }
        catch (Exception ex)
        {
            LogWarn("Path rebase failed", ex);
            Toast("Path rebase failed. Check logs for details.", _theme.Danger);
        }
    }

    private void SaveDatabaseAs()
    {
        if (!_stateStore.Exists(_activeDbPath))
        {
            Toast("No scan DB to save", _theme.Warning);
            return;
        }

        // If an opened source exists, offer to overwrite it or save to a new location
        if (_openedSourcePath != null)
        {
            var sourceName = Path.GetFileName(_openedSourcePath);
            var choice = ShowChoiceDialog(
                $"This database was opened from \"{sourceName}\".\n\n" +
                "Would you like to overwrite the original file, or save to a new location?",
                "Save Database",
                TaskDialogIcon.Information,
                "Overwrite", "Save As", "Cancel");

            if (choice == 2) return;

            if (choice == 0)
            {
                try
                {
                    _stateStore.SaveCopyTo(_activeDbPath, _openedSourcePath);
                    Toast($"Saved to {sourceName}", _theme.Success);
                }
                catch (Exception ex)
                {
                    LogWarn("Save to source failed", ex);
                    Toast("Save failed. Check logs for details.", _theme.Danger);
                }
                return;
            }
            // "Save As" falls through to save-as dialog below
        }

        var scansFolder = ScanStateStore.ScansFolder;
        if (!Directory.Exists(scansFolder)) Directory.CreateDirectory(scansFolder);

        var defaultName = _openedSourcePath != null
            ? Path.GetFileName(_openedSourcePath)
            : $"scan-state-{DateTime.Now:yyyyMMdd-HHmmss}.db";

        using var dialog = new SaveFileDialog
        {
            Filter = "Scan DB (*.db)|*.db",
            FileName = defaultName,
            InitialDirectory = scansFolder
        };
        if (dialog.ShowDialog(this) != DialogResult.OK) return;

        try
        {
            _stateStore.SaveCopyTo(_activeDbPath, dialog.FileName);
            _openedSourcePath = dialog.FileName;
            _stateStore.SetOpenedFromPath(_activeDbPath, _openedSourcePath);
            UpdateTitle();
            Toast($"Saved DB to {Path.GetFileName(dialog.FileName)}", _theme.Success);
        }
        catch (Exception ex)
        {
            LogWarn("Save failed", ex);
            Toast("Save failed. Check logs for details.", _theme.Danger);
        }
    }

    /// <summary>
    /// Checks if there's content worth saving and prompts user to save first.
    /// Matches React UI's executeDestructiveAction → showSaveWarning flow.
    /// Returns true if the destructive action should proceed, false to cancel.
    /// </summary>
    private bool PromptSaveBeforeDestructiveAction(string actionDescription)
    {
        bool hasContent = _results.Count > 0 || _scanState is UiScanState.Completed or UiScanState.Canceled;
        if (!hasContent)
        {
            try
            {
                var info = _stateStore.TryGetSessionInfo(_activeDbPath);
                hasContent = info is { TotalFiles: > 0 };
            }
            catch { }
        }
        if (!hasContent) return true; // Nothing to save, proceed

        var choice = ShowChoiceDialog(
            $"{actionDescription}\n\n" +
            "Would you like to save the current database first?",
            "Save Current Database?",
            TaskDialogIcon.Warning,
            "Save First", "Don't Save", "Cancel");

        if (choice == 2) return false;
        if (choice == 0) SaveDatabaseAs();
        return true;
    }

    /// <summary>Create a fresh scan database, resetting all state. Matches React UI's "New Scan DB" flow.</summary>
    private void HandleNewScanDb()
    {
        if (!PromptSaveBeforeDestructiveAction(
            "Creating a new scan database will erase all current scan data and encryption settings."))
            return;

        // Reset all state
        _results = [];
        _filteredResults = [];
        _binding.DataSource = new List<ScanResult>();
        _snippetBox.Clear();
        _progressBar.Value = 0;
        _statusLabel.Text = "Ready";
        _settingsWarningLabel.Visible = false;
        _pathBox.Text = "";
        _openedSourcePath = null;
        UpdateTitle();
        DisposeActiveCipher();

        // Delete and recreate the database
        if (_stateStore.Exists(_activeDbPath))
        {
            _stateStore.CloseConnection(_activeDbPath);
            TryDeleteDatabase(_activeDbPath);
        }

        _activeDbPath = _stateStore.DefaultDatabasePath;
        SetScanState(UiScanState.Idle);
        CrashLog.Audit("DB_CLEAR", "New scan database created (full reset)");
        UpdateEncryptionIndicator();
        Toast("New scan database created", _theme.Success);

        // Prompt for passphrase setup on the fresh database
        PromptInitialPassphraseSetup();
    }

    /// <summary>Change the encryption passphrase on the current database.</summary>
    private void HandleChangePassphrase()
    {
        if (!IsDbEncrypted(_activeDbPath) || _activeCipher == null)
        {
            Toast("No encrypted database to change passphrase for", _theme.Warning);
            return;
        }

        // Rate limiting: prevent brute-force attacks on current passphrase
        var (allowed, retryAfter) = CheckPassphraseRateLimit();
        if (!allowed)
        {
            Toast($"Too many failed attempts. Please wait {retryAfter} seconds.", _theme.Warning);
            return;
        }

        // Ask for current passphrase verification + new passphrase
        using var dlg = new ChangePassphraseDialog(_theme);
        if (dlg.ShowDialog(this) != DialogResult.OK) return;

        var currentPass = dlg.CurrentPassphrase;
        var newPass = dlg.NewPassphrase;

        // Verify current passphrase
        var saltBase64 = _stateStore.GetEncryptionSalt(_activeDbPath);
        var verifier = _stateStore.GetEncryptionVerifier(_activeDbPath);
        if (saltBase64 == null || verifier == null)
        {
            Toast("Encryption metadata missing", _theme.Danger);
            return;
        }

        var salt = Convert.FromBase64String(saltBase64);
        var testCipher = FieldCipher.FromPassphrase(currentPass, salt);
        if (!testCipher.VerifyPassphrase(verifier))
        {
            testCipher.Dispose();
            // Try legacy iterations for databases created before the upgrade
            testCipher = FieldCipher.FromPassphraseLegacy(currentPass, salt);
            if (!testCipher.VerifyPassphrase(verifier))
            {
                testCipher.Dispose();
                RecordPassphraseFailure();
                CrashLog.Audit("PASSPHRASE_VERIFY_FAIL", $"Change-passphrase: incorrect current passphrase (attempt {_passphraseFailures})");
                Toast("Current passphrase is incorrect", _theme.Danger);
                return;
            }
        }
        ResetPassphraseRateLimit();
        testCipher.Dispose();

        // Create new cipher with new passphrase
        var newSalt = FieldCipher.GenerateSalt();
        var newCipher = FieldCipher.FromPassphrase(newPass, newSalt);
        var newVerifier = newCipher.CreateVerifier();
        var newSaltBase64 = Convert.ToBase64String(newSalt);

        // Re-encrypt all findings with new cipher
        using var progressDlg = new EncryptionProgressDialog(_theme);
        progressDlg.Text = "Re-Encrypting Database";
        Exception? upgradeError = null;
        var completed = 0;

        Task.Run(() =>
        {
            try
            {
                _stateStore.ChangeEncryption(_activeDbPath, _activeCipher!, newCipher, (done, total) =>
                {
                    try { progressDlg.Invoke(() => progressDlg.UpdateProgress(done, total)); }
                    catch (ObjectDisposedException) { }
                    catch (InvalidOperationException) { }
                }, newSaltBase64, newVerifier);
            }
            catch (Exception ex) { upgradeError = ex; }
            finally { Interlocked.Exchange(ref completed, 1); }
        });

        if (Volatile.Read(ref completed) == 0)
        {
            var closeTimer = new System.Windows.Forms.Timer { Interval = 50 };
            closeTimer.Tick += (_, _) =>
            {
                if (Volatile.Read(ref completed) == 1)
                {
                    closeTimer.Stop();
                    closeTimer.Dispose();
                    if (!progressDlg.IsDisposed) progressDlg.Close();
                }
            };
            closeTimer.Start();
            progressDlg.ShowDialog(this);
            closeTimer.Stop();
            closeTimer.Dispose();
        }

        if (upgradeError != null)
        {
            newCipher.Dispose();
            LogWarn("Passphrase change failed", upgradeError);
            Toast("Passphrase change failed. Check logs.", _theme.Danger);
            return;
        }

        DisposeActiveCipher();
        _activeCipher = newCipher;
        _stateStore.SetCipher(newCipher);
        CrashLog.Audit("PASSPHRASE_CHANGE", "Database passphrase changed and data re-encrypted");
        Toast("Database passphrase changed", _theme.Success);
    }

    /// <summary>Update the encrypted indicator and change passphrase button visibility.</summary>
    private void UpdateEncryptionIndicator()
    {
        var encrypted = _activeCipher != null;
        _encryptedIndicator.Visible = encrypted;
        _changePassphraseButton.Visible = encrypted;
    }

