feat: upgrade to Room 3 and expand cross-platform encryption support

- Update Android Gradle Plugin to 9.3.0 and Room to 3.0.0, migrating code to `androidx.room3` APIs.
- Implement encryption-capable drivers for iOS (`IosCipherDriver`), JVM (`JdbcSQLiteDriver`), and WasmJS (`NamedWebWorkerSQLiteDriver`) using SQLCipher and SQLite3MultipleCiphers.
- Add `room3.worker.js` with OPFS support to enable persistent, encrypted storage for the Web target.
- Standardize the database filename as `notes.db` across all implementations and migrate the schema to version 2.
- Refactor `SafeRepo` and `DatabaseHolder` to support asynchronous lifecycle management, including encryption, rekeying, and decryption.
- Update build logic and documentation to support dynamic selection between Room and SQLDelight via `CORE_DATA_DB_MODULE`.
- Improve error handling in `SplashViewModel` to better manage database initialization failures.
- Add comprehensive integration tests for Room CRUD operations, paging, and encryption on JVM and WasmJS.

Author: softartdev

AGENTS.md

@@ -8,7 +8,7 @@
 ## Quick Reference
 
 ### Project Structure & Module Organization
-- Core: `core/domain`, `core/presentation`, `core/data/db-sqldelight` (default), `core/data/db-room` (optional), `core/test/common`.
+- Core: `core/domain`, `core/presentation`, selectable `core/data/db-sqldelight` or `core/data/db-room`, `core/test/common`.
 - Features: `feature/backup/{domain,ui}`, `feature/console/{domain,presentation,ui}`, `feature/file-explorer/data`.
 - UI: `core/ui` (common Compose code and resources), `core/test/ui` (multiplatform Compose UI tests), `core/test/jvm` (JVM-specific UI test utilities).
 - Apps: `app/android`, `app/desktop`, `app/web`, `app/ios-kit` (SwiftPM-linked framework), `app/iosApp` (Xcode project).

CONTRIBUTING.md

@@ -460,16 +460,19 @@ open app/iosApp/iosApp.xcodeproj
 Edit `gradle.properties`:
 
 ```properties
-# Use SQLDelight (default)
+# Use SQLDelight
 CORE_DATA_DB_MODULE=:core:data:db-sqldelight
 
 # Or use Room
 CORE_DATA_DB_MODULE=:core:data:db-room
 ```
 
-Then rebuild:
+Only the selected module is included by `settings.gradle.kts`; invalid values fail during
+settings evaluation. Keep exactly one assignment active, then run the full verification workflow:
 ```bash
-./gradlew clean build
+./gradle/build_quick.sh
+./gradlew :app:android:connectedCheck
+./gradlew build
 ```
 
 ## Testing Guidelines

app/android/src/androidTest/java/com/softartdev/notedelight/CryptInstrumentedTest.kt

@@ -4,10 +4,13 @@ import android.text.SpannableStringBuilder
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.filters.MediumTest
 import co.touchlab.kermit.Logger
+import com.softartdev.notedelight.model.Note
 import com.softartdev.notedelight.model.PlatformSQLiteState
 import com.softartdev.notedelight.repository.SafeRepo
 import kotlinx.coroutines.test.runTest
+import kotlinx.datetime.LocalDateTime
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.koin.java.KoinJavaComponent.inject
@@ -31,4 +34,28 @@ class CryptInstrumentedTest {
         safeRepo.decrypt(SpannableStringBuilder(password))
         assertEquals(PlatformSQLiteState.UNENCRYPTED, safeRepo.databaseState)
     }
-}
+
+    @Test
+    fun notePersistsAfterDatabaseReopen() = runTest {
+        safeRepo.buildDbIfNeed()
+        assertEquals("2", safeRepo.execute("PRAGMA user_version"))
+        // SafeRoom must not be combined with a WAL mode that it does not manage.
+        // Otherwise a cold process start can discard the previous process' WAL.
+        assertNotEquals("wal", safeRepo.execute("PRAGMA journal_mode")?.lowercase())
+        safeRepo.noteDAO.insert(
+            Note(
+                id = 0,
+                title = "Persistent note",
+                text = "Must survive closing and reopening the database",
+                dateCreated = LocalDateTime(2026, 7, 21, 4, 27),
+                dateModified = LocalDateTime(2026, 7, 21, 4, 27),
+            )
+        )
+        assertEquals(1L, safeRepo.noteDAO.count())
+
+        safeRepo.closeDatabase()
+        safeRepo.buildDbIfNeed()
+
+        assertEquals(1L, safeRepo.noteDAO.count())
+    }
+}

app/iosApp/KotlinMultiplatformLinkedPackage/subpackages/KotlinMultiplatformLinkedPackageDylib/Package.swift