    /// <summary>
    /// Check if the database needs a schema upgrade and prompt the user.
    /// Returns true if the database is current (or was successfully upgraded),
    /// false if the user canceled and the database should NOT be loaded.
    /// </summary>
    private bool CheckDatabaseVersion(string dbPath)
    {
        // Use schema version (not app version) to decide if an upgrade is needed.
        // This avoids unnecessary upgrade prompts on patch-only version bumps.
        var info = _stateStore.TryGetSessionInfo(dbPath);
        var dbSchemaVersion = info?.SchemaVersion ?? 0;
        if (dbSchemaVersion >= ScanStateStore.SchemaVersion) return true; // Schema is current

        var dbVersion = info?.AppVersion ?? "unknown (pre-1.0)";
        var appVersion = ScanStateStore.GetAppVersion();
        var decision = ShowChoiceDialog(
            $"This scan database was created with v{dbVersion}, "
            + $"but the application is now v{appVersion}.\n\n"
            + "The database schema must be upgraded to work with this version. "
            + "Your scan results will be preserved.",
            "Database Upgrade Required", TaskDialogIcon.Warning,
            "Backup && Upgrade", "Upgrade", "Cancel");

        if (decision == 2) return false; // Cancel — don't load this database

        if (decision == 0) // Backup & Upgrade
        {
            using var save = new SaveFileDialog
            {
                Filter = "Scan DB (*.db)|*.db",
                FileName = $"scan-backup-{DateTime.Now:yyyyMMdd-HHmmss}.db"
            };
            if (save.ShowDialog(this) != DialogResult.OK)
            {
                Toast("Upgrade canceled — no backup location selected", _theme.Warning);
                return false;
            }
            try { File.Copy(dbPath, save.FileName, overwrite: true); }
            catch (Exception ex)
            {
                LogWarn("Backup failed", ex);
                Toast("Backup failed. Check logs for details.", _theme.Danger);
                return false;
            }
            Toast($"Backup saved to {save.FileName}", _theme.Info);
        }

        try
        {
            _stateStore.UpgradeDatabase(dbPath);
            _results = _stateStore.LoadResults(dbPath);
            SetFilteredResults();
            Toast($"Database upgraded to v{appVersion}", _theme.Success);
            return true;
        }
        catch (Exception ex)
        {
            LogWarn("Upgrade failed", ex);
            Toast("Upgrade failed. Check logs for details.", _theme.Danger);
            return false;
        }
    }

    // ═══════════════════════════════════════════════════════════
    //  File operations
    // ═══════════════════════════════════════════════════════════

    private void BrowsePath()
    {
        using var dialog = new FolderBrowserDialog
        {
            Description = "Select scan root", UseDescriptionForTitle = true
        };
        if (dialog.ShowDialog(this) != DialogResult.OK) return;
        _pathBox.Text = dialog.SelectedPath;
        Toast($"Selected folder: {Path.GetFileName(dialog.SelectedPath)}", _theme.Info);
    }

    private void ExportPaths()
    {
        if (_results.Count == 0) { Toast("No results to export", _theme.Warning); return; }

        using var dialog = new SaveFileDialog
        {
            Filter = "CSV (*.csv)|*.csv", FileName = "flagged-files.csv"
        };
        if (dialog.ShowDialog(this) != DialogResult.OK) return;

        var lines = new List<string> { "FilePath,Classification,MatchCount,Score" };
        foreach (var r in _results.Where(r => r.ReviewStatus != ReviewStatus.FalsePositive))
        {
            var classification = string.Join("|", r.Findings.Select(f => f.Type).Distinct());
            lines.Add($"{SecurityHelpers.EscapeCsvField(r.FilePath)},{SecurityHelpers.EscapeCsvField(classification)},{r.Findings.Count},{r.Score}");
        }

        try
        {
            File.WriteAllLines(dialog.FileName, lines);
            CrashLog.Audit("DATA_EXPORT", $"CSV export: {lines.Count - 1} file paths to {Path.GetFileName(dialog.FileName)}");
            Toast($"Exported {lines.Count - 1:n0} paths", _theme.Success);
        }
        catch (Exception ex)
        {
            CrashLog.Error("CSV export failed", ex);
            Toast("Export failed — check file path and permissions", _theme.Danger);
        }
    }

    private void GenerateReport()
    {
        if (_results.Count == 0) { Toast("No results to generate a report from", _theme.Warning); return; }

        using var dialog = new SaveFileDialog
        {
            Filter = "PDF (*.pdf)|*.pdf",
            FileName = $"CUIckScan-Report-{DateTime.Now:yyyyMMdd-HHmmss}.pdf"
        };
        if (dialog.ShowDialog(this) != DialogResult.OK) return;

        try
        {
            var session = _stateStore.TryGetSessionInfo(_activeDbPath);
            var appVersion = ScanStateStore.GetAppVersion();
            var enabledRules = session?.EnabledRules?.ToList()
                ?? _enabledRuleLabels.ToList();

            ReportGenerator.Generate(
                outputPath: dialog.FileName,
                allResults: _results,
                scanRoot: session?.RootPath ?? _pathBox.Text.Trim(),
                appVersion: appVersion,
                threadCount: (int)_threadsBox.Value,
                totalFiles: session?.TotalFiles ?? 0,
                rules: enabledRules,
                scanDate: session?.StartedUtc.ToLocalTime() ?? DateTime.Now
            );

            Toast($"Report saved to {dialog.FileName}", _theme.Success);
        }
        catch (Exception ex)
        {
            LogWarn("Failed to generate report", ex);
            Toast("Failed to generate report. Check logs for details.", _theme.Danger);
        }
    }

    private void CopyOrMoveFiles(bool move)
    {
        if (_results.Count == 0) { Toast("No matched files", _theme.Warning); return; }

        var filesToProcess = _results.Where(r => r.ReviewStatus != ReviewStatus.FalsePositive).ToList();
        var action = move ? "Move" : "Copy";
        var confirm = MessageBox.Show(this,
            $"{filesToProcess.Count:n0} flagged file(s) will be {action.ToLowerInvariant()}d to a folder you select.\n\n" +
            "False positives are excluded. Continue?",
            $"{action} Matched Files",
            MessageBoxButtons.OKCancel, MessageBoxIcon.Question);
        if (confirm != DialogResult.OK) return;

        using var folderDialog = new FolderBrowserDialog
        {
            Description = move ? "Select move destination" : "Select copy destination",
            UseDescriptionForTitle = true,
        };
        if (folderDialog.ShowDialog(this) != DialogResult.OK) return;

        var sourceRoot = _pathBox.Text.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
        var targetRoot = folderDialog.SelectedPath;
        var preserve = move ? _preserveMoveStructure.Checked : _preserveCopyStructure.Checked;

        Toast($"{(move ? "Moving" : "Copying")} {filesToProcess.Count:n0} files…", _theme.Info);

        var processed = 0;
        var errors = new List<string>();

        foreach (var result in filesToProcess)
        {
            try
            {
                var source = result.FilePath;
                var destination = preserve
                    ? Path.Combine(targetRoot, Path.GetRelativePath(sourceRoot, source))
                    : Path.Combine(targetRoot, Path.GetFileName(source));

                // Guard against path traversal (../ escaping targetRoot)
                destination = Path.GetFullPath(destination);
                if (!SecurityHelpers.IsPathWithinRoot(destination, targetRoot))
                {
                    errors.Add($"{Path.GetFileName(result.FilePath)}: destination escapes target folder");
                    continue;
                }

                var destDir = Path.GetDirectoryName(destination);
                if (!string.IsNullOrWhiteSpace(destDir)) Directory.CreateDirectory(destDir);

                if (move)
                {
                    if (File.Exists(destination)) File.Delete(destination);
                    File.Move(source, destination);
                }
                else
                {
                    File.Copy(source, destination, overwrite: true);
                }

                processed++;
            }
            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
            {
                errors.Add($"{Path.GetFileName(result.FilePath)}: file operation failed");
            }
        }

        if (errors.Count > 0)
        {
            var summary = string.Join(Environment.NewLine, errors.Take(20));
            if (errors.Count > 20) summary += $"{Environment.NewLine}… and {errors.Count - 20} more";
            MessageBox.Show(this,
                $"{processed:n0} succeeded, {errors.Count:n0} failed:{Environment.NewLine}{Environment.NewLine}{summary}",
                $"{(move ? "Move" : "Copy")} Results", MessageBoxButtons.OK, MessageBoxIcon.Warning);
        }

        Toast($"{(move ? "Moved" : "Copied")} {processed:n0} files",
            processed > 0 ? _theme.Success : _theme.Warning);
    }

    // ═══════════════════════════════════════════════════════════
    //  Result display
    // ═══════════════════════════════════════════════════════════

    private void ShowSnippet()
    {
        if (_resultsList.SelectedItem is not ScanResult selected)
        {
            _snippetBox.Clear();
            AppendSnippetText("Select a file from the results list to view details.",
                foreColor: _theme.TextMuted, italic: true);
            PositionFpOverlay();
            return;
        }

        // Position inline FP reason overlay on selected card
        PositionFpOverlay();

        // Suspend painting while building content (flicker-free)
        if (_snippetBox.IsHandleCreated)
            SendMessage(_snippetBox.Handle, WM_SETREDRAW, IntPtr.Zero, IntPtr.Zero);
        try
        {
            _snippetBox.Clear();

            // ─── FILE HEADER ───
            AppendSnippetText("  " + Path.GetFileName(selected.FilePath) + "\n",
                foreColor: _theme.Accent, bold: true);
            AppendSnippetText("  " + selected.FilePath + "\n",
                foreColor: _theme.TextMuted);

            // Category tags (colored per type)
            AppendSnippetText("  ");
            foreach (var ft in selected.Findings.Select(f => f.Type).Distinct())
            {
                var tagBg = BlendColor(GetTagColor(ft.ToString()), _theme.SecondaryBg, 0.25);
                AppendSnippetText($" {ft} ", foreColor: GetTagColor(ft.ToString()), backColor: tagBg, bold: true);
                AppendSnippetText(" ");
            }

            // Finding count + score
            AppendSnippetText($"  {selected.Findings.Count} finding{(selected.Findings.Count != 1 ? "s" : "")}",
                foreColor: _theme.TextSecondary);
            AppendSnippetText(" \u00b7 ");
            var scoreColor = GetScoreColor(selected.Score);
            AppendSnippetText($"Score: {selected.Score}", foreColor: scoreColor, bold: true);
            AppendSnippetText("\n");

            // Review status (if reviewed)
            if (selected.ReviewedBy != null)
            {
                var reviewColor = selected.ReviewStatus == ReviewStatus.Confirmed
                    ? _theme.Success : _theme.Danger;
                var statusText = selected.ReviewStatus == ReviewStatus.Confirmed
                    ? "Confirmed" : "False Positive";
                AppendSnippetText($"  {statusText}", foreColor: reviewColor, bold: true);
                AppendSnippetText($" by {selected.ReviewedBy}", foreColor: _theme.TextMuted);
                if (selected.ReviewedUtc != null && DateTime.TryParse(selected.ReviewedUtc, out var dt))
                    AppendSnippetText($" on {dt:MMM d, yyyy h:mm tt}", foreColor: _theme.TextMuted);
                AppendSnippetText("\n");
                // FP reason display in snippet
                if (selected.ReviewStatus == ReviewStatus.FalsePositive && !string.IsNullOrWhiteSpace(selected.FalsePositiveReason))
                    AppendSnippetText($"  Reason: {selected.FalsePositiveReason}\n", foreColor: _theme.TextSecondary);
            }

            // Thick divider
            AppendSnippetText("\n" + new string('\u2501', 90) + "\n\n", foreColor: _theme.Border);

            // ─── PER-FINDING CARDS ───
            var findingsToShow = selected.Findings.Take(MaxSnippetFindings).ToList();
            for (int i = 0; i < findingsToShow.Count; i++)
            {
                var f = findingsToShow[i];
                var catColor = GetTagColor(f.Type.ToString());

                // Thin separator between findings
                if (i > 0)
                    AppendSnippetText("  " + new string('\u2500', 86) + "\n\n", foreColor: _theme.Border);

                // Finding header: type badge + pattern name + score
                var badgeBg = BlendColor(catColor, _theme.SecondaryBg, 0.25);
                AppendSnippetText($"  {f.Type} ", foreColor: catColor, backColor: badgeBg, bold: true);
                AppendSnippetText($"  {f.Pattern}", foreColor: _theme.TextPrimary, bold: true);
                var fScoreColor = GetScoreColor(f.Score);
                AppendSnippetText($"  Score: {f.Score}\n", foreColor: fScoreColor, bold: true);

                // "Triggered by" line
                if (!string.IsNullOrEmpty(f.MatchedText))
                {
                    var triggerBg = BlendColor(catColor, _theme.SecondaryBg, 0.10);
                    AppendSnippetText("  Triggered by: ", foreColor: catColor);
                    AppendSnippetText($"\"{f.MatchedText}\"", foreColor: catColor, backColor: triggerBg, bold: true);
                    AppendSnippetText("\n");
                }

                // Snippet content with highlighted matches
                AppendSnippetText("  ");
                if (f.Snippet.Contains('\t'))
                {
                    // Tabular data: render with cell boundaries and per-cell highlighting
                    var rows = f.Snippet.Split('\n');
                    foreach (var row in rows)
                    {
                        var cells = row.Split('\t');
                        AppendSnippetText("  \u2502 ", foreColor: _theme.Border);
                        for (int ci = 0; ci < cells.Length; ci++)
                        {
                            if (ci > 0) AppendSnippetText(" \u2502 ", foreColor: _theme.Border);
                            AppendHighlightedSnippet(cells[ci], f.MatchedText, catColor);
                        }
                        AppendSnippetText(" \u2502\n", foreColor: _theme.Border);
                    }
                }
                else
                {
                    AppendHighlightedSnippet(f.Snippet, f.MatchedText, catColor);
                    if (!f.Snippet.EndsWith('\n'))
                        AppendSnippetText("\n");
                }

                AppendSnippetText("\n");
            }

            // Truncation notice
            if (selected.Findings.Count > MaxSnippetFindings)
                AppendSnippetText($"  \u2026 and {selected.Findings.Count - MaxSnippetFindings} more finding(s) not shown\n",
                    foreColor: _theme.TextMuted, italic: true);

            // Scroll to top
            _snippetBox.SelectionStart = 0;
            _snippetBox.ScrollToCaret();
        }
        finally
        {
            if (_snippetBox.IsHandleCreated)
            {
                SendMessage(_snippetBox.Handle, WM_SETREDRAW, (IntPtr)1, IntPtr.Zero);
                _snippetBox.Invalidate();
            }
        }
    }

    /// <summary>Appends formatted text to the snippet RichTextBox.</summary>
    private void AppendSnippetText(string text, Color? foreColor = null, Color? backColor = null,
        bool bold = false, bool italic = false)
    {
        _snippetBox.SelectionStart = _snippetBox.TextLength;
        _snippetBox.SelectionLength = 0;
        _snippetBox.SelectionColor = foreColor ?? _snippetBox.ForeColor;
        _snippetBox.SelectionBackColor = backColor ?? _snippetBox.BackColor;
        var style = FontStyle.Regular;
        if (bold) style |= FontStyle.Bold;
        if (italic) style |= FontStyle.Italic;
        _snippetBox.SelectionFont = GetSnippetFont(style);
        _snippetBox.AppendText(text);
    }

    /// <summary>Renders snippet text with matched-text portions highlighted in category color.
    /// Mirrors the React HighlightedSnippet component.</summary>
    private void AppendHighlightedSnippet(string snippet, string matchedText, Color categoryColor)
    {
        if (string.IsNullOrEmpty(matchedText) || string.IsNullOrEmpty(snippet))
        {
            AppendSnippetText(snippet ?? "", foreColor: _theme.TextSecondary);
            return;
        }

        var tintBg = BlendColor(categoryColor, _theme.SecondaryBg, 0.15);
        var escaped = Regex.Escape(matchedText);
        string[] parts;
        try { parts = Regex.Split(snippet, $"({escaped})", RegexOptions.IgnoreCase); }
        catch { AppendSnippetText(snippet, foreColor: _theme.TextSecondary); return; }

        foreach (var part in parts)
        {
            if (part.Length == 0) continue;
            if (string.Equals(part, matchedText, StringComparison.OrdinalIgnoreCase))
                AppendSnippetText(part, foreColor: categoryColor, backColor: tintBg, bold: true);
            else
                AppendSnippetText(part, foreColor: _theme.TextSecondary);
        }
    }

    private const int OpenButtonWidth = 42; // width of the open-file button area on the right
    private const int ReviewButtonWidth = 72;
    private const int ReviewButtonHeight = 20;
    private const int RevealButtonWidth = 20;
    private readonly Font _drawReviewFont = new("Segoe UI", 7f, FontStyle.Bold);

    /// <summary>
    /// Positions the inline FP-reason TextBox overlay on top of the selected card's
    /// reason area, giving the same in-card editing feel as the React UI's &lt;input&gt;.
    /// </summary>
    private void PositionFpOverlay()
    {
        if (_fpReasonOverlay is null) return;

        var idx = _resultsList.SelectedIndex;
        if (idx < 0 || idx >= _resultsList.Items.Count
            || _resultsList.Items[idx] is not ScanResult item
            || item.ReviewStatus != ReviewStatus.FalsePositive)
        {
            _fpReasonOverlay.Visible = false;
            _fpReasonTrackedPath = null;
            return;
        }

        // GetItemRectangle returns coordinates relative to the ListBox client area (scroll-aware)
        var itemRect = _resultsList.GetItemRectangle(idx);
        var cardRect = Rectangle.Inflate(itemRect, -8, -4);
        var contentRight = cardRect.Right - OpenButtonWidth - 4;

        // Must match DrawItem painted input rect: rect.Left + 6, width = contentRight - rect.Left - 10
        var reasonY = cardRect.Top + 54 + ReviewButtonHeight + 4;
        var reasonX = cardRect.Left + 6;
        var reasonW = contentRight - cardRect.Left - 10;
        var reasonH = 22;

        // Clip: hide if scrolled out of view
        var clientH = _resultsList.ClientSize.Height;
        if (reasonY + reasonH < 0 || reasonY > clientH)
        {
            _fpReasonOverlay.Visible = false;
            return;
        }