@@ -13,13 +13,13 @@ let package = Package(
     )
   ],
   dependencies: [
-    .package(path: "../_core_data_db_sqldelight")
+    .package(path: "../_core_data_db_room")
   ],
   targets: [
     .target(
       name: "KotlinMultiplatformLinkedPackageDylib",
       dependencies: [
-        .product(name: "_core_data_db_sqldelight", package: "_core_data_db_sqldelight")
+        .product(name: "_core_data_db_room", package: "_core_data_db_room")
       ]
     )
   ]

app/iosApp/KotlinMultiplatformLinkedPackage/subpackages/_core_data_db_room/Package.swift

@@ -0,0 +1,32 @@
+// swift-tools-version: 5.9
+import PackageDescription
+let package = Package(
+  name: "_core_data_db_room",
+  platforms: [
+    .iOS("14.1")
+  ],
+  products: [
+    .library(
+      name: "_core_data_db_room",
+      type: .none,
+      targets: ["_core_data_db_room"]
+    )
+  ],
+  dependencies: [
+    .package(
+      url: "https://github.com/sqlcipher/SQLCipher.swift.git",
+      exact: "4.16.0"
+    )
+  ],
+  targets: [
+    .target(
+      name: "_core_data_db_room",
+      dependencies: [
+        .product(
+          name: "SQLCipher",
+          package: "SQLCipher.swift"
+        )
+      ]
+    )
+  ]
+)

app/iosApp/KotlinMultiplatformLinkedPackage/subpackages/_core_data_db_room/Sources/_core_data_db_room/_core_data_db_room.m

@@ -125,7 +125,7 @@ build/dist/wasmJs/productionExecutable/
 ├── skiko.wasm                   # Skia graphics engine
 ├── sqlite3.js                   # SQLite JavaScript
 ├── sqlite3.wasm                 # SQLite3MultipleCiphers WASM (with encryption)
-├── sqlite.worker.js             # Custom OPFS worker
+├── <selected ORM worker>        # SQLDelight or bundled Room 3 OPFS worker
 ├── coi-serviceworker.js         # Service worker for headers
 └── sql-wasm.wasm               # Legacy SQL.js (fallback)
 ```
@@ -578,4 +578,3 @@ try {
 - [SQL.js](https://sql.js.org/)
 - [WebAssembly](https://webassembly.org/)
 - [PWA Documentation](https://web.dev/progressive-web-apps/)
-

app/iosApp/KotlinMultiplatformLinkedPackage/subpackages/_core_data_db_room/Sources/_core_data_db_room/include/_core_data_db_room.h

@@ -13,6 +13,8 @@ plugins {
     alias(libs.plugins.download)
 }
 
+val coreDataDbModule = providers.gradleProperty("CORE_DATA_DB_MODULE").get()
+
 kotlin {
     wasmJs {
         outputModuleName.set("composeApp")
@@ -43,8 +45,14 @@ kotlin {
                 implementation(libs.koin.compose)
                 implementation(libs.kermit)
                 implementation(npm("firebase", libs.versions.firebaseWeb.get()))
+                implementation(devNpm("copy-webpack-plugin", "9.1.0"))
             }
             resources.srcDir(layout.buildDirectory.dir("sqlite"))
+            if (coreDataDbModule == ":core:data:db-room") {
+                resources.srcDir(
+                    project(coreDataDbModule).layout.projectDirectory.dir("src/wasmJsMain/resources")
+                )
+            }
         }
         wasmJsTest {
             dependencies {

app/web/README.md

@@ -21,7 +21,7 @@ async function createDatabase() {
     try {
       const rc = capi.sqlite3mc_vfs_create("opfs", 0);
       if (rc === 0) {
-        db = new sqlite3.oo1.DB("file:database.db?vfs=multipleciphers-opfs", "c");
+        db = new sqlite3.oo1.DB("file:notes.db?vfs=multipleciphers-opfs", "c");
         return;
       }
     } catch (error) {
@@ -30,7 +30,7 @@ async function createDatabase() {
 
     // Fallback: try opfs without encryption
     try {
-      db = new sqlite3.oo1.DB("file:database.db?vfs=opfs", "c");
+      db = new sqlite3.oo1.DB("file:notes.db?vfs=opfs", "c");
       return;
     } catch (error) {
       try {