        _fpReasonOverlay.SetBounds(reasonX, reasonY, reasonW, reasonH);
        if (_fpReasonTrackedPath != item.FilePath)
        {
            _fpReasonTrackedPath = item.FilePath;
            _fpReasonOverlay.Text = item.FalsePositiveReason ?? "";
        }
        _fpReasonOverlay.Visible = true;
    }

    private void DrawResultItem(object? sender, DrawItemEventArgs e)
    {
        if (e.Index < 0 || e.Index >= _resultsList.Items.Count) return;
        var selected = (e.State & DrawItemState.Selected) == DrawItemState.Selected;
        var bg = selected ? _theme.TertiaryBg : _theme.SecondaryBg;

        using var bgBrush = new SolidBrush(bg);
        e.Graphics.FillRectangle(bgBrush, e.Bounds);

        if (_resultsList.Items[e.Index] is not ScanResult item) return;

        var rect = Rectangle.Inflate(e.Bounds, -8, -4);
        using var cardBrush = new SolidBrush(_theme.CardBg);
        using var pen = new Pen(selected ? _theme.Accent : _theme.Border);
        e.Graphics.FillRectangle(cardBrush, rect);
        e.Graphics.DrawRectangle(pen, rect);

        var name = Path.GetFileName(item.FilePath);
        var dir = Path.GetDirectoryName(item.FilePath) ?? string.Empty;
        var ext = Path.GetExtension(item.FilePath).TrimStart('.').ToLowerInvariant();

        // Content area (left, excluding file icon button)
        var contentRight = rect.Right - OpenButtonWidth - 4;

        // Row 1: File name + reveal button (↗ placed right after the name)
        var nameMaxWidth = contentRight - rect.Left - RevealButtonWidth - 16;
        var nameSize = TextRenderer.MeasureText(e.Graphics, name, _drawNameFont, new Size(nameMaxWidth, 16), TextFormatFlags.EndEllipsis);
        var nameDrawWidth = Math.Min(nameSize.Width, nameMaxWidth);
        TextRenderer.DrawText(e.Graphics, name,
            _drawNameFont,
            new Rectangle(rect.Left + 8, rect.Top + 5, nameMaxWidth, 16),
            _theme.TextPrimary, TextFormatFlags.EndEllipsis);

        // Reveal in Explorer button — right after filename text
        var revealRect = new Rectangle(rect.Left + 8 + nameDrawWidth, rect.Top + 4, RevealButtonWidth, 18);
        TextRenderer.DrawText(e.Graphics, "↗", _drawNameFont, revealRect, _theme.Accent,
            TextFormatFlags.HorizontalCenter | TextFormatFlags.VerticalCenter);

        // Row 2: Directory path
        TextRenderer.DrawText(e.Graphics, dir,
            _drawDirFont,
            new Rectangle(rect.Left + 8, rect.Top + 22, contentRight - rect.Left - 8, 14),
            _theme.TextSecondary, TextFormatFlags.EndEllipsis);

        // Row 3: Colored type tags + score
        var tagX = rect.Left + 8;
        var tagY = rect.Top + 38;
        foreach (var ft in item.Findings.Select(f => f.Type).Distinct().Take(3))
        {
            var tagText = $"[{ft}]";
            var tagClr = GetTagColor(ft.ToString());
            TextRenderer.DrawText(e.Graphics, tagText, _drawTagFont, new Point(tagX, tagY), tagClr);
            tagX += TextRenderer.MeasureText(tagText, _drawTagFont).Width + 2;
        }

        var scoreClr = GetScoreColor(item.Score);
        TextRenderer.DrawText(e.Graphics,
            $"  {item.Findings.Count} findings  Score: {item.Score}",
            _drawInfoFont, new Point(tagX, tagY), scoreClr);

        // Row 4: Review buttons — right-aligned: [by user] [Confirm] [False Positive]
        var reviewY = rect.Top + 54;
        var isConfirmed = item.ReviewStatus == ReviewStatus.Confirmed;
        var isFP = item.ReviewStatus == ReviewStatus.FalsePositive;

        // Layout right-to-left from contentRight
        var fpWidth = ReviewButtonWidth + 8;
        var fpRect = new Rectangle(contentRight - fpWidth, reviewY, fpWidth, ReviewButtonHeight);
        var confirmRect = new Rectangle(fpRect.Left - ReviewButtonWidth - 4, reviewY, ReviewButtonWidth, ReviewButtonHeight);

        // "Confirmed" button
        var confirmBg = isConfirmed ? _theme.Success : Color.FromArgb(20, _theme.Success.R, _theme.Success.G, _theme.Success.B);
        var confirmFg = isConfirmed ? Color.White : _theme.Success;
        using (var confirmBrush = new SolidBrush(confirmBg))
        {
            e.Graphics.FillRectangle(confirmBrush, confirmRect);
            using var confirmPen = new Pen(_theme.Success);
            e.Graphics.DrawRectangle(confirmPen, confirmRect);
        }
        TextRenderer.DrawText(e.Graphics, isConfirmed ? "✓ Confirmed" : "Confirm",
            _drawReviewFont, confirmRect, confirmFg,
            TextFormatFlags.HorizontalCenter | TextFormatFlags.VerticalCenter);

        // "False Positive" button
        var fpBg = isFP ? _theme.Danger : Color.FromArgb(20, _theme.Danger.R, _theme.Danger.G, _theme.Danger.B);
        var fpFg = isFP ? Color.White : _theme.Danger;
        using (var fpBrush = new SolidBrush(fpBg))
        {
            e.Graphics.FillRectangle(fpBrush, fpRect);
            using var fpPen = new Pen(_theme.Danger);
            e.Graphics.DrawRectangle(fpPen, fpRect);
        }
        TextRenderer.DrawText(e.Graphics, isFP ? "✓ False Positive" : "False Positive",
            _drawReviewFont, fpRect, fpFg,
            TextFormatFlags.HorizontalCenter | TextFormatFlags.VerticalCenter);

        // Review attribution text — to the LEFT of the Confirm button
        if (item.ReviewStatus != ReviewStatus.None && !string.IsNullOrEmpty(item.ReviewedBy))
        {
            var attrText = $"by {item.ReviewedBy}";
            var attrWidth = TextRenderer.MeasureText(attrText, _drawInfoFont).Width;
            var attrX = confirmRect.Left - attrWidth - 6;
            TextRenderer.DrawText(e.Graphics, attrText, _drawInfoFont, new Point(attrX, reviewY + 3),
                _theme.TextSecondary);
        }

        // FP reason — paint an input-like box on every FP card; the real overlay TextBox covers the selected one
        if (item.ReviewStatus == ReviewStatus.FalsePositive)
        {
            var reasonY = reviewY + ReviewButtonHeight + 4;
            var reasonInputRect = new Rectangle(rect.Left + 6, reasonY, contentRight - rect.Left - 10, 22);

            if (!selected)
            {
                // Draw input background + border to look like a text field
                using var inputBg = new SolidBrush(_theme.CardBg);
                e.Graphics.FillRectangle(inputBg, reasonInputRect);
                using var inputBorder = new Pen(_theme.BorderHover);
                e.Graphics.DrawRectangle(inputBorder, reasonInputRect);

                // Draw reason text or grey placeholder
                var textRect = new Rectangle(reasonInputRect.Left + 4, reasonInputRect.Top + 2,
                    reasonInputRect.Width - 8, reasonInputRect.Height - 4);
                if (!string.IsNullOrWhiteSpace(item.FalsePositiveReason))
                {
                    TextRenderer.DrawText(e.Graphics, item.FalsePositiveReason, _drawReasonFont, textRect,
                        _theme.TextPrimary, TextFormatFlags.EndEllipsis | TextFormatFlags.SingleLine);
                }
                else
                {
                    TextRenderer.DrawText(e.Graphics, "Reason for false positive...", _drawReasonFont, textRect,
                        _theme.TextSecondary, TextFormatFlags.EndEllipsis | TextFormatFlags.SingleLine);
                }
            }
            else
            {
                PositionFpOverlay(); // reposition real TextBox on scroll/redraw
            }
        }

        // File type icon button area (right side)
        var btnRect = new Rectangle(rect.Right - OpenButtonWidth, rect.Top + 1, OpenButtonWidth, rect.Height - 2);
        var (iconColor, iconLabel) = GetFileTypeStyle(ext);
        using var iconBgBrush = new SolidBrush(Color.FromArgb(20, iconColor.R, iconColor.G, iconColor.B));
        e.Graphics.FillRectangle(iconBgBrush, btnRect);

        // Draw mini file icon shape
        var iconCx = btnRect.Left + btnRect.Width / 2;
        var iconTop = btnRect.Top + 8;
        var iconW = 24;
        var iconH = 30;
        var iconLeft = iconCx - iconW / 2;

        using var filePen = new Pen(iconColor, 1.2f);
        using var fileFill = new SolidBrush(Color.FromArgb(24, iconColor.R, iconColor.G, iconColor.B));
        using var fileShape = new System.Drawing.Drawing2D.GraphicsPath();
        fileShape.AddLine(iconLeft, iconTop + 2, iconLeft + iconW - 7, iconTop + 2);
        fileShape.AddLine(iconLeft + iconW - 7, iconTop + 2, iconLeft + iconW, iconTop + 9);
        fileShape.AddLine(iconLeft + iconW, iconTop + 9, iconLeft + iconW, iconTop + iconH - 2);
        fileShape.AddLine(iconLeft + iconW, iconTop + iconH - 2, iconLeft, iconTop + iconH - 2);
        fileShape.CloseFigure();
        e.Graphics.FillPath(fileFill, fileShape);
        e.Graphics.DrawPath(filePen, fileShape);

        // Extension label badge at bottom of icon
        using var labelBrush = new SolidBrush(iconColor);
        var labelRect = new Rectangle(iconLeft - 1, iconTop + iconH - 13, iconW + 2, 12);
        e.Graphics.FillRectangle(labelBrush, labelRect);
        TextRenderer.DrawText(e.Graphics, iconLabel, _drawLabelFont, labelRect, Color.White,
            TextFormatFlags.HorizontalCenter | TextFormatFlags.VerticalCenter);
    }

    private void OnResultsListMouseClick(object? sender, MouseEventArgs e)
    {
        var idx = _resultsList.IndexFromPoint(e.Location);
        if (idx < 0 || idx >= _resultsList.Items.Count) return;
        if (_resultsList.Items[idx] is not ScanResult item) return;

        var itemRect = _resultsList.GetItemRectangle(idx);
        var cardRect = Rectangle.Inflate(itemRect, -8, -4);

        // Content area (left, excluding file icon button)
        var contentRight = cardRect.Right - OpenButtonWidth - 4;

        // Check "Confirmed" button click — right-aligned
        var reviewY = cardRect.Top + 54;
        var fpWidth = ReviewButtonWidth + 8;
        var fpRect = new Rectangle(contentRight - fpWidth, reviewY, fpWidth, ReviewButtonHeight);
        var confirmRect = new Rectangle(fpRect.Left - ReviewButtonWidth - 4, reviewY, ReviewButtonWidth, ReviewButtonHeight);

        if (confirmRect.Contains(e.Location))
        {
            var newStatus = item.ReviewStatus == ReviewStatus.Confirmed ? ReviewStatus.None : ReviewStatus.Confirmed;
            SetReviewOnItem(item, newStatus);
            return;
        }

        // Check "False Positive" button click — right-aligned
        if (fpRect.Contains(e.Location))
        {
            var newStatus = item.ReviewStatus == ReviewStatus.FalsePositive ? ReviewStatus.None : ReviewStatus.FalsePositive;
            SetReviewOnItem(item, newStatus);
            return;
        }

        // Check Reveal in Explorer button (↗ right after filename text)
        var clickName = Path.GetFileName(item.FilePath);
        var clickNameMaxW = contentRight - cardRect.Left - RevealButtonWidth - 16;
        var clickNameW = Math.Min(
            TextRenderer.MeasureText(clickName, _drawNameFont, new Size(clickNameMaxW, 16), TextFormatFlags.EndEllipsis).Width,
            clickNameMaxW);
        var revealRect = new Rectangle(cardRect.Left + 8 + clickNameW, cardRect.Top + 4, RevealButtonWidth, 18);
        if (revealRect.Contains(e.Location))
        {
            RevealInExplorer(item.FilePath);
            return;
        }

        // Check file type icon button area (right side, opens file)
        var openBtnRect = new Rectangle(cardRect.Right - OpenButtonWidth, cardRect.Top + 1, OpenButtonWidth, cardRect.Height - 2);
        if (openBtnRect.Contains(e.Location))
        {
            OpenFileWithDefault(item.FilePath);
        }
    }

    private void SetReviewOnItem(ScanResult item, ReviewStatus newStatus)
    {
        try
        {
            _stateStore.SetReviewStatus(_activeDbPath, item.FilePath, newStatus);

            // ScanResult is an immutable record — create updated copies
            var username = newStatus == ReviewStatus.None ? null : $"{Environment.UserDomainName}\\{Environment.UserName}";
            var utcNow = newStatus == ReviewStatus.None ? null : DateTime.UtcNow.ToString("O");
            // Clear FP reason when status changes away from FalsePositive
            var fpReason = newStatus == ReviewStatus.FalsePositive ? item.FalsePositiveReason : null;
            var updated = item with { ReviewStatus = newStatus, ReviewedBy = username, ReviewedUtc = utcNow, FalsePositiveReason = fpReason };

            // Replace in the results list (rebuild if needed since IReadOnlyList may not be mutable)
            var mutableList = new List<ScanResult>(_results);
            var idx = mutableList.FindIndex(r => r.FilePath == item.FilePath);
            if (idx >= 0) mutableList[idx] = updated;
            _results = mutableList;

            ApplyResultFilters(); // re-filter in case FP was toggled
            _resultsList.Invalidate(); // force redraw
            ShowSnippet(); // refresh snippet panel and FP reason panel

            var label = newStatus switch
            {
                ReviewStatus.Confirmed => "Confirmed",
                ReviewStatus.FalsePositive => "False Positive",
                _ => "Pending"
            };
            CrashLog.Audit("REVIEW_STATUS", $"File={Path.GetFileName(item.FilePath)} Status={newStatus}");
            Toast($"{Path.GetFileName(item.FilePath)}: {label}", newStatus == ReviewStatus.Confirmed ? _theme.Success : newStatus == ReviewStatus.FalsePositive ? _theme.Warning : _theme.Info);
        }
        catch (Exception ex)
        {
            LogWarn("Failed to update review status", ex);
            Toast("Failed to update review status", _theme.Danger);
        }
    }

    private void OnFpReasonBoxLeave(object? sender, EventArgs e)
    {
        if (_fpReasonOverlay is null || _fpReasonTrackedPath is null) return;
        var reason = string.IsNullOrWhiteSpace(_fpReasonOverlay.Text) ? null : _fpReasonOverlay.Text.Trim();

        // Find the current item and check if the reason actually changed
        var item = _results?.Cast<ScanResult>().FirstOrDefault(r => r.FilePath == _fpReasonTrackedPath);
        if (item is null || (item.FalsePositiveReason ?? "") == (reason ?? "")) return;

        try
        {
            _stateStore.SetFpReason(_activeDbPath, _fpReasonTrackedPath, reason);

            // Update in-memory results
            if (_results is null) return;
            var mutableList = new List<ScanResult>(_results);
            var idx = mutableList.FindIndex(r => r.FilePath == _fpReasonTrackedPath);
            if (idx >= 0)
            {
                mutableList[idx] = mutableList[idx] with { FalsePositiveReason = reason };
                _results = mutableList;
            }

            ApplyResultFilters();
            _resultsList.Invalidate();
            ShowSnippet(); // refresh snippet panel
        }
        catch (Exception ex)
        {
            LogWarn("Failed to save FP reason", ex);
        }
    }

    private void RevealInExplorer(string filePath)
    {
        if (!SecurityHelpers.IsValidLocalFilePath(filePath))
        {
            Toast("Cannot reveal file: invalid file path", _theme.Warning);
            return;
        }
        try
        {
            // Strip quotes and commas — commas are the /select argument separator in explorer.exe
            var safePath = filePath.Replace("\"", "").Replace(",", "");
            Process.Start(new ProcessStartInfo
            {
                FileName = "explorer.exe",
                Arguments = $"/select,\"{safePath}\"",
                UseShellExecute = true
            });
        }
        catch (Exception ex)
        {
            LogWarn("Cannot reveal file in explorer", ex);
            Toast("Cannot reveal file. Check logs for details.", _theme.Warning);
        }
    }

    private void OpenFileWithDefault(string filePath)
    {
        if (!SecurityHelpers.IsValidLocalFilePath(filePath))
        {
            Toast("Cannot open file: invalid file path", _theme.Warning);
            return;
        }
        if (SecurityHelpers.IsBlockedExecutable(filePath))
        {
            Toast("Cannot open executable files directly", _theme.Warning);
            return;
        }
        try
        {
            Process.Start(new ProcessStartInfo
            {
                FileName = filePath,
                UseShellExecute = true
            });
        }
        catch (Exception ex)
        {
            LogWarn("Cannot open file", ex);
            Toast("Cannot open file. Check logs for details.", _theme.Warning);
        }
    }

    private static (Color color, string label) GetFileTypeStyle(string ext) => ext switch
    {
        "xlsx" or "xls" => (Color.FromArgb(0x1D, 0x6F, 0x42), "XLS"),
        "csv" => (Color.FromArgb(0x1D, 0x6F, 0x42), "CSV"),
        "docx" or "doc" => (Color.FromArgb(0x2B, 0x57, 0x9A), "DOC"),
        "pptx" or "ppt" => (Color.FromArgb(0xD2, 0x47, 0x26), "PPT"),
        "pdf" => (Color.FromArgb(0xE2, 0x57, 0x4C), "PDF"),
        "eml" or "msg" => (Color.FromArgb(0x00, 0x78, 0xD4), "EML"),
        "xml" => (Color.FromArgb(0x9B, 0x59, 0xB6), "XML"),
        "json" => (Color.FromArgb(0xF3, 0x9C, 0x12), "JSON"),
        "yaml" or "yml" => (Color.FromArgb(0xCB, 0x17, 0x1E), "YML"),
        "dwg" => (Color.FromArgb(0xE7, 0x4C, 0x3C), "DWG"),
        "dxf" => (Color.FromArgb(0xC0, 0x39, 0x2B), "DXF"),
        "vsdx" => (Color.FromArgb(0x39, 0x55, 0xA3), "VSD"),
        "txt" or "log" or "md" or "rtf" => (Color.FromArgb(0x7F, 0x8C, 0x8D), ext.ToUpperInvariant()),
        "jpg" or "jpeg" or "png" or "tif" or "tiff" => (Color.FromArgb(0x27, 0xAE, 0x60), "IMG"),
        "html" or "htm" => (Color.FromArgb(0xE4, 0x4D, 0x26), "HTM"),
        "cs" => (Color.FromArgb(0x68, 0x21, 0x7A), "C#"),
        "cpp" or "h" => (Color.FromArgb(0x00, 0x59, 0x9C), "C++"),
        "vb" => (Color.FromArgb(0x00, 0x53, 0x9C), "VB"),
        "ini" or "cfg" => (Color.FromArgb(0x95, 0xA5, 0xA6), ext.ToUpperInvariant()),
        _ => (Color.FromArgb(0x6B, 0x72, 0x80), ext.Length > 0 ? ext[..Math.Min(ext.Length, 3)].ToUpperInvariant() : "FILE"),
    };

    // ═══════════════════════════════════════════════════════════
    //  Toast notifications
    // ═══════════════════════════════════════════════════════════

    private void PositionToastHost()
    {
        _toastHost.Location = new Point(
            ClientSize.Width - _toastHost.Width - 12,
            ClientSize.Height - _toastHost.Height - 12);
    }

    private async void Toast(string message, Color color)
    {
        try
        {
            if (IsDisposed) return;
            var panel = new Panel { Height = 36, Dock = DockStyle.Top, BackColor = color, Padding = new Padding(8) };
            var label = new Label
            {
                Text = message, Dock = DockStyle.Fill, ForeColor = Color.White, AutoEllipsis = true
            };
            panel.Controls.Add(label);
            _toastHost.Controls.Add(panel);
            panel.BringToFront();
            await Task.Delay(ToastDurationMs);
            if (!panel.IsDisposed)
            {
                _toastHost.Controls.Remove(panel);
                panel.Dispose();
            }
        }
        catch (Exception ex) when (ex is ObjectDisposedException or InvalidOperationException)
        {
            // Expected during form teardown — swallow silently
        }
        catch (Exception ex)
        {
            // async void must never throw unhandled — log and swallow
            CrashLog.Debug($"Toast error: {ex.Message}");
        }
    }

    // ═══════════════════════════════════════════════════════════
    //  Helpers
    // ═══════════════════════════════════════════════════════════

    private async Task RunUiActionAsync(Func<Task> action, string errorTitle)
    {
        try { await action(); }
        catch (Exception ex)
        {
            LogWarn(errorTitle, ex);
            MessageBox.Show(this, $"{errorTitle}. Check logs for details.", errorTitle, MessageBoxButtons.OK, MessageBoxIcon.Error);
        }
    }

    private bool TryArchiveDatabase(string source, string dest)
    {
        try
        {
            _stateStore.CloseConnection(source);
            File.Move(source, dest, overwrite: true);
            return true;
        }
        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
        {
            LogWarn($"Unable to archive '{source}'.", ex);
            return false;
        }
    }

    /// <summary>Returns true if the database has an encryption salt (findings are encrypted).</summary>
    private bool IsDbEncrypted(string dbPath)
    {
        try { return _stateStore.GetEncryptionSalt(dbPath) != null; }
        catch (Exception ex) { CrashLog.Warn("Failed to check encryption status", ex); return false; }
    }

    private void DisposeActiveCipher()
    {
        if (_activeCipher != null)
        {
            _stateStore.SetCipher(null);
            _activeCipher.Dispose();
            _activeCipher = null;
        }
        _pendingSalt = null;
        _pendingVerifier = null;
    }

    // ─── Passphrase rate limiting (matches ScanApiHost thresholds) ───
    // Note: No lock needed — all calls originate from UI thread button-click handlers.

    private (bool Allowed, int RetryAfterSeconds) CheckPassphraseRateLimit()
    {
        if (_passphraseFailures < 3) return (true, 0);
        var delaySec = _passphraseFailures switch
        {
            < 5 => 1,
            < 10 => 5,
            _ => 30,
        };
        var elapsed = (DateTime.UtcNow - _lastFailureUtc).TotalSeconds;
        if (elapsed < delaySec)
            return (false, (int)Math.Ceiling(delaySec - elapsed));
        return (true, 0);
    }

    private void RecordPassphraseFailure()
    {
        _passphraseFailures++;
        _lastFailureUtc = DateTime.UtcNow;
    }

    private void ResetPassphraseRateLimit()
    {
        _passphraseFailures = 0;
    }

    // ─── Encryption helpers ───

    /// <summary>Prompt user to enter passphrase and unlock an encrypted database.
    /// Returns true if cipher was activated, false if user canceled.</summary>
    private bool TryUnlockEncryptedDb(string dbPath)
    {
        var saltBase64 = _stateStore.GetEncryptionSalt(dbPath);
        if (saltBase64 == null) return false;
        var verifier = _stateStore.GetEncryptionVerifier(dbPath);
        if (verifier == null)
        {
            MessageBox.Show(this, "Database encryption metadata is corrupt (missing verifier).",
                "Encryption Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            return false;
        }

        var salt = Convert.FromBase64String(saltBase64);
        string? lastError = null;

        while (true)
        {
            var (allowed, retryAfter) = CheckPassphraseRateLimit();
            if (!allowed)
            {
                MessageBox.Show(this, $"Too many failed attempts. Please wait {retryAfter} seconds.",
                    "Rate Limited", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                continue;
            }

            using var dlg = new PassphraseDialog(PassphraseDialog.PassphraseMode.Enter, _theme, lastError);
            if (dlg.ShowDialog(this) != DialogResult.OK)
                return false;

            var passphrase = dlg.EnteredPassphrase;
            var cipher = FieldCipher.FromPassphrase(passphrase, salt);
            if (!cipher.VerifyPassphrase(verifier))
            {
                // Try legacy (100K) iterations for databases created before the upgrade
                cipher.Dispose();
                cipher = FieldCipher.FromPassphraseLegacy(passphrase, salt);
            }
            if (cipher.VerifyPassphrase(verifier))
            {
                CrashLog.Log("Passphrase unlock: success");
                CrashLog.Audit("PASSPHRASE_VERIFY", "Database unlocked successfully");
                ResetPassphraseRateLimit();
                DisposeActiveCipher();
                _activeCipher = cipher;
                _stateStore.SetCipher(cipher);
                UpdateEncryptionIndicator();
                return true;
            }

            cipher.Dispose();
            RecordPassphraseFailure();
            CrashLog.Warn($"Passphrase unlock: failed (attempt {_passphraseFailures})");
            CrashLog.Audit("PASSPHRASE_VERIFY_FAIL", $"Incorrect passphrase (attempt {_passphraseFailures})");
            lastError = "Incorrect passphrase";
        }
    }

    /// <summary>Prompt user to set an encryption passphrase on a database.
    /// Returns true if passphrase was set, false if user canceled.</summary>
    private bool TrySetPassphraseOnDb(string dbPath)
    {
        using var dlg = new PassphraseDialog(PassphraseDialog.PassphraseMode.Set, _theme);
        if (dlg.ShowDialog(this) != DialogResult.OK)
            return false;

        var passphrase = dlg.EnteredPassphrase;
        var salt = FieldCipher.GenerateSalt();
        var cipher = FieldCipher.FromPassphrase(passphrase, salt);
        var verifierText = cipher.CreateVerifier();
        var saltBase64 = Convert.ToBase64String(salt);

        DisposeActiveCipher();
        _activeCipher = cipher;
        _stateStore.SetCipher(cipher);

        // Encrypt existing data if any
        var info = _stateStore.TryGetSessionInfo(dbPath);
        if (info != null && info.TotalFiles > 0)
        {
            // Metadata (salt/verifier) is set atomically inside UpgradeEncryption's
            // single transaction — if crash mid-way, DB remains unencrypted.
            using var progressDlg = new EncryptionProgressDialog(_theme);
            Exception? upgradeError = null;
            var completed = 0; // 0 = not done, 1 = done

            Task.Run(() =>
            {
                try
                {
                    _stateStore.UpgradeEncryption(dbPath, cipher, (done, total) =>
                    {
                        try { progressDlg.Invoke(() => progressDlg.UpdateProgress(done, total)); }
                        catch (ObjectDisposedException) { }
                        catch (InvalidOperationException) { }
                    }, saltBase64, verifierText);
                }
                catch (Exception ex) { upgradeError = ex; }
                finally { Interlocked.Exchange(ref completed, 1); }
            });

            // If background task already completed (e.g. 0 findings), skip showing dialog
            if (Volatile.Read(ref completed) == 0)
            {
                // Use a UI timer to reliably close the dialog when the task completes.
                // This avoids a race where Task.Run finishes between the Volatile.Read check
                // and ShowDialog creating the window handle (which would leave the dialog stuck).
                var closeTimer = new System.Windows.Forms.Timer { Interval = 50 };
                closeTimer.Tick += (_, _) =>
                {
                    if (Volatile.Read(ref completed) == 1)
                    {
                        closeTimer.Stop();
                        closeTimer.Dispose();
                        if (!progressDlg.IsDisposed) progressDlg.Close();
                    }
                };
                closeTimer.Start();
                progressDlg.ShowDialog(this);
                closeTimer.Stop();
                closeTimer.Dispose();
            }

            if (upgradeError != null)
            {
                LogWarn("Encryption upgrade failed", upgradeError);
                MessageBox.Show(this, "Encryption upgrade failed. Check logs for details.",
                    "Encryption Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return false;
            }
        }
        else
        {
            // No data to encrypt — just persist metadata directly
            _stateStore.SetEncryptionMetadata(dbPath, saltBase64, verifierText);
        }

        CrashLog.Audit("ENCRYPTION_SET", "Database encryption enabled via WinForms UI (AES-256-GCM)"); // M19: Audit parity with React UI
        UpdateEncryptionIndicator();
        Toast("Database encrypted", _theme.Success);
        return true;
    }

    private bool TryDeleteDatabase(string dbPath)
    {
        try { _stateStore.DeleteDatabase(dbPath); return true; }
        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
        {
            LogWarn($"Unable to delete '{dbPath}'.", ex);
            return false;
        }
    }

    private string BuildAlternateDatabasePath()
    {
        var folder = Path.GetDirectoryName(_stateStore.DefaultDatabasePath) ?? AppContext.BaseDirectory;
        return Path.Combine(folder, $"scan-state-{DateTime.Now:yyyyMMdd-HHmmss}.db");
    }

    /// <summary>BeginInvoke with IsDisposed guard — safe to call after form close.</summary>
    private void SafeBeginInvoke(Action action)
    {
        try
        {
            if (!IsDisposed && IsHandleCreated) BeginInvoke(action);
        }
        catch (ObjectDisposedException) { }
        catch (InvalidOperationException) { }
    }

    private void LogPathAccessIssue(string message)
    {
        LogWarn(message, null);
        SafeBeginInvoke(() => _statusLabel.Text = "Scanning… some protected paths were skipped.");
    }

    /// <summary>
    /// Shows a TaskDialog with custom-labeled buttons instead of generic Yes/No/Cancel.
    /// Returns the 0-based index of the clicked button. X/Escape maps to the last button (typically Cancel).
    /// </summary>
    private int ShowChoiceDialog(string text, string title, TaskDialogIcon icon, params string[] buttonLabels)
    {
        var page = new TaskDialogPage { Text = text, Caption = title, Icon = icon, AllowCancel = true };
        var buttons = new TaskDialogButton[buttonLabels.Length];
        for (int i = 0; i < buttonLabels.Length; i++)
        {
            buttons[i] = new TaskDialogButton(buttonLabels[i]);
            page.Buttons.Add(buttons[i]);
        }
        var result = TaskDialog.ShowDialog(this, page);
        for (int i = 0; i < buttons.Length; i++)
            if (ReferenceEquals(result, buttons[i])) return i;
        return buttonLabels.Length - 1; // X/Escape → last button (Cancel/Ignore/Skip)
    }

    private static void LogWarn(string message, Exception? ex)
    {
        if (ex is null) CrashLog.Warn(message);
        else CrashLog.Warn(message, ex);
    }

    /// <summary>Detect OS light theme preference via registry. Matches React UI's prefers-color-scheme check.</summary>
    private static bool IsOsLightTheme()
    {
        try
        {
            using var key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(
                @"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize");
            var val = key?.GetValue("AppsUseLightTheme");
            return val is int i && i == 1;
        }
        catch { return false; } // default to dark on failure
    }

    private void LoadAppIcon()
    {
        var candidates = new[]
        {
            Path.Combine(AppContext.BaseDirectory, "Resources", "app.ico"),
            Path.Combine(AppContext.BaseDirectory, "app.ico"),
            Path.Combine(AppContext.BaseDirectory, "..", "..", "..", "Resources", "app.ico"),
        };
        foreach (var path in candidates)
        {
            if (!File.Exists(path)) continue;
            try { Icon = new Icon(path); return; } catch { }
        }
    }

    // ═══════════════════════════════════════════════════════════
    //  PassphraseDialog — modal dialog for enter/set passphrase
    // ═══════════════════════════════════════════════════════════

    private sealed class PassphraseDialog : Form
    {
        public enum PassphraseMode { Enter, Set }

        public string EnteredPassphrase { get; private set; } = string.Empty;

        private readonly TextBox _passphraseBox;
        private readonly TextBox? _confirmBox;
        private readonly CheckBox? _acknowledgeBox;
        private readonly Label _errorLabel;
        private readonly Label? _strengthLabel;
        private readonly PassphraseMode _mode;

        public PassphraseDialog(PassphraseMode mode, ThemePalette theme, string? initialError = null)
        {
            _mode = mode;
            var isSet = mode == PassphraseMode.Set;

            Text = isSet ? "Set Encryption Passphrase" : "Unlock Encrypted Database";
            FormBorderStyle = FormBorderStyle.FixedDialog;
            StartPosition = FormStartPosition.CenterParent;
            MaximizeBox = false;
            MinimizeBox = false;
            ShowInTaskbar = false;
            Size = new Size(440, isSet ? 420 : 260);
            BackColor = theme.PrimaryBg;
            ForeColor = theme.TextPrimary;

            var y = 16;

            // Title label
            var titleLabel = new Label
            {
                Text = isSet ? "Set Encryption Passphrase" : "Enter Passphrase",
                Font = new Font("Segoe UI", 12f, FontStyle.Bold),
                AutoSize = true,
                Location = new Point(20, y),
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(titleLabel);
            y += 32;

            if (isSet)
            {
                var warningLabel = new Label
                {
                    Text = "⚠ WARNING: If you lose your passphrase, your scan data cannot be recovered.\n" +
                           "There is no reset mechanism. Make sure you remember it.",
                    Font = new Font("Segoe UI", 8.5f, FontStyle.Bold),
                    ForeColor = theme.Warning,
                    Location = new Point(20, y),
                    Size = new Size(390, 48),
                };
                Controls.Add(warningLabel);
                y += 54;
            }

            // Passphrase label
            Controls.Add(new Label
            {
                Text = "Passphrase:",
                Font = new Font("Segoe UI", 9f),
                AutoSize = true,
                Location = new Point(20, y),
                ForeColor = theme.TextSecondary,
            });
            y += 20;

            // Passphrase text box
            _passphraseBox = new TextBox
            {
                Location = new Point(20, y),
                Size = new Size(385, 28),
                UseSystemPasswordChar = true,
                Font = new Font("Segoe UI", 10f),
                BackColor = theme.SecondaryBg,
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(_passphraseBox);
            y += 32;

            if (isSet)
            {
                Controls.Add(new Label
                {
                    Text = "Confirm Passphrase:",
                    Font = new Font("Segoe UI", 9f),
                    AutoSize = true,
                    Location = new Point(20, y),
                    ForeColor = theme.TextSecondary,
                });
                y += 20;

                _confirmBox = new TextBox
                {
                    Location = new Point(20, y),
                    Size = new Size(385, 28),
                    UseSystemPasswordChar = true,
                    Font = new Font("Segoe UI", 10f),
                    BackColor = theme.SecondaryBg,
                    ForeColor = theme.TextPrimary,
                };
                Controls.Add(_confirmBox);
                y += 34;

                _strengthLabel = new Label
                {
                    Text = "",
                    Font = new Font("Segoe UI", 8f),
                    ForeColor = theme.Warning,
                    Location = new Point(20, y),
                    Size = new Size(385, 18),
                    Visible = false,
                };
                Controls.Add(_strengthLabel);
                y += 20;

                _acknowledgeBox = new CheckBox
                {
                    Text = "I understand that losing this passphrase means permanent data loss",
                    Font = new Font("Segoe UI", 8.5f),
                    AutoSize = true,
                    Location = new Point(18, y),
                    ForeColor = theme.TextSecondary,
                };
                Controls.Add(_acknowledgeBox);
                y += 28;
            }

            // Show passphrase checkbox
            var showCheck = new CheckBox
            {
                Text = "Show passphrase",
                Font = new Font("Segoe UI", 8.5f),
                AutoSize = true,
                Location = new Point(18, y),
                ForeColor = theme.TextSecondary,
            };
            showCheck.CheckedChanged += (_, _) =>
            {
                _passphraseBox.UseSystemPasswordChar = !showCheck.Checked;
                if (_confirmBox != null) _confirmBox.UseSystemPasswordChar = !showCheck.Checked;
            };
            Controls.Add(showCheck);
            y += 28;

            // Error label
            _errorLabel = new Label
            {
                Text = initialError ?? "",
                Font = new Font("Segoe UI", 8.5f),
                ForeColor = theme.Danger,
                Location = new Point(20, y),
                Size = new Size(385, 18),
                Visible = !string.IsNullOrEmpty(initialError),
            };
            Controls.Add(_errorLabel);
            y += 22;

            // Buttons
            var submitBtn = new Button
            {
                Text = isSet ? "Encrypt" : "Unlock",
                Size = new Size(100, 32),
                Location = new Point(200, y),
                FlatStyle = FlatStyle.Flat,
                BackColor = isSet ? theme.Success : theme.Accent,
                ForeColor = Color.White,
                Font = new Font("Segoe UI", 9f, FontStyle.Bold),
            };
            submitBtn.FlatAppearance.BorderSize = 0;
            submitBtn.Click += OnSubmit;

            var cancelBtn = new Button
            {
                Text = "Cancel",
                Size = new Size(90, 32),
                Location = new Point(310, y),
                FlatStyle = FlatStyle.Flat,
                BackColor = theme.SecondaryBg,
                ForeColor = theme.TextPrimary,
                Font = new Font("Segoe UI", 9f),
                DialogResult = DialogResult.Cancel,
            };
            cancelBtn.FlatAppearance.BorderColor = theme.Border;
            cancelBtn.FlatAppearance.BorderSize = 1;

            Controls.Add(submitBtn);
            Controls.Add(cancelBtn);

            AcceptButton = submitBtn;
            CancelButton = cancelBtn;
            ActiveControl = _passphraseBox;
        }

        private void OnSubmit(object? sender, EventArgs e)
        {
            var pass = _passphraseBox.Text;

            if (string.IsNullOrEmpty(pass))
            {
                ShowError("Passphrase is required.");
                return;
            }

            if (_mode == PassphraseMode.Set)
            {
                if (pass.Length < 8)
                {
                    ShowError("Passphrase must be at least 8 characters.");
                    return;
                }
                if (_confirmBox != null && pass != _confirmBox.Text)
                {
                    ShowError("Passphrases do not match.");
                    return;
                }
                if (_acknowledgeBox is { Checked: false })
                {
                    ShowError("You must acknowledge the data loss warning.");
                    return;
                }

                // Show strength warning — require user to re-confirm by clicking again
                var strengthWarn = SecurityHelpers.CheckPassphraseStrength(pass);
                if (strengthWarn != null && _strengthLabel != null && !_strengthLabel.Visible)
                {
                    _strengthLabel.Text = strengthWarn;
                    _strengthLabel.Visible = true;
                    return; // User must click submit again to confirm
                }
            }

            EnteredPassphrase = pass;
            _passphraseBox.Text = string.Empty;
            if (_confirmBox != null) _confirmBox.Text = string.Empty;
            DialogResult = DialogResult.OK;
            Close();
        }

        private void ShowError(string msg)
        {
            _errorLabel.Text = msg;
            _errorLabel.Visible = true;
        }

        protected override void Dispose(bool disposing)
        {
            if (disposing)
            {
                // Reduce passphrase exposure window
                EnteredPassphrase = string.Empty;
            }
            base.Dispose(disposing);
        }
    }

    // ═══════════════════════════════════════════════════════════
    //  EncryptionProgressDialog — modal progress during encrypt
    // ═══════════════════════════════════════════════════════════

    private sealed class EncryptionProgressDialog : Form
    {
        private readonly ProgressBar _progressBar;
        private readonly Label _statusLabel;

        public EncryptionProgressDialog(ThemePalette theme)
        {
            Text = "Encrypting Database";
            FormBorderStyle = FormBorderStyle.FixedDialog;
            StartPosition = FormStartPosition.CenterParent;
            ControlBox = false;
            MaximizeBox = false;
            MinimizeBox = false;
            ShowInTaskbar = false;
            Size = new Size(420, 140);
            BackColor = theme.PrimaryBg;
            ForeColor = theme.TextPrimary;

            _statusLabel = new Label
            {
                Text = "Encrypting database...",
                Font = new Font("Segoe UI", 10f),
                Location = new Point(20, 16),
                Size = new Size(370, 24),
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(_statusLabel);

            _progressBar = new ProgressBar
            {
                Location = new Point(20, 48),
                Size = new Size(370, 28),
                Minimum = 0,
                Maximum = 100,
                Style = ProgressBarStyle.Continuous,
            };
            Controls.Add(_progressBar);
        }

        public void UpdateProgress(int done, int total)
        {
            _progressBar.Maximum = Math.Max(1, total);
            _progressBar.Value = Math.Min(done, _progressBar.Maximum);
            var pct = total > 0 ? (done * 100 / total) : 0;
            _statusLabel.Text = $"Encrypting… {done:n0} / {total:n0} items ({pct}%)";
        }
    }

    // ═══════════════════════════════════════════════════════════
    //  ChangePassphraseDialog — modal dialog for changing encryption passphrase
    // ═══════════════════════════════════════════════════════════

    private sealed class ChangePassphraseDialog : Form
    {
        public string CurrentPassphrase { get; private set; } = string.Empty;
        public string NewPassphrase { get; private set; } = string.Empty;

        private readonly TextBox _currentBox;
        private readonly TextBox _newBox;
        private readonly TextBox _confirmBox;
        private readonly CheckBox _acknowledgeBox;
        private readonly Label _errorLabel;

        public ChangePassphraseDialog(ThemePalette theme)
        {
            Text = "Change Database Passphrase";
            FormBorderStyle = FormBorderStyle.FixedDialog;
            StartPosition = FormStartPosition.CenterParent;
            MaximizeBox = false;
            MinimizeBox = false;
            ShowInTaskbar = false;
            Size = new Size(440, 420);
            BackColor = theme.PrimaryBg;
            ForeColor = theme.TextPrimary;

            var y = 16;

            var titleLabel = new Label
            {
                Text = "Change Database Passphrase",
                Font = new Font("Segoe UI", 12f, FontStyle.Bold),
                AutoSize = true,
                Location = new Point(20, y),
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(titleLabel);
            y += 32;

            var warningLabel = new Label
            {
                Text = "⚠ After changing, all data will be re-encrypted with the new passphrase.\n" +
                       "If you forget or lose the new passphrase, ALL data is permanently lost.",
                Font = new Font("Segoe UI", 8.5f, FontStyle.Bold),
                ForeColor = theme.Warning,
                Location = new Point(20, y),
                Size = new Size(390, 40),
            };
            Controls.Add(warningLabel);
            y += 46;

            // Current passphrase
            Controls.Add(new Label
            {
                Text = "Current Passphrase:",
                Font = new Font("Segoe UI", 9f),
                AutoSize = true,
                Location = new Point(20, y),
                ForeColor = theme.TextSecondary,
            });
            y += 20;

            _currentBox = new TextBox
            {
                Location = new Point(20, y),
                Size = new Size(385, 28),
                UseSystemPasswordChar = true,
                Font = new Font("Segoe UI", 10f),
                BackColor = theme.SecondaryBg,
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(_currentBox);
            y += 34;

            // New passphrase
            Controls.Add(new Label
            {
                Text = "New Passphrase:",
                Font = new Font("Segoe UI", 9f),
                AutoSize = true,
                Location = new Point(20, y),
                ForeColor = theme.TextSecondary,
            });
            y += 20;

            _newBox = new TextBox
            {
                Location = new Point(20, y),
                Size = new Size(385, 28),
                UseSystemPasswordChar = true,
                Font = new Font("Segoe UI", 10f),
                BackColor = theme.SecondaryBg,
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(_newBox);
            y += 34;

            // Confirm new passphrase
            Controls.Add(new Label
            {
                Text = "Confirm New Passphrase:",
                Font = new Font("Segoe UI", 9f),
                AutoSize = true,
                Location = new Point(20, y),
                ForeColor = theme.TextSecondary,
            });
            y += 20;

            _confirmBox = new TextBox
            {
                Location = new Point(20, y),
                Size = new Size(385, 28),
                UseSystemPasswordChar = true,
                Font = new Font("Segoe UI", 10f),
                BackColor = theme.SecondaryBg,
                ForeColor = theme.TextPrimary,
            };
            Controls.Add(_confirmBox);
            y += 34;

            _acknowledgeBox = new CheckBox
            {
                Text = "I understand that losing the new passphrase means permanent data loss",
                Font = new Font("Segoe UI", 8.5f),
                AutoSize = true,
                Location = new Point(18, y),
                ForeColor = theme.TextSecondary,
            };
            Controls.Add(_acknowledgeBox);
            y += 28;

            _errorLabel = new Label
            {
                Text = "",
                Font = new Font("Segoe UI", 8.5f),
                ForeColor = theme.Danger,
                Location = new Point(20, y),
                Size = new Size(385, 18),
                Visible = false,
            };
            Controls.Add(_errorLabel);
            y += 22;

            var submitBtn = new Button
            {
                Text = "Change Passphrase",
                Size = new Size(140, 32),
                Location = new Point(160, y),
                FlatStyle = FlatStyle.Flat,
                BackColor = ColorTranslator.FromHtml("#eab308"),
                ForeColor = Color.Black,
                Font = new Font("Segoe UI", 9f, FontStyle.Bold),
            };
            submitBtn.FlatAppearance.BorderSize = 0;
            submitBtn.Click += OnSubmit;

            var cancelBtn = new Button
            {
                Text = "Cancel",
                Size = new Size(90, 32),
                Location = new Point(310, y),
                FlatStyle = FlatStyle.Flat,
                BackColor = theme.SecondaryBg,
                ForeColor = theme.TextPrimary,
                Font = new Font("Segoe UI", 9f),
                DialogResult = DialogResult.Cancel,
            };
            cancelBtn.FlatAppearance.BorderColor = theme.Border;
            cancelBtn.FlatAppearance.BorderSize = 1;

            Controls.Add(submitBtn);
            Controls.Add(cancelBtn);

            AcceptButton = submitBtn;
            CancelButton = cancelBtn;
            ActiveControl = _currentBox;
        }

        private void OnSubmit(object? sender, EventArgs e)
        {
            if (string.IsNullOrEmpty(_currentBox.Text))
            {
                ShowError("Current passphrase is required.");
                return;
            }
            if (string.IsNullOrEmpty(_newBox.Text))
            {
                ShowError("New passphrase is required.");
                return;
            }
            if (_newBox.Text.Length < 8)
            {
                ShowError("New passphrase must be at least 8 characters.");
                return;
            }
            if (_newBox.Text != _confirmBox.Text)
            {
                ShowError("New passphrases do not match.");
                return;
            }
            if (_currentBox.Text == _newBox.Text)
            {
                ShowError("New passphrase must be different from current passphrase.");
                return;
            }
            if (!_acknowledgeBox.Checked)
            {
                ShowError("You must acknowledge the data loss warning.");
                return;
            }

            CurrentPassphrase = _currentBox.Text;
            NewPassphrase = _newBox.Text;
            _currentBox.Text = _newBox.Text = _confirmBox.Text = string.Empty;
            DialogResult = DialogResult.OK;
            Close();
        }

        private void ShowError(string msg)
        {
            _errorLabel.Text = msg;
            _errorLabel.Visible = true;
        }

        protected override void Dispose(bool disposing)
        {
            if (disposing)
            {
                CurrentPassphrase = string.Empty;
                NewPassphrase = string.Empty;
            }
            base.Dispose(disposing);
        }
    }
